hecks 3.10.0 → 3.11.0

data/rust/host/src/expr_json.rs

@@ -12,6 +12,14 @@ pub struct Comparison {
     pub negated: bool,
 }
 
+/// Which ends of a string `Expr::Strip` trims.
+#[derive(Debug, Clone, Copy)]
+pub enum StripSide {
+    Both,
+    Left,
+    Right,
+}
+
 #[derive(Debug, Clone, Copy)]
 pub enum BlockMode {
     All,
@@ -35,6 +43,9 @@ pub enum Expr {
     Bool { value: bool },
     Nil,
     Add { left: Box<Expr>, right: Box<Expr> },
+    Sub { left: Box<Expr>, right: Box<Expr> },
+    Mul { left: Box<Expr>, right: Box<Expr> },
+    Div { left: Box<Expr>, right: Box<Expr> },
     SignTest { cmp: Comparison, receiver: Box<Expr> },
     Empty { receiver: Box<Expr> },
     ToS { receiver: Box<Expr> },
@@ -48,6 +59,7 @@ pub enum Expr {
     Presence { receiver: Box<Expr>, negated: bool },
     Assignment { receiver: Box<Expr>, negated: bool },
     Split { receiver: Box<Expr>, separator: String },
+    Strip { receiver: Box<Expr>, side: StripSide },
     StartsWith { receiver: Box<Expr>, substring: String },
     EndsWith { receiver: Box<Expr>, substring: String },
     First { receiver: Box<Expr> },
@@ -95,6 +107,9 @@ pub fn parse(json: &Json) -> Result<Expr, String> {
         "bool" => Expr::Bool { value: field("value")?.as_bool().ok_or_else(|| format!("bool's value isn't a boolean: {json}"))? },
         "nil" => Expr::Nil,
         "add" => Expr::Add { left: Box::new(expr("left")?), right: Box::new(expr("right")?) },
+        "sub" => Expr::Sub { left: Box::new(expr("left")?), right: Box::new(expr("right")?) },
+        "mul" => Expr::Mul { left: Box::new(expr("left")?), right: Box::new(expr("right")?) },
+        "div" => Expr::Div { left: Box::new(expr("left")?), right: Box::new(expr("right")?) },
         "sign_test" => Expr::SignTest { cmp: comparison()?, receiver: Box::new(expr("receiver")?) },
         "empty" => Expr::Empty { receiver: Box::new(expr("receiver")?) },
         "to_s" => Expr::ToS { receiver: Box::new(expr("receiver")?) },
@@ -136,6 +151,15 @@ pub fn parse(json: &Json) -> Result<Expr, String> {
             negated: field("negated")?.as_bool().ok_or_else(|| format!("assignment's negated isn't a boolean: {json}"))?,
         },
         "split" => Expr::Split { receiver: Box::new(expr("receiver")?), separator: str_field("separator")? },
+        "strip" => Expr::Strip {
+            receiver: Box::new(expr("receiver")?),
+            side: match str_field("side")?.as_str() {
+                "both" => StripSide::Both,
+                "left" => StripSide::Left,
+                "right" => StripSide::Right,
+                other => return Err(format!("strip's side {other:?} is none of both/left/right: {json}")),
+            },
+        },
         "starts_with" => Expr::StartsWith { receiver: Box::new(expr("receiver")?), substring: str_field("substring")? },
         "ends_with" => Expr::EndsWith { receiver: Box::new(expr("receiver")?), substring: str_field("substring")? },
         "first" => Expr::First { receiver: Box::new(expr("receiver")?) },
@@ -374,6 +398,45 @@ fn add(left: &Value, right: &Value) -> Result<Value, String> {
     }
 }
 
