main
tag: launch-2026-06-01
tag: magicmirror-v0.1.1
tag: magicmirror-v0.3.0
tag: mnw-cli-v0.1.2
tag: mnw-cli-v0.1.3
tag: mnw-cli-v0.1.4
tag: pom-v0.4.1
tag: pom-v0.4.2
tag: pom-v0.4.3
tag: pom-v0.4.4
tag: pom-v0.4.5
tag: wam-v0.3.0
tag: wam-v0.3.1
Files
Commits
Tags
Notes
Issues
Correct stale comments across server, tests and mnw-admin
Roughly 100 files of comment, doc and CHANGELOG-adjacent edits: stale
doc comments corrected in routes, db, scanning, email, git and the
scheduler; dead explanatory blocks removed from the test workflows;
one tautological test dropped. Two unused deps (utoipa-axum,
async-stripe-payment) removed from server/Cargo.toml, proven by
cargo check --all-targets. mnw-cli gains its LICENSE file.
106 files changed,
+758 insertions,
-560 deletions
644
644
"tracing",
645
645
]
646
646
647
-
[[package]]
648
-
name = "async-stripe-payment"
649
-
version = "1.0.0-rc.6"
650
-
source = "registry+https://github.com/rust-lang/crates.io-index"
651
-
checksum = "9063ec5de6b3c6ea14141911fd55eb2e54051acc9c0223b4ce7f938295f587fb"
652
-
dependencies = [
653
-
"async-stripe-client-core",
654
-
"async-stripe-shared",
655
-
"async-stripe-types",
656
-
"miniserde",
657
-
"serde",
658
-
"serde_json",
659
-
"smol_str",
660
-
"tracing",
661
-
]
662
-
663
647
[[package]]
664
648
name = "async-stripe-product"
665
649
version = "1.0.0-rc.6"
5288
5272
"async-stripe-checkout",
5289
5273
"async-stripe-connect",
5290
5274
"async-stripe-core",
5291
-
"async-stripe-payment",
5292
5275
"async-stripe-product",
5293
5276
"async-stripe-shared",
5294
5277
"async-stripe-types",
5371
5354
"url",
5372
5355
"urlencoding",
5373
5356
"utoipa",
5374
-
"utoipa-axum",
5375
5357
"utoipa-swagger-ui",
5376
5358
"uuid",
5377
5359
"webauthn-authenticator-rs",
6006
5988
"subtle",
6007
5989
]
6008
5990
6009
-
[[package]]
6010
-
name = "paste"
6011
-
version = "1.0.15"
6012
-
source = "registry+https://github.com/rust-lang/crates.io-index"
6013
-
checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
6014
-
6015
5991
[[package]]
6016
5992
name = "pastey"
6017
5993
version = "0.1.1"
9369
9345
"utoipa-gen",
9370
9346
]
9371
9347
9372
-
[[package]]
9373
-
name = "utoipa-axum"
9374
-
version = "0.2.0"
9375
-
source = "registry+https://github.com/rust-lang/crates.io-index"
9376
-
checksum = "7c25bae5bccc842449ec0c5ddc5cbb6a3a1eaeac4503895dc105a1138f8234a0"
9377
-
dependencies = [
9378
-
"axum",
9379
-
"paste",
9380
-
"tower-layer",
9381
-
"tower-service",
9382
-
"utoipa",
9383
-
]
9384
-
9385
9348
[[package]]
9386
9349
name = "utoipa-gen"
9387
9350
version = "5.5.0"
10768
10731
"pkg-config",
10769
10732
]
10770
10733
10771
-
[[patch.unused]]
10772
-
name = "kberg"
10773
-
version = "0.1.0"
10774
-
10775
-
[[patch.unused]]
10776
-
name = "ops-status"
10777
-
version = "0.1.0"
10778
-
10779
-
[[patch.unused]]
10780
-
name = "painhours"
10781
-
version = "0.1.0"
10782
-
10783
10734
[[patch.unused]]
10784
10735
name = "makeover-immediate"
10785
10736
version = "0.30.0"
10796
10747
name = "synckit-config"
10797
10748
version = "0.2.0"
10798
10749
10750
+
[[patch.unused]]
10751
+
name = "kberg"
10752
+
version = "0.1.0"
10753
+
10754
+
[[patch.unused]]
10755
+
name = "ops-status"
10756
+
version = "0.1.0"
