hecks 3.13.0 → 4.0.0

data/rust/host/src/boundary_fuzz/auth.rs

@@ -9,7 +9,16 @@ use crate::fuzz_support::*;
 const SECRET: &str = "fuzz-secret";
 
 fn session(rng: &mut Rng) -> Session {
-    Session { identity_id: random_text(rng), email: random_text(rng), name: random_text(rng), role: if rng.chance(2) { Some(random_text(rng)) } else { None } }
+    Session {
+        identity_id: random_text(rng),
+        email: random_text(rng),
+        name: random_text(rng),
+        role: if rng.chance(2) {
+            Some(random_text(rng))
+        } else {
+            None
+        },
+    }
 }
 
 #[test]
@@ -20,9 +29,23 @@ fn a_signed_cookie_reads_back_as_the_session_it_was_made_from() {
             for _ in 0..30 {
                 let original = session(&mut rng);
                 let cookie = session_cookie(SECRET, &original);
-                let read = parse_session_cookie(SECRET, &cookie).unwrap_or_else(|| panic!("seed {seed}: own cookie for {:?} refused", original.email));
-                assert_eq!((read.identity_id, read.email, read.name, read.role), (original.identity_id, original.email, original.name, original.role), "seed {seed}");
-                assert!(parse_session_cookie("another-secret", &cookie).is_none(), "seed {seed}: a different secret verified the cookie");
+                let read = parse_session_cookie(SECRET, &cookie).unwrap_or_else(|| {
+                    panic!("seed {seed}: own cookie for {:?} refused", original.email)
+                });
+                assert_eq!(
+                    (read.identity_id, read.email, read.name, read.role),
+                    (
+                        original.identity_id,
+                        original.email,
+                        original.name,
+                        original.role
+                    ),
+                    "seed {seed}"
+                );
+                assert!(
+                    parse_session_cookie("another-secret", &cookie).is_none(),
+                    "seed {seed}: a different secret verified the cookie"
+                );
             }
         });
     }
@@ -35,7 +58,8 @@ fn no_arbitrary_or_tampered_token_ever_verifies() {
             let mut rng = Rng::new(seed ^ 0x70C);
             let genuine_cookie = session_cookie(SECRET, &session(&mut rng));
             let genuine_account = account_token(SECRET, &random_text(&mut rng), 60);
-            let genuine_purpose = purpose_token(SECRET, "reset", json!({"email": random_text(&mut rng)}), 60);
+            let genuine_purpose =
+                purpose_token(SECRET, "reset", json!({"email": random_text(&mut rng)}), 60);
             for _ in 0..40 {
                 let junk = match rng.below(4) {
                     0 => random_text(&mut rng),
@@ -43,18 +67,40 @@ fn no_arbitrary_or_tampered_token_ever_verifies() {
                     2 => ".".repeat(rng.below(4)),
                     _ => String::from_utf8_lossy(&random_bytes(&mut rng)).into_owned(),
                 };
-                assert!(parse_session_cookie(SECRET, &junk).is_none(), "seed {seed}: {junk:?} read as a session");
-                assert!(verify_account_token(SECRET, &junk).is_none(), "seed {seed}: {junk:?} read as an account token");
-                assert!(verify_purpose_token(SECRET, "reset", &junk).is_none(), "seed {seed}: {junk:?} read as a purpose token");
+                assert!(
+                    parse_session_cookie(SECRET, &junk).is_none(),
+                    "seed {seed}: {junk:?} read as a session"
+                );
+                assert!(
+                    verify_account_token(SECRET, &junk).is_none(),
+                    "seed {seed}: {junk:?} read as an account token"
+                );
+                assert!(
+                    verify_purpose_token(SECRET, "reset", &junk).is_none(),
+                    "seed {seed}: {junk:?} read as a purpose token"
+                );
 
