@voxgig/sdkgen 4.20.0 → 4.22.0

package/project/.sdk/tm/rust/feature/validate.rs

@@ -0,0 +1,306 @@
+
+use std::rc::Rc;
+
+use crate::core::context::Context;
+use crate::core::helpers::{getp, setp};
+use crate::core::types::{Feature, OutVal};
+use crate::feature::support::*;
+use crate::utility::voxgigstruct as vs;
+use crate::utility::voxgigstruct::{InjectDef, Value};
+
+// Built rather than written, so the backticks cannot be lost in an edit.
+fn open_key() -> String {
+    format!("{}$OPEN{}", 96u8 as char, 96u8 as char)
+}
+
+pub struct ValidateFeature {
+    pub name: String,
+    pub active: bool,
+    pub add_opts: Option<Value>,
+    options: Value,
+    spec: Value,
+
+    request: bool,
+    response: bool,
+    mode: String,
+}
+
+impl ValidateFeature {
+    pub fn new() -> ValidateFeature {
+        ValidateFeature {
+            name: "validate".to_string(),
+            active: true,
+            add_opts: None,
+            options: Value::Noval,
+            spec: Value::empty_map(),
+            request: true,
+            response: false,
+            mode: "throw".to_string(),
+        }
+    }
+
+    fn payload(&self, ctx: &Rc<Context>, opname: &str) -> Value {
+        let body = "create" == opname || "update" == opname || "patch" == opname;
+
+        let base = if body {
+            ctx.data.borrow().clone()
+        } else {
+            ctx.mtch.borrow().clone()
+        };
+        let req = if body {
+            ctx.reqdata.borrow().clone()
+        } else {
+            ctx.reqmatch.borrow().clone()
+        };
+
+        let out = Value::empty_map();
+        for src in [&base, &req] {
+            if let Some(m) = src.as_map() {
+                for (k, v) in m.borrow().iter() {
+                    setp(&out, k, v.clone());
+                }
+            }
+        }
+
+        if let Some(m) = out.as_map() {
+            m.borrow_mut().shift_remove("$action");
+        }
+
+        out
+    }
+
+    fn entity_spec(&self, ctx: &Rc<Context>) -> Value {
+        getp(&self.spec, &entname(ctx))
+    }
+
+    fn check(
+        &self,
+        ctx: &Rc<Context>,
+        data: &Value,
+        spec: &Value,
+        direction: &str,
+    ) -> Vec<String> {
+        let collector = Value::empty_list();
+        let injdef = InjectDef {
+            errs: Some(collector.clone()),
+            ..Default::default()
+        };
+
+        // A spec this port cannot run at all (rather than a payload that
+        // fails it) must not take the operation down with it: report it like
+        // any other failure and let `mode` decide.
+        let ran = vs::validate(data, spec, Some(&injdef));
+
+        let mut errs: Vec<String> = Vec::new();
+        if let Some(l) = collector.as_list() {
+            for e in l.borrow().iter() {
+                errs.push(errmsg(e));
+            }
+        }
+        if errs.is_empty() {
+            if let Err(e) = ran {
+                errs.push(e.message);
+            }
+        }
+
+        if !errs.is_empty() {
+            let report = Value::empty_map();
+            setp(&report, "entity", Value::str(entname(ctx)));
+            setp(&report, "op", Value::str(opname(ctx)));
+            setp(&report, "direction", Value::str(direction));
+            setp(
+                &report,
+                "errs",
+                Value::list(errs.iter().map(Value::str).collect()),
+            );
+            setp(&report, "data", data.clone());
+            report_invalid(&self.options, &report);
+        }
+
+        errs
+    }
+}
+
+impl Feature for ValidateFeature {
+    fn name(&self) -> String {
+        self.name.clone()
+    }
+    fn active(&self) -> bool {
+        self.active
+    }
+    fn add_options(&self) -> Option<Value> {
+        self.add_opts.clone()
+    }
+
+    fn init(&mut self, _ctx: &Rc<Context>, options: &Value) {
+        self.options = options.clone();
+        self.active = fopt_bool(options, "active", false);
+
+        // DEFAULTS ARE APPLIED HERE, not by the option spec. The model's
+        // `config.options` documents them and types them; it does not inject
+        // them, because each feature entry in the spec is optional and struct
+        // fills in nothing through an optional union. So every feature
+        // resolves its own.
+        self.request = fopt_bool(options, "request", true);
+        self.response = fopt_bool(options, "response", false);
+
+        // FAIL CLOSED. Only the exact string "report" selects report mode, so
+        // a typo (`mode: "thow"`) still rejects rather than silently turning
+        // enforcement off - the failure nobody would notice. The option spec
+        // rejects the typo outright; this is what happens if it ever does not.
