hecks 3.9.0 → 3.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f5088f868a4fb798d8295bdf93ad836ac63abeeac372d19ea486ed445587944
-  data.tar.gz: 526e4623eeb9947b2ccf74cf8599ee8f0820b677335c36f33905f20695fdb0bc
+  metadata.gz: d303c552c29899c933f31445d71ea42063a1b7cc5233cdef4a1d7392aa10201c
+  data.tar.gz: caa19c0f1639d2ca386465977a1c099336ee2c1e598399ee3b88122206d3c2b7
 SHA512:
-  metadata.gz: e6a604f67014c7c7136749ad1d2d661652083a5ab03274faa5531a221f0e6a27e81b4be0e0a464ec5d7253eac7ebc33aae342308fd58a724cc65d90f77d5a68c
-  data.tar.gz: c087ba04b615b664d1895fc040c75c4a906b330d080e24e360f9086b2893250f71cf7970d77253064e4ec91d1be12962497fce4097bcb8df66f45cbc1e31effe
+  metadata.gz: 3b2ee56f395214eee7e018c8ba28650b8f5f9ec97cc683b705037e19e37c96246fa4a380bbedb2aec9189ccb0361f3ef5f32e7af07cd5808531c1891e6e3011c
+  data.tar.gz: deb31a80d9d10f30898074608b3158e2e916989160d69cb632777c14dae4305dd2fe43d5da8561024625c0e24175fab7fc7998469854e00f16561ef1e2dd59cf

data/lib/hecks/projections/deploy/templates/lambda/template.yaml.tmpl

@@ -126,7 +126,7 @@ Resources:
           # triggers that first boot; a LATER real schema evolution
           # (era 2+) is a separate, later re-generation, not this one.
           HECKS_DOMAIN: @@declared_domain_name@@
-          # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/main.rs`'s
+          # UNCONDITIONAL, not gated on `rust_web` — `rust/host/src/boot.rs`'s
           # own boot sequence reads `ir::ir().ok_or(...)?` for every domain
           # regardless of web mode (era-lineage bookkeeping needs the IR, not
           # just the optional in-process web UI), so a Shared-mode domain with

data/lib/hecks/version.rb

@@ -1,5 +1,5 @@
 module Hecks
   # Read directly by the gemspec, so this file must never require the
   # rest of the gem (its dependencies aren't resolved yet at that point).
-  VERSION = "3.9.0".freeze
+  VERSION = "3.9.1".freeze
 end

