Remove unused response bodies from a number of API endpoints.

This removes the response body from the following methods:

* `POST /api/setup`
* `POST /api/auth/login`
* `POST /api/invite/:id`
* `POST /api/password`

The bodies returned from these methods were something of a rough guess as to what might be useful. Actual client development has shown that we don't use _any_ of the data from any of these API responses, so let's not tie ourselves to future compatibility by continuing to send them. We can add a body to a bodyless method a _lot_ more easily than we can change the body of a method that already returns one, after all.

These changes are not backwards compatible for clients which care about the existing bodies. To my knowledge, there are no such clients; the included client definitely doesn't care.

## Internals

Not only does this change stop returning bodies at the API surface, but it also stops retrieving and returning values used internally to construct those responses, simplifying the code a bit in the process.

One side effect of this is that tests that need to log in a user now need to manually verify the returned token secret, to convert it back into a user, whereas the previous versions returned both a token secret and a user during password login. I don't love the increase in the size of the tests, but I think it's the right tradeoff (and this change is code net-negative anyways).

Merges no-content into main.

1 files changed, 10 insertions, 12 deletions

diff --git a/src/token/app.rs b/src/token/app.rs
index 49f9a45..56c0e21 100644
--- a/src/token/app.rs
+++ b/src/token/app.rs
@@ -32,7 +32,7 @@ impl<'a> Tokens<'a> {
         name: &Name,
         password: &Password,
         login_at: &DateTime,
-    ) -> Result<(User, Secret), LoginError> {
+    ) -> Result<Secret, LoginError> {
         let mut tx = self.db.begin().await?;
         let (user, stored_hash) = tx
             .auth()
@@ -47,18 +47,16 @@ impl<'a> Tokens<'a> {
         // if the account is deleted during that time.
         tx.commit().await?;
 
-        let snapshot = user.as_snapshot().ok_or(LoginError::Rejected)?;
+        user.as_snapshot().ok_or(LoginError::Rejected)?;
 
-        let token = if stored_hash.verify(password)? {
+        if stored_hash.verify(password)? {
             let mut tx = self.db.begin().await?;
-            let token = tx.tokens().issue(&user, login_at).await?;
+            let secret = tx.tokens().issue(&user, login_at).await?;
             tx.commit().await?;
-            token
+            Ok(secret)
         } else {
-            Err(LoginError::Rejected)?
-        };
-
-        Ok((snapshot, token))
+            Err(LoginError::Rejected)
+        }
     }
 
     pub async fn change_password(
@@ -67,7 +65,7 @@ impl<'a> Tokens<'a> {
         password: &Password,
         to: &Password,
         changed_at: &DateTime,
-    ) -> Result<(User, Secret), LoginError> {
+    ) -> Result<Secret, LoginError> {
         let mut tx = self.db.begin().await?;
         let (user, stored_hash) = tx
             .auth()
@@ -86,7 +84,7 @@ impl<'a> Tokens<'a> {
             return Err(LoginError::Rejected);
         }
 
-        let snapshot = user.as_snapshot().ok_or(LoginError::Rejected)?;
+        user.as_snapshot().ok_or(LoginError::Rejected)?;
         let to_hash = to.hash()?;
 
         let mut tx = self.db.begin().await?;
@@ -99,7 +97,7 @@ impl<'a> Tokens<'a> {
             self.token_events.broadcast(event);
         }
 
-        Ok((snapshot, secret))
+        Ok(secret)
     }
 
     pub async fn validate(