hecks 3.10.0 → 3.11.0

data/rust/codegen/src/types.rs

@@ -26,15 +26,15 @@ pub fn emit_check_invariants(exemplar: &Exemplar, vo: &Json, value_objects_by_na
             continue;
         }
         let field = naming::rust_ident_field(crate::attr::name(attr));
-        if crate::attr::list(attr) {
-            body.push(format!("        for item in &self.{field} {{ item.check_invariants()?; }}"));
-        } else {
-            body.push(format!("        self.{field}.check_invariants()?;"));
-        }
+        body.push(nested_invariant_line(&field, crate::attr::list(attr), crate::attr::optional(attr)));
     }
 
     for attr in attributes {
         if crate::attr::list(attr) {
+            let field = format!("self.{}", naming::rust_ident_field(crate::attr::name(attr)));
+            if let Some(line) = crate::constraints::emit_list_pattern_check(exemplar, &field, attr, &name) {
+                body.push(format!("        {line}"));
+            }
             continue;
         }
         let field = format!("self.{}", naming::rust_ident_field(crate::attr::name(attr)));
@@ -64,6 +64,18 @@ pub fn emit_check_invariants(exemplar: &Exemplar, vo: &Json, value_objects_by_na
     format!("impl {name} {{\n    pub fn check_invariants(&self) -> Result<(), crate::kernel::Refusal> {{\n{}\n        Ok(())\n    }}\n}}\n", body.join("\n"))
 }
 
+/// The line that runs a nested value object's own invariants. An optional slot is an `Option` in
+/// the record, so its invariants run only when it is present, as Ruby validates only what it is
+/// given; a list's members each run theirs.
+fn nested_invariant_line(field: &str, list: bool, optional: bool) -> String {
+    match (list, optional) {
+        (true, true) => format!("        if let Some(items) = &self.{field} {{ for item in items {{ item.check_invariants()?; }} }}"),
+        (true, false) => format!("        for item in &self.{field} {{ item.check_invariants()?; }}"),
+        (false, true) => format!("        if let Some(value) = &self.{field} {{ value.check_invariants()?; }}"),
+        (false, false) => format!("        self.{field}.check_invariants()?;"),
+    }
+}
+
 pub fn emit_closed_set_table(exemplar: &Exemplar, vo: &Json) -> String {
     let name = naming::rust_ident(vo.get("name").and_then(Json::as_str).unwrap_or(""));
     let attributes = vo.get("attributes").map(Json::each).unwrap_or(&[]);
@@ -286,6 +298,83 @@ pub fn emit_record(exemplar: &Exemplar, aggregate: &Json, value_objects_by_name:
     format!("{struct_part}\n\n{fielded_part}")
 }
 
