hecks 3.6.0 → 3.9.0

data/rust/host/src/main.rs

@@ -1,35 +1,7 @@
 //! Lambda custom-runtime entry point (or a long-lived server under
 //! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
 
-mod api;
-mod approval;
-mod auth;
-mod checkout;
-mod dispatch;
-mod expr_json;
-mod field_hints;
-mod ir;
-mod journal;
-mod lambda_client;
-mod log;
-mod mint;
-mod needs;
-mod payments;
-mod presentation;
-mod presentation_write;
-mod query_step;
-mod rate_limit;
-mod reference_transform;
-mod reference_validate;
-mod resend;
-mod secrets;
-mod server;
-mod storage_shape;
-#[cfg(test)]
-mod test_pg;
-mod ui_schema;
-mod wasm_runner;
-mod web;
+use rust_host::{approval, auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server, storage_shape};
 
 use lambda_runtime::{service_fn, Error, LambdaEvent};
 use std::path::PathBuf;
@@ -69,10 +41,10 @@ async fn main() -> Result<(), Error> {
                 .fetch_secret_string(&secret_arn)
                 .await
                 .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
-            let password = secrets::extract_field(&secret_json, "password")?;
-            // Literal, unescaped, no percent-encoding -- parse_database_url
-            // below never percent-decodes the password segment either way.
-            format!("postgres://postgres:{password}@{db_host}:5432/{db_name}")
+            // The user and port come from the secret too (a client sharing an instance logs in as
+            // its own role); the password goes in literal, since parse_database_url below never
+            // percent-decodes it.
+            secrets::database_url(&secret_json, &db_host, &db_name)?
         }
         Err(_) => std::env::var("DATABASE_URL")
             .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,
@@ -108,16 +80,8 @@ async fn main() -> Result<(), Error> {
             std::env::set_var("SESSION_SECRET", session_secret);
         }
     }
-    // RESEND_SECRET_ID: fetched the same way, but a failed fetch only
-    // logs -- mail is optional, and a missing secret must not stop the
-    // host from serving everything else (resend.rs answers 503 without
-    // a key).
-    if let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") {
-        let fetched = secret_fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
-        match fetched.and_then(|json| secrets::extract_field(&json, "api_key")) {
-            Ok(api_key) => unsafe { std::env::set_var("RESEND_API_KEY", api_key) },
-            Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
-        }
+    for extension in extension::installed() {
+        extension.boot_secrets(&secret_fetcher).await;
     }
     let wasm_path = PathBuf::from(
         std::env::var("HECKS_WASM_PATH").unwrap_or_else(|_| "banking.wasm".to_string()),
@@ -132,7 +96,9 @@ async fn main() -> Result<(), Error> {
     let schema = std::env::var("HECKS_SCHEMA").ok().filter(|s| !s.is_empty());
     // Checkout on AWS keeps the business's payment keys in a named Secrets
     // Manager secret; refuse before touching the database when none is named.
-    payments::check_boot(web::checkout_enabled(std::env::var("HECKS_CHECKOUT_DOMAIN").ok().as_deref(), &domain))?;
+    for extension in extension::installed() {
+        extension.boot_check(&domain)?;
+    }
 
     // RDS refuses a plain NoTls connection by default and needs AWS's
     // own RDS CA specifically, not a generic public bundle (see

data/rust/host/src/mint.rs

@@ -495,7 +495,7 @@ async fn table_exists<C: GenericClient>(client: &C, name: &str) -> anyhow::Resul
 
 /// No backfill: adopting an era means its history already exists elsewhere.
 /// Runs in its own transaction because `create_head_snapshot`'s SAVEPOINT needs one open.
-pub(crate) async fn adopt_head_snapshots<C: GenericClient>(
+pub async fn adopt_head_snapshots<C: GenericClient>(
     client: &C,
     domain: &str,
     aggregates: &[Aggregate],

data/rust/host/src/payments/tests.rs

@@ -300,7 +300,7 @@ impl Tenant {
     async fn register(&self, slug: &str) -> (u64, Value) {
         let body = json!({"event_slug": slug, "name": "Ada Lovelace", "email": "ada@example.com"}).to_string();
         let platform = self.platform_now().await;
-        let response = web::registrations_route(&body, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::registrations_route(&body, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         (response["statusCode"].as_u64().unwrap(), serde_json::from_str(response["body"].as_str().unwrap()).unwrap_or(Value::Null))
     }
 
