Remove unused response bodies from a number of API endpoints.

This removes the response body from the following methods:

* `POST /api/setup`
* `POST /api/auth/login`
* `POST /api/invite/:id`
* `POST /api/password`

The bodies returned from these methods were something of a rough guess as to what might be useful. Actual client development has shown that we don't use _any_ of the data from any of these API responses, so let's not tie ourselves to future compatibility by continuing to send them. We can add a body to a bodyless method a _lot_ more easily than we can change the body of a method that already returns one, after all.

These changes are not backwards compatible for clients which care about the existing bodies. To my knowledge, there are no such clients; the included client definitely doesn't care.

## Internals

Not only does this change stop returning bodies at the API surface, but it also stops retrieving and returning values used internally to construct those responses, simplifying the code a bit in the process.

One side effect of this is that tests that need to log in a user now need to manually verify the returned token secret, to convert it back into a user, whereas the previous versions returned both a token secret and a user during password login. I don't love the increase in the size of the tests, but I think it's the right tradeoff (and this change is code net-negative anyways).

Merges no-content into main.

2 files changed, 14 insertions, 10 deletions

diff --git a/src/invite/handlers/accept/mod.rs b/src/invite/handlers/accept/mod.rs
index 9fa4d6a..cdf385f 100644
--- a/src/invite/handlers/accept/mod.rs
+++ b/src/invite/handlers/accept/mod.rs
@@ -7,12 +7,12 @@ use axum::{
 use crate::{
     app::App,
     clock::RequestedAt,
+    empty::Empty,
     error::{Internal, NotFound},
     invite::{app, handlers::PathInfo},
     name::Name,
     password::Password,
     token::extract::IdentityCookie,
-    user::User,
 };
 
 #[cfg(test)]
@@ -24,14 +24,14 @@ pub async fn handler(
     identity: IdentityCookie,
     Path(invite): Path<PathInfo>,
     Json(request): Json<Request>,
-) -> Result<(IdentityCookie, Json<User>), Error> {
-    let (login, secret) = app
+) -> Result<(IdentityCookie, Empty), Error> {
+    let secret = app
         .invites()
         .accept(&invite, &request.name, &request.password, &accepted_at)
         .await
         .map_err(Error)?;
     let identity = identity.set(secret);
-    Ok((identity, Json(login)))
+    Ok((identity, Empty))
 }
 
 #[derive(serde::Deserialize)]
diff --git a/src/invite/handlers/accept/test.rs b/src/invite/handlers/accept/test.rs
index cb13900..adc7aa4 100644
--- a/src/invite/handlers/accept/test.rs
+++ b/src/invite/handlers/accept/test.rs
@@ -1,6 +1,6 @@
 use axum::extract::{Json, Path, State};
 
-use crate::{invite::app::AcceptError, name::Name, test::fixtures};
+use crate::{empty::Empty, invite::app::AcceptError, name::Name, test::fixtures};
 
 #[tokio::test]
 async fn valid_invite() {
@@ -18,7 +18,7 @@ async fn valid_invite() {
         name: name.clone(),
         password: password.clone(),
     };
-    let (identity, Json(response)) = super::handler(
+    let (identity, Empty) = super::handler(
         State(app.clone()),
         fixtures::now(),
         identity,
@@ -31,7 +31,6 @@ async fn valid_invite() {
     // Verify the response
 
     assert!(identity.secret().is_some());
-    assert_eq!(name, response.name);
 
     // Verify that the issued token is valid
 
@@ -43,16 +42,21 @@ async fn valid_invite() {
         .validate(&secret, &fixtures::now())
         .await
         .expect("newly-issued identity cookie is valid");
-    assert_eq!(response, login);
+    assert_eq!(name, login.name);
 
     // Verify that the given credentials can log in
 
-    let (login, _) = app
+    let secret = app
         .tokens()
         .login(&name, &password, &fixtures::now())
         .await
         .expect("credentials given on signup are valid");
-    assert_eq!(response, login);
+    let (_, login) = app
+        .tokens()
+        .validate(&secret, &fixtures::now())
+        .await
+        .expect("validating a newly-issued token secret succeeds");
+    assert_eq!(name, login.name);
 }
 
 #[tokio::test]