lint

src/auth.rs

···
 };
 use axum::{extract::FromRequestParts, http::StatusCode};
 use base64::Engine as _;
-use sha2::{Digest, Sha256};
+use sha2::{Digest as _, Sha256};
 
 use crate::{AppState, Error, error::ErrorMessage};
 
···
                 Error::with_status(StatusCode::UNAUTHORIZED, anyhow!("no authorization header"))
             })?;
 
-        let auth_str = auth_header.to_str().map_err(|_| {
+        let auth_str = auth_header.to_str().map_err(|e| {
             Error::with_status(
                 StatusCode::UNAUTHORIZED,
-                anyhow!("authorization header should be valid utf-8"),
+                anyhow!("authorization header should be valid utf-8").context(e),
             )
         })?;
 
···
 
         // Handle different token types
         if auth_str.starts_with("Bearer ") || auth_str.starts_with("DPoP ") {
-            let token = auth_str.splitn(2, ' ').nth(1).unwrap();
+            let token = auth_str
+                .split_once(' ')
+                .expect("Auth string should have a space")
+                .1;
+
             if has_dpop {
                 // Process DPoP token - the Authorization header contains the access token
                 // and the DPoP header contains the proof
-                let dpop_token = dpop_header.unwrap().to_str().map_err(|_| {
-                    Error::with_status(
-                        StatusCode::UNAUTHORIZED,
-                        anyhow!("DPoP header should be valid utf-8"),
-                    )
-                })?;
+                let dpop_token = dpop_header
+                    .expect("DPoP header should exist")
+                    .to_str()
+                    .map_err(|e| {
+                        Error::with_status(
+                            StatusCode::UNAUTHORIZED,
+                            anyhow!("DPoP header should be valid utf-8").context(e),
+                        )
+                    })?;
 
                 return validate_dpop_token(token, dpop_token, parts, state).await;
-            } else {
-                // Standard Bearer token
-                return validate_bearer_token(token, state).await;
             }
+
+            // Standard Bearer token
+            return validate_bearer_token(token, state).await;
         }
 
         // If we reach here, no valid authorization method was found
···
     }
 }
 
+#[expect(clippy::too_many_lines, reason = "validating dpop has many loc")]
 /// Validate a DPoP token and proof
 async fn validate_dpop_token(
     access_token: &str,
···
     }
 
     // Check token expiration
-    if let Some(exp) = claims.get("exp").and_then(|v| v.as_i64()) {
+    if let Some(exp) = claims.get("exp").and_then(serde_json::Value::as_i64) {
         let now = chrono::Utc::now().timestamp();
         if now >= exp {
             return Err(Error::with_message(
···
 
     // Decode header
     let dpop_header_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
-        .decode(dpop_parts[0])
+        .decode(dpop_parts.first().context("header part missing")?)
         .context("failed to decode DPoP header")?;
 
     let dpop_header: serde_json::Value =
···
 
     // Decode claims
     let dpop_claims_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
-        .decode(dpop_parts[1])
+        .decode(dpop_parts.get(1).context("claims part missing")?)
         .context("failed to decode DPoP claims")?;
 
     let dpop_claims: serde_json::Value =
···
     for prop in required_props {
         let value = jwk
             .get(prop)
-            .context(format!("JWK missing required property: {}", prop))?;
-        drop(canonical_jwk.insert(prop.to_string(), value.clone()));
+            .context(format!("JWK missing required property: {prop}"))?;
+        drop(canonical_jwk.insert((*prop).to_owned(), value.clone()));
     }
 
     // Serialize with no whitespace
···
     // Get expiry from token or default to 60 seconds
     let exp = dpop_claims
         .get("exp")
-        .and_then(|e| e.as_i64())
-        .unwrap_or_else(|| timestamp + 60);
+        .and_then(serde_json::Value::as_i64)
+        .unwrap_or_else(|| timestamp.checked_add(60).unwrap_or(timestamp));
 
     _ = sqlx::query!(
         r#"

src/endpoints/sync.rs

···
             active,
             status,
             did: input.did.clone(),
-            rev: Some(atrium_api::types::string::Tid::new(r.rev).unwrap()),
+            rev: Some(
+                atrium_api::types::string::Tid::new(r.rev).expect("should be able to convert Tid"),
+            ),
         }
         .into(),
     ))
···
                 head: atrium_api::types::string::Cid::new(
                     Cid::from_str(&r.root).expect("should be a valid CID"),
                 ),
-                rev: atrium_api::types::string::Tid::new(r.rev).unwrap(),
+                rev: atrium_api::types::string::Tid::new(r.rev)
+                    .expect("should be able to convert Tid"),
                 status: None,
             }
             .into()

