additional lints

Cargo.toml

···
 [package]
 name = "bluepds"
 version = "0.0.0"
-edition = "2021"
+edition = "2024"
 publish = false
+authors = ["Justin Moore", "Timothy Quilling <[e-mail]>"]
+description = "Alternative ATProto PDS implementation"
+license = ""
+readme = "README.md"
+repository = "https://github.com/DrChat/bluepds"
+keywords = ["atproto", "pds"]
+categories = []
+
+[profile.dev.package."*"]
+opt-level = 3
+
+[profile.dev]
+opt-level = 1
+
+[profile.release]
+opt-level = "s" # Slightly slows compile times, great improvements to file size and runtime performance.
+lto = "thin" # Do a second optimization pass over the entire program, including dependencies.
+codegen-units = 1 # Compile the entire crate as one unit.
+strip = "debuginfo" # Strip all debugging information from the binary to slightly reduce file size.
+
+[lints.rust]
+## Groups
+# warnings = { level = "warn", priority = -1 } # All lints that are set to issue warnings
+# deprecated-safe = { level = "warn", priority = -1 } # Lints for functions which were erroneously marked as safe in the past
+# future-incompatible = { level = "warn", priority = -1 } # Lints that detect code that has future-compatibility problems
+# keyword-idents = { level = "warn", priority = -1 } # Lints that detect identifiers which will be come keywords in later editions
+# let-underscore = { level = "warn", priority = -1 } # Lints that detect wildcard let bindings that are likely to be invalid
+# nonstandard-style = { level = "warn", priority = -1 } # Violation of standard naming conventions
+# refining-impl-trait = { level = "warn", priority = -1 } # Detects refinement of impl Trait return types by trait implementations
+# rust-2018-compatibility = { level = "warn", priority = -1 } # Lints used to transition code from the 2015 edition to 2018
+# rust-2021-compatibility = { level = "warn", priority = -1 } # Lints used to transition code from the 2018 edition to 2021
+# rust-2018-idioms = { level = "warn", priority = -1 } # Lints to nudge you toward idiomatic features of Rust 2018
+# rust-2024-compatibility = { level = "warn", priority = -1 } # Lints used to transition code from the 2021 edition to 2024
+# unused = { level = "warn", priority = -1 } # Lints that detect things being declared but not used, or excess syntax
+## Individual
+ambiguous_negative_literals = "warn" # checks for cases that are confusing between a negative literal and a negation that's not part of the literal.
+closure_returning_async_block = "warn" # detects cases where users write a closure that returns an async block. # nightly
+ffi_unwind_calls = "warn"
+# fuzzy_provenance_casts = "warn" # unstable
+# lossy_provenance_casts = "warn" # unstable
+macro_use_extern_crate = "warn"
+meta_variable_misuse = "warn"
+missing_abi = "warn"
+missing_copy_implementations = "allow" # detects potentially-forgotten implementations of Copy for public types.
+missing_debug_implementations = "allow" # detects missing implementations of fmt::Debug for public types.
+missing_docs = "warn"
+# multiple_supertrait_upcastable = "warn" # unstable
+# must_not_suspend = "warn" # unstable
+non_ascii_idents = "warn"
+# non_exhaustive_omitted_patterns = "warn" # unstable
+redundant_imports = "warn"
+redundant_lifetimes = "warn"
+rust_2024_incompatible_pat = "warn" # nightly
+single_use_lifetimes = "warn"
+trivial_casts = "warn"
+trivial_numeric_casts = "warn"
+unit_bindings = "warn"
+unnameable_types = "warn"
+# unqualified_local_imports = "warn" # unstable
+unreachable_pub = "warn"
+unsafe_code = "forbid"
+unstable_features = "warn"
+# unused_crate_dependencies = "warn"
+unused_import_braces = "warn"
+unused_lifetimes = "warn"
+unused_qualifications = "warn"
+unused_results = "warn"
+variant_size_differences = "warn"
+elided_lifetimes_in_paths = "allow"
+# unstable-features = "allow"
+
+[lints.clippy]
+# Groups
+# nursery = { level = "warn", priority = -1 }
+# correctness = { level = "warn", priority = -1 }
+# suspicious = { level = "warn", priority = -1 }
+# complexity = { level = "warn", priority = -1 }
+# perf = { level = "warn", priority = -1 }
+# style = { level = "warn", priority = -1 }
+
+# pedantic = { level = "warn", priority = -1 }
+# restriction = { level = "warn", priority = -1 }
+cargo = { level = "warn", priority = -1 }
+# Temporary Allows
+single_call_fn = "allow"
+multiple_crate_versions = "allow"
+expect_used = "allow"
+# Style Allows
+implicit_return = "allow"
+self_named_module_files = "allow"
+else_if_without_else = "allow"
+std_instead_of_alloc = "allow"
+std_instead_of_core = "allow"
+blanket_clippy_restriction_lints = "allow"
+float_arithmetic = "allow"
+redundant_pub_crate = "allow"
+pub_with_shorthand = "allow"
+absolute_paths = "allow"
+module_name_repetitions = "allow"
+missing_trait_methods = "allow"
+separated_literal_suffix = "allow"
+exhaustive_structs = "allow"
+field_scoped_visibility_modifiers = "allow"
+allow_attributes_without_reason = "allow"
+# Warns
+missing_docs_in_private_items = "warn"
+use_self = "warn"
+str_to_string = "warn"
+print_stdout = "warn"
+unseparated_literal_suffix = "warn"
+unwrap_used = "warn"
+# Denys
+enum_glob_use = "deny"
+# expect_used = "deny"
 