@@ -314,14 +314,14 @@ impl Tenant {
         let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
         let header = sign(secret, now, &payload);
         let platform = self.platform_now().await;
-        let response = web::webhook_route(&payload, &header, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::webhook_route(&payload, &header, &platform, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         response["statusCode"].as_u64().unwrap()
     }
 
     // POST /registrations/:id/complete with a successful outcome (the mock
     // walkthrough's "Pay" button).
     async fn settle(&self, reference: &str) -> u64 {
-        let response = web::registration_complete_route(reference, r#"{"outcome":"succeeded"}"#, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+        let response = web::registration_complete_route(reference, r#"{"outcome":"succeeded"}"#, &self.client, &self.wasm, &self.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
         response["statusCode"].as_u64().unwrap()
     }
 
@@ -672,7 +672,7 @@ async fn a_declined_payment_frees_the_seat_and_a_paid_one_keeps_it() {
 
     let (_, body) = t.register("declined").await;
     let first = body["registration_id"].as_str().unwrap().to_string();
-    let response = web::registration_complete_route(&first, r#"{"outcome":"failed"}"#, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+    let response = web::registration_complete_route(&first, r#"{"outcome":"failed"}"#, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
     assert_eq!(response["statusCode"].as_u64(), Some(200));
     assert_eq!(t.payment_status(&first).await, "failed");
 
@@ -714,7 +714,7 @@ async fn archiving_a_paid_registration_frees_its_seat_and_restoring_it_takes_the
     assert_eq!(registration_status(&t, &reference).await, "archived");
     assert_eq!(t.payment_status(&reference).await, "succeeded", "archiving never touches the Payment");
     let read = dispatch::read(&t.client, &t.wasm).await.unwrap();
-    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"), Some(1));
+    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"), Some(1));
 
     let (status, body) = t.register("archive-me").await;
     assert_eq!(status, 200, "the archived registration's seat is free again: {body}");
@@ -728,11 +728,11 @@ async fn archiving_a_paid_registration_frees_its_seat_and_restoring_it_takes_the
     assert_eq!(registration_status(&t, &reference).await, "active");
     let read = dispatch::read(&t.client, &t.wasm).await.unwrap();
     assert_eq!(
-        web::seats_taken(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"),
+        web::seats_taken(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"),
         2,
         "a restored registration counts again, even past capacity: the site refuses a restore with no seat"
     );
-    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::ir::fixture_payments(), "archive-me"), Some(0));
+    assert_eq!(web::seats_left(&read, "CheckoutFixture", &crate::commerce_ir::fixture_payments(), "archive-me"), Some(0));
 }
 
 #[tokio::test]
@@ -876,7 +876,7 @@ async fn an_event_verified_only_by_the_public_mock_secret_is_refused_for_a_real_
     let payload = event.to_string();
     let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs() as i64;
     let header = sign(web::MOCK_STRIPE_WEBHOOK_SECRET, now, &payload);
-    let response = web::webhook_route(&payload, &header, &t.platform, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::ir::fixture_payments()).await;
+    let response = web::webhook_route(&payload, &header, &t.platform, &t.client, &t.wasm, &t.config, &NeverInvoker, &crate::commerce_ir::fixture_payments()).await;
     assert_eq!(response["statusCode"], 500, "{event}");
     assert_eq!(t.payment_status(&reference).await, "pending", "a forged completion must not settle a real payment");
 }

