Introduces CsrfForm<T>: a FromRequest extractor that looks up the
session's csrf_token and constant-time-compares it to a csrf_token
field in the form body. Drop-in replacement for Form<T> on every
state-changing /web/ POST handler. Missing or expired session →
redirect to /web/login; malformed body → 400; token mismatch → 403.
WebSession carries csrf_token, minted alongside the session token at
login and magic-link consume. Not rotated per request — rotation
would break multi-tab use and buys little over SameSite=Strict
cookies.
Handlers: bulk, purge-closed, reset, close, reopen, analyze,
delete-recording, logout all now require CsrfForm<_>. Login stays
unprotected (SameSite=Strict alone is sufficient — forced-login CSRF
has no impact on this codebase). /api/... is header-auth, exempt.
Constant-time compare via subtle::ConstantTimeEq avoids timing
oracles on the token.
Template work is NOT in this commit — browser forms still post
without csrf_token, so the live web UI will 403 until Schritt 6
(templates render the hidden field).
Tests: all 12 red specs in csrf_attack_test.rs now green, #[ignore]
removed. Integration tests that POSTed to protected endpoints
switched to a new create_router_and_session_store entrypoint which
returns a handle to the store so tests can read csrf_token for the
active session.
Introduces a system for broadcasting real-time events to the web UI.
This enables features like automatic page reloads when case data changes
in the background, improving the user experience by keeping the UI
synchronized with the backend.
Key components:
- `events` module: Contains the `CaseEventKind` enum, `CaseEvent`
struct, and `EventSender` type for managing the broadcast channel.
- SSE endpoint (`/web/events`): Streams events to connected browsers.
- Client-side JavaScript: Listens for events and triggers debounced page
reloads.
- Integration points: Workers and route handlers now emit events when
relevant state changes occur.
The TOML dependency is added to `Cargo.lock` to support configuration
file parsing.
New modules `config` and `startup` are introduced in
`doctate-client-core`:
- `config`: Handles client configuration loading and saving, including
defaults for polling intervals and window hours.
- `startup`: Contains routines for initial cleanup tasks, such as
removing stale markers and orphan audio files based on defined
retention periods.
This commit introduces a new startup cleanup routine for the Doctate
client.
The cleanup process reaps stale markers and orphaned audio files to
adhere to data minimization principles and maintain client efficiency.
Specifically, it performs the following actions:
- Removes markers that are older than 72 hours and have been confirmed
by
the server. This ensures that old, irrelevant metadata is purged.
- Cleans up orphaned audio files (e.g., `.m4a` without corresponding
`.meta.json` or vice-versa) that are older than 24 hours. This
prevents the accumulation of audio data that will never be uploaded,
as such files are silently ignored by the uploader.
- Removes any temporary files (`.tmp`) left over from interrupted
writes,
as these are considered invalid at startup.
The `filetime` crate is added as a dependency to facilitate setting
modification times for testing purposes.
This commit introduces a new poller to the desktop client, responsible
for fetching case markers and their one-liners. It also integrates a
case list UI, allowing users to view and interact with their cases.
Key changes include:
- **New Dependencies**: Added `doctate-client-core`, `time`, and
`webbrowser` to `Cargo.lock`.
- **Background Task Spawning**: Refactored `spawn_uploader` to
`spawn_background` to include the new `OnelinerPoller` and its
dependencies.
- **Case Store Integration**: The `DoctateApp` now initializes and uses
a `CaseStore` to manage case markers.
- **UI Enhancements**:
- A new `render_case_list` function displays recent cases with their
last activity time and one-liner.
- Buttons to "Continue" recording for a case and "Open" the case in
a web browser are added.
- A staleness indicator for the poller's connection is displayed.
- **State Management**:
- The `AppState` is updated to reflect the new UI elements and
interactions.
- Actions like `Continue` and `OpenWeb` are handled.
- **Configuration**: Poll interval and window hours are now configurable
and used by the poller.
- **Error Handling**: Improved error handling for saving configuration
and background task operations.
- **Code Cleanup**: Minor refactoring and documentation updates.
Introduces a new crate `doctate-client-core` to house shared client-side
logic. This includes:
- `case_store`: Manages local case marker files and merging with server
snapshots.
- `snapshot_cache`: Placeholder for caching server responses.
- `oneliner_poller`: Placeholder for the background polling task.
The workspace configuration and `Cargo.lock` have been updated to
include the new crate.
This commit introduces a new API endpoint `/api/oneliners` that allows
authenticated users to retrieve a list of their recent oneliners.
The endpoint supports conditional GET requests using the `ETag` header
for efficient caching. It also allows specifying a time window for the
oneliners via the `hours` query parameter, with sensible defaults and
clamping.
The implementation includes:
- A new route handler `handle_oneliners`.
- A new type `OnelinerWatermark` for tracking user-specific timestamps.
- Logic for scanning user data directories, filtering by time, and
handling deleted cases.
- Test cases to cover various scenarios, including caching, time
windowing, and edge cases.
This commit adds the `libc` dependency to the `Cargo.toml` file for
Unix-based targets. This dependency is required by the `ffmpeg` command
execution within the `recorder` module, specifically for handling
process management and signaling on Unix-like systems.
Introduces new modules for audio recording (`recorder.rs`) and
asynchronous uploading (`uploader.rs`) with retry logic.
The `recorder` module uses `ffmpeg` as a subprocess to capture audio and
save it as M4A files. It handles starting, stopping, and reporting
recording events.
The `uploader` module manages a queue of recordings to be uploaded to
the server. It supports persistent storage of pending uploads via
sidecar JSON files, exponential backoff for retries, and emits events
for UI feedback.
New dependencies were added to `Cargo.toml` and `Cargo.lock` to support
these features, including `reqwest`, `serde_json`, `tokio`, `uuid`, and
`which`.
Introduces a `Config` struct to manage client settings, including server
URL and API key.
This configuration is stored in a TOML file following OS-standard
conventions.
The `directories` crate is used to determine the correct path for the
configuration file across different operating systems.
The `thiserror` crate is used for custom error handling related to
configuration loading and saving.
Added unit tests to verify the configuration loading and saving logic.
Adds the desktop client as a new workspace member and includes its
initial
Cargo.toml and main.rs files. This lays the groundwork for the desktop
application's user interface and integration with the common library.
Moves shared types and utility functions to a new `doctate-common`
crate.
This includes:
- API key header constant
- AckResponse and AckStatus types
- Timestamp formatting and parsing utilities
This change centralizes common functionality, reducing duplication and
improving maintainability.
The `server` crate now depends on `doctate-common`.
This commit introduces a new `doctate-common` crate to the workspace.
This crate will house shared data structures and constants used by both
the `doctate-server` and any future clients.
This refactoring helps to:
- Reduce code duplication.
- Improve maintainability by centralizing common logic.
- Define a clear API contract for server-client communication.
The following modules have been added:
- `ack`: Contains `AckResponse` and `AckStatus` for server responses.
- `constants`: Defines shared constants like API endpoints and multipart
field names.
- `timestamp`: Provides utilities for handling RFC3339 timestamps,
including conversions to and from filesystem-safe strings.
This commit updates various dependencies to their latest versions,
ensuring better compatibility and security. It also corrects the
`.gitignore` file to properly exclude the `target/` directory instead of
`server/target/`.
Brummel