dovenest

dovenest/server/src/db.rs
db.rs
⎇
Raw
1use std::path::Path;
2use std::sync::Arc;
3
4use rusqlite::{Connection, OptionalExtension, params};
5
6const SCHEMA_VERSION: i64 = 2;
7
8#[derive(Debug, Clone)]
9pub struct User {
10 pub id: i64,
11 pub name: String,
12 pub is_admin: bool,
13 /// Disabled users cannot sign in and their sessions are rejected.
14 pub active: bool,
15}
16
17#[derive(Debug, Clone)]
18pub struct RootRow {
19 pub id: i64,
20 /// Path relative to the server root; "." means the whole root.
21 pub path: String,
22 /// "rw" or "ro"
23 pub mode: String,
24}
25
26#[derive(Debug, Clone)]
27pub struct ShareRow {
28 pub id: i64,
29 pub token: String,
30 pub creator_id: i64,
31 /// Path of the shared item relative to the server root.
32 pub target: String,
33 pub is_file: bool,
34 /// "rw" or "ro"
35 pub mode: String,
36 pub created_at: String,
37 pub expires_at: Option<String>,
38}
39
40impl ShareRow {
41 pub fn is_expired(&self) -> bool {
42 match &self.expires_at {
43 Some(e) => chrono::DateTime::parse_from_rfc3339(e)
44 .map(|t| chrono::Utc::now() >= t.with_timezone(&chrono::Utc))
45 .unwrap_or(false),
46 None => false,
47 }
48 }
49}
50
51#[derive(Clone)]
52pub struct Db(Arc<tokio::sync::Mutex<Connection>>);
53
54impl std::fmt::Debug for Db {
55 fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
56 f.debug_struct("Db").finish()
57 }
58}
59
60impl Db {
61 pub async fn open(path: &Path) -> anyhow::Result<Self> {
62 if let Some(parent) = path.parent()
63 && !parent.as_os_str().is_empty()
64 {
65 std::fs::create_dir_all(parent)?;
66 }
67 let conn = Connection::open(path)?;
68 conn.pragma_update(None, "journal_mode", "WAL")?;
69 conn.pragma_update(None, "foreign_keys", "ON")?;
70 conn.pragma_update(None, "busy_timeout", "5000")?;
71 Self::migrate(&conn)?;
72 Ok(Self(Arc::new(tokio::sync::Mutex::new(conn))))
73 }
74
75 /// Open a fresh in-memory database (used by tests — no temp file needed).
76 pub async fn open_in_memory() -> anyhow::Result<Self> {
77 let conn = Connection::open_in_memory()?;
78 conn.pragma_update(None, "foreign_keys", "ON")?;
79 conn.pragma_update(None, "busy_timeout", "5000")?;
80 Self::migrate(&conn)?;
81 Ok(Self(Arc::new(tokio::sync::Mutex::new(conn))))
82 }
83
84 fn migrate(conn: &Connection) -> rusqlite::Result<()> {
85 conn.execute(
86 "CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)",
87 [],
88 )?;
89 let version: i64 = conn
90 .query_row(
91 "SELECT value FROM meta WHERE key = 'schema_version'",
92 [],
93 |r| r.get::<_, String>(0),
94 )
95 .optional()?
96 .and_then(|v| v.parse().ok())
97 .unwrap_or(0);
98
99 if version < 1 {
100 conn.execute_batch(SCHEMA_V1)?;
101 }
102 if version < 2 {
103 // User management (M7): a disabled flag so admins can suspend
104 // accounts without deleting them.
105 conn.execute_batch("ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1")?;
106 }
107 conn.execute(
108 "INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', ?1)",
109 [SCHEMA_VERSION.to_string()],
110 )?;
111 Ok(())
112 }
113
114 // ---------- users ----------
115
116 pub async fn user_count(&self) -> i64 {
117 let c = self.0.lock().await;
118 c.query_row("SELECT COUNT(*) FROM users", [], |r| r.get(0))
119 .unwrap_or(0)
120 }
121
122 /// Create the first admin account with the whole root visible (read-write).
