@kromatv/sdk 0.1.39-canary.3579809

package/rust/kroma-http/src/loopback/tcp.rs

@@ -0,0 +1,186 @@
+//! Built on hyper's own client, which cannot follow a redirect: a sidecar
+//! answering 302 is trying to move the core somewhere, and the only correct
+//! destination is the one the supervisor named.
+
+use std::sync::OnceLock;
+
+use anyhow::{bail, Context, Result};
+use bytes::Bytes;
+use http_body_util::{BodyExt, Full, Limited};
+use hyper_util::client::legacy::connect::HttpConnector;
+use hyper_util::client::legacy::Client;
+use hyper_util::rt::TokioExecutor;
+
+use super::transport::{Request, Transport};
+use crate::response::Response;
+
+/// Memory guard on a response body: what one wrong peer may make this process
+/// allocate, not a size any real payload on the seam approaches.
+pub const MAX_BODY_BYTES: usize = 64 * 1024 * 1024;
+
+/// Pooled HTTP/1.1 to another process on this machine.
+#[derive(Debug, Default)]
+pub struct Tcp;
+
+impl Transport for Tcp {
+    fn name(&self) -> &'static str {
+        "tcp"
+    }
+
+    fn accepts(&self, url: &str) -> bool {
+        is_loopback(url).unwrap_or(false)
+    }
+
+    fn send(&self, request: &Request<'_>) -> Result<Response> {
+        ensure_loopback(request.url)?;
+        let mut prepared = hyper::Request::builder()
+            .method(request.method.as_str())
+            .uri(request.url);
+        for (name, value) in request.headers {
+            prepared = prepared.header(name, value);
+        }
+        let body = match request.body {
+            Some((content_type, bytes)) => {
+                prepared = prepared.header("content-type", content_type);
+                Bytes::copy_from_slice(bytes)
+            }
+            None => Bytes::new(),
+        };
+        let prepared = prepared
+            .body(Full::new(body))
+            .context("build the loopback request")?;
+        let timeout = request.timeout;
+        block_on(async move {
+            // The budget covers the body too: a peer that answers its head and
+            // then stalls mid-body would otherwise hold this thread for as long
+            // as it likes.
+            tokio::time::timeout(timeout, async move {
+                let response = client()
+                    .request(prepared)
+                    .await
+                    .context("send the loopback request")?;
+                let status = response.status().as_u16();
+                let headers = response
+                    .headers()
+                    .iter()
+                    .map(|(name, value)| {
+                        (
+                            name.as_str().to_string(),
+                            String::from_utf8_lossy(value.as_bytes()).into_owned(),
+                        )
+                    })
+                    .collect();
+                let body = Limited::new(response.into_body(), MAX_BODY_BYTES)
+                    .collect()
+                    .await
+                    .map_err(|e| anyhow::anyhow!("read the loopback response body: {e}"))?;
+                Ok(Response {
+                    status,
+                    headers,
+                    body: body.to_bytes().to_vec(),
+                })
+            })
+            .await
+            .context("the loopback peer did not answer in time")?
+        })
+    }
+}
+
+fn client() -> &'static Client<HttpConnector, Full<Bytes>> {
+    static CLIENT: OnceLock<Client<HttpConnector, Full<Bytes>>> = OnceLock::new();
+    CLIENT.get_or_init(|| Client::builder(TokioExecutor::new()).build_http())
+}
+
+// `Handle::block_on` panics on a worker thread and `spawn_blocking` threads still
+// carry the ambient handle, so the work goes to a runtime that is not the
+// caller's.
+fn runtime() -> &'static tokio::runtime::Runtime {
+    static RUNTIME: OnceLock<tokio::runtime::Runtime> = OnceLock::new();
+    RUNTIME.get_or_init(|| {
+        tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(1)
+            .thread_name("kroma-loopback")
+            .enable_all()
+            .build()
+            .expect("build the loopback runtime")
+    })
+}
+
+// A sidecar builds with `panic = "abort"`, so a panic here would take the whole
+// module process down where the caller expects a recoverable error.
+fn block_on<T>(future: impl std::future::Future<Output = Result<T>> + Send + 'static) -> Result<T>
+where
+    T: Send + 'static,
+{
+    let (tx, rx) = std::sync::mpsc::sync_channel(1);
+    runtime().spawn(async move {
+        let _ = tx.send(future.await);
+    });
+    match rx.recv() {
+        Ok(outcome) => outcome,
+        Err(_) => bail!("the loopback exchange ended without a response"),
+    }
+}
+
+fn is_loopback(url: &str) -> Result<bool> {
+    let uri: hyper::Uri = url.parse().with_context(|| format!("parse the URL: {url}"))?;
+    if uri.scheme_str() != Some("http") {
+        return Ok(false);
+    }
+    let Some(host) = uri.host() else {
+        return Ok(false);
+    };
+    // An IPv6 host keeps its brackets through `host`, and loopback is a range
+    // rather than the one literal the supervisor happens to hand out, so this
+    // parses rather than matching strings.
+    let bare = host.trim_start_matches('[').trim_end_matches(']');
+    Ok(bare == "localhost"
+        || bare
+            .parse::<std::net::IpAddr>()
+            .is_ok_and(|ip| ip.is_loopback()))
+}
+
+fn ensure_loopback(url: &str) -> Result<()> {
+    if !is_loopback(url)? {
+        bail!("the tcp transport refuses {url}: not plain http on this machine");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_host_that_is_not_loopback_is_refused() {
+        let err = ensure_loopback("http://example.com/_port/x")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("example.com"), "{err}");
+    }
+
+    #[test]
+    fn every_spelling_of_this_machine_is_accepted() {
+        assert!(Tcp.accepts("http://127.0.0.1:9/_port/x"));
+        assert!(Tcp.accepts("http://localhost:9/_port/x"));
+        assert!(Tcp.accepts("http://[::1]:9/_port/x"));
+        assert!(Tcp.accepts("http://127.0.0.2:9/_port/x"));
+    }
+
+    #[test]
+    fn an_address_outside_the_loopback_range_is_refused() {
+        assert!(!Tcp.accepts("http://10.0.0.5:9/_port/x"));
+        assert!(!Tcp.accepts("http://169.254.169.254/latest/meta-data"));
+    }
+
+    #[test]
+    fn a_tls_url_is_refused_because_this_seam_has_no_tls_stack() {
+        assert!(!Tcp.accepts("https://127.0.0.1:9/_port/x"));
+    }
+
+    #[test]
+    fn an_unparseable_url_is_refused_rather_than_panicking() {
+        assert!(!Tcp.accepts("not a url"));
+        assert!(ensure_loopback("not a url").is_err());
+    }
+}

