hecks 3.5.0 → 3.7.0

data/lib/hecks/projections/site/admin_cms.rb

@@ -45,19 +45,25 @@ module Hecks
         # @return [Hash{String => String}] each placeholder to the TypeScript text that replaces it
         def tokens(admin)
           setting = admin.setting
-          {
-            "__BANNER__"       => RoutesTs::BANNER,
-            "__COOKIE__"       => JSON.generate(setting.session_cookie),
+          { "__BANNER__" => RoutesTs::BANNER, **session_tokens(setting), "__ROLES__" => RoutesTs.literal(admin.roles),
+            **path_tokens(admin, setting), "__SSO_TARGET__" => setting.sso_target }
+        end
+
+        # @return [Hash{String => String}] the session cookie and host placeholders
+        def session_tokens(setting)
+          { "__COOKIE__"       => JSON.generate(setting.session_cookie),
             "__HOST_ENV__"     => JSON.generate(setting.host_env),
-            "__HOST_DEFAULT__" => JSON.generate(setting.host_default),
-            "__ROLES__"        => RoutesTs.literal(admin.roles),
-            "__ACCOUNT_PATH__" => JSON.generate(setting.account_path),
+            "__HOST_DEFAULT__" => JSON.generate(setting.host_default) }
+        end
+
+        # @return [Hash{String => String}] the account, members, endpoint and content-system path
+        #   placeholders
+        def path_tokens(admin, setting)
+          { "__ACCOUNT_PATH__" => JSON.generate(setting.account_path),
             "__MEMBERS_PATH__" => JSON.generate(setting.members_path),
             "__ENDPOINT__"     => JSON.generate(admin.cms_endpoint),
             "__CMS_PREFIX__"   => JSON.generate("#{setting.cms_base}/"),
-            "__CMS_ADMIN__"    => JSON.generate("#{setting.cms_base}/admin"),
-            "__SSO_TARGET__"   => setting.sso_target
-          }
+            "__CMS_ADMIN__"    => JSON.generate("#{setting.cms_base}/admin") }
         end
 
         def fill(text, tokens) = tokens.reduce(text) { |filled, (token, value)| filled.gsub(token, value) }

data/lib/hecks/projections/site/edge/behaviours.rb

@@ -42,12 +42,16 @@ module Hecks
           # share it, their methods united.
           def resolved
             groups = @rows.select(&:cdn).group_by { |row| Pattern.edge(row.path) }
-            groups.to_h do |pattern, rows|
-              entries = rows.map { |row| entry(row, pattern) }
-              disagree = entries.map { |entry| entry.except(:methods) }.uniq.size > 1
-              problem(pattern, "is declared by #{rows.size} routes that resolve to different behaviours") if disagree
-              [pattern, entries.first.merge(methods: methods(rows))]
-            end
+            groups.to_h { |pattern, rows| [pattern, group_entry(pattern, rows)] }
+          end
+
+          # The one behaviour the routes on `pattern` share, refused when they resolve to
+          # different ones.
+          def group_entry(pattern, rows)
+            entries = rows.map { |row| entry(row, pattern) }
+            disagree = entries.map { |entry| entry.except(:methods) }.uniq.size > 1
+            problem(pattern, "is declared by #{rows.size} routes that resolve to different behaviours") if disagree
+            entries.first.merge(methods: methods(rows))
           end
 
           def entry(row, pattern)

data/lib/hecks/projections/site/edge/checks.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "findings"
+require_relative "route_checks"
+
 module Hecks
   module Projections
     module Site
@@ -8,9 +11,10 @@ module Hecks
         # thing that exists, no two rows claim one name or priority, and every route the edge serves
         # has the origin, the policy and, for a server behind the load balancer, the rule it needs.
         class Checks
+          include Findings
+
           LOGICAL_ID = /\A[A-Za-z][A-Za-z0-9]*\z/
           INTRINSIC = /\A!(Ref|ImportValue|Sub|GetAtt)\s+\S/
-          PRIORITIES = (1..50_000)
 
