itsi 0.2.21.rc1 → 0.2.21

data/crates/itsi_server/src/server/middleware_stack/mod.rs

@@ -49,7 +49,7 @@ impl StringMatch {
             let src_str = value.funcall::<_, _, String>("source", ())?;
             let regex = Regex::new(&src_str).map_err(|e| {
                 magnus::Error::new(
-                    magnus::exception::standard_error(),
+                    magnus::Ruby::get().unwrap().exception_standard_error(),
                     format!("Invalid regexp: {}", e),
                 )
             })?;
@@ -142,7 +142,7 @@ impl MiddlewareSet {
             let mut routes = vec![];
             for (index, route) in RArray::from_value(*routes_raw)
                 .ok_or(magnus::Error::new(
-                    magnus::exception::standard_error(),
+                    magnus::Ruby::get().unwrap().exception_standard_error(),
                     format!("Routes must be an array. Got {:?}", routes_raw),
                 ))?
                 .into_iter()
@@ -152,18 +152,18 @@ impl MiddlewareSet {
                 let route_raw = route_hash
                     .get("route")
                     .ok_or(magnus::Error::new(
-                        magnus::exception::standard_error(),
+                        magnus::Ruby::get().unwrap().exception_standard_error(),
                         "Route is missing :route key",
                     ))?
                     .funcall::<_, _, String>("source", ())?;
 
                 let middleware =
                     RHash::from_value(route_hash.get("middleware").ok_or(magnus::Error::new(
-                        magnus::exception::standard_error(),
+                        magnus::Ruby::get().unwrap().exception_standard_error(),
                         "Route is missing middleware key",
                     ))?)
                     .ok_or(magnus::Error::new(
-                        magnus::exception::standard_error(),
+                        magnus::Ruby::get().unwrap().exception_standard_error(),
                         format!("middleware must be a hash. Got {:?}", routes_raw),
                     ))?;
 
@@ -179,7 +179,7 @@ impl MiddlewareSet {
                             RArray::from_value(value)
                                 .ok_or_else(|| {
                                     magnus::Error::new(
-                                        magnus::exception::type_error(),
+                                        magnus::Ruby::get().unwrap().exception_type_error(),
                                         "Expected array",
                                     )
                                 })
@@ -232,7 +232,7 @@ impl MiddlewareSet {
             Ok(Self {
                 route_set: RegexSet::new(&routes).map_err(|e| {
                     magnus::Error::new(
-                        magnus::exception::standard_error(),
+                        magnus::Ruby::get().unwrap().exception_standard_error(),
                         format!("Failed to create route set: {}", e),
                     )
                 })?,
@@ -243,7 +243,7 @@ impl MiddlewareSet {
                     .collect::<std::result::Result<Vec<Regex>, regex::Error>>()
                     .map_err(|e| {
                         magnus::Error::new(
-                            magnus::exception::standard_error(),
+                            magnus::Ruby::get().unwrap().exception_standard_error(),
                             format!("Failed to create route set: {}", e),
                         )
                     })?
@@ -254,7 +254,7 @@ impl MiddlewareSet {
             })
         } else {
             Err(magnus::Error::new(
-                magnus::exception::standard_error(),
+                magnus::Ruby::get().unwrap().exception_standard_error(),
                 "Failed to create middleware stack",
             ))
         }
@@ -286,7 +286,7 @@ impl MiddlewareSet {
             self.route_set
         );
         Err(magnus::Error::new(
-            magnus::exception::standard_error(),
+            magnus::Ruby::get().unwrap().exception_standard_error(),
             format!(
                 "No matching middleware stack found for request: {:?}",
                 request
@@ -338,7 +338,7 @@ impl MiddlewareSet {
                 "app" => Ok(Middleware::RubyApp(RubyApp::from_value(parameters.into())?)),
                 "proxy" => Ok(Middleware::Proxy(Proxy::from_value(parameters)?)),
                 _ => Err(magnus::Error::new(
-                    magnus::exception::standard_error(),
+                    magnus::Ruby::get().unwrap().exception_standard_error(),
                     format!("Unknown filter type: {}", mw_type),
                 )),
             }
@@ -349,7 +349,7 @@ impl MiddlewareSet {
         match result {
             Ok(result) => Ok(result),
             Err(err) => Err(magnus::Error::new(
-                magnus::exception::standard_error(),
+                magnus::Ruby::get().unwrap().exception_standard_error(),
                 format!(
                     "Failed to instantiate middleware of type {}, due to {}",
                     middleware_type, err

data/crates/itsi_server/src/server/serve_strategy/cluster_mode.rs

@@ -145,9 +145,10 @@ impl ClusterMode {
 
                     call_with_gvl(|_| {
                         create_ruby_thread(move || {
-                            call_without_gvl(move || match worker_clone.boot(self_clone) {
-                                Err(err) => error!("Worker boot failed {:?}", err),
-                                _ => {}
+                            call_without_gvl(move || {
+                                if let Err(err) = worker_clone.boot(self_clone) {
+                                    error!("Worker boot failed {:?}", err);
+                                }
                             })
                         });
                     });

