hecks 5.0.0 → 6.0.0

data/rust/src/kernel/repository.rs

@@ -195,10 +195,11 @@ pub fn row_json(id: String, record: super::Json) -> super::Json {
     super::Json::Object(fields)
 }
 
-/// True when `actor_id` holds `role` through a live (`ends_at` unset) assignment.
+/// True when `actor_id` holds `role` through a live assignment.
 ///
-/// Runs the chapter-declared `assignments` query through `named_query::run`; `None`, or a verb
-/// missing from `queries`, holds no role. Ruby likewise ignores scope and `starts_at`.
+/// Runs the bluebook-declared `live_assignments` query through `named_query::run`, which is what
+/// decides an assignment is live (Governance's `ends_at: nil`); `None`, or a verb missing from
+/// `queries`, holds no role. Ruby likewise ignores scope and `starts_at`.
 pub fn holds_role_via(
     store: &impl AggregateScan,
     queries: &[super::QueryDef],
@@ -217,10 +218,7 @@ pub fn holds_role_via(
         return false;
     };
     rows.iter().any(|(_, record)| {
-        let matches_role =
-            record.dig("role_name.value").and_then(super::Json::as_str) == Some(role);
-        let not_revoked = matches!(record.dig("ends_at"), None | Some(super::Json::Null));
-        matches_role && not_revoked
+        record.dig("role_name.value").and_then(super::Json::as_str) == Some(role)
     })
 }
 
@@ -283,6 +281,90 @@ pub fn check_role_via(
     ))
 }
 
+/// Refuses with `Unauthorized` unless the caller may run a command that any one of `command_roles`
+/// may run.
+///
+/// Each role is judged as `check_role_via` judges one; the first that lets the caller through
+/// settles it. When none does, the refusal names them all (`A or B`), as Ruby's does. A caller who
+/// is not checked at all (no stated role, no identified actor) is let through by any of them.
+pub fn check_roles_via(
+    command_roles: &[&str],
+    command_name: &str,
+    caller_role: Option<&str>,
+    caller_actor_id: Option<&str>,
+    store: &impl AggregateScan,
+    queries: &[super::QueryDef],
+    assignments: Option<&str>,
+) -> Result<(), super::Refusal> {
+    let refused = command_roles.iter().all(|role| {
+        check_role_via(
+            Some(role),
+            command_name,
+            caller_role,
+            caller_actor_id,
+            store,
+            queries,
+            assignments,
+        )
+        .is_err()
+    });
+    if !refused {
+        return Ok(());
+    }
+    let joined = command_roles.join(" or ");
+    Err(super::Refusal::Unauthorized(
+        super::refusal_wording::UnauthorizedRoleMismatchArgs {
+            command: command_name,
+            role: &joined,
+            caller_role: caller_role.unwrap_or("no assigned role"),
+        }
+        .render_args(),
+    ))
+}
+
+#[cfg(test)]
+mod check_roles_via_tests {
+    use super::{check_roles_via, AggregateScan};
+
+    struct NoStore;
+    impl AggregateScan for NoStore {}
+
+    fn check(roles: &[&str], caller: Option<&str>) -> Result<(), String> {
+        check_roles_via(roles, "Open", caller, None, &NoStore, &[], None)
+            .map_err(|refusal| refusal.to_string())
+    }
+
+    #[test]
+    fn a_caller_holding_any_of_the_roles_is_let_through() {
+        assert_eq!(check(&["Customer", "Sales Rep"], Some("Customer")), Ok(()));
+        assert_eq!(check(&["Customer", "Sales Rep"], Some("Sales Rep")), Ok(()));
+    }
+
+    #[test]
+    fn a_caller_holding_none_is_refused_with_every_role_named() {
+        assert_eq!(
+            check(&["Customer", "Sales Rep"], Some("Viewer")),
+            Err(
+                "Open refused — role: Customer or Sales Rep, and the caller stated Viewer"
+                    .to_string()
+            )
+        );
+    }
+
+    #[test]
+    fn a_caller_who_states_no_role_is_not_checked_as_ever() {
+        assert_eq!(check(&["Customer", "Sales Rep"], None), Ok(()));
+    }
+
+    #[test]
+    fn one_role_refuses_exactly_as_check_role_via_does() {
+        assert_eq!(
+            check(&["Agent"], Some("Customer")),
+            Err("Open refused — role: Agent, and the caller stated Customer".to_string())
+        );
+    }
+}
+
 // End-to-end pin of `filter_entries_cross_domain` against the scenario in
 // spec/query_none_in_state_growth_spec.rb, which expects surviving ids `c2` and `nonexistent`.
 #[cfg(test)]
@@ -360,8 +442,8 @@ mod check_role_actor_id_tests {
     use crate::kernel::query_comparators::QueryComparator;
     use crate::kernel::{Json, QueryCondition, QueryConditionValue, QueryDef, Refusal};
 
