From 2d3bf03d63e83b714ae2eecef9a71c0c34e81a96 Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Thu, 18 Jun 2026 00:41:25 +0200 Subject: [PATCH] Upgrade to `rand` 0.10 and the next RustCrypto generation `rand` 0.10 and the new RustCrypto generation both build on `rand_core` 0.10, so they have to move together: - `rand`, `rand_chacha` and `rand_core` 0.10 - `digest` 0.11, `sha2` 0.11, `hmac` 0.13, `const-oid` 0.10 - `elliptic-curve` 0.14, `ecdsa` 0.17, `p256`, `p384` and `k256` 0.14, `signature` 3 - `der`, `spki` and `sec1` 0.8, `pkcs8` 0.11, `pem-rfc7468` 1.0 - `rsa` 0.10.0-rc.19 and `pkcs1` 0.8.0-rc.5, which have no stable release yet. They are pinned exactly, because release candidates break their API between releases. - `argon2` 0.6 and `pbkdf2` 0.13 On the `rand` side, `RngCore` becomes `Rng` and the old `Rng` becomes `RngExt`. `gen_*` becomes `random_*`, `thread_rng` becomes `rng`, `distributions` becomes `distr`, and `from_rng` can no longer fail. On the crypto side, `mas-jose` and `mas-keystore` move to `BoxedUint` for RSA, to the `pkcs1` and `pkcs8` reference types, and to the `Generate` trait for key generation, and `mas-jose` no longer depends on `generic-array`. Password hashing goes through `hash_password_with_rng`. Stored data is unaffected. The password hashing snapshots are unchanged, so bcrypt, Argon2 and PBKDF2 produce the same hashes for the same input and salt, and `pbkdf2` 0.13 keeps the same defaults (SHA-256, 600 000 rounds). The keystore snapshots change only because keys generated from a seeded RNG differ. The snapshots of keys loaded from files are unchanged. `opa-wasm` 0.3.3 already uses this generation, so most of the duplicate crates it pulled in go away. The `deny.toml` skip list now names what still pulls the older versions: cookie, sqlx, headers, wasmtime and pest for RustCrypto, and opentelemetry_sdk, sentry and ulid for `rand` 0.9. --- Cargo.lock | 542 +++++++++++++----- Cargo.toml | 74 +-- clippy.toml | 3 +- crates/axum-utils/src/csrf.rs | 14 +- crates/cli/src/app_state.rs | 4 +- crates/cli/src/commands/config.rs | 7 +- crates/cli/src/commands/manage.rs | 13 +- crates/cli/src/commands/syn2mas.rs | 5 +- crates/cli/src/commands/templates.rs | 7 +- crates/config/src/sections/matrix.rs | 6 +- crates/config/src/sections/mod.rs | 5 +- crates/config/src/sections/secrets.rs | 17 +- crates/data-model/src/compat/device.rs | 7 +- .../src/oauth2/authorization_grant.rs | 7 +- crates/data-model/src/oauth2/client.rs | 4 +- .../src/oauth2/device_code_grant.rs | 7 +- crates/data-model/src/tokens.rs | 9 +- crates/data-model/src/users.rs | 9 +- crates/data-model/src/utils.rs | 13 +- .../admin/v1/user_registration_tokens/add.rs | 3 +- crates/handlers/src/compat/login.rs | 10 +- .../handlers/src/compat/login_sso_redirect.rs | 3 +- crates/handlers/src/graphql/mod.rs | 6 +- .../handlers/src/oauth2/authorization/mod.rs | 2 +- .../handlers/src/oauth2/device/authorize.rs | 3 +- crates/handlers/src/oauth2/mod.rs | 5 +- crates/handlers/src/oauth2/registration.rs | 3 +- crates/handlers/src/passwords.rs | 38 +- crates/handlers/src/session.rs | 6 +- crates/handlers/src/test_utils.rs | 6 +- crates/handlers/src/views/login.rs | 4 +- crates/jose/Cargo.toml | 2 +- crates/jose/src/jwa/asymmetric.rs | 7 +- crates/jose/src/jwa/hmac.rs | 33 +- crates/jose/src/jwa/symmetric.rs | 5 +- crates/jose/src/jwk/private_parameters.rs | 19 +- crates/jose/src/jwk/public_parameters.rs | 34 +- crates/jose/src/jwt/signed.rs | 16 +- crates/keystore/src/lib.rs | 78 +-- .../keystore__generate_sign_and_verify-2.snap | 9 +- .../keystore__generate_sign_and_verify-3.snap | 11 +- .../keystore__generate_sign_and_verify-4.snap | 9 +- .../keystore__generate_sign_and_verify-5.snap | 15 +- .../keystore__generate_sign_and_verify.snap | 53 +- .../tests/snapshots/keystore__jwt_ES256.snap | 2 +- .../tests/snapshots/keystore__jwt_ES256K.snap | 2 +- .../tests/snapshots/keystore__jwt_ES384.snap | 2 +- .../tests/snapshots/keystore__jwt_PS256.snap | 2 +- .../tests/snapshots/keystore__jwt_PS384.snap | 2 +- .../tests/snapshots/keystore__jwt_PS512.snap | 2 +- .../tests/snapshots/keystore__jwt_RS256.snap | 2 +- .../tests/snapshots/keystore__jwt_RS384.snap | 2 +- .../tests/snapshots/keystore__jwt_RS512.snap | 2 +- .../src/requests/authorization_code.rs | 11 +- .../src/requests/client_credentials.rs | 5 +- .../oidc-client/src/requests/refresh_token.rs | 5 +- crates/oidc-client/src/requests/token.rs | 5 +- .../src/types/client_credentials.rs | 7 +- crates/oidc-client/tests/it/main.rs | 3 +- crates/storage-pg/src/compat/access_token.rs | 5 +- crates/storage-pg/src/compat/refresh_token.rs | 5 +- crates/storage-pg/src/compat/session.rs | 4 +- crates/storage-pg/src/compat/sso_login.rs | 4 +- crates/storage-pg/src/lib.rs | 6 +- crates/storage-pg/src/oauth2/access_token.rs | 4 +- .../src/oauth2/authorization_grant.rs | 4 +- crates/storage-pg/src/oauth2/client.rs | 4 +- .../src/oauth2/device_code_grant.rs | 4 +- crates/storage-pg/src/oauth2/refresh_token.rs | 4 +- crates/storage-pg/src/oauth2/session.rs | 4 +- .../storage-pg/src/personal/access_token.rs | 5 +- crates/storage-pg/src/personal/session.rs | 4 +- crates/storage-pg/src/policy_data.rs | 5 +- crates/storage-pg/src/queue/job.rs | 8 +- crates/storage-pg/src/queue/worker.rs | 5 +- crates/storage-pg/src/upstream_oauth2/link.rs | 4 +- .../src/upstream_oauth2/provider.rs | 4 +- .../storage-pg/src/upstream_oauth2/session.rs | 4 +- crates/storage-pg/src/user/email.rs | 10 +- crates/storage-pg/src/user/mod.rs | 4 +- crates/storage-pg/src/user/password.rs | 5 +- crates/storage-pg/src/user/recovery.rs | 6 +- crates/storage-pg/src/user/registration.rs | 4 +- .../storage-pg/src/user/registration_token.rs | 4 +- crates/storage-pg/src/user/session.rs | 8 +- crates/storage-pg/src/user/terms.rs | 5 +- crates/storage/src/compat/access_token.rs | 7 +- crates/storage/src/compat/refresh_token.rs | 7 +- crates/storage/src/compat/session.rs | 6 +- crates/storage/src/compat/sso_login.rs | 7 +- crates/storage/src/lib.rs | 5 +- crates/storage/src/oauth2/access_token.rs | 6 +- .../storage/src/oauth2/authorization_grant.rs | 6 +- crates/storage/src/oauth2/client.rs | 6 +- .../storage/src/oauth2/device_code_grant.rs | 6 +- crates/storage/src/oauth2/refresh_token.rs | 6 +- crates/storage/src/oauth2/session.rs | 14 +- crates/storage/src/personal/access_token.rs | 7 +- crates/storage/src/personal/session.rs | 7 +- crates/storage/src/policy_data.rs | 7 +- crates/storage/src/queue/job.rs | 22 +- crates/storage/src/queue/worker.rs | 7 +- crates/storage/src/upstream_oauth2/link.rs | 6 +- .../storage/src/upstream_oauth2/provider.rs | 7 +- crates/storage/src/upstream_oauth2/session.rs | 6 +- crates/storage/src/user/email.rs | 18 +- crates/storage/src/user/mod.rs | 6 +- crates/storage/src/user/password.rs | 7 +- crates/storage/src/user/recovery.rs | 10 +- crates/storage/src/user/registration.rs | 6 +- crates/storage/src/user/registration_token.rs | 7 +- crates/storage/src/user/session.rs | 14 +- crates/storage/src/user/terms.rs | 7 +- crates/syn2mas/src/migration.rs | 31 +- .../syn2mas/src/synapse_reader/config/mod.rs | 5 +- .../syn2mas/src/synapse_reader/config/oidc.rs | 5 +- crates/tasks/src/email.rs | 5 +- crates/tasks/src/lib.rs | 2 +- crates/tasks/src/new_queue.rs | 7 +- crates/tasks/src/recovery.rs | 2 +- crates/templates/src/context.rs | 80 +-- crates/templates/src/context/captcha.rs | 4 +- crates/templates/src/lib.rs | 4 +- crates/templates/src/macros.rs | 7 +- deny.toml | 51 +- 125 files changed, 1026 insertions(+), 717 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 7846cc388..aa8f899fa 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -63,6 +63,17 @@ dependencies = [ "cpufeatures 0.2.17", ] +[[package]] +name = "aes" +version = "0.9.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32" +dependencies = [ + "cipher 0.5.2", + "cpubits", + "cpufeatures 0.3.1", +] + [[package]] name = "aes-gcm" version = "0.10.3" @@ -70,13 +81,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" dependencies = [ "aead 0.5.2", - "aes", + "aes 0.8.4", "cipher 0.4.4", - "ctr", - "ghash", + "ctr 0.9.2", + "ghash 0.5.1", "subtle", ] +[[package]] +name = "aes-gcm" +version = "0.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f" +dependencies = [ + "aead 0.6.1", + "aes 0.9.3", + "cipher 0.5.2", + "ctr 0.10.1", + "ctutils", + "ghash 0.6.0", +] + [[package]] name = "aho-corasick" version = "1.1.3" @@ -209,13 +234,13 @@ dependencies = [ [[package]] name = "argon2" -version = "0.5.3" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072" +checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c" dependencies = [ "base64ct", "blake2", - "cpufeatures 0.2.17", + "cpufeatures 0.3.1", "password-hash", ] @@ -675,9 +700,9 @@ dependencies = [ [[package]] name = "base16ct" -version = "0.2.0" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" +checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6" [[package]] name = "base64" @@ -736,11 +761,11 @@ dependencies = [ [[package]] name = "blake2" -version = "0.10.6" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe" +checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f" dependencies = [ - "digest 0.10.7", + "digest 0.11.3", ] [[package]] @@ -763,11 +788,11 @@ dependencies = [ [[package]] name = "block-padding" -version = "0.3.3" +version = "0.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93" +checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] @@ -862,11 +887,11 @@ dependencies = [ [[package]] name = "cbc" -version = "0.1.2" +version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6" +checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896" dependencies = [ - "cipher 0.4.4", + "cipher 0.5.2", ] [[package]] @@ -1113,7 +1138,7 @@ version = "0.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747" dependencies = [ - "aes-gcm", + "aes-gcm 0.10.3", "base64 0.22.1", "hkdf", "percent-encoding", @@ -1185,6 +1210,12 @@ dependencies = [ "cfg-if", ] +[[package]] +name = "cpubits" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae" + [[package]] name = "cpufeatures" version = "0.2.17" @@ -1430,12 +1461,17 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" [[package]] name = "crypto-bigint" -version = "0.5.5" +version = "0.7.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" +checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271" dependencies = [ - "generic-array", - "rand_core 0.6.4", + "cpubits", + "ctutils", + "getrandom 0.4.3", + "hybrid-array", + "num-traits", + "rand_core 0.10.1", + "serdect", "subtle", "zeroize", ] @@ -1462,6 +1498,16 @@ dependencies = [ "rand_core 0.10.1", ] +[[package]] +name = "crypto-primes" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f" +dependencies = [ + "crypto-bigint", + "rand_core 0.10.1", +] + [[package]] name = "csv" version = "1.4.0" @@ -1492,6 +1538,15 @@ dependencies = [ "cipher 0.4.4", ] +[[package]] +name = "ctr" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21" +dependencies = [ + "cipher 0.5.2", +] + [[package]] name = "ctutils" version = "0.4.3" @@ -1499,6 +1554,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574" dependencies = [ "cmov", + "subtle", ] [[package]] @@ -1619,7 +1675,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" dependencies = [ "const-oid 0.9.6", - "pem-rfc7468", + "pem-rfc7468 0.7.0", + "zeroize", +] + +[[package]] +name = "der" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a" +dependencies = [ + "const-oid 0.10.2", + "pem-rfc7468 1.0.0", "zeroize", ] @@ -1751,16 +1818,17 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" [[package]] name = "ecdsa" -version = "0.16.9" +version = "0.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" +checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0" dependencies = [ - "der", - "digest 0.10.7", + "der 0.8.2", + "digest 0.11.3", "elliptic-curve", "rfc6979", - "signature", - "spki", + "signature 3.0.0", + "spki 0.8.1", + "zeroize", ] [[package]] @@ -1774,20 +1842,20 @@ dependencies = [ [[package]] name = "elliptic-curve" -version = "0.13.8" +version = "0.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" +checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65" dependencies = [ "base16ct", "crypto-bigint", - "digest 0.10.7", + "crypto-common 0.2.2", + "digest 0.11.3", "ff", - "generic-array", "group", - "hkdf", - "pem-rfc7468", - "pkcs8", - "rand_core 0.6.4", + "hybrid-array", + "pem-rfc7468 1.0.0", + "pkcs8 0.11.0", + "rand_core 0.10.1", "sec1", "subtle", "zeroize", @@ -1909,14 +1977,20 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" [[package]] name = "ff" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393" +checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f" dependencies = [ - "rand_core 0.6.4", + "rand_core 0.10.1", "subtle", ] +[[package]] +name = "fiat-crypto" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24" + [[package]] name = "figment" version = "0.10.19" @@ -2129,7 +2203,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", - "zeroize", ] [[package]] @@ -2174,7 +2247,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1" dependencies = [ "opaque-debug", - "polyval", + "polyval 0.6.2", +] + +[[package]] +name = "ghash" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5" +dependencies = [ + "polyval 0.7.3", ] [[package]] @@ -2230,12 +2312,12 @@ dependencies = [ [[package]] name = "group" -version = "0.13.0" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" +checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4" dependencies = [ "ff", - "rand_core 0.6.4", + "rand_core 0.10.1", "subtle", ] @@ -2461,11 +2543,13 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9" [[package]] name = "hybrid-array" -version = "0.4.10" +version = "0.4.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" dependencies = [ + "subtle", "typenum", + "zeroize", ] [[package]] @@ -2953,7 +3037,6 @@ version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" dependencies = [ - "block-padding", "generic-array", ] @@ -2963,6 +3046,7 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7" dependencies = [ + "block-padding", "hybrid-array", ] @@ -3175,16 +3259,17 @@ dependencies = [ [[package]] name = "k256" -version = "0.13.4" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b" +checksum = "93f50113171a713f4a4231ef82eb26703607139b35dcb56241f0ceab2ae1f7d8" dependencies = [ - "cfg-if", + "cpubits", "ecdsa", "elliptic-curve", - "once_cell", - "sha2 0.10.9", - "signature", + "primeorder", + "sha2 0.11.0", + "signature 3.0.0", + "wnaf", ] [[package]] @@ -3359,7 +3444,7 @@ dependencies = [ "mas-templates", "mime", "oauth2-types", - "rand 0.8.6", + "rand 0.10.3", "reqwest", "sentry", "serde", @@ -3422,8 +3507,8 @@ dependencies = [ "opentelemetry-semantic-conventions", "opentelemetry-stdout", "opentelemetry_sdk", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "reqwest", "rustls", "sd-notify", @@ -3465,9 +3550,9 @@ dependencies = [ "mas-iana", "mas-jose", "mas-keystore", - "pem-rfc7468", - "rand 0.8.6", - "rand_chacha 0.3.1", + "pem-rfc7468 1.0.0", + "rand 0.10.3", + "rand_chacha 0.10.0", "rustls-pki-types", "schemars 1.2.1", "serde", @@ -3507,8 +3592,8 @@ dependencies = [ "mas-iana", "mas-jose", "oauth2-types", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "regex", "serde", "serde_json", @@ -3583,10 +3668,10 @@ dependencies = [ "opentelemetry", "opentelemetry-semantic-conventions", "pbkdf2", - "pkcs8", + "pkcs8 0.11.0", "psl", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "reqwest", "ruma-common", "rustls", @@ -3596,7 +3681,7 @@ dependencies = [ "serde_json", "serde_urlencoded", "serde_with", - "sha2 0.10.9", + "sha2 0.11.0", "sqlx", "thiserror 2.0.18", "tokio", @@ -3697,26 +3782,25 @@ version = "1.27.0-rc.0" dependencies = [ "base64ct", "chrono", - "digest 0.10.7", + "digest 0.11.3", "ecdsa", "elliptic-curve", - "generic-array", - "hmac 0.12.1", + "hmac 0.13.0", "insta", "k256", "mas-iana", "p256", "p384", - "rand 0.8.6", - "rand_chacha 0.3.1", - "rsa", + "rand 0.10.3", + "rand_chacha 0.10.0", + "rsa 0.10.0-rc.19", "schemars 1.2.1", "sec1", "serde", "serde_json", "serde_with", - "sha2 0.10.9", - "signature", + "sha2 0.11.0", + "signature 3.0.0", "thiserror 2.0.18", "url", ] @@ -3728,8 +3812,8 @@ dependencies = [ "aead 0.6.1", "base64ct", "chacha20poly1305", - "const-oid 0.9.6", - "der", + "const-oid 0.10.2", + "der 0.8.2", "elliptic-curve", "insta", "k256", @@ -3737,14 +3821,14 @@ dependencies = [ "mas-jose", "p256", "p384", - "pem-rfc7468", - "pkcs1", - "pkcs8", - "rand 0.8.6", - "rand_chacha 0.3.1", - "rsa", + "pem-rfc7468 1.0.0", + "pkcs1 0.8.0-rc.5", + "pkcs8 0.11.0", + "rand 0.10.3", + "rand_chacha 0.10.0", + "rsa 0.10.0-rc.19", "sec1", - "spki", + "spki 0.8.1", "thiserror 2.0.18", ] @@ -3822,8 +3906,8 @@ dependencies = [ "mime", "oauth2-types", "p256", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "reqwest", "rustls", "serde", @@ -3885,7 +3969,7 @@ dependencies = [ "mas-jose", "oauth2-types", "opentelemetry", - "rand_core 0.6.4", + "rand_core 0.10.1", "serde", "serde_json", "thiserror 2.0.18", @@ -3912,12 +3996,12 @@ dependencies = [ "opentelemetry", "opentelemetry-semantic-conventions", "pin-project-lite", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "sea-query", "sea-query-sqlx", "serde_json", - "sha2 0.10.9", + "sha2 0.11.0", "sqlx", "thiserror 2.0.18", "tokio", @@ -3946,8 +4030,8 @@ dependencies = [ "mas-templates", "opentelemetry", "opentelemetry-semantic-conventions", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "serde", "serde_json", "sqlx", @@ -3977,8 +4061,8 @@ dependencies = [ "minijinja", "minijinja-contrib", "oauth2-types", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "serde", "serde_json", "serde_urlencoded", @@ -4020,6 +4104,15 @@ version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3" +[[package]] +name = "mcf" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2044bdbade272ded4a1529324f4f30ca7b0c5b496541f2a9095bbd1c9d03cb06" +dependencies = [ + "base64ct", +] + [[package]] name = "md-5" version = "0.10.6" @@ -4268,7 +4361,7 @@ dependencies = [ "serde", "serde_json", "serde_with", - "sha2 0.10.9", + "sha2 0.11.0", "thiserror 2.0.18", "url", ] @@ -4509,26 +4602,29 @@ dependencies = [ [[package]] name = "p256" -version = "0.13.2" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" +checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a" dependencies = [ "ecdsa", "elliptic-curve", + "primefield", "primeorder", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] name = "p384" -version = "0.13.1" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" +checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f" dependencies = [ "ecdsa", "elliptic-curve", + "fiat-crypto", + "primefield", "primeorder", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -4577,26 +4673,26 @@ checksum = "487f2ccd1e17ce8c1bfab3a65c89525af41cfad4c8659021a1e9a2aacd73b89b" [[package]] name = "password-hash" -version = "0.5.0" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166" +checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b" dependencies = [ - "base64ct", - "rand_core 0.6.4", - "subtle", + "getrandom 0.4.3", + "phc", + "rand_core 0.10.1", ] [[package]] name = "pbkdf2" -version = "0.12.2" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" +checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629" dependencies = [ - "digest 0.10.7", - "hmac 0.12.1", + "digest 0.11.3", + "hmac 0.13.0", + "mcf", "password-hash", - "rayon", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -4631,6 +4727,15 @@ dependencies = [ "base64ct", ] +[[package]] +name = "pem-rfc7468" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9" +dependencies = [ + "base64ct", +] + [[package]] name = "percent-encoding" version = "2.3.2" @@ -4680,6 +4785,18 @@ dependencies = [ "sha2 0.10.9", ] +[[package]] +name = "phc" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892" +dependencies = [ + "base64ct", + "ctutils", + "getrandom 0.4.3", + "rand_core 0.10.1", +] + [[package]] name = "phf" version = "0.11.3" @@ -4789,24 +4906,36 @@ version = "0.7.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" dependencies = [ - "der", - "pkcs8", - "spki", + "der 0.7.10", + "pkcs8 0.10.2", + "spki 0.7.3", +] + +[[package]] +name = "pkcs1" +version = "0.8.0-rc.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f485dbafe293ea6ccaa7d82bc591651a796eb8a9aec3df040b057b706073dbc3" +dependencies = [ + "der 0.8.2", + "spki 0.8.1", ] [[package]] name = "pkcs5" -version = "0.7.1" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6" +checksum = "63d440a804ec8d6fafbb6b84471e013286658d373248927692ab3366686220ca" dependencies = [ - "aes", + "aes 0.9.3", + "aes-gcm 0.11.1", "cbc", - "der", + "der 0.8.2", "pbkdf2", + "rand_core 0.10.1", "scrypt", - "sha2 0.10.9", - "spki", + "sha2 0.11.0", + "spki 0.8.1", ] [[package]] @@ -4815,10 +4944,20 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" dependencies = [ - "der", + "der 0.7.10", + "spki 0.7.3", +] + +[[package]] +name = "pkcs8" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7" +dependencies = [ + "der 0.8.2", "pkcs5", - "rand_core 0.6.4", - "spki", + "rand_core 0.10.1", + "spki 0.8.1", ] [[package]] @@ -4876,6 +5015,17 @@ dependencies = [ "universal-hash 0.5.1", ] +[[package]] +name = "polyval" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd" +dependencies = [ + "cpubits", + "cpufeatures 0.3.1", + "universal-hash 0.6.1", +] + [[package]] name = "portable-atomic" version = "1.11.1" @@ -4930,12 +5080,30 @@ dependencies = [ ] [[package]] -name = "primeorder" -version = "0.13.6" +name = "primefield" +version = "0.