hecks 3.14.0 → 5.0.0

data/rust/host/src/b64.rs

@@ -0,0 +1,91 @@
+//! The base64 the host reads and writes, in the two alphabets and strictness it needs.
+//!
+//! Both decoders refuse a second spelling of the same bytes where they can: URL-safe text must be
+//! canonical (no padding, no spare non-zero bits), because a signature that verifies over one
+//! spelling must not be re-spelled into a lookalike the issuer never produced.
+
+use base64::alphabet;
+use base64::engine::general_purpose::{GeneralPurpose, GeneralPurposeConfig, URL_SAFE_NO_PAD};
+use base64::engine::DecodePaddingMode;
+use base64::Engine;
+
+/// Standard alphabet, accepting padding or none: what webhook secrets and signatures arrive as.
+const STANDARD_ANY_PADDING: GeneralPurpose = GeneralPurpose::new(
+    &alphabet::STANDARD,
+    GeneralPurposeConfig::new().with_decode_padding_mode(DecodePaddingMode::Indifferent),
+);
+
+/// Unpadded base64url (RFC 4648 section 5).
+pub fn url_encode(bytes: &[u8]) -> String {
+    URL_SAFE_NO_PAD.encode(bytes)
+}
+
+/// Canonical unpadded base64url; `None` for padding, a character outside the alphabet, a length
+/// no byte string encodes to, or spare trailing bits that are not zero.
+pub fn url_decode(text: &str) -> Option<Vec<u8>> {
+    URL_SAFE_NO_PAD.decode(text).ok()
+}
+
+/// Standard base64, padded or not; `None` on any other character.
+pub fn standard_decode(text: &str) -> Option<Vec<u8>> {
+    STANDARD_ANY_PADDING.decode(text).ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn url_text_round_trips_every_length_and_is_url_safe() {
+        for input in [
+            &b""[..],
+            b"a",
+            b"ab",
+            b"abc",
+            b"abcd",
+            b"\x00\xff\x10hello world!",
+        ] {
+            let encoded = url_encode(input);
+            assert!(
+                !encoded.contains(['+', '/', '=']),
+                "must be URL-safe: {encoded}"
+            );
+            assert_eq!(url_decode(&encoded).as_deref(), Some(input));
+        }
+    }
+
+    #[test]
+    fn url_text_must_be_canonical() {
+        assert_eq!(url_decode("Zg").as_deref(), Some(&b"f"[..]));
+        assert_eq!(url_decode("Zg=="), None, "padding is a second spelling");
+        assert_eq!(url_decode("Zh"), None, "spare bits must be zero");
+        assert_eq!(
+            url_decode("a+b/"),
+            None,
+            "the standard alphabet is another spelling"
+        );
+        assert_eq!(
+            url_decode("Z"),
+            None,
+            "no byte string encodes to one character"
+        );
+    }
+
+    #[test]
+    fn standard_text_decodes_padded_or_not_and_refuses_other_characters() {
+        assert_eq!(
+            standard_decode("c2VjcmV0LWtleQ==").as_deref(),
+            Some(&b"secret-key"[..])
+        );
+        assert_eq!(
+            standard_decode("c2VjcmV0LWtleQ").as_deref(),
+            Some(&b"secret-key"[..])
+        );
+        assert_eq!(
+            standard_decode("-_"),
+            None,
+            "the URL-safe alphabet is not standard"
+        );
+        assert_eq!(standard_decode("not base64!"), None);
+    }
+}

data/rust/host/src/bin/expr_harness.rs

@@ -16,12 +16,16 @@ fn main() -> anyhow::Result<()> {
     let mut input = String::new();
     std::io::stdin().read_to_string(&mut input)?;
     let request: Json = serde_json::from_str(&input)?;
-    let cases = request.get("cases").and_then(Json::as_array).ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
+    let cases = request
+        .get("cases")
+        .and_then(Json::as_array)
+        .ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
 
     let results: Vec<Json> = cases
         .iter()
         .map(|case| {
-            let outcome = expr_json::parse(&case["ast"]).and_then(|expr| expr_json::interpret(&expr, &case["instance"]));
+            let outcome = expr_json::parse(&case["ast"])
+                .and_then(|expr| expr_json::interpret(&expr, &case["instance"]));
             match outcome {
                 Ok(value) => json!({ "ok": to_json(&value) }),
                 Err(error) => json!({ "error": error }),

data/rust/host/src/bin/lineage_harness.rs

@@ -8,10 +8,13 @@
 //! stdout is `{"results": [...]}`, one entry per operation in order. A per-operation Postgres
 //! error (such as an RLS refusal) lands in that entry; only a failed connection exits nonzero.
 
