hecks 3.14.0 → 4.0.0

data/rust/host/src/web/newsletter.rs

@@ -1,11 +1,10 @@
-use super::newsletter_send::{site_url, unsubscribe_token, unsubscribe_token_matches, unsubscribe_url};
-use super::{instances_for, last_refusal, respond};
+use super::newsletter_send::{unsubscribe_token, unsubscribe_token_matches, unsubscribe_url};
+use super::{instances_for, last_refusal, respond, site_url};
 use crate::auth;
+use crate::commerce_ir::{newsletter_provider, NewsletterProvider};
 use crate::dispatch;
+use crate::host::Host;
 use crate::ir::ir;
-use crate::commerce_ir::{newsletter_provider, NewsletterProvider};
-use crate::journal::LineageConfig;
-use crate::lambda_client::LambdaInvoker;
 use crate::resend::{Email, Mailer};
 use serde_json::{json, Value};
 use std::collections::HashMap;
@@ -26,20 +25,28 @@ pub(super) async fn newsletter_route(
     path: &str,
     query: &HashMap<String, String>,
     raw_body: &str,
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-    config: &LineageConfig,
-    invoker: &dyn LambdaInvoker,
+    host: Host<'_>,
 ) -> Option<Value> {
+    let Host {
+        client, wasm_path, ..
+    } = host;
     // The chapter that declares `provides "newsletter"` names the verbs
     // and the subscribing aggregate; a domain that attaches none serves
     // none of these routes.
     let provider = ir().and_then(newsletter_provider)?;
     match (method, path) {
-        ("POST", "/newsletter/subscribers") => Some(newsletter_subscribe_route(&provider, raw_body, client, wasm_path, config, invoker).await),
-        ("GET", "/newsletter/subscribers") => Some(newsletter_subscribers_list_route(&provider, client, wasm_path).await),
-        ("GET", "/newsletter/subscribers/confirm") => Some(newsletter_confirm_route(&provider, query, client, wasm_path, config, invoker).await),
-        ("GET", "/newsletter/subscribers/unsubscribe") => Some(newsletter_unsubscribe_route(&provider, query, client, wasm_path, config, invoker).await),
+        ("POST", "/newsletter/subscribers") => {
+            Some(newsletter_subscribe_route(&provider, raw_body, host).await)
+        }
+        ("GET", "/newsletter/subscribers") => {
+            Some(newsletter_subscribers_list_route(&provider, client, wasm_path).await)
+        }
+        ("GET", "/newsletter/subscribers/confirm") => {
+            Some(newsletter_confirm_route(&provider, query, host).await)
+        }
+        ("GET", "/newsletter/subscribers/unsubscribe") => {
+            Some(newsletter_unsubscribe_route(&provider, query, host).await)
+        }
         _ => None,
     }
 }
@@ -49,31 +56,51 @@ pub(super) async fn newsletter_route(
 async fn newsletter_subscribe_route(
     provider: &NewsletterProvider,
     raw_body: &str,
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-    config: &LineageConfig,
-    invoker: &dyn LambdaInvoker,
+    host: Host<'_>,
 ) -> Value {
+    let Host {
+        client, wasm_path, ..
+    } = host;
     let body: Value = match serde_json::from_str(raw_body) {
         Ok(v) => v,
-        Err(e) => return respond(400, "application/json", &json!({"error": format!("invalid JSON: {e}")}).to_string()),
+        Err(e) => {
+            return respond(
+                400,
+                "application/json",
+                &json!({"error": format!("invalid JSON: {e}")}).to_string(),
+            )
+        }
     };
     let Some(email) = body.get("email").and_then(|v| v.as_str()) else {
-        return respond(400, "application/json", &json!({"error": "email"}).to_string());
+        return respond(
+            400,
+            "application/json",
+            &json!({"error": "email"}).to_string(),
+        );
     };
-    let first_name = body.get("first_name").and_then(|v| v.as_str()).filter(|s| !s.is_empty());
-    let last_name = body.get("last_name").and_then(|v| v.as_str()).filter(|s| !s.is_empty());
+    let first_name = body
+        .get("first_name")
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.is_empty());
+    let last_name = body
+        .get("last_name")
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.is_empty());
 
     let read = match dispatch::read(client, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
-    let existing = instances_for(&read, &provider.instance_prefix()).iter().any(|(id, _)| id == email);
+    let existing = instances_for(&read, &provider.instance_prefix())
+        .iter()
+        .any(|(id, _)| id == email);
 
