style(rust): apply cargo fmt across all crates

hyperpolymath · hyperpolymath · commit b01065e7ae98 · 2026-05-12T14:09:44.000+02:00
Unbreaks Rust CI's cargo fmt --check job on main.
diff --git a/rgtv-cli/src/main.rs b/rgtv-cli/src/main.rs
@@ -92,12 +92,10 @@ struct Config {
 
 impl Config {
     fn from_env() -> Result<Self, String> {
-        let base_url = env::var("RGTV_URL")
-            .unwrap_or_else(|_| "http://127.0.0.1:9100".to_string());
-        let agent_token = env::var("RGTV_AGENT_TOKEN")
-            .map_err(|_| "RGTV_AGENT_TOKEN must be set".to_string())?;
-        let broker_bin = env::var("RGTV_BROKER_BIN")
-            .unwrap_or_else(|_| "vault-broker".to_string());
+        let base_url = env::var("RGTV_URL").unwrap_or_else(|_| "http://127.0.0.1:9100".to_string());
+        let agent_token =
+            env::var("RGTV_AGENT_TOKEN").map_err(|_| "RGTV_AGENT_TOKEN must be set".to_string())?;
+        let broker_bin = env::var("RGTV_BROKER_BIN").unwrap_or_else(|_| "vault-broker".to_string());
         Ok(Config {
             base_url,
             agent_token: Zeroizing::new(agent_token),
@@ -155,7 +153,8 @@ fn get_credentials(cfg: &Config) -> Result<CredentialsResponse, String> {
         .set("Authorization", &bearer(&cfg.agent_token))
         .call()
         .map_err(ureq_err)?;
-    resp.into_json().map_err(|e| format!("parse credentials: {e}"))
+    resp.into_json()
+        .map_err(|e| format!("parse credentials: {e}"))
 }
 
 fn post_grant(cfg: &Config, hint: &str) -> Result<GrantResponse, String> {
@@ -203,7 +202,10 @@ fn log_file() -> PathBuf {
 
 fn write_pid(pid: u32) -> std::io::Result<()> {
     let path = pid_file();
-    fs::create_dir_all(path.parent().expect("invariant: pid_file() path always has a parent"))?;
+    fs::create_dir_all(
+        path.parent()
+            .expect("invariant: pid_file() path always has a parent"),
+    )?;
     let mut f = fs::File::create(&path)?;
     write!(f, "{pid}")
 }
@@ -248,10 +250,7 @@ fn cmd_get(cfg: &Config, args: &[String]) {
         (rest[1].clone(), &rest[2..])
     } else {
         // Default env var name: hint uppercased, dashes and dots → underscores.
-        let default_var = hint
-            .to_uppercase()
-            .replace('-', "_")
-            .replace('.', "_");
+        let default_var = hint.to_uppercase().replace('-', "_").replace('.', "_");
         (default_var, rest)
     };
 
@@ -365,8 +364,10 @@ fn cmd_verify(cfg: &Config, args: &[String]) {
     use zeroize::Zeroize;
     value.zeroize();
 
-    println!("ok — hint '{hint}' is redeemable (grant {}, TTL {}s)",
-        grant.grant_id, grant.expires_in_secs);
+    println!(
+        "ok — hint '{hint}' is redeemable (grant {}, TTL {}s)",
+        grant.grant_id, grant.expires_in_secs
+    );
 }
 
 /// `rgtv audit [--max <n>]`
@@ -417,7 +418,12 @@ fn cmd_daemon_start(cfg: &Config) {
     }
 
