Struct ServerState 

pub struct ServerState {
    pub storage: Arc<dyn StorageBackend>,
    pub verifier: Arc<dyn TokenVerifier>,
    pub validator: Arc<dyn Validator>,
    pub path_codec: Arc<dyn PathCodec>,
    pub compression: CompressionFormat,
    pub max_upload_size: u64,
    pub limits: Option<Limits>,
    pub zrip_levels: Option<ZripLevels>,
    pub cleanup_interval: Duration,
    pub session_ttl: Duration,
}

Immutable server configuration shared by all handlers.

Fields

storage: Arc<dyn StorageBackend>

The storage backend serving file content.

verifier: Arc<dyn TokenVerifier>

Turns bearer tokens into claims.

validator: Arc<dyn Validator>

Decides whether claims may access a path.

path_codec: Arc<dyn PathCodec>

Real storage paths ↔ client-visible shadow paths.

Defaults to IdentityPathCodec (no translation).

compression: CompressionFormat

Compression applied to downloads when the client asks for it.

max_upload_size: u64

Upper bound for a single upload body.

limits: Option<Limits>

Advertised tuning-parameter ranges; None exports the libfw built-in defaults (and enforces nothing beyond existing hard caps).

zrip_levels: Option<ZripLevels>

Advertised zrip level range; None ignores the level header, so every zrip download uses ZRIP_DEFAULT_LEVEL.

cleanup_interval: Duration

Sweep period of the stale session-temp cleaner (tus Expiration), see ServerState::spawn_stale_session_cleanup.

Defaults to 1 hour; Duration::ZERO disables the sweeper.

session_ttl: Duration

Max age of an abandoned session upload temp before it is removed.

Defaults to DEFAULT_SESSION_TTL (24 hours).

Implementations

impl ServerState

pub fn builder() -> ServerStateBuilder

Start building a server state.

pub fn authorize( &self, claims: &TokenClaims, path: &str, action: Action, ) -> Result<(), AuthError>

Check whether claims may perform action on path.

impl ServerState

pub fn resolve_client_path( &self, claims: &TokenClaims, shadow: &str, action: Action, ) -> Result<String, PathResolveError>

Resolve a client-supplied (shadow) path to the canonical real path.

Pipeline: shape-validate the shadow → PathCodec::decode → shape-validate the decoded real path (defense in depth) → authorize action against the real path, so allowed_paths keeps its exact pre-translation semantics.

Hierarchical composition: when the whole string is not a valid shadow (e.g. a directory shadow with literal child segments appended, {dirShadow}/sub/file.txt), the longest decodable segment prefix is decoded and the remaining segments are appended verbatim to the decoded real path before authorization. A directory shadow therefore covers its whole subtree — uploads into not-yet-listed children, downloads of freshly created files — with no per-path shadow minting. The fallback only ever succeeds on a prefix the codec itself accepts, so tampered or unknown shadows still surface the original codec error (→ 400); authorization still runs on the combined real path, so allowed_paths prefix semantics are unchanged.

The returned real path is safe to hand to the storage backend; it must never be echoed back to the client — responses go through ServerState::expose_path.

pub fn expose_path(&self, real: &str) -> String

Translate a real storage path for client consumption (shadow).

impl ServerState

pub fn capabilities(&self) -> Capabilities

The capability advertisement served at GET /capabilities.

Filters the compression formats by the configured download compression and overlays the optional builder overrides; unset dimensions fall back to the libfw built-in defaults.

pub fn spawn_stale_session_cleanup(self: &Arc<Self>) -> JoinHandle<()>

Spawn the stale session-temp cleaner as a background task.

Every cleanup_interval it sweeps the storage for abandoned session-upload temps and removes the ones whose last write is older than session_ttl (tus Expiration; a client that vanished mid-upload never leaves its .libfw-sess-* temp / .blocks sidecar behind forever).

A zero cleanup_interval disables the sweeper: the returned handle completes immediately. Backends that keep no long-lived session temps (the StorageBackend trait default) simply report 0 removals.