hecks 3.1.1 → 3.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8bfb40ad9e9760533d77e179154821128fee28930877e35118b5e87c5c32731
-  data.tar.gz: 49fd0e562e846d8633c11101d7b11c6d751089c8ca0f281907f1c669e1d19438
+  metadata.gz: 508adf3c37fdb512fe3fa7ba61d7f614742a76b750f0072a363bec69bc99cefd
+  data.tar.gz: 825f357d3d68ccab74ba071fc4ab3abc412ffc38458968d9f038a769e2039382
 SHA512:
-  metadata.gz: e584bed9d83942763f583530d44910d6a988c7b55af6a4177f257ba017562957f373ea7ea726340b7ae845e2811d7217665ab6815991ae9cffb0e6cb437928c2
-  data.tar.gz: 6cac69c95c6dedc28736d5401d64a6597327c27b8d3ed1909c225ad6191c4cb0cac929ac9f3896f5c648c890d75b10d6d4b3d5431498e82e560bd682f2dc312d
+  metadata.gz: e55bd4e1b03b8399b7dc189bee0cd126a00ec315eed8c1060cd0dd237c443c61af26d6005af246c1855f54f683d710646bf7b05fbb068335c14fbb01eb5cdcef
+  data.tar.gz: 300db7e2fd71722c2627fa1bcc96c992776d87e796db3cdc83570eb8b48f2200c05def67bea1f116a30506c613f69e44a4573d36f3e36fd5bc394687b694855f

data/lib/hecks/projections/deploy/box/settings.rb

@@ -79,7 +79,7 @@ module Hecks
             :infra_name, :stack_prefix, :instance_type, :volume_gb, :swap_gb, :database_class,
             :storage_gb, :backup_days, :snapshots_keep, :database_name, :engine_version,
             :containers, :routes, :default_container, :origin_header, :origin_secret,
-            :secret_prefixes, :tunnel, :tunnel_service, :proxy_image, :task_definition,
+            :secret_prefixes, :writable_secrets, :tunnel, :tunnel_service, :proxy_image, :task_definition,
             :migration, :s3_buckets, keyword_init: true
           ) do
             # @return [String] the CloudFormation stack that holds the database
@@ -119,6 +119,7 @@ module Hecks
               containers: containers, routes: read_routes(s.fetch(:routes, []), containers),
               default_container: read_default(s[:default_container], containers), origin_header: header,
               origin_secret: secret, secret_prefixes: read_prefixes(s, infra_name),
+              writable_secrets: read_writable_secrets(s),
               tunnel: tunnel, tunnel_service: tunnel_service,
               proxy_image: check(:proxy_image, s.fetch(:proxy_image, PROXY_IMAGE), IMAGE),
               task_definition: task_definition, migration: read_migration(s[:migration], database_name),
@@ -283,6 +284,12 @@ module Hecks
             list.map { |p| check(:secret_prefixes, p, SECRET_NAME) }
           end
 
+          # Secrets the box may overwrite, such as one an admin page stores a key in. Production
+          # only: a rehearsal box never changes a secret.
+          def read_writable_secrets(settings)
+            Array(settings.fetch(:writable_secrets, [])).map { |name| check(:writable_secrets, name, SECRET_NAME) }
+          end
+
           def string_map(key, value, key_pattern, value_pattern)
             raise ArgumentError, "#{key}: expected a hash" unless value.is_a?(Hash)
 

data/lib/hecks/projections/deploy/box/templates/box.yaml.tmpl

@@ -104,6 +104,7 @@ Resources:
                 Resource:
                   - !Ref DbSecretArn
 @@SECRET_RESOURCES@@
+@@WRITABLE_SECRETS@@
 @@S3_POLICY@@
 
   BoxProfile:

data/lib/hecks/projections/deploy/box/templates/deploy-box.sh.tmpl

@@ -18,6 +18,19 @@ DB_SECRET=$(out "$RDS_STACK" DbSecretArn)
 ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
 
 WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+
+# SMOKE_LISTENER=1 (a rehearsal box only) mounts a loopback HTTPS site on 127.0.0.1:8443 that adds the
+# origin secret, so a browser-driven smoke run can reach the box through an SSM port-forward without the
+# CDN. TLS because a site that treats a request carrying the origin secret as https expects an https
+# Origin on every form post.
+cat > "$WORK/smoke.caddy" <<'SMOKE_EOF'
+https://127.0.0.1:8443 {
+	tls internal
+	reverse_proxy 127.0.0.1:80 {
+@@SMOKE_HEADER@@
+	}
+}
+SMOKE_EOF
 ( cd "$WORK" && bash "$HERE/render-compose.sh" "$DB_HOST" "$DB_SECRET" "$@" )
 
 # Run a script on the box over SSM, wait for it, print its output, return its status.
@@ -38,12 +51,14 @@ run_on_box() {
 B64() { base64 < "$1" | tr -d '\n'; }
 ROLL=$(jq -n --arg compose "$(B64 "$WORK/compose.json")" --arg secrets "$(B64 "$WORK/secrets.json")" \
   --arg caddy "$(B64 "$HERE/Caddyfile")" --arg fetch "$(B64 "$HERE/fetch-secrets.sh")" \
+  --arg smokefile "$(B64 "$WORK/smoke.caddy")" --arg smoke "${SMOKE_LISTENER:-}" \
   --arg registry "$ACCOUNT.dkr.ecr.$REGION.amazonaws.com" --arg dir "$DIR" '
   {commands: ["cloud-init status --wait >/dev/null 2>&1 || true",
     "set -e", "mkdir -p \($dir)/caddy-extra && cd \($dir)", "umask 077",
     "echo \($compose) | base64 -d > compose.json; echo \($secrets) | base64 -d > secrets.json",
     "echo \($caddy) | base64 -d > Caddyfile; echo \($fetch) | base64 -d > fetch-secrets.sh",
     "bash fetch-secrets.sh",
+    (if $smoke == "1" then "echo \($smokefile) | base64 -d > caddy-extra/smoke.caddy" else "rm -f caddy-extra/smoke.caddy" end),
     "aws ecr get-login-password --region '"$REGION"' | docker login --username AWS --password-stdin \($registry) >/dev/null",
     "docker compose -f compose.json pull --quiet",
     "docker compose -f compose.json up -d --remove-orphans",

data/lib/hecks/projections/deploy/box.rb

@@ -196,7 +196,8 @@ module Hecks
                    "VOLUME_GB" => plan.volume_gb.to_s, "SNAPSHOTS_KEEP" => plan.snapshots_keep.to_s,
                    "AMI_PARAMETER" => ami_parameter(plan.instance_type),
                    "COMPUTE_DOMAIN" => compute_domain(region),
-                   "SECRET_RESOURCES" => secret_resources(plan), "TUNNEL_EGRESS" => tunnel_egress(plan),
+                   "SECRET_RESOURCES" => secret_resources(plan), "WRITABLE_SECRETS" => writable_secrets(plan),
+                   "TUNNEL_EGRESS" => tunnel_egress(plan),
                    "SWAP_COMMANDS" => swap_commands(plan), "ECR_REPOSITORIES" => ecr_repositories(plan),
                    "ECR_OUTPUTS" => ecr_outputs(plan), "S3_POLICY" => s3_policy(plan))
         end
@@ -261,6 +262,28 @@ module Hecks
           end.join.chomp
         end
 