 [dependencies]
 atrium-api = "0.25"

build.rs

···
+//! This file is used to tell cargo to recompile the project if the migrations folder changes.
 fn main() {
     println!("cargo:rerun-if-changed=migrations");
 }

src/auth.rs

···
 }
 
 impl AuthenticatedUser {
+    /// Get the DID of the authenticated user.
     pub(crate) fn did(&self) -> String {
         self.did.clone()
     }
···
                 .await
                 .with_context(|| format!("failed to query account {did}"))?;
 
-            Ok(AuthenticatedUser {
-                did: did.to_string(),
+            Ok(Self {
+                did: did.to_owned(),
             })
         } else {
             Err(Error::with_status(
···
         .context("failed to decode claims")?;
     let claims = serde_json::from_slice(&claims).context("failed to parse claims as json")?;
 
-    Ok((typ.to_string(), claims))
+    Ok((typ.to_owned(), claims))
 }

src/config.rs

···
+//! Configuration structures for the PDS.
 use std::{net::SocketAddr, path::PathBuf};
 
 use serde::Deserialize;
 use url::Url;
 
+/// The metrics configuration.
 pub(crate) mod metrics {
     use super::*;
 
     #[derive(Deserialize, Debug, Clone)]
+    /// The Prometheus configuration.
     pub(crate) struct PrometheusConfig {
         /// The URL of the Prometheus server's exporter endpoint.
         pub url: Url,
···
 #[derive(Deserialize, Debug, Clone)]
 #[serde(tag = "type")]
 pub(crate) enum MetricConfig {
+    /// The Prometheus push gateway.
     PrometheusPush(metrics::PrometheusConfig),
 }
 

src/did.rs

···
+//! DID utilities.
+
 use anyhow::{Context, Result, bail};
 use atrium_api::types::string::Did;
 use serde::{Deserialize, Serialize};
···
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
+/// DID verification method.
 pub(crate) struct DidVerificationMethod {
     pub id: String,
     #[serde(rename = "type")]
···
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
+/// DID document.
 pub(crate) struct DidDocument {
     #[serde(rename = "@context", skip_serializing_if = "Vec::is_empty")]
     pub context: Vec<Url>,

src/endpoints/identity.rs

···
         .fetch_one(&db)
         .await
     {
-        let did = atrium_api::types::string::Did::new(did).unwrap();
+        let did = atrium_api::types::string::Did::new(did).expect("should be valid DID format");
         return Ok(Json(identity::resolve_handle::OutputData { did }.into()));
     }
 
···
 ) -> Result<()> {
     let handle = input.handle.as_str();
     let did_str = user.did();
-    let did = atrium_api::types::string::Did::new(user.did()).unwrap();
+    let did = atrium_api::types::string::Did::new(user.did()).expect("should be valid DID format");
 
     let existing_did = sqlx::query_scalar!(r#"SELECT did FROM handles WHERE handle = ?"#, handle)
         .fetch_optional(&db)
···
         .with_context(|| format!("failed to resolve DID for {did_str}"))?;
 
     let op = PlcOperation {
-        typ: "plc_operation".to_string(),
+        typ: "plc_operation".to_owned(),
         rotation_keys: vec![rkey.did().to_string()],
-        verification_methods: HashMap::from([("atproto".to_string(), skey.did().to_string())]),
-        also_known_as: vec![input.handle.as_str().to_string()],
+        verification_methods: HashMap::from([("atproto".to_owned(), skey.did().to_string())]),
+        also_known_as: vec![input.handle.as_str().to_owned()],
         services: HashMap::from([(
-            "atproto_pds".to_string(),
+            "atproto_pds".to_owned(),
             PlcService::Pds {
                 endpoint: config.host_name.clone(),
             },
···
     }
 
     // FIXME: Properly abstract these implementation details.
-    let did_hash = did_str.strip_prefix("did:plc:").unwrap();
+    let did_hash = did_str.strip_prefix("did:plc:").expect("should be valid DID format");
     let doc = tokio::fs::File::options()
         .read(true)
         .write(true)
···
 
     let cid_str = plc_cid.to_string();
 
