hecks 3.10.0 → 3.12.0

data/rust/host/src/web/registrations.rs

@@ -34,17 +34,15 @@ fn payment_processor(read: &Value, payments: &PaymentsProvider, reference: &str)
         .and_then(|(_, payment)| payment.get("processor").and_then(|p| p.get("value")).and_then(|v| v.as_str()).map(String::from))
 }
 
-/// Payment statuses whose registration still holds a seat. A registration
-/// with no Payment, or one that's archived, holds none regardless of status.
-const SEAT_HOLDING_PAYMENT_STATUSES: [&str; 4] = ["pending", "succeeded", "refunding", "disputed"];
-
-/// The Registration lifecycle state that gives its seat back.
-const ARCHIVED_REGISTRATION_STATUS: &str = "archived";
-
-/// Whether a registration's own lifecycle has archived it. A missing or
-/// non-text `status` is active.
-fn registration_archived(registration: &Value) -> bool {
-    registration.get("status").and_then(|s| s.as_str()) == Some(ARCHIVED_REGISTRATION_STATUS)
+// Payment statuses whose registration still holds a seat come from the
+// payment lifecycle's `holds_seat` mark (`PaymentsProvider::holds_seat`). A
+// registration with no Payment, or one in a state that frees its seat, holds none.
+
+/// Whether a registration's own lifecycle state is one the chapter declares gives its seat
+/// back (`RegistrationsProvider::frees_seat`). A missing or non-text `status` is active.
+fn registration_frees_seat(registration: &Value, frees_seat: &[String]) -> bool {
+    let status = registration.get("status").and_then(|s| s.as_str());
+    status.is_some_and(|status| frees_seat.iter().any(|freed| freed == status))
 }
 
 /// A reference to an aggregate reads back as its plain id, or wrapped as
@@ -55,17 +53,24 @@ fn plain_id(raw: Option<&Value>) -> Option<String> {
     value.as_str().filter(|id| !id.is_empty()).map(String::from)
 }
 
-/// Seats used per event slug: non-archived Registrations whose Payment (same
+/// Seats used per event slug: Registrations not in a seat-freeing state whose Payment (same
 /// reference) is in a seat-holding status.
 fn seat_counts(read: &Value, domain: &str, payments: &PaymentsProvider) -> std::collections::HashMap<String, usize> {
+    let binding = crate::commerce_ir::registrations_binding(domain);
+    count_seats(read, &binding, payments)
+}
+
+/// The seat count of `seat_counts` against an explicit registrations binding.
+fn count_seats(read: &Value, binding: &crate::commerce_ir::RegistrationsProvider, payments: &PaymentsProvider) -> std::collections::HashMap<String, usize> {
     let statuses: std::collections::HashMap<String, String> = instances_for(read, &payments.instance_prefix())
         .into_iter()
         .filter_map(|(id, payment)| payment.get("status").and_then(|s| s.as_str()).map(|s| (id, s.to_string())))
         .collect();
     let mut counts = std::collections::HashMap::new();
-    for (id, registration) in instances_for(read, &crate::commerce_ir::registrations_binding(domain).registration_prefix()) {
-        let holds = statuses.get(&id).is_some_and(|status| SEAT_HOLDING_PAYMENT_STATUSES.contains(&status.as_str()));
-        if let (true, false, Some(event_slug)) = (holds, registration_archived(&registration), plain_id(registration.get("event_slug"))) {
+    for (id, registration) in instances_for(read, &binding.registration_prefix()) {
+        let holds = statuses.get(&id).is_some_and(|status| payments.holds_seat.iter().any(|held| held == status));
+        let freed = registration_frees_seat(&registration, &binding.frees_seat);
+        if let (true, false, Some(event_slug)) = (holds, freed, plain_id(registration.get("event_slug"))) {
             *counts.entry(event_slug).or_insert(0) += 1;
         }
     }
@@ -82,6 +87,27 @@ fn event_capacity(event: &Value) -> Option<i64> {
     event.get("capacity").and_then(|c| c.get("value")).and_then(|v| v.as_i64())
 }
 