10757
+
10758
+
[[patch.unused]]
10759
+
name = "painhours"
10760
+
version = "0.1.0"
10761
+
10799
10762
[[patch.unused]]
10800
10763
name = "quasi-immediate"
10801
10764
version = "0.36.0"
29
29
30
30
# OpenAPI spec generation
31
31
utoipa = { version = "5", features = ["axum_extras", "chrono", "uuid"] }
32
-
utoipa-axum = "0.2"
33
32
utoipa-swagger-ui = { version = "9", features = ["axum"] }
34
33
serde = { version = "1.0.228", features = ["derive"] }
35
34
serde_json = "1.0.149"
201
200
async-stripe-checkout = { version = "1.0.0-rc.6", features = ["deserialize", "checkout_session"] }
202
201
async-stripe-connect = { version = "1.0.0-rc.6", features = ["deserialize", "account", "account_link", "transfer", "transfer_reversal"] }
203
202
async-stripe-core = { version = "1.0.0-rc.6", features = ["deserialize", "balance", "refund", "customer"] }
204
-
async-stripe-payment = { version = "1.0.0-rc.6", features = ["deserialize"] }
205
203
async-stripe-product = { version = "1.0.0-rc.6", features = ["deserialize", "product", "price"] }
206
204
async-stripe-types = { version = "1.0.0-rc.6", features = ["deserialize"] }
207
205
# reqwest 0.13's `rustls` feature is an alias for `__rustls-aws-lc-rs` and there
117
117
| Progress bar | `.progress-bar-container` + `.progress-bar` | `--slim` (6px), `--rounded`, `.progress-bar--highlight` (purple, default green) | — |
118
118
| Upload status block | `.upload-status` + `-row` | `-msg.is-success`, `-msg.is-error` | — |
119
119
| Status pill | `.field-status` / `.save-status` | `.success`, `.error`, `.saving` | — |
120
-
| Table | `.data-table` + `.well` (rich), `.compact-table` (small mono) | `.minw-300..800` for horizontal scroll min-width | `.sortable.ascending`, `.sortable.descending` |
120
+
| Table | `.data-table` + `.well` (rich), `.compact-table` (small mono) | `.minw-300..800` for horizontal scroll min-width | — |
121
121
| Tabs | `.tabs` + `.tab` | — | `.tab.chosen` (makeover's name, not the site's) |
122
122
| Breadcrumb | `.breadcrumb` | — | — |
123
123
| Pagination | `_ui.html` macro `pagination` → `.pagination` | — | `.active` |
3
3
//! When enabled, the entire site is reachable only by logged-in users who hold
4
4
//! a creator account or an active Fan+ subscription; everyone else is bounced
5
5
//! to `/login` with a notice. This backs the testnot.work staging mirror, whose
6
-
//! data is a daily restore of production, gating it to Fan+/creator accounts
7
-
//! keeps that mirror off the open internet (the "available to anyone with a
8
-
//! Fan+ or creator account" rule), matching the testnot Fan+ perk.
6
+
//! catalog is fabricated by the example seed (see `seed/mod.rs`) rather than
7
+
//! restored from production, so it holds no real user data. Gating it to
8
+
//! Fan+/creator accounts keeps the mirror off the open internet (the "available
9
+
//! to anyone with a Fan+ or creator account" rule), matching the testnot Fan+
10
+
//! perk.
9
11
//!
10
12
//! It is a COARSE pre-filter: it reads the cached session flags only (no DB
11
13
//! query, no session-tracking revalidation). The per-route `AuthUser` extractor
57
59
|| hit(path, "/__errors")
58
60
// Operational endpoints: the deploy smoke check and machine callers.
