move Clock/MockClock/SystemClock/BoxClock/BoxRng to mas-data-model

Cargo.lock

@@ -3282,6 +3282,7 @@ dependencies = [
  "mas-jose",
  "oauth2-types",
  "rand 0.8.5",
+ "rand_chacha 0.3.1",
  "regex",
  "ruma-common",
  "serde",
@@ -6178,6 +6179,7 @@ dependencies = [
  "futures-util",
  "insta",
  "mas-config",
+ "mas-data-model",
  "mas-iana",
  "mas-storage",
  "mas-storage-pg",

crates/axum-utils/src/csrf.rs

@@ -6,7 +6,7 @@
 
 use base64ct::{Base64UrlUnpadded, Encoding};
 use chrono::{DateTime, Duration, Utc};
-use mas_storage::Clock;
+use mas_data_model::Clock;
 use rand::{Rng, RngCore, distributions::Standard, prelude::Distribution as _};
 use serde::{Deserialize, Serialize};
 use serde_with::{TimestampSeconds, serde_as};

crates/axum-utils/src/user_authorization.rs

@@ -16,9 +16,9 @@ use axum::{
 use axum_extra::typed_header::{TypedHeader, TypedHeaderRejectionReason};
 use headers::{Authorization, Header, HeaderMapExt, HeaderName, authorization::Bearer};
 use http::{HeaderMap, HeaderValue, Request, StatusCode, header::WWW_AUTHENTICATE};
-use mas_data_model::Session;
+use mas_data_model::{Clock, Session};
 use mas_storage::{
-    Clock, RepositoryAccess,
+    RepositoryAccess,
     oauth2::{OAuth2AccessTokenRepository, OAuth2SessionRepository},
 };
 use serde::{Deserialize, de::DeserializeOwned};

crates/cli/src/app_state.rs

@@ -9,7 +9,7 @@ use std::{convert::Infallible, net::IpAddr, sync::Arc};
 use axum::extract::{FromRef, FromRequestParts};
 use ipnetwork::IpNetwork;
 use mas_context::LogContext;
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig, SystemClock};
 use mas_handlers::{
     ActivityTracker, BoundActivityTracker, CookieManager, ErrorWrapper, GraphQLSchema, Limiter,
     MetadataCache, RequesterFingerprint, passwords::PasswordManager,
@@ -19,9 +19,7 @@ use mas_keystore::{Encrypter, Keystore};
 use mas_matrix::HomeserverConnection;
 use mas_policy::{Policy, PolicyFactory};
 use mas_router::UrlBuilder;
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, RepositoryFactory, SystemClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryFactory};
 use mas_storage_pg::PgRepositoryFactory;
 use mas_templates::Templates;
 use opentelemetry::KeyValue;

crates/cli/src/commands/config.rs

@@ -11,7 +11,7 @@ use camino::Utf8PathBuf;
 use clap::Parser;
 use figment::Figment;
 use mas_config::{ConfigurationSection, RootConfig, SyncConfig};
-use mas_storage::{Clock as _, SystemClock};
+use mas_data_model::{Clock as _, SystemClock};
 use mas_storage_pg::MIGRATOR;
 use rand::SeedableRng;
 use tokio::io::AsyncWriteExt;

crates/cli/src/commands/manage.rs

@@ -15,11 +15,11 @@ use figment::Figment;
 use mas_config::{
     ConfigurationSection, ConfigurationSectionExt, DatabaseConfig, MatrixConfig, PasswordsConfig,
 };
-use mas_data_model::{Device, TokenType, Ulid, UpstreamOAuthProvider, User};
+use mas_data_model::{Clock, Device, SystemClock, TokenType, Ulid, UpstreamOAuthProvider, User};
 use mas_email::Address;
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    Clock, RepositoryAccess, SystemClock,
+    RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionFilter, CompatSessionRepository},
     oauth2::OAuth2SessionFilter,
     queue::{

crates/cli/src/commands/server.rs

@@ -14,10 +14,10 @@ use mas_config::{
     AppConfig, ClientsConfig, ConfigurationSection, ConfigurationSectionExt, UpstreamOAuth2Config,
 };
 use mas_context::LogContext;
+use mas_data_model::SystemClock;
 use mas_handlers::{ActivityTracker, CookieManager, Limiter, MetadataCache};
 use mas_listener::server::Server;
 use mas_router::UrlBuilder;
-use mas_storage::SystemClock;
 use mas_storage_pg::{MIGRATOR, PgRepositoryFactory};
 use sqlx::migrate::Migrate;
 use tracing::{Instrument, info, info_span, warn};

crates/cli/src/commands/syn2mas.rs

@@ -13,7 +13,7 @@ use mas_config::{
     ConfigurationSection, ConfigurationSectionExt, DatabaseConfig, MatrixConfig, SyncConfig,
     UpstreamOAuth2Config,
 };
-use mas_storage::SystemClock;
+use mas_data_model::SystemClock;
 use mas_storage_pg::MIGRATOR;
 use rand::thread_rng;
 use sqlx::{Connection, Either, PgConnection, postgres::PgConnectOptions, types::Uuid};

crates/cli/src/commands/templates.rs

@@ -12,7 +12,7 @@ use mas_config::{
     AccountConfig, BrandingConfig, CaptchaConfig, ConfigurationSection, ConfigurationSectionExt,
     ExperimentalConfig, MatrixConfig, PasswordsConfig, TemplatesConfig,
 };
-use mas_storage::{Clock, SystemClock};
+use mas_data_model::{Clock, SystemClock};
 use rand::SeedableRng;
 use tracing::info_span;
 

crates/cli/src/commands/worker.rs

@@ -9,8 +9,8 @@ use std::{process::ExitCode, time::Duration};
 use clap::Parser;
 use figment::Figment;
 use mas_config::{AppConfig, ConfigurationSection};
+use mas_data_model::SystemClock;
 use mas_router::UrlBuilder;
-use mas_storage::SystemClock;
 use mas_storage_pg::PgRepositoryFactory;
 use tracing::{info, info_span};
 

crates/cli/src/sync.rs

@@ -9,9 +9,10 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use mas_config::{ClientsConfig, UpstreamOAuth2Config};
+use mas_data_model::Clock;
 use mas_keystore::Encrypter;
 use mas_storage::{
-    Clock, Pagination, RepositoryAccess,
+    Pagination, RepositoryAccess,
     upstream_oauth2::{UpstreamOAuthProviderFilter, UpstreamOAuthProviderParams},
 };
 use mas_storage_pg::PgRepository;

crates/data-model/Cargo.toml

@@ -26,6 +26,7 @@ url.workspace = true
 crc.workspace = true
 ulid.workspace = true
 rand.workspace = true
+rand_chacha.workspace = true
 regex.workspace = true
 woothee.workspace = true
 ruma-common.workspace = true

crates/data-model/src/lib.rs

@@ -8,6 +8,7 @@
 
 use thiserror::Error;
 