123 /// Only valid while no users exist (enforced by the caller).
124 pub async fn create_admin(&self, name: &str, pass_hash: &str) -> Result<User, rusqlite::Error> {
125 let mut c = self.0.lock().await;
126 let tx = c.transaction()?;
127 tx.execute(
128 "INSERT INTO users (name, pass_hash, is_admin, created_at)
129 VALUES (?1, ?2, 1, ?3)",
130 params![name, pass_hash, now()],
131 )?;
132 let user_id = tx.last_insert_rowid();
133 tx.execute(
134 "INSERT INTO user_roots (user_id, path, mode) VALUES (?1, '.', 'rw')",
135 params![user_id],
136 )?;
137 tx.commit()?;
138 Ok(User {
139 id: user_id,
140 name: name.to_string(),
141 is_admin: true,
142 active: true,
143 })
144 }
145
146 pub async fn verify_password(&self, name: &str, password: &str) -> Option<User> {
147 let c = self.0.lock().await;
148 let row: Option<(i64, String, bool, String, bool)> = c
149 .query_row(
150 "SELECT id, name, is_admin != 0, pass_hash, active != 0 FROM users WHERE name = ?1",
151 [name],
152 |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?)),
153 )
154 .optional()
155 .ok()
156 .flatten();
157 let (id, name, is_admin, hash, active) = row?;
158 if !active {
159 return None;
160 }
161 crate::auth::verify_password(password, &hash).then_some(User {
162 id,
163 name,
164 is_admin,
165 active,
166 })
167 }
168
169 // ---------- sessions ----------
170
171 pub async fn create_session(&self, user_id: i64, token: &str) -> Result<(), rusqlite::Error> {
172 let c = self.0.lock().await;
173 c.execute(
174 "INSERT INTO sessions (token, user_id, created_at, last_seen_at)
175 VALUES (?1, ?2, ?3, ?4)",
176 params![token, user_id, now(), now()],
177 )?;
178 Ok(())
179 }
180
181 pub async fn delete_session(&self, token: &str) -> Result<(), rusqlite::Error> {
182 let c = self.0.lock().await;
183 c.execute("DELETE FROM sessions WHERE token = ?1", [token])?;
184 Ok(())
185 }
186
187 pub async fn session_user(&self, token: &str) -> Option<User> {
188 let c = self.0.lock().await;
189 c.query_row(
190 "SELECT u.id, u.name, u.is_admin != 0, u.active != 0
191 FROM sessions s JOIN users u ON u.id = s.user_id
192 WHERE s.token = ?1 AND u.active = 1",
193 [token],
194 |r| {
195 Ok(User {
196 id: r.get(0)?,
197 name: r.get(1)?,
198 is_admin: r.get(2)?,
199 active: r.get(3)?,
200 })
201 },
202 )
203 .ok()
204 }
205
206 // ---------- roots ----------
207
208 pub async fn user_roots(&self, user_id: i64) -> Vec<RootRow> {
209 let c = self.0.lock().await;
210 let mut out = Vec::new();
211 let Ok(mut stmt) =
212 c.prepare("SELECT id, path, mode FROM user_roots WHERE user_id = ?1 ORDER BY id")
213 else {
214 return out;
215 };
216 if let Ok(rows) = stmt.query_map([user_id], |r| {
217 Ok(RootRow {
218 id: r.get(0)?,
219 path: r.get(1)?,
220 mode: r.get(2)?,
221 })
222 }) {
223 out.extend(rows.flatten());
224 }
225 out
226 }
227
228 // ---------- admin: user management (M7) ----------
229
230 pub async fn all_users(&self) -> Vec<User> {
231 let c = self.0.lock().await;
232 let mut out = Vec::new();
233 let sql = "SELECT id, name, is_admin != 0, active != 0 FROM users ORDER BY id";