-// journal.rs has no `crate::` references, so it is shared with `bootstrap` by path, not a lib
-// split.
+// journal.rs reaches only `crate::hecks_naming`, so it is shared with `bootstrap` by path, not a
+// lib split, and carries that one file with it.
 // The flat-journal functions it also carries are unused here.
 #[allow(dead_code)]
+#[path = "../../../codegen/src/hecks_naming.rs"]
+mod hecks_naming;
+#[allow(dead_code)]
 #[path = "../journal.rs"]
 mod journal;
 
@@ -31,7 +34,9 @@ async fn main() -> anyhow::Result<()> {
     let [_, db_name, app_role, domain, era] = args.as_slice() else {
         anyhow::bail!("usage: lineage_harness <db_name> <app_role> <domain> <era>");
     };
-    let era: i32 = era.parse().map_err(|_| anyhow::anyhow!("era must be an integer, got {era:?}"))?;
+    let era: i32 = era
+        .parse()
+        .map_err(|_| anyhow::anyhow!("era must be an integer, got {era:?}"))?;
 
     let mut input = String::new();
     std::io::stdin().read_to_string(&mut input)?;
@@ -42,7 +47,11 @@ async fn main() -> anyhow::Result<()> {
         .ok_or_else(|| anyhow::anyhow!("stdin JSON missing \"operations\" array"))?;
 
     // tokio_postgres ignores libpq's `PGPASSWORD`, so pass it through when the server asks for one.
-    let password = std::env::var("PGPASSWORD").ok().filter(|p| !p.is_empty()).map(|p| format!(" password={p}")).unwrap_or_default();
+    let password = std::env::var("PGPASSWORD")
+        .ok()
+        .filter(|p| !p.is_empty())
+        .map(|p| format!(" password={p}"))
+        .unwrap_or_default();
     let conn_string = format!("host=localhost dbname={db_name} user={app_role}{password}");
     let (client, connection) = tokio_postgres::connect(&conn_string, NoTls).await?;
     tokio::spawn(async move {
@@ -51,7 +60,11 @@ async fn main() -> anyhow::Result<()> {
         }
     });
 
-    let config = journal::LineageConfig { domain: domain.clone(), era: Some(era), mirrored: None };
+    let config = journal::LineageConfig {
+        domain: domain.clone(),
+        era: Some(era),
+        mirrored: None,
+    };
     let mut results = Vec::with_capacity(operations.len());
 
     for operation in operations {
@@ -62,7 +75,11 @@ async fn main() -> anyhow::Result<()> {
     Ok(())
 }
 
-async fn run_one(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> Value {
+async fn run_one(
+    client: &tokio_postgres::Client,
+    config: &journal::LineageConfig,
+    operation: &Value,
+) -> Value {
     let op = operation.get("op").and_then(|v| v.as_str()).unwrap_or("");
 
     let outcome = match op {
@@ -82,20 +99,34 @@ async fn run_one(client: &tokio_postgres::Client, config: &journal::LineageConfi
     }
 }
 
-async fn read_all(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+async fn read_all(
+    client: &tokio_postgres::Client,
+    config: &journal::LineageConfig,
+    operation: &Value,
+) -> anyhow::Result<Value> {
     let storage_name = require_str(operation, "storage_name")?;
     let rows = journal::read_lineage_head_all(client, &config.domain, storage_name).await?;
-    Ok(json!({ "rows": rows.into_iter().map(|(id, state)| json!([id, state])).collect::<Vec<_>>() }))
+    Ok(
+        json!({ "rows": rows.into_iter().map(|(id, state)| json!([id, state])).collect::<Vec<_>>() }),
+    )
 }
 
-async fn read_by_id(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+async fn read_by_id(
+    client: &tokio_postgres::Client,
+    config: &journal::LineageConfig,
+    operation: &Value,
+) -> anyhow::Result<Value> {
     let storage_name = require_str(operation, "storage_name")?;
     let id = require_str(operation, "id")?;
     let state = journal::read_lineage_head_by_id(client, &config.domain, storage_name, id).await?;
     Ok(json!({ "state": state }))
 }
 