     let log_path = log_file();
-    fs::create_dir_all(log_path.parent().expect("invariant: log_file() path always has a parent")).unwrap_or_else(|e| {
+    fs::create_dir_all(
+        log_path
+            .parent()
+            .expect("invariant: log_file() path always has a parent"),
+    )
+    .unwrap_or_else(|e| {
         eprintln!("error: could not create state dir: {e}");
         process::exit(1);
     });
@@ -462,7 +468,10 @@ fn cmd_daemon_start(cfg: &Config) {
     for i in 0..10 {
         std::thread::sleep(Duration::from_secs(1));
         if let Ok(h) = get_health(cfg) {
-            println!("vault-broker ready: {} ({} credentials loaded)", h.status, h.credential_count);
+            println!(
+                "vault-broker ready: {} ({} credentials loaded)",
+                h.status, h.credential_count
+            );
             println!("logs: {}", log_path.display());
             return;
         }
@@ -548,8 +557,8 @@ fn cmd_daemon_status(cfg: &Config) {
 fn cmd_daemon(cfg: &Config, args: &[String]) {
     let sub = args.first().map(String::as_str).unwrap_or("");
     match sub {
-        "start"  => cmd_daemon_start(cfg),
-        "stop"   => cmd_daemon_stop(),
+        "start" => cmd_daemon_start(cfg),
+        "stop" => cmd_daemon_stop(),
         "status" => cmd_daemon_status(cfg),
         other => {
             eprintln!("Unknown daemon sub-command: '{other}'");
@@ -602,11 +611,11 @@ fn main() {
     });
 
     match args[1].as_str() {
-        "get"    => cmd_get(&cfg, &args[2..]),
-        "list"   => cmd_list(&cfg),
+        "get" => cmd_get(&cfg, &args[2..]),
+        "list" => cmd_list(&cfg),
         "status" => cmd_status(&cfg),
         "verify" => cmd_verify(&cfg, &args[2..]),
-        "audit"  => cmd_audit(&args[2..]),
+        "audit" => cmd_audit(&args[2..]),
         "rotate" => cmd_rotate(&args[2..]),
         "daemon" => cmd_daemon(&cfg, &args[2..]),
         "--version" | "version" => println!("rgtv 0.1.0"),
diff --git a/vault-broker/src/main.rs b/vault-broker/src/main.rs
@@ -181,7 +181,13 @@ async fn list_credentials(
     headers: HeaderMap,
 ) -> impl IntoResponse {
     if let Err(code) = authenticate(&headers, &state.agent_token) {
-        return (code, Json(ErrorResponse { error: "unauthorized".into() })).into_response();
+        return (
+            code,
+            Json(ErrorResponse {
+                error: "unauthorized".into(),
+            }),
+        )
+            .into_response();
     }
     let mut hints: Vec<String> = state.credentials.keys().cloned().collect();
     hints.sort();
@@ -191,7 +197,11 @@ async fn list_credentials(
 
 async fn health(State(state): State<SharedState>) -> impl IntoResponse {
     let cred_count = state.credentials.len();
-    let grants_active = state.grants.lock().expect("invariant: mutex is not poisoned").len();
+    let grants_active = state
+        .grants
+        .lock()
+        .expect("invariant: mutex is not poisoned")
+        .len();
     info!(cred_count, grants_active, "health check");
     Json(HealthResponse {
         status: "ok",
@@ -209,7 +219,13 @@ async fn create_grant(
     Json(req): Json<GrantRequest>,
 ) -> impl IntoResponse {
     if let Err(code) = authenticate(&headers, &state.agent_token) {
-        return (code, Json(ErrorResponse { error: "unauthorized".into() })).into_response();
+        return (
+            code,
+            Json(ErrorResponse {
+                error: "unauthorized".into(),
+            }),
+        )
+            .into_response();
     }
 
     // Validate hint exists.
@@ -228,7 +244,10 @@ async fn create_grant(
     let expires_at = SystemTime::now() + state.grant_ttl;
 
     {
-        let mut grants = state.grants.lock().expect("invariant: mutex is not poisoned");
+        let mut grants = state
+            .grants
+            .lock()
+            .expect("invariant: mutex is not poisoned");
 
         // Purge expired grants to keep memory tidy.
         let now = SystemTime::now();
@@ -267,12 +286,21 @@ async fn redeem_grant(
     Path(grant_id): Path<String>,
 ) -> impl IntoResponse {
     if let Err(code) = authenticate(&headers, &state.agent_token) {
-        return (code, Json(ErrorResponse { error: "unauthorized".into() })).into_response();
+        return (
+            code,
+            Json(ErrorResponse {
+                error: "unauthorized".into(),
+            }),
+        )
+            .into_response();
     }
 