                 for (genuine, verifies) in [
-                    (&genuine_cookie, (|t: &str| parse_session_cookie(SECRET, t).is_some()) as fn(&str) -> bool),
-                    (&genuine_account, |t: &str| verify_account_token(SECRET, t).is_some()),
-                    (&genuine_purpose, |t: &str| verify_purpose_token(SECRET, "reset", t).is_some()),
+                    (
+                        &genuine_cookie,
+                        (|t: &str| parse_session_cookie(SECRET, t).is_some()) as fn(&str) -> bool,
+                    ),
+                    (&genuine_account, |t: &str| {
+                        verify_account_token(SECRET, t).is_some()
+                    }),
+                    (&genuine_purpose, |t: &str| {
+                        verify_purpose_token(SECRET, "reset", t).is_some()
+                    }),
                 ] {
-                    assert!(verifies(genuine), "seed {seed}: the untampered token must verify");
+                    assert!(
+                        verifies(genuine),
+                        "seed {seed}: the untampered token must verify"
+                    );
                     let tampered = mutate_text(&mut rng, genuine);
-                    assert!(tampered == *genuine || !verifies(&tampered), "seed {seed}: tampered token {tampered:?} verified");
+                    assert!(
+                        tampered == *genuine || !verifies(&tampered),
+                        "seed {seed}: tampered token {tampered:?} verified"
+                    );
                 }
             }
         });
@@ -65,8 +111,18 @@ fn no_arbitrary_or_tampered_token_ever_verifies() {
 fn a_token_for_one_purpose_never_verifies_for_another_or_as_an_account_token() {
     let token = purpose_token(SECRET, "reset", json!({"email": "a@example.com"}), 60);
     assert!(verify_purpose_token(SECRET, "reset", &token).is_some());
-    for other in ["", "RESET", "reset ", "reset:", "invite", "reset:fuzz-secret"] {
-        assert!(verify_purpose_token(SECRET, other, &token).is_none(), "purpose {other:?}");
+    for other in [
+        "",
+        "RESET",
+        "reset ",
+        "reset:",
+        "invite",
+        "reset:fuzz-secret",
+    ] {
+        assert!(
+            verify_purpose_token(SECRET, other, &token).is_none(),
+            "purpose {other:?}"
+        );
     }
     assert!(verify_account_token(SECRET, &token).is_none());
     assert!(parse_session_cookie(SECRET, &token).is_none());
@@ -75,20 +131,45 @@ fn a_token_for_one_purpose_never_verifies_for_another_or_as_an_account_token() {
 #[test]
 fn an_expired_or_unexpiring_signed_payload_is_not_a_session() {
     let sign_payload = |payload: Value| {
-        let encoded = base64_encode(payload.to_string().as_bytes());
+        let encoded = b64::url_encode(payload.to_string().as_bytes());
         format!("{encoded}.{}", sign(SECRET, &encoded))
     };
     let person = json!({"identity_id": "i", "email": "e", "name": "n"});
-    for exp in [json!(0), json!(1), json!(-1), json!(1.5), json!("9999999999"), json!(null), json!(u64::MAX)] {
+    for exp in [
+        json!(0),
+        json!(1),
+        json!(-1),
+        json!(1.5),
+        json!("9999999999"),
+        json!(null),
+        json!(u64::MAX),
+    ] {
         let mut payload = person.clone();
         payload["exp"] = exp.clone();
         let verdict = parse_session_cookie(SECRET, &sign_payload(payload)).is_some();
         assert_eq!(verdict, exp == json!(u64::MAX), "exp {exp}");
     }
-    assert!(parse_session_cookie(SECRET, &sign_payload(person)).is_none(), "no exp is no session");
-    for payload in [json!([]), json!(1), json!("s"), json!(null), json!({"exp": u64::MAX}), json!({"exp": u64::MAX, "identity_id": 1, "email": "e", "name": "n"})] {
-        assert!(parse_session_cookie(SECRET, &sign_payload(payload.clone())).is_none(), "{payload}");
-        assert!(verify_account_token(SECRET, &sign_payload(payload.clone())).is_none() || payload.get("email").is_some(), "{payload}");
+    assert!(
+        parse_session_cookie(SECRET, &sign_payload(person)).is_none(),
+        "no exp is no session"
+    );
+    for payload in [
+        json!([]),
+        json!(1),
+        json!("s"),
+        json!(null),
+        json!({"exp": u64::MAX}),
+        json!({"exp": u64::MAX, "identity_id": 1, "email": "e", "name": "n"}),
+    ] {
+        assert!(
+            parse_session_cookie(SECRET, &sign_payload(payload.clone())).is_none(),
+            "{payload}"
+        );
+        assert!(
+            verify_account_token(SECRET, &sign_payload(payload.clone())).is_none()
+                || payload.get("email").is_some(),
+            "{payload}"
+        );
     }
 }
 
