honeymaker 0.12.3 → 0.12.4

data/crates/honeymaker-client/src/transport/io_timeout.rs

@@ -0,0 +1,352 @@
+//! Net::HTTP's read_timeout / write_timeout: a limit on each wait for the socket, not on the whole
+//! exchange. A peer that keeps sending, however slowly, never times out.
+use std::future::Future;
+use std::io;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicBool, Ordering::SeqCst};
+use std::sync::{Arc, Mutex};
+use std::task::{Context, Poll, Waker};
+use std::time::Duration;
+use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
+use tokio::time::{Sleep, sleep};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Stall {
+    Read,
+    Write,
+}
+impl std::fmt::Display for Stall {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Stall::Read => "Net::ReadTimeout",
+            Stall::Write => "Net::WriteTimeout",
+        })
+    }
+}
+impl std::error::Error for Stall {}
+
+/// Shared across the HTTP body, the TLS stream, and the raw socket below TLS.
+/// A body queued by hyper is not yet transmitted: only the subsequent successful
+/// flush above TLS can enable response timeouts below TLS.
+#[derive(Default)]
+pub(crate) struct RequestProgress {
+    queued: AtomicBool,
+    flushed: AtomicBool,
+    reader: Mutex<Option<Waker>>,
+}
+impl RequestProgress {
+    pub(crate) fn body_queued(&self) {
+        self.queued.store(true, SeqCst);
+    }
+
+    fn flushed(&self) {
+        let mut reader = self.reader.lock().unwrap();
+        if self.queued.load(SeqCst)
+            && !self.flushed.swap(true, SeqCst)
+            && let Some(waker) = reader.take()
+        {
+            waker.wake();
+        }
+    }
+
+    fn can_read(&self, cx: &Context<'_>) -> bool {
+        let mut reader = self.reader.lock().unwrap();
+        if self.flushed.load(SeqCst) {
+            return true;
+        }
+        *reader = Some(cx.waker().clone());
+        false
+    }
+}
+
+/// Observes flush completion above TLS, after hyper has drained its HTTP buffer.
+pub(crate) struct RequestIo<S> {
+    inner: S,
+    progress: Arc<RequestProgress>,
+    wrote: bool,
+}
+impl<S> RequestIo<S> {
+    pub(crate) fn new(inner: S, progress: Arc<RequestProgress>) -> Self {
+        Self {
+            inner,
+            progress,
+            wrote: false,
+        }
+    }
+}
+impl<S: AsyncRead + Unpin> AsyncRead for RequestIo<S> {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.get_mut().inner).poll_read(cx, buf)
+    }
+}
+impl<S: AsyncWrite + Unpin> AsyncWrite for RequestIo<S> {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        let this = self.get_mut();
+        let result = Pin::new(&mut this.inner).poll_write(cx, buf);
+        if matches!(result, Poll::Ready(Ok(n)) if n > 0) {
+            this.wrote = true;
+        }
+        result
+    }
+    fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        let result = Pin::new(&mut this.inner).poll_flush(cx);
+        if this.wrote && matches!(result, Poll::Ready(Ok(()))) {
+            this.progress.flushed();
+        }
+        result
+    }
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.get_mut().inner).poll_shutdown(cx)
+    }
+}
+
+pub(crate) struct TimeoutIo<S> {
+    inner: S,
+    progress: Option<Arc<RequestProgress>>,
+    read: Duration,
+    write: Duration,
+    read_timer: Option<Pin<Box<Sleep>>>,
+    write_timer: Option<Pin<Box<Sleep>>>,
+    /// A write is waiting on the socket: the request is still being transmitted.
+    writing: bool,
+}
+
+impl<S> TimeoutIo<S> {
+    pub(crate) fn new(inner: S, read: Duration, write: Duration) -> Self {
+        Self {
+            inner,
+            progress: None,
+            read,
+            write,
+            read_timer: None,
+            write_timer: None,
+            writing: false,
+        }
+    }
+
+    pub(crate) fn for_request(
+        inner: S,
+        read: Duration,
+        write: Duration,
+        progress: Arc<RequestProgress>,
+    ) -> Self {
+        Self {
+            progress: Some(progress),
+            ..Self::new(inner, read, write)
+        }
+    }
+
+    /// A write finished. If it moved bytes (or ends a wait), transmission progressed, so the
+    /// response wait starts afresh from now: Net::HTTP only starts reading once it has written.
+    /// The existing Sleep is reset rather than dropped, so it keeps the reader's waker.
