hecks 3.14.0 → 4.0.0

data/rust/src/kernel/repository.rs

@@ -27,8 +27,10 @@ pub struct InMemoryRepository<T: Clone> {
 }
 
 impl<T: Clone> InMemoryRepository<T> {
-    pub fn new() -> Self {
-        Self { records: BTreeMap::new() }
+    pub const fn new() -> Self {
+        Self {
+            records: BTreeMap::new(),
+        }
     }
 
     /// `(id, record)` pairs; `Repository::all` drops the id, which the CLI `instances` dump needs.
@@ -46,7 +48,9 @@ impl<T: Clone> InMemoryRepository<T> {
         &'a self,
         to_json: impl Fn(&T) -> super::Json + 'a,
     ) -> impl Iterator<Item = (&'a String, &'a super::Json)> {
-        self.records.iter().map(move |(id, slot)| (id, slot.json.get_or_init(|| to_json(&slot.record))))
+        self.records
+            .iter()
+            .map(move |(id, slot)| (id, slot.json.get_or_init(|| to_json(&slot.record))))
     }
 }
 
@@ -56,11 +60,20 @@ impl<T: Clone> Repository<T> for InMemoryRepository<T> {
     }
 
     fn save(&mut self, id: &str, record: T) {
-        self.records.insert(id.to_string(), Slot { record, json: OnceCell::new() });
+        self.records.insert(
+            id.to_string(),
+            Slot {
+                record,
+                json: OnceCell::new(),
+            },
+        );
     }
 
     fn all(&self) -> Vec<T> {
-        self.records.values().map(|slot| slot.record.clone()).collect()
+        self.records
+            .values()
+            .map(|slot| slot.record.clone())
+            .collect()
     }
 
     fn count(&self) -> usize {
@@ -83,7 +96,12 @@ pub fn check_reference<T: Clone>(
     }
     // Wording goes through `RefusalSite` so it cannot drift from the Ruby table.
     Err(super::Refusal::NotFound(
-        super::refusal_wording::NotFoundReferenceTargetMissingArgs { target, heads, key: value }.render_args(),
+        super::refusal_wording::NotFoundReferenceTargetMissingArgs {
+            target,
+            heads,
+            key: value,
+        }
+        .render_args(),
     ))
 }
 
@@ -104,7 +122,9 @@ pub trait AggregateScan {
     /// `scan`, so a store that overrides only `scan` still answers; generated stores override
     /// this to read their repositories' cached renderings.
     fn scan_each(&self, aggregate: &str, visit: &mut dyn FnMut(&str, &super::Json)) -> bool {
-        let Some(entries) = self.scan(aggregate) else { return false };
+        let Some(entries) = self.scan(aggregate) else {
+            return false;
+        };
         for (id, record) in &entries {
             visit(id, record);
         }
@@ -168,7 +188,9 @@ pub fn entry_matches(
 ///
 /// Shared because read models nest this wrapping at every level, not only the top row.
 pub fn row_json(id: String, record: super::Json) -> super::Json {
-    let super::Json::Object(mut fields) = record else { return record };
+    let super::Json::Object(mut fields) = record else {
+        return record;
+    };
     fields.insert(0, ("id".to_string(), super::Json::Str(id)));
     super::Json::Object(fields)
 }
@@ -187,10 +209,16 @@ pub fn holds_role_via(
     let Some(def) = assignments.and_then(|verb| super::named_query::find(queries, verb)) else {
         return false;
     };
-    let args = super::Json::Object(vec![("actor_id".to_string(), super::Json::Str(actor_id.to_string()))]);
-    let Ok(rows) = super::named_query::run(store, def, &args, None) else { return false };
+    let args = super::Json::Object(vec![(
+        "actor_id".to_string(),
+        super::Json::Str(actor_id.to_string()),
+    )]);
+    let Ok(rows) = super::named_query::run(store, def, &args, None) else {
+        return false;
+    };
     rows.iter().any(|(_, record)| {
-        let matches_role = record.dig("role_name.value").and_then(super::Json::as_str) == Some(role);
+        let matches_role =
+            record.dig("role_name.value").and_then(super::Json::as_str) == Some(role);
         let not_revoked = matches!(record.dig("ends_at"), None | Some(super::Json::Null));
         matches_role && not_revoked
     })
@@ -214,7 +242,9 @@ pub fn check_role_via(
     queries: &[super::QueryDef],
     assignments: Option<&str>,
 ) -> Result<(), super::Refusal> {
-    let attached = assignments.and_then(|verb| super::named_query::find(queries, verb)).is_some();
+    let attached = assignments
+        .and_then(|verb| super::named_query::find(queries, verb))
+        .is_some();
     // An identified caller with no stated role is checked against what Governance assigned them: the
     // caller need not claim a role it may not hold. Unchecked without a Governance provider, as ever.
     if let (None, Some(role), Some(actor_id)) = (caller_role, command_role, caller_actor_id) {
@@ -222,10 +252,17 @@ pub fn check_role_via(
             return Ok(());
         }
         return Err(super::Refusal::Unauthorized(
-            super::refusal_wording::UnauthorizedRoleMismatchArgs { command: command_name, role, caller_role: "no assigned role" }.render_args(),
+            super::refusal_wording::UnauthorizedRoleMismatchArgs {
+                command: command_name,
+                role,
+                caller_role: "no assigned role",
+            }
+            .render_args(),
         ));
     }
-    let (Some(caller), Some(role)) = (caller_role, command_role) else { return Ok(()) };
+    let (Some(caller), Some(role)) = (caller_role, command_role) else {
+        return Ok(());
+    };
 
