Prune commentary and stale Rust port notes

server/src/auth.rs

@@ -1,16 +1,3 @@
-//! Bearer-token auth for the entire HTTP surface.
-//!
-//! This server's API *is* remote code execution, so the token gates every route
-//! with zero unauthenticated endpoints -- the middleware is applied once around
-//! the whole router (including the fallback) in `main.rs`, never per-route, so a
-//! new route can't forget it. See PLAN.md's security section for the threat
-//! model.
-//!
-//! Nothing in this module -- and nothing anywhere else -- may log the
-//! Authorization header or the token; the test below is a tripwire against a
-//! logging change silently starting to. It is one test covering both gating and
-//! logging on purpose -- see the note in it.
-
 use std::net::SocketAddr;
 use std::sync::Arc;
 use std::time::Duration;
@@ -24,9 +11,6 @@ use wg_app_link::enroll::{take_pending, token_hash_hex, token_matches};
 use crate::config::TokenEntry;
 use crate::session::SessionManager;
 
-/// Applied to every rejection. Not against brute force -- infeasible at 256
-/// bits -- but so a scanner probing the port shows up as a slow, loggable
-/// drip rather than a fast one.
 const REJECT_DELAY: Duration = Duration::from_millis(300);
 
 pub async fn require_token(
@@ -48,9 +32,6 @@ pub async fn require_token(
         if token_matches(token, &hashes) {
             return next.run(request).await;
         }
-        // A link minted by `--enroll-link` while this server was running:
-        // the entry moves from the spool into the config here, on first
-        // use, and is an ordinary token from then on.
         match take_pending(&manager.pending_enrollments_dir(), token) {
             Ok(Some(name)) => {
                 let entry = TokenEntry {
@@ -127,12 +108,6 @@ mod tests {
         builder.body(Body::empty()).expect("request")
     }
 
-    /// One test rather than separate gating and logging tests,
-    /// deliberately: tracing caches callsite interest process-wide, so a
-    /// test that hits the rejection path with no subscriber installed can
-    /// poison the interest cache for the one that captures logs. Keeping
-    /// every exercise of the middleware under the capturing subscriber
-    /// makes the log assertions deterministic.
     #[tokio::test]
     async fn gates_every_route_and_never_logs_the_token() {
         #[derive(Clone, Default)]
@@ -164,8 +139,6 @@ mod tests {
         let token = generate_token();
         let router = guarded_router(manager_with_token(dir.path(), &token));
 
-        // No header, wrong token, wrong scheme: 401 everywhere, including
-        // paths that don't exist -- a scanner learns nothing.
         for (path, auth) in [
             ("/probe", None),
             ("/probe", Some("Bearer wrong".to_string())),
@@ -191,29 +164,16 @@ mod tests {
             .expect("response");
         assert_eq!(ok.status(), StatusCode::OK);
 
-        // The tripwire that keeps a future logging change (e.g. logging
-        // request headers) from silently leaking credentials.
         let logged = String::from_utf8_lossy(&capture.0.lock().unwrap()).into_owned();
         assert!(
             !logged.contains(&token),
             "the bearer token leaked into the logs: {logged}"
         );
-        // The rejections themselves do get logged (that's the point).
         assert!(logged.contains("missing or invalid bearer token"));
     }
 
-    /// A token spooled by `--enroll-link` is refused by nothing: the first
-    /// request carrying it is served, and from then on it is in the config
-    /// like any other.
     #[tokio::test]
     async fn a_spooled_enrollment_is_adopted_on_first_use() {
-        // Under a subscriber, like every other exercise of this middleware.
-        // `tracing` caches a callsite's interest process-wide the first time it
-        // is reached, so the refusal at the end of this test -- reached with no
-        // subscriber on this thread -- could cache the rejection warning as
-        // never-enabled and make the tripwire above see an empty log. That
-        // failed about one full-suite run in ten, in the test that exists to
-        // notice a credential leak, which is the worst place for a flake.
         let _guard = tracing::subscriber::set_default(
             tracing_subscriber::fmt()
                 .with_max_level(tracing::Level::TRACE)