style: apply rustfmt after clippy let-chain fixes

src/api/auth.rs

@@ -69,7 +69,8 @@ pub async fn login(
 
     // Rate limit check (per IP)
     if let Some(ip_str) = &ctx.ip_address
-        && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>() {
+        && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>()
+    {
         state.rate_limiter.check(ip_addr)?;
     }
 
@@ -103,7 +104,8 @@ pub async fn login(
     if !is_authed {
         record_login_failure(&state, body.username.trim(), ip, ctx.user_agent.as_deref()).await;
         if let Some(ip_str) = &ctx.ip_address
-            && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>() {
+            && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>()
+        {
             state.rate_limiter.record_failure(ip_addr);
         }
         // Non-enumerating error for both unknown user and bad password.
@@ -117,7 +119,8 @@ pub async fn login(
 
     // Clear rate limit on success
     if let Some(ip_str) = &ctx.ip_address
-        && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>() {
+        && let Ok(ip_addr) = ip_str.parse::<std::net::IpAddr>()
+    {
         state.rate_limiter.record_success(ip_addr);
     }
 

src/api/sessions.rs

@@ -104,7 +104,8 @@ pub async fn terminate_session(
 ) -> Result<Json<Value>> {
     // If the user is trying to terminate the current session, disallow it
     if let Some(current_id) = auth.session_id.as_deref()
-        && id == current_id {
+        && id == current_id
+    {
         return Err(AppError::InvalidInput(
             "Cannot terminate current session".into(),
         ));

src/api/tenants.rs

@@ -54,7 +54,8 @@ pub async fn create_tenant(
     require(&state.provider, &auth.user.id, "roles:manage").await?;
 
     if let Some(ref s) = body.slug
-        && !s.trim().is_empty() {
+        && !s.trim().is_empty()
+    {
         crate::identity::slug::validate_slug(s)?;
     }
 
@@ -124,7 +125,8 @@ pub async fn update_tenant(
     require(&state.provider, &auth.user.id, "roles:manage").await?;
 
     if let Some(ref s) = body.slug
-        && !s.trim().is_empty() {
+        && !s.trim().is_empty()
+    {
         crate::identity::slug::validate_slug(s)?;
     }
 

src/api/ui.rs

@@ -27,7 +27,8 @@ pub fn ui_dist_dir() -> PathBuf {
         }
     }
     if let Ok(exe) = std::env::current_exe()
-        && let Some(dir) = exe.parent() {
+        && let Some(dir) = exe.parent()
+    {
         for rel in ["ui/dist", "../ui/dist", "../../ui/dist"] {
             let candidate = dir.join(rel);
             if candidate.exists() {

src/cli/mod.rs

@@ -567,7 +567,8 @@ async fn cmd_init(
     let db_path = std::path::Path::new(&sqlite_path);
     println!("Creating database directory...");
     if let Some(parent) = db_path.parent()
-        && !parent.as_os_str().is_empty() {
+        && !parent.as_os_str().is_empty()
+    {
         std::fs::create_dir_all(parent)?;
     }
 
@@ -664,7 +665,9 @@ async fn run_init_validation(config: &Config, admin_skipped: bool) -> anyhow::Re
     let db_path = std::path::Path::new(&sqlite_path);
     let mut dirs_ok = true;
     if let Some(parent) = db_path.parent()
-        && !parent.as_os_str().is_empty() && std::fs::create_dir_all(parent).is_err() {
+        && !parent.as_os_str().is_empty()
+        && std::fs::create_dir_all(parent).is_err()
+    {
         dirs_ok = false;
     }
     if let Ok(home) = std::env::var("HOME") {
@@ -891,7 +894,8 @@ async fn cmd_backup(config: &Config, path: &std::path::Path) -> anyhow::Result<(
             }
 
             if let Some(parent) = path.parent()
-                && !parent.as_os_str().is_empty() {
+                && !parent.as_os_str().is_empty()
+            {
                 std::fs::create_dir_all(parent)?;
             }
 
