Sasedev/khadhroony-solana-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.3.12-pre.002

Browse Source
This commit is contained in:
SinuS von SifriduS
2026-09-09 07:12:37 +02:00
parent 08e9a34183
commit 91438e8214
12 changed files with 937 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
// version: 8
// version: 9
//! Dependency firewall canaries for the RAW transaction ingest Worker foundation.
@@ -8,10 +8,23 @@ fn pre_002_manifest_dependency_surface_is_exact() {
let manifest = include_str!("../Cargo.toml");
let dependencies = dependency_section(manifest);
let names = manifest_dependency_names(dependencies);
assert_eq!(names, vec!["ksp-core-lib", "ksp-logging-lib", "ksp-raw-transaction-lib", "ksp-store-lib", "ksp-worker-api", "sha2", "tokio",],);
assert_eq!(
names,
vec![
"ksp-core-lib",
"ksp-logging-lib",
"ksp-onchain-transport-lib",
"ksp-raw-transaction-lib",
"ksp-store-lib",
"ksp-worker-api",
"sha2",
"tokio",
],
);
for required in [
"ksp-core-lib = { path = \"../ksp-core-lib\" }",
"ksp-logging-lib = { path = \"../ksp-logging-lib\" }",
"ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }",
"ksp-raw-transaction-lib = { path = \"../ksp-raw-transaction-lib\" }",
"ksp-store-lib = { path = \"../ksp-store-lib\", default-features = false }",
"ksp-worker-api = { path = \"../ksp-worker-api\" }",
@@ -24,7 +37,7 @@ fn pre_002_manifest_dependency_surface_is_exact() {
}
#[test]
fn pre_002_manifest_keeps_forbidden_layers_and_live_sources_out() {
fn v0_3_12_pre_002_manifest_opens_only_the_onchain_transport_live_source_edge() {
let manifest = include_str!("../Cargo.toml");
let dependencies = dependency_section(manifest);
for forbidden in [
@@ -33,7 +46,6 @@ fn pre_002_manifest_keeps_forbidden_layers_and_live_sources_out() {
"ksp-interface-lib",
"ksp-job-api",
"ksp-job-backfill-lib",
"ksp-onchain-transport-lib",
"ksp-program-api",
"ksp-store-api",
"ksp-store-postgres-lib",
@@ -52,12 +64,13 @@ fn pre_002_manifest_keeps_forbidden_layers_and_live_sources_out() {
}
#[test]
fn pre_009_source_surface_hardens_shutdown_and_faults_without_backend_or_live_source() {
fn v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io() {
let root = include_str!("../src/lib.rs");
let runtime = include_str!("../src/runtime.rs");
let admission = include_str!("../src/admission.rs");
let persistence = include_str!("../src/persistence.rs");
let snapshot = include_str!("../src/snapshot.rs");
let runtime_resources = include_str!("../src/runtime_resources.rs");
for required in [
"tokio::sync::mpsc::channel",
"canonicalize_raw_transaction",
@@ -81,7 +94,8 @@ fn pre_009_source_surface_hardens_shutdown_and_faults_without_backend_or_live_so
|| runtime.contains(required)
|| admission.contains(required)
|| persistence.contains(required)
|| snapshot.contains(required),
|| snapshot.contains(required)
|| runtime_resources.contains(required),
"required pre.009 hardening contract missing: {required}"
);
}
@@ -91,7 +105,6 @@ fn pre_009_source_surface_hardens_shutdown_and_faults_without_backend_or_live_so
"pub use self::persistence::RawTransactionIngestPersistencePort",
"unbounded_channel",
"ksp_store_postgres_lib::",
"ksp_onchain_transport_lib::",
"ForceRehydrate",
"ksp_config_lib::",
"reqwest::",
@@ -101,7 +114,8 @@ fn pre_009_source_surface_hardens_shutdown_and_faults_without_backend_or_live_so
&& !runtime.contains(forbidden)
&& !admission.contains(forbidden)
&& !persistence.contains(forbidden)
&& !snapshot.contains(forbidden),
&& !snapshot.contains(forbidden)
&& !runtime_resources.contains(forbidden),
"pre.009 crossed a forbidden runtime boundary: {forbidden}"
);
}

85
crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
// version: 2
// version: 3
//! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
@@ -92,7 +92,7 @@ fn pre_010_debug_and_settings_errors_redact_worker_identity_and_invalid_values()
}
#[test]
fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_neutral() {
fn v0_3_12_pre_002_manifest_dependency_surface_opens_only_transport_and_remains_backend_neutral() {
let manifest = include_str!("../Cargo.toml");
let mut section = "";
let mut normal = std::collections::BTreeSet::new();
