hecks 3.14.0 → 5.0.0

data/rust/host/src/wasm_runner.rs

@@ -62,9 +62,17 @@ type Compiled = Mutex<Option<(Engine, Module)>>;
 /// leaves the cell empty for the next caller to retry.
 fn engine_and_module(wasm_path: &Path) -> anyhow::Result<(Engine, Module)> {
     let cache = ENGINE_AND_MODULE.get_or_init(|| Mutex::new(HashMap::new()));
-    let cell = Arc::clone(cache.lock().unwrap().entry(wasm_path.to_path_buf()).or_default());
-
-    let mut compiled = cell.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+    let cell = Arc::clone(
+        cache
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .entry(wasm_path.to_path_buf())
+            .or_default(),
+    );
+
+    let mut compiled = cell
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
     if let Some((engine, module)) = compiled.as_ref() {
         return Ok((engine.clone(), module.clone()));
     }
@@ -84,7 +92,12 @@ static COMPILED_PATHS: Mutex<Vec<PathBuf>> = Mutex::new(Vec::new());
 /// How many times `wasm_path` has been compiled in this process.
 #[cfg(test)]
 pub(crate) fn compile_count(wasm_path: &Path) -> usize {
-    COMPILED_PATHS.lock().unwrap().iter().filter(|compiled| compiled.as_path() == wasm_path).count()
+    COMPILED_PATHS
+        .lock()
+        .unwrap()
+        .iter()
+        .filter(|compiled| compiled.as_path() == wasm_path)
+        .count()
 }
 
 /// Compiles `wasm_path` at boot, before the host starts listening, so
@@ -139,8 +152,10 @@ pub(crate) mod tests {
     /// A copy of the checkout fixture wasm at a path no other test uses, so
     /// its first call is a real cold compile whatever order tests run in.
     pub(crate) fn cold_copy_of_fixture(name: &str) -> PathBuf {
-        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist/checkout_fixture.wasm");
-        let dir = std::env::temp_dir().join(format!("hecks_wasm_runner_{}_{name}", std::process::id()));
+        let source =
+            PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist/checkout_fixture.wasm");
+        let dir =
+            std::env::temp_dir().join(format!("hecks_wasm_runner_{}_{name}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         let copy = dir.join("checkout_fixture.wasm");
         std::fs::copy(&source, &copy).expect("hecks build_wasm writes checkout_fixture.wasm");

data/rust/host/src/web/commerce.rs

@@ -3,7 +3,8 @@
 // named in `render` and `route`.
 
 use super::{
-    checkout_enabled, newsletter, newsletter_send, payments_routes, registrations_list_route, resend_webhook, respond, session_secret,
+    checkout_enabled, newsletter, newsletter_send, payments_routes, registrations_list_route,
+    resend_webhook, respond, session_secret,
 };
 use crate::extension::{Ctx, HostExtension, RateRule};
 use crate::payments;
@@ -32,22 +33,45 @@ impl HostExtension for Commerce {
         // is checked first since it needs none of the Payments::Payment/Event context checkout
         // requires. The subscriber list is PII (email, names, status): only an Admin or Owner
         // holding the account cookie may read it, like sending does.
-        if ctx.method == "GET" && ctx.path == "/newsletter/subscribers" && ir.and_then(crate::commerce_ir::newsletter_provider).is_some() {
+        if ctx.method == "GET"
+            && ctx.path == "/newsletter/subscribers"
+            && ir
+                .and_then(crate::commerce_ir::newsletter_provider)
+                .is_some()
+        {
             let Some(domain_ir) = ir else {
-                return Some(respond(500, "text/plain", "HECKS_IR_PATH not set or unreadable — this domain has no web layer configured"));
+                return Some(respond(
+                    500,
+                    "text/plain",
+                    "HECKS_IR_PATH not set or unreadable — this domain has no web layer configured",
+                ));
             };
-            if let Err(response) = newsletter_send::require_admin(domain_ir, ctx.cookies, &session_secret(), ctx.client).await {
+            if let Err(response) = newsletter_send::require_admin(
+                domain_ir,
+                ctx.cookies,
+                &session_secret(),
+                ctx.client,
+            )
+            .await
+            {
                 return Some(response);
             }
         }
         let headers = ctx.event.and_then(|e| e.get("headers"));
-        if let Some(response) =
-            resend_webhook::resend_webhook_route(ctx.method, ctx.path, ctx.raw_body, headers, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        if let Some(response) = resend_webhook::resend_webhook_route(
+            ctx.method,
+            ctx.path,
+            ctx.raw_body,
+            headers,
+            ctx.host(),
+        )
+        .await
         {
             return Some(response);
         }
         if let Some(response) =
-            newsletter::newsletter_route(ctx.method, ctx.path, ctx.query, ctx.raw_body, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+            newsletter::newsletter_route(ctx.method, ctx.path, ctx.query, ctx.raw_body, ctx.host())
+                .await
         {
             return Some(response);
         }
@@ -57,7 +81,15 @@ impl HostExtension for Commerce {
             .and_then(|h| h.get("stripe-signature"))
             .and_then(|v| v.as_str())
             .unwrap_or("");
-        payments_routes(ir, ctx.method, ctx.path, ctx.raw_body, stripe_signature, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        payments_routes(
+            ir,
+            ctx.method,
+            ctx.path,
+            ctx.raw_body,
+            stripe_signature,
+            ctx.host(),
+        )
+        .await
     }
 