src/firehose.rs

···
     },
 }
 
-impl Into<sync::subscribe_repos::RepoOp> for RepoOp {
-    fn into(self) -> sync::subscribe_repos::RepoOp {
-        let (action, cid, prev, path) = match self {
+impl From<RepoOp> for sync::subscribe_repos::RepoOp {
+    fn from(val: RepoOp) -> Self {
+        let (action, cid, prev, path) = match val {
             RepoOp::Create { cid, path } => ("create", Some(cid), None, path),
             RepoOp::Update { cid, path, prev } => ("update", Some(cid), Some(prev), path),
             RepoOp::Delete { path, prev } => ("delete", None, Some(prev), path),
···
             prev_data: val.pcid.map(atrium_api::types::CidLink),
             rebase: false,
             repo: val.did,
-            rev: Tid::new(val.rev).unwrap(),
+            rev: Tid::new(val.rev).expect("should be valid revision"),
             seq: 0,
             since: None,
             time: Datetime::now(),

src/oauth.rs

···
 use crate::metrics::AUTH_FAILED;
 use crate::{AppConfig, AppState, Client, Db, Error, Result, SigningKey};
 use anyhow::{Context as _, anyhow};
-use argon2::{Argon2, PasswordHash, PasswordVerifier};
-use atrium_crypto::keypair::Did;
+use argon2::{Argon2, PasswordHash, PasswordVerifier as _};
+use atrium_crypto::keypair::Did as _;
 use axum::response::Redirect;
 use axum::{
     Json, Router, extract,
···
     response::IntoResponse,
     routing::{get, post},
 };
-use base64::Engine;
+use base64::Engine as _;
 use metrics::counter;
 use rand::distributions::Alphanumeric;
-use rand::{Rng, thread_rng};
+use rand::{Rng as _, thread_rng};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
-use sha2::Digest;
+use sha2::Digest as _;
 use std::collections::{HashMap, HashSet};
 
 /// JWK thumbprint required properties for each key type (RFC7638)
···
     ("RSA", &["e", "kty", "n"]),
 ];
 
+/// JWT ID used record for tracking used JTIs to prevent replay attacks
+#[derive(Debug, Serialize, Deserialize)]
+struct JtiRecord {
+    expires_at: i64,
+    issuer: String,
+    jti: String,
+}
+
 /// Parses a JWT without validation and returns header and claims
 fn parse_jwt(token: &str) -> Result<(Value, Value)> {
     let parts: Vec<&str> = token.split('.').collect();
···
     }
 
     let header_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
-        .decode(parts[0])
+        .decode(parts.first().expect("should have JWT header"))
         .context("Failed to decode JWT header")?;
 
     let header: Value =
         serde_json::from_slice(&header_bytes).context("Failed to parse JWT header as JSON")?;
 
     let claims_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD
-        .decode(parts[1])
+        .decode(parts.get(1).expect("should have JWT claims"))
         .context("Failed to decode JWT claims")?;
 
     let claims: Value =
···
     // Find required properties for this key type
     let required_props = JWK_REQUIRED_PROPS
         .iter()
-        .find(|(kty, _)| *kty == key_type)
-        .map(|(_, props)| *props)
-        .context(format!("Unsupported key type: {}", key_type))?;
+        .find(|&&(kty, _)| kty == key_type)
+        .map(|&(_, props)| props)
+        .context(anyhow!("Unsupported key type: {key_type}"))?;
 
     // Build a new JWK with only the required properties
     let mut canonical_jwk = serde_json::Map::new();
 
-    for prop in required_props {
+    for &prop in required_props {
         let value = jwk
             .get(prop)
-            .context(format!("JWK missing required property: {}", prop))?;
-        drop(canonical_jwk.insert(prop.to_string(), value.clone()));
+            .context(anyhow!("JWK missing required property: {prop}"))?;
+        drop(canonical_jwk.insert((*prop).to_string(), value.clone()));
     }
 
     // Serialize with no whitespace
···
     })))
 }
 
-/// Fetch and validate client metadata from client_id URL
+/// Fetch and validate client metadata from `client_id` URL
 async fn fetch_client_metadata(client: &Client, client_id: &str) -> Result<Value> {
     // Handle localhost development
     if client_id.starts_with("http://localhost") {
···
         });
 
