Rustfmt

src/api/config_edit.rs

@@ -58,10 +58,10 @@ pub(super) async fn patch_config(
     let reservation = if let Some(request) = reload_request.filter(|_| resolved.runtime_changed) {
         Some(
             shared
-            .reload_control
-            .reserve(prepared.response.revision.clone(), request)
-            .await
-            .map_err(reload_submit_failure)?,
+                .reload_control
+                .reserve(prepared.response.revision.clone(), request)
+                .await
+                .map_err(reload_submit_failure)?,
         )
     } else {
         None
@@ -176,8 +176,7 @@ async fn prepare_patch_to_path(
     for section in &touched {
         if *section == "server" {
             let rendered = render_server_listeners(&requested_cfg)?;
-            owner_contents =
-                upsert_toml_table(&owner_contents, "server.listeners", &rendered);
+            owner_contents = upsert_toml_table(&owner_contents, "server.listeners", &rendered);
         } else {
             let rendered = render_top_level_section(&requested_cfg, section)?;
             owner_contents = upsert_toml_table(&owner_contents, section, &rendered);

src/api/config_edit/tests.rs

@@ -51,8 +51,7 @@ async fn patch_revision_conflict() {
 
 #[tokio::test]
 async fn patch_sni_reports_restart_required() {
-    let (path, _d) =
-        temp_config("[censorship]\ntls_domain = \"a.com\"\n[server]\nport = 443\n");
+    let (path, _d) = temp_config("[censorship]\ntls_domain = \"a.com\"\n[server]\nport = 443\n");
     let patch: Json = serde_json::json!({"censorship": {"tls_domain": "b.com"}});
     let resp = apply_patch_to_path(&path, &patch, None).await.unwrap();
     assert!(resp.restart_required);
@@ -252,9 +251,7 @@ async fn patch_rejects_multiple_source_owners_without_writing() {
         "censorship": {"tls_domain": "new.example"}
     });
 
-    let error = apply_patch_to_path(&root, &patch, None)
-        .await
-        .unwrap_err();
+    let error = apply_patch_to_path(&root, &patch, None).await.unwrap_err();
 
     assert_eq!(error.code, "config_patch_not_atomic");
     assert_eq!(tokio::fs::read_to_string(&root).await.unwrap(), root_body);
@@ -276,10 +273,7 @@ async fn unavailable_reload_coordinator_is_detected_before_config_write() {
     drop(receiver);
 
     let error = match control
-        .reserve(
-            prepared.response.revision.clone(),
-            ReloadRequest::default(),
-        )
+        .reserve(prepared.response.revision.clone(), ReloadRequest::default())
         .await
     {
         Ok(_) => panic!("closed reload coordinator must reject the reservation"),

src/api/config_store.rs

@@ -11,14 +11,12 @@ use super::model::ApiFailure;
 // Source-preserving TOML rendering and atomic persistence helpers.
 mod persistence;
 
+#[cfg(test)]
+use persistence::{find_toml_table_bounds, render_access_section, save_sections_to_disk};
 pub(in crate::api) use persistence::{
     render_server_listeners, render_top_level_section, save_access_sections_to_disk,
     upsert_toml_table, write_atomic,
 };
-#[cfg(test)]
-use persistence::{
-    find_toml_table_bounds, render_access_section, save_sections_to_disk,
-};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(super) enum AccessSection {

src/api/config_store/persistence.rs

@@ -7,13 +7,13 @@ use serde::Serialize;
 
 use crate::config::{ProxyConfig, RateLimitBps};
 
+#[cfg(test)]
+use super::compute_revision;
 use super::{
     AccessSection, compute_snapshot_revision, load_candidate_snapshot, load_config_snapshot,
     resolve_single_source_owner, toml_path_exists,
 };
 use crate::api::model::ApiFailure;
-#[cfg(test)]
-use super::compute_revision;
 
 /// Re-render the given top-level tables from `cfg` and upsert each into the
 /// on-disk file, preserving every untouched section (and its comments).
@@ -80,9 +80,7 @@ pub(in crate::api) fn render_top_level_section(
 }
 