data/rust/host/src/payments.rs

@@ -187,7 +187,7 @@ impl Connection {
 /// This tenant's connection, read out of the replayed instances, or `None`
 /// until an Owner has connected an account.
 pub fn connection(read: &Value, domain: &str) -> Option<Connection> {
-    let (_, state) = instances_for(read, &crate::ir::payment_connection_binding(domain).instance_prefix()).into_iter().find(|(id, _)| id == CONNECTION_SLUG)?;
+    let (_, state) = instances_for(read, &crate::commerce_ir::payment_connection_binding(domain).instance_prefix()).into_iter().find(|(id, _)| id == CONNECTION_SLUG)?;
     let text = |field: &str| state.get(field).and_then(|v| v.get("value")).and_then(|v| v.as_str()).unwrap_or_default().to_string();
     Some(Connection {
         status: state.get("status").and_then(|v| v.as_str()).unwrap_or_default().to_string(),
@@ -236,14 +236,14 @@ pub fn checkout_plan(connection: Option<&Connection>, platform: &PlatformConfig)
 }
 
 async fn dispatch_on_connection(
-    which: crate::ir::ConnectionVerb,
+    which: crate::commerce_ir::ConnectionVerb,
     facts: Value,
     client: &Mutex<Client>,
     wasm_path: &Path,
     config: &LineageConfig,
     invoker: &dyn LambdaInvoker,
 ) -> anyhow::Result<dispatch::Outcome> {
-    let verb = crate::ir::payment_connection_binding(&config.domain).verb(which).to_string();
+    let verb = crate::commerce_ir::payment_connection_binding(&config.domain).verb(which).to_string();
     dispatch::handle_routed(client, wasm_path, &verb, json!(CONNECTION_SLUG), facts, None, config, invoker).await
 }
 
@@ -362,8 +362,8 @@ pub async fn route(
         "/payments/connection" => show(&caller, platform, client, wasm_path, config).await,
         "/payments/connection/direct" => direct_route(&caller, raw_body, platform, client, wasm_path, config, invoker).await,
         "/payments/connection/disconnect" => disconnect_route(&caller, platform, client, wasm_path, config, invoker).await,
-        "/payments/connection/enable" => switch_route(&caller, crate::ir::ConnectionVerb::Enable, platform, client, wasm_path, config, invoker).await,
-        _ => switch_route(&caller, crate::ir::ConnectionVerb::Disable, platform, client, wasm_path, config, invoker).await,
+        "/payments/connection/enable" => switch_route(&caller, crate::commerce_ir::ConnectionVerb::Enable, platform, client, wasm_path, config, invoker).await,
+        _ => switch_route(&caller, crate::commerce_ir::ConnectionVerb::Disable, platform, client, wasm_path, config, invoker).await,
     })
 }
 
@@ -403,10 +403,10 @@ async fn record_connection(
         None => {
             let mut creation = facts;
             creation["slug"] = json!({"value": CONNECTION_SLUG});
-            dispatch::handle_facts(client, wasm_path, &crate::ir::payment_connection_binding(&config.domain).connect, creation, None, config, invoker).await
+            dispatch::handle_facts(client, wasm_path, &crate::commerce_ir::payment_connection_binding(&config.domain).connect, creation, None, config, invoker).await
         }
-        Some("disconnected") => dispatch_on_connection(crate::ir::ConnectionVerb::Reconnect, facts, client, wasm_path, config, invoker).await,
-        Some("paused") => dispatch_on_connection(crate::ir::ConnectionVerb::Resume, facts, client, wasm_path, config, invoker).await,
+        Some("disconnected") => dispatch_on_connection(crate::commerce_ir::ConnectionVerb::Reconnect, facts, client, wasm_path, config, invoker).await,
+        Some("paused") => dispatch_on_connection(crate::commerce_ir::ConnectionVerb::Resume, facts, client, wasm_path, config, invoker).await,
         Some(_) => return json_error(409, "an account is already connected — disconnect it first"),
     };
     match outcome {
@@ -465,7 +465,7 @@ async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, client: &M
         return json_error(409, "nothing to disconnect");
     };
 