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" +checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4" +dependencies = [ + "crypto-bigint", + "crypto-common 0.2.2", + "ff", + "rand_core 0.10.1", + "subtle", + "zeroize", +] + +[[package]] +name = "primeorder" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06" dependencies = [ "elliptic-curve", + "once_cell", + "primefield", + "serdect", + "wnaf", ] [[package]] @@ -5154,6 +5322,16 @@ dependencies = [ "rand_core 0.9.3", ] +[[package]] +name = "rand_chacha" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3e6af7f3e25ded52c41df4e0b1af2d047e45896c2f3281792ed68a1c243daedb" +dependencies = [ + "ppv-lite86", + "rand_core 0.10.1", +] + [[package]] name = "rand_core" version = "0.6.4" @@ -5324,12 +5502,12 @@ dependencies = [ [[package]] name = "rfc6979" -version = "0.4.0" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" +checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b" dependencies = [ - "hmac 0.12.1", - "subtle", + "crypto-bigint", + "hmac 0.13.0", ] [[package]] @@ -5357,15 +5535,33 @@ dependencies = [ "num-bigint-dig", "num-integer", "num-traits", - "pkcs1", - "pkcs8", + "pkcs1 0.7.5", + "pkcs8 0.10.2", "rand_core 0.6.4", - "signature", - "spki", + "signature 2.2.0", + "spki 0.7.3", "subtle", "zeroize", ] +[[package]] +name = "rsa" +version = "0.10.0-rc.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "33405e321e16ef941ca66e254f6904c3aafd3c7ff001fb88bf11c73eb75c2b85" +dependencies = [ + "const-oid 0.10.2", + "crypto-bigint", + "crypto-primes", + "digest 0.11.3", + "pkcs1 0.8.0-rc.5", + "pkcs8 0.11.0", + "rand_core 0.10.1", + "signature 3.0.0", + "spki 0.8.1", + "zeroize", +] + [[package]] name = "ruma-common" version = "0.19.0" @@ -5555,11 +5751,12 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f" [[package]] name = "salsa20" -version = "0.10.2" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213" +checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c" dependencies = [ - "cipher 0.4.4", + "cfg-if", + "cipher 0.5.2", ] [[package]] @@ -5628,13 +5825,14 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" [[package]] name = "scrypt" -version = "0.11.0" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f" +checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0" dependencies = [ + "cfg-if", "pbkdf2", "salsa20", - "sha2 0.10.9", + "sha2 0.11.0", ] [[package]] @@ -5685,14 +5883,14 @@ dependencies = [ [[package]] name = "sec1" -version = "0.7.3" +version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" +checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d" dependencies = [ "base16ct", - "der", - "generic-array", - "pkcs8", + "ctutils", + "der 0.8.2", + "hybrid-array", "subtle", "zeroize", ] @@ -6014,6 +6212,16 @@ dependencies = [ "unsafe-libyaml", ] +[[package]] +name = "serdect" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e" +dependencies = [ + "base16ct", + "serde", +] + [[package]] name = "sha1" version = "0.10.6" @@ -6098,6 +6306,16 @@ dependencies = [ "rand_core 0.6.4", ] +[[package]] +name = "signature" +version = "3.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5" +dependencies = [ + "digest 0.11.3", + "rand_core 0.10.1", +] + [[package]] name = "simd_cesu8" version = "1.1.1" @@ -6187,7 +6405,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" dependencies = [ "base64ct", - "der", + "der 0.7.10", +] + +[[package]] +name = "spki" +version = "0.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9" +dependencies = [ + "base64ct", + "der 0.8.2", ] [[package]] @@ -6320,7 +6548,7 @@ dependencies = [ "once_cell", "percent-encoding", "rand 0.8.6", - "rsa", + "rsa 0.9.10", "serde", "sha1 0.10.6", "sha2 0.10.9", @@ -6510,8 +6738,8 @@ dependencies = [ "oauth2-types", "opentelemetry", "opentelemetry-semantic-conventions", - "rand 0.8.6", - "rand_chacha 0.3.1", + "rand 0.10.3", + "rand_chacha 0.10.0", "rustc-hash", "serde", "serde_json", @@ -7037,9 +7265,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" [[package]] name = "typenum" -version = "1.18.0" +version = "1.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f" +checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "ucd-trie" @@ -8176,6 +8404,18 @@ dependencies = [ "wasmparser", ] +[[package]] +name = "wnaf" +version = "0.14.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa" +dependencies = [ + "ff", + "group", + "hybrid-array", + "primefield", +] + [[package]] name = "woothee" version = "0.13.0" diff --git a/Cargo.toml b/Cargo.toml index 701789e68..738af8abe 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -122,12 +123,12 @@ features = ["alloc", "getrandom"] # Argon2 password hashing [workspace.dependencies.argon2] -version = "0.5.3" -features = ["password-hash", "std"] +version = "0.6.0" +features = ["alloc", "password-hash", "rand_core"] # Constant-time base64 [workspace.dependencies.base64ct] -version = "1.8.0" +version = "1.8.3" features = ["std"] # Bcrypt password hashing @@ -180,8 +181,8 @@ features = ["derive"] # Object Identifiers (OIDs) as constants [workspace.dependencies.const-oid] -version = "0.9.6" -features = ["std"] +version = "0.10.2" +features = ["db"] # Utility for converting between different cases [workspace.dependencies.convert_case] @@ -201,7 +202,7 @@ version = "1.4.0" # DER encoding [workspace.dependencies.der] -version = "0.7.10" +version = "0.8.0" features = ["std"] # Interactive CLI dialogs @@ -212,7 +213,7 @@ features = ["fuzzy-select", "password"] # Cryptographic digest algorithms [workspace.dependencies.digest] -version = "0.10.7" +version = "0.11.3" # Load environment variables from .env files [workspace.dependencies.dotenvy] @@ -220,13 +221,13 @@ version = "0.15.7" # ECDSA algorithms [workspace.dependencies.ecdsa] -version = "0.16.9" -features = ["signing", "verifying"] +version = "0.17.0" +features = ["alloc", "der", "pem", "pkcs8", "std"] # Elliptic curve cryptography [workspace.dependencies.elliptic-curve] -version = "0.13.8" -features = ["std", "pem", "sec1"] +version = "0.14.1" +features = ["std", "pem", "pkcs8", "arithmetic"] # Configuration loading [workspace.dependencies.figment] @@ -241,10 +242,6 @@ version = "1.2.2" [workspace.dependencies.futures-util] version = "0.3.31" -# Fixed-size arrays with trait implementations -[workspace.dependencies.generic-array] -version = "0.14.7" - # Rate-limiting [workspace.dependencies.governor] version = "0.10.1" @@ -253,7 +250,7 @@ features = ["std", "dashmap", "quanta"] # HMAC calculation [workspace.dependencies.hmac] -version = "0.12.1" +version = "0.13.0" # HTTP headers [workspace.dependencies.headers] @@ -349,8 +346,8 @@ version = "0.15.0" # K256 elliptic curve [workspace.dependencies.k256] -version = "0.13.4" -features = ["std"] +version = "0.14.0" +features = ["std", "ecdsa", "pem", "pkcs8"] # RFC 5646 language tags [workspace.dependencies.language-tags] @@ -439,13 +436,13 @@ default-features = false # P256 elliptic curve [workspace.dependencies.p256] -version = "0.13.2" -features = ["std"] +version = "0.14.0" +features = ["std", "ecdsa", "pem", "pkcs8"] # P384 elliptic curve [workspace.dependencies.p384] -version = "0.13.1" -features = ["std"] +version = "0.14.0" +features = ["std", "ecdsa", "pem", "pkcs8"] # Text padding utilities [workspace.dependencies.pad] @@ -453,12 +450,12 @@ version = "0.1.6" # PBKDF2 password hashing [workspace.dependencies.pbkdf2] -version = "0.12.2" -features = ["password-hash", "std", "simple", "parallel"] +version = "0.13.0" +features = ["phc", "sha2", "alloc"] # PEM encoding/decoding [workspace.dependencies.pem-rfc7468] -version = "0.7.0" +version = "1.0.0" features = ["std"] # Parser generator @@ -474,14 +471,15 @@ version = "2.8.3" version = "0.2.16" # PKCS#1 encoding +# Pinned: release candidates break their API between releases [workspace.dependencies.pkcs1] -version = "0.7.5" +version = "=0.8.0-rc.5" features = ["std"] # PKCS#8 encoding [workspace.dependencies.pkcs8] -version = "0.10.2" -features = ["std", "pkcs5", "encryption"] +version = "0.11.0" +features = ["std", "pem", "encryption"] # Public Suffix List [workspace.dependencies.psl] @@ -493,11 +491,11 @@ version = "0.12.6" # Random values [workspace.dependencies.rand] -version = "0.8.5" +version = "0.10.1" [workspace.dependencies.rand_chacha] -version = "0.3.1" +version = "0.10.0" [workspace.dependencies.rand_core] -version = "0.6.4" +version = "0.10.1" # Regular expressions [workspace.dependencies.regex] @@ -518,9 +516,10 @@ features = [ ] # RSA cryptography +# Pinned: release candidates break their API between releases [workspace.dependencies.rsa] -version = "0.9.10" -features = ["std", "pem"] +version = "=0.10.0-rc.19" +features = ["std", "encoding"] # Fast hash algorithm for HashMap [workspace.dependencies.rustc-hash] @@ -549,7 +548,7 @@ features = ["url2", "chrono04", "preserve_order"] # SEC1 encoding format [workspace.dependencies.sec1] -version = "0.7.3" +version = "0.8.1" features = ["std"] # Query builder @@ -607,12 +606,13 @@ version = "0.9.34" # SHA-2 cryptographic hash algorithm [workspace.dependencies.sha2] -version = "0.10.9" +version = "0.11.0" features = ["oid"] # Digital signature traits [workspace.dependencies.signature] -version = "2.2.0" +version = "3.0.0" +features = ["alloc", "rand_core"] # Low-level socket manipulation [workspace.dependencies.socket2] @@ -620,7 +620,7 @@ version = "0.6.2" # Subject Public Key Info [workspace.dependencies.spki] -version = "0.7.3" +version = "0.8.0" features = ["std"] # SQL database support diff --git a/clippy.toml b/clippy.toml index 109d36d5d..3482c2f0d 100644 --- a/clippy.toml +++ b/clippy.toml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -6,7 +7,7 @@ doc-valid-idents = ["OpenID", "OAuth", "UserInfo", "..", "PostgreSQL", "SQLite"] disallowed-methods = [ - { path = "rand::thread_rng", reason = "do not create rngs on the fly, pass them as parameters" }, + { path = "rand::rng", reason = "do not create rngs on the fly, pass them as parameters" }, { path = "chrono::Utc::now", reason = "source the current time from the clock instead" }, # ulid's own constructors/accessors below either use ulid's (separate) `rand` # or its `std`-only SystemTime API. Use `mas_data_model::UlidExt` instead so our diff --git a/crates/axum-utils/src/csrf.rs b/crates/axum-utils/src/csrf.rs index a4ef49b76..078e9814f 100644 --- a/crates/axum-utils/src/csrf.rs +++ b/crates/axum-utils/src/csrf.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -7,7 +8,10 @@ use base64ct::{Base64UrlUnpadded, Encoding}; use chrono::{DateTime, Duration, Utc}; use mas_data_model::Clock; -use rand::{Rng, RngCore, distributions::Standard, prelude::Distribution as _}; +use rand::{ + Rng, RngExt, + distr::{Distribution as _, StandardUniform}, +}; use serde::{Deserialize, Serialize}; use serde_with::{TimestampSeconds, serde_as}; use thiserror::Error; @@ -55,8 +59,8 @@ impl CsrfToken { } /// Generate a new random token valid for a specified duration - fn generate(now: DateTime, mut rng: impl Rng, ttl: Duration) -> Self { - let token = Standard.sample(&mut rng); + fn generate(now: DateTime, mut rng: impl RngExt, ttl: Duration) -> Self { + let token = StandardUniform.sample(&mut rng); Self::new(token, now, ttl) } @@ -108,7 +112,7 @@ pub trait CsrfExt { /// if necessary fn csrf_token(self, clock: &C, rng: R) -> (CsrfToken, Self) where - R: RngCore, + R: Rng, C: Clock; /// Verify that the given CSRF-protected form is valid, returning the inner @@ -126,7 +130,7 @@ pub trait CsrfExt { impl CsrfExt for CookieJar { fn csrf_token(self, clock: &C, rng: R) -> (CsrfToken, Self) where - R: RngCore, + R: Rng, C: Clock, { let now = clock.now(); diff --git a/crates/cli/src/app_state.rs b/crates/cli/src/app_state.rs index 6a9b455fa..b662b6b8c 100644 --- a/crates/cli/src/app_state.rs +++ b/crates/cli/src/app_state.rs @@ -243,9 +243,9 @@ impl FromRequestParts for BoxRng { ) -> impl Future> + Send { // This rng is used to source the local rng #[expect(clippy::disallowed_methods)] - let rng = rand::thread_rng(); + let mut rng = rand::rng(); - let rng = rand_chacha::ChaChaRng::from_rng(rng).expect("Failed to seed RNG"); + let rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let rng: Self = Box::new(rng); ready(Ok(rng)) } diff --git a/crates/cli/src/commands/config.rs b/crates/cli/src/commands/config.rs index ae4d329ff..015d25257 100644 --- a/crates/cli/src/commands/config.rs +++ b/crates/cli/src/commands/config.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -98,8 +99,10 @@ impl Options { let _span = info_span!("cli.config.generate").entered(); let clock = SystemClock::default(); - // XXX: we should disallow SeedableRng::from_entropy - let mut rng = rand_chacha::ChaChaRng::from_entropy(); + // Seed the RNG from the thread RNG. `rand::rng()` is normally + // disallowed (we inject RNGs), but this is a top-level entry point. + #[expect(clippy::disallowed_methods)] + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut rand::rng()); let mut config = RootConfig::generate(&mut rng).await?; if !synapse_config.is_empty() { diff --git a/crates/cli/src/commands/manage.rs b/crates/cli/src/commands/manage.rs index 65aceda4d..91716d3d3 100644 --- a/crates/cli/src/commands/manage.rs +++ b/crates/cli/src/commands/manage.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -33,8 +34,8 @@ use mas_storage::{ }; use mas_storage_pg::{DatabaseError, PgRepository}; use rand::{ - RngCore, SeedableRng, - distributions::{Alphanumeric, DistString as _}, + Rng, SeedableRng, + distr::{Alphanumeric, SampleString as _}, }; use sqlx::{Acquire, types::Uuid}; use tracing::{error, info, info_span, warn}; @@ -222,8 +223,10 @@ impl Options { pub async fn run(self, figment: &Figment) -> anyhow::Result { use Subcommand as SC; let clock = SystemClock::default(); - // XXX: we should disallow SeedableRng::from_entropy - let mut rng = rand_chacha::ChaChaRng::from_entropy(); + // Seed the RNG from the thread RNG. `rand::rng()` is normally disallowed + // (we inject RNGs), but this is a top-level entry point. + #[expect(clippy::disallowed_methods)] + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut rand::rng()); match self.subcommand { SC::SetPassword { @@ -1112,7 +1115,7 @@ impl UserCreationRequest<'_> { async fn do_register( self, repo: &mut dyn RepositoryAccess, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, ) -> Result { let Self { diff --git a/crates/cli/src/commands/syn2mas.rs b/crates/cli/src/commands/syn2mas.rs index 4f7983e24..c1a54c1c6 100644 --- a/crates/cli/src/commands/syn2mas.rs +++ b/crates/cli/src/commands/syn2mas.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -14,7 +15,7 @@ use mas_config::{ UpstreamOAuth2Config, }; use mas_data_model::SystemClock; -use rand::thread_rng; +use rand::rng; use sqlx::{Connection, Either, PgConnection, postgres::PgConnectOptions, types::Uuid}; use syn2mas::{ LockedMasDatabase, MasWriter, Progress, ProgressStage, SynapseReader, synapse_config, @@ -257,7 +258,7 @@ impl Options { let clock = SystemClock::default(); // TODO is this rng ok? #[expect(clippy::disallowed_methods)] - let mut rng = thread_rng(); + let mut rng = rng(); let progress = Progress::default(); diff --git a/crates/cli/src/commands/templates.rs b/crates/cli/src/commands/templates.rs index 875122406..7e724e87c 100644 --- a/crates/cli/src/commands/templates.rs +++ b/crates/cli/src/commands/templates.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -73,11 +74,13 @@ impl Options { } else { SystemClock::default().now() }; + // `rand::rng()` is normally disallowed (we inject RNGs), but this + // is a top-level entry point. + #[expect(clippy::disallowed_methods)] let rng = if stabilise { rand_chacha::ChaChaRng::from_seed([42; 32]) } else { - // XXX: we should disallow SeedableRng::from_entropy - rand_chacha::ChaChaRng::from_entropy() + rand_chacha::ChaChaRng::from_rng(&mut rand::rng()) }; let url_builder = mas_router::UrlBuilder::new("https://example.com/".parse()?, None, None); diff --git a/crates/config/src/sections/matrix.rs b/crates/config/src/sections/matrix.rs index 25c43620c..7391e5d2d 100644 --- a/crates/config/src/sections/matrix.rs +++ b/crates/config/src/sections/matrix.rs @@ -8,8 +8,8 @@ use anyhow::bail; use camino::Utf8PathBuf; use rand::{ - Rng, - distributions::{Alphanumeric, DistString}, + RngExt, + distr::{Alphanumeric, SampleString}, }; use schemars::JsonSchema; use serde::{Deserialize, Serialize}; @@ -143,7 +143,7 @@ impl MatrixConfig { pub(crate) fn generate(mut rng: R) -> Self where - R: Rng + Send, + R: RngExt + Send, { Self { kind: HomeserverKind::default(), diff --git a/crates/config/src/sections/mod.rs b/crates/config/src/sections/mod.rs index 04519e220..2f233108e 100644 --- a/crates/config/src/sections/mod.rs +++ b/crates/config/src/sections/mod.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -6,7 +7,7 @@ use anyhow::bail; use camino::Utf8PathBuf; -use rand::Rng; +use rand::RngExt; use schemars::JsonSchema; use serde::{Deserialize, Serialize}; @@ -172,7 +173,7 @@ impl RootConfig { /// Returns an error if the secrets could not be generated pub async fn generate(mut rng: R) -> anyhow::Result where - R: Rng + Send, + R: RngExt + Send, { Ok(Self { clients: ClientsConfig::default(), diff --git a/crates/config/src/sections/secrets.rs b/crates/config/src/sections/secrets.rs index 31d44124d..e52490fd6 100644 --- a/crates/config/src/sections/secrets.rs +++ b/crates/config/src/sections/secrets.rs @@ -12,7 +12,10 @@ use camino::Utf8PathBuf; use futures_util::future::{try_join, try_join_all}; use mas_jose::jwk::{JsonWebKey, JsonWebKeySet, Thumbprint}; use mas_keystore::{Encrypter, Keystore, PrivateKey}; -use rand::{Rng, SeedableRng, distributions::Standard, prelude::Distribution as _}; +use rand::{ + RngExt, SeedableRng, + distr::{Distribution as _, StandardUniform}, +}; use schemars::JsonSchema; use serde::{Deserialize, Serialize}; use serde_with::serde_as; @@ -347,12 +350,12 @@ impl SecretsConfig { #[tracing::instrument(skip_all)] pub(crate) async fn generate(mut rng: R) -> anyhow::Result where - R: Rng + Send, + R: RngExt + Send, { info!("Generating keys..."); let span = tracing::info_span!("rsa"); - let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng)?; + let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let rsa_key = task::spawn_blocking(move || { let _entered = span.enter(); let ret = PrivateKey::generate_rsa(key_rng).unwrap(); @@ -368,7 +371,7 @@ impl SecretsConfig { }; let span = tracing::info_span!("ec_p256"); - let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng)?; + let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let ec_p256_key = task::spawn_blocking(move || { let _entered = span.enter(); let ret = PrivateKey::generate_ec_p256(key_rng); @@ -384,7 +387,7 @@ impl SecretsConfig { }; let span = tracing::info_span!("ec_p384"); - let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng)?; + let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let ec_p384_key = task::spawn_blocking(move || { let _entered = span.enter(); let ret = PrivateKey::generate_ec_p384(key_rng); @@ -400,7 +403,7 @@ impl SecretsConfig { }; let span = tracing::info_span!("ec_k256"); - let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng)?; + let key_rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let ec_k256_key = task::spawn_blocking(move || { let _entered = span.enter(); let ret = PrivateKey::generate_ec_k256(key_rng); @@ -416,7 +419,7 @@ impl SecretsConfig { }; Ok(Self { - encryption: Encryption::Value(Standard.sample(&mut rng)), + encryption: Encryption::Value(StandardUniform.sample(&mut rng)), keys: Some(vec![rsa_key, ec_p256_key, ec_p384_key, ec_k256_key]), keys_dir: None, }) diff --git a/crates/data-model/src/compat/device.rs b/crates/data-model/src/compat/device.rs index e275b740f..16b7e9b8c 100644 --- a/crates/data-model/src/compat/device.rs +++ b/crates/data-model/src/compat/device.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -6,8 +7,8 @@ use oauth2_types::scope::ScopeToken; use rand::{ - RngCore, - distributions::{Alphanumeric, DistString}, + Rng, + distr::{Alphanumeric, SampleString}, }; use serde::{Deserialize, Serialize}; use thiserror::Error; @@ -58,7 +59,7 @@ impl Device { } /// Generate a random device ID - pub fn generate(rng: &mut R) -> Self { + pub fn generate(rng: &mut R) -> Self { let id: String = Alphanumeric.sample_string(rng, GENERATED_DEVICE_ID_LENGTH); Self { id } } diff --git a/crates/data-model/src/oauth2/authorization_grant.rs b/crates/data-model/src/oauth2/authorization_grant.rs index 23d0489a9..ddfed4240 100644 --- a/crates/data-model/src/oauth2/authorization_grant.rs +++ b/crates/data-model/src/oauth2/authorization_grant.