-    /// The assignments query a real Governance attachment declares.
-    const GOVERNANCE_ASSIGNMENTS: &str = "Governance::RoleAssignment.AssignmentsForActor";
+    /// The live assignments query a real Governance attachment declares.
+    const GOVERNANCE_ASSIGNMENTS: &str = "Governance::RoleAssignment.LiveAssignmentsForActor";
 
     fn check_role(
         command_role: Option<&str>,
@@ -398,20 +480,28 @@ mod check_role_actor_id_tests {
         }
     }
 
-    /// The `AssignmentsForActor` `QueryDef` a merged `Store` compiles.
+    /// The `LiveAssignmentsForActor` `QueryDef` a merged `Store` compiles.
     fn assignments_for_actor_query() -> QueryDef {
         QueryDef {
-            verb: "Governance::RoleAssignment.AssignmentsForActor",
+            verb: "Governance::RoleAssignment.LiveAssignmentsForActor",
             aggregate: "Governance::RoleAssignment",
-            conditions: &[QueryCondition {
-                field: "actor_id",
-                comparator: QueryComparator::Eq,
-                value: QueryConditionValue::Arg("actor_id"),
-            }],
+            conditions: &[
+                QueryCondition {
+                    field: "actor_id",
+                    comparator: QueryComparator::Eq,
+                    value: QueryConditionValue::Arg("actor_id"),
+                },
+                QueryCondition {
+                    field: "ends_at",
+                    comparator: QueryComparator::Eq,
+                    value: QueryConditionValue::Null,
+                },
+            ],
             reference_hop_conditions: &[],
             order_by: None,
             offset: None,
             limit: None,
+            cursor: false,
             authorization: None,
         }
     }
@@ -634,7 +724,7 @@ mod check_role_actor_id_tests {
 
     // The declared provider verb is honoured, not the Governance query name...
     #[test]
-    fn check_role_via_reads_whichever_assignments_query_the_chapter_declared() {
+    fn check_role_via_reads_whichever_assignments_query_the_bluebook_declared() {
         let declared = QueryDef {
             verb: "Access::Grant.HeldBy",
             ..assignments_for_actor_query()

data/rust/src/kernel/vocab/mod.rs

@@ -11,10 +11,14 @@ pub mod aggregate_dispatch_order;
 pub mod entity_dispatch_order;
 pub mod field_hint;
 pub mod query_comparator;
+pub mod reducer;
+pub mod refusal_class;
 pub mod refusal_template;
 
 pub use aggregate_dispatch_order::AggregateStep;
 pub use entity_dispatch_order::EntityStep;
 pub use field_hint::FieldHint;
 pub use query_comparator::QueryComparator;
+pub use reducer::Reducer;
+pub use refusal_class::RefusalClass;
 pub use refusal_template::RefusalSite;