     async fn account_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
@@ -67,20 +99,44 @@ impl HostExtension for Commerce {
         // account cookie, unlike the guest newsletter routes served ahead of the account gate.
         if newsletter_send::issue_action(ctx.method, ctx.path).is_some() {
             return newsletter_send::issue_route(
-                ctx.method, ctx.path, domain_ir, ctx.raw_body, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+                ctx.method,
+                ctx.path,
+                domain_ir,
+                ctx.raw_body,
+                ctx.cookies,
+                &secret,
+                ctx.host(),
             )
             .await;
         }
         if ctx.method == "GET" && ctx.path == "/registrations" {
-            return Some(registrations_list_route(domain_ir, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config).await);
+            return Some(
+                registrations_list_route(
+                    domain_ir,
+                    ctx.cookies,
+                    &secret,
+                    ctx.client,
+                    ctx.wasm_path,
+                    ctx.config,
+                )
+                .await,
+            );
         }
         // The tenant's payment connection: same gate as the checkout routes, since only the
         // HECKS_CHECKOUT_DOMAIN domain carries one — any other domain served by this binary falls
         // through as unknown.
-        if payments::owns(ctx.method, ctx.path) && checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain) {
+        if payments::owns(ctx.method, ctx.path)
+            && checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain)
+        {
             return payments::route(
-                ctx.method, ctx.path, ctx.raw_body, ctx.cookies, &secret, domain_ir, &payments::PlatformConfig::load().await,
-                ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+                ctx.method,
+                ctx.path,
+                ctx.raw_body,
+                ctx.cookies,
+                &secret,
+                domain_ir,
+                &payments::PlatformConfig::load().await,
+                ctx.host(),
             )
             .await;
         }
@@ -89,8 +145,20 @@ impl HostExtension for Commerce {
 
     fn rate_rules(&self) -> Vec<RateRule> {
         vec![
-            RateRule { name: "subscribe", method: "POST", path: "/newsletter/subscribers", limit_env: "HECKS_RATE_LIMIT_SUBSCRIBE", default_limit: 10 },
-            RateRule { name: "register", method: "POST", path: "/registrations", limit_env: "HECKS_RATE_LIMIT_REGISTER", default_limit: 15 },
+            RateRule {
+                name: "subscribe",
+                method: "POST",
+                path: "/newsletter/subscribers",
+                limit_env: "HECKS_RATE_LIMIT_SUBSCRIBE",
+                default_limit: 10,
+            },
+            RateRule {
+                name: "register",
+                method: "POST",
+                path: "/registrations",
+                limit_env: "HECKS_RATE_LIMIT_REGISTER",
+                default_limit: 15,
+            },
         ]
     }
 