+pub mod clock;
 pub(crate) mod compat;
 pub mod oauth2;
 pub(crate) mod policy_data;
@@ -16,6 +17,7 @@ pub(crate) mod tokens;
 pub(crate) mod upstream_oauth2;
 pub(crate) mod user_agent;
 pub(crate) mod users;
+mod utils;
 
 /// Error when an invalid state transition is attempted.
 #[derive(Debug, Error)]
@@ -25,6 +27,7 @@ pub struct InvalidTransitionError;
 pub use ulid::Ulid;
 
 pub use self::{
+    clock::{Clock, SystemClock},
     compat::{
         CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
         CompatSessionState, CompatSsoLogin, CompatSsoLoginState, Device, ToScopeTokenError,
@@ -53,4 +56,5 @@ pub use self::{
         UserEmailAuthentication, UserEmailAuthenticationCode, UserRecoverySession,
         UserRecoveryTicket, UserRegistration, UserRegistrationPassword, UserRegistrationToken,
     },
+    utils::{BoxClock, BoxRng},
 };

crates/data-model/src/utils.rs

@@ -0,0 +1,13 @@
+// Copyright 2025 New Vector Ltd.
+//
+// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+// Please see LICENSE files in the repository root for full details.
+
+use rand_chacha::rand_core::CryptoRngCore;
+
+use crate::clock::Clock;
+
+/// A boxed [`Clock`]
+pub type BoxClock = Box<dyn Clock + Send>;
+/// A boxed random number generator
+pub type BoxRng = Box<dyn CryptoRngCore + Send>;

crates/handlers/src/activity_tracker/bound.rs

@@ -6,8 +6,7 @@
 
 use std::net::IpAddr;
 
-use mas_data_model::{BrowserSession, CompatSession, Session};
-use mas_storage::Clock;
+use mas_data_model::{BrowserSession, Clock, CompatSession, Session};
 
 use crate::activity_tracker::ActivityTracker;
 

crates/handlers/src/activity_tracker/mod.rs

@@ -10,8 +10,8 @@ mod worker;
 use std::net::IpAddr;
 
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, Session};
-use mas_storage::{BoxRepositoryFactory, Clock};
+use mas_data_model::{BrowserSession, Clock, CompatSession, Session};
+use mas_storage::BoxRepositoryFactory;
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 use ulid::Ulid;
 

crates/handlers/src/admin/call_context.rs

@@ -16,8 +16,8 @@ use axum_extra::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{Session, User};
-use mas_storage::{BoxClock, BoxRepository, RepositoryError};
+use mas_data_model::{BoxClock, Session, User};
+use mas_storage::{BoxRepository, RepositoryError};
 use ulid::Ulid;
 
 use super::response::ErrorResponse;

crates/handlers/src/admin/mod.rs

@@ -20,6 +20,7 @@ use axum::{
 use hyper::header::{ACCEPT, AUTHORIZATION, CONTENT_TYPE};
 use indexmap::IndexMap;
 use mas_axum_utils::InternalError;
+use mas_data_model::BoxRng;
 use mas_http::CorsLayerExt;
 use mas_matrix::HomeserverConnection;
 use mas_policy::PolicyFactory;
@@ -27,7 +28,6 @@ use mas_router::{
     ApiDoc, ApiDocCallback, OAuth2AuthorizationEndpoint, OAuth2TokenEndpoint, Route, SimpleRoute,
     UrlBuilder,
 };
-use mas_storage::BoxRng;
 use mas_templates::{ApiDocContext, Templates};
 use tower_http::cors::{Any, CorsLayer};
 

crates/handlers/src/admin/v1/mod.rs

@@ -11,9 +11,9 @@ use aide::axum::{
     routing::{get_with, post_with},
 };
 use axum::extract::{FromRef, FromRequestParts};
+use mas_data_model::BoxRng;
 use mas_matrix::HomeserverConnection;
 use mas_policy::PolicyFactory;
-use mas_storage::BoxRng;
 
 use super::call_context::CallContext;
 use crate::passwords::PasswordManager;

crates/handlers/src/admin/v1/policy_data/set.rs

@@ -9,8 +9,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_policy::PolicyFactory;
-use mas_storage::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 

crates/handlers/src/admin/v1/upstream_oauth_links/add.rs

@@ -7,7 +7,7 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use ulid::Ulid;

crates/handlers/src/admin/v1/user_emails/add.rs

@@ -9,8 +9,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_storage::{
-    BoxRng,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     user::UserEmailFilter,
 };

crates/handlers/src/admin/v1/user_emails/delete.rs

@@ -7,10 +7,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::{
-    BoxRng,
-    queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
-};
+use mas_data_model::BoxRng;
+use mas_storage::queue::{ProvisionUserJob, QueueJobRepositoryExt as _};
 use ulid::Ulid;
 
 use crate::{

crates/handlers/src/admin/v1/user_registration_tokens/add.rs

@@ -9,7 +9,7 @@ use axum::{Json, response::IntoResponse};
 use chrono::{DateTime, Utc};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use rand::distributions::{Alphanumeric, DistString};
 use schemars::JsonSchema;
 use serde::Deserialize;

crates/handlers/src/admin/v1/user_registration_tokens/list.rs

@@ -173,7 +173,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/admin/v1/user_registration_tokens/revoke.rs

@@ -105,7 +105,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/admin/v1/user_registration_tokens/update.rs