+        # The statement that lets a production box overwrite the secrets named as writable.
+        #
+        # @param plan [Settings::Plan] the resolved settings
+        # @return [String] a policy statement for the role, or nothing when none are declared
+        def writable_secrets(plan)
+          return "" if plan.writable_secrets.empty?
+
+          arns = plan.writable_secrets.map { |name| name.end_with?("*") ? name : "#{name}-*" }.uniq
+          resources = arns.map do |pattern|
+            "#{' ' * 20}- !Sub \"arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:#{pattern}\"\n"
+          end.join
+          <<~YAML.chomp
+            #{' ' * 14}- !If
+            #{' ' * 16}- IsProduction
+            #{' ' * 16}- Effect: Allow
+            #{' ' * 18}Action: secretsmanager:PutSecretValue
+            #{' ' * 18}Resource:
+            #{resources.chomp}
+            #{' ' * 16}- !Ref AWS::NoValue
+          YAML
+        end
+
         # @param plan [Settings::Plan] the resolved settings
         # @return [String] the outbound rules a Cloudflare Tunnel sidecar needs, or nothing
         def tunnel_egress(plan)
@@ -437,7 +460,14 @@ module Hecks
           template("deploy-box.sh.tmpl", "STACK" => plan.infra_name, "BOX_STACK" => plan.box_stack,
                                          "RDS_STACK" => plan.rds_stack, "REGION" => region,
                                          "DIR" => "/opt/#{plan.infra_name}", "HEALTH_CHECKS" => health_checks(plan),
-                                         "USAGE" => deploy_usage(plan))
+                                         "SMOKE_HEADER" => smoke_header(plan), "USAGE" => deploy_usage(plan))
+        end
+
+        # @param plan [Settings::Plan] the resolved settings
+        # @return [String] the line that adds the origin secret to the smoke listener's requests, or
+        #   nothing when the world has no origin guard
+        def smoke_header(plan)
+          plan.origin_header ? "\t\theader_up #{plan.origin_header} {$ORIGIN_SECRET}" : ""
         end
 
         # @param plan [Settings::Plan] the resolved settings

data/lib/hecks/projections/deploy/scripts/hosting.mk.tmpl

@@ -8,11 +8,15 @@
 # machine. It replaces any path to a working copy: ROOT below points the
 # Makefile's build and mint-era steps at it. Override HECKS_VERSION to build
 # from another release, or HECKS_ROOT to use a checkout you manage yourself.
+#
+# HECKS_VERSION=edge is the one exception to "pinned": it follows the newest commit on main,
+# is fetched afresh on every build, and prints the commit it got.
 
 HECKS_VERSION   ?= @@RELEASE@@
 HECKS_SOURCE    ?= @@SOURCE@@
 HECKS_CACHE_DIR ?= @@CACHE_DIR@@
 HECKS_ROOT      ?= $(HECKS_CACHE_DIR)/hecks-$(HECKS_VERSION)
+HECKS_TAG       := $(if $(filter edge,$(HECKS_VERSION)),edge,v$(HECKS_VERSION))
 ROOT            := $(HECKS_ROOT)
 SERVICE         ?= @@SERVICE@@
 URL             ?= @@URL@@
@@ -22,20 +26,32 @@ URL             ?= @@URL@@
 build: hecks-release
 
 # Fetches the pinned release's tag into HECKS_ROOT unless it is already there,
-# and refuses a checkout that is not exactly that tag.
+# and refuses a checkout that is not exactly that tag. The edge tag moves, so it is
+# fetched afresh on every build and its commit is printed, not checked.
 hecks-release:
+ifeq ($(HECKS_VERSION),edge)
+	@mkdir -p "$(HECKS_CACHE_DIR)"; \
+		if [ -d "$(HECKS_ROOT)/.git" ]; then \
+			git -C "$(HECKS_ROOT)" fetch --quiet --depth 1 origin "+refs/tags/edge:refs/tags/edge" && \
+			git -C "$(HECKS_ROOT)" checkout --quiet --detach edge; \
+		else \
+			git clone --quiet --depth 1 --branch edge "$(HECKS_SOURCE)" "$(HECKS_ROOT)"; \
+		fi; \
+		echo "hecks edge at $$(git -C "$(HECKS_ROOT)" rev-parse --short HEAD) in $(HECKS_ROOT)"
+else
 	@if [ -f "$(HECKS_ROOT)/exe/hecks" ]; then \
 		echo "hecks v$(HECKS_VERSION) is already at $(HECKS_ROOT)"; \
 	else \
 		echo "Fetching hecks v$(HECKS_VERSION) from $(HECKS_SOURCE) into $(HECKS_ROOT)..."; \
 		mkdir -p "$(HECKS_CACHE_DIR)" && \
-		git clone --quiet --depth 1 --branch "v$(HECKS_VERSION)" "$(HECKS_SOURCE)" "$(HECKS_ROOT)"; \
+		git clone --quiet --depth 1 --branch "$(HECKS_TAG)" "$(HECKS_SOURCE)" "$(HECKS_ROOT)"; \
 	fi
 	@tag="$$(git -C "$(HECKS_ROOT)" describe --tags --exact-match 2>/dev/null)"; \
-		if [ "$$tag" != "v$(HECKS_VERSION)" ]; then \
-			echo "$(HECKS_ROOT) is at '$$tag', not v$(HECKS_VERSION). Remove it and re-run, or set HECKS_ROOT."; \
+		if [ "$$tag" != "$(HECKS_TAG)" ]; then \
+			echo "$(HECKS_ROOT) is at '$$tag', not $(HECKS_TAG). Remove it and re-run, or set HECKS_ROOT."; \
 			exit 1; \
 		fi
+endif
 
