hecks 3.7.0 → 3.9.1

data/rust/host/src/rate_limit.rs

@@ -4,6 +4,7 @@
 use axum::http::header::{HeaderValue, CONTENT_TYPE, RETRY_AFTER};
 use axum::http::{HeaderMap, HeaderName, StatusCode};
 use axum::response::{IntoResponse, Response};
+use crate::extension::RateRule;
 use serde_json::json;
 use std::collections::{BTreeMap, HashMap, VecDeque};
 use std::net::{IpAddr, Ipv6Addr};
@@ -14,8 +15,6 @@ use std::time::{Duration, Instant};
 const UNKNOWN_CLIENT: &str = "unknown";
 
 const DEFAULT_WINDOW_SECONDS: u64 = 3600;
-const DEFAULT_SUBSCRIBE: usize = 10;
-const DEFAULT_REGISTER: usize = 15;
 const DEFAULT_MAX_KEYS: usize = 10_000;
 
 /// The outcome of counting one request against a window.
@@ -215,28 +214,12 @@ fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
     a.len() == b.len() && a.iter().zip(b).fold(0u8, |diff, (x, y)| diff | (x ^ y)) == 0
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum Form {
-    Subscribe,
-    Register,
-}
-
-impl Form {
-    pub fn for_request(method: &str, path: &str) -> Option<Self> {
-        match (method, path) {
-            ("POST", "/newsletter/subscribers") => Some(Self::Subscribe),
-            ("POST", "/registrations") => Some(Self::Register),
-            _ => None,
-        }
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Config {
     enabled: bool,
     window: Duration,
-    subscribe: usize,
-    register: usize,
+    // Each extension rule's budget, by rule name.
+    limits: HashMap<&'static str, usize>,
     max_keys: usize,
     trust: ProxyTrust,
 }
@@ -256,8 +239,10 @@ impl Config {
             }
         };
         let window = number("HECKS_RATE_LIMIT_WINDOW_SECONDS", DEFAULT_WINDOW_SECONDS);
-        let subscribe = number("HECKS_RATE_LIMIT_SUBSCRIBE", DEFAULT_SUBSCRIBE as u64);
-        let register = number("HECKS_RATE_LIMIT_REGISTER", DEFAULT_REGISTER as u64);
+        let limits = crate::extension::rate_rules()
+            .iter()
+            .map(|rule| (rule.name, usize::try_from(number(rule.limit_env, rule.default_limit as u64)).unwrap_or(usize::MAX)))
+            .collect();
         let max_keys = number("HECKS_RATE_LIMIT_MAX_KEYS", DEFAULT_MAX_KEYS as u64);
         let hops = get("HECKS_TRUSTED_PROXY_HOPS").map(|v| v.trim().to_string()).filter(|v| !v.is_empty()).map_or(0, |raw| {
             raw.parse::<usize>().unwrap_or_else(|_| {
@@ -272,19 +257,20 @@ impl Config {
         let config = Self {
             enabled,
             window: Duration::from_secs(window),
-            subscribe: usize::try_from(subscribe).unwrap_or(usize::MAX),
-            register: usize::try_from(register).unwrap_or(usize::MAX),
+            limits,
             max_keys: usize::try_from(max_keys).unwrap_or(usize::MAX),
             trust: ProxyTrust { networks, hops, auth },
         };
         (config, warnings)
     }
 
-    fn limit_for(&self, form: Form) -> usize {
-        match form {
-            Form::Subscribe => self.subscribe,
-            Form::Register => self.register,
-        }
+    fn limit_for(&self, rule: &RateRule) -> usize {
+        self.limits.get(rule.name).copied().unwrap_or(rule.default_limit)
+    }
+
+    #[cfg(test)]
+    fn limit(&self, name: &str) -> usize {
+        self.limits[name]
     }
 }
 
@@ -336,7 +322,7 @@ pub enum Verdict {
 
 pub struct RateLimits {
     config: Config,
-    windows: Mutex<HashMap<Form, SlidingWindow>>,
+    windows: Mutex<HashMap<&'static str, SlidingWindow>>,
     warned_untrusted_proxy: AtomicBool,
 }
 
@@ -355,8 +341,7 @@ impl RateLimits {
             json!({
                 "enabled": config.enabled,
                 "window_seconds": config.window.as_secs(),
-                "subscribe": config.subscribe,
-                "register": config.register,
+                "limits": config.limits,
                 "trusted_networks": config.trust.networks.len(),
                 "trusted_proxy_hops": config.trust.hops,
                 "proxy_auth": config.trust.auth.is_some(),
@@ -372,7 +357,7 @@ impl RateLimits {
 