@@ -143,7 +143,7 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::Clock as _;
+    use mas_data_model::Clock as _;
     use serde_json::json;
     use sqlx::PgPool;
 

crates/handlers/src/admin/v1/users/add.rs

@@ -10,8 +10,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::BoxRng;
 use mas_matrix::{HomeserverConnection, ProvisionRequest};
-use mas_storage::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use tracing::warn;

crates/handlers/src/admin/v1/users/deactivate.rs

@@ -8,10 +8,8 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::{
-    BoxRng,
-    queue::{DeactivateUserJob, QueueJobRepositoryExt as _},
-};
+use mas_data_model::BoxRng;
+use mas_storage::queue::{DeactivateUserJob, QueueJobRepositoryExt as _};
 use schemars::JsonSchema;
 use serde::Deserialize;
 use tracing::info;
@@ -134,7 +132,8 @@ mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
     use insta::{allow_duplicates, assert_json_snapshot};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_data_model::Clock;
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::{PgPool, types::Json};
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/admin/v1/users/lock.rs

@@ -92,7 +92,8 @@ pub async fn handler(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_data_model::Clock;
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/admin/v1/users/reactivate.rs

@@ -102,8 +102,9 @@ pub async fn handler(
 #[cfg(test)]
 mod tests {
     use hyper::{Request, StatusCode};
+    use mas_data_model::Clock;
     use mas_matrix::{HomeserverConnection, ProvisionRequest};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/admin/v1/users/set_password.rs

@@ -8,7 +8,7 @@ use aide::{NoApi, OperationIo, transform::TransformOperation};
 use axum::{Json, extract::State, response::IntoResponse};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_storage::BoxRng;
+use mas_data_model::BoxRng;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use ulid::Ulid;

crates/handlers/src/admin/v1/users/unlock.rs

@@ -89,8 +89,9 @@ pub async fn handler(
 #[cfg(test)]
 mod tests {
     use hyper::{Request, StatusCode};
+    use mas_data_model::Clock;
     use mas_matrix::{HomeserverConnection, ProvisionRequest};
-    use mas_storage::{Clock, RepositoryAccess, user::UserRepository};
+    use mas_storage::{RepositoryAccess, user::UserRepository};
     use sqlx::PgPool;
 
     use crate::test_utils::{RequestBuilderExt, ResponseExt, TestState, setup};

crates/handlers/src/bin/api-schema.rs

@@ -50,8 +50,8 @@ macro_rules! impl_from_ref {
 }
 
 impl_from_request_parts!(mas_storage::BoxRepository);
-impl_from_request_parts!(mas_storage::BoxClock);
-impl_from_request_parts!(mas_storage::BoxRng);
+impl_from_request_parts!(mas_data_model::BoxClock);
+impl_from_request_parts!(mas_data_model::BoxRng);
 impl_from_request_parts!(mas_handlers::BoundActivityTracker);
 impl_from_ref!(mas_router::UrlBuilder);
 impl_from_ref!(mas_templates::Templates);

crates/handlers/src/compat/login.rs

@@ -11,10 +11,13 @@ use axum_extra::typed_header::TypedHeader;
 use chrono::Duration;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{CompatSession, CompatSsoLoginState, Device, SiteConfig, TokenType, User};
+use mas_data_model::{
+    BoxClock, BoxRng, Clock, CompatSession, CompatSsoLoginState, Device, SiteConfig, TokenType,
+    User,
+};
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, BoxRepositoryFactory, RepositoryAccess,
     compat::{
         CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository,
         CompatSsoLoginRepository,

crates/handlers/src/compat/login_sso_complete.rs

@@ -17,10 +17,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng, Clock};
 use mas_router::{CompatLoginSsoAction, UrlBuilder};
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess, compat::CompatSsoLoginRepository,
-};
+use mas_storage::{BoxRepository, RepositoryAccess, compat::CompatSsoLoginRepository};
 use mas_templates::{CompatSsoContext, ErrorContext, TemplateContext, Templates};
 use serde::{Deserialize, Serialize};
 use ulid::Ulid;

crates/handlers/src/compat/login_sso_redirect.rs

@@ -10,8 +10,9 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{CompatLoginSsoAction, CompatLoginSsoComplete, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, compat::CompatSsoLoginRepository};
+use mas_storage::{BoxRepository, compat::CompatSsoLoginRepository};
 use rand::distributions::{Alphanumeric, DistString};
 use serde::Deserialize;
 use serde_with::serde;

crates/handlers/src/compat/logout.rs

@@ -11,9 +11,9 @@ use axum_extra::typed_header::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, Clock, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionRepository},
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };

crates/handlers/src/compat/logout_all.rs

@@ -10,9 +10,9 @@ use axum_extra::typed_header::TypedHeader;
 use headers::{Authorization, authorization::Bearer};
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, Clock, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     compat::{CompatAccessTokenRepository, CompatSessionFilter, CompatSessionRepository},
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };

crates/handlers/src/compat/refresh.rs

@@ -8,9 +8,9 @@ use axum::{Json, extract::State, response::IntoResponse};
 use chrono::Duration;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{SiteConfig, TokenFormatError, TokenType};
+use mas_data_model::{BoxClock, BoxRng, Clock, SiteConfig, TokenFormatError, TokenType};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock,
+    BoxRepository,
     compat::{CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository},
 };
 use serde::{Deserialize, Serialize};

crates/handlers/src/graphql/mod.rs

@@ -28,13 +28,13 @@ use hyper::header::CACHE_CONTROL;
 use mas_axum_utils::{
     InternalError, SessionInfo, SessionInfoExt, cookies::CookieJar, sentry::SentryEventID,
 };
-use mas_data_model::{BrowserSession, Session, SiteConfig, User};
+use mas_data_model::{
+    BoxClock, BoxRng, BrowserSession, Clock, Session, SiteConfig, SystemClock, User,
+};
 use mas_matrix::HomeserverConnection;
 use mas_policy::{InstantiateError, Policy, PolicyFactory};
 use mas_router::UrlBuilder;
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, Clock, RepositoryError, SystemClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryError};
 use opentelemetry_semantic_conventions::trace::{GRAPHQL_DOCUMENT, GRAPHQL_OPERATION_NAME};
 use rand::{SeedableRng, thread_rng};
 use rand_chacha::ChaChaRng;

crates/handlers/src/graphql/state.rs

@@ -5,11 +5,11 @@
 // Please see LICENSE files in the repository root for full details.
 
