hecks 2.9.0 → 3.0.0

data/rust/host/src/wasm_runner.rs

@@ -0,0 +1,191 @@
+// Runs the compiled `.wasm` artifact through an embedded wasmtime
+// instance — the only place in this crate that touches wasmtime.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, OnceLock};
+use tokio::io::{AsyncRead, AsyncWrite};
+use wasmtime::{Engine, Linker, Module, Store};
+use wasmtime_wasi::cli::{IsTerminal, StdinStream, StdoutStream};
+use wasmtime_wasi::p1::{self, WasiP1Ctx};
+use wasmtime_wasi::p2::pipe::{MemoryInputPipe, MemoryOutputPipe};
+use wasmtime_wasi::WasiCtxBuilder;
+
+#[derive(Clone)]
+struct StepsIn(MemoryInputPipe);
+
+impl IsTerminal for StepsIn {
+    fn is_terminal(&self) -> bool {
+        false
+    }
+}
+
+impl StdinStream for StepsIn {
+    fn async_stream(&self) -> Box<dyn AsyncRead + Send + Sync> {
+        Box::new(self.0.clone())
+    }
+}
+
+#[derive(Clone)]
+struct StepsOut(MemoryOutputPipe);
+
+impl IsTerminal for StepsOut {
+    fn is_terminal(&self) -> bool {
+        false
+    }
+}
+
+impl StdoutStream for StepsOut {
+    fn async_stream(&self) -> Box<dyn AsyncWrite + Send + Sync> {
+        Box::new(self.0.clone())
+    }
+}
+
+// Cached per (warm) process, not per call — `Engine`/`Module` hold only
+// the compiled artifact, so caching leaks nothing between invocations.
+// Recompiling on every warm call would cost real seconds per dispatch,
+// and `dispatch::read`'s snapshot fast path never reaches here at all.
+//
+// Keyed by `wasm_path`, not one shared slot: a single test binary can
+// dispatch against two domains' `.wasm` files at once, and a bare
+// `OnceLock<(Engine, Module)>` would silently serve one domain's
+// compiled module to the other's dispatch calls.
+static ENGINE_AND_MODULE: OnceLock<Mutex<HashMap<PathBuf, Arc<Compiled>>>> = OnceLock::new();
+
+/// One path's compiled module, empty until first compiled. The cell's
+/// lock is the single-flight gate other callers for the same path queue on.
+type Compiled = Mutex<Option<(Engine, Module)>>;
+
+/// Compiles `wasm_path` once per process, however many callers ask at
+/// once — later callers for the same path block on the first one's
+/// compile rather than each paying for their own. A failed compile
+/// leaves the cell empty for the next caller to retry.
+fn engine_and_module(wasm_path: &Path) -> anyhow::Result<(Engine, Module)> {
+    let cache = ENGINE_AND_MODULE.get_or_init(|| Mutex::new(HashMap::new()));
+    let cell = Arc::clone(cache.lock().unwrap().entry(wasm_path.to_path_buf()).or_default());
+
+    let mut compiled = cell.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+    if let Some((engine, module)) = compiled.as_ref() {
+        return Ok((engine.clone(), module.clone()));
+    }
+    let engine = Engine::default();
+    let module = Module::from_file(&engine, wasm_path)?;
+    #[cfg(test)]
+    COMPILED_PATHS.lock().unwrap().push(wasm_path.to_path_buf());
+    *compiled = Some((engine.clone(), module.clone()));
+    Ok((engine, module))
+}
+
+/// Every path `engine_and_module` has compiled, one entry per compile, so
+/// a test can tell one compile from a burst of them.
+#[cfg(test)]
+static COMPILED_PATHS: Mutex<Vec<PathBuf>> = Mutex::new(Vec::new());
+
+/// How many times `wasm_path` has been compiled in this process.
+#[cfg(test)]
+pub(crate) fn compile_count(wasm_path: &Path) -> usize {
+    COMPILED_PATHS.lock().unwrap().iter().filter(|compiled| compiled.as_path() == wasm_path).count()
+}
+
+/// Compiles `wasm_path` at boot, before the host starts listening, so
+/// the first real request meets an already-compiled module.
+pub fn warm(wasm_path: &Path) -> anyhow::Result<()> {
+    engine_and_module(wasm_path).map(|_| ())
+}
+
+/// Runs `wasm_path` (a wasm32-wasip1 module speaking the `{"steps"}` ->
+/// `{"instances","events","refusals"}` contract) against `input`,
+/// returning its stdout. `Store`/`Linker` are fresh every call.
