hecks 4.0.0 → 6.0.0

data/rust/host/Cargo.toml

@@ -17,8 +17,10 @@ path = "src/main.rs"
 # No path dependency on `rust`: the compiled `.wasm` is loaded through wasmtime as an untrusted
 # module, so dispatch runs sandboxed with no access to this crate's Postgres connection.
 [dependencies]
-wasmtime = "49.0.1"
-wasmtime-wasi = "49.0.1"
+# The runtime, free of any driver: this crate (the adapters) implements its backends and transports.
+rust_host_core = { path = "core" }
+wasmtime = "49.0.4"
+wasmtime-wasi = "49.0.4"
 lambda_runtime = "0.13"
 tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "sync"] }
 # Used by server.rs (HECKS_SERVE_MODE=1) to answer the ALB's HTTP on Fargate. HTTP/1.1 only;
@@ -32,7 +34,6 @@ tokio-postgres = { version = "0.7", features = ["with-serde_json-1"] }
 # default-features = false: rustls's default pulls in aws_lc_rs (C); "ring" keeps this pure Rust.
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 tokio-postgres-rustls = { version = "0.14", default-features = false, features = ["ring"] }
-rustls-pemfile = "2"
 # arbitrary_precision keeps a number as the text Ruby wrote (`1.0e+20`, integers past u64).
 # preserve_order keeps JSON object key order (a translation edge's `renames` order is meaningful).
 serde_json = { version = "1", features = ["preserve_order", "arbitrary_precision"] }
@@ -60,6 +61,9 @@ aws-sdk-secretsmanager = { version = "1", default-features = false, features = [
 aws-smithy-http-client = { version = "1", default-features = false, features = ["rustls-ring"] }
 async-trait = "0.1.92"
 
+[dev-dependencies]
+rust_host_core = { path = "core", features = ["test-support"] }
+
 # CI never attaches a debugger to dev binaries, so skip debuginfo to save build time.
 [profile.dev]
 debug = 0

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-4.0.0
+6.0.0

data/rust/host/core/Cargo.toml

@@ -0,0 +1,64 @@
+[package]
+name = "rust_host_core"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+name = "rust_host_core"
+path = "src/lib.rs"
+
+# The host's runtime: dispatch, the journal's data, the Store and its Backend trait, the IR, the
+# expression engine and the presentation code. It depends on no driver: no Postgres, HTTP server or
+# client, or AWS SDK is in this table, so the compiler refuses to let one in. The wasm sandbox
+# (wasmtime) is how it runs a domain, not a transport.
+[features]
+# Test doubles the adapters' tests use: a lambda invoker that must never be called.
+test-support = []
+
+[dependencies]
+hecks_expr = { path = "../../expr" }
+wasmtime = "49.0.4"
+wasmtime-wasi = "49.0.4"
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync"] }
+serde_json = { version = "1", features = ["preserve_order", "arbitrary_precision"] }
+anyhow = "1"
+regex = "1"
+sha2 = "0.10"
+base64 = "0.22"
+async-trait = "0.1.92"
+
+# Clippy beyond its defaults: pedantic and nursery, plus the restriction lints that keep a panic
+# out of library code. `hecks gate_run.gate stage=ci only=rust_clippy` makes each of these an error.
+# The same table is in every crate's Cargo.toml; change them together.
+[lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+nursery = { level = "warn", priority = -1 }
+unwrap_used = "warn"
+expect_used = "warn"
+panic = "warn"
+dbg_macro = "warn"
+todo = "warn"
+unimplemented = "warn"
+# Lints that ask for prose or an attribute on every item rather than for better code.
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+must_use_candidate = "allow"
+return_self_not_must_use = "allow"
+module_name_repetitions = "allow"
+too_many_lines = "allow"
+too_long_first_doc_paragraph = "allow"
+doc_markdown = "allow"
+# Numeric conversions here are deliberate: JSON numbers are f64 and ids are small.
+cast_possible_truncation = "allow"
+cast_possible_wrap = "allow"
+cast_precision_loss = "allow"
+cast_sign_loss = "allow"
+# Naming heuristics that fire on ordinary short names.
+similar_names = "allow"
+many_single_char_names = "allow"
+struct_field_names = "allow"
+# Heuristics that cost more clarity than they buy here.
+redundant_pub_crate = "allow"
+future_not_send = "allow"
+significant_drop_tightening = "allow"
+match_same_arms = "allow"