 # Pushes one container's already-built local image under a fresh tag and rolls
 # it out. Build the image first (docker-build); see deploy-service.sh.

data/lib/hecks/projections/deploy/scripts/settings.rb

@@ -12,6 +12,8 @@ module Hecks
           REF       = %r{\A[\w./-]+\z}
           ERA       = /\A[0-9a-zA-Z._-]+\z/
           RELEASE   = /\Av?\d+\.\d+\.\d+([.-][0-9A-Za-z.-]+)?\z/
+          # The moving tag on main; the one release name that is not a version.
+          EDGE      = "edge".freeze
           SOURCE    = %r{\A[\w.@:/~-]+\z}
           MAKE_PATH = /\A[^\s#]+\z/
 
@@ -43,6 +45,8 @@ module Hecks
             release = fetch(:hecks_release, nil)
             raise ArgumentError, missing_release_message unless release
 
+            return EDGE if release.to_s == EDGE
+
             check(:hecks_release, release.to_s, RELEASE).delete_prefix("v")
           end
 
@@ -63,6 +67,8 @@ module Hecks
                   end
 
               so the domain image is built from a fixed Hecks release, not from a checkout on one machine.
+              `hecks_release "edge"` follows the newest commit on main instead: each build fetches it
+              afresh and prints the commit it got, so a build is not reproducible from the name alone.
             MSG
           end
 

data/lib/hecks/version.rb

@@ -1,5 +1,5 @@
 module Hecks
   # Read directly by the gemspec, so this file must never require the
   # rest of the gem (its dependencies aren't resolved yet at that point).
-  VERSION = "3.1.1".freeze
+  VERSION = "3.1.2".freeze
 end

data/rust/codegen/src/commands.rs

@@ -444,14 +444,7 @@ pub fn emit_command(exemplar: &Exemplar, command: &Json, aggregate: &Json, domai
         .collect();
 
     let transition = mutations::lifecycle_transition_for(command, aggregate);
-    let transition_arg = match &transition {
-        Some(t) => format!(
-            "Some(crate::kernel::TransitionCheck {{ field: {}, from_states: &[{}] }})",
-            naming::ruby_inspect_string(&t.field),
-            t.from_states.iter().map(|s| naming::ruby_inspect_string(s)).collect::<Vec<_>>().join(", ")
-        ),
-        None => "None".to_string(),
-    };
+    let transition_arg = mutations::transition_check_arg(transition.as_ref());
 
     let mutations_list = command.get("mutations").map(Json::each).unwrap_or(&[]);
     // A `delegate` mutation is rendered by `delegation_of`, which overwrites `mutation_lines`;
@@ -772,14 +765,7 @@ fn delegation_of(exemplar: &Exemplar, command: &Json, aggregate: &Json, value_ob
         })
         .collect();
     let transition = mutations::lifecycle_transition_for(target, entity);
-    let transition_arg = match &transition {
-        Some(t) => format!(
-            "Some(crate::kernel::TransitionCheck {{ field: {}, from_states: &[{}] }})",
-            naming::ruby_inspect_string(&t.field),
-            t.from_states.iter().map(|s| naming::ruby_inspect_string(s)).collect::<Vec<_>>().join(", ")
-        ),
-        None => "None".to_string(),
-    };
+    let transition_arg = mutations::transition_check_arg(transition.as_ref());
     let mut mutation_lines: Vec<String> = target
         .get("mutations")
         .map(Json::each)
@@ -896,14 +882,7 @@ pub fn emit_entity_command(
         .collect();
 