 use async_graphql::{Response, ServerError};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, RepositoryError};
+use mas_storage::{BoxRepository, RepositoryError};
 
 use crate::{Limiter, graphql::Requester, passwords::PasswordManager};
 

crates/handlers/src/lib.rs

@@ -42,7 +42,7 @@ use mas_keystore::{Encrypter, Keystore};
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::{Route, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng};
+use mas_storage::{BoxRepository, BoxRepositoryFactory};
 use mas_templates::{ErrorContext, NotFoundContext, TemplateContext, Templates};
 use opentelemetry::metrics::Meter;
 use sqlx::PgPool;
@@ -94,6 +94,7 @@ macro_rules! impl_from_error_for_route {
 }
 
 pub use mas_axum_utils::{ErrorWrapper, cookies::CookieManager};
+use mas_data_model::{BoxClock, BoxRng};
 
 pub use self::{
     activity_tracker::{ActivityTracker, Bound as BoundActivityTracker},

crates/handlers/src/oauth2/authorization/consent.rs

@@ -15,12 +15,12 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::AuthorizationGrantStage;
+use mas_data_model::{AuthorizationGrantStage, BoxClock, BoxRng};
 use mas_keystore::Keystore;
 use mas_policy::Policy;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     oauth2::{OAuth2AuthorizationGrantRepository, OAuth2ClientRepository},
 };
 use mas_templates::{ConsentContext, PolicyViolationContext, TemplateContext, Templates};

crates/handlers/src/oauth2/authorization/mod.rs

@@ -10,10 +10,10 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, SessionInfoExt, cookies::CookieJar};
-use mas_data_model::{AuthorizationCode, Pkce};
+use mas_data_model::{AuthorizationCode, BoxClock, BoxRng, Pkce};
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     oauth2::{OAuth2AuthorizationGrantRepository, OAuth2ClientRepository},
 };
 use mas_templates::Templates;

crates/handlers/src/oauth2/device/authorize.rs

@@ -13,9 +13,10 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_keystore::Encrypter;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2DeviceCodeGrantParams};
+use mas_storage::{BoxRepository, oauth2::OAuth2DeviceCodeGrantParams};
 use oauth2_types::{
     errors::{ClientError, ClientErrorCode},
     requests::{DeviceAuthorizationRequest, DeviceAuthorizationResponse, GrantType},

crates/handlers/src/oauth2/device/consent.rs

@@ -16,9 +16,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{DeviceConsentContext, PolicyViolationContext, TemplateContext, Templates};
 use serde::Deserialize;
 use tracing::warn;

crates/handlers/src/oauth2/device/link.rs

@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar};
+use mas_data_model::BoxClock;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository};
+use mas_storage::BoxRepository;
 use mas_templates::{
     DeviceLinkContext, DeviceLinkFormField, FieldError, FormState, TemplateContext, Templates,
 };

crates/handlers/src/oauth2/introspection.rs

@@ -12,12 +12,12 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
-use mas_data_model::{Device, TokenFormatError, TokenType};
+use mas_data_model::{BoxClock, Clock, Device, TokenFormatError, TokenType};
 use mas_iana::oauth::{OAuthClientAuthenticationMethod, OAuthTokenTypeHint};
 use mas_keystore::Encrypter;
 use mas_matrix::HomeserverConnection;
 use mas_storage::{
-    BoxClock, BoxRepository, Clock,
+    BoxRepository,
     compat::{CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionRepository},
     oauth2::{OAuth2AccessTokenRepository, OAuth2RefreshTokenRepository, OAuth2SessionRepository},
     user::UserRepository,
@@ -605,11 +605,10 @@ pub(crate) async fn post(
 mod tests {
     use chrono::Duration;
     use hyper::{Request, StatusCode};
-    use mas_data_model::{AccessToken, RefreshToken};
+    use mas_data_model::{AccessToken, Clock, RefreshToken};
     use mas_iana::oauth::OAuthTokenTypeHint;
     use mas_matrix::{HomeserverConnection, MockHomeserverConnection, ProvisionRequest};
     use mas_router::{OAuth2Introspection, OAuth2RegistrationEndpoint, SimpleRoute};
-    use mas_storage::Clock;
     use oauth2_types::{
         errors::{ClientError, ClientErrorCode},
         registration::ClientRegistrationResponse,

crates/handlers/src/oauth2/mod.rs

@@ -8,8 +8,8 @@ use std::collections::HashMap;
 
 use chrono::Duration;
 use mas_data_model::{
-    AccessToken, Authentication, AuthorizationGrant, BrowserSession, Client, RefreshToken, Session,
-    TokenType,
+    AccessToken, Authentication, AuthorizationGrant, BrowserSession, Client, Clock, RefreshToken,
+    Session, TokenType,
 };
 use mas_iana::jose::JsonWebSignatureAlg;
 use mas_jose::{
@@ -19,7 +19,7 @@ use mas_jose::{
 };
 use mas_keystore::Keystore;
 use mas_router::UrlBuilder;
-use mas_storage::{Clock, RepositoryAccess};
+use mas_storage::RepositoryAccess;
 use thiserror::Error;
 
 pub mod authorization;

crates/handlers/src/oauth2/registration.rs

@@ -10,10 +10,11 @@ use axum::{Json, extract::State, response::IntoResponse};
 use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
+use mas_data_model::{BoxClock, BoxRng};
 use mas_iana::oauth::OAuthClientAuthenticationMethod;
 use mas_keystore::Encrypter;
 use mas_policy::{EvaluationResult, Policy};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2ClientRepository};
+use mas_storage::{BoxRepository, oauth2::OAuth2ClientRepository};
 use oauth2_types::{
     errors::{ClientError, ClientErrorCode},
     registration::{

crates/handlers/src/oauth2/revoke.rs

@@ -10,11 +10,11 @@ use mas_axum_utils::{
     client_authorization::{ClientAuthorization, CredentialsVerificationError},
     record_error,
 };
-use mas_data_model::TokenType;
+use mas_data_model::{BoxClock, BoxRng, TokenType};
 use mas_iana::oauth::OAuthTokenTypeHint;
 use mas_keystore::Encrypter;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},
 };
 use oauth2_types::{

