hecks 3.14.0 → 5.0.0

data/rust/host/src/lambda_client.rs

@@ -17,9 +17,9 @@ pub trait LambdaInvoker: Send + Sync {
 }
 
 // Mirrors Ruby's `"hecks-#{domain.downcase}"` — deployed stack names depend on
-// this exact casing.
+// this exact casing, down to a word-final capital sigma, so it lowercases as Ruby does.
 pub fn function_name_for(domain: &str) -> String {
-    format!("hecks-{}", domain.to_lowercase())
+    format!("hecks-{}", crate::hecks_naming::ruby_downcase(domain))
 }
 
 // Mirrors `PolicyInterpreter#deliver`'s record shape, minus `on:` — this crate
@@ -47,11 +47,29 @@ impl CrossDomainDeliveryRecord {
 
 // A target-side refusal returns `delivered: false`; a genuine invoke fault
 // (`function_error`, or a hard `Err` from `invoke`) returns `Err` instead.
-pub async fn deliver<L: LambdaInvoker + ?Sized>(invoker: &L, reaction: &Value) -> anyhow::Result<CrossDomainDeliveryRecord> {
-    let policy = reaction.get("policy").and_then(Value::as_str).unwrap_or_default().to_string();
-    let target_domain = reaction.get("target_domain").and_then(Value::as_str).unwrap_or_default().to_string();
-    let target_verb = reaction.get("target_verb").and_then(Value::as_str).unwrap_or_default().to_string();
-    let payload = reaction.get("payload").cloned().unwrap_or_else(|| serde_json::json!({}));
+pub async fn deliver<L: LambdaInvoker + ?Sized>(
+    invoker: &L,
+    reaction: &Value,
+) -> anyhow::Result<CrossDomainDeliveryRecord> {
+    let policy = reaction
+        .get("policy")
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .to_string();
+    let target_domain = reaction
+        .get("target_domain")
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .to_string();
+    let target_verb = reaction
+        .get("target_verb")
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .to_string();
+    let payload = reaction
+        .get("payload")
+        .cloned()
+        .unwrap_or_else(|| serde_json::json!({}));
 
     let function_name = function_name_for(&target_domain);
     // No `"role"` — a policy reaction is system-triggered, the same reasoning
@@ -61,18 +79,32 @@ pub async fn deliver<L: LambdaInvoker + ?Sized>(invoker: &L, reaction: &Value) -
     let outcome = invoker.invoke(&function_name, &request_payload).await?;
 
     if outcome.function_error {
-        let message = outcome.body.get("errorMessage").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| outcome.body.to_string());
-        anyhow::bail!("Lambda {function_name} ({}): {message}", target_verb);
+        let message = outcome
+            .body
+            .get("errorMessage")
+            .and_then(Value::as_str)
+            .map_or_else(|| outcome.body.to_string(), str::to_string);
+        anyhow::bail!("Lambda {function_name} ({target_verb}): {message}");
     }
 
     let target_side_refusal = outcome
         .body
         .get("refusals")
         .and_then(Value::as_array)
-        .and_then(|refusals| refusals.iter().find(|r| r.get("verb").and_then(Value::as_str) == Some(target_verb.as_str())));
+        .and_then(|refusals| {
+            refusals
+                .iter()
+                .find(|r| r.get("verb").and_then(Value::as_str) == Some(target_verb.as_str()))
+        });
 
     let Some(refusal) = target_side_refusal else {
-        return Ok(CrossDomainDeliveryRecord { policy, target_domain, target_verb, delivered: true, reason: None });
+        return Ok(CrossDomainDeliveryRecord {
+            policy,
+            target_domain,
+            target_verb,
+            delivered: true,
+            reason: None,
+        });
     };
 
     Ok(CrossDomainDeliveryRecord {
@@ -80,7 +112,10 @@ pub async fn deliver<L: LambdaInvoker + ?Sized>(invoker: &L, reaction: &Value) -
         target_domain,
         target_verb,
         delivered: false,
-        reason: refusal.get("error").and_then(Value::as_str).map(String::from),
+        reason: refusal
+            .get("error")
+            .and_then(Value::as_str)
+            .map(String::from),
     })
 }
 
@@ -102,6 +137,8 @@ pub struct DeliveryFailure {
 
 // Retries only a genuine invoke fault (`Err`); a clean `Ok(delivered: false)`
 // refusal is a business outcome and is never retried.
+// `DeliveryFailure` carries the whole reaction for the dead letter, so its size is intended.
+#[allow(clippy::result_large_err)]
 pub async fn deliver_with_retry<L: LambdaInvoker + ?Sized>(
     invoker: &L,
     reaction: &Value,
@@ -122,13 +159,28 @@ pub async fn deliver_with_retry<L: LambdaInvoker + ?Sized>(
     }
 