+/// Copy of `ir` whose every `projects` field also carries the `type` of the remote field it reads,
+/// so the projecting aggregate's pseudo-attribute and setter follow it (ADR 0025 addendum). A
+/// single-field value object resolves to its one attribute's type, a reference to `String`, and a
+/// field that resolves to nothing stays `String`.
+pub fn with_resolved_projection_types(ir: &Json) -> Json {
+    let mut resolved = ir.clone();
+    let aggregates: Vec<Json> = ir.get("aggregates").map(Json::each).unwrap_or(&[]).to_vec();
+    let Some(list) = resolved.get_mut("aggregates").and_then(Json::as_array_mut) else {
+        return resolved;
+    };
+    for (aggregate, original) in list.iter_mut().zip(aggregates.iter()) {
+        let Some(fields) = aggregate.get_mut("projected_fields").and_then(Json::as_array_mut) else {
+            continue;
+        };
+        for field in fields.iter_mut() {
+            let scalar = projected_scalar_type(&aggregates, original, field, 0);
+            field.set("type", Json::String(scalar));
+        }
+    }
+    resolved
+}
+
+const PROJECTION_CHAIN_LIMIT: usize = 8;
+
+// The scalar type a projection of `field` copies, following a chain of projections.
+fn projected_scalar_type(aggregates: &[Json], owner: &Json, field: &Json, depth: usize) -> String {
+    let reference = field.get("reference").and_then(Json::as_str).unwrap_or("");
+    let remote = field.get("remote_field").and_then(Json::as_str).unwrap_or("");
+    let target = owner
+        .get("attributes")
+        .map(Json::each)
+        .unwrap_or(&[])
+        .iter()
+        .find(|a| crate::attr::name(a) == reference)
+        .and_then(|a| naming::reference_target(crate::attr::type_name(a)))
+        .and_then(|name| aggregates.iter().find(|a| a.get("name").and_then(Json::as_str) == Some(name)));
+    target.map(|t| remote_scalar_type(aggregates, t, remote, depth)).unwrap_or_else(|| "String".to_string())
+}
+
+fn remote_scalar_type(aggregates: &[Json], target: &Json, remote: &str, depth: usize) -> String {
+    let declared = target.get("attributes").map(Json::each).unwrap_or(&[]).iter().find(|a| crate::attr::name(a) == remote);
+    if let Some(attr) = declared {
+        return unwrapped_scalar_type(target, crate::attr::type_name(attr));
+    }
+    let chained = target.get("projected_fields").map(Json::each).unwrap_or(&[]).iter().find(|f| f.get("name").and_then(Json::as_str) == Some(remote));
+    match chained {
+        Some(next) if depth < PROJECTION_CHAIN_LIMIT => projected_scalar_type(aggregates, target, next, depth + 1),
+        _ => "String".to_string(),
+    }
+}
+
+// A single-field value object reads as its one attribute's type; anything else as itself.
+fn unwrapped_scalar_type(aggregate: &Json, type_name: &str) -> String {
+    let sole = aggregate
+        .get("value_objects")
+        .map(Json::each)
+        .unwrap_or(&[])
+        .iter()
+        .find(|vo| vo.get("name").and_then(Json::as_str) == Some(type_name))
+        .map(|vo| vo.get("attributes").map(Json::each).unwrap_or(&[]))
+        .filter(|attrs| attrs.len() == 1 && !crate::attr::list(&attrs[0]))
+        .map(|attrs| crate::attr::type_name(&attrs[0]).to_string());
+    let resolved = sole.unwrap_or_else(|| type_name.to_string());
+    let resolved = if resolved == "Boolean" { "TrueClass".to_string() } else { resolved };
+    naming::effective_scalar_type(&resolved).unwrap_or("String").to_string()
+}
+
+// The `Value` reader a generated setter narrows with, by scalar type.
+fn projection_reader(scalar: &str) -> &'static str {
+    match scalar {
+        "Integer" => "into_i64",
+        "Float" => "into_f64",
+        "TrueClass" | "FalseClass" => "into_bool",
+        _ => "into_string",
+    }
+}
+
 /// Port of the retired Ruby generator's `types.rb#projected_field_pseudo_attributes` (ADR 0025).
 pub fn projected_field_pseudo_attributes(aggregate: &Json) -> Vec<Json> {
     aggregate
@@ -295,9 +384,10 @@ pub fn projected_field_pseudo_attributes(aggregate: &Json) -> Vec<Json> {
         .iter()
         .map(|field| {
             let name = field.get("name").and_then(Json::as_str).unwrap_or("").to_string();
+            let scalar = field.get("type").and_then(Json::as_str).unwrap_or("String").to_string();
             Json::Object(vec![
                 ("name".to_string(), Json::String(name)),
-                ("type".to_string(), Json::String("String".to_string())),
+                ("type".to_string(), Json::String(scalar)),
                 ("list".to_string(), Json::Bool(false)),
                 ("optional".to_string(), Json::Bool(true)),
             ])
@@ -329,11 +419,12 @@ pub fn emit_set_projected_field(aggregate: &Json) -> String {
         .map(|field| {
             let field_name = field.get("name").and_then(Json::as_str).unwrap_or("");
             let ident = naming::rust_ident_field(field_name);
-            format!("            {} => self.{} = value,", naming::ruby_inspect_string(field_name), ident)
+            let reader = projection_reader(field.get("type").and_then(Json::as_str).unwrap_or("String"));
+            format!("            {} => self.{} = value.and_then(crate::kernel::Value::{}),", naming::ruby_inspect_string(field_name), ident, reader)
         })
         .collect();
     format!(
-        "impl crate::kernel::SetProjectedField for {name} {{\n    fn set_projected_field(&mut self, name: &'static str, value: Option<String>) {{\n        match name {{\n{}\n            _ => {{}}\n        }}\n    }}\n}}\n",
+        "impl crate::kernel::SetProjectedField for {name} {{\n    fn set_projected_field(&mut self, name: &'static str, value: Option<crate::kernel::Value>) {{\n        match name {{\n{}\n            _ => {{}}\n        }}\n    }}\n}}\n",
         arms.join("\n")
     )
 }
@@ -404,4 +495,71 @@ mod tests {
         assert!(!from_json.contains("TrueClass::from_json"));
         assert!(to_json.contains("crate::kernel::Json::Bool(self.on)"));
     }
+
+    /// An Event whose `starts_at` is a single-field Integer value object, and a Booking projecting it.
+    fn event_and_booking() -> Json {
+        Json::parse(
+            r#"{"aggregates":[
+              {"name":"Event","attributes":[{"name":"starts_at","type":"StartsAt","list":false}],
+               "value_objects":[{"name":"StartsAt","attributes":[{"name":"value","type":"Integer","list":false}]}]},
+              {"name":"Booking","attributes":[{"name":"event","type":"Reference<Event>","list":false}],
+               "projected_fields":[{"name":"starts_at","reference":"event","remote_field":"starts_at"}]}
+            ]}"#,
+        )
+        .unwrap()
+    }
+
+    fn resolved_booking() -> Json {
+        with_resolved_projection_types(&event_and_booking()).get("aggregates").map(Json::each).unwrap_or(&[])[1].clone()
+    }
+
+    #[test]
+    fn a_projection_through_a_single_field_value_object_takes_its_scalar_type() {
+        let field = resolved_booking().get("projected_fields").map(Json::each).unwrap_or(&[])[0].clone();
+
+        assert_eq!(field.get("type").and_then(Json::as_str), Some("Integer"));
+    }
+
+    #[test]
+    fn the_projected_pseudo_attribute_follows_the_remote_type() {
+        let attrs = projected_field_pseudo_attributes(&resolved_booking());
+
+        assert_eq!(crate::attr::type_name(&attrs[0]), "Integer");
+    }
+
+    #[test]
+    fn the_projected_setter_narrows_with_the_remote_types_reader() {
+        let setter = emit_set_projected_field(&resolved_booking());
+
+        assert!(setter.contains("\"starts_at\" => self.starts_at = value.and_then(crate::kernel::Value::into_i64),"));
+    }
+
+    /// A value object holding a required and an optional value object, and a required and an
+    /// optional list of them.
+    fn holder_value_object() -> Json {
+        Json::parse(
+            r#"{
+              "name":"Holder",
+              "attributes":[
+                {"name":"required_note","type":"Note","list":false,"optional":false},
+                {"name":"note","type":"Note","list":false,"optional":true},
+                {"name":"required_notes","type":"Note","list":true,"optional":false},
+                {"name":"notes","type":"Note","list":true,"optional":true}
+              ]
+            }"#,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn a_nested_value_object_checks_its_invariants_only_when_it_is_present() {
+        let note = Json::parse(r#"{"name":"Note","attributes":[{"name":"text","type":"String","list":false,"optional":false}]}"#).unwrap();
+        let by_name: HashMap<String, &Json> = HashMap::from([("Note".to_string(), &note)]);
+        let generated = emit_check_invariants(&Exemplar::load(), &holder_value_object(), &by_name, &HashMap::new());
+
+        assert!(generated.contains("self.required_note.check_invariants()?;"));
+        assert!(generated.contains("if let Some(value) = &self.note { value.check_invariants()?; }"));
+        assert!(generated.contains("for item in &self.required_notes { item.check_invariants()?; }"));
+        assert!(generated.contains("if let Some(items) = &self.notes { for item in items { item.check_invariants()?; } }"));
+    }
 }

