Security fixes:
- Hash tokens with SHA-256 at construction time so authentication
compares fixed-size 32-byte digests, eliminating length-oracle
timing leaks
- Scope auth SSE broadcasts per-user in chat_auth_token_handler —
AuthRequired/AuthCompleted events were leaking across tenants
- Propagate DB errors in restart handlers instead of silently
swallowing via `if let Ok(Some(...))` pattern
Code quality:
- Log SSE serialization failures instead of silently producing empty
strings via unwrap_or_default()
- Remove dead `pub type AuthState = MultiAuthState` alias
- Replace `.unwrap()` with `Arc::clone(db)` in app.rs multi-tenant
workspace setup (db is guaranteed Some in context, but unwrap
violates project convention)
- Fix telegram setup test to inject UserIdentity into request
extensions (handler now requires AuthenticatedUser)
- Add safety comments on test-only expect/unwrap calls for CI
- Apply cargo fmt to fix pre-existing formatting
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