     let transition = mutations::lifecycle_transition_for(command, entity);
-    let transition_arg = match &transition {
-        Some(t) => format!(
-            "Some(crate::kernel::TransitionCheck {{ field: {}, from_states: &[{}] }})",
-            naming::ruby_inspect_string(&t.field),
-            t.from_states.iter().map(|s| naming::ruby_inspect_string(s)).collect::<Vec<_>>().join(", ")
-        ),
-        None => "None".to_string(),
-    };
+    let transition_arg = mutations::transition_check_arg(transition.as_ref());
 
     let mutations_list = command.get("mutations").map(Json::each).unwrap_or(&[]);
     let mut mutation_lines: Vec<String> = mutations_list.iter().map(|m| mutations::emit_mutation_line(exemplar, m, entity, command, value_objects_by_name, false)).collect();
@@ -1063,14 +1042,7 @@ pub fn emit_nested_entity_command(
 
     // The nested entity's lifecycle, as in `emit_entity_command`.
     let transition = mutations::lifecycle_transition_for(command, nested);
-    let transition_arg = match &transition {
-        Some(t) => format!(
-            "Some(crate::kernel::TransitionCheck {{ field: {}, from_states: &[{}] }})",
-            naming::ruby_inspect_string(&t.field),
-            t.from_states.iter().map(|s| naming::ruby_inspect_string(s)).collect::<Vec<_>>().join(", ")
-        ),
-        None => "None".to_string(),
-    };
+    let transition_arg = mutations::transition_check_arg(transition.as_ref());
 
     let mutations_list = command.get("mutations").map(Json::each).unwrap_or(&[]);
     let mut mutation_lines: Vec<String> = mutations_list.iter().map(|m| mutations::emit_mutation_line(exemplar, m, nested, command, value_objects_by_name, false)).collect();

data/rust/codegen/src/mutations.rs

@@ -392,6 +392,23 @@ pub struct Transition {
     pub field: String,
     pub to_state: String,
     pub from_states: Vec<String>,
+    /// A row with no `from:` admits every state, so no check is emitted for the command.
+    pub unconstrained: bool,
+}
+
+/// The `Option<TransitionCheck>` expression a dispatch function is generated with.
+///
+/// `None` covers both "no transition" and an unconstrained one; an empty `from_states` slice
+/// would refuse every state instead of admitting every state.
+pub fn transition_check_arg(transition: Option<&Transition>) -> String {
+    match transition {
+        Some(t) if !t.unconstrained => format!(
+            "Some(crate::kernel::TransitionCheck {{ field: {}, from_states: &[{}] }})",
+            naming::ruby_inspect_string(&t.field),
+            t.from_states.iter().map(|s| naming::ruby_inspect_string(s)).collect::<Vec<_>>().join(", ")
+        ),
+        _ => "None".to_string(),
+    }
 }
 
 /// Collapses a command's transition rows into the shape `TransitionCheck` wants.
@@ -417,19 +434,25 @@ pub fn lifecycle_transition_for(command: &Json, aggregate: &Json) -> Option<Tran
             }
         }
         let field = lifecycle.get("field").and_then(Json::as_str).unwrap_or("").to_string();
-        return Some(Transition { field, to_state: String::new(), from_states });
+        return Some(Transition { field, to_state: String::new(), from_states, unconstrained: false });
     }
 
     let field = lifecycle.get("field").and_then(Json::as_str).unwrap_or("").to_string();
     let to_state = rows[0].get("to_state").map(Json::to_s).unwrap_or_default();
     let mut from_states: Vec<String> = Vec::new();
+    let mut unconstrained = false;
     for row in &rows {
-        let from = row.get("from_state").map(Json::to_s).unwrap_or_default();
-        if !from_states.contains(&from) {
-            from_states.push(from);
+        match row.get_raw("from_state") {
+            None | Some(Json::Null) => unconstrained = true,
+            Some(from) => {
+                let from = from.to_s();
+                if !from_states.contains(&from) {
+                    from_states.push(from);
+                }
+            }
         }
     }
-    Some(Transition { field, to_state, from_states })
+    Some(Transition { field, to_state, from_states, unconstrained })
 }
 
