v0.2.9-pre.003

crates/ksp-onchain-transport-lib/unit_tests/grpc_settings.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-onchain-transport-lib/unit_tests/grpc_settings.rs
-// version: 2
+// version: 3
 
 fn endpoint(name: &str, enabled: bool, url: &str, session: crate::YellowstoneGrpcSessionSettings) -> crate::YellowstoneGrpcEndpointSettings {
     let parsed = crate::YellowstoneGrpcEndpointUrl::parse(url).expect("fixture Yellowstone gRPC URL must parse");
@@ -149,3 +149,50 @@ fn grpc_transport_settings_require_one_enabled_endpoint() {
     assert!(crate::YellowstoneGrpcTransportSettings::new(std::vec![disabled]).validate().is_err());
     assert!(crate::YellowstoneGrpcTransportSettings::new(std::vec![]).validate().is_err());
 }
+
+#[test]
+fn grpc_metadata_validates_ascii_bounds_sensitivity_and_redacted_debug() {
+    let public = crate::YellowstoneGrpcMetadataEntry::public("x-ksp-public", "VISIBLE-CANARY").expect("public metadata must validate");
+    let secret = crate::YellowstoneGrpcMetadataEntry::secret("x-ksp-token", "GRPC-SECRET-CANARY").expect("secret metadata must validate");
+    assert_eq!(public.key(), "x-ksp-public");
+    assert!(!public.is_secret());
+    assert!(secret.is_secret());
+    let rendered = format!("{public:?} {secret:?}");
+    assert!(!rendered.contains("VISIBLE-CANARY"));
+    assert!(!rendered.contains("GRPC-SECRET-CANARY"));
+    let mut metadata = tonic::metadata::MetadataMap::new();
+    assert!(secret.append_to(&mut metadata).is_ok());
+    let appended = metadata.get("x-ksp-token").expect("secret metadata must be appended");
+    assert!(appended.is_sensitive());
+}
+
+#[test]
+fn grpc_metadata_rejects_reserved_binary_uppercase_malformed_and_oversized_values() {
+    assert!(crate::YellowstoneGrpcMetadataEntry::public("grpc-timeout", "1").is_err());
+    assert!(crate::YellowstoneGrpcMetadataEntry::public("x-ksp-bin", "1").is_err());
+    assert!(crate::YellowstoneGrpcMetadataEntry::public("X-KSP-UPPER", "1").is_err());
+    assert!(crate::YellowstoneGrpcMetadataEntry::public("x-ksp-bad", "line\nfeed").is_err());
+    assert!(crate::YellowstoneGrpcMetadataEntry::secret("x-ksp-large", "S".repeat(super::MAX_GRPC_METADATA_VALUE_LENGTH_BYTES + 1)).is_err());
+}
+
+#[test]
+fn grpc_endpoint_metadata_count_is_bounded_and_url_tracks_tls_scheme() {
+    let http = crate::YellowstoneGrpcEndpointUrl::parse("http://127.0.0.1:10000").expect("HTTP URL must parse");
+    let https = crate::YellowstoneGrpcEndpointUrl::parse("https://example.invalid:443").expect("HTTPS URL must parse");
+    assert!(!http.uses_tls());
+    assert!(https.uses_tls());
+    let metadata = (0..=super::MAX_GRPC_METADATA_ENTRY_COUNT)
+        .map(|index| {
+            return crate::YellowstoneGrpcMetadataEntry::public(format!("x-ksp-{index}"), "value").expect("generated metadata must be valid");
+        })
+        .collect();
+    let endpoint = crate::YellowstoneGrpcEndpointSettings::new(
+        "metadata-bound",
+        true,
+        crate::YellowstoneGrpcProviderName::new("fixture"),
+        crate::YellowstoneGrpcClusterName::new("devnet"),
+        http,
+        crate::YellowstoneGrpcSessionSettings::default(),
+    );
+    assert!(endpoint.with_metadata(metadata).is_err());
+}