         // Extract redirect_uri from query params if available
-        let redirect_uris = if let Some(query) = client_url.query() {
-            let pairs: HashMap<_, _> = url::form_urlencoded::parse(query.as_bytes()).collect();
-            if let Some(uri) = pairs.get("redirect_uri") {
-                vec![json!(uri)]
-            } else {
+        let redirect_uris = client_url.query().map_or_else(
+            || {
                 vec![
                     json!("http://127.0.0.1/callback"),
                     json!("http://[::1]/callback"),
                 ]
-            }
-        } else {
-            vec![
-                json!("http://127.0.0.1/callback"),
-                json!("http://[::1]/callback"),
-            ]
-        };
+            },
+            |query| {
+                let pairs: HashMap<_, _> = url::form_urlencoded::parse(query.as_bytes()).collect();
+                pairs.get("redirect_uri").map_or_else(
+                    || {
+                        vec![
+                            json!("http://127.0.0.1/callback"),
+                            json!("http://[::1]/callback"),
+                        ]
+                    },
+                    |uri| vec![json!(uri)],
+                )
+            },
+        );
 
-        metadata["redirect_uris"] = json!(redirect_uris);
+        if let Some(redirect_uris_value) = metadata.as_object_mut() {
+            drop(redirect_uris_value.insert("redirect_uris".to_owned(), json!(redirect_uris)));
+        }
+
         return Ok(metadata);
     }
 
···
     // Validate DPoP tokens requirement
     if !metadata
         .get("dpop_bound_access_tokens")
-        .and_then(|v| v.as_bool())
+        .and_then(Value::as_bool)
         .unwrap_or(false)
     {
         return Err(Error::with_status(
···
     Ok(metadata)
 }
 
-/// JWT ID used record for tracking used JTIs to prevent replay attacks
-#[derive(Debug, Serialize, Deserialize)]
-struct JtiRecord {
-    jti: String,
-    issuer: String,
-    expires_at: i64,
-}
-
 /// Pushed Authorization Request endpoint
 /// POST `/oauth/par`
+#[expect(clippy::too_many_lines)]
 async fn par(
     State(db): State<Db>,
     State(client): State<Client>,
···
             .and_then(|uris| uris.as_array())
             .context("client metadata missing redirect_uris")?;
 
-        let uri_valid = allowed_uris.iter().any(|uri| {
-            uri.as_str()
-                .map_or(false, |uri_str| uri_str == provided_uri)
-        });
+        let uri_valid = allowed_uris
+            .iter()
+            .any(|uri| uri.as_str().is_some_and(|uri_str| uri_str == provided_uri));
 
         if !uri_valid {
             return Err(Error::with_status(
···
     } else if client_metadata
         .get("redirect_uris")
         .and_then(|uris| uris.as_array())
-        .map_or(0, |uris| uris.len())
+        .map_or(0, Vec::len)
         != 1
     {
         return Err(Error::with_status(
···
         .take(32)
         .map(char::from)
         .collect::<String>();
-    let request_uri = format!("urn:ietf:params:oauth:request_uri:req-{}", request_id);
+    let request_uri = format!("urn:ietf:params:oauth:request_uri:req-{request_id}");
 
     // Store request data in the database
     let now = chrono::Utc::now();
···
 
     Ok(Json(json!({
         "request_uri": request_uri,
-        "expires_in": 300 // 5 minutes
+        "expires_in": 300_i32 // 5 minutes
     })))
 }
 
···
 
 /// OAuth Authorization Sign-in endpoint
 /// POST `/oauth/authorize/sign-in`
+#[expect(clippy::too_many_lines)]
 async fn authorize_signin(
     State(db): State<Db>,
     State(config): State<AppConfig>,
     State(client): State<Client>,
     extract::Form(form_data): extract::Form<HashMap<String, String>>,
 ) -> Result<impl IntoResponse> {
+    use std::fmt::Write as _;
+
     // Extract form data
     let username = form_data.get("username").context("username is required")?;
     let password = form_data.get("password").context("password is required")?;
···
     .context("failed to query database")?
     .context("user not found")?;
 
-    // Verify password
-    match Argon2::default().verify_password(
+    // Verify password - fixed to use equality check instead of pattern matching
+    if Argon2::default().verify_password(
         password.as_bytes(),
         &PasswordHash::new(account.password.as_str()).context("invalid password hash in db")?,
-    ) {
-        Ok(()) => {}
-        Err(_) => {
-            counter!(AUTH_FAILED).increment(1);
-            return Err(Error::with_status(
-                StatusCode::UNAUTHORIZED,
-                anyhow!("invalid credentials"),
-            ));
-        }
+    ) == Ok(())
+    {
+    } else {
+        counter!(AUTH_FAILED).increment(1);
+        return Err(Error::with_status(
+            StatusCode::UNAUTHORIZED,
+            anyhow!("invalid credentials"),
+        ));
     }
 