     // `check` with the clock supplied, so tests need not sleep.
     pub fn check_at(&self, method: &str, path: &str, headers: &HeaderMap, peer: Option<IpAddr>, now: Instant) -> Verdict {
-        let Some(form) = Form::for_request(method, path).filter(|_| self.config.enabled) else {
+        let Some(rule) = crate::extension::rate_rule_for(method, path).filter(|_| self.config.enabled) else {
             return Verdict::Allowed;
         };
         let key = self.client_key(headers, peer);
@@ -380,8 +365,8 @@ impl RateLimits {
             let mut windows = self.windows.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
             let config = &self.config;
             windows
-                .entry(form)
-                .or_insert_with(|| SlidingWindow::new(config.limit_for(form), config.window, config.max_keys))
+                .entry(rule.name)
+                .or_insert_with(|| SlidingWindow::new(config.limit_for(&rule), config.window, config.max_keys))
                 .check(&key, now)
         };
         if decision.allowed {
@@ -725,7 +710,7 @@ mod tests {
         assert!(warnings.is_empty());
         assert!(config.enabled);
         assert_eq!(config.window, HOUR);
-        assert_eq!((config.subscribe, config.register, config.max_keys), (10, 15, 10_000));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.max_keys), (10, 15, 10_000));
         assert_eq!(config.trust, ProxyTrust::default());
     }
 
@@ -743,7 +728,7 @@ mod tests {
         ]);
         assert!(warnings.is_empty(), "{warnings:?}");
         assert_eq!(config.window, Duration::from_secs(60));
-        assert_eq!((config.subscribe, config.register, config.max_keys), (3, 4, 50));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.max_keys), (3, 4, 50));
         assert_eq!(config.trust, trust(&["10.0.0.0/8", "127.0.0.1"], 1, Some(("x-origin-secret", "s3cret"))));
     }
 
@@ -766,7 +751,7 @@ mod tests {
             ("HECKS_TRUSTED_PROXY_HOPS", "two"),
             ("HECKS_TRUSTED_PROXIES", "10.0.0.0/8, banana"),
         ]);
-        assert_eq!((config.subscribe, config.register, config.window), (10, 15, HOUR));
+        assert_eq!((config.limit("subscribe"), config.limit("register"), config.window), (10, 15, HOUR));
         assert_eq!(config.trust.hops, 0);
         assert_eq!(config.trust.networks.len(), 1);
         assert_eq!(warnings.len(), 5, "{warnings:?}");
@@ -786,8 +771,9 @@ mod tests {
 
     #[test]
     fn only_the_public_write_routes_are_limited() {
-        assert_eq!(Form::for_request("POST", "/newsletter/subscribers"), Some(Form::Subscribe));
-        assert_eq!(Form::for_request("POST", "/registrations"), Some(Form::Register));
+        let name = |method, path| crate::extension::rate_rule_for(method, path).map(|rule| rule.name);
+        assert_eq!(name("POST", "/newsletter/subscribers"), Some("subscribe"));
+        assert_eq!(name("POST", "/registrations"), Some("register"));
         for (method, path) in [
             ("GET", "/newsletter/subscribers"),
             ("GET", "/newsletter/subscribers/confirm"),
@@ -800,7 +786,7 @@ mod tests {
             ("POST", "/members"),
             ("POST", "/newsletter/subscribers/"),
         ] {
-            assert_eq!(Form::for_request(method, path), None, "{method} {path}");
+            assert_eq!(crate::extension::rate_rule_for(method, path).map(|rule| rule.name), None, "{method} {path}");
         }
     }
 

data/rust/host/src/secrets.rs

@@ -75,6 +75,12 @@ pub fn extract_field(secret_json: &str, field: &str) -> Result<String, String> {
         .ok_or_else(|| format!("secret's SecretString has no string {field:?} field"))
 }
 
+/// One named string field out of a secret's JSON `SecretString`, or `None` when the secret does not
+/// carry it (or is not JSON, or the field is blank). For a field a secret may have and may not.
+pub fn optional_field(secret_json: &str, field: &str) -> Option<String> {
+    extract_field(secret_json, field).ok().filter(|value| !value.trim().is_empty())
+}
+
 /// The `postgres://` URL for a database secret.
 ///
 /// The user is the secret's `username`, which is `postgres` for RDS's managed master secret and a
@@ -96,6 +102,15 @@ pub fn database_url(secret_json: &str, host: &str, database: &str) -> Result<Str
 mod tests {
     use super::*;
 