           # The id a policy reference names, or nil when it names none.
           #
@@ -42,8 +46,7 @@ module Hecks
             check_setting
             check_policies
             check_upstreams
-            check_rules
-            check_routes
+            RouteChecks.new(@edge, @rows, @vocabulary, @problems).call
           end
 
           private
@@ -53,7 +56,10 @@ module Hecks
             return problem("Edge", "has no row; declare one member with template:") unless setting
 
             check_template(setting.template) if setting.template || !@template_named
+            check_secret(setting)
+          end
 
+          def check_secret(setting)
             problem("Edge", "has secret_header but no secret_value") if setting.secret_header && !setting.secret_value
             problem("Edge", "has secret_value but no secret_header") if setting.secret_value && !setting.secret_header
           end
@@ -66,96 +72,40 @@ module Hecks
           end
 
           def check_policies
-            @edge.policies.each do |policy|
-              label = "EdgePolicy #{policy.cache_class}#{" on #{policy.origin}" if policy.origin}"
-              member_of(label, "cache_class", policy.cache_class, :cache)
-              member_of(label, "origin", policy.origin, :origin) if policy.origin
-              { cache: policy.cache, origin_request: policy.origin_request,
-                response_headers: policy.response_headers }.compact.each do |field, reference|
-                next if (reference == "none" && field != :cache) || self.class.resolve(reference)
-
-                managed = Deploy::Fargate::Cdn::MANAGED_POLICIES.keys.join(", ")
-                problem(label, "has #{field} #{reference.inspect}; use a managed name (#{managed}), " \
-                               "a policy id or an intrinsic like !Ref Name")
-              end
-            end
+            @edge.policies.each { |policy| check_policy(policy) }
             repeated(@edge.policies.map { |policy| [policy.cache_class, policy.origin] }, "EdgePolicy") do |key|
-              "#{key[0]}#{" on #{key[1]}" if key[1]}"
-            end
-          end
-
-          def check_upstreams
-            @edge.upstreams.each do |upstream|
-              member_of("EdgeOrigin #{upstream.origin}", "origin", upstream.origin, :origin)
-              problem("EdgeOrigin #{upstream.origin}", "has id #{upstream.id.inspect}; an origin id is a logical id") unless
-                LOGICAL_ID.match?(upstream.id.to_s)
+              policy_name(key[0], key[1])
             end
-            repeated(@edge.upstreams.map(&:origin), "EdgeOrigin", &:itself)
-          end
-
-          def check_rules
-            return check_no_alb unless @edge.alb?
-
-            problem("EdgeRule", "rows need an Edge row with listener:") if @edge.rules.any? && !@edge.setting&.listener
-            @edge.rules.each { |rule| check_rule(rule) }
-            repeated(@edge.rules.map(&:rule), "EdgeRule", &:itself)
-            repeated(@edge.rules.map(&:priority), "EdgeRule priority", &:to_s)
           end
 
-          # With `alb: false` nothing routes by listener rule, so a rule row, or a route that names
-          # one, describes a load balancer the project says it does not have. Every route that is
-          # served by a server behind the edge still needs the origin that reaches it.
-          def check_no_alb
-            problem("EdgeRule", "rows describe a load balancer, and the Edge row says alb: false") if @edge.rules.any?
-            @rows.select(&:alb_rule).each do |row|
-              problem(row.path, "names alb_rule #{row.alb_rule}, and the Edge row says alb: false")
-            end
-            @rows.each do |row|
-              next if row.cdn || !%w[cms domain].include?(row.origin) || @edge.upstream(row.origin)
-
-              problem(row.path, "is served from #{row.origin}, which no EdgeOrigin maps, and with alb: false " \
-                                "nothing else reaches it")
+          def check_policy(policy)
+            label = "EdgePolicy #{policy_name(policy.cache_class, policy.origin)}"
+            member_of(label, "cache_class", policy.cache_class, :cache)
+            member_of(label, "origin", policy.origin, :origin) if policy.origin
+            { cache: policy.cache, origin_request: policy.origin_request,
+              response_headers: policy.response_headers }.compact.each do |field, reference|
+              check_reference(label, field, reference)
             end
           end
 