234 if let Ok(mut stmt) = c.prepare(sql)
235 && let Ok(rows) = stmt.query_map([], |r| {
236 Ok(User {
237 id: r.get(0)?,
238 name: r.get(1)?,
239 is_admin: r.get(2)?,
240 active: r.get(3)?,
241 })
242 })
243 {
244 out.extend(rows.flatten());
245 }
246 out
247 }
248
249 pub async fn find_user_by_id(&self, id: i64) -> Option<User> {
250 let c = self.0.lock().await;
251 c.query_row(
252 "SELECT id, name, is_admin != 0, active != 0 FROM users WHERE id = ?1",
253 [id],
254 |r| {
255 Ok(User {
256 id: r.get(0)?,
257 name: r.get(1)?,
258 is_admin: r.get(2)?,
259 active: r.get(3)?,
260 })
261 },
262 )
263 .ok()
264 }
265
266 pub async fn find_user_by_name(&self, name: &str) -> Option<User> {
267 let c = self.0.lock().await;
268 c.query_row(
269 "SELECT id, name, is_admin != 0, active != 0 FROM users WHERE name = ?1",
270 [name],
271 |r| {
272 Ok(User {
273 id: r.get(0)?,
274 name: r.get(1)?,
275 is_admin: r.get(2)?,
276 active: r.get(3)?,
277 })
278 },
279 )
280 .ok()
281 }
282
283 pub async fn count_admins(&self) -> i64 {
284 let c = self.0.lock().await;
285 c.query_row(
286 "SELECT COUNT(*) FROM users WHERE is_admin = 1 AND active = 1",
287 [],
288 |r| r.get(0),
289 )
290 .unwrap_or(0)
291 }
292
293 /// Create a user with the given roots (path, mode) pairs.
294 pub async fn create_user(
295 &self,
296 name: &str,
297 pass_hash: &str,
298 is_admin: bool,
299 roots: &[(String, String)],
300 ) -> Result<User, rusqlite::Error> {
301 let mut c = self.0.lock().await;
302 let tx = c.transaction()?;
303 tx.execute(
304 "INSERT INTO users (name, pass_hash, is_admin, active, created_at)
305 VALUES (?1, ?2, ?3, 1, ?4)",
306 params![name, pass_hash, is_admin as i64, now()],
307 )?;
308 let user_id = tx.last_insert_rowid();
309 for (path, mode) in roots {
310 tx.execute(
311 "INSERT INTO user_roots (user_id, path, mode) VALUES (?1, ?2, ?3)",
312 params![user_id, path, mode],
313 )?;
314 }
315 tx.commit()?;
316 Ok(User {
317 id: user_id,
318 name: name.to_string(),
319 is_admin,
320 active: true,
321 })
322 }
323
324 pub async fn update_user_password(
325 &self,
326 id: i64,
327 pass_hash: &str,
328 ) -> Result<(), rusqlite::Error> {
329 let c = self.0.lock().await;
330 c.execute(
331 "UPDATE users SET pass_hash = ?1 WHERE id = ?2",
332 params![pass_hash, id],
333 )?;
334 Ok(())
335 }
336
337 pub async fn set_user_admin(&self, id: i64, is_admin: bool) -> Result<(), rusqlite::Error> {
338 let c = self.0.lock().await;
339 c.execute(
340 "UPDATE users SET is_admin = ?1 WHERE id = ?2",
341 params![is_admin as i64, id],
342 )?;
343 Ok(())
344 }
345
346 pub async fn set_user_active(&self, id: i64, active: bool) -> Result<(), rusqlite::Error> {
347 let c = self.0.lock().await;
348 c.execute(
349 "UPDATE users SET active = ?1 WHERE id = ?2",
350 params![active as i64, id],
351 )?;
352 Ok(())
353 }
354
355 pub async fn delete_user(&self, id: i64) -> bool {
356 let c = self.0.lock().await;
357 c.execute("DELETE FROM users WHERE id = ?1", [id])
358 .ok()
359 .map(|n| n > 0)
360 .unwrap_or(false)
361 }
362
363 /// Replace a user's roots with the given (path, mode) pairs.
