51f14fa2b1
Closes the gaps and the one security finding from the second end-to-end
CLI test (E2E_STASH_REPORT.md), plus the H1 boot-regression found while
re-reviewing those fixes.
Security
- S6: reserved-path validation (`check_reserved`) now case-folds before
comparing, so `/API/v2/x`, `/HEALTHZ`, `/Admin/x` are rejected like
their lowercase forms. Request-time matching stays case-sensitive.
- S10: "public route != public data" callout in sdk-shape.md (script_gate
skips authz when the principal is anonymous).
Observability / features
- G1: trigger executions now write `execution_logs`. Migration 0043 adds
a `source` column (CHECK mirrors ExecutionSource/OutboxSourceKind,
DEFAULT 'http' backfills history); a shared `build_execution_log` helper
in executor-core; dispatcher logging for outbox triggers + queue
consumers (skips sync-HTTP rows the orchestrator already logs). `pic
logs` gains a source column + `--source` filter.
- G5: dev-only in-memory email capture under PICLOUD_DEV_MODE with no SMTP
(email::send succeeds locally), readable at GET /api/v1/admin/dev/emails
(Owner/Admin only; route mounted only in capture mode).
- G6: generalized the Rhai in-place-mutation footgun note (trim/replace/
make_upper/make_lower/crop/truncate/pad return ()).
- G2/G3/G4 (CLI): `pic members`, `pic files`, `pic queues`, read-only
`pic kv` (+ new kv_api.rs); `pic deploy --timeout/--memory/--kind/
--sandbox`; first-class `pic triggers create-{docs,files,pubsub,queue,
email}` wrappers. All new client path segments percent-encoded via seg().
H1 regression fix (found in re-review)
- The S6 change also runs in `compile_routes`, which compiles every stored
route at boot and on each route CRUD. A single stored route the new
validation rejects (creatable while the S6 gap existed) made the whole
compile Err and aborted startup. `compile_routes` is now lenient: it
skips an un-compilable row with a warning instead of bricking boot
(route creation still validates separately). Migration 0044 sweeps
pre-existing reserved-path routes on upgrade (WHERE mirrors
check_reserved exactly). Added regression tests for both.
Verified: cargo fmt, clippy --all-targets --all-features -D warnings, the
schema_snapshot test, and the new S6/lenient-compile unit tests all pass;
boot-resilience and G1/G5 confirmed live.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
2.0 KiB
Rust
60 lines
2.0 KiB
Rust
use async_trait::async_trait;
|
|
use picloud_shared::{ExecutionLog, ExecutionLogSink, LogSinkError};
|
|
use sqlx::PgPool;
|
|
|
|
/// Persists `ExecutionLog` rows to the `execution_logs` table.
|
|
///
|
|
/// In cluster mode this impl lives in the manager and is reachable
|
|
/// from orchestrator nodes via an HTTP wrapper; in single-process MVP
|
|
/// mode the orchestrator's `DataPlaneState` holds it directly.
|
|
pub struct PostgresExecutionLogSink {
|
|
pool: PgPool,
|
|
}
|
|
|
|
impl PostgresExecutionLogSink {
|
|
#[must_use]
|
|
pub fn new(pool: PgPool) -> Self {
|
|
Self { pool }
|
|
}
|
|
}
|
|
|
|
#[async_trait]
|
|
impl ExecutionLogSink for PostgresExecutionLogSink {
|
|
async fn record(&self, log: ExecutionLog) -> Result<(), LogSinkError> {
|
|
let headers = serde_json::to_value(&log.request_headers)
|
|
.map_err(|e| LogSinkError::Backend(format!("encode headers: {e}")))?;
|
|
let response_code = log.response_code.map(i32::from);
|
|
let duration_ms = i32::try_from(log.duration_ms).unwrap_or(i32::MAX);
|
|
|
|
sqlx::query(
|
|
"INSERT INTO execution_logs ( \
|
|
id, app_id, script_id, request_id, \
|
|
request_path, request_headers, request_body, \
|
|
response_code, response_body, \
|
|
logs, duration_ms, status, source, created_at \
|
|
) VALUES ( \
|
|
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14 \
|
|
)",
|
|
)
|
|
.bind(log.id)
|
|
.bind(log.app_id.into_inner())
|
|
.bind(log.script_id.into_inner())
|
|
.bind(log.request_id.into_inner())
|
|
.bind(&log.request_path)
|
|
.bind(headers)
|
|
.bind(&log.request_body)
|
|
.bind(response_code)
|
|
.bind(&log.response_body)
|
|
.bind(&log.script_logs)
|
|
.bind(duration_ms)
|
|
.bind(log.status.as_str())
|
|
.bind(log.source.as_str())
|
|
.bind(log.created_at)
|
|
.execute(&self.pool)
|
|
.await
|
|
.map_err(|e| LogSinkError::Backend(e.to_string()))?;
|
|
|
|
Ok(())
|
|
}
|
|
}
|