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.10.0
+3.11.0

data/rust/host/src/api.rs

@@ -1089,8 +1089,8 @@ mod tests {
     }
 
     #[test]
-    fn a_record_that_does_not_exist_refuses_with_json_doors_own_wording() {
-        // `JSON_DOOR.find!`'s own message, `id` inspected the way Ruby
+    fn a_record_that_does_not_exist_refuses_with_json_adapters_own_wording() {
+        // `JSON_ADAPTER.find!`'s own message, `id` inspected the way Ruby
         // inspects it.
         let refusal = not_found(&format!("no {} found for id {:?}", "Client", "acme"));
         assert_eq!(body(&refusal), json!({"error": "NotFound", "message": "no Client found for id \"acme\""}));
@@ -1365,7 +1365,7 @@ mod tests {
     fn every_state_styled() -> Value {
         json!({"states": {
             "Event": {"open": {"tone": "good"}, "closed": {"tone": "muted"}},
-            "Registration": {"active": {}, "archived": {"tone": "muted"}},
+            "Registration": {"active": {}, "archived": {"tone": "muted"}, "cancelled": {"tone": "muted"}},
             "PaymentConnection": {"connected": {}, "enabled": {}, "disconnected": {}, "paused": {}}
         }})
     }
@@ -1590,7 +1590,7 @@ mod tests {
         assert!(!refused["message"].as_str().expect("a message").is_empty(), "{refused}");
 
