hecks 3.9.1 → 3.11.0

data/rust/host/src/resend.rs

@@ -9,6 +9,8 @@ const TIMEOUT: Duration = Duration::from_secs(15);
 const MAX_ATTEMPTS: u32 = 4;
 const DEFAULT_RETRY_SECS: u64 = 1;
 const MAX_RETRY_SECS: u64 = 5;
+/// The address the mock refuses, and (in `mock_deliver`) the reason it gives. Adapter-side test
+/// vocabulary: the domain names neither, and the Ruby mock keeps its own copy (ADR 0099).
 const MOCK_BOUNCE_ADDRESS: &str = "bounce@example.com";
 
 /// One email to one recipient.

data/rust/host/src/server.rs

@@ -23,7 +23,7 @@ use tokio::sync::Mutex;
 use tokio_postgres::Client;
 
 /// The per-request dispatch decision, shared between the Lambda custom-runtime path and the
-/// axum fallback route below. `body` is already-parsed JSON in one of three shapes.
+/// axum fallback route below. `body` is already-parsed JSON in one of its recognized shapes.
 pub async fn dispatch_body(
     body: Value,
     client: &Mutex<Client>,
@@ -208,7 +208,7 @@ fn admit(limits: &RateLimits, peer: SocketAddr, method: &Method, uri: &Uri, head
 
     // A real HTTP client (browser via the ALB, or a server-to-server call) carries none of a
     // Function URL's automatic wrapping, so anything not already one of `dispatch_body`'s
-    // three recognized shapes gets that envelope synthesized from the real request instead.
+    // recognized shapes gets that envelope synthesized from the real request instead.
     // The internal shapes carry a caller's own claim of `role` with no session check, so
     // they're honored only from a peer on this host (the task's own sidecar); everyone
     // else — the load balancer, i.e. the public internet — gets an ordinary request
@@ -247,7 +247,10 @@ fn trusts_internal_dispatch(peer: SocketAddr) -> bool {
 /// Whether `value` already matches one of `dispatch_body`'s recognized shapes; anything
 /// else (including a bare `{}`) is real REST traffic needing `synthesize_function_url_envelope`.
 fn is_internal_dispatch_shape(value: &Value) -> bool {
-    value.get("requestContext").is_some() || value.get("read").is_some() || value.get("verb").is_some()
+    value.get("requestContext").is_some()
+        || value.get("read").is_some()
+        || value.get("query").is_some()
+        || value.get("verb").is_some()
 }
 
 /// Rebuilds the envelope shape a real Lambda Function URL invocation already produces
@@ -324,6 +327,13 @@ mod tests {
         assert!(is_internal_dispatch_shape(&serde_json::json!({"read": true})));
     }
 
+    #[test]
+    fn a_declared_query_body_is_recognized_as_internal_dispatch() {
+        // `dispatch_body` answers `{"query": ...}`, and the generated editor's list and picture
+        // pickers ask it; without this a loopback caller was sent to the login page.
+        assert!(is_internal_dispatch_shape(&serde_json::json!({"query": "Pictures::MediaItem.Pictures", "args": {}})));
+    }
+
     #[test]
     fn a_verb_command_body_is_recognized_as_internal_dispatch() {
         assert!(is_internal_dispatch_shape(&serde_json::json!({"verb": "Register", "args": {}})));
@@ -367,10 +377,13 @@ mod tests {
     // caller's own word for its role and no session check.
     #[test]
     fn a_verb_or_read_body_from_outside_this_host_is_an_ordinary_request_not_a_command() {
-        for body in [r#"{"verb":"Approve","role":"admin"}"#, r#"{"read":true}"#] {
+        for body in [r#"{"verb":"Approve","role":"admin"}"#, r#"{"read":true}"#, r#"{"query":"Pictures::MediaItem.Pictures","args":{}}"#] {
             let envelope = admitted("10.0.0.5:5000", "/webhooks/x", body);
 
-            assert!(envelope.get("verb").is_none() && envelope.get("read").is_none(), "{body} must not reach dispatch as a command");
+            assert!(
+                envelope.get("verb").is_none() && envelope.get("read").is_none() && envelope.get("query").is_none(),
+                "{body} must not reach dispatch as a command"
+            );
             assert_eq!(envelope["requestContext"]["http"]["method"], "POST");
             assert_eq!(envelope["rawPath"], "/webhooks/x");
             assert_eq!(envelope["body"], body);
@@ -389,7 +402,7 @@ mod tests {
 
