fix in smtp and split rs files

src/api/access_tokens.rs

@@ -0,0 +1,172 @@
+#[derive(Debug, Deserialize)]
+pub struct AccessTokenRequest {
+    kind: String,
+    slug: String,
+    password: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct AccessTokenResponse {
+    access_token: String,
+    expires_at: String,
+}
+
+pub async fn create_resource_access_token(
+    State(state): State<SharedState>,
+    Json(payload): Json<AccessTokenRequest>,
+) -> Result<Json<AccessTokenResponse>, ApiError> {
+    let kind = payload.kind.trim();
+    let slug = payload.slug.trim();
+    match kind {
+        "workspace" => {
+            let workspace = db::find_workspace(&state.db, slug)
+                .await?
+                .ok_or_else(ApiError::not_found_workspace)?;
+            if !db::verify_workspace_password(&workspace, Some(payload.password.as_str())) {
+                return Err(ApiError::unauthorized());
+            }
+        }
+        "pad" => {
+            let pad = db::find_pad(&state.db, slug)
+                .await?
+                .ok_or_else(ApiError::not_found_note)?;
+            if !db::verify_pad_password(&pad, Some(payload.password.as_str())) {
+                return Err(ApiError::unauthorized());
+            }
+        }
+        _ => return Err(ApiError::bad_request("Invalid resource kind")),
+    }
+
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    let token = hex::encode(bytes);
+    let expires_at =
+        (Utc::now() + Duration::days(state.anonymous_access_token_ttl_days)).to_rfc3339();
+    sqlx::query(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_ACCESS_TOKENS_INSERT,
+    ))
+    .bind(hash_access_token(&token))
+    .bind(kind)
+    .bind(slug)
+    .bind(&expires_at)
+    .execute(state.db.pool())
+    .await?;
+    Ok(Json(AccessTokenResponse {
+        access_token: token,
+        expires_at,
+    }))
+}
+
+pub async fn verify_resource_access_token(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    token: Option<&str>,
+) -> Result<bool, ApiError> {
+    let Some(token) = token.map(str::trim).filter(|value| !value.is_empty()) else {
+        return Ok(false);
+    };
+    if crate::auth::resource_permission(state, kind, slug, Some(token))
+        .await
+        .map_err(|error| ApiError::forbidden(&error.message))?
+        .is_some()
+    {
+        return Ok(true);
+    }
+    let count: i64 = sqlx::query_scalar(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_ACCESS_TOKENS_VALID_COUNT,
+    ))
+    .bind(hash_access_token(token))
+    .bind(kind)
+    .bind(slug)
+    .bind(Utc::now().to_rfc3339())
+    .fetch_one(state.db.pool())
+    .await?;
+    Ok(count > 0)
+}
+
+fn hash_access_token(token: &str) -> String {
+    hex::encode(Sha256::digest(token.as_bytes()))
+}
+
+pub struct ApiError {
+    status: StatusCode,
+    message: String,
+}
+
+impl ApiError {
+    fn bad_request(message: &str) -> Self {
+        Self {
+            status: StatusCode::BAD_REQUEST,
+            message: message.into(),
+        }
+    }
+    fn payload_too_large(max_bytes: usize) -> Self {
+        let max_mb = max_bytes / (1024 * 1024);
+        Self {
+            status: StatusCode::PAYLOAD_TOO_LARGE,
+            message: format!("The file may be at most {max_mb} MB"),
+        }
+    }
+    fn not_found_file() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "File not found".into(),
+        }
+    }
+    fn unauthorized() -> Self {
+        Self {
+            status: StatusCode::UNAUTHORIZED,
+            message: "Invalid password".into(),
+        }
+    }
+    fn forbidden(message: &str) -> Self {
+        Self {
+            status: StatusCode::FORBIDDEN,
+            message: message.into(),
+        }
+    }
+    fn not_found_workspace() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Workspace not found".into(),
+        }
+    }
+    fn not_found_note() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Note not found".into(),
+        }
+    }
+    fn not_found_revision() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Revision not found".into(),
+        }
+    }
+    fn internal(message: &str) -> Self {
+        Self {
+            status: StatusCode::INTERNAL_SERVER_ERROR,
+            message: message.into(),
+        }
+    }
+}
+
+impl From<sqlx::Error> for ApiError {
+    fn from(error: sqlx::Error) -> Self {
+        tracing::error!(%error, "database error");
+        Self::internal("Database error")
+    }
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        (
+            self.status,
+            Json(serde_json::json!({"error": self.message})),
+        )
+            .into_response()
+    }
+}