crates/handlers/src/oauth2/token.rs

@@ -16,7 +16,8 @@ use mas_axum_utils::{
     record_error,
 };
 use mas_data_model::{
-    AuthorizationGrantStage, Client, Device, DeviceCodeGrantState, SiteConfig, TokenType,
+    AuthorizationGrantStage, BoxClock, BoxRng, Client, Clock, Device, DeviceCodeGrantState,
+    SiteConfig, TokenType,
 };
 use mas_i18n::DataLocale;
 use mas_keystore::{Encrypter, Keystore};
@@ -25,7 +26,7 @@ use mas_oidc_client::types::scope::ScopeToken;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     oauth2::{
         OAuth2AccessTokenRepository, OAuth2AuthorizationGrantRepository,
         OAuth2RefreshTokenRepository, OAuth2SessionRepository,

crates/handlers/src/oauth2/userinfo.rs

@@ -15,13 +15,14 @@ use mas_axum_utils::{
     record_error,
     user_authorization::{AuthorizationVerificationError, UserAuthorization},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_jose::{
     constraints::Constrainable,
     jwt::{JsonWebSignatureHeader, Jwt},
 };
 use mas_keystore::Keystore;
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng, oauth2::OAuth2ClientRepository};
+use mas_storage::{BoxRepository, oauth2::OAuth2ClientRepository};
 use serde::Serialize;
 use serde_with::skip_serializing_none;
 use thiserror::Error;

crates/handlers/src/rate_limit.rs

@@ -301,8 +301,7 @@ impl Limiter {
 
 #[cfg(test)]
 mod tests {
-    use mas_data_model::User;
-    use mas_storage::{Clock, clock::MockClock};
+    use mas_data_model::{Clock, User, clock::MockClock};
     use rand::SeedableRng;
 
     use super::*;

crates/handlers/src/session.rs

@@ -8,9 +8,9 @@
 
 use axum::response::{Html, IntoResponse as _, Response};
 use mas_axum_utils::{SessionInfoExt, cookies::CookieJar, csrf::CsrfExt};
-use mas_data_model::BrowserSession;
+use mas_data_model::{BrowserSession, Clock};
 use mas_i18n::DataLocale;
-use mas_storage::{BoxRepository, Clock, RepositoryError};
+use mas_storage::{BoxRepository, RepositoryError};
 use mas_templates::{AccountInactiveContext, TemplateContext, Templates};
 use rand::RngCore;
 use thiserror::Error;

crates/handlers/src/test_utils.rs

@@ -28,17 +28,14 @@ use mas_axum_utils::{
     cookies::{CookieJar, CookieManager},
 };
 use mas_config::RateLimitingConfig;
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig, clock::MockClock};
 use mas_email::{MailTransport, Mailer};
 use mas_i18n::Translator;
 use mas_keystore::{Encrypter, JsonWebKey, JsonWebKeySet, Keystore, PrivateKey};
 use mas_matrix::{HomeserverConnection, MockHomeserverConnection};
 use mas_policy::{InstantiateError, Policy, PolicyFactory};
 use mas_router::{SimpleRoute, UrlBuilder};
-use mas_storage::{
-    BoxClock, BoxRepository, BoxRepositoryFactory, BoxRng, RepositoryError, RepositoryFactory,
-    clock::MockClock,
-};
+use mas_storage::{BoxRepository, BoxRepositoryFactory, RepositoryError, RepositoryFactory};
 use mas_storage_pg::PgRepositoryFactory;
 use mas_tasks::QueueWorker;
 use mas_templates::{SiteConfigExt, Templates};

crates/handlers/src/upstream_oauth2/authorize.rs

@@ -10,11 +10,11 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, cookies::CookieJar};
-use mas_data_model::UpstreamOAuthProvider;
+use mas_data_model::{BoxClock, BoxRng, UpstreamOAuthProvider};
 use mas_oidc_client::requests::authorization_code::AuthorizationRequestData;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     upstream_oauth2::{UpstreamOAuthProviderRepository, UpstreamOAuthSessionRepository},
 };
 use thiserror::Error;

crates/handlers/src/upstream_oauth2/backchannel_logout.rs

@@ -12,7 +12,9 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::record_error;
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderOnBackchannelLogout};
+use mas_data_model::{
+    BoxClock, BoxRng, UpstreamOAuthProvider, UpstreamOAuthProviderOnBackchannelLogout,
+};
 use mas_jose::{
     claims::{self, Claim, TimeOptions},
     jwt::JwtDecodeError,
@@ -22,7 +24,7 @@ use mas_oidc_client::{
     requests::jose::{JwtVerificationData, verify_signed_jwt},
 };
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Pagination,
+    BoxRepository, Pagination,
     compat::CompatSessionFilter,
     oauth2::OAuth2SessionFilter,
     queue::{QueueJobRepositoryExt as _, SyncDevicesJob},

crates/handlers/src/upstream_oauth2/cache.rs

@@ -302,11 +302,10 @@ mod tests {
     // 'insecure' discovery
 
     use mas_data_model::{
-        UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
-        UpstreamOAuthProviderTokenAuthMethod,
+        Clock, UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
+        UpstreamOAuthProviderTokenAuthMethod, clock::MockClock,
     };
     use mas_iana::jose::JsonWebSignatureAlg;
-    use mas_storage::{Clock, clock::MockClock};
     use oauth2_types::scope::{OPENID, Scope};
     use ulid::Ulid;
     use wiremock::{

crates/handlers/src/upstream_oauth2/callback.rs

@@ -14,13 +14,15 @@ use axum::{
 };
 use hyper::StatusCode;
 use mas_axum_utils::{GenericError, InternalError, cookies::CookieJar};
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderResponseMode};
+use mas_data_model::{
+    BoxClock, BoxRng, Clock, UpstreamOAuthProvider, UpstreamOAuthProviderResponseMode,
+};
 use mas_jose::claims::TokenHash;
 use mas_keystore::{Encrypter, Keystore};
 use mas_oidc_client::requests::jose::JwtVerificationData;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock,
+    BoxRepository,
     upstream_oauth2::{
         UpstreamOAuthLinkRepository, UpstreamOAuthProviderRepository,
         UpstreamOAuthSessionRepository,