+pub fn run(wasm_path: &Path, input: &str) -> anyhow::Result<String> {
+    let (engine, module) = engine_and_module(wasm_path)?;
+
+    let mut linker: Linker<WasiP1Ctx> = Linker::new(&engine);
+    p1::add_to_linker_sync(&mut linker, |ctx| ctx)?;
+
+    let stdout_pipe = MemoryOutputPipe::new(64 * 1024 * 1024);
+    let wasi_ctx = WasiCtxBuilder::new()
+        .stdin(StepsIn(MemoryInputPipe::new(input.to_string())))
+        .stdout(StepsOut(stdout_pipe.clone()))
+        .build_p1();
+
+    let mut store = Store::new(&engine, wasi_ctx);
+    let instance = linker.instantiate(&mut store, &module)?;
+    let start = instance.get_typed_func::<(), ()>(&mut store, "_start")?;
+
+    // A WASI "command" module calls `proc_exit` (an `I32Exit` trap) on
+    // ordinary completion too — exit code 0 is success here, same as a
+    // native process's exit status after `main` returns.
+    match start.call(&mut store, ()) {
+        Ok(()) => {}
+        Err(err) => {
+            if let Some(exit) = err.downcast_ref::<wasmtime_wasi::I32Exit>() {
+                if exit.0 != 0 {
+                    anyhow::bail!("wasm module exited with status {}", exit.0);
+                }
+            } else {
+                return Err(err.into());
+            }
+        }
+    }
+
+    drop(store);
+    Ok(String::from_utf8(stdout_pipe.contents().to_vec())?)
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    /// A copy of the checkout fixture wasm at a path no other test uses, so
+    /// its first call is a real cold compile whatever order tests run in.
+    pub(crate) fn cold_copy_of_fixture(name: &str) -> PathBuf {
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist/checkout_fixture.wasm");
+        let dir = std::env::temp_dir().join(format!("hecks_wasm_runner_{}_{name}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let copy = dir.join("checkout_fixture.wasm");
+        std::fs::copy(&source, &copy).expect("hecks build_wasm writes checkout_fixture.wasm");
+        copy
+    }
+
+    /// A burst of concurrent cold callers compiles the module exactly
+    /// once; paying per-caller would make a cold burst slower than one
+    /// compile and let retries after a timeout pile up faster than they finish.
+    #[test]
+    fn a_burst_of_cold_callers_compiles_the_module_once() {
+        let path = cold_copy_of_fixture("burst");
+        let callers: Vec<_> = (0..8)
+            .map(|_| {
+                let path = path.clone();
+                std::thread::spawn(move || engine_and_module(&path).map(|_| ()))
+            })
+            .collect();
+        for caller in callers {
+            caller.join().unwrap().unwrap();
+        }
+        assert_eq!(compile_count(&path), 1);
+    }
+
+    #[test]
+    fn a_warmed_module_is_not_compiled_again_by_the_first_run() {
+        let path = cold_copy_of_fixture("warm");
+        warm(&path).unwrap();
+        assert_eq!(compile_count(&path), 1);
+
+        let answer = run(&path, r#"{"steps": []}"#).unwrap();
+        assert!(answer.contains("instances"), "got {answer}");
+        assert_eq!(compile_count(&path), 1, "run reused the warmed module");
+    }
+
+    #[test]
+    fn a_module_that_fails_to_compile_is_retried_by_the_next_caller() {
+        let path = cold_copy_of_fixture("retry");
+        let good = std::fs::read(&path).unwrap();
+        std::fs::write(&path, b"not a wasm module").unwrap();
+        assert!(warm(&path).is_err());
+        assert_eq!(compile_count(&path), 0);
+
+        std::fs::write(&path, good).unwrap();
+        warm(&path).unwrap();
+        assert_eq!(compile_count(&path), 1);
+    }
+}

data/rust/host/src/web/newsletter/cooldown.rs

@@ -0,0 +1,126 @@
+use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+/// How long an address is left alone after a confirmation email went to it.
+pub(super) const WINDOW: Duration = Duration::from_secs(10 * 60);
+
+/// The most addresses remembered; past it a new address is refused, not evicting a live one.
+pub(super) const CAPACITY: usize = 10_000;
+
+/// A per-address cooldown on confirmation emails, so the form cannot mail-bomb someone.
+///
+/// In-process: not shared between tasks and lost on restart, so each task has its own window.
