chore: remove dead code, dedupe settings ui, trim dependencies

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

Cargo.lock

@@ -24,7 +24,8 @@ opt-level = 1
 opt-level = 3
 debug = false
 strip = true
-lto = "thin"
+lto = "fat"
+codegen-units = 1
 panic = "abort"
 
 [profile.profiling]

Cargo.toml

@@ -8,6 +8,9 @@ homepage.workspace = true
 repository.workspace = true
 license.workspace = true
 
+[package.metadata.cargo-machete]
+ignored = ["ipnet"]
+
 [[example]]
 name = "background_job"
 required-features = ["reqwest", "tokio"]
@@ -32,14 +35,12 @@ futures-timer = "3"
 http = "1"
 ipnet = "2"
 jiff = { version = "0.2", optional = true }
-rand = "0.10"
 reqwest = { version = "0.13", default-features = false, optional = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["rt"], optional = true }
 tower = { version = "0.5", default-features = false, optional = true }
-url = "2"
 
 [dev-dependencies]
 axum = "0.8"

crates/api/Cargo.toml

@@ -11,10 +11,8 @@ use std::{
 
 use async_channel::{Receiver, Sender};
 use futures_lite::future;
-use http::{HeaderValue, Request, StatusCode, header};
-use rand::RngExt;
+use http::{HeaderValue, Request, StatusCode, Uri, header};
 use serde::Serialize;
-use url::Url;
 
 use crate::{Event, Transport};
 
@@ -73,7 +71,7 @@ impl Client {
 
 /// Configures a buffered client.
 pub struct Builder<T: Transport> {
-    endpoint: Url,
+    endpoint: Uri,
     api_key: String,
     transport: T,
     batch_size: usize,
@@ -85,13 +83,18 @@ pub struct Builder<T: Transport> {
 
 impl<T: Transport> Builder<T> {
     fn new(base_url: impl AsRef<str>, api_key: impl Into<String>, transport: T) -> Result<Self, Error> {
-        let mut endpoint =
-            Url::parse(base_url.as_ref()).map_err(|_| Error::InvalidConfiguration("invalid base URL"))?;
-        let path = endpoint.path().trim_end_matches('/');
+        let base: Uri = base_url.as_ref().parse().map_err(|_| Error::InvalidConfiguration("invalid base URL"))?;
+        let (Some(scheme), Some(authority)) = (base.scheme(), base.authority()) else {
+            return Err(Error::InvalidConfiguration("invalid base URL"));
+        };
+        let path = base.path().trim_end_matches('/');
         let path = if path.ends_with("/api/v1/events") { path.to_owned() } else { format!("{path}/api/v1/events") };
-        endpoint.set_path(&path);
-        endpoint.set_query(None);
-        endpoint.set_fragment(None);
+        let endpoint = Uri::builder()
+            .scheme(scheme.clone())
+            .authority(authority.clone())
+            .path_and_query(path)
+            .build()
+            .map_err(|_| Error::InvalidConfiguration("invalid base URL"))?;
         Ok(Self {
             endpoint,
             api_key: api_key.into(),
@@ -289,7 +292,7 @@ async fn send_batch<T: Transport>(config: &Builder<T>, entity_id: &str, events:
         let mut authorization = HeaderValue::from_str(&format!("Bearer {}", config.api_key))
             .map_err(|_| Error::InvalidConfiguration("invalid API key"))?;
         authorization.set_sensitive(true);
-        let request = Request::post(config.endpoint.as_str())
+        let request = Request::post(config.endpoint.clone())
             .header(header::AUTHORIZATION, authorization)
             .header(header::CONTENT_TYPE, "application/json")
             .body(body.clone())
@@ -325,9 +328,8 @@ async fn send_batch<T: Transport>(config: &Builder<T>, entity_id: &str, events:
             Attempt::Response(Err(_)) | Attempt::Timeout => None,
         };
         if attempt < config.max_retries {
-            let base = 100_u64.saturating_mul(2_u64.saturating_pow(attempt));
-            let jitter = rand::rng().random_range(0..=(base / 4));
-            let delay = retry_after.unwrap_or_else(|| Duration::from_millis(base + jitter));
+            let backoff = Duration::from_millis(100_u64.saturating_mul(2_u64.saturating_pow(attempt)));
+            let delay = retry_after.unwrap_or(backoff);
             futures_timer::Delay::new(delay).await;
         }
     }

crates/api/src/client.rs

@@ -7,6 +7,9 @@ repository.workspace = true
 license.workspace = true
 publish = false
 
+[package.metadata.cargo-machete]
+ignored = ["md-5"]
+
 [lib]
 path = "src/lib.rs"
 