@@ -121,7 +121,16 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
}
assert_eq!(
normal,
std::collections::BTreeSet::from(["ksp-core-lib", "ksp-logging-lib", "ksp-raw-transaction-lib", "ksp-store-lib", "ksp-worker-api", "sha2", "tokio",])
std::collections::BTreeSet::from([
"ksp-core-lib",
"ksp-logging-lib",
"ksp-onchain-transport-lib",
"ksp-raw-transaction-lib",
"ksp-store-lib",
"ksp-worker-api",
"sha2",
"tokio",
])
);
assert!(dev.is_empty());
assert!(build.is_empty());
@@ -131,7 +140,6 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
"ksp-config-lib",
"ksp-job-api",
"ksp-job-backfill-lib",
"ksp-onchain-transport-lib",
"ksp-store-api",
"ksp-store-postgres-lib",
"reqwest",
@@ -146,11 +154,12 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
#[test]
fn pre_010_source_visibility_contract_uses_crate_root_for_shared_items() {
let source_contracts: [(&str, &[&str]); 4] = [
let source_contracts: [(&str, &[&str]); 5] = [
(include_str!("../src/settings.rs"), &["RawTransactionIngestSettings"]),
(include_str!("../src/runtime.rs"), &["RawTransactionIngestHandle", "RawTransactionIngestWorker"]),
(include_str!("../src/snapshot.rs"), &["RawTransactionIngestSnapshot", "RawTransactionIngestSnapshotSource"]),
(include_str!("../src/persistence.rs"), &["RawTransactionIngestPersistenceOutcome", "RawTransactionIngestPersistencePort"]),
(include_str!("../src/runtime_resources.rs"), &["RawTransactionIngestYellowstoneSource", "RawTransactionIngestRuntimeResources"]),
];
for (source, symbols) in source_contracts {
for symbol in symbols {
@@ -166,6 +175,7 @@ fn pre_010_source_visibility_contract_uses_crate_root_for_shared_items() {
("identity", include_str!("../src/identity.rs")),
("persistence", include_str!("../src/persistence.rs")),
("runtime", include_str!("../src/runtime.rs")),
("runtime_resources", include_str!("../src/runtime_resources.rs")),
("settings", include_str!("../src/settings.rs")),
("snapshot", include_str!("../src/snapshot.rs")),
] {
@@ -184,6 +194,7 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
include_str!("../src/lib.rs"),
include_str!("../src/persistence.rs"),
include_str!("../src/runtime.rs"),
include_str!("../src/runtime_resources.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
];
@@ -198,8 +209,6 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
"checkpoint",
"Discovery",
"discovery",
"Hydration",
"hydration",
"historical",
] {
assert!(!source.contains(forbidden), "historical/retriever surface leaked into Worker production source: {forbidden}");
@@ -209,8 +218,39 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
}
#[test]
fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transport() {
let sources = [
fn v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resources() {
for source in [
include_str!("../src/admission.rs"),
include_str!("../src/error.rs"),
include_str!("../src/identity.rs"),
include_str!("../src/lib.rs"),
include_str!("../src/persistence.rs"),
include_str!("../src/runtime.rs"),
include_str!("../src/runtime_resources.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
] {
let lower = source.to_ascii_lowercase();
for forbidden in ["api_key", "api-key", "authorization", "bearer ", "password", "credential", "secret"] {
assert!(!lower.contains(forbidden), "secret-like material leaked into Worker production source: {forbidden}");
}
}
let transport_source = include_str!("../src/runtime_resources.rs");
assert!(transport_source.contains("ksp_onchain_transport_lib::"));
for forbidden in [
"ksp_config_lib::",
"ksp_store_postgres_lib::",
"ksp_offchain_transport_lib::",
"reqwest::",
"tokio_tungstenite::",
"tonic::",
"yellowstone_grpc_proto::",
"postgresql://",
"postgres://",
] {
assert!(!transport_source.contains(forbidden), "forbidden implementation detail leaked into runtime resources: {forbidden}");
}
for source in [
include_str!("../src/admission.rs"),
include_str!("../src/error.rs"),
include_str!("../src/identity.rs"),
@@ -219,16 +259,11 @@ fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transpor
include_str!("../src/runtime.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
];