data/rust/host/core/clippy.toml

@@ -0,0 +1,4 @@
+# The restriction lints (unwrap, expect, panic) guard library code; a test panics to fail.
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true

data/rust/host/core/src/arg_limits.rs

@@ -0,0 +1,48 @@
+//! The largest string a public request body may carry.
+//!
+//! Every kernel run feeds the whole world in and reads it all back (`wasm_runner`), and a string
+//! a command argument carries is copied several times into that answer. Without a cap, a few
+//! requests at the HTTP body limit grow the world past the kernel's output cap, and every later
+//! command fails. `server::admit` checks a public request's body against it before anything is
+//! dispatched; the internal protocol, from a peer on this host, is not capped.
+
+use serde_json::Value;
+
+/// 256 KiB: room for a long post body or an embedded document, small enough that one request
+/// adds a bounded amount to every later kernel run.
+pub const MAX_STRING_ARG_BYTES: usize = 256 * 1024;
+
+/// The byte length of the longest string anywhere in `value`, when it is past
+/// `MAX_STRING_ARG_BYTES`; `None` when every string fits.
+pub fn oversized(value: &Value) -> Option<usize> {
+    let longest = longest_string(value);
+    (longest > MAX_STRING_ARG_BYTES).then_some(longest)
+}
+
+/// The byte length of the longest string anywhere in `value`.
+fn longest_string(value: &Value) -> usize {
+    match value {
+        Value::String(text) => text.len(),
+        Value::Array(items) => items.iter().map(longest_string).max().unwrap_or(0),
+        Value::Object(fields) => fields.values().map(longest_string).max().unwrap_or(0),
+        Value::Null | Value::Bool(_) | Value::Number(_) => 0,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn strings_within_the_cap_pass() {
+        let body = json!({"name": "x".repeat(MAX_STRING_ARG_BYTES), "count": 3});
+        assert_eq!(oversized(&body), None);
+    }
+
+    #[test]
+    fn a_nested_string_past_the_cap_is_found_at_any_depth() {
+        let body = json!({"with": {"tags": ["ok", "x".repeat(MAX_STRING_ARG_BYTES + 1)]}});
+        assert_eq!(oversized(&body), Some(MAX_STRING_ARG_BYTES + 1));
+    }
+}