@@ -105,17 +173,27 @@ impl HostExtension for Commerce {
     // secret may also carry `webhook_secret`, the signing secret of the Resend webhook that
     // POST /webhooks/resend verifies; without it that route answers 503.
     async fn boot_secrets(&self, fetcher: &AwsSecretFetcher) {
-        let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") else { return };
-        let fetched = fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
-        let read = fetched.and_then(|json| secrets::extract_field(&json, "api_key").map(|api_key| (api_key, secrets::optional_field(&json, "webhook_secret"))));
+        let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") else {
+            return;
+        };
+        let fetched = fetcher
+            .fetch_secret_string(&resend_secret_id)
+            .await
+            .map_err(|e| format!("{e:#}"));
+        let read = fetched.and_then(|json| {
+            secrets::extract_field(&json, "api_key")
+                .map(|api_key| (api_key, secrets::optional_field(&json, "webhook_secret")))
+        });
         match read {
-            Ok((api_key, webhook_secret)) => unsafe {
-                std::env::set_var("RESEND_API_KEY", api_key);
+            Ok((api_key, webhook_secret)) => {
+                secrets::provide("RESEND_API_KEY", api_key);
                 if let Some(webhook_secret) = webhook_secret {
-                    std::env::set_var("RESEND_WEBHOOK_SECRET", webhook_secret);
+                    secrets::provide("RESEND_WEBHOOK_SECRET", webhook_secret);
                 }
-            },
-            Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
+            }
+            Err(e) => {
+                eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}");
+            }
         }
     }
 }

data/rust/host/src/web/newsletter/cooldown.rs

@@ -3,7 +3,7 @@ use std::sync::Mutex;
 use std::time::{Duration, Instant};
 
 /// How long an address is left alone after a confirmation email went to it.
-pub(super) const WINDOW: Duration = Duration::from_secs(10 * 60);
+pub(super) const WINDOW: Duration = Duration::from_mins(10);
 
 /// The most addresses remembered; past it a new address is refused, not evicting a live one.
 pub(super) const CAPACITY: usize = 10_000;
@@ -19,7 +19,11 @@ pub(super) struct ConfirmationCooldown {
 
 impl ConfirmationCooldown {
     pub(super) fn new(window: Duration, capacity: usize) -> Self {
-        Self { window, capacity, last_sent: Mutex::new(HashMap::new()) }
+        Self {
+            window,
+            capacity,
+            last_sent: Mutex::new(HashMap::new()),
+        }
     }
 
     /// Whether an email may go to `email` now (keyed by lowercased address). A `true` records the
@@ -31,7 +35,10 @@ impl ConfirmationCooldown {
     /// `try_acquire` with the clock supplied, so tests need not sleep.
     pub(super) fn try_acquire_at(&self, email: &str, now: Instant) -> bool {
         let key = email.to_lowercase();
-        let mut last_sent = self.last_sent.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+        let mut last_sent = self
+            .last_sent
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         let window = self.window;
         last_sent.retain(|_, sent| now.saturating_duration_since(*sent) < window);
         if last_sent.contains_key(&key) || last_sent.len() >= self.capacity {

data/rust/host/src/web/newsletter/template.rs

@@ -10,19 +10,30 @@ pub(super) const MAX_TEMPLATE_BYTES: usize = 256 * 1024;
 
 // Escapes a URL for an HTML attribute or text position.
 fn escape_html(value: &str) -> String {
-    value.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;").replace('\'', "&#39;")
+    value
+        .replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&#39;")
 }
 
 // Fills the placeholders with HTML-escaped URLs. `Err` names why the
 // template is unusable: without {{CONFIRM_URL}} the email would carry no
 // link. {{UNSUBSCRIBE_URL}} is optional. The result starts at its first
 // non-blank character so the mailer sends it as HTML.
-pub(super) fn fill_template(template: &str, confirm_url: &str, unsubscribe_url: &str) -> Result<String, &'static str> {
+pub(super) fn fill_template(
+    template: &str,
+    confirm_url: &str,
+    unsubscribe_url: &str,
+) -> Result<String, &'static str> {
     if !template.contains(CONFIRM_TOKEN) {
         return Err("the template has no {{CONFIRM_URL}} placeholder");
     }
     let filled = template.replace(CONFIRM_TOKEN, &escape_html(confirm_url));
-    Ok(personalize(&filled, &escape_html(unsubscribe_url)).trim_start().to_string())
+    Ok(personalize(&filled, &escape_html(unsubscribe_url))
+        .trim_start()
+        .to_string())
 }
 
