api: a stream opened with a token ends with it

A token was checked when a request came, and a stream answered to it (the dashboard's
events, a subscription's links and messages, the store's streams) then went on for as
long as the client kept it open: past the token's expiry, past its user's tokens being
revoked, its user disabled or removed, its session ended.

Now a middleware inside `login::bearer` (`login::streams_end`) ends a streaming answer
(`text/event-stream`, `application/x-ndjson`) to a request with a token at the token's
deadline, its expiry, or as soon as the document no longer takes it
(`token::still_taken`, the checks `verify` makes of the document, now its own
function): looked at when a change touches protocol data (the root, a switch, among
it), and when a session ends on the node itself in a swarm without a registry
(`AppState::session_ended`). No polling: a timer for the expiry, and the changes as
they come. The client reconnects with the token it has then; a refreshed token is a
new one, so a stream lasts a token's lifetime at most (12 hours by default).

`futures` is a dependency of every build now (for `take_until`), not only of libp2p's
and Tor's.

1 files changed, 3 insertions, 3 deletions

diff --git a/Cargo.toml b/Cargo.toml
index e6cd6c6..920cbfe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ dashboard = []
 # supervises or one running elsewhere.
 mycelium = ["dep:reqwest", "dep:rustls", "dep:libc"]
 # The libp2p transport (`--libp2p-enable`).
-libp2p = ["dep:libp2p", "dep:libp2p-stream", "dep:futures"]
+libp2p = ["dep:libp2p", "dep:libp2p-stream"]
 # The Tor transport (`--tor-enable`): onion services, with arti.
 tor = [
     "dep:arti-client",
@@ -22,7 +22,6 @@ tor = [
     "dep:tor-proto",
     "dep:tor-rtcompat",
     "dep:safelog",
-    "dep:futures",
 ]
 
 [dependencies]
@@ -48,7 +47,8 @@ clap = "4.6"
 dashmap = "6.2"
 # Deflate (pure Rust), for large sync messages; Automerge uses it already.
 flate2 = "1.1"
-futures = { version = "0.3", optional = true }
+# Streams: an API stream ended with its token (`api::login::streams_end`), libp2p, tor.
+futures = "0.3"
 libp2p = { version = "0.57", optional = true, features = ["tokio", "tcp", "quic", "dns", "noise", "yamux", "ed25519", "identify", "ping", "macros", "relay", "dcutr", "upnp", "autonat", "mdns", "kad"] }
 libp2p-stream = { version = "0.5.0-alpha", optional = true }
 ed25519-dalek = "3"