@@ -109,10 +190,14 @@ fn base64_decoding_and_cookie_names_take_any_text() {
             let mut rng = Rng::new(seed ^ 0xBA5E);
             for _ in 0..100 {
                 let text = random_text(&mut rng);
-                let _ = base64_decode(&text);
+                let _ = b64::url_decode(&text);
                 let _ = resolve_account_cookie(Some(&text));
                 let bytes = random_bytes(&mut rng);
-                assert_eq!(base64_decode(&base64_encode(&bytes)), bytes, "seed {seed}");
+                assert_eq!(
+                    b64::url_decode(&b64::url_encode(&bytes)),
+                    Some(bytes),
+                    "seed {seed}"
+                );
             }
         });
     }

data/rust/host/src/boundary_fuzz/expr_json.rs

@@ -8,11 +8,61 @@ use crate::fuzz_support::*;
 use serde_json::{json, Value};
 
 const BINARY: &[&str] = &["or", "and", "compare", "include", "add", "modulo"];
-const UNARY: &[&str] = &["not", "sign_test", "empty", "to_s", "size", "presence", "assignment", "first", "last", "split", "strip", "starts_with", "ends_with", "matches_regex"];
+const UNARY: &[&str] = &[
+    "not",
+    "sign_test",
+    "empty",
+    "to_s",
+    "size",
+    "presence",
+    "assignment",
+    "first",
+    "last",
+    "split",
+    "strip",
+    "starts_with",
+    "ends_with",
+    "matches_regex",
+];
 
 const PATTERNS: &[&str] = &[
-    "", "^$", "a", "(a*)*b", "(a|aa)+$", "[", "]", "[]", "[^]", "[a-", "(", ")", "(?", "(?P<x>", "\\", "\\d+", "\\D\\W\\S\\H", "\\Z", "[\\d]", "[\\Z]", "\\p{L}+", "\\p{Nope}",
-    "a{1000}", "a{1000}{1000}", "(((a{100}){100}){100})", "(?i)ABC", "(?x) a b", "\\x{110000}", "\\u{1F355}", ".*.*.*.*.*.*.*b", "\\b\\B", "(?<n>a)\\k<n>", "(a)\\1", "^*", "$+", "é+", "🍕{2}",
+    "",
+    "^$",
+    "a",
+    "(a*)*b",
+    "(a|aa)+$",
+    "[",
+    "]",
+    "[]",
+    "[^]",
+    "[a-",
+    "(",
+    ")",
+    "(?",
+    "(?P<x>",
+    "\\",
+    "\\d+",
+    "\\D\\W\\S\\H",
+    "\\Z",
+    "[\\d]",
+    "[\\Z]",
+    "\\p{L}+",
+    "\\p{Nope}",
+    "a{1000}",
+    "a{1000}{1000}",
+    "(((a{100}){100}){100})",
+    "(?i)ABC",
+    "(?x) a b",
+    "\\x{110000}",
+    "\\u{1F355}",
+    ".*.*.*.*.*.*.*b",
+    "\\b\\B",
+    "(?<n>a)\\k<n>",
+    "(a)\\1",
+    "^*",
+    "$+",
+    "é+",
+    "🍕{2}",
 ];
 