     // Generate authorization code
···
         .collect::<String>();
 
     // Determine redirect URI to use
-    let redirect_uri = if let Some(uri) = &par_request.redirect_uri {
+    let redirect_uri = if let Some(uri) = par_request.redirect_uri.as_ref() {
         uri.clone()
     } else {
         let client_metadata = fetch_client_metadata(&client, client_id).await?;
···
             .and_then(|uris| uris.first())
             .and_then(|uri| uri.as_str())
             .context("No redirect_uri available")?
-            .to_string()
+            .to_owned()
     };
 
     // Store the authorization code
···
     });
 
     // Build redirect URL
-    let mut redirect_url = redirect_uri;
-    match par_request.response_mode {
-        None => redirect_url.push_str("?"), // Default to query
-        Some(response_mode) => match response_mode.as_str() {
-            "query" => redirect_url.push_str("?"),
-            "fragment" => redirect_url.push_str("#"),
-            _ => redirect_url.push_str("?"), // Default to query
-        },
-    };
-    redirect_url.push_str(&format!("state={}", urlencoding::encode(&state)));
+    let mut redirect_target = redirect_uri;
+    match par_request.response_mode.as_deref() {
+        Some("fragment") => redirect_target.push('#'),
+        _ => redirect_target.push('?'),
+    }
+
+    write!(redirect_target, "state={}", urlencoding::encode(&state)).unwrap();
     let host_name = format!("https://{}", &config.host_name);
-    redirect_url.push_str(&format!("&iss={}", urlencoding::encode(&host_name)));
-    redirect_url.push_str(&format!("&code={}", urlencoding::encode(&code)));
-    Ok(Redirect::to(&redirect_url))
+    write!(redirect_target, "&iss={}", urlencoding::encode(&host_name)).unwrap();
+    write!(redirect_target, "&code={}", urlencoding::encode(&code)).unwrap();
+    Ok(Redirect::to(&redirect_target))
 }
 
 /// Verify a DPoP proof and return the JWK thumbprint
···
     let (header, claims) = parse_jwt(dpop_token)?;
 
     // Verify "typ" is "dpop+jwt"
-    if header.get("typ").and_then(|t| t.as_str()) != Some("dpop+jwt") {
+    if header.get("typ").and_then(Value::as_str) != Some("dpop+jwt") {
         return Err(Error::with_status(
             StatusCode::BAD_REQUEST,
             anyhow!("Invalid DPoP token type"),
···
     // Verify required claims
     let jti = claims
         .get("jti")
-        .and_then(|j| j.as_str())
+        .and_then(Value::as_str)
         .context("Missing jti claim in DPoP token")?;
 
     // Check for token expiration
+    #[expect(clippy::arithmetic_side_effects)]
     let exp = claims
         .get("exp")
-        .and_then(|e| e.as_i64())
+        .and_then(Value::as_i64)
         .unwrap_or_else(|| chrono::Utc::now().timestamp() + 60); // Default 60s if not specified
 
     let now = chrono::Utc::now().timestamp();
···
     }
 
     // Check htm (HTTP method) claim
-    if claims.get("htm").and_then(|m| m.as_str()) != Some(http_method) {
+    if claims.get("htm").and_then(Value::as_str) != Some(http_method) {
         return Err(Error::with_status(
             StatusCode::BAD_REQUEST,
             anyhow!("Invalid htm claim in DPoP token"),
···
     }
 
     // Check htu (HTTP URI) claim
-    if claims.get("htu").and_then(|u| u.as_str()) != Some(http_uri) {
+    if claims.get("htu").and_then(Value::as_str) != Some(http_uri) {
         return Err(Error::with_status(
             StatusCode::BAD_REQUEST,
             anyhow!(
                 "Invalid htu claim in DPoP token: expected {}, got {}",
                 http_uri,
-                claims.get("htu").and_then(|u| u.as_str()).unwrap_or("None")
+                claims.get("htu").and_then(Value::as_str).unwrap_or("None")
             ),
         ));
     }
···
     .context("failed to store JTI")?;
 
     // Cleanup expired JTIs periodically (1% chance on each request)
-    if thread_rng().gen_range(0..100) == 0 {
+    if thread_rng().gen_range(0_i32..100_i32) == 0_i32 {
         _ = sqlx::query!(r#"DELETE FROM oauth_used_jtis WHERE expires_at < ?"#, now)
             .execute(db)
             .await
···
     Ok(thumbprint)
 }
 
