hecks 3.14.0 → 4.0.0

data/rust/host/src/auth.rs

@@ -1,7 +1,10 @@
 //! Google sign-in and stateless sessions: OAuth, ID-token verification
 //! against Google's real JWKS, and HMAC-signed session/account cookies.
 
+use crate::b64;
+use crate::crypto::{constant_time_eq, hex_encode};
 use crate::dispatch;
+use crate::host::Host;
 use crate::journal;
 use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
@@ -31,7 +34,8 @@ pub struct Session {
 }
 
 pub fn authorization_url(redirect_uri: &str, secret: &str) -> Result<String, String> {
-    let client_id = std::env::var("GOOGLE_CLIENT_ID").map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
+    let client_id = crate::secrets::var("GOOGLE_CLIENT_ID")
+        .map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
     let payload = now_secs().to_string();
     let state = format!("{payload}.{}", sign(secret, &payload));
     Ok(format!(
@@ -55,11 +59,12 @@ pub fn verify_state(state: &str, secret: &str) -> Result<(), String> {
 }
 
 pub async fn verify(code: &str, redirect_uri: &str) -> Result<Claims, String> {
-    let client_id = std::env::var("GOOGLE_CLIENT_ID").map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
-    let client_secret =
-        std::env::var("GOOGLE_CLIENT_SECRET").map_err(|_| "GOOGLE_CLIENT_SECRET not set".to_string())?;
+    let client_id = crate::secrets::var("GOOGLE_CLIENT_ID")
+        .map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
+    let client_secret = crate::secrets::var("GOOGLE_CLIENT_SECRET")
+        .map_err(|_| "GOOGLE_CLIENT_SECRET not set".to_string())?;
 
-    let http = reqwest::Client::new();
+    let http = crate::http::client();
     let resp = http
         .post("https://oauth2.googleapis.com/token")
         .form(&[
@@ -77,7 +82,10 @@ pub async fn verify(code: &str, redirect_uri: &str) -> Result<Claims, String> {
         let body = resp.text().await.unwrap_or_default();
         return Err(format!("token exchange failed: {body}"));
     }
-    let body: Value = resp.json().await.map_err(|e| format!("token response: {e}"))?;
+    let body: Value = resp
+        .json()
+        .await
+        .map_err(|e| format!("token response: {e}"))?;
     let id_token = body
         .get("id_token")
         .and_then(|v| v.as_str())
@@ -90,10 +98,13 @@ pub async fn verify(code: &str, redirect_uri: &str) -> Result<Claims, String> {
 // and missing Google's own key rotation would be worse than one extra
 // HTTPS round trip per login.
 async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, String> {
-    let header = jsonwebtoken::decode_header(id_token).map_err(|e| format!("bad id_token header: {e}"))?;
-    let kid = header.kid.ok_or_else(|| "id_token header has no kid".to_string())?;
+    let header =
+        jsonwebtoken::decode_header(id_token).map_err(|e| format!("bad id_token header: {e}"))?;
+    let kid = header
+        .kid
+        .ok_or_else(|| "id_token header has no kid".to_string())?;
 
-    let http = reqwest::Client::new();
+    let http = crate::http::client();
     let jwks: Value = http
         .get("https://www.googleapis.com/oauth2/v3/certs")
         .send()
@@ -106,10 +117,19 @@ async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, Stri
     let key = jwks
         .get("keys")
         .and_then(|k| k.as_array())
-        .and_then(|keys| keys.iter().find(|k| k.get("kid").and_then(|v| v.as_str()) == Some(kid.as_str())))
+        .and_then(|keys| {
+            keys.iter()
+                .find(|k| k.get("kid").and_then(|v| v.as_str()) == Some(kid.as_str()))
+        })
         .ok_or_else(|| format!("no JWKS key matches id_token's kid {kid:?}"))?;
-    let n = key.get("n").and_then(|v| v.as_str()).ok_or_else(|| "JWKS key has no n".to_string())?;
-    let e = key.get("e").and_then(|v| v.as_str()).ok_or_else(|| "JWKS key has no e".to_string())?;
+    let n = key
+        .get("n")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| "JWKS key has no n".to_string())?;
+    let e = key
+        .get("e")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| "JWKS key has no e".to_string())?;
     let decoding_key = jsonwebtoken::DecodingKey::from_rsa_components(n, e)
         .map_err(|err| format!("building decoding key from JWKS: {err}"))?;
 
@@ -122,13 +142,20 @@ async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, Stri
     let claims = token.claims;
 
     Ok(Claims {
-        issuer: claims.get("iss").and_then(|v| v.as_str()).unwrap_or(ISSUER).to_string(),
+        issuer: claims
+            .get("iss")
+            .and_then(|v| v.as_str())
+            .unwrap_or(ISSUER)
+            .to_string(),
         subject: claims
             .get("sub")
             .and_then(|v| v.as_str())
             .ok_or_else(|| "id_token has no sub".to_string())?
             .to_string(),
-        email: claims.get("email").and_then(|v| v.as_str()).map(|s| s.to_string()),
+        email: claims
+            .get("email")
+            .and_then(|v| v.as_str())
+            .map(std::string::ToString::to_string),
         email_verified: matches!(claims.get("email_verified"), Some(Value::Bool(true)))
             || claims.get("email_verified").and_then(|v| v.as_str()) == Some("true"),
     })
@@ -153,26 +180,30 @@ pub fn resolve_account_cookie(configured: Option<&str>) -> Result<String, String
 /// Reads `HECKS_SESSION_COOKIE`; an invalid value falls back to the
 /// default here, but `main` refuses it at boot so it can't go unnoticed.
 pub fn account_cookie_name() -> String {
-    resolve_account_cookie(std::env::var("HECKS_SESSION_COOKIE").ok().as_deref()).unwrap_or_else(|_| DEFAULT_ACCOUNT_COOKIE.to_string())
+    resolve_account_cookie(std::env::var("HECKS_SESSION_COOKIE").ok().as_deref())
+        .unwrap_or_else(|_| DEFAULT_ACCOUNT_COOKIE.to_string())
 }
 