 // Reads a response body, stopping as soon as it passes the cap.
@@ -31,7 +42,9 @@ async fn read_capped(mut response: reqwest::Response) -> Result<String, String>
     while let Some(chunk) = response.chunk().await.map_err(|e| e.to_string())? {
         bytes.extend_from_slice(&chunk);
         if bytes.len() > MAX_TEMPLATE_BYTES {
-            return Err(format!("the template is larger than {MAX_TEMPLATE_BYTES} bytes"));
+            return Err(format!(
+                "the template is larger than {MAX_TEMPLATE_BYTES} bytes"
+            ));
         }
     }
     String::from_utf8(bytes).map_err(|_| "the template is not UTF-8".to_string())
@@ -40,8 +53,12 @@ async fn read_capped(mut response: reqwest::Response) -> Result<String, String>
 // GETs the template (5 second timeout, size capped); a non-2xx answer or
 // any transport trouble is an `Err` with the reason.
 async fn fetch_template(url: &str) -> Result<String, String> {
-    let http = reqwest::Client::builder().timeout(FETCH_TIMEOUT).build().map_err(|e| e.to_string())?;
-    let response = http.get(url).send().await.map_err(|e| e.to_string())?;
+    let response = crate::http::client()
+        .get(url)
+        .timeout(FETCH_TIMEOUT)
+        .send()
+        .await
+        .map_err(|e| e.to_string())?;
     if !response.status().is_success() {
         return Err(format!("the template answered {}", response.status()));
     }
@@ -51,7 +68,9 @@ async fn fetch_template(url: &str) -> Result<String, String> {
 // The HTML body when NEWSLETTER_CONFIRMATION_TEMPLATE_URL names a usable
 // template; None (after logging why) when the caller should send plain text.
 pub(super) async fn branded_body(confirm_url: &str, unsubscribe_url: &str) -> Option<String> {
-    let url = std::env::var("NEWSLETTER_CONFIRMATION_TEMPLATE_URL").ok().filter(|u| !u.trim().is_empty())?;
+    let url = std::env::var("NEWSLETTER_CONFIRMATION_TEMPLATE_URL")
+        .ok()
+        .filter(|u| !u.trim().is_empty())?;
     let template = match fetch_template(url.trim()).await {
         Ok(t) => t,
         Err(e) => {

data/rust/host/src/web/newsletter/tests.rs

@@ -3,58 +3,105 @@ use super::*;
 #[test]
 fn a_confirm_token_verifies_only_for_the_address_it_was_minted_for() {
     let token = confirm_token("s3cret-value", "a@example.com");
-    assert!(confirm_token_matches("s3cret-value", &token, "a@example.com"));
-    assert!(!confirm_token_matches("s3cret-value", &token, "b@example.com"));
+    assert!(confirm_token_matches(
+        "s3cret-value",
+        &token,
+        "a@example.com"
+    ));
+    assert!(!confirm_token_matches(
+        "s3cret-value",
+        &token,
+        "b@example.com"
+    ));
 }
 
 #[test]
 fn a_confirm_token_signed_with_another_secret_is_refused() {
     let token = confirm_token("one-secret", "a@example.com");
-    assert!(!confirm_token_matches("another-secret", &token, "a@example.com"));
+    assert!(!confirm_token_matches(
+        "another-secret",
+        &token,
+        "a@example.com"
+    ));
 }
 
 #[test]
 fn a_token_minted_for_another_purpose_is_not_a_confirm_token() {
-    let other = auth::purpose_token("s3cret-value", "account-sso", json!({ "email": "a@example.com" }), 60);
-    assert!(!confirm_token_matches("s3cret-value", &other, "a@example.com"));
+    let other = auth::purpose_token(
+        "s3cret-value",
+        "account-sso",
+        json!({ "email": "a@example.com" }),
+        60,
+    );
+    assert!(!confirm_token_matches(
+        "s3cret-value",
+        &other,
+        "a@example.com"
+    ));
 }
 
 #[test]
 fn an_expired_or_garbled_token_is_refused() {
-    let expired = auth::purpose_token("s3cret-value", CONFIRM_PURPOSE, json!({ "email": "a@example.com" }), 0);
+    let expired = auth::purpose_token(
+        "s3cret-value",
+        CONFIRM_PURPOSE,
+        json!({ "email": "a@example.com" }),
+        0,
+    );
     std::thread::sleep(std::time::Duration::from_millis(1100));
-    assert!(!confirm_token_matches("s3cret-value", &expired, "a@example.com"));
-    assert!(!confirm_token_matches("s3cret-value", "not-a-token", "a@example.com"));
+    assert!(!confirm_token_matches(
+        "s3cret-value",
+        &expired,
+        "a@example.com"
+    ));
+    assert!(!confirm_token_matches(
+        "s3cret-value",
+        "not-a-token",
+        "a@example.com"
+    ));
     assert!(!confirm_token_matches("s3cret-value", "", "a@example.com"));
 }
 