-async fn write(client: &tokio_postgres::Client, config: &journal::LineageConfig, operation: &Value) -> anyhow::Result<Value> {
+async fn write(
+    client: &tokio_postgres::Client,
+    config: &journal::LineageConfig,
+    operation: &Value,
+) -> anyhow::Result<Value> {
     let aggregate = require_str(operation, "aggregate")?;
     let id = require_str(operation, "id")?;
     let state = operation
@@ -105,7 +136,12 @@ async fn write(client: &tokio_postgres::Client, config: &journal::LineageConfig,
     journal::append_lineage_mutation(
         client,
         config,
-        &journal::Mutation { aggregate, id, operation: "save", state },
+        &journal::Mutation {
+            aggregate,
+            id,
+            operation: "save",
+            state,
+        },
     )
     .await?;
     Ok(json!({}))

data/rust/host/src/bin/mint_harness.rs

@@ -4,29 +4,29 @@
 // Modules are shared with `bootstrap` by path, not a lib split, so `crate::` in mint.rs resolves
 // here.
 #[allow(dead_code)]
-#[path = "../log.rs"]
-mod log;
+#[path = "../expr_json.rs"]
+mod expr_json;
+#[allow(dead_code)]
+#[path = "../../../codegen/src/hecks_naming.rs"]
+mod hecks_naming;
 #[allow(dead_code)]
 #[path = "../journal.rs"]
 mod journal;
 #[allow(dead_code)]
-#[path = "../storage_shape.rs"]
-mod storage_shape;
+#[path = "../log.rs"]
+mod log;
+#[allow(dead_code)]
+#[path = "../mint.rs"]
+mod mint;
 #[allow(dead_code)]
 #[path = "../reference_transform.rs"]
 mod reference_transform;
 #[allow(dead_code)]
-#[path = "../expr_json.rs"]
-mod expr_json;
-#[allow(dead_code)]
 #[path = "../reference_validate.rs"]
 mod reference_validate;
 #[allow(dead_code)]
-#[path = "../approval.rs"]
-mod approval;
-#[allow(dead_code)]
-#[path = "../mint.rs"]
-mod mint;
+#[path = "../storage_shape.rs"]
+mod storage_shape;
 
 // The shared modules' Postgres tests connect through `crate::test_pg`, so the harness's own test
 // build carries the same connection-string helpers.
@@ -48,8 +48,10 @@ async fn main() -> anyhow::Result<()> {
         anyhow::bail!("usage: mint_harness <db_name> <owner_role> <domain> <ir_json_path>");
     };
 
-    let ir_text = std::fs::read_to_string(ir_path).map_err(|e| anyhow::anyhow!("reading {ir_path}: {e}"))?;
-    let ir: Value = serde_json::from_str(&ir_text).map_err(|e| anyhow::anyhow!("parsing {ir_path}: {e}"))?;
+    let ir_text =
+        std::fs::read_to_string(ir_path).map_err(|e| anyhow::anyhow!("reading {ir_path}: {e}"))?;
+    let ir: Value =
+        serde_json::from_str(&ir_text).map_err(|e| anyhow::anyhow!("parsing {ir_path}: {e}"))?;
 
     // A server that wants a password over TCP gets it from PGPASSWORD, as libpq would read it.
     // Built field by field, not spliced into a connection string, so a password with a space,
@@ -81,7 +83,11 @@ async fn main() -> anyhow::Result<()> {
         .unwrap_or_default()
         .iter()
         .map(|agg| {
-            let name = agg.get("name").and_then(Value::as_str).unwrap_or("").to_string();
+            let name = agg
+                .get("name")
+                .and_then(Value::as_str)
+                .unwrap_or("")
+                .to_string();
             let storage_name = journal::snake(&name);
             mint::Aggregate { name, storage_name }
         })
@@ -92,40 +98,67 @@ async fn main() -> anyhow::Result<()> {
     let era = match mint::decide_boot_action(&held, &my_label) {
         mint::BootDecision::UseExisting { ordinal } => ordinal,
         mint::BootDecision::HoldFirst => {
-            let source_text = ir.get("source_text").and_then(Value::as_str).unwrap_or("mint_harness fixture source");
+            let source_text = ir
+                .get("source_text")
+                .and_then(Value::as_str)
+                .unwrap_or("mint_harness fixture source");
             mint::hold_first(&client, domain, source_text, &ir, &aggregates, None).await?;
             1
         }
         mint::BootDecision::LatestUnnamed { ordinal } => {
             anyhow::bail!("latest held era {ordinal} has no label -- mint_harness has no bluebook parser to name it with");
         }
-        mint::BootDecision::Mint { ordinal, from_ordinal, from_label } => {
-            let mut labels: Vec<String> = held.iter().map(|h| h.label.clone().unwrap_or_default()).collect();
+        mint::BootDecision::Mint {
+            ordinal,
+            from_ordinal,
+            from_label,
+        } => {
+            let mut labels: Vec<String> = held
+                .iter()
+                .map(|h| h.label.clone().unwrap_or_default())
+                .collect();
             labels.push(my_label.clone());
             let edges = mint::parse_edges(&ir, domain);
             let chain = mint::edge_chain(&edges, &labels)
                 .map_err(|e| anyhow::anyhow!("drifted from era {from_ordinal} ({from_label}) to {my_label} with no covering edge -- {e}"))?;
 