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.9.0
+3.9.1

data/rust/host/src/boot.rs

@@ -0,0 +1,443 @@
+//! Lambda custom-runtime entry point (or a long-lived server under
+//! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
+
+use crate::{approval, auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server, storage_shape};
+
+use lambda_runtime::{service_fn, Error, LambdaEvent};
+use std::path::PathBuf;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+
+/// Boots the host: secrets, Postgres, wasm, era minting, then the Lambda runtime loop (or the
+/// long-lived server under HECKS_SERVE_MODE=1). Extensions are read from `extension::installed()`,
+/// so a binary that wants its own must `extension::install` them before calling this.
+pub async fn run() -> Result<(), Error> {
+    // HECKS_SERVE_MODE=1 switches the boot into the long-lived server
+    // loop below instead of the Lambda custom-runtime loop; every step
+    // from here through the era-minting sequence is shared, unchanged,
+    // by both modes.
+    let boot_started = std::time::Instant::now();
+    let serve_mode = std::env::var("HECKS_SERVE_MODE").as_deref() == Ok("1");
+
+    // HECKS_SESSION_COOKIE names the account cookie; refuse the boot
+    // here if it can't be written into a Set-Cookie header, rather
+    // than falling back silently at request time.
+    auth::resolve_account_cookie(std::env::var("HECKS_SESSION_COOKIE").ok().as_deref())?;
+
+    // DB_SECRET_ARN: the password is fetched from Secrets Manager here,
+    // at cold start, rather than trusted from a plaintext
+    // Environment.Variables value, which any principal with
+    // lambda:GetFunctionConfiguration could read regardless of the
+    // secret-at-rest protection its name suggests. Falls back to
+    // DATABASE_URL directly when DB_SECRET_ARN is absent (manual
+    // debugging over an SSM tunnel).
+    //
+    // The fetcher built here is reused below for GOOGLE_OAUTH_SECRET_ID
+    // and SESSION_SECRET_ARN too.
+    let secret_fetcher = secrets::AwsSecretFetcher::from_env().await;
+    let database_url = match std::env::var("DB_SECRET_ARN") {
+        Ok(secret_arn) => {
+            let db_host = std::env::var("DB_HOST").map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
+            let db_name = std::env::var("DB_NAME").map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
+            let secret_json = secret_fetcher
+                .fetch_secret_string(&secret_arn)
+                .await
+                .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
+            // The user and port come from the secret too (a client sharing an instance logs in as
+            // its own role); the password goes in literal, since parse_database_url below never
+            // percent-decodes it.
+            secrets::database_url(&secret_json, &db_host, &db_name)?
+        }
+        Err(_) => std::env::var("DATABASE_URL")
+            .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,
+    };
+
+    // GOOGLE_OAUTH_SECRET_ID/SESSION_SECRET_ARN: the same
+    // Secrets-Manager-at-cold-start approach as DB_SECRET_ARN above,
+    // applied to auth.rs's GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET and
+    // web.rs's SESSION_SECRET.
+    //
+    // Safety: this runs before any request is dispatched, so nothing
+    // else reads or writes the environment concurrently with these
+    // `set_var` calls.
+    if let Ok(oauth_secret_id) = std::env::var("GOOGLE_OAUTH_SECRET_ID") {
+        let secret_json = secret_fetcher
+            .fetch_secret_string(&oauth_secret_id)
+            .await
+            .map_err(|e| format!("fetching GOOGLE_OAUTH_SECRET_ID from Secrets Manager: {e:#}"))?;
+        let client_id = secrets::extract_field(&secret_json, "client_id")?;
+        let client_secret = secrets::extract_field(&secret_json, "client_secret")?;
+        unsafe {
+            std::env::set_var("GOOGLE_CLIENT_ID", client_id);
+            std::env::set_var("GOOGLE_CLIENT_SECRET", client_secret);
+        }
+    }
+    if let Ok(session_secret_arn) = std::env::var("SESSION_SECRET_ARN") {
+        let secret_json = secret_fetcher
+            .fetch_secret_string(&session_secret_arn)
+            .await
+            .map_err(|e| format!("fetching SESSION_SECRET_ARN from Secrets Manager: {e:#}"))?;
+        let session_secret = secrets::extract_field(&secret_json, "session_secret")?;
+        unsafe {
+            std::env::set_var("SESSION_SECRET", session_secret);
+        }
+    }
+    for extension in extension::installed() {
+        extension.boot_secrets(&secret_fetcher).await;
+    }
+    let wasm_path = PathBuf::from(
+        std::env::var("HECKS_WASM_PATH").unwrap_or_else(|_| "banking.wasm".to_string()),
+    );
+
+    // Must run before the Postgres connection opens -- `SET search_path`
+    // below has to run before `journal::ensure_schema` or anything else
+    // touches the connection, or unqualified names resolve against
+    // Postgres's default search_path instead of this domain's.
+    // HECKS_SCHEMA is optional.
+    let domain = std::env::var("HECKS_DOMAIN").map_err(|_| "HECKS_DOMAIN is required")?;
+    let schema = std::env::var("HECKS_SCHEMA").ok().filter(|s| !s.is_empty());
+    // Checkout on AWS keeps the business's payment keys in a named Secrets
+    // Manager secret; refuse before touching the database when none is named.
+    for extension in extension::installed() {
+        extension.boot_check(&domain)?;
+    }
+
+    // RDS refuses a plain NoTls connection by default and needs AWS's
+    // own RDS CA specifically, not a generic public bundle (see
+    // Cargo.toml).
+    let mut roots = rustls::RootCertStore::empty();
+    for cert in rustls_pemfile::certs(&mut include_bytes!("../rds-ca-bundle.pem").as_slice()) {
+        roots.add(cert.map_err(|e| format!("parsing rds-ca-bundle.pem: {e}"))?)?;
+    }
+    let tls_config = rustls::ClientConfig::builder()
+        .with_root_certificates(roots)
+        .with_no_client_auth();
+    let tls = tokio_postgres_rustls::MakeRustlsConnect::new(tls_config);
+    // Not tokio_postgres::connect(url, tls) -- that treats DATABASE_URL
+    // as a strict URI, and RDS-generated passwords can contain
+    // URI-reserved `?`/`#` that CloudFormation never percent-encodes.
+    let mut config = parse_database_url(&database_url)?;
+    // RDS requires TLS (rds-ca-bundle.pem); local Postgres over loopback
+    // can't be verified against the RDS CA, so localhost uses NoTls.
+    let local_postgres = database_url_is_local(&config);
+    if !local_postgres {
+        config.ssl_mode(tokio_postgres::config::SslMode::Require);
+    }
+    // NoTlsStream and RustlsStream can't unify in one branch, so the
+    // two paths are spawned separately.
+    let connect_phase = log::phase_with("db_connect", serde_json::json!({ "tls": !local_postgres }));
+    let client = if local_postgres {
+        let (client, connection) = config
+            .connect(tokio_postgres::NoTls)
+            .await
+            .map_err(|e| format!("connecting to Postgres via DATABASE_URL: {e:?}"))?;
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("postgres connection error: {e:#}");
+            }
+        });
+        client
+    } else {
+        let (client, connection) = config
+            .connect(tls)
+            .await
+            .map_err(|e| format!("connecting to Postgres via DATABASE_URL: {e:?}"))?;
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                eprintln!("postgres connection error: {e:#}");