data/crates/itsi_server/src/services/password_hasher.rs

@@ -4,7 +4,7 @@ use argon2::{
 };
 
 use itsi_error::ItsiError;
-use magnus::{error::Result, Value};
+use magnus::{error::Result, Ruby, Value};
 use serde::Deserialize;
 use serde_magnus::deserialize;
 use sha_crypt::{
@@ -26,7 +26,13 @@ pub enum HashAlgorithm {
 }
 
 pub fn create_password_hash(password: String, algo: Value) -> Result<String> {
-    let hash_algorithm: HashAlgorithm = deserialize(algo)?;
+    let ruby = Ruby::get().map_err(|_| {
+        magnus::Error::new(
+            magnus::Ruby::get().unwrap().exception_runtime_error(),
+            "Failed to acquire Ruby VM handle",
+        )
+    })?;
+    let hash_algorithm: HashAlgorithm = deserialize(&ruby, algo)?;
     match hash_algorithm {
         HashAlgorithm::Bcrypt => {
             // Use the bcrypt crate for password hashing.

data/crates/itsi_server/src/services/rate_limiter.rs

@@ -6,9 +6,11 @@ use redis::{Client, RedisError, Script};
 use serde::Deserialize;
 use std::any::Any;
 use std::collections::{HashMap, HashSet};
+use std::fmt::Write as _;
 use std::result::Result;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, LazyLock};
-use std::time::{Duration, Instant};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 use tokio::sync::Mutex as AsyncMutex;
 use tokio::time::timeout;
 use tracing::warn;
@@ -303,27 +305,37 @@ impl RateLimiter for InMemoryRateLimiter {
 
         let mut entries = self.entries.write();
 
-        let entry = entries
-            .entry(key.to_string())
-            .or_insert_with(|| RateLimitEntry {
-                count: 0,
-                expires_at: now + timeout,
-            });
+        // Avoid per-request allocation: only allocate a String when inserting a new key.
+        //
+        // NOTE: we use `get_mut` first because `HashMap::entry` for `HashMap<String, _>`
+        // requires an owned `String`, which would allocate on every request.
+        if let Some(entry) = entries.get_mut(key) {
+            if entry.expires_at < now {
+                entry.expires_at = now + timeout;
+                entry.count = 1;
+            } else {
+                entry.count += 1;
+            }
+
+            let ttl = if entry.expires_at > now {
+                entry.expires_at.duration_since(now).as_secs()
+            } else {
+                0
+            };
 
-        if entry.expires_at < now {
-            entry.expires_at = now + timeout;
-            entry.count = 1;
-        } else {
-            entry.count += 1;
+            return Ok((entry.count, ttl));
         }
 
-        let ttl = if entry.expires_at > now {
-            entry.expires_at.duration_since(now).as_secs()
-        } else {
-            0
-        };
+        // Insert path: allocate once for the new key.
+        entries.insert(
+            key.to_owned(),
+            RateLimitEntry {
+                count: 1,
+                expires_at: now + timeout,
+            },
+        );
 
-        Ok((entry.count, ttl))
+        Ok((1, timeout.as_secs()))
     }
 
     async fn check_limit(
@@ -378,14 +390,49 @@ impl BanManager {
 }
 
 /// Utility function to create a rate limit key for a specific minute
-pub fn create_rate_limit_key(api_key: &str, resource: &str) -> String {
-    // Get the current minute number (0-59)
-    let now = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default();
+static CACHED_MINUTE_BUCKET_SECS: AtomicU64 = AtomicU64::new(0);
+static CACHED_MINUTE_BUCKET: AtomicU64 = AtomicU64::new(0);
+
+#[inline]
+fn cached_minute_bucket() -> u64 {
+    // Cache the computed minute bucket and only refresh at most once per second.
+    // This avoids a syscall and divisions/mods on every request, while preserving
+    // the exact same value as the previous implementation.
+    let now_secs = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    let last = CACHED_MINUTE_BUCKET_SECS.load(Ordering::Relaxed);
+    if last != now_secs {
+        let minutes = (now_secs / 60) % 60;
+        CACHED_MINUTE_BUCKET.store(minutes, Ordering::Relaxed);
+        CACHED_MINUTE_BUCKET_SECS.store(now_secs, Ordering::Relaxed);
+        minutes
+    } else {
+        CACHED_MINUTE_BUCKET.load(Ordering::Relaxed)
+    }
+}
 