-    let which = if existing.status == "enabled" { crate::ir::ConnectionVerb::Suspend } else { crate::ir::ConnectionVerb::Disconnect };
+    let which = if existing.status == "enabled" { crate::commerce_ir::ConnectionVerb::Suspend } else { crate::commerce_ir::ConnectionVerb::Disconnect };
     match dispatch_on_connection(which, json!({}), client, wasm_path, config, invoker).await {
         Ok(outcome) if outcome.accepted => {
             if existing.is_direct() {
@@ -480,7 +480,7 @@ async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, client: &M
 }
 
 // Enable or disable real payments: operator only.
-async fn switch_route(caller: &Caller, which: crate::ir::ConnectionVerb, platform: &PlatformConfig, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
+async fn switch_route(caller: &Caller, which: crate::commerce_ir::ConnectionVerb, platform: &PlatformConfig, client: &Mutex<Client>, wasm_path: &Path, config: &LineageConfig, invoker: &dyn LambdaInvoker) -> Value {
     if let Err(response) = require_operator(caller) {
         return response;
     }

data/rust/host/src/rate_limit.rs

@@ -4,6 +4,7 @@
 use axum::http::header::{HeaderValue, CONTENT_TYPE, RETRY_AFTER};
 use axum::http::{HeaderMap, HeaderName, StatusCode};
 use axum::response::{IntoResponse, Response};
+use crate::extension::RateRule;
 use serde_json::json;
 use std::collections::{BTreeMap, HashMap, VecDeque};
 use std::net::{IpAddr, Ipv6Addr};
@@ -14,8 +15,6 @@ use std::time::{Duration, Instant};
 const UNKNOWN_CLIENT: &str = "unknown";
 
 const DEFAULT_WINDOW_SECONDS: u64 = 3600;
-const DEFAULT_SUBSCRIBE: usize = 10;
-const DEFAULT_REGISTER: usize = 15;
 const DEFAULT_MAX_KEYS: usize = 10_000;
 
 /// The outcome of counting one request against a window.
@@ -215,28 +214,12 @@ fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
     a.len() == b.len() && a.iter().zip(b).fold(0u8, |diff, (x, y)| diff | (x ^ y)) == 0
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum Form {
-    Subscribe,
-    Register,
-}
-
-impl Form {
-    pub fn for_request(method: &str, path: &str) -> Option<Self> {
-        match (method, path) {
-            ("POST", "/newsletter/subscribers") => Some(Self::Subscribe),
-            ("POST", "/registrations") => Some(Self::Register),
-            _ => None,
-        }
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Config {
     enabled: bool,
     window: Duration,
-    subscribe: usize,
-    register: usize,
+    // Each extension rule's budget, by rule name.
+    limits: HashMap<&'static str, usize>,
     max_keys: usize,
     trust: ProxyTrust,
 }
@@ -256,8 +239,10 @@ impl Config {
             }
         };
         let window = number("HECKS_RATE_LIMIT_WINDOW_SECONDS", DEFAULT_WINDOW_SECONDS);
-        let subscribe = number("HECKS_RATE_LIMIT_SUBSCRIBE", DEFAULT_SUBSCRIBE as u64);
-        let register = number("HECKS_RATE_LIMIT_REGISTER", DEFAULT_REGISTER as u64);
+        let limits = crate::extension::rate_rules()
+            .iter()
+            .map(|rule| (rule.name, usize::try_from(number(rule.limit_env, rule.default_limit as u64)).unwrap_or(usize::MAX)))
+            .collect();
         let max_keys = number("HECKS_RATE_LIMIT_MAX_KEYS", DEFAULT_MAX_KEYS as u64);
         let hops = get("HECKS_TRUSTED_PROXY_HOPS").map(|v| v.trim().to_string()).filter(|v| !v.is_empty()).map_or(0, |raw| {
             raw.parse::<usize>().unwrap_or_else(|_| {
@@ -272,19 +257,20 @@ impl Config {
         let config = Self {
             enabled,
             window: Duration::from_secs(window),
-            subscribe: usize::try_from(subscribe).unwrap_or(usize::MAX),
-            register: usize::try_from(register).unwrap_or(usize::MAX),
+            limits,
             max_keys: usize::try_from(max_keys).unwrap_or(usize::MAX),
             trust: ProxyTrust { networks, hops, auth },
         };
         (config, warnings)
     }
 