     if existing {
         if let (Some(first), Some(last)) = (first_name, last_name) {
             let facts = json!({"first_name": {"value": first}, "last_name": {"value": last}});
-            if let Err(e) = dispatch::handle_routed(client, wasm_path, &provider.add_name, json!(email), facts, None, config, invoker).await {
+            if let Err(e) =
+                dispatch::handle_routed(host, &provider.add_name, json!(email), facts, None).await
+            {
                 return respond(500, "text/plain", &format!("{e:#}"));
             }
         }
@@ -85,12 +112,16 @@ async fn newsletter_subscribe_route(
         if let Some(last) = last_name {
             facts["last_name"] = json!({"value": last});
         }
-        let outcome = match dispatch::handle_facts(client, wasm_path, &provider.subscribe, facts, None, config, invoker).await {
+        let outcome = match dispatch::handle_facts(host, &provider.subscribe, facts, None).await {
             Ok(o) => o,
             Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
         };
         if !outcome.accepted {
-            return respond(422, "application/json", &last_refusal(&outcome.result).to_string());
+            return respond(
+                422,
+                "application/json",
+                &last_refusal(&outcome.result).to_string(),
+            );
         }
         send_confirmation(email).await;
     }
@@ -104,16 +135,31 @@ async fn newsletter_subscribe_route(
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
     let Some((_, subscriber)) = subscribers.iter().find(|(id, _)| id == email) else {
-        return respond(500, "text/plain", "subscriber vanished immediately after being written");
+        return respond(
+            500,
+            "text/plain",
+            "subscriber vanished immediately after being written",
+        );
     };
-    let status = subscriber.get("status").and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
-    respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
+    let status = subscriber
+        .get("status")
+        .and_then(|v| v.as_str())
+        .unwrap_or_else(|| provider.initial_status());
+    respond(
+        200,
+        "application/json",
+        &json!({"email": email, "status": status}).to_string(),
+    )
 }
 
 // Reads directly off `instances`, not `dispatch::query`: Subscriber lives
 // under the Newsletter chapter, not `config.domain`, so the qualified
 // question name would not resolve there.
-async fn newsletter_subscribers_list_route(provider: &NewsletterProvider, client: &Mutex<Client>, wasm_path: &Path) -> Value {
+async fn newsletter_subscribers_list_route(
+    provider: &NewsletterProvider,
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+) -> Value {
     let read = match dispatch::read(client, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
@@ -129,7 +175,12 @@ async fn newsletter_subscribers_list_route(provider: &NewsletterProvider, client
             })
         })
         .collect();
-    subscribers.sort_by(|a, b| a["email"].as_str().unwrap_or("").cmp(b["email"].as_str().unwrap_or("")));
+    subscribers.sort_by(|a, b| {
+        a["email"]
+            .as_str()
+            .unwrap_or("")
+            .cmp(b["email"].as_str().unwrap_or(""))
+    });
     respond(200, "application/json", &json!(subscribers).to_string())
 }
 
@@ -137,30 +188,50 @@ const CONFIRM_PURPOSE: &str = "newsletter-confirm";
 
 // SESSION_SECRET; unset means no confirm link can be signed and none is sent.
 fn confirm_secret() -> Option<String> {
-    std::env::var("SESSION_SECRET").ok().filter(|s| !s.is_empty())
+    crate::secrets::var("SESSION_SECRET")
+        .ok()
+        .filter(|s| !s.is_empty())
 }
 
 fn confirm_token(secret: &str, email: &str) -> String {
-    auth::purpose_token(secret, CONFIRM_PURPOSE, json!({ "email": email }), crate::commerce_ir::newsletter_windows_binding().0)
+    auth::purpose_token(
+        secret,
+        CONFIRM_PURPOSE,
+        json!({ "email": email }),
+        crate::commerce_ir::newsletter_windows_binding().0,
+    )
 }
 
 fn confirm_token_matches(secret: &str, token: &str, email: &str) -> bool {
     auth::verify_purpose_token(secret, CONFIRM_PURPOSE, token)
-        .and_then(|claims| claims.get("email").and_then(|v| v.as_str()).map(|signed| signed == email))
+        .and_then(|claims| {
+            claims
+                .get("email")
+                .and_then(|v| v.as_str())
+                .map(|signed| signed == email)
+        })
         .unwrap_or(false)
 }
 
 // Percent-encodes the address so a '+' in the local part survives the URL.
 fn confirm_url(site_url: &str, email: &str, token: &str) -> String {
-    let mut url = reqwest::Url::parse(&format!("{site_url}/newsletter-confirmed.html")).unwrap_or_else(|_| reqwest::Url::parse("http://invalid.invalid/").unwrap());
-    url.query_pairs_mut().append_pair("email", email).append_pair("token", token);
+    // An unparseable site URL degrades to a placeholder host rather than failing the send.
+    let Ok(mut url) = reqwest::Url::parse(&format!("{site_url}/newsletter-confirmed.html"))
+        .or_else(|_| reqwest::Url::parse("http://invalid.invalid/"))
+    else {
+        return String::new();
+    };
+    url.query_pairs_mut()
+        .append_pair("email", email)
+        .append_pair("token", token);
     url.to_string()
 }
 