     Err(DeliveryFailure {
-        policy: reaction.get("policy").and_then(Value::as_str).unwrap_or_default().to_string(),
-        target_domain: reaction.get("target_domain").and_then(Value::as_str).unwrap_or_default().to_string(),
-        target_verb: reaction.get("target_verb").and_then(Value::as_str).unwrap_or_default().to_string(),
-        payload: reaction.get("payload").cloned().unwrap_or_else(|| serde_json::json!({})),
-        // Safe: this arm only runs after the loop above executed at least once,
-        // and every iteration's `Err` arm sets `last_error` before falling through.
-        error: last_error.unwrap(),
+        policy: reaction
+            .get("policy")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .to_string(),
+        target_domain: reaction
+            .get("target_domain")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .to_string(),
+        target_verb: reaction
+            .get("target_verb")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .to_string(),
+        payload: reaction
+            .get("payload")
+            .cloned()
+            .unwrap_or_else(|| serde_json::json!({})),
+        // The loop runs at least once and every `Err` arm sets `last_error`, so the fallback is
+        // unreachable; it exists only so a zero attempt budget still reports a failure.
+        error: last_error.unwrap_or_else(|| anyhow::anyhow!("no delivery attempt ran")),
         attempts: MAX_DELIVERY_ATTEMPTS,
     })
 }
@@ -144,10 +196,17 @@ impl AwsLambdaInvoker {
     // actually wires in `ring` (see Cargo.toml's note on this dependency).
     pub async fn from_env() -> Self {
         let http_client = aws_smithy_http_client::Builder::new()
-            .tls_provider(aws_smithy_http_client::tls::Provider::Rustls(aws_smithy_http_client::tls::rustls_provider::CryptoMode::Ring))
+            .tls_provider(aws_smithy_http_client::tls::Provider::Rustls(
+                aws_smithy_http_client::tls::rustls_provider::CryptoMode::Ring,
+            ))
             .build_https();
-        let config = aws_config::defaults(aws_config::BehaviorVersion::latest()).http_client(http_client).load().await;
-        Self { client: aws_sdk_lambda::Client::new(&config) }
+        let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
+            .http_client(http_client)
+            .load()
+            .await;
+        Self {
+            client: aws_sdk_lambda::Client::new(&config),
+        }
     }
 }
 
@@ -177,12 +236,18 @@ impl LambdaInvoker for AwsLambdaInvoker {
             .map_err(|e| anyhow::anyhow!("invoking Lambda {function_name}: {e:?}"))?;
 
         let function_error = response.function_error().is_some();
-        let bytes = response.payload().map(|blob| blob.as_ref().to_vec()).unwrap_or_default();
+        let bytes = response
+            .payload()
+            .map(|blob| blob.as_ref().to_vec())
+            .unwrap_or_default();
         // A non-JSON/empty body reads as `{}` rather than failing the call;
         // `function_error` (checked above) is what actually signals a fault.
         let body: Value = serde_json::from_slice(&bytes).unwrap_or_else(|_| serde_json::json!({}));
 
-        Ok(InvokeOutcome { body, function_error })
+        Ok(InvokeOutcome {
+            body,
+            function_error,
+        })
     }
 }
 
@@ -200,6 +265,30 @@ mod tests {
         assert_eq!(function_name_for("Banking"), "hecks-banking");
     }
 
+    // spec/fixtures/stack_name_vectors.json is asserted by spec/deploy_stack_names_spec.rb against
+    // all four Ruby copies of the formula, so a drift in any of them fails a test.
+    fn stack_name_vectors() -> Value {
+        serde_json::from_str(include_str!(
+            "../../../spec/fixtures/stack_name_vectors.json"
+        ))
+        .unwrap()
+    }
+
+    #[test]
+    fn function_name_matches_every_shared_stack_name_vector() {
+        let vectors = stack_name_vectors();
+        let rows = vectors["rows"].as_array().unwrap();
+        assert!(!rows.is_empty());
+        for row in rows {
+            let domain = row["domain"].as_str().unwrap();
+            assert_eq!(
+                function_name_for(domain),
+                row["name"].as_str().unwrap(),
+                "{domain}"
+            );
+        }
+    }
+
     // Records each call and answers with whatever canned outcome the test configured.
     struct MockLambdaInvoker {
         response: Result<InvokeOutcome, String>,
@@ -208,20 +297,39 @@ mod tests {
 
     impl MockLambdaInvoker {
         fn answering(body: Value, function_error: bool) -> Self {
-            Self { response: Ok(InvokeOutcome { body, function_error }), calls: Mutex::new(Vec::new()) }
+            Self {
+                response: Ok(InvokeOutcome {
+                    body,
+                    function_error,
+                }),
+                calls: Mutex::new(Vec::new()),
+            }
         }
 
         fn failing(message: &str) -> Self {
-            Self { response: Err(message.to_string()), calls: Mutex::new(Vec::new()) }
+            Self {
+                response: Err(message.to_string()),
+                calls: Mutex::new(Vec::new()),
+            }
         }
     }
 