+/// `Resolver.checked_arithmetic`: the same 64-bit and finiteness limits `add` holds to, named for
+/// the operation that overflowed.
+fn arithmetic(
+    name: &str,
+    symbol: &str,
+    left: &Value,
+    right: &Value,
+    int_op: fn(i64, i64) -> Option<i64>,
+    float_op: fn(f64, f64) -> f64,
+) -> Result<Value, String> {
+    let lhs = require_number(left, name)?;
+    let rhs = require_number(right, name)?;
+    if let (Value::Int(a), Value::Int(b)) = (&lhs, &rhs) {
+        return int_op(*a, *b)
+            .map(Value::Int)
+            .ok_or_else(|| format!("{name} overflowed: {a} {symbol} {b} does not fit in a 64-bit integer"));
+    }
+    let result = float_op(numeric(&lhs).unwrap_or_default(), numeric(&rhs).unwrap_or_default());
+    if result.is_finite() {
+        Ok(Value::Float(result))
+    } else {
+        Err(format!("{name} overflowed: {} {symbol} {} is not a finite number", to_s(&lhs)?, to_s(&rhs)?))
+    }
+}
+
+/// `Resolver.divide`: a zero divisor faults first; integers floor toward negative infinity.
+fn divide(left: &Value, right: &Value) -> Result<Value, String> {
+    if numeric(&require_number(right, "division")?) == Some(0.0) {
+        return Err("divided by 0".to_string());
+    }
+    arithmetic("division", "/", left, right, floor_div, |a, b| a / b)
+}
+
+/// Floored integer division; `None` only for `i64::MIN / -1`, which does not fit in 64 bits.
+fn floor_div(a: i64, b: i64) -> Option<i64> {
+    let quotient = a.checked_div(b)?;
+    Some(if a % b != 0 && ((a < 0) != (b < 0)) { quotient - 1 } else { quotient })
+}
+
 /// `Resolver.apply_modulo`: floored like Ruby's `%`, so the result takes the divisor's sign.
 fn modulo(receiver: &Value, divisor: &Value) -> Result<Value, String> {
     let receiver = require_number(receiver, "modulo")?;
@@ -423,6 +486,18 @@ fn split(text: &str, separator: &str) -> Vec<Value> {
     parts.into_iter().map(Value::Str).collect()
 }
 
+/// Ruby's `String#strip` family: trims null, tab, line feed, vertical tab, form feed, carriage
+/// return and space, never a Unicode space (Rust's own `trim` would drop U+00A0 too).
+fn strip(text: &str, side: StripSide) -> String {
+    let stripped = |c: char| matches!(c, '\0' | '\t' | '\n' | '\u{b}' | '\u{c}' | '\r' | ' ');
+    match side {
+        StripSide::Both => text.trim_matches(stripped),
+        StripSide::Left => text.trim_start_matches(stripped),
+        StripSide::Right => text.trim_end_matches(stripped),
+    }
+    .to_string()
+}
+
 /// Compiles a Ruby `Regexp` source for the `regex` crate.
 ///
 /// Ruby's `\d \w \s \h` are ASCII and its `^ $` are always line anchors, where `regex` reads
@@ -545,6 +620,13 @@ fn eval(expr: &Expr, instance: &Json, scope: Option<&Scope>) -> Result<Value, St
             }
         }
         Expr::Add { left, right } => add(&recur(left)?, &recur(right)?),
+        Expr::Sub { left, right } => {
+            arithmetic("subtraction", "-", &recur(left)?, &recur(right)?, i64::checked_sub, |a, b| a - b)
+        }
+        Expr::Mul { left, right } => {
+            arithmetic("multiplication", "*", &recur(left)?, &recur(right)?, i64::checked_mul, |a, b| a * b)
+        }
+        Expr::Div { left, right } => divide(&recur(left)?, &recur(right)?),
         Expr::Modulo { receiver, divisor } => modulo(&recur(receiver)?, &recur(divisor)?),
         Expr::SignTest { cmp, receiver } => {
             let v = recur(receiver)?;
@@ -587,6 +669,10 @@ fn eval(expr: &Expr, instance: &Json, scope: Option<&Scope>) -> Result<Value, St
             Value::Array(items) => Ok(items.into_iter().next_back().unwrap_or(Value::Nil)),
             other => Err(format!("last expects a list, got {}", describe(&other))),
         },
+        Expr::Strip { receiver, side } => match recur(receiver)? {
+            Value::Str(text) => Ok(Value::Str(strip(&text, *side))),
+            other => Err(format!("strip expects a string, got {}", describe(&other))),
+        },
         Expr::StartsWith { receiver, substring } => match recur(receiver)? {
             Value::Str(text) => Ok(Value::Bool(text.starts_with(substring.as_str()))),
             other => Err(format!("start_with? expects a string, got {}", describe(&other))),
@@ -828,6 +914,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn sub_mul_div_follow_rubys_limits_and_floor_integer_division() {
+        let op = |name: &str, l: Json, r: Json| json!({"op":name,"left":l,"right":r});
+        assert_eq!(run(op("sub", int(5), int(2)), json!({})), Ok(Value::Int(3)));
+        assert_eq!(run(op("mul", int(6), json!({"op":"float","value":0.5})), json!({})), Ok(Value::Float(3.0)));
+        assert_eq!(run(op("div", int(-7), int(2)), json!({})), Ok(Value::Int(-4)));
+        assert_eq!(run(op("div", int(7), int(-2)), json!({})), Ok(Value::Int(-4)));
+        assert_eq!(run(op("div", int(7), int(0)), json!({})), Err("divided by 0".to_string()));
+        assert_eq!(
+            run(op("mul", int(i64::MAX), int(2)), json!({})),
+            Err("multiplication overflowed: 9223372036854775807 * 2 does not fit in a 64-bit integer".to_string())
+        );
+        assert_eq!(
+            run(op("div", int(i64::MIN), int(-1)), json!({})),
+            Err("division overflowed: -9223372036854775808 / -1 does not fit in a 64-bit integer".to_string())
+        );
+        assert_eq!(run(op("sub", lookup_of("a"), int(1)), json!({"a": null})), Err("subtraction expects a number, got nil".to_string()));
+    }
+
     #[test]
     fn modulo_floors_like_ruby_for_integers_and_floats() {
         let modulo = |r: Json, d: Json| json!({"op":"modulo","receiver":r,"divisor":d});
@@ -1035,6 +1140,19 @@ mod tests {
         assert_eq!(run(call("first", lookup_of("x")), json!({"x": null})), Err("first expects a list, got nil".to_string()));
     }
 
