fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(modules): extension-point-aware resolver policy (§5.5 C2)

Browse Source 
Add the runtime heart of extension points: `ModuleSource::resolve_policy`
decides lexical vs dynamic resolution by the NEAREST declaration of a name
walking up the importing origin's chain — a concrete module → lexical (seal
to origin, Phase 4b); an extension-point marker → dynamic, resolved against
the inheriting app (`cx.app_id`) so the app can override, falling back to the
default body up-chain; the EP wins a depth tie.

- shared: `ModuleResolution { Module | NoProvider | NotFound }` + a
  `resolve_policy(origin, inheriting_app, name)` trait method with a
  lexical-only default impl (existing fakes inherit it unchanged).
- PostgresModuleSource: one-round-trip nearest-declaration query (min EP depth
  vs min module depth over the chain CTEs), then the lexical/dynamic branch.
- module_resolver: calls `resolve_policy(origin, cx.app_id, path)`; maps
  NoProvider → a clear "extension point has no provider" error, NotFound →
  module-not-found. Cache + AST-source sealing unchanged.
- executor-core tests: a policy fake + 3 cases (app override binds dynamically,
  no-provider errors, non-EP stays lexical).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-29 20:07:59 +02:00
parent 8b68a7d7e8
commit 8f966783fe
5 changed files with 299 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
crates/executor-core/src/module_resolver.rs
View File

@@ -377,17 +377,40 @@ impl ModuleResolver for PicloudModuleResolver {
let origin = importer_source
.and_then(decode_origin)
.unwrap_or(self.default_origin);
let lookup_result: Result<Option<picloud_shared::ModuleScript>, ModuleSourceError> =
tokio::task::block_in_place(|| handle.block_on(self.source.resolve(origin, path)));
// §5.5 policy resolution: the source decides lexical (seal to `origin`)
// vs dynamic (an extension point resolves against the inheriting app,
// `cx.app_id`). The result is already the concrete module to bind, or a
// terminal NoProvider/NotFound.
let lookup_result: Result<picloud_shared::ModuleResolution, ModuleSourceError> =
tokio::task::block_in_place(|| {
handle.block_on(self.source.resolve_policy(origin, self.cx.app_id, path))
});
let module_row = match lookup_result {
Ok(Some(m)) => m,
Ok(None) => {
Ok(picloud_shared::ModuleResolution::Module(m)) => m,
Ok(picloud_shared::ModuleResolution::NotFound) => {
return Err(Box::new(EvalAltResult::ErrorModuleNotFound(
path.to_string(),
pos,
)));
}
Ok(picloud_shared::ModuleResolution::NoProvider) => {
// §5.5: an extension point with no provider for this app is a
// hard failure (the app must supply the module or a default
// body must exist up-chain). Distinct, actionable message.
return Err(Box::new(EvalAltResult::ErrorInModule(
path.to_string(),
Box::new(EvalAltResult::ErrorRuntime(
format!(
"extension point {path:?} has no provider for this app — \
define a module named {path:?} or a default body up-chain"
)
.into(),
pos,
)),
pos,
)));
}
Err(e) => {
// v1.1.4 §10a: redact the backend error before it
// reaches a script. In public-HTTP context (principal:

