Server overhaul: clear clippy::pedantic wins

Taken from a -W clippy::pedantic scan, no allow added: map_or/map_or_else, method references instead of closures,
clone_from, write! instead of push_str(format!), borrowed Option<&str>, push_of without a needless Option, the
envelope's entity moved instead of cloned, the scheduler's plan() no longer a needless async fn (its doc now says
what it does on failure), sort_unstable, digit separators and inline format args in tests. Not taken: missing
# Errors/# Panics docs, must_use, doc backticks, assert!(x.is_empty()) in tests, too_many_lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/landing.rs

@@ -6,6 +6,8 @@
 //! `from` query parameter (the inviting admin's display name, set by E-12's link) is only passed on into the
 //! `kvitt://invite` link, never shown. Any code of 1 to 32 characters gets 200; anything else a 404 page.
 
+use std::fmt::Write as _;
+
 use axum::extract::{Path, RawQuery, State};
 use axum::http::{HeaderMap, HeaderValue, StatusCode, header};
 use axum::response::{IntoResponse, Response};
@@ -153,10 +155,11 @@ pub fn render(
         utf8_percent_encode(&code, NON_ALPHANUMERIC)
     );
     if let Some(name) = from {
-        open_url.push_str(&format!(
+        let _ = write!(
+            open_url,
             "&{FROM_PARAM}={}",
             utf8_percent_encode(name, NON_ALPHANUMERIC)
-        ));
+        );
     }
     let download = download_url
         .map(|url| {

server/crates/kvitt-server/src/api/rows.rs

@@ -22,8 +22,8 @@ pub fn uuid(text: &str) -> Result<Uuid, AppError> {
     Uuid::parse_str(text).map_err(|e| AppError::internal(format!("stored id is not a uuid: {e}")))
 }
 
-fn opt_uuid(text: Option<String>) -> Result<Option<Uuid>, AppError> {
-    text.as_deref().map(uuid).transpose()
+fn opt_uuid(text: Option<&str>) -> Result<Option<Uuid>, AppError> {
+    text.map(uuid).transpose()
 }
 
 /// Parses a stored snake_case enum token through its serde form.
@@ -504,7 +504,7 @@ pub async fn expense(conn: &mut SqliteConnection, id: Uuid) -> Result<Option<Exp
                 })
             })
             .collect::<Result<_, AppError>>()?,
-        recurring_template_id: opt_uuid(row.recurring_template_id)?,
+        recurring_template_id: opt_uuid(row.recurring_template_id.as_deref())?,
         recurring_period: row.recurring_period,
         created_by_user_id: uuid(&row.created_by_user_id)?,
         updated_by_user_id: uuid(&row.updated_by_user_id)?,

server/crates/kvitt-server/src/auth.rs

@@ -46,7 +46,7 @@ const TOUCH_INTERVAL: Duration = Duration::hours(1);
 pub fn sha256_hex(text: &str) -> String {
     let digest = Sha256::digest(text.as_bytes());
     let mut hex = String::with_capacity(64);
-    for byte in digest.iter() {
+    for byte in &digest {
         let _ = write!(hex, "{byte:02x}");
     }
     hex

server/crates/kvitt-server/src/openapi.rs

@@ -331,7 +331,8 @@ impl Modify for CommonRules {
 fn is_unauthenticated(operation: &Operation) -> bool {
     operation.security.as_ref().is_some_and(|requirements| {
         requirements.iter().all(|r| {
-            serde_json::to_value(r).is_ok_and(|v| v.as_object().is_some_and(|o| o.is_empty()))
+            serde_json::to_value(r)
+                .is_ok_and(|v| v.as_object().is_some_and(serde_json::Map::is_empty))
         })
     })
 }

server/crates/kvitt-server/src/push/fcm.rs

@@ -214,7 +214,7 @@ impl FcmClient {
 
     fn assertion(&self, now: DateTime<Utc>) -> Result<String, String> {
         let mut header = Header::new(Algorithm::RS256);
-        header.kid = self.account.private_key_id.clone();
+        header.kid.clone_from(&self.account.private_key_id);
         let claims = Claims {
             iss: &self.account.client_email,
             scope: SCOPE,

server/crates/kvitt-server/src/router.rs

@@ -136,8 +136,7 @@ async fn log_request(request: Request, next: Next) -> Response {
     let route = request
         .extensions()
         .get::<MatchedPath>()
-        .map(|p| p.as_str().to_owned())
-        .unwrap_or_else(|| "<unmatched>".to_owned());
+        .map_or_else(|| "<unmatched>".to_owned(), |p| p.as_str().to_owned());
     let span = tracing::info_span!(
         "request",
         method = %method,
@@ -151,8 +150,7 @@ async fn log_request(request: Request, next: Next) -> Response {
     let error_code = response
         .extensions()
         .get::<LoggedErrorCode>()
-        .map(|c| c.0.as_str())
-        .unwrap_or("");
+        .map_or("", |c| c.0.as_str());
     span.in_scope(|| {
         tracing::info!(status, latency_ms, error_code, "request");
     });

server/crates/kvitt-server/src/sync/push.rs

@@ -57,7 +57,7 @@ fn canonical_uuid(value: Option<&Value>) -> Option<Uuid> {
         .filter(|id| id.hyphenated().to_string() == text)
 }
 