-/// Verify a code_verifier against stored code_challenge
+/// Verify a `code_verifier` against stored `code_challenge`
 fn verify_pkce(code_verifier: &str, stored_challenge: &str, method: &str) -> Result<()> {
     // Only S256 is supported currently
     if method != "S256" {
···
 /// OAuth token endpoint
 /// - POST `/oauth/token`
 ///
-/// Handles both authorization_code and refresh_token grants
+/// Handles both `authorization_code` and `refresh_token` grants
+#[expect(clippy::too_many_lines)]
 async fn token(
     State(db): State<Db>,
     State(skey): State<SigningKey>,
···
             // Generate tokens
             let now = chrono::Utc::now().timestamp();
             let access_token_expires_in = 3600; // 1 hour
+            #[expect(clippy::arithmetic_side_effects)]
             let access_token_expires_at = now + access_token_expires_in;
-            let refresh_token_expires_at = now + 2592000; // 30 days
+            #[expect(clippy::arithmetic_side_effects)]
+            let refresh_token_expires_at = now + 2_592_000; // 30 days
 
             // Create access token
             let access_token_claims = json!({
···
             // Generate new tokens
             let now = chrono::Utc::now().timestamp();
             let access_token_expires_in = 3600; // 1 hour
+            #[expect(clippy::arithmetic_side_effects)]
             let access_token_expires_at = now + access_token_expires_in;
-            let refresh_token_expires_at = now + 2592000; // 30 days
+            #[expect(clippy::arithmetic_side_effects)]
+            let refresh_token_expires_at = now + 2_592_000; // 30 days
 
             // Create access token
             let access_token_claims = json!({
···
     // For a real implementation, you would construct a proper JWK
     // with all the required fields based on the key type
 
-    let key_did = skey.did();
+    let did_string = skey.did();
 
     // Extract the key ID from the DID string
     // did:key:z... format, where z... is the multibase-encoded public key
-    let key_id = key_did.strip_prefix("did:key:").unwrap_or(&key_did);
+    let key_id = did_string.strip_prefix("did:key:").unwrap_or(&did_string);
 
     let jwk = json!({
         "kty": "EC",
···
 ) -> Result<Json<Value>> {
     // Extract required parameters
     let token = form_data.get("token").context("token is required")?;
-    let refresh_token_string = "refresh_token".to_string();
+    let refresh_token_string = "refresh_token".to_owned();
     let token_type_hint = form_data
         .get("token_type_hint")
         .unwrap_or(&refresh_token_string);
···
     let token_type_hint = form_data.get("token_type_hint");
 
     // Parse the token
-    let (typ, claims) = match crate::auth::verify(&skey.did(), token) {
-        Ok(result) => result,
-        Err(_) => {
-            // Per RFC7662, invalid tokens return { "active": false }
-            return Ok(Json(json!({"active": false})));
-        }
+    let Ok((typ, claims)) = crate::auth::verify(&skey.did(), token) else {
+        // Per RFC7662, invalid tokens return { "active": false }
+        return Ok(Json(json!({"active": false})));
     };
 
     // Check token type
···
     }
 
     // Check expiration
-    if let Some(exp) = claims.get("exp").and_then(|v| v.as_i64()) {
+    if let Some(exp) = claims.get("exp").and_then(Value::as_i64) {
         let now = chrono::Utc::now().timestamp();
         if now >= exp {
             return Ok(Json(json!({"active": false})));
···
     }
 
     // Token is valid, return introspection info
-    let subject = claims.get("sub").and_then(|v| v.as_str());
-    let client_id = claims.get("aud").and_then(|v| v.as_str());
-    let scope = claims.get("scope").and_then(|v| v.as_str());
-    let expiration = claims.get("exp").and_then(|v| v.as_i64());
-    let issued_at = claims.get("iat").and_then(|v| v.as_i64());
+    let subject = claims.get("sub").and_then(Value::as_str);
+    let client_id = claims.get("aud").and_then(Value::as_str);
+    let scope = claims.get("scope").and_then(Value::as_str);
+    let expiration = claims.get("exp").and_then(Value::as_i64);
+    let issued_at = claims.get("iat").and_then(Value::as_i64);
 
     Ok(Json(json!({
         "active": true,

src/tests.rs

···
 //! Testing utilities for the PDS.
-
+#![expect(clippy::arbitrary_source_item_ordering)]
 use std::{
     net::{IpAddr, Ipv4Addr, SocketAddr, TcpListener},
     path::PathBuf,
-    sync::Arc,
     time::{Duration, Instant},
 };
 