@@ -956,7 +960,8 @@ async fn cmd_restore(config: &Config, path: &std::path::Path) -> anyhow::Result<
             let sqlite_path = config.database.sqlite_path();
             let target_path = std::path::Path::new(&sqlite_path);
             if let Some(parent) = target_path.parent()
-                && !parent.as_os_str().is_empty() {
+                && !parent.as_os_str().is_empty()
+            {
                 std::fs::create_dir_all(parent)?;
             }
             std::fs::copy(path, target_path).with_context(|| {

src/config/mod.rs

@@ -294,7 +294,8 @@ impl Default for ShutdownConfig {
 
 fn resolve_home_path(path: &str) -> String {
     if let Some(stripped) = path.strip_prefix("~/")
-        && let Ok(home) = std::env::var("HOME") {
+        && let Ok(home) = std::env::var("HOME")
+    {
         return Path::new(&home)
             .join(stripped)
             .to_string_lossy()
@@ -312,7 +313,8 @@ impl Config {
             *path = resolve_home_path(path);
         }
         if let Some(ref mut url) = self.database.url
-            && let Some(stripped) = url.strip_prefix("sqlite://") {
+            && let Some(stripped) = url.strip_prefix("sqlite://")
+        {
             let clean = resolve_home_path(stripped);
             *url = format!("sqlite://{clean}");
         }
@@ -371,7 +373,8 @@ impl Config {
     /// Default user configuration path (~/.config/nx9-auth/config.toml)
     pub fn default_user_config_path() -> Option<PathBuf> {
         if let Ok(xdg) = std::env::var("XDG_CONFIG_HOME")
-            && !xdg.is_empty() {
+            && !xdg.is_empty()
+        {
             return Some(PathBuf::from(xdg).join("nx9-auth/config.toml"));
         }
         if let Ok(home) = std::env::var("HOME") {

src/db/mod.rs

@@ -58,7 +58,8 @@ pub async fn init_provider(
         DatabaseBackend::Sqlite => {
             let path = config.database.sqlite_path();
             if let Some(parent) = std::path::Path::new(&path).parent()
-                && !parent.as_os_str().is_empty() {
+                && !parent.as_os_str().is_empty()
+            {
                 std::fs::create_dir_all(parent).with_context(|| {
                     format!("failed to create database directory: {}", parent.display())
                 })?;
@@ -177,7 +178,8 @@ pub async fn init_provider(
 #[cfg(feature = "sqlite")]
 pub async fn create_pool(path: &str) -> Result<SqlitePool> {
     if let Some(parent) = std::path::Path::new(path).parent()
-        && !parent.as_os_str().is_empty() {
+        && !parent.as_os_str().is_empty()
+    {
         std::fs::create_dir_all(parent).with_context(|| {
             format!("failed to create database directory: {}", parent.display())
         })?;

src/identity/application_members.rs

@@ -222,7 +222,8 @@ pub async fn update(
     }
 
     if let Some(new_enabled) = enabled
-        && new_enabled != existing.enabled {
+        && new_enabled != existing.enabled
+    {
         let action = if new_enabled {
             "application.member_enabled"
         } else {

src/identity/applications.rs

@@ -324,7 +324,8 @@ pub async fn update(
         .find_by_slug(slug)
         .await
         .map_err(AppError::Database)?
-        && (other.entity_id != id || other.entity_type != "application") {
+        && (other.entity_id != id || other.entity_type != "application")
+    {
         return Err(AppError::Conflict(format!("slug '{slug}' already exists")));
     }
 

src/identity/roles.rs

@@ -191,7 +191,8 @@ pub async fn update_role(
         .find_by_name(name)
         .await
         .map_err(AppError::Database)?
-        && other.id != id {
+        && other.id != id
+    {
         return Err(AppError::Conflict(format!("role '{name}' already exists")));
     }
 

src/middleware/auth.rs

@@ -74,7 +74,8 @@ where
         //    cannot rely solely on the HttpOnly cookie.
         if let Some(auth_header) = parts.headers.get(axum::http::header::AUTHORIZATION)
             && let Ok(value) = auth_header.to_str()
-                && let Some(raw) = value.strip_prefix("Bearer ") {
+            && let Some(raw) = value.strip_prefix("Bearer ")
+        {
             let raw = raw.trim();
 