+pub(super) struct ConfirmationCooldown {
+    window: Duration,
+    capacity: usize,
+    last_sent: Mutex<HashMap<String, Instant>>,
+}
+
+impl ConfirmationCooldown {
+    pub(super) fn new(window: Duration, capacity: usize) -> Self {
+        Self { window, capacity, last_sent: Mutex::new(HashMap::new()) }
+    }
+
+    /// Whether an email may go to `email` now (keyed by lowercased address). A `true` records the
+    /// send, so the caller must then send.
+    pub(super) fn try_acquire(&self, email: &str) -> bool {
+        self.try_acquire_at(email, Instant::now())
+    }
+
+    /// `try_acquire` with the clock supplied, so tests need not sleep.
+    pub(super) fn try_acquire_at(&self, email: &str, now: Instant) -> bool {
+        let key = email.to_lowercase();
+        let mut last_sent = self.last_sent.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+        let window = self.window;
+        last_sent.retain(|_, sent| now.saturating_duration_since(*sent) < window);
+        if last_sent.contains_key(&key) || last_sent.len() >= self.capacity {
+            return false;
+        }
+        last_sent.insert(key, now);
+        true
+    }
+
+    #[cfg(test)]
+    fn remembered(&self) -> usize {
+        self.last_sent.lock().unwrap().len()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn cooldown() -> ConfirmationCooldown {
+        ConfirmationCooldown::new(Duration::from_secs(600), 3)
+    }
+
+    #[test]
+    fn the_first_send_is_allowed_and_a_second_inside_the_window_is_not() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("a@example.com", start));
+        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(1)));
+        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(599)));
+    }
+
+    #[test]
+    fn the_address_is_allowed_again_once_the_window_has_passed() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("a@example.com", start));
+        assert!(cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(600)));
+        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(601)));
+    }
+
+    #[test]
+    fn a_refused_attempt_does_not_extend_the_window() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("a@example.com", start));
+        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(500)));
+        assert!(cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(600)));
+    }
+
+    #[test]
+    fn the_key_is_the_lowercased_address() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("Ann@Example.com", start));
+        assert!(!cooldown.try_acquire_at("ann@example.COM", start));
+    }
+
+    #[test]
+    fn different_addresses_do_not_limit_each_other() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("a@example.com", start));
+        assert!(cooldown.try_acquire_at("b@example.com", start));
+    }
+
+    #[test]
+    fn expired_entries_are_pruned() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        cooldown.try_acquire_at("a@example.com", start);
+        cooldown.try_acquire_at("b@example.com", start);
+        assert_eq!(cooldown.remembered(), 2);
+        assert!(cooldown.try_acquire_at("c@example.com", start + Duration::from_secs(700)));
+        assert_eq!(cooldown.remembered(), 1);
+    }
+
+    #[test]
+    fn at_capacity_a_new_address_is_refused_and_no_live_entry_is_evicted() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        for address in ["a@example.com", "b@example.com", "c@example.com"] {
+            assert!(cooldown.try_acquire_at(address, start));
+        }
+        assert!(!cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(1)));
+        assert_eq!(cooldown.remembered(), 3);
+        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(1)));
+    }
+
+    #[test]
+    fn at_capacity_expired_entries_make_room_first() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        for address in ["a@example.com", "b@example.com", "c@example.com"] {
+            assert!(cooldown.try_acquire_at(address, start));
+        }
+        assert!(cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(600)));
+        assert_eq!(cooldown.remembered(), 1);
+    }
+}

data/rust/host/src/web/newsletter/tests.rs

@@ -0,0 +1,104 @@
+use super::*;
+
+#[test]
+fn a_confirm_token_verifies_only_for_the_address_it_was_minted_for() {
+    let token = confirm_token("s3cret-value", "a@example.com");
+    assert!(confirm_token_matches("s3cret-value", &token, "a@example.com"));
+    assert!(!confirm_token_matches("s3cret-value", &token, "b@example.com"));
+}
+
+#[test]
+fn a_confirm_token_signed_with_another_secret_is_refused() {