+            }
+        });
+        client
+    };
+
+    connect_phase.end();
+
+    // Every unqualified table/view reference this binary issues
+    // resolves through search_path, so this is what makes a shared
+    // instance's per-domain schemas transparent to the rest of the
+    // binary.
+    //
+    // CREATE SCHEMA before SET search_path: setting search_path to a
+    // schema that doesn't exist yet succeeds in Postgres, so a missing
+    // schema only surfaces later as a confusing "no schema has been
+    // selected to create in" error from `ensure_schema`. Idempotent: an
+    // existing schema is the ordinary case on every boot after the first.
+    if let Some(schema) = &schema {
+        client
+            .batch_execute(&format!("CREATE SCHEMA IF NOT EXISTS {}", journal::quote_ident(schema)))
+            .await
+            .map_err(|e| format!("creating schema {schema:?}: {e:#}"))?;
+        client
+            .batch_execute(&format!("SET search_path TO {}", journal::quote_ident(schema)))
+            .await
+            .map_err(|e| format!("setting search_path to {schema:?}: {e:#}"))?;
+    }
+
+    let phase = log::phase("ensure_schema");
+    journal::ensure_schema(&client)
+        .await
+        .map_err(|e| format!("provisioning hecks_lambda_journal: {e:#}"))?;
+    phase.end();
+
+    let ir = ir::ir().ok_or("HECKS_IR_PATH is not set or unreadable — this binary needs its own domain's ir.json sidecar")?;
+    ir::refuse_unsupported_persistence_adapters(ir)?;
+    let my_hash = storage_shape::mint_hash(ir);
+    let my_label = storage_shape::mint_label(ir);
+
+    let mut aggregates: Vec<mint::Aggregate> = ir::lineage_capable_aggregates(ir)
+        .into_iter()
+        .map(|(qualified, storage_name)| {
+            let name = qualified.rsplit("::").next().unwrap_or(&qualified).to_string();
+            mint::Aggregate { name, storage_name }
+        })
+        .collect();
+    // A chapter that `provides "membership"` names who may sign in; that
+    // aggregate can be vendored, so it may be missing from this domain's
+    // lineage-capable list. Mint its head anyway for Google-auth to read.
+    if let Some(membership) = ir::membership_provider(ir) {
+        let name = membership.aggregate.rsplit("::").next().unwrap_or(&membership.aggregate).to_string();
+        let storage_name = journal::snake(&name);
+        if !aggregates.iter().any(|a| a.storage_name == storage_name) {
+            aggregates.push(mint::Aggregate { name, storage_name });
+        }
+    }
+
+    // The era-partitioned lineage subsystem is provisioned only when
+    // something needs it: a lineage-capable aggregate, or Google auth
+    // configured (ADR 0034 requires it for Member sessions either way).
+    let needs_lineage = !aggregates.is_empty() || std::env::var("GOOGLE_CLIENT_ID").is_ok();
+
+    let era: Option<i32> = if needs_lineage {
+        // Idempotent (gated by `provisioner?`); must run before the
+        // first `journal::held_eras` call, since `hecks_eras` doesn't
+        // exist yet on a truly fresh Postgres instance.
+        let phase = log::phase("ensure_base");
+        mint::ensure_base(&client, &domain).await.map_err(|e| format!("provisioning hecks_eras for {domain}: {e:#}"))?;
+        phase.end();
+
+        // Compares this binary's own shape hash (`storage_shape`, over
+        // `ir::ir()`) against held eras to decide the boot action: boot
+        // at a matching era, mint era 1 if the domain is new, or mint
+        // the next era if it has drifted -- refusing toward
+        // `hecks scaffold_translation` (no edge covers it) or
+        // `hecks audit_translation --approve` (needs review) otherwise.
+        let era_phase = log::phase("era_resolve");
+        let held = journal::held_eras(&client, &domain).await.map_err(|e| format!("checking hecks_eras for {domain}: {e:#}"))?;
+
+        // The decision itself is a pure, unit-tested function
+        // (`mint::decide_boot_action`); everything below just carries
+        // out whichever of its four outcomes came back.
+        let decision = mint::decide_boot_action(&held, &my_label);
+        era_phase.end_with(serde_json::json!({ "held_eras": held.len(), "decision": decision.name() }));
+        let ordinal: i32 = match decision {
+            // Adopting an existing era still provisions what this binary
+            // is about to write into, the same as minting does --
+            // skipping it would let a matched-era host write into
+            // head-snapshot tables that were never created.
+            mint::BootDecision::UseExisting { ordinal } => {
+                let phase = log::phase_with("adopt_head_snapshots", serde_json::json!({ "era": ordinal }));
+                mint::adopt_head_snapshots(&client, &domain, &aggregates, ordinal)
+                    .await
+                    .map_err(|e| format!("adopting era {ordinal} of {domain}: {e:#}"))?;
+                phase.end();
+                ordinal
+            }
+            mint::BootDecision::HoldFirst => {
+                let source_text =
+                    ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
+                let phase = log::phase_with("hold_first", serde_json::json!({ "era": 1 }));
+                mint::hold_first(&client, &domain, source_text, ir, &aggregates, None).await.map_err(|e| format!("minting era 1 of {domain}: {e:#}"))?;
+                phase.end();
+                1
+            }
+            mint::BootDecision::LatestUnnamed { ordinal } => {
+                return Err(format!(
+                    "cannot boot: {domain}'s latest held era (ordinal {ordinal}) has no name yet -- this crate can't \
+                     name it itself (no bluebook parser, ADR 0012's own boundary) -- boot Ruby once against this \
+                     database to name it (Runtime::EraCheck's own lazy-naming path), then redeploy",
+                )
+                .into());
+            }
+            mint::BootDecision::Mint { ordinal, from_ordinal, from_label } => {
+                let mut labels: Vec<String> = held.iter().map(|held_era| held_era.label.clone().unwrap_or_default()).collect();
+                labels.push(my_label.clone());
+                let edges = mint::parse_edges(ir, &domain);
+                let chain = mint::edge_chain(&edges, &labels).map_err(|e| {
+                    format!(
+                        "cannot boot: {domain} has drifted from era {from_ordinal} ({from_label}) to a shape \
+                         ({my_label}) no translation edge covers -- {e} -- run hecks scaffold_translation, review it \
+                         with hecks audit_translation, then redeploy",
+                    )
+                })?;
+
+                // Checks every edge in the chain with a compute/rekey
+                // rule, not just the newest -- a chain can carry more
+                // than one, matched against the raw ir.json edge
+                // (digest-relevant shape) by the same from/to pair.
+                let raw_edges = ir.get("translations").and_then(serde_json::Value::as_array).cloned().unwrap_or_default();
+                let committed_approvals = approval::committed(ir);
+                let approval_phase = log::phase_with("approval_check", serde_json::json!({ "edges": chain.len(), "committed": committed_approvals.len() }));
+                for edge in &chain {
+                    let Some(raw_edge) = raw_edges.iter().find(|candidate| {
