hecks 3.12.0 → 3.13.0

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.12.0
+3.13.0

data/rust/host/src/auth.rs

@@ -260,6 +260,43 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
         })
 }
 
+/// Resolves an external identity the way the Google callback does: the PostgresEra head first,
+/// then the flat journal's `instances`. A domain whose Identity chapter keeps no head of its own
+/// (its heads cover its own aggregates and the membership aggregate) holds the link only there.
+///
+/// # Errors
+///
+/// Returns the flat journal's read error, except that a missing flat journal means no link there. A
+/// head that cannot be read is logged and skipped, as the Google callback does, so the flat journal
+/// still gets its turn.
+pub async fn resolve_identity_anywhere(
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+    domain_ir: &Value,
+    issuer: &str,
+    subject: &str,
+) -> anyhow::Result<Option<String>> {
+    match resolve_identity_from_head(client, domain_ir, issuer, subject).await {
+        Ok(Some(found)) => return Ok(Some(found)),
+        Ok(None) => {}
+        Err(error) => eprintln!("resolve_identity: identity head: {error:#}"),
+    }
+    let read = match dispatch::read(client, wasm_path).await {
+        Ok(read) => read,
+        Err(error) if flat_journal_is_absent(&error) => return Ok(None),
+        Err(error) => return Err(error),
+    };
+    Ok(resolve_identity(read.get("instances").unwrap_or(&Value::Null), issuer, subject))
+}
+
+// A store with heads only has no flat journal to read; that is "no link there", not an outage.
+fn flat_journal_is_absent(error: &anyhow::Error) -> bool {
+    error
+        .chain()
+        .filter_map(|cause| cause.downcast_ref::<tokio_postgres::Error>())
+        .any(|db| db.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE))
+}
+
 /// Identity lives in the PostgresEra head, not `dispatch::read`'s
 /// `instances` — tries both the domain-qualified and the bare relation name.
 pub async fn resolve_identity_from_head(
@@ -1102,6 +1139,27 @@ mod tests {
         assert!(resolve_identity(&instances, "google", "nope").is_none());
     }
 
+    #[test]
+    fn resolve_identity_finds_a_link_that_only_the_flat_journal_holds() {
+        // The shape `ExternalIdentifier.Link` leaves in the flat snapshot of a domain whose Identity
+        // chapter has no head of its own; the key carries the issuer URL and the subject.
+        let instances = json!({
+            "Identity::ExternalIdentifier#https://accounts.google.com:111": {
+                "identity": "471ef402-8609-4fa4-9288-6372fc74650d",
+                "key": {"value": "https://accounts.google.com:111"},
+                "issuer": {"value": "https://accounts.google.com"},
+                "subject": {"value": "111"},
+            },
+        });
+        let read = json!({ "instances": instances });
+        assert_eq!(
+            resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "111").as_deref(),
+            Some("471ef402-8609-4fa4-9288-6372fc74650d")
+        );
+        assert!(resolve_identity(read.get("instances").unwrap_or(&Value::Null), "https://accounts.google.com", "112").is_none());
+        assert!(resolve_identity(&Value::Null, "https://accounts.google.com", "111").is_none());
+    }
+
     #[test]
     fn resolve_identity_reads_the_2_0_identity_field() {
         let instances = json!({

data/rust/host/src/platform_signin/session.rs

@@ -123,7 +123,7 @@ pub struct HostMembers<'a> {
 #[async_trait]
 impl MemberDirectory for HostMembers<'_> {
     async fn identity_for(&self, issuer: &str, subject: &str) -> anyhow::Result<Option<String>> {
-        auth::resolve_identity_from_head(self.client, self.domain_ir, issuer, subject).await
+        auth::resolve_identity_anywhere(self.client, self.wasm_path, self.domain_ir, issuer, subject).await
     }
 