     #[test]
     fn a_verb_or_read_body_from_this_host_still_reaches_dispatch_unchanged() {
-        for body in [r#"{"verb":"Register","to":"r1","with":{}}"#, r#"{"read":true}"#] {
+        for body in [r#"{"verb":"Register","to":"r1","with":{}}"#, r#"{"read":true}"#, r#"{"query":"Banking::Customer.Suspended","args":{}}"#] {
             let envelope = admitted("127.0.0.1:5000", "/anything", body);
 
             assert_eq!(envelope, serde_json::from_str::<Value>(body).unwrap());

data/rust/host/src/ui_schema.rs

@@ -29,7 +29,8 @@ pub fn build(domain_ir: &Value, config: &Value) -> Value {
     let mut collections = Map::new();
     for aggregate in &aggregates {
         let key = key_for.get(agg_name(aggregate)).cloned().unwrap_or_default();
-        collections.insert(key, build_collection(aggregate, config, &key_for, &by_name));
+        let scoped = with_shared_value_objects(aggregate, &aggregates);
+        collections.insert(key, build_collection(&scoped, config, &key_for, &by_name));
     }
 
     json!({
@@ -48,12 +49,13 @@ pub fn schema(domain_ir: &Value, config: &Value) -> Value {
 
     let mut schema = Map::new();
     for aggregate in &aggregates {
+        let scoped = with_shared_value_objects(aggregate, &aggregates);
         let queries: Vec<Value> = array(aggregate, "queries")
             .iter()
             .map(|query| {
                 let args: Vec<Value> = array(query, "attributes")
                     .iter()
-                    .map(|attribute| field(attribute, aggregate, &key_for, &Value::Null))
+                    .map(|attribute| field(attribute, &scoped, &key_for, &Value::Null))
                     .collect();
                 json!({ "name": query.get("name").cloned().unwrap_or(Value::Null), "args": args })
             })
@@ -81,6 +83,30 @@ pub fn key_for(aggregates: &[&Value], config: &Value) -> KeyFor {
     aggregates.iter().map(|a| (agg_name(a).to_string(), collection_key(a, config))).collect()
 }
 
+/// The aggregate with every value object the rest of the domain
+/// declares appended to its own, so an attribute typed by a value object
+/// another aggregate owns resolves like an owner-declared one. The
+/// aggregate's own declarations come first and `find_value_object` takes
+/// the first match: the owner wins, then declaration order among the
+/// others — the same order `web.rs` reads a value object's shape in.
+fn with_shared_value_objects(aggregate: &Value, aggregates: &[&Value]) -> Value {
+    let mut scoped = aggregate.clone();
+    let shared: Vec<Value> = aggregates
+        .iter()
+        .filter(|other| agg_name(other) != agg_name(aggregate))
+        .flat_map(|other| array(other, "value_objects").iter().cloned())
+        .collect();
+    if shared.is_empty() {
+        return scoped;
+    }
+    let mut value_objects = array(aggregate, "value_objects").to_vec();
+    value_objects.extend(shared);
+    if let Some(object) = scoped.as_object_mut() {
+        object.insert("value_objects".to_string(), Value::Array(value_objects));
+    }
+    scoped
+}
+
 pub fn aggregates(domain_ir: &Value) -> Vec<&Value> {
     domain_ir.get("aggregates").and_then(|v| v.as_array()).map(|a| a.iter().collect()).unwrap_or_default()
 }
@@ -557,8 +583,9 @@ pub fn field(attribute: &Value, aggregate: &Value, key_for: &KeyFor, formats: &V
         return merge(base, primitive_shape(ty, format));
     }
 
-    // A value object belongs to its own aggregate's table only — one
-    // typed by another aggregate falls through here, exactly as in Ruby.
+    // `build` and `schema` hand this the aggregate with the domain's other
+    // value objects appended (`with_shared_value_objects`), so one declared
+    // on a different aggregate resolves here too.
     if let Some(value_object) = find_value_object(aggregate, ty) {
         if truthy(value_object.get("closed_set")) {
             return merge(base, enum_shape(value_object));
@@ -1347,5 +1374,105 @@ mod tests {
             ])
         );
     }
-}
 
