fix(clippy): apply auto-fixable linting suggestions

Reviewed-on: #83

.woodpecker/server-clippy-fix.yaml

@@ -0,0 +1,45 @@
+when:
+  - event: push
+    branch: main
+    path:
+      include: ['.woodpecker/server-*.yaml', 'server/**']
+
+steps:
+  - name: clippy-fix
+    image: jdxcode/mise:latest
+    directory: server
+    environment:
+      CARGO_TERM_COLOR: always
+      CARGO_TARGET_DIR: /usr/local/cargo/target
+      CARGO_HOME: /usr/local/cargo/registry
+      GITEA_TOKEN:
+        from_secret: GITEA_TOKEN
+      GITEA_URL:
+        from_secret: GITEA_URL
+    volumes:
+      - cargo-target:/usr/local/cargo/target
+      - cargo-registry:/usr/local/cargo/registry
+    commands:
+      - apt-get update && apt-get install -y pkg-config curl
+      - mise install rust
+      - mise install protoc
+      - mise exec rust -- cargo clippy --fix --allow-dirty --all
+      - |
+        cd ..
+        if git diff --quiet HEAD; then
+          echo "No machine-applicable clippy fixes found, nothing to do."
+          exit 0
+        fi
+        git config user.email "bot@arbiter"
+        git config user.name "Clippy Bot"
+        git add -A
+        git commit -m "fix(clippy): apply auto-fixable linting suggestions"
+        git config http.extraHeader "Authorization: token ${GITEA_TOKEN}"
+        git push --force origin HEAD:refs/heads/bot/clippy-fixes
+        HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+          -X POST "${GITEA_URL}/api/v1/repos/${CI_REPO}/pulls" \
+          -H "Authorization: token ${GITEA_TOKEN}" \
+          -H "Content-Type: application/json" \
+          -d "{\"title\":\"fix(clippy): apply auto-fixable linting suggestions\",\"head\":\"bot/clippy-fixes\",\"base\":\"main\",\"body\":\"Automated clippy fixes generated by CI bot.\"}")
+        echo "Gitea API response: ${HTTP_STATUS}"
+        [ "$HTTP_STATUS" = "201" ] || [ "$HTTP_STATUS" = "409" ] || [ "$HTTP_STATUS" = "422" ] || exit 1

server/crates/arbiter-client/src/auth.rs

@@ -100,7 +100,7 @@ async fn send_auth_challenge_solution(
     key: &SigningKey,
     challenge: AuthChallenge,
 ) -> Result<(), AuthError> {
-    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
+    let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
     let challenge = authn::AuthChallenge {
         nonce: *challenge
             .random

server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs

@@ -11,7 +11,9 @@ use kameo::{
     prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
     reply::ReplySender,
 };
-use std::ops::ControlFlow;
+use std::{ops::ControlFlow, time::Duration};
+
+const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
 
 pub struct Args {
     pub client: ClientProfile,
@@ -64,6 +66,14 @@ impl Actor for ClientApprovalController {
                 .await;
         }
 
+        let weak = actor_ref.downgrade();
+        tokio::spawn(async move {
+            tokio::time::sleep(APPROVAL_TIMEOUT).await;
+            if let Some(r) = weak.upgrade() {
+                let _ = r.tell(OnApprovalTimeout {}).await;
+            }
+        });
+
         Ok(this)
     }
 
@@ -104,4 +114,14 @@ impl ClientApprovalController {
             ctx.stop();
         }
     }
+
+    /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
+    /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
+    #[message(ctx)]
+    pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
+        if self.pending > 0 {
+            self.send_reply(Ok(false));
+            ctx.stop();
+        }
+    }
 }

server/crates/arbiter-server/src/grpc/client/auth.rs

@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        as u64,
+                        .cast_unsigned(),
                     random: challenge.nonce.to_vec(),
                 })
             }

server/crates/arbiter-server/src/grpc/operator/auth.rs

@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
                         .timestamp
                         .timestamp_nanos_opt()
                         .expect("timestamp within range")
-                        as u64,
+                        .cast_unsigned(),
                     random: challenge.nonce.to_vec(),
                 })
             }

server/crates/arbiter-server/src/peers/client/auth.rs

@@ -298,7 +298,7 @@ where
 
     let signature = expect_message(transport, |req: Inbound| match req {
         Inbound::AuthChallengeSolution { signature } => Some(signature),
-        _ => None,
+        Inbound::AuthChallengeRequest { .. } => None,
     })
     .await
     .map_err(|e| {

server/crates/arbiter-server/src/peers/operator/auth/state.rs

@@ -127,8 +127,6 @@ where
         })
     }
 
-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
     async fn verify_solution(
         &mut self,
         ChallengeContext {