 /// A flat, HMAC-signed `email` + expiry claim, verified by /accounts/me
 /// and the SSO handoff — deliberately not a `Session` cookie.
 pub fn account_token(secret: &str, email: &str, ttl_secs: u64) -> String {
     let payload = json!({"email": email, "exp": now_secs() + ttl_secs});
-    let encoded = base64_encode(payload.to_string().as_bytes());
+    let encoded = b64::url_encode(payload.to_string().as_bytes());
     format!("{encoded}.{}", sign(secret, &encoded))
 }
 
 pub fn verify_account_token(secret: &str, token: &str) -> Option<String> {
     let payload = verify_sig(secret, token)?;
-    let bytes = base64_decode(&payload);
+    let bytes = b64::url_decode(&payload)?;
     let value: Value = serde_json::from_slice(&bytes).ok()?;
     let exp = value.get("exp")?.as_u64()?;
     if now_secs() > exp {
         return None;
     }
-    value.get("email")?.as_str().map(|s| s.to_string())
+    value
+        .get("email")?
+        .as_str()
+        .map(std::string::ToString::to_string)
 }
 
 /// Verifies only for `purpose` (the signing key derives from it, so it
@@ -181,15 +212,18 @@ pub fn purpose_token(secret: &str, purpose: &str, claims: Value, ttl_secs: u64)
     let mut payload = claims;
     payload["purpose"] = json!(purpose);
     payload["exp"] = json!(now_secs() + ttl_secs);
-    let encoded = base64_encode(payload.to_string().as_bytes());
-    format!("{encoded}.{}", sign(&purpose_key(secret, purpose), &encoded))
+    let encoded = b64::url_encode(payload.to_string().as_bytes());
+    format!(
+        "{encoded}.{}",
+        sign(&purpose_key(secret, purpose), &encoded)
+    )
 }
 
 /// The claims of a token minted by `purpose_token` for the same `purpose`,
 /// or `None` when the signature, the purpose or the expiry does not hold.
 pub fn verify_purpose_token(secret: &str, purpose: &str, token: &str) -> Option<Value> {
     let payload = verify_sig(&purpose_key(secret, purpose), token)?;
-    let claims: Value = serde_json::from_slice(&base64_decode(&payload)).ok()?;
+    let claims: Value = serde_json::from_slice(&b64::url_decode(&payload)?).ok()?;
     if claims.get("purpose")?.as_str()? != purpose || now_secs() > claims.get("exp")?.as_u64()? {
         return None;
     }
@@ -211,13 +245,13 @@ pub fn session_cookie(secret: &str, session: &Session) -> String {
         "role": session.role,
         "exp": now_secs() + SESSION_TTL_SECS,
     });
-    let encoded = base64_encode(payload.to_string().as_bytes());
+    let encoded = b64::url_encode(payload.to_string().as_bytes());
     format!("{encoded}.{}", sign(secret, &encoded))
 }
 
 pub fn parse_session_cookie(secret: &str, cookie: &str) -> Option<Session> {
     let payload = verify_sig(secret, cookie)?;
-    let bytes = base64_decode(&payload);
+    let bytes = b64::url_decode(&payload)?;
     let value: Value = serde_json::from_slice(&bytes).ok()?;
     // A cookie with no `exp`, or one in the past, is no session: a signed
     // payload alone would otherwise stay valid until the secret changed.
@@ -228,7 +262,10 @@ pub fn parse_session_cookie(secret: &str, cookie: &str) -> Option<Session> {
         identity_id: value.get("identity_id")?.as_str()?.to_string(),
         email: value.get("email")?.as_str()?.to_string(),
         name: value.get("name")?.as_str()?.to_string(),
-        role: value.get("role").and_then(|v| v.as_str()).map(|s| s.to_string()),
+        role: value
+            .get("role")
+            .and_then(|v| v.as_str())
+            .map(std::string::ToString::to_string),
     })
 }
 
@@ -250,7 +287,11 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
                 .and_then(|v| v.as_str())
                 .map(str::to_string)
         })
-        .or_else(|| state.get("identity_id").and_then(|v| v.as_str().map(str::to_string)))
+        .or_else(|| {
+            state
+                .get("identity_id")
+                .and_then(|v| v.as_str().map(str::to_string))
+        })
         .or_else(|| {
             state
                 .get("identity_id")
@@ -286,7 +327,11 @@ pub async fn resolve_identity_anywhere(
         Err(error) if flat_journal_is_absent(&error) => return Ok(None),
         Err(error) => return Err(error),
     };
-    Ok(resolve_identity(read.get("instances").unwrap_or(&Value::Null), issuer, subject))
+    Ok(resolve_identity(
+        read.get("instances").unwrap_or(&Value::Null),
+        issuer,
+        subject,
+    ))
 }
 
 // A store with heads only has no flat journal to read; that is "no link there", not an outage.
@@ -327,7 +372,7 @@ pub async fn resolve_identity_from_head(
                 return Ok(identity_id_from_state(&state));
             }
             Ok(None) => return Ok(None),
-            Err(e) if e.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE) => continue,
+            Err(e) if e.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE) => {}
             Err(e) => return Err(e.into()),
         }
     }
@@ -337,7 +382,11 @@ pub async fn resolve_identity_from_head(
 // Member lives in the PostgresEra head, not `dispatch::read`'s journal
 // `instances` — reading `instances` for an already-linked member misses
 // it entirely, so this queries the head view directly instead.
-async fn member_row_by_email(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> anyhow::Result<Option<Value>> {
+async fn member_row_by_email(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    email: &str,
+) -> anyhow::Result<Option<Value>> {
     let (_, storage_name) = membership_aggregate(domain_ir)?;
     // docs/decisions/0059: `head_view` needs the domain name too, the
     // same one `ir.rs`/`web.rs` already extract this way.
@@ -346,7 +395,10 @@ async fn member_row_by_email(client: &Mutex<Client>, domain_ir: &Value, email: &
     journal::read_lineage_head_by_id(&*guard, domain, &storage_name, email).await
 }
 
-async fn member_rows(client: &Mutex<Client>, domain_ir: &Value) -> anyhow::Result<Vec<(String, Value)>> {
+async fn member_rows(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+) -> anyhow::Result<Vec<(String, Value)>> {
     let (_, storage_name) = membership_aggregate(domain_ir)?;
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
     let guard = client.lock().await;
@@ -366,7 +418,11 @@ fn membership_aggregate(domain_ir: &Value) -> anyhow::Result<(String, String)> {
 }
 
