Fix identity extraction in cedar_guard middleware & correct revoke_bot_token OpenAPI docs (#2028)

* #1999: rebase

Signed-off-by: Hongze Gao <15101764808@163.com>

* - Export bot_token_dto in jupiter model so BotTokenInfo is reachable
- BotsStorage: add get_bot_by_id() for bot existence checks
- BotsStorage: use update_many() in revoke_bot_tokens_by_bot to avoid N+1
- BotsStorage: validate HMAC secret (non-empty, min 32 chars) in load_bot_token_hmac_key
- BotsStorage: use DateTimeWithTimeZone for expiry comparison in find_bot_by_token
- AuditStorage: set created_at with DateTimeWithTimeZone (Utc::now().into())
- bot_router: ensure bot exists before create/list/revoke; return 404 when missing
- bot_router: validate expires_in range (1..=10y) to avoid overflow/panic
- tests: add audit_storage to AppService in test_storage()

Signed-off-by: Hongze Gao <15101764808@163.com>

* #1999: fix identity extraction in cedar_guard middleware and revoke_bot_token 404 OpenAPI docs

- Use req.extract() to resolve LoginUser/BotIdentity instead of direct extensions access
- Fix missing Bot/Human context and incorrect "reader" fallback
- Update 404 description to "Bot not found"
- Align docs with idempotent implementation

Signed-off-by: Hongze Gao <15101764808@163.com>

* #1999: remove duplicate bot token helpers and module export

- remove duplicated  in
- deduplicate bot token HMAC helpers in  to fix E0428
- short-circuit auth extraction in :
  try  first, then  only if needed

Signed-off-by: Hongze Gao <15101764808@163.com>

* #1999: use stateful axum extractors in cedar guard middleware

- replace state-less request extraction in  with
   for both
   and
- fix incorrect import by removing  and
  importing  instead
- keep short-circuit principal resolution: try bot identity first,
  then attempt login user only when bot extraction fails

Signed-off-by: Hongze Gao <15101764808@163.com>

* #1999: use request parts API for stateful identity extraction in cedar_guard

- replace invalid  usage with
  and extract identities from
- run  first,
  then fall back to
- preserve middleware flow by reconstructing the request with
   before calling

Signed-off-by: Hongze Gao <15101764808@163.com>

* #1999: satisfy clippy by matching extractor results directly

- replace  +  with direct
   matching in
- keep principal resolution order unchanged:
   first, then , then  fallback

Signed-off-by: Hongze Gao <15101764808@163.com>

---------

Signed-off-by: Hongze Gao <15101764808@163.com>

Author: WiedersehenM

mono/src/api/guard/cedar_guard.rs

@@ -1,7 +1,7 @@
 use std::{collections::HashMap, path::Path, str::FromStr};
 
 use axum::{
-    extract::{FromRef, Request, State},
+    extract::{FromRef, FromRequestParts, Request, State},
     middleware::Next,
     response::Response,
 };
@@ -138,16 +138,16 @@ pub async fn cedar_guard(
     //     .ok_or_else(|| MegaError::with_message(format!("Change list not found for link: {}", link)))?;
     // let repo_path: PathBuf = cl_model.path.into();
 
-    let login_user = req.extensions().get::<LoginUser>();
-    let bot_identity = req.extensions().get::<BotIdentity>();
+    let (mut parts, body) = req.into_parts();
 
-    let (principal_type, principal_id) = if let Some(bot) = bot_identity {
-        ("Bot".to_string(), bot.bot.id.to_string())
-    } else if let Some(user) = login_user {
-        ("User".to_string(), user.username.clone())
-    } else {
-        ("User".to_string(), "reader".to_string())
-    };
+    let (principal_type, principal_id) =
+        if let Ok(bot) = BotIdentity::from_request_parts(&mut parts, &state).await {
+            ("Bot".to_string(), bot.bot.id.to_string())
+        } else if let Ok(user) = LoginUser::from_request_parts(&mut parts, &state).await {
+            ("User".to_string(), user.username.clone())
+        } else {
+            ("User".to_string(), "reader".to_string())
+        };
 
     // let policy_path = repo_path.join("cedar/policies.cedar");
     // let policy_content = get_blob_string(&state, &policy_path).await?;
@@ -169,6 +169,8 @@ pub async fn cedar_guard(
                 MegaError::Other(format!("Guard Authorization failed: {}", e)),
             )
         })?;
+
+    let req = Request::from_parts(parts, body);
     let response = next.run(req).await;
 
     if response.status().is_client_error() {

mono/src/api/router/bot_router.rs

@@ -314,7 +314,7 @@ async fn list_bot_tokens(
         (status = 200, description = "Token revoked successfully"),
         (status = 401, description = "Unauthorized"),
         (status = 403, description = "Forbidden - admin only"),
-        (status = 404, description = "Bot or token not found"),
+        (status = 404, description = "Bot not found"),
     ),
     tag = BOT_TAG
 )]