+    #[test]
+    fn an_optional_field_is_read_when_present_and_none_when_absent_blank_or_not_json() {
+        let json = r#"{"api_key":"re_1","webhook_secret":"whsec_abc","blank":"  "}"#;
+        assert_eq!(optional_field(json, "webhook_secret").as_deref(), Some("whsec_abc"));
+        assert_eq!(optional_field(json, "missing"), None);
+        assert_eq!(optional_field(json, "blank"), None);
+        assert_eq!(optional_field("not json", "webhook_secret"), None);
+    }
+
     #[test]
     fn a_master_secret_logs_in_as_postgres_on_the_default_port() {
         let json = r#"{"username":"postgres","password":"abc123"}"#;

data/rust/host/src/web/commerce.rs

@@ -0,0 +1,121 @@
+// Commerce as a host extension: the newsletter, payments, registrations and mail routes, their boot
+// check and their boot-time secret, answered through `extension::HostExtension` instead of being
+// named in `render` and `route`.
+
+use super::{
+    checkout_enabled, newsletter, newsletter_send, payments_routes, registrations_list_route, resend_webhook, respond, session_secret,
+};
+use crate::extension::{Ctx, HostExtension, RateRule};
+use crate::payments;
+use crate::secrets::{self, AwsSecretFetcher};
+use async_trait::async_trait;
+use serde_json::Value;
+
+pub struct Commerce;
+
+fn checkout_domain() -> Option<String> {
+    std::env::var("HECKS_CHECKOUT_DOMAIN").ok()
+}
+
+#[async_trait]
+impl HostExtension for Commerce {
+    // Registration/checkout/newsletter routes are opt-in: they only exist when HECKS_CHECKOUT_DOMAIN
+    // names this domain, since Event/Registration and the Payments::Payment chapter are declared
+    // against it specifically. The capability shapes are pinned by
+    // spec/fixtures/rust_host/checkout_fixture, which this module's tests run against.
+    async fn guest_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
+        if !checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain) {
+            return None;
+        }
+        let ir = crate::extension::loaded_ir();
+        // Newsletter subscribe shares this gate (same hecksagon as the registration aggregates) and
+        // is checked first since it needs none of the Payments::Payment/Event context checkout
+        // requires. The subscriber list is PII (email, names, status): only an Admin or Owner
+        // holding the account cookie may read it, like sending does.
+        if ctx.method == "GET" && ctx.path == "/newsletter/subscribers" && ir.and_then(crate::commerce_ir::newsletter_provider).is_some() {
+            let Some(domain_ir) = ir else {
+                return Some(respond(500, "text/plain", "HECKS_IR_PATH not set or unreadable — this domain has no web layer configured"));
+            };
+            if let Err(response) = newsletter_send::require_admin(domain_ir, ctx.cookies, &session_secret(), ctx.client).await {
+                return Some(response);
+            }
+        }
+        let headers = ctx.event.and_then(|e| e.get("headers"));
+        if let Some(response) =
+            resend_webhook::resend_webhook_route(ctx.method, ctx.path, ctx.raw_body, headers, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        {
+            return Some(response);
+        }
+        if let Some(response) =
+            newsletter::newsletter_route(ctx.method, ctx.path, ctx.query, ctx.raw_body, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+        {
+            return Some(response);
+        }
+        let stripe_signature = ctx
+            .event
+            .and_then(|e| e.get("headers"))
+            .and_then(|h| h.get("stripe-signature"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+        payments_routes(ir, ctx.method, ctx.path, ctx.raw_body, stripe_signature, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker).await
+    }
+
+    async fn account_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
+        let domain_ir = ctx.domain_ir?;
+        let secret = session_secret();
+        // Sending a newsletter issue (web/newsletter_send.rs's own header): an Admin's or Owner's
+        // account cookie, unlike the guest newsletter routes served ahead of the account gate.
+        if newsletter_send::issue_action(ctx.method, ctx.path).is_some() {
+            return newsletter_send::issue_route(
+                ctx.method, ctx.path, domain_ir, ctx.raw_body, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+            )
+            .await;
+        }
+        if ctx.method == "GET" && ctx.path == "/registrations" {
+            return Some(registrations_list_route(domain_ir, ctx.cookies, &secret, ctx.client, ctx.wasm_path, ctx.config).await);
+        }
+        // The tenant's payment connection: same gate as the checkout routes, since only the
+        // HECKS_CHECKOUT_DOMAIN domain carries one — any other domain served by this binary falls
+        // through as unknown.
+        if payments::owns(ctx.method, ctx.path) && checkout_enabled(checkout_domain().as_deref(), &ctx.config.domain) {
+            return payments::route(
+                ctx.method, ctx.path, ctx.raw_body, ctx.cookies, &secret, domain_ir, &payments::PlatformConfig::load().await,
+                ctx.client, ctx.wasm_path, ctx.config, ctx.invoker,
+            )
+            .await;
+        }
+        None
+    }
+
+    fn rate_rules(&self) -> Vec<RateRule> {
+        vec![
+            RateRule { name: "subscribe", method: "POST", path: "/newsletter/subscribers", limit_env: "HECKS_RATE_LIMIT_SUBSCRIBE", default_limit: 10 },
+            RateRule { name: "register", method: "POST", path: "/registrations", limit_env: "HECKS_RATE_LIMIT_REGISTER", default_limit: 15 },
+        ]
+    }
+
+    // Checkout on AWS keeps the business's payment keys in a named Secrets Manager secret; refuse
+    // before touching the database when none is named.
+    fn boot_check(&self, domain: &str) -> Result<(), String> {
+        payments::check_boot(checkout_enabled(checkout_domain().as_deref(), domain))
+    }
+
+    // RESEND_SECRET_ID: a failed fetch only logs -- mail is optional, and a missing secret must not
+    // stop the host from serving everything else (resend.rs answers 503 without a key). The same
+    // secret may also carry `webhook_secret`, the signing secret of the Resend webhook that
+    // POST /webhooks/resend verifies; without it that route answers 503.
+    async fn boot_secrets(&self, fetcher: &AwsSecretFetcher) {
+        let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") else { return };
+        let fetched = fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
+        let read = fetched.and_then(|json| secrets::extract_field(&json, "api_key").map(|api_key| (api_key, secrets::optional_field(&json, "webhook_secret"))));
+        match read {
+            Ok((api_key, webhook_secret)) => unsafe {
+                std::env::set_var("RESEND_API_KEY", api_key);
+                if let Some(webhook_secret) = webhook_secret {
+                    std::env::set_var("RESEND_WEBHOOK_SECRET", webhook_secret);
+                }
+            },
+            Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
+        }
+    }
+}