-          def check_rule(rule)
-            label = "EdgeRule #{rule.rule}"
-            member_of(label, "origin", rule.origin, :origin)
-            problem(label, "has origin assets; the load balancer does not front the assets origin") if rule.origin == "assets"
-            problem(label, "is not a logical id") unless LOGICAL_ID.match?(rule.rule.to_s)
-            unless PRIORITIES.cover?(rule.priority.to_i)
-              problem(label, "has priority #{rule.priority}; a priority is #{PRIORITIES.first} to #{PRIORITIES.last}")
-            end
-            return if rule.origin.nil? || @edge.upstream(rule.origin)&.target_group
+          def check_reference(label, field, reference)
+            return if (reference == "none" && field != :cache) || self.class.resolve(reference)
 
-            problem(label, "forwards to #{rule.origin}, whose EdgeOrigin names no target_group")
+            managed = Deploy::Fargate::Cdn::MANAGED_POLICIES.keys.join(", ")
+            problem(label, "has #{field} #{reference.inspect}; use a managed name (#{managed}), " \
+                           "a policy id or an intrinsic like !Ref Name")
           end
 
-          def check_routes
-            edge_rows = @rows.select { |row| row.cdn || row.alb_rule }
-            edge_rows.each do |row|
-              next if row.origin == "assets" && !row.cdn
-
-              problem(row.path, "has origin #{row.origin}, which no EdgeOrigin maps") unless @edge.upstream(row.origin)
-              next unless row.cdn && !@edge.policy(row.cache, row.origin)
+          def policy_name(cache_class, origin) = "#{cache_class}#{" on #{origin}" if origin}"
 
-              problem(row.path, "has cache class #{row.cache} on #{row.origin}, which no EdgePolicy maps")
+          def check_upstreams
+            @edge.upstreams.each do |upstream|
+              member_of("EdgeOrigin #{upstream.origin}", "origin", upstream.origin, :origin)
+              problem("EdgeOrigin #{upstream.origin}", "has id #{upstream.id.inspect}; an origin id is a logical id") unless
+                LOGICAL_ID.match?(upstream.id.to_s)
             end
-            default_rows = @rows.select { |row| row.path == "/*" && row.cdn }
-            problem("the route table", "needs one row for /* : the default behaviour") if default_rows.empty?
-          end
-
-          def member_of(label, field, value, vocabulary)
-            return if @vocabulary.fetch(vocabulary).include?(value)
-
-            problem(label, "has #{field} #{value.inspect}; #{field} is one of #{@vocabulary.fetch(vocabulary).join(', ')}")
-          end
-
-          def repeated(keys, what)
-            keys.tally.each { |key, count| problem(what, "#{yield(key)} is declared #{count} times") if count > 1 }
+            repeated(@edge.upstreams.map(&:origin), "EdgeOrigin", &:itself)
           end
-
-          def problem(label, text) = @problems << "#{label} #{text}"
         end
       end
     end