-fn envelope(index: usize, raw: Value) -> Result<Envelope, AppError> {
+fn envelope(index: usize, mut raw: Value) -> Result<Envelope, AppError> {
     let bad = |what: &str| {
         AppError::invalid_request(format!("mutations[{index}]: {what}")).with_field("mutations")
     };
@@ -68,7 +68,10 @@ fn envelope(index: usize, raw: Value) -> Result<Envelope, AppError> {
         Some("settlement") => EntityType::Settlement,
         _ => return Err(bad("entity_type must be expense or settlement")),
     };
-    let entity = raw.get("entity").cloned().unwrap_or(Value::Null);
+    let entity = raw
+        .get_mut("entity")
+        .map(Value::take)
+        .unwrap_or(Value::Null);
     let entity_id = canonical_uuid(entity.get("id"))
         .ok_or_else(|| bad("entity.id must be a lowercase hyphenated uuid"))?;
     Ok(Envelope {
@@ -410,13 +413,13 @@ fn rejected(env: &Envelope, rejection: Rejection, current: Option<SyncEntity>) -
     })
 }
 
-fn push_of(push_type: PushType, env: &Envelope, ctx: &Ctx<'_>) -> Option<PushMessage> {
-    Some(PushMessage {
+fn push_of(push_type: PushType, env: &Envelope, ctx: &Ctx<'_>) -> PushMessage {
+    PushMessage {
         push_type,
         entity_id: Some(env.entity_id),
         actor_user_id: ctx.caller.user_id,
         count: 1,
-    })
+    }
 }
 
 async fn reload<K: Kind>(conn: &mut SqliteConnection, id: Uuid) -> Result<K::Wire, AppError> {
@@ -552,7 +555,7 @@ async fn process<K: Kind>(
             .await?;
             return Ok(Processed {
                 result: accepted(env, K::entity(after)),
-                push: push_of(K::DELETED, env, ctx),
+                push: Some(push_of(K::DELETED, env, ctx)),
             });
         }
         // Created and deleted before it ever synced: store the tombstone, no audit, no push. It is validated like a
@@ -595,7 +598,7 @@ async fn process<K: Kind>(
         .await?;
         return Ok(Processed {
             result: accepted(env, K::entity(after)),
-            push: push_of(K::CREATED, env, ctx),
+            push: Some(push_of(K::CREATED, env, ctx)),
         });
     };
 
@@ -638,7 +641,7 @@ async fn process<K: Kind>(
     .await?;
     Ok(Processed {
         result: accepted(env, K::entity(after)),
-        push: push_of(K::UPDATED, env, ctx),
+        push: Some(push_of(K::UPDATED, env, ctx)),
     })
 }
 

server/crates/kvitt-server/src/tasks/scheduler.rs

@@ -61,17 +61,17 @@ pub async fn run_daily<F, Fut>(
     if run_at_start {
         job().await;
     }
-    let mut due = plan(clock.now(), at).await;
+    let mut due = plan(clock.now(), at);
     loop {
         let now = clock.now();
         if now >= due {
             job().await;
-            due = plan(clock.now().max(due), at).await;
+            due = plan(clock.now().max(due), at);
             continue;
         }
         if due - now > Duration::days(1) + Duration::hours(2) {
             // The clock went backward: plan from the new now.
-            due = plan(now, at).await;
+            due = plan(now, at);
             continue;
         }
         let wait = (due - now).to_std().unwrap_or(StdDuration::ZERO).min(poll);
@@ -79,8 +79,8 @@ pub async fn run_daily<F, Fut>(
     }
 }
 
-/// [`next_run`], retried after a poll interval if it fails (it cannot for valid times; logged, never panics).
-async fn plan(after: DateTime<Utc>, at: NaiveTime) -> DateTime<Utc> {
+/// [`next_run`], or one day after `after` if it fails (it cannot for valid times; logged, never panics).
+fn plan(after: DateTime<Utc>, at: NaiveTime) -> DateTime<Utc> {
     match next_run(after, at) {
         Ok(instant) => instant,
         Err(e) => {