data/rust/host/src/web/newsletter.rs

@@ -2,7 +2,8 @@ use super::newsletter_send::{site_url, unsubscribe_token, unsubscribe_token_matc
 use super::{instances_for, last_refusal, respond};
 use crate::auth;
 use crate::dispatch;
-use crate::ir::{ir, newsletter_provider, NewsletterProvider};
+use crate::ir::ir;
+use crate::commerce_ir::{newsletter_provider, NewsletterProvider};
 use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
 use crate::resend::{Email, Mailer};

data/rust/host/src/web/newsletter_send.rs

@@ -1,7 +1,7 @@
 use super::{active_session_email, instances_for, last_refusal, percent_decode, respond};
 use crate::auth;
 use crate::dispatch;
-use crate::ir::{newsletter_issues_provider, newsletter_provider, NewsletterIssuesProvider, NewsletterProvider};
+use crate::commerce_ir::{newsletter_issues_provider, newsletter_provider, NewsletterIssuesProvider, NewsletterProvider};
 use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
 use crate::resend::{Email, Mailer};

data/rust/host/src/web/registration_receipt.rs

@@ -4,7 +4,7 @@
 
 use super::instances_for;
 use crate::dispatch;
-use crate::ir::PaymentsProvider;
+use crate::commerce_ir::PaymentsProvider;
 use crate::journal::LineageConfig;
 use crate::resend::{Email, Mailer};
 use serde_json::{json, Value};
@@ -82,7 +82,7 @@ pub(super) async fn send_receipt(reference: &str, client: &Mutex<Client>, wasm_p
     let Ok(read) = dispatch::read(client, wasm_path).await else {
         return;
     };
-    let binding = crate::ir::registrations_binding(&config.domain);
+    let binding = crate::commerce_ir::registrations_binding(&config.domain);
     let registrations = instances_for(&read, &binding.registration_prefix());
     let Some((_, registration)) = registrations.iter().find(|(id, _)| id == reference) else {
         return;