         // An unknown command, and an unknown record, both refuse the
-        // way JsonDoor refuses them.
+        // way Json refuses them.
         let unknown_command =
             command_route(&ir, "customers", "CUST-9001", "nope", "", &client, &wasm, &lineage, &invoker).await;
         assert_eq!(unknown_command["statusCode"], 404);

data/rust/host/src/bin/validate_harness.rs

@@ -0,0 +1,43 @@
+//! Rust side of the stored-value differential: runs the mint audit's structural layer
+//! (`reference_validate::validate`) over each `{aggregate, id, state}` case on stdin against one
+//! domain IR, and prints the violations of each. `spec/rust_host_reference_validate_conformance_spec.rb`
+//! holds those to the answers the Ruby runtime gives the same values.
+
+#[allow(dead_code)]
+#[path = "../expr_json.rs"]
+mod expr_json;
+#[allow(dead_code)]
+#[path = "../reference_validate.rs"]
+mod reference_validate;
+
+use serde_json::{json, Value};
+use std::io::Read;
+
+// Usage: `validate_harness < {"ir": <domain ir.json>, "cases": [{"aggregate": "Name", "id": "x", "state": {..}}, ..]}`.
+// Prints `{"results": [{"violations": [..]} | {"error": ".."}, ..]}`, one per case, in order.
+fn main() -> anyhow::Result<()> {
+    let mut input = String::new();
+    std::io::stdin().read_to_string(&mut input)?;
+    let request: Value = serde_json::from_str(&input)?;
+    let ir = request.get("ir").ok_or_else(|| anyhow::anyhow!("no \"ir\" on stdin"))?;
+    let cases = request.get("cases").and_then(Value::as_array).ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
+
+    let results: Vec<Value> = cases.iter().map(|case| answer(ir, case)).collect();
+    println!("{}", json!({ "results": results }));
+    Ok(())
+}
+
+fn answer(ir: &Value, case: &Value) -> Value {
+    let name = case.get("aggregate").and_then(Value::as_str).unwrap_or("");
+    let aggregate = ir
+        .get("aggregates")
+        .and_then(Value::as_array)
+        .and_then(|list| list.iter().find(|a| a.get("name").and_then(Value::as_str) == Some(name)));
+    match aggregate {
+        None => json!({ "error": format!("no aggregate {name:?} in the IR") }),
+        Some(aggregate) => {
+            let id = case.get("id").and_then(Value::as_str).unwrap_or("");
+            json!({ "violations": reference_validate::validate(ir, aggregate, id, &case["state"]) })
+        }
+    }
+}

data/rust/host/src/boundary_fuzz/expr_json.rs

@@ -8,7 +8,7 @@ use crate::fuzz_support::*;
 use serde_json::{json, Value};
 
 const BINARY: &[&str] = &["or", "and", "compare", "include", "add", "modulo"];
-const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "starts_with", "ends_with", "matches_regex"];
+const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "strip", "starts_with", "ends_with", "matches_regex"];
 
 const PATTERNS: &[&str] = &[
     "", "^$", "a", "(a*)*b", "(a|aa)+$", "[", "]", "[]", "[^]", "[a-", "(", ")", "(?", "(?P<x>", "\\", "\\d+", "\\D\\W\\S\\H", "\\Z", "[\\d]", "[\\Z]", "\\p{L}+", "\\p{Nope}",
@@ -43,7 +43,7 @@ fn node(rng: &mut Rng, depth: usize) -> Value {
         }
         4..=7 => {
             let op = *rng.pick(UNARY);
-            let mut value = json!({"op": op, "receiver": node(rng, depth + 1), "expr": node(rng, depth + 1), "negated": rng.chance(2), "separator": random_text(rng), "substring": random_text(rng), "pattern": *rng.pick(PATTERNS), "flags": *rng.pick(&["", "i", "m", "x", "imx", "z"])});
+            let mut value = json!({"op": op, "receiver": node(rng, depth + 1), "expr": node(rng, depth + 1), "negated": rng.chance(2), "separator": random_text(rng), "side": *rng.pick(&["both", "left", "right", "sideways"]), "substring": random_text(rng), "pattern": *rng.pick(PATTERNS), "flags": *rng.pick(&["", "i", "m", "x", "imx", "z"])});
             value["cmp"] = json!({"less_than": rng.chance(2), "equal": rng.chance(2), "negated": rng.chance(2)});
             value
         }