+/// A whole-number field read as a bare number or as a single-field value
+/// object's `{"value": N}`; `None` for anything else, so an unreadable value
+/// never blocks a registration.
+fn whole_number(field: Option<&Value>) -> Option<i64> {
+    let field = field?;
+    field.as_i64().or_else(|| field.get("value").and_then(|v| v.as_i64()))
+}
+
+/// Whether an event's registration window has shut because its start is
+/// nearer than `registration_cutoff_hours` (Unix seconds, whole hours).
+/// Refused only when both `starts_at` and `registration_cutoff_hours` are
+/// readable and `now_secs + hours * 3600 > starts_at`; exactly at the
+/// cutoff is still open. Either field absent, null or unreadable means no
+/// cutoff, the stance the seat check takes.
+fn registration_cutoff_passed(event: &Value, now_secs: i64) -> bool {
+    let (Some(starts_at), Some(hours)) = (whole_number(event.get("starts_at")), whole_number(event.get("registration_cutoff_hours"))) else {
+        return false;
+    };
+    now_secs.saturating_add(hours.saturating_mul(3600)) > starts_at
+}
+
 /// Seats still open given `taken`, never below zero.
 fn open_seats(capacity: i64, taken: usize) -> i64 {
     (capacity - taken as i64).max(0)
@@ -419,6 +445,22 @@ pub(crate) async fn registrations_route(
     config: &LineageConfig,
     invoker: &dyn LambdaInvoker,
     payments: &PaymentsProvider,
+) -> Value {
+    registrations_route_at(raw_body, platform, client, wasm_path, config, invoker, payments, unix_now()).await
+}
+
+// The route with the wall clock passed in, so a test can fix the time the
+// registration cutoff is measured against.
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn registrations_route_at(
+    raw_body: &str,
+    platform: &payments::PlatformConfig,
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    config: &LineageConfig,
+    invoker: &dyn LambdaInvoker,
+    payments: &PaymentsProvider,
+    now_secs: i64,
 ) -> Value {
     let body: Value = match serde_json::from_str(raw_body) {
         Ok(v) => v,
@@ -448,6 +490,11 @@ pub(crate) async fn registrations_route(
     if event.get("status").and_then(|v| v.as_str()) != Some("open") {
         return respond(422, "application/json", &json!({"error": "registration is closed for this event"}).to_string());
     }
+    // An event that opted into a cutoff stops taking registrations that many
+    // hours before it starts; a missing or unreadable field is no cutoff.
+    if registration_cutoff_passed(event, now_secs) {
+        return respond(422, "application/json", &json!({"error": "registration has closed for this event"}).to_string());
+    }
     // A full event refuses before any Stripe call or write. An event whose
     // capacity cannot be read is not blocked: capacity is required when an
     // event is scheduled, so its absence means nothing to enforce.
@@ -477,7 +524,7 @@ pub(crate) async fn registrations_route(
     // follows, the unused session simply expires.
     let embedded_checkout = if let payments::CheckoutPlan::Stripe { api_key, publishable_key } = &plan {
         let auth = checkout::StripeAuth { api_key, base_url: &platform.api_base };
-        match checkout::create_checkout_session(&auth, price_cents, event_name, &reference, checkout::session_expires_at(unix_now())).await {
+        match checkout::create_checkout_session(&auth, price_cents, event_name, &reference, checkout::session_expires_at(now_secs, crate::commerce_ir::checkout_windows_binding().session_hold)).await {
             // Stripe.js is opened with the publishable key; the answer carries
             // no `checkout_url`.
             Ok(session) => Some(json!({
@@ -611,9 +658,10 @@ pub(crate) async fn webhook_route(
         return mock_secret_refused();
     }
     let candidates = if configured.is_empty() { vec![MOCK_STRIPE_WEBHOOK_SECRET] } else { configured };
+    let tolerance = crate::commerce_ir::checkout_windows_binding().webhook_tolerance;
     let mut verification = Ok(());
     for secret in &candidates {
-        verification = checkout::verify_signature(raw_body, signature_header, secret, now);
+        verification = checkout::verify_signature(raw_body, signature_header, secret, now, tolerance);
         if verification.is_ok() {
             break;
         }
@@ -671,7 +719,7 @@ pub(crate) async fn webhook_route(
             }
             "checkout.session.expired" => Some((payments.failed.as_str(), json!({
                 "reference": reference_fact,
-                "reason": {"value": "checkout_expired"},
+                "reason": {"value": payments.lapse_reason},
                 "reported_processor": reported_processor,
             }))),
             _ => None,
@@ -749,7 +797,7 @@ mod tests {
 