data/lib/hecks/projections/site/edge/findings.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      class Edge
+        # What the edge checks share for recording a problem: a line of the form
+        # `<label> <text>`, and the two shapes of finding that repeat (a value outside a closed set,
+        # a key declared more than once). The including class holds `@vocabulary` and `@problems`.
+        module Findings
+          private
+
+          def member_of(label, field, value, vocabulary)
+            return if @vocabulary.fetch(vocabulary).include?(value)
+
+            problem(label, "has #{field} #{value.inspect}; #{field} is one of #{@vocabulary.fetch(vocabulary).join(", ")}")
+          end
+
+          def repeated(keys, what)
+            keys.tally.each { |key, count| problem(what, "#{yield(key)} is declared #{count} times") if count > 1 }
+          end
+
+          def problem(label, text) = @problems << "#{label} #{text}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/edge/route_checks.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require_relative "findings"
+
+module Hecks
+  module Projections
+    module Site
+      class Edge
+        # The part of the edge checks that reads the listener rules and the routes: each rule is
+        # well formed and reaches a target group, and every route the edge serves has the origin and
+        # the policy it needs.
+        class RouteChecks
+          include Findings
+
+          PRIORITIES = (1..50_000)
+
+          # @param edge [Edge] the edge being read, its rows set
+          # @param rows [Array<Table::Row>] the route table's rows
+          # @param vocabulary [Hash{Symbol => Array<String>}] the Site chapter's closed sets
+          # @param problems [Array<String>] collects each problem found, one line each
+          def initialize(edge, rows, vocabulary, problems)
+            @edge = edge
+            @rows = rows
+            @vocabulary = vocabulary
+            @problems = problems
+          end
+
+          # @return [void]
+          def call
+            check_rules
+            check_routes
+          end
+
+          private
+
+          def check_rules
+            return check_no_alb unless @edge.alb?
+
+            check_listener
+            @edge.rules.each { |rule| check_rule(rule) }
+            repeated(@edge.rules.map(&:rule), "EdgeRule", &:itself)
+            repeated(@edge.rules.map(&:priority), "EdgeRule priority", &:to_s)
+          end
+
+          def check_listener
+            problem("EdgeRule", "rows need an Edge row with listener:") if @edge.rules.any? && !@edge.setting&.listener
+          end
+
+          # With `alb: false` nothing routes by listener rule, so a rule row, or a route that names
+          # one, describes a load balancer the project says it does not have. Every route that is
+          # served by a server behind the edge still needs the origin that reaches it.
+          def check_no_alb
+            problem("EdgeRule", "rows describe a load balancer, and the Edge row says alb: false") if @edge.rules.any?
+            @rows.select(&:alb_rule).each do |row|
+              problem(row.path, "names alb_rule #{row.alb_rule}, and the Edge row says alb: false")
+            end
+            @rows.each { |row| check_reachable(row) }
+          end
+
+          def check_reachable(row)
+            return if row.cdn || !%w[cms domain].include?(row.origin) || @edge.upstream(row.origin)
+
+            problem(row.path, "is served from #{row.origin}, which no EdgeOrigin maps, and with alb: false " \
+                              "nothing else reaches it")
+          end
+
+          def check_rule(rule)
+            label = "EdgeRule #{rule.rule}"
+            member_of(label, "origin", rule.origin, :origin)
+            problem(label, "has origin assets; the load balancer does not front the assets origin") if rule.origin == "assets"
+            problem(label, "is not a logical id") unless Checks::LOGICAL_ID.match?(rule.rule.to_s)
+            check_priority(label, rule)
+            check_target_group(label, rule)
+          end
+
+          def check_priority(label, rule)
+            return if PRIORITIES.cover?(rule.priority.to_i)
+
+            problem(label, "has priority #{rule.priority}; a priority is #{PRIORITIES.first} to #{PRIORITIES.last}")
+          end
+
+          def check_target_group(label, rule)
+            return if rule.origin.nil? || @edge.upstream(rule.origin)&.target_group
+
+            problem(label, "forwards to #{rule.origin}, whose EdgeOrigin names no target_group")
+          end
+
+          def check_routes
+            @rows.select { |row| row.cdn || row.alb_rule }.each { |row| check_route(row) }
+            default_rows = @rows.select { |row| row.path == "/*" && row.cdn }
+            problem("the route table", "needs one row for /* : the default behaviour") if default_rows.empty?
+          end
+
+          def check_route(row)
+            return if row.origin == "assets" && !row.cdn
+
+            problem(row.path, "has origin #{row.origin}, which no EdgeOrigin maps") unless @edge.upstream(row.origin)
+            check_policy_mapped(row)
+          end
+
+          def check_policy_mapped(row)
+            return unless row.cdn && !@edge.policy(row.cache, row.origin)
+
+            problem(row.path, "has cache class #{row.cache} on #{row.origin}, which no EdgePolicy maps")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/edge/row_reader.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      class Edge
+        # Reads the declared rows of one kind into structs, recording a problem for each unknown
+        # field, each missing required field and each field of the wrong type.
+        class RowReader
+          # @param kind [Symbol] a key of `Edge::OBJECTS`
+          # @param problems [Array<String>] collects each problem found
+          def initialize(kind, problems)
+            @kind = kind
+            @problems = problems
+            @fields = FIELDS.fetch(kind)
+          end
+
+          # @param members [Array<Hash{Symbol => Object}>] the declared rows
+          # @return [Array<Struct>] the rows that carry known, well-typed fields
+          def call(members)
+            members.each_with_index.map { |member, index| read(member, "#{OBJECTS.fetch(@kind)} row #{index + 1}") }
+          end
+
+          private
+
+          def read(member, label)
+            check_fields(member, label)
+            STRUCTS.fetch(@kind).new(**typed_fields(member, label))
+          end
+
+          def check_fields(member, label)
+            unknown = member.keys - @fields.keys
+            @problems << "#{label} has no field #{unknown.join(", ")}; fields are #{@fields.keys.join(", ")}" if unknown.any?
+            (REQUIRED.fetch(@kind) - member.keys).each { |field| @problems << "#{label} needs #{field}" }
+          end
+
+          # A field of the wrong type is recorded as a problem and kept, so its row still builds.
+          def typed_fields(member, label)
+            member.slice(*@fields.keys).select do |field, value|
+              typed?(value, @fields.fetch(field)) ||
+                (@problems << "#{label} has #{field} #{value.inspect}; #{field} is #{type_name(@fields.fetch(field))}")
+            end
+          end
+
+          def typed?(value, type) = type == :bool ? [true, false].include?(value) : value.is_a?(type)
+
+          def type_name(type) = type == :bool ? "true or false" : "a #{type}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/edge/rules.rb