-    fn limit_for(&self, form: Form) -> usize {
-        match form {
-            Form::Subscribe => self.subscribe,
-            Form::Register => self.register,
-        }
+    fn limit_for(&self, rule: &RateRule) -> usize {
+        self.limits.get(rule.name).copied().unwrap_or(rule.default_limit)
+    }
+
+    #[cfg(test)]
+    fn limit(&self, name: &str) -> usize {
+        self.limits[name]
     }
 }
 
@@ -336,7 +322,7 @@ pub enum Verdict {
 
 pub struct RateLimits {
     config: Config,
-    windows: Mutex<HashMap<Form, SlidingWindow>>,
+    windows: Mutex<HashMap<&'static str, SlidingWindow>>,
     warned_untrusted_proxy: AtomicBool,
 }
 
@@ -355,8 +341,7 @@ impl RateLimits {
             json!({
                 "enabled": config.enabled,
                 "window_seconds": config.window.as_secs(),
-                "subscribe": config.subscribe,
-                "register": config.register,
+                "limits": config.limits,
                 "trusted_networks": config.trust.networks.len(),
                 "trusted_proxy_hops": config.trust.hops,
                 "proxy_auth": config.trust.auth.is_some(),
@@ -372,7 +357,7 @@ impl RateLimits {
 
     // `check` with the clock supplied, so tests need not sleep.
     pub fn check_at(&self, method: &str, path: &str, headers: &HeaderMap, peer: Option<IpAddr>, now: Instant) -> Verdict {
-        let Some(form) = Form::for_request(method, path).filter(|_| self.config.enabled) else {
+        let Some(rule) = crate::extension::rate_rule_for(method, path).filter(|_| self.config.enabled) else {
             return Verdict::Allowed;
         };
         let key = self.client_key(headers, peer);
@@ -380,8 +365,8 @@ impl RateLimits {
             let mut windows = self.windows.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
             let config = &self.config;
             windows
-                .entry(form)
-                .or_insert_with(|| SlidingWindow::new(config.limit_for(form), config.window, config.max_keys))
+                .entry(rule.name)
+                .or_insert_with(|| SlidingWindow::new(config.limit_for(&rule), config.window, config.max_keys))
                 .check(&key, now)
         };
         if decision.allowed {
@@ -725,7 +710,7 @@ mod tests {
         assert!(warnings.is_empty());
         assert!(config.enabled);
         assert_eq!(config.window, HOUR);
-        assert_eq!((config.subscribe, config.register, config.max_keys), (10, 15, 10_000));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.max_keys), (10, 15, 10_000));
         assert_eq!(config.trust, ProxyTrust::default());
     }
 
@@ -743,7 +728,7 @@ mod tests {
         ]);
         assert!(warnings.is_empty(), "{warnings:?}");
         assert_eq!(config.window, Duration::from_secs(60));
-        assert_eq!((config.subscribe, config.register, config.max_keys), (3, 4, 50));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.max_keys), (3, 4, 50));
         assert_eq!(config.trust, trust(&["10.0.0.0/8", "127.0.0.1"], 1, Some(("x-origin-secret", "s3cret"))));
     }
 
@@ -766,7 +751,7 @@ mod tests {
             ("HECKS_TRUSTED_PROXY_HOPS", "two"),
             ("HECKS_TRUSTED_PROXIES", "10.0.0.0/8, banana"),
         ]);
-        assert_eq!((config.subscribe, config.register, config.window), (10, 15, HOUR));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.window), (10, 15, HOUR));
         assert_eq!(config.trust.hops, 0);
         assert_eq!(config.trust.networks.len(), 1);
         assert_eq!(warnings.len(), 5, "{warnings:?}");
@@ -786,8 +771,9 @@ mod tests {
 