     #[test]
     fn a_registration_holds_a_seat_while_its_payment_is_open_paid_or_being_settled() {
-        let payments = crate::commerce_ir::fixture_payments();
+        let payments = four_state_payments();
         let read = read_with(
             10,
             &[("a", "yoga", "pending"), ("b", "yoga", "succeeded"), ("c", "yoga", "refunding"), ("d", "yoga", "disputed")],
@@ -788,6 +836,49 @@ mod tests {
         assert_eq!(seats_left(&read, "CheckoutFixture", &payments, "yoga"), Some(1));
     }
 
+    fn binding_freeing(states: &[&str]) -> crate::commerce_ir::RegistrationsProvider {
+        let mut binding = crate::commerce_ir::RegistrationsProvider::conventional("CheckoutFixture");
+        binding.frees_seat = states.iter().map(|s| s.to_string()).collect();
+        binding
+    }
+
+    #[test]
+    fn a_declared_state_other_than_archived_frees_its_seat() {
+        let payments = crate::commerce_ir::fixture_payments();
+        let mut read = read_with(3, &[("a", "yoga", "succeeded"), ("b", "yoga", "succeeded")]);
+        set_registration_status(&mut read, "a", "cancelled");
+        let counts = count_seats(&read, &binding_freeing(&["cancelled"]), &payments);
+        assert_eq!(counts.get("yoga"), Some(&1), "cancelled is declared, so it frees the seat");
+    }
+
+    #[test]
+    fn the_fixture_declared_cancelled_state_frees_its_seat_beside_archived() {
+        let payments = crate::commerce_ir::fixture_payments();
+        let binding = crate::commerce_ir::registrations_provider(&crate::commerce_ir::fixture_ir()).expect("registrations");
+        let mut read = read_with(3, &[("a", "yoga", "succeeded"), ("b", "yoga", "succeeded"), ("c", "yoga", "succeeded")]);
+        set_registration_status(&mut read, "a", "cancelled");
+        set_registration_status(&mut read, "b", "archived");
+        assert_eq!(count_seats(&read, &binding, &payments).get("yoga"), Some(&1));
+    }
+
+    #[test]
+    fn a_state_the_chapter_does_not_declare_keeps_its_seat_even_when_it_is_archived() {
+        let payments = crate::commerce_ir::fixture_payments();
+        let mut read = read_with(3, &[("a", "yoga", "succeeded")]);
+        set_registration_status(&mut read, "a", "archived");
+        let counts = count_seats(&read, &binding_freeing(&["cancelled"]), &payments);
+        assert_eq!(counts.get("yoga"), Some(&1), "only the declared states free a seat");
+    }
+
+    #[test]
+    fn with_no_declaration_the_conventional_binding_frees_the_archived_seat() {
+        let payments = crate::commerce_ir::fixture_payments();
+        let mut read = read_with(3, &[("a", "yoga", "succeeded")]);
+        set_registration_status(&mut read, "a", "archived");
+        let conventional = crate::commerce_ir::RegistrationsProvider::conventional("CheckoutFixture");
+        assert_eq!(count_seats(&read, &conventional, &payments).get("yoga"), None);
+    }
+
     #[test]
     fn a_registration_with_no_status_counts_as_active() {
         let payments = crate::commerce_ir::fixture_payments();
@@ -847,18 +938,22 @@ mod tests {
         read["instances"][format!("CheckoutFixture::Registration#{reference}")]["status"] = json!(status);
     }
 