@@ -60,15 +60,19 @@ module Hecks
 
           def check_names
             names = @edge.rules.map(&:rule)
-            @rows.select(&:alb_rule).each do |row|
-              rule = @edge.rules.find { |candidate| candidate.rule == row.alb_rule }
-              next problem(row.path, "names alb_rule #{row.alb_rule}; rules are #{names.join(', ')}") unless rule
-              next if rule.origin == row.origin
+            @rows.select(&:alb_rule).each { |row| check_named(row, names) }
+          end
 
-              problem(row.path, "is served from #{row.origin} but its rule #{rule.rule} forwards to #{rule.origin}")
-            end
+          def check_named(row, names)
+            rule = rule_named(row.alb_rule)
+            return problem(row.path, "names alb_rule #{row.alb_rule}; rules are #{names.join(", ")}") unless rule
+            return if rule.origin == row.origin
+
+            problem(row.path, "is served from #{row.origin} but its rule #{rule.rule} forwards to #{rule.origin}")
           end
 
+          def rule_named(name) = @edge.rules.find { |rule| rule.rule == name }
+
           # A route of a server behind the load balancer other than the website has a rule of its
           # own or sits under a broader route of the same server that has one.
           def check_carried
@@ -81,22 +85,16 @@ module Hecks
           end
 
           # The rule that carries a route: its own, else the nearest broader route's of its server.
-          def rule_of(row)
-            named = @edge.rules.find { |rule| rule.rule == row.alb_rule }
-            return named if named
+          def rule_of(row) = rule_named(row.alb_rule) || covering_rule(row)
 