     let authorized = match caller_actor_id {
         Some(actor_id) if attached => holds_role_via(store, queries, assignments, actor_id, role),
@@ -237,7 +274,12 @@ pub fn check_role_via(
     }
     // The refusal quotes the role the caller typed, not the one `holds_role_via` found (as Ruby).
     Err(super::Refusal::Unauthorized(
-        super::refusal_wording::UnauthorizedRoleMismatchArgs { command: command_name, role, caller_role: caller }.render_args(),
+        super::refusal_wording::UnauthorizedRoleMismatchArgs {
+            command: command_name,
+            role,
+            caller_role: caller,
+        }
+        .render_args(),
     ))
 }
 
@@ -257,12 +299,18 @@ mod filter_entries_none_in_state_tests {
     impl AggregateScan for FakeStore {
         fn scan(&self, aggregate: &str) -> Option<Vec<(String, Json)>> {
             let bare = aggregate.strip_prefix(&format!("{}::", self.domain))?;
-            self.aggregates.iter().find(|(name, _)| *name == bare).map(|(_, entries)| entries.clone())
+            self.aggregates
+                .iter()
+                .find(|(name, _)| *name == bare)
+                .map(|(_, entries)| entries.clone())
         }
     }
 
     fn claim_record(state: &str) -> Json {
-        Json::obj(vec![("state", Json::obj(vec![("value", Json::str(state))]))])
+        Json::obj(vec![(
+            "state",
+            Json::obj(vec![("value", Json::str(state))]),
+        )])
     }
 
     fn assignment_record(claim_id: &str) -> Json {
@@ -298,8 +346,10 @@ mod filter_entries_none_in_state_tests {
             &cross_domain,
         );
 
-        let claim_ids: Vec<&str> =
-            matched.iter().map(|(_, record)| record.dig("claim_id").and_then(Json::as_str).unwrap()).collect();
+        let claim_ids: Vec<&str> = matched
+            .iter()
+            .map(|(_, record)| record.dig("claim_id").and_then(Json::as_str).unwrap())
+            .collect();
         assert_eq!(claim_ids, vec!["c2", "nonexistent"]);
     }
 }
@@ -321,7 +371,15 @@ mod check_role_actor_id_tests {
         store: &impl AggregateScan,
         queries: &[QueryDef],
     ) -> Result<(), Refusal> {
-        check_role_via(command_role, command_name, caller_role, caller_actor_id, store, queries, Some(GOVERNANCE_ASSIGNMENTS))
+        check_role_via(
+            command_role,
+            command_name,
+            caller_role,
+            caller_actor_id,
+            store,
+            queries,
+            Some(GOVERNANCE_ASSIGNMENTS),
+        )
     }
 