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -14,8 +15,8 @@ use oauth2_types::{ scope::{OPENID, PROFILE, Scope}, }; use rand::{ - RngCore, - distributions::{Alphanumeric, DistString}, + Rng, + distr::{Alphanumeric, SampleString}, }; use serde::Serialize; use ulid::Ulid; @@ -224,7 +225,7 @@ impl AuthorizationGrant { } #[doc(hidden)] - pub fn sample(now: DateTime, rng: &mut impl RngCore) -> Self { + pub fn sample(now: DateTime, rng: &mut impl Rng) -> Self { Self { id: Ulid::from_datetime_with_rng(now, rng), stage: AuthorizationGrantStage::Pending, diff --git a/crates/data-model/src/oauth2/client.rs b/crates/data-model/src/oauth2/client.rs index 1e8058000..ea08cd2c5 100644 --- a/crates/data-model/src/oauth2/client.rs +++ b/crates/data-model/src/oauth2/client.rs @@ -13,7 +13,7 @@ use oauth2_types::{ registration::{ClientMetadata, Localized}, requests::GrantType, }; -use rand::RngCore; +use rand::Rng; use serde::Serialize; use thiserror::Error; use ulid::Ulid; @@ -181,7 +181,7 @@ impl Client { } #[doc(hidden)] - pub fn samples(now: DateTime, rng: &mut impl RngCore) -> Vec { + pub fn samples(now: DateTime, rng: &mut impl Rng) -> Vec { vec![ // A client with all the URIs set Self { diff --git a/crates/data-model/src/oauth2/device_code_grant.rs b/crates/data-model/src/oauth2/device_code_grant.rs index 6fb62a940..d3b2bbadd 100644 --- a/crates/data-model/src/oauth2/device_code_grant.rs +++ b/crates/data-model/src/oauth2/device_code_grant.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -8,7 +9,7 @@ use std::net::IpAddr; use chrono::{DateTime, Utc}; use oauth2_types::scope::Scope; -use rand::{Rng, RngCore}; +use rand::{Rng, RngExt}; use serde::Serialize; use ulid::Ulid; @@ -30,9 +31,9 @@ const USER_CODE_ALPHABET: &[u8; 32] = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ"; const USER_CODE_LENGTH: usize = 6; /// Generate a random user code for a device code grant. -pub fn generate_user_code(rng: &mut R) -> String { +pub fn generate_user_code(rng: &mut R) -> String { (0..USER_CODE_LENGTH) - .map(|_| char::from(USER_CODE_ALPHABET[rng.gen_range(0..USER_CODE_ALPHABET.len())])) + .map(|_| char::from(USER_CODE_ALPHABET[rng.random_range(0..USER_CODE_ALPHABET.len())])) .collect() } diff --git a/crates/data-model/src/tokens.rs b/crates/data-model/src/tokens.rs index 750179d38..aa7bda2bd 100644 --- a/crates/data-model/src/tokens.rs +++ b/crates/data-model/src/tokens.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -8,7 +9,7 @@ use base64ct::{Base64UrlUnpadded, Encoding}; use chrono::{DateTime, Utc}; use crc::{CRC_32_ISO_HDLC, Crc}; use mas_iana::oauth::OAuthTokenTypeHint; -use rand::{Rng, RngCore, distributions::Alphanumeric}; +use rand::{Rng, RngExt, distr::Alphanumeric}; use thiserror::Error; use ulid::Ulid; @@ -280,7 +281,7 @@ impl TokenType { } /// Generate a token for the given type - pub fn generate(self, rng: &mut (impl RngCore + ?Sized)) -> String { + pub fn generate(self, rng: &mut (impl Rng + ?Sized)) -> String { let random_part: String = rng .sample_iter(&Alphanumeric) .take(30) @@ -409,7 +410,7 @@ pub enum TokenFormatError { mod tests { use std::collections::HashSet; - use rand::thread_rng; + use rand::rng; use super::*; @@ -469,7 +470,7 @@ mod tests { const COUNT: usize = 500; // Generate 500 of each token type #[expect(clippy::disallowed_methods)] - let mut rng = thread_rng(); + let mut rng = rng(); for t in [ TokenType::CompatAccessToken, diff --git a/crates/data-model/src/users.rs b/crates/data-model/src/users.rs index a1f1df661..eaa245d62 100644 --- a/crates/data-model/src/users.rs +++ b/crates/data-model/src/users.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -7,7 +8,7 @@ use std::net::IpAddr; use chrono::{DateTime, Utc}; -use rand::Rng; +use rand::RngExt; use serde::Serialize; use ulid::Ulid; use url::Url; @@ -57,7 +58,7 @@ impl User { impl User { #[doc(hidden)] #[must_use] - pub fn samples(now: chrono::DateTime, rng: &mut impl Rng) -> Vec { + pub fn samples(now: chrono::DateTime, rng: &mut impl RngExt) -> Vec { vec![User { id: Ulid::from_datetime_with_rng(now, rng), username: "john".to_owned(), @@ -173,7 +174,7 @@ impl BrowserSession { impl BrowserSession { #[must_use] - pub fn samples(now: chrono::DateTime, rng: &mut impl Rng) -> Vec { + pub fn samples(now: chrono::DateTime, rng: &mut impl RngExt) -> Vec { User::samples(now, rng) .into_iter() .map(|user| BrowserSession { @@ -201,7 +202,7 @@ pub struct UserEmail { impl UserEmail { #[must_use] - pub fn samples(now: chrono::DateTime, rng: &mut impl Rng) -> Vec { + pub fn samples(now: chrono::DateTime, rng: &mut impl RngExt) -> Vec { vec![ Self { id: Ulid::from_datetime_with_rng(now, rng), diff --git a/crates/data-model/src/utils.rs b/crates/data-model/src/utils.rs index d50724eea..9c23110e2 100644 --- a/crates/data-model/src/utils.rs +++ b/crates/data-model/src/utils.rs @@ -5,8 +5,7 @@ // Please see LICENSE files in the repository root for full details. use chrono::{DateTime, Utc}; -use rand::Rng; -use rand_chacha::rand_core::CryptoRngCore; +use rand::{CryptoRng, RngExt}; use ulid::Ulid; use crate::clock::Clock; @@ -14,7 +13,7 @@ use crate::clock::Clock; /// A boxed [`Clock`] pub type BoxClock = Box; /// A boxed random number generator -pub type BoxRng = Box; +pub type BoxRng = Box; /// Extension trait on [`Ulid`] to build and inspect ULIDs using `chrono` /// timestamps and an injected RNG. @@ -25,19 +24,19 @@ pub trait UlidExt: Sized { /// This reproduces the exact bit layout of `ulid`'s own /// `Ulid::from_datetime_with_source` (48 timestamp bits, then 80 random /// bits drawn as a `u16` followed by a `u64`). - fn from_datetime_with_rng(datetime: DateTime, rng: &mut R) -> Self; + fn from_datetime_with_rng(datetime: DateTime, rng: &mut R) -> Self; /// The creation timestamp encoded in this [`Ulid`], as a `chrono` datetime. fn datetime_utc(&self) -> DateTime; } impl UlidExt for Ulid { - fn from_datetime_with_rng(datetime: DateTime, rng: &mut R) -> Self { + fn from_datetime_with_rng(datetime: DateTime, rng: &mut R) -> Self { let timestamp_ms = u64::try_from(datetime.timestamp_millis()).unwrap_or(0); let timebits = timestamp_ms & ((1 << Ulid::TIME_BITS) - 1); - let msb = timebits << 16 | u64::from(rng.r#gen::()); - let lsb = rng.r#gen::(); + let msb = timebits << 16 | u64::from(rng.random::()); + let lsb = rng.random::(); Ulid::from(u128::from(msb) << 64 | u128::from(lsb)) } diff --git a/crates/handlers/src/admin/v1/user_registration_tokens/add.rs b/crates/handlers/src/admin/v1/user_registration_tokens/add.rs index 3e641e25d..111d40cd9 100644 --- a/crates/handlers/src/admin/v1/user_registration_tokens/add.rs +++ b/crates/handlers/src/admin/v1/user_registration_tokens/add.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // Copyright 2025 The Matrix.org Foundation C.I.C. // @@ -10,7 +11,7 @@ use chrono::{DateTime, Utc}; use hyper::StatusCode; use mas_axum_utils::record_error; use mas_data_model::BoxRng; -use rand::distributions::{Alphanumeric, DistString}; +use rand::distr::{Alphanumeric, SampleString}; use schemars::JsonSchema; use serde::Deserialize; diff --git a/crates/handlers/src/compat/login.rs b/crates/handlers/src/compat/login.rs index f30b1bab4..b4175b3ae 100644 --- a/crates/handlers/src/compat/login.rs +++ b/crates/handlers/src/compat/login.rs @@ -31,7 +31,7 @@ use mas_storage::{ user::{UserPasswordRepository, UserRepository}, }; use opentelemetry::{Key, KeyValue, metrics::Counter}; -use rand::{CryptoRng, RngCore}; +use rand::{CryptoRng, Rng}; use serde::{Deserialize, Serialize}; use serde_with::{DurationMilliSeconds, serde_as, skip_serializing_none}; use thiserror::Error; @@ -533,7 +533,7 @@ pub(crate) async fn post( /// [`Policy::evaluate_compat_login`], return the appropriate `RouteError` /// response. async fn process_violations_for_compat_login( - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, repo: &mut BoxRepository, session_limit_config: Option<&SessionLimitConfig>, @@ -772,7 +772,7 @@ async fn find_lru_compat_sessions_flawed( } async fn token_login( - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, repo: &mut BoxRepository, policy: &mut Policy, @@ -913,7 +913,7 @@ async fn token_login( } async fn user_password_login( - mut rng: &mut (impl RngCore + CryptoRng + Send), + mut rng: &mut (impl CryptoRng + Send), clock: &impl Clock, password_manager: &PasswordManager, limiter: &Limiter, @@ -1036,7 +1036,7 @@ mod tests { use assert_matches::assert_matches; use hyper::Request; use mas_matrix::{HomeserverConnection, ProvisionRequest}; - use rand::distributions::{Alphanumeric, DistString}; + use rand::distr::{Alphanumeric, SampleString}; use sqlx::PgPool; use super::*; diff --git a/crates/handlers/src/compat/login_sso_redirect.rs b/crates/handlers/src/compat/login_sso_redirect.rs index 8edb868fd..4f2233ef1 100644 --- a/crates/handlers/src/compat/login_sso_redirect.rs +++ b/crates/handlers/src/compat/login_sso_redirect.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -11,7 +12,7 @@ use mas_axum_utils::{GenericError, InternalError}; use mas_data_model::{BoxClock, BoxRng}; use mas_router::{CompatLoginSsoAction, CompatLoginSsoComplete, UrlBuilder}; use mas_storage::{BoxRepository, compat::CompatSsoLoginRepository}; -use rand::distributions::{Alphanumeric, DistString}; +use rand::distr::{Alphanumeric, SampleString}; use serde::Deserialize; use thiserror::Error; use url::Url; diff --git a/crates/handlers/src/graphql/mod.rs b/crates/handlers/src/graphql/mod.rs index d3c3fb9b8..2089d4636 100644 --- a/crates/handlers/src/graphql/mod.rs +++ b/crates/handlers/src/graphql/mod.rs @@ -46,7 +46,7 @@ use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryError}; use opentelemetry_semantic_conventions::trace::{ GRAPHQL_DOCUMENT, GRAPHQL_OPERATION_NAME, GRAPHQL_OPERATION_TYPE, }; -use rand::{SeedableRng, thread_rng}; +use rand::{SeedableRng, rng}; use rand_chacha::ChaChaRng; use state::has_session_ended; use tracing::{Instrument, info_span}; @@ -125,9 +125,9 @@ impl state::State for GraphQLState { fn rng(&self) -> BoxRng { #[expect(clippy::disallowed_methods)] - let rng = thread_rng(); + let mut rng = rng(); - let rng = ChaChaRng::from_rng(rng).expect("Failed to seed rng"); + let rng = ChaChaRng::from_rng(&mut rng); Box::new(rng) } } diff --git a/crates/handlers/src/oauth2/authorization/mod.rs b/crates/handlers/src/oauth2/authorization/mod.rs index b72e58056..3a45d4207 100644 --- a/crates/handlers/src/oauth2/authorization/mod.rs +++ b/crates/handlers/src/oauth2/authorization/mod.rs @@ -27,7 +27,7 @@ use oauth2_types::{ requests::{AuthorizationRequest, GrantType, Prompt, ResponseMode}, response_type::ResponseType, }; -use rand::{Rng, distributions::Alphanumeric}; +use rand::{RngExt, distr::Alphanumeric}; use serde::Deserialize; use thiserror::Error; diff --git a/crates/handlers/src/oauth2/device/authorize.rs b/crates/handlers/src/oauth2/device/authorize.rs index 827b4f3d5..e486075c0 100644 --- a/crates/handlers/src/oauth2/device/authorize.rs +++ b/crates/handlers/src/oauth2/device/authorize.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -23,7 +24,7 @@ use oauth2_types::{ requests::{DeviceAuthorizationRequest, DeviceAuthorizationResponse, GrantType}, scope::ScopeToken, }; -use rand::distributions::{Alphanumeric, DistString}; +use rand::distr::{Alphanumeric, SampleString}; use thiserror::Error; use ulid::Ulid; diff --git a/crates/handlers/src/oauth2/mod.rs b/crates/handlers/src/oauth2/mod.rs index cf28818e2..bfbc28553 100644 --- a/crates/handlers/src/oauth2/mod.rs +++ b/crates/handlers/src/oauth2/mod.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -45,7 +46,7 @@ pub(crate) enum IdTokenSignatureError { } pub(crate) fn generate_id_token( - rng: &mut (impl rand::RngCore + rand::CryptoRng), + rng: &mut impl rand::CryptoRng, clock: &impl Clock, url_builder: &UrlBuilder, key_store: &Keystore, @@ -96,7 +97,7 @@ pub(crate) fn generate_id_token( } pub(crate) async fn generate_token_pair( - rng: &mut (impl rand::RngCore + Send), + rng: &mut (impl rand::Rng + Send), clock: &impl Clock, repo: &mut R, session: &Session, diff --git a/crates/handlers/src/oauth2/registration.rs b/crates/handlers/src/oauth2/registration.rs index e47546479..d3176adad 100644 --- a/crates/handlers/src/oauth2/registration.rs +++ b/crates/handlers/src/oauth2/registration.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -25,7 +26,7 @@ use oauth2_types::{ }; use opentelemetry::{Key, KeyValue, metrics::Counter}; use psl::Psl; -use rand::distributions::{Alphanumeric, DistString}; +use rand::distr::{Alphanumeric, SampleString}; use serde::Serialize; use sha2::Digest as _; use thiserror::Error; diff --git a/crates/handlers/src/passwords.rs b/crates/handlers/src/passwords.rs index 23b8dd0cc..ec0b14a10 100644 --- a/crates/handlers/src/passwords.rs +++ b/crates/handlers/src/passwords.rs @@ -8,10 +8,13 @@ use std::{collections::HashMap, sync::Arc}; use anyhow::Context; -use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier, password_hash::SaltString}; +use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier}; use futures_util::future::OptionFuture; use pbkdf2::{Pbkdf2, password_hash}; -use rand::{CryptoRng, RngCore, SeedableRng, distributions::Standard, prelude::Distribution}; +use rand::{ + CryptoRng, SeedableRng, + distr::{Distribution, StandardUniform}, +}; use thiserror::Error; use zeroize::Zeroizing; use zxcvbn::zxcvbn; @@ -163,16 +166,16 @@ impl PasswordManager { /// Returns an error if the hashing failed or if the password manager is /// disabled #[tracing::instrument(name = "passwords.hash", skip_all)] - pub async fn hash( + pub async fn hash( &self, - rng: R, + mut rng: R, password: Zeroizing, ) -> Result<(SchemeVersion, String), anyhow::Error> { let inner = self.get_inner()?; // Seed a future-local RNG so the RNG passed in parameters doesn't have to be // 'static - let rng = rand_chacha::ChaChaRng::from_rng(rng)?; + let rng = rand_chacha::ChaChaRng::from_rng(&mut rng); let span = tracing::Span::current(); // `inner` is being moved in the blocking task, so we need to copy the version @@ -230,7 +233,7 @@ impl PasswordManager { /// Returns an error if the password hash verification failed or if the /// password manager is disabled #[tracing::instrument(name = "passwords.verify_and_upgrade", skip_all, fields(%scheme))] - pub async fn verify_and_upgrade( + pub async fn verify_and_upgrade( &self, rng: R, scheme: SchemeVersion, @@ -311,7 +314,7 @@ impl Hasher { } } - fn hash_blocking( + fn hash_blocking( &self, rng: R, password: Zeroizing, @@ -342,7 +345,7 @@ enum Algorithm { } impl Algorithm { - fn hash_blocking( + fn hash_blocking( self, mut rng: R, password: &[u8], @@ -355,7 +358,7 @@ impl Algorithm { password.extend_from_slice(pepper); } - let salt = Standard.sample(&mut rng); + let salt = StandardUniform.sample(&mut rng); let hashed = bcrypt::hash_with_salt(password, cost.unwrap_or(12), salt)?; Ok(hashed.format_for_version(bcrypt::Version::TwoB)) @@ -372,8 +375,7 @@ impl Algorithm { Argon2::new(algorithm, version, params) }; - let salt = SaltString::generate(rng); - let hashed = phf.hash_password(password.as_ref(), &salt)?; + let hashed = phf.hash_password_with_rng(&mut rng, password.as_ref())?; Ok(hashed.to_string()) } @@ -383,8 +385,8 @@ impl Algorithm { password.extend_from_slice(pepper); } - let salt = SaltString::generate(rng); - let hashed = Pbkdf2.hash_password(password.as_ref(), &salt)?; + let hashed = + Pbkdf2::default().hash_password_with_rng(&mut rng, password.as_ref())?; Ok(hashed.to_string()) } } @@ -422,7 +424,9 @@ impl Algorithm { match phf.verify_password(password.as_ref(), &hashed_password) { Ok(()) => PasswordVerificationResult::success(), - Err(password_hash::Error::Password) => PasswordVerificationResult::failure(), + Err(password_hash::Error::PasswordInvalid) => { + PasswordVerificationResult::failure() + } Err(e) => Err(e)?, } } @@ -435,9 +439,11 @@ impl Algorithm { let hashed_password = PasswordHash::new(hashed_password)?; - match Pbkdf2.verify_password(password.as_ref(), &hashed_password) { + match Pbkdf2::default().verify_password(password.as_ref(), &hashed_password) { Ok(()) => PasswordVerificationResult::success(), - Err(password_hash::Error::Password) => PasswordVerificationResult::failure(), + Err(password_hash::Error::PasswordInvalid) => { + PasswordVerificationResult::failure() + } Err(e) => Err(e)?, } } diff --git a/crates/handlers/src/session.rs b/crates/handlers/src/session.rs index 5ca543d71..cafcb46a1 100644 --- a/crates/handlers/src/session.rs +++ b/crates/handlers/src/session.rs @@ -18,7 +18,7 @@ use mas_storage::{ personal::PersonalSessionFilter, }; use mas_templates::{AccountInactiveContext, TemplateContext, Templates}; -use rand::RngCore; +use rand::Rng; use thiserror::Error; #[derive(Debug, Error)] @@ -60,7 +60,7 @@ pub fn render_account_inactive( templates: &Templates, locale: &DataLocale, clock: &impl Clock, - rng: impl RngCore, + rng: impl Rng, cookie_jar: CookieJar, user: User, action: Option, @@ -93,7 +93,7 @@ pub fn render_account_inactive( pub async fn load_session_or_fallback( cookie_jar: CookieJar, clock: &impl Clock, - rng: impl RngCore, + rng: impl Rng, templates: &Templates, locale: &DataLocale, action: Option, diff --git a/crates/handlers/src/test_utils.rs b/crates/handlers/src/test_utils.rs index 56df8d652..f3e125b50 100644 --- a/crates/handlers/src/test_utils.rs +++ b/crates/handlers/src/test_utils.rs @@ -469,7 +469,7 @@ impl TestState { /// Panics if the RNG is already locked. pub fn rng(&self) -> ChaChaRng { let mut parent_rng = self.rng.try_lock().expect("Failed to lock RNG"); - ChaChaRng::from_rng(&mut *parent_rng).unwrap() + ChaChaRng::from_rng(&mut *parent_rng) } /// Do a call to the userinfo endpoint to check if the given token is valid. @@ -546,7 +546,7 @@ impl graphql::State for TestGraphQLState { fn rng(&self) -> BoxRng { let mut parent_rng = self.rng.lock().expect("Failed to lock RNG"); - let rng = ChaChaRng::from_rng(&mut *parent_rng).expect("Failed to seed RNG"); + let rng = ChaChaRng::from_rng(&mut *parent_rng); Box::new(rng) } } @@ -684,7 +684,7 @@ impl FromRequestParts for BoxRng { state: &TestState, ) -> impl Future> + Send { let mut parent_rng = state.rng.lock().expect("Failed to lock RNG"); - let rng = ChaChaRng::from_rng(&mut *parent_rng).expect("Failed to seed RNG"); + let rng = ChaChaRng::from_rng(&mut *parent_rng); let rng: Self = Box::new(rng); ready(Ok(rng)) } diff --git a/crates/handlers/src/views/login.rs b/crates/handlers/src/views/login.rs index 98fe1a88e..23a7e31a3 100644 --- a/crates/handlers/src/views/login.rs +++ b/crates/handlers/src/views/login.rs @@ -32,7 +32,7 @@ use mas_templates::{ ToFormState, }; use opentelemetry::{Key, KeyValue, metrics::Counter}; -use rand::Rng; +use rand::RngExt; use serde::{Deserialize, Serialize}; use zeroize::Zeroizing; @@ -430,7 +430,7 @@ async fn render( action: OptionalPostAuthAction, repo: &mut impl RepositoryAccess, clock: &impl Clock, - rng: impl Rng, + rng: impl RngExt, templates: &Templates, homeserver: &dyn HomeserverConnection, site_config: &SiteConfig, diff --git a/crates/jose/Cargo.toml b/crates/jose/Cargo.toml index ac9c4d96a..11d265611 100644 --- a/crates/jose/Cargo.toml +++ b/crates/jose/Cargo.toml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -23,7 +24,6 @@ chrono.workspace = true digest.workspace = true ecdsa.workspace = true elliptic-curve.workspace = true -generic-array.workspace = true hmac.workspace = true k256.workspace = true p256.workspace = true diff --git a/crates/jose/src/jwa/asymmetric.rs b/crates/jose/src/jwa/asymmetric.rs index b490d5796..ffdf3cb69 100644 --- a/crates/jose/src/jwa/asymmetric.rs +++ b/crates/jose/src/jwa/asymmetric.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -7,7 +8,7 @@ use digest::Digest; use mas_iana::jose::{JsonWebKeyEcEllipticCurve, JsonWebSignatureAlg}; use sha2::{Sha256, Sha384, Sha512}; -use signature::rand_core::CryptoRngCore; +use signature::rand_core::TryCryptoRng; use thiserror::Error; use super::signature::Signature; @@ -231,9 +232,9 @@ impl From for AsymmetricSigningKey { } impl signature::RandomizedSigner for AsymmetricSigningKey { - fn try_sign_with_rng( + fn try_sign_with_rng( &self, - rng: &mut impl CryptoRngCore, + rng: &mut R, msg: &[u8], ) -> Result { match self { diff --git a/crates/jose/src/jwa/hmac.rs b/crates/jose/src/jwa/hmac.rs index ba24ee960..c12251133 100644 --- a/crates/jose/src/jwa/hmac.rs +++ b/crates/jose/src/jwa/hmac.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -7,32 +8,32 @@ use std::marker::PhantomData; use digest::{ - Digest, Mac, OutputSizeUser, - crypto_common::BlockSizeUser, - generic_array::{ArrayLength, GenericArray}, + Digest, KeyInit, Mac, OutputSizeUser, + array::{Array, ArraySize}, + block_api::BlockSizeUser, }; use signature::{Signer, Verifier}; use thiserror::Error; -pub struct Signature> { - signature: GenericArray, +pub struct Signature { + signature: Array, } -impl> PartialEq for Signature { +impl PartialEq for Signature { fn eq(&self, other: &Self) -> bool { self.signature == other.signature } } -impl> Eq for Signature {} +impl Eq for Signature {} -impl> std::fmt::Debug for Signature { +impl std::fmt::Debug for Signature { fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { write!(f, "{:?