+        self.mode = if "report" == fopt_str(options, "mode", "throw") {
+            "report".to_string()
+        } else {
+            "throw".to_string()
+        };
+
+        // `strict` is applied ONCE, here, by rebuilding the spec tree without
+        // the `$OPEN` markers - rather than per call, which would clone a
+        // spec for every request an SDK ever makes. REBUILT, not mutated:
+        // `Value` is Rc-backed, so a clone shares its maps with the module
+        // constant every other client in the process reads.
+        let entityspec = crate::core::schema::entityspec();
+        self.spec = if fopt_bool(options, "strict", false) {
+            close(&entityspec)
+        } else {
+            entityspec
+        };
+    }
+
+    fn pre_spec(&mut self, ctx: &Rc<Context>) {
+        if !self.active || !self.request {
+            return;
+        }
+
+        let opname = opname(ctx);
+        let opspec = getp(&getp(&self.entity_spec(ctx), "op"), &opname);
+        if opspec.is_nullish() {
+            return;
+        }
+
+        let payload = self.payload(ctx, &opname);
+        let errs = self.check(ctx, &payload, &opspec, "request");
+        if errs.is_empty() || "report" == self.mode {
+            return;
+        }
+
+        let err = ctx.make_error(
+            "validate_failed",
+            &format!(
+                "Invalid {} request for entity \"{}\": {}",
+                opname,
+                entname(ctx),
+                errs.join("; ")
+            ),
+        );
+        ctx.out_set("spec", OutVal::Err(err));
+    }
+
+    fn pre_done(&mut self, ctx: &Rc<Context>) {
+        if !self.active || !self.response {
+            return;
+        }
+
+        let dataspec = getp(&self.entity_spec(ctx), "data");
+        if dataspec.is_nullish() {
+            return;
+        }
+
+        let result = match ctx.result.borrow().clone() {
+            Some(r) => r,
+            None => return,
+        };
+
+        let resdata = result.borrow().resdata.clone();
+        if resdata.is_nullish() {
+            return;
+        }
+
+        let records: Vec<Value> = match resdata.as_list() {
+            Some(l) => l.borrow().clone(),
+            None => vec![resdata.clone()],
+        };
+
+        let mut errs: Vec<String> = Vec::new();
+        for record in records.iter() {
+            if record.is_nullish() {
+                continue;
+            }
+
+            // A NON-OBJECT IS A FAILURE, not something to skip. A load that
+            // answered 42 where the entity's spec wants a record must not
+            // pass this feature silently - struct rejects it with the field
+            // it could not find.
+            errs.extend(self.check(ctx, record, &dataspec, "response"));
+        }
+
+        if errs.is_empty() || "report" == self.mode {
+            return;
+        }
+
+        let err = ctx.make_error(
+            "validate_failed",
+            &format!(
+                "Invalid response for entity \"{}\": {}",
+                entname(ctx),
+                errs.join("; ")
+            ),
+        );
+
+        let mut r = result.borrow_mut();
+        r.ok = false;
+        r.err = Some(err);
+        r.resdata = Value::Noval;
+    }
+}
+
+fn opname(ctx: &Rc<Context>) -> String {
+    ctx.op.borrow().name.clone()
+}
+
+fn entname(ctx: &Rc<Context>) -> String {
+    let name = match ctx.entity.borrow().clone() {
+        Some(e) => e.get_name(),
+        None => String::new(),
+    };
+    if !name.is_empty() {
+        return name;
+    }
+    ctx.op.borrow().entity.clone()
+}
+
+fn errmsg(v: &Value) -> String {
+    match v {
+        Value::Str(s) => s.clone(),
+        _ => vs::stringify(v, None, false),
+    }
+}
+
+// The `onInvalid` callback, if the options carry one. Held as a struct
+// `Value::Func`, which is the only function shape an option map can hold in
+// this port; it is called with the report as its value argument and its
+// return is discarded.
+fn report_invalid(options: &Value, report: &Value) {
+    let cb = getp(options, "onInvalid");
+    if let Value::Func(f) = cb {
+        let inj = crate::utility::voxgigstruct::Injection::from_def(None);
+        let _ = f(&inj, report, "", &Value::empty_map());
+    }
+}
+
+fn close(node: &Value) -> Value {
+    match node {
+        Value::List(l) => Value::list(l.borrow().iter().map(close).collect()),
+        Value::Map(m) => {
+            let out = Value::empty_map();
+            let open = open_key();
+            for (k, v) in m.borrow().iter() {
+                if *k != open {
+                    setp(&out, k, close(v));
+                }
+            }
+            out
+        }
+        _ => node.clone(),
+    }
+}

