[autofix.ci] apply automated fixes

Author: autofix-ci[bot]

crates/api-keys-simplified/src/generator.rs

@@ -373,8 +373,13 @@ mod tests {
 
     #[test]
     fn test_verify_checksum_dos_protection() {
-        let generator =
-            ApiKeyManagerV0::init("sk", KeyConfig::balanced(), HashConfig::default(), std::time::Duration::ZERO).unwrap();
+        let generator = ApiKeyManagerV0::init(
+            "sk",
+            KeyConfig::balanced(),
+            HashConfig::default(),
+            std::time::Duration::ZERO,
+        )
+        .unwrap();
 
         // Test oversized key rejection
         let huge_key = SecureString::from("a".repeat(1000));

crates/api-keys-simplified/src/token_parser.rs

@@ -161,7 +161,8 @@ mod tests {
             HashConfig::default()
         };
 
-        let generator = ApiKeyManagerV0::init("text", config, hash_config, std::time::Duration::ZERO).unwrap();
+        let generator =
+            ApiKeyManagerV0::init("text", config, hash_config, std::time::Duration::ZERO).unwrap();
         let ts = Utc::now();
         let key = if with_expiry {
             generator

crates/api-keys-simplified/src/validator.rs

@@ -47,16 +47,21 @@ impl KeyValidator {
         })
     }
 
-    fn verify_expiry(&self, parts: Parts, expiry_grace_period: std::time::Duration) -> Result<KeyStatus> {
+    fn verify_expiry(
+        &self,
+        parts: Parts,
+        expiry_grace_period: std::time::Duration,
+    ) -> Result<KeyStatus> {
         if let Some(expiry) = parts.expiry_b64 {
             let decoded = URL_SAFE_NO_PAD
                 .decode(expiry)
                 .or(Err(Error::InvalidFormat))?;
-            let expiry_timestamp = i64::from_be_bytes(decoded.try_into().or(Err(Error::InvalidFormat))?);
+            let expiry_timestamp =
+                i64::from_be_bytes(decoded.try_into().or(Err(Error::InvalidFormat))?);
 
             let current_time = chrono::Utc::now().timestamp();
             let grace_seconds = expiry_grace_period.as_secs() as i64;
-            
+
             // Key is invalid if it expired more than grace_period ago
             // This ensures once a key expires beyond the grace period, it stays expired
             // even if the clock goes backwards
@@ -156,25 +161,29 @@ mod tests {
         let hash = hasher.hash(&key).unwrap();
 
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
         assert_eq!(
             validator
-                .verify(key.expose_secret(), hash.as_ref(), std::time::Duration::ZERO)
+                .verify(
+                    key.expose_secret(),
+                    hash.as_ref(),
+                    std::time::Duration::ZERO
+                )
                 .unwrap(),
             KeyStatus::Valid
         );
         assert_eq!(
-            validator.verify("wrong_key", hash.as_ref(), std::time::Duration::ZERO).unwrap(),
+            validator
+                .verify("wrong_key", hash.as_ref(), std::time::Duration::ZERO)
+                .unwrap(),
             KeyStatus::Invalid
         );
     }
 
     #[test]
     fn test_invalid_hash_format() {
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
         let result = validator.verify("any_key", "invalid_hash", std::time::Duration::ZERO);
         // After timing oracle fix: invalid hash format returns Ok(Invalid) instead of Err
         // to prevent timing-based user enumeration attacks
@@ -190,8 +199,7 @@ mod tests {
         let hash = hasher.hash(&valid_key).unwrap();
 
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
         let result = validator.verify(&oversized_key, hash.as_ref(), std::time::Duration::ZERO);
         assert!(result.is_err());
         assert!(matches!(result.unwrap_err(), Error::InvalidFormat));
@@ -202,8 +210,7 @@ mod tests {
         let oversized_hash = "a".repeat(513); // Exceeds MAX_HASH_LENGTH
 