149
crates/executor-core/tests/modules.rs
View File

@@ -8,7 +8,7 @@
//! verify the same code path the `picloud` binary runs at request
//! time.
use std::collections::{BTreeMap, HashMap};
use std::collections::{BTreeMap, HashMap, HashSet};
use std::sync::atomic::{AtomicUsize, Ordering};
use std::sync::Arc;
@@ -736,3 +736,150 @@ async fn lexical_entry_origin_selects_app_module() {
.expect("should execute");
assert_eq!(resp.body, serde_json::json!(999));
}
// ---------------------------------------------------------------------------
// §5.5 extension points — resolver handling of the policy outcomes.
//
// `PolicyModuleSource` is a flat fake that overrides `resolve_policy`: an EP
// name resolves dynamically against the inheriting app; a non-EP name resolves
// lexically from the importing origin. This verifies the resolver maps
// Module/NoProvider/NotFound correctly. The full chain semantics (default body
// up-chain, nearest-declaration tie) are covered by the CLI journey tests.
// ---------------------------------------------------------------------------
#[derive(Default)]
struct PolicyModuleSource {
modules: Mutex<HashMap<(ScriptOwner, String), ModuleScript>>,
eps: Mutex<HashSet<String>>,
}
impl PolicyModuleSource {
fn new() -> Arc<Self> {
Arc::new(Self::default())
}
async fn put(self: &Arc<Self>, owner: ScriptOwner, name: &str, source: &str) {
let (app_id, group_id) = match owner {
ScriptOwner::App(a) => (Some(a), None),
ScriptOwner::Group(g) => (None, Some(g)),
};
self.modules.lock().await.insert(
(owner, name.to_string()),
ModuleScript {
script_id: ScriptId::new(),
app_id,
group_id,
name: name.to_string(),
source: source.to_string(),
updated_at: Utc::now(),
},
);
}
async fn mark_ep(self: &Arc<Self>, name: &str) {
self.eps.lock().await.insert(name.to_string());
}
}
#[async_trait]
impl ModuleSource for PolicyModuleSource {
async fn resolve(
&self,
origin: ScriptOwner,
name: &str,
) -> Result<Option<ModuleScript>, ModuleSourceError> {
Ok(self
.modules
.lock()
.await
.get(&(origin, name.to_string()))
.cloned())
}
async fn resolve_policy(
&self,
origin: ScriptOwner,
inheriting_app: AppId,
name: &str,
) -> Result<picloud_shared::ModuleResolution, ModuleSourceError> {
use picloud_shared::ModuleResolution;
if self.eps.lock().await.contains(name) {
// Extension point → dynamic, resolved against the inheriting app.
return Ok(
match self.resolve(ScriptOwner::App(inheriting_app), name).await? {
Some(m) => ModuleResolution::Module(m),
None => ModuleResolution::NoProvider,
},
);
}
Ok(match self.resolve(origin, name).await? {
Some(m) => ModuleResolution::Module(m),
None => ModuleResolution::NotFound,
})
}
}
/// An extension-point import binds the inheriting APP's module even though the
/// importing script's defining node is the group (dynamic override — the
/// inverse of the Phase 4b sealed/lexical import).
#[tokio::test(flavor = "multi_thread")]
async fn extension_point_resolves_app_override() {
let source = PolicyModuleSource::new();
let app = AppId::new();
let group = GroupId::new();
source.mark_ep("theme").await;
// App provides its own `theme`; group has none.
source
.put(ScriptOwner::App(app), "theme", r#"fn color() { "red" }"#)
.await;
let engine = engine_with(source.clone());
// Entry runs as the inherited GROUP endpoint importing the EP `theme`.
let resp = engine
.execute(
r#"import "theme" as t; t::color()"#,
req_with_owner(app, ScriptOwner::Group(group)),
)
.expect("should execute");
assert_eq!(resp.body, serde_json::json!("red"));
}
/// An extension point with no provider for the app is a hard error.
#[tokio::test(flavor = "multi_thread")]
async fn extension_point_without_provider_errors() {
let source = PolicyModuleSource::new();
let app = AppId::new();
let group = GroupId::new();
source.mark_ep("theme").await; // declared, but no module anywhere.
let engine = engine_with(source.clone());
let err = engine
.execute(
r#"import "theme" as t; t::color()"#,
req_with_owner(app, ScriptOwner::Group(group)),
)
.expect_err("missing provider must error");
let msg = format!("{err:?}").to_lowercase();
assert!(
msg.contains("no provider") || msg.contains("extension point"),
"expected a no-provider error, got {msg}"
);
}
/// A non-extension-point name still resolves lexically from the origin.
#[tokio::test(flavor = "multi_thread")]
async fn non_extension_point_stays_lexical() {
let source = PolicyModuleSource::new();
let app = AppId::new();
let group = GroupId::new();
source
.put(ScriptOwner::Group(group), "util", r#"fn v() { 7 }"#)
.await;
let engine = engine_with(source.clone());
let resp = engine
.execute(
r#"import "util" as u; u::v()"#,
req_with_owner(app, ScriptOwner::Group(group)),
)
.expect("should execute");
assert_eq!(resp.body, serde_json::json!(7));
}