Sasedev/khadhroony-solana-project
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.3.12-pre.002

Browse Source
This commit is contained in:
SinuS von SifriduS
2026-09-09 07:12:37 +02:00
parent 08e9a34183
commit 91438e8214
12 changed files with 937 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
View File

@@ -1,5 +1,5 @@
// file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
// version: 2
// version: 3
//! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
@@ -92,7 +92,7 @@ fn pre_010_debug_and_settings_errors_redact_worker_identity_and_invalid_values()
}
#[test]
fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_neutral() {
fn v0_3_12_pre_002_manifest_dependency_surface_opens_only_transport_and_remains_backend_neutral() {
let manifest = include_str!("../Cargo.toml");
let mut section = "";
let mut normal = std::collections::BTreeSet::new();
@@ -121,7 +121,16 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
}
assert_eq!(
normal,
std::collections::BTreeSet::from(["ksp-core-lib", "ksp-logging-lib", "ksp-raw-transaction-lib", "ksp-store-lib", "ksp-worker-api", "sha2", "tokio",])
std::collections::BTreeSet::from([
"ksp-core-lib",
"ksp-logging-lib",
"ksp-onchain-transport-lib",
"ksp-raw-transaction-lib",
"ksp-store-lib",
"ksp-worker-api",
"sha2",
"tokio",
])
);
assert!(dev.is_empty());
assert!(build.is_empty());
@@ -131,7 +140,6 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
"ksp-config-lib",
"ksp-job-api",
"ksp-job-backfill-lib",
"ksp-onchain-transport-lib",
"ksp-store-api",
"ksp-store-postgres-lib",
"reqwest",
@@ -146,11 +154,12 @@ fn pre_010_manifest_dependency_surface_remains_exact_source_neutral_and_backend_
#[test]
fn pre_010_source_visibility_contract_uses_crate_root_for_shared_items() {
let source_contracts: [(&str, &[&str]); 4] = [
let source_contracts: [(&str, &[&str]); 5] = [
(include_str!("../src/settings.rs"), &["RawTransactionIngestSettings"]),
(include_str!("../src/runtime.rs"), &["RawTransactionIngestHandle", "RawTransactionIngestWorker"]),
(include_str!("../src/snapshot.rs"), &["RawTransactionIngestSnapshot", "RawTransactionIngestSnapshotSource"]),
(include_str!("../src/persistence.rs"), &["RawTransactionIngestPersistenceOutcome", "RawTransactionIngestPersistencePort"]),
(include_str!("../src/runtime_resources.rs"), &["RawTransactionIngestYellowstoneSource", "RawTransactionIngestRuntimeResources"]),
];
for (source, symbols) in source_contracts {
for symbol in symbols {
@@ -166,6 +175,7 @@ fn pre_010_source_visibility_contract_uses_crate_root_for_shared_items() {
("identity", include_str!("../src/identity.rs")),
("persistence", include_str!("../src/persistence.rs")),
("runtime", include_str!("../src/runtime.rs")),
("runtime_resources", include_str!("../src/runtime_resources.rs")),
("settings", include_str!("../src/settings.rs")),
("snapshot", include_str!("../src/snapshot.rs")),
] {
@@ -184,6 +194,7 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
include_str!("../src/lib.rs"),
include_str!("../src/persistence.rs"),
include_str!("../src/runtime.rs"),
include_str!("../src/runtime_resources.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
];
@@ -198,8 +209,6 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
"checkpoint",
"Discovery",
"discovery",
"Hydration",
"hydration",
"historical",
] {
assert!(!source.contains(forbidden), "historical/retriever surface leaked into Worker production source: {forbidden}");
@@ -209,8 +218,39 @@ fn pre_010_production_surface_has_no_historical_backfill_or_retriever_contract()
}
#[test]
fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transport() {
let sources = [
fn v0_3_12_pre_002_production_sources_keep_transport_confined_to_runtime_resources() {
for source in [
include_str!("../src/admission.rs"),
include_str!("../src/error.rs"),
include_str!("../src/identity.rs"),
include_str!("../src/lib.rs"),
include_str!("../src/persistence.rs"),
include_str!("../src/runtime.rs"),
include_str!("../src/runtime_resources.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
] {
let lower = source.to_ascii_lowercase();
for forbidden in ["api_key", "api-key", "authorization", "bearer ", "password", "credential", "secret"] {
assert!(!lower.contains(forbidden), "secret-like material leaked into Worker production source: {forbidden}");
}
}
let transport_source = include_str!("../src/runtime_resources.rs");
assert!(transport_source.contains("ksp_onchain_transport_lib::"));
for forbidden in [
"ksp_config_lib::",
"ksp_store_postgres_lib::",
"ksp_offchain_transport_lib::",
"reqwest::",
"tokio_tungstenite::",
"tonic::",
"yellowstone_grpc_proto::",
"postgresql://",
"postgres://",
] {
assert!(!transport_source.contains(forbidden), "forbidden implementation detail leaked into runtime resources: {forbidden}");
}
for source in [
include_str!("../src/admission.rs"),
include_str!("../src/error.rs"),
include_str!("../src/identity.rs"),
@@ -219,16 +259,11 @@ fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transpor
include_str!("../src/runtime.rs"),
include_str!("../src/settings.rs"),
include_str!("../src/snapshot.rs"),
];
for source in sources {
let lower = source.to_ascii_lowercase();
for forbidden in ["api_key", "api-key", "authorization", "bearer ", "password", "credential", "secret"] {
assert!(!lower.contains(forbidden), "secret-like material leaked into Worker production source: {forbidden}");
}
] {
assert!(!source.contains("ksp_onchain_transport_lib::"), "Transport dependency escaped runtime_resources.rs");
for forbidden in [
"ksp_config_lib::",
"ksp_store_postgres_lib::",
"ksp_onchain_transport_lib::",
"ksp_offchain_transport_lib::",
"reqwest::",
"tokio_tungstenite::",
@@ -237,12 +272,26 @@ fn pre_010_production_sources_scan_clean_for_config_secrets_backend_and_transpor
"postgresql://",
"postgres://",
] {
assert!(!source.contains(forbidden), "Config/backend/Transport implementation leaked into Worker production source: {forbidden}");
assert!(!source.contains(forbidden), "forbidden implementation detail leaked into Worker production source: {forbidden}");
}
}
return;
}
#[test]
fn v0_3_12_pre_002_runtime_resource_contract_performs_no_live_io_or_source_spawn() {
let resources = include_str!("../src/runtime_resources.rs");
let runtime = include_str!("../src/runtime.rs");
for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed", "tokio::spawn", "JoinSet"] {
assert!(!resources.contains(forbidden), "pre.002 runtime-resource contract opened premature live behavior: {forbidden}");
}
assert!(runtime.contains("start_with_runtime_resources"));
for forbidden in ["open_standard_subscribe", "next_update", "get_transaction_observed", "get_block_observed"] {
assert!(!runtime.contains(forbidden), "pre.002 runtime start opened premature live behavior: {forbidden}");
}
return;
}
#[test]
fn pre_010_lower_layers_have_no_dependency_return_to_concrete_worker() {
for manifest in [
@@ -260,7 +309,7 @@ fn pre_010_lower_layers_have_no_dependency_return_to_concrete_worker() {
}
#[test]
fn pre_010_public_root_exposes_no_runtime_backend_or_live_source_implementation_types() {
fn v0_3_12_pre_002_public_root_exposes_contract_types_without_transport_implementation_paths() {
let root = include_str!("../src/lib.rs");
for forbidden in [
"pub mod ",