     async fn session_for_identity(&self, identity_id: &str) -> anyhow::Result<Option<Session>> {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.12.0
+  version: 3.13.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -97,6 +97,8 @@ files:
 - lib/hecks/adapters/driven/postgres_era.adapter
 - lib/hecks/adapters/driven/prism.adapter
 - lib/hecks/adapters/driven/prism.rb
+- lib/hecks/adapters/driven/script_runner.adapter
+- lib/hecks/adapters/driven/script_runner.rb
 - lib/hecks/adapters/driven/secure_random_identity.adapter
 - lib/hecks/adapters/driven/secure_random_identity.rb
 - lib/hecks/adapters/driven/sql_query_builder.rb
@@ -454,13 +456,21 @@ files:
 - lib/hecks/forms/value_object_shape.rb
 - lib/hecks/fqn.rb
 - lib/hecks/framework.rb
+- lib/hecks/framework/bluebook/change.behaviors
+- lib/hecks/framework/bluebook/change.bluebook
+- lib/hecks/framework/bluebook/change.hecksagon
 - lib/hecks/framework/bluebook/compliance.bluebook
 - lib/hecks/framework/bluebook/console_settings.bluebook
 - lib/hecks/framework/bluebook/framework.hecksagon
 - lib/hecks/framework/bluebook/governance.bluebook
 - lib/hecks/framework/bluebook/identity.bluebook
 - lib/hecks/framework/bluebook/privacy.bluebook
-- lib/hecks/framework/oidc.json
+- lib/hecks/framework/change.oidc.json
+- lib/hecks/framework/compliance.oidc.json
+- lib/hecks/framework/console_settings.oidc.json
+- lib/hecks/framework/governance.oidc.json
+- lib/hecks/framework/identity.oidc.json
+- lib/hecks/framework/privacy.oidc.json
 - lib/hecks/freezer.rb
 - lib/hecks/fuzzing.rb
 - lib/hecks/fuzzing/bounded_exhaustive_expressions.rb
@@ -574,11 +584,12 @@ files:
 - lib/hecks/grammar/evolve/keywords.rb
 - lib/hecks/grammar/evolve/seeds.rb
 - lib/hecks/grammar/expression.bluebook
+- lib/hecks/grammar/expression.oidc.json
 - lib/hecks/grammar/expression_operators.json
 - lib/hecks/grammar/grammar.hecksagon
-- lib/hecks/grammar/oidc.json
 - lib/hecks/grammar/operators.rb
 - lib/hecks/grammar/translation.bluebook
+- lib/hecks/grammar/translation.oidc.json
 - lib/hecks/hecks/adapters/bluebook_report.rb
 - lib/hecks/hecks/adapters/codebase/codemods.rb
 - lib/hecks/hecks/adapters/codebase/conformance.rb
@@ -1177,7 +1188,10 @@ files:
 - lib/hecks/projections/site/edge/behaviours.rb
 - lib/hecks/projections/site/edge/checks.rb
 - lib/hecks/projections/site/edge/findings.rb
+- lib/hecks/projections/site/edge/function_checks.rb
+- lib/hecks/projections/site/edge/function_code.rb
 - lib/hecks/projections/site/edge/pattern.rb
+- lib/hecks/projections/site/edge/redirect_host.js.tmpl
 - lib/hecks/projections/site/edge/route_checks.rb
 - lib/hecks/projections/site/edge/row_reader.rb
 - lib/hecks/projections/site/edge/rules.rb
@@ -1622,9 +1636,9 @@ files:
 - lib/rubocop/cop/hecks/symbol_string_key_mix.rb
 - lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb
 - lib/rubocop/cop/hecks/untyped_raise.rb
-- prebuilt/9ee54e2f0d4d6d3fe046827779b221e02de665fba911a048ae5dd8b8fbfb7d90.marshal
-- prebuilt/d74a00e996222c1d8b676d5959092effc46b4dc59e0555f3bf9554ac58e3094a.marshal
-- prebuilt/verdicts-df19f35868d3284a70f55e42dcef87ef4e65e6a678e5135f72e1f6cff4c1357b.json
+- prebuilt/2b59737fbdbd5f44edda0fddce2611f45d76087b3a7c782d1f1a17ea58c77948.marshal
+- prebuilt/58208399bada10b0db99928c48e38789288fc58f7b71a72b21bfa386680e32ed.marshal
+- prebuilt/verdicts-48318ca172edd21443b1ad02801c697fff100b746e828f09db987647641a5df2.json
 - qa/settings.yml
 - rust/.cargo/config.toml
 - rust/.cargo/mutants.toml