 /// Renders normalized listener entries as nested array-of-table blocks.
-pub(in crate::api) fn render_server_listeners(
-    cfg: &ProxyConfig,
-) -> Result<String, ApiFailure> {
+pub(in crate::api) fn render_server_listeners(cfg: &ProxyConfig) -> Result<String, ApiFailure> {
     let mut out = String::new();
     for listener in &cfg.server.listeners {
         out.push_str("[[server.listeners]]\n");
@@ -339,10 +337,7 @@ fn header_belongs_to(header: &str, table_name: &str) -> bool {
 /// [`find_all_table_blocks`] for the full set of (possibly scattered) blocks.
 /// Locates one complete TOML table block in source text.
 #[cfg(test)]
-pub(super) fn find_toml_table_bounds(
-    source: &str,
-    table_name: &str,
-) -> Option<(usize, usize)> {
+pub(super) fn find_toml_table_bounds(source: &str, table_name: &str) -> Option<(usize, usize)> {
     find_all_table_blocks(source, table_name).into_iter().next()
 }
 

src/api/config_store/tests.rs

@@ -31,8 +31,7 @@ async fn save_sections_preserves_other_tables_and_comments() {
 
 #[test]
 fn find_bounds_matches_array_of_tables() {
-    let src =
-        "[server]\nport = 1\n\n[[upstreams]]\nkind = \"a\"\n\n[[upstreams]]\nkind = \"b\"\n";
+    let src = "[server]\nport = 1\n\n[[upstreams]]\nkind = \"a\"\n\n[[upstreams]]\nkind = \"b\"\n";
     let bounds = find_toml_table_bounds(src, "upstreams");
     assert!(bounds.is_some(), "should locate [[upstreams]] block start");
     let (start, end) = bounds.unwrap();
@@ -242,8 +241,7 @@ async fn access_mutation_writes_only_the_single_included_owner() {
     let root = dir.path().join("config.toml");
     let included = dir.path().join("users.toml");
     let root_body = "include = \"users.toml\"\n[censorship]\ntls_domain = \"example.com\"\n";
-    let included_body =
-        "[access.users]\nalice = \"00000000000000000000000000000000\"\n";
+    let included_body = "[access.users]\nalice = \"00000000000000000000000000000000\"\n";
     tokio::fs::write(&root, root_body).await.unwrap();
     tokio::fs::write(&included, included_body).await.unwrap();
     let mut cfg = load_config_from_disk(&root).await.unwrap();
@@ -303,8 +301,8 @@ fn render_user_rate_limits_section() {
         },
     );
 
-    let rendered = render_access_section(&cfg, AccessSection::UserRateLimits)
-        .expect("section must render");
+    let rendered =
+        render_access_section(&cfg, AccessSection::UserRateLimits).expect("section must render");
 
     assert!(rendered.starts_with("[access.user_rate_limits]\n"));
     assert!(rendered.contains("alice = { up_bps = 1024, down_bps = 2048 }"));

src/api/users/create.rs

@@ -175,4 +175,3 @@ pub(in crate::api) async fn create_user(
 
     Ok((CreateUserResponse { user, secret }, revision))
 }
-

src/api/users/lifecycle.rs

@@ -56,7 +56,6 @@ pub(in crate::api) async fn rotate_secret(
     ))
 }
 
-
 pub(in crate::api) async fn delete_user(
     user: &str,
     expected_revision: Option<String>,
@@ -115,4 +114,3 @@ pub(in crate::api) async fn delete_user(
 
     Ok((user.to_string(), revision))
 }
-

src/api/users/links.rs

@@ -197,4 +197,3 @@ fn resolve_extra_tls_domains(cfg: &ProxyConfig) -> Vec<&str> {
     }
     domains
 }
-

src/api/users/tests.rs

@@ -1,292 +1,292 @@
-    use super::*;
-    use crate::ip_tracker::UserIpTracker;
-    use crate::stats::Stats;
+use super::*;
+use crate::ip_tracker::UserIpTracker;
+use crate::stats::Stats;
 
