refactor: 删除部分多余的代码和注释

src/auth/middleware.rs

@@ -8,20 +8,16 @@ use axum::{
 use axum_extra::extract::CookieJar;
 use std::sync::Arc;
 
-use crate::error::ErrorResponse;
 use crate::state::AppState;
+use crate::web::ErrorResponse;
 
-/// Session cookie name
 pub const SESSION_COOKIE: &str = "one_kvm_session";
 
-/// Extract session ID from request
 pub fn extract_session_id(cookies: &CookieJar, headers: &axum::http::HeaderMap) -> Option<String> {
-    // First try cookie
     if let Some(cookie) = cookies.get(SESSION_COOKIE) {
         return Some(cookie.value().to_string());
     }
 
-    // Then try Authorization header (Bearer token)
     if let Some(auth_header) = headers.get(axum::http::header::AUTHORIZATION) {
         if let Ok(auth_str) = auth_header.to_str() {
             if let Some(token) = auth_str.strip_prefix("Bearer ") {
@@ -33,7 +29,6 @@ pub fn extract_session_id(cookies: &CookieJar, headers: &axum::http::HeaderMap)
     None
 }
 
-/// Authentication middleware
 pub async fn auth_middleware(
     State(state): State<Arc<AppState>>,
     cookies: CookieJar,
@@ -41,29 +36,23 @@ pub async fn auth_middleware(
     next: Next,
 ) -> Result<Response, StatusCode> {
     let raw_path = request.uri().path();
-    // When this middleware is mounted under /api, Axum strips the prefix for the inner router.
-    // Normalize the path so checks work whether it is mounted or not.
+    // Mounted under /api: inner path may lack prefix; normalize for whitelist checks.
     let path = raw_path.strip_prefix("/api").unwrap_or(raw_path);
 
-    // Check if system is initialized
     if !state.config.is_initialized() {
-        // Allow only setup-related endpoints when not initialized
         if is_setup_public_endpoint(path) {
             return Ok(next.run(request).await);
         }
     }
 
-    // Public endpoints that don't require auth
     if is_public_endpoint(path) {
         return Ok(next.run(request).await);
     }
 
-    // Extract session ID
     let session_id = extract_session_id(&cookies, request.headers());
 
     if let Some(session_id) = session_id {
         if let Ok(Some(session)) = state.sessions.get(&session_id).await {
-            // Add session to request extensions
             request.extensions_mut().insert(session);
             return Ok(next.run(request).await);
         }
@@ -87,9 +76,7 @@ fn unauthorized_response(message: &str) -> Response {
     (StatusCode::UNAUTHORIZED, Json(body)).into_response()
 }
 
-/// Check if endpoint is public (no auth required)
 fn is_public_endpoint(path: &str) -> bool {
-    // Note: paths here are relative to /api since middleware is applied within the nested router
     matches!(
         path,
         "/" | "/auth/login" | "/health" | "/setup" | "/setup/init"
@@ -102,7 +89,6 @@ fn is_public_endpoint(path: &str) -> bool {
         || path.ends_with(".svg")
 }
 
-/// Setup-only endpoints allowed before initialization.
 fn is_setup_public_endpoint(path: &str) -> bool {
     matches!(
         path,

src/auth/mod.rs

@@ -1,6 +1,5 @@
 pub mod middleware;
 mod password;
-mod rfc3339;
 mod session;
 mod user;
 

src/auth/password.rs

@@ -5,7 +5,6 @@ use argon2::{
 
 use crate::error::{AppError, Result};
 
-/// Hash a password using Argon2
 pub fn hash_password(password: &str) -> Result<String> {
     let salt = SaltString::generate(&mut OsRng);
     let argon2 = Argon2::default();
@@ -16,7 +15,6 @@ pub fn hash_password(password: &str) -> Result<String> {
         .map_err(|e| AppError::Internal(format!("Password hashing failed: {}", e)))
 }
 
-/// Verify a password against a hash
 pub fn verify_password(password: &str, hash: &str) -> Result<bool> {
     let parsed_hash = PasswordHash::new(hash)
         .map_err(|e| AppError::Internal(format!("Invalid password hash: {}", e)))?;

src/auth/rfc3339.rs

@@ -1,13 +0,0 @@
-//! RFC3339 strings in SQLite; structs use `time::serde::rfc3339`.
-
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-/// Parse DB text; bad input → `now_utc()`.
-pub fn parse(s: &str) -> OffsetDateTime {
-    OffsetDateTime::parse(s, &Rfc3339).unwrap_or_else(|_| OffsetDateTime::now_utc())
-}
-
-pub fn format(dt: OffsetDateTime) -> String {
-    dt.format(&Rfc3339).expect("RFC3339 format")
-}

src/auth/session.rs

@@ -1,12 +1,12 @@
 use serde::{Deserialize, Serialize};
-use sqlx::{Pool, Sqlite};
+use std::collections::HashMap;
+use std::sync::Arc;
 use time::{Duration, OffsetDateTime};
+use tokio::sync::RwLock;
 use uuid::Uuid;
 