data/rust/host/core/src/clock.rs

@@ -0,0 +1,146 @@
+//! The wall clock, read once the same way everywhere.
+
+/// Whole seconds since the Unix epoch; 0 if the system clock reads before it.
+pub fn unix_now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |elapsed| elapsed.as_secs() as i64)
+}
+
+/// The current instant in ISO 8601 UTC, matching Ruby's `Time.now.utc.iso8601`: the rendering
+/// a journal step's `occurred_at` and a role assignment's `starts_at` both carry.
+pub fn iso8601_now() -> String {
+    iso_utc(unix_now().max(0) as u64)
+}
+
+/// Epoch seconds as an ISO 8601 UTC instant, `YYYY-MM-DDTHH:MM:SSZ`.
+pub fn iso_utc(secs: u64) -> String {
+    let days = secs / 86_400;
+    let rem = secs % 86_400;
+    let (h, m, s) = (rem / 3600, (rem % 3600) / 60, rem % 60);
+    let (y, mo, d) = civil_from_days(days as i64);
+    format!("{y:04}-{mo:02}-{d:02}T{h:02}:{m:02}:{s:02}Z")
+}
+
+/// Epoch seconds of an ISO 8601 UTC instant (`YYYY-MM-DDTHH:MM:SSZ`, optional fractional
+/// seconds, which are dropped); `None` for anything else, an offset other than `Z` included.
+pub fn parse_iso_utc(text: &str) -> Option<i64> {
+    let bytes = text.as_bytes();
+    if bytes.len() < 20 || !text.is_ascii() || *bytes.last()? != b'Z' {
+        return None;
+    }
+    let number = |range: std::ops::Range<usize>| -> Option<i64> {
+        let digits = text.get(range)?;
+        digits
+            .bytes()
+            .all(|b| b.is_ascii_digit())
+            .then(|| digits.parse().ok())
+            .flatten()
+    };
+    let separators_ok = bytes[4] == b'-'
+        && bytes[7] == b'-'
+        && bytes[10] == b'T'
+        && bytes[13] == b':'
+        && bytes[16] == b':';
+    let fraction = &text[19..text.len() - 1];
+    let fraction_ok = fraction.is_empty()
+        || (fraction.starts_with('.')
+            && fraction.len() > 1
+            && fraction[1..].bytes().all(|b| b.is_ascii_digit()));
+    if !separators_ok || !fraction_ok {
+        return None;
+    }
+    let (year, month, day) = (number(0..4)?, number(5..7)?, number(8..10)?);
+    let (hour, minute, second) = (number(11..13)?, number(14..16)?, number(17..19)?);
+    let in_range = (1..=12).contains(&month)
+        && (1..=days_in_month(year, month)).contains(&day)
+        && hour < 24
+        && minute < 60
+        && second < 60;
+    in_range
+        .then(|| days_from_civil(year, month, day) * 86_400 + hour * 3600 + minute * 60 + second)
+}
+
+const fn days_in_month(year: i64, month: i64) -> i64 {
+    match month {
+        2 if year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+// Howard Hinnant's days-from-civil algorithm, inverted -- avoids
+// pulling in a full date/time crate for one timestamp format.
+const fn civil_from_days(z: i64) -> (i64, u32, u32) {
+    let z = z + 719_468;
+    let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
+    let doe = (z - era * 146_097) as u64;
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146_096) / 365;
+    let y = yoe as i64 + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;
+    (if m <= 2 { y + 1 } else { y }, m, d)
+}
+
+// The inverse of `civil_from_days`: whole days since 1970-01-01 for a proleptic Gregorian date.
+const fn days_from_civil(year: i64, month: i64, day: i64) -> i64 {
+    let y = if month <= 2 { year - 1 } else { year };
+    let era = if y >= 0 { y } else { y - 399 } / 400;
+    let yoe = y - era * 400;
+    let mp = if month > 2 { month - 3 } else { month + 9 };
+    let doy = (153 * mp + 2) / 5 + day - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    era * 146_097 + doe - 719_468
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn iso_utc_and_parse_iso_utc_are_inverses_across_leap_days_and_century_years() {
+        for secs in [
+            0_u64,
+            951_782_400,   // 2000-02-29, a leap day in a 400-year
+            1_078_012_800, // 2004-02-29
+            4_107_542_400, // 2100-03-01, 2100 is not a leap year
+            1_792_000_000,
+            4_102_444_799,
+        ] {
+            assert_eq!(parse_iso_utc(&iso_utc(secs)), Some(secs as i64), "{secs}");
+        }
+        assert_eq!(iso_utc(951_782_400), "2000-02-29T00:00:00Z");
+        assert_eq!(parse_iso_utc("1970-01-01T00:00:00Z"), Some(0));
+    }
+
+    #[test]
+    fn parse_iso_utc_drops_fractional_seconds_and_refuses_everything_else() {
+        assert_eq!(
+            parse_iso_utc("2026-10-22T12:00:00.789Z"),
+            parse_iso_utc("2026-10-22T12:00:00Z")
+        );
+        for bad in [
+            "",
+            "tomorrow",
+            "2026-10-22",
+            "2026-10-22T12:00:00",
+            "2026-10-22T12:00:00+00:00",
+            "2026-10-22 12:00:00Z",
+            "2026-13-01T00:00:00Z",
+            "2026-02-29T00:00:00Z",
+            "2026-00-10T00:00:00Z",
+            "2026-10-22T24:00:00Z",
+            "2026-10-22T12:60:00Z",
+            "2026-10-22T12:00:60Z",
+            "2026-10-22T12:00:00.Z",
+            "2026-10-22T12:00:00.1xZ",
+            "+026-10-22T12:00:00Z",
+            "2026-10-22T12:00:0éZ",
+        ] {
+            assert_eq!(parse_iso_utc(bad), None, "{bad:?}");
+        }
+    }
+}