hecks 3.11.0 → 3.13.0

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.11.0
+3.13.0

data/rust/host/src/auth.rs

@@ -260,6 +260,43 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
         })
 }
 
+/// Resolves an external identity the way the Google callback does: the PostgresEra head first,
+/// then the flat journal's `instances`. A domain whose Identity chapter keeps no head of its own
+/// (its heads cover its own aggregates and the membership aggregate) holds the link only there.
+///
+/// # Errors
+///
+/// Returns the flat journal's read error, except that a missing flat journal means no link there. A
+/// head that cannot be read is logged and skipped, as the Google callback does, so the flat journal
+/// still gets its turn.
+pub async fn resolve_identity_anywhere(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    domain_ir: &Value,
+    issuer: &str,
+    subject: &str,
+) -> anyhow::Result<Option<String>> {
+    match resolve_identity_from_head(client, domain_ir, issuer, subject).await {
+        Ok(Some(found)) => return Ok(Some(found)),
+        Ok(None) => {}
+        Err(error) => eprintln!("resolve_identity: identity head: {error:#}"),
+    }
+    let read = match dispatch::read(client, wasm_path).await {
+        Ok(read) => read,
+        Err(error) if flat_journal_is_absent(&error) => return Ok(None),
+        Err(error) => return Err(error),
+    };
+    Ok(resolve_identity(read.get("instances").unwrap_or(&Value::Null), issuer, subject))
+}
+
+// A store with heads only has no flat journal to read; that is "no link there", not an outage.
+fn flat_journal_is_absent(error: &anyhow::Error) -> bool {
+    error
+        .chain()
+        .filter_map(|cause| cause.downcast_ref::<tokio_postgres::Error>())
+        .any(|db| db.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE))
+}
+
 /// Identity lives in the PostgresEra head, not `dispatch::read`'s
 /// `instances` — tries both the domain-qualified and the bare relation name.
 pub async fn resolve_identity_from_head(
@@ -1102,6 +1139,27 @@ mod tests {
         assert!(resolve_identity(&instances, "google", "nope").is_none());
     }
 
+    #[test]
+    fn resolve_identity_finds_a_link_that_only_the_flat_journal_holds() {
+        // The shape `ExternalIdentifier.Link` leaves in the flat snapshot of a domain whose Identity
+        // chapter has no head of its own; the key carries the issuer URL and the subject.
+        let instances = json!({
+            "Identity::ExternalIdentifier#https://accounts.google.com:111": {
+                "identity": "471ef402-8609-4fa4-9288-6372fc74650d",
+                "key": {"value": "https://accounts.google.com:111"},
+                "issuer": {"value": "https://accounts.google.com"},
+                "subject": {"value": "111"},
+            },
+        });
+        let read = json!({ "instances": instances });
+        assert_eq!(
+            resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "111").as_deref(),
+            Some("471ef402-8609-4fa4-9288-6372fc74650d")
+        );
+        assert!(resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "112").is_none());
+        assert!(resolve_identity(&Value::Null, "https://accounts.google.com", "111").is_none());
+    }
+
     #[test]
     fn resolve_identity_reads_the_2_0_identity_field() {
         let instances = json!({

data/rust/host/src/extension.rs

@@ -81,7 +81,19 @@ pub fn installed() -> &'static [Arc<dyn HostExtension>] {
 }
 
 fn default_extensions() -> Vec<Arc<dyn HostExtension>> {
-    vec![Arc::new(crate::web::Commerce)]
+    let vars = crate::platform_signin::settings::PROCESS_VARIABLES
+        .iter()
+        .filter_map(|name| std::env::var(name).ok().map(|value| (name.to_string(), value)))
+        .collect();
+    default_extensions_from(&vars)
+}
+
+/// The default extensions for an explicit set of settings: commerce, plus platform sign-in when
+/// it is switched on (or its boot refusal when its settings are wrong).
+pub(crate) fn default_extensions_from(vars: &HashMap<String, String>) -> Vec<Arc<dyn HostExtension>> {
+    let mut extensions: Vec<Arc<dyn HostExtension>> = vec![Arc::new(crate::web::Commerce)];
+    extensions.extend(crate::platform_signin::extension::extensions_for(vars));
+    extensions
 }
 
 /// The loaded domain IR, for an extension that needs it in the guest phase.

data/rust/host/src/lib.rs

@@ -23,6 +23,7 @@ pub mod log;
 pub mod mint;
 pub mod needs;
 pub mod payments;
+pub mod platform_signin;
 pub mod presentation;
 pub mod presentation_write;
 pub mod query_step;