     #[test]
     fn only_the_public_write_routes_are_limited() {
-        assert_eq!(Form::for_request("POST", "/newsletter/subscribers"), Some(Form::Subscribe));
-        assert_eq!(Form::for_request("POST", "/registrations"), Some(Form::Register));
+        let name = |method, path| crate::extension::rate_rule_for(method, path).map(|rule| rule.name);
+        assert_eq!(name("POST", "/newsletter/subscribers"), Some("subscribe"));
+        assert_eq!(name("POST", "/registrations"), Some("register"));
         for (method, path) in [
             ("GET", "/newsletter/subscribers"),
             ("GET", "/newsletter/subscribers/confirm"),
@@ -800,7 +786,7 @@ mod tests {
             ("POST", "/members"),
             ("POST", "/newsletter/subscribers/"),
         ] {
-            assert_eq!(Form::for_request(method, path), None, "{method} {path}");
+            assert_eq!(crate::extension::rate_rule_for(method, path).map(|rule| rule.name), None, "{method} {path}");
         }
     }
 

data/rust/host/src/secrets.rs

@@ -75,10 +75,54 @@ pub fn extract_field(secret_json: &str, field: &str) -> Result<String, String> {
         .ok_or_else(|| format!("secret's SecretString has no string {field:?} field"))
 }
 
+/// The `postgres://` URL for a database secret.
+///
+/// The user is the secret's `username`, which is `postgres` for RDS's managed master secret and a
+/// client's own role for a database shared with other clients; a secret without one is read as
+/// `postgres`. The port is the secret's `port` when it has one, else 5432. The password goes in
+/// literal, as before: the URL parser downstream never percent-decodes it, so a client's generated
+/// password is letters and digits only.
+pub fn database_url(secret_json: &str, host: &str, database: &str) -> Result<String, String> {
+    let password = extract_field(secret_json, "password")?;
+    let user = extract_field(secret_json, "username").unwrap_or_else(|_| "postgres".to_string());
+    let port = serde_json::from_str::<serde_json::Value>(secret_json)
+        .ok()
+        .and_then(|v| v.get("port").and_then(|p| p.as_u64().or_else(|| p.as_str().and_then(|s| s.parse().ok()))))
+        .unwrap_or(5432);
+    Ok(format!("postgres://{user}:{password}@{host}:{port}/{database}"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_master_secret_logs_in_as_postgres_on_the_default_port() {
+        let json = r#"{"username":"postgres","password":"abc123"}"#;
+        assert_eq!(database_url(json, "db.example", "app").unwrap(), "postgres://postgres:abc123@db.example:5432/app");
+    }
+
+    #[test]
+    fn a_clients_own_secret_logs_in_as_its_role() {
+        let json = r#"{"username":"acme","password":"s3cr3t","host":"db.example","port":5433,"dbname":"acme"}"#;
+        assert_eq!(database_url(json, "db.example", "acme").unwrap(), "postgres://acme:s3cr3t@db.example:5433/acme");
+    }
+
+    #[test]
+    fn a_secret_with_no_username_is_read_as_postgres() {
+        assert_eq!(database_url(r#"{"password":"pw"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:5432/d");
+    }
+
+    #[test]
+    fn a_port_written_as_text_is_read() {
+        assert_eq!(database_url(r#"{"password":"pw","port":"6000"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:6000/d");
+    }
+
+    #[test]
+    fn a_secret_with_no_password_is_refused() {
+        assert!(database_url(r#"{"username":"acme"}"#, "h", "d").is_err());
+    }
+
     #[test]
     fn extracts_the_named_field_from_the_generated_secret_shape() {
         assert_eq!(