+    #[test]
+    fn strip_trims_rubys_whitespace_and_needs_a_string() {
+        let strip_of = |side: &str, text: &str| run(json!({"op":"strip","receiver":lookup_of("x"),"side":side}), json!({"x": text}));
+        assert_eq!(strip_of("both", " \t a b \0"), Ok(Value::Str("a b".into())));
+        assert_eq!(strip_of("left", "  a "), Ok(Value::Str("a ".into())));
+        assert_eq!(strip_of("right", " a  "), Ok(Value::Str(" a".into())));
+        assert_eq!(strip_of("both", "\u{a0}a"), Ok(Value::Str("\u{a0}a".into())));
+        assert_eq!(
+            run(json!({"op":"strip","receiver":lookup_of("x"),"side":"both"}), json!({"x": null})),
+            Err("strip expects a string, got nil".to_string())
+        );
+    }
+
     #[test]
     fn starts_with_and_ends_with_need_a_string() {
         let starts = json!({"op":"starts_with","receiver":lookup_of("x"),"substring":"ab"});

data/rust/host/src/mint.rs

@@ -815,7 +815,7 @@ pub async fn audit_before_mint<C: GenericClient>(
         // `layer_one!(violations, aggregate, after)` exactly.
         if let Some(aggregate_ir) = ir_aggregates.get(aggregate.name.as_str()) {
             for (id, state) in &after {
-                violations.extend(reference_validate::validate(aggregate_ir, id, state));
+                violations.extend(reference_validate::validate(ir, aggregate_ir, id, state));
             }
         }
 

data/rust/host/src/payments/tests.rs

@@ -735,6 +735,21 @@ async fn archiving_a_paid_registration_frees_its_seat_and_restoring_it_takes_the
     assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"), Some(0));
 }
 