-    sqlx::query!(
+    _ = sqlx::query!(
         r#"UPDATE accounts SET plc_root = ? WHERE did = ?"#,
         cid_str,
         did_str
···
     fhp.identity(
         atrium_api::com::atproto::sync::subscribe_repos::IdentityData {
             did: did.clone(),
-            handle: Some(Handle::new(handle.to_string()).unwrap()),
+            handle: Some(Handle::new(handle.to_owned()).expect("should be valid handle")),
             seq: 0, // Filled by firehose later.
             time: Datetime::now(),
         },

src/endpoints/mod.rs

···
+//! Root module for all endpoints.
 use axum::{Json, Router, routing::get};
 use serde_json::json;
 
···
 mod server;
 mod sync;
 
+/// Health check endpoint. Returns name and version of the service.
 pub(crate) async fn health() -> Result<Json<serde_json::Value>> {
     Ok(Json(json!({
-        "version": "bluepds"
+        "version": concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION")),
     })))
 }
 
+/// Register all root routes.
 pub(crate) fn routes() -> Router<AppState> {
     Router::new()
         .route("/_health", get(health))

src/endpoints/repo.rs

···
         // If the swap failed, indicate as such.
         Ok(r.rows_affected() != 0)
     } else {
-        sqlx::query!(
+        _ = sqlx::query!(
             r#"UPDATE accounts SET root = ?, rev = ? WHERE did = ?"#,
             cid_str,
             rev_str,
···
                 .await
                 .context("failed to query did")?;
 
-            (handle.to_string(), did)
+            (handle.to_owned(), did)
         }
         AtIdentifier::Did(did) => {
             let did = did.as_str();
···
                 .await
                 .context("failed to query did")?;
 
-            (handle, did.to_string())
+            (handle, did.to_owned())
         }
     };
 
     Ok((
-        atrium_api::types::string::Did::new(did).unwrap(),
-        atrium_api::types::string::Handle::new(handle).unwrap(),
+        atrium_api::types::string::Did::new(did).expect("should be valid DID"),
+        atrium_api::types::string::Handle::new(handle).expect("should be valid handle"),
     ))
 }
 
···
                 let (ty, rf) = (map.get("$type"), map.get("ref"));
 
                 if let (Some(ty), Some(rf)) = (ty, rf) {
-                    if ty == &serde_json::Value::String("blob".to_string()) {
+                    if ty == &serde_json::Value::String("blob".to_owned()) {
                         if let Ok(rf) = serde_json::from_value::<BlobRef>(rf.clone()) {
                             cids.push(Cid::from_str(&rf.link).context("failed to convert cid")?);
                         }
···
             .sign(&builder.bytes())
             .context("failed to sign commit")?;
 
-        builder
+        _ = builder
             .finalize(sig)
             .await
             .context("failed to write signed commit")?;
···
     .context("failed to swap commit")?
     {
         // This should always succeed.
-        let old = input.swap_commit.clone().unwrap();
+        let old = input.swap_commit.clone().expect("swap_commit should always be Some");
 
         // The swap failed. Return the old commit and do not update the repository.
         return Ok(Json(
···
         match op {
             RepoOp::Update { path, .. } | RepoOp::Delete { path, .. } => {
                 // FIXME: This may cause issues if a user deletes more than one record referencing the same blob.
-                sqlx::query!(
+                _ = sqlx::query!(
                     r#"UPDATE blob_ref SET record = NULL WHERE did = ? AND record = ?"#,
                     did_str,
                     path
···
 
         // Handle the case where a new record references an existing blob.
         if r.rows_affected() == 0 {
-            sqlx::query!(
+            _ = sqlx::query!(
                 r#"INSERT INTO blob_ref (record, cid, did) VALUES (?, ?, ?)"#,
                 key,
                 cid_str,
···
         ops,
         cid: repo.root(),
         rev: repo.commit().rev().to_string(),
-        did: atrium_api::types::string::Did::new(user.did()).unwrap(),
+        did: atrium_api::types::string::Did::new(user.did()).expect("should be valid DID"),
         blobs: blobs.into_iter().map(|(_, c)| c).collect::<Vec<_>>(),
     })
     .await;
···
             cid: res.cid.clone(),
             commit: r.commit.clone(),
             uri: res.uri.clone(),
-            validation_status: Some("unknown".to_string()),
+            validation_status: Some("unknown".to_owned()),
         }
         .into(),
     ))
···
             cid: res.cid.clone(),
             commit: r.commit,
             uri: res.uri.clone(),
-            validation_status: Some("unknown".to_string()),
+            validation_status: Some("unknown".to_owned()),
         }
         .into(),
     ))
···
     let mut it = Box::pin(tree.keys());
     while let Some(key) = it.try_next().await.context("failed to iterate repo keys")? {
         if let Some((collection, _rkey)) = key.split_once('/') {
-            collections.insert(collection.to_string());
+            _ = collections.insert(collection.to_owned());
         }
     }
 