}", self.signature) } } -impl> Clone for Signature { +impl Clone for Signature { fn clone(&self) -> Self { Self { signature: self.signature.clone(), @@ -40,30 +41,30 @@ impl> Clone for Signature { } } -impl> From> for GenericArray { +impl From> for Array { fn from(val: Signature) -> Self { val.signature } } -impl<'a, S: ArrayLength> TryFrom<&'a [u8]> for Signature { +impl<'a, S: ArraySize> TryFrom<&'a [u8]> for Signature { type Error = InvalidLength; fn try_from(value: &'a [u8]) -> Result { if value.len() != S::to_usize() { return Err(InvalidLength); } - let mut signature = GenericArray::default(); + let mut signature = Array::default(); signature.copy_from_slice(value); Ok(Self { signature }) } } -impl> signature::SignatureEncoding for Signature { - type Repr = GenericArray; +impl signature::SignatureEncoding for Signature { + type Repr = Array; } -impl> AsRef<[u8]> for Signature { +impl AsRef<[u8]> for Signature { fn as_ref(&self) -> &[u8] { self.signature.as_ref() } @@ -104,7 +105,7 @@ impl msg: &[u8], ) -> Result as OutputSizeUser>::OutputSize>, signature::Error> { - let mut mac = as Mac>::new_from_slice(&self.key) + let mut mac = as KeyInit>::new_from_slice(&self.key) .map_err(signature::Error::from_source)?; mac.update(msg); let signature = mac.finalize().into_bytes(); diff --git a/crates/jose/src/jwa/symmetric.rs b/crates/jose/src/jwa/symmetric.rs index 3e45b6ab0..8231b44dc 100644 --- a/crates/jose/src/jwa/symmetric.rs +++ b/crates/jose/src/jwa/symmetric.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -80,9 +81,9 @@ impl From for SymmetricKey { } impl signature::RandomizedSigner for SymmetricKey { - fn try_sign_with_rng( + fn try_sign_with_rng( &self, - _rng: &mut (impl rand::CryptoRng + rand::RngCore), + _rng: &mut R, msg: &[u8], ) -> Result { // XXX: is that implementation alright? diff --git a/crates/jose/src/jwk/private_parameters.rs b/crates/jose/src/jwk/private_parameters.rs index 5e0bc01ae..1735dba01 100644 --- a/crates/jose/src/jwk/private_parameters.rs +++ b/crates/jose/src/jwk/private_parameters.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -200,7 +201,7 @@ struct RsaOtherPrimeInfo { } mod rsa_impls { - use rsa::{BigUint, RsaPrivateKey}; + use rsa::{BoxedUint, RsaPrivateKey}; use super::RsaPrivateParameters; @@ -215,14 +216,14 @@ mod rsa_impls { type Error = rsa::errors::Error; fn try_from(value: &RsaPrivateParameters) -> Result { - let n = BigUint::from_bytes_be(value.n.as_bytes()); - let e = BigUint::from_bytes_be(value.e.as_bytes()); - let d = BigUint::from_bytes_be(value.d.as_bytes()); + let n = BoxedUint::from_be_slice_vartime(value.n.as_bytes()); + let e = BoxedUint::from_be_slice_vartime(value.e.as_bytes()); + let d = BoxedUint::from_be_slice_vartime(value.d.as_bytes()); let primes = [&value.p, &value.q] .into_iter() .chain(value.oth.iter().flatten().map(|o| &o.r)) - .map(|i| BigUint::from_bytes_be(i.as_bytes())) + .map(|i| BoxedUint::from_be_slice_vartime(i.as_bytes())) .collect(); let key = RsaPrivateKey::from_components(n, e, d, primes)?; @@ -273,7 +274,7 @@ impl From for super::public_parameters::EcPublicParameters mod ec_impls { use elliptic_curve::{ AffinePoint, Curve, SecretKey, - sec1::{Coordinates, FromEncodedPoint, ModulusSize, ToEncodedPoint}, + sec1::{Coordinates, FromSec1Point, ModulusSize, ToSec1Point}, }; use super::{super::JwkEcCurve, EcPrivateParameters}; @@ -303,7 +304,7 @@ mod ec_impls { impl From> for EcPrivateParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: SecretKey) -> Self { @@ -314,11 +315,11 @@ mod ec_impls { impl From<&SecretKey> for EcPrivateParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: &SecretKey) -> Self { - let point = key.public_key().to_encoded_point(false); + let point = key.public_key().to_sec1_point(false); let Coordinates::Uncompressed { x, y } = point.coordinates() else { unreachable!() }; diff --git a/crates/jose/src/jwk/public_parameters.rs b/crates/jose/src/jwk/public_parameters.rs index f4b57c532..b4f01cab7 100644 --- a/crates/jose/src/jwk/public_parameters.rs +++ b/crates/jose/src/jwk/public_parameters.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -176,7 +177,7 @@ impl OkpPublicParameters { } mod rsa_impls { - use rsa::{BigUint, RsaPublicKey, traits::PublicKeyParts}; + use rsa::{BoxedUint, RsaPublicKey, traits::PublicKeyParts}; use super::{JsonWebKeyPublicParameters, RsaPublicParameters}; use crate::base64::Base64UrlNoPad; @@ -202,8 +203,8 @@ mod rsa_impls { impl From<&RsaPublicKey> for RsaPublicParameters { fn from(key: &RsaPublicKey) -> Self { Self { - n: Base64UrlNoPad::new(key.n().to_bytes_be()), - e: Base64UrlNoPad::new(key.e().to_bytes_be()), + n: Base64UrlNoPad::new(key.n().to_be_bytes_trimmed_vartime().into_vec()), + e: Base64UrlNoPad::new(key.e().to_be_bytes_trimmed_vartime().into_vec()), } } } @@ -218,8 +219,8 @@ mod rsa_impls { impl TryFrom<&RsaPublicParameters> for RsaPublicKey { type Error = rsa::errors::Error; fn try_from(value: &RsaPublicParameters) -> Result { - let n = BigUint::from_bytes_be(value.n.as_bytes()); - let e = BigUint::from_bytes_be(value.e.as_bytes()); + let n = BoxedUint::from_be_slice_vartime(value.n.as_bytes()); + let e = BoxedUint::from_be_slice_vartime(value.e.as_bytes()); let key = RsaPublicKey::new(n, e)?; Ok(key) } @@ -228,10 +229,9 @@ mod rsa_impls { mod ec_impls { use digest::typenum::Unsigned; - use ecdsa::EncodedPoint; use elliptic_curve::{ AffinePoint, FieldBytes, PublicKey, - sec1::{Coordinates, FromEncodedPoint, ModulusSize, ToEncodedPoint}, + sec1::{Coordinates, FromSec1Point, ModulusSize, Sec1Point, ToSec1Point}, }; use super::{super::JwkEcCurve, EcPublicParameters, JsonWebKeyPublicParameters}; @@ -240,7 +240,7 @@ mod ec_impls { impl TryFrom<&EcPublicParameters> for PublicKey where C: elliptic_curve::CurveArithmetic, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize + Unsigned, { type Error = elliptic_curve::Error; @@ -256,10 +256,10 @@ mod ec_impls { .get(..C::FieldBytesSize::USIZE) .ok_or(elliptic_curve::Error)?; - let x = FieldBytes::::from_slice(x); - let y = FieldBytes::::from_slice(y); - let pubkey = EncodedPoint::::from_affine_coordinates(x, y, false); - let pubkey: Option<_> = PublicKey::from_encoded_point(&pubkey).into(); + let x = FieldBytes::::try_from(x).map_err(|_| elliptic_curve::Error)?; + let y = FieldBytes::::try_from(y).map_err(|_| elliptic_curve::Error)?; + let pubkey = Sec1Point::::from_affine_coordinates(&x, &y, false); + let pubkey: Option<_> = PublicKey::from_sec1_point(&pubkey).into(); pubkey.ok_or(elliptic_curve::Error) } } @@ -267,7 +267,7 @@ mod ec_impls { impl From> for JsonWebKeyPublicParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: PublicKey) -> Self { @@ -278,7 +278,7 @@ mod ec_impls { impl From<&PublicKey> for JsonWebKeyPublicParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: &PublicKey) -> Self { @@ -289,7 +289,7 @@ mod ec_impls { impl From> for EcPublicParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: PublicKey) -> Self { @@ -300,11 +300,11 @@ mod ec_impls { impl From<&PublicKey> for EcPublicParameters where C: elliptic_curve::CurveArithmetic + JwkEcCurve, - AffinePoint: FromEncodedPoint + ToEncodedPoint, + AffinePoint: FromSec1Point + ToSec1Point, C::FieldBytesSize: ModulusSize, { fn from(key: &PublicKey) -> Self { - let point = key.to_encoded_point(false); + let point = key.to_sec1_point(false); let Coordinates::Uncompressed { x, y } = point.coordinates() else { unreachable!() }; diff --git a/crates/jose/src/jwt/signed.rs b/crates/jose/src/jwt/signed.rs index 5a495f256..2c5f4cc80 100644 --- a/crates/jose/src/jwt/signed.rs +++ b/crates/jose/src/jwt/signed.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -5,9 +6,9 @@ // Please see LICENSE files in the repository root for full details. use base64ct::{Base64UrlUnpadded, Encoding}; -use rand::thread_rng; +use rand::rng; use serde::{Serialize, de::DeserializeOwned}; -use signature::{RandomizedSigner, SignatureEncoding, Verifier, rand_core::CryptoRngCore}; +use signature::{RandomizedSigner, SignatureEncoding, Verifier, rand_core::CryptoRng}; use thiserror::Error; use super::{header::JsonWebSignatureHeader, raw::RawJwt}; @@ -325,7 +326,7 @@ impl Jwt<'static, T> { T: Serialize, { #[expect(clippy::disallowed_methods)] - Self::sign_with_rng(&mut thread_rng(), header, payload, key) + Self::sign_with_rng(&mut rng(), header, payload, key) } /// Sign the given payload with the given key using the given RNG. @@ -341,7 +342,7 @@ impl Jwt<'static, T> { key: &K, ) -> Result where - R: CryptoRngCore, + R: CryptoRng, K: RandomizedSigner, S: SignatureEncoding, T: Serialize, @@ -378,7 +379,7 @@ impl Jwt<'static, T> { mod tests { #![allow(clippy::disallowed_methods)] use mas_iana::jose::JsonWebSignatureAlg; - use rand::thread_rng; + use rand::rng; use super::*; @@ -406,7 +407,10 @@ mod tests { let header = JsonWebSignatureHeader::new(JsonWebSignatureAlg::Es256); let payload = serde_json::json!({"hello": "world"}); - let key = ecdsa::SigningKey::::random(&mut thread_rng()); + let key = + as elliptic_curve::Generate>::generate_from_rng( + &mut rng(), + ); let signed = Jwt::sign::<_, ecdsa::Signature<_>>(header, payload, &key).unwrap(); signed .verify::<_, ecdsa::Signature<_>>(key.verifying_key()) diff --git a/crates/keystore/src/lib.rs b/crates/keystore/src/lib.rs index fa9d305bb..c9c7685b6 100644 --- a/crates/keystore/src/lib.rs +++ b/crates/keystore/src/lib.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -8,19 +9,18 @@ use std::{ops::Deref, sync::Arc}; -use der::{Decode, Encode, EncodePem, zeroize::Zeroizing}; -use elliptic_curve::{pkcs8::EncodePrivateKey, sec1::ToEncodedPoint}; +use der::{Decode, Encode, EncodePem, pem::PemLabel, zeroize::Zeroizing}; +use elliptic_curve::{Generate, pkcs8::EncodePrivateKey, sec1::ToSec1Point}; use mas_iana::jose::{JsonWebKeyType, JsonWebSignatureAlg}; pub use mas_jose::jwk::{JsonWebKey, JsonWebKeySet}; use mas_jose::{ jwa::{AsymmetricSigningKey, AsymmetricVerifyingKey}, jwk::{JsonWebKeyPublicParameters, ParametersInfo, PublicJsonWebKeySet, Thumbprint}, }; -use pem_rfc7468::PemLabel; use pkcs1::EncodeRsaPrivateKey; -use pkcs8::{AssociatedOid, PrivateKeyInfo}; -use rand::{CryptoRng, RngCore}; -use rsa::BigUint; +use pkcs8::{AssociatedOid, PrivateKeyInfoRef}; +use rand::CryptoRng; +use rsa::BoxedUint; use thiserror::Error; mod encrypter; @@ -133,7 +133,7 @@ pub enum PrivateKey { pub struct WrongAlgorithmError; impl PrivateKey { - fn from_pkcs1_private_key(pkcs1_key: &pkcs1::RsaPrivateKey) -> Result { + fn from_pkcs1_private_key(pkcs1_key: &pkcs1::RsaPrivateKeyRef<'_>) -> Result { // Taken from `TryFrom> for RsaPrivateKey` // Multi-prime RSA keys not currently supported @@ -141,17 +141,17 @@ impl PrivateKey { return Err(pkcs1::Error::Version.into()); } - let n = BigUint::from_bytes_be(pkcs1_key.modulus.as_bytes()); - let e = BigUint::from_bytes_be(pkcs1_key.public_exponent.as_bytes()); - let d = BigUint::from_bytes_be(pkcs1_key.private_exponent.as_bytes()); - let first_prime = BigUint::from_bytes_be(pkcs1_key.prime1.as_bytes()); - let second_prime = BigUint::from_bytes_be(pkcs1_key.prime2.as_bytes()); + let n = BoxedUint::from_be_slice_vartime(pkcs1_key.modulus.as_bytes()); + let e = BoxedUint::from_be_slice_vartime(pkcs1_key.public_exponent.as_bytes()); + let d = BoxedUint::from_be_slice_vartime(pkcs1_key.private_exponent.as_bytes()); + let first_prime = BoxedUint::from_be_slice_vartime(pkcs1_key.prime1.as_bytes()); + let second_prime = BoxedUint::from_be_slice_vartime(pkcs1_key.prime2.as_bytes()); let primes = vec![first_prime, second_prime]; let key = rsa::RsaPrivateKey::from_components(n, e, d, primes)?; Ok(Self::Rsa(Box::new(key))) } - fn from_private_key_info(info: PrivateKeyInfo) -> Result { + fn from_private_key_info(info: PrivateKeyInfoRef<'_>) -> Result { match info.algorithm.oid { pkcs1::ALGORITHM_OID => Ok(Self::Rsa(Box::new(info.try_into()?))), elliptic_curve::ALGORITHM_OID => match info.algorithm.parameters_oid()? { @@ -287,16 +287,16 @@ impl PrivateKey { /// - the key could not be decrypted /// - the PKCS8 key could not be loaded pub fn load_encrypted_der(der: &[u8], password: impl AsRef<[u8]>) -> Result { - if let Ok(info) = pkcs8::EncryptedPrivateKeyInfo::from_der(der) { + if let Ok(info) = pkcs8::EncryptedPrivateKeyInfoRef::from_der(der) { let decrypted = info.decrypt(password)?; return Self::load_der(decrypted.as_bytes()).map_err(|inner| LoadError::InEncrypted { inner: Box::new(inner), }); } - if pkcs8::PrivateKeyInfo::from_der(der).is_ok() + if pkcs8::PrivateKeyInfoRef::from_der(der).is_ok() || sec1::EcPrivateKey::from_der(der).is_ok() - || pkcs1::RsaPrivateKey::from_der(der).is_ok() + || pkcs1::RsaPrivateKeyRef::from_der(der).is_ok() { return Err(LoadError::Unencrypted); } @@ -317,11 +317,11 @@ impl PrivateKey { /// - the PKCS8/SEC1/PKCS1 key could not be loaded pub fn load_der(der: &[u8]) -> Result { // Let's try evey known DER format one after the other - if pkcs8::EncryptedPrivateKeyInfo::from_der(der).is_ok() { + if pkcs8::EncryptedPrivateKeyInfoRef::from_der(der).is_ok() { return Err(LoadError::Encrypted); } - if let Ok(info) = pkcs8::PrivateKeyInfo::from_der(der) { + if let Ok(info) = pkcs8::PrivateKeyInfoRef::from_der(der) { return Self::from_private_key_info(info); } @@ -329,7 +329,7 @@ impl PrivateKey { return Self::from_ec_private_key(info); } - if let Ok(pkcs1_key) = pkcs1::RsaPrivateKey::from_der(der) { + if let Ok(pkcs1_key) = pkcs1::RsaPrivateKeyRef::from_der(der) { return Self::from_pkcs1_private_key(&pkcs1_key); } @@ -351,16 +351,16 @@ impl PrivateKey { let (label, doc) = pem_rfc7468::decode_vec(pem.as_bytes())?; match label { - pkcs8::EncryptedPrivateKeyInfo::PEM_LABEL => { - let info = pkcs8::EncryptedPrivateKeyInfo::from_der(&doc)?; + pkcs8::EncryptedPrivateKeyInfoRef::PEM_LABEL => { + let info = pkcs8::EncryptedPrivateKeyInfoRef::from_der(&doc)?; let decrypted = info.decrypt(password)?; Self::load_der(decrypted.as_bytes()).map_err(|inner| LoadError::InEncrypted { inner: Box::new(inner), }) } - pkcs1::RsaPrivateKey::PEM_LABEL - | pkcs8::PrivateKeyInfo::PEM_LABEL + pkcs1::RsaPrivateKeyRef::PEM_LABEL + | pkcs8::PrivateKeyInfoRef::PEM_LABEL | sec1::EcPrivateKey::PEM_LABEL => Err(LoadError::Unencrypted), label => Err(LoadError::UnsupportedPemLabel { @@ -383,13 +383,13 @@ impl PrivateKey { let (label, doc) = pem_rfc7468::decode_vec(pem.as_bytes())?; match label { - pkcs1::RsaPrivateKey::PEM_LABEL => { - let pkcs1_key = pkcs1::RsaPrivateKey::from_der(&doc)?; + pkcs1::RsaPrivateKeyRef::PEM_LABEL => { + let pkcs1_key = pkcs1::RsaPrivateKeyRef::from_der(&doc)?; Self::from_pkcs1_private_key(&pkcs1_key) } - pkcs8::PrivateKeyInfo::PEM_LABEL => { - let info = pkcs8::PrivateKeyInfo::from_der(&doc)?; + pkcs8::PrivateKeyInfoRef::PEM_LABEL => { + let info = pkcs8::PrivateKeyInfoRef::from_der(&doc)?; Self::from_private_key_info(info) } @@ -398,7 +398,7 @@ impl PrivateKey { Self::from_ec_private_key(key) } - pkcs8::EncryptedPrivateKeyInfo::PEM_LABEL => Err(LoadError::Encrypted), + pkcs8::EncryptedPrivateKeyInfoRef::PEM_LABEL => Err(LoadError::Encrypted), label => Err(LoadError::UnsupportedPemLabel { label: label.to_owned(), @@ -495,26 +495,26 @@ impl PrivateKey { /// # Errors /// /// Returns any error from the underlying key generator - pub fn generate_rsa(mut rng: R) -> Result { + pub fn generate_rsa(mut rng: R) -> Result { let key = rsa::RsaPrivateKey::new(&mut rng, 2048)?; Ok(Self::Rsa(Box::new(key))) } /// Generate an Elliptic Curve key for the P-256 curve - pub fn generate_ec_p256(mut rng: R) -> Self { - let key = elliptic_curve::SecretKey::random(&mut rng); + pub fn generate_ec_p256(mut rng: R) -> Self { + let key = elliptic_curve::SecretKey::generate_from_rng(&mut rng); Self::EcP256(Box::new(key)) } /// Generate an Elliptic Curve key for the P-384 curve - pub fn generate_ec_p384(mut rng: R) -> Self { - let key = elliptic_curve::SecretKey::random(&mut rng); + pub fn generate_ec_p384(mut rng: R) -> Self { + let key = elliptic_curve::SecretKey::generate_from_rng(&mut rng); Self::EcP384(Box::new(key)) } /// Generate an Elliptic Curve key for the secp256k1 curve - pub fn generate_ec_k256(mut rng: R) -> Self { - let key = elliptic_curve::SecretKey::random(&mut rng); + pub fn generate_ec_k256(mut rng: R) -> Self { + let key = elliptic_curve::SecretKey::generate_from_rng(&mut rng); Self::EcK256(Box::new(key)) } } @@ -525,11 +525,11 @@ impl PrivateKey { fn to_sec1_der(key: &elliptic_curve::SecretKey) -> Result>, der::Error> where C: elliptic_curve::Curve + elliptic_curve::CurveArithmetic + AssociatedOid, - elliptic_curve::PublicKey: elliptic_curve::sec1::ToEncodedPoint, + elliptic_curve::PublicKey: elliptic_curve::sec1::ToSec1Point, C::FieldBytesSize: elliptic_curve::sec1::ModulusSize, { let private_key_bytes = Zeroizing::new(key.to_bytes()); - let public_key_bytes = key.public_key().to_encoded_point(false); + let public_key_bytes = key.public_key().to_sec1_point(false); Ok(Zeroizing::new( sec1::EcPrivateKey { private_key: &private_key_bytes, @@ -546,11 +546,11 @@ fn to_sec1_pem( ) -> Result, der::Error> where C: elliptic_curve::Curve + elliptic_curve::CurveArithmetic + AssociatedOid, - elliptic_curve::PublicKey: elliptic_curve::sec1::ToEncodedPoint, + elliptic_curve::PublicKey: elliptic_curve::sec1::ToSec1Point, C::FieldBytesSize: elliptic_curve::sec1::ModulusSize, { let private_key_bytes = Zeroizing::new(key.to_bytes()); - let public_key_bytes = key.public_key().to_encoded_point(false); + let public_key_bytes = key.public_key().to_sec1_point(false); Ok(Zeroizing::new( sec1::EcPrivateKey { private_key: &private_key_bytes, diff --git a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-2.snap b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-2.snap index 42a2f0945..4a4f80bd7 100644 --- a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-2.snap +++ b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-2.snap @@ -1,10 +1,9 @@ --- source: crates/keystore/tests/keystore.rs -expression: "ec_p256.to_pem(LineEnding::LF).unwrap()" +expression: "&*ec_p256.to_pem(LineEnding::LF).unwrap()" --- -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIH3L+ZYgfEaJtclP07qPQBrmkHEhYkyYooxvU8AlSW+CoAoGCCqGSM49 -AwEHoUQDQgAEXcA+X+lhDCmmzaUQFh7i7gkT7mwdrRUsMl9RSfyWh93n+xq3O4/m -vMmUnlvy7tBoHkcAdTJ+Zkv+loLw+mkcBA== +MHcCAQEEILI2J4kLaLQCw/EUtQupK0g4Hd5K2rpL7DPf8JxJR8sXoAoGCCqGSM49 +AwEHoUQDQgAExoXwK0I+5KIXMQcact2A5BTX8T8UDH5zHCBL7hKxO6y69kAn2NIP +9VZgChemq1baX+/4eZMgYbsFjjZxCepjFw== -----END EC PRIVATE KEY----- - diff --git a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-3.snap b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-3.snap index b71a5dcad..a42f9e68c 100644 --- a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-3.snap +++ b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-3.snap @@ -1,11 +1,10 @@ --- source: crates/keystore/tests/keystore.rs -expression: "ec_p384.to_pem(LineEnding::LF).unwrap()" +expression: "&*ec_p384.to_pem(LineEnding::LF).unwrap()" --- -----BEGIN EC PRIVATE KEY----- -MIGkAgEBBDAl3R97SR8hWLuMH6737YdvXVb7P7T9pKSIhQozmzN+r+V5Ncvjn+DQ -Q/QxYr9nLwOgBwYFK4EEACKhZANiAASa86XQW7CDF9GhvcBY53sJ4lP0z9rfrjwo -nwixQJIWBROjlpsm5hdIwLfj46IUPYCNEoD8VP8eR2s/uzlgEv1hnz/2wmLlMqU0 -2R5QcY7Gc9CyDTO1bh5V2FFYjks4xfs= +MIGkAgEBBDDSnZxO7HGescWZ8Lx5EnOSp/ep8AeJi5Phq3DGbqshMxDMIE89tQz5 +bKFDIry98DCgBwYFK4EEACKhZANiAAQvXEB4cXKh8IOp3H7DGeBEMl7tpkROyGqh +bcdbCIZ55BookRp7GpfUldNOW/z/iLs5m8as3P6h+2GtvmxitErGxLe+ziBh4MCH +/FiUkahhEaRkZN3wZax5cquzSESgYns= -----END EC PRIVATE KEY----- - diff --git a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-4.snap b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-4.snap index 850ca57cf..b97bdb87e 100644 --- a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-4.snap +++ b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-4.snap @@ -1,10 +1,9 @@ --- source: crates/keystore/tests/keystore.rs -expression: "ec_k256.to_pem(LineEnding::LF).unwrap()" +expression: "&*ec_k256.to_pem(LineEnding::LF).unwrap()" --- -----BEGIN EC PRIVATE KEY----- -MHQCAQEEIBcikq9QkV39T8VFZWD4j5wO9xm0FWxhuAmvDRpix8XUoAcGBSuBBAAK -oUQDQgAEf4htTtPsdxlZn1htWE3ueHT4JB/4n4lxVOQdT/3RFuCS5aKQ04oS9pKM -QAHAn1bjbLRQ88Yxi3CgHuCitS+RrA== +MHQCAQEEILWCa5ChwVAT7+XP9fGxVPzVBEE9SiFmzQrUYujA+qxPoAcGBSuBBAAK +oUQDQgAEljNWxpBfmKyeamlQsZHUq7Npp3a7NwI4tVTtZi10UvZSccc8LeOoJoFW +KneiunxfPzfWhQQH/ChWKtAAyrdm5Q== -----END EC PRIVATE KEY----- - diff --git a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-5.snap b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-5.snap index a38f81bbd..d00d0ca11 100644 --- a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-5.snap +++ b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify-5.snap @@ -4,18 +4,17 @@ expression: jwks --- keys: - kty: RSA - n: vClyfM076hWBZonjThx_PX46UQUWb2LfOpUV1655ZGoKMKgqanLMMfLBPjW9ouY6UtrZ7BxEgl01xLZ1dLdD2Ggb2IpwW56PUuZD2w9hJMungjR0ImymFBwjA9j2ucr0eIHdVQoOakEsrB0dqEC-3R7ax7piGCj9YB6uGZbDVfIJUv40o1pb-hvmmyQHwpoU4jR1y_V-OhrdFMPtwCXov2nlrqDb_e-T7TQlu4FN0URI6VxLNcSkgZfJH50PdJPr7AHqtnWhOGBfLaC9jDpGxfbjmC1iSMSzOt6WyVdcnqHv_JpzXu0SzFqpUSm3OI_l2DUjwTJBL1TOIRTVsjQN1w + n: yiR2hY43e0aMz4lhaQvnyjlbVhudk6KexRnJ35Cz5X_yifzlr2Ui006UOKoWPJoUCFrwOXC-rGnPlzqYDtjOLKWWvMdNUyIwfGoovRxqRrcoAHKl76Iuq9DFFSksI_aFmpwltVZaUbrsg6q8ptQ_E9uZfb7lTNoFBhjA3VUPhlWAQEvBpo78YlB8rD8z-OqAN92JeYM841c1r4W3-U9H7g9WuBO2FMedA0Zl1k2MEz50NcGUUe8YB1GcV8IsP2RiTKd8PwsjlM37xQ2j_l4MuU0zxXfWw35ukSjpQaOJcyU9FTLj6f-reLH0gpVCq8N4qRNQsbEhDxaJNE-VnDYMew e: AQAB - kty: EC crv: P-256 - x: XcA-X-lhDCmmzaUQFh7i7gkT7mwdrRUsMl9RSfyWh90 - y: 5_satzuP5rzJlJ5b8u7QaB5HAHUyfmZL_paC8PppHAQ + x: xoXwK0I-5KIXMQcact2A5BTX8T8UDH5zHCBL7hKxO6w + y: uvZAJ9jSD_VWYAoXpqtW2l_v-HmTIGG7BY42cQnqYxc - kty: EC crv: P-384 - x: mvOl0FuwgxfRob3AWOd7CeJT9M_a3648KJ8IsUCSFgUTo5abJuYXSMC34-OiFD2A - y: jRKA_FT_HkdrP7s5YBL9YZ8_9sJi5TKlNNkeUHGOxnPQsg0ztW4eVdhRWI5LOMX7 + x: L1xAeHFyofCDqdx-wxngRDJe7aZETshqoW3HWwiGeeQaKJEaexqX1JXTTlv8_4i7 + y: OZvGrNz-ofthrb5sYrRKxsS3vs4gYeDAh_xYlJGoYRGkZGTd8GWseXKrs0hEoGJ7 - kty: EC crv: secp256k1 - x: f4htTtPsdxlZn1htWE3ueHT4JB_4n4lxVOQdT_3RFuA - y: kuWikNOKEvaSjEABwJ9W42y0UPPGMYtwoB7gorUvkaw - + x: ljNWxpBfmKyeamlQsZHUq7Npp3a7NwI4tVTtZi10UvY + y: UnHHPC3jqCaBVip3orp8Xz831oUEB_woVirQAMq3ZuU diff --git a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify.snap b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify.snap index 13523757a..afe174dd4 100644 --- a/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify.snap +++ b/crates/keystore/tests/snapshots/keystore__generate_sign_and_verify.snap @@ -1,32 +1,31 @@ --- source: crates/keystore/tests/keystore.rs -expression: "rsa.to_pem(LineEnding::LF).unwrap()" +expression: "&*rsa.to_pem(LineEnding::LF).unwrap()" --- -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAvClyfM076hWBZonjThx/PX46UQUWb2LfOpUV1655ZGoKMKgq -anLMMfLBPjW9ouY6UtrZ7BxEgl01xLZ1dLdD2Ggb2IpwW56PUuZD2w9hJMungjR0 -ImymFBwjA9j2ucr0eIHdVQoOakEsrB0dqEC+3R7ax7piGCj9YB6uGZbDVfIJUv40 -o1pb+hvmmyQHwpoU4jR1y/V+OhrdFMPtwCXov2nlrqDb/e+T7TQlu4FN0URI6VxL -NcSkgZfJH50PdJPr7AHqtnWhOGBfLaC9jDpGxfbjmC1iSMSzOt6WyVdcnqHv/Jpz -Xu0SzFqpUSm3OI/l2DUjwTJBL1TOIRTVsjQN1wIDAQABAoIBAD4bcC7Bj4U0lAHE -gcLGpTkm8RjNFRqvB//ONed7L5Z1aeelmlqIid3ywtZF5tJeK+ItWsEUk4h0O8sy -bpKX600DEC3phCy5qZUzbDJiYS5ECoZvyeWS9z6sCuK6OrYYx5j/RI9NQnTQDm7B -LYjb1iQmixBh9P8EiJ2xgsXvfYpgSDv2nUBVywp8HUmadAqE89cBsyurvMpR6eY4 -HI0Wge+vIbh0KHj5h7sJ7C8mWBcnjkJ9hWSCumMth3wufEpfs4lCUjhojTkr6ioT -9Mok8VpZvsxzDw3Ubnut1lX7II2EYwNEfgm/Tcw4/NC2eLc1AjoshxLVLg5JWy85 -RGj7FAECgYEAyLTpdQjD0PrQBi6O5HWQnVMVvJQz6bihdKUrjwJOfWvqgKVpAVVQ -IbLUT3J6ooe4Tei6xc7viNA7JZ+KyRvaQuZT4nWW2AkOCOnaxH3NKI4cDpWsdNdC -jNBHnIUUvDU4c4CkgIc8f1Gezm9epDVsgb1+wxwSbB8Je4S7M8is1WUCgYEA7//M -f1UPl32yaXH7ag8DbWHMzeNRw5T+F3zTagp93mCM0mPYyjggMfwPFr7167ISWrG4 -6DfHHABqhjnAkKfrrFMN5Xm8oup60XXIox1FB4Ew4K0VzyMTnSMPMMEGJZx6VQJP -TlGpexs4t+1N/gWgcGv1OgZ+fw7hjcaFtTMAcIsCgYBY/W3tyF8aT7rgotAUl9Px -DZ+7p3KFFKnx0DJKDFnE3o5xT+YJA0yuRF5Cg53AZrDfSmtVvXUTklBHVD/y/3h8 -5ScYZ87kJs+kQBwRtz2515i1FsQKYk9NpCO8UH1rHaXUAJvvqQa35PamzVaHNHDR -7bVAyTeZ3QEVVTqzsSyAyQKBgQDDIcL+QIW10VBPJYqZ9+z8cUkYmVuwXqKdLDOk -gzVFqlC0+tOXzzx2B4+pGchPQ3Bi5x8FR9yOqtPxoGEt/CnE6Z5h1rIF8Am95jsk -TDcE3AiGlJQn30giOhAuvrIlwG1CUudyMTlQS5i5Cquf/qks3sn6zK7q1YmUQTYT -Vo1j8wKBgQCgSISkWgRrQhEdZKBBzcxkWyUXUMieZa+pPTooZGY1VAqyTSXHUlLi -mrWtJ4temNK6OE7xAWJMWL6cVAxQUrs8C11DS//IGMxlMF/7uMU6pOFmMqq52G3D -k3NkZSJmC1liFiu3Q6Q2UqGHRX8CS5MeLncReuNUnFOiX8X2fcjoRw== +MIIEpQIBAAKCAQEAyiR2hY43e0aMz4lhaQvnyjlbVhudk6KexRnJ35Cz5X/yifzl +r2Ui006UOKoWPJoUCFrwOXC+rGnPlzqYDtjOLKWWvMdNUyIwfGoovRxqRrcoAHKl +76Iuq9DFFSksI/aFmpwltVZaUbrsg6q8ptQ/E9uZfb7lTNoFBhjA3VUPhlWAQEvB +po78YlB8rD8z+OqAN92JeYM841c1r4W3+U9H7g9WuBO2FMedA0Zl1k2MEz50NcGU +Ue8YB1GcV8IsP2RiTKd8PwsjlM37xQ2j/l4MuU0zxXfWw35ukSjpQaOJcyU9FTLj +6f+reLH0gpVCq8N4qRNQsbEhDxaJNE+VnDYMewIDAQABAoIBACC/QXgnbvOInV0t +u1siM52+Jv7PIHr/WEtD/0E5lvsx/B/AmZENiFPFIhv/6fRNXbtwyAP2MN2LkrbE +JkgZdWUkOkRA4VT7b/Fn3Uuto8Xq/A7+g8VLd9YbzyG7dsworsI6U52J7L3a02AN +M9yu+70C0V3epBUMKM4xCmWQ1yACxim7NHzMa9tFzYPzZjQ7icDoY2Ku+Yh60HOc +HudGcw3T4QM4XYT4rubUnVA8iUWlFmqhSqJoaNXo5hZ4a5kmZJndTj9PsgZrweG/ +nksx7HVrljwOEUhFAr5TeOxwzIPiOaFPrKMHz7gux6S1hg5av/EgZFHWcG69bSsp +Oqk0ockCgYEA7dviO07nt6S6komg5ScXqpfNcY7FmANN9P1Qc5XHQC3m3JKbYOhb +o4HCBveJVgYoPRPsg9NLMZjFcI9ioM4MAM3Kmw0qEiiETtu/AVCHExQmY7RbpF2C +nknhSdi8tkKwoJqy+VgWZ1JtcbcIxbZTjPNFP8YleZGIrpC/tTldXS0CgYEA2Y86 +Ct0FRDesm/5Igz+jF66fjeuyVIWnrAijA4qVsanCaeqaVljOvdb7jdgv+xFxQwa8 +tGSfPZcJ2CDaXvdKBBQSYdGmAk1Csx7AhEcqGTlSB8AunEqVxSeRIo77TB63E45c +YETiww1xrWnwMrIk/yv4nQ4arobjk0z3Gv4ZKUcCgYEAkiItc9Keei0ykyULPL4v +xBdPmRzmOOaO1p1q+BhlOgD5fTp1S6x14Jav5ifesINH5X6AKN1/rRD2/JibN8Bf +j37fozMLTeymnOxVBTG8SvRuQYNlai4pOaaaSwxlpHSEn6drndWIriHuK5cQRKgn +3Mj5Gp1aGL5ZAybbITQFMGECgYEAsIq+IeSainHXOrqMoxy3vtbwGJ1Dl7zhhAN6 +LLx/nqzP210JornsAjb66G6e+NB9pVNJO+VPJw5yaZS3P0rSIB8dj40tdj61ul5h +ALYy3kcaXrm/2QnZISRrbKy0FV/zVgY2xdQAYyF8tqj5xlmzFfHbi67PTgKdl4Fk +H95EEq8CgYEAtnRVj6QTwewhyrohk7Um4hNDTztWsl/fp5nXLt6oMpdTpSNcZ8mN +BL9tkexGnVkFUFuLDFih5lR3vfWybgW5SYeqtPTN6H1WILg4/+hzz9Q7rocsD8IS +fvPh2AABTi/IG3o5LYYIhc2i6D+dgOIJIz9mSq8tEG19umGOcQrfC2w= -----END RSA PRIVATE KEY----- - diff --git a/crates/keystore/tests/snapshots/keystore__jwt_ES256.snap b/crates/keystore/tests/snapshots/keystore__jwt_ES256.snap index 562a72caf..3813aebd5 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_ES256.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_ES256.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJFUzI1NiJ9.IiI.Yvudbc_oPln_H02H9woFZurQrgzsuWGnRK2kZzat_rp2HYFZtYobvMw9LqPDgeqq9a1HiL_Hx796SqyobiTXJg +eyJhbGciOiJFUzI1NiJ9.IiI.1bCvHBi8U9PPx2AeivKsulmaWl3lBebZLkOmsDuEfgg-xDk70BiFMVYa_K3cB6eLJ4YevF8699mOPvoJTZHvxg diff --git a/crates/keystore/tests/snapshots/keystore__jwt_ES256K.snap b/crates/keystore/tests/snapshots/keystore__jwt_ES256K.snap index 9b937afdf..9e0c7bae6 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_ES256K.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_ES256K.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJFUzI1NksifQ.IiI.4q4ua7R-we5m58rKtLQDHJmQJb15dEUhj7A_H5kh591mrScXFmCYXVQI5iKKXGFHBV_AFISrJF4YjWCHDnLPeQ +eyJhbGciOiJFUzI1NksifQ.IiI.OZ2SAGjxchqzA-QlD5Ejp-Vbt4WFPvWX7x9mkeeuu6c6I1xFTyXZrk7MKp7DdQX4pxb_swhlhzU4DEDLgRrBLw diff --git a/crates/keystore/tests/snapshots/keystore__jwt_ES384.snap b/crates/keystore/tests/snapshots/keystore__jwt_ES384.snap index 5297e8c2f..34ad65455 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_ES384.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_ES384.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJFUzM4NCJ9.IiI.p9Otttjs3JOxZCeuIKwkql3YM-nfdxo__EVt84sex_PcokYjY47sa0qsvCqUUhpUoLSBihdchynuYqc5lOFuAM3Pi2pjg-ZrTqrzI23UlzFonlr4Zag9Qo3IYD10HKFq +eyJhbGciOiJFUzM4NCJ9.IiI.Yve7Rrfz6HK76aL_gQB8CchNTfj4IJw9hPxbQxjceOeOufe6ikY_1ZwndJaaP3Rh3DI6BwzazcTxrh7Y0l42O4WrFRg86QA1xi83jY_SFup20h933Xdy2Cox0LuzR4kU diff --git a/crates/keystore/tests/snapshots/keystore__jwt_PS256.snap b/crates/keystore/tests/snapshots/keystore__jwt_PS256.snap index 1d7c18db3..772d6d9e3 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_PS256.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_PS256.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJQUzI1NiJ9.IiI.HlJaOfS2PMi4mWzE8-0EgXt06-MeqzaLRy_04gs4HTS7FugbSJ0rJiwUwhss6O1KWT9TvDqo6AQBO_2hV1DKDiBIIh5Z6M92uC4MJNVLbAVQo6dSBt2DfSzioBI5MoDOBvgbIwSZAIFMqKTbYDa9rQ3XRAaClpqrIN-ACa3gz99ds5mYvUyiYsL5uuEBuWrp8DRk6WKjduhpOi4sMvylZbnfop1uHbvg6_dk5lzXt-1MKIW1QJW_63cFn7vdap5T9U4DBsEkCzYtuwgU-UCmsC8W07QEfcrJhHIlYoPQPHePKF0A4dVHKrgRmf1ik2p6e-VNw129JMvx0KO6v_JBww +eyJhbGciOiJQUzI1NiJ9.IiI.cG5_Q1ghrgjQ8gr8Zv7QJB0c-zK3kcoJ1uCn20BdI-1c8ixqpCHIq4xa-m04E84H5lN8jpWzbEl0XAf1c56n2DBGG8SgK9K5UgwajNEEiOzUXu7pXHq-6flPJ6KXK0NeSDtLFxNEfEzKkgJflMMHOXpBfkYKCvgmQlPHkcVO19id1_Yeq5L-POyeTjxlma2WyUliBzHOx2UXnu7wkj_K0a-sfRXhqV64bN-ywpC90x_enTer1Dur3PHDZnlmw5TGrxkg2Mpm_3gcrYv4SFAEE7QA1R9WFFDQt21c5kr-v9TMDg8LSRTGk7pGcMkgoREsywIoK3qZYzMmYs0mmG1ApA diff --git a/crates/keystore/tests/snapshots/keystore__jwt_PS384.snap b/crates/keystore/tests/snapshots/keystore__jwt_PS384.snap index 058db0ed5..ea167ef12 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_PS384.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_PS384.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJQUzM4NCJ9.IiI.AHBo1kZW72IQfs7NvjfrD_WpDa9avLdKyf_rqcCp0mJtGID60cgOG5RDTmI6K7TwzykW6l6LjEuYXDR8hemri6mQrtpQ6rMVTJwqJ6D8M92vH4b2gDBwSwbKz427bGdd_fnqm5K2ntwZGC7pceYg1zbcUQ6NJXs3vqKI6YSKustmm9yA1iMfugFG4eLAPrpfTtLmT1sSWYTYWHVT-6G5q7Bfk7Yu5aHiGDQTo427-Y9YF2fabIuDyCGG48UrBp0ajlm1MHKCBuOvK6NI5Jojd9IWDIf7tvAArsrKVR8QRvDXqqPInJEEZ5x7H1YEEZ5Qrh4XKVhRh9b3O-grDMxMng +eyJhbGciOiJQUzM4NCJ9.IiI.rDDCp3s3RQQGM0MVSclGp9Rv4Ngc87cF7z5NY8g-Mp60D_PcRoJ0M1mBmLR_O1s1kheNyyFiQvZY-N1vM2hXPXBLdzCmMjog69W9iWRyzAh4BTFO9DKoYw1ERZXN13UDQ0RdM_TQlDGo_Prk6LOn15E4Xz6uBbaum7YaHN99T5Ilj12OvDQ8bkUqEk9wgMPVWOdP-iEsdpFd2M3poE-VYLV6qIQ9B2jWOq56_wAS2cB-rCMJsL-4Ev_SrZAVjnc73GIvB75Sx5I9NexdGWzJh9wyJWw60J9cl178Ny2jVSHg-m8x2u8do8I0ObO0-27-cbcrVfn10hIjJpSNpNB1hg diff --git a/crates/keystore/tests/snapshots/keystore__jwt_PS512.snap b/crates/keystore/tests/snapshots/keystore__jwt_PS512.snap index 1736ec046..4a7275445 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_PS512.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_PS512.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJQUzUxMiJ9.IiI.o_-UDhc26qYAstuaFJQUz8OKw3UeMc4N7b3U4qcLM-84dxRdw-wBw1rf94jX71vsrFQ2bEh6J5fc4_VtYgKBb2P6QvoL55c7Gqr-5JBw8BkoiiCzlvKIsi_j41FH5Gb4ZBE5Nf9vZD7DnD9BhYXadxaiksx20oNRKIKQ3oMiJxH1w0c-miCSoIR0jnS1QLlKoHYVb7wnkCiR2SOYQ42Je8B8REVzWm2GrqS2cRWnpi3nHihrapruL_BA161Ip1uH4lUFdZLXeG-R6pAlg1OJ_QXSZlP16nzT6MAW_-IFXfioR1QKT8AFNBodY8zlQCGglMyppZi5Y9i7YaMxFgnM4A +eyJhbGciOiJQUzUxMiJ9.IiI.H-pMk9Ig2jCvM2eJnmclfN4V4fwQZO8kQKilXfNxJC2R-q1QbRv0iK6OU5uJk6zO03jc9s86GwHg_hkoT68oszC--ca83hSOQ3KAzF5YukrRuQbskbz3SZAvdjXNAd29JlGAAGc0tl86ghBrNkLLkhEDKAlHGMZqZXSUmAMecCgpu9IN6vXOdaqDOdyYR7BRmEm8sSnAvYVwxDCSdSYq7Yn0Dc3c5SlzjgF0UEEihy9dGmBVDVcMC3II9DOdSBghEyokjWXVSr423nosOd_XWO_TqcTjLo4evdwmNIhgyj1KtQ8YQfrMLisxk8570NSQSEzzRRk1st9zOS3zPlbY2A diff --git a/crates/keystore/tests/snapshots/keystore__jwt_RS256.snap b/crates/keystore/tests/snapshots/keystore__jwt_RS256.snap index 43d4230ea..ad87639de 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_RS256.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_RS256.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJSUzI1NiJ9.IiI.H_iz_ry505dPMNxQIi4raU88i3wu7DS0Rre6Qm_LJz0Ee_gd5C_t92fBcrFkber1XL_p8AvlXx4DT2Zr_PMBL_2IblJ7t0Od5wnGC__twarj0v1t6KfUkLXcJ3Jy-StnHNbFTmdFnLuGGWIO7xG9h6xgKIvTroVoLJekMzYCc0wSFiyCfaow4yuKesQHUO-N9VDDPoYhkCPqbhVI_d0y6u7KmQy97FbCdCIxvPGHWrwxWcmYbTh4K9xhGDspDUUEubjYTg3t-oaMc2TJqWvu2FE8jyD02A8OCgca6bCU3NmV_Qr6LSUpFNsL4c-0sIp3-L9ndEWzGnN-ZeeGKur-FQ +eyJhbGciOiJSUzI1NiJ9.IiI.gq_hQ6VcQNMVmKlQltK5pS_Yu8PoTCFoWHqQVj1VymYymuKJ9GSgPDxgtkPQVotB985ZaNCuLjoXA4x-xVgMTroSdTQiupBDPpzhZhOuHPgKFQzmC8aBkWxAF_xxLBlZOMwiSly6k_0afE5GgY1SnHu9I57TkGLwHQnTOvL-ED7LvkZxTefxxsDMjgZjboNEPEjbkHl859we5_nKMeL_8jUAhijvaksWZK8pNQdeqg9V9ZNHOgtUG1pPwlSYMjrOTk_a1y6yXAihvuZCwbCCiuquiPi1oWI9Nfv5YGeT8SjSDHAYYJTRyaNOo62fwFC-BuYjVDBdl3uZtO-Ys2g8CA diff --git a/crates/keystore/tests/snapshots/keystore__jwt_RS384.snap b/crates/keystore/tests/snapshots/keystore__jwt_RS384.snap index 1ba885663..8d928dd0f 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_RS384.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_RS384.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJSUzM4NCJ9.IiI.bxKYTQQ4RlxOUvxbU_kuwJKGXXiuIPeRgO78a_3zHjvxIzDNKDvQK3w4DUVTlibR-iTVOASRSycWifBJZx_tsU7-BSqrBcjMtgP7mW-HwZ6pANO071iPkkiQU7gqMzbc2tz4uqGI0Z0izkX0_9dOOFSb7jKIUMzzW1O14fBPhZ4kPqkj07A9S9LW9lauQUTXrFgyEaT6G372cyNxi3-T55u9lkjjiiVN4TAhkaXUSN79IE2rNstU8DtKKs725WNUFy30f1-Ftc-J2uGEOsMZ9CQvEVPwOKbvFY2Uh1S8-FT4ahhwj1fxrmUwDH2lSmz6Rj5zf9-FF-IzivSVq4Z4ig +eyJhbGciOiJSUzM4NCJ9.IiI.KXWxSvxoLuCwtpP-N0fCAFho6zFI44P-42ALMx70vQiM9C_MKbLGpmSET_-GJIQ-fjxJ8jpFmVQjfKuhzHpJZP6JVTHVFg34Z0KOKYM45QqLPooXOf7c9O46DczFoJC0mGuMAWsAtEvgvFgRYHe8KgPg_HBczcHZ71uYDLyz5BINqG_TaDRQBT5vNoPKrnP526CJrHHNT-h2XJumhOjC1XVDj8lj1hlWk63xepZ7fybhLIDAKuEgjfTLBkAaJ1V2hz46uD7g_vvGXGEiBDW93_zWKoTs9ZDrBt-kL82GGay3zLTRHFRORah4hI4GbnJHgy22Dj-RhTJm3deTejkSjg diff --git a/crates/keystore/tests/snapshots/keystore__jwt_RS512.snap b/crates/keystore/tests/snapshots/keystore__jwt_RS512.snap index 7312fefc3..e02dabab4 100644 --- a/crates/keystore/tests/snapshots/keystore__jwt_RS512.snap +++ b/crates/keystore/tests/snapshots/keystore__jwt_RS512.snap @@ -2,4 +2,4 @@ source: crates/keystore/tests/keystore.rs expression: token.as_str() --- -eyJhbGciOiJSUzUxMiJ9.IiI.nFsZ3X8GCgpPEojuEktc9a4C-YGQYx8XpbzhOkgnMVrw_wpqIQgWI--4r6BYV6TYAH8NBdQ8Dkdw6POh1Ni-vAtE2rAzjU19ySth5mfP7WEJXRxA1oEV3-dOqCgUI2JJEM13DuLlWFsUaOCbc1_kCkiziTcLtNap__EPGp5koRy-ZyVa1p_mQSQ4NlhJ3hZfHMGnQ0k3RWnpBn3AqERWllQllLniWGQ4l7rZStsD8PRr-rg7P7W7CRIyjrDqy_3bNJyKQCzs_oUrxO-Z7CU6-KfAeyM2U80TQvhZb-Z8_1dJ8e9WsfudQMLtHgO4tlD678Ywezjvr5ackZdn4QEEEA +eyJhbGciOiJSUzUxMiJ9.IiI.AwxfqjEihH6xYO8xNF24sg5cO8z2bS50V-27YQEViePcRlaqPZHXn6h45YxFXbElrXgKtM97y0KXa8Rr5TrfyH8VXB1OzHNyQ76cZ4zbfYveMZhBh7pGiHVMEPQ0ZErobZXyk9Rxe-HxK1zi9qmmJZLHsQLEFh5zDkTg5dgpEJcklxmCTCT0RLDcilsNdaL7XkTMyjmMck25xciteEy3mpGXppRuDQwsN4ywfNp9VDBC5NjxBYF39D7hkvybOF5eKeaXVo2zw9OmJ4wNg_KgQdNAf-y8wgU71ydo5FHa8d9--HZFTn9ifxZYOCXd34k5vKyScdaXTLUtGFlt0zjDxA diff --git a/crates/oidc-client/src/requests/authorization_code.rs b/crates/oidc-client/src/requests/authorization_code.rs index 9d316e2fd..bbf418b3f 100644 --- a/crates/oidc-client/src/requests/authorization_code.rs +++ b/crates/oidc-client/src/requests/authorization_code.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -25,8 +26,8 @@ use oauth2_types::{ scope::{OPENID, Scope}, }; use rand::{ - Rng, - distributions::{Alphanumeric, DistString}, + RngExt, + distr::{Alphanumeric, SampleString}, }; use serde::Serialize; use url::Url; @@ -214,7 +215,7 @@ struct FullAuthorizationRequest { /// Build the authorization request. fn build_authorization_request( authorization_data: AuthorizationRequestData, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result<(FullAuthorizationRequest, AuthorizationValidationData), AuthorizationError> { let AuthorizationRequestData { client_id, @@ -327,7 +328,7 @@ fn build_authorization_request( pub fn build_authorization_url( authorization_endpoint: Url, authorization_data: AuthorizationRequestData, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result<(Url, AuthorizationValidationData), AuthorizationError> { tracing::debug!( scope = ?authorization_data.scope, @@ -403,7 +404,7 @@ pub async fn access_token_with_authorization_code( validation_data: AuthorizationValidationData, id_token_verification_data: Option>, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result<(AccessTokenResponse, Option>), TokenAuthorizationCodeError> { tracing::debug!("Exchanging authorization code for access token..."); diff --git a/crates/oidc-client/src/requests/client_credentials.rs b/crates/oidc-client/src/requests/client_credentials.rs index 539d1a715..d1e48539a 100644 --- a/crates/oidc-client/src/requests/client_credentials.rs +++ b/crates/oidc-client/src/requests/client_credentials.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -13,7 +14,7 @@ use oauth2_types::{ requests::{AccessTokenRequest, AccessTokenResponse, ClientCredentialsGrant}, scope::Scope, }; -use rand::Rng; +use rand::RngExt; use url::Url; use crate::{ @@ -51,7 +52,7 @@ pub async fn access_token_with_client_credentials( token_endpoint: &Url, scope: Option, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result { tracing::debug!("Requesting access token with client credentials..."); diff --git a/crates/oidc-client/src/requests/refresh_token.rs b/crates/oidc-client/src/requests/refresh_token.rs index 5358d28b5..98d23c89f 100644 --- a/crates/oidc-client/src/requests/refresh_token.rs +++ b/crates/oidc-client/src/requests/refresh_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -14,7 +15,7 @@ use oauth2_types::{ requests::{AccessTokenRequest, AccessTokenResponse, RefreshTokenGrant}, scope::Scope, }; -use rand::Rng; +use rand::RngExt; use url::Url; use super::jose::JwtVerificationData; @@ -75,7 +76,7 @@ pub async fn refresh_access_token( id_token_verification_data: Option>, auth_id_token: Option<&IdToken<'_>>, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result<(AccessTokenResponse, Option>), TokenRefreshError> { tracing::debug!("Refreshing access token…"); diff --git a/crates/oidc-client/src/requests/token.rs b/crates/oidc-client/src/requests/token.rs index 774ab93dd..da1629c14 100644 --- a/crates/oidc-client/src/requests/token.rs +++ b/crates/oidc-client/src/requests/token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -11,7 +12,7 @@ use http::header::ACCEPT; use mas_http::RequestBuilderExt; use mime::APPLICATION_JSON; use oauth2_types::requests::{AccessTokenRequest, AccessTokenResponse}; -use rand::Rng; +use rand::RngExt; use url::Url; use crate::{ @@ -46,7 +47,7 @@ pub async fn request_access_token( token_endpoint: &Url, request: AccessTokenRequest, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result { tracing::debug!(?request, "Requesting access token..."); diff --git a/crates/oidc-client/src/types/client_credentials.rs b/crates/oidc-client/src/types/client_credentials.rs index a097ef469..c09f007c6 100644 --- a/crates/oidc-client/src/types/client_credentials.rs +++ b/crates/oidc-client/src/types/client_credentials.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -18,7 +19,7 @@ use mas_jose::{ jwt::{JsonWebSignatureHeader, Jwt}, }; use mas_keystore::Keystore; -use rand::Rng; +use rand::RngExt; use serde::Serialize; use serde_json::Value; use url::Url; @@ -135,7 +136,7 @@ impl ClientCredentials { request: reqwest::RequestBuilder, form: &T, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result { let request = match self { ClientCredentials::None { client_id } => request.form(&RequestWithClientCredentials { @@ -331,7 +332,7 @@ fn prepare_claims( iss: String, aud: String, now: DateTime, - rng: &mut impl Rng, + rng: &mut impl RngExt, ) -> Result, ClaimError> { let mut claims = HashMap::new(); diff --git a/crates/oidc-client/tests/it/main.rs b/crates/oidc-client/tests/it/main.rs index 28960e9d5..813f17eb8 100644 --- a/crates/oidc-client/tests/it/main.rs +++ b/crates/oidc-client/tests/it/main.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 Kévin Commaille. // @@ -19,7 +20,7 @@ use mas_keystore::{JsonWebKey, JsonWebKeySet, Keystore, PrivateKey}; use mas_oidc_client::types::{IdToken, client_credentials::ClientCredentials}; use rand::{ SeedableRng, - distributions::{Alphanumeric, DistString}, + distr::{Alphanumeric, SampleString}, }; use url::Url; use wiremock::MockServer; diff --git a/crates/storage-pg/src/compat/access_token.rs b/crates/storage-pg/src/compat/access_token.rs index e35d19dd8..8d7947132 100644 --- a/crates/storage-pg/src/compat/access_token.rs +++ b/crates/storage-pg/src/compat/access_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -8,7 +9,7 @@ use async_trait::async_trait; use chrono::{DateTime, Duration, Utc}; use mas_data_model::{Clock, CompatAccessToken, CompatSession, UlidExt as _}; use mas_storage::compat::CompatAccessTokenRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -136,7 +137,7 @@ impl CompatAccessTokenRepository for PgCompatAccessTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, token: String, diff --git a/crates/storage-pg/src/compat/refresh_token.rs b/crates/storage-pg/src/compat/refresh_token.rs index 64e81023e..b48407d5f 100644 --- a/crates/storage-pg/src/compat/refresh_token.rs +++ b/crates/storage-pg/src/compat/refresh_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -11,7 +12,7 @@ use mas_data_model::{ UlidExt as _, }; use mas_storage::compat::CompatRefreshTokenRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -148,7 +149,7 @@ impl CompatRefreshTokenRepository for PgCompatRefreshTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, compat_access_token: &CompatAccessToken, diff --git a/crates/storage-pg/src/compat/session.rs b/crates/storage-pg/src/compat/session.rs index 3cc5f4d32..b9046feed 100644 --- a/crates/storage-pg/src/compat/session.rs +++ b/crates/storage-pg/src/compat/session.rs @@ -18,7 +18,7 @@ use mas_storage::{ compat::{CompatSessionFilter, CompatSessionRepository}, pagination::Node, }; -use rand::RngCore; +use rand::Rng; use sea_query::{Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def}; use sea_query_sqlx::SqlxBinder; use sqlx::PgConnection; @@ -337,7 +337,7 @@ impl CompatSessionRepository for PgCompatSessionRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, device: Device, diff --git a/crates/storage-pg/src/compat/sso_login.rs b/crates/storage-pg/src/compat/sso_login.rs index e6abb67d6..d9c37c009 100644 --- a/crates/storage-pg/src/compat/sso_login.rs +++ b/crates/storage-pg/src/compat/sso_login.rs @@ -15,7 +15,7 @@ use mas_storage::{ compat::{CompatSsoLoginFilter, CompatSsoLoginRepository}, pagination::Node, }; -use rand::RngCore; +use rand::Rng; use sea_query::{Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def}; use sea_query_sqlx::SqlxBinder; use sqlx::PgConnection; @@ -274,7 +274,7 @@ impl CompatSsoLoginRepository for PgCompatSsoLoginRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, login_token: String, redirect_uri: Url, diff --git a/crates/storage-pg/src/lib.rs b/crates/storage-pg/src/lib.rs index 95ab44b8b..9d407086d 100644 --- a/crates/storage-pg/src/lib.rs +++ b/crates/storage-pg/src/lib.rs @@ -22,7 +22,7 @@ //! ```rust //! # use async_trait::async_trait; //! # use ulid::Ulid; -//! # use rand::RngCore; +//! # use rand::Rng; //! # use mas_data_model::Clock; //! # use mas_data_model::UlidExt; //! # use mas_storage_pg::{DatabaseError, ExecuteExt}; @@ -42,7 +42,7 @@ //! # async fn lookup(&mut self, id: Ulid) -> Result, Self::Error>; //! # async fn add( //! # &mut