     #[async_trait::async_trait]
     impl LambdaInvoker for MockLambdaInvoker {
-        async fn invoke(&self, function_name: &str, payload: &str) -> anyhow::Result<InvokeOutcome> {
-            self.calls.lock().unwrap().push((function_name.to_string(), payload.to_string()));
+        async fn invoke(
+            &self,
+            function_name: &str,
+            payload: &str,
+        ) -> anyhow::Result<InvokeOutcome> {
+            self.calls
+                .lock()
+                .unwrap()
+                .push((function_name.to_string(), payload.to_string()));
             match &self.response {
-                Ok(outcome) => Ok(InvokeOutcome { body: outcome.body.clone(), function_error: outcome.function_error }),
+                Ok(outcome) => Ok(InvokeOutcome {
+                    body: outcome.body.clone(),
+                    function_error: outcome.function_error,
+                }),
                 Err(message) => anyhow::bail!("{message}"),
             }
         }
@@ -240,7 +348,12 @@ mod tests {
     async fn delivers_and_invokes_the_computed_function_name_with_the_verb_args_payload_shape() {
         let invoker = MockLambdaInvoker::answering(serde_json::json!({ "refusals": [] }), false);
 
-        let record = deliver(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open")).await.unwrap();
+        let record = deliver(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await
+        .unwrap();
 
         assert!(record.delivered);
         assert_eq!(record.reason, None);
@@ -262,7 +375,12 @@ mod tests {
             false,
         );
 
-        let record = deliver(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open")).await.unwrap();
+        let record = deliver(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await
+        .unwrap();
 
         assert!(!record.delivered);
         assert_eq!(record.reason.as_deref(), Some("already under review"));
@@ -277,7 +395,12 @@ mod tests {
             false,
         );
 
-        let record = deliver(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open")).await.unwrap();
+        let record = deliver(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await
+        .unwrap();
 
         assert!(record.delivered);
     }
@@ -286,11 +409,21 @@ mod tests {
     async fn a_function_error_response_is_a_hard_failure_not_a_delivery_record() {
         // Mirrors Ruby's `raise WiringError` on `function_error` — not a domain
         // refusal, so it propagates rather than becoming a `delivered: false` record.
-        let invoker = MockLambdaInvoker::answering(serde_json::json!({ "errorMessage": "unhandled panic" }), true);
+        let invoker = MockLambdaInvoker::answering(
+            serde_json::json!({ "errorMessage": "unhandled panic" }),
+            true,
+        );
 
-        let outcome = deliver(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open")).await;
+        let outcome = deliver(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await;
 
-        assert!(outcome.is_err(), "a function_error response must propagate as Err, not a delivered:false record");
+        assert!(
+            outcome.is_err(),
+            "a function_error response must propagate as Err, not a delivered:false record"
+        );
     }
 
     #[tokio::test]
@@ -313,20 +446,31 @@ mod tests {
 
     impl FlakyLambdaInvoker {
         fn failing_then_succeeding(fail_count: u32) -> Self {
-            Self { fail_count: std::sync::atomic::AtomicU32::new(fail_count), calls: Mutex::new(Vec::new()) }
+            Self {
+                fail_count: std::sync::atomic::AtomicU32::new(fail_count),
+                calls: Mutex::new(Vec::new()),
+            }
         }
     }
 
     #[async_trait::async_trait]
     impl LambdaInvoker for FlakyLambdaInvoker {
-        async fn invoke(&self, function_name: &str, _payload: &str) -> anyhow::Result<InvokeOutcome> {
+        async fn invoke(
+            &self,
+            function_name: &str,
+            _payload: &str,
+        ) -> anyhow::Result<InvokeOutcome> {
             self.calls.lock().unwrap().push(function_name.to_string());
             let remaining = self.fail_count.load(std::sync::atomic::Ordering::SeqCst);
             if remaining > 0 {
-                self.fail_count.store(remaining - 1, std::sync::atomic::Ordering::SeqCst);
+                self.fail_count
+                    .store(remaining - 1, std::sync::atomic::Ordering::SeqCst);
                 anyhow::bail!("ThrottlingException: rate exceeded");
             }
-            Ok(InvokeOutcome { body: serde_json::json!({ "refusals": [] }), function_error: false })
+            Ok(InvokeOutcome {
+                body: serde_json::json!({ "refusals": [] }),
+                function_error: false,
+            })
         }
     }
 