package/rust/kroma-http/src/loopback/transport.rs

@@ -0,0 +1,41 @@
+use std::time::Duration;
+
+use anyhow::Result;
+
+use crate::response::Response;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Method {
+    Get,
+    Post,
+}
+
+impl Method {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Get => "GET",
+            Self::Post => "POST",
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct Request<'a> {
+    pub method: Method,
+    pub url: &'a str,
+    pub headers: &'a [(String, String)],
+    pub body: Option<(&'a str, &'a [u8])>,
+    pub timeout: Duration,
+}
+
+/// A way for one KROMA process to reach another.
+///
+/// [`Transport::send`] blocks the calling thread. An implementation built on
+/// async internals owns that bridge itself.
+pub trait Transport: Send + Sync + 'static {
+    fn name(&self) -> &'static str;
+
+    fn accepts(&self, url: &str) -> bool;
+
+    fn send(&self, request: &Request<'_>) -> Result<Response>;
+}

package/rust/kroma-http/src/multipart.rs

@@ -0,0 +1,52 @@
+//! How one `multipart/form-data` part is spelled for curl.
+
+use std::path::Path;
+
+use crate::config::option_line;
+
+/// One part of a `multipart/form-data` body: a literal value, or a file read
+/// from disk at send time.
+#[derive(Debug, Clone, Copy)]
+pub enum FormPart<'a> {
+    Text(&'a str),
+    File(&'a Path),
+}
+
+// `form` reads a leading `@` as a file path and a leading `<` as a file to take
+// the value from, so a literal value travels as `form-string`, which reads
+// neither. A file name is quoted because `form` splits an unquoted one on `,`
+// and `;`.
+pub(crate) fn part_line(name: &str, part: FormPart<'_>) -> String {
+    match part {
+        FormPart::Text(value) => option_line("form-string", &format!("{name}={value}")),
+        FormPart::File(path) => option_line("form", &format!("{name}=@\"{}\"", path.display())),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_literal_value_is_never_read_as_a_file_path() {
+        assert_eq!(
+            part_line("mysubmit", FormPart::Text("@/etc/passwd")),
+            "form-string = \"mysubmit=@/etc/passwd\"\n"
+        );
+        assert_eq!(
+            part_line("mysubmit", FormPart::Text("Replace")),
+            "form-string = \"mysubmit=Replace\"\n"
+        );
+    }
+
+    #[test]
+    fn a_file_part_quotes_the_name_so_a_path_can_carry_a_separator() {
+        assert_eq!(
+            part_line(
+                "archive",
+                FormPart::File(Path::new("/data/a;b/channel.zip"))
+            ),
+            "form = \"archive=@\\\"/data/a;b/channel.zip\\\"\"\n"
+        );
+    }
+}

