lint (shadow_unrelated)

Cargo.toml

···
 multiple_crate_versions = "allow"
 expect_used = "allow"
 # # Temporary Allows - Restriction
-shadow_reuse = "allow"
-shadow_unrelated = "allow"
 min_ident_chars = "allow"
 # arbitrary_source_item_ordering = "allow"
 renamed_function_params = "allow"
···
 tests_outside_test_module = "allow"
 ref_patterns = "allow"
 question_mark_used = "allow"
+shadow_reuse = "allow"
 # Warns
 missing_docs_in_private_items = "warn"
 use_self = "warn"

src/auth.rs

···
 
         // N.B: We ignore all fields inside of the token up until this point because they can be
         // attacker-controlled.
-        let (typ, claims) = verify(&state.signing_key.did(), token).map_err(|e| {
-            Error::with_status(
-                StatusCode::UNAUTHORIZED,
-                e.context("failed to verify auth token"),
-            )
-        }).context("token auth should be verify")?;
+        let (typ, claims) = verify(&state.signing_key.did(), token)
+            .map_err(|e| {
+                Error::with_status(
+                    StatusCode::UNAUTHORIZED,
+                    e.context("failed to verify auth token"),
+                )
+            })
+            .context("token auth should be verify")?;
 
         // Ensure this is an authentication token.
         if typ != "at+jwt" {
···
             let _status = sqlx::query_scalar!(r#"SELECT status FROM accounts WHERE did = ?"#, did)
                 .fetch_one(&state.db)
                 .await
-                .with_context(|| format!("failed to query account {did}")).context("should fetch account status")?;
+                .with_context(|| format!("failed to query account {did}"))
+                .context("should fetch account status")?;
 
             Ok(Self {
                 did: did.to_owned(),

src/endpoints/identity.rs

···
         .await
         .context("failed to open did doc")?;
 
-    let op_bytes = serde_ipld_dagcbor::to_vec(&op)
-        .context("failed to encode plc op")?;
+    let op_bytes = serde_ipld_dagcbor::to_vec(&op).context("failed to encode plc op")?;
 
     let plc_cid = CarStore::open(doc)
         .await

src/endpoints/repo.rs

···
                 if let (Some(blob_type), Some(blob_ref)) = (map.get("$type"), map.get("ref")) {
                     if blob_type == &serde_json::Value::String("blob".to_owned()) {
                         if let Ok(rf) = serde_json::from_value::<BlobRef>(blob_ref.clone()) {
-                            cids.push(
-                                Cid::from_str(&rf.link)
-                                    .context("failed to convert cid")?,
-                            );
+                            cids.push(Cid::from_str(&rf.link).context("failed to convert cid")?);
                         }
                     }
                 }
···
             .context("failed to extract key")?;
     }
 
-    let mut tx = db
-        .begin()
-        .await
-        .context("failed to begin transaction")?;
+    let mut tx = db.begin().await.context("failed to begin transaction")?;
 
     if !swap_commit(
         &mut *tx,
···
     };
     Ok(Json(
         repo::put_record::OutputData {
-            cid: cid
-                .context("missing cid")?,
+            cid: cid.context("missing cid")?,
             commit: write_result.commit.to_owned(),
-            uri: uri
-                .context("missing uri")?,
+            uri: uri.context("missing uri")?,
             validation_status: Some("unknown".to_owned()),
         }
         .into(),
···
 
     let mut tree = repo.tree();
     let mut it = Box::pin(tree.keys());
-    while let Some(key) = it
-        .try_next()
-        .await
-        .context("failed to iterate repo keys")?
-    {
+    while let Some(key) = it.try_next().await.context("failed to iterate repo keys")? {
         if let Some((collection, _rkey)) = key.split_once('/') {
             _ = collections.insert(collection.to_owned());
         }
···
         .await
         .context("failed to find record")?;
 
-    let record: Option<serde_json::Value> = repo
-        .get_raw(&key)
-        .await
-        .context("failed to read record")?;
+    let record: Option<serde_json::Value> =
+        repo.get_raw(&key).await.context("failed to read record")?;
 
     record.map_or_else(
         || {
···
     let mut len = 0_usize;
     let mut sha = Sha256::new();
     let mut stream = request.into_body().into_data_stream();
-    while let Some(bytes) = stream
-        .try_next()
-        .await
-        .context("failed to receive file")?
-    {
-        len = len
-            .checked_add(bytes.len())
-            .context("size overflow")?;
+    while let Some(bytes) = stream.try_next().await.context("failed to receive file")? {
+        len = len.checked_add(bytes.len()).context("size overflow")?;
 
         // Deal with any sneaky end-users trying to bypass size limitations.
-        let len_u64: u64 = len
-            .try_into()
-            .context("failed to convert `len`")?;
+        let len_u64: u64 = len.try_into().context("failed to convert `len`")?;
         if len_u64 > config.blob.limit {
             drop(file);
             tokio::fs::remove_file(&filename)

src/endpoints/server.rs

···
     State(fhp): State<FirehoseProducer>,
     Json(input): Json<server::create_account::Input>,
 ) -> Result<Json<server::create_account::Output>> {
-    let email = input
-        .email
-        .as_deref()
-        .context("no email provided")?;
+    let email = input.email.as_deref().context("no email provided")?;
     // Hash the user's password.
     let pass = Argon2::default()
         .hash_password(
···
 