data/rust/src/kernel/vocab/reducer.rs

@@ -0,0 +1,109 @@
+// GENERATED by hecks project_rust_vocabulary (Hecks::Projections::RustVocabulary,
+// lib/hecks/projections/rust_vocabulary.rb) from Vocabulary::Reducer
+// (lib/hecks/language/bluebook/vocabulary.bluebook).
+// Do not hand-edit — re-run hecks project_rust_vocabulary instead.
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Reducer {
+    Count,
+    Sum,
+    Avg,
+    Min,
+    Max,
+    Median,
+    Percentile,
+    Any,
+    All,
+}
+
+impl Reducer {
+    /// Every row, in declared order.
+    pub const ALL: &'static [Self] = &[
+        Self::Count,
+        Self::Sum,
+        Self::Avg,
+        Self::Min,
+        Self::Max,
+        Self::Median,
+        Self::Percentile,
+        Self::Any,
+        Self::All,
+    ];
+
+    /// The row's declared `name`.
+    pub const fn name(&self) -> &'static str {
+        match self {
+            Self::Count => "count",
+            Self::Sum => "sum",
+            Self::Avg => "avg",
+            Self::Min => "min",
+            Self::Max => "max",
+            Self::Median => "median",
+            Self::Percentile => "percentile",
+            Self::Any => "any",
+            Self::All => "all",
+        }
+    }
+
+    /// The row's declared `identity`.
+    pub const fn identity(&self) -> &'static str {
+        match self {
+            Self::Count => "0",
+            Self::Sum => "0",
+            Self::Avg => "null",
+            Self::Min => "null",
+            Self::Max => "null",
+            Self::Median => "null",
+            Self::Percentile => "null",
+            Self::Any => "false",
+            Self::All => "true",
+        }
+    }
+
+    /// The row's declared `combine`.
+    pub const fn combine(&self) -> &'static str {
+        match self {
+            Self::Count => "add",
+            Self::Sum => "add",
+            Self::Avg => "collect",
+            Self::Min => "min",
+            Self::Max => "max",
+            Self::Median => "collect",
+            Self::Percentile => "collect",
+            Self::Any => "or",
+            Self::All => "and",
+        }
+    }
+
+    /// The row's declared `inverse`.
+    pub const fn inverse(&self) -> &'static str {
+        match self {
+            Self::Count => "subtract",
+            Self::Sum => "subtract",
+            Self::Avg => "",
+            Self::Min => "",
+            Self::Max => "",
+            Self::Median => "",
+            Self::Percentile => "",
+            Self::Any => "",
+            Self::All => "",
+        }
+    }
+
+    /// The row whose `name` is `name`, if any.
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.iter().copied().find(|row| row.name() == name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_row_is_found_by_its_own_name() {
+        for row in Reducer::ALL {
+            assert_eq!(Reducer::from_name(row.name()), Some(*row));
+        }
+    }
+}

data/rust/src/kernel/vocab/refusal_class.rs

@@ -0,0 +1,124 @@
+// GENERATED by hecks project_rust_vocabulary (Hecks::Projections::RustVocabulary,
+// lib/hecks/projections/rust_vocabulary.rb) from Vocabulary::RefusalClass
+// (lib/hecks/language/bluebook/vocabulary.bluebook).
+// Do not hand-edit — re-run hecks project_rust_vocabulary instead.
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum RefusalClass {
+    AbsentArgument,
+    AlreadyExists,
+    AttributeAbsent,
+    EnsuresNotMet,
+    GivenNotMet,
+    InvariantViolation,
+    LifecycleRefused,
+    NothingToCorrect,
+    NotFound,
+    ProjectionAbsent,
+    RemoteRefusal,
+    TypeMismatch,
+    Unauthorized,
+    UnknownArgument,
+    UnknownVerb,
+}
+
+impl RefusalClass {
+    /// Every row, in declared order.
+    pub const ALL: &'static [Self] = &[
+        Self::AbsentArgument,
+        Self::AlreadyExists,
+        Self::AttributeAbsent,
+        Self::EnsuresNotMet,
+        Self::GivenNotMet,
+        Self::InvariantViolation,
+        Self::LifecycleRefused,
+        Self::NothingToCorrect,
+        Self::NotFound,
+        Self::ProjectionAbsent,
+        Self::RemoteRefusal,
+        Self::TypeMismatch,
+        Self::Unauthorized,
+        Self::UnknownArgument,
+        Self::UnknownVerb,
+    ];
+
+    /// The row's declared `name`.
+    pub const fn name(&self) -> &'static str {
+        match self {
+            Self::AbsentArgument => "AbsentArgument",
+            Self::AlreadyExists => "AlreadyExists",
+            Self::AttributeAbsent => "AttributeAbsent",
+            Self::EnsuresNotMet => "EnsuresNotMet",
+            Self::GivenNotMet => "GivenNotMet",
+            Self::InvariantViolation => "InvariantViolation",
+            Self::LifecycleRefused => "LifecycleRefused",
+            Self::NothingToCorrect => "NothingToCorrect",
+            Self::NotFound => "NotFound",
+            Self::ProjectionAbsent => "ProjectionAbsent",
+            Self::RemoteRefusal => "RemoteRefusal",
+            Self::TypeMismatch => "TypeMismatch",
+            Self::Unauthorized => "Unauthorized",
+            Self::UnknownArgument => "UnknownArgument",
+            Self::UnknownVerb => "UnknownVerb",
+        }
+    }
+
+    /// The row's declared `kind`.
+    pub const fn kind(&self) -> &'static str {
+        match self {
+            Self::AbsentArgument => "absent_argument",
+            Self::AlreadyExists => "refused",
+            Self::AttributeAbsent => "refused",
+            Self::EnsuresNotMet => "refused",
+            Self::GivenNotMet => "refused",
+            Self::InvariantViolation => "refused",
+            Self::LifecycleRefused => "refused",
+            Self::NothingToCorrect => "refused",
+            Self::NotFound => "not_found",
+            Self::ProjectionAbsent => "refused",
+            Self::RemoteRefusal => "refused",
+            Self::TypeMismatch => "refused",
+            Self::Unauthorized => "unauthorized",
+            Self::UnknownArgument => "refused",
+            Self::UnknownVerb => "refused",
+        }
+    }
+
+    /// The row's declared `stage`.
+    pub const fn stage(&self) -> &'static str {
+        match self {
+            Self::AbsentArgument => "arguments",
+            Self::AlreadyExists => "state",
+            Self::AttributeAbsent => "state",
+            Self::EnsuresNotMet => "ensures",
+            Self::GivenNotMet => "givens",
+            Self::InvariantViolation => "invariants",
+            Self::LifecycleRefused => "state",
+            Self::NothingToCorrect => "state",
+            Self::NotFound => "state",
+            Self::ProjectionAbsent => "state",
+            Self::RemoteRefusal => "remote",
+            Self::TypeMismatch => "arguments",
+            Self::Unauthorized => "role",
+            Self::UnknownArgument => "arguments",
+            Self::UnknownVerb => "request",
+        }
+    }
+
+    /// The row whose `name` is `name`, if any.
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.iter().copied().find(|row| row.name() == name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_row_is_found_by_its_own_name() {
+        for row in RefusalClass::ALL {
+            assert_eq!(RefusalClass::from_name(row.name()), Some(*row));
+        }
+    }
+}