 fn membership_names(aggregate: &str) -> (String, String) {
-    let bare = aggregate.rsplit("::").next().unwrap_or(aggregate).to_string();
+    let bare = aggregate
+        .rsplit("::")
+        .next()
+        .unwrap_or(aggregate)
+        .to_string();
     let storage_name = crate::journal::snake(&bare);
     (bare, storage_name)
 }
@@ -374,7 +430,13 @@ fn membership_names(aggregate: &str) -> (String, String) {
 // Ported from `Adapters::PostgresEra#append` -- the same journal-insert
 // + snapshot-upsert transaction every Member write uses. The advisory
 // lock guards a concurrent domain rename, not ordinal uniqueness.
-async fn append_member_state(client: &Mutex<Client>, config: &LineageConfig, domain_ir: &Value, id: &str, state: &Value) -> anyhow::Result<()> {
+async fn append_member_state(
+    client: &Mutex<Client>,
+    config: &LineageConfig,
+    domain_ir: &Value,
+    id: &str,
+    state: &Value,
+) -> anyhow::Result<()> {
     let (aggregate_name, _) = membership_aggregate(domain_ir)?;
     let mut guard = client.lock().await;
     let txn = guard.transaction().await?;
@@ -388,7 +450,12 @@ async fn append_member_state(client: &Mutex<Client>, config: &LineageConfig, dom
     journal::append_lineage_mutation(
         &txn,
         config,
-        &journal::Mutation { aggregate: &aggregate_name, id, operation: "save", state },
+        &journal::Mutation {
+            aggregate: &aggregate_name,
+            id,
+            operation: "save",
+            state,
+        },
     )
     .await?;
 
@@ -396,7 +463,11 @@ async fn append_member_state(client: &Mutex<Client>, config: &LineageConfig, dom
     Ok(())
 }
 
-pub async fn session_for_member_by_identity(client: &Mutex<Client>, domain_ir: &Value, identity_id: &str) -> anyhow::Result<Option<Session>> {
+pub async fn session_for_member_by_identity(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    identity_id: &str,
+) -> anyhow::Result<Option<Session>> {
     let (_, storage_name) = membership_aggregate(domain_ir)?;
     // docs/decisions/0059 — same domain-qualification as above.
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
@@ -420,7 +491,11 @@ pub async fn session_for_member_by_identity(client: &Mutex<Client>, domain_ir: &
             identity_id: identity_id.to_string(),
             email: state.get("email")?.get("value")?.as_str()?.to_string(),
             name: state.get("name")?.get("value")?.as_str()?.to_string(),
-            role: state.get("role").and_then(|v| v.get("value")).and_then(|v| v.as_str()).map(|s| s.to_string()),
+            role: state
+                .get("role")
+                .and_then(|v| v.get("value"))
+                .and_then(|v| v.as_str())
+                .map(std::string::ToString::to_string),
         })
     }))
 }
@@ -438,15 +513,20 @@ pub async fn provision(
     subject: &str,
     invoker: &dyn LambdaInvoker,
 ) -> anyhow::Result<Option<Session>> {
-    let member = match member_row_by_email(client, domain_ir, email).await? {
-        Some(m) => m,
-        None => return Ok(None),
+    let Some(member) = member_row_by_email(client, domain_ir, email).await? else {
+        return Ok(None);
     };
     if is_disabled(&member) {
         return Ok(None);
     }
-    let role = member.get("role").and_then(|v| v.get("value")).and_then(|v| v.as_str());
-    let already_linked = member.get("identity_id").and_then(|v| v.get("value")).is_some();
+    let role = member
+        .get("role")
+        .and_then(|v| v.get("value"))
+        .and_then(|v| v.as_str());
+    let already_linked = member
+        .get("identity_id")
+        .and_then(|v| v.get("value"))
+        .is_some();
     let (Some(role), false) = (role, already_linked) else {
         return Ok(None);
     };
@@ -470,49 +550,55 @@ pub async fn provision(
     // already_linked guard above never recognized as unlinked. Resolving
     // first makes a retry converge onto the earlier attempt's identity
     // instead of accumulating another orphan.
-    let identity_id = match resolve_identity_from_head(client, domain_ir, issuer, subject).await? {
-        Some(existing) => existing,
-        None => {
-            let identity_id = uuid::Uuid::new_v4().to_string();
-
-            // `None` on every dispatch below: this is system-initiated
-            // provisioning, not a caller-submitted command, so there is no
-            // caller role to assert.
-            let register = dispatch::handle(
-                client, wasm_path, &identity.register,
-                json!({"identity_id": {"value": identity_id}}), None, config, invoker,
-            ).await?;
-            if !register.accepted {
-                anyhow::bail!("{} refused: {}", identity.register, register.result);
-            }
-
-            let link_external = dispatch::handle(
-                client, wasm_path, &identity.link,
-                json!({
-                    "identity": identity_id, "key": {"value": format!("{issuer}:{subject}")},
-                    "issuer": {"value": issuer}, "subject": {"value": subject},
-                }), None, config, invoker,
-            ).await?;
-            if !link_external.accepted {
-                anyhow::bail!("{} refused: {}", identity.link, link_external.result);
-            }
+    let identity_id = if let Some(existing) =
+        resolve_identity_from_head(client, domain_ir, issuer, subject).await?
+    {
+        existing
+    } else {
+        let identity_id = uuid::Uuid::new_v4().to_string();
+
+        // `None` on every dispatch below: this is system-initiated
+        // provisioning, not a caller-submitted command, so there is no
+        // caller role to assert.
+        let register = dispatch::handle(
+            Host::new(client, wasm_path, config, invoker),
+            &identity.register,
+            json!({"identity_id": {"value": identity_id}}),
+            None,
+        )
+        .await?;
+        if !register.accepted {
+            anyhow::bail!("{} refused: {}", identity.register, register.result);
+        }
 
-            identity_id
+        let link_external = dispatch::handle(
+            Host::new(client, wasm_path, config, invoker),
+            &identity.link,
+            json!({
+                "identity": identity_id, "key": {"value": format!("{issuer}:{subject}")},
+                "issuer": {"value": issuer}, "subject": {"value": subject},
+            }),
+            None,
+        )
+        .await?;
+        if !link_external.accepted {
+            anyhow::bail!("{} refused: {}", identity.link, link_external.result);
         }
+
+        identity_id
     };
 
     // The grant verb this domain's declared authorization provider names
     // (`ir::authorization_provider`), never a hard-coded chapter.
     let Some(provider) = crate::ir::authorization_provider(domain_ir) else {
-        anyhow::bail!("this domain attaches no chapter that provides \"authorization\" — cannot grant a role");
+        anyhow::bail!(
+            "this domain attaches no chapter that provides \"authorization\" — cannot grant a role"
+        );
     };
-    let assign_role = dispatch::handle(
-        client, wasm_path, &provider.grant,
-        json!({
+    let assign_role = dispatch::handle(Host::new(client, wasm_path, config, invoker), &provider.grant, json!({
             "actor_id": {"value": identity_id}, "role_name": {"value": role}, "scope": {"value": config.domain.clone()},
             "starts_at": {"value": httpdate_now()},
-        }), None, config, invoker,
-    ).await?;
+        }), None).await?;
     if !assign_role.accepted {
         anyhow::bail!("{} refused: {}", provider.grant, assign_role.result);
     }
@@ -524,8 +610,18 @@ pub async fn provision(
     new_state["identity_id"] = json!({"value": identity_id});
     append_member_state(client, config, domain_ir, email, &new_state).await?;
 