-use anyhow::{Context as _, Result};
+use anyhow::Result;
 use atrium_api::{
     com::atproto::server,
-    types::{
-        Unknown,
-        string::{AtIdentifier, Did, Handle, Nsid, RecordKey},
-    },
+    types::string::{AtIdentifier, Did, Handle, Nsid, RecordKey},
 };
 use figment::{Figment, providers::Format as _};
 use futures::future::join_all;
-use rand::{Rng, thread_rng};
 use serde::{Deserialize, Serialize};
 use tokio::sync::OnceCell;
 use uuid::Uuid;
 
-use crate::{AppState, auth::AuthenticatedUser, config::AppConfig};
+use crate::config::AppConfig;
 
 /// Global test state, created once for all tests.
 pub(crate) static TEST_STATE: OnceCell<TestState> = OnceCell::const_new();
···
 
 impl Drop for TempDir {
     fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.path);
+        drop(std::fs::remove_dir_all(&self.path));
     }
 }
 
 /// Test state for the application.
 pub(crate) struct TestState {
-    /// The temporary directory for test data.
-    temp_dir: TempDir,
     /// The address the test server is listening on.
     address: SocketAddr,
+    /// The HTTP client.
+    client: reqwest::Client,
     /// The application configuration.
     config: AppConfig,
-    /// The HTTP client.
-    client: reqwest::Client,
+    /// The temporary directory for test data.
+    #[expect(dead_code)]
+    temp_dir: TempDir,
 }
 
 impl TestState {
-    /// Create a new test state.
-    async fn new() -> Result<Self> {
-        // Create a temporary directory for test data
-        let temp_dir = TempDir::new()?;
+    /// Get a base URL for the test server.
+    pub(crate) fn base_url(&self) -> String {
+        format!("http://{}", self.address)
+    }
+
+    /// Create a test account.
+    pub(crate) async fn create_test_account(&self) -> Result<TestAccount> {
+        // Create the account
+        let handle = "test.handle";
+        let response = self
+            .client
+            .post(format!(
+                "http://{}/xrpc/com.atproto.server.createAccount",
+                self.address
+            ))
+            .json(&server::create_account::InputData {
+                did: None,
+                verification_code: None,
+                verification_phone: None,
+                email: Some(format!("{}@example.com", &handle)),
+                handle: Handle::new(handle.to_owned()).expect("should be able to create handle"),
+                password: Some("password123".to_owned()),
+                invite_code: None,
+                recovery_key: None,
+                plc_op: None,
+            })
+            .send()
+            .await?;
 
-        // Find a free port
-        let listener = TcpListener::bind(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0))?;
-        let address = listener.local_addr()?;
-        drop(listener);
+        let account: server::create_account::Output = response.json().await?;
 
+        Ok(TestAccount {
+            handle: handle.to_owned(),
+            did: account.did.to_string(),
+            access_token: account.access_jwt.clone(),
+            refresh_token: account.refresh_jwt.clone(),
+        })
+    }
+
+    /// Create a new test state.
+    #[expect(clippy::unused_async)]
+    async fn new() -> Result<Self> {
         // Configure the test app
         #[derive(Serialize, Deserialize)]
         struct TestConfigInput {
+            db: Option<String>,
             host_name: Option<String>,
-            db: Option<String>,
+            key: Option<PathBuf>,
             listen_address: Option<SocketAddr>,
-            key: Option<PathBuf>,
             test: Option<bool>,
         }
+        // Create a temporary directory for test data
+        let temp_dir = TempDir::new()?;
+
+        // Find a free port
+        let listener = TcpListener::bind(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0))?;
+        let address = listener.local_addr()?;
+        drop(listener);
 
         let test_config = TestConfigInput {
+            db: Some(format!("sqlite://{}/test.db", temp_dir.path().display())),
             host_name: Some(format!("localhost:{}", address.port())),
-            db: Some(format!("sqlite://{}/test.db", temp_dir.path().display())),
+            key: Some(temp_dir.path().join("test.key")),
             listen_address: Some(address),
-            key: Some(temp_dir.path().join("test.key")),
             test: Some(true),
         };
 
···
             .build()?;
 
         Ok(Self {
-            temp_dir,
             address,
-            config,
             client,
+            config,
+            temp_dir,
         })
     }
 
···
         let address = self.address;
 
         // Start the application in a background task
-        tokio::spawn(async move {
+        let _handle = tokio::spawn(async move {
             // Set up the application
             use crate::*;
 
             // Initialize metrics (noop in test mode)
-            let _ = metrics::setup(None);
+            drop(metrics::setup(None));
 