+    fn wrote(&mut self, progressed: bool) {
+        self.write_timer = None;
+        if (progressed || self.writing)
+            && let Some(t) = self.read_timer.as_mut()
+        {
+            t.as_mut().reset(tokio::time::Instant::now() + self.read);
+        }
+        self.writing = false;
+    }
+}
+
+fn stalled<T>(
+    timer: &mut Option<Pin<Box<Sleep>>>,
+    limit: Duration,
+    which: Stall,
+    cx: &mut Context<'_>,
+) -> Poll<io::Result<T>> {
+    let t = timer.get_or_insert_with(|| Box::pin(sleep(limit)));
+    match t.as_mut().poll(cx) {
+        Poll::Ready(()) => {
+            *timer = None;
+            Poll::Ready(Err(io::Error::new(io::ErrorKind::TimedOut, which)))
+        }
+        Poll::Pending => Poll::Pending,
+    }
+}
+
+impl<S: AsyncRead + Unpin> AsyncRead for TimeoutIo<S> {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        match Pin::new(&mut this.inner).poll_read(cx, buf) {
+            Poll::Ready(r) => {
+                this.read_timer = None;
+                Poll::Ready(r)
+            }
+            // While the request is still going out, a read wait is not a response wait (hyper
+            // polls reads alongside writes); the write timer governs until the write completes.
+            Poll::Pending if this.progress.as_ref().is_some_and(|p| !p.can_read(cx)) => {
+                Poll::Pending
+            }
+            Poll::Pending if this.writing => Poll::Pending,
+            Poll::Pending => stalled(&mut this.read_timer, this.read, Stall::Read, cx),
+        }
+    }
+}
+
+impl<S: AsyncWrite + Unpin> TimeoutIo<S> {
+    fn write_side<T>(
+        &mut self,
+        cx: &mut Context<'_>,
+        poll: Poll<io::Result<T>>,
+        progressed: impl FnOnce(&T) -> bool,
+    ) -> Poll<io::Result<T>> {
+        match poll {
+            Poll::Ready(Ok(v)) => {
+                self.wrote(progressed(&v));
+                Poll::Ready(Ok(v))
+            }
+            Poll::Ready(Err(e)) => {
+                self.write_timer = None;
+                self.writing = false;
+                Poll::Ready(Err(e))
+            }
+            Poll::Pending => {
+                self.writing = true;
+                stalled(&mut self.write_timer, self.write, Stall::Write, cx)
+            }
+        }
+    }
+}
+
+impl<S: AsyncWrite + Unpin> AsyncWrite for TimeoutIo<S> {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        let this = self.get_mut();
+        let poll = Pin::new(&mut this.inner).poll_write(cx, buf);
+        this.write_side(cx, poll, |n| *n > 0)
+    }
+    fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        let poll = Pin::new(&mut this.inner).poll_flush(cx);
+        this.write_side(cx, poll, |_| false)
+    }
+    fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        let this = self.get_mut();
+        let poll = Pin::new(&mut this.inner).poll_shutdown(cx);
+        this.write_side(cx, poll, |_| false)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt, duplex};
+
+    fn stall_of(e: &io::Error) -> Option<Stall> {
+        e.get_ref().and_then(|x| x.downcast_ref::<Stall>()).copied()
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_silent_peer_times_out_after_the_read_limit() {
+        let (a, _b) = duplex(64);
+        let mut io = TimeoutIo::new(a, Duration::from_secs(30), Duration::from_secs(10));
+        let started = tokio::time::Instant::now();
+        let e = io.read(&mut [0u8; 8]).await.unwrap_err();
+        assert_eq!(
+            (e.kind(), stall_of(&e)),
+            (io::ErrorKind::TimedOut, Some(Stall::Read))
+        );
+        assert_eq!(started.elapsed(), Duration::from_secs(30));
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_slow_but_steady_peer_never_times_out() {
+        let (a, mut b) = duplex(64);
+        tokio::spawn(async move {
+            for _ in 0..5 {
+                sleep(Duration::from_secs(29)).await;
+                b.write_all(b"x").await.unwrap();
+            }
+        });
+        let mut io = TimeoutIo::new(a, Duration::from_secs(30), Duration::from_secs(10));
+        let mut buf = [0u8; 5];
+        io.read_exact(&mut buf).await.unwrap();
+        assert_eq!(&buf, b"xxxxx");
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn write_progress_restarts_the_response_wait() {
+        let (a, _b) = duplex(64);
+        let io = TimeoutIo::new(a, Duration::from_secs(30), Duration::from_secs(10));
+        let (mut r, mut w) = tokio::io::split(io);
+        let started = tokio::time::Instant::now();
+        let reader = async { r.read(&mut [0u8; 8]).await.unwrap_err() };
+        let writer = async {
+            sleep(Duration::from_secs(20)).await;
+            w.write_all(b"x").await.unwrap(); // the request's last byte goes out at 20 s