+                        candidate.get("domain").and_then(serde_json::Value::as_str) == Some(domain.as_str())
+                            && candidate.get("from").and_then(serde_json::Value::as_str) == Some(edge.from.as_str())
+                            && candidate.get("to").and_then(serde_json::Value::as_str) == Some(edge.to.as_str())
+                    }) else {
+                        return Err(format!("cannot boot: {domain}'s edge {} -> {} vanished between parsing and approval-checking it", edge.from, edge.to).into());
+                    };
+                    approval::check(&client, &domain, raw_edge, ordinal, &committed_approvals).await.map_err(|e| format!("{e:#}"))?;
+                }
+                approval_phase.end();
+
+                // Runs before anything is minted, over the live compiled
+                // chain (plain SELECTs, never a persisted matview), so a
+                // refusal leaves no half-born era.
+                let watermarks: std::collections::HashMap<i32, Option<i64>> = held.iter().map(|held_era| (held_era.ordinal, held_era.watermark)).collect();
+                let audit_phase = log::phase_with("audit_before_mint", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
+                mint::audit_before_mint(&client, &domain, ir, &aggregates, ordinal, &chain, &raw_edges, &watermarks)
+                    .await
+                    .map_err(|e| format!("{e:#}"))?;
+                audit_phase.end();
+
+                let held_text = ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
+                let mint_phase = log::phase_with("mint_era", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
+                mint::mint_era(&client, &domain, ordinal, &my_hash, &my_label, held_text, &aggregates, &chain, None, &mint::lifecycle_defaults(ir))
+                    .await
+                    .map_err(|e| format!("minting era {ordinal} of {domain}: {e:#}"))?;
+                mint_phase.end();
+                ordinal
+            }
+        };
+        Some(ordinal)
+    } else {
+        None
+    };
+
+    // The mirrored set is the IR's own capable list, by qualified name
+    // -- never "everything this kernel can mutate". A domain that binds
+    // everything to plain `Postgres` mirrors nothing.
+    let mirrored = ir::mirrored_aggregates(ir);
+    let lineage_config = Arc::new(journal::LineageConfig { domain, era, mirrored: Some(mirrored) });
+
+    // Mutex, not a bare Arc<Client> -- dispatch::handle needs
+    // Client::transaction (&mut Client) to hold the advisory lock
+    // across the rehydrate-then-append sequence (see dispatch.rs).
+    let client = Arc::new(Mutex::new(client));
+    let wasm_path = Arc::new(wasm_path);
+    // One invoker for this process's lifetime -- credentials/region
+    // resolve once at boot, not per invocation. See lambda_client.rs:
+    // the compiled `.wasm` module can't dispatch this itself (no
+    // network inside that sandbox).
+    let invoker = Arc::new(lambda_client::AwsLambdaInvoker::from_env().await);
+
+    // `role` is optional, mirroring `args`: an absent key means no
+    // caller asserted a role, and `dispatch::handle`'s `check_role`
+    // stays on its unchecked path. Read by `server::dispatch_body` below.
+    if serve_mode {
+        log::info(
+            "boot",
+            serde_json::json!({ "mode": "serve", "domain": &lineage_config.domain, "era": &my_label, "boot_ms": boot_started.elapsed().as_millis() as u64 }),
+        );
+        let version = server::version_body(&my_label, &my_hash, std::env::var("HECKS_BUILD").ok().as_deref());
+        let limits = Arc::new(rate_limit::RateLimits::from_env());
+        let state = server::ServerState { client, wasm_path, lineage_config, invoker, limits };
+        return server::serve(state, version).await;
+    }
+
+    lambda_runtime::run(service_fn(move |event: LambdaEvent<serde_json::Value>| {
+        let client = Arc::clone(&client);
+        let wasm_path = Arc::clone(&wasm_path);
+        let lineage_config = Arc::clone(&lineage_config);
+        let invoker = Arc::clone(&invoker);
+        async move {
+            let (body, _context) = event.into_parts();
+            server::dispatch_body(body, &client, &wasm_path, &lineage_config, invoker.as_ref()).await
+        }
+    }))
+    .await
+}
+
+// Parses `postgres://user:password@host:port/db` without treating it
+// as a URI -- an RDS/Aurora auto-generated password can contain
+// `?`/`#`, which a strict URI parser would treat as delimiters.
+fn parse_database_url(url: &str) -> Result<tokio_postgres::Config, String> {
+    let rest = url
+        .strip_prefix("postgres://")
+        .or_else(|| url.strip_prefix("postgresql://"))
+        .ok_or_else(|| format!("DATABASE_URL doesn't start with postgres:// or postgresql://"))?;
+
+    let (authority, db_and_query) = rest
+        .split_once('/')
+        .ok_or_else(|| "DATABASE_URL has no '/' separating host from database name".to_string())?;
+    let dbname = db_and_query.split(['?', '#']).next().unwrap_or(db_and_query);
+
+    let (credentials, host_and_port) = match authority.rsplit_once('@') {
+        Some((credentials, host_and_port)) => (Some(credentials), host_and_port),
+        None => (None, authority),
+    };
+    let (host, port) = match host_and_port.rsplit_once(':') {
+        Some((host, port)) => {
+            let port: u16 = port
+                .parse()
+                .map_err(|e| format!("DATABASE_URL's port {port:?} isn't a valid number: {e}"))?;
+            (host, port)
+        }
+        None => (host_and_port, 5432),
+    };
+
+    let mut config = tokio_postgres::Config::new();
+    config.host(host).port(port).dbname(dbname);
+    if let Some(credentials) = credentials {
+        match credentials.split_once(':') {
+            Some((user, password)) => {
+                config.user(user).password(password);
+            }
+            None => {
+                config.user(credentials);
+            }
+        }
+    }
+    Ok(config)
+}
+
+fn database_url_is_local(config: &tokio_postgres::Config) -> bool {
+    use tokio_postgres::config::Host;
+    config.get_hosts().iter().any(|host| match host {
+        Host::Tcp(name) => name == "localhost" || name == "127.0.0.1" || name == "::1",
+        _ => false,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_a_password_with_uri_reserved_characters() {
+        let config = parse_database_url(
+            "postgres://postgres:T3st$Pa?#ss*>Word@db.example.com:5432/pizzas",
+        )
+        .expect("should parse despite ?/# in the password");
+        assert_eq!(config.get_hosts().len(), 1);
+        assert_eq!(config.get_ports(), &[5432]);
+        assert_eq!(config.get_user(), Some("postgres"));
+        assert_eq!(config.get_dbname(), Some("pizzas"));
+    }
+
+    #[test]
+    fn parses_a_plain_password_too() {
+        let config = parse_database_url("postgres://postgres:plainpassword@localhost:5432/pizzas")
+            .expect("should parse a password with no special characters");
+        assert_eq!(config.get_user(), Some("postgres"));
+        assert_eq!(config.get_dbname(), Some("pizzas"));
+    }
+
+    #[test]
+    fn parses_a_local_url_with_no_user_or_port() {
+        let config = parse_database_url("postgres://localhost/app_development")
+            .expect("should parse a peer-auth local URL");
+        assert_eq!(config.get_dbname(), Some("app_development"));
+        assert_eq!(config.get_ports(), &[5432]);
+        assert!(database_url_is_local(&config));
+    }
+}