+#[tokio::test]
+async fn cancelling_a_paid_registration_reaches_a_state_the_fixture_declares_as_freeing_its_seat() {
+    let t = tenant("hecks_pay_test_capacity_cancel").await;
+    t.schedule_event_with_capacity("cancel-me", 1).await;
+    let (_, body) = t.register("cancel-me").await;
+    let reference = body["registration_id"].as_str().unwrap().to_string();
+    assert_eq!(t.settle(&reference).await, 200);
+
+    let cancelled = registration_command(&t, "Cancel", &reference).await;
+    assert!(cancelled.accepted, "{:?}", cancelled.result);
+    let state = registration_status(&t, &reference).await;
+    let declared = crate::commerce_ir::registrations_provider(&crate::commerce_ir::fixture_ir()).expect("registrations");
+    assert!(declared.frees_seat.contains(&state), "{state} is one of {:?}", declared.frees_seat);
+}
+
 #[tokio::test]
 async fn only_an_active_registration_can_be_archived_and_only_an_archived_one_restored() {
     let t = tenant("hecks_pay_test_archive_guards").await;
@@ -763,7 +778,7 @@ async fn a_stripe_session_expires_about_thirty_one_minutes_after_it_is_created()
     let sent = t.fake.requests_to("/v1/checkout/sessions");
     assert_eq!(sent.len(), 1);
     let expires_at: i64 = sent[0].body.split('&').find_map(|pair| pair.strip_prefix("expires_at=")).expect("an expires_at form field").parse().unwrap();
-    let hold = crate::checkout::SESSION_HOLD_SECONDS;
+    let hold = crate::checkout::effective_hold_seconds(crate::commerce_ir::checkout_windows_binding().session_hold);
     assert!((before + hold..=after + hold).contains(&expires_at), "expires_at {expires_at} is not {hold}s after creation ({before}..{after})");
     assert!((30 * 60..=35 * 60).contains(&hold), "Stripe's minimum is 30 minutes, and the hold should stay close to it");
 }
@@ -1398,3 +1413,14 @@ fn purpose_tokens_only_verify_for_their_own_purpose_and_secret() {
     assert!(auth::verify_purpose_token("other", "one", &token).is_none());
     assert!(auth::verify_account_token("k", &token).is_none(), "not a session cookie");
 }
+
+// ADR 0099: the processor and the modes are this adapter's own words, but the domain still has to
+// admit them. The fixture's source is the bluebook as the domain wrote it.
+#[test]
+fn the_adapter_words_are_ones_the_connection_domain_admits() {
+    let ir = crate::commerce_ir::fixture_ir();
+    let source = ir["source_text"].as_str().expect("the fixture carries its bluebook source");
+    assert!(source.contains(&format!("one_of: {MODES:?}")), "ConnectionMode must admit exactly {MODES:?}");
+    let payments = std::fs::read_to_string(std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../spec/fixtures/rust_host/checkout_fixture/bluebook/payments.bluebook")).expect("payments bluebook");
+    assert!(payments.contains(&format!("one_of: [\"mock_stripe\", \"{PROCESSOR}\"]")), "Payment's Processor must admit {PROCESSOR}");
+}

data/rust/host/src/payments.rs

@@ -19,7 +19,15 @@ use keystore::{KeyStore, StoredDocument, StoredKeys};
 
 const CONNECTION_SLUG: &str = "payments";
 const STRIPE_API_BASE: &str = "https://api.stripe.com";
+/// ADAPTER FACT (ADR 0099): the two environments a Stripe account has, named by the key prefix
+/// (`sk_test_`, `sk_live_`) and the env vars read here. The domain's `ConnectionMode` enumerates
+/// the same words; `the_adapter_words_are_ones_the_connection_domain_admits` holds the two
+/// together, so a renamed mode fails a test instead of a request.
 const MODES: [&str; 2] = ["test", "live"];
+/// ADAPTER FACT (ADR 0099): this module is the Stripe adapter, so the processor it reports to the
+/// domain is its own name. The domain's `Processor` enumerates the processors it admits; the same
+/// test holds the word to it.
+const PROCESSOR: &str = "stripe";
 /// The reserved `account_ref` of a connection that uses the business's own
 /// Stripe account directly. It is the only kind of connection this host charges.
 pub const SELF_ACCOUNT: &str = "self";
@@ -217,7 +225,7 @@ pub fn checkout_plan(connection: Option<&Connection>, platform: &PlatformConfig)
     match connection.status.as_str() {
         "enabled" => {
             let (key, publishable_key) = platform.direct_pair(&connection.mode);
-            if connection.processor != "stripe" || !connection.is_direct() || key.is_empty() {
+            if connection.processor != PROCESSOR || !connection.is_direct() || key.is_empty() {
                 CheckoutPlan::Paused
             } else if publishable_key.is_empty() {
                 eprintln!(
@@ -298,7 +306,7 @@ fn require_operator(caller: &Caller) -> Result<(), Value> {
 // modes have keys. Built field by field, so a credential can never appear here:
 // none is ever read into this value.
 fn connection_json(connection: Option<&Connection>, platform: &PlatformConfig, caller: &Caller) -> Value {
-    let label = connection.filter(|c| c.processor == "stripe").map(|_| "Stripe");
+    let label = connection.filter(|c| c.processor == PROCESSOR).map(|_| "Stripe");
     let present = |value: Option<&str>| value.filter(|s| !s.is_empty()).map(Value::from).unwrap_or(Value::Null);
     json!({
         "status": connection.map(|c| c.status.as_str()).unwrap_or("not_connected"),
@@ -442,7 +450,7 @@ async fn direct_route(caller: &Caller, raw_body: &str, platform: &PlatformConfig
     }
     let display_name = own_account_display_name(platform, platform.direct_key(&mode)).await;
     let facts = json!({
-        "processor": {"value": "stripe"},
+        "processor": {"value": PROCESSOR},
         "account_ref": {"value": SELF_ACCOUNT},
         "mode": {"value": mode},
         "display_name": {"value": display_name},
@@ -700,7 +708,7 @@ async fn save_keys_route(caller: &Caller, body: &Value, platform: &PlatformConfi
         return connection_response(caller, &fresh, client, wasm_path, config).await;
     }
     let facts = json!({
-        "processor": {"value": "stripe"},
+        "processor": {"value": PROCESSOR},
         "account_ref": {"value": SELF_ACCOUNT},
         "mode": {"value": mode},
         "display_name": {"value": display_name},