@@ -66,7 +69,6 @@ axum = { version = "0.8", default-features = false, features = [
   "tokio",
 ] }
 axum-extra = { version = "0.12", default-features = false, features = ["cookie", "typed-header"] }
-base64 = "0.23"
 headers = "0.4"
 http = "1.5"
 ipnet = "2.12"

crates/liwan/Cargo.toml

@@ -1,11 +1,9 @@
 use std::collections::HashSet;
 
 use anyhow::{Result, bail};
-use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 use chrono::Utc;
-use rand::RngExt;
 use rand::distr::{Alphanumeric, SampleString};
-use rusqlite::{OptionalExtension, Transaction};
+use rusqlite::{Connection, OptionalExtension, Transaction};
 
 use crate::app::{
     SqlitePool,
@@ -42,7 +40,7 @@ impl LiwanApiKeys {
     ) -> Result<(ApiKey, String)> {
         let display_name = display_name.trim();
         validate_display_name(display_name)?;
-        let secret = URL_SAFE_NO_PAD.encode(rand::rng().random::<[u8; 24]>());
+        let secret = Alphanumeric.sample_string(&mut rand::rng(), 32);
         let plaintext = format!("{KEY_PREFIX}{secret}");
         let id = Alphanumeric.sample_string(&mut rand::rng(), 16);
         let secret_hash = blake3::hash(secret.as_bytes()).to_hex().to_string();
@@ -76,61 +74,7 @@ impl LiwanApiKeys {
     /// Lists all key metadata without exposing hashes.
     pub fn all(&self) -> Result<Vec<ApiKey>> {
         let conn = self.pool.get()?;
-        let mut stmt = conn.prepare_cached(
-            "select id, display_name, created_at, expires_at, last_used_at,
-                (select json_group_array(entity_id) from api_key_entities where key_id = api_keys.id),
-                permissions_json, all_entities,
-                (select json_group_array(project_id) from api_key_projects where key_id = api_keys.id), all_projects
-             from api_keys order by created_at desc",
-        )?;
-        let rows = stmt.query_map([], |row| {
-            Ok((
-                row.get::<_, String>(0)?,
-                row.get::<_, String>(1)?,
-                row.get(2)?,
-                row.get(3)?,
-                row.get(4)?,
-                row.get::<_, String>(5)?,
-                row.get::<_, String>(6)?,
-                row.get::<_, bool>(7)?,
-                row.get::<_, String>(8)?,
-                row.get::<_, bool>(9)?,
-            ))
-        })?;
-        let mut keys = Vec::new();
-        for row in rows {
-            let (
-                id,
-                display_name,
-                created_at,
-                expires_at,
-                last_used_at,
-                entities,
-                permissions,
-                all_entities,
-                projects,
-                all_projects,
-            ) = row?;
-            keys.push(ApiKey {
-                id,
-                display_name,
-                entities: if all_entities {
-                    AccessScope::All
-                } else {
-                    AccessScope::Selected(serde_json::from_str(&entities)?)
-                },
-                projects: if all_projects {
-                    AccessScope::All
-                } else {
-                    AccessScope::Selected(serde_json::from_str(&projects)?)
-                },
-                permissions: serde_json::from_str(&permissions)?,
-                created_at,
-                last_used_at,
-                expires_at,
-            });
-        }
-        Ok(keys)
+        query_keys(&conn, "", [])
     }
 
     /// Updates a key's display name, access, and permissions.
@@ -168,54 +112,16 @@ impl LiwanApiKeys {
 