-            covers = @rows.select do |other|
-              other.alb_rule && other.origin == row.origin &&
-                Pattern.strictly_covers?(Pattern.edge(other.path), Pattern.edge(row.path))
-            end
-            covering = covers.find do |one|
-              covers.none? do |other|
-                Pattern.strictly_covers?(Pattern.edge(one.path), Pattern.edge(other.path))
-              end
-            end
-            covering && @edge.rules.find { |rule| rule.rule == covering.alb_rule }
+          def covering_rule(row)
+            covers = @rows.select { |other| other.alb_rule && other.origin == row.origin && strictly_covers?(other, row) }
+            covering = covers.find { |one| covers.none? { |other| strictly_covers?(one, other) } }
+            covering && rule_named(covering.alb_rule)
           end
 
+          def strictly_covers?(one, other) = Pattern.strictly_covers?(Pattern.edge(one.path), Pattern.edge(other.path))
+
           # A rule of another server, with a lower priority, whose paths include one a route's own
           # rule would answer later, is a route answered by the wrong server.
           def check_cross_origin
@@ -105,16 +103,20 @@ module Hecks
               next if row.origin == "assets"
 
               own = rule_of(row)&.priority || fallback
-              @edge.rules.each do |rule|
-                next if rule.origin == row.origin || rule.priority >= own
-                next unless carried(rule).any? { |other| Pattern.covers?(Pattern.edge(other.path), Pattern.edge(row.path)) }
-
-                problem(row.path, "is served from #{row.origin} but rule #{rule.rule} (priority #{rule.priority}) " \
-                                  "sends it to #{rule.origin} first")
-              end
+              @edge.rules.each { |rule| check_answered_first(row, rule, own) }
             end
           end
 
+          def check_answered_first(row, rule, own)
+            return if rule.origin == row.origin || rule.priority >= own
+            return unless carried(rule).any? { |other| covers?(other, row) }
+
+            problem(row.path, "is served from #{row.origin} but rule #{rule.rule} (priority #{rule.priority}) " \
+                              "sends it to #{rule.origin} first")
+          end
+
+          def covers?(one, other) = Pattern.covers?(Pattern.edge(one.path), Pattern.edge(other.path))
+
           def default_priority
             default = @rows.find { |row| row.path == "/*" }
             @edge.rules.find { |rule| rule.rule == default&.alb_rule }&.priority || Float::INFINITY

data/lib/hecks/projections/site/edge.rb

@@ -3,6 +3,7 @@
 require_relative "../deploy/fargate/cdn"
 require_relative "table"
 require_relative "edge/pattern"
+require_relative "edge/row_reader"
 require_relative "edge/checks"
 require_relative "edge/behaviours"
 require_relative "edge/rules"
@@ -79,30 +80,9 @@ module Hecks
         # @param members [Array<Hash{Symbol => Object}>] the declared rows
         # @param problems [Array<String>] collects each problem found
         # @return [Array<Struct>] the rows that carry known, well-typed fields
-        def self.build(kind, members, problems)
-          members.each_with_index.map do |member, index|
-            label = "#{OBJECTS.fetch(kind)} row #{index + 1}"
-            unknown = member.keys - FIELDS.fetch(kind).keys
-            if unknown.any?
-              problems << "#{label} has no field #{unknown.join(', ')}; fields are #{FIELDS.fetch(kind).keys.join(', ')}"
-            end
-            (REQUIRED.fetch(kind) - member.keys).each { |field| problems << "#{label} needs #{field}" }
-            typed = member.slice(*FIELDS.fetch(kind).keys).select do |field, value|
-              typed?(value, FIELDS.fetch(kind).fetch(field)) ||
-                (problems << "#{label} has #{field} #{value.inspect}; " \
-                             "#{field} is #{type_name(FIELDS.fetch(kind).fetch(field))}")
-            end
-            STRUCTS.fetch(kind).new(**typed)
-          end
-        end
+        def self.build(kind, members, problems) = RowReader.new(kind, problems).call(members)
         private_class_method :build
 