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
         let result = validator.verify("valid_key", &oversized_hash, std::time::Duration::ZERO);
         assert!(result.is_err());
         assert!(matches!(result.unwrap_err(), Error::InvalidFormat));
@@ -216,8 +223,7 @@ mod tests {
         let hash = hasher.hash(&valid_key).unwrap();
 
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
 
         // Test at boundary (512 chars - should pass)
         let max_key = "a".repeat(512);
@@ -238,18 +244,25 @@ mod tests {
         let valid_hash = hasher.hash(&valid_key).unwrap();
 
         let (dummy_key, dummy_hash) = dummy_key_and_hash();
-        let validator =
-            KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
+        let validator = KeyValidator::new(true, dummy_key, dummy_hash).unwrap();
 
         let result1 = validator.verify("wrong_key", valid_hash.as_ref(), std::time::Duration::ZERO);
         assert!(result1.is_ok());
         assert_eq!(result1.unwrap(), KeyStatus::Invalid);
 
-        let result2 = validator.verify(valid_key.expose_secret(), "invalid_hash_format", std::time::Duration::ZERO);
+        let result2 = validator.verify(
+            valid_key.expose_secret(),
+            "invalid_hash_format",
+            std::time::Duration::ZERO,
+        );
         assert!(result2.is_ok());
         assert_eq!(result2.unwrap(), KeyStatus::Invalid);
 
-        let result3 = validator.verify(valid_key.expose_secret(), "not even close to valid", std::time::Duration::ZERO);
+        let result3 = validator.verify(
+            valid_key.expose_secret(),
+            "not even close to valid",
+            std::time::Duration::ZERO,
+        );
         assert!(result3.is_ok());
         assert_eq!(result3.unwrap(), KeyStatus::Invalid);
     }

crates/api-keys-simplified/tests/checksum_dos_protection.rs

@@ -44,7 +44,13 @@ fn test_checksum_prevents_expensive_verification() {
 fn test_valid_checksum_proceeds_to_argon2() {
     // Verify that valid checksums still go through Argon2 verification
     let config = KeyConfig::default().disable_checksum();
-    let generator = ApiKeyManagerV0::init("verify", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let generator = ApiKeyManagerV0::init(
+        "verify",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
 
     let key = generator.generate(Environment::production()).unwrap();
 
@@ -70,8 +76,13 @@ fn test_valid_checksum_proceeds_to_argon2() {
 #[test]
 fn test_dos_protection_comparison() {
     // Compare DoS resistance: with vs without checksum
-    let with_checksum =
-        ApiKeyManagerV0::init("dos1", KeyConfig::default(), HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let with_checksum = ApiKeyManagerV0::init(
+        "dos1",
+        KeyConfig::default(),
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
 
     let without_checksum = ApiKeyManagerV0::init(
         "dos2",

crates/api-keys-simplified/tests/concurrency.rs

@@ -56,7 +56,15 @@ fn test_concurrent_generation_and_uniqueness() {
 fn test_concurrent_verification_and_checksum() {
     // Tests: Argon2 thread safety, checksum verification (enabled by default), Arc-wrapped SecureString
     let config = KeyConfig::default();
-    let generator = Arc::new(ApiKeyManagerV0::init("pk", config, HashConfig::default(), std::time::Duration::ZERO).unwrap());
+    let generator = Arc::new(
+        ApiKeyManagerV0::init(
+            "pk",
+            config,
+            HashConfig::default(),
+            std::time::Duration::ZERO,
+        )
+        .unwrap(),
+    );
 
     // Generate test data
     let mut keys_and_hashes = Vec::new();
@@ -104,7 +112,13 @@ fn test_concurrent_verification_and_checksum() {
 #[test]
 fn test_clone_safety_and_config_isolation() {
     // Tests: Clone safety, different configs don't interfere, cross-verification
-    let gen1 = ApiKeyManagerV0::init("g1", KeyConfig::balanced(), HashConfig::balanced(), std::time::Duration::ZERO).unwrap();
+    let gen1 = ApiKeyManagerV0::init(
+        "g1",
+        KeyConfig::balanced(),
+        HashConfig::balanced(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let gen2_cloned = gen1.clone();
     let gen3 = ApiKeyManagerV0::init(
         "g3",