data/rust/host/src/query_step.rs

@@ -1,7 +1,7 @@
 //! The wire's query step: `{"query": "Aggregate.Query", "args": {...}}`.
 //!
 //! A declared query that filters stored records is answered by the kernel against current
-//! state, the way the Ruby launcher and doors answer it. A query that `returns` a value object
+//! state, the way the Ruby launcher and entry points answer it. A query that `returns` a value object
 //! is answered from outside the domain (a hecksagon `answers_query` binding); this host binds
 //! no adapter, so it refuses that question rather than answer it from the aggregate's rows, and
 //! it writes nothing to the journal for either.
@@ -25,15 +25,24 @@ pub enum Plan {
 ///
 /// @param domain_ir the domain's IR, when this host has one (`HECKS_IR_PATH`)
 /// @param domain the domain's name, used to qualify a short question
-/// @param question `Aggregate.Query`, or `Domain::Aggregate.Query`
+/// @param question `Aggregate.Query`, or `Chapter::Aggregate.Query` for this domain or one of its
+///   attached chapters
 /// @return a kernel question for a declared derivable query, a refusal for an unknown query on a
 ///   known aggregate or for a query answered outside the domain
 pub fn plan(domain_ir: Option<&Value>, domain: &str, question: &str) -> Plan {
-    let short = question.rsplit_once("::").map_or(question, |(_, rest)| rest);
-    let qualified = format!("{domain}::{short}");
+    // A question that names its own chapter (`Chapter::Aggregate.Query`) is asked of that chapter:
+    // the kernel's query table is keyed by the chapter's own domain name, so re-qualifying it with
+    // this host's would send an attached chapter's query to a table that does not hold it.
+    let (owner, short) = question.rsplit_once("::").unwrap_or((domain, question));
+    let qualified = format!("{owner}::{short}");
     let Some((aggregate_name, query_name)) = short.split_once('.') else {
         return Plan::Kernel(qualified);
     };
+    // This host's IR describes only its own domain's aggregates; another chapter's question is the
+    // kernel's to answer or refuse.
+    if owner != domain {
+        return Plan::Kernel(qualified);
+    }
     let aggregate = domain_ir
         .and_then(|ir| ir.get("aggregates"))
         .and_then(|v| v.as_array())
@@ -131,6 +140,15 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_question_naming_an_attached_chapter_keeps_that_chapter() {
+        let ir = domain();
+        assert_eq!(plan(Some(&ir), "Banking", "Media::MediaItem.Active"), Plan::Kernel("Media::MediaItem.Active".into()));
+        // The host's own aggregate of the same name is not mistaken for the chapter's.
+        assert_eq!(plan(Some(&ir), "Banking", "Media::Ledger.Ir"), Plan::Kernel("Media::Ledger.Ir".into()));
+        assert_eq!(plan(None, "Banking", "Media::MediaItem.Listing"), Plan::Kernel("Media::MediaItem.Listing".into()));
+    }
+
     #[test]
     fn what_this_ir_does_not_show_is_left_to_the_kernel() {
         let ir = domain();