-    let name = member.get("name").and_then(|v| v.get("value")).and_then(|v| v.as_str()).unwrap_or_default().to_string();
-    Ok(Some(Session { identity_id, email: email.to_string(), name, role: Some(role.to_string()) }))
+    let name = member
+        .get("name")
+        .and_then(|v| v.get("value"))
+        .and_then(|v| v.as_str())
+        .unwrap_or_default()
+        .to_string();
+    Ok(Some(Session {
+        identity_id,
+        email: email.to_string(),
+        name,
+        role: Some(role.to_string()),
+    }))
 }
 
 pub async fn grant_access(
@@ -559,7 +655,10 @@ pub async fn admit_person(
     name: &str,
 ) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
-    let exists = member_rows(client, domain_ir).await?.into_iter().any(|(id, _)| id.to_lowercase() == email);
+    let exists = member_rows(client, domain_ir)
+        .await?
+        .into_iter()
+        .any(|(id, _)| id.to_lowercase() == email);
     if exists {
         return Ok(false);
     }
@@ -571,7 +670,10 @@ pub async fn admit_person(
 // The disabled flag sits beside the role rather than replacing it, so
 // enabling a person again restores exactly the role they held.
 fn is_disabled(state: &Value) -> bool {
-    state.get("disabled").and_then(|v| v.as_bool()).unwrap_or(false)
+    state
+        .get("disabled")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false)
 }
 
 // A deleted person's row is never erased (this is an append-only journal,
@@ -579,12 +681,18 @@ fn is_disabled(state: &Value) -> bool {
 // stops listing it. There is deliberately no undelete route: re-admitting
 // the same email starts a fresh row rather than reviving this one.
 fn is_deleted(state: &Value) -> bool {
-    state.get("deleted").and_then(|v| v.as_bool()).unwrap_or(false)
+    state
+        .get("deleted")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false)
 }
 
 // The role name a membership row holds, if any.
 fn role_of(state: &Value) -> Option<&str> {
-    state.get("role").and_then(|v| v.get("value")).and_then(|v| v.as_str())
+    state
+        .get("role")
+        .and_then(|v| v.get("value"))
+        .and_then(|v| v.as_str())
 }
 
 /// The roles that pass the admin gate. "Owner" is a superset of "Admin" —
@@ -612,24 +720,41 @@ fn is_last_active_admin(rows: &[(String, Value)], state: &Value) -> bool {
 
 /// Whether the person with `email` (compared case-insensitively) is an
 /// active admin: granted the "Admin" or "Owner" role and not disabled.
-pub async fn caller_is_admin(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> anyhow::Result<bool> {
+pub async fn caller_is_admin(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    email: &str,
+) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
-    Ok(member_rows(client, domain_ir).await?.iter().any(|(id, state)| id.to_lowercase() == email && is_active_admin(state)))
+    Ok(member_rows(client, domain_ir)
+        .await?
+        .iter()
+        .any(|(id, state)| id.to_lowercase() == email && is_active_admin(state)))
 }
 
 /// Whether `email` may hold a session right now: admitted, granted a role,
 /// and not disabled — a signature alone can't tell, since a cookie outlives a later disable.
-pub async fn has_access(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> anyhow::Result<bool> {
+pub async fn has_access(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    email: &str,
+) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
     Ok(member_rows(client, domain_ir)
         .await?
         .iter()
-        .any(|(id, state)| id.to_lowercase() == email && role_of(state).is_some() && !is_disabled(state)))
+        .any(|(id, state)| {
+            id.to_lowercase() == email && role_of(state).is_some() && !is_disabled(state)
+        }))
 }
 
 /// The role `email` holds right now, or `None` if unknown, roleless, or
 /// disabled — reads the live membership head, never the session cookie.
-pub async fn active_role(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> anyhow::Result<Option<String>> {
+pub async fn active_role(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    email: &str,
+) -> anyhow::Result<Option<String>> {
     let email = email.to_lowercase();
     Ok(member_rows(client, domain_ir)
         .await?
@@ -640,7 +765,11 @@ pub async fn active_role(client: &Mutex<Client>, domain_ir: &Value, email: &str)
 
 /// The Governance identity id linked to the member with `email`, read from
 /// the live membership head. `None` when the member has not signed in yet.
-pub async fn member_identity_id(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> anyhow::Result<Option<String>> {
+pub async fn member_identity_id(
+    client: &Mutex<Client>,
+    domain_ir: &Value,
+    email: &str,
+) -> anyhow::Result<Option<String>> {
     let email = email.to_lowercase();
     Ok(member_rows(client, domain_ir)
         .await?
@@ -651,7 +780,11 @@ pub async fn member_identity_id(client: &Mutex<Client>, domain_ir: &Value, email
 
 // The id the sign-in flow wrote onto a Member row, or `None` before then.
 fn linked_identity_id(state: &Value) -> Option<String> {
-    state.get("identity_id").and_then(|v| v.get("value")).and_then(|v| v.as_str()).map(str::to_string)
+    state
+        .get("identity_id")
+        .and_then(|v| v.get("value"))
+        .and_then(|v| v.as_str())
+        .map(str::to_string)
 }
 
 /// Every admitted person as a JSON row: name, email, role, `linked`
@@ -664,7 +797,10 @@ pub async fn all_people(client: &Mutex<Client>, domain_ir: &Value) -> anyhow::Re
         .filter(|(_, state)| !is_deleted(state))
         .map(|(_, state)| {
             let role = role_of(&state);
-            let linked = state.get("identity_id").and_then(|v| v.get("value")).is_some();
+            let linked = state
+                .get("identity_id")
+                .and_then(|v| v.get("value"))
+                .is_some();
             let disabled = is_disabled(&state);
             json!({
                 "name": state.get("name").and_then(|v| v.get("value")),
@@ -710,10 +846,17 @@ pub async fn set_person_disabled(
 
     let mut guard = client.lock().await;
     let txn = guard.transaction().await?;
-    txn.execute("SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))", &[&config.domain]).await?;
+    txn.execute(
+        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
+        &[&config.domain],
+    )
+    .await?;
     let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
 