self, -//! # rng: &mut (dyn RngCore + Send), +//! # rng: &mut (dyn Rng + Send), //! # clock: &dyn Clock, //! # ) -> Result; //! # } @@ -116,7 +116,7 @@ //! )] //! async fn add( //! &mut self, -//! rng: &mut (dyn RngCore + Send), +//! rng: &mut (dyn Rng + Send), //! clock: &dyn Clock, //! ) -> Result { //! let created_at = clock.now(); diff --git a/crates/storage-pg/src/oauth2/access_token.rs b/crates/storage-pg/src/oauth2/access_token.rs index 206e92254..7fdf05d41 100644 --- a/crates/storage-pg/src/oauth2/access_token.rs +++ b/crates/storage-pg/src/oauth2/access_token.rs @@ -9,7 +9,7 @@ use async_trait::async_trait; use chrono::{DateTime, Duration, Utc}; use mas_data_model::{AccessToken, AccessTokenState, Clock, Session, UlidExt as _}; use mas_storage::oauth2::OAuth2AccessTokenRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -139,7 +139,7 @@ impl OAuth2AccessTokenRepository for PgOAuth2AccessTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: String, diff --git a/crates/storage-pg/src/oauth2/authorization_grant.rs b/crates/storage-pg/src/oauth2/authorization_grant.rs index 3be349300..dc461ed38 100644 --- a/crates/storage-pg/src/oauth2/authorization_grant.rs +++ b/crates/storage-pg/src/oauth2/authorization_grant.rs @@ -16,7 +16,7 @@ use mas_data_model::{ use mas_iana::oauth::PkceCodeChallengeMethod; use mas_storage::oauth2::OAuth2AuthorizationGrantRepository; use oauth2_types::{requests::ResponseMode, scope::Scope}; -use rand::RngCore; +use rand::Rng; use sqlx::{PgConnection, types::Json}; use ulid::Ulid; use url::Url; @@ -200,7 +200,7 @@ impl OAuth2AuthorizationGrantRepository for PgOAuth2AuthorizationGrantRepository )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, redirect_uri: Url, diff --git a/crates/storage-pg/src/oauth2/client.rs b/crates/storage-pg/src/oauth2/client.rs index 7cc49367e..7a723323a 100644 --- a/crates/storage-pg/src/oauth2/client.rs +++ b/crates/storage-pg/src/oauth2/client.rs @@ -21,7 +21,7 @@ use mas_storage::{ }; use oauth2_types::{oidc::ApplicationType, requests::GrantType}; use opentelemetry_semantic_conventions::attribute::DB_QUERY_TEXT; -use rand::RngCore; +use rand::Rng; use sea_query::{ Expr, ExprTrait, PostgresQueryBuilder, Query, SimpleExpr, enum_def, extension::postgres::PgExpr as _, @@ -492,7 +492,7 @@ impl OAuth2ClientRepository for PgOAuth2ClientRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, redirect_uris: Vec, metadata_digest: Option, diff --git a/crates/storage-pg/src/oauth2/device_code_grant.rs b/crates/storage-pg/src/oauth2/device_code_grant.rs index 226a06edc..664082e50 100644 --- a/crates/storage-pg/src/oauth2/device_code_grant.rs +++ b/crates/storage-pg/src/oauth2/device_code_grant.rs @@ -14,7 +14,7 @@ use mas_data_model::{ }; use mas_storage::oauth2::{OAuth2DeviceCodeGrantParams, OAuth2DeviceCodeGrantRepository}; use oauth2_types::scope::Scope; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -157,7 +157,7 @@ impl OAuth2DeviceCodeGrantRepository for PgOAuth2DeviceCodeGrantRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: OAuth2DeviceCodeGrantParams<'_>, ) -> Result { diff --git a/crates/storage-pg/src/oauth2/refresh_token.rs b/crates/storage-pg/src/oauth2/refresh_token.rs index aeecc6847..26c94ee29 100644 --- a/crates/storage-pg/src/oauth2/refresh_token.rs +++ b/crates/storage-pg/src/oauth2/refresh_token.rs @@ -9,7 +9,7 @@ use async_trait::async_trait; use chrono::{DateTime, Utc}; use mas_data_model::{AccessToken, Clock, RefreshToken, RefreshTokenState, Session, UlidExt as _}; use mas_storage::oauth2::OAuth2RefreshTokenRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -170,7 +170,7 @@ impl OAuth2RefreshTokenRepository for PgOAuth2RefreshTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: &AccessToken, diff --git a/crates/storage-pg/src/oauth2/session.rs b/crates/storage-pg/src/oauth2/session.rs index 42c8900ca..29234cacb 100644 --- a/crates/storage-pg/src/oauth2/session.rs +++ b/crates/storage-pg/src/oauth2/session.rs @@ -16,7 +16,7 @@ use mas_storage::{ pagination::Node, }; use oauth2_types::scope::{Scope, ScopeToken}; -use rand::RngCore; +use rand::Rng; use sea_query::{ Condition, Expr, ExprTrait, PgFunc, PostgresQueryBuilder, Query, SimpleExpr, enum_def, extension::postgres::PgExpr, @@ -272,7 +272,7 @@ impl OAuth2SessionRepository for PgOAuth2SessionRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, user: Option<&User>, diff --git a/crates/storage-pg/src/personal/access_token.rs b/crates/storage-pg/src/personal/access_token.rs index c42615c22..9a0b5c7e8 100644 --- a/crates/storage-pg/src/personal/access_token.rs +++ b/crates/storage-pg/src/personal/access_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -10,7 +11,7 @@ use mas_data_model::{ personal::{PersonalAccessToken, session::PersonalSession}, }; use mas_storage::personal::PersonalAccessTokenRepository; -use rand::RngCore; +use rand::Rng; use sha2::{Digest, Sha256}; use sqlx::PgConnection; use ulid::Ulid; @@ -177,7 +178,7 @@ impl PersonalAccessTokenRepository for PgPersonalAccessTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &PersonalSession, access_token: &str, diff --git a/crates/storage-pg/src/personal/session.rs b/crates/storage-pg/src/personal/session.rs index d677140ef..fa03f50be 100644 --- a/crates/storage-pg/src/personal/session.rs +++ b/crates/storage-pg/src/personal/session.rs @@ -22,7 +22,7 @@ use mas_storage::{ }; use oauth2_types::scope::Scope; use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT; -use rand::RngCore; +use rand::Rng; use sea_query::{ Cond, Condition, Expr, ExprTrait, PgFunc, PostgresQueryBuilder, Query, SimpleExpr, enum_def, extension::postgres::PgExpr as _, @@ -243,7 +243,7 @@ impl PersonalSessionRepository for PgPersonalSessionRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, owner: PersonalSessionOwner, actor_user: &User, diff --git a/crates/storage-pg/src/policy_data.rs b/crates/storage-pg/src/policy_data.rs index 0226e3fbc..02957d982 100644 --- a/crates/storage-pg/src/policy_data.rs +++ b/crates/storage-pg/src/policy_data.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -9,7 +10,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, PolicyData, UlidExt as _}; use mas_storage::policy_data::PolicyDataRepository; -use rand::RngCore; +use rand::Rng; use serde_json::Value; use sqlx::{PgConnection, types::Json}; use ulid::Ulid; @@ -90,7 +91,7 @@ impl PolicyDataRepository for PgPolicyDataRepository<'_> { )] async fn set( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, data: Value, ) -> Result { diff --git a/crates/storage-pg/src/queue/job.rs b/crates/storage-pg/src/queue/job.rs index 1a3731459..ca71f3680 100644 --- a/crates/storage-pg/src/queue/job.rs +++ b/crates/storage-pg/src/queue/job.rs @@ -12,7 +12,7 @@ use chrono::{DateTime, Duration, Utc}; use mas_data_model::{Clock, UlidExt as _}; use mas_storage::queue::{Job, QueueJobRepository, Worker}; use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use tracing::Instrument; use ulid::Ulid; @@ -90,7 +90,7 @@ impl QueueJobRepository for PgQueueJobRepository<'_> { )] async fn schedule( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -132,7 +132,7 @@ impl QueueJobRepository for PgQueueJobRepository<'_> { )] async fn schedule_later( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -335,7 +335,7 @@ impl QueueJobRepository for PgQueueJobRepository<'_> { )] async fn retry( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, id: Ulid, delay: Duration, diff --git a/crates/storage-pg/src/queue/worker.rs b/crates/storage-pg/src/queue/worker.rs index e2f7223bf..3c2c6bcf9 100644 --- a/crates/storage-pg/src/queue/worker.rs +++ b/crates/storage-pg/src/queue/worker.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -10,7 +11,7 @@ use async_trait::async_trait; use chrono::Duration; use mas_data_model::{Clock, UlidExt as _}; use mas_storage::queue::{QueueWorkerRepository, Worker}; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -46,7 +47,7 @@ impl QueueWorkerRepository for PgQueueWorkerRepository<'_> { )] async fn register( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, ) -> Result { let now = clock.now(); diff --git a/crates/storage-pg/src/upstream_oauth2/link.rs b/crates/storage-pg/src/upstream_oauth2/link.rs index d377901fc..a7e20a7af 100644 --- a/crates/storage-pg/src/upstream_oauth2/link.rs +++ b/crates/storage-pg/src/upstream_oauth2/link.rs @@ -14,7 +14,7 @@ use mas_storage::{ upstream_oauth2::{UpstreamOAuthLinkFilter, UpstreamOAuthLinkRepository}, }; use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT; -use rand::RngCore; +use rand::Rng; use sea_query::{ Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def, extension::postgres::PgExpr as _, }; @@ -221,7 +221,7 @@ impl UpstreamOAuthLinkRepository for PgUpstreamOAuthLinkRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, subject: String, diff --git a/crates/storage-pg/src/upstream_oauth2/provider.rs b/crates/storage-pg/src/upstream_oauth2/provider.rs index 291ba2ff7..e17c56652 100644 --- a/crates/storage-pg/src/upstream_oauth2/provider.rs +++ b/crates/storage-pg/src/upstream_oauth2/provider.rs @@ -18,7 +18,7 @@ use mas_storage::{ }, }; use opentelemetry_semantic_conventions::attribute::DB_QUERY_TEXT; -use rand::RngCore; +use rand::Rng; use sea_query::{Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def}; use sea_query_sqlx::SqlxBinder; use sqlx::{PgConnection, types::Json}; @@ -330,7 +330,7 @@ impl UpstreamOAuthProviderRepository for PgUpstreamOAuthProviderRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: UpstreamOAuthProviderParams, ) -> Result { diff --git a/crates/storage-pg/src/upstream_oauth2/session.rs b/crates/storage-pg/src/upstream_oauth2/session.rs index aa13be42d..27d8f131a 100644 --- a/crates/storage-pg/src/upstream_oauth2/session.rs +++ b/crates/storage-pg/src/upstream_oauth2/session.rs @@ -16,7 +16,7 @@ use mas_storage::{ pagination::Node, upstream_oauth2::{UpstreamOAuthSessionFilter, UpstreamOAuthSessionRepository}, }; -use rand::RngCore; +use rand::Rng; use sea_query::{ Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def, extension::postgres::PgExpr, }; @@ -253,7 +253,7 @@ impl UpstreamOAuthSessionRepository for PgUpstreamOAuthSessionRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, state_str: String, diff --git a/crates/storage-pg/src/user/email.rs b/crates/storage-pg/src/user/email.rs index 525405be6..f4eee92ee 100644 --- a/crates/storage-pg/src/user/email.rs +++ b/crates/storage-pg/src/user/email.rs @@ -16,7 +16,7 @@ use mas_storage::{ pagination::Node, user::{UserEmailFilter, UserEmailRepository}, }; -use rand::RngCore; +use rand::Rng; use sea_query::{Expr, ExprTrait, Func, PostgresQueryBuilder, Query, SimpleExpr, enum_def}; use sea_query_sqlx::SqlxBinder; use sqlx::PgConnection; @@ -354,7 +354,7 @@ impl UserEmailRepository for PgUserEmailRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, email: String, @@ -448,7 +448,7 @@ impl UserEmailRepository for PgUserEmailRepository<'_> { )] async fn add_authentication_for_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, session: &BrowserSession, @@ -500,7 +500,7 @@ impl UserEmailRepository for PgUserEmailRepository<'_> { )] async fn add_authentication_for_registration( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, user_registration: &UserRegistration, @@ -553,7 +553,7 @@ impl UserEmailRepository for PgUserEmailRepository<'_> { )] async fn add_authentication_code( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, duration: chrono::Duration, user_email_authentication: &UserEmailAuthentication, diff --git a/crates/storage-pg/src/user/mod.rs b/crates/storage-pg/src/user/mod.rs index c5143146a..4335d9fb1 100644 --- a/crates/storage-pg/src/user/mod.rs +++ b/crates/storage-pg/src/user/mod.rs @@ -11,7 +11,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, UlidExt as _, User}; use mas_storage::user::{UserFilter, UserRepository}; -use rand::RngCore; +use rand::Rng; use sea_query::{ Expr, ExprTrait, PostgresQueryBuilder, Query, SimpleExpr, extension::postgres::PgExpr as _, }; @@ -295,7 +295,7 @@ impl UserRepository for PgUserRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ) -> Result { diff --git a/crates/storage-pg/src/user/password.rs b/crates/storage-pg/src/user/password.rs index a9a4a6f45..5fdae4720 100644 --- a/crates/storage-pg/src/user/password.rs +++ b/crates/storage-pg/src/user/password.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -8,7 +9,7 @@ use async_trait::async_trait; use chrono::{DateTime, Utc}; use mas_data_model::{Clock, Password, UlidExt as _, User}; use mas_storage::user::UserPasswordRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -108,7 +109,7 @@ impl UserPasswordRepository for PgUserPasswordRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, version: u16, diff --git a/crates/storage-pg/src/user/recovery.rs b/crates/storage-pg/src/user/recovery.rs index 01b9cd20b..cfc1504eb 100644 --- a/crates/storage-pg/src/user/recovery.rs +++ b/crates/storage-pg/src/user/recovery.rs @@ -11,7 +11,7 @@ use async_trait::async_trait; use chrono::{DateTime, Duration, Utc}; use mas_data_model::{Clock, UlidExt as _, UserEmail, UserRecoverySession, UserRecoveryTicket}; use mas_storage::user::UserRecoveryRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use uuid::Uuid; @@ -134,7 +134,7 @@ impl UserRecoveryRepository for PgUserRecoveryRepository<'_> { )] async fn add_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, user_agent: String, @@ -232,7 +232,7 @@ impl UserRecoveryRepository for PgUserRecoveryRepository<'_> { )] async fn add_ticket( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_recovery_session: &UserRecoverySession, user_email: &UserEmail, diff --git a/crates/storage-pg/src/user/registration.rs b/crates/storage-pg/src/user/registration.rs index c5f116515..1ee93d0b7 100644 --- a/crates/storage-pg/src/user/registration.rs +++ b/crates/storage-pg/src/user/registration.rs @@ -13,7 +13,7 @@ use mas_data_model::{ UserRegistration, UserRegistrationPassword, UserRegistrationToken, }; use mas_storage::user::UserRegistrationRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use url::Url; @@ -167,7 +167,7 @@ impl UserRegistrationRepository for PgUserRegistrationRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ip_address: Option, diff --git a/crates/storage-pg/src/user/registration_token.rs b/crates/storage-pg/src/user/registration_token.rs index 79ffce985..464afbb13 100644 --- a/crates/storage-pg/src/user/registration_token.rs +++ b/crates/storage-pg/src/user/registration_token.rs @@ -12,7 +12,7 @@ use mas_storage::{ pagination::Node, user::{UserRegistrationTokenFilter, UserRegistrationTokenRepository}, }; -use rand::RngCore; +use rand::Rng; use sea_query::{Condition, Expr, ExprTrait, PostgresQueryBuilder, Query, enum_def}; use sea_query_sqlx::SqlxBinder; use sqlx::PgConnection; @@ -435,7 +435,7 @@ impl UserRegistrationTokenRepository for PgUserRegistrationTokenRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn mas_data_model::Clock, token: String, usage_limit: Option, diff --git a/crates/storage-pg/src/user/session.rs b/crates/storage-pg/src/user/session.rs index b601d57df..24e2473ff 100644 --- a/crates/storage-pg/src/user/session.rs +++ b/crates/storage-pg/src/user/session.rs @@ -18,7 +18,7 @@ use mas_storage::{ pagination::Node, user::{BrowserSessionFilter, BrowserSessionRepository}, }; -use rand::RngCore; +use rand::Rng; use sea_query::{Expr, ExprTrait, PostgresQueryBuilder, Query}; use sea_query_sqlx::SqlxBinder; use sqlx::PgConnection; @@ -240,7 +240,7 @@ impl BrowserSessionRepository for PgBrowserSessionRepository<'_> { )] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, user_agent: Option, @@ -469,7 +469,7 @@ impl BrowserSessionRepository for PgBrowserSessionRepository<'_> { )] async fn authenticate_with_password( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, user_password: &Password, @@ -518,7 +518,7 @@ impl BrowserSessionRepository for PgBrowserSessionRepository<'_> { )] async fn authenticate_with_upstream( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, upstream_oauth_session: &UpstreamOAuthAuthorizationSession, diff --git a/crates/storage-pg/src/user/terms.rs b/crates/storage-pg/src/user/terms.rs index 61c40f178..42706bc35 100644 --- a/crates/storage-pg/src/user/terms.rs +++ b/crates/storage-pg/src/user/terms.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2024 The Matrix.org Foundation C.I.C. // @@ -7,7 +8,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, UlidExt as _, User}; use mas_storage::user::UserTermsRepository; -use rand::RngCore; +use rand::Rng; use sqlx::PgConnection; use ulid::Ulid; use url::Url; @@ -45,7 +46,7 @@ impl UserTermsRepository for PgUserTermsRepository<'_> { )] async fn accept_terms( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, terms_url: Url, diff --git a/crates/storage/src/compat/access_token.rs b/crates/storage/src/compat/access_token.rs index 8dd41ba43..2dc55e9d0 100644 --- a/crates/storage/src/compat/access_token.rs +++ b/crates/storage/src/compat/access_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -7,7 +8,7 @@ use async_trait::async_trait; use chrono::Duration; use mas_data_model::{Clock, CompatAccessToken, CompatSession}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -66,7 +67,7 @@ pub trait CompatAccessTokenRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, token: String, @@ -98,7 +99,7 @@ repository_impl!(CompatAccessTokenRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, token: String, diff --git a/crates/storage/src/compat/refresh_token.rs b/crates/storage/src/compat/refresh_token.rs index d4434569c..d272466ed 100644 --- a/crates/storage/src/compat/refresh_token.rs +++ b/crates/storage/src/compat/refresh_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -6,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, CompatAccessToken, CompatRefreshToken, CompatSession}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -62,7 +63,7 @@ pub trait CompatRefreshTokenRepository: Send + Sync { /// * `token`: The token of the refresh token async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, compat_access_token: &CompatAccessToken, @@ -114,7 +115,7 @@ repository_impl!(CompatRefreshTokenRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, compat_session: &CompatSession, compat_access_token: &CompatAccessToken, diff --git a/crates/storage/src/compat/session.rs b/crates/storage/src/compat/session.rs index 9149e4953..2750102ec 100644 --- a/crates/storage/src/compat/session.rs +++ b/crates/storage/src/compat/session.rs @@ -10,7 +10,7 @@ use std::net::IpAddr; use async_trait::async_trait; use chrono::{DateTime, Utc}; use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, Device, User}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Page, Pagination, repository_impl, user::BrowserSessionFilter}; @@ -274,7 +274,7 @@ pub trait CompatSessionRepository: Send + Sync { #[expect(clippy::too_many_arguments)] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, device: Device, @@ -449,7 +449,7 @@ repository_impl!(CompatSessionRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, device: Device, diff --git a/crates/storage/src/compat/sso_login.rs b/crates/storage/src/compat/sso_login.rs index 69de52948..07bb88d2f 100644 --- a/crates/storage/src/compat/sso_login.rs +++ b/crates/storage/src/compat/sso_login.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -6,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, User}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use url::Url; @@ -162,7 +163,7 @@ pub trait CompatSsoLoginRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, login_token: String, redirect_uri: Url, @@ -255,7 +256,7 @@ repository_impl!(CompatSsoLoginRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, login_token: String, redirect_uri: Url, diff --git a/crates/storage/src/lib.rs b/crates/storage/src/lib.rs index c5d5d0b26..310ef52b5 100644 --- a/crates/storage/src/lib.rs +++ b/crates/storage/src/lib.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -58,7 +59,7 @@ //! /// Returns [`Self::Error`] if the underlying repository fails //! async fn add( //! &mut self, -//! rng: &mut (dyn RngCore + Send), +//! rng: &mut (dyn Rng + Send), //! clock: &dyn Clock, //! ) -> Result; //! } @@ -67,7 +68,7 @@ //! async fn lookup(&mut self, id: Ulid) -> Result, Self::Error>; //! async fn add( //! &mut self, -//! rng: &mut (dyn RngCore + Send), +//! rng: &mut (dyn Rng + Send), //! clock: &dyn Clock, //! ) -> Result; //! ); diff --git a/crates/storage/src/oauth2/access_token.rs b/crates/storage/src/oauth2/access_token.rs index 0001a4ee1..c072e60c2 100644 --- a/crates/storage/src/oauth2/access_token.rs +++ b/crates/storage/src/oauth2/access_token.rs @@ -8,7 +8,7 @@ use async_trait::async_trait; use chrono::{DateTime, Duration, Utc}; use mas_data_model::{AccessToken, Clock, Session}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -67,7 +67,7 @@ pub trait OAuth2AccessTokenRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: String, @@ -163,7 +163,7 @@ repository_impl!