     // Begin a new transaction to actually create the user's profile.
     // Unless committed, the transaction will be automatically rolled back.
-    let mut tx = db
-        .begin()
-        .await
-        .context("failed to begin transaction")?;
+    let mut tx = db.begin().await.context("failed to begin transaction")?;
 
     let _invite = match input.invite_code {
         Some(ref code) => {
···
             .await
             .context("failed to check invite code")?;
 
-            invite
-                .context("invalid invite code")?
+            invite.context("invalid invite code")?
         }
         None => {
             return Err(anyhow!("invite code required").into());
···
     )
     .await
     .context("failed to sign genesis op")?;
-    let op_bytes = serde_ipld_dagcbor::to_vec(&op)
-        .context("failed to encode genesis op")?;
+    let op_bytes = serde_ipld_dagcbor::to_vec(&op).context("failed to encode genesis op")?;
 
     let did_hash = {
         let digest = base32::encode(
···
     .context("failed to create new account")?;
 
     // The account is fully created. Commit the SQL transaction to the database.
-    tx.commit()
-        .await
-        .context("failed to commit transaction")?;
+    tx.commit().await.context("failed to commit transaction")?;
 
     // Broadcast the identity event now that the new identity is resolvable on the public directory.
     fhp.identity(
···
 
     match Argon2::default().verify_password(
         password.as_bytes(),
-        &PasswordHash::new(account.password.as_str())
-            .context("invalid password hash in db")?,
+        &PasswordHash::new(account.password.as_str()).context("invalid password hash in db")?,
     ) {
         Ok(_) => {}
         Err(_e) => {
···
     req: Request,
 ) -> Result<Json<server::refresh_session::Output>> {
     // TODO: store hashes of refresh tokens and enforce single-use
-    let auth = req
+    let auth_token = req
         .headers()
         .get(axum::http::header::AUTHORIZATION)
-        .context("no authorization header provided")?;
-    let token = auth
+        .context("no authorization header provided")?
         .to_str()
         .ok()
         .and_then(|auth| auth.strip_prefix("Bearer "))
         .context("invalid authentication token")?;
 
-    let (typ, claims) = auth::verify(&skey.did(), token)
-        .context("failed to verify refresh token")?;
+    let (typ, claims) =
+        auth::verify(&skey.did(), auth_token).context("failed to verify refresh token")?;
     if typ != "refresh+jwt" {
         return Err(Error::with_status(
             StatusCode::UNAUTHORIZED,
···
     State(db): State<Db>,
 ) -> Result<Json<server::get_session::Output>> {
     let did = user.did();
-
+    #[expect(clippy::shadow_unrelated, reason = "is related")]
     if let Some(user) = sqlx::query!(
         r#"
         SELECT a.email, a.status, (

src/endpoints/sync.rs

···
 }
 
 async fn subscribe_repos(
-    ws: WebSocketUpgrade,
+    ws_up: WebSocketUpgrade,
     State(fh): State<FirehoseProducer>,
     Query(input): Query<SubscribeReposParametersData>,
 ) -> impl IntoResponse {
···
                 .expect("should be a valid response");
         }
     };
-
-    ws.on_upgrade(async move |ws| {
+    ws_up.on_upgrade(async move |ws| {
         fh.client_connection(ws, cursor).await;
     })
 }

src/firehose.rs

···
             let msg = sync::subscribe_repos::Error::FutureCursor(Some(format!(
                 "cursor {cursor} is greater than the current sequence number {seq}"
             )));
-
             serde_ipld_dagcbor::to_writer(&mut frame, &hdr).expect("should serialize header");
             serde_ipld_dagcbor::to_writer(&mut frame, &msg).expect("should serialize message");
-
             // Drop the connection.
             drop(ws.send(Message::binary(frame)).await);
             bail!(
···
             );
         }
 
-        for &(seq, ty, ref msg) in history.iter() {
-            if seq > cursor {
-                break;
+        for &(historical_seq, ty, ref msg) in history.iter() {
+            if cursor > historical_seq {
+                continue;
             }
-
             let hdr = FrameHeader::Message(ty.to_owned());
             serde_ipld_dagcbor::to_writer(&mut frame, &hdr).expect("should serialize header");
             serde_ipld_dagcbor::to_writer(&mut frame, msg).expect("should serialize message");
-
             if let Err(e) = ws.send(Message::binary(frame.clone())).await {
                 debug!("Firehose client disconnected during backfill: {e}");
                 break;
             }
-
             // Clear out the frame to begin a new one.
             frame.clear();
         }

src/main.rs

···
 ///
 /// Reference: https://atproto.com/specs/xrpc#service-proxying
 async fn service_proxy(
-    url: Uri,
+    uri: Uri,
     user: AuthenticatedUser,
     State(skey): State<SigningKey>,
     State(client): State<reqwest::Client>,
     headers: HeaderMap,
     request: Request<Body>,
 ) -> Result<Response<Body>> {
-    let url_path = url.path_and_query().context("invalid service proxy url")?;
+    let url_path = uri.path_and_query().context("invalid service proxy url")?;
     let lxm = url_path
         .path()
         .strip_prefix("/")