package/project/.sdk/tm/rust/tests/common/mod.rs

@@ -1,13 +1,3 @@
-// Shared SDK test SUPPORT: the helpers the generated entity/direct tests and
-// the corpus call sites share — env loading, the sdk-test-control.json skip
-// and pacing machinery, corpus access, entity-data conversion, ctx
-// construction from a JSON test entry, and the fh* feature-test harness
-// (mirrors tm/go/test/testsupport_test.go plus the fh* harness from
-// tm/go/test/feature_test.go). Each test binary includes it with
-// `mod common;`.
-//
-// The corpus ENGINE half of this file was retired by the vendor-tag rollout:
-// see the note where it used to be, and tests/omni_resolver/mod.rs.
 
 #![allow(dead_code)]
 
@@ -40,7 +30,6 @@ pub fn read_json(path: &PathBuf) -> Value {
     json_parse(&txt).unwrap_or_else(|e| panic!("failed to parse {:?}: {}", path, e))
 }
 
-/// The shared test spec ../.sdk/test/test.json.
 pub fn load_test_spec() -> Value {
     let mut p = manifest_dir();
     p.push("..");
@@ -100,22 +89,6 @@ pub fn is_control_skipped(kind: &str, name: &str, mode: &str) -> (bool, String)
     (false, String::new())
 }
 
-/// Extra SDK options every LIVE client is constructed with, read from
-/// sdk-test-control.json `test.client.options`.
-///
-/// The generated live client knows two things: the base URL (from the spec)
-/// and the credential (from the environment). Everything else about how a
-/// particular API wants to be talked to - which features to switch on, and
-/// with what settings - is a property of THAT API, known to the project and
-/// to nothing in the toolchain.
-///
-/// Merged UNDER the generated fields, so the suite's own base/apikey/server
-/// values win: this ADDS to the live client, it does not redirect it.
-///
-/// Reserved fields are stripped HERE rather than at each merge site: the
-/// generated map only names a field when the model calls for one, so a
-/// "base" in this block would face no competing value and would silently
-/// redirect the whole suite - credential included - to another host.
 pub const LIVE_RESERVED: [&str; 6] =
     ["base", "prefix", "suffix", "server", "apikey", "secret"];
 
@@ -240,14 +213,6 @@ pub fn json_normalize(v: &Value) -> Value {
     }
 }
 
-// The corpus ENGINE that used to live here — `runset` / `runset_named`
-// (the entry loop) and `match_deep` / `match_string` (the match engine) —
-// is superseded by the vendored @voxgig/omni runner, driven through the
-// adapter in tests/omni_resolver/mod.rs (vendor-tag rollout, Decision 4).
-// This file keeps its SUPPORT half under its own name — env loading, the
-// sdk-test-control skip/pacing machinery, corpus and entity-data access,
-// ctx construction from a JSON entry, and the fh feature harness — so the
-// emitted call sites did not move.
 