-    #[tokio::test]
-    async fn users_from_config_reports_effective_tcp_limit_with_global_fallback() {
-        let mut cfg = ProxyConfig::default();
+#[tokio::test]
+async fn users_from_config_reports_effective_tcp_limit_with_global_fallback() {
+    let mut cfg = ProxyConfig::default();
+    cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    cfg.access.user_max_tcp_conns_global_each = 7;
+
+    let stats = Stats::new();
+    let tracker = UserIpTracker::new();
+
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    assert!(!alice.in_runtime);
+    assert_eq!(alice.max_tcp_conns, Some(7));
+
+    cfg.access.user_max_tcp_conns.insert("alice".to_string(), 5);
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    assert!(!alice.in_runtime);
+    assert_eq!(alice.max_tcp_conns, Some(5));
+
+    cfg.access.user_max_tcp_conns.insert("alice".to_string(), 0);
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    assert!(!alice.in_runtime);
+    assert_eq!(alice.max_tcp_conns, Some(7));
+
+    cfg.access.user_max_tcp_conns_global_each = 0;
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    assert!(!alice.in_runtime);
+    assert_eq!(alice.max_tcp_conns, None);
+}
+
+#[tokio::test]
+async fn users_from_config_reports_user_rate_limits() {
+    let mut cfg = ProxyConfig::default();
+    cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    cfg.access.user_rate_limits.insert(
+        "alice".to_string(),
+        RateLimitBps {
+            up_bps: 1024,
+            down_bps: 0,
+        },
+    );
+
+    let stats = Stats::new();
+    let tracker = UserIpTracker::new();
+
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+
+    assert_eq!(alice.rate_limit_up_bps, Some(1024));
+    assert_eq!(alice.rate_limit_down_bps, None);
+}
+
+#[tokio::test]
+async fn users_from_config_reports_user_enabled_default_and_override() {
+    let mut cfg = ProxyConfig::default();
+    cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    cfg.access.users.insert(
+        "bob".to_string(),
+        "fedcba9876543210fedcba9876543210".to_string(),
+    );
+    cfg.access.user_enabled.insert("bob".to_string(), false);
+
+    let stats = Stats::new();
+    let tracker = UserIpTracker::new();
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    let bob = users
+        .iter()
+        .find(|entry| entry.username == "bob")
+        .expect("bob must be present");
+
+    assert!(alice.enabled);
+    assert!(!bob.enabled);
+
+    cfg.access.user_enabled.insert("bob".to_string(), true);
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let bob = users
+        .iter()
+        .find(|entry| entry.username == "bob")
+        .expect("bob must be present");
+    assert!(bob.enabled);
+}
+
+#[tokio::test]
+async fn users_from_config_marks_runtime_membership_when_snapshot_is_provided() {
+    let mut disk_cfg = ProxyConfig::default();
+    disk_cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    disk_cfg.access.users.insert(
+        "bob".to_string(),
+        "fedcba9876543210fedcba9876543210".to_string(),
+    );
+
+    let mut runtime_cfg = ProxyConfig::default();
+    runtime_cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+
+    let stats = Stats::new();
+    let tracker = UserIpTracker::new();
+    let users =
+        users_from_config(&disk_cfg, &stats, &tracker, None, None, Some(&runtime_cfg)).await;
+
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+    let bob = users
+        .iter()
+        .find(|entry| entry.username == "bob")
+        .expect("bob must be present");
+
+    assert!(alice.in_runtime);
+    assert!(!bob.in_runtime);
+}
+
+#[tokio::test]
+async fn users_from_config_returns_tls_link_for_each_tls_domain() {
+    let mut cfg = ProxyConfig::default();
+    cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    cfg.general.modes.classic = false;
+    cfg.general.modes.secure = false;
+    cfg.general.modes.tls = true;
+    cfg.general.links.public_host = Some("proxy.example.net".to_string());
+    cfg.general.links.public_port = Some(443);
+    cfg.censorship.tls_domain = "front-a.example.com".to_string();
+    cfg.censorship.tls_domains = vec![
+        "front-b.example.com".to_string(),
+        "front-c.example.com".to_string(),
+        "front-b.example.com".to_string(),
+        "front-a.example.com".to_string(),
+    ];
+
+    let stats = Stats::new();