             // 2a. Personal access token
@@ -99,11 +100,8 @@ where
             }
 
             // 2b. Session token (same value as nx9_session cookie)
-                    if let Some(session) = sessions::validate_session(
+            if let Some(session) =
-                        &app_state.provider,
+                sessions::validate_session(&app_state.provider, raw, &app_state.config.security)
-                        raw,
-                        &app_state.config.security,
-                    )
                     .await?
             {
                 let user = app_state

src/runtime/application.rs

@@ -163,7 +163,8 @@ impl Lifecycle for Application {
         }
 
         if self.router.is_none()
-            && let Some(provider) = &self.provider {
+            && let Some(provider) = &self.provider
+        {
             let app_state = crate::state::AppState::new(provider.clone(), config);
             let router = crate::api::router::build(app_state);
             self.router = Some(router);

src/security/passwords.rs

@@ -75,10 +75,22 @@ pub fn validate_password_strength(password: &str, is_admin: bool) -> Result<(),
 
     // 1. Exact matches for highly common passwords
     let exact_weak: HashSet<&str> = [
-        "password", "admin123", "qwerty", "12345678", "123456789",
+        "password",
-        "administrator", "nx9-auth", "nx9auth", "password123", "admin",
+        "admin123",
-        "letmein", "welcome", "password12345"
+        "qwerty",
-    ].into_iter().collect();
+        "12345678",
+        "123456789",
+        "administrator",
+        "nx9-auth",
+        "nx9auth",
+        "password123",
+        "admin",
+        "letmein",
+        "welcome",
+        "password12345",
+    ]
+    .into_iter()
+    .collect();
 
     if exact_weak.contains(normalized.as_str()) {
         return Err(AppError::InvalidInput(
@@ -98,7 +110,10 @@ pub fn validate_password_strength(password: &str, is_admin: bool) -> Result<(),
     }
 
     // 3. Reject single repeated characters
-    if password.chars().all(|c| c == password.chars().next().unwrap()) {
+    if password
+        .chars()
+        .all(|c| c == password.chars().next().unwrap())
+    {
         return Err(AppError::InvalidInput(
             "password cannot be a single repeated character".to_string(),
         ));

src/security/rate_limit.rs

@@ -73,7 +73,8 @@ impl RateLimiter {
     pub fn check(&self, ip: IpAddr) -> Result<(), AppError> {
         if let Some(s) = self.state.get(&ip)
             && let Some(until) = s.locked_until
-                && Instant::now() < until {
+            && Instant::now() < until
+        {
             return Err(AppError::RateLimited);
         }
         Ok(())
@@ -86,7 +87,8 @@ impl RateLimiter {
 
         // Clear the lockout if it has expired
         if let Some(until) = s.locked_until
-            && now >= until {
+            && now >= until
+        {
             s.locked_until = None;
         }
 

src/security/sessions.rs

@@ -78,7 +78,8 @@ pub async fn validate_session(
 
     // Check absolute expiry
     if let Ok(expires) = chrono::DateTime::parse_from_rfc3339(&session.expires_at)
-        && now > expires {
+        && now > expires
+    {
         provider
             .sessions()
             .revoke(&session.id)

src/security/tokens.rs

@@ -132,7 +132,8 @@ pub async fn validate_token(
     // Check expiry if set
     if let Some(ref exp) = token.expires_at
         && let Ok(expires) = chrono::DateTime::parse_from_rfc3339(exp)
-            && chrono::Utc::now() > expires {
+        && chrono::Utc::now() > expires
+    {
         return Ok(None);
     }