Closes the gaps and the one security finding from the second end-to-end
CLI test (E2E_STASH_REPORT.md), plus the H1 boot-regression found while
re-reviewing those fixes.
Security
- S6: reserved-path validation (`check_reserved`) now case-folds before
comparing, so `/API/v2/x`, `/HEALTHZ`, `/Admin/x` are rejected like
their lowercase forms. Request-time matching stays case-sensitive.
- S10: "public route != public data" callout in sdk-shape.md (script_gate
skips authz when the principal is anonymous).
Observability / features
- G1: trigger executions now write `execution_logs`. Migration 0043 adds
a `source` column (CHECK mirrors ExecutionSource/OutboxSourceKind,
DEFAULT 'http' backfills history); a shared `build_execution_log` helper
in executor-core; dispatcher logging for outbox triggers + queue
consumers (skips sync-HTTP rows the orchestrator already logs). `pic
logs` gains a source column + `--source` filter.
- G5: dev-only in-memory email capture under PICLOUD_DEV_MODE with no SMTP
(email::send succeeds locally), readable at GET /api/v1/admin/dev/emails
(Owner/Admin only; route mounted only in capture mode).
- G6: generalized the Rhai in-place-mutation footgun note (trim/replace/
make_upper/make_lower/crop/truncate/pad return ()).
- G2/G3/G4 (CLI): `pic members`, `pic files`, `pic queues`, read-only
`pic kv` (+ new kv_api.rs); `pic deploy --timeout/--memory/--kind/
--sandbox`; first-class `pic triggers create-{docs,files,pubsub,queue,
email}` wrappers. All new client path segments percent-encoded via seg().
H1 regression fix (found in re-review)
- The S6 change also runs in `compile_routes`, which compiles every stored
route at boot and on each route CRUD. A single stored route the new
validation rejects (creatable while the S6 gap existed) made the whole
compile Err and aborted startup. `compile_routes` is now lenient: it
skips an un-compilable row with a warning instead of bricking boot
(route creation still validates separately). Migration 0044 sweeps
pre-existing reserved-path routes on upgrade (WHERE mirrors
check_reserved exactly). Added regression tests for both.
Verified: cargo fmt, clippy --all-targets --all-features -D warnings, the
schema_snapshot test, and the new S6/lenient-compile unit tests all pass;
boot-resilience and G1/G5 confirmed live.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
126 lines
3.8 KiB
Rust
126 lines
3.8 KiB
Rust
use std::collections::BTreeMap;
|
|
|
|
use chrono::{DateTime, Utc};
|
|
use serde::{Deserialize, Serialize};
|
|
use uuid::Uuid;
|
|
|
|
use crate::{AppId, RequestId, ScriptId};
|
|
|
|
/// One row in the `execution_logs` table. Same shape flows through the
|
|
/// `ExecutionLogSink` trait and the `GET /scripts/{id}/logs` response.
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct ExecutionLog {
|
|
pub id: Uuid,
|
|
/// Owning app at the time of execution. Materialized at write time
|
|
/// so a future "move script to another app" doesn't retag history.
|
|
pub app_id: AppId,
|
|
pub script_id: ScriptId,
|
|
pub request_id: RequestId,
|
|
|
|
pub request_path: String,
|
|
pub request_headers: BTreeMap<String, String>,
|
|
pub request_body: serde_json::Value,
|
|
|
|
pub response_code: Option<u16>,
|
|
pub response_body: Option<serde_json::Value>,
|
|
|
|
/// `log::*` entries captured during the execution, serialized as a
|
|
/// JSON array of `{timestamp, level, message, data}` objects.
|
|
pub script_logs: serde_json::Value,
|
|
|
|
pub duration_ms: u64,
|
|
pub status: ExecutionStatus,
|
|
|
|
/// What dispatched this execution: `http` for direct data-plane
|
|
/// ingress, or one of the trigger kinds (`kv`, `cron`, `queue`,
|
|
/// `invoke`, …) for background runs. Materialized so `pic logs`
|
|
/// can surface — and filter by — the origin of every run, not just
|
|
/// the HTTP ones. Defaults to `http` for rows written before the
|
|
/// column existed (migration 0043).
|
|
#[serde(default)]
|
|
pub source: ExecutionSource,
|
|
|
|
pub created_at: DateTime<Utc>,
|
|
}
|
|
|
|
/// Origin of an execution. Wire strings mirror
|
|
/// `manager-core::OutboxSourceKind` (plus `Queue`, which the queue
|
|
/// consumer dispatches outside the outbox) so a trigger's source kind
|
|
/// maps straight through to its execution-log row. Keep the variants and
|
|
/// the `source` CHECK constraint in migration 0043 in sync.
|
|
#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum ExecutionSource {
|
|
#[default]
|
|
Http,
|
|
Kv,
|
|
Docs,
|
|
DeadLetter,
|
|
Cron,
|
|
Files,
|
|
Pubsub,
|
|
Email,
|
|
Invoke,
|
|
Queue,
|
|
}
|
|
|
|
impl ExecutionSource {
|
|
#[must_use]
|
|
pub fn as_str(self) -> &'static str {
|
|
match self {
|
|
Self::Http => "http",
|
|
Self::Kv => "kv",
|
|
Self::Docs => "docs",
|
|
Self::DeadLetter => "dead_letter",
|
|
Self::Cron => "cron",
|
|
Self::Files => "files",
|
|
Self::Pubsub => "pubsub",
|
|
Self::Email => "email",
|
|
Self::Invoke => "invoke",
|
|
Self::Queue => "queue",
|
|
}
|
|
}
|
|
|
|
/// Parse a wire string back into a variant. Returns `None` for an
|
|
/// unknown value (callers treat that as "no filter" or a 422).
|
|
#[must_use]
|
|
pub fn from_wire(s: &str) -> Option<Self> {
|
|
match s {
|
|
"http" => Some(Self::Http),
|
|
"kv" => Some(Self::Kv),
|
|
"docs" => Some(Self::Docs),
|
|
"dead_letter" => Some(Self::DeadLetter),
|
|
"cron" => Some(Self::Cron),
|
|
"files" => Some(Self::Files),
|
|
"pubsub" => Some(Self::Pubsub),
|
|
"email" => Some(Self::Email),
|
|
"invoke" => Some(Self::Invoke),
|
|
"queue" => Some(Self::Queue),
|
|
_ => None,
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Matches the CHECK constraint on `execution_logs.status`. Keep the
|
|
/// serde rename in sync with the migration.
|
|
#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum ExecutionStatus {
|
|
Success,
|
|
Error,
|
|
Timeout,
|
|
BudgetExceeded,
|
|
}
|
|
|
|
impl ExecutionStatus {
|
|
#[must_use]
|
|
pub fn as_str(self) -> &'static str {
|
|
match self {
|
|
Self::Success => "success",
|
|
Self::Error => "error",
|
|
Self::Timeout => "timeout",
|
|
Self::BudgetExceeded => "budget_exceeded",
|
|
}
|
|
}
|
|
}
|