+        };
+        let (e, ()) = tokio::join!(reader, writer);
+        assert_eq!(stall_of(&e), Some(Stall::Read));
+        assert_eq!(
+            started.elapsed(),
+            Duration::from_secs(50),
+            "30 s after the last write, not after the first read"
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_peer_that_stops_reading_times_out_the_write() {
+        let (a, _b) = duplex(8);
+        let mut io = TimeoutIo::new(a, Duration::from_secs(30), Duration::from_secs(10));
+        let e = io.write_all(&[0u8; 64]).await.unwrap_err();
+        assert_eq!(stall_of(&e), Some(Stall::Write));
+    }
+}
+
+#[cfg(test)]
+mod completion_tests {
+    use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt, duplex};
+
+    #[tokio::test(start_paused = true)]
+    async fn response_wait_starts_only_after_the_complete_request_is_flushed() {
+        let (a, _peer) = duplex(64);
+        let progress = Arc::new(RequestProgress::default());
+        let raw = TimeoutIo::for_request(
+            a,
+            Duration::from_secs(30),
+            Duration::from_secs(10),
+            progress.clone(),
+        );
+        let io = RequestIo::new(raw, progress.clone());
+        let (mut reader, mut writer) = tokio::io::split(io);
+        let started = tokio::time::Instant::now();
+        let read = async { reader.read(&mut [0; 1]).await.unwrap_err() };
+        let write = async {
+            // An initial flush and a partial request must not enable the response timer.
+            writer.flush().await.unwrap();
+            writer.write_all(b"head").await.unwrap();
+            writer.flush().await.unwrap();
+            sleep(Duration::from_secs(40)).await;
+            progress.body_queued();
+            writer.write_all(b"body").await.unwrap();
+            // Even when all plaintext is accepted, wait until TLS has flushed it.
+            sleep(Duration::from_secs(40)).await;
+            writer.flush().await.unwrap();
+        };
+        let (err, ()) = tokio::join!(read, write);
+        assert_eq!(
+            err.get_ref().unwrap().downcast_ref::<Stall>(),
+            Some(&Stall::Read)
+        );
+        assert_eq!(started.elapsed(), Duration::from_secs(110));
+    }
+}

data/crates/honeymaker-client/src/transport/response.rs

@@ -0,0 +1,169 @@
+//! What the gem's Net::HTTP + Faraday stack turns an HTTP answer into (Ruling R6).
+use super::{BodyFraming, Cause, Failure, Raw, Reply};
+use flate2::read::{GzDecoder, ZlibDecoder};
+use serde::de::{Deserialize, Deserializer, Visitor};
+use std::collections::HashSet;
+use std::fmt;
+use std::io::Read;
+
+/// Faraday::Response::Json#process_response_type?: the media type before `;`, unstripped and
+/// case-sensitive, matched against /\bjson$/.
+fn json_type(content_type: Option<&str>) -> bool {
+    let t = content_type.unwrap_or("").split(';').next().unwrap_or("");
+    t.strip_suffix("json").is_some_and(|head| {
+        !head
+            .chars()
+            .last()
+            .is_some_and(|c| c.is_ascii_alphanumeric() || c == '_')
+    })
+}
+
+/// Ruby String#strip: ASCII whitespace and NUL.
+fn blank(b: &[u8]) -> bool {
+    b.iter()
+        .all(|c| matches!(c, b' ' | b'\t' | b'\n' | 0x0b | 0x0c | b'\r' | 0))
+}
+
+/// Net::HTTPResponse#inflater: gzip, x-gzip and deflate (any case) are inflated unless a
+/// Content-Range is present; Zlib::Inflate.new(32 + MAX_WBITS) auto-detects a zlib or gzip header,
+/// so both are accepted for each. Recognized encodings are removed even on empty bodies.
+/// A Zlib error escaping Faraday's adapter is a client_error, post-send.
+pub fn decode(mut raw: Raw) -> Result<Raw, Failure> {
+    let enc = raw.content_encoding.as_deref().map(str::to_ascii_lowercase);
+    if raw.content_range {
+        return Ok(raw);
+    }
+    match enc.as_deref() {
+        Some("gzip" | "x-gzip" | "deflate") => raw.content_encoding = None,
+        Some("none" | "identity") => {
+            raw.content_encoding = None;
+            return Ok(raw);
+        }
+        _ => return Ok(raw),
+    }
+    if raw.body.is_empty() {
+        return Ok(raw);
+    }
+    let mut out = Vec::new();
+    let result = if raw.body.starts_with(&[0x1f, 0x8b]) {
+        GzDecoder::new(&raw.body[..]).read_to_end(&mut out)
+    } else {
+        ZlibDecoder::new(&raw.body[..]).read_to_end(&mut out)
+    };
+    if let Err(e) = result {
+        if e.kind() != std::io::ErrorKind::UnexpectedEof {
+            return Err(Failure::new(Cause::Other, format!("Zlib::DataError: {e}")));
+        }
+        // net-http 0.9.1 read_body_0 returns from inside the inflater block for length/chunked
+        // bodies. Its ensure then suppresses finish's error because `success` was never set.