data/rust/src/kernel/vocab/refusal_template.rs

@@ -250,7 +250,7 @@ impl RefusalSite {
             Self::InvariantViolationClosedSetMember => "{type} admits {admitted} — got {offered}",
             Self::InvariantViolationValueObjectInvariant => "{name} invariant violated — {description} (given {offered})",
             Self::InvariantViolationAdmitsDeclaredSet => "{name} admits {admits} — {admitted} — got {offered}",
-            Self::InvariantViolationUndeclaredSet => "{name} admits {admits}, which this chapter does not declare — a closed set is named Aggregate::SetName, and it must be one the bluebook actually holds",
+            Self::InvariantViolationUndeclaredSet => "{name} admits {admits}, which this bluebook does not declare — a closed set is named Aggregate::SetName, and it must be one the bluebook actually holds",
             Self::InvariantViolationGroupByCollision => "{read_model} groups by {fields}, but rows {ids} share {key} — a group_by leaf holds one row; add a field that tells them apart",
             Self::UnauthorizedTenantRequired => "{query} declares authorize with tenant: {field} — pass {field}: to name which {field} this ask is scoped to",
             Self::UnauthorizedRoleMismatch => "{command} refused — role: {role}, and the caller stated {caller_role}",
@@ -1753,7 +1753,7 @@ mod tests {
         );
         assert_eq!(
             InvariantViolationUndeclaredSetArgs { name: "name \"x\"", admits: "admits \"x\"" }.render_args(),
-            "name \"x\" admits admits \"x\", which this chapter does not declare — a closed set is named Aggregate::SetName, and it must be one the bluebook actually holds"
+            "name \"x\" admits admits \"x\", which this bluebook does not declare — a closed set is named Aggregate::SetName, and it must be one the bluebook actually holds"
         );
         assert_eq!(
             InvariantViolationGroupByCollisionArgs { read_model: "read_model \"x\"", fields: &[], ids: &[], key: "key \"x\"" }.render_args(),

data/rust/src/lib.rs

@@ -2,7 +2,7 @@
 //! Std-only, zero Cargo dependencies (ADR 0012); wasm-bindgen lives in rust/web.
 
 // Generated code keeps one shape for every domain, so a domain with no arms still has its `match`,
-// a store still has its `new()`, a chapter may hold an aggregate named like itself
+// a store still has its `new()`, a bluebook may hold an aggregate named like itself
 // (identity::identity), and every command gets the same signature whether or not it uses all of
 // it. Clippy's complaints about that shape are not bugs to fix per file; the generators fix the
 // ones that are real (see the emitters in rust/codegen/src).

data/rust/web/Cargo.lock

@@ -2,6 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -14,6 +23,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -38,9 +53,41 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
 [[package]]
 name = "rust"
 version = "0.1.0"
+dependencies = [
+ "regex",
+]
 
 [[package]]
 name = "rust_web"