-    if !rows.iter().any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state)) {
+    if !rows
+        .iter()
+        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+    {
         return Ok(DisableOutcome::CallerNotAdmin);
     }
     if disable && caller == target {
@@ -738,7 +881,12 @@ pub async fn set_person_disabled(
     journal::append_lineage_mutation(
         &txn,
         config,
-        &journal::Mutation { aggregate: &aggregate_name, id, operation: "save", state: &new_state },
+        &journal::Mutation {
+            aggregate: &aggregate_name,
+            id,
+            operation: "save",
+            state: &new_state,
+        },
     )
     .await?;
     txn.commit().await?;
@@ -775,10 +923,17 @@ pub async fn set_person_deleted(
 
     let mut guard = client.lock().await;
     let txn = guard.transaction().await?;
-    txn.execute("SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))", &[&config.domain]).await?;
+    txn.execute(
+        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
+        &[&config.domain],
+    )
+    .await?;
     let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
 
-    if !rows.iter().any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state)) {
+    if !rows
+        .iter()
+        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+    {
         return Ok(DeleteOutcome::CallerNotAdmin);
     }
     let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
@@ -796,7 +951,12 @@ pub async fn set_person_deleted(
     journal::append_lineage_mutation(
         &txn,
         config,
-        &journal::Mutation { aggregate: &aggregate_name, id, operation: "save", state: &new_state },
+        &journal::Mutation {
+            aggregate: &aggregate_name,
+            id,
+            operation: "save",
+            state: &new_state,
+        },
     )
     .await?;
     txn.commit().await?;
@@ -832,10 +992,17 @@ pub async fn set_person_role(
 
     let mut guard = client.lock().await;
     let txn = guard.transaction().await?;
-    txn.execute("SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))", &[&config.domain]).await?;
+    txn.execute(
+        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
+        &[&config.domain],
+    )
+    .await?;
     let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
 
-    if !rows.iter().any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state)) {
+    if !rows
+        .iter()
+        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+    {
         return Ok(RoleOutcome::CallerNotAdmin);
     }
     let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
@@ -853,7 +1020,12 @@ pub async fn set_person_role(
     journal::append_lineage_mutation(
         &txn,
         config,
-        &journal::Mutation { aggregate: &aggregate_name, id, operation: "save", state: &new_state },
+        &journal::Mutation {
+            aggregate: &aggregate_name,
+            id,
+            operation: "save",
+            state: &new_state,
+        },
     )
     .await?;
     txn.commit().await?;
@@ -862,21 +1034,38 @@ pub async fn set_person_role(
 
 /// Whether `identity_id` holds a live Admin/Owner assignment in this
 /// domain's authorization provider; `None` provider means never admin.
-pub fn holds_admin(instances: &Value, identity_id: &str, provider: Option<&crate::ir::AuthorizationProvider>) -> bool {
-    let Some(provider) = provider else { return false };
+pub fn holds_admin(
+    instances: &Value,
+    identity_id: &str,
+    provider: Option<&crate::ir::AuthorizationProvider>,
+) -> bool {
+    let Some(provider) = provider else {
+        return false;
+    };
     let prefix = format!("{}#", provider.assignment_aggregate);
     instances.as_object().is_some_and(|obj| {
         obj.iter().any(|(key, state)| {
             key.starts_with(&prefix)
-                && state.get("actor_id").and_then(|v| v.get("value")).and_then(|v| v.as_str()) == Some(identity_id)
-                && state.get("role_name").and_then(|v| v.get("value")).and_then(|v| v.as_str()).is_some_and(is_admin_role)
-                && state.get("ends_at").map(|v| v.is_null()).unwrap_or(true)
+                && state
+                    .get("actor_id")
+                    .and_then(|v| v.get("value"))
+                    .and_then(|v| v.as_str())
+                    == Some(identity_id)
+                && state
+                    .get("role_name")
+                    .and_then(|v| v.get("value"))
+                    .and_then(|v| v.as_str())
+                    .is_some_and(is_admin_role)
+                && state.get("ends_at").is_none_or(serde_json::Value::is_null)
         })
     })
 }
 
 fn now_secs() -> u64 {
-    SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().as_secs()
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
 }
 
 // `dispatch.rs`'s `occurred_at` stamping reuses this exact rendering
@@ -896,11 +1085,11 @@ pub(crate) fn httpdate_now() -> String {
 
 // Howard Hinnant's days-from-civil algorithm, inverted -- avoids
 // pulling in a full date/time crate for one timestamp format.
-fn civil_from_days(z: i64) -> (i64, u32, u32) {
+const fn civil_from_days(z: i64) -> (i64, u32, u32) {
     let z = z + 719_468;
     let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
     let doe = (z - era * 146_097) as u64;
-    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146_096) / 365;
     let y = yoe as i64 + era * 400;
     let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
     let mp = (5 * doy + 2) / 153;
@@ -909,10 +1098,12 @@ fn civil_from_days(z: i64) -> (i64, u32, u32) {
     (if m <= 2 { y + 1 } else { y }, m, d)
 }
 
+#[allow(clippy::expect_used)] // reason: HMAC accepts a key of any length, so construction cannot fail
 fn sign(secret: &str, payload: &str) -> String {
     use hmac::{Hmac, Mac};
     use sha2::Sha256;
-    let mut mac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).expect("HMAC accepts any key length");
+    let mut mac =
+        Hmac::<Sha256>::new_from_slice(secret.as_bytes()).expect("HMAC accepts any key length");
     mac.update(payload.as_bytes());
     hex_encode(&mac.finalize().into_bytes())
 }
@@ -926,64 +1117,17 @@ fn verify_sig(secret: &str, token: &str) -> Option<String> {
     }
 }
 
