hecks 3.13.0 → 4.0.0

data/rust/host/src/extension.rs

@@ -29,6 +29,15 @@ pub struct Ctx<'a> {
     pub wasm_path: &'a Path,
     pub config: &'a LineageConfig,
     pub invoker: &'a dyn LambdaInvoker,
+    /// The four above as one value, for the host's own handlers.
+    pub host: crate::host::Host<'a>,
+}
+
+impl<'a> Ctx<'a> {
+    /// The request's journal connection, module, lineage and invoker, as one value.
+    pub const fn host(&self) -> crate::host::Host<'a> {
+        self.host
+    }
 }
 
 /// A public write an extension wants limited per client: `limit_env` names the budget setting.
@@ -83,14 +92,20 @@ pub fn installed() -> &'static [Arc<dyn HostExtension>] {
 fn default_extensions() -> Vec<Arc<dyn HostExtension>> {
     let vars = crate::platform_signin::settings::PROCESS_VARIABLES
         .iter()
-        .filter_map(|name| std::env::var(name).ok().map(|value| (name.to_string(), value)))
+        .filter_map(|name| {
+            crate::secrets::var(name)
+                .ok()
+                .map(|value| (name.to_string(), value))
+        })
         .collect();
     default_extensions_from(&vars)
 }
 
 /// The default extensions for an explicit set of settings: commerce, plus platform sign-in when
 /// it is switched on (or its boot refusal when its settings are wrong).
-pub(crate) fn default_extensions_from(vars: &HashMap<String, String>) -> Vec<Arc<dyn HostExtension>> {
+pub(crate) fn default_extensions_from(
+    vars: &HashMap<String, String>,
+) -> Vec<Arc<dyn HostExtension>> {
     let mut extensions: Vec<Arc<dyn HostExtension>> = vec![Arc::new(crate::web::Commerce)];
     extensions.extend(crate::platform_signin::extension::extensions_for(vars));
     extensions
@@ -103,10 +118,15 @@ pub fn loaded_ir() -> Option<&'static Value> {
 
 /// Every installed extension's rate rules.
 pub fn rate_rules() -> Vec<RateRule> {
-    installed().iter().flat_map(|extension| extension.rate_rules()).collect()
+    installed()
+        .iter()
+        .flat_map(|extension| extension.rate_rules())
+        .collect()
 }
 
 /// The rule that limits this request, if any.
 pub fn rate_rule_for(method: &str, path: &str) -> Option<RateRule> {
-    rate_rules().into_iter().find(|rule| rule.method == method && rule.path == path)
+    rate_rules()
+        .into_iter()
+        .find(|rule| rule.method == method && rule.path == path)
 }

data/rust/host/src/field_hints.rs

@@ -27,8 +27,10 @@ pub static EMAIL_HINT: LazyLock<Regex> =
 /// `(?i)` up front is this crate's spelling
 /// of Ruby's trailing `/i` — the WHOLE pattern is case-insensitive
 /// on both sides, never partially.
-pub static URL_HINT: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r#"(?i)\b(url|uri|website|link)\b"#).expect("declared field-hint pattern must compile"));
+pub static URL_HINT: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?i)\b(url|uri|website|link)\b"#)
+        .expect("declared field-hint pattern must compile")
+});
 
 /// Tel hint, resolving to `html_type` on a match —
 /// Vocabulary::FieldHint's own declared pattern, unmodified (the
@@ -37,8 +39,9 @@ pub static URL_HINT: LazyLock<Regex> =
 /// `(?i)` up front is this crate's spelling
 /// of Ruby's trailing `/i` — the WHOLE pattern is case-insensitive
 /// on both sides, never partially.
-pub static TEL_HINT: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r#"(?i)phone|\btel(ephone)?\b"#).expect("declared field-hint pattern must compile"));
+pub static TEL_HINT: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?i)phone|\btel(ephone)?\b"#).expect("declared field-hint pattern must compile")
+});
 
 /// Textarea hint, resolving to `kind` on a match —
 /// Vocabulary::FieldHint's own declared pattern, unmodified (the
@@ -47,6 +50,7 @@ pub static TEL_HINT: LazyLock<Regex> =
 /// `(?i)` up front is this crate's spelling
 /// of Ruby's trailing `/i` — the WHOLE pattern is case-insensitive
 /// on both sides, never partially.
-pub static TEXTAREA_HINT: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r#"(?i)\b(text|body|note|notes|description|message|comment)\b"#).expect("declared field-hint pattern must compile"));
-
+pub static TEXTAREA_HINT: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?i)\b(text|body|note|notes|description|message|comment)\b"#)
+        .expect("declared field-hint pattern must compile")
+});

data/rust/host/src/fuzz_support.rs

@@ -13,7 +13,7 @@ pub(crate) struct Rng(u64);
 
 impl Rng {
     pub(crate) fn new(seed: u64) -> Self {
-        Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+        Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
     }
 
     pub(crate) fn next(&mut self) -> u64 {
@@ -38,7 +38,10 @@ impl Rng {
 
 /// How many seeds each fuzz test runs.
 pub(crate) fn seeds() -> u64 {
-    std::env::var("HOST_FUZZ_SEEDS").ok().and_then(|v| v.parse().ok()).unwrap_or(200)
+    std::env::var("HOST_FUZZ_SEEDS")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(200)
 }
 