(OAuth2AccessTokenRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: String, diff --git a/crates/storage/src/oauth2/authorization_grant.rs b/crates/storage/src/oauth2/authorization_grant.rs index e01c1946d..cd23c7b30 100644 --- a/crates/storage/src/oauth2/authorization_grant.rs +++ b/crates/storage/src/oauth2/authorization_grant.rs @@ -12,7 +12,7 @@ use mas_data_model::{ AuthorizationCode, AuthorizationGrant, BrowserSession, Client, Clock, Session, }; use oauth2_types::{requests::ResponseMode, scope::Scope}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use url::Url; @@ -56,7 +56,7 @@ pub trait OAuth2AuthorizationGrantRepository: Send + Sync { #[expect(clippy::too_many_arguments)] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, redirect_uri: Url, @@ -167,7 +167,7 @@ pub trait OAuth2AuthorizationGrantRepository: Send + Sync { repository_impl!(OAuth2AuthorizationGrantRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, redirect_uri: Url, diff --git a/crates/storage/src/oauth2/client.rs b/crates/storage/src/oauth2/client.rs index b1e6017d8..8f37877e3 100644 --- a/crates/storage/src/oauth2/client.rs +++ b/crates/storage/src/oauth2/client.rs @@ -12,7 +12,7 @@ use mas_data_model::{Client, Clock}; use mas_iana::{jose::JsonWebSignatureAlg, oauth::OAuthClientAuthenticationMethod}; use mas_jose::jwk::PublicJsonWebKeySet; use oauth2_types::{oidc::ApplicationType, requests::GrantType}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use url::Url; @@ -232,7 +232,7 @@ pub trait OAuth2ClientRepository: Send + Sync { #[expect(clippy::too_many_arguments)] async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, redirect_uris: Vec, metadata_digest: Option, @@ -360,7 +360,7 @@ repository_impl!(OAuth2ClientRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, redirect_uris: Vec, metadata_digest: Option, diff --git a/crates/storage/src/oauth2/device_code_grant.rs b/crates/storage/src/oauth2/device_code_grant.rs index 220a7fb1e..5b8a0d529 100644 --- a/crates/storage/src/oauth2/device_code_grant.rs +++ b/crates/storage/src/oauth2/device_code_grant.rs @@ -11,7 +11,7 @@ use async_trait::async_trait; use chrono::Duration; use mas_data_model::{BrowserSession, Client, Clock, DeviceCodeGrant, Session}; use oauth2_types::scope::Scope; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -63,7 +63,7 @@ pub trait OAuth2DeviceCodeGrantRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: OAuth2DeviceCodeGrantParams<'_>, ) -> Result; @@ -216,7 +216,7 @@ pub trait OAuth2DeviceCodeGrantRepository: Send + Sync { repository_impl!(OAuth2DeviceCodeGrantRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: OAuth2DeviceCodeGrantParams<'_>, ) -> Result; diff --git a/crates/storage/src/oauth2/refresh_token.rs b/crates/storage/src/oauth2/refresh_token.rs index c0ef40eca..8d475fc3c 100644 --- a/crates/storage/src/oauth2/refresh_token.rs +++ b/crates/storage/src/oauth2/refresh_token.rs @@ -7,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{AccessToken, Clock, RefreshToken, Session}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -66,7 +66,7 @@ pub trait OAuth2RefreshTokenRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: &AccessToken, @@ -170,7 +170,7 @@ repository_impl!(OAuth2RefreshTokenRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &Session, access_token: &AccessToken, diff --git a/crates/storage/src/oauth2/session.rs b/crates/storage/src/oauth2/session.rs index dbb133b3f..0ca1ab5e8 100644 --- a/crates/storage/src/oauth2/session.rs +++ b/crates/storage/src/oauth2/session.rs @@ -11,7 +11,7 @@ use async_trait::async_trait; use chrono::{DateTime, Utc}; use mas_data_model::{BrowserSession, Client, Clock, Device, Session, User}; use oauth2_types::scope::Scope; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Pagination, pagination::Page, repository_impl, user::BrowserSessionFilter}; @@ -348,7 +348,7 @@ pub trait OAuth2SessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, user: Option<&User>, @@ -374,7 +374,7 @@ pub trait OAuth2SessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add_from_browser_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, user_session: &BrowserSession, @@ -408,7 +408,7 @@ pub trait OAuth2SessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add_from_client_credentials( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, scope: Scope, @@ -568,7 +568,7 @@ repository_impl!(OAuth2SessionRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, user: Option<&User>, @@ -578,7 +578,7 @@ repository_impl!(OAuth2SessionRepository: async fn add_from_browser_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, user_session: &BrowserSession, @@ -587,7 +587,7 @@ repository_impl!(OAuth2SessionRepository: async fn add_from_client_credentials( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, client: &Client, scope: Scope, diff --git a/crates/storage/src/personal/access_token.rs b/crates/storage/src/personal/access_token.rs index 363a3199f..c9e6d72c5 100644 --- a/crates/storage/src/personal/access_token.rs +++ b/crates/storage/src/personal/access_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -9,7 +10,7 @@ use mas_data_model::{ Clock, personal::{PersonalAccessToken, session::PersonalSession}, }; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -84,7 +85,7 @@ pub trait PersonalAccessTokenRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &PersonalSession, access_token: &str, @@ -125,7 +126,7 @@ repository_impl!(PersonalAccessTokenRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, session: &PersonalSession, access_token: &str, diff --git a/crates/storage/src/personal/session.rs b/crates/storage/src/personal/session.rs index 921c6df39..f5cf2bc5c 100644 --- a/crates/storage/src/personal/session.rs +++ b/crates/storage/src/personal/session.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -15,7 +16,7 @@ use mas_data_model::{ }, }; use oauth2_types::scope::Scope; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Page, Pagination, repository_impl}; @@ -61,7 +62,7 @@ pub trait PersonalSessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, owner: PersonalSessionOwner, actor_user: &User, @@ -154,7 +155,7 @@ repository_impl!(PersonalSessionRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, owner: PersonalSessionOwner, actor_user: &User, diff --git a/crates/storage/src/policy_data.rs b/crates/storage/src/policy_data.rs index 68f0040ab..783c76c99 100644 --- a/crates/storage/src/policy_data.rs +++ b/crates/storage/src/policy_data.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -7,7 +8,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, PolicyData}; -use rand_core::RngCore; +use rand_core::Rng; use crate::repository_impl; @@ -43,7 +44,7 @@ pub trait PolicyDataRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn set( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, data: serde_json::Value, ) -> Result; @@ -67,7 +68,7 @@ repository_impl!(PolicyDataRepository: async fn set( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, data: serde_json::Value, ) -> Result; diff --git a/crates/storage/src/queue/job.rs b/crates/storage/src/queue/job.rs index 78d9ad186..9a553e9f7 100644 --- a/crates/storage/src/queue/job.rs +++ b/crates/storage/src/queue/job.rs @@ -10,7 +10,7 @@ use async_trait::async_trait; use chrono::{DateTime, Duration, Utc}; use mas_data_model::Clock; use opentelemetry::trace::TraceContextExt; -use rand_core::RngCore; +use rand_core::Rng; use serde::{Deserialize, Serialize}; use tracing_opentelemetry::OpenTelemetrySpanExt; use ulid::Ulid; @@ -101,7 +101,7 @@ pub trait QueueJobRepository: Send + Sync { /// Returns an error if the underlying repository fails. async fn schedule( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -127,7 +127,7 @@ pub trait QueueJobRepository: Send + Sync { #[expect(clippy::too_many_arguments)] async fn schedule_later( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -199,7 +199,7 @@ pub trait QueueJobRepository: Send + Sync { /// Returns an error if the underlying repository fails. async fn retry( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, id: Ulid, delay: Duration, @@ -243,7 +243,7 @@ pub trait QueueJobRepository: Send + Sync { repository_impl!(QueueJobRepository: async fn schedule( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -252,7 +252,7 @@ repository_impl!(QueueJobRepository: async fn schedule_later( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, queue_name: &str, payload: serde_json::Value, @@ -279,7 +279,7 @@ repository_impl!(QueueJobRepository: async fn retry( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, id: Ulid, delay: Duration, @@ -313,7 +313,7 @@ pub trait QueueJobRepositoryExt: QueueJobRepository { /// Returns an error if the underlying repository fails. async fn schedule_job( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, job: J, ) -> Result<(), Self::Error>; @@ -332,7 +332,7 @@ pub trait QueueJobRepositoryExt: QueueJobRepository { /// Returns an error if the underlying repository fails. async fn schedule_job_later( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, job: J, scheduled_at: DateTime, @@ -353,7 +353,7 @@ where )] async fn schedule_job( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, job: J, ) -> Result<(), Self::Error> { @@ -380,7 +380,7 @@ where )] async fn schedule_job_later( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, job: J, scheduled_at: DateTime, diff --git a/crates/storage/src/queue/worker.rs b/crates/storage/src/queue/worker.rs index c937134fe..60f17e727 100644 --- a/crates/storage/src/queue/worker.rs +++ b/crates/storage/src/queue/worker.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -8,7 +9,7 @@ use async_trait::async_trait; use chrono::Duration; use mas_data_model::Clock; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -35,7 +36,7 @@ pub trait QueueWorkerRepository: Send + Sync { /// Returns an error if the underlying repository fails. async fn register( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, ) -> Result; @@ -93,7 +94,7 @@ pub trait QueueWorkerRepository: Send + Sync { repository_impl!(QueueWorkerRepository: async fn register( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, ) -> Result; diff --git a/crates/storage/src/upstream_oauth2/link.rs b/crates/storage/src/upstream_oauth2/link.rs index 1053e6dd9..cbc05c14c 100644 --- a/crates/storage/src/upstream_oauth2/link.rs +++ b/crates/storage/src/upstream_oauth2/link.rs @@ -7,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, UpstreamOAuthLink, UpstreamOAuthProvider, User}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Pagination, pagination::Page, repository_impl}; @@ -167,7 +167,7 @@ pub trait UpstreamOAuthLinkRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, subject: String, @@ -271,7 +271,7 @@ repository_impl!(UpstreamOAuthLinkRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, subject: String, diff --git a/crates/storage/src/upstream_oauth2/provider.rs b/crates/storage/src/upstream_oauth2/provider.rs index df217b433..4203067bc 100644 --- a/crates/storage/src/upstream_oauth2/provider.rs +++ b/crates/storage/src/upstream_oauth2/provider.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -15,7 +16,7 @@ use mas_data_model::{ }; use mas_iana::jose::JsonWebSignatureAlg; use oauth2_types::scope::Scope; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use url::Url; @@ -186,7 +187,7 @@ pub trait UpstreamOAuthProviderRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: UpstreamOAuthProviderParams, ) -> Result; @@ -294,7 +295,7 @@ repository_impl!(UpstreamOAuthProviderRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, params: UpstreamOAuthProviderParams ) -> Result; diff --git a/crates/storage/src/upstream_oauth2/session.rs b/crates/storage/src/upstream_oauth2/session.rs index 6e017ca45..61d70c21b 100644 --- a/crates/storage/src/upstream_oauth2/session.rs +++ b/crates/storage/src/upstream_oauth2/session.rs @@ -10,7 +10,7 @@ use mas_data_model::{ BrowserSession, Clock, UpstreamOAuthAuthorizationSession, UpstreamOAuthLink, UpstreamOAuthProvider, }; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Pagination, pagination::Page, repository_impl}; @@ -120,7 +120,7 @@ pub trait UpstreamOAuthSessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, state: String, @@ -245,7 +245,7 @@ repository_impl!(UpstreamOAuthSessionRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, upstream_oauth_provider: &UpstreamOAuthProvider, state: String, diff --git a/crates/storage/src/user/email.rs b/crates/storage/src/user/email.rs index eadf3dfb9..ef055c5fa 100644 --- a/crates/storage/src/user/email.rs +++ b/crates/storage/src/user/email.rs @@ -10,7 +10,7 @@ use mas_data_model::{ BrowserSession, Clock, UpstreamOAuthAuthorizationSession, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode, UserRegistration, }; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Pagination, pagination::Page, repository_impl}; @@ -167,7 +167,7 @@ pub trait UserEmailRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, email: String, @@ -212,7 +212,7 @@ pub trait UserEmailRepository: Send + Sync { /// Returns an error if the underlying repository fails async fn add_authentication_for_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, session: &BrowserSession, @@ -233,7 +233,7 @@ pub trait UserEmailRepository: Send + Sync { /// Returns an error if the underlying repository fails async fn add_authentication_for_registration( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, registration: &UserRegistration, @@ -257,7 +257,7 @@ pub trait UserEmailRepository: Send + Sync { /// already exists for this session async fn add_authentication_code( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, duration: chrono::Duration, authentication: &UserEmailAuthentication, @@ -378,7 +378,7 @@ repository_impl!(UserEmailRepository: async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, email: String, @@ -389,7 +389,7 @@ repository_impl!(UserEmailRepository: async fn add_authentication_for_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, session: &BrowserSession, @@ -397,7 +397,7 @@ repository_impl!(UserEmailRepository: async fn add_authentication_for_registration( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, registration: &UserRegistration, @@ -405,7 +405,7 @@ repository_impl!(UserEmailRepository: async fn add_authentication_code( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, duration: chrono::Duration, authentication: &UserEmailAuthentication, diff --git a/crates/storage/src/user/mod.rs b/crates/storage/src/user/mod.rs index 561c87d7f..0df11e78b 100644 --- a/crates/storage/src/user/mod.rs +++ b/crates/storage/src/user/mod.rs @@ -9,7 +9,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, User}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{Page, Pagination, repository_impl}; @@ -278,7 +278,7 @@ pub trait UserRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ) -> Result; @@ -431,7 +431,7 @@ repository_impl!(UserRepository: async fn find_by_username(&mut self, username: &str) -> Result, Self::Error>; async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ) -> Result; diff --git a/crates/storage/src/user/password.rs b/crates/storage/src/user/password.rs index fff0298e9..75a3566f4 100644 --- a/crates/storage/src/user/password.rs +++ b/crates/storage/src/user/password.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -6,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, Password, User}; -use rand_core::RngCore; +use rand_core::Rng; use crate::repository_impl; @@ -48,7 +49,7 @@ pub trait UserPasswordRepository: Send + Sync { /// Returns [`Self::Error`] if underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, version: u16, @@ -61,7 +62,7 @@ repository_impl!(UserPasswordRepository: async fn active(&mut self, user: &User) -> Result, Self::Error>; async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, version: u16, diff --git a/crates/storage/src/user/recovery.rs b/crates/storage/src/user/recovery.rs index 47c6bef59..d93b33e13 100644 --- a/crates/storage/src/user/recovery.rs +++ b/crates/storage/src/user/recovery.rs @@ -9,7 +9,7 @@ use std::net::IpAddr; use async_trait::async_trait; use mas_data_model::{Clock, UserEmail, UserRecoverySession, UserRecoveryTicket}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -57,7 +57,7 @@ pub trait UserRecoveryRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, user_agent: String, @@ -97,7 +97,7 @@ pub trait UserRecoveryRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add_ticket( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_recovery_session: &UserRecoverySession, user_email: &UserEmail, @@ -154,7 +154,7 @@ repository_impl!(UserRecoveryRepository: async fn add_session( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, email: String, user_agent: String, @@ -169,7 +169,7 @@ repository_impl!(UserRecoveryRepository: async fn add_ticket( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_recovery_session: &UserRecoverySession, user_email: &UserEmail, diff --git a/crates/storage/src/user/registration.rs b/crates/storage/src/user/registration.rs index dc2a73f9e..731a0b2f1 100644 --- a/crates/storage/src/user/registration.rs +++ b/crates/storage/src/user/registration.rs @@ -11,7 +11,7 @@ use mas_data_model::{ Clock, UpstreamOAuthAuthorizationSession, UserEmailAuthentication, UserRegistration, UserRegistrationToken, }; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use url::Url; @@ -56,7 +56,7 @@ pub trait UserRegistrationRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ip_address: Option, @@ -227,7 +227,7 @@ repository_impl!(UserRegistrationRepository: async fn lookup(&mut self, id: Ulid) -> Result, Self::Error>; async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, username: String, ip_address: Option, diff --git a/crates/storage/src/user/registration_token.rs b/crates/storage/src/user/registration_token.rs index 1fb98550e..db0df9e57 100644 --- a/crates/storage/src/user/registration_token.rs +++ b/crates/storage/src/user/registration_token.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -6,7 +7,7 @@ use async_trait::async_trait; use chrono::{DateTime, Utc}; use mas_data_model::{Clock, UserRegistrationToken}; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::repository_impl; @@ -155,7 +156,7 @@ pub trait UserRegistrationTokenRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, token: String, usage_limit: Option, @@ -280,7 +281,7 @@ repository_impl!(UserRegistrationTokenRepository: async fn find_by_token(&mut self, token: &str) -> Result, Self::Error>; async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, token: String, usage_limit: Option, diff --git a/crates/storage/src/user/session.rs b/crates/storage/src/user/session.rs index 5f7d25afa..d4153b688 100644 --- a/crates/storage/src/user/session.rs +++ b/crates/storage/src/user/session.rs @@ -12,7 +12,7 @@ use chrono::{DateTime, Utc}; use mas_data_model::{ Authentication, BrowserSession, Clock, Password, UpstreamOAuthAuthorizationSession, User, }; -use rand_core::RngCore; +use rand_core::Rng; use ulid::Ulid; use crate::{ @@ -200,7 +200,7 @@ pub trait BrowserSessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, user_agent: Option, @@ -283,7 +283,7 @@ pub trait BrowserSessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn authenticate_with_password( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, user_password: &Password, @@ -305,7 +305,7 @@ pub trait BrowserSessionRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn authenticate_with_upstream( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, upstream_oauth_session: &UpstreamOAuthAuthorizationSession, @@ -393,7 +393,7 @@ repository_impl!(BrowserSessionRepository: async fn lookup(&mut self, id: Ulid) -> Result, Self::Error>; async fn add( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, user_agent: Option, @@ -420,7 +420,7 @@ repository_impl!(BrowserSessionRepository: async fn authenticate_with_password( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, user_password: &Password, @@ -428,7 +428,7 @@ repository_impl!(BrowserSessionRepository: async fn authenticate_with_upstream( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user_session: &BrowserSession, upstream_oauth_session: &UpstreamOAuthAuthorizationSession, diff --git a/crates/storage/src/user/terms.rs b/crates/storage/src/user/terms.rs index 155360973..8a1e0ca2f 100644 --- a/crates/storage/src/user/terms.rs +++ b/crates/storage/src/user/terms.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2024 The Matrix.org Foundation C.I.C. // @@ -6,7 +7,7 @@ use async_trait::async_trait; use mas_data_model::{Clock, User}; -use rand_core::RngCore; +use rand_core::Rng; use url::Url; use crate::repository_impl; @@ -32,7 +33,7 @@ pub trait UserTermsRepository: Send + Sync { /// Returns [`Self::Error`] if the underlying repository fails async fn accept_terms( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, terms_url: Url, @@ -42,7 +43,7 @@ pub trait UserTermsRepository: Send + Sync { repository_impl!(UserTermsRepository: async fn accept_terms( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, user: &User, terms_url: Url, diff --git a/crates/syn2mas/src/migration.rs b/crates/syn2mas/src/migration.rs index d34e804e6..30e50bf48 100644 --- a/crates/syn2mas/src/migration.rs +++ b/crates/syn2mas/src/migration.