+    // Two aggregates: `Site` declares the value objects, `Deployment` types
+    // attributes by them without declaring any of its own.
+    fn shared_domain(extra_deployment_vos: Value) -> Value {
+        let vo = |name: &str, attrs: Value| json!({"name": name, "attributes": attrs, "closed_set": false, "members": []});
+        json!({
+            "name": "Fleet",
+            "aggregates": [
+                {
+                    "name": "Site", "identified_by": ["key.value"],
+                    "attributes": [{"name": "key", "type": "SiteKey", "list": false, "optional": false}],
+                    "value_objects": [
+                        vo("SiteKey", json!([{"name": "value", "type": "String"}])),
+                        vo("Window", json!([{"name": "starts", "type": "String"}, {"name": "ends", "type": "String"}])),
+                        vo("Price", json!([{"name": "cents", "type": "Integer"}, {"name": "currency", "type": "String"}])),
+                        {"name": "Tier", "attributes": [{"name": "level", "type": "String"}], "closed_set": true,
+                         "members": [[["level", "gold"]], [["level", "silver"]]]}
+                    ],
+                    "entities": [], "commands": [], "queries": []
+                },
+                {
+                    "name": "Deployment", "identified_by": ["id"],
+                    "attributes": [
+                        {"name": "site_key", "type": "SiteKey", "list": false, "optional": false},
+                        {"name": "window", "type": "Window", "list": false, "optional": true},
+                        {"name": "price", "type": "Price", "list": false, "optional": true},
+                        {"name": "tier", "type": "Tier", "list": false, "optional": true}
+                    ],
+                    "value_objects": extra_deployment_vos,
+                    "entities": [], "commands": [], "queries": []
+                }
+            ]
+        })
+    }
+
+    fn deployment_field(schema: &Value, name: &str) -> Value {
+        schema["collections"]["deployments"]["fields"]
+            .as_array()
+            .and_then(|fields| fields.iter().find(|f| f["key"] == name))
+            .cloned()
+            .expect("a Deployment field")
+    }
+
+    #[test]
+    fn a_one_attribute_value_object_another_aggregate_declares_keeps_its_wrapped_field() {
+        let schema = build(&shared_domain(json!([])), &json!({}));
+        assert_eq!(
+            deployment_field(&schema, "site_key"),
+            json!({"key": "site_key", "label": "Site Key", "optional": false, "shape": "text_value", "field": "value"})
+        );
+        // The column the console renders from it unwraps the same key.
+        let columns = &schema["collections"]["deployments"]["columns"];
+        assert_eq!(columns[0]["field"], "value");
+    }
+
+    #[test]
+    fn compound_money_and_enum_value_objects_resolve_the_same_when_another_aggregate_declares_them() {
+        let schema = build(&shared_domain(json!([])), &json!({}));
+        assert_eq!(deployment_field(&schema, "window")["shape"], "compound");
+        assert_eq!(deployment_field(&schema, "window")["fields"].as_array().map(Vec::len), Some(2));
+        assert_eq!(deployment_field(&schema, "price")["shape"], "money");
+        let tier = deployment_field(&schema, "tier");
+        assert_eq!(tier["shape"], "enum");
+        assert_eq!(tier["field"], "level");
+    }
+
+    #[test]
+    fn an_owner_declared_value_object_is_unchanged_by_the_shared_lookup() {
+        let schema = build(&domain(), &json!({}));
+        assert_eq!(
+            schema["collections"]["clients"]["fields"][1],
+            json!({"key": "name", "label": "Name", "optional": false, "shape": "text_value", "field": "value"})
+        );
+    }
+
+    #[test]
+    fn a_name_two_aggregates_declare_resolves_to_the_owner_then_the_first_declared() {
+        // The owner's own `SiteKey` (attribute `text`) shadows Site's.
+        let own = json!([{"name": "SiteKey", "attributes": [{"name": "text", "type": "String"}], "closed_set": false, "members": []}]);
+        let schema = build(&shared_domain(own), &json!({}));
+        assert_eq!(deployment_field(&schema, "site_key")["field"], "text");
+
+        // Two other aggregates declaring one name: the earlier one wins.
+        let mut domain = shared_domain(json!([]));
+        domain["aggregates"].as_array_mut().unwrap().push(json!({
+            "name": "Probe", "identified_by": ["id"],
+            "attributes": [{"name": "site_key", "type": "SiteKey", "list": false, "optional": false}],
+            "value_objects": [{"name": "SiteKey", "attributes": [{"name": "text", "type": "String"}], "closed_set": false, "members": []}],
+            "entities": [], "commands": [], "queries": []
+        }));
+        domain["aggregates"].as_array_mut().unwrap().push(json!({
+            "name": "Other", "identified_by": ["id"],
+            "attributes": [{"name": "site_key", "type": "SiteKey", "list": false, "optional": false}],
+            "value_objects": [], "entities": [], "commands": [], "queries": []
+        }));
+        let schema = build(&domain, &json!({}));
+        // Site precedes Probe in declaration order, so Other reads Site's.
+        assert_eq!(schema["collections"]["others"]["fields"][0]["field"], "value");
+        // Probe's own declaration still wins for Probe.
+        assert_eq!(schema["collections"]["probes"]["fields"][0]["field"], "text");
+    }
+}

data/rust/host/src/web/newsletter.rs

@@ -106,7 +106,7 @@ async fn newsletter_subscribe_route(
     let Some((_, subscriber)) = subscribers.iter().find(|(id, _)| id == email) else {
         return respond(500, "text/plain", "subscriber vanished immediately after being written");
     };
-    let status = subscriber.get("status").and_then(|v| v.as_str()).unwrap_or("pending");
+    let status = subscriber.get("status").and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
     respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
 }
 
