fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(v1.1.3-modules): shared types, migrations, engine + resolver scaffold

Browse Source 
Lays down the v1.1.3 plumbing:

- `ScriptKind` enum in `picloud-shared` ('endpoint' | 'module').
- `ModuleSource` trait + `ModuleScript` DTO + `NoopModuleSource` in
  `picloud-shared`. Resolver lives in `executor-core`; Postgres impl
  in `manager-core` (`PostgresModuleSource`).
- `Services::new` grows a fifth `modules: Arc<dyn ModuleSource>` arg.
- `ScriptValidator` returns `ValidatedScript { imports }` so the
  manager can populate the dep-graph table on save. New
  `validate_module` method on the trait gates module-shape rules.
- `Engine::execute_ast(&Arc<rhai::AST>, req)` lets the orchestrator's
  script cache reuse compiled ASTs. `Engine::execute(&str, req)` is
  preserved as a convenience that compiles inline. `Engine::compile`
  exposes the AST for callers that want to cache.
- `PicloudModuleResolver` replaces `DummyModuleResolver` per-call.
  Bridges Rhai's sync `ModuleResolver::resolve` to async
  `ModuleSource::lookup` via `Handle::block_on`. Enforces:
  - cross-app isolation (resolver captures `Arc<SdkCallCx>`),
  - circular import detection (in-progress stack on the resolver),
  - import depth limit (default 8 via
    `Limits::module_import_depth_max`).
- Module-shape validation walks `ast.statements()` via `rhai/internals`
  and accepts only `Var { CONSTANT }`, `Import`, and `Noop`. The
  manager admin endpoint runs `validate_module` at save (primary
  gate); resolver re-runs it at load (defense in depth).
- LRU cache `(AppId, name) -> (updated_at, Arc<Module>)` owned by
  `Engine`. Size from `PICLOUD_MODULE_CACHE_SIZE` (default 512).
- Migration `0015_scripts_kind.sql` adds `scripts.kind` + composite
  index + module-name shape CHECK.
- Migration `0016_script_imports.sql` adds the dep-graph table with
  FK CASCADE on both columns.
- Repo: `kind` threaded through SELECT/INSERT/UPDATE. New
  `count_routes_for_script` / `count_triggers_for_script` /
  `list_imports` methods. `create`/`update` open a transaction and
  call `replace_imports_tx` to populate the dep-graph.
- Admin endpoint: accepts `kind`; rejects reserved module names;
  rejects `endpoint → module` transitions when routes / triggers
  exist.
- SDK_VERSION 1.3 → 1.4.

Workspace builds; full test suite (~440 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-02 22:04:21 +02:00
parent 5bbbc26c84
commit 84833d3e4e
23 changed files with 1231 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
crates/manager-core/src/api.rs
View File