for source in sources {
let lower = source.to_ascii_lowercase();
for forbidden in ["api_key", "api-key", "authorization", "bearer ", "password", "credential", "secret"] {
assert!(!lower.contains(forbidden), "secret-like material leaked into Worker production source: {forbidden}");
}
] {
assert!(!source.contains("ksp_onchain_transport_lib::"), "Transport dependency escaped runtime_resources.rs");
for forbidden in [
"ksp_config_lib::",
"ksp_store_postgres_lib::",
"ksp_onchain_transport_lib::",
"ksp_offchain_transport_lib::",
"reqwest::",
"tokio_tungstenite::",
@@ -237,12 +272,26 @@ fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transpor
"postgresql://",
"postgres://",
] {
assert!(!source.contains(forbidden), "Config/backend/Transport implementation leaked into Worker production source: {forbidden}");
assert!(!source.contains(forbidden), "forbidden implementation detail leaked into Worker production source: {forbidden}");
}
}
return;
}
#[test]
fn v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn() {
let resources = include_str!("../src/runtime_resources.rs");
let runtime = include_str!("../src/runtime.rs");
for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed", "tokio::spawn", "JoinSet"] {
assert!(!resources.contains(forbidden), "pre.002 runtime-resource contract opened premature live behavior: {forbidden}");
}
assert!(runtime.contains("start_with_runtime_resources"));
for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed"] {
assert!(!runtime.contains(forbidden), "pre.002 runtime start opened premature live behavior: {forbidden}");
}
return;
}
#[test]
fn pre_010_lower_layers_have_no_dependency_return_to_concrete_worker() {
for manifest in [
@@ -260,7 +309,7 @@ fn pre_010_lower_layers_have_no_dependency_return_to_concrete_worker() {
}
#[test]
fn pre_010_public_root_exposes_no_runtime_backend_or_live_source_implementation_types() {
fn v0_3_12_pre_002_public_root_exposes_contract_types_without_transport_implementation_paths() {
let root = include_str!("../src/lib.rs");
for forbidden in [
"pub mod ",

36
crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
// version: 8
// version: 9
//! External public-surface proofs for the RAW transaction ingest Worker foundation.
@@ -135,3 +135,37 @@ fn pre_009_source_and_drain_timeout_error_codes_are_public_and_stable() {
assert_eq!(ksp_worker_raw_transaction_ingest_lib::ERROR_CODE_RAW_TRANSACTION_INGEST_SOURCE_FAILED.code(), "source_failed");
return;
}
#[test]
fn v0_3_12_pre_002_runtime_resource_types_are_consumable_without_client_escape_hatch() {
let _source_new: fn(
ksp_onchain_transport_lib::YellowstoneGrpcChannel,
ksp_onchain_transport_lib::YellowstoneSubscribeRequest,
ksp_onchain_transport_lib::HttpTransportPool,
ksp_onchain_transport_lib::HttpRoleName,
) -> ksp_core_lib::Result<ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestYellowstoneSource> =
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestYellowstoneSource::new;
let _resources_new: fn(
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestYellowstoneSource,
) -> ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestRuntimeResources =
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestRuntimeResources::new;
let _start_with_resources: fn(
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestSettings,
std::sync::Arc<ksp_store_lib::Store>,
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestRuntimeResources,
) -> ksp_core_lib::Result<ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestHandle> =
ksp_worker_raw_transaction_ingest_lib::RawTransactionIngestWorker::start_with_runtime_resources;
let source = include_str!("../src/runtime_resources.rs");
for forbidden in [
"pub fn channel(",
"pub fn http_pool(",
"pub fn subscribe_request(",
"pub fn hydration_role(",
"pub fn enqueue(",
"pub fn send(",
"pub fn inner(",
] {
assert!(!source.contains(forbidden), "runtime-resource implementation escape hatch present: {forbidden}");
}
return;
}

20
crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
// version: 1
// version: 2
//! Release-completeness canaries through the `pre.010` public/release/security hardening tranche.