···
         repo::describe_repo::OutputData {
             collections: collections
                 .into_iter()
-                .map(|s| Nsid::new(s).unwrap())
+                .map(|s| Nsid::new(s).expect("should be valid NSID"))
                 .collect::<Vec<_>>(),
             did: did.clone(),
             did_doc: Unknown::Null, // TODO: Fetch the DID document from the PLC directory
···
             repo::get_record::OutputData {
                 cid: cid.map(atrium_api::types::string::Cid::new),
                 uri,
-                value: record.try_into_unknown().unwrap(),
+                value: record.try_into_unknown().expect("should be valid JSON"),
             }
             .into(),
         ))
···
             repo::list_records::RecordData {
                 cid: atrium_api::types::string::Cid::new(*cid),
                 uri: format!("at://{}/{}", did.as_str(), key),
-                value: value.try_into_unknown().unwrap(),
+                value: value.try_into_unknown().expect("should be valid JSON"),
             }
             .into(),
         )
···
         .context("no content-type provided")?
         .to_str()
         .context("invalid content-type provided")?
-        .to_string();
+        .to_owned();
 
     if length > config.blob.limit {
         return Err(Error::with_status(
···
         .await
         .context("failed to create temporary file")?;
 
-    let mut len = 0usize;
+    let mut len = 0_usize;
     let mut sha = Sha256::new();
     let mut stream = request.into_body().into_data_stream();
     while let Some(bytes) = stream.try_next().await.context("failed to receive file")? {
···
 
     let cid = Cid::new_v1(
         IPLD_RAW,
-        atrium_repo::Multihash::wrap(IPLD_MH_SHA2_256, hash.as_slice()).unwrap(),
+        atrium_repo::Multihash::wrap(IPLD_MH_SHA2_256, hash.as_slice()).expect("should be valid hash"),
     );
 
     let cid_str = cid.to_string();
···
 
     let did_str = user.did();
 
-    sqlx::query!(
+    _ = sqlx::query!(
         r#"INSERT INTO blob_ref (cid, did, record) VALUES (?, ?, NULL)"#,
         cid_str,
         did_str

src/endpoints/server.rs

···
     // Account can be created. Synthesize a new DID for the user.
     // https://github.com/did-method-plc/did-method-plc?tab=readme-ov-file#did-creation
     let op = PlcOperation {
-        typ: "plc_operation".to_string(),
+        typ: "plc_operation".to_owned(),
         rotation_keys: recovery_keys,
-        verification_methods: HashMap::from([("atproto".to_string(), skey.did().to_string())]),
+        verification_methods: HashMap::from([("atproto".to_owned(), skey.did().to_string())]),
         also_known_as: vec![format!("at://{}", input.handle.as_str())],
         services: HashMap::from([(
-            "atproto_pds".to_string(),
+            "atproto_pds".to_owned(),
             PlcService::Pds {
                 endpoint: format!("https://{}", config.host_name),
             },
···
             .await
             .context("failed to create carstore")?;
 
-        let repo_builder = Repository::create(&mut store, Did::from_str(&did).unwrap())
+        let repo_builder = Repository::create(&mut store, Did::from_str(&did).expect("should be valid DID format"))
             .await
             .context("failed to initialize user repo")?;
 
···
     let cid_str = cid.to_string();
     let rev_str = rev.as_str();
 
-    sqlx::query!(
+    _ = sqlx::query!(
         r#"
         INSERT INTO accounts (did, email, password, root, plc_root, rev, created_at)
             VALUES (?, ?, ?, ?, ?, ?, datetime('now'));
···
     // Broadcast the identity event now that the new identity is resolvable on the public directory.
     fhp.identity(
         atrium_api::com::atproto::sync::subscribe_repos::IdentityData {
-            did: Did::from_str(&did).unwrap(),
-            handle: Some(Handle::new(handle).unwrap()),
+            did: Did::from_str(&did).expect("should be valid DID format"),
+            handle: Some(Handle::new(handle).expect("should be valid handle")),
             seq: 0, // Filled by firehose later.
             time: Datetime::now(),
         },
···
     fhp.account(
         atrium_api::com::atproto::sync::subscribe_repos::AccountData {
             active: true,
-            did: Did::from_str(&did).unwrap(),
+            did: Did::from_str(&did).expect("should be valid DID format"),
             seq: 0,       // Filled by firehose later.
             status: None, // "takedown" / "suspended" / "deactivated"
             time: Datetime::now(),
···
     )
     .await;
 