crates/handlers/src/upstream_oauth2/cookie.rs

@@ -8,8 +8,8 @@
 
 use chrono::{DateTime, Duration, Utc};
 use mas_axum_utils::cookies::CookieJar;
+use mas_data_model::Clock;
 use mas_router::PostAuthAction;
-use mas_storage::Clock;
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use ulid::Ulid;

crates/handlers/src/upstream_oauth2/link.rs

@@ -19,13 +19,13 @@ use mas_axum_utils::{
     csrf::{CsrfExt, ProtectedForm},
     record_error,
 };
-use mas_data_model::UpstreamOAuthProviderOnConflict;
+use mas_data_model::{BoxClock, BoxRng, UpstreamOAuthProviderOnConflict};
 use mas_jose::jwt::Jwt;
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     upstream_oauth2::{UpstreamOAuthLinkRepository, UpstreamOAuthSessionRepository},
     user::{BrowserSessionRepository, UserEmailRepository, UserRepository},
@@ -1483,7 +1483,7 @@ mod tests {
 
     async fn add_linked_upstream_session(
         rng: &mut ChaChaRng,
-        clock: &impl mas_storage::Clock,
+        clock: &impl mas_data_model::Clock,
         repo: &mut Box<dyn Repository<RepositoryError> + Send + Sync + 'static>,
         provider: &mas_data_model::UpstreamOAuthProvider,
         subject: &str,

crates/handlers/src/views/app.rs

@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{AppContext, TemplateContext, Templates};
 use serde::Deserialize;
 

crates/handlers/src/views/index.rs

@@ -9,8 +9,9 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 use mas_axum_utils::{InternalError, cookies::CookieJar, csrf::CsrfExt};
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::UrlBuilder;
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{IndexContext, TemplateContext, Templates};
 
 use crate::{

crates/handlers/src/views/login.rs

@@ -17,12 +17,12 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::oauth2::LoginHint;
+use mas_data_model::{BoxClock, BoxRng, Clock, oauth2::LoginHint};
 use mas_i18n::DataLocale;
 use mas_matrix::HomeserverConnection;
 use mas_router::{UpstreamOAuth2Authorize, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, Clock, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     upstream_oauth2::UpstreamOAuthProviderRepository,
     user::{BrowserSessionRepository, UserPasswordRepository, UserRepository},
 };

crates/handlers/src/views/logout.rs

@@ -13,8 +13,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::BoxClock;
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, user::BrowserSessionRepository};
+use mas_storage::{BoxRepository, user::BrowserSessionRepository};
 
 use crate::BoundActivityTracker;
 

crates/handlers/src/views/recovery/progress.rs

@@ -15,10 +15,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{QueueJobRepositoryExt as _, SendAccountRecoveryEmailsJob},
 };
 use mas_templates::{EmptyContext, RecoveryProgressContext, TemplateContext, Templates};

crates/handlers/src/views/recovery/start.rs

@@ -18,10 +18,10 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{QueueJobRepositoryExt as _, SendAccountRecoveryEmailsJob},
 };
 use mas_templates::{

crates/handlers/src/views/register/cookie.rs

@@ -9,8 +9,7 @@ use std::collections::BTreeSet;
 
 use chrono::{DateTime, Duration, Utc};
 use mas_axum_utils::cookies::CookieJar;
-use mas_data_model::UserRegistration;
-use mas_storage::Clock;
+use mas_data_model::{Clock, UserRegistration};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use ulid::Ulid;

crates/handlers/src/views/register/mod.rs

@@ -8,9 +8,9 @@ use axum::{
     response::{Html, IntoResponse, Response},
 };
 use mas_axum_utils::{InternalError, SessionInfoExt, cookies::CookieJar, csrf::CsrfExt as _};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_router::{PasswordRegister, UpstreamOAuth2Authorize, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{RegisterContext, TemplateContext, Templates};
 
 use super::shared::OptionalPostAuthAction;

crates/handlers/src/views/register/password.rs

@@ -18,13 +18,13 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, CsrfToken, ProtectedForm},
 };
-use mas_data_model::CaptchaConfig;
+use mas_data_model::{BoxClock, BoxRng, CaptchaConfig};
 use mas_i18n::DataLocale;
 use mas_matrix::HomeserverConnection;
 use mas_policy::Policy;
 use mas_router::UrlBuilder;
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng, RepositoryAccess,
+    BoxRepository, RepositoryAccess,
     queue::{QueueJobRepositoryExt as _, SendEmailAuthenticationCodeJob},
     user::{UserEmailRepository, UserRepository},
 };

crates/handlers/src/views/register/steps/display_name.rs

@@ -14,8 +14,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt as _, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{
     FieldError, RegisterStepsDisplayNameContext, RegisterStepsDisplayNameFormField,
     TemplateContext as _, Templates, ToFormState,

crates/handlers/src/views/register/steps/finish.rs

@@ -13,11 +13,11 @@ use axum::{
 use axum_extra::TypedHeader;
 use chrono::Duration;
 use mas_axum_utils::{InternalError, SessionInfoExt as _, cookies::CookieJar};
-use mas_data_model::SiteConfig;
+use mas_data_model::{BoxClock, BoxRng, SiteConfig};
 use mas_matrix::HomeserverConnection;
 use mas_router::{PostAuthAction, UrlBuilder};
 use mas_storage::{
-    BoxClock, BoxRepository, BoxRng,
+    BoxRepository,
     queue::{ProvisionUserJob, QueueJobRepositoryExt as _},
     user::UserEmailFilter,
 };

crates/handlers/src/views/register/steps/registration_token.rs

@@ -14,8 +14,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt as _, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng};
+use mas_storage::BoxRepository;
 use mas_templates::{
     FieldError, RegisterStepsRegistrationTokenContext, RegisterStepsRegistrationTokenFormField,
     TemplateContext as _, Templates, ToFormState,

crates/handlers/src/views/register/steps/verify_email.rs

@@ -13,8 +13,9 @@ use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
 };
+use mas_data_model::{BoxClock, BoxRng};
 use mas_router::{PostAuthAction, UrlBuilder};
-use mas_storage::{BoxClock, BoxRepository, BoxRng, RepositoryAccess, user::UserEmailRepository};
+use mas_storage::{BoxRepository, RepositoryAccess, user::UserEmailRepository};
 use mas_templates::{
     FieldError, RegisterStepsVerifyEmailContext, RegisterStepsVerifyEmailFormField,
     TemplateContext, Templates, ToFormState,