data/rust/host/src/lib.rs

@@ -4,6 +4,7 @@
 pub mod api;
 pub mod approval;
 pub mod auth;
+pub mod boot;
 pub mod checkout;
 pub mod commerce_ir;
 pub mod dispatch;

data/rust/host/src/main.rs

@@ -1,441 +1,7 @@
-//! Lambda custom-runtime entry point (or a long-lived server under
-//! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
-
-use rust_host::{approval, auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server, storage_shape};
-
-use lambda_runtime::{service_fn, Error, LambdaEvent};
-use std::path::PathBuf;
-use std::sync::Arc;
-use tokio::sync::Mutex;
+//! Lambda custom-runtime entry point (or a long-lived server under HECKS_SERVE_MODE=1): installs no
+//! extensions of its own, so the host runs with its defaults. See `rust_host::boot::run`.
 
 #[tokio::main]
-async fn main() -> Result<(), Error> {
-    // HECKS_SERVE_MODE=1 switches the boot into the long-lived server
-    // loop below instead of the Lambda custom-runtime loop; every step
-    // from here through the era-minting sequence is shared, unchanged,
-    // by both modes.
-    let boot_started = std::time::Instant::now();
-    let serve_mode = std::env::var("HECKS_SERVE_MODE").as_deref() == Ok("1");
-
-    // HECKS_SESSION_COOKIE names the account cookie; refuse the boot
-    // here if it can't be written into a Set-Cookie header, rather
-    // than falling back silently at request time.
-    auth::resolve_account_cookie(std::env::var("HECKS_SESSION_COOKIE").ok().as_deref())?;
-
-    // DB_SECRET_ARN: the password is fetched from Secrets Manager here,
-    // at cold start, rather than trusted from a plaintext
-    // Environment.Variables value, which any principal with
-    // lambda:GetFunctionConfiguration could read regardless of the
-    // secret-at-rest protection its name suggests. Falls back to
-    // DATABASE_URL directly when DB_SECRET_ARN is absent (manual
-    // debugging over an SSM tunnel).
-    //
-    // The fetcher built here is reused below for GOOGLE_OAUTH_SECRET_ID
-    // and SESSION_SECRET_ARN too.
-    let secret_fetcher = secrets::AwsSecretFetcher::from_env().await;
-    let database_url = match std::env::var("DB_SECRET_ARN") {
-        Ok(secret_arn) => {
-            let db_host = std::env::var("DB_HOST").map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
-            let db_name = std::env::var("DB_NAME").map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
-            let secret_json = secret_fetcher
-                .fetch_secret_string(&secret_arn)
-                .await
-                .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
-            // The user and port come from the secret too (a client sharing an instance logs in as
-            // its own role); the password goes in literal, since parse_database_url below never
-            // percent-decodes it.
-            secrets::database_url(&secret_json, &db_host, &db_name)?
-        }
-        Err(_) => std::env::var("DATABASE_URL")
-            .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,
-    };
-
-    // GOOGLE_OAUTH_SECRET_ID/SESSION_SECRET_ARN: the same
-    // Secrets-Manager-at-cold-start approach as DB_SECRET_ARN above,
-    // applied to auth.rs's GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET and
-    // web.rs's SESSION_SECRET.
-    //
-    // Safety: this runs before any request is dispatched, so nothing
-    // else reads or writes the environment concurrently with these
-    // `set_var` calls.
-    if let Ok(oauth_secret_id) = std::env::var("GOOGLE_OAUTH_SECRET_ID") {
-        let secret_json = secret_fetcher
-            .fetch_secret_string(&oauth_secret_id)
-            .await
-            .map_err(|e| format!("fetching GOOGLE_OAUTH_SECRET_ID from Secrets Manager: {e:#}"))?;
-        let client_id = secrets::extract_field(&secret_json, "client_id")?;
-        let client_secret = secrets::extract_field(&secret_json, "client_secret")?;
-        unsafe {
-            std::env::set_var("GOOGLE_CLIENT_ID", client_id);
-            std::env::set_var("GOOGLE_CLIENT_SECRET", client_secret);
-        }
-    }
-    if let Ok(session_secret_arn) = std::env::var("SESSION_SECRET_ARN") {
-        let secret_json = secret_fetcher
-            .fetch_secret_string(&session_secret_arn)
-            .await
-            .map_err(|e| format!("fetching SESSION_SECRET_ARN from Secrets Manager: {e:#}"))?;
-        let session_secret = secrets::extract_field(&secret_json, "session_secret")?;
-        unsafe {
-            std::env::set_var("SESSION_SECRET", session_secret);
-        }
-    }
-    for extension in extension::installed() {
-        extension.boot_secrets(&secret_fetcher).await;
-    }
-    let wasm_path = PathBuf::from(
-        std::env::var("HECKS_WASM_PATH").unwrap_or_else(|_| "banking.wasm".to_string()),
-    );
-
-    // Must run before the Postgres connection opens -- `SET search_path`
-    // below has to run before `journal::ensure_schema` or anything else
-    // touches the connection, or unqualified names resolve against
-    // Postgres's default search_path instead of this domain's.
-    // HECKS_SCHEMA is optional.
-    let domain = std::env::var("HECKS_DOMAIN").map_err(|_| "HECKS_DOMAIN is required")?;
-    let schema = std::env::var("HECKS_SCHEMA").ok().filter(|s| !s.is_empty());
-    // Checkout on AWS keeps the business's payment keys in a named Secrets
-    // Manager secret; refuse before touching the database when none is named.
-    for extension in extension::installed() {
-        extension.boot_check(&domain)?;
-    }
-
-    // RDS refuses a plain NoTls connection by default and needs AWS's
-    // own RDS CA specifically, not a generic public bundle (see
-    // Cargo.toml).
-    let mut roots = rustls::RootCertStore::empty();
-    for cert in rustls_pemfile::certs(&mut include_bytes!("../rds-ca-bundle.pem").as_slice()) {
-        roots.add(cert.map_err(|e| format!("parsing rds-ca-bundle.pem: {e}"))?)?;
-    }
-    let tls_config = rustls::ClientConfig::builder()
-        .with_root_certificates(roots)
-        .with_no_client_auth();
-    let tls = tokio_postgres_rustls::MakeRustlsConnect::new(tls_config);
-    // Not tokio_postgres::connect(url, tls) -- that treats DATABASE_URL
-    // as a strict URI, and RDS-generated passwords can contain
-    // URI-reserved `?`/`#` that CloudFormation never percent-encodes.
-    let mut config = parse_database_url(&database_url)?;
-    // RDS requires TLS (rds-ca-bundle.pem); local Postgres over loopback
-    // can't be verified against the RDS CA, so localhost uses NoTls.
-    let local_postgres = database_url_is_local(&config);
-    if !local_postgres {
-        config.ssl_mode(tokio_postgres::config::SslMode::Require);
-    }
-    // NoTlsStream and RustlsStream can't unify in one branch, so the
-    // two paths are spawned separately.
-    let connect_phase = log::phase_with("db_connect", serde_json::json!({ "tls": !local_postgres }));
-    let client = if local_postgres {
-        let (client, connection) = config
-            .connect(tokio_postgres::NoTls)
-            .await
-            .map_err(|e| format!("connecting to Postgres via DATABASE_URL: {e:?}"))?;
-        tokio::spawn(async move {
-            if let Err(e) = connection.await {
-                eprintln!("postgres connection error: {e:#}");
-            }
-        });
-        client
-    } else {
-        let (client, connection) = config
-            .connect(tls)
-            .await
-            .map_err(|e| format!("connecting to Postgres via DATABASE_URL: {e:?}"))?;
-        tokio::spawn(async move {
-            if let Err(e) = connection.await {