@@ -32,7 +32,10 @@ fn pre_010_production_module_inventory_is_exact() -> std::io::Result<()> {
}
}
names.sort_unstable();
assert_eq!(names, std::vec!["admission.rs", "error.rs", "identity.rs", "lib.rs", "persistence.rs", "runtime.rs", "settings.rs", "snapshot.rs",]);
assert_eq!(
names,
std::vec!["admission.rs", "error.rs", "identity.rs", "lib.rs", "persistence.rs", "runtime.rs", "runtime_resources.rs", "settings.rs", "snapshot.rs",]
);
return std::result::Result::Ok(());
}
@@ -74,12 +77,14 @@ fn pre_010_public_root_export_inventory_is_exact() {
"MIN_RAW_TRANSACTION_INGEST_SHUTDOWN_DRAIN_TIMEOUT",
"RAW_TRANSACTION_INGEST_WORKER_KIND_CODE",
"RawTransactionIngestHandle",
"RawTransactionIngestRuntimeResources",
"RawTransactionIngestSettings",
"RawTransactionIngestSnapshot",
"RawTransactionIngestSnapshotFuture",
"RawTransactionIngestSnapshotSource",
"RawTransactionIngestTerminalFuture",
"RawTransactionIngestWorker",
"RawTransactionIngestYellowstoneSource",
]
);
assert!(!root.contains("pub mod "));
@@ -92,22 +97,25 @@ fn pre_010_external_hardening_suite_is_present_and_scoped() {
for required in [
"pre_010_external_error_codes_are_stable_unique_and_domain_scoped",
"pre_010_debug_and_settings_errors_redact_worker_identity_and_invalid_values",
"pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_neutral",
"v0_3_12_pre_002_manifest_dependency_surface_opens_only_transport_and_remains_backend_neutral",
"pre_010_source_visibility_contract_uses_crate_root_for_shared_items",
"pre_010_production_surface_has_no_historical_backfill_or_retriever_contract",
"pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transport",
"v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resources",
"v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn",
"pre_010_lower_layers_have_no_dependency_return_to_concrete_worker",
"pre_010_public_root_exposes_no_runtime_backend_or_live_source_implementation_types",
"v0_3_12_pre_002_public_root_exposes_contract_types_without_transport_implementation_paths",
] {
assert!(hardening.contains(required), "required pre.010 hardening canary missing: {required}");
}
let dependency_boundary = include_str!("dependency_boundary.rs");
assert!(dependency_boundary.contains("pre_002_manifest_dependency_surface_is_exact"));
assert!(dependency_boundary.contains("pre_009_source_surface_hardens_shutdown_and_faults_without_backend_or_live_source"));
assert!(dependency_boundary.contains("v0_3_12_pre_002_source_surface_hardens_shutdown_and_faults_without_backend_or_premature_live_io"));
assert!(dependency_boundary.contains("v0_3_12_pre_002_manifest_opens_only_the_onchain_transport_live_source_edge"));
let public_api = include_str!("public_api.rs");
assert!(public_api.contains("pre_003_kind_code_and_settings_are_consumable_from_crate_root"));
assert!(public_api.contains("pre_004_start_handle_and_terminal_future_are_consumable_without_public_join_handle"));
assert!(public_api.contains("pre_008_snapshot_surface_and_common_projection_are_public_and_stable"));
assert!(public_api.contains("pre_009_source_and_drain_timeout_error_codes_are_public_and_stable"));
assert!(public_api.contains("v0_3_12_pre_002_runtime_resource_types_are_consumable_without_client_escape_hatch"));
return;
}