@@ -134,7 +134,6 @@ async fn newsletter_subscribers_list_route(provider: &NewsletterProvider, client
 }
 
 const CONFIRM_PURPOSE: &str = "newsletter-confirm";
-const CONFIRM_TTL_SECS: u64 = 14 * 24 * 60 * 60;
 
 // SESSION_SECRET; unset means no confirm link can be signed and none is sent.
 fn confirm_secret() -> Option<String> {
@@ -142,7 +141,7 @@ fn confirm_secret() -> Option<String> {
 }
 
 fn confirm_token(secret: &str, email: &str) -> String {
-    auth::purpose_token(secret, CONFIRM_PURPOSE, json!({ "email": email }), CONFIRM_TTL_SECS)
+    auth::purpose_token(secret, CONFIRM_PURPOSE, json!({ "email": email }), crate::commerce_ir::newsletter_windows_binding().0)
 }
 
 fn confirm_token_matches(secret: &str, token: &str, email: &str) -> bool {
@@ -219,7 +218,7 @@ pub(super) async fn send_confirmation_if_pending(email: &str, client: &Mutex<Cli
     };
     let pending = instances_for(&read, &provider.instance_prefix())
         .iter()
-        .any(|(id, subscriber)| id == email && subscriber.get("status").and_then(|v| v.as_str()) == Some("pending"));
+        .any(|(id, subscriber)| id == email && provider.is_awaiting_confirmation(subscriber.get("status").and_then(|v| v.as_str())));
     if pending {
         send_confirmation(email).await;
     }
@@ -250,7 +249,7 @@ async fn newsletter_confirm_route(provider: &NewsletterProvider, query: &HashMap
         return respond(404, "application/json", &json!({"error": "no such subscriber"}).to_string());
     };
 
-    if subscriber.get("status").and_then(|v| v.as_str()) == Some("pending") {
+    if provider.is_awaiting_confirmation(subscriber.get("status").and_then(|v| v.as_str())) {
         if let Err(e) = dispatch::handle_routed(client, wasm_path, &provider.confirm, json!(email), json!({}), None, config, invoker).await {
             return respond(500, "text/plain", &format!("{e:#}"));
         }
@@ -261,7 +260,7 @@ async fn newsletter_confirm_route(provider: &NewsletterProvider, query: &HashMap
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
-    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or("pending");
+    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
     respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
 }
 
@@ -300,7 +299,7 @@ async fn newsletter_unsubscribe_route(provider: &NewsletterProvider, query: &Has
         return respond(404, "application/json", &json!({"error": "no such subscriber"}).to_string());
     };
 
-    if subscriber.get("status").and_then(|v| v.as_str()) != Some("unsubscribed") {
+    if !provider.has_left(subscriber.get("status").and_then(|v| v.as_str())) {
         if let Err(e) = dispatch::handle_routed(client, wasm_path, &provider.unsubscribe, json!(email), json!({}), None, config, invoker).await {
             return respond(500, "text/plain", &format!("{e:#}"));
         }
@@ -311,6 +310,6 @@ async fn newsletter_unsubscribe_route(provider: &NewsletterProvider, query: &Has
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
     let subscribers = instances_for(&read, &provider.instance_prefix());
-    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or("pending");
+    let status = subscribers.iter().find(|(id, _)| id == email).and_then(|(_, s)| s.get("status")).and_then(|v| v.as_str()).unwrap_or(provider.initial_status());
     respond(200, "application/json", &json!({"email": email, "status": status}).to_string())
 }

data/rust/host/src/web/newsletter_send.rs

@@ -18,10 +18,10 @@ const UNSUBSCRIBE_TOKEN: &str = "{{UNSUBSCRIBE_URL}}";
 const DEFAULT_SITE_URL: &str = "http://localhost:4321";
 
 // The purpose keys an unsubscribe token apart from a confirm token, so neither
-// verifies as the other. The lifetime is long (two years) because the link sits
-// in emails that are opened months after they were sent.
+// verifies as the other. The lifetime is the Newsletter bluebook's
+// `unsubscribe_window` (long, because the link sits in emails opened months after
+// they were sent), not a number held here.
 pub(super) const UNSUBSCRIBE_PURPOSE: &str = "newsletter-unsubscribe";
-const UNSUBSCRIBE_TTL_SECS: u64 = 730 * 24 * 60 * 60;
 