     /// Mirrors the merged `Store` compiled for a domain using Governance: one `RoleAssignment`
@@ -345,7 +403,11 @@ mod check_role_actor_id_tests {
         QueryDef {
             verb: "Governance::RoleAssignment.AssignmentsForActor",
             aggregate: "Governance::RoleAssignment",
-            conditions: &[QueryCondition { field: "actor_id", comparator: QueryComparator::Eq, value: QueryConditionValue::Arg("actor_id") }],
+            conditions: &[QueryCondition {
+                field: "actor_id",
+                comparator: QueryComparator::Eq,
+                value: QueryConditionValue::Arg("actor_id"),
+            }],
             reference_hop_conditions: &[],
             order_by: None,
             offset: None,
@@ -356,65 +418,134 @@ mod check_role_actor_id_tests {
 
     fn role_assignment(actor_id: &str, role_name: &str, ends_at: Option<&str>) -> Json {
         Json::obj(vec![
-            ("actor_id", Json::obj(vec![("value", Json::str(actor_id.to_string()))])),
-            ("role_name", Json::obj(vec![("value", Json::str(role_name.to_string()))])),
-            ("scope", Json::obj(vec![("value", Json::str("kitchen".to_string()))])),
-            ("starts_at", Json::obj(vec![("value", Json::str("2026-01-01".to_string()))])),
-            ("ends_at", match ends_at {
-                Some(ts) => Json::obj(vec![("value", Json::str(ts.to_string()))]),
-                None => Json::Null,
-            }),
+            (
+                "actor_id",
+                Json::obj(vec![("value", Json::str(actor_id.to_string()))]),
+            ),
+            (
+                "role_name",
+                Json::obj(vec![("value", Json::str(role_name.to_string()))]),
+            ),
+            (
+                "scope",
+                Json::obj(vec![("value", Json::str("kitchen".to_string()))]),
+            ),
+            (
+                "starts_at",
+                Json::obj(vec![("value", Json::str("2026-01-01".to_string()))]),
+            ),
+            (
+                "ends_at",
+                ends_at.map_or(Json::Null, |ts| {
+                    Json::obj(vec![("value", Json::str(ts.to_string()))])
+                }),
+            ),
         ])
     }
 
     // An identified actor with no grant is refused even when the typed role matches.
     #[test]
     fn refuses_an_identified_caller_with_no_matching_grant_even_though_the_typed_role_matches() {
-        let store = FakeStore { role_assignments: vec![] };
+        let store = FakeStore {
+            role_assignments: vec![],
+        };
         let queries = [assignments_for_actor_query()];
 
-        let result = check_role(Some("Chef"), "Prepare", Some("Chef"), Some("attacker"), &store, &queries);
+        let result = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("attacker"),
+            &store,
+            &queries,
+        );
 
-        assert!(result.is_err(), "an actor with no real grant must be refused even though it typed the right role");
+        assert!(
+            result.is_err(),
+            "an actor with no real grant must be refused even though it typed the right role"
+        );
     }
 
     // A live (non-revoked) matching grant is accepted.
     #[test]
     fn accepts_an_identified_caller_with_a_live_matching_grant() {
-        let store = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))] };
+        let store = FakeStore {
+            role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))],
+        };
         let queries = [assignments_for_actor_query()];
 
-        let result = check_role(Some("Chef"), "Prepare", Some("Chef"), Some("u1"), &store, &queries);
+        let result = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("u1"),
+            &store,
+            &queries,
+        );
 
-        assert!(result.is_ok(), "a live matching grant must be accepted: {result:?}");
+        assert!(
+            result.is_ok(),
+            "a live matching grant must be accepted: {result:?}"
+        );
     }
 
     // A revoked grant (`ends_at` set) is refused.
     #[test]
     fn refuses_a_revoked_grant() {
-        let store = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", Some("2026-06-01")))] };
+        let store = FakeStore {
+            role_assignments: vec![(
+                "ra1".to_string(),
+                role_assignment("u1", "Chef", Some("2026-06-01")),
+            )],
+        };
         let queries = [assignments_for_actor_query()];
 
-        let result = check_role(Some("Chef"), "Prepare", Some("Chef"), Some("u1"), &store, &queries);
+        let result = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("u1"),
+            &store,
+            &queries,
+        );
 
-        assert!(result.is_err(), "a revoked grant must not authorize: {result:?}");
+        assert!(
+            result.is_err(),
+            "a revoked grant must not authorize: {result:?}"
+        );
     }
 
     // An identified caller that states no role is held to what Governance assigned them.
     #[test]
     fn an_identified_caller_with_no_stated_role_needs_a_live_assignment_of_the_commands_role() {
-        let store = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))] };
+        let store = FakeStore {
+            role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))],
+        };
         let queries = [assignments_for_actor_query()];
 