     // Retrieve and immediately remove the grant.
     let hint = {
-        let mut grants = state.grants.lock().expect("invariant: mutex is not poisoned");
+        let mut grants = state
+            .grants
+            .lock()
+            .expect("invariant: mutex is not poisoned");
         match grants.remove(&grant_id) {
             None => {
                 warn!(%grant_id, "redeem: grant not found or already redeemed");
@@ -344,15 +372,16 @@ async fn redeem_grant(
 async fn main() {
     tracing_subscriber::fmt()
         .with_env_filter(
-            tracing_subscriber::EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| "vault_broker=info,tower_http=warn".parse().expect("invariant: hardcoded filter string is valid")),
+            tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(|_| {
+                "vault_broker=info,tower_http=warn"
+                    .parse()
+                    .expect("invariant: hardcoded filter string is valid")
+            }),
         )
         .init();
 
-    let agent_token = Zeroizing::new(
-        env::var("RGTV_AGENT_TOKEN")
-            .expect("RGTV_AGENT_TOKEN must be set"),
-    );
+    let agent_token =
+        Zeroizing::new(env::var("RGTV_AGENT_TOKEN").expect("RGTV_AGENT_TOKEN must be set"));
     let grant_ttl_secs: u64 = env::var("RGTV_GRANT_TTL_SECS")
         .ok()
         .and_then(|v| v.parse().ok())
@@ -384,6 +413,10 @@ async fn main() {
     let addr = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 0], port));
     info!(%addr, grant_ttl_secs, "vault-broker starting");
 
-    let listener = tokio::net::TcpListener::bind(addr).await.expect("invariant: bind to [::]:port succeeds");
-    axum::serve(listener, app).await.expect("invariant: axum server runs until shutdown");
+    let listener = tokio::net::TcpListener::bind(addr)
+        .await
+        .expect("invariant: bind to [::]:port succeeds");
+    axum::serve(listener, app)
+        .await
+        .expect("invariant: axum server runs until shutdown");
 }
diff --git a/vault-worker/src/lib.rs b/vault-worker/src/lib.rs
@@ -167,11 +167,13 @@ fn check_auth(req: &Request, env: &Env) -> std::result::Result<(), Response> {
         Ok(v) => v.to_string(),
         Err(_) => {
             // Fail closed — if the secret is missing, reject every request.
-            return Err(Response::error(
-                "server misconfigured: RGTV_AGENT_TOKEN not set",
-                500,
-            )
-            .unwrap_or_else(|_| Response::empty().expect("invariant: Response::empty() construction always succeeds")));
+            return Err(
+                Response::error("server misconfigured: RGTV_AGENT_TOKEN not set", 500)
+                    .unwrap_or_else(|_| {
+                        Response::empty()
+                            .expect("invariant: Response::empty() construction always succeeds")
+                    }),
+            );
         }
     };
     let expected = format!("Bearer {token}");
@@ -181,8 +183,9 @@ fn check_auth(req: &Request, env: &Env) -> std::result::Result<(), Response> {
         .unwrap_or_default()
         .unwrap_or_default();
     if auth != expected {
-        Err(Response::error("unauthorized", 401)
-            .unwrap_or_else(|_| Response::empty().expect("invariant: Response::empty() construction always succeeds")))
+        Err(Response::error("unauthorized", 401).unwrap_or_else(|_| {
+            Response::empty().expect("invariant: Response::empty() construction always succeeds")
+        }))
     } else {
         Ok(())
     }
@@ -308,8 +311,7 @@ async fn handle_create_grant(mut req: Request, ctx: RouteContext<()>) -> Result<
     };
 
     // Store the grant record in its DO instance.
-    let body_str = serde_json::to_string(&record)
-        .map_err(|e| Error::RustError(e.to_string()))?;
+    let body_str = serde_json::to_string(&record).map_err(|e| Error::RustError(e.to_string()))?;
     let ns = ctx.durable_object("GRANTS")?;
     let stub = ns.id_from_name(&grant_id)?.get_stub()?;
     stub.fetch_with_request(do_put_request(&body_str)?).await?;