+    /// The fixture's payments binding with the production table: the fixture lifecycle has only
+    /// pending, succeeded and failed, so refunding and disputed need the table set here.
+    fn four_state_payments() -> crate::commerce_ir::PaymentsProvider {
+        let mut payments = crate::commerce_ir::fixture_payments();
+        payments.holds_seat = HOLDING.iter().map(|s| s.to_string()).collect();
+        payments
+    }
+
     #[test]
-    fn the_seat_holding_table_is_exactly_pending_succeeded_refunding_and_disputed() {
-        let mut table = SEAT_HOLDING_PAYMENT_STATUSES;
-        table.sort_unstable();
-        let mut expected = HOLDING;
-        expected.sort_unstable();
-        assert_eq!(table, expected);
+    fn the_seat_holding_table_comes_from_the_fixture_ir_mark() {
+        assert_eq!(crate::commerce_ir::fixture_payments().holds_seat, vec!["pending", "succeeded"]);
     }
 
     #[test]
     fn every_holding_status_holds_one_seat_and_every_freeing_status_holds_none() {
-        let payments = crate::commerce_ir::fixture_payments();
+        let payments = four_state_payments();
         for status in HOLDING {
             let read = read_with(10, &[("r", "yoga", status)]);
             assert_eq!(seats_taken(&read, "CheckoutFixture", &payments, "yoga"), 1, "{status} should hold a seat");
@@ -1235,6 +1330,114 @@ mod tests {
         assert!(response["body"].as_str().unwrap().contains("closed"));
     }
 