 fn leaf(rng: &mut Rng) -> Value {
@@ -22,8 +72,12 @@ fn leaf(rng: &mut Rng) -> Value {
         2 => json!({"op": "str", "value": random_text(rng)}),
         3 => json!({"op": "bool", "value": rng.chance(2)}),
         4 => json!({"op": "nil"}),
-        5 => json!({"op": "lookup", "path": (0..1 + rng.below(3)).map(|_| *rng.pick(&["a", "b", "items", "name", "missing", "x", ""])).collect::<Vec<_>>()}),
-        6 => json!({"op": "array", "elements": (0..rng.below(4)).map(|_| json!({"op": "int", "value": rng.below(5)})).collect::<Vec<_>>()}),
+        5 => {
+            json!({"op": "lookup", "path": (0..=rng.below(3)).map(|_| *rng.pick(&["a", "b", "items", "name", "missing", "x", ""])).collect::<Vec<_>>()})
+        }
+        6 => {
+            json!({"op": "array", "elements": (0..rng.below(4)).map(|_| json!({"op": "int", "value": rng.below(5)})).collect::<Vec<_>>()})
+        }
         7 => json!({"op": "int", "value": i64::MAX}),
         _ => json!({"op": "str", "value": ""}),
     }
@@ -47,7 +101,9 @@ fn node(rng: &mut Rng, depth: usize) -> Value {
             value["cmp"] = json!({"less_than": rng.chance(2), "equal": rng.chance(2), "negated": rng.chance(2)});
             value
         }
-        8 => json!({"op": *rng.pick(&["block_predicate", "find"]), "mode": *rng.pick(&["all", "any", "none", "some"]), "receiver": node(rng, depth + 1), "param": *rng.pick(&["i", "a", ""]), "predicate": node(rng, depth + 1), "path": [*rng.pick(&["a", "x"])]}),
+        8 => {
+            json!({"op": *rng.pick(&["block_predicate", "find"]), "mode": *rng.pick(&["all", "any", "none", "some"]), "receiver": node(rng, depth + 1), "param": *rng.pick(&["i", "a", ""]), "predicate": node(rng, depth + 1), "path": [*rng.pick(&["a", "x"])]})
+        }
         _ => random_value(rng, 1),
     }
 }
@@ -56,7 +112,14 @@ fn instance(rng: &mut Rng) -> Value {
     let mut fields = serde_json::Map::new();
     for key in ["a", "b", "items", "name", "x"] {
         if !rng.chance(4) {
-            fields.insert(key.to_string(), if rng.chance(2) { random_value(rng, 1) } else { json!([{"x": 1}, {"x": "t"}, 3]) });
+            fields.insert(
+                key.to_string(),
+                if rng.chance(2) {
+                    random_value(rng, 1)
+                } else {
+                    json!([{"x": 1}, {"x": "t"}, 3])
+                },
+            );
         }
     }
     Value::Object(fields)
@@ -131,13 +194,16 @@ fn integer_arithmetic_at_the_limits_refuses_instead_of_overflowing() {
         json!({"op": "modulo", "receiver": int(i64::MAX), "divisor": int(i64::MIN)}),
         json!({"op": "modulo", "receiver": int(1), "divisor": int(0)}),
         json!({"op": "modulo", "receiver": {"op": "float", "value": 1.5}, "divisor": {"op": "float", "value": 0.0}}),
-        json!({"op": "add", "left": {"op": "float", "value": 1.7976931348623157e308}, "right": {"op": "float", "value": 1.7976931348623157e308}}),
+        json!({"op": "add", "left": {"op": "float", "value": 1.797_693_134_862_315_7e308}, "right": {"op": "float", "value": 1.797_693_134_862_315_7e308}}),
     ];
     for tree in cases {
         let expr = parse(&tree).expect("well-formed");
         let _ = interpret(&expr, &json!({}));
     }
-    assert!(interpret(&parse(&cases_add_overflow()).unwrap(), &json!({})).is_err(), "i64::MAX + 1 must refuse");
+    assert!(
+        interpret(&parse(&cases_add_overflow()).unwrap(), &json!({})).is_err(),
+        "i64::MAX + 1 must refuse"
+    );
 }
 
 fn cases_add_overflow() -> Value {
@@ -147,9 +213,17 @@ fn cases_add_overflow() -> Value {
 #[test]
 fn a_document_nested_past_the_json_limit_never_reaches_the_interpreter() {
     // The IR is read with serde_json, whose recursion limit refuses what would overflow `parse`.
-    let nested = format!("{}{{\"op\":\"nil\"}}{}", "{\"op\":\"not\",\"expr\":".repeat(10_000), "}".repeat(10_000));
+    let nested = format!(
+        "{}{{\"op\":\"nil\"}}{}",
+        "{\"op\":\"not\",\"expr\":".repeat(10_000),
+        "}".repeat(10_000)
+    );
     assert!(serde_json::from_str::<Value>(&nested).is_err());
-    let within = format!("{}{{\"op\":\"nil\"}}{}", "{\"op\":\"not\",\"expr\":".repeat(60), "}".repeat(60));
+    let within = format!(
+        "{}{{\"op\":\"nil\"}}{}",
+        "{\"op\":\"not\",\"expr\":".repeat(60),
+        "}".repeat(60)
+    );
     guarded("depth 60", move || {
         let tree: Value = serde_json::from_str(&within).expect("within serde's limit");
         let expr = parse(&tree).expect("well-formed");

data/rust/host/src/boundary_fuzz/ir.rs

@@ -8,9 +8,46 @@ use crate::fuzz_support::*;
 use serde_json::json;
 