crates/storage-pg/src/app_session.rs

@@ -7,9 +7,11 @@
 //! A module containing PostgreSQL implementation of repositories for sessions
 
 use async_trait::async_trait;
-use mas_data_model::{CompatSession, CompatSessionState, Device, Session, SessionState, User};
+use mas_data_model::{
+    Clock, CompatSession, CompatSessionState, Device, Session, SessionState, User,
+};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     app_session::{AppSession, AppSessionFilter, AppSessionRepository, AppSessionState},
     compat::CompatSessionFilter,
     oauth2::OAuth2SessionFilter,
@@ -523,11 +525,10 @@ impl AppSessionRepository for PgAppSessionRepository<'_> {
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::Device;
+    use mas_data_model::{Device, clock::MockClock};
     use mas_storage::{
         Pagination, RepositoryAccess,
         app_session::{AppSession, AppSessionFilter},
-        clock::MockClock,
         oauth2::OAuth2SessionRepository,
     };
     use oauth2_types::{

crates/storage-pg/src/compat/access_token.rs

@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_data_model::{CompatAccessToken, CompatSession};
-use mas_storage::{Clock, compat::CompatAccessTokenRepository};
+use mas_data_model::{Clock, CompatAccessToken, CompatSession};
+use mas_storage::compat::CompatAccessTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;

crates/storage-pg/src/compat/mod.rs

@@ -20,10 +20,9 @@ pub use self::{
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::Device;
+    use mas_data_model::{Clock, Device, clock::MockClock};
     use mas_storage::{
-        Clock, Pagination, RepositoryAccess,
-        clock::MockClock,
+        Pagination, RepositoryAccess,
         compat::{
             CompatAccessTokenRepository, CompatRefreshTokenRepository, CompatSessionFilter,
             CompatSessionRepository, CompatSsoLoginFilter,

crates/storage-pg/src/compat/refresh_token.rs

@@ -7,9 +7,9 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
+    Clock, CompatAccessToken, CompatRefreshToken, CompatRefreshTokenState, CompatSession,
 };
-use mas_storage::{Clock, compat::CompatRefreshTokenRepository};
+use mas_storage::compat::CompatRefreshTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;

crates/storage-pg/src/compat/session.rs

@@ -9,11 +9,11 @@ use std::net::IpAddr;
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    BrowserSession, CompatSession, CompatSessionState, CompatSsoLogin, CompatSsoLoginState, Device,
-    User,
+    BrowserSession, Clock, CompatSession, CompatSessionState, CompatSsoLogin, CompatSsoLoginState,
+    Device, User,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     compat::{CompatSessionFilter, CompatSessionRepository},
 };
 use rand::RngCore;

crates/storage-pg/src/compat/sso_login.rs

@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, CompatSession, CompatSsoLogin, CompatSsoLoginState};
+use mas_data_model::{BrowserSession, Clock, CompatSession, CompatSsoLogin, CompatSsoLoginState};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     compat::{CompatSsoLoginFilter, CompatSsoLoginRepository},
 };
 use rand::RngCore;

crates/storage-pg/src/lib.rs

@@ -22,7 +22,7 @@
 //! # use async_trait::async_trait;
 //! # use ulid::Ulid;
 //! # use rand::RngCore;
-//! # use mas_storage::Clock;
+//! # use mas_data_model::Clock;
 //! # use mas_storage_pg::{DatabaseError, ExecuteExt};
 //! # use sqlx::PgConnection;
 //! # use uuid::Uuid;

crates/storage-pg/src/oauth2/access_token.rs

@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_data_model::{AccessToken, AccessTokenState, Session};
-use mas_storage::{Clock, oauth2::OAuth2AccessTokenRepository};
+use mas_data_model::{AccessToken, AccessTokenState, Clock, Session};
+use mas_storage::oauth2::OAuth2AccessTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;

crates/storage-pg/src/oauth2/authorization_grant.rs

@@ -7,10 +7,10 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    AuthorizationCode, AuthorizationGrant, AuthorizationGrantStage, Client, Pkce, Session,
+    AuthorizationCode, AuthorizationGrant, AuthorizationGrantStage, Client, Clock, Pkce, Session,
 };
 use mas_iana::oauth::PkceCodeChallengeMethod;
-use mas_storage::{Clock, oauth2::OAuth2AuthorizationGrantRepository};
+use mas_storage::oauth2::OAuth2AuthorizationGrantRepository;
 use oauth2_types::{requests::ResponseMode, scope::Scope};
 use rand::RngCore;
 use sqlx::PgConnection;

crates/storage-pg/src/oauth2/client.rs

@@ -10,10 +10,10 @@ use std::{
 };
 
 use async_trait::async_trait;
-use mas_data_model::{Client, JwksOrJwksUri};
+use mas_data_model::{Client, Clock, JwksOrJwksUri};
 use mas_iana::{jose::JsonWebSignatureAlg, oauth::OAuthClientAuthenticationMethod};
 use mas_jose::jwk::PublicJsonWebKeySet;
-use mas_storage::{Clock, oauth2::OAuth2ClientRepository};
+use mas_storage::oauth2::OAuth2ClientRepository;
 use oauth2_types::{oidc::ApplicationType, requests::GrantType};
 use opentelemetry_semantic_conventions::attribute::DB_QUERY_TEXT;
 use rand::RngCore;

crates/storage-pg/src/oauth2/device_code_grant.rs

@@ -8,11 +8,8 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, DeviceCodeGrant, DeviceCodeGrantState, Session};
-use mas_storage::{
-    Clock,
-    oauth2::{OAuth2DeviceCodeGrantParams, OAuth2DeviceCodeGrantRepository},
-};
+use mas_data_model::{BrowserSession, Clock, DeviceCodeGrant, DeviceCodeGrantState, Session};
+use mas_storage::oauth2::{OAuth2DeviceCodeGrantParams, OAuth2DeviceCodeGrantRepository};
 use oauth2_types::scope::Scope;
 use rand::RngCore;
 use sqlx::PgConnection;

