fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(v1.1.3-modules): shared types, migrations, engine + resolver scaffold

Browse Source 
Lays down the v1.1.3 plumbing:

- `ScriptKind` enum in `picloud-shared` ('endpoint' | 'module').
- `ModuleSource` trait + `ModuleScript` DTO + `NoopModuleSource` in
  `picloud-shared`. Resolver lives in `executor-core`; Postgres impl
  in `manager-core` (`PostgresModuleSource`).
- `Services::new` grows a fifth `modules: Arc<dyn ModuleSource>` arg.
- `ScriptValidator` returns `ValidatedScript { imports }` so the
  manager can populate the dep-graph table on save. New
  `validate_module` method on the trait gates module-shape rules.
- `Engine::execute_ast(&Arc<rhai::AST>, req)` lets the orchestrator's
  script cache reuse compiled ASTs. `Engine::execute(&str, req)` is
  preserved as a convenience that compiles inline. `Engine::compile`
  exposes the AST for callers that want to cache.
- `PicloudModuleResolver` replaces `DummyModuleResolver` per-call.
  Bridges Rhai's sync `ModuleResolver::resolve` to async
  `ModuleSource::lookup` via `Handle::block_on`. Enforces:
  - cross-app isolation (resolver captures `Arc<SdkCallCx>`),
  - circular import detection (in-progress stack on the resolver),
  - import depth limit (default 8 via
    `Limits::module_import_depth_max`).
- Module-shape validation walks `ast.statements()` via `rhai/internals`
  and accepts only `Var { CONSTANT }`, `Import`, and `Noop`. The
  manager admin endpoint runs `validate_module` at save (primary
  gate); resolver re-runs it at load (defense in depth).
- LRU cache `(AppId, name) -> (updated_at, Arc<Module>)` owned by
  `Engine`. Size from `PICLOUD_MODULE_CACHE_SIZE` (default 512).
- Migration `0015_scripts_kind.sql` adds `scripts.kind` + composite
  index + module-name shape CHECK.
- Migration `0016_script_imports.sql` adds the dep-graph table with
  FK CASCADE on both columns.
- Repo: `kind` threaded through SELECT/INSERT/UPDATE. New
  `count_routes_for_script` / `count_triggers_for_script` /
  `list_imports` methods. `create`/`update` open a transaction and
  call `replace_imports_tx` to populate the dep-graph.
- Admin endpoint: accepts `kind`; rejects reserved module names;
  rejects `endpoint → module` transitions when routes / triggers
  exist.
- SDK_VERSION 1.3 → 1.4.

Workspace builds; full test suite (~440 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-02 22:04:21 +02:00
parent 5bbbc26c84
commit 84833d3e4e
23 changed files with 1231 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
crates/executor-core/src/engine.rs
View File

