From e672df922d63a089f05dca003e187e2baa21a2c2 Mon Sep 17 00:00:00 2001
From: DeFiDude <59237470+DeFiDude@users.noreply.github.com>
Date: Thu, 7 May 2026 00:39:18 -0600
Subject: [PATCH] ci: align clippy with Rust 1.85

---
 clippy.toml                      |  2 ++
 crates/rns-crypto/src/aes_cbc.rs | 17 +++++++++++++----
 crates/rns-crypto/src/token.rs   |  2 +-
 3 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 clippy.toml

diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 0000000..566161e
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,2 @@
+# Keep Clippy suggestions aligned with the public MSRV in Cargo.toml.
+msrv = "1.85"
diff --git a/crates/rns-crypto/src/aes_cbc.rs b/crates/rns-crypto/src/aes_cbc.rs
index 230abd3..910bb14 100644
--- a/crates/rns-crypto/src/aes_cbc.rs
+++ b/crates/rns-crypto/src/aes_cbc.rs
@@ -8,6 +8,15 @@ use cbc::cipher::{BlockDecryptMut, BlockEncryptMut, KeyIvInit};
 use cbc::{Decryptor, Encryptor};
 use thiserror::Error;
 
+const AES_BLOCK_SIZE: usize = 16;
+
+/// Rust 1.85-compatible block alignment check. Newer Clippy suggests
+/// `usize::is_multiple_of`, but that API is not available on our MSRV.
+#[inline]
+pub(crate) fn is_nonzero_block_aligned(len: usize) -> bool {
+    len != 0 && len % AES_BLOCK_SIZE == 0
+}
+
 /// Errors surfaced by [`encrypt`] and [`decrypt`].
 #[derive(Debug, Error)]
 pub enum AesCbcError {
@@ -31,10 +40,10 @@ pub enum AesCbcError {
 /// AES-CBC encrypt. Caller pads; `plaintext.len()` must be a non-zero
 /// multiple of 16. IV must be 16 bytes.
 pub fn encrypt(key: &[u8], iv: &[u8], plaintext: &[u8]) -> Result<Vec<u8>, AesCbcError> {
-    if iv.len() != 16 {
+    if iv.len() != AES_BLOCK_SIZE {
         return Err(AesCbcError::InvalidIvLength(iv.len()));
     }
-    if plaintext.is_empty() || plaintext.len() % 16 != 0 {
+    if !is_nonzero_block_aligned(plaintext.len()) {
         return Err(AesCbcError::NotBlockAligned);
     }
 
@@ -65,10 +74,10 @@ pub fn encrypt(key: &[u8], iv: &[u8], plaintext: &[u8]) -> Result<Vec<u8>, AesCb
 
 /// AES-CBC decrypt. Output is still PKCS7-padded; caller strips it.
 pub fn decrypt(key: &[u8], iv: &[u8], ciphertext: &[u8]) -> Result<Vec<u8>, AesCbcError> {
-    if iv.len() != 16 {
+    if iv.len() != AES_BLOCK_SIZE {
         return Err(AesCbcError::InvalidIvLength(iv.len()));
     }
-    if ciphertext.is_empty() || ciphertext.len() % 16 != 0 {
+    if !is_nonzero_block_aligned(ciphertext.len()) {
         return Err(AesCbcError::NotBlockAligned);
     }
 
diff --git a/crates/rns-crypto/src/token.rs b/crates/rns-crypto/src/token.rs
index 09626a5..02f8a26 100644
--- a/crates/rns-crypto/src/token.rs
+++ b/crates/rns-crypto/src/token.rs
@@ -85,7 +85,7 @@ pub fn decrypt(token: &[u8], key: &[u8]) -> Result<Vec<u8>, TokenError> {
     let iv = &signed_parts[..16];
     let ciphertext = &signed_parts[16..];
 
-    if ciphertext.is_empty() || ciphertext.len() % 16 != 0 {
+    if !aes_cbc::is_nonzero_block_aligned(ciphertext.len()) {
         return Err(TokenError::AuthenticationFailed);
     }