data/rust/host/src/boundary_fuzz/ir.rs

@@ -50,6 +50,7 @@ fn every_provider_reader_answers_any_ir_shape() {
                 let _ = newsletter_provider(&ir).map(|p| p.instance_prefix());
                 let _ = newsletter_issues_provider(&ir).map(|p| p.issue_prefix());
                 let _ = payments_provider(&ir).map(|p| p.instance_prefix());
+                let _ = checkout_windows(&ir);
                 if let Some(p) = registrations_provider(&ir) {
                     let _ = (p.event_prefix(), p.registration_prefix(), p.request_target());
                 }

data/rust/host/src/boundary_fuzz/server.rs

@@ -1,4 +1,4 @@
-//! Seeded fuzz of the HTTP front door (`admit`, `value_to_response`): hostile bodies, methods, URIs
+//! Seeded fuzz of the HTTP front entry point (`admit`, `value_to_response`): hostile bodies, methods, URIs
 //! and headers must be answered, never panic, and a refused request must leave no trace.
 //! Everything here is in-process: `admit` is the whole of what runs before dispatch, so none of
 //! it needs Postgres or wasm.

data/rust/host/src/checkout.rs

@@ -7,10 +7,6 @@ use sha2::Sha256;
 
 type HmacSha256 = Hmac<Sha256>;
 
-// docs.stripe.com/webhooks#verify-events — 5 minutes, guards against a
-// replayed old payload even against a leaked (not yet rotated) secret.
-const TOLERANCE_SECONDS: i64 = 300;
-
 pub struct SignatureError(pub String);
 
 impl std::fmt::Display for SignatureError {
@@ -22,7 +18,10 @@ impl std::fmt::Display for SignatureError {
 // Signs `<timestamp>.<raw body>`, the exact bytes Stripe sent -- re-serializing
 // the JSON would disagree on whitespace or key order and break every match.
 // `now` is a parameter, not read internally, so a test can hold time fixed.
-pub fn verify_signature(payload: &str, header: &str, secret: &str, now: i64) -> Result<(), SignatureError> {
+// `tolerance_seconds` is the freshness window the Checkout bluebook declares
+// (`WebhookReceipt.tolerance`, read from the IR): it guards against a replayed
+// old payload even against a leaked (not yet rotated) secret.
+pub fn verify_signature(payload: &str, header: &str, secret: &str, now: i64, tolerance_seconds: i64) -> Result<(), SignatureError> {
     let mut timestamp: Option<i64> = None;
     let mut signatures: Vec<&str> = Vec::new();
     for part in header.split(',') {
@@ -39,9 +38,9 @@ pub fn verify_signature(payload: &str, header: &str, secret: &str, now: i64) ->
     if signatures.is_empty() {
         return Err(SignatureError("Stripe-Signature header has no v1= signature".to_string()));
     }
-    if (now - timestamp).abs() > TOLERANCE_SECONDS {
+    if (now - timestamp).abs() > tolerance_seconds {
         return Err(SignatureError(format!(
-            "timestamp {timestamp} is outside the {TOLERANCE_SECONDS}s tolerance (now: {now})"
+            "timestamp {timestamp} is outside the {tolerance_seconds}s tolerance (now: {now})"
         )));
     }
 
@@ -98,11 +97,19 @@ pub struct EmbeddedSession {
     pub client_secret: String,
 }
 