crates/storage-pg/src/oauth2/mod.rs

@@ -24,10 +24,9 @@ pub use self::{
 #[cfg(test)]
 mod tests {
     use chrono::Duration;
-    use mas_data_model::AuthorizationCode;
+    use mas_data_model::{AuthorizationCode, Clock, clock::MockClock};
     use mas_storage::{
-        Clock, Pagination,
-        clock::MockClock,
+        Pagination,
         oauth2::{OAuth2DeviceCodeGrantParams, OAuth2SessionFilter, OAuth2SessionRepository},
     };
     use oauth2_types::{

crates/storage-pg/src/oauth2/refresh_token.rs

@@ -6,8 +6,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{AccessToken, RefreshToken, RefreshTokenState, Session};
-use mas_storage::{Clock, oauth2::OAuth2RefreshTokenRepository};
+use mas_data_model::{AccessToken, Clock, RefreshToken, RefreshTokenState, Session};
+use mas_storage::oauth2::OAuth2RefreshTokenRepository;
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;

crates/storage-pg/src/oauth2/session.rs

@@ -8,9 +8,9 @@ use std::net::IpAddr;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{BrowserSession, Client, Session, SessionState, User};
+use mas_data_model::{BrowserSession, Client, Clock, Session, SessionState, User};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     oauth2::{OAuth2SessionFilter, OAuth2SessionRepository},
 };
 use oauth2_types::scope::{Scope, ScopeToken};

crates/storage-pg/src/policy_data.rs

@@ -7,8 +7,8 @@
 //! storage.
 
 use async_trait::async_trait;
-use mas_data_model::PolicyData;
-use mas_storage::{Clock, policy_data::PolicyDataRepository};
+use mas_data_model::{Clock, PolicyData};
+use mas_storage::policy_data::PolicyDataRepository;
 use rand::RngCore;
 use serde_json::Value;
 use sqlx::{PgConnection, types::Json};
@@ -151,7 +151,8 @@ impl PolicyDataRepository for PgPolicyDataRepository<'_> {
 
 #[cfg(test)]
 mod tests {
-    use mas_storage::{clock::MockClock, policy_data::PolicyDataRepository};
+    use mas_data_model::clock::MockClock;
+    use mas_storage::policy_data::PolicyDataRepository;
     use rand::SeedableRng;
     use rand_chacha::ChaChaRng;
     use serde_json::json;

crates/storage-pg/src/queue/job.rs

@@ -8,10 +8,8 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use mas_storage::{
-    Clock,
-    queue::{Job, QueueJobRepository, Worker},
-};
+use mas_data_model::Clock;
+use mas_storage::queue::{Job, QueueJobRepository, Worker};
 use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT;
 use rand::RngCore;
 use sqlx::PgConnection;

crates/storage-pg/src/queue/worker.rs

@@ -8,10 +8,8 @@
 
 use async_trait::async_trait;
 use chrono::Duration;
-use mas_storage::{
-    Clock,
-    queue::{QueueWorkerRepository, Worker},
-};
+use mas_data_model::Clock;
+use mas_storage::queue::{QueueWorkerRepository, Worker};
 use rand::RngCore;
 use sqlx::PgConnection;
 use ulid::Ulid;

crates/storage-pg/src/upstream_oauth2/link.rs

@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{UpstreamOAuthLink, UpstreamOAuthProvider, User};
+use mas_data_model::{Clock, UpstreamOAuthLink, UpstreamOAuthProvider, User};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{UpstreamOAuthLinkFilter, UpstreamOAuthLinkRepository},
 };
 use opentelemetry_semantic_conventions::trace::DB_QUERY_TEXT;

crates/storage-pg/src/upstream_oauth2/mod.rs

@@ -21,12 +21,11 @@ mod tests {
     use chrono::Duration;
     use mas_data_model::{
         UpstreamOAuthProviderClaimsImports, UpstreamOAuthProviderOnBackchannelLogout,
-        UpstreamOAuthProviderTokenAuthMethod,
+        UpstreamOAuthProviderTokenAuthMethod, clock::MockClock,
     };
     use mas_iana::jose::JsonWebSignatureAlg;
     use mas_storage::{
         Pagination, RepositoryAccess,
-        clock::MockClock,
         upstream_oauth2::{
             UpstreamOAuthLinkFilter, UpstreamOAuthLinkRepository, UpstreamOAuthProviderFilter,
             UpstreamOAuthProviderParams, UpstreamOAuthProviderRepository,

crates/storage-pg/src/upstream_oauth2/provider.rs

@@ -6,9 +6,9 @@
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use mas_data_model::{UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports};
+use mas_data_model::{Clock, UpstreamOAuthProvider, UpstreamOAuthProviderClaimsImports};
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{
         UpstreamOAuthProviderFilter, UpstreamOAuthProviderParams, UpstreamOAuthProviderRepository,
     },

crates/storage-pg/src/upstream_oauth2/session.rs

@@ -7,11 +7,11 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    UpstreamOAuthAuthorizationSession, UpstreamOAuthAuthorizationSessionState, UpstreamOAuthLink,
-    UpstreamOAuthProvider,
+    Clock, UpstreamOAuthAuthorizationSession, UpstreamOAuthAuthorizationSessionState,
+    UpstreamOAuthLink, UpstreamOAuthProvider,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     upstream_oauth2::{UpstreamOAuthSessionFilter, UpstreamOAuthSessionRepository},
 };
 use rand::RngCore;

crates/storage-pg/src/user/email.rs

@@ -7,11 +7,11 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use mas_data_model::{
-    BrowserSession, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
+    BrowserSession, Clock, User, UserEmail, UserEmailAuthentication, UserEmailAuthenticationCode,
     UserRegistration,
 };
 use mas_storage::{
-    Clock, Page, Pagination,
+    Page, Pagination,
     user::{UserEmailFilter, UserEmailRepository},
 };
 use rand::RngCore;

crates/storage-pg/src/user/mod.rs

@@ -8,11 +8,8 @@
 //! repositories
 
 use async_trait::async_trait;
-use mas_data_model::User;
-use mas_storage::{
-    Clock,
-    user::{UserFilter, UserRepository},
-};
+use mas_data_model::{Clock, User};
+use mas_storage::user::{UserFilter, UserRepository};
 use rand::RngCore;
 use sea_query::{Expr, PostgresQueryBuilder, Query};
 use sea_query_binder::SqlxBinder;