-    let minutes = now.as_secs() / 60 % 60;
-    format!("ratelimit:{}:{}:{}", api_key, resource, minutes)
+pub fn create_rate_limit_key(api_key: &str, resource: &str) -> String {
+    let minutes = cached_minute_bucket();
+
+    // Build the exact same string as:
+    // format!("ratelimit:{}:{}:{}", api_key, resource, minutes)
+    // but avoid `format!` machinery and minimize reallocations.
+    let mut s = String::with_capacity(
+        "ratelimit:".len() + api_key.len() + 1 + resource.len() + 1 + 2, // minutes is 0-59
+    );
+
+    s.push_str("ratelimit:");
+    s.push_str(api_key);
+    s.push(':');
+    s.push_str(resource);
+    s.push(':');
+    // u64->decimal without intermediate allocation
+    let _ = write!(&mut s, "{}", minutes);
+
+    s
 }
 
 /// Utility function to create a ban key for an IP address

data/crates/itsi_server/src/services/static_file_server.rs

@@ -127,6 +127,38 @@ impl CacheEntry {
         &self,
         supported_encodings: &[HeaderValue],
     ) -> (Arc<Bytes>, Option<HeaderValue>) {
+        // Fast-path: if the caller already computed a preferred single encoding token,
+        // it will pass exactly one HeaderValue (e.g. "br"). This avoids per-request
+        // string splitting/parsing on the cached static file hot-path.
+        if supported_encodings.len() == 1 {
+            let hv = &supported_encodings[0];
+            if hv == HEADER_VALUE_ZSTD {
+                if let Some(zstd) = self.zstd.as_ref() {
+                    return (zstd.clone(), Some(HEADER_VALUE_ZSTD.clone()));
+                }
+                return (self.content.clone(), None);
+            }
+            if hv == HEADER_VALUE_BR {
+                if let Some(br) = self.br.as_ref() {
+                    return (br.clone(), Some(HEADER_VALUE_BR.clone()));
+                }
+                return (self.content.clone(), None);
+            }
+            if hv == HEADER_VALUE_GZIP {
+                if let Some(gz) = self.gz.as_ref() {
+                    return (gz.clone(), Some(HEADER_VALUE_GZIP.clone()));
+                }
+                return (self.content.clone(), None);
+            }
+            if hv == HEADER_VALUE_DEFLATE {
+                if let Some(deflate) = self.deflate.as_ref() {
+                    return (deflate.clone(), Some(HEADER_VALUE_DEFLATE.clone()));
+                }
+                return (self.content.clone(), None);
+            }
+        }
+
+        // Slow-path: parse Accept-Encoding values and select the first supported encoding.
         for encoding_header in supported_encodings {
             if let Ok(header_value) = encoding_header.to_str() {
                 for header_value in header_value.split(",").map(|hv| hv.trim()) {
@@ -416,15 +448,12 @@ impl StaticFileServer {
         abs_path: &str,
         accept: ResponseFormat,
     ) -> std::result::Result<ResolvedAsset, NotFoundBehavior> {
-        let ext_opt = Path::new(key)
-            .extension()
-            .and_then(|e| e.to_str())
-            .map(|s| s.to_lowercase());
+        let ext_opt = Path::new(key).extension().and_then(|e| e.to_str());
 
         // If the allowed list is non-empty, enforce membership
         if !self.allowed_extensions.is_empty() {
             match ext_opt {
-                Some(ref ext)
+                Some(ext)
                     if self
                         .allowed_extensions
                         .iter()
@@ -569,8 +598,7 @@ impl StaticFileServer {
                             }
                         }
                     }
-                    if index_file.is_some() {
-                        let index_path = index_file.unwrap();
+                    if let Some(index_path) = index_file {
                         self.key_to_path
                             .lock()
                             .insert(key.to_string(), index_path.clone());
@@ -876,10 +904,7 @@ impl StaticFileServer {
                         content_length.to_string()
                     },
                 )
-                .header(
-                    "Last-Modified",
-                    format_http_date_header(cache_entry.last_modified),
-                );
+                .header("Last-Modified", cache_entry.last_modified_http_date.clone());
 
             if let Some(range) = content_range {
                 builder = builder.header("Content-Range", range);
@@ -1228,8 +1253,8 @@ async fn generate_directory_listing(
             });
 
             // Serialize the JSON object to a pretty-printed string.
-            let json_string = serde_json::to_string_pretty(&json_obj)
-                .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+            let json_string =
+                serde_json::to_string_pretty(&json_obj).map_err(std::io::Error::other)?;
 
             Ok(json_string)
         }

data/crates/itsi_tracing/src/lib.rs

@@ -1,4 +1,4 @@
-use atty::{Stream, is};
+use atty::{is, Stream};
 use std::{
     env,
     sync::{Mutex, OnceLock},
@@ -10,8 +10,8 @@ use tracing_subscriber::fmt::{
     format::{FmtSpan, JsonFields},
     writer::BoxMakeWriter,
 };
-use tracing_subscriber::{EnvFilter, fmt, prelude::*, reload};
-use tracing_subscriber::{Layer, Registry, layer::Layered};
+use tracing_subscriber::{fmt, prelude::*, reload, EnvFilter};
+use tracing_subscriber::{layer::Layered, Layer, Registry};
 
 // Global reload handle for changing the level at runtime.
 static RELOAD_HANDLE: OnceLock<