+    // Schedules `slug` starting at `starts_at` with the optional cutoff set
+    // (or absent), through the real Event.Schedule command.
+    async fn schedule_timed_event(client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, slug: &str, starts_at: i64, cutoff_hours: Option<i64>) {
+        let mut args = json!({
+            "slug": {"value": slug}, "name": {"value": "Sample Studio"},
+            "price": {"cents": 4200}, "capacity": {"value": 20},
+            "starts_at": {"value": starts_at},
+        });
+        if let Some(hours) = cutoff_hours {
+            args["registration_cutoff_hours"] = json!({"value": hours});
+        }
+        let outcome = dispatch::handle(client, wasm_path, "CheckoutFixture::Event.Schedule", args, None, config, &lambda_client::NeverInvoker)
+            .await
+            .unwrap();
+        assert!(outcome.accepted, "scheduling the timed fixture event should succeed: {:?}", outcome.result);
+    }
+
+    #[tokio::test]
+    async fn registrations_route_refuses_a_session_inside_its_registration_cutoff_and_writes_nothing() {
+        let client = scratch_db("hecks_host_web_test_registrations_cutoff_passed").await;
+        provision_lineage(&*client.lock().await, "CheckoutFixture", 1, &["Event", "Registration", "Payment"]).await;
+        let config = checkout_config(1);
+        let wasm_path = checkout_wasm_path();
+
+        // Starts in 5 hours with a 6 hour cutoff: registration closed an hour ago.
+        let now = 1_800_000_000;
+        schedule_timed_event(&client, &wasm_path, &config, "too-late", now + 5 * 3600, Some(6)).await;
+
+        let body = json!({"event_slug": "too-late", "name": "Ada", "email": "ada@example.com"}).to_string();
+        let response = registrations_route_at(&body, &payments::test_platform(), &client, &wasm_path, &config, &lambda_client::NeverInvoker, &crate::commerce_ir::fixture_payments(), now).await;
+        assert_eq!(response["statusCode"], 422, "{response:?}");
+        assert_eq!(
+            serde_json::from_str::<Value>(response["body"].as_str().unwrap()).unwrap(),
+            json!({"error": "registration has closed for this event"})
+        );
+
+        let read = dispatch::read(&client, &wasm_path).await.unwrap();
+        let instances = read["instances"].as_object().unwrap();
+        assert!(
+            instances.keys().all(|k| !k.starts_with("Payments::Payment#") && !k.starts_with("CheckoutFixture::Registration#")),
+            "a refused registration must write no Payment and no Registration: {instances:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn registrations_route_accepts_a_session_with_no_cutoff_even_when_it_has_a_start() {
+        let client = scratch_db("hecks_host_web_test_registrations_cutoff_absent").await;
+        provision_lineage(&*client.lock().await, "CheckoutFixture", 1, &["Event", "Registration", "Payment"]).await;
+        let config = checkout_config(1);
+        let wasm_path = checkout_wasm_path();
+
+        // A start in the past and no cutoff field: nothing to enforce.
+        let now = 1_800_000_000;
+        schedule_timed_event(&client, &wasm_path, &config, "no-cutoff", now - 3600, None).await;
+
+        let body = json!({"event_slug": "no-cutoff", "name": "Ada", "email": "ada@example.com"}).to_string();
+        let response = registrations_route_at(&body, &payments::test_platform(), &client, &wasm_path, &config, &lambda_client::NeverInvoker, &crate::commerce_ir::fixture_payments(), now).await;
+        assert_eq!(response["statusCode"], 200, "{response:?}");
+
+        let read = dispatch::read(&client, &wasm_path).await.unwrap();
+        let instances = read["instances"].as_object().unwrap();
+        assert!(instances.keys().any(|k| k.starts_with("CheckoutFixture::Registration#")), "{instances:?}");
+        assert!(instances.keys().any(|k| k.starts_with("Payments::Payment#")), "{instances:?}");
+    }
+
+    #[test]
+    fn a_registration_cutoff_needs_both_fields_and_ignores_unreadable_ones() {
+        let now = 1_000_000;
+        let past_start = json!({"starts_at": 0});
+        assert!(!registration_cutoff_passed(&json!({}), now));
+        assert!(!registration_cutoff_passed(&past_start, now), "a start with no cutoff hours is no cutoff");
+        assert!(!registration_cutoff_passed(&json!({"registration_cutoff_hours": 48}), now), "hours with no start is no cutoff");
+        assert!(!registration_cutoff_passed(&json!({"starts_at": null, "registration_cutoff_hours": 48}), now));
+        assert!(!registration_cutoff_passed(&json!({"starts_at": 0, "registration_cutoff_hours": null}), now));
+        assert!(!registration_cutoff_passed(&json!({"starts_at": "soon", "registration_cutoff_hours": 48}), now));
+        assert!(!registration_cutoff_passed(&json!({"starts_at": 0, "registration_cutoff_hours": "two"}), now));
+        assert!(!registration_cutoff_passed(&json!({"starts_at": {"value": "soon"}, "registration_cutoff_hours": {"value": 1.5}}), now));
+    }
+
+    #[test]
+    fn a_registration_cutoff_is_open_exactly_at_the_boundary_and_closed_a_second_later() {
+        // Cutoff 2 hours before a start of 100_000: the window shuts after 92_800.
+        let event = json!({"starts_at": 100_000, "registration_cutoff_hours": 2});
+        assert!(!registration_cutoff_passed(&event, 92_799));
+        assert!(!registration_cutoff_passed(&event, 92_800), "exactly at the cutoff is still open");
+        assert!(registration_cutoff_passed(&event, 92_801));
+    }
+
+    #[test]
+    fn a_registration_cutoff_reads_a_value_object_or_a_bare_number() {
+        let wrapped = json!({"starts_at": {"value": 100_000}, "registration_cutoff_hours": {"value": 2}});
+        let bare = json!({"starts_at": 100_000, "registration_cutoff_hours": 2});
+        let mixed = json!({"starts_at": {"value": 100_000}, "registration_cutoff_hours": 2});
+        for event in [wrapped, bare, mixed] {
+            assert!(!registration_cutoff_passed(&event, 92_800), "{event}");
+            assert!(registration_cutoff_passed(&event, 92_801), "{event}");
+        }
+    }
+
+    #[test]
+    fn a_registration_cutoff_refuses_a_start_already_in_the_past() {
+        let event = json!({"starts_at": 1_000, "registration_cutoff_hours": 1});
+        assert!(registration_cutoff_passed(&event, 5_000));
+        let no_hours_of_notice = json!({"starts_at": 1_000, "registration_cutoff_hours": 0});
+        assert!(!registration_cutoff_passed(&no_hours_of_notice, 1_000));
+        assert!(registration_cutoff_passed(&no_hours_of_notice, 1_001));
+    }
+
     #[tokio::test]
     async fn registrations_route_propagates_a_real_domain_refusal_from_payment_initiate() {
         // A zero-price event: PositiveMoney's invariant refuses