-        assert!(check_role(Some("Chef"), "Prepare", None, Some("u1"), &store, &queries).is_ok(), "an assigned actor needs no stated role");
-        assert!(check_role(Some("Waiter"), "Serve", None, Some("u1"), &store, &queries).is_err(), "an actor not assigned the role is refused");
-        assert!(check_role(Some("Chef"), "Prepare", None, Some("u2"), &store, &queries).is_err(), "an unassigned actor is refused");
+        assert!(
+            check_role(Some("Chef"), "Prepare", None, Some("u1"), &store, &queries).is_ok(),
+            "an assigned actor needs no stated role"
+        );
+        assert!(
+            check_role(Some("Waiter"), "Serve", None, Some("u1"), &store, &queries).is_err(),
+            "an actor not assigned the role is refused"
+        );
+        assert!(
+            check_role(Some("Chef"), "Prepare", None, Some("u2"), &store, &queries).is_err(),
+            "an unassigned actor is refused"
+        );
     }
 
     // Revoked assignments do not count for a caller with no stated role either.
     #[test]
     fn an_identified_caller_with_no_stated_role_is_refused_on_a_revoked_assignment() {
-        let store = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", Some("2026-06-01")))] };
+        let store = FakeStore {
+            role_assignments: vec![(
+                "ra1".to_string(),
+                role_assignment("u1", "Chef", Some("2026-06-01")),
+            )],
+        };
         let queries = [assignments_for_actor_query()];
 
         assert!(check_role(Some("Chef"), "Prepare", None, Some("u1"), &store, &queries).is_err());
@@ -423,64 +554,149 @@ mod check_role_actor_id_tests {
     // No Governance provider attached: an actor with no stated role stays unchecked, as before.
     #[test]
     fn an_identified_caller_with_no_stated_role_is_unchecked_when_governance_is_not_attached() {
-        let store = FakeStore { role_assignments: vec![] };
+        let store = FakeStore {
+            role_assignments: vec![],
+        };
 
         let result = check_role_via(Some("Chef"), "Prepare", None, Some("u1"), &store, &[], None);
 
-        assert!(result.is_ok(), "no provider, nothing to check against: {result:?}");
+        assert!(
+            result.is_ok(),
+            "no provider, nothing to check against: {result:?}"
+        );
     }
 
     // A caller with only `role:` keeps the plain string comparison, whatever grants exist.
     #[test]
     fn a_bare_role_only_caller_is_unaffected_by_any_real_grant_data() {
-        let store = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Customer", None))] };
+        let store = FakeStore {
+            role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Customer", None))],
+        };
         let queries = [assignments_for_actor_query()];
 
         // Matching string, no actor_id: accepted.
-        let matches = check_role(Some("Chef"), "Prepare", Some("Chef"), None, &store, &queries);
-        assert!(matches.is_ok(), "a bare matching role string must still be accepted unchanged: {matches:?}");
+        let matches = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            None,
+            &store,
+            &queries,
+        );
+        assert!(
+            matches.is_ok(),
+            "a bare matching role string must still be accepted unchanged: {matches:?}"
+        );
 
         // Mismatched string, no actor_id: refused.
-        let mismatches = check_role(Some("Chef"), "Prepare", Some("Customer"), None, &store, &queries);
-        assert!(mismatches.is_err(), "a bare mismatched role string must still refuse unchanged");
+        let mismatches = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Customer"),
+            None,
+            &store,
+            &queries,
+        );
+        assert!(
+            mismatches.is_err(),
+            "a bare mismatched role string must still refuse unchanged"
+        );
     }
 
     // Without an `AssignmentsForActor` query, a bound `actor_id` falls back to the string check.
     #[test]
     fn falls_back_to_the_string_check_when_this_domain_never_attached_governance() {
-        let store = FakeStore { role_assignments: vec![] };
+        let store = FakeStore {
+            role_assignments: vec![],
+        };
         let queries: [QueryDef; 0] = [];
 
-        let matches = check_role(Some("Chef"), "Prepare", Some("Chef"), Some("whoever"), &store, &queries);
+        let matches = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("whoever"),
+            &store,
+            &queries,
+        );
         assert!(matches.is_ok(), "no AssignmentsForActor query compiled in -> string fallback, matching role -> accepted: {matches:?}");
 
-        let mismatches = check_role(Some("Chef"), "Prepare", Some("Customer"), Some("whoever"), &store, &queries);
+        let mismatches = check_role(
+            Some("Chef"),
+            "Prepare",
+            Some("Customer"),
+            Some("whoever"),
+            &store,
+            &queries,
+        );
         assert!(mismatches.is_err(), "no AssignmentsForActor query compiled in -> string fallback, mismatched role -> refused");
     }
 