 #[test]
 fn the_confirm_url_carries_the_encoded_address_and_the_token() {
     let url = confirm_url("https://example.com", "a+b@example.com", "tok.en");
-    assert_eq!(url, "https://example.com/newsletter-confirmed.html?email=a%2Bb%40example.com&token=tok.en");
+    assert_eq!(
+        url,
+        "https://example.com/newsletter-confirmed.html?email=a%2Bb%40example.com&token=tok.en"
+    );
 }
 
 #[test]
 fn the_confirmation_email_holds_the_link_and_says_it_can_be_ignored() {
-    let body = confirmation_body("https://example.com/newsletter-confirmed.html?email=a%40b.c&token=t");
+    let body =
+        confirmation_body("https://example.com/newsletter-confirmed.html?email=a%40b.c&token=t");
     assert!(body.contains("https://example.com/newsletter-confirmed.html?email=a%40b.c&token=t"));
     assert!(body.contains("ignore this email"));
 }
 
 fn unsubscribe_query(pairs: &[(&str, &str)]) -> HashMap<String, String> {
-    pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect()
+    pairs
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect()
 }
 
 fn status_and_error(response: &Value) -> (u64, String) {
     let body: Value = serde_json::from_str(response["body"].as_str().unwrap()).unwrap();
-    (response["statusCode"].as_u64().unwrap(), body["error"].as_str().unwrap_or("").to_string())
+    (
+        response["statusCode"].as_u64().unwrap(),
+        body["error"].as_str().unwrap_or("").to_string(),
+    )
 }
 
 #[test]
 fn an_unsubscribe_request_with_a_token_for_its_own_address_is_authorized() {
     let token = unsubscribe_token("s3cret-value", "a@example.com");
     let query = unsubscribe_query(&[("email", "a@example.com"), ("token", &token)]);
-    assert_eq!(unsubscribe_authorized(Some("s3cret-value"), &query).unwrap(), "a@example.com");
+    assert_eq!(
+        unsubscribe_authorized(Some("s3cret-value"), &query).unwrap(),
+        "a@example.com"
+    );
 }
 
 #[test]
@@ -63,7 +110,12 @@ fn an_unsubscribe_request_without_a_valid_token_is_a_403() {
     let own = unsubscribe_token("s3cret-value", "a@example.com");
     let other = unsubscribe_token("s3cret-value", "b@example.com");
     let confirm = confirm_token("s3cret-value", "a@example.com");
-    let expired = auth::purpose_token("s3cret-value", "newsletter-unsubscribe", json!({ "email": "a@example.com" }), 0);
+    let expired = auth::purpose_token(
+        "s3cret-value",
+        "newsletter-unsubscribe",
+        json!({ "email": "a@example.com" }),
+        0,
+    );
     std::thread::sleep(std::time::Duration::from_millis(1100));
     let cases = [
         unsubscribe_query(&[("email", "a@example.com")]),
@@ -76,7 +128,11 @@ fn an_unsubscribe_request_without_a_valid_token_is_a_403() {
     ];
     for query in &cases {
         let err = unsubscribe_authorized(Some("s3cret-value"), query).unwrap_err();
-        assert_eq!(status_and_error(&err), (403, refusal.to_string()), "{query:?}");
+        assert_eq!(
+            status_and_error(&err),
+            (403, refusal.to_string()),
+            "{query:?}"
+        );
         assert_eq!(err["body"], json!({ "error": refusal }).to_string());
     }
 }
@@ -85,13 +141,20 @@ fn an_unsubscribe_request_without_a_valid_token_is_a_403() {
 fn an_unsubscribe_request_is_refused_when_there_is_no_secret_to_check_against() {
     let token = unsubscribe_token("s3cret-value", "a@example.com");
     let query = unsubscribe_query(&[("email", "a@example.com"), ("token", &token)]);
-    assert_eq!(unsubscribe_authorized(None, &query).unwrap_err()["statusCode"], 403);
+    assert_eq!(
+        unsubscribe_authorized(None, &query).unwrap_err()["statusCode"],
+        403
+    );
 }
 