data/rust/host/src/web.rs

@@ -608,20 +608,20 @@ async fn registrations_list_route(
 // Built field-by-field from an allowlist so intake answers (health,
 // medications) and payment fields can never appear here.
 fn registration_list_rows(read: &Value, domain: &str) -> Vec<Value> {
-    const TIMESTAMP_KEYS: [&str; 4] = ["created_at", "registered_at", "requested_at", "occurred_at"];
+    let binding = crate::commerce_ir::registrations_binding(domain);
     let plain = |value: Option<&Value>| -> Option<Value> {
         let value = value?;
         Some(value.get("value").cloned().unwrap_or_else(|| value.clone()))
     };
     let text = |value: Option<&Value>| plain(value).and_then(|v| v.as_str().map(|s| s.trim().to_string()));
 
-    let mut rows: Vec<(Option<String>, Value)> = instances_for(read, &crate::commerce_ir::registrations_binding(domain).registration_prefix())
+    let mut rows: Vec<(Option<String>, Value)> = instances_for(read, &binding.registration_prefix())
         .into_iter()
         .map(|(id, registration)| {
             let attendee = registration.get("attendee").cloned().unwrap_or_else(|| json!({}));
             let joined = [text(attendee.get("first_name")), text(attendee.get("last_name"))].into_iter().flatten().collect::<Vec<_>>().join(" ");
             let name = if joined.is_empty() { text(attendee.get("name")).unwrap_or_default() } else { joined };
-            let stamp = TIMESTAMP_KEYS.iter().find_map(|key| text(registration.get(*key)));
+            let stamp = binding.timestamp_keys.iter().find_map(|key| text(registration.get(key.as_str())));
             let mut row = json!({
                 "registration_id": id,
                 "email": text(attendee.get("email")),
@@ -1686,17 +1686,29 @@ fn redirect(location: &str) -> Value {
     json!({"statusCode": 302, "headers": {"location": location}, "body": "", "isBase64Encoded": false})
 }
 
-// HttpOnly + SameSite always; Secure only when GOOGLE_REDIRECT_URI is
-// https — a localhost http:// callback can't set a Secure cookie.
+// HttpOnly + SameSite always; Secure unless the host's own address is plain http — a localhost
+// http:// callback can't set a Secure cookie. See `account_cookie_flags` for which address counts.
 fn cookie_flags() -> &'static str {
-    let uri = std::env::var("GOOGLE_REDIRECT_URI").unwrap_or_default();
-    if uri.starts_with("http://") {
-        "; Path=/; HttpOnly; SameSite=Lax"
+    let redirect_uri = std::env::var("GOOGLE_REDIRECT_URI").unwrap_or_default();
+    let site_url = std::env::var("SITE_URL").unwrap_or_default();
+    account_cookie_flags(&redirect_uri, &site_url)
+}
+
+// The flags for the account cookie given the Google redirect URI and the site's public address.
+// A host that sets the redirect URI is judged by it, as ever; a host that has stopped setting it
+// is judged by SITE_URL, and with neither set the cookie is Secure.
+pub(crate) fn account_cookie_flags(redirect_uri: &str, site_url: &str) -> &'static str {
+    let judged_by = if redirect_uri.is_empty() { site_url } else { redirect_uri };
+    if judged_by.starts_with("http://") {
+        COOKIE_FLAGS_PLAIN
     } else {
-        "; Path=/; HttpOnly; Secure; SameSite=Lax"
+        COOKIE_FLAGS_SECURE
     }
 }
 