-    let did = Did::from_str(&did).unwrap();
+    let did = Did::from_str(&did).expect("should be valid DID format");
 
     fhp.commit(Commit {
         car: store,
···
         // determine whether or not an account exists.
         let _ = Argon2::default().verify_password(
             password.as_bytes(),
-            &PasswordHash::new(DUMMY_PASSWORD).unwrap(),
+            &PasswordHash::new(DUMMY_PASSWORD).expect("should be valid password hash"),
         );
 
         return Err(Error::with_status(
···
             refresh_jwt: refresh_token,
 
             active: Some(true),
-            did: Did::from_str(&did).unwrap(),
+            did: Did::from_str(&did).expect("should be valid DID format"),
             did_doc: None,
             email: None,
             email_auth_factor: None,
             email_confirmed: None,
-            handle: Handle::new(account.handle).unwrap(),
+            handle: Handle::new(account.handle).expect("should be valid handle"),
             status: None,
         }
         .into(),
···
             refresh_jwt: refresh_token,
 
             active: Some(active), // TODO?
-            did: Did::new(did.to_string()).unwrap(),
+            did: Did::new(did.to_owned()).expect("should be valid DID format"),
             did_doc: None,
-            handle: Handle::new(user.handle).unwrap(),
+            handle: Handle::new(user.handle).expect("should be valid handle"),
             status,
         }
         .into(),
···
         Ok(Json(
             server::get_session::OutputData {
                 active: Some(active),
-                did: Did::from_str(&did).unwrap(),
+                did: Did::from_str(&did).expect("should be valid DID format"),
                 did_doc: None,
                 email: Some(user.email),
                 email_auth_factor: None,
                 email_confirmed: None,
-                handle: Handle::new(user.handle).unwrap(),
+                handle: Handle::new(user.handle).expect("should be valid handle"),
                 status,
             }
             .into(),
···
         server::describe_server::OutputData {
             available_user_domains: vec![],
             contact: None,
-            did: Did::from_str(&format!("did:web:{}", config.host_name)).unwrap(),
+            did: Did::from_str(&format!("did:web:{}", config.host_name)).expect("should be valid DID format"),
             invite_code_required: Some(true),
             links: None,
             phone_verification_required: Some(false), // email verification

src/endpoints/sync.rs

···
         .map(|r| {
             sync::list_repos::RepoData {
                 active: Some(true),
-                did: Did::new(r.did).unwrap(),
-                head: atrium_api::types::string::Cid::new(Cid::from_str(&r.root).unwrap()),
+                did: Did::new(r.did).expect("should be a valid DID"),
+                head: atrium_api::types::string::Cid::new(Cid::from_str(&r.root).expect("should be a valid CID")),
                 rev: r.rev,
                 status: None,
             }
···
             return Response::builder()
                 .status(StatusCode::BAD_REQUEST)
                 .body(Body::empty())
-                .unwrap();
+                .expect("should be a valid response")
         }
     };
 
-    ws.on_upgrade(move |ws| async move {
+    ws.on_upgrade(async move |ws| {
         fh.client_connection(ws, cursor).await;
     })
 }

src/error.rs

···
+//! Error handling for the application.
 use axum::{
     body::Body,
     http::StatusCode,
···
 }
 
 #[derive(Default, serde::Serialize)]
-pub struct ErrorMessage {
+/// A JSON error message.
+pub(crate) struct ErrorMessage {
     error: String,
     message: String,
 }
···
     }
 }
 impl ErrorMessage {
-    pub fn new(error: impl Into<String>, message: impl Into<String>) -> Self {
+    /// Create a new error message to be returned as JSON body.
+    pub(crate) fn new(error: impl Into<String>, message: impl Into<String>) -> Self {
         Self {
             error: error.into(),
             message: message.into(),
···
 }
 
 impl Error {
+    /// Returned when a route is not yet implemented.
     pub fn unimplemented(err: impl Into<anyhow::Error>) -> Self {
         Self::with_status(StatusCode::NOT_IMPLEMENTED, err)
     }
 
+    /// Returned when just providing a status code.
     pub fn with_status(status: StatusCode, err: impl Into<anyhow::Error>) -> Self {
         Self {
             status,
···
         }
     }
 
-    pub fn with_message(
+    /// Returned when providing a status code and a JSON message body.
+    pub(crate) fn with_message(
         status: StatusCode,
         err: impl Into<anyhow::Error>,
         message: impl Into<ErrorMessage>,
···
             Response::builder()
                 .status(self.status)
                 .body(Body::new(format!("{:?}", self.err)))
-                .unwrap()
+                .expect("should be a valid response")
         } else {
             Response::builder()
                 .status(self.status)
                 .header("Content-Type", "application/json")
                 .body(Body::new(self.message.unwrap_or_default().to_string()))
-                .unwrap()
+                .expect("should be a valid response")
         }
     }
 }

src/firehose.rs

···
+//! The firehose module.
 use std::{collections::VecDeque, time::Duration};
 
 use anyhow::{Result, bail};
···
         let mut map = serializer.serialize_map(None)?;
 
         match self {
-            FrameHeader::Message(s) => {
+            Self::Message(s) => {
                 map.serialize_key("op")?;
                 map.serialize_value(&1)?;
                 map.serialize_key("t")?;
                 map.serialize_value(s.as_str())?;
             }
-            FrameHeader::Error => {
+            Self::Error => {
                 map.serialize_key("op")?;
                 map.serialize_value(&-1)?;
             }
···
     }
 }
 
