castrum 0.7.0

package/rust/ip_trust.rs

@@ -0,0 +1,185 @@
+use crate::util::trim_ascii_whitespace;
+use ipnet::{IpNet, Ipv4Net, Ipv6Net};
+use napi::{Error, Result, Status};
+use std::net::IpAddr;
+use xxhash_rust::xxh3::Xxh3;
+
+#[derive(Clone)]
+pub enum ProxyTrustMode {
+    None,
+    All,
+    Networks(Vec<IpNet>),
+}
+
+impl ProxyTrustMode {
+    pub fn from_config(enabled: bool, networks: Option<Vec<String>>) -> Result<Self> {
+        if !enabled {
+            return Ok(Self::None);
+        }
+
+        // Safety: an enabled trust-proxy mode with NO explicit networks must
+        // never fall back to ProxyTrustMode::All (which trusts every hop and
+        // lets clients spoof X-Forwarded-For). Treat it as "trust nothing"
+        // unless the operator explicitly lists trusted networks.
+        let Some(networks) = networks else {
+            return Ok(Self::Networks(Vec::new()));
+        };
+
+        if networks.is_empty() {
+            return Ok(Self::Networks(Vec::new()));
+        }
+
+        let mut out = Vec::with_capacity(networks.len());
+
+        for raw in networks {
+            let raw = raw.trim();
+            if raw.is_empty() {
+                continue;
+            }
+
+            if let Ok(ip) = raw.parse::<IpAddr>() {
+                out.push(ip_to_net(ip));
+            } else {
+                let net: IpNet = raw.parse().map_err(|_| {
+                    Error::new(
+                        Status::InvalidArg,
+                        format!("invalid trusted proxy network: {raw}"),
+                    )
+                })?;
+                out.push(net);
+            }
+        }
+
+        // Networks that filtered down to nothing -> trust nothing (see above).
+        Ok(Self::Networks(out))
+    }
+
+    #[inline(always)]
+    pub fn is_none(&self) -> bool {
+        matches!(self, Self::None)
+    }
+
+    pub fn is_trusted(&self, ip: IpAddr) -> bool {
+        match self {
+            Self::None => false,
+            Self::All => true,
+            Self::Networks(nets) => nets.iter().any(|n| n.contains(&ip)),
+        }
+    }
+}
+
+pub enum ResolvedIp<'a> {
+    V4([u8; 4]),
+    V6([u8; 16]),
+    Raw(&'a [u8]),
+}
+
+impl<'a> From<IpAddr> for ResolvedIp<'a> {
+    fn from(ip: IpAddr) -> Self {
+        match ip {
+            IpAddr::V4(v4) => ResolvedIp::V4(v4.octets()),
+            IpAddr::V6(v6) => ResolvedIp::V6(v6.octets()),
+        }
+    }
+}
+
+impl ResolvedIp<'_> {
+    pub fn rate_key(&self, seed: u64) -> u64 {
+        let mut h = Xxh3::with_seed(seed);
+
+        match self {
+            ResolvedIp::V4(octets) => {
+                h.update(&[1]);
+                h.update(octets);
+            }
+            ResolvedIp::V6(octets) => {
+                h.update(&[2]);
+                h.update(octets);
+            }
+            ResolvedIp::Raw(bytes) => {
+                h.update(&[0]);
+                h.update(bytes);
+            }
+        }
+
+        h.digest()
+    }
+}
+
+fn ip_to_net(ip: IpAddr) -> IpNet {
+    match ip {
+        IpAddr::V4(v4) => IpNet::V4(Ipv4Net::new(v4, 32).expect("valid /32")),
+        IpAddr::V6(v6) => IpNet::V6(Ipv6Net::new(v6, 128).expect("valid /128")),
+    }
+}
+
+fn parse_ip_bytes(bytes: &[u8]) -> Option<IpAddr> {
+    let s = std::str::from_utf8(trim_ascii_whitespace(bytes)).ok()?;
+    s.parse::<IpAddr>().ok()
+}
+
+pub fn resolve_client_ip<'a>(
+    mode: &ProxyTrustMode,
+    socket_ip: &'a [u8],
+    xff: Option<&'a [u8]>,
+    x_real_ip: Option<&'a [u8]>,
+) -> (ResolvedIp<'a>, bool) {
+    let socket_trim = trim_ascii_whitespace(socket_ip);
+    let socket_parsed = parse_ip_bytes(socket_trim);
+
+    let peer_trusted = socket_parsed
+        .map(|ip| mode.is_trusted(ip))
+        .unwrap_or(false);
+
+    if mode.is_none() || !peer_trusted {
+        return (
+            socket_parsed
+                .map(Into::into)
+                .unwrap_or(ResolvedIp::Raw(socket_trim)),
+            peer_trusted,
+        );
+    }
+
+    if let Some(xff) = xff {
+        let mut last_valid: Option<ResolvedIp> = None;
+
+        for part in xff.split(|&b| b == b',').rev() {
+            let part = trim_ascii_whitespace(part);
+            if part.is_empty() {
+                continue;
+            }
+
+            match parse_ip_bytes(part) {
+                Some(ip) => {
+                    let trusted = mode.is_trusted(ip);
+                    last_valid = Some(ip.into());
+
+                    if !trusted {
+                        return (last_valid.take().unwrap(), peer_trusted);
+                    }
+                }
+                None => break,
+            }
+        }
+
+        if let Some(ip) = last_valid {
+            return (ip, peer_trusted);
+        }
+    }
+
+    if let Some(xri) = x_real_ip {
+        let xri_trim = trim_ascii_whitespace(xri);
+        let first = xri_trim.split(|&b| b == b',').next().unwrap_or(xri_trim);
+
+        if let Some(ip) = parse_ip_bytes(first) {
+            return (ip.into(), peer_trusted);
+        }
+    }
+
+    (
+        socket_parsed
+            .map(Into::into)
+            .unwrap_or(ResolvedIp::Raw(socket_trim)),
+        peer_trusted,
+    )
+}

