Module library 

Saved notecards and saved renders: scope/destination types, permission helpers, and the orphan-file sweeper.

Every handler that mutates or reads a saved item funnels through one of the assert_can_* helpers here so the permission rules live in exactly one place.

Structs

GlwDataRow

Raw row fields for a saved GLW event as fetched from the DB.

GlwDataView

Public, serializable record of a saved GLW event. Excludes the raw payload_json blob (which is large and only the render worker needs it) so the library list stays small over the wire.

LogoRow

Raw row fields for a saved logo as fetched from the DB.

LogoView

Public, serializable record of a saved logo. Excludes the raw bytes (downloaded separately via GET /api/logos/{id}/image).

NotecardRow

Raw row fields for a saved notecard as fetched from the DB.

NotecardView

Public, serializable record of a saved notecard.

RenderRow

Raw row fields for a saved render as fetched from the DB.

RenderView

Public, serializable record of a saved render.

ThemeRow

Raw row fields for a saved theme as fetched from the DB.

Enums

Destination

Owner scope of a saved notecard or saved render. Exactly one of the two variants is set; the schema CHECK constraint mirrors this at the DB.

GlwDataSourceKind

Where a saved GLW row originally came from. Persisted as the source_kind text column. Surfaced in the library list so the user can tell pasted JSON from a real id/key fetch.

Constants

MAX_DISPLAY_NAME_LEN

Maximum length, in unicode codepoints, of a user-supplied display name. Applies to groups.name and saved_notecards.name.

Functions

assert_can_delete_glw_data

Permission gate for deleting a GLW data row. Personal: must be the owner. Group: must be an owner of the group.

assert_can_delete_logo

Permission gate for deleting a logo. Personal: must be the owner. Group: must be an owner of the group.

assert_can_delete_notecard

Permission gate for deleting a notecard (same rule as renders).

assert_can_delete_render

Permission gate for deleting a render. Personal: must be the owner. Group: must be an owner of the group.

assert_can_modify_theme

Permission gate for modifying (renaming / overwriting / deleting) a theme. Personal: must be the owner. Group: must be an owner of the group. Mirrors assert_can_delete_glw_data.

assert_can_read_glw_data

Permission gate for reading a GLW data row. Personal: must be the owner. Group: must be a member of the owning group.

assert_can_read_logo

Permission gate for reading a logo. Personal: must be the owner. Group: must be a member of the owning group.

assert_can_read_notecard

Permission gate for reading a notecard. Personal: must be the owner. Group: must be a member.

assert_can_read_render

Permission gate for reading a render. Personal: must be the owner. Group: must be a member; members may not see in_progress or failed renders.

assert_can_read_theme

Permission gate for reading a theme. Personal: must be the owner. Group: must be a member of the owning group.

assert_can_view

Resolve a destination to whether the current user can view its contents and (for groups) what role they have. Personal scope means the user is the owner; otherwise Error::Forbidden is returned.

assert_can_write

Verify that the calling user is allowed to write to the given destination. Personal scope is always allowed; group scope requires owner membership.

destination_from_columns

Convert a (owner_user_id, owner_group_id) row pair (exactly one of the two is Some) into a Destination.

is_canonical_hex_color

True if s is canonical #rrggbb — exactly one leading # followed by exactly six ASCII hex digits (case-insensitive). Shared by every endpoint that validates a colour swatch on the way in (the route-colour preference, the saved-colour palette, and saved themes).

recover_orphaned_in_progress

Mark every saved_renders row still in status = 'in_progress' as failed. Run once at server startup, before the HTTP listener accepts connections: anything found in in_progress at that moment is orphaned by definition — the tokio task that could have transitioned it died with the previous process. Without this sweep each abandoned row would permanently count against MAX_CONCURRENT_RENDERS_PER_USER.

run_orphan_sweeper

Run the orphan-file sweeper. Wakes every period seconds; if the dirty flag is unset, the tick is a cheap no-op. When the flag is set the sweeper scans <storage_dir>/renders/ and unlinks any file whose UUID is not present in saved_renders. A scan failure re-raises the flag so the next tick retries.

sanitise_display_name

Trim a user-supplied display name and reject it if it is empty, longer than MAX_DISPLAY_NAME_LEN codepoints, contains any unicode control character (char::is_control — NUL, TAB, LF, CR, the C1 control block, DEL), or contains any unicode Cf Format character (bidi overrides, zero-width joiners, the BOM, language-tag block, etc. — see is_unicode_format). field is interpolated into the error message so the caller does not need to repeat the label.