-// 31, not 30: Stripe requires an expiry at least 30 minutes out.
-pub const SESSION_HOLD_SECONDS: i64 = 31 * 60;
+// 31, not 30: Stripe requires an expiry at least 30 minutes out. This floor is a
+// fact about the processor, so it lives here in the adapter; the domain declares
+// only how long a session holds its seat (`CheckoutSession.hold`), and a hold
+// shorter than the floor is raised to it.
+pub const STRIPE_MIN_HOLD_SECONDS: i64 = 31 * 60;
+
+/// The hold actually sent to Stripe for a domain hold of `hold_seconds`.
+pub fn effective_hold_seconds(hold_seconds: i64) -> i64 {
+    hold_seconds.max(STRIPE_MIN_HOLD_SECONDS)
+}
 
-pub fn session_expires_at(now: i64) -> i64 {
-    now + SESSION_HOLD_SECONDS
+pub fn session_expires_at(now: i64, hold_seconds: i64) -> i64 {
+    now + effective_hold_seconds(hold_seconds)
 }
 
 // Errors carry Stripe's message when it refuses, never a secret.
@@ -158,6 +165,8 @@ pub async fn create_checkout_session(
 mod tests {
     use super::*;
 
+    const TOLERANCE_SECONDS: i64 = 300;
+
     fn sign(secret: &str, timestamp: i64, payload: &str) -> String {
         let signed_payload = format!("{timestamp}.{payload}");
         let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).unwrap();
@@ -195,7 +204,7 @@ mod tests {
         let now = 1_700_000_000;
         let header = format!("t={now},v1={}", sign(secret, now, payload));
 
-        assert!(verify_signature(payload, &header, secret, now).is_ok());
+        assert!(verify_signature(payload, &header, secret, now, TOLERANCE_SECONDS).is_ok());
     }
 
     #[test]
@@ -207,7 +216,7 @@ mod tests {
         // Same header, different body — exactly what an attacker
         // intercepting and rewriting the request in transit would send.
         let tampered = r#"{"type":"checkout.session.expired"}"#;
-        assert!(verify_signature(tampered, &header, secret, now).is_err());
+        assert!(verify_signature(tampered, &header, secret, now, TOLERANCE_SECONDS).is_err());
     }
 
     #[test]
@@ -216,7 +225,7 @@ mod tests {
         let now = 1_700_000_000;
         let header = format!("t={now},v1={}", sign("whsec_real", now, payload));
 
-        assert!(verify_signature(payload, &header, "whsec_wrong", now).is_err());
+        assert!(verify_signature(payload, &header, "whsec_wrong", now, TOLERANCE_SECONDS).is_err());
     }
 
     #[test]
@@ -231,7 +240,14 @@ mod tests {
         // to be a separate, independent gate rather than folded into
         // "does the signature verify at all."
         let much_later = signed_at + TOLERANCE_SECONDS + 1;
-        assert!(verify_signature(payload, &header, secret, much_later).is_err());
+        assert!(verify_signature(payload, &header, secret, much_later, TOLERANCE_SECONDS).is_err());
+    }
+
+    #[test]
+    fn a_hold_shorter_than_stripes_floor_is_raised_to_it() {
+        assert_eq!(effective_hold_seconds(1800), STRIPE_MIN_HOLD_SECONDS);
+        assert_eq!(effective_hold_seconds(3600), 3600);
+        assert_eq!(session_expires_at(1_000, 1800), 1_000 + STRIPE_MIN_HOLD_SECONDS);
     }
 
     #[test]
@@ -246,20 +262,20 @@ mod tests {
             sign(new_secret, now, payload)
         );
 
-        assert!(verify_signature(payload, &header, old_secret, now).is_ok());
-        assert!(verify_signature(payload, &header, new_secret, now).is_ok());
+        assert!(verify_signature(payload, &header, old_secret, now, TOLERANCE_SECONDS).is_ok());
+        assert!(verify_signature(payload, &header, new_secret, now, TOLERANCE_SECONDS).is_ok());
     }
 
     #[test]
     fn a_header_with_no_v1_at_all_is_rejected() {
         let now = 1_700_000_000;
         let header = format!("t={now}");
-        assert!(verify_signature("{}", &header, "whsec_test", now).is_err());
+        assert!(verify_signature("{}", &header, "whsec_test", now, TOLERANCE_SECONDS).is_err());
     }
 
     #[test]
     fn a_header_with_no_timestamp_at_all_is_rejected() {
         let header = "v1=deadbeef".to_string();
-        assert!(verify_signature("{}", &header, "whsec_test", 1_700_000_000).is_err());
+        assert!(verify_signature("{}", &header, "whsec_test", 1_700_000_000, TOLERANCE_SECONDS).is_err());
     }
 }