 // ---- ctx construction from JSON test entries --------------------------------------
 

package/project/.sdk/tm/rust/tests/custom_utility_test.rs

@@ -1,5 +1,3 @@
-// Custom utility overrides (mirrors tm/go/test/custom_utility_test.go):
-// caller-supplied callables in options.utility land on utility.custom.
 
 use RUSTCRATE::core::helpers::{call_vfn, getp, jo, vfn};
 use RUSTCRATE::{test_sdk, Value};

package/project/.sdk/tm/rust/tests/feature/secrets/main.rs

@@ -1,28 +1,3 @@
-// Behavioural tests for the secrets feature (vendored @voxgig/sekreto).
-//
-// The contract under test: the `apikey` OPTION keeps its exact old meaning
-// and always wins, because the feature places it FIRST in the provider
-// chain (a `memory` store named `options`) - explicit-beats-lookup falls
-// out of sekreto's first-hit rule rather than from special-case logic. With
-// the feature inactive nothing changes at all. With it active and the
-// option unset, the chain supplies the credential instead.
-//
-// EVERY CLIENT HERE IS LIVE, and the thing counted is `system.fetch` - the
-// real transport the whole fetcher chain ends at. That is deliberate, and
-// it is the mistake this file exists to avoid: under `test_sdk` the test
-// feature REPLACES the transport with its own in-memory mock, so a counter
-// hung off `system.fetch` is never reached, and "no request was sent" would
-// hold for a healthy SDK carrying no secrets feature at all. An assertion
-// that cannot fail pins no rule. So each fail-closed case proves its own
-// counter FIRST, with the same construction and a WORKING provider: one
-// request must reach `system.fetch` carrying the resolved credential. Only
-// then does a zero from the broken provider mean REFUSED rather than
-// UNWIRED. And the refusal is matched on the PROVIDER'S OWN message, so an
-// unrelated failure cannot stand in for fail-closed.
-//
-// This file lives in the `feature/` container on purpose: `target add`
-// trims it, along with the feature source and the vendored library, for a
-// project whose model does not select `secrets`.
 
 use std::cell::RefCell;
 use std::rc::Rc;
@@ -38,14 +13,6 @@ const BASE: &str = "http://secrets.test/api";
 
 // ---- the counted transport ---------------------------------------------
 
-/// One recorded request, SNAPSHOT at the moment it was handed to the
-/// transport.
-///
-/// A snapshot, not the fetchdef itself, and that is load-bearing: the
-/// fetchdef's `headers` map is an Rc the retry path rewrites IN PLACE, so
-/// a recorder that kept the live map would report every earlier call as
-/// carrying the LAST token - and "the retry carried a new credential"
-/// would pass whether or not it did.
 #[derive(Clone)]
 struct Call {
     url: String,
@@ -205,12 +172,6 @@ fn authof(fetchdef: &Value) -> Option<String> {
     }
 }
 
-// The Authorization header carries the SPEC's credential prefix, which a
-// TEMPLATE cannot know: an OpenAPI `http`/`bearer` scheme gives
-// `Bearer <token>`, an apiKey scheme the raw token. So assert on the
-// CREDENTIAL and let the prefix be whatever this SDK's API declares -
-// pinning the whole header value passes only for a prefix-less API, and
-// this file ships to every project that selects the feature.
 fn credential_is(header: Option<String>, token: &str) {
     let got = header.unwrap_or_default();
     assert!(
@@ -227,14 +188,6 @@ fn call_auth(calls: &[Call], i: usize) -> Option<String> {
 