package/rust/kroma-http/src/response.rs

@@ -0,0 +1,130 @@
+//! The rendered outcome of one exchange.
+
+use anyhow::{bail, Context, Result};
+use serde::de::DeserializeOwned;
+
+/// One HTTP exchange: final status + final header block + body bytes.
+#[derive(Debug)]
+pub struct Response {
+    pub status: u16,
+    pub headers: Vec<(String, String)>,
+    pub body: Vec<u8>,
+}
+
+impl Response {
+    /// First header with this name, case-insensitively.
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(k, _)| k.eq_ignore_ascii_case(name))
+            .map(|(_, v)| v.as_str())
+    }
+
+    pub fn text(&self) -> String {
+        String::from_utf8_lossy(&self.body).into_owned()
+    }
+
+    pub fn json<T: DeserializeOwned>(&self) -> Result<T> {
+        serde_json::from_slice(&self.body)
+            .with_context(|| format!("parse JSON response: {}", snippet(&self.body)))
+    }
+
+    /// Error out (with a body snippet) unless the status is 2xx.
+    pub fn ensure_ok(self) -> Result<Self> {
+        if !(200..300).contains(&self.status) {
+            bail!("HTTP {}: {}", self.status, snippet(&self.body));
+        }
+        Ok(self)
+    }
+}
+
+fn snippet(body: &[u8]) -> String {
+    let text = String::from_utf8_lossy(body);
+    let trimmed = text.trim();
+    let mut s: String = trimmed.chars().take(200).collect();
+    if trimmed.chars().count() > 200 {
+        s.push_str("...");
+    }
+    s
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn header_lookup_is_case_insensitive() {
+        let resp = Response {
+            status: 409,
+            headers: vec![(
+                "X-Transmission-Session-Id".to_string(),
+                "abc123".to_string(),
+            )],
+            body: Vec::new(),
+        };
+        assert_eq!(resp.header("x-transmission-session-id"), Some("abc123"));
+        assert_eq!(resp.header("missing"), None);
+    }
+
+    #[test]
+    fn ensure_ok_rejects_non_2xx_with_snippet() {
+        let resp = Response {
+            status: 500,
+            headers: Vec::new(),
+            body: b"boom".to_vec(),
+        };
+        let err = resp.ensure_ok().unwrap_err().to_string();
+        assert!(err.contains("500"), "{err}");
+        assert!(err.contains("boom"), "{err}");
+    }
+
+    #[test]
+    fn snippet_trims_and_truncates_long_bodies() {
+        assert_eq!(snippet(b"  hi there  "), "hi there");
+        let long = "a".repeat(500);
+        let s = snippet(long.as_bytes());
+        assert_eq!(s.chars().count(), 203, "200 kept chars + the ... suffix");
+        assert!(s.ends_with("..."));
+        let exact = "b".repeat(200);
+        let s = snippet(exact.as_bytes());
+        assert_eq!(s.chars().count(), 200);
+        assert!(!s.ends_with("..."));
+    }
+
+    #[test]
+    fn response_text_and_json_round_trip_and_error() {
+        let resp = Response {
+            status: 200,
+            headers: Vec::new(),
+            body: br#"{"a":1}"#.to_vec(),
+        };
+        assert_eq!(resp.text(), r#"{"a":1}"#);
+        let v: serde_json::Value = resp.json().unwrap();
+        assert_eq!(v["a"], 1);
+
+        let bad = Response {
+            status: 200,
+            headers: Vec::new(),
+            body: b"not json at all".to_vec(),
+        };
+        let err = bad.json::<serde_json::Value>().unwrap_err().to_string();
+        assert!(err.contains("parse JSON"), "{err}");
+        assert!(err.contains("not json"), "{err}");
+    }
+
+    #[test]
+    fn ensure_ok_accepts_2xx() {
+        let resp = Response {
+            status: 204,
+            headers: Vec::new(),
+            body: Vec::new(),
+        };
+        assert!(resp.ensure_ok().is_ok());
+        let redirect = Response {
+            status: 300,
+            headers: Vec::new(),
+            body: b"moved".to_vec(),
+        };
+        assert!(redirect.ensure_ok().is_err());
+    }
+}

package/rust/kroma-i18n/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "kroma-i18n"
+version = "0.1.39-canary.3579809"
+edition = "2021"
+rust-version = "1.88"
+description = "Server-side i18n: a faithful Rust port of @kromatv/core's i18n (shared catalogs, plurals, fallback)"
+license = "AGPL-3.0-or-later"
+
+[dependencies]
+# The shared JSON catalogs are `include_str!`'d at compile time and parsed once,
+# lazily, on first use. serde_json is the only dependency.
+serde_json = { version = "1" }