data/rust/host/src/server.rs

@@ -276,7 +276,8 @@ fn value_to_response(value: Value) -> Response {
     let Some(status_code) = value.get("statusCode").and_then(|v| v.as_u64()) else {
         return (StatusCode::OK, axum::Json(value)).into_response();
     };
-    let status = StatusCode::from_u16(status_code as u16).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    // `try_from`, not `as u16`: 65736 would wrap to 200 and turn a handler's garbage into a success.
+    let status = u16::try_from(status_code).ok().and_then(|code| StatusCode::from_u16(code).ok()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
 
     let mut headers = HeaderMap::new();
     if let Some(header_obj) = value.get("headers").and_then(|h| h.as_object()) {
@@ -665,3 +666,7 @@ mod tests {
         assert_eq!(version_body("e", "h", Some(""))["build"], env!("CARGO_PKG_VERSION"));
     }
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/server.rs"]
+mod boundary_fuzz;

data/rust/host/src/web/commerce.rs

@@ -0,0 +1,113 @@
+// Commerce as a host extension: the newsletter, payments, registrations and mail routes, their boot
+// check and their boot-time secret, answered through `extension::HostExtension` instead of being
+// named in `render` and `route`.
+
+use super::{
+    checkout_enabled, newsletter, newsletter_send, payments_routes, registrations_list_route, resend_webhook, respond, session_secret,
+};
+use crate::extension::{Ctx, HostExtension, RateRule};
+use crate::payments;
+use crate::secrets::{self, AwsSecretFetcher};
+use async_trait::async_trait;
+use serde_json::Value;
+
+pub struct Commerce;
+
+fn checkout_domain() -> Option<String> {
+    std::env::var("HECKS_CHECKOUT_DOMAIN").ok()
+}
+
+#[async_trait]
+impl HostExtension for Commerce {
+    // Registration/checkout/newsletter routes are opt-in: they only exist when HECKS_CHECKOUT_DOMAIN
+    // names this domain, since Event/Registration and the Payments::Payment chapter are declared
+    // against it specifically. The capability shapes are pinned by
+    // spec/fixtures/rust_host/checkout_fixture, which this module's tests run against.
+    async fn guest_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
+        if !checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain) {
+            return None;
+        }
+        let ir = crate::extension::loaded_ir();
+        // Newsletter subscribe shares this gate (same hecksagon as the registration aggregates) and
+        // is checked first since it needs none of the Payments::Payment/Event context checkout
+        // requires. The subscriber list is PII (email, names, status): only an Admin or Owner
+        // holding the account cookie may read it, like sending does.
+        if ctx.method == "GET" && ctx.path == "/newsletter/subscribers" && ir.and_then(crate::commerce_ir::newsletter_provider).is_some() {
+            let Some(domain_ir) = ir else {
+                return Some(respond(500, "text/plain", "HECKS_IR_PATH not set or unreadable — this domain has no web layer configured"));
+            };
+            if let Err(response) = newsletter_send::require_admin(domain_ir, ctx.cookies, &session_secret(), ctx.client).await {
+                return Some(response);
+            }
+        }
+        let headers = ctx.event.and_then(|e| e.get("headers"));
+        if let Some(response) =
+            resend_webhook::resend_webhook_route(ctx.method, ctx.path, ctx.raw_body, headers, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        {
+            return Some(response);
+        }
+        if let Some(response) =
+            newsletter::newsletter_route(ctx.method, ctx.path, ctx.query, ctx.raw_body, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        {
+            return Some(response);
+        }
+        let stripe_signature = ctx
+            .event
+            .and_then(|e| e.get("headers"))
+            .and_then(|h| h.get("stripe-signature"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+        payments_routes(ir, ctx.method, ctx.path, ctx.raw_body, stripe_signature, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+    }
+
+    async fn account_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
+        let domain_ir = ctx.domain_ir?;
+        let secret = session_secret();
+        // Sending a newsletter issue (web/newsletter_send.rs's own header): an Admin's or Owner's
+        // account cookie, unlike the guest newsletter routes served ahead of the account gate.
+        if newsletter_send::issue_action(ctx.method, ctx.path).is_some() {
+            return newsletter_send::issue_route(
+                ctx.method, ctx.path, domain_ir, ctx.raw_body, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+            )
+            .await;
+        }
+        if ctx.method == "GET" && ctx.path == "/registrations" {
+            return Some(registrations_list_route(domain_ir, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config).await);
+        }
+        // The tenant's payment connection: same gate as the checkout routes, since only the
+        // HECKS_CHECKOUT_DOMAIN domain carries one — any other domain served by this binary falls
+        // through as unknown.
+        if payments::owns(ctx.method, ctx.path) && checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain) {
+            return payments::route(
+                ctx.method, ctx.path, ctx.raw_body, ctx.cookies, &secret, domain_ir, &payments::PlatformConfig::load().await,
+                ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+            )
+            .await;
+        }
+        None
+    }
+
+    fn rate_rules(&self) -> Vec<RateRule> {
+        vec![
+            RateRule { name: "subscribe", method: "POST", path: "/newsletter/subscribers", limit_env: "HECKS_RATE_LIMIT_SUBSCRIBE", default_limit: 10 },
+            RateRule { name: "register", method: "POST", path: "/registrations", limit_env: "HECKS_RATE_LIMIT_REGISTER", default_limit: 15 },
+        ]
+    }
+
+    // Checkout on AWS keeps the business's payment keys in a named Secrets Manager secret; refuse
+    // before touching the database when none is named.
+    fn boot_check(&self, domain: &str) -> Result<(), String> {
+        payments::check_boot(checkout_enabled(checkout_domain().as_deref(), domain))
+    }
+
+    // RESEND_SECRET_ID: a failed fetch only logs -- mail is optional, and a missing secret must not
+    // stop the host from serving everything else (resend.rs answers 503 without a key).
+    async fn boot_secrets(&self, fetcher: &AwsSecretFetcher) {
+        let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") else { return };
+        let fetched = fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
+        match fetched.and_then(|json| secrets::extract_field(&json, "api_key")) {
+            Ok(api_key) => unsafe { std::env::set_var("RESEND_API_KEY", api_key) },
+            Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
+        }
+    }
+}