-            // The same gate the host runs: a compute/rekey edge mints only on an approval, from the
-            // journal or committed in ir.json's `approvals`.
-            let raw_edges = ir.get("translations").and_then(Value::as_array).cloned().unwrap_or_default();
-            let committed_approvals = approval::committed(&ir);
-            for edge in &chain {
-                // An edge with no raw entry fails closed, as the host does, and never skips the gate.
-                let Some(raw_edge) = raw_edges.iter().find(|candidate| {
-                    candidate.get("domain").and_then(Value::as_str) == Some(domain.as_str())
-                        && candidate.get("from").and_then(Value::as_str) == Some(edge.from.as_str())
-                        && candidate.get("to").and_then(Value::as_str) == Some(edge.to.as_str())
-                }) else {
-                    anyhow::bail!("cannot boot: {domain}'s edge {} -> {} vanished between parsing and approval-checking it", edge.from, edge.to);
-                };
-                approval::check(&client, domain, raw_edge, ordinal, &committed_approvals).await?;
-            }
-            let watermarks: HashMap<i32, Option<i64>> = held.iter().map(|h| (h.ordinal, h.watermark)).collect();
-            mint::audit_before_mint(&client, domain, &ir, &aggregates, ordinal, &chain, &raw_edges, &watermarks).await?;
+            // The raw ir.json edges, matched to the chain by from/to pair for the audit.
+            let raw_edges = ir
+                .get("translations")
+                .and_then(Value::as_array)
+                .cloned()
+                .unwrap_or_default();
+            let watermarks: HashMap<i32, Option<i64>> =
+                held.iter().map(|h| (h.ordinal, h.watermark)).collect();
+            mint::audit_before_mint(
+                &client,
+                domain,
+                &ir,
+                &aggregates,
+                ordinal,
+                &chain,
+                &raw_edges,
+                &watermarks,
+            )
+            .await?;
 
-            let held_text = ir.get("source_text").and_then(Value::as_str).unwrap_or("mint_harness fixture source");
-            mint::mint_era(&client, domain, ordinal, &my_hash, &my_label, held_text, &aggregates, &chain, None, &mint::lifecycle_defaults(&ir)).await?;
+            let held_text = ir
+                .get("source_text")
+                .and_then(Value::as_str)
+                .unwrap_or("mint_harness fixture source");
+            mint::mint_era(
+                &client,
+                domain,
+                ordinal,
+                &my_hash,
+                &my_label,
+                held_text,
+                &aggregates,
+                &chain,
+                None,
+                &mint::lifecycle_defaults(&ir),
+            )
+            .await?;
             ordinal
         }
     };

data/rust/host/src/bin/validate_harness.rs

@@ -19,8 +19,13 @@ fn main() -> anyhow::Result<()> {
     let mut input = String::new();
     std::io::stdin().read_to_string(&mut input)?;
     let request: Value = serde_json::from_str(&input)?;
-    let ir = request.get("ir").ok_or_else(|| anyhow::anyhow!("no \"ir\" on stdin"))?;
-    let cases = request.get("cases").and_then(Value::as_array).ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
+    let ir = request
+        .get("ir")
+        .ok_or_else(|| anyhow::anyhow!("no \"ir\" on stdin"))?;
+    let cases = request
+        .get("cases")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow::anyhow!("no \"cases\" array on stdin"))?;
 
     let results: Vec<Value> = cases.iter().map(|case| answer(ir, case)).collect();
     println!("{}", json!({ "results": results }));
@@ -32,12 +37,15 @@ fn answer(ir: &Value, case: &Value) -> Value {
     let aggregate = ir
         .get("aggregates")
         .and_then(Value::as_array)
-        .and_then(|list| list.iter().find(|a| a.get("name").and_then(Value::as_str) == Some(name)));
-    match aggregate {
-        None => json!({ "error": format!("no aggregate {name:?} in the IR") }),
-        Some(aggregate) => {
+        .and_then(|list| {
+            list.iter()
+                .find(|a| a.get("name").and_then(Value::as_str) == Some(name))
+        });
+    aggregate.map_or_else(
+        || json!({ "error": format!("no aggregate {name:?} in the IR") }),
+        |aggregate| {
             let id = case.get("id").and_then(Value::as_str).unwrap_or("");
             json!({ "violations": reference_validate::validate(ir, aggregate, id, &case["state"]) })
-        }
-    }
+        },
+    )
 }