server: module docs on leaf db modules; glob the audit-file gitignore
- Add //! headers to the 10 previously-undocumented leaf db modules
(email_signups, scheduler_jobs, synckit/{rotation,apps,devices,subscriptions,
keys,log,blobs}).
- .gitignore: ignore audit_*.md / docs/audit_*.md, not just the literal
audit_review.md — dated audit reports (audit_doubledown_*.md) were unignored
and one `git add docs/` from leaking internal findings into the public repo.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
10 files changed,
+38 insertions,
-0 deletions
| 49 |
49 |
|
|
| 50 |
50 |
|
# Private working files — live in _private/, synced via Syncthing
|
| 51 |
51 |
|
todo.md
|
|
52 |
+ |
# Glob, not the literal name: audit reports drifted to dated files
|
|
53 |
+ |
# (audit_doubledown_2026-07-01.md, etc.) that a literal `audit_review.md` rule
|
|
54 |
+ |
# left unignored — one `git add docs/` from leaking internal findings into the
|
|
55 |
+ |
# public repo (audit Run 17).
|
| 52 |
56 |
|
audit_review.md
|
|
57 |
+ |
audit_*.md
|
|
58 |
+ |
docs/audit_*.md
|
| 53 |
59 |
|
|
| 54 |
60 |
|
# sandod local state (regenerable)
|
| 55 |
61 |
|
sando/daemon/sando.db
|
|
1 |
+ |
//! Email signup capture (launch waitlist / newsletter): insert a signup with
|
|
2 |
+ |
//! its `source`, and read the full list + count for the admin view.
|
|
3 |
+ |
|
| 1 |
4 |
|
use sqlx::PgPool;
|
| 2 |
5 |
|
use uuid::Uuid;
|
| 3 |
6 |
|
|
|
1 |
+ |
//! Scheduler job-run ledger: record each background job tick (name +
|
|
2 |
+ |
//! rows_affected + timestamp) and read the recent runs for the admin/health view.
|
|
3 |
+ |
|
| 1 |
4 |
|
use chrono::{DateTime, Utc};
|
| 2 |
5 |
|
use sqlx::{FromRow, PgPool};
|
| 3 |
6 |
|
|
|
1 |
+ |
//! SyncKit developer apps: create/lookup a registered app, hash its API key
|
|
2 |
+ |
//! (SHA-256; the raw key is never stored), and resolve an app by key or id.
|
|
3 |
+ |
|
| 1 |
4 |
|
use sqlx::PgPool;
|
| 2 |
5 |
|
|
| 3 |
6 |
|
use crate::db::models::*;
|
|
1 |
+ |
//! SyncKit binary blobs: resolve a blob by content hash, confirm an uploaded
|
|
2 |
+ |
//! blob (internal vs developer paths) once its S3 object lands, and delete a
|
|
3 |
+ |
//! blob. Content-addressed, so a repeat hash dedups rather than re-storing.
|
|
4 |
+ |
|
| 1 |
5 |
|
use sqlx::PgPool;
|
| 2 |
6 |
|
|
| 3 |
7 |
|
use crate::db::models::*;
|
|
1 |
+ |
//! SyncKit per-user devices: upsert a paired device, list a user's devices,
|
|
2 |
+ |
//! verify ownership, advance its sync cursor (with a last-seen touch), and
|
|
3 |
+ |
//! delete it.
|
|
4 |
+ |
|
| 1 |
5 |
|
use sqlx::PgPool;
|
| 2 |
6 |
|
|
| 3 |
7 |
|
use crate::db::enums::SyncPlatform;
|
|
1 |
+ |
//! SyncKit per-key state: upsert/read a sync key, batch app usage stats, and
|
|
2 |
+ |
//! prune the sync change-log past a retention horizon.
|
|
3 |
+ |
|
| 1 |
4 |
|
use sqlx::PgPool;
|
| 2 |
5 |
|
|
| 3 |
6 |
|
use crate::db::{SyncAppId, UserId};
|
|
1 |
+ |
//! SyncKit change log: the push/pull sync protocol core — append a device's
|
|
2 |
+ |
//! changes and pull the changes since a cursor (optionally filtered), the basis
|
|
3 |
+ |
//! of the multi-device convergence protocol.
|
|
4 |
+ |
|
| 1 |
5 |
|
use serde_json::Value as JsonValue;
|
| 2 |
6 |
|
use sqlx::PgPool;
|
| 3 |
7 |
|
|
|
1 |
+ |
//! SyncKit end-to-end key rotation state machine: begin a rotation, stream the
|
|
2 |
+ |
//! re-encrypted entries in batches, and atomically complete it. `begin` and
|
|
3 |
+ |
//! `complete` guard against concurrent rotations for the same key.
|
|
4 |
+ |
|
| 1 |
5 |
|
use serde_json::Value as JsonValue;
|
| 2 |
6 |
|
use sqlx::PgPool;
|
| 3 |
7 |
|
|
|
1 |
+ |
//! SyncKit end-user app subscriptions (the per-user subs billed on MNW's own
|
|
2 |
+ |
//! Stripe account, distinct from developer billing): create/read a user's app
|
|
3 |
+ |
//! subscription and gate internal writes on an active subscription.
|
|
4 |
+ |
|
| 1 |
5 |
|
use chrono::{DateTime, Utc};
|
| 2 |
6 |
|
use sqlx::PgPool;
|
| 3 |
7 |
|
|