-pub enum RepoOp {
-    Create { cid: Cid, path: String },
-    Update { cid: Cid, path: String, prev: Cid },
-    Delete { path: String, prev: Cid },
+/// A repository operation.
+pub(crate) enum RepoOp {
+    /// Create a new record.
+    Create {
+        /// The CID of the record.
+        cid: Cid,
+        /// The path of the record.
+        path: String
+    },
+    /// Update an existing record.
+    Update {
+        /// The CID of the record.
+        cid: Cid,
+        /// The path of the record.
+        path: String,
+        /// The previous CID of the record.
+        prev: Cid
+    },
+    /// Delete an existing record.
+    Delete {
+        /// The path of the record.
+        path: String,
+        /// The previous CID of the record.
+        prev: Cid
+    },
 }
 
 impl From<RepoOp> for sync::subscribe_repos::RepoOp {
···
         };
 
         sync::subscribe_repos::RepoOpData {
-            action: action.to_string(),
+            action: action.to_owned(),
             cid: cid.map(atrium_api::types::CidLink),
             path,
         }
···
     }
 }
 
-pub struct Commit {
+/// A commit to the repository.
+pub(crate) struct Commit {
     /// The car file containing the commit blocks.
     pub car: Vec<u8>,
     /// The operations performed in this commit.
···
             .await;
     }
 
+    /// Handle client connection.
     pub(crate) async fn client_connection(&self, ws: WebSocket, cursor: Option<i64>) {
         let _ = self
             .tx
···
     seq: u64,
     mut msg: sync::subscribe_repos::Message,
 ) -> (&'static str, Vec<u8>) {
-    let mut dummy_seq = 0i64;
+    let mut dummy_seq = 0_i64;
     let (ty, nseq) = match &mut msg {
         sync::subscribe_repos::Message::Account(m) => ("#account", &mut m.seq),
         sync::subscribe_repos::Message::Commit(m) => ("#commit", &mut m.seq),
···
     // Set the sequence number.
     *nseq = seq as i64;
 
-    let hdr = FrameHeader::Message(ty.to_string());
+    let hdr = FrameHeader::Message(ty.to_owned());
 
     let mut frame = Vec::new();
-    serde_ipld_dagcbor::to_writer(&mut frame, &hdr).unwrap();
-    serde_ipld_dagcbor::to_writer(&mut frame, &msg).unwrap();
+    serde_ipld_dagcbor::to_writer(&mut frame, &hdr).expect("should serialize header");
+    serde_ipld_dagcbor::to_writer(&mut frame, &msg).expect("should serialize message");
 
     (ty, frame)
 }
···
         let client = &mut clients[i];
         if let Err(e) = client.send(msg.clone()).await {
             debug!("Firehose client disconnected: {e}");
-            clients.remove(i);
+            _ = clients.remove(i);
         }
     }
 
···
                 "cursor {cursor} is greater than the current sequence number {seq}"
             )));
 
-            serde_ipld_dagcbor::to_writer(&mut frame, &hdr).unwrap();
-            serde_ipld_dagcbor::to_writer(&mut frame, &msg).unwrap();
+            serde_ipld_dagcbor::to_writer(&mut frame, &hdr).expect("should serialize header");
+            serde_ipld_dagcbor::to_writer(&mut frame, &msg).expect("should serialize message");
 
             // Drop the connection.
             let _ = ws.send(Message::binary(frame)).await;
···
             }
 
             let hdr = FrameHeader::Message(ty.to_string());
-            serde_ipld_dagcbor::to_writer(&mut frame, &hdr).unwrap();
-            serde_ipld_dagcbor::to_writer(&mut frame, msg).unwrap();
+            serde_ipld_dagcbor::to_writer(&mut frame, &hdr).expect("should serialize header");
+            serde_ipld_dagcbor::to_writer(&mut frame, msg).expect("should serialize message");
 
             if let Err(e) = ws.send(Message::binary(frame.clone())).await {
                 debug!("Firehose client disconnected during backfill: {e}");
···
     Ok(ws)
 }
 
+/// Reconnect to upstream relays.
 pub(crate) async fn reconnect_relays(client: &Client, config: &AppConfig) {
     // Avoid connecting to upstream relays in test mode.
     if config.test {
···
     let handle = tokio::spawn(async move {
         let mut clients: Vec<WebSocket> = Vec::new();
         let mut history = VecDeque::with_capacity(1000);
-        let mut seq = 1u64;
+        let mut seq = 1_u64;
 