+pub(crate) const COOKIE_FLAGS_SECURE: &str = "; Path=/; HttpOnly; Secure; SameSite=Lax";
+const COOKIE_FLAGS_PLAIN: &str = "; Path=/; HttpOnly; SameSite=Lax";
+
 fn redirect_with_cookie(location: &str, cookie: &str) -> Value {
     json!({"statusCode": 302, "headers": {"location": location}, "cookies": [cookie], "body": "", "isBase64Encoded": false})
 }
@@ -2985,6 +2997,38 @@ mod tests {
 
 }
 
+#[cfg(test)]
+mod cookie_flag_tests {
+    use super::account_cookie_flags;
+
+    const SECURE: &str = "; Path=/; HttpOnly; Secure; SameSite=Lax";
+    const PLAIN: &str = "; Path=/; HttpOnly; SameSite=Lax";
+
+    #[test]
+    fn a_host_that_sets_the_redirect_uri_is_judged_by_it_as_before() {
+        assert_eq!(account_cookie_flags("https://site.example/auth/google/callback", ""), SECURE);
+        assert_eq!(account_cookie_flags("http://localhost:4567/auth/google/callback", ""), PLAIN);
+        assert_eq!(account_cookie_flags("https://site.example/cb", "http://localhost:4321"), SECURE);
+        assert_eq!(account_cookie_flags("http://localhost:4567/cb", "https://site.example"), PLAIN);
+    }
+
+    #[test]
+    fn a_host_with_no_redirect_uri_and_an_https_site_url_still_sets_secure() {
+        assert_eq!(account_cookie_flags("", "https://site.example"), SECURE);
+        assert_eq!(account_cookie_flags("", "https://site.example/"), SECURE);
+    }
+
+    #[test]
+    fn a_host_with_no_redirect_uri_and_an_http_site_url_does_not_demand_secure() {
+        assert_eq!(account_cookie_flags("", "http://localhost:4321"), PLAIN);
+    }
+
+    #[test]
+    fn a_host_with_neither_setting_stays_secure() {
+        assert_eq!(account_cookie_flags("", ""), SECURE);
+    }
+}
+
 #[cfg(test)]
 #[path = "boundary_fuzz/web.rs"]
 mod boundary_fuzz;

data/rust/parser/src/emit.rs

@@ -411,13 +411,18 @@ fn mutation_source_json(source: &Option<ir::MutationSource>) -> JsonValue {
             ("kind".to_string(), JsonValue::str("state")),
             ("name".to_string(), JsonValue::str(name.clone())),
         ]),
+        Some(ir::MutationSource::Expression(text)) => JsonValue::Object(vec![
+            ("kind".to_string(), JsonValue::str("expression")),
+            ("text".to_string(), JsonValue::str(text.clone())),
+            ("ast".to_string(), crate::expr::ast_json::emit_resolver(&crate::expr::resolver::parse(text))),
+        ]),
         None => JsonValue::Null,
     }
 }
 
 /// `IR::Lifecycle#to_h`; `transitions:` arrives already expanded, one row per `from_state`.
 fn lifecycle_json(l: &ir::Lifecycle) -> JsonValue {
-    JsonValue::Object(vec![
+    let mut fields = vec![
         ("field".to_string(), JsonValue::str(l.field.clone())),
         ("default".to_string(), JsonValue::str(l.default.clone())),
         (
@@ -435,7 +440,25 @@ fn lifecycle_json(l: &ir::Lifecycle) -> JsonValue {
                     .collect(),
             ),
         ),
-    ])
+    ];
+    // Omitted when empty, so an unmarked lifecycle's IR is unchanged.
+    if !l.marks.is_empty() {
+        fields.push((
+            "marks".to_string(),
+            JsonValue::Object(
+                l.marks
+                    .iter()
+                    .map(|(name, states)| {
+                        (
+                            name.clone(),
+                            JsonValue::Array(states.iter().map(|s| JsonValue::str(s.clone())).collect()),
+                        )
+                    })
+                    .collect(),
+            ),
+        ));
+    }
+    JsonValue::Object(fields)
 }
 