-                eprintln!("postgres connection error: {e:#}");
-            }
-        });
-        client
-    };
-
-    connect_phase.end();
-
-    // Every unqualified table/view reference this binary issues
-    // resolves through search_path, so this is what makes a shared
-    // instance's per-domain schemas transparent to the rest of the
-    // binary.
-    //
-    // CREATE SCHEMA before SET search_path: setting search_path to a
-    // schema that doesn't exist yet succeeds in Postgres, so a missing
-    // schema only surfaces later as a confusing "no schema has been
-    // selected to create in" error from `ensure_schema`. Idempotent: an
-    // existing schema is the ordinary case on every boot after the first.
-    if let Some(schema) = &schema {
-        client
-            .batch_execute(&format!("CREATE SCHEMA IF NOT EXISTS {}", journal::quote_ident(schema)))
-            .await
-            .map_err(|e| format!("creating schema {schema:?}: {e:#}"))?;
-        client
-            .batch_execute(&format!("SET search_path TO {}", journal::quote_ident(schema)))
-            .await
-            .map_err(|e| format!("setting search_path to {schema:?}: {e:#}"))?;
-    }
-
-    let phase = log::phase("ensure_schema");
-    journal::ensure_schema(&client)
-        .await
-        .map_err(|e| format!("provisioning hecks_lambda_journal: {e:#}"))?;
-    phase.end();
-
-    let ir = ir::ir().ok_or("HECKS_IR_PATH is not set or unreadable — this binary needs its own domain's ir.json sidecar")?;
-    ir::refuse_unsupported_persistence_adapters(ir)?;
-    let my_hash = storage_shape::mint_hash(ir);
-    let my_label = storage_shape::mint_label(ir);
-
-    let mut aggregates: Vec<mint::Aggregate> = ir::lineage_capable_aggregates(ir)
-        .into_iter()
-        .map(|(qualified, storage_name)| {
-            let name = qualified.rsplit("::").next().unwrap_or(&qualified).to_string();
-            mint::Aggregate { name, storage_name }
-        })
-        .collect();
-    // A chapter that `provides "membership"` names who may sign in; that
-    // aggregate can be vendored, so it may be missing from this domain's
-    // lineage-capable list. Mint its head anyway for Google-auth to read.
-    if let Some(membership) = ir::membership_provider(ir) {
-        let name = membership.aggregate.rsplit("::").next().unwrap_or(&membership.aggregate).to_string();
-        let storage_name = journal::snake(&name);
-        if !aggregates.iter().any(|a| a.storage_name == storage_name) {
-            aggregates.push(mint::Aggregate { name, storage_name });
-        }
-    }
-
-    // The era-partitioned lineage subsystem is provisioned only when
-    // something needs it: a lineage-capable aggregate, or Google auth
-    // configured (ADR 0034 requires it for Member sessions either way).
-    let needs_lineage = !aggregates.is_empty() || std::env::var("GOOGLE_CLIENT_ID").is_ok();
-
-    let era: Option<i32> = if needs_lineage {
-        // Idempotent (gated by `provisioner?`); must run before the
-        // first `journal::held_eras` call, since `hecks_eras` doesn't
-        // exist yet on a truly fresh Postgres instance.
-        let phase = log::phase("ensure_base");
-        mint::ensure_base(&client, &domain).await.map_err(|e| format!("provisioning hecks_eras for {domain}: {e:#}"))?;
-        phase.end();
-
-        // Compares this binary's own shape hash (`storage_shape`, over
-        // `ir::ir()`) against held eras to decide the boot action: boot
-        // at a matching era, mint era 1 if the domain is new, or mint
-        // the next era if it has drifted -- refusing toward
-        // `hecks scaffold_translation` (no edge covers it) or
-        // `hecks audit_translation --approve` (needs review) otherwise.
-        let era_phase = log::phase("era_resolve");
-        let held = journal::held_eras(&client, &domain).await.map_err(|e| format!("checking hecks_eras for {domain}: {e:#}"))?;
-
-        // The decision itself is a pure, unit-tested function
-        // (`mint::decide_boot_action`); everything below just carries
-        // out whichever of its four outcomes came back.
-        let decision = mint::decide_boot_action(&held, &my_label);
-        era_phase.end_with(serde_json::json!({ "held_eras": held.len(), "decision": decision.name() }));
-        let ordinal: i32 = match decision {
-            // Adopting an existing era still provisions what this binary
-            // is about to write into, the same as minting does --
-            // skipping it would let a matched-era host write into
-            // head-snapshot tables that were never created.
-            mint::BootDecision::UseExisting { ordinal } => {
-                let phase = log::phase_with("adopt_head_snapshots", serde_json::json!({ "era": ordinal }));
-                mint::adopt_head_snapshots(&client, &domain, &aggregates, ordinal)
-                    .await
-                    .map_err(|e| format!("adopting era {ordinal} of {domain}: {e:#}"))?;
-                phase.end();
-                ordinal
-            }
-            mint::BootDecision::HoldFirst => {
-                let source_text =
-                    ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
-                let phase = log::phase_with("hold_first", serde_json::json!({ "era": 1 }));
-                mint::hold_first(&client, &domain, source_text, ir, &aggregates, None).await.map_err(|e| format!("minting era 1 of {domain}: {e:#}"))?;
-                phase.end();
-                1
-            }
-            mint::BootDecision::LatestUnnamed { ordinal } => {
-                return Err(format!(
-                    "cannot boot: {domain}'s latest held era (ordinal {ordinal}) has no name yet -- this crate can't \
-                     name it itself (no bluebook parser, ADR 0012's own boundary) -- boot Ruby once against this \
-                     database to name it (Runtime::EraCheck's own lazy-naming path), then redeploy",
-                )
-                .into());
-            }
-            mint::BootDecision::Mint { ordinal, from_ordinal, from_label } => {
-                let mut labels: Vec<String> = held.iter().map(|held_era| held_era.label.clone().unwrap_or_default()).collect();
-                labels.push(my_label.clone());
-                let edges = mint::parse_edges(ir, &domain);
-                let chain = mint::edge_chain(&edges, &labels).map_err(|e| {
-                    format!(
-                        "cannot boot: {domain} has drifted from era {from_ordinal} ({from_label}) to a shape \
-                         ({my_label}) no translation edge covers -- {e} -- run hecks scaffold_translation, review it \
-                         with hecks audit_translation, then redeploy",
-                    )
-                })?;
-
-                // Checks every edge in the chain with a compute/rekey
-                // rule, not just the newest -- a chain can carry more
-                // than one, matched against the raw ir.json edge
-                // (digest-relevant shape) by the same from/to pair.
-                let raw_edges = ir.get("translations").and_then(serde_json::Value::as_array).cloned().unwrap_or_default();
-                let committed_approvals = approval::committed(ir);
-                let approval_phase = log::phase_with("approval_check", serde_json::json!({ "edges": chain.len(), "committed": committed_approvals.len() }));
-                for edge in &chain {
-                    let Some(raw_edge) = raw_edges.iter().find(|candidate| {