-/// Compares two signatures without stopping at the first differing byte, so how long a forged
-/// cookie takes to refuse does not tell the caller how many leading characters were right.
-fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
-    a.len() == b.len() && a.iter().zip(b).fold(0u8, |diff, (x, y)| diff | (x ^ y)) == 0
-}
-
-fn hex_encode(bytes: &[u8]) -> String {
-    bytes.iter().map(|b| format!("{b:02x}")).collect()
-}
-
-const B64: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-
-fn base64_encode(input: &[u8]) -> String {
-    let mut out = String::new();
-    for chunk in input.chunks(3) {
-        let b = [chunk[0], *chunk.get(1).unwrap_or(&0), *chunk.get(2).unwrap_or(&0)];
-        let n = ((b[0] as u32) << 16) | ((b[1] as u32) << 8) | b[2] as u32;
-        out.push(B64[(n >> 18) as usize & 0x3f] as char);
-        out.push(B64[(n >> 12) as usize & 0x3f] as char);
-        if chunk.len() > 1 {
-            out.push(B64[(n >> 6) as usize & 0x3f] as char);
-        }
-        if chunk.len() > 2 {
-            out.push(B64[n as usize & 0x3f] as char);
-        }
-    }
-    out
-}
-
-fn base64_decode(input: &str) -> Vec<u8> {
-    let mut table = [255u8; 256];
-    for (i, &c) in B64.iter().enumerate() {
-        table[c as usize] = i as u8;
-    }
-    let mut out = Vec::new();
-    let mut buf = 0u32;
-    let mut bits = 0u32;
-    for c in input.bytes() {
-        let v = table[c as usize];
-        if v == 255 {
-            continue;
-        }
-        buf = (buf << 6) | v as u32;
-        bits += 6;
-        if bits >= 8 {
-            bits -= 8;
-            out.push((buf >> bits) as u8);
-        }
-    }
-    out
-}
-
 pub(crate) fn urlencode(s: &str) -> String {
+    use std::fmt::Write;
     let mut out = String::new();
     for b in s.bytes() {
         match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => out.push(b as char),
-            _ => out.push_str(&format!("%{b:02X}")),
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}"); // writing to a String cannot fail
+            }
         }
     }
     out
@@ -993,15 +1137,6 @@ pub(crate) fn urlencode(s: &str) -> String {
 mod tests {
     use super::*;
 
-    #[test]
-    fn base64_round_trips_arbitrary_bytes() {
-        for input in [b"".as_slice(), b"a", b"ab", b"abc", b"abcd", b"\x00\xff\x10hello world!"] {
-            let encoded = base64_encode(input);
-            assert!(!encoded.contains('+') && !encoded.contains('/'), "must be URL-safe: {encoded}");
-            assert_eq!(base64_decode(&encoded), input, "round trip failed for {input:?}");
-        }
-    }
-
     #[test]
     fn signed_token_verifies_with_the_right_secret_and_rejects_tampering() {
         let token = sign_test_token("s3cret", "hello");
@@ -1019,9 +1154,15 @@ mod tests {
     #[test]
     fn account_token_round_trips_and_rejects_tampering_or_the_wrong_secret() {
         let token = account_token("s3cret", "chris@example.com", 60);
-        assert_eq!(verify_account_token("s3cret", &token).as_deref(), Some("chris@example.com"));
+        assert_eq!(
+            verify_account_token("s3cret", &token).as_deref(),
+            Some("chris@example.com")
+        );
         assert_eq!(verify_account_token("wrong-secret", &token), None);
-        assert_eq!(verify_account_token("s3cret", "garbage.notasignature"), None);
+        assert_eq!(
+            verify_account_token("s3cret", "garbage.notasignature"),
+            None
+        );
     }
 
     #[test]
@@ -1039,22 +1180,41 @@ mod tests {
     #[test]
     fn account_token_matches_the_known_answer_vector() {
         let payload = r#"{"email":"chris@example.com","exp":4102444800}"#;
-        let encoded = base64_encode(payload.as_bytes());
-        assert_eq!(encoded, "eyJlbWFpbCI6ImNocmlzQGV4YW1wbGUuY29tIiwiZXhwIjo0MTAyNDQ0ODAwfQ");
-        assert_eq!(sign("s3cret", &encoded), "143ebe224b067f9744b509937358bb39a87ed30df06aaec594934b85a288cade");
+        let encoded = b64::url_encode(payload.as_bytes());
+        assert_eq!(
+            encoded,
+            "eyJlbWFpbCI6ImNocmlzQGV4YW1wbGUuY29tIiwiZXhwIjo0MTAyNDQ0ODAwfQ"
+        );
+        assert_eq!(
+            sign("s3cret", &encoded),
+            "143ebe224b067f9744b509937358bb39a87ed30df06aaec594934b85a288cade"
+        );
         let token = sign_test_token("s3cret", &encoded);
-        assert_eq!(verify_account_token("s3cret", &token).as_deref(), Some("chris@example.com"));
+        assert_eq!(
+            verify_account_token("s3cret", &token).as_deref(),
+            Some("chris@example.com")
+        );
         // account_token writes the same payload shape: keys in sorted order, no spaces.
         let minted = account_token("s3cret", "chris@example.com", 60);
         let (minted_payload, _) = minted.rsplit_once('.').unwrap();
-        let claims: Value = serde_json::from_slice(&base64_decode(minted_payload)).unwrap();
-        assert_eq!(String::from_utf8(base64_decode(minted_payload)).unwrap(), format!(r#"{{"email":"chris@example.com","exp":{}}}"#, claims["exp"]));
+        let claims: Value =
+            serde_json::from_slice(&b64::url_decode(minted_payload).unwrap()).unwrap();
+        assert_eq!(
+            String::from_utf8(b64::url_decode(minted_payload).unwrap()).unwrap(),
+            format!(r#"{{"email":"chris@example.com","exp":{}}}"#, claims["exp"])
+        );
     }
 
     #[test]
     fn the_account_cookie_defaults_when_unset_or_empty() {
-        assert_eq!(resolve_account_cookie(None).unwrap(), DEFAULT_ACCOUNT_COOKIE);
-        assert_eq!(resolve_account_cookie(Some("")).unwrap(), DEFAULT_ACCOUNT_COOKIE);
+        assert_eq!(
+            resolve_account_cookie(None).unwrap(),
+            DEFAULT_ACCOUNT_COOKIE
+        );
+        assert_eq!(
+            resolve_account_cookie(Some("")).unwrap(),
+            DEFAULT_ACCOUNT_COOKIE
+        );
     }
 
     #[test]
@@ -1064,14 +1224,23 @@ mod tests {
 
     #[test]
     fn the_account_cookie_takes_a_configured_valid_name() {
-        assert_eq!(resolve_account_cookie(Some("hecks_session")).unwrap(), "hecks_session");
-        assert_eq!(resolve_account_cookie(Some("app-session.v2")).unwrap(), "app-session.v2");
+        assert_eq!(
+            resolve_account_cookie(Some("hecks_session")).unwrap(),
+            "hecks_session"
+        );
+        assert_eq!(
+            resolve_account_cookie(Some("app-session.v2")).unwrap(),
+            "app-session.v2"
+        );
     }
 