 const KEYS: &[&str] = &[
-    "name", "aggregates", "lineage", "capable_aggregates", "storage_name", "persistence", "adapter", "authorization", "grant", "assignment_aggregate", "membership", "provider", "aggregate",
-    "identity", "register", "link", "resolve", "newsletter", "subscribe", "add_name", "confirm", "unsubscribe", "newsletter_issues", "issue_aggregate", "schedule", "send_issue", "record_delivery",
-    "payments", "initiate", "succeeded", "failed", "event_aggregate", "registrations", "registration_aggregate", "request", "payment_connection", "commands", "attributes",
+    "name",
+    "aggregates",
+    "lineage",
+    "capable_aggregates",
+    "storage_name",
+    "persistence",
+    "adapter",
+    "adapters",
+    "port",
+    "authorization",
+    "grant",
+    "assignment_aggregate",
+    "membership",
+    "provider",
+    "aggregate",
+    "identity",
+    "register",
+    "link",
+    "resolve",
+    "newsletter",
+    "subscribe",
+    "add_name",
+    "confirm",
+    "unsubscribe",
+    "newsletter_issues",
+    "issue_aggregate",
+    "schedule",
+    "send_issue",
+    "record_delivery",
+    "payments",
+    "initiate",
+    "succeeded",
+    "failed",
+    "event_aggregate",
+    "registrations",
+    "registration_aggregate",
+    "request",
+    "payment_connection",
+    "commands",
+    "attributes",
 ];
 
 /// An object over the keys the readers look up, with each value the right shape, the wrong
@@ -24,7 +61,17 @@ fn random_ir(rng: &mut Rng, depth: usize) -> Value {
         let value = match rng.below(5) {
             0 if depth < 2 => random_ir(rng, depth + 1),
             1 => Value::String(random_text(rng)),
-            2 => Value::Array((0..rng.below(2)).map(|_| if depth < 2 { random_ir(rng, depth + 1) } else { Value::Null }).collect()),
+            2 => Value::Array(
+                (0..rng.below(2))
+                    .map(|_| {
+                        if depth < 2 {
+                            random_ir(rng, depth + 1)
+                        } else {
+                            Value::Null
+                        }
+                    })
+                    .collect(),
+            ),
             3 => json!(*rng.pick(&["Postgres", "PostgresEra", "Heki", "Memory", ""])),
             _ => random_value(rng, 2),
         };
@@ -39,20 +86,33 @@ fn every_provider_reader_answers_any_ir_shape() {
         guarded(&format!("seed {seed}"), move || {
             let mut rng = Rng::new(seed);
             for _ in 0..40 {
-                let ir = if rng.chance(8) { random_value(&mut rng, 0) } else { random_ir(&mut rng, 0) };
+                let ir = if rng.chance(8) {
+                    random_value(&mut rng, 0)
+                } else {
+                    random_ir(&mut rng, 0)
+                };
                 let _ = lineage_capable_aggregates(&ir);
                 let _ = persistence_adapters(&ir);
                 let _ = mirrored_aggregates(&ir);
                 let _ = authorization_provider(&ir);
                 let _ = membership_provider(&ir);
                 let _ = identity_provider(&ir);
-                let _ = command_declares(&ir, &random_text(&mut rng), &random_text(&mut rng), &random_text(&mut rng));
+                let _ = command_declares(
+                    &ir,
+                    &random_text(&mut rng),
+                    &random_text(&mut rng),
+                    &random_text(&mut rng),
+                );
                 let _ = newsletter_provider(&ir).map(|p| p.instance_prefix());
                 let _ = newsletter_issues_provider(&ir).map(|p| p.issue_prefix());
                 let _ = payments_provider(&ir).map(|p| p.instance_prefix());
                 let _ = checkout_windows(&ir);
                 if let Some(p) = registrations_provider(&ir) {
-                    let _ = (p.event_prefix(), p.registration_prefix(), p.request_target());
+                    let _ = (
+                        p.event_prefix(),
+                        p.registration_prefix(),
+                        p.request_target(),
+                    );
                 }
                 if let Some(p) = payment_connection_provider(&ir) {
                     let _ = p.instance_prefix();
@@ -60,21 +120,113 @@ fn every_provider_reader_answers_any_ir_shape() {
                 let _ = registrations_binding(&random_text(&mut rng));
                 let _ = payment_connection_binding(&random_text(&mut rng));
                 if let Err(message) = refuse_unsupported_persistence_adapters(&ir) {
-                    assert!(message.contains("rust/host only has a backend"), "seed {seed}: unhelpful refusal {message:?}");
+                    assert!(
+                        message.contains("rust/host only has a backend")
+                            || message.contains("does not declare")
+                            || message.contains("rather than \"persistence\"")
+                            || message.contains("\"adapters\""),
+                        "seed {seed}: unhelpful refusal {message:?}"
+                    );
                 }
             }
         });
     }
 }
 