 // ---- clients ------------------------------------------------------------
 
-// `allow.op` is named explicitly: a project that narrows the default set
-// would otherwise turn the raw-path cases into a false RED (the control leg
-// refused before it reached the transport), and the rule under test lives
-// at the transport, downstream of the allow gate either way.
-//
-// `base` is named explicitly too: a LIVE client whose model has a templated
-// base URL panics on a missing server variable at construction, and this
-// file ships to every project.
 fn sdk(wire: &Wire, secrets: Vec<(&str, Value)>) -> Rc<ProjectNameSDK> {
     let fopts = jo(vec![("active", Value::Bool(true))]);
     for (k, v) in secrets {
@@ -303,15 +256,6 @@ fn secrets_call(client: &Rc<ProjectNameSDK>, args: Vec<Value>) -> Value {
 
 // ---- the ENTITY path ----------------------------------------------------
 
-/// One request through the REAL entity-request utility, on the client's own
-/// utility - the one the feature wrapped.
-///
-/// `direct()` and `graphql()` are the raw paths and are exercised as
-/// themselves below; this is the OTHER half, and it cannot be reached by
-/// naming an entity because this file is a TEMPLATE and no project's entity
-/// names are known here. `make_request` is the utility every generated
-/// entity op ends at, so driving it directly exercises the same seam with
-/// the same wiring.
 fn entity_request(client: &Rc<ProjectNameSDK>, path: &str) -> Option<String> {
     let rootctx = client.get_root_ctx();
     let utility = rootctx.util();
@@ -514,12 +458,6 @@ fn auth_null_suppresses_the_credential_chain_or_no_chain() {
         wire.trace()
     );
 
-    // The suppression survives option validation rather than being replaced
-    // by the optspec's default auth map.
-    //
-    // Read from the RAW map: `getp` applies the Group A rule and answers
-    // the alt for a stored null, so it cannot tell an absent auth from a
-    // suppressed one - and only the latter is a suppression.
     let opts = client.options_map();
     let suppressed = match &opts {
         Value::Map(m) => matches!(m.borrow().get("auth"), Some(Value::Null)),
@@ -787,13 +725,6 @@ fn an_unknown_provider_kind_refuses_rather_than_sending() {
     assert_eq!(control.sent(), 1, "the control request never reached the wire");
 }
 
-// A MALFORMED entry is the same rule again, and the one a typed port can
-// get wrong silently: `providers` is a Value list, so an entry that is
-// neither a callable nor a spec map (a bare "hashicorp" where a spec was
-// meant) matches no arm. Dropping it leaves the chain quietly SHORTER than
-// the options say - a fail-OPEN that sends the request without the
-// credential the project configured. It must refuse instead, carrying
-// sekreto's own wording, on every wire path.
 const MALFORMED_MSG: &str = "sekreto: not a provider or a provider spec";
 
 #[test]
@@ -879,15 +810,6 @@ fn the_selected_plugin_kinds_have_distinct_names() {
     );
 }
 
-// A SELECTED plugin kind is really in the vocabulary.
-//
-// Construction is where an unknown kind is refused, so a chain that names
-// the kind and still reaches the wire IS the check. The memory store comes
-// FIRST so sekreto's first-hit rule answers from it and the vault is never
-// contacted - the kind has to be declarable, not reachable.
-//
-// Conditional on the kind being selected, because this file ships to
-// projects that take the feature without the `vault` plugin group.
 #[test]
 fn a_selected_plugin_kind_is_in_the_sdk_vocabulary() {
     let defs = RUSTCRATE::feature::secrets::plugins::definitions();
@@ -990,13 +912,10 @@ fn cache_false_asks_the_chain_on_every_request() {
 }
 
 // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this feature
-// used to override from the layer above.
 //
 // DEFAULT caching here, which is the whole point: `cache: true` is about
 // holding a HIT (the test below pins that half), and keeping the settled
 // resolution after a miss meant the chain was never asked again for the life
-// of the client. A secret provisioned after startup (a mounted file, a vault
-// policy granted a minute late) was invisible forever.
 #[test]
 fn cache_true_re_asks_after_a_miss() {
     let wire = Wire::new();
@@ -1153,12 +1072,6 @@ fn sekreto_is_live_for_arbitrary_secrets_and_redaction() {
     );
 }
 