-                        candidate.get("domain").and_then(serde_json::Value::as_str) == Some(domain.as_str())
-                            && candidate.get("from").and_then(serde_json::Value::as_str) == Some(edge.from.as_str())
-                            && candidate.get("to").and_then(serde_json::Value::as_str) == Some(edge.to.as_str())
-                    }) else {
-                        return Err(format!("cannot boot: {domain}'s edge {} -> {} vanished between parsing and approval-checking it", edge.from, edge.to).into());
-                    };
-                    approval::check(&client, &domain, raw_edge, ordinal, &committed_approvals).await.map_err(|e| format!("{e:#}"))?;
-                }
-                approval_phase.end();
-
-                // Runs before anything is minted, over the live compiled
-                // chain (plain SELECTs, never a persisted matview), so a
-                // refusal leaves no half-born era.
-                let watermarks: std::collections::HashMap<i32, Option<i64>> = held.iter().map(|held_era| (held_era.ordinal, held_era.watermark)).collect();
-                let audit_phase = log::phase_with("audit_before_mint", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
-                mint::audit_before_mint(&client, &domain, ir, &aggregates, ordinal, &chain, &raw_edges, &watermarks)
-                    .await
-                    .map_err(|e| format!("{e:#}"))?;
-                audit_phase.end();
-
-                let held_text = ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
-                let mint_phase = log::phase_with("mint_era", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
-                mint::mint_era(&client, &domain, ordinal, &my_hash, &my_label, held_text, &aggregates, &chain, None, &mint::lifecycle_defaults(ir))
-                    .await
-                    .map_err(|e| format!("minting era {ordinal} of {domain}: {e:#}"))?;
-                mint_phase.end();
-                ordinal
-            }
-        };
-        Some(ordinal)
-    } else {
-        None
-    };
-
-    // The mirrored set is the IR's own capable list, by qualified name
-    // -- never "everything this kernel can mutate". A domain that binds
-    // everything to plain `Postgres` mirrors nothing.
-    let mirrored = ir::mirrored_aggregates(ir);
-    let lineage_config = Arc::new(journal::LineageConfig { domain, era, mirrored: Some(mirrored) });
-
-    // Mutex, not a bare Arc<Client> -- dispatch::handle needs
-    // Client::transaction (&mut Client) to hold the advisory lock
-    // across the rehydrate-then-append sequence (see dispatch.rs).
-    let client = Arc::new(Mutex::new(client));
-    let wasm_path = Arc::new(wasm_path);
-    // One invoker for this process's lifetime -- credentials/region
-    // resolve once at boot, not per invocation. See lambda_client.rs:
-    // the compiled `.wasm` module can't dispatch this itself (no
-    // network inside that sandbox).
-    let invoker = Arc::new(lambda_client::AwsLambdaInvoker::from_env().await);
-
-    // `role` is optional, mirroring `args`: an absent key means no
-    // caller asserted a role, and `dispatch::handle`'s `check_role`
-    // stays on its unchecked path. Read by `server::dispatch_body` below.
-    if serve_mode {
-        log::info(
-            "boot",
-            serde_json::json!({ "mode": "serve", "domain": &lineage_config.domain, "era": &my_label, "boot_ms": boot_started.elapsed().as_millis() as u64 }),
-        );
-        let version = server::version_body(&my_label, &my_hash, std::env::var("HECKS_BUILD").ok().as_deref());
-        let limits = Arc::new(rate_limit::RateLimits::from_env());
-        let state = server::ServerState { client, wasm_path, lineage_config, invoker, limits };
-        return server::serve(state, version).await;
-    }
-
-    lambda_runtime::run(service_fn(move |event: LambdaEvent<serde_json::Value>| {
-        let client = Arc::clone(&client);
-        let wasm_path = Arc::clone(&wasm_path);
-        let lineage_config = Arc::clone(&lineage_config);
-        let invoker = Arc::clone(&invoker);
-        async move {
-            let (body, _context) = event.into_parts();
-            server::dispatch_body(body, &client, &wasm_path, &lineage_config, invoker.as_ref()).await
-        }
-    }))
-    .await
-}
-
-// Parses `postgres://user:password@host:port/db` without treating it
-// as a URI -- an RDS/Aurora auto-generated password can contain
-// `?`/`#`, which a strict URI parser would treat as delimiters.
-fn parse_database_url(url: &str) -> Result<tokio_postgres::Config, String> {
-    let rest = url
-        .strip_prefix("postgres://")
-        .or_else(|| url.strip_prefix("postgresql://"))
-        .ok_or_else(|| format!("DATABASE_URL doesn't start with postgres:// or postgresql://"))?;
-
-    let (authority, db_and_query) = rest
-        .split_once('/')
-        .ok_or_else(|| "DATABASE_URL has no '/' separating host from database name".to_string())?;
-    let dbname = db_and_query.split(['?', '#']).next().unwrap_or(db_and_query);
-
-    let (credentials, host_and_port) = match authority.rsplit_once('@') {
-        Some((credentials, host_and_port)) => (Some(credentials), host_and_port),
-        None => (None, authority),
-    };
-    let (host, port) = match host_and_port.rsplit_once(':') {
-        Some((host, port)) => {
-            let port: u16 = port
-                .parse()
-                .map_err(|e| format!("DATABASE_URL's port {port:?} isn't a valid number: {e}"))?;
-            (host, port)
-        }
-        None => (host_and_port, 5432),
-    };
-
-    let mut config = tokio_postgres::Config::new();
-    config.host(host).port(port).dbname(dbname);
-    if let Some(credentials) = credentials {
-        match credentials.split_once(':') {
-            Some((user, password)) => {
-                config.user(user).password(password);
-            }
-            None => {
-                config.user(credentials);
-            }
-        }
-    }
-    Ok(config)
-}
-
-fn database_url_is_local(config: &tokio_postgres::Config) -> bool {
-    use tokio_postgres::config::Host;
-    config.get_hosts().iter().any(|host| match host {
-        Host::Tcp(name) => name == "localhost" || name == "127.0.0.1" || name == "::1",
-        _ => false,
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_a_password_with_uri_reserved_characters() {
-        let config = parse_database_url(
-            "postgres://postgres:T3st$Pa?#ss*>Word@db.example.com:5432/pizzas",
-        )
-        .expect("should parse despite ?/# in the password");
-        assert_eq!(config.get_hosts().len(), 1);
-        assert_eq!(config.get_ports(), &[5432]);
-        assert_eq!(config.get_user(), Some("postgres"));
-        assert_eq!(config.get_dbname(), Some("pizzas"));
-    }
-
-    #[test]
-    fn parses_a_plain_password_too() {
-        let config = parse_database_url("postgres://postgres:plainpassword@localhost:5432/pizzas")
-            .expect("should parse a password with no special characters");
-        assert_eq!(config.get_user(), Some("postgres"));
-        assert_eq!(config.get_dbname(), Some("pizzas"));
-    }
-
-    #[test]
-    fn parses_a_local_url_with_no_user_or_port() {
-        let config = parse_database_url("postgres://localhost/app_development")
-            .expect("should parse a peer-auth local URL");
-        assert_eq!(config.get_dbname(), Some("app_development"));
-        assert_eq!(config.get_ports(), &[5432]);
-        assert!(database_url_is_local(&config));
-    }
+async fn main() -> Result<(), lambda_runtime::Error> {
+    rust_host::boot::run().await
 }