 /// Right-hand side for a `set`, coercing the source into the target attribute's declared type.
@@ -782,3 +805,49 @@ fn emit_mutation_line_body(
         other => panic!("unsupported mutation op {other:?} — command_skip_reason should have caught this"),
     }
 }
+
+#[cfg(test)]
+mod transition_tests {
+    use super::*;
+
+    fn aggregate(rows: &str) -> Json {
+        Json::parse(&format!(
+            r#"{{"name":"Account","lifecycle":{{"field":"status","default":"draft","transitions":[{rows}]}}}}"#
+        ))
+        .unwrap()
+    }
+
+    fn command(name: &str) -> Json {
+        Json::parse(&format!(r#"{{"name":"{name}"}}"#)).unwrap()
+    }
+
+    #[test]
+    fn a_transition_without_from_admits_every_state() {
+        let account = aggregate(r#"{"command":"Open","to_state":"open","from_state":null}"#);
+        let transition = lifecycle_transition_for(&command("Open"), &account).unwrap();
+        assert!(transition.unconstrained);
+        assert_eq!(transition.to_state, "open");
+        assert_eq!(transition_check_arg(Some(&transition)), "None");
+    }
+
+    #[test]
+    fn a_transition_with_from_checks_that_state() {
+        let account = aggregate(r#"{"command":"Close","to_state":"closed","from_state":"open"}"#);
+        let transition = lifecycle_transition_for(&command("Close"), &account).unwrap();
+        assert!(!transition.unconstrained);
+        assert_eq!(
+            transition_check_arg(Some(&transition)),
+            r#"Some(crate::kernel::TransitionCheck { field: "status", from_states: &["open"] })"#
+        );
+    }
+
+    #[test]
+    fn one_unconstrained_row_among_constrained_ones_admits_every_state() {
+        let account = aggregate(
+            r#"{"command":"Reopen","to_state":"open","from_state":"closed"},
+               {"command":"Reopen","to_state":"open","from_state":null}"#,
+        );
+        let transition = lifecycle_transition_for(&command("Reopen"), &account).unwrap();
+        assert_eq!(transition_check_arg(Some(&transition)), "None");
+    }
+}

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.1.1
+3.1.2

data/rust/host/src/web/registration_receipt/tests.rs

@@ -0,0 +1,39 @@
+use super::*;
+
+#[test]
+fn cents_render_as_dollars_with_two_places() {
+    assert_eq!(dollars(10800), "$108.00");
+    assert_eq!(dollars(14805), "$148.05");
+    assert_eq!(dollars(5), "$0.05");
+}
+
+#[test]
+fn the_built_in_receipt_names_the_event_the_first_name_and_the_amount() {
+    let body = built_in_body(Some("Ada"), "Yogadelics", Some(10800));
+    assert!(body.starts_with("Hi Ada,"));
+    assert!(body.contains("You're registered for Yogadelics."));
+    assert!(body.contains("$108.00"));
+    assert_eq!(receipt_subject("Yogadelics"), "You're registered for Yogadelics");
+}
+
+#[test]
+fn a_built_in_receipt_without_a_name_or_amount_still_reads_cleanly() {
+    let body = built_in_body(None, "Yogadelics", None);
+    assert!(body.starts_with("Hi,"));
+    assert!(!body.contains("payment of"));
+}
+
+#[test]
+fn the_sites_finished_email_is_read() {
+    let answer = serde_json::json!({"subject": "You're registered for Yogadelics", "body": "Hi Ada,\n\nWhere: Somewhere\n"});
+    assert_eq!(
+        site_email_from_json(&answer),
+        Some(SiteEmail { subject: "You're registered for Yogadelics".into(), body: "Hi Ada,\n\nWhere: Somewhere\n".into() })
+    );
+}
+
+#[test]
+fn an_incomplete_answer_from_the_site_falls_back_to_the_built_in_wording() {
+    assert_eq!(site_email_from_json(&serde_json::json!({"error": "no such session"})), None);
+    assert_eq!(site_email_from_json(&serde_json::json!({"subject": "Hi", "body": "  "})), None);
+}