 #[derive(Debug, PartialEq)]
 pub(super) enum IssueAction {
@@ -116,7 +116,7 @@ pub(super) fn site_url() -> String {
 }
 
 pub(super) fn unsubscribe_token(secret: &str, email: &str) -> String {
-    auth::purpose_token(secret, UNSUBSCRIBE_PURPOSE, json!({ "email": email }), UNSUBSCRIBE_TTL_SECS)
+    auth::purpose_token(secret, UNSUBSCRIBE_PURPOSE, json!({ "email": email }), crate::commerce_ir::newsletter_windows_binding().1)
 }
 
 pub(super) fn unsubscribe_token_matches(secret: &str, token: &str, email: &str) -> bool {
@@ -141,11 +141,11 @@ fn value_of<'a>(state: &'a Value, field: &str) -> &'a str {
     state.get(field).and_then(|v| v.get("value")).and_then(|v| v.as_str()).unwrap_or("")
 }
 
-// Every confirmed subscriber's address, alphabetical so a send is repeatable.
-fn confirmed_emails(subscribers: &[(String, Value)]) -> Vec<String> {
+// Every address in a state that receives issues (the lifecycle's `receives_issues` mark), alphabetical so a send is repeatable.
+fn confirmed_emails(provider: &NewsletterProvider, subscribers: &[(String, Value)]) -> Vec<String> {
     let mut emails: Vec<String> = subscribers
         .iter()
-        .filter(|(_, s)| s.get("status").and_then(|v| v.as_str()) == Some("confirmed"))
+        .filter(|(_, s)| provider.receives_issues(s.get("status").and_then(|v| v.as_str())))
         .map(|(email, _)| email.clone())
         .collect();
     emails.sort();
@@ -177,7 +177,7 @@ async fn send_issue(
     };
     let subject = value_of(&issue, "subject").to_string();
     let body = value_of(&issue, "body").to_string();
-    let recipients = confirmed_emails(&instances_for(&read, &subscribers.instance_prefix()));
+    let recipients = confirmed_emails(subscribers, &instances_for(&read, &subscribers.instance_prefix()));
 
     // Marked sent before mailing: a second click then refuses ("only a draft
     // issue can be sent") instead of mailing everyone twice.
@@ -323,15 +323,40 @@ mod tests {
         assert!(require_signing_secret("s3cret-value").is_ok());
     }
 
-    #[test]
-    fn only_confirmed_subscribers_are_recipients_in_alphabetical_order() {
-        let subscribers = vec![
+    fn provider_with(marks: serde_json::Value) -> NewsletterProvider {
+        let mut fact = json!({
+            "provider": "Newsletter", "subscribe": "N::S.Subscribe", "add_name": "N::S.AddName",
+            "confirm": "N::S.Confirm", "unsubscribe": "N::S.Unsubscribe", "aggregate": "N::S"
+        });
+        for (key, states) in marks.as_object().into_iter().flatten() {
+            fact[key] = states.clone();
+        }
+        newsletter_provider(&json!({ "newsletter": fact })).expect("newsletter")
+    }
+
+    fn rows() -> Vec<(String, Value)> {
+        vec![
             ("zed@example.com".to_string(), json!({ "status": "confirmed" })),
             ("pending@example.com".to_string(), json!({ "status": "pending" })),
             ("amy@example.com".to_string(), json!({ "status": "confirmed" })),
+            ("vip@example.com".to_string(), json!({ "status": "vip" })),
             ("gone@example.com".to_string(), json!({ "status": "unsubscribed" })),
-        ];
-        assert_eq!(confirmed_emails(&subscribers), vec!["amy@example.com".to_string(), "zed@example.com".to_string()]);
+        ]
+    }
+
+    #[test]
+    fn legacy_default_sends_to_confirmed_subscribers_in_alphabetical_order() {
+        let provider = provider_with(json!({}));
+        assert_eq!(confirmed_emails(&provider, &rows()), vec!["amy@example.com".to_string(), "zed@example.com".to_string()]);
+    }
+
+    #[test]
+    fn the_declared_receives_issues_mark_selects_the_recipients() {
+        let provider = provider_with(json!({ "receives_issues": ["vip", "confirmed"] }));
+        assert_eq!(
+            confirmed_emails(&provider, &rows()),
+            vec!["amy@example.com".to_string(), "vip@example.com".to_string(), "zed@example.com".to_string()]
+        );
     }
 
     #[test]