+fn ir_binding(adapter: &str, adapters: Option<Value>) -> Value {
+    let mut ir =
+        json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
+    if let Some(adapters) = adapters {
+        ir["adapters"] = adapters;
+    }
+    ir
+}
+
+fn refusal(ir: &Value) -> String {
+    refuse_unsupported_persistence_adapters(ir).unwrap_err()
+}
+
 #[test]
 fn an_unsupported_persistence_adapter_is_always_refused_at_boot() {
+    // No `adapters` key (every deployed IR today): the old behaviour, byte for byte.
     for adapter in ["Heki", "Memory", "Sqlite", "", "postgres", "Postgres "] {
-        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
-        assert!(refuse_unsupported_persistence_adapters(&ir).is_err(), "{adapter:?}");
+        let message = refusal(&ir_binding(adapter, None));
+        assert!(message.starts_with("rust/host only has a backend for [\"Postgres\", \"PostgresEra\"] today; this domain also binds: A (persisted_by "), "{adapter:?}");
+    }
+    for adapter in ["Postgres", "PostgresEra"] {
+        assert!(refuse_unsupported_persistence_adapters(&ir_binding(adapter, None)).is_ok());
     }
+}
+
+#[test]
+fn declared_supported_adapters_boot() {
     for adapter in ["Postgres", "PostgresEra"] {
-        let ir = json!({"name": "D", "persistence": {"aggregates": [{"name": "A", "adapter": adapter}]}});
-        assert!(refuse_unsupported_persistence_adapters(&ir).is_ok(), "{adapter:?}");
+        for port in [json!("persistence"), Value::Null] {
+            let ir = ir_binding(
+                adapter,
+                Some(
+                    json!([{"name": adapter, "port": port, "fields": [], "secrets": [], "defaults": {}}]),
+                ),
+            );
+            assert!(
+                refuse_unsupported_persistence_adapters(&ir).is_ok(),
+                "{adapter} {port}"
+            );
+        }
+    }
+}
+
+#[test]
+fn declared_but_unsupported_adapters_hit_the_backend_rule() {
+    for adapter in ["Heki", "Memory"] {
+        let ir = ir_binding(
+            adapter,
+            Some(json!([{"name": adapter, "port": "persistence"}])),
+        );
+        assert!(
+            refusal(&ir).starts_with("rust/host only has a backend"),
+            "{adapter}"
+        );
+    }
+}
+
+#[test]
+fn supported_but_undeclared_adapters_are_refused_by_name() {
+    for declared in [json!([]), json!([{"name": "Heki", "port": "persistence"}])] {
+        let message = refusal(&ir_binding("Postgres", Some(declared)));
+        assert!(
+            message.contains("A binds Postgres, which the domain's IR does not declare"),
+            "{message}"
+        );
+    }
+}
+
+#[test]
+fn a_non_persistence_port_is_refused() {
+    for port in [json!("mail"), json!(""), json!(7), json!(["persistence"])] {
+        let ir = ir_binding(
+            "Postgres",
+            Some(json!([{"name": "Postgres", "port": port}])),
+        );
+        assert!(
+            refusal(&ir).contains("rather than \"persistence\""),
+            "{port}"
+        );
+    }
+}
+
+#[test]
+fn a_malformed_adapters_key_is_a_clear_refusal_never_a_panic() {
+    for bad in [
+        Value::Null,
+        json!("Postgres"),
+        json!(3),
+        json!({"name": "Postgres"}),
+        json!([{"port": "persistence"}]),
+        json!([{"name": 5}]),
+        json!([null]),
+    ] {
+        let message = refusal(&ir_binding("Postgres", Some(bad.clone())));
+        assert!(message.contains("\"adapters\""), "{bad}: {message}");
     }
 }