@@ -4,11 +4,15 @@ use std::time::Instant;
use chrono::Utc;
use picloud_shared::{
ScriptValidator, SdkCallCx, Services, TriggerEvent, ValidationError, SDK_VERSION,
ScriptValidator, SdkCallCx, Services, TriggerEvent, ValidatedScript, ValidationError,
SDK_VERSION,
};
use rhai::{Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module, Scope};
use rhai::{Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module, Scope, AST};
use serde_json::Value as Json;
use crate::module_resolver::{
extract_imports, new_module_cache, validate_module_source, ModuleCache, PicloudModuleResolver,
};
use crate::sandbox::Limits;
use crate::sdk;
use crate::sdk::bridge::{dynamic_to_json, json_to_dynamic};
@@ -16,6 +20,11 @@ use crate::types::{
ExecError, ExecRequest, ExecResponse, ExecStats, InvocationType, LogEntry, LogLevel,
};
/// Default capacity for the module cache. Sized assuming a small fleet
/// of distinct modules per process; can be overridden via
/// `PICLOUD_MODULE_CACHE_SIZE`.
const DEFAULT_MODULE_CACHE_SIZE: usize = 512;
/// Preconfigured Rhai engine with sandbox limits applied and the SDK
/// `Services` bundle attached.
///
@@ -31,12 +40,34 @@ use crate::types::{
pub struct Engine {
limits: Limits,
services: Services,
/// v1.1.3: shared compiled-module cache. Per-key
/// `(app_id, name)`; invalidated lazily by `updated_at` mismatch
/// at resolver time.
module_cache: Arc<ModuleCache>,
}
impl Engine {
#[must_use]
pub fn new(limits: Limits, services: Services) -> Self {
Self { limits, services }
let cap = std::env::var("PICLOUD_MODULE_CACHE_SIZE")
.ok()
.and_then(|s| s.parse::<usize>().ok())
.unwrap_or(DEFAULT_MODULE_CACHE_SIZE);
Self::with_module_cache_capacity(limits, services, cap)
}
/// Explicit capacity for tests that exercise LRU eviction.
#[must_use]
pub fn with_module_cache_capacity(
limits: Limits,
services: Services,
module_cache_capacity: usize,
) -> Self {
Self {
limits,
services,
module_cache: new_module_cache(module_cache_capacity),
}
}
#[must_use]
@@ -44,16 +75,42 @@ impl Engine {
&self.limits
}
/// Parse-only validation. Surfaced at script-upload time so syntax
/// errors are caught before the first invocation. Same logic as the
/// `ScriptValidator` impl below but with the richer `ExecError`
/// variant; callers in the executor path use this, the manager
/// path goes through the trait.
pub fn validate(&self, source: &str) -> Result<(), ExecError> {
/// Shared compiled-module cache. Exposed so tests can introspect
/// the cache state (length, contents) under a Mutex lock.
#[must_use]
pub fn module_cache(&self) -> &Arc<ModuleCache> {
&self.module_cache
}
/// Parse-only validation for endpoint scripts. Surfaced at script-
/// upload time so syntax errors are caught before the first
/// invocation. Returns the script's literal-path `import "<name>"`
/// declarations so the repo can populate the dep-graph table.
pub fn validate(&self, source: &str) -> Result<ValidatedScript, ExecError> {
// Validation uses a fresh `RhaiEngine` without service hooks
// attached — modules are only resolved at execute() time, so
// the resolver during validate is intentionally Dummy (no DB
// access here; we just need the parser).
let engine = build_engine(self.limits, None);
extract_imports(&engine, source).map_err(ExecError::Parse)
}
/// Module-shape validation (v1.1.3). Compiles, rejects any top-
/// level statement that isn't `fn`/`const`/`import`, and returns
/// the declared imports.
pub fn validate_module(&self, source: &str) -> Result<ValidatedScript, ExecError> {
let engine = build_engine(self.limits, None);
validate_module_source(&engine, source).map_err(ExecError::Parse)
}
/// Compile `source` to a reusable AST. Lets callers (the
/// orchestrator's script cache) compile once and execute many
/// times against the same AST.
pub fn compile(&self, source: &str) -> Result<Arc<AST>, ExecError> {
let engine = build_engine(self.limits, None);
engine
.compile(source)
.map(|_| ())
.map(Arc::new)
.map_err(|e| ExecError::Parse(e.to_string()))
}
@@ -63,6 +120,25 @@ impl Engine {
/// request replace the engine's defaults field-by-field; the
/// manager already clamped them against the admin ceiling.
pub fn execute(&self, source: &str, req: ExecRequest) -> Result<ExecResponse, ExecError> {
let effective_limits = self.limits.with_overrides(&req.sandbox_overrides);
// Compile inline so the source-only path stays available for
// tests and one-off callers that don't pre-cache an AST.
let engine_for_compile = build_engine(effective_limits, None);
let ast = engine_for_compile
.compile(source)
.map(Arc::new)
.map_err(|e| ExecError::Parse(e.to_string()))?;
self.execute_ast(&ast, req)
}
/// v1.1.3: execute a pre-compiled AST. The orchestrator's script
/// cache hands compiled ASTs in directly; this path skips the
/// per-call compile.
pub fn execute_ast(
&self,
ast: &Arc<AST>,
req: ExecRequest,
) -> Result<ExecResponse, ExecError> {
let effective_limits = self.limits.with_overrides(&req.sandbox_overrides);
let logs: Arc<Mutex<Vec<LogEntry>>> = Arc::new(Mutex::new(Vec::new()));
let mut engine = build_engine(effective_limits, Some(logs.clone()));
@@ -80,18 +156,25 @@ impl Engine {
is_dead_letter_handler: req.is_dead_letter_handler,
event: req.event.clone(),
});
// v1.1.3: replace the no-op `DummyModuleResolver` build_engine
// installed with the real per-call resolver. The resolver owns
// `cx.clone()` so cross-app isolation derives from this exact
// call's context, not from any script-passed argument.
let resolver = PicloudModuleResolver::new(
self.services.modules.clone(),
cx.clone(),
self.module_cache.clone(),
effective_limits.module_import_depth_max,
);
engine.set_module_resolver(resolver);
sdk::register_all(&mut engine, &self.services, cx);
let ast = engine
.compile(source)
.map_err(|e| ExecError::Parse(e.to_string()))?;
let mut scope = Scope::new();
scope.push_constant("ctx", build_ctx_map(&req));
let started = Instant::now();
let value: Dynamic = engine
.eval_ast_with_scope(&mut scope, &ast)
.eval_ast_with_scope(&mut scope, ast.as_ref())
.map_err(map_eval_error)?;
let duration = started.elapsed();
@@ -116,8 +199,18 @@ impl Engine {
}
impl ScriptValidator for Engine {
fn validate(&self, source: &str) -> Result<(), ValidationError> {
Engine::validate(self, source).map_err(|e| ValidationError::Syntax(e.to_string()))
fn validate(&self, source: &str) -> Result<ValidatedScript, ValidationError> {
Engine::validate(self, source).map_err(|e| match e {
ExecError::Parse(msg) => ValidationError::Syntax(msg),
other => ValidationError::Syntax(other.to_string()),
})
}
fn validate_module(&self, source: &str) -> Result<ValidatedScript, ValidationError> {
Engine::validate_module(self, source).map_err(|e| match e {
ExecError::Parse(msg) => ValidationError::ModuleShape(msg),
other => ValidationError::ModuleShape(other.to_string()),
})
}
}