feat: persist rolling-quota usage to SQLite (usage_db)

Cargo.toml

@@ -32,6 +32,7 @@ url = "2.5.7"
 tokio-util = { version = "0.7.17", features = ["compat"] }
 pg-core = { version = "0.6.1", features = ["rust", "stream"] }
 minreq = { version = "2.14.1", features = ["json-using-serde", "https-native"]}
+rusqlite = { version = "0.40.1", features = ["bundled"] }
 
 [dev-dependencies]
 # Enables `pg_core::test::TestSetup` for building real verifying keys and

src/config.rs

@@ -16,6 +16,7 @@ pub struct RawCryptifyConfig {
     chunk_size: Option<u64>,
     session_ttl_secs: Option<u64>,
     staging_mode: Option<bool>,
+    usage_db: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -35,6 +36,11 @@ pub struct CryptifyConfig {
     chunk_size: u64,
     session_ttl_secs: u64,
     staging_mode: bool,
+    /// Filesystem path to the SQLite database backing the rolling-quota
+    /// usage state. When set, per-sender usage survives process restarts
+    /// (the in-memory map in `Store` is only a cache). `None` keeps usage
+    /// entirely in memory, as it was before persistence was added.
+    usage_db: Option<String>,
 }
 
 impl From<RawCryptifyConfig> for CryptifyConfig {
@@ -57,6 +63,7 @@ impl From<RawCryptifyConfig> for CryptifyConfig {
             chunk_size: config.chunk_size.unwrap_or(5_000_000),
             session_ttl_secs: config.session_ttl_secs.unwrap_or(3600),
             staging_mode: config.staging_mode.unwrap_or(false),
+            usage_db: config.usage_db,
         }
     }
 }
@@ -118,6 +125,12 @@ impl CryptifyConfig {
         self.staging_mode
     }
 
+    /// Path to the SQLite database backing rolling-quota usage, if
+    /// configured. `None` means usage is kept in memory only.
+    pub fn usage_db(&self) -> Option<&str> {
+        self.usage_db.as_deref()
+    }
+
     #[cfg(test)]
     pub(crate) fn for_test(server_url: &str, staging_mode: bool) -> Self {
         CryptifyConfig {
@@ -135,6 +148,41 @@ impl CryptifyConfig {
             chunk_size: 5_000_000,
             session_ttl_secs: 3600,
             staging_mode,
+            usage_db: None,
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rocket::figment::{providers::Serialized, Figment};
+
+    fn base_config() -> serde_json::Value {
+        serde_json::json!({
+            "server_url": "http://localhost",
+            "data_dir": "/tmp/data",
+            "email_from": "Test <test@example.com>",
+            "smtp_url": "localhost",
+            "smtp_port": 1025u16,
+            "allowed_origins": ".*",
+            "pkg_url": "http://localhost",
+        })
+    }
+
+    #[test]
+    fn usage_db_is_parsed_when_present() {
+        let mut raw = base_config();
+        raw["usage_db"] = serde_json::json!("/app/data/usage.db");
+        let config: CryptifyConfig = Figment::from(Serialized::defaults(raw)).extract().unwrap();
+        assert_eq!(config.usage_db(), Some("/app/data/usage.db"));
+    }
+
+    #[test]
+    fn usage_db_defaults_to_none_when_absent() {
+        let config: CryptifyConfig = Figment::from(Serialized::defaults(base_config()))
+            .extract()
+            .unwrap();
+        assert_eq!(config.usage_db(), None);
+    }
+}

src/main.rs

@@ -1262,6 +1262,7 @@ pub fn build_rocket(figment: Figment, vk: Parameters<VerifyingKey>) -> Rocket<Bu
         .manage(Store::with_idle_ttl(
             std::time::Duration::from_secs(config.session_ttl_secs()),
             metrics.clone(),
+            config.usage_db(),
         ))
         .manage(vk)
         .manage(pkg_client)