             // Create client
             let simple_client = reqwest::Client::builder()
···
                 .context("failed to build requester client")?;
             let client = reqwest_middleware::ClientBuilder::new(simple_client.clone())
                 .with(http_cache_reqwest::Cache(http_cache_reqwest::HttpCache {
-                    mode: http_cache_reqwest::CacheMode::Default,
-                    manager: http_cache_reqwest::MokaManager::default(),
-                    options: http_cache_reqwest::HttpCacheOptions::default(),
+                    mode: CacheMode::Default,
+                    manager: MokaManager::default(),
+                    options: HttpCacheOptions::default(),
                 }))
                 .build();
 
             // Create a test keypair
-            std::fs::create_dir_all(&config.key.parent().context("should have parent")?)?;
+            std::fs::create_dir_all(config.key.parent().context("should have parent")?)?;
             let (skey, rkey) = {
-                let skey =
-                    atrium_crypto::keypair::Secp256k1Keypair::create(&mut rand::thread_rng());
-                let rkey =
-                    atrium_crypto::keypair::Secp256k1Keypair::create(&mut rand::thread_rng());
+                let skey = Secp256k1Keypair::create(&mut rand::thread_rng());
+                let rkey = Secp256k1Keypair::create(&mut rand::thread_rng());
 
                 let keys = KeyData {
                     skey: skey.export(),
···
             };
 
             // Set up database
-            let opts = sqlx::sqlite::SqliteConnectOptions::from_str(&config.db)
+            let opts = SqliteConnectOptions::from_str(&config.db)
                 .context("failed to parse database options")?
                 .create_if_missing(true);
-            let db = sqlx::SqlitePool::connect_with(opts).await?;
+            let db = SqlitePool::connect_with(opts).await?;
 
             sqlx::migrate!()
                 .run(&db)
···
             };
 
             // Create the router
-            let app = axum::Router::new()
-                .route("/", axum::routing::get(crate::index))
-                .merge(crate::oauth::routes())
+            let app = Router::new()
+                .route("/", get(index))
+                .merge(oauth::routes())
                 .nest(
                     "/xrpc",
-                    crate::endpoints::routes()
-                        .merge(crate::actor_endpoints::routes())
-                        .fallback(crate::service_proxy),
+                    endpoints::routes()
+                        .merge(actor_endpoints::routes())
+                        .fallback(service_proxy),
                 )
-                .layer(tower_http::cors::CorsLayer::permissive())
-                .layer(tower_http::trace::TraceLayer::new_for_http())
+                .layer(CorsLayer::permissive())
+                .layer(TraceLayer::new_for_http())
                 .with_state(app_state);
 
-            println!("Test server listening on {address}");
-
             // Listen for connections
-            let listener = tokio::net::TcpListener::bind(&address)
+            let listener = TcpListener::bind(&address)
                 .await
                 .context("failed to bind address")?;
 
···
 
         Ok(())
     }
-
-    /// Create a test account.
-    pub async fn create_test_account(&self) -> Result<TestAccount> {
-        let handle = "test.handle";
-        println!("Creating test account with handle: {}", handle);
-
-        // Create the account
-        let response = self
-            .client
-            .post(&format!(
-                "http://{}/xrpc/com.atproto.server.createAccount",
-                self.address
-            ))
-            .json(&server::create_account::InputData {
-                did: None,
-                verification_code: None,
-                verification_phone: None,
-                email: Some(format!("{}@example.com", &handle)),
-                handle: Handle::new(handle.to_owned()).expect("should be able to create handle"),
-                password: Some("password123".to_string()),
-                invite_code: None,
-                recovery_key: None,
-                plc_op: None,
-            })
-            .send()
-            .await?;
-
-        let account: server::create_account::Output = response.json().await?;
-
-        Ok(TestAccount {
-            handle: handle.to_owned(),
-            did: account.did.to_string(),
-            access_token: account.access_jwt.clone(),
-            refresh_token: account.refresh_jwt.clone(),
-        })
-    }
-
-    /// Get a base URL for the test server.
-    pub fn base_url(&self) -> String {
-        format!("http://{}", self.address)
-    }
 }
 
 /// A test account that can be used for testing.
-pub struct TestAccount {
-    /// The account handle.
-    pub handle: String,
-    /// The account DID.
-    pub did: String,
+pub(crate) struct TestAccount {
     /// The access token for the account.
-    pub access_token: String,
+    pub(crate) access_token: String,
+    /// The account DID.
+    pub(crate) did: String,
+    /// The account handle.
+    pub(crate) handle: String,
     /// The refresh token for the account.
-    pub refresh_token: String,
+    #[expect(dead_code)]
+    pub(crate) refresh_token: String,
 }
 