         // TODO: We should use `com.atproto.sync.notifyOfUpdate` to reach out to relays
         // that may have disconnected from us due to timeout.

src/main.rs

···
+//! PDS implementation.
 use std::{
     net::{IpAddr, Ipv4Addr, SocketAddr},
     path::PathBuf,
···
 mod plc;
 mod storage;
 
+/// The application-wide result type.
 pub type Result<T> = std::result::Result<T, Error>;
 pub use error::Error;
 use uuid::Uuid;
 
+/// The reqwest client type with middleware.
 pub type Client = reqwest_middleware::ClientWithMiddleware;
+/// The database connection pool.
 pub type Db = SqlitePool;
+/// The Azure credential type.
 pub type Cred = Arc<dyn TokenCredential>;
 
+/// The application user agent. Concatenates the package name and version. e.g. `bluepds/0.0.0`.
 pub const APP_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),);
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
+/// The key data structure.
 struct KeyData {
     /// Primary signing key for all repo operations.
     skey: Vec<u8>,
···
 //
 // Reference: https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve-signature-algorithm-in-2022/
 #[derive(Clone)]
+/// The signing key for PLC/DID operations.
 pub struct SigningKey(Arc<Secp256k1Keypair>);
 #[derive(Clone)]
+/// The rotation key for PLC operations.
 pub struct RotationKey(Arc<Secp256k1Keypair>);
 
 impl std::ops::Deref for SigningKey {
···
 }
 
 #[derive(Parser, Debug, Clone)]
+/// Command line arguments.
 struct Args {
+    /// The verbosity level.
     #[command(flatten)]
     verbosity: Verbosity<InfoLevel>,
 
···
 
 #[derive(Clone, FromRef)]
 struct AppState {
+    /// The application configuration.
     config: AppConfig,
+    /// The Azure credential.
     cred: Cred,
+    /// The database connection pool.
     db: Db,
 
+    /// The HTTP client with middleware.
     client: Client,
+    /// The simple HTTP client.
     simple_client: reqwest::Client,
+    /// The firehose producer.
     firehose: FirehoseProducer,
 
+    /// The signing key.
     signing_key: SigningKey,
+    /// The rotation key.
     rotation_key: RotationKey,
 }
 
+/// The index (/) route.
 async fn index() -> impl IntoResponse {
     r#"
          __                         __
···
     ) -> Result<()> {
         let did = user.did();
         let prefs = sqlx::types::Json(input.preferences.clone());
-        sqlx::query!(
+        _ = sqlx::query!(
             r#"UPDATE accounts SET private_prefs = ? WHERE did = ?"#,
             prefs,
             did
···
     }
 
     #[rustfmt::skip]
+    /// Register all actor endpoints.
     pub(crate) fn routes() -> Router<AppState> {
         // AP /xrpc/app.bsky.actor.putPreferences
         // AG /xrpc/app.bsky.actor.getPreferences
···
         }
         // HACK: Assume the bluesky appview by default.
         None => (
-            Did::new("did:web:api.bsky.app".to_string()).unwrap(),
-            "#bsky_appview".to_string(),
+            Did::new("did:web:api.bsky.app".to_owned()).expect("should be a valid DID"),
+            "#bsky_appview".to_owned(),
         ),
     };
 
···
 
     let mut h = HeaderMap::new();
     if let Some(hdr) = request.headers().get("atproto-accept-labelers") {
-        h.insert("atproto-accept-labelers", hdr.clone());
+        _ = h.insert("atproto-accept-labelers", hdr.clone());
     }
     if let Some(hdr) = request.headers().get(http::header::CONTENT_TYPE) {
-        h.insert(http::header::CONTENT_TYPE, hdr.clone());
+        _ = h.insert(http::header::CONTENT_TYPE, hdr.clone());
     }
 
     let r = client
···
     Ok(resp)
 }
 
+/// The main application entry point.
 async fn run() -> anyhow::Result<()> {
     let args = Args::parse();
 
···
         }))
         .build();
 
-    tokio::fs::create_dir_all(&config.key.parent().unwrap())
+    tokio::fs::create_dir_all(&config.key.parent().expect("should have parent"))
         .await
         .context("failed to create key directory")?;
 
···
     .await
     .context("failed to query database")?;
 
+    #[allow(clippy::print_stdout)]
     if c == 0 {
         let uuid = Uuid::new_v4().to_string();
 
-        sqlx::query!(
+        _ = sqlx::query!(
             r#"
             INSERT INTO invites (id, did, count, created_at)
                 VALUES (?, NULL, 1, datetime('now'))
···
     });
 
     // Now that the app is live, request a crawl from upstream relays.
-    let _ = firehose::reconnect_relays(&client, &config).await;
+    firehose::reconnect_relays(&client, &config).await;
 
     serve
         .await

src/metrics.rs

···
 
 use crate::config;
 