@@ -334,12 +478,19 @@ mod tests {
     async fn deliver_with_retry_rides_out_a_transient_fault_that_clears_before_attempts_run_out() {
         let invoker = FlakyLambdaInvoker::failing_then_succeeding(MAX_DELIVERY_ATTEMPTS - 1);
 
-        let record = deliver_with_retry(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open"))
-            .await
-            .expect("should succeed once the fault clears, within MAX_DELIVERY_ATTEMPTS");
+        let record = deliver_with_retry(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await
+        .expect("should succeed once the fault clears, within MAX_DELIVERY_ATTEMPTS");
 
         assert!(record.delivered);
-        assert_eq!(invoker.calls.lock().unwrap().len(), MAX_DELIVERY_ATTEMPTS as usize, "should have retried exactly up to the successful attempt");
+        assert_eq!(
+            invoker.calls.lock().unwrap().len(),
+            MAX_DELIVERY_ATTEMPTS as usize,
+            "should have retried exactly up to the successful attempt"
+        );
     }
 
     #[tokio::test]
@@ -351,28 +502,43 @@ mod tests {
             false,
         );
 
-        let record = deliver_with_retry(&invoker, &reaction("Compliance", "Compliance::AccountFreezeReview.Open"))
-            .await
-            .expect("a domain-side refusal is Ok, not a DeliveryFailure");
+        let record = deliver_with_retry(
+            &invoker,
+            &reaction("Compliance", "Compliance::AccountFreezeReview.Open"),
+        )
+        .await
+        .expect("a domain-side refusal is Ok, not a DeliveryFailure");
 
         assert!(!record.delivered);
-        assert_eq!(invoker.calls.lock().unwrap().len(), 1, "a clean refusal should never be retried");
+        assert_eq!(
+            invoker.calls.lock().unwrap().len(),
+            1,
+            "a clean refusal should never be retried"
+        );
     }
 
     #[tokio::test]
-    async fn deliver_with_retry_gives_up_after_max_attempts_and_carries_everything_a_dead_letter_needs() {
+    async fn deliver_with_retry_gives_up_after_max_attempts_and_carries_everything_a_dead_letter_needs(
+    ) {
         let invoker = MockLambdaInvoker::failing("ResourceNotFoundException: function not found");
 
-        let failure = deliver_with_retry(&invoker, &reaction("Notifications", "Notifications.Send"))
-            .await
-            .expect_err("a persistent fault should exhaust every attempt and fail");
+        let failure =
+            deliver_with_retry(&invoker, &reaction("Notifications", "Notifications.Send"))
+                .await
+                .expect_err("a persistent fault should exhaust every attempt and fail");
 
         assert_eq!(failure.policy, "ReviewOnFreeze");
         assert_eq!(failure.target_domain, "Notifications");
         assert_eq!(failure.target_verb, "Notifications.Send");
-        assert_eq!(failure.payload, serde_json::json!({ "number": { "value": "acct-1" } }));
+        assert_eq!(
+            failure.payload,
+            serde_json::json!({ "number": { "value": "acct-1" } })
+        );
         assert_eq!(failure.attempts, MAX_DELIVERY_ATTEMPTS);
         assert!(format!("{:#}", failure.error).contains("ResourceNotFoundException"));
-        assert_eq!(invoker.calls.lock().unwrap().len(), MAX_DELIVERY_ATTEMPTS as usize);
+        assert_eq!(
+            invoker.calls.lock().unwrap().len(),
+            MAX_DELIVERY_ATTEMPTS as usize
+        );
     }
 }

data/rust/host/src/lib.rs

@@ -2,20 +2,32 @@
 //! Commerce (payments, checkout, newsletter, registrations, mail) plugs in through [`extension::HostExtension`].
 