     #[test]
     fn the_account_cookie_refuses_a_name_that_could_break_the_set_cookie_header() {
         for bad in ["a;b", "a=b", "a b", "a\r\nSet-Cookie: x", "sessão"] {
-            assert!(resolve_account_cookie(Some(bad)).is_err(), "{bad:?} should be refused");
+            assert!(
+                resolve_account_cookie(Some(bad)).is_err(),
+                "{bad:?} should be refused"
+            );
         }
     }
 
@@ -1084,7 +1253,8 @@ mod tests {
             role: Some("Admin".to_string()),
         };
         let cookie = session_cookie("s3cret", &session);
-        let parsed = parse_session_cookie("s3cret", &cookie).expect("should parse with the right secret");
+        let parsed =
+            parse_session_cookie("s3cret", &cookie).expect("should parse with the right secret");
         assert_eq!(parsed.identity_id, "id-1");
         assert_eq!(parsed.email, "chris@example.com");
         assert_eq!(parsed.role.as_deref(), Some("Admin"));
@@ -1098,7 +1268,7 @@ mod tests {
         if let Some(exp) = exp {
             payload["exp"] = json!(exp);
         }
-        let encoded = base64_encode(payload.to_string().as_bytes());
+        let encoded = b64::url_encode(payload.to_string().as_bytes());
         format!("{encoded}.{}", sign(secret, &encoded))
     }
 
@@ -1153,10 +1323,20 @@ mod tests {
         });
         let read = json!({ "instances": instances });
         assert_eq!(
-            resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "111").as_deref(),
+            resolve_identity(
+                read.get("instances").unwrap_or(&Value::Null),
+                "https://accounts.google.com",
+                "111"
+            )
+            .as_deref(),
             Some("471ef402-8609-4fa4-9288-6372fc74650d")
         );
-        assert!(resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "112").is_none());
+        assert!(resolve_identity(
+            read.get("instances").unwrap_or(&Value::Null),
+            "https://accounts.google.com",
+            "112"
+        )
+        .is_none());
         assert!(resolve_identity(&Value::Null, "https://accounts.google.com", "111").is_none());
     }
 
@@ -1198,22 +1378,49 @@ mod tests {
         let admin = json!({"role": {"value": "Admin"}});
         let disabled_admin = json!({"role": {"value": "Admin"}, "disabled": true});
         let member = json!({"role": {"value": "Member"}});
-        let rows = |states: &[&Value]| -> Vec<(String, Value)> { states.iter().enumerate().map(|(i, s)| (i.to_string(), (*s).clone())).collect() };
+        let rows = |states: &[&Value]| -> Vec<(String, Value)> {
+            states
+                .iter()
+                .enumerate()
+                .map(|(i, s)| (i.to_string(), (*s).clone()))
+                .collect()
+        };
 
-        assert!(is_last_active_admin(&rows(&[&admin, &member, &disabled_admin]), &admin), "the only active admin");
-        assert!(!is_last_active_admin(&rows(&[&admin, &admin]), &admin), "another active admin remains");
-        assert!(!is_last_active_admin(&rows(&[&admin, &disabled_admin]), &disabled_admin), "a disabled admin is not an active one");
-        assert!(!is_last_active_admin(&rows(&[&admin, &member]), &member), "a non-admin never counts");
+        assert!(
+            is_last_active_admin(&rows(&[&admin, &member, &disabled_admin]), &admin),
+            "the only active admin"
+        );
+        assert!(
+            !is_last_active_admin(&rows(&[&admin, &admin]), &admin),
+            "another active admin remains"
+        );
+        assert!(
+            !is_last_active_admin(&rows(&[&admin, &disabled_admin]), &disabled_admin),
+            "a disabled admin is not an active one"
+        );
+        assert!(
+            !is_last_active_admin(&rows(&[&admin, &member]), &member),
+            "a non-admin never counts"
+        );
 
         // An Owner is an admin too: it counts toward, and is protected by, the guard.
         let owner = json!({"role": {"value": "Owner"}});
-        assert!(is_last_active_admin(&rows(&[&owner, &member]), &owner), "the only active admin may be an Owner");
-        assert!(!is_last_active_admin(&rows(&[&owner, &admin]), &admin), "an Owner keeps another admin from being the last");
+        assert!(
+            is_last_active_admin(&rows(&[&owner, &member]), &owner),
+            "the only active admin may be an Owner"
+        );
+        assert!(
+            !is_last_active_admin(&rows(&[&owner, &admin]), &admin),
+            "an Owner keeps another admin from being the last"
+        );
     }
 
     #[test]
     fn holds_admin_accepts_an_owner_assignment_and_refuses_other_roles() {
-        let provider = crate::ir::AuthorizationProvider { grant: "G".to_string(), assignment_aggregate: "Governance::RoleAssignment".to_string() };
+        let provider = crate::ir::AuthorizationProvider {
+            grant: "G".to_string(),
+            assignment_aggregate: "Governance::RoleAssignment".to_string(),
+        };
         let assignment = |role: &str| json!({"Governance::RoleAssignment#a": {"actor_id": {"value": "id-1"}, "role_name": {"value": role}, "ends_at": null}});
         assert!(holds_admin(&assignment("Admin"), "id-1", Some(&provider)));
         assert!(holds_admin(&assignment("Owner"), "id-1", Some(&provider)));
@@ -1223,8 +1430,14 @@ mod tests {
 
     #[test]
     fn membership_names_snakes_the_bare_aggregate() {
-        assert_eq!(membership_names("Member"), ("Member".to_string(), "member".to_string()));
-        assert_eq!(membership_names("Membership::Person"), ("Person".to_string(), "person".to_string()));
+        assert_eq!(
+            membership_names("Member"),
+            ("Member".to_string(), "member".to_string())
+        );
+        assert_eq!(
+            membership_names("Membership::Person"),
+            ("Person".to_string(), "person".to_string())
+        );
     }
 
     #[test]
@@ -1251,10 +1464,16 @@ mod tests {
         tokio::spawn(async move {
             let _ = conn.await;
         });
-        admin.batch_execute(&format!("DROP DATABASE IF EXISTS {name} WITH (FORCE)")).await.unwrap();
-        admin.batch_execute(&format!("CREATE DATABASE {name}")).await.unwrap();
+        admin
+            .batch_execute(&format!("DROP DATABASE IF EXISTS {name} WITH (FORCE)"))
+            .await
+            .unwrap();
+        admin
+            .batch_execute(&format!("CREATE DATABASE {name}"))
+            .await
+            .unwrap();
 