+    let tracker = UserIpTracker::new();
+    let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
+    let alice = users
+        .iter()
+        .find(|entry| entry.username == "alice")
+        .expect("alice must be present");
+
+    assert_eq!(alice.links.tls.len(), 3);
+    assert!(
+        alice
+            .links
+            .tls
+            .iter()
+            .any(|link| link.ends_with(&hex::encode("front-a.example.com")))
+    );
+    assert!(
+        alice
+            .links
+            .tls
+            .iter()
+            .any(|link| link.ends_with(&hex::encode("front-b.example.com")))
+    );
+    assert!(
+        alice
+            .links
+            .tls
+            .iter()
+            .any(|link| link.ends_with(&hex::encode("front-c.example.com")))
+    );
+    assert_eq!(alice.links.tls_domains.len(), 2);
+    assert!(
+        alice
+            .links
+            .tls_domains
+            .iter()
+            .any(|entry| entry.domain == "front-b.example.com"
+                && entry.link.ends_with(&hex::encode("front-b.example.com")))
+    );
+    assert!(
+        alice
+            .links
+            .tls_domains
+            .iter()
+            .any(|entry| entry.domain == "front-c.example.com"
+                && entry.link.ends_with(&hex::encode("front-c.example.com")))
+    );
+    assert!(
+        !alice
+            .links
+            .tls_domains
+            .iter()
+            .any(|entry| entry.domain == "front-a.example.com")
+    );
+}
+
+#[test]
+fn build_user_quota_list_skips_users_without_positive_quota_and_sorts_by_username() {
+    let mut cfg = ProxyConfig::default();
+    cfg.access.users.insert(
+        "alice".to_string(),
+        "0123456789abcdef0123456789abcdef".to_string(),
+    );
+    cfg.access.users.insert(
+        "bob".to_string(),
+        "fedcba9876543210fedcba9876543210".to_string(),
+    );
+    cfg.access.users.insert(
+        "carol".to_string(),
+        "aaaabbbbccccddddeeeeffff00001111".to_string(),
+    );
+    // alice has a positive quota and should be listed.
+    cfg.access
+        .user_data_quota
+        .insert("alice".to_string(), 1 << 20);
+    // bob has no quota entry at all (None) — should be skipped.
+    // carol has an explicit zero quota — should be skipped.
+    cfg.access.user_data_quota.insert("carol".to_string(), 0);
+
+    let stats = Stats::new();
+    // Charge some traffic against alice; carol gets traffic too but should
+    // still be filtered out by the quota check.
+    let alice_stats = stats.get_or_create_user_stats_handle("alice");
+    stats.quota_charge_post_write(&alice_stats, 4096);
+    let carol_stats = stats.get_or_create_user_stats_handle("carol");
+    stats.quota_charge_post_write(&carol_stats, 99);
+
+    let data = build_user_quota_list(&cfg, &stats);
+
+    assert_eq!(data.users.len(), 1);
+    let entry = &data.users[0];
+    assert_eq!(entry.username, "alice");
+    assert_eq!(entry.data_quota_bytes, 1 << 20);
+    assert_eq!(entry.used_bytes, 4096);
+    assert_eq!(entry.last_reset_epoch_secs, 0);
+}
+
+#[test]
+fn build_user_quota_list_orders_multiple_users_by_username_ascending() {
+    let mut cfg = ProxyConfig::default();
+    for name in ["charlie", "alice", "bob"] {
         cfg.access.users.insert(
-            "alice".to_string(),
+            name.to_string(),
             "0123456789abcdef0123456789abcdef".to_string(),
         );
-        cfg.access.user_max_tcp_conns_global_each = 7;
-
-        let stats = Stats::new();
-        let tracker = UserIpTracker::new();
-
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        assert!(!alice.in_runtime);
-        assert_eq!(alice.max_tcp_conns, Some(7));
-
-        cfg.access.user_max_tcp_conns.insert("alice".to_string(), 5);
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        assert!(!alice.in_runtime);
-        assert_eq!(alice.max_tcp_conns, Some(5));
-
-        cfg.access.user_max_tcp_conns.insert("alice".to_string(), 0);
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        assert!(!alice.in_runtime);
-        assert_eq!(alice.max_tcp_conns, Some(7));
-
-        cfg.access.user_max_tcp_conns_global_each = 0;
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        assert!(!alice.in_runtime);
-        assert_eq!(alice.max_tcp_conns, None);
+        cfg.access.user_data_quota.insert(name.to_string(), 1 << 30);
     }
 