364 pub async fn set_user_roots(
365 &self,
366 user_id: i64,
367 roots: &[(String, String)],
368 ) -> Result<(), rusqlite::Error> {
369 let mut c = self.0.lock().await;
370 let tx = c.transaction()?;
371 tx.execute("DELETE FROM user_roots WHERE user_id = ?1", [user_id])?;
372 for (path, mode) in roots {
373 tx.execute(
374 "INSERT INTO user_roots (user_id, path, mode) VALUES (?1, ?2, ?3)",
375 params![user_id, path, mode],
376 )?;
377 }
378 tx.commit()?;
379 Ok(())
380 }
381
382 // ---------- shares ----------
383
384 pub async fn create_share(
385 &self,
386 creator_id: i64,
387 token: &str,
388 target: &str,
389 is_file: bool,
390 mode: &str,
391 expires_at: Option<&str>,
392 ) -> Result<ShareRow, rusqlite::Error> {
393 let c = self.0.lock().await;
394 c.execute(
395 "INSERT INTO shares (token, creator_id, target, is_file, mode, created_at, expires_at)
396 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
397 params![
398 token,
399 creator_id,
400 target,
401 is_file as i64,
402 mode,
403 now(),
404 expires_at
405 ],
406 )?;
407 let id = c.last_insert_rowid();
408 Ok(ShareRow {
409 id,
410 token: token.to_string(),
411 creator_id,
412 target: target.to_string(),
413 is_file,
414 mode: mode.to_string(),
415 created_at: now(),
416 expires_at: expires_at.map(|s| s.to_string()),
417 })
418 }
419
420 pub async fn share_by_token(&self, token: &str) -> Option<ShareRow> {
421 let c = self.0.lock().await;
422 let sql = SHARE_BY_TOKEN.as_str();
423 c.query_row(sql, [token], map_share).ok()
424 }
425
426 pub async fn user_shares(&self, creator_id: i64) -> Vec<ShareRow> {
427 let c = self.0.lock().await;
428 let mut out = Vec::new();
429 let sql = USER_SHARES.as_str();
430 if let Ok(mut stmt) = c.prepare(sql)
431 && let Ok(rows) = stmt.query_map([creator_id], map_share)
432 {
433 out.extend(rows.flatten());
434 }
435 out
436 }
437
438 pub async fn delete_share(&self, id: i64, creator_id: i64) -> bool {
439 let c = self.0.lock().await;
440 c.execute(
441 "DELETE FROM shares WHERE id = ?1 AND creator_id = ?2",
442 params![id, creator_id],
443 )
444 .ok()
445 .map(|n| n > 0)
446 .unwrap_or(false)
447 }
448
449 // ---------- settings ----------
450
451 pub async fn get_setting(&self, key: &str) -> Option<String> {
452 let c = self.0.lock().await;
453 c.query_row("SELECT value FROM settings WHERE key = ?1", [key], |r| {
454 r.get(0)
455 })
456 .ok()
457 }
458
459 pub async fn set_setting(&self, key: &str, value: &str) -> Result<(), rusqlite::Error> {
460 let c = self.0.lock().await;
461 c.execute(
462 "INSERT INTO settings (key, value) VALUES (?1, ?2)
463 ON CONFLICT(key) DO UPDATE SET value = ?2",
464 params![key, value],
465 )?;
466 Ok(())
467 }
468
469 /// Whether users may create writable (read-write) shares. Off by default;
470 /// the admin setting gates it.