 /// The most a single guarded case may take before it counts as a hang.
@@ -60,10 +63,18 @@ pub(crate) fn guarded<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Se
             handle.join().expect("guarded thread joined");
             value
         }
-        Err(mpsc::RecvTimeoutError::Timeout) => panic!("{label}: no answer within {LIMIT:?} (hang)"),
+        Err(mpsc::RecvTimeoutError::Timeout) => {
+            panic!("{label}: no answer within {LIMIT:?} (hang)")
+        }
         Err(mpsc::RecvTimeoutError::Disconnected) => {
-            let panic = handle.join().expect_err("a guarded thread that sent nothing must have panicked");
-            let message = panic.downcast_ref::<String>().cloned().or_else(|| panic.downcast_ref::<&str>().map(|s| s.to_string()));
+            let panic = handle
+                .join()
+                .expect_err("a guarded thread that sent nothing must have panicked");
+            let message = panic.downcast_ref::<String>().cloned().or_else(|| {
+                panic
+                    .downcast_ref::<&str>()
+                    .map(std::string::ToString::to_string)
+            });
             panic!("{label}: panicked: {}", message.unwrap_or_default())
         }
     }
@@ -73,9 +84,63 @@ pub(crate) fn guarded<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Se
 /// shape that slices through a char boundary), control characters, NUL, bidi marks, astral
 /// planes, combining marks, percent signs, and every JSON/URL/cookie delimiter.
 const PIECES: &[&str] = &[
-    "a", "Z", "0", "9", " ", "\"", "'", "\\", "/", "%", "%4", "%41", "%zz", "%+1", "+", "=", "&", ";", "?", "#", ".", "..", "-", "_", ":", ",", "{", "}", "[", "]",
-    "\n", "\t", "\r", "\u{0}", "\u{1f}", "\u{7f}", "é", "ü", "日本", "🍕", "\u{10FFFF}", "\u{200B}", "\u{FEFF}", "\u{202E}", "\u{FFFD}", "e\u{301}", "__", "::",
-    "<script>", "../", "%0d%0a", "id", "name", "value", "sort", "direction", "desc",
+    "a",
+    "Z",
+    "0",
+    "9",
+    " ",
+    "\"",
+    "'",
+    "\\",
+    "/",
+    "%",
+    "%4",
+    "%41",
+    "%zz",
+    "%+1",
+    "+",
+    "=",
+    "&",
+    ";",
+    "?",
+    "#",
+    ".",
+    "..",
+    "-",
+    "_",
+    ":",
+    ",",
+    "{",
+    "}",
+    "[",
+    "]",
+    "\n",
+    "\t",
+    "\r",
+    "\u{0}",
+    "\u{1f}",
+    "\u{7f}",
+    "é",
+    "ü",
+    "日本",
+    "🍕",
+    "\u{10FFFF}",
+    "\u{200B}",
+    "\u{FEFF}",
+    "\u{202E}",
+    "\u{FFFD}",
+    "e\u{301}",
+    "__",
+    "::",
+    "<script>",
+    "../",
+    "%0d%0a",
+    "id",
+    "name",
+    "value",
+    "sort",
+    "direction",
+    "desc",
 ];
 
 pub(crate) fn random_text(rng: &mut Rng) -> String {
@@ -97,8 +162,8 @@ pub(crate) fn edge_number(rng: &mut Rng) -> Value {
         json!(1e308),
         json!(-1e308),
         json!(5e-324),
-        json!(1.7976931348623157e308),
-        json!(9007199254740993_i64),
+        json!(1.797_693_134_862_315_7e308),
+        json!(9_007_199_254_740_993_i64),
     ];
     rng.pick(&edges).clone()
 }
@@ -112,7 +177,11 @@ pub(crate) fn random_value(rng: &mut Rng, depth: usize) -> Value {
         2 => edge_number(rng),
         3 | 4 => Value::String(random_text(rng)),
         5 => json!(rng.next() as i64 >> rng.below(63)),
-        6 => Value::Array((0..rng.below(4)).map(|_| random_value(rng, depth + 1)).collect()),
+        6 => Value::Array(
+            (0..rng.below(4))
+                .map(|_| random_value(rng, depth + 1))
+                .collect(),
+        ),
         _ => {
             let mut map = Map::new();
             for _ in 0..rng.below(4) {
@@ -125,9 +194,12 @@ pub(crate) fn random_value(rng: &mut Rng, depth: usize) -> Value {
 