-use super::rfc3339;
 use crate::error::Result;
 
-/// Session data
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Session {
     pub id: String,
@@ -19,29 +19,25 @@ pub struct Session {
 }
 
 impl Session {
-    /// Check if session is expired
     pub fn is_expired(&self) -> bool {
         OffsetDateTime::now_utc() > self.expires_at
     }
 }
 
-/// Session store backed by SQLite
 #[derive(Clone)]
 pub struct SessionStore {
-    pool: Pool<Sqlite>,
+    inner: Arc<RwLock<HashMap<String, Session>>>,
     default_ttl: Duration,
 }
 
 impl SessionStore {
-    /// Create a new session store
-    pub fn new(pool: Pool<Sqlite>, ttl_secs: i64) -> Self {
+    pub fn new(ttl_secs: i64) -> Self {
         Self {
-            pool,
+            inner: Arc::new(RwLock::new(HashMap::new())),
             default_ttl: Duration::seconds(ttl_secs),
         }
     }
 
-    /// Create a new session
     pub async fn create(&self, user_id: &str) -> Result<Session> {
         let now = OffsetDateTime::now_utc();
         let session = Session {
@@ -52,105 +48,57 @@ impl SessionStore {
             data: None,
         };
 
-        sqlx::query(
-            r#"
-            INSERT INTO sessions (id, user_id, created_at, expires_at, data)
-            VALUES (?1, ?2, ?3, ?4, ?5)
-            "#,
-        )
-        .bind(&session.id)
-        .bind(&session.user_id)
-        .bind(rfc3339::format(session.created_at))
-        .bind(rfc3339::format(session.expires_at))
-        .bind(session.data.as_ref().map(|d| d.to_string()))
-        .execute(&self.pool)
-        .await?;
-
+        let mut guard = self.inner.write().await;
+        guard.insert(session.id.clone(), session.clone());
         Ok(session)
     }
 
-    /// Get a session by ID
     pub async fn get(&self, session_id: &str) -> Result<Option<Session>> {
-        let row: Option<(String, String, String, String, Option<String>)> = sqlx::query_as(
-            "SELECT id, user_id, created_at, expires_at, data FROM sessions WHERE id = ?1",
-        )
-        .bind(session_id)
-        .fetch_optional(&self.pool)
-        .await?;
-
-        match row {
-            Some((id, user_id, created_at, expires_at, data)) => {
-                let session = Session {
-                    id,
-                    user_id,
-                    created_at: rfc3339::parse(&created_at),
-                    expires_at: rfc3339::parse(&expires_at),
-                    data: data.and_then(|d| serde_json::from_str(&d).ok()),
-                };
-
-                if session.is_expired() {
-                    self.delete(&session.id).await?;
-                    Ok(None)
-                } else {
-                    Ok(Some(session))
-                }
-            }
-            None => Ok(None),
+        let mut guard = self.inner.write().await;
+        let Some(session) = guard.get(session_id).cloned() else {
+            return Ok(None);
+        };
+        if session.is_expired() {
+            guard.remove(session_id);
+            return Ok(None);
         }
+        Ok(Some(session))
     }
 
-    /// Delete a session
     pub async fn delete(&self, session_id: &str) -> Result<()> {
-        sqlx::query("DELETE FROM sessions WHERE id = ?1")
-            .bind(session_id)
-            .execute(&self.pool)
-            .await?;
+        let mut guard = self.inner.write().await;
+        guard.remove(session_id);
         Ok(())
     }
 
-    /// Delete all expired sessions
     pub async fn cleanup_expired(&self) -> Result<u64> {
-        let now = rfc3339::format(OffsetDateTime::now_utc());
-        let result = sqlx::query("DELETE FROM sessions WHERE expires_at < ?1")
-            .bind(now)
-            .execute(&self.pool)
-            .await?;
-        Ok(result.rows_affected())
+        let mut guard = self.inner.write().await;
+        let before = guard.len();
+        guard.retain(|_, s| !s.is_expired());
+        Ok((before - guard.len()) as u64)
     }
 
-    /// Delete all sessions
     pub async fn delete_all(&self) -> Result<u64> {
-        let result = sqlx::query("DELETE FROM sessions")
-            .execute(&self.pool)
-            .await?;
-        Ok(result.rows_affected())
+        let mut guard = self.inner.write().await;
+        let n = guard.len() as u64;
+        guard.clear();
+        Ok(n)
     }
 