-// ---- ACCESS-TOKEN EXCHANGE ----------------------------------------------
-//
-// What the chain resolves is a REFRESH token, which is POSTed to a token
-// endpoint for a short-lived ACCESS token; the access token is what the
-// Authorization header carries; and when the API answers 401 the client
-// buys another and tries the same request again, once.
 
 const REFRESH: &str = "REFRESH01";
 
@@ -1252,7 +1165,6 @@ fn an_expiry_buys_another_token_and_retries_the_same_request() {
     assert_eq!(wire.token().len(), 2, "expected a second token purchase");
     assert_eq!(wire.api().len(), 2, "expected the request to be retried");
     credential_is(call_auth(&wire.api(), 0), "ACCESS01");
-    // The retry must carry the NEW token, not the spent one.
     credential_is(call_auth(&wire.api(), 1), "ACCESS02");
     assert_eq!(
         getp(&res, "ok"),
@@ -1489,7 +1401,6 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
     );
 
     // AND NO PURCHASE. resolve() runs before with_refresh's suppression
-    // check, so the refresh token used to go to the token endpoint in a
     // request body even here. Stopping the retry does not unsend it, and
     // only the token endpoint can see this.
     assert_eq!(
@@ -1501,12 +1412,6 @@ fn exchange_auth_null_suppresses_and_is_never_retried() {
     );
 }
 
-// The exchange with NO system.fetch: the ordinary case, where make_options
-// leaves the seam unset and the purchase takes its own raw HTTP path. There
-// is no token endpoint to talk to here, so what this pins is that the
-// fallback EXISTS and reports - before this, `buy` with no custom transport
-// simply had nothing to call - and that a failed purchase refuses the
-// operation rather than sending it unauthenticated.
 #[test]
 fn the_exchange_has_a_raw_transport_when_no_system_fetch_is_given() {
     // Port 1 is reserved and never listening, so the connection is refused

package/project/.sdk/tm/rust/tests/feature_test.rs

@@ -1,10 +1,3 @@
-// Behavioural tests for the enterprise features shipped with this SDK
-// (mirrors tm/go/test/feature_test.go). Feature behaviour is unit-tested
-// by driving each feature through a faithful miniature of the real
-// operation pipeline against a configurable mock transport — the same hook
-// order and short-circuit rules as the generated entity op code, but with
-// no live server and no API-specific fixtures. Each block runs only when
-// its feature is present in this SDK (see common::fh_present).
 
 mod common;
 
@@ -1828,15 +1821,6 @@ fn feature_proxy_inactive_does_not_wrap() {
 
 // --- station --------------------------------------------------------------------
 
-// The station adapter (installed by @voxgig/sdkgen-station) with NO open
-// station must be an inert no-op that emits nothing and fails nothing
-// (station design 3.1). Constructed through the generated make_feature
-// factory - never a compile-time module reference - so this file stays
-// compilable both with and without the station feature installed: absent,
-// the factory answers with the inert BaseFeature and fh_present skips the
-// assertions. Bound behaviour (registration, injection, wire events) is
-// exercised by the station library's own suite and the consumer-side
-// station validation, not here.
 #[test]
 fn feature_station_inert_without_open_station() {
     if !fh_present(&["station"]) {

package/project/.sdk/tm/rust/tests/netsim_test.rs

@@ -1,9 +1,3 @@
-// Network-behaviour simulation over the offline mock transport (mirrors
-// tm/go/test/netsim_test.go). The `test` feature accepts an optional `net`
-// config so unit tests can exercise slow, failing and offline conditions
-// without a live server. These checks drive the transport through
-// direct(), which needs no entity, so they run for every generated SDK
-// regardless of its API shape.
 
 use RUSTCRATE::core::helpers::{getp, jo, now_ms};
 use RUSTCRATE::{test_sdk, Value};