-pub(crate) const AUTH_FAILED: &str = "bluepds.auth.failed"; // Counter.
-
-pub(crate) const FIREHOSE_HISTORY: &str = "bluepds.firehose.history"; // Gauge.
-pub(crate) const FIREHOSE_LISTENERS: &str = "bluepds.firehose.listeners"; // Gauge.
-pub(crate) const FIREHOSE_MESSAGES: &str = "bluepds.firehose.messages"; // Counter.
-pub(crate) const FIREHOSE_SEQUENCE: &str = "bluepds.firehose.sequence"; // Counter.
-
-pub(crate) const REPO_COMMITS: &str = "bluepds.repo.commits"; // Counter.
-pub(crate) const REPO_OP_CREATE: &str = "bluepds.repo.op.create"; // Counter.
-pub(crate) const REPO_OP_UPDATE: &str = "bluepds.repo.op.update"; // Counter.
-pub(crate) const REPO_OP_DELETE: &str = "bluepds.repo.op.delete"; // Counter.
+/// Authorization failed. Counter.
+pub(crate) const AUTH_FAILED: &str = "bluepds.auth.failed";
+/// Firehose history. Gauge.
+pub(crate) const FIREHOSE_HISTORY: &str = "bluepds.firehose.history";
+/// Firehose listeners. Gauge.
+pub(crate) const FIREHOSE_LISTENERS: &str = "bluepds.firehose.listeners";
+/// Firehose messages. Counter.
+pub(crate) const FIREHOSE_MESSAGES: &str = "bluepds.firehose.messages";
+/// Firehose sequence. Counter.
+pub(crate) const FIREHOSE_SEQUENCE: &str = "bluepds.firehose.sequence";
+/// Repository commits. Counter.
+pub(crate) const REPO_COMMITS: &str = "bluepds.repo.commits";
+/// Repository operation create. Counter.
+pub(crate) const REPO_OP_CREATE: &str = "bluepds.repo.op.create";
+/// Repository operation update. Counter.
+pub(crate) const REPO_OP_UPDATE: &str = "bluepds.repo.op.update";
+/// Repository operation delete. Counter.
+pub(crate) const REPO_OP_DELETE: &str = "bluepds.repo.op.delete";
 
 /// Must be ran exactly once on startup. This will declare all of the instruments for `metrics`.
 pub(crate) fn setup(config: &Option<config::MetricConfig>) -> anyhow::Result<()> {

src/plc.rs

···
+//! PLC operations.
 use std::collections::HashMap;
 
 use anyhow::{Context, bail};
···
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
 #[serde(rename_all = "camelCase", tag = "type")]
+/// A PLC service.
 pub(crate) enum PlcService {
     #[serde(rename = "AtprotoPersonalDataServer")]
-    Pds { endpoint: String },
+    /// A personal data server.
+    Pds {
+        /// The URL of the PDS.
+        endpoint: String
+    },
 }
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
···
 }
 
 impl PlcOperation {
+    /// Sign an operation with the provided signature.
     pub(crate) fn sign(self, sig: Vec<u8>) -> SignedPlcOperation {
         SignedPlcOperation {
             typ: self.typ,
···
 
 #[derive(Debug, Deserialize, Serialize, Clone)]
 #[serde(rename_all = "camelCase")]
+/// A signed PLC operation.
 pub(crate) struct SignedPlcOperation {
     #[serde(rename = "type")]
     pub typ: String,
···
 
 /// Submit a PLC operation to the public directory.
 pub(crate) async fn submit(client: &Client, did: &str, op: &SignedPlcOperation) -> anyhow::Result<()> {
-    debug!("submitting {} {}", did, serde_json::to_string(&op).unwrap());
+    debug!("submitting {} {}", did, serde_json::to_string(&op).expect("should serialize"));
 
     let res = client
         .post(format!("{PLC_DIRECTORY}{did}"))
···
 
         bail!(
             "error from PLC directory: {}",
-            serde_json::to_string(&e).unwrap()
+            serde_json::to_string(&e).expect("should serialize")
         );
     }
 }

src/storage.rs

···
 
 use crate::{Db, config::RepoConfig};
 
+/// Open a block store for a given DID.
 pub(crate) async fn open_store(
     config: &RepoConfig,
     did: impl Into<String>,
···
     CarStore::open(f).await.context("failed to open car store")
 }
 
+/// Open a repository for a given DID.
 pub(crate) async fn open_repo_db(
     config: &RepoConfig,
     db: &Db,
···
     .await
     .context("failed to query database")?;
 
-    open_repo(config, did, Cid::from_str(&cid).unwrap()).await
+    open_repo(config, did, Cid::from_str(&cid).expect("should be valid CID")).await
 }
 
+/// Open a repository for a given DID and CID.
 pub(crate) async fn open_repo(
     config: &RepoConfig,
     did: impl Into<String>,