-        let (client, conn) = tokio_postgres::connect(&crate::test_pg::conninfo(&name), NoTls)
+        let (client, conn) = tokio_postgres::connect(&crate::test_pg::conninfo(name), NoTls)
             .await
             .expect("connect to scratch db");
         tokio::spawn(async move {
@@ -1306,36 +1525,74 @@ mod tests {
             ).await.unwrap();
         }
 
-        let chris = member_row_by_email(&db, &domain_ir, "chris@example.com").await.unwrap().expect("should find chris");
+        let chris = member_row_by_email(&db, &domain_ir, "chris@example.com")
+            .await
+            .unwrap()
+            .expect("should find chris");
         assert_eq!(chris["email"]["value"], "chris@example.com");
-        assert!(member_row_by_email(&db, &domain_ir, "nobody@example.com").await.unwrap().is_none());
+        assert!(member_row_by_email(&db, &domain_ir, "nobody@example.com")
+            .await
+            .unwrap()
+            .is_none());
 
-        let session = session_for_member_by_identity(&db, &domain_ir, "id-1").await.unwrap().expect("should find the linked member");
+        let session = session_for_member_by_identity(&db, &domain_ir, "id-1")
+            .await
+            .unwrap()
+            .expect("should find the linked member");
         assert_eq!(session.email, "chris@example.com");
         assert_eq!(session.role.as_deref(), Some("Admin"));
-        assert!(session_for_member_by_identity(&db, &domain_ir, "id-nope").await.unwrap().is_none());
+        assert!(session_for_member_by_identity(&db, &domain_ir, "id-nope")
+            .await
+            .unwrap()
+            .is_none());
 
         let people = all_people(&db, &domain_ir).await.unwrap();
         assert_eq!(people.len(), 2);
-        let chris = people.iter().find(|p| p["email"] == "chris@example.com").unwrap();
+        let chris = people
+            .iter()
+            .find(|p| p["email"] == "chris@example.com")
+            .unwrap();
         assert_eq!(chris["linked"], true);
         assert_eq!(chris["granted"], true);
         assert_eq!(chris["identity_id"], "id-1");
-        let angie = people.iter().find(|p| p["email"] == "angie@example.com").unwrap();
+        let angie = people
+            .iter()
+            .find(|p| p["email"] == "angie@example.com")
+            .unwrap();
         assert_eq!(angie["linked"], false);
         assert_eq!(angie["granted"], false);
         assert!(angie["identity_id"].is_null());
 
-        assert_eq!(member_identity_id(&db, &domain_ir, "Chris@Example.com").await.unwrap().as_deref(), Some("id-1"));
-        assert_eq!(member_identity_id(&db, &domain_ir, "angie@example.com").await.unwrap(), None);
-        assert_eq!(member_identity_id(&db, &domain_ir, "nobody@example.com").await.unwrap(), None);
+        assert_eq!(
+            member_identity_id(&db, &domain_ir, "Chris@Example.com")
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("id-1")
+        );
+        assert_eq!(
+            member_identity_id(&db, &domain_ir, "angie@example.com")
+                .await
+                .unwrap(),
+            None
+        );
+        assert_eq!(
+            member_identity_id(&db, &domain_ir, "nobody@example.com")
+                .await
+                .unwrap(),
+            None
+        );
     }
 
     #[tokio::test]
     async fn append_member_state_writes_the_journal_and_advances_the_head_snapshot() {
         let domain_ir = member_domain_ir();
         let db = scratch_member_db("hecks_host_auth_test_append_member").await;
-        let config = LineageConfig { domain: "Acme".to_string(), era: Some(1), mirrored: None };
+        let config = LineageConfig {
+            domain: "Acme".to_string(),
+            era: Some(1),
+            mirrored: None,
+        };
         {
             let guard = db.lock().await;
             // ordinal 0 -- below the journal's bigserial sequence (starts
@@ -1353,16 +1610,24 @@ mod tests {
 
         let granted = json!({"name": {"value": "Angie Chen"}, "email": {"value": "angie@example.com"},
                               "role": {"value": "Admin"}, "identity_id": null});
-        append_member_state(&db, &config, &domain_ir, "angie@example.com", &granted).await.unwrap();
+        append_member_state(&db, &config, &domain_ir, "angie@example.com", &granted)
+            .await
+            .unwrap();
 
         // The head view reflects the new state immediately.
-        let after = member_row_by_email(&db, &domain_ir, "angie@example.com").await.unwrap().expect("still there");
+        let after = member_row_by_email(&db, &domain_ir, "angie@example.com")
+            .await
+            .unwrap()
+            .expect("still there");
         assert_eq!(after["role"]["value"], "Admin");
 
         // A real journal row was appended -- not a raw update bypassing it.
         let guard = db.lock().await;
         let journal_rows = guard
-            .query("SELECT era, aggregate, aggregate_id, operation, state FROM hecks_journal_acme", &[])
+            .query(
+                "SELECT era, aggregate, aggregate_id, operation, state FROM hecks_journal_acme",
+                &[],
+            )
             .await
             .unwrap();
         assert_eq!(journal_rows.len(), 1);
@@ -1380,11 +1645,17 @@ mod tests {
 
         // The snapshot's own ordinal advanced past the seed row's.
         let ordinal: i64 = guard
-            .query_one("SELECT ordinal FROM acme_member_head_snapshot_1 WHERE id = $1", &[&"angie@example.com"])
+            .query_one(
+                "SELECT ordinal FROM acme_member_head_snapshot_1 WHERE id = $1",
+                &[&"angie@example.com"],
+            )
             .await
             .unwrap()
             .get(0);
-        assert!(ordinal > 0, "should have advanced past the seed row's ordinal 0");
+        assert!(
+            ordinal > 0,
+            "should have advanced past the seed row's ordinal 0"
+        );
         drop(guard);
 
         // The ordinal-guarded upsert (`WHERE ordinal < EXCLUDED.ordinal`)
@@ -1398,11 +1669,17 @@ mod tests {
             &[&"angie@example.com", &json!({"role": {"value": "SHOULD_NOT_APPLY"}})],
         ).await.unwrap();
         let state: Value = guard
-            .query_one("SELECT state FROM acme_member_head_snapshot_1 WHERE id = $1", &[&"angie@example.com"])
+            .query_one(
+                "SELECT state FROM acme_member_head_snapshot_1 WHERE id = $1",
+                &[&"angie@example.com"],
+            )
             .await
             .unwrap()
             .get(0);
-        assert_eq!(state["role"]["value"], "Admin", "a lower ordinal must never move the snapshot backward");
+        assert_eq!(
+            state["role"]["value"], "Admin",
+            "a lower ordinal must never move the snapshot backward"
+        );
     }
 }