471 pub async fn allow_writable_shares(&self) -> bool {
472 self.get_setting("allow_writable_shares").await.as_deref() == Some("1")
473 }
474
475 pub async fn set_allow_writable_shares(&self, v: bool) -> Result<(), rusqlite::Error> {
476 self.set_setting("allow_writable_shares", if v { "1" } else { "0" })
477 .await
478 }
479}
480
481const SHARE_COLS: &str = "id, token, creator_id, target, is_file, mode, created_at, expires_at";
482static SHARE_BY_TOKEN: std::sync::LazyLock<String> =
483 std::sync::LazyLock::new(|| format!("SELECT {SHARE_COLS} FROM shares WHERE token = ?1"));
484static USER_SHARES: std::sync::LazyLock<String> = std::sync::LazyLock::new(|| {
485 format!("SELECT {SHARE_COLS} FROM shares WHERE creator_id = ?1 ORDER BY id DESC")
486});
487
488fn map_share(r: &rusqlite::Row) -> rusqlite::Result<ShareRow> {
489 Ok(ShareRow {
490 id: r.get(0)?,
491 token: r.get(1)?,
492 creator_id: r.get(2)?,
493 target: r.get(3)?,
494 is_file: r.get::<_, i64>(4)? != 0,
495 mode: r.get(5)?,
496 created_at: r.get(6)?,
497 expires_at: r.get(7)?,
498 })
499}
500
501fn now() -> String {
502 chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true)
503}
504
505const SCHEMA_V1: &str = r#"
506CREATE TABLE IF NOT EXISTS users (
507 id INTEGER PRIMARY KEY AUTOINCREMENT,
508 name TEXT NOT NULL UNIQUE COLLATE NOCASE,
509 pass_hash TEXT NOT NULL,
510 is_admin INTEGER NOT NULL DEFAULT 0,
511 created_at TEXT NOT NULL
512);
513
514CREATE TABLE IF NOT EXISTS user_roots (
515 id INTEGER PRIMARY KEY AUTOINCREMENT,
516 user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
517 path TEXT NOT NULL,
518 mode TEXT NOT NULL CHECK (mode IN ('rw','ro')),
519 UNIQUE (user_id, path)
520);
521
522CREATE TABLE IF NOT EXISTS shares (
523 id INTEGER PRIMARY KEY AUTOINCREMENT,
524 token TEXT NOT NULL UNIQUE,
525 creator_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
526 target TEXT NOT NULL,
527 is_file INTEGER NOT NULL,
528 mode TEXT NOT NULL CHECK (mode IN ('rw','ro')),
529 created_at TEXT NOT NULL,
530 expires_at TEXT
531);
532
533CREATE TABLE IF NOT EXISTS sessions (
534 token TEXT PRIMARY KEY,
535 user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
536 created_at TEXT NOT NULL,
537 last_seen_at TEXT NOT NULL
538);
539
540CREATE TABLE IF NOT EXISTS settings (
541 key TEXT PRIMARY KEY,
542 value TEXT NOT NULL
543);
544INSERT OR IGNORE INTO settings (key, value) VALUES ('allow_writable_shares', '0');
545"#;
546
547#[cfg(test)]
548mod tests {
549 use super::*;
550
551 // Most tests use an in-memory DB (the file-based path is still covered
552 // by `v1_db_migrates_to_v2` and the integration harness' `Db::open`).
553 async fn mem() -> Db {
554 Db::open_in_memory().await.unwrap()
555 }
556
557 async fn db_with_admin() -> (Db, User) {
558 let db = mem().await;
559 let hash = crate::auth::hash_password("admin1234").unwrap();
560 let admin = db.create_admin("admin", &hash).await.unwrap();
561 (db, admin)
562 }
563
564 #[tokio::test]
565 async fn fresh_db_state() {
566 let db = mem().await;
567 assert_eq!(db.user_count().await, 0);
568 assert_eq!(db.count_admins().await, 0);
569 assert!(!db.allow_writable_shares().await);
570 assert!(db.find_user_by_name("nobody").await.is_none());
571 assert!(db.find_user_by_id(1).await.is_none());
572 assert!(db.all_users().await.is_empty());
573 }
574
575 #[tokio::test]
576 async fn v1_db_migrates_to_v2() {
577 let dir = tempfile::tempdir().unwrap();
578 let path = dir.path().join("legacy.sqlite");
579 {
580 let conn = rusqlite::Connection::open(&path).unwrap();
581 conn.execute_batch(SCHEMA_V1).unwrap();
582 conn.execute(
583 "INSERT INTO users (name, pass_hash, is_admin, created_at)
584 VALUES ('legacy', 'hash', 1, '2024-01-01T00:00:00Z')",
585 [],
586 )
587 .unwrap();
588 conn.execute(
589 "INSERT INTO user_roots (user_id, path, mode) VALUES (1, 'docs', 'rw')",
590 [],
591 )
592 .unwrap();
593 }
594 let db = Db::open(&path).await.unwrap();
595 assert_eq!(db.user_count().await, 1);
596 let u = db.find_user_by_name("legacy").await.unwrap();
597 assert!(u.active, "v2 migration must default active to true");
598 assert!(u.is_admin);
599 assert_eq!(db.user_roots(u.id).await.len(), 1);
600 // Migrations are idempotent.