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -17,7 +18,7 @@ use chrono::{DateTime, Utc}; use compact_str::CompactString; use futures_util::{SinkExt, StreamExt as _, TryFutureExt, TryStreamExt as _}; use mas_data_model::{Clock, UlidExt as _}; -use rand::{RngCore, SeedableRng}; +use rand::{Rng, SeedableRng}; use thiserror::Error; use thiserror_ext::ContextInto; use tokio_util::sync::PollSender; @@ -147,7 +148,7 @@ pub async fn migrate( mas: MasWriter, server_name: String, clock: &dyn Clock, - rng: &mut impl RngCore, + rng: &mut impl Rng, provider_id_mapping: std::collections::HashMap, progress: &Progress, ignore_missing_auth_providers: bool, @@ -217,7 +218,7 @@ async fn migrate_users( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, mut state: MigrationState, - rng: &mut impl RngCore, + rng: &mut impl Rng, progress_counter: ProgressCounter, ) -> Result<(MasWriter, MigrationState), Error> { let start = Instant::now(); @@ -227,7 +228,7 @@ async fn migrate_users( // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let task = tokio::spawn( async move { let mut user_buffer = MasWriteBuffer::new(&mas); @@ -341,7 +342,7 @@ async fn migrate_users( async fn migrate_threepids( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, - rng: &mut impl RngCore, + rng: &mut impl Rng, state: MigrationState, progress_counter: ProgressCounter, ) -> Result<(MasWriter, MigrationState), Error> { @@ -352,7 +353,7 @@ async fn migrate_threepids( // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let task = tokio::spawn( async move { let mut email_buffer = MasWriteBuffer::new(&mas); @@ -457,7 +458,7 @@ async fn migrate_threepids( async fn migrate_external_ids( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, - rng: &mut impl RngCore, + rng: &mut impl Rng, state: MigrationState, progress_counter: ProgressCounter, ignore_missing_auth_providers: bool, @@ -469,7 +470,7 @@ async fn migrate_external_ids( // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let task = tokio::spawn( async move { let mut write_buffer = MasWriteBuffer::new(&mas); @@ -576,7 +577,7 @@ async fn migrate_external_ids( async fn migrate_devices( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, - rng: &mut impl RngCore, + rng: &mut impl Rng, mut state: MigrationState, progress_counter: ProgressCounter, ) -> Result<(MasWriter, MigrationState), Error> { @@ -587,7 +588,7 @@ async fn migrate_devices( // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let task = tokio::spawn( async move { let mut write_buffer = MasWriteBuffer::new(&mas); @@ -719,7 +720,7 @@ async fn migrate_unrefreshable_access_tokens( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, clock: &dyn Clock, - rng: &mut impl RngCore, + rng: &mut impl Rng, mut state: MigrationState, progress_counter: ProgressCounter, ) -> Result<(MasWriter, MigrationState), Error> { @@ -731,7 +732,7 @@ async fn migrate_unrefreshable_access_tokens( let now = clock.now(); // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let task = tokio::spawn( async move { let mut write_buffer = MasWriteBuffer::new(&mas); @@ -871,7 +872,7 @@ async fn migrate_refreshable_token_pairs( synapse: &mut SynapseReader<'_>, mut mas: MasWriter, clock: &dyn Clock, - rng: &mut impl RngCore, + rng: &mut impl Rng, mut state: MigrationState, progress_counter: ProgressCounter, ) -> Result<(MasWriter, MigrationState), Error> { @@ -882,7 +883,7 @@ async fn migrate_refreshable_token_pairs( // create a new RNG seeded from the passed RNG so that we can move it into the // spawned task - let mut rng = rand_chacha::ChaChaRng::from_rng(rng).expect("failed to seed rng"); + let mut rng = rand_chacha::ChaChaRng::from_rng(&mut *rng); let now = clock.now(); let task = tokio::spawn( async move { @@ -1011,7 +1012,7 @@ async fn migrate_refreshable_token_pairs( fn transform_user( user: &SynapseUser, server_name: &str, - rng: &mut impl RngCore, + rng: &mut impl Rng, ) -> Result<(MasNewUser, Option), Error> { let username = user .name diff --git a/crates/syn2mas/src/synapse_reader/config/mod.rs b/crates/syn2mas/src/synapse_reader/config/mod.rs index 3c9454ba6..73c4c9141 100644 --- a/crates/syn2mas/src/synapse_reader/config/mod.rs +++ b/crates/syn2mas/src/synapse_reader/config/mod.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -11,7 +12,7 @@ use camino::Utf8PathBuf; use chrono::{DateTime, Utc}; use figment::providers::{Format, Yaml}; use mas_config::{PasswordAlgorithm, PasswordHashingScheme}; -use rand::Rng; +use rand::RngExt; use serde::Deserialize; use sqlx::postgres::PgConnectOptions; use tracing::warn; @@ -150,7 +151,7 @@ impl Config { pub fn adjust_mas_config( self, mut mas_config: mas_config::RootConfig, - rng: &mut impl Rng, + rng: &mut impl RngExt, now: DateTime, ) -> mas_config::RootConfig { let providers = self.all_oidc_providers(); diff --git a/crates/syn2mas/src/synapse_reader/config/oidc.rs b/crates/syn2mas/src/synapse_reader/config/oidc.rs index 17a0c6d20..ffa2f35d4 100644 --- a/crates/syn2mas/src/synapse_reader/config/oidc.rs +++ b/crates/syn2mas/src/synapse_reader/config/oidc.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2025 New Vector Ltd. // // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -14,7 +15,7 @@ use mas_config::{ use mas_data_model::UlidExt as _; use mas_iana::jose::JsonWebSignatureAlg; use oauth2_types::scope::{OPENID, Scope, ScopeToken}; -use rand::Rng; +use rand::RngExt; use serde::Deserialize; use tracing::warn; use ulid::Ulid; @@ -196,7 +197,7 @@ impl OidcProvider { /// Map this Synapse OIDC provider config to a MAS upstream provider config. pub(crate) fn into_mas_config( self, - rng: &mut impl Rng, + rng: &mut impl RngExt, now: DateTime, ) -> Option { let client_id = self.client_id?; diff --git a/crates/tasks/src/email.rs b/crates/tasks/src/email.rs index 8e685843a..a56bf48a7 100644 --- a/crates/tasks/src/email.rs +++ b/crates/tasks/src/email.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2023, 2024 The Matrix.org Foundation C.I.C. // @@ -9,7 +10,7 @@ use chrono::Duration; use mas_email::{Address, EmailVerificationContext, Mailbox}; use mas_storage::queue::{SendEmailAuthenticationCodeJob, VerifyEmailJob}; use mas_templates::TemplateContext as _; -use rand::{Rng, distributions::Uniform}; +use rand::{RngExt, distr::Uniform}; use tracing::info; use crate::{ @@ -93,7 +94,7 @@ impl RunnableJob for SendEmailAuthenticationCodeJob { }; // Generate a new 6-digit authentication code - let range = Uniform::::from(0..1_000_000); + let range = Uniform::::new(0, 1_000_000).expect("valid range"); let code = rng.sample(range); let code = format!("{code:06}"); let code = repo diff --git a/crates/tasks/src/lib.rs b/crates/tasks/src/lib.rs index 7cc0508a5..7fe3c343e 100644 --- a/crates/tasks/src/lib.rs +++ b/crates/tasks/src/lib.rs @@ -82,7 +82,7 @@ impl State { // This is fine for now, we may move that to a trait at some point. #[expect(clippy::unused_self, clippy::disallowed_methods)] pub fn rng(&self) -> rand_chacha::ChaChaRng { - rand_chacha::ChaChaRng::from_rng(rand::thread_rng()).expect("failed to seed rng") + rand_chacha::ChaChaRng::from_rng(&mut rand::rng()) } pub async fn repository(&self) -> Result { diff --git a/crates/tasks/src/new_queue.rs b/crates/tasks/src/new_queue.rs index dfeee6b97..7ce80eb41 100644 --- a/crates/tasks/src/new_queue.rs +++ b/crates/tasks/src/new_queue.rs @@ -20,7 +20,7 @@ use opentelemetry::{ KeyValue, metrics::{Counter, Histogram, UpDownCounter}, }; -use rand::{Rng, RngCore, distributions::Uniform}; +use rand::{Rng, RngExt, distr::Uniform}; use serde::de::DeserializeOwned; use sqlx::{ Acquire, Either, @@ -472,7 +472,8 @@ impl QueueWorker { // This is to make sure we wake up every second to do the maintenance tasks // We add a little bit of random jitter to the duration, so that we don't get // fully synced workers waking up at the same time after each notification - let sleep_duration = rng.sample(Uniform::new(MIN_SLEEP_DURATION, MAX_SLEEP_DURATION)); + let sleep_duration = + rng.sample(Uniform::new(MIN_SLEEP_DURATION, MAX_SLEEP_DURATION).expect("valid range")); let wakeup_sleep = tokio::time::sleep(sleep_duration); tokio::select! { @@ -1026,7 +1027,7 @@ impl JobTracker { /// already finished jobs. async fn process_jobs( &mut self, - rng: &mut (dyn RngCore + Send), + rng: &mut (dyn Rng + Send), clock: &dyn Clock, repo: &mut dyn RepositoryAccess, blocking: bool, diff --git a/crates/tasks/src/recovery.rs b/crates/tasks/src/recovery.rs index 0b3af373a..7dd519bce 100644 --- a/crates/tasks/src/recovery.rs +++ b/crates/tasks/src/recovery.rs @@ -15,7 +15,7 @@ use mas_storage::{ user::{UserEmailFilter, UserRecoveryRepository}, }; use mas_templates::{EmailRecoveryContext, TemplateContext}; -use rand::distributions::{Alphanumeric, DistString}; +use rand::distr::{Alphanumeric, SampleString}; use tracing::{error, info}; use crate::{ diff --git a/crates/templates/src/context.rs b/crates/templates/src/context.rs index 937a2b66e..e5547c7ee 100644 --- a/crates/templates/src/context.rs +++ b/crates/templates/src/context.rs @@ -37,8 +37,8 @@ use oauth2_types::{ scope::{OPENID, Scope}, }; use rand::{ - Rng, SeedableRng, - distributions::{Alphanumeric, DistString}, + RngExt, SeedableRng, + distr::{Alphanumeric, SampleString}, }; use rand_chacha::ChaCha8Rng; use serde::{Deserialize, Serialize, ser::SerializeStruct}; @@ -113,7 +113,7 @@ pub trait TemplateContext: Serialize { /// /// This is then used to check for template validity in unit tests and in /// the CLI (`cargo run -- templates check`) - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -151,7 +151,7 @@ pub(crate) fn sample_list(samples: Vec) -> BTreeMap( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -188,7 +188,7 @@ impl std::ops::Deref for WithLanguage { } impl TemplateContext for WithLanguage { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -197,7 +197,7 @@ impl TemplateContext for WithLanguage { Self: Sized, { // Create a forked RNG so we make samples deterministic between locales - let rng = ChaCha8Rng::from_rng(rng).unwrap(); + let rng = ChaCha8Rng::from_rng(&mut *rng); locales .iter() .flat_map(|locale| { @@ -227,7 +227,7 @@ pub struct WithCsrf { } impl TemplateContext for WithCsrf { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -260,7 +260,7 @@ pub struct WithSession { } impl TemplateContext for WithSession { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -298,7 +298,7 @@ pub struct WithOptionalSession { } impl TemplateContext for WithOptionalSession { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -349,7 +349,7 @@ impl Serialize for EmptyContext { } impl TemplateContext for EmptyContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -377,7 +377,7 @@ impl IndexContext { } impl TemplateContext for IndexContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -423,7 +423,7 @@ impl AppContext { } impl TemplateContext for AppContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -456,7 +456,7 @@ impl ApiDocContext { } impl TemplateContext for ApiDocContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -548,7 +548,7 @@ pub struct LoginContext { } impl TemplateContext for LoginContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -656,7 +656,7 @@ pub struct RegisterContext { } impl TemplateContext for RegisterContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -699,7 +699,7 @@ pub struct PasswordRegisterContext { } impl TemplateContext for PasswordRegisterContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -742,7 +742,7 @@ pub struct ConsentContext { } impl TemplateContext for ConsentContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -818,7 +818,7 @@ pub struct PolicyViolationContext { } impl TemplateContext for PolicyViolationContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -976,7 +976,7 @@ pub struct CompatLoginPolicyViolationContext { } impl TemplateContext for CompatLoginPolicyViolationContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1048,7 +1048,7 @@ pub struct CompatSsoContext { } impl TemplateContext for CompatSsoContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1120,7 +1120,7 @@ impl EmailRecoveryContext { } impl TemplateContext for EmailRecoveryContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1185,7 +1185,7 @@ impl EmailVerificationContext { } impl TemplateContext for EmailVerificationContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1257,7 +1257,7 @@ impl RegisterStepsVerifyEmailContext { } impl TemplateContext for RegisterStepsVerifyEmailContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1297,7 +1297,7 @@ impl RegisterStepsEmailInUseContext { } impl TemplateContext for RegisterStepsEmailInUseContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1352,7 +1352,7 @@ impl RegisterStepsDisplayNameContext { } impl TemplateContext for RegisterStepsDisplayNameContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1407,7 +1407,7 @@ impl RegisterStepsRegistrationTokenContext { } impl TemplateContext for RegisterStepsRegistrationTokenContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1458,7 +1458,7 @@ impl RecoveryStartContext { } impl TemplateContext for RecoveryStartContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1500,7 +1500,7 @@ impl RecoveryProgressContext { } impl TemplateContext for RecoveryProgressContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1546,7 +1546,7 @@ impl RecoveryExpiredContext { } impl TemplateContext for RecoveryExpiredContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1610,7 +1610,7 @@ impl RecoveryFinishContext { } impl TemplateContext for RecoveryFinishContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1659,7 +1659,7 @@ impl UpstreamExistingLinkContext { } impl TemplateContext for UpstreamExistingLinkContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1697,7 +1697,7 @@ impl UpstreamSuggestLink { } impl TemplateContext for UpstreamSuggestLink { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -1826,7 +1826,7 @@ impl UpstreamRegister { } impl TemplateContext for UpstreamRegister { - fn sample( + fn sample( now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1913,7 +1913,7 @@ impl DeviceLinkContext { } impl TemplateContext for DeviceLinkContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -1952,7 +1952,7 @@ impl DeviceConsentContext { } impl TemplateContext for DeviceConsentContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -2020,7 +2020,7 @@ impl AccountInactiveContext { } impl TemplateContext for AccountInactiveContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -2065,7 +2065,7 @@ impl DeviceNameContext { } impl TemplateContext for DeviceNameContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, _locales: &[DataLocale], @@ -2091,7 +2091,7 @@ pub struct FormPostContext { } impl TemplateContext for FormPostContext { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], @@ -2173,7 +2173,7 @@ impl std::fmt::Display for ErrorContext { } impl TemplateContext for ErrorContext { - fn sample( + fn sample( _now: chrono::DateTime, _rng: &mut R, _locales: &[DataLocale], @@ -2267,7 +2267,7 @@ impl NotFoundContext { } impl TemplateContext for NotFoundContext { - fn sample( + fn sample( _now: DateTime, _rng: &mut R, _locales: &[DataLocale], diff --git a/crates/templates/src/context/captcha.rs b/crates/templates/src/context/captcha.rs index 76e692548..7676f365d 100644 --- a/crates/templates/src/context/captcha.rs +++ b/crates/templates/src/context/captcha.rs @@ -12,7 +12,7 @@ use minijinja::{ Value, value::{Enumerator, Object}, }; -use rand::Rng; +use rand::RngExt; use serde::Serialize; use crate::{TemplateContext, context::SampleIdentifier}; @@ -60,7 +60,7 @@ impl WithCaptcha { } impl TemplateContext for WithCaptcha { - fn sample( + fn sample( now: chrono::DateTime, rng: &mut R, locales: &[DataLocale], diff --git a/crates/templates/src/lib.rs b/crates/templates/src/lib.rs index 18eaa74e4..890fca353 100644 --- a/crates/templates/src/lib.rs +++ b/crates/templates/src/lib.rs @@ -22,7 +22,7 @@ use mas_i18n::Translator; use mas_router::UrlBuilder; use mas_spa::ViteManifest; use minijinja::{UndefinedBehavior, Value}; -use rand::Rng; +use rand::RngExt; use serde::Serialize; use thiserror::Error; use tokio::task::JoinError; @@ -487,7 +487,7 @@ impl Templates { /// # Errors /// /// Returns an error if any of the templates fails to render - pub fn check_render( + pub fn check_render( &self, now: chrono::DateTime, rng: &R, diff --git a/crates/templates/src/macros.rs b/crates/templates/src/macros.rs index 6785dabe1..e596ee78f 100644 --- a/crates/templates/src/macros.rs +++ b/crates/templates/src/macros.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2021-2024 The Matrix.org Foundation C.I.C. // @@ -78,9 +79,9 @@ macro_rules! register_templates { /// # Errors /// /// Returns an error if any template fails to render with any of the sample. - pub(crate) fn all(templates: &Templates, now: chrono::DateTime, rng: &R) -> anyhow::Result<::std::collections::BTreeMap<(&'static str, SampleIdentifier), String>> { + pub(crate) fn all(templates: &Templates, now: chrono::DateTime, rng: &R) -> anyhow::Result<::std::collections::BTreeMap<(&'static str, SampleIdentifier), String>> { let mut out = ::std::collections::BTreeMap::new(); - // TODO shouldn't the Rng be independent for each render? + // TODO shouldn't the RngExt be independent for each render? $( { let mut rng = rng.clone(); @@ -104,7 +105,7 @@ macro_rules! register_templates { /// /// Returns an error if the template fails to render with any of the sample. pub(crate) fn $name - < __R: Rng + Clone $( , $( $lt $( : $clt $(+ $dlt )* + TemplateContext )? ),+ )? > + < __R: RngExt + Clone $( , $( $lt $( : $clt $(+ $dlt )* + TemplateContext )? ),+ )? > (templates: &Templates, now: chrono::DateTime, rng: &mut __R) -> anyhow::Result> { let locales = templates.translator().available_locales(); diff --git a/deny.toml b/deny.toml index f0fa2172a..69e100642 100644 --- a/deny.toml +++ b/deny.toml @@ -95,39 +95,40 @@ skip = [ { name = "darling_core", version = "0.20.11" }, { name = "darling_macro", version = "0.20.11" }, - # We are still mainly using rand 0.8 + # We moved to rand 0.10, but cookie and sqlx still pull the 0.8 generation { name = "rand", version = "0.8.6" }, { name = "rand_chacha", version = "0.3.1" }, { name = "rand_core", version = "0.6.4" }, { name = "getrandom", version = "0.2.16" }, - # opa-wasm 0.3 is on rand 0.10, opentelemetry_sdk, sentry and ulid are - # still on rand 0.9 + # ...and opentelemetry_sdk, sentry and ulid pull the 0.9 generation { name = "rand", version = "0.9.4" }, + { name = "rand_chacha", version = "0.9.0" }, { name = "rand_core", version = "0.9.3" }, { name = "getrandom", version = "0.3.3" }, - # opa-wasm 0.3 is on base64 0.23, the rest of the tree is still on 0.22 + + # We moved to the new (digest 0.11-based) generation of the RustCrypto + # crates, but cookie (via axum-extra's private cookies), sqlx, headers, + # wasmtime and pest still pull the previous generation + { name = "aead", version = "0.5.2" }, # aes-gcm 0.10 <- cookie + { name = "aes", version = "0.8.4" }, # aes-gcm 0.10 <- cookie + { name = "aes-gcm", version = "0.10.3" }, # cookie + { name = "block-buffer", version = "0.10.4" }, # digest 0.10 + { name = "cipher", version = "0.4.4" }, # aes, aes-gcm, ctr + { name = "cpufeatures", version = "0.2.17" }, # aes, polyval, sha1, sha2 0.10 + { name = "crypto-common", version = "0.1.6" }, # aead, cipher, digest 0.10 + { name = "ctr", version = "0.9.2" }, # aes-gcm 0.10 <- cookie + { name = "digest", version = "0.10.7" }, # hmac, md-5, sha1, sha2 0.10 + { name = "ghash", version = "0.5.1" }, # aes-gcm 0.10 <- cookie + { name = "hmac", version = "0.12.1" }, # hkdf 0.12 <- cookie, sqlx + { name = "inout", version = "0.1.4" }, # cipher 0.4 + { name = "md-5", version = "0.10.6" }, # sqlx + { name = "polyval", version = "0.6.2" }, # ghash 0.5 + { name = "sha1", version = "0.10.6" }, # headers + { name = "sha2", version = "0.10.9" }, # cookie, sqlx, wasmtime, pest + { name = "universal-hash", version = "0.5.1" }, # ghash, polyval + + # bcrypt and opa-wasm moved to base64 0.23, the rest of the tree is on 0.22 { name = "base64", version = "0.22.1" }, - # opa-wasm 0.3 is on the digest 0.11 generation of the RustCrypto crates, - # the rest of the tree (mas-jose, argon2, rsa, sqlx, …) is still on the - # digest 0.10 one - { name = "block-buffer", version = "0.10.4" }, - { name = "chacha20", version = "0.9.1" }, - { name = "const-oid", version = "0.9.6" }, - { name = "cpufeatures", version = "0.2.17" }, - { name = "crypto-common", version = "0.1.6" }, - { name = "digest", version = "0.10.7" }, - { name = "hmac", version = "0.12.1" }, - { name = "md-5", version = "0.10.6" }, - { name = "sha1", version = "0.10.6" }, - { name = "sha2", version = "0.10.9" }, - # bcrypt 0.19 (via blowfish) is on cipher 0.5, the rest of the tree is - # still on 0.4 - { name = "cipher", version = "0.4.4" }, - { name = "inout", version = "0.1.4" }, - # chacha20poly1305 0.11 is on aead 0.6, cookie (via aes-gcm) is still on - # aead 0.5 - { name = "aead", version = "0.5.2" }, - { name = "universal-hash", version = "0.5.1" }, # zerovec-derive (via icu) moved to syn 3, everything else is on syn 2 { name = "syn", version = "2.0.106" }, ]