 // Per-process only (not shared across instances); see `ConfirmationCooldown`.
 fn confirmation_cooldown() -> &'static cooldown::ConfirmationCooldown {
     static COOLDOWN: OnceLock<cooldown::ConfirmationCooldown> = OnceLock::new();
-    COOLDOWN.get_or_init(|| cooldown::ConfirmationCooldown::new(cooldown::WINDOW, cooldown::CAPACITY))
+    COOLDOWN
+        .get_or_init(|| cooldown::ConfirmationCooldown::new(cooldown::WINDOW, cooldown::CAPACITY))
 }
 
 fn confirmation_body(confirm_url: &str) -> String {
@@ -195,21 +266,32 @@ pub(super) async fn send_confirmation(email: &str) {
     let site = site_url();
     let link = confirm_url(&site, email, &confirm_token(&secret, email));
     let unsubscribe = unsubscribe_url(&site, email, &unsubscribe_token(&secret, email));
-    let body = match template::branded_body(&link, &unsubscribe).await {
-        Some(html) => html,
-        None => confirmation_body(&link),
-    };
+    let body = template::branded_body(&link, &unsubscribe)
+        .await
+        .unwrap_or_else(|| confirmation_body(&link));
     let delivery = mailer
-        .deliver(&Email { to: email, subject: "Confirm your newsletter subscription", body: &body, unsubscribe_url: Some(&unsubscribe) })
+        .deliver(&Email {
+            to: email,
+            subject: "Confirm your newsletter subscription",
+            body: &body,
+            unsubscribe_url: Some(&unsubscribe),
+        })
         .await;
     if !delivery.ok {
-        eprintln!("newsletter: the confirmation email was not delivered: {}", delivery.reason.unwrap_or_default());
+        eprintln!(
+            "newsletter: the confirmation email was not delivered: {}",
+            delivery.reason.unwrap_or_default()
+        );
     }
 }
 
 // Only mails when the address is now `pending`; an already-confirmed or
 // unsubscribed registrant is left alone.
-pub(super) async fn send_confirmation_if_pending(email: &str, client: &Mutex<Client>, wasm_path: &Path) {
+pub(super) async fn send_confirmation_if_pending(
+    email: &str,
+    client: &Mutex<Client>,
+    wasm_path: &Path,
+) {
     let Some(provider) = ir().and_then(newsletter_provider) else {
         return;
     };
@@ -218,7 +300,11 @@ pub(super) async fn send_confirmation_if_pending(email: &str, client: &Mutex<Cli
     };
     let pending = instances_for(&read, &provider.instance_prefix())
         .iter()
-        .any(|(id, subscriber)| id == email && provider.is_awaiting_confirmation(subscriber.get("status").and_then(|v| v.as_str())));
+        .any(|(id, subscriber)| {
+            id == email
+                && provider
+                    .is_awaiting_confirmation(subscriber.get("status").and_then(|v| v.as_str()))
+        });
     if pending {
         send_confirmation(email).await;
     }
@@ -228,16 +314,31 @@ pub(super) async fn send_confirmation_if_pending(email: &str, client: &Mutex<Cli
 // a missing, wrong or expired one refuses before any subscriber is touched.
 // Idempotent: dispatches Confirm only while still `pending`, so a double
 // click or link-prefetch lands on the same success response, not a 422.
-async fn newsletter_confirm_route(provider: &NewsletterProvider, query: &HashMap<String, String>, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
+async fn newsletter_confirm_route(
+    provider: &NewsletterProvider,
+    query: &HashMap<String, String>,
+    host: Host<'_>,
+) -> Value {
+    let Host {
+        client, wasm_path, ..
+    } = host;
     let Some(email) = query.get("email") else {
-        return respond(400, "application/json", &json!({"error": "email"}).to_string());
+        return respond(
+            400,
+            "application/json",
+            &json!({"error": "email"}).to_string(),
+        );
     };
     let signed = match (confirm_secret(), query.get("token")) {
         (Some(secret), Some(token)) => confirm_token_matches(&secret, token, email),
         _ => false,
     };
     if !signed {
-        return respond(403, "application/json", &json!({"error": "this confirmation link is invalid or has expired"}).to_string());
+        return respond(
+            403,
+            "application/json",
+            &json!({"error": "this confirmation link is invalid or has expired"}).to_string(),
+        );
     }
 