data/rust/host/src/secrets.rs

@@ -75,6 +75,12 @@ pub fn extract_field(secret_json: &str, field: &str) -> Result<String, String> {
         .ok_or_else(|| format!("secret's SecretString has no string {field:?} field"))
 }
 
+/// One named string field out of a secret's JSON `SecretString`, or `None` when the secret does not
+/// carry it (or is not JSON, or the field is blank). For a field a secret may have and may not.
+pub fn optional_field(secret_json: &str, field: &str) -> Option<String> {
+    extract_field(secret_json, field).ok().filter(|value| !value.trim().is_empty())
+}
+
 /// The `postgres://` URL for a database secret.
 ///
 /// The user is the secret's `username`, which is `postgres` for RDS's managed master secret and a
@@ -96,6 +102,15 @@ pub fn database_url(secret_json: &str, host: &str, database: &str) -> Result<Str
 mod tests {
     use super::*;
 
+    #[test]
+    fn an_optional_field_is_read_when_present_and_none_when_absent_blank_or_not_json() {
+        let json = r#"{"api_key":"re_1","webhook_secret":"whsec_abc","blank":"  "}"#;
+        assert_eq!(optional_field(json, "webhook_secret").as_deref(), Some("whsec_abc"));
+        assert_eq!(optional_field(json, "missing"), None);
+        assert_eq!(optional_field(json, "blank"), None);
+        assert_eq!(optional_field("not json", "webhook_secret"), None);
+    }
+
     #[test]
     fn a_master_secret_logs_in_as_postgres_on_the_default_port() {
         let json = r#"{"username":"postgres","password":"abc123"}"#;

data/rust/host/src/web/commerce.rs

@@ -101,12 +101,20 @@ impl HostExtension for Commerce {
     }
 
     // RESEND_SECRET_ID: a failed fetch only logs -- mail is optional, and a missing secret must not
-    // stop the host from serving everything else (resend.rs answers 503 without a key).
+    // stop the host from serving everything else (resend.rs answers 503 without a key). The same
+    // secret may also carry `webhook_secret`, the signing secret of the Resend webhook that
+    // POST /webhooks/resend verifies; without it that route answers 503.
     async fn boot_secrets(&self, fetcher: &AwsSecretFetcher) {
         let Ok(resend_secret_id) = std::env::var("RESEND_SECRET_ID") else { return };
         let fetched = fetcher.fetch_secret_string(&resend_secret_id).await.map_err(|e| format!("{e:#}"));
-        match fetched.and_then(|json| secrets::extract_field(&json, "api_key")) {
-            Ok(api_key) => unsafe { std::env::set_var("RESEND_API_KEY", api_key) },
+        let read = fetched.and_then(|json| secrets::extract_field(&json, "api_key").map(|api_key| (api_key, secrets::optional_field(&json, "webhook_secret"))));
+        match read {
+            Ok((api_key, webhook_secret)) => unsafe {
+                std::env::set_var("RESEND_API_KEY", api_key);
+                if let Some(webhook_secret) = webhook_secret {
+                    std::env::set_var("RESEND_WEBHOOK_SECRET", webhook_secret);
+                }
+            },
             Err(e) => eprintln!("RESEND_SECRET_ID could not be read, so email sending stays off: {e}"),
         }
     }

data/rust/host/src/web/resend_webhook.rs

@@ -18,7 +18,8 @@ type HmacSha256 = Hmac<Sha256>;
 // its Delivery (`RecordOpen` / `RecordClick`, which refuse a repeat). The
 // delivery is found by the Resend message id stored when the issue was sent.
 // Served under the same gate as the other newsletter routes, and only when
-// RESEND_WEBHOOK_SECRET (the endpoint's `whsec_` signing secret) is set.
+// RESEND_WEBHOOK_SECRET (the endpoint's `whsec_` signing secret) is set, either
+// directly or from the `webhook_secret` field of the secret RESEND_SECRET_ID names.
 
 const SECRET_VARIABLE: &str = "RESEND_WEBHOOK_SECRET";
 // Resend signs with Svix, whose default replay window is five minutes.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.9.1
 platform: ruby
 authors:
 - Chris Young
@@ -1474,9 +1474,9 @@ files:
 - lib/rubocop/cop/hecks/fallback_hash_lookup.rb
 - lib/rubocop/cop/hecks/sequential_hash_rename_in_loop.rb
 - lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb
-- prebuilt/4e6c3cd1f578a38732ea5454dae52562d03d8e9886216077a5c34cbf589f3463.marshal
-- prebuilt/911cdcc56b5a094ed26583a4c76401dba6455b1f434722ed22b850bc1b1bdd28.marshal
-- prebuilt/verdicts-3230a251570aa03666708d16f92e646feab6a3f8cc2a3540c017d748e41d41a1.json
+- prebuilt/0ee7f83cba59ce7d1c45c65ba166b071779f70143449f584f33ff7989f64eccb.marshal
+- prebuilt/6e4a6bcf0aa880e2e6b056e1846b70e5a768090b9dc998bbadeaf5d6bcfd3db8.marshal
+- prebuilt/verdicts-91aaf93ce8981bd9a754948f075d95650dc2ec6435015376f5c60992b36a24b1.json
 - qa/settings.yml
 - rust/.cargo/config.toml
 - rust/.cargo/mutants.toml
@@ -1543,6 +1543,7 @@ files:
 - rust/host/src/bin/expr_harness.rs
 - rust/host/src/bin/lineage_harness.rs
 - rust/host/src/bin/mint_harness.rs
+- rust/host/src/boot.rs
 - rust/host/src/boundary_fuzz/api.rs
 - rust/host/src/boundary_fuzz/auth.rs
 - rust/host/src/boundary_fuzz/expr_json.rs