 /// `IR::Query#to_h` merged with `query_options_json`, which appends only the declared
@@ -783,15 +806,24 @@ fn dispatch_spec_json(d: &ir::DispatchSpec) -> JsonValue {
     ])
 }
 
+/// An ask policy carries `ask` where a trigger policy carries `trigger_command`, as
+/// `Behaviour::Policy#to_h` does; a trigger policy has no `ask` key at all.
+fn trigger_or_ask_entry(p: &ir::Policy) -> (String, JsonValue) {
+    match &p.ask {
+        Some(name) => ("ask".to_string(), JsonValue::str(name.clone())),
+        None => (
+            "trigger_command".to_string(),
+            JsonValue::opt_str(&p.trigger_command),
+        ),
+    }
+}
+
 /// `Policy#to_h`: attribute declaration order from reaction.bluebook, then `where_ast` last.
 fn policy_json(p: &ir::Policy) -> JsonValue {
     JsonValue::Object(vec![
         ("name".to_string(), JsonValue::str(p.name.clone())),
         ("on_event".to_string(), JsonValue::opt_str(&p.on_event)),
-        (
-            "trigger_command".to_string(),
-            JsonValue::opt_str(&p.trigger_command),
-        ),
+        trigger_or_ask_entry(p),
         (
             "target_domain".to_string(),
             JsonValue::opt_str(&p.target_domain),

data/rust/parser/src/expr/ast_json.rs

@@ -66,7 +66,7 @@ fn emit_include(haystack: &Resolver, needle: &Resolver) -> JsonValue {
         .expect("non-empty by the guard above")
 }
 
-fn emit_resolver(node: &Resolver) -> JsonValue {
+pub fn emit_resolver(node: &Resolver) -> JsonValue {
     match node {
         Resolver::IntegerLiteral(v) => obj(vec![op_tag("int"), ("value", JsonValue::Number(v.to_string()))]),
         Resolver::FloatLiteral(v) => obj(vec![op_tag("float"), ("value", JsonValue::Number(ruby_float(*v)))]),
@@ -78,6 +78,9 @@ fn emit_resolver(node: &Resolver) -> JsonValue {
             ("path", JsonValue::Array(path.split('.').map(|s| JsonValue::String(s.to_string())).collect())),
         ]),
         Resolver::Addition(left, right) => obj(vec![op_tag("add"), ("left", emit_resolver(left)), ("right", emit_resolver(right))]),
+        Resolver::Subtraction(left, right) => obj(vec![op_tag("sub"), ("left", emit_resolver(left)), ("right", emit_resolver(right))]),
+        Resolver::Multiplication(left, right) => obj(vec![op_tag("mul"), ("left", emit_resolver(left)), ("right", emit_resolver(right))]),
+        Resolver::Division(left, right) => obj(vec![op_tag("div"), ("left", emit_resolver(left)), ("right", emit_resolver(right))]),
         Resolver::SignTest { operator, receiver } => obj(vec![
             op_tag("sign_test"),
             ("cmp", emit_comparison(operator)),
@@ -106,6 +109,9 @@ fn emit_resolver(node: &Resolver) -> JsonValue {
         Resolver::Split { receiver, separator } => {
             obj(vec![op_tag("split"), ("receiver", emit_resolver(receiver)), ("separator", JsonValue::String(separator.clone()))])
         }
+        Resolver::Strip { receiver, side } => {
+            obj(vec![op_tag("strip"), ("receiver", emit_resolver(receiver)), ("side", JsonValue::String((*side).to_string()))])
+        }
         Resolver::StartsWith { receiver, substring } => {
             obj(vec![op_tag("starts_with"), ("receiver", emit_resolver(receiver)), ("substring", JsonValue::String(substring.clone()))])
         }