-        def self.typed?(value, type) = type == :bool ? [true, false].include?(value) : value.is_a?(type)
-        private_class_method :typed?
-
-        def self.type_name(type) = type == :bool ? "true or false" : "a #{type}"
-        private_class_method :type_name
-
         # @param records [Hash{Symbol => Array<Struct>}] the rows of each kind
         # @param table [Table] the checked route table
         # @param vocabulary [Hash{Symbol => Array<String>}] the closed sets
@@ -110,21 +90,30 @@ module Hecks
         # @param template [String, nil] the template the caller names, if any
         # @raise [Table::Invalid] naming every problem when there is one
         def initialize(records, table:, vocabulary:, problems:, template: nil)
+          assign(records)
+          Checks.new(self, table.rows, vocabulary, problems, template_named: !template.nil?).call
+          build_outputs(table, problems) if problems.empty?
+          return if problems.empty?
+
+          raise Table::Invalid, "the edge is refused:\n#{problems.map { |line| "  - #{line}" }.join("\n")}"
+        end
+
+        # Reads the checked rows into the accessors, then builds what the routes need from them.
+        def assign(records)
           @setting = records.fetch(:setting).first
           @policies = records.fetch(:policy)
           @upstreams = records.fetch(:upstream)
           @rules = records.fetch(:rule)
-          Checks.new(self, table.rows, vocabulary, problems, template_named: !template.nil?).call
-          if problems.empty?
-            @listener_rules = alb? ? Rules.new(self, table.rows, problems).call : []
-            built = Behaviours.new(self, table.rows, problems).call
-            @default_behaviour = built.fetch(:default)
-            @behaviours = built.fetch(:list)
-          end
-          return if problems.empty?
+        end
+        private :assign
 
-          raise Table::Invalid, "the edge is refused:\n#{problems.map { |line| "  - #{line}" }.join("\n")}"
+        def build_outputs(table, problems)
+          @listener_rules = alb? ? Rules.new(self, table.rows, problems).call : []
+          built = Behaviours.new(self, table.rows, problems).call
+          @default_behaviour = built.fetch(:default)
+          @behaviours = built.fetch(:list)
         end
+        private :build_outputs
 
         # @return [Boolean] whether the project has a load balancer, and so listener rules; true
         #   unless the `Edge` row says `alb: false`

data/lib/hecks/projections/site/live_edge.rb

@@ -88,12 +88,14 @@ module Hecks
 
         def generated_behaviours
           list = [[DEFAULT, @edge.default_behaviour], *@edge.behaviours.map { |entry| [entry[:path], entry] }]
-          list.to_h do |path, entry|
-            [path, { path: path, origin: entry[:origin], methods: Array(entry[:methods]).sort, cached: %w[GET HEAD],
-                     protocol: entry[:viewer_protocol], compress: entry[:compress] == true,
-                     cache: policy_id(entry[:cache_policy]), request: policy_id(entry[:origin_request_policy]),
-                     response: policy_id(entry[:response_headers_policy]) }]
-          end
+          list.to_h { |path, entry| [path, generated_entry(path, entry)] }
+        end
+
+        def generated_entry(path, entry)
+          { path: path, origin: entry[:origin], methods: Array(entry[:methods]).sort, cached: %w[GET HEAD],
+            protocol: entry[:viewer_protocol], compress: entry[:compress] == true,
+            cache: policy_id(entry[:cache_policy]), request: policy_id(entry[:origin_request_policy]),
+            response: policy_id(entry[:response_headers_policy]) }
         end
 
         def policy_id(policy) = policy&.first
@@ -154,7 +156,7 @@ module Hecks
           theirs = current.keys.reject { |path| path == DEFAULT || !generated.key?(path) }
           return [] if mine == theirs
 
-          ["order differs among the behaviours both have:\n    project: #{mine.join(' ')}\n    live:    #{theirs.join(' ')}"]
+          ["order differs among the behaviours both have:\n    project: #{mine.join(" ")}\n    live:    #{theirs.join(" ")}"]
         end
       end
     end