package/rust/json_ops.rs

@@ -0,0 +1,66 @@
+// rust/json_ops.rs — v2: tighter inlining
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+use serde::de::{Deserializer, IgnoredAny, SeqAccess, Visitor};
+use serde::Deserialize;
+use std::fmt;
+
+#[derive(Deserialize)]
+struct IdRow {
+    #[serde(default)]
+    id: Option<i64>,
+}
+
+struct IdSumVisitor;
+
+impl<'de> Visitor<'de> for IdSumVisitor {
+    type Value = i64;
+
+    #[inline]
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str("an array of objects with numeric ids")
+    }
+
+    #[inline]
+    fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> std::result::Result<Self::Value, A::Error> {
+        let mut sum = 0i64;
+        while let Some(row) = seq.next_element::<Option<IdRow>>()? {
+            if let Some(IdRow { id: Some(id) }) = row {
+                sum = sum.saturating_add(id);
+            }
+        }
+        Ok(sum)
+    }
+}
+
+struct IdSum(i64);
+
+impl<'de> Deserialize<'de> for IdSum {
+    #[inline]
+    fn deserialize<D: Deserializer<'de>>(d: D) -> std::result::Result<Self, D::Error> {
+        d.deserialize_seq(IdSumVisitor).map(IdSum)
+    }
+}
+
+#[inline(always)]
+pub fn json_valid_bytes(input: &[u8]) -> bool {
+    // sonic-rs uses SIMD validation internally — already optimal.
+    sonic_rs::from_slice::<IgnoredAny>(input).is_ok()
+}
+
+#[inline]
+pub fn json_sum_ids_bytes(input: &[u8]) -> Result<i64> {
+    sonic_rs::from_slice::<IdSum>(input)
+        .map(|s| s.0)
+        .map_err(|e| Error::from_reason(e.to_string()))
+}
+
+#[napi]
+pub fn json_valid(input: Uint8Array) -> bool {
+    json_valid_bytes(input.as_ref())
+}
+
+#[napi]
+pub fn json_sum_ids(input: Uint8Array) -> Result<i64> {
+    json_sum_ids_bytes(input.as_ref())
+}

package/rust/json_patch_ops.rs

@@ -0,0 +1,25 @@
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+use serde_json::Value;
+
+#[napi]
+pub fn json_patch(doc: Uint8Array, patch: Uint8Array) -> Result<Buffer> {
+    let mut doc_val: Value =
+        sonic_rs::from_slice(doc.as_ref()).map_err(|e| Error::from_reason(e.to_string()))?;
+
+    let patch_val: json_patch::Patch =
+        sonic_rs::from_slice(patch.as_ref()).map_err(|e| Error::from_reason(e.to_string()))?;
+
+    json_patch::patch(&mut doc_val, &patch_val).map_err(|e| Error::from_reason(e.to_string()))?;
+
+    let mut out = Vec::with_capacity(
+        doc.as_ref()
+            .len()
+            .saturating_add(patch.as_ref().len())
+            .saturating_add(32),
+    );
+
+    sonic_rs::to_writer(&mut out, &doc_val).map_err(|e| Error::from_reason(e.to_string()))?;
+
+    Ok(Buffer::from(out))
+}