 /// `text` with a few random edits, on char boundaries.
 pub(crate) fn mutate_text(rng: &mut Rng, text: &str) -> String {
+    const JUNK: &[char] = &[
+        '{', '}', '[', ']', '"', '\\', ',', ':', '-', '+', '.', 'e', '0', '9', 'n', 't', ' ',
+        '\u{0}', '\n', '%', 'é', '🍕',
+    ];
     let mut chars: Vec<char> = text.chars().collect();
-    const JUNK: &[char] = &['{', '}', '[', ']', '"', '\\', ',', ':', '-', '+', '.', 'e', '0', '9', 'n', 't', ' ', '\u{0}', '\n', '%', 'é', '🍕'];
-    for _ in 0..1 + rng.below(3) {
+    for _ in 0..=rng.below(3) {
         if chars.is_empty() {
             chars.push(*rng.pick(JUNK));
             continue;

data/rust/host/src/host.rs

@@ -0,0 +1,100 @@
+//! What a request handler needs to reach the domain, travelling as one value.
+
+use crate::journal::LineageConfig;
+use crate::lambda_client::LambdaInvoker;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use tokio_postgres::Client;
+
+/// The server's own shared handles, when a host is built from them.
+#[derive(Clone, Copy)]
+struct Shared<'a> {
+    client: &'a Arc<Mutex<Client>>,
+    wasm_path: &'a Arc<PathBuf>,
+    config: &'a Arc<LineageConfig>,
+    invoker: &'a Arc<dyn LambdaInvoker>,
+}
+
+/// The journal connection, the compiled domain module, the lineage it runs under, and the
+/// invoker that delivers a policy's cross-domain reactions. Borrowed from the server's state (or
+/// a test's fixtures) for the length of one call, so it is `Copy`.
+#[derive(Clone, Copy)]
+pub struct Host<'a> {
+    /// The one Postgres connection; its mutex serializes every write onto it.
+    pub client: &'a Mutex<Client>,
+    pub wasm_path: &'a Path,
+    pub config: &'a LineageConfig,
+    pub invoker: &'a dyn LambdaInvoker,
+    shared: Option<Shared<'a>>,
+}
+
+impl<'a> Host<'a> {
+    /// A host over borrowed pieces. It cannot outlive the call, so work that must outlast the
+    /// response stays inline.
+    pub fn new(
+        client: &'a Mutex<Client>,
+        wasm_path: &'a Path,
+        config: &'a LineageConfig,
+        invoker: &'a dyn LambdaInvoker,
+    ) -> Self {
+        Self {
+            client,
+            wasm_path,
+            config,
+            invoker,
+            shared: None,
+        }
+    }
+
+    /// A host over the server's own `Arc`s, from which `detach` can hand work an owned copy.
+    pub fn shared(
+        client: &'a Arc<Mutex<Client>>,
+        wasm_path: &'a Arc<PathBuf>,
+        config: &'a Arc<LineageConfig>,
+        invoker: &'a Arc<dyn LambdaInvoker>,
+    ) -> Self {
+        Self {
+            client,
+            wasm_path,
+            config,
+            invoker: invoker.as_ref(),
+            shared: Some(Shared {
+                client,
+                wasm_path,
+                config,
+                invoker,
+            }),
+        }
+    }
+
+    /// An owned copy for a task that outlives this request, or `None` when the host was built
+    /// from borrows and so cannot be detached.
+    pub fn detach(&self) -> Option<OwnedHost> {
+        self.shared.map(|shared| OwnedHost {
+            client: Arc::clone(shared.client),
+            wasm_path: Arc::clone(shared.wasm_path),
+            config: Arc::clone(shared.config),
+            invoker: Arc::clone(shared.invoker),
+        })
+    }
+}
+
+/// A `Host` that owns its handles, for work spawned past the end of a request.
+pub struct OwnedHost {
+    client: Arc<Mutex<Client>>,
+    wasm_path: Arc<PathBuf>,
+    config: Arc<LineageConfig>,
+    invoker: Arc<dyn LambdaInvoker>,
+}
+
+impl OwnedHost {
+    pub fn host(&self) -> Host<'_> {
+        Host::new(
+            &self.client,
+            &self.wasm_path,
+            &self.config,
+            self.invoker.as_ref(),
+        )
+    }
+}

data/rust/host/src/http.rs

@@ -0,0 +1,22 @@
+//! The one HTTP client the host's outbound calls share.
+
+use std::sync::LazyLock;
+
+/// Built once: the TLS configuration and its root certificates are the costly part of a client.
+///
+/// It keeps no idle connections. The tests run each case on its own runtime, and a connection
+/// opened under one runtime is dead under the next, so reusing connections would fail them; these
+/// calls (sign-in, checkout, receipts, template fetches) are infrequent and go to different
+/// hosts, so reuse would not pay anyway.
+#[allow(clippy::expect_used)] // reason: a client with default TLS settings always builds
+static CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
+    reqwest::Client::builder()
+        .pool_max_idle_per_host(0)
+        .build()
+        .expect("a reqwest client with default settings always builds")
+});
+
+/// The shared client. Set a per-call timeout on the request, not on the client.
+pub(crate) fn client() -> &'static reqwest::Client {
+    &CLIENT
+}