601 let db2 = Db::open(&path).await.unwrap();
602 assert_eq!(db2.user_count().await, 1);
603 assert!(db2.find_user_by_name("legacy").await.unwrap().active);
604 }
605
606 #[tokio::test]
607 async fn admin_user_and_passwords() {
608 let (db, admin) = db_with_admin().await;
609 assert!(admin.is_admin);
610 assert!(admin.active);
611 // Root "." rw is assigned by create_admin.
612 let roots = db.user_roots(admin.id).await;
613 assert_eq!(roots.len(), 1);
614 assert_eq!(roots[0].path, ".");
615 assert_eq!(roots[0].mode, "rw");
616
617 assert!(db.verify_password("admin", "admin1234").await.is_some());
618 assert!(db.verify_password("admin", "nope").await.is_none());
619 // Name lookup is case-insensitive (COLLATE NOCASE).
620 assert!(db.verify_password("ADMIN", "admin1234").await.is_some());
621 // Disabled users cannot verify.
622 db.set_user_active(admin.id, false).await.unwrap();
623 assert!(db.verify_password("admin", "admin1234").await.is_none());
624 db.set_user_active(admin.id, true).await.unwrap();
625 assert!(db.verify_password("admin", "admin1234").await.is_some());
626 }
627
628 #[tokio::test]
629 async fn sessions_lifecycle() {
630 let (db, admin) = db_with_admin().await;
631 assert!(db.session_user("ghost-token").await.is_none());
632 db.create_session(admin.id, "tok1").await.unwrap();
633 let u = db.session_user("tok1").await.unwrap();
634 assert_eq!(u.id, admin.id);
635 // Disabling the user invalidates existing sessions.
636 db.set_user_active(admin.id, false).await.unwrap();
637 assert!(db.session_user("tok1").await.is_none());
638 db.set_user_active(admin.id, true).await.unwrap();
639 assert!(db.session_user("tok1").await.is_some());
640 db.delete_session("tok1").await.unwrap();
641 assert!(db.session_user("tok1").await.is_none());
642 }
643
644 #[tokio::test]
645 async fn user_crud_and_roots() {
646 let (db, _admin) = db_with_admin().await;
647 let h = crate::auth::hash_password("bobpass1").unwrap();
648 let bob = db
649 .create_user("bob", &h, false, &[("docs".into(), "rw".into())])
650 .await
651 .unwrap();
652 assert!(!bob.is_admin);
653 assert!(bob.active);
654
655 // Duplicate name (case-insensitive) is rejected.
656 let h2 = crate::auth::hash_password("carolpass1").unwrap();
657 assert!(db.create_user("BOB", &h2, false, &[]).await.is_err());
658 assert!(db.create_user("carol", &h2, false, &[]).await.is_ok());
659
660 // Lookup helpers.
661 assert_eq!(db.find_user_by_name("Bob").await.unwrap().id, bob.id);
662 assert_eq!(db.find_user_by_id(bob.id).await.unwrap().name, "bob");
663 assert!(db.find_user_by_name("dave").await.is_none());
664 assert_eq!(db.all_users().await.len(), 3);
665
666 // Root replacement semantics.
667 let roots = db.user_roots(bob.id).await;
668 assert_eq!(roots.len(), 1);
669 db.set_user_roots(
670 bob.id,
671 &[(".".into(), "ro".into()), ("docs".into(), "rw".into())],
672 )
673 .await
674 .unwrap();
675 let roots = db.user_roots(bob.id).await;
676 assert_eq!(roots.len(), 2);
677 assert!(roots.iter().any(|r| r.path == "." && r.mode == "ro"));
678 db.set_user_roots(bob.id, &[]).await.unwrap();
679 assert!(db.user_roots(bob.id).await.is_empty());
680
681 // Password update.