-    #[tokio::test]
-    async fn users_from_config_reports_user_rate_limits() {
-        let mut cfg = ProxyConfig::default();
-        cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-        cfg.access.user_rate_limits.insert(
-            "alice".to_string(),
-            RateLimitBps {
-                up_bps: 1024,
-                down_bps: 0,
-            },
-        );
+    let stats = Stats::new();
+    let data = build_user_quota_list(&cfg, &stats);
 
-        let stats = Stats::new();
-        let tracker = UserIpTracker::new();
-
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-
-        assert_eq!(alice.rate_limit_up_bps, Some(1024));
-        assert_eq!(alice.rate_limit_down_bps, None);
-    }
-
-    #[tokio::test]
-    async fn users_from_config_reports_user_enabled_default_and_override() {
-        let mut cfg = ProxyConfig::default();
-        cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-        cfg.access.users.insert(
-            "bob".to_string(),
-            "fedcba9876543210fedcba9876543210".to_string(),
-        );
-        cfg.access.user_enabled.insert("bob".to_string(), false);
-
-        let stats = Stats::new();
-        let tracker = UserIpTracker::new();
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        let bob = users
-            .iter()
-            .find(|entry| entry.username == "bob")
-            .expect("bob must be present");
-
-        assert!(alice.enabled);
-        assert!(!bob.enabled);
-
-        cfg.access.user_enabled.insert("bob".to_string(), true);
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let bob = users
-            .iter()
-            .find(|entry| entry.username == "bob")
-            .expect("bob must be present");
-        assert!(bob.enabled);
-    }
-
-    #[tokio::test]
-    async fn users_from_config_marks_runtime_membership_when_snapshot_is_provided() {
-        let mut disk_cfg = ProxyConfig::default();
-        disk_cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-        disk_cfg.access.users.insert(
-            "bob".to_string(),
-            "fedcba9876543210fedcba9876543210".to_string(),
-        );
-
-        let mut runtime_cfg = ProxyConfig::default();
-        runtime_cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-
-        let stats = Stats::new();
-        let tracker = UserIpTracker::new();
-        let users =
-            users_from_config(&disk_cfg, &stats, &tracker, None, None, Some(&runtime_cfg)).await;
-
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-        let bob = users
-            .iter()
-            .find(|entry| entry.username == "bob")
-            .expect("bob must be present");
-
-        assert!(alice.in_runtime);
-        assert!(!bob.in_runtime);
-    }
-
-    #[tokio::test]
-    async fn users_from_config_returns_tls_link_for_each_tls_domain() {
-        let mut cfg = ProxyConfig::default();
-        cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-        cfg.general.modes.classic = false;
-        cfg.general.modes.secure = false;
-        cfg.general.modes.tls = true;
-        cfg.general.links.public_host = Some("proxy.example.net".to_string());
-        cfg.general.links.public_port = Some(443);
-        cfg.censorship.tls_domain = "front-a.example.com".to_string();
-        cfg.censorship.tls_domains = vec![
-            "front-b.example.com".to_string(),
-            "front-c.example.com".to_string(),
-            "front-b.example.com".to_string(),
-            "front-a.example.com".to_string(),
-        ];
-
-        let stats = Stats::new();
-        let tracker = UserIpTracker::new();
-        let users = users_from_config(&cfg, &stats, &tracker, None, None, None).await;
-        let alice = users
-            .iter()
-            .find(|entry| entry.username == "alice")
-            .expect("alice must be present");
-
-        assert_eq!(alice.links.tls.len(), 3);
-        assert!(
-            alice
-                .links
-                .tls
-                .iter()
-                .any(|link| link.ends_with(&hex::encode("front-a.example.com")))
-        );
-        assert!(
-            alice
-                .links
-                .tls
-                .iter()
-                .any(|link| link.ends_with(&hex::encode("front-b.example.com")))
-        );
-        assert!(
-            alice