     // The declared provider verb is honoured, not the Governance query name...
     #[test]
     fn check_role_via_reads_whichever_assignments_query_the_chapter_declared() {
-        let declared = QueryDef { verb: "Access::Grant.HeldBy", ..assignments_for_actor_query() };
+        let declared = QueryDef {
+            verb: "Access::Grant.HeldBy",
+            ..assignments_for_actor_query()
+        };
         let queries = [declared];
 
-        let granted = FakeStore { role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))] };
-        let accepted = check_role_via(Some("Chef"), "Prepare", Some("Chef"), Some("u1"), &granted, &queries, Some("Access::Grant.HeldBy"));
-        assert!(accepted.is_ok(), "a live grant under the declared query must be accepted: {accepted:?}");
+        let granted = FakeStore {
+            role_assignments: vec![("ra1".to_string(), role_assignment("u1", "Chef", None))],
+        };
+        let accepted = check_role_via(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("u1"),
+            &granted,
+            &queries,
+            Some("Access::Grant.HeldBy"),
+        );
+        assert!(
+            accepted.is_ok(),
+            "a live grant under the declared query must be accepted: {accepted:?}"
+        );
 
-        let ungranted = FakeStore { role_assignments: vec![] };
-        let refused = check_role_via(Some("Chef"), "Prepare", Some("Chef"), Some("u1"), &ungranted, &queries, Some("Access::Grant.HeldBy"));
-        assert!(refused.is_err(), "no grant under the declared query must refuse even though the typed role matches");
+        let ungranted = FakeStore {
+            role_assignments: vec![],
+        };
+        let refused = check_role_via(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("u1"),
+            &ungranted,
+            &queries,
+            Some("Access::Grant.HeldBy"),
+        );
+        assert!(
+            refused.is_err(),
+            "no grant under the declared query must refuse even though the typed role matches"
+        );
     }
 
     // ...and with no declared provider, a Governance-named query is ignored.
     #[test]
     fn check_role_via_ignores_a_governance_named_query_nobody_declared() {
-        let store = FakeStore { role_assignments: vec![] };
+        let store = FakeStore {
+            role_assignments: vec![],
+        };
         let queries = [assignments_for_actor_query()];
 
-        let result = check_role_via(Some("Chef"), "Prepare", Some("Chef"), Some("whoever"), &store, &queries, None);
-        assert!(result.is_ok(), "no declared provider -> string fallback, matching role -> accepted: {result:?}");
+        let result = check_role_via(
+            Some("Chef"),
+            "Prepare",
+            Some("Chef"),
+            Some("whoever"),
+            &store,
+            &queries,
+            None,
+        );
+        assert!(
+            result.is_ok(),
+            "no declared provider -> string fallback, matching role -> accepted: {result:?}"
+        );
     }
 }
 
@@ -489,6 +705,8 @@ mod json_cache_tests {
     use super::{InMemoryRepository, Repository};
     use crate::kernel::Json;
 
+    // reason: `json_entries` takes `fn(&T) -> Json`, so the signature is fixed by the caller.
+    #[allow(clippy::trivially_copy_pass_by_ref)]
     fn render(n: &i64) -> Json {
         Json::obj(vec![("n", Json::int(*n))])
     }
@@ -499,11 +717,20 @@ mod json_cache_tests {
         let mut repo: InMemoryRepository<i64> = InMemoryRepository::new();
         repo.save("b", 2);
         repo.save("a", 1);
-        let first: Vec<(String, Json)> = repo.json_entries(render).map(|(id, json)| (id.clone(), json.clone())).collect();
-        assert_eq!(first, vec![("a".to_string(), render(&1)), ("b".to_string(), render(&2))]);
+        let first: Vec<(String, Json)> = repo
+            .json_entries(render)
+            .map(|(id, json)| (id.clone(), json.clone()))
+            .collect();
+        assert_eq!(
+            first,
+            vec![("a".to_string(), render(&1)), ("b".to_string(), render(&2))]
+        );
 
         repo.save("a", 10);
-        let second: Vec<Json> = repo.json_entries(render).map(|(_, json)| json.clone()).collect();
+        let second: Vec<Json> = repo
+            .json_entries(render)
+            .map(|(_, json)| json.clone())
+            .collect();
         assert_eq!(second, vec![render(&10), render(&2)]);
     }
 }