data/rust/host/src/web/registration_receipt.rs

@@ -0,0 +1,122 @@
+// The email a registrant gets once their payment has gone through: what they
+// booked and what they paid. Best-effort, like every other mail the host
+// sends: the payment stands whatever delivery does.
+
+use super::instances_for;
+use crate::dispatch;
+use crate::ir::PaymentsProvider;
+use crate::journal::LineageConfig;
+use crate::resend::{Email, Mailer};
+use serde_json::{json, Value};
+use std::path::Path;
+use tokio::sync::Mutex;
+use tokio_postgres::Client;
+
+#[cfg(test)]
+mod tests;
+
+fn dollars(cents: i64) -> String {
+    format!("${}.{:02}", cents / 100, cents % 100)
+}
+
+fn receipt_subject(event_name: &str) -> String {
+    format!("You're registered for {event_name}")
+}
+
+/// The subject and body the site built from the wording an editor keeps in
+/// the CMS (when, where and how-to-prepare are filled in there: the venue lives
+/// only in the CMS).
+#[derive(Debug, PartialEq)]
+struct SiteEmail {
+    subject: String,
+    body: String,
+}
+
+fn site_email_from_json(body: &Value) -> Option<SiteEmail> {
+    let text = |key: &str| body.get(key).and_then(Value::as_str).filter(|s| !s.trim().is_empty()).map(String::from);
+    Some(SiteEmail { subject: text("subject")?, body: text("body")? })
+}
+
+/// Asks the site for the finished email (signed, short-lived, bound to this
+/// one event). Best effort: any failure means the host's own built-in wording
+/// goes out instead, so a receipt is always sent.
+async fn site_email(event_slug: &str, first_name: Option<&str>, amount_cents: Option<i64>) -> Option<SiteEmail> {
+    let secret = std::env::var("SESSION_SECRET").ok().filter(|s| !s.is_empty())?;
+    let token = crate::auth::purpose_token(&secret, "confirmation-email", json!({ "event": event_slug }), 300);
+    let mut url = reqwest::Url::parse(&format!("{}/api/confirmation-email", super::newsletter_send::site_url())).ok()?;
+    {
+        let mut query = url.query_pairs_mut();
+        query.append_pair("event", event_slug);
+        if let Some(name) = first_name {
+            query.append_pair("first_name", name);
+        }
+        if let Some(cents) = amount_cents {
+            query.append_pair("amount_cents", &cents.to_string());
+        }
+    }
+    let response = reqwest::Client::new().get(url).header("x-internal-auth", token).timeout(std::time::Duration::from_secs(8)).send().await.ok()?;
+    if !response.status().is_success() {
+        return None;
+    }
+    site_email_from_json(&response.json::<Value>().await.ok()?)
+}
+
+/// The host's own wording, used when the site cannot be asked.
+fn built_in_body(first_name: Option<&str>, event_name: &str, amount_cents: Option<i64>) -> String {
+    let greeting = first_name.map(|name| format!("Hi {name},")).unwrap_or_else(|| "Hi,".to_string());
+    let paid = amount_cents.map(|cents| format!(" We received your payment of {}.", dollars(cents))).unwrap_or_default();
+    format!("{greeting}\n\nYou're registered for {event_name}.{paid}\n\nYour seat is held. If anything changes, just reply to this email.\n")
+}
+
+/// Mails the receipt for `reference` if its Payment has succeeded. A missing
+/// mailer, registrant address or event is skipped quietly.
+pub(super) async fn send_receipt(reference: &str, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, payments: &PaymentsProvider) {
+    let mailer = match Mailer::from_env() {
+        Ok(Some(mailer)) => mailer,
+        Ok(None) => return,
+        Err(e) => {
+            eprintln!("registration receipt: {e}");
+            return;
+        }
+    };
+    let Ok(read) = dispatch::read(client, wasm_path).await else {
+        return;
+    };
+    let binding = crate::ir::registrations_binding(&config.domain);
+    let registrations = instances_for(&read, &binding.registration_prefix());
+    let Some((_, registration)) = registrations.iter().find(|(id, _)| id == reference) else {
+        return;
+    };
+    let payment_instances = instances_for(&read, &payments.instance_prefix());
+    let payment = payment_instances.iter().find(|(id, _)| id == reference).map(|(_, p)| p);
+    if payment.and_then(|p| p.get("status")).and_then(|s| s.as_str()) != Some("succeeded") {
+        return;
+    }
+    let attendee = registration.get("attendee").cloned().unwrap_or_else(|| serde_json::json!({}));
+    let Some(to) = attendee.get("email").and_then(|v| v.as_str()).filter(|s| !s.is_empty()) else {
+        return;
+    };
+    let events = instances_for(&read, &binding.event_prefix());
+    let event_name = registration
+        .get("event_slug")
+        .and_then(|v| v.as_str())
+        .and_then(|slug| events.iter().find(|(id, _)| id == slug))
+        .and_then(|(_, e)| e.get("name"))
+        .and_then(|n| n.get("value"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("your event");
+    let amount = payment.and_then(|p| p.get("amount")).and_then(|a| a.get("cents")).and_then(Value::as_i64);
+    let first_name = attendee.get("first_name").and_then(|v| v.as_str()).filter(|s| !s.is_empty());
+    let from_site = match registration.get("event_slug").and_then(|v| v.as_str()) {
+        Some(slug) => site_email(slug, first_name, amount).await,
+        None => None,
+    };
+    let (subject, body) = match from_site {
+        Some(email) => (email.subject, email.body),
+        None => (receipt_subject(event_name), built_in_body(first_name, event_name, amount)),
+    };
+    let delivery = mailer.deliver(&Email { to, subject: &subject, body: &body, unsubscribe_url: None }).await;
+    if !delivery.ok {
+        eprintln!("registration receipt: not delivered: {}", delivery.reason.unwrap_or_default());
+    }
+}