59
61
|| path == "/health"
62
+
// Placeholder: no /metrics route is mounted (Prometheus scraping was
63
+
// retired 2026-07-21, see lib.rs). Kept so a future scrape endpoint is
64
+
// reachable without editing the gate.
60
65
|| path == "/metrics"
61
66
|| hit(path, "/stripe/webhook") // inert on testnot (Stripe stubbed) but never gate a webhook
62
67
|| hit(path, "/postmark") // inbound/webhook callbacks
7
7
//!
8
8
//! Two-factor authentication supports both TOTP (time-based one-time
9
9
//! passwords via `totp-rs`) and WebAuthn passkeys (via `webauthn-rs`).
10
-
//! Account lockout is enforced after repeated failed login attempts, with
11
-
//! progressive delays tracked by `failed_login_attempts` and `locked_until`
12
-
//! on the user row. New-device login notifications are sent via Postmark
10
+
//! Account lockout is enforced after 5 failed login attempts and lasts a flat
11
+
//! 15 minutes, tracked by `failed_login_attempts` and `locked_until` on the
12
+
//! user row. New-device login notifications are sent via Postmark
13
13
//! when enabled.
14
14
//!
15
15
//! Extractors: [`AuthUser`] (required login), [`MaybeUserUnverified`] (optional,
614
614
}
615
615
}
616
616
617
-
/// Hash a password using Argon2id.
617
+
/// Synchronous Argon2id hash.
618
618
///
619
619
/// Production: 46 MiB, 2 iterations (~600ms). With `fast-tests` feature: 8 MiB, 1 iteration (~10ms).
620
620
/// Verification auto-detects params from the hash string, so no feature flag needed there.
621
621
///
622
-
/// Synchronous Argon2id hash. CPU-bound (hundreds of ms); do NOT call from an
622
+
/// CPU-bound (hundreds of ms); do NOT call from an
623
623
/// async handler, use [`hash_password_async`], which runs this on a blocking
624
624
/// thread so a burst of signups can't starve the Tokio worker pool. The sync
625
625
/// form remains `pub` only for one-time `DUMMY_HASH` initializers and
1096
1096
}
1097
1097
}
1098
1098
1099
-
// ---- existing tests (unchanged) ----
1099
+
// ---- tests ----
1100
1100
1101
1101
#[test]
1102
1102
fn socket_addr_combines_host_and_port() {
283
283
pub const SCAN_JOB_RETENTION_DAYS: u32 = 30;
284
284
/// Directory under which the scanner spools large objects to tempfiles
285
285
/// before invoking path/stream-based layer entries. On production, systemd
286
-
/// provisions this via `StateDirectory=mnw/scan-spool` so the path resolves
287
-
/// to `/var/lib/mnw/scan-spool`. Override with `MNW_SCAN_SPOOL_DIR` for dev.
286
+
/// provisions this via `StateDirectory=makenotwork/scan-spool` so the path
287
+
/// resolves to `/var/lib/makenotwork/scan-spool`. Override with
288
+
/// `MNW_SCAN_SPOOL_DIR` for dev.
288
289
pub const SCAN_SPOOL_DIR: &str = "/var/lib/makenotwork/scan-spool";
289
290
/// Files in `SCAN_SPOOL_DIR` older than this are considered orphaned
290
291
/// (a panic, OOM, or hard kill left them behind) and reaped on the
330
331
/// Skip, the same shape as the disabled case, never blocking the file.
331
332
pub const SCAN_EXTERNAL_LOOKUP_TIMEOUT_SECS: u64 = 10;
332
333
333
-
// Caddy on-demand TLS
334
334
// Caps concurrent cache-miss DB lookups in `/api/domains/caddy-ask`. Cache hits
335
335
// are unbounded (DashMap). At capacity, the handler returns 503 so Caddy retries
336
336
// later instead of stampeding the DB pool or driving ACME issuance for garbage