-    /// Delete all sessions for a specific user
-    pub async fn delete_by_user_id(&self, user_id: &str) -> Result<u64> {
-        let result = sqlx::query("DELETE FROM sessions WHERE user_id = ?1")
-            .bind(user_id)
-            .execute(&self.pool)
-            .await?;
-        Ok(result.rows_affected())
-    }
-
-    /// List all session IDs
     pub async fn list_ids(&self) -> Result<Vec<String>> {
-        let rows: Vec<(String,)> = sqlx::query_as("SELECT id FROM sessions")
-            .fetch_all(&self.pool)
-            .await?;
-        Ok(rows.into_iter().map(|(id,)| id).collect())
+        let guard = self.inner.read().await;
+        Ok(guard.keys().cloned().collect())
     }
 
-    /// Extend session expiration
     pub async fn extend(&self, session_id: &str) -> Result<()> {
-        let new_expires = OffsetDateTime::now_utc() + self.default_ttl;
-        sqlx::query("UPDATE sessions SET expires_at = ?1 WHERE id = ?2")
-            .bind(rfc3339::format(new_expires))
-            .bind(session_id)
-            .execute(&self.pool)
-            .await?;
+        let mut guard = self.inner.write().await;
+        if let Some(session) = guard.get_mut(session_id) {
+            if session.is_expired() {
+                guard.remove(session_id);
+            } else {
+                session.expires_at = OffsetDateTime::now_utc() + self.default_ttl;
+            }
+        }
         Ok(())
     }
 }

src/auth/user.rs

@@ -1,122 +1,99 @@
 use serde::{Deserialize, Serialize};
 use sqlx::{Pool, Sqlite};
+use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
 use uuid::Uuid;
 
 use super::password::{hash_password, verify_password};
-use super::rfc3339;
 use crate::error::{AppError, Result};
 
-/// User row type from database
-type UserRow = (String, String, String, String, String);
+type UserRow = (String, String, String);
 
-/// User data
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct User {
     pub id: String,
     pub username: String,
     #[serde(skip_serializing)]
     pub password_hash: String,
-    #[serde(with = "time::serde::rfc3339")]
-    pub created_at: OffsetDateTime,
-    #[serde(with = "time::serde::rfc3339")]
-    pub updated_at: OffsetDateTime,
 }
 
 impl User {
-    /// Convert from database row to User
     fn from_row(row: UserRow) -> Self {
-        let (id, username, password_hash, created_at, updated_at) = row;
+        let (id, username, password_hash) = row;
         Self {
             id,
             username,
             password_hash,
-            created_at: rfc3339::parse(&created_at),
-            updated_at: rfc3339::parse(&updated_at),
         }
     }
 }
 
-/// User store backed by SQLite
 #[derive(Clone)]
 pub struct UserStore {
     pool: Pool<Sqlite>,
 }
 
 impl UserStore {
-    /// Create a new user store
     pub fn new(pool: Pool<Sqlite>) -> Self {
         Self { pool }
     }
 
-    /// Create a new user
-    pub async fn create(&self, username: &str, password: &str) -> Result<User> {
-        // Check if username already exists
-        if self.get_by_username(username).await?.is_some() {
-            return Err(AppError::BadRequest(format!(
-                "Username '{}' already exists",
-                username
-            )));
+    /// The single local user, or `None` if none exists. Errors if more than one row is present.
+    pub async fn single_user(&self) -> Result<Option<User>> {
+        let mut rows: Vec<UserRow> = sqlx::query_as(
+            "SELECT id, username, password_hash FROM users ORDER BY rowid ASC LIMIT 2",
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        match rows.len() {
+            0 => Ok(None),
+            1 => Ok(Some(User::from_row(rows.remove(0)))),
+            _ => Err(AppError::Internal(
+                "Multiple user accounts in database; this build supports only one".to_string(),
+            )),
+        }
+    }
+
+    pub async fn create_first_user(&self, username: &str, password: &str) -> Result<User> {
+        if self.single_user().await?.is_some() {
+            return Err(AppError::BadRequest(
+                "A user account already exists".to_string(),
+            ));
         }
 
         let password_hash = hash_password(password)?;
-        let now = OffsetDateTime::now_utc();
         let user = User {
             id: Uuid::new_v4().to_string(),
             username: username.to_string(),
             password_hash,
-            created_at: now,
-            updated_at: now,
         };
 
         sqlx::query(
             r#"
-            INSERT INTO users (id, username, password_hash, created_at, updated_at)
-            VALUES (?1, ?2, ?3, ?4, ?5)
+            INSERT INTO users (id, username, password_hash)
+            VALUES (?1, ?2, ?3)
             "#,
         )
         .bind(&user.id)
         .bind(&user.username)
         .bind(&user.password_hash)
-        .bind(rfc3339::format(user.created_at))
-        .bind(rfc3339::format(user.updated_at))
         .execute(&self.pool)
         .await?;
 