+    let token = confirm_token("one-secret", "a@example.com");
+    assert!(!confirm_token_matches("another-secret", &token, "a@example.com"));
+}
+
+#[test]
+fn a_token_minted_for_another_purpose_is_not_a_confirm_token() {
+    let other = auth::purpose_token("s3cret-value", "account-sso", json!({ "email": "a@example.com" }), 60);
+    assert!(!confirm_token_matches("s3cret-value", &other, "a@example.com"));
+}
+
+#[test]
+fn an_expired_or_garbled_token_is_refused() {
+    let expired = auth::purpose_token("s3cret-value", CONFIRM_PURPOSE, json!({ "email": "a@example.com" }), 0);
+    std::thread::sleep(std::time::Duration::from_millis(1100));
+    assert!(!confirm_token_matches("s3cret-value", &expired, "a@example.com"));
+    assert!(!confirm_token_matches("s3cret-value", "not-a-token", "a@example.com"));
+    assert!(!confirm_token_matches("s3cret-value", "", "a@example.com"));
+}
+
+#[test]
+fn the_confirm_url_carries_the_encoded_address_and_the_token() {
+    let url = confirm_url("https://example.com", "a+b@example.com", "tok.en");
+    assert_eq!(url, "https://example.com/newsletter-confirmed.html?email=a%2Bb%40example.com&token=tok.en");
+}
+
+#[test]
+fn the_confirmation_email_holds_the_link_and_says_it_can_be_ignored() {
+    let body = confirmation_body("https://example.com/newsletter-confirmed.html?email=a%40b.c&token=t");
+    assert!(body.contains("https://example.com/newsletter-confirmed.html?email=a%40b.c&token=t"));
+    assert!(body.contains("ignore this email"));
+}
+
+fn unsubscribe_query(pairs: &[(&str, &str)]) -> HashMap<String, String> {
+    pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect()
+}
+
+fn status_and_error(response: &Value) -> (u64, String) {
+    let body: Value = serde_json::from_str(response["body"].as_str().unwrap()).unwrap();
+    (response["statusCode"].as_u64().unwrap(), body["error"].as_str().unwrap_or("").to_string())
+}
+
+#[test]
+fn an_unsubscribe_request_with_a_token_for_its_own_address_is_authorized() {
+    let token = unsubscribe_token("s3cret-value", "a@example.com");
+    let query = unsubscribe_query(&[("email", "a@example.com"), ("token", &token)]);
+    assert_eq!(unsubscribe_authorized(Some("s3cret-value"), &query).unwrap(), "a@example.com");
+}
+
+#[test]
+fn an_unsubscribe_request_without_a_valid_token_is_a_403() {
+    let refusal = "this unsubscribe link is invalid or has expired";
+    let own = unsubscribe_token("s3cret-value", "a@example.com");
+    let other = unsubscribe_token("s3cret-value", "b@example.com");
+    let confirm = confirm_token("s3cret-value", "a@example.com");
+    let expired = auth::purpose_token("s3cret-value", "newsletter-unsubscribe", json!({ "email": "a@example.com" }), 0);
+    std::thread::sleep(std::time::Duration::from_millis(1100));
+    let cases = [
+        unsubscribe_query(&[("email", "a@example.com")]),
+        unsubscribe_query(&[("email", "a@example.com"), ("token", "")]),
+        unsubscribe_query(&[("email", "a@example.com"), ("token", "bogus")]),
+        unsubscribe_query(&[("email", "a@example.com"), ("token", &other)]),
+        unsubscribe_query(&[("email", "a@example.com"), ("token", &confirm)]),
+        unsubscribe_query(&[("email", "a@example.com"), ("token", &expired)]),
+        unsubscribe_query(&[("email", "b@example.com"), ("token", &own)]),
+    ];
+    for query in &cases {
+        let err = unsubscribe_authorized(Some("s3cret-value"), query).unwrap_err();
+        assert_eq!(status_and_error(&err), (403, refusal.to_string()), "{query:?}");
+        assert_eq!(err["body"], json!({ "error": refusal }).to_string());
+    }
+}
+
+#[test]
+fn an_unsubscribe_request_is_refused_when_there_is_no_secret_to_check_against() {
+    let token = unsubscribe_token("s3cret-value", "a@example.com");
+    let query = unsubscribe_query(&[("email", "a@example.com"), ("token", &token)]);
+    assert_eq!(unsubscribe_authorized(None, &query).unwrap_err()["statusCode"], 403);
+}
+
+#[test]
+fn an_unsubscribe_request_without_an_address_is_a_400() {
+    let token = unsubscribe_token("s3cret-value", "a@example.com");
+    let err = unsubscribe_authorized(Some("s3cret-value"), &unsubscribe_query(&[("token", &token)])).unwrap_err();
+    assert_eq!(err["statusCode"], 400);
+}
+
+#[test]
+fn a_confirm_token_is_not_an_unsubscribe_token_and_the_reverse() {
+    let confirm = confirm_token("s3cret-value", "a@example.com");
+    let unsubscribe = unsubscribe_token("s3cret-value", "a@example.com");
+    assert!(!unsubscribe_token_matches("s3cret-value", &confirm, "a@example.com"));
+    assert!(!confirm_token_matches("s3cret-value", &unsubscribe, "a@example.com"));
+}