     /// Replaces a key's secret and sets a new expiration, without changing its access.
     pub fn regenerate(&self, key_id: &str, expiration: ApiKeyExpiration) -> Result<Option<(ApiKey, String)>> {
-        let secret = URL_SAFE_NO_PAD.encode(rand::rng().random::<[u8; 24]>());
+        let secret = Alphanumeric.sample_string(&mut rand::rng(), 32);
         let hash = blake3::hash(secret.as_bytes()).to_hex().to_string();
         let expires_at = expiration.expires_at();
         let mut conn = self.pool.get()?;
         let tx = conn.transaction()?;
-        let changed = tx.execute(
+        tx.execute(
             "update api_keys set secret_hash = ?, expires_at = ?, last_used_at = null where id = ?",
             rusqlite::params![hash, expires_at, key_id],
         )?;
-        if changed == 0 {
-            return Ok(None);
-        }
-        let (display_name, created_at, entities, all_entities, projects, all_projects, permissions) = tx.query_row(
-            "select display_name, created_at,
-                (select json_group_array(entity_id) from api_key_entities where key_id = api_keys.id), all_entities,
-                (select json_group_array(project_id) from api_key_projects where key_id = api_keys.id), all_projects,
-                permissions_json from api_keys where id = ?",
-            [key_id],
-            |row| {
-                Ok((
-                    row.get::<_, String>(0)?,
-                    row.get(1)?,
-                    row.get::<_, String>(2)?,
-                    row.get::<_, bool>(3)?,
-                    row.get::<_, String>(4)?,
-                    row.get::<_, bool>(5)?,
-                    row.get::<_, String>(6)?,
-                ))
-            },
-        )?;
-        let key = ApiKey {
-            id: key_id.to_string(),
-            display_name,
-            entities: if all_entities {
-                AccessScope::All
-            } else {
-                AccessScope::Selected(serde_json::from_str(&entities)?)
-            },
-            projects: if all_projects {
-                AccessScope::All
-            } else {
-                AccessScope::Selected(serde_json::from_str(&projects)?)
-            },
-            permissions: serde_json::from_str(&permissions)?,
-            created_at,
-            last_used_at: None,
-            expires_at,
-        };
+        let Some(key) = query_keys(&tx, "where id = ?", [key_id])?.pop() else { return Ok(None) };
         tx.commit()?;
         Ok(Some((key, format!("{KEY_PREFIX}{secret}"))))
     }
@@ -288,17 +194,37 @@ impl LiwanApiKeys {
                 } else {
                     AccessScope::Selected(permitted_entities.into_iter().collect())
                 },
-                projects: if all_projects {
-                    AccessScope::All
-                } else {
-                    AccessScope::Selected(serde_json::from_str(&projects)?)
-                },
+                projects: AccessScope::from_db(all_projects, &projects)?,
                 permissions: serde_json::from_str(&permissions)?,
             },
         }))
     }
 }
 
+fn query_keys(conn: &Connection, filter: &str, params: impl rusqlite::Params) -> Result<Vec<ApiKey>> {
+    let mut stmt = conn.prepare_cached(&format!(
+        "select id, display_name, created_at, expires_at, last_used_at, permissions_json, all_entities,
+            (select json_group_array(entity_id) from api_key_entities where key_id = api_keys.id), all_projects,
+            (select json_group_array(project_id) from api_key_projects where key_id = api_keys.id)
+         from api_keys {filter} order by created_at desc"
+    ))?;
+    let mut rows = stmt.query(params)?;
+    let mut keys = Vec::new();
+    while let Some(row) = rows.next()? {
+        keys.push(ApiKey {
+            id: row.get(0)?,
+            display_name: row.get(1)?,
+            created_at: row.get(2)?,
+            expires_at: row.get(3)?,
+            last_used_at: row.get(4)?,
+            permissions: serde_json::from_str(&row.get::<_, String>(5)?)?,
+            entities: AccessScope::from_db(row.get(6)?, &row.get::<_, String>(7)?)?,
+            projects: AccessScope::from_db(row.get(8)?, &row.get::<_, String>(9)?)?,
+        });
+    }
+    Ok(keys)
+}
+
 fn validate_display_name(display_name: &str) -> Result<()> {
     if display_name.is_empty() || display_name.len() > 100 {
         bail!("API key name must be between 1 and 100 characters");

crates/liwan/src/app/core/api_keys.rs

@@ -76,11 +76,6 @@ impl DateRange {
         Ok(Self { start, end: self.start })
     }
 
-    /// Return whether the range ends after the current time
-    pub fn ends_in_future(&self) -> bool {
-        self.end > Utc::now()
-    }
-
     /// Return the range duration
     pub fn duration(&self) -> chrono::Duration {
         self.end - self.start

crates/liwan/src/app/core/reports/mod.rs

@@ -48,16 +48,8 @@ impl LiwanTeams {
                 display_name,
                 users: serde_json::from_str(&users)?,
                 access: Access {
-                    entities: if all_entities {
-                        AccessScope::All
-                    } else {
-                        AccessScope::Selected(serde_json::from_str(&entities)?)
-                    },
-                    projects: if all_projects {
-                        AccessScope::All
-                    } else {
-                        AccessScope::Selected(serde_json::from_str(&projects)?)
-                    },
+                    entities: AccessScope::from_db(all_entities, &entities)?,
+                    projects: AccessScope::from_db(all_projects, &projects)?,
                     permissions: serde_json::from_str::<HashSet<AccessPermission>>(&permissions)?,
                 },
             });

crates/liwan/src/app/core/teams.rs

@@ -5,7 +5,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct Event {
     pub entity_id: String,
     pub visitor_group_id: String,
@@ -163,6 +163,11 @@ impl Default for AccessScope {
 }
 
 impl AccessScope {
+    /// Build a scope from a stored "all" flag and a JSON array of selected IDs.
+    pub fn from_db(all: bool, ids: &str) -> serde_json::Result<Self> {
+        if all { Ok(Self::All) } else { serde_json::from_str(ids).map(Self::Selected) }
+    }
+
     /// Check whether an ID falls within this scope.
     pub fn contains(&self, id: &str) -> bool {
         match self {