@@ -12,8 +12,8 @@ use axum::{
Extension, Json, Router,
};
use picloud_shared::{
AppId, ExecutionLog, InstanceRole, Principal, Script, ScriptId, ScriptSandbox, ScriptValidator,
ValidationError,
AppId, ExecutionLog, InstanceRole, Principal, Script, ScriptId, ScriptKind, ScriptSandbox,
ScriptValidator, ValidatedScript, ValidationError,
};
use serde::Deserialize;
@@ -88,6 +88,11 @@ pub struct CreateScriptRequest {
pub name: String,
pub description: Option<String>,
pub source: String,
/// v1.1.3: `endpoint` (default — handles HTTP routes / trigger
/// targets) or `module` (library of fn/const imported by other
/// scripts). Modules reject route binding and trigger creation.
#[serde(default)]
pub kind: ScriptKind,
pub timeout_seconds: Option<i32>,
pub memory_limit_mb: Option<i32>,
/// Sandbox overrides; absent or empty `{}` means "use platform
@@ -120,6 +125,10 @@ pub struct UpdateScriptRequest {
/// `Some(ScriptSandbox::empty())` to clear them). Absent leaves
/// the stored value unchanged.
pub sandbox: Option<ScriptSandbox>,
/// v1.1.3: `Some(kind)` changes the script's role. Transitions to
/// `Module` are rejected if any routes or triggers still reference
/// the script. `module → endpoint` is always allowed.
pub kind: Option<ScriptKind>,
}
#[allow(clippy::option_option)]
@@ -202,7 +211,20 @@ async fn create_script<R: ScriptRepository, L: ExecutionLogRepository>(
Capability::AppWriteScript(input.app_id),
)
.await?;
state.validator.validate(&input.source)?;
// v1.1.3: dispatch to the right validator based on declared kind.
// Module bodies have stricter rules (no top-level statements) so
// they need a separate gate; endpoints retain the parse-only path.
let validated: ValidatedScript = if input.kind == ScriptKind::Module {
if RESERVED_MODULE_NAMES.contains(&input.name.as_str()) {
return Err(ApiError::Invalid(ValidationError::ModuleShape(format!(
"{:?} is a reserved module name (shadows a built-in SDK namespace)",
input.name
))));
}
state.validator.validate_module(&input.source)?
} else {
state.validator.validate(&input.source)?
};
state.sandbox_ceiling.check(&input.sandbox)?;
// Refuse early if the app_id doesn't exist — a clean 422 beats a
// raw FK violation surfacing as 500.
@@ -216,6 +238,7 @@ async fn create_script<R: ScriptRepository, L: ExecutionLogRepository>(
name: input.name,
description: input.description,
source: input.source,
kind: input.kind,
timeout_seconds: input.timeout_seconds,
memory_limit_mb: input.memory_limit_mb,
sandbox: if input.sandbox.is_empty() {
@@ -223,11 +246,39 @@ async fn create_script<R: ScriptRepository, L: ExecutionLogRepository>(
} else {
Some(input.sandbox)
},
imports: validated.imports,
})
.await?;
Ok((StatusCode::CREATED, Json(created)))
}
/// Module names that would shadow a built-in stdlib / service namespace.
/// Rejected at create time so `import "kv" as foo` can never resolve to
/// a user-supplied module instead of (in a hypothetical future) the
/// real KV bridge — defense against author confusion, not a security
/// boundary (stdlib namespaces and module imports already live in
/// disjoint Rhai scopes).
const RESERVED_MODULE_NAMES: &[&str] = &[
"log",
"regex",
"random",
"time",
"json",
"base64",
"hex",
"url",
"kv",
"docs",
"dead_letters",
"http",
"files",
"pubsub",
"secrets",
"email",
"users",
"queue",
];
async fn update_script<R: ScriptRepository, L: ExecutionLogRepository>(
State(state): State<AdminState<R, L>>,
Extension(principal): Extension<Principal>,
@@ -241,9 +292,44 @@ async fn update_script<R: ScriptRepository, L: ExecutionLogRepository>(
Capability::AppWriteScript(script.app_id),
)
.await?;
if let Some(src) = input.source.as_deref() {
state.validator.validate(src)?;
// Effective post-update kind: explicit override > existing kind.
let effective_kind = input.kind.unwrap_or(script.kind);
// v1.1.3: reject `endpoint → module` if the script still has
// routes or triggers bound to it. The reverse direction is always
// allowed (a module can't have routes/triggers anyway, so the
// transition can never strand users).
if effective_kind == ScriptKind::Module && script.kind != ScriptKind::Module {
let routes = state.repo.count_routes_for_script(id).await?;
let triggers = state.repo.count_triggers_for_script(id).await?;
if routes + triggers > 0 {
return Err(ApiError::Invalid(ValidationError::ModuleShape(format!(
"cannot change kind to module: script is referenced by {routes} route(s) and {triggers} trigger(s); detach them first"
))));
}
if RESERVED_MODULE_NAMES.contains(&script.name.as_str()) {
return Err(ApiError::Invalid(ValidationError::ModuleShape(format!(
"{:?} is a reserved module name (shadows a built-in SDK namespace)",
script.name
))));
}
}
// v1.1.3: re-validate using the effective kind so endpoint → module
// transitions with a fresh source enforce the module shape rules.
// Source-less edits (name/description only) don't re-validate.
let imports_for_patch: Option<Vec<String>> = if let Some(src) = input.source.as_deref() {
let validated = if effective_kind == ScriptKind::Module {
state.validator.validate_module(src)?
} else {
state.validator.validate(src)?
};
Some(validated.imports)
} else {
None
};
if let Some(sb) = input.sandbox.as_ref() {
state.sandbox_ceiling.check(sb)?;
}
@@ -258,6 +344,8 @@ async fn update_script<R: ScriptRepository, L: ExecutionLogRepository>(
timeout_seconds: input.timeout_seconds,
memory_limit_mb: input.memory_limit_mb,
sandbox: input.sandbox,
kind: input.kind,
imports: imports_for_patch,
},
)
.await?;