data/rust/host/src/web/registrations.rs

@@ -367,6 +367,12 @@ pub(crate) async fn registration_complete_route(
         }
     }
 
+    // Only a payment that settled just now earns a receipt; a repeat click was
+    // refused above as already settled.
+    if outcome == "succeeded" && outcome_result.accepted {
+        super::registration_receipt::send_receipt(registration_id, client, wasm_path, config, payments).await;
+    }
+
     let read = match dispatch::read(client, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
@@ -675,8 +681,14 @@ pub(crate) async fn webhook_route(
             // A refusal here (e.g. a redelivered webhook — Stripe's delivery
             // is at-least-once) is a benign no-op: the payment already holds
             // the right status, and 200 tells Stripe's retry logic to stop.
-            if let Err(e) = dispatch::handle_routed(client, wasm_path, verb, json!(reference), facts, None, config, invoker).await {
-                return respond(500, "text/plain", &format!("{e:#}"));
+            match dispatch::handle_routed(client, wasm_path, verb, json!(reference), facts, None, config, invoker).await {
+                Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
+                // Only the delivery that settles the payment sends the receipt;
+                // a redelivery is refused and stays quiet.
+                Ok(settled) if settled.accepted && event_type == "checkout.session.completed" => {
+                    super::registration_receipt::send_receipt(&reference, client, wasm_path, config, payments).await;
+                }
+                Ok(_) => {}
             }
         }
     }

data/rust/host/src/web.rs

@@ -18,6 +18,7 @@ use tokio_postgres::Client;
 
 mod newsletter;
 mod newsletter_send;
+mod registration_receipt;
 mod registrations;
 
 use registrations::payments_routes;

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.1.2
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -910,6 +910,8 @@ files:
 - rust/host/src/web/newsletter/template.rs
 - rust/host/src/web/newsletter/tests.rs
 - rust/host/src/web/newsletter_send.rs
+- rust/host/src/web/registration_receipt.rs
+- rust/host/src/web/registration_receipt/tests.rs
 - rust/host/src/web/registrations.rs
 - rust/lsp/.gitignore
 - rust/lsp/Cargo.lock