 /// Initialize the test state.
-pub async fn init_test_state() -> Result<&'static TestState> {
-    TEST_STATE
-        .get_or_try_init(|| async {
-            let state = TestState::new().await?;
-            state.start_app().await?;
-            Ok(state)
-        })
-        .await
+pub(crate) async fn init_test_state() -> Result<&'static TestState> {
+    async fn init_test_state() -> std::result::Result<TestState, anyhow::Error> {
+        let state = TestState::new().await?;
+        state.start_app().await?;
+        Ok(state)
+    }
+    TEST_STATE.get_or_try_init(init_test_state).await
 }
 
 /// Create a record benchmark that creates records and measures the time it takes.
-pub async fn create_record_benchmark(count: usize, concurrent: usize) -> Result<Duration> {
+#[expect(
+    clippy::arithmetic_side_effects,
+    clippy::integer_division,
+    clippy::integer_division_remainder_used,
+    clippy::use_debug,
+    clippy::print_stdout
+)]
+pub(crate) async fn create_record_benchmark(count: usize, concurrent: usize) -> Result<Duration> {
     // Initialize the test state
     let state = init_test_state().await?;
 
···
                 let record_idx = batch_idx * batch_size + i;
 
                 let result = client
-                    .post(&format!("{}/xrpc/com.atproto.repo.createRecord", base_url))
-                    .header("Authorization", format!("Bearer {}", access_token))
+                    .post(format!("{base_url}/xrpc/com.atproto.repo.createRecord"))
+                    .header("Authorization", format!("Bearer {access_token}"))
                     .json(&atrium_api::com::atproto::repo::create_record::InputData {
-                        repo: AtIdentifier::Did(Did::new(account_did.clone()).unwrap()),
-                        collection: Nsid::new("app.bsky.feed.post".to_string()).unwrap(),
-                        rkey: Some(RecordKey::new(format!("test-{}", record_idx)).unwrap()),
+                        repo: AtIdentifier::Did(Did::new(account_did.clone()).expect("valid DID")),
+                        collection: Nsid::new("app.bsky.feed.post".to_owned()).expect("valid NSID"),
+                        rkey: Some(
+                            RecordKey::new(format!("test-{record_idx}")).expect("valid record key"),
+                        ),
                         validate: None,
                         record: serde_json::from_str(
                             &serde_json::json!({
                                 "$type": "app.bsky.feed.post",
-                                "text": format!("Test post {} from {}", record_idx, account_handle),
+                                "text": format!("Test post {record_idx} from {account_handle}"),
                                 "createdAt": chrono::Utc::now().to_rfc3339(),
                             })
                             .to_string(),
                         )
-                        .unwrap(),
+                        .expect("valid JSON record"),
                         swap_commit: None,
                     })
                     .send()
···
 
                 let request_duration = request_start.elapsed();
                 if record_idx % 10 == 0 {
-                    println!("Created record {} in {:?}", record_idx, request_duration);
+                    println!("Created record {record_idx} in {request_duration:?}");
                 }
                 results.push(result);
             }
···
     let results = join_all(handles).await;
 
     // Check for errors
-    for result in results {
-        let batch_results = result?;
-        for result in batch_results {
-            match result {
+    for batch_result in results {
+        let batch_responses = batch_result?;
+        for response_result in batch_responses {
+            match response_result {
                 Ok(response) => {
                     if !response.status().is_success() {
                         return Err(anyhow::anyhow!(
···
 }
 
 #[cfg(test)]
+#[expect(clippy::module_inception, clippy::use_debug, clippy::print_stdout)]
 mod tests {
     use super::*;
+    use anyhow::anyhow;
 
     #[tokio::test]
     async fn test_create_account() -> Result<()> {
···
         let account = state.create_test_account().await?;
 
         println!("Created test account: {}", account.handle);
-        assert!(!account.handle.is_empty());
-        assert!(!account.did.is_empty());
-        assert!(!account.access_token.is_empty());
+        if account.handle.is_empty() {
+            return Err(anyhow::anyhow!("Account handle is empty"));
+        }
+        if account.did.is_empty() {
+            return Err(anyhow::anyhow!("Account DID is empty"));
+        }
+        if account.access_token.is_empty() {
+            return Err(anyhow::anyhow!("Account access token is empty"));
+        }
 
         Ok(())
     }
···
     async fn test_create_record_benchmark() -> Result<()> {
         let duration = create_record_benchmark(100, 1).await?;
 
-        println!("Created 100 records in {:?}", duration);
-        assert!(duration.as_secs() < 100, "Benchmark took too long");
+        println!("Created 100 records in {duration:?}");
+
+        if duration.as_secs() >= 100 {
+            return Err(anyhow!("Benchmark took too long"));
+        }
 
         Ok(())
     }