+        if raw.framing == BodyFraming::CloseDelimited {
+            return Err(Failure::new(Cause::Other, "Zlib::BufError: buffer error"));
+        }
+        // Ruby's block-form Inflate#inflate yields full 16 KiB buffers, flushing the remainder
+        // only on stream end. An incomplete stream never delivers that pending remainder.
+        const RUBY_ZLIB_BUFFER: usize = 16 * 1024;
+        out.truncate(out.len() / RUBY_ZLIB_BUFFER * RUBY_ZLIB_BUFFER);
+    }
+    raw.body = out.into();
+    Ok(raw)
+}
+
+pub fn shape(method: &str, url: &str, raw: Raw) -> Reply {
+    let text = || String::from_utf8_lossy(&raw.body).into_owned();
+    if (400..=599).contains(&raw.status) {
+        let message = if raw.body.is_empty() {
+            if raw.status == 407 {
+                "407 \"Proxy Authentication Required\"".into()
+            } else {
+                format!(
+                    "the server responded with status {} for {} {url}",
+                    raw.status,
+                    method.to_uppercase()
+                )
+            }
+        } else {
+            text()
+        };
+        return Reply::Status {
+            status: raw.status,
+            message,
+        };
+    }
+    if !json_type(raw.content_type.as_deref()) || blank(&raw.body) {
+        return Reply::NotJson;
+    }
+    match parse_strict(&raw.body) {
+        Some(v) => Reply::Parsed(v),
+        None => Reply::Status {
+            status: raw.status,
+            message: text(),
+        },
+    }
+}
+
+/// JSON 3.0.2 accepts invalid UTF-8 in strings. Rust values use replacement characters;
+/// downstream interpretation uses ASCII tokens. Syntax (including escapes and surrogates)
+/// remains strict, and duplicate keys are compared as unescaped bytes before lossy conversion.
+fn parse_strict(body: &[u8]) -> Option<serde_json::Value> {
+    let text = String::from_utf8_lossy(body);
+    let value = serde_json::from_str(&text).ok()?;
+    validate_structure(body)?;
+    Some(value)
+}
+
+/// The lossy parse has already checked grammar. Walk the original tokens to check byte-key
+/// identity and depth: distinct invalid keys can collapse in Value, hiding keys or subtrees.
+fn validate_structure(mut body: &[u8]) -> Option<()> {
+    let mut containers: Vec<Option<HashSet<Vec<u8>>>> = Vec::new();
+    while let Some((&token, rest)) = body.split_first() {
+        match token {
+            b'{' | b'[' => {
+                containers.push((token == b'{').then(HashSet::new));
+                // json 3.0.2 handles empty containers before incrementing current_nesting.
+                let closing = if token == b'{' { b'}' } else { b']' };
+                if containers.len() > 100
+                    && rest.iter().find(|b| !b.is_ascii_whitespace()) != Some(&closing)
+                {
+                    return None;
+                }
+            }
+            b'}' | b']' => {
+                containers.pop()?;
+            }
+            b'"' => {
+                let mut strings =
+                    serde_json::Deserializer::from_slice(body).into_iter::<ByteString>();
+                let string = strings.next()?.ok()?.0;
+                body = &body[strings.byte_offset()..];
+                if body.iter().find(|b| !b.is_ascii_whitespace()) == Some(&b':')
+                    && !containers.last_mut()?.as_mut()?.insert(string)
+                {
+                    return None;
+                }
+                continue;
+            }
+            _ => {}
+        }
+        body = rest;
+    }
+    Some(())
+}
+
+/// serde's byte-string decoder retains invalid UTF-8 and unescapes keys for comparison.
+/// Its permissive escape handling is safe only after the strict string parse above.
+struct ByteString(Vec<u8>);
+impl<'de> Deserialize<'de> for ByteString {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        d.deserialize_bytes(ByteStringVisitor)
+    }
+}
+struct ByteStringVisitor;
+impl<'de> Visitor<'de> for ByteStringVisitor {
+    type Value = ByteString;
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("a JSON string")
+    }
+    fn visit_bytes<E>(self, bytes: &[u8]) -> Result<Self::Value, E> {
+        Ok(ByteString(bytes.to_vec()))
+    }
+}