     let read = match dispatch::read(client, wasm_path).await {
@@ -246,11 +347,17 @@ async fn newsletter_confirm_route(provider: &NewsletterProvider, query: &HashMap
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
     let Some((_, subscriber)) = subscribers.iter().find(|(id, _)| id == email) else {
-        return respond(404, "application/json", &json!({"error": "no such subscriber"}).to_string());
+        return respond(
+            404,
+            "application/json",
+            &json!({"error": "no such subscriber"}).to_string(),
+        );
     };
 
     if provider.is_awaiting_confirmation(subscriber.get("status").and_then(|v| v.as_str())) {
-        if let Err(e) = dispatch::handle_routed(client, wasm_path, &provider.confirm, json!(email), json!({}), None, config, invoker).await {
+        if let Err(e) =
+            dispatch::handle_routed(host, &provider.confirm, json!(email), json!({}), None).await
+        {
             return respond(500, "text/plain", &format!("{e:#}"));
         }
     }
@@ -260,15 +367,31 @@ async fn newsletter_confirm_route(provider: &NewsletterProvider, query: &HashMap
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
-    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
-    respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
+    let status = subscribers
+        .iter()
+        .find(|(id, _)| id == email)
+        .and_then(|(_, s)| s.get("status"))
+        .and_then(|v| v.as_str())
+        .unwrap_or_else(|| provider.initial_status());
+    respond(
+        200,
+        "application/json",
+        &json!({"email": email, "status": status}).to_string(),
+    )
 }
 
 // 400 with no address; 403 for a missing, wrong, other-address or expired
 // token, or no secret to check against. Otherwise Ok(email).
-fn unsubscribe_authorized<'a>(secret: Option<&str>, query: &'a HashMap<String, String>) -> Result<&'a str, Value> {
+fn unsubscribe_authorized<'a>(
+    secret: Option<&str>,
+    query: &'a HashMap<String, String>,
+) -> Result<&'a str, Value> {
     let Some(email) = query.get("email") else {
-        return Err(respond(400, "application/json", &json!({"error": "email"}).to_string()));
+        return Err(respond(
+            400,
+            "application/json",
+            &json!({"error": "email"}).to_string(),
+        ));
     };
     let signed = match (secret, query.get("token")) {
         (Some(secret), Some(token)) => unsubscribe_token_matches(secret, token, email),
@@ -277,14 +400,25 @@ fn unsubscribe_authorized<'a>(secret: Option<&str>, query: &'a HashMap<String, S
     if signed {
         Ok(email)
     } else {
-        Err(respond(403, "application/json", &json!({"error": "this unsubscribe link is invalid or has expired"}).to_string()))
+        Err(respond(
+            403,
+            "application/json",
+            &json!({"error": "this unsubscribe link is invalid or has expired"}).to_string(),
+        ))
     }
 }
 
 // Same token/idempotency shape as newsletter_confirm_route: Unsubscribe's
 // own `given` accepts a pending or confirmed subscriber, so a repeat click
 // on an already-unsubscribed row lands on the same success response.
-async fn newsletter_unsubscribe_route(provider: &NewsletterProvider, query: &HashMap<String, String>, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
+async fn newsletter_unsubscribe_route(
+    provider: &NewsletterProvider,
+    query: &HashMap<String, String>,
+    host: Host<'_>,
+) -> Value {
+    let Host {
+        client, wasm_path, ..
+    } = host;
     let email = match unsubscribe_authorized(confirm_secret().as_deref(), query) {
         Ok(email) => email,
         Err(refusal) => return refusal,
@@ -296,11 +430,18 @@ async fn newsletter_unsubscribe_route(provider: &NewsletterProvider, query: &Has
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
     let Some((_, subscriber)) = subscribers.iter().find(|(id, _)| id == email) else {
-        return respond(404, "application/json", &json!({"error": "no such subscriber"}).to_string());
+        return respond(
+            404,
+            "application/json",
+            &json!({"error": "no such subscriber"}).to_string(),
+        );
     };
 
     if !provider.has_left(subscriber.get("status").and_then(|v| v.as_str())) {
-        if let Err(e) = dispatch::handle_routed(client, wasm_path, &provider.unsubscribe, json!(email), json!({}), None, config, invoker).await {
+        if let Err(e) =
+            dispatch::handle_routed(host, &provider.unsubscribe, json!(email), json!({}), None)
+                .await
+        {
             return respond(500, "text/plain", &format!("{e:#}"));
         }
     }
@@ -310,6 +451,15 @@ async fn newsletter_unsubscribe_route(provider: &NewsletterProvider, query: &Has
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
-    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
-    respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
+    let status = subscribers
+        .iter()
+        .find(|(id, _)| id == email)
+        .and_then(|(_, s)| s.get("status"))
+        .and_then(|v| v.as_str())
+        .unwrap_or_else(|| provider.initial_status());
+    respond(
+        200,
+        "application/json",
+        &json!({"email": email, "status": status}).to_string(),
+    )
 }