crates/api-keys-simplified/tests/configuration.rs

@@ -4,7 +4,13 @@ use api_keys_simplified::{ExposeSecret, SecureStringExt};
 #[test]
 fn test_custom_entropy() {
     let config = KeyConfig::new().with_entropy(16).unwrap();
-    let generator = ApiKeyManagerV0::init("sk", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let generator = ApiKeyManagerV0::init(
+        "sk",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let key = generator.generate(Environment::test()).unwrap();
 
     assert!(key.key().len() > 10);
@@ -13,7 +19,13 @@ fn test_custom_entropy() {
 #[test]
 fn test_without_checksum() {
     let config = KeyConfig::default().disable_checksum();
-    let generator = ApiKeyManagerV0::init("pk", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let generator = ApiKeyManagerV0::init(
+        "pk",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let key = generator.generate(Environment::production()).unwrap();
 
     // Environment "live" means production, Base64URL can contain underscores and hyphens
@@ -54,7 +66,8 @@ fn test_custom_hash_config() {
     let hash_config = HashConfig::custom(8192, 1, 1).unwrap();
 
     let config = KeyConfig::default();
-    let generator = ApiKeyManagerV0::init("text", config, hash_config, std::time::Duration::ZERO).unwrap();
+    let generator =
+        ApiKeyManagerV0::init("text", config, hash_config, std::time::Duration::ZERO).unwrap();
     let key = generator.generate(Environment::dev()).unwrap();
 
     assert_eq!(
@@ -67,13 +80,25 @@ fn test_custom_hash_config() {
 fn test_entropy_boundaries() {
     // Minimum entropy
     let config_min = KeyConfig::new().with_entropy(16).unwrap();
-    let gen_min = ApiKeyManagerV0::init("min", config_min, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let gen_min = ApiKeyManagerV0::init(
+        "min",
+        config_min,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let key_min = gen_min.generate(Environment::test()).unwrap();
     assert!(!key_min.key().is_empty());
 
     // Maximum entropy
     let config_max = KeyConfig::new().with_entropy(64).unwrap();
-    let gen_max = ApiKeyManagerV0::init("max", config_max, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let gen_max = ApiKeyManagerV0::init(
+        "max",
+        config_max,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let key_max = gen_max.generate(Environment::test()).unwrap();
     assert!(key_max.key().len() > key_min.key().len());
 }

crates/api-keys-simplified/tests/key_expiry.rs

@@ -196,7 +196,13 @@ fn test_expiry_without_checksum() {
     use api_keys_simplified::{HashConfig, KeyConfig};
 
     let config = KeyConfig::default().disable_checksum();
-    let manager = ApiKeyManagerV0::init("sk", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let manager = ApiKeyManagerV0::init(
+        "sk",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
 
     let past = Utc::now() - Duration::hours(1);
     let future = Utc::now() + Duration::hours(1);

crates/api-keys-simplified/tests/security.rs

@@ -33,7 +33,13 @@ fn test_different_keys_same_hash() {
 #[test]
 fn test_checksum_validation() {
     let config = KeyConfig::default();
-    let generator = ApiKeyManagerV0::init("chk", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let generator = ApiKeyManagerV0::init(
+        "chk",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let with_checksum = generator.generate(Environment::test()).unwrap();
     assert!(generator.verify_checksum(with_checksum.key()).unwrap());
 
@@ -75,7 +81,13 @@ fn test_collision_resistance() {
 #[test]
 fn test_key_format_consistency() {
     let config = KeyConfig::default();
-    let generator = ApiKeyManagerV0::init("format", config, HashConfig::default(), std::time::Duration::ZERO).unwrap();
+    let generator = ApiKeyManagerV0::init(
+        "format",
+        config,
+        HashConfig::default(),
+        std::time::Duration::ZERO,
+    )
+    .unwrap();
     let key = generator.generate(Environment::test()).unwrap();
     let key_str = key.key().expose_secret();