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -212,8 +212,7 @@ impl OperatorSession {
         &mut self,
     ) -> Result<Vec<EvmWalletAccess>, Error> {
         let mut conn = self.props.db.get().await?;
-        use crate::db::schema::evm_wallet_access;
-        let access_entries = evm_wallet_access::table
+        let access_entries = crate::db::schema::evm_wallet_access::table
             .select(EvmWalletAccess::as_select())
             .load::<_>(&mut conn)
             .await?;

server/crates/arbiter-server/src/peers/operator/session/mod.rs

@@ -1,7 +1,7 @@
 use super::{OutOfBand, OperatorConnection};
 use crate::{
     actors::{
-        flow_coordinator::client_connect_approval::ClientApprovalController,
+        flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController},
         operator_registry::ConnectOperator,
     },
     peers::client::ClientProfile,
@@ -63,7 +63,7 @@ impl OperatorSession {
         Self {
             props,
             sender,
-            pending_client_approvals: Default::default(),
+            pending_client_approvals: HashMap::default(),
         }
     }
 }
@@ -88,6 +88,7 @@ impl OperatorSession {
                 actor = "operator",
                 event = "failed to announce new client connection"
             );
+            let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
             return;
         }
 

server/crates/arbiter-server/tests/operator/auth.rs

@@ -400,7 +400,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
     let challenge = match response {
         Ok(resp) => match resp {
             auth::Outbound::AuthChallenge { challenge } => challenge,
-            other => panic!("Expected AuthChallenge, got {other:?}"),
+            other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
         },
         Err(err) => panic!("Expected Ok response, got Err({err:?})"),
     };

server/crates/arbiter-server/tests/vault/lifecycle.rs

@@ -14,7 +14,7 @@ use diesel_async::RunQueryDsl;
 
 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap() {
+async fn bootstrap() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
         .await
@@ -39,7 +39,7 @@ async fn test_bootstrap() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_bootstrap_rejects_double() {
+async fn bootstrap_rejects_double() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -50,7 +50,7 @@ async fn test_bootstrap_rejects_double() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_create_new_before_bootstrap_fails() {
+async fn create_new_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
@@ -65,7 +65,7 @@ async fn test_create_new_before_bootstrap_fails() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_decrypt_before_bootstrap_fails() {
+async fn decrypt_before_bootstrap_fails() {
     let db = db::create_test_pool().await;
     let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
         .await
@@ -77,7 +77,7 @@ async fn test_decrypt_before_bootstrap_fails() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_new_restores_sealed_state() {
+async fn new_restores_sealed_state() {
     let db = db::create_test_pool().await;
     let actor = common::bootstrapped_vault(&db).await;
     drop(actor);
@@ -91,7 +91,7 @@ async fn test_new_restores_sealed_state() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_correct_password() {
+async fn unseal_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -114,7 +114,7 @@ async fn test_unseal_correct_password() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_unseal_wrong_then_correct_password() {
+async fn unseal_wrong_then_correct_password() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 

server/crates/arbiter-server/tests/vault/storage.rs

@@ -12,7 +12,7 @@ use std::collections::HashSet;
 
 #[tokio::test]
 #[test_log::test]
-async fn test_create_decrypt_roundtrip() {
+async fn create_decrypt_roundtrip() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -28,7 +28,7 @@ async fn test_create_decrypt_roundtrip() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_decrypt_nonexistent_returns_not_found() {
+async fn decrypt_nonexistent_returns_not_found() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -38,7 +38,7 @@ async fn test_decrypt_nonexistent_returns_not_found() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_ciphertext_differs_across_entries() {
+async fn ciphertext_differs_across_entries() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;
 
@@ -76,7 +76,7 @@ async fn test_ciphertext_differs_across_entries() {
 
 #[tokio::test]
 #[test_log::test]
-async fn test_nonce_never_reused() {
+async fn nonce_never_reused() {
     let db = db::create_test_pool().await;
     let mut actor = common::bootstrapped_vault(&db).await;