package/rust/json_schema.rs

@@ -0,0 +1,151 @@
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+use serde::de::{DeserializeSeed, Deserializer, SeqAccess, Visitor};
+use serde_json::Value;
+use std::fmt;
+use std::sync::Arc;
+
+use crate::util::{should_parallelize, total_bytes, unpack};
+#[napi]
+pub struct SchemaValidator {
+    schema: Arc<jsonschema::Validator>,
+}
+
+#[napi]
+impl SchemaValidator {
+    #[napi(constructor)]
+    pub fn new(schema_bytes: Uint8Array) -> Result<Self> {
+        let schema_str = std::str::from_utf8(&schema_bytes)
+            .map_err(|_| Error::new(Status::InvalidArg, "Invalid UTF-8 in schema"))?;
+
+        let schema_value: Value = sonic_rs::from_str(schema_str)
+            .map_err(|e| Error::new(Status::InvalidArg, format!("Schema JSON error: {}", e)))?;
+
+        let compiled = jsonschema::validator_for(&schema_value).map_err(|e| {
+            Error::new(
+                Status::InvalidArg,
+                format!("Schema compilation error: {}", e),
+            )
+        })?;
+
+        Ok(Self {
+            schema: Arc::new(compiled),
+        })
+    }
+
+    #[inline]
+    fn validate_doc(&self, bytes: &[u8]) -> bool {
+        match sonic_rs::from_slice::<Value>(bytes) {
+            Ok(value) => self.schema.is_valid(&value),
+            Err(_) => false,
+        }
+    }
+
+    /// Validate a packed batch of individual JSON documents.
+    ///
+    /// Input format:
+    ///
+    ///   [u32 count]
+    ///   repeated:
+    ///     [u32 doc_len]
+    ///     [doc bytes]
+    ///
+    /// This avoids materializing the entire batch into one DOM array.
+    #[napi]
+    pub fn validate_batch_packed_count(&self, packed: Uint8Array) -> Result<u32> {
+        let items = unpack(packed.as_ref())?;
+
+        let count: u32 = if should_parallelize(items.len(), total_bytes(&items)) {
+            use rayon::prelude::*;
+
+            items
+                .par_chunks(256)
+                .map(|chunk| chunk.iter().filter(|item| self.validate_doc(item)).count() as u32)
+                .sum()
+        } else {
+            items.iter().filter(|item| self.validate_doc(item)).count() as u32
+        };
+
+        Ok(count)
+    }
+
+    /// Validate a packed batch and return a packed bitset.
+    ///
+    /// Output format:
+    ///
+    ///   [u32 count]
+    ///   [ceil(count / 8) bytes]
+    #[napi]
+    pub fn validate_batch_packed_bitset(&self, packed: Uint8Array) -> Result<Buffer> {
+        let items = unpack(packed.as_ref())?;
+
+        Ok(Buffer::from(crate::util::validation_bitset_chunked(
+            &items,
+            |item| self.validate_doc(item),
+            256,
+        )))
+    }
+
+    /// Stream-validate a JSON array payload.
+    ///
+    /// This still materializes one array element at a time, because
+    /// `jsonschema` currently expects a DOM-like value, but it avoids
+    /// materializing the entire array at once.
+    #[napi]
+    pub fn validate_batch_streaming(&self, batch_bytes: Uint8Array) -> Result<u32> {
+        let mut de = sonic_rs::Deserializer::from_slice(batch_bytes.as_ref());
+        let seed = BatchSeed {
+            validator: &self.schema,
+        };
+
+        let count = seed
+            .deserialize(&mut de)
+            .map_err(|e| Error::from_reason(format!("Streaming batch JSON error: {}", e)))?;
+
+        Ok(count)
+    }
+}
+
+struct BatchSeed<'a> {
+    validator: &'a jsonschema::Validator,
+}
+
+impl<'de> DeserializeSeed<'de> for BatchSeed<'_> {
+    type Value = u32;
+
+    fn deserialize<D>(self, deserializer: D) -> std::result::Result<Self::Value, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_seq(BatchVisitor {
+            validator: self.validator,
+        })
+    }
+}
+
+struct BatchVisitor<'a> {
+    validator: &'a jsonschema::Validator,
+}
+
+impl<'de> Visitor<'de> for BatchVisitor<'_> {
+    type Value = u32;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("a JSON array of documents")
+    }
+
+    fn visit_seq<A>(self, mut seq: A) -> std::result::Result<Self::Value, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        let mut count = 0u32;
+
+        while let Some(value) = seq.next_element::<Value>()? {
+            if self.validator.is_valid(&value) {
+                count += 1;
+            }
+        }
+
+        Ok(count)
+    }
+}