 #[test]
 fn an_unsubscribe_request_without_an_address_is_a_400() {
     let token = unsubscribe_token("s3cret-value", "a@example.com");
-    let err = unsubscribe_authorized(Some("s3cret-value"), &unsubscribe_query(&[("token", &token)])).unwrap_err();
+    let err = unsubscribe_authorized(
+        Some("s3cret-value"),
+        &unsubscribe_query(&[("token", &token)]),
+    )
+    .unwrap_err();
     assert_eq!(err["statusCode"], 400);
 }
 
@@ -99,8 +162,16 @@ fn an_unsubscribe_request_without_an_address_is_a_400() {
 fn a_confirm_token_is_not_an_unsubscribe_token_and_the_reverse() {
     let confirm = confirm_token("s3cret-value", "a@example.com");
     let unsubscribe = unsubscribe_token("s3cret-value", "a@example.com");
-    assert!(!unsubscribe_token_matches("s3cret-value", &confirm, "a@example.com"));
-    assert!(!confirm_token_matches("s3cret-value", &unsubscribe, "a@example.com"));
+    assert!(!unsubscribe_token_matches(
+        "s3cret-value",
+        &confirm,
+        "a@example.com"
+    ));
+    assert!(!confirm_token_matches(
+        "s3cret-value",
+        &unsubscribe,
+        "a@example.com"
+    ));
 }
 
 use template::fill_template;
@@ -110,7 +181,12 @@ const UNSUBSCRIBE: &str = "https://example.com/newsletter-unsubscribed.html?emai
 
 #[test]
 fn a_template_gets_the_confirm_link_in_place_of_its_placeholder() {
-    let body = fill_template("<p><a href=\"{{CONFIRM_URL}}\">Confirm</a></p>", CONFIRM, UNSUBSCRIBE).unwrap();
+    let body = fill_template(
+        "<p><a href=\"{{CONFIRM_URL}}\">Confirm</a></p>",
+        CONFIRM,
+        UNSUBSCRIBE,
+    )
+    .unwrap();
     assert_eq!(body, "<p><a href=\"https://example.com/newsletter-confirmed.html?email=a%40b.c&amp;token=t\">Confirm</a></p>");
 }
 
@@ -123,15 +199,28 @@ fn a_template_without_the_confirm_placeholder_is_rejected() {
 #[test]
 fn the_unsubscribe_placeholder_is_optional_and_replaced_wherever_present() {
     assert!(fill_template("<a href=\"{{CONFIRM_URL}}\">x</a>", CONFIRM, UNSUBSCRIBE).is_ok());
-    let body = fill_template("<a href=\"{{CONFIRM_URL}}\">x</a>{{UNSUBSCRIBE_URL}}|{{UNSUBSCRIBE_URL}}", CONFIRM, UNSUBSCRIBE).unwrap();
+    let body = fill_template(
+        "<a href=\"{{CONFIRM_URL}}\">x</a>{{UNSUBSCRIBE_URL}}|{{UNSUBSCRIBE_URL}}",
+        CONFIRM,
+        UNSUBSCRIBE,
+    )
+    .unwrap();
     assert!(!body.contains("{{"));
     assert_eq!(body.matches("newsletter-unsubscribed.html").count(), 2);
 }
 
 #[test]
 fn ampersands_and_quotes_in_a_url_are_escaped_inside_the_html() {
-    let body = fill_template("<a href=\"{{CONFIRM_URL}}\">x</a>", "https://e.com/?a=1&b=\"2\"<>'", UNSUBSCRIBE).unwrap();
-    assert_eq!(body, "<a href=\"https://e.com/?a=1&amp;b=&quot;2&quot;&lt;&gt;&#39;\">x</a>");
+    let body = fill_template(
+        "<a href=\"{{CONFIRM_URL}}\">x</a>",
+        "https://e.com/?a=1&b=\"2\"<>'",
+        UNSUBSCRIBE,
+    )
+    .unwrap();
+    assert_eq!(
+        body,
+        "<a href=\"https://e.com/?a=1&amp;b=&quot;2&quot;&lt;&gt;&#39;\">x</a>"
+    );
 }
 
 #[test]