682 let new_h = crate::auth::hash_password("bobpass2").unwrap();
683 db.update_user_password(bob.id, &new_h).await.unwrap();
684 assert!(db.verify_password("bob", "bobpass1").await.is_none());
685 assert!(db.verify_password("bob", "bobpass2").await.is_some());
686
687 // Admin flag + count (only active admins count).
688 db.set_user_admin(bob.id, true).await.unwrap();
689 assert_eq!(db.count_admins().await, 2);
690 db.set_user_active(bob.id, false).await.unwrap();
691 assert_eq!(db.count_admins().await, 1);
692 db.set_user_admin(bob.id, false).await.unwrap();
693
694 // Deletion.
695 assert!(db.delete_user(bob.id).await);
696 assert!(db.find_user_by_id(bob.id).await.is_none());
697 assert!(!db.delete_user(bob.id).await);
698 assert_eq!(db.user_count().await, 2);
699 }
700
701 fn share_row(expires_at: Option<&str>) -> ShareRow {
702 ShareRow {
703 id: 1,
704 token: "t".into(),
705 creator_id: 1,
706 target: "docs".into(),
707 is_file: false,
708 mode: "ro".into(),
709 created_at: "2024-01-01T00:00:00Z".into(),
710 expires_at: expires_at.map(str::to_string),
711 }
712 }
713
714 #[test]
715 fn share_expiry_logic() {
716 assert!(!share_row(None).is_expired());
717 assert!(!share_row(Some("2999-01-01T00:00:00Z")).is_expired());
718 assert!(share_row(Some("2000-01-01T00:00:00Z")).is_expired());
719 // Unparseable expiry → treated as not expired (fail open for reads).
720 assert!(!share_row(Some("not-a-date")).is_expired());
721 }
722
723 #[tokio::test]
724 async fn shares_crud() {
725 let (db, admin) = db_with_admin().await;
726 let s1 = db
727 .create_share(admin.id, "tok-a", "docs", false, "ro", None)
728 .await
729 .unwrap();
730 let s2 = db
731 .create_share(
732 admin.id,
733 "tok-b",
734 "file.txt",
735 true,
736 "rw",
737 Some("2999-01-01T00:00:00Z"),
738 )
739 .await
740 .unwrap();
741 assert!(s2.id > s1.id);
742
743 let found = db.share_by_token("tok-b").await.unwrap();
744 assert!(found.is_file);
745 assert_eq!(found.mode, "rw");
746 assert!(db.share_by_token("nope").await.is_none());
747
748 // Listed newest-first.
749 let list = db.user_shares(admin.id).await;
750 assert_eq!(list.len(), 2);
751 assert_eq!(list[0].id, s2.id);
752 // Other users see nothing.
753 let h = crate::auth::hash_password("bobpass1").unwrap();
754 let bob = db.create_user("bob", &h, false, &[]).await.unwrap();
755 assert!(db.user_shares(bob.id).await.is_empty());
756
757 // Only the creator can delete.
758 assert!(!db.delete_share(s1.id, bob.id).await);
759 assert!(db.delete_share(s1.id, admin.id).await);
760 assert!(db.share_by_token("tok-a").await.is_none());
761 assert!(!db.delete_share(s1.id, admin.id).await);
762 }
763
764 #[tokio::test]
765 async fn settings_round_trip() {
766 let (db, _admin) = db_with_admin().await;
767 assert!(!db.allow_writable_shares().await);
768 db.set_allow_writable_shares(true).await.unwrap();
769 assert!(db.allow_writable_shares().await);
770 // Upsert semantics.
771 db.set_allow_writable_shares(false).await.unwrap();
772 assert!(!db.allow_writable_shares().await);
773 // Generic get/set.
774 db.set_setting("custom", "v").await.unwrap();
775 assert_eq!(db.get_setting("custom").await.as_deref(), Some("v"));
776 assert_eq!(db.get_setting("missing").await, None);
777 }
778}
779