         Ok(user)
     }
 
-    /// Get user by ID
-    pub async fn get(&self, user_id: &str) -> Result<Option<User>> {
-        let row: Option<UserRow> = sqlx::query_as(
-            "SELECT id, username, password_hash, created_at, updated_at FROM users WHERE id = ?1",
-        )
-        .bind(user_id)
-        .fetch_optional(&self.pool)
-        .await?;
-
-        Ok(row.map(User::from_row))
-    }
-
-    /// Get user by username
-    pub async fn get_by_username(&self, username: &str) -> Result<Option<User>> {
-        let row: Option<UserRow> = sqlx::query_as(
-            "SELECT id, username, password_hash, created_at, updated_at FROM users WHERE username = ?1",
-        )
-        .bind(username)
-        .fetch_optional(&self.pool)
-        .await?;
-
-        Ok(row.map(User::from_row))
-    }
-
-    /// Verify user credentials
     pub async fn verify(&self, username: &str, password: &str) -> Result<Option<User>> {
-        let user = match self.get_by_username(username).await? {
-            Some(user) => user,
+        let user = match self.single_user().await? {
+            Some(u) => u,
             None => return Ok(None),
         };
 
+        if user.username != username {
+            return Ok(None);
+        }
+
         if verify_password(password, &user.password_hash)? {
             Ok(Some(user))
         } else {
@@ -124,15 +101,23 @@ impl UserStore {
         }
     }
 
-    /// Update user password
     pub async fn update_password(&self, user_id: &str, new_password: &str) -> Result<()> {
+        let user = self
+            .single_user()
+            .await?
+            .ok_or_else(|| AppError::NotFound("User not found".to_string()))?;
+
+        if user.id != user_id {
+            return Err(AppError::AuthError("Invalid session".to_string()));
+        }
+
         let password_hash = hash_password(new_password)?;
         let now = OffsetDateTime::now_utc();
 
         let result =
             sqlx::query("UPDATE users SET password_hash = ?1, updated_at = ?2 WHERE id = ?3")
                 .bind(&password_hash)
-                .bind(rfc3339::format(now))
+                .bind(now.format(&Rfc3339).expect("RFC3339 format"))
                 .bind(user_id)
                 .execute(&self.pool)
                 .await?;
@@ -144,21 +129,24 @@ impl UserStore {
         Ok(())
     }
 
-    /// Update username
     pub async fn update_username(&self, user_id: &str, new_username: &str) -> Result<()> {
-        if let Some(existing) = self.get_by_username(new_username).await? {
-            if existing.id != user_id {
-                return Err(AppError::BadRequest(format!(
-                    "Username '{}' already exists",
-                    new_username
-                )));
-            }
+        let user = self
+            .single_user()
+            .await?
+            .ok_or_else(|| AppError::NotFound("User not found".to_string()))?;
+
+        if user.id != user_id {
+            return Err(AppError::AuthError("Invalid session".to_string()));
+        }
+
+        if new_username == user.username {
+            return Ok(());
         }
 
         let now = OffsetDateTime::now_utc();
         let result = sqlx::query("UPDATE users SET username = ?1, updated_at = ?2 WHERE id = ?3")
             .bind(new_username)
-            .bind(rfc3339::format(now))
+            .bind(now.format(&Rfc3339).expect("RFC3339 format"))
             .bind(user_id)
             .execute(&self.pool)
             .await?;
@@ -169,37 +157,4 @@ impl UserStore {
 
         Ok(())
     }
-
-    /// List all users
-    pub async fn list(&self) -> Result<Vec<User>> {
-        let rows: Vec<UserRow> = sqlx::query_as(
-            "SELECT id, username, password_hash, created_at, updated_at FROM users ORDER BY created_at",
-        )
-        .fetch_all(&self.pool)
-        .await?;
-
-        Ok(rows.into_iter().map(User::from_row).collect())
-    }
-
-    /// Delete user by ID
-    pub async fn delete(&self, user_id: &str) -> Result<()> {
-        let result = sqlx::query("DELETE FROM users WHERE id = ?1")
-            .bind(user_id)
-            .execute(&self.pool)
-            .await?;
-
-        if result.rows_affected() == 0 {
-            return Err(AppError::NotFound("User not found".to_string()));
-        }
-
-        Ok(())
-    }
-
-    /// Check if any users exist
-    pub async fn has_users(&self) -> Result<bool> {
-        let count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
-            .fetch_one(&self.pool)
-            .await?;
-        Ok(count.0 > 0)
-    }
 }