 pub mod api;
-pub mod approval;
 pub mod auth;
+mod b64;
 pub mod boot;
 pub mod checkout;
+mod clock;
 pub mod commerce_ir;
+mod crypto;
 pub mod dispatch;
 pub mod expr_json;
+#[cfg(test)]
+#[path = "boundary_fuzz/expr_json.rs"]
+pub mod expr_json_fuzz;
 pub mod extension;
+mod http;
+// Generated: its static regexes are literals that compile, and the generator always emits
+// `r#"…"#`, so the lints below are allowed here.
+#[allow(clippy::expect_used, clippy::needless_raw_string_hashes)]
 pub mod field_hints;
 #[cfg(test)]
 pub mod fuzz_support;
-#[cfg(test)]
-#[path = "boundary_fuzz/expr_json.rs"]
-pub mod expr_json_fuzz;
+pub mod host;
+// The one `Hecks::Naming` port, compiled from `hecks-codegen`'s source: the host and the codegen
+// are independent Cargo projects, so the file is shared by path rather than by dependency.
+#[allow(dead_code)]
+#[path = "../../codegen/src/hecks_naming.rs"]
+pub mod hecks_naming;
 pub mod ir;
 pub mod journal;
 pub mod lambda_client;

data/rust/host/src/log.rs

@@ -29,8 +29,16 @@ pub fn phase(name: &'static str) -> Phase {
 
 /// Starts a boot phase and logs its `start` line.
 pub fn phase_with(name: &'static str, fields: Value) -> Phase {
-    emit("info", "boot_phase", phase_fields(name, "start", &fields, None));
-    Phase { name, fields, started: std::time::Instant::now() }
+    emit(
+        "info",
+        "boot_phase",
+        phase_fields(name, "start", &fields, None),
+    );
+    Phase {
+        name,
+        fields,
+        started: std::time::Instant::now(),
+    }
 }
 
 impl Phase {
@@ -46,7 +54,11 @@ impl Phase {
         if let (Value::Object(base), Value::Object(extra)) = (&mut fields, outcome) {
             base.extend(extra);
         }
-        emit("info", "boot_phase", phase_fields(self.name, "end", &fields, Some(elapsed_ms)));
+        emit(
+            "info",
+            "boot_phase",
+            phase_fields(self.name, "end", &fields, Some(elapsed_ms)),
+        );
         elapsed_ms
     }
 }
@@ -113,22 +125,61 @@ mod tests {
 
     #[test]
     fn a_phase_line_names_the_phase_and_an_end_line_carries_elapsed_ms() {
-        let start = render("info", "boot_phase", phase_fields("audit_aggregate", "start", &json!({"aggregate": "registration"}), None));
+        let start = render(
+            "info",
+            "boot_phase",
+            phase_fields(
+                "audit_aggregate",
+                "start",
+                &json!({"aggregate": "registration"}),
+                None,
+            ),
+        );
         let parsed: Value = serde_json::from_str(&start).unwrap();
         assert_eq!(parsed["msg"], "boot_phase");
-        assert_eq!((parsed["phase"].as_str(), parsed["event"].as_str()), (Some("audit_aggregate"), Some("start")));
+        assert_eq!(
+            (parsed["phase"].as_str(), parsed["event"].as_str()),
+            (Some("audit_aggregate"), Some("start"))
+        );
         assert_eq!(parsed["aggregate"], "registration");
-        assert!(parsed.get("elapsed_ms").is_none(), "a start line has no duration yet");
-
-        let end = render("info", "boot_phase", phase_fields("audit_aggregate", "end", &json!({"aggregate": "registration"}), Some(42)));
+        assert!(
+            parsed.get("elapsed_ms").is_none(),
+            "a start line has no duration yet"
+        );
+
+        let end = render(
+            "info",
+            "boot_phase",
+            phase_fields(
+                "audit_aggregate",
+                "end",
+                &json!({"aggregate": "registration"}),
+                Some(42),
+            ),
+        );
         let parsed: Value = serde_json::from_str(&end).unwrap();
-        assert_eq!((parsed["event"].as_str(), parsed["elapsed_ms"].as_u64()), (Some("end"), Some(42)));
+        assert_eq!(
+            (parsed["event"].as_str(), parsed["elapsed_ms"].as_u64()),
+            (Some("end"), Some(42))
+        );
     }
 
     #[test]
     fn a_phase_field_cannot_overwrite_the_phase_or_event() {
-        let fields = phase_fields("connect", "start", &json!({"phase": "other", "event": "end", "era": 7}), None);
-        assert_eq!((fields["phase"].as_str(), fields["event"].as_str(), fields["era"].as_u64()), (Some("connect"), Some("start"), Some(7)));
+        let fields = phase_fields(
+            "connect",
+            "start",
+            &json!({"phase": "other", "event": "end", "era": 7}),
+            None,
+        );
+        assert_eq!(
+            (
+                fields["phase"].as_str(),
+                fields["event"].as_str(),
+                fields["era"].as_u64()
+            ),
+            (Some("connect"), Some("start"), Some(7))
+        );
     }
 
     #[test]