data/rust/host/src/web/newsletter.rs

@@ -2,7 +2,8 @@ use super::newsletter_send::{site_url, unsubscribe_token, unsubscribe_token_matc
 use super::{instances_for, last_refusal, respond};
 use crate::auth;
 use crate::dispatch;
-use crate::ir::{ir, newsletter_provider, NewsletterProvider};
+use crate::ir::ir;
+use crate::commerce_ir::{newsletter_provider, NewsletterProvider};
 use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
 use crate::resend::{Email, Mailer};

data/rust/host/src/web/newsletter_send.rs

@@ -1,7 +1,7 @@
 use super::{active_session_email, instances_for, last_refusal, percent_decode, respond};
 use crate::auth;
 use crate::dispatch;
-use crate::ir::{newsletter_issues_provider, newsletter_provider, NewsletterIssuesProvider, NewsletterProvider};
+use crate::commerce_ir::{newsletter_issues_provider, newsletter_provider, NewsletterIssuesProvider, NewsletterProvider};
 use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
 use crate::resend::{Email, Mailer};

data/rust/host/src/web/registration_receipt.rs

@@ -4,7 +4,7 @@
 
 use super::instances_for;
 use crate::dispatch;
-use crate::ir::PaymentsProvider;
+use crate::commerce_ir::PaymentsProvider;
 use crate::journal::LineageConfig;
 use crate::resend::{Email, Mailer};
 use serde_json::{json, Value};
@@ -82,7 +82,7 @@ pub(super) async fn send_receipt(reference: &str, client: &Mutex<Client>, wasm_p
     let Ok(read) = dispatch::read(client, wasm_path).await else {
         return;
     };
-    let binding = crate::ir::registrations_binding(&config.domain);
+    let binding = crate::commerce_ir::registrations_binding(&config.domain);
     let registrations = instances_for(&read, &binding.registration_prefix());
     let Some((_, registration)) = registrations.iter().find(|(id, _)| id == reference) else {
         return;