-                .links
-                .tls
-                .iter()
-                .any(|link| link.ends_with(&hex::encode("front-c.example.com")))
-        );
-        assert_eq!(alice.links.tls_domains.len(), 2);
-        assert!(
-            alice
-                .links
-                .tls_domains
-                .iter()
-                .any(|entry| entry.domain == "front-b.example.com"
-                    && entry.link.ends_with(&hex::encode("front-b.example.com")))
-        );
-        assert!(
-            alice
-                .links
-                .tls_domains
-                .iter()
-                .any(|entry| entry.domain == "front-c.example.com"
-                    && entry.link.ends_with(&hex::encode("front-c.example.com")))
-        );
-        assert!(
-            !alice
-                .links
-                .tls_domains
-                .iter()
-                .any(|entry| entry.domain == "front-a.example.com")
-        );
-    }
-
-    #[test]
-    fn build_user_quota_list_skips_users_without_positive_quota_and_sorts_by_username() {
-        let mut cfg = ProxyConfig::default();
-        cfg.access.users.insert(
-            "alice".to_string(),
-            "0123456789abcdef0123456789abcdef".to_string(),
-        );
-        cfg.access.users.insert(
-            "bob".to_string(),
-            "fedcba9876543210fedcba9876543210".to_string(),
-        );
-        cfg.access.users.insert(
-            "carol".to_string(),
-            "aaaabbbbccccddddeeeeffff00001111".to_string(),
-        );
-        // alice has a positive quota and should be listed.
-        cfg.access
-            .user_data_quota
-            .insert("alice".to_string(), 1 << 20);
-        // bob has no quota entry at all (None) — should be skipped.
-        // carol has an explicit zero quota — should be skipped.
-        cfg.access.user_data_quota.insert("carol".to_string(), 0);
-
-        let stats = Stats::new();
-        // Charge some traffic against alice; carol gets traffic too but should
-        // still be filtered out by the quota check.
-        let alice_stats = stats.get_or_create_user_stats_handle("alice");
-        stats.quota_charge_post_write(&alice_stats, 4096);
-        let carol_stats = stats.get_or_create_user_stats_handle("carol");
-        stats.quota_charge_post_write(&carol_stats, 99);
-
-        let data = build_user_quota_list(&cfg, &stats);
-
-        assert_eq!(data.users.len(), 1);
-        let entry = &data.users[0];
-        assert_eq!(entry.username, "alice");
-        assert_eq!(entry.data_quota_bytes, 1 << 20);
-        assert_eq!(entry.used_bytes, 4096);
+    let names: Vec<&str> = data.users.iter().map(|e| e.username.as_str()).collect();
+    assert_eq!(names, vec!["alice", "bob", "charlie"]);
+    for entry in &data.users {
+        assert_eq!(entry.used_bytes, 0);
         assert_eq!(entry.last_reset_epoch_secs, 0);
+        assert_eq!(entry.data_quota_bytes, 1 << 30);
     }
-
-    #[test]
-    fn build_user_quota_list_orders_multiple_users_by_username_ascending() {
-        let mut cfg = ProxyConfig::default();
-        for name in ["charlie", "alice", "bob"] {
-            cfg.access.users.insert(
-                name.to_string(),
-                "0123456789abcdef0123456789abcdef".to_string(),
-            );
-            cfg.access.user_data_quota.insert(name.to_string(), 1 << 30);
-        }
-
-        let stats = Stats::new();
-        let data = build_user_quota_list(&cfg, &stats);
-
-        let names: Vec<&str> = data.users.iter().map(|e| e.username.as_str()).collect();
-        assert_eq!(names, vec!["alice", "bob", "charlie"]);
-        for entry in &data.users {
-            assert_eq!(entry.used_bytes, 0);
-            assert_eq!(entry.last_reset_epoch_secs, 0);
-            assert_eq!(entry.data_quota_bytes, 1 << 30);
-        }
-    }
+}

src/api/users/update.rs

@@ -194,7 +194,6 @@ pub(in crate::api) async fn patch_user(
     Ok((user_info, revision))
 }
 
-
 pub(in crate::api) async fn set_user_enabled(
     user: &str,
     enabled: bool,
@@ -243,4 +242,3 @@ pub(in crate::api) async fn set_user_enabled(
 
     Ok((user_info, revision))
 }
-

src/api/users/view.rs

@@ -110,4 +110,3 @@ pub(in crate::api) fn build_user_quota_list(cfg: &ProxyConfig, stats: &Stats) ->
     }
     UserQuotaListData { users }
 }
-