bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: harden community production foundation through story 1.5

Browse Source
This commit is contained in:
bsodfather
2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/admin-api/tests/integration/common.rs
+4
View File
@@ -211,6 +211,10 @@ pub(super) async fn create_lead(Json(payload): Json<Value>) -> Json<Value> {
pub(super) async fn test_registry() -> PostgresRegistry {
let database_url = crank_test_support::postgres_schema_url("test_admin_api").await;
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
crank_registry::MigrationAuthority::apply(&pool)
.await
.unwrap();
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
let password_hash = hash_password(TEST_AUTH_PASSWORD, TEST_PASSWORD_PEPPER).unwrap();
let user_id = registry
apps/admin-api/tests/integration/operations_agents.rs
+73 -7
View File
@@ -10,7 +10,7 @@ use std::{
};
use async_trait::async_trait;
use axum::{Json, Router, routing::post};
use axum::{Json, Router, extract::State, http::HeaderMap, routing::post};
use crank_core::{
ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
@@ -97,8 +97,8 @@ impl IdentityProvider for RejectingIdentityProvider {
async fn creates_publishes_and_tests_rest_operation() {
let registry = test_registry().await;
let storage_root = test_storage_root("lifecycle");
let upstream_base_url = spawn_upstream_server().await;
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
let (upstream_base_url, observed_upstream_headers) = spawn_correlation_upstream_server().await;
let base_url = spawn_admin_api(build_test_app(registry.clone(), storage_root)).await;
let client = authorized_client(&base_url).await;
let created = client
@@ -132,18 +132,25 @@ async fn creates_publishes_and_tests_rest_operation() {
.json::<Value>()
.await
.unwrap();
let test_run = client
let test_run_response = client
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
.header("x-request-id", "req_admin_test_run")
.header(
"traceparent",
"00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
)
.json(&json!({
"version": 1,
"input": { "email": "user@example.com" }
}))
.send()
.await
.unwrap()
.json::<Value>()
.await
.unwrap();
assert_eq!(
test_run_response.headers()["x-trace-id"].to_str().unwrap(),
"0af7651916cd43dd8448eb211c80319c"
);
let test_run = test_run_response.json::<Value>().await.unwrap();
assert_eq!(listed["items"][0]["name"], "crm_create_lead");
assert_eq!(
@@ -158,6 +165,65 @@ async fn creates_publishes_and_tests_rest_operation() {
"user@example.com"
);
assert_eq!(test_run["response_preview"]["id"], "lead_123");
let logs = registry
.list_invocation_logs(crank_registry::ListInvocationLogsQuery {
workspace_id: &WorkspaceId::new(DEFAULT_WORKSPACE_ID),
level: None,
search_text: None,
source: Some(crank_core::InvocationSource::AdminTestRun),
operation_id: Some(&crank_core::OperationId::new(&operation_id)),
agent_id: None,
created_after: None,
limit: 10,
})
.await
.unwrap();
assert_eq!(logs.len(), 1);
assert_eq!(
logs[0].log.request_id.as_deref(),
Some("req_admin_test_run")
);
assert_eq!(
logs[0].log.trace_id.as_deref(),
Some("0af7651916cd43dd8448eb211c80319c")
);
let upstream_headers = observed_upstream_headers.lock().await;
let upstream_headers = upstream_headers.as_ref().unwrap();
assert_eq!(
upstream_headers["x-request-id"].to_str().unwrap(),
"req_admin_test_run"
);
assert_eq!(
&upstream_headers["traceparent"].to_str().unwrap()[3..35],
"0af7651916cd43dd8448eb211c80319c"
);
}
async fn spawn_correlation_upstream_server() -> (String, Arc<tokio::sync::Mutex<Option<HeaderMap>>>)
{
let observed = Arc::new(tokio::sync::Mutex::new(None));
let app = Router::new()
.route("/crm/leads", post(capture_correlation_and_create_lead))
.with_state(Arc::clone(&observed));
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
let address = listener.local_addr().unwrap();
tokio::spawn(async move {
axum::serve(listener, app).await.unwrap();
});
(format!("http://{address}"), observed)
}
async fn capture_correlation_and_create_lead(
State(observed): State<Arc<tokio::sync::Mutex<Option<HeaderMap>>>>,
headers: HeaderMap,
Json(payload): Json<Value>,
) -> Json<Value> {
*observed.lock().await = Some(headers);
Json(json!({
"id": "lead_123",
"status": "created",
"input": payload,
}))
}
#[tokio::test(flavor = "multi_thread")]
apps/admin-api/tests/integration/request_context.rs
+162 -2
View File
@@ -3,10 +3,10 @@ use std::{
sync::{Arc, Mutex},
};
use admin_api::request_context::{REQUEST_ID_HEADER, apply_request_context};
use admin_api::request_context::{REQUEST_ID_HEADER, TRACE_ID_HEADER, apply_request_context};
use axum::{
Router,
body::Body,
body::{Body, to_bytes},
http::{HeaderMap, HeaderValue, Request, StatusCode},
routing::get,
};
@@ -64,6 +64,11 @@ async fn logs_request_completion_and_rejects_untrusted_values() {
.find(|event: &serde_json::Value| event["event"] == "admin.request.completed")
.unwrap();
assert_eq!(event["request_id"], "req_admin_trace_123");
let trace_id = response.headers()[TRACE_ID_HEADER.as_str()]
.to_str()
.unwrap();
assert_eq!(trace_id.len(), 32);
assert_eq!(event["trace_id"], trace_id);
assert_eq!(event["fields"]["status"], 200);
assert_eq!(event["fields"]["route"], "/probe");
@@ -85,9 +90,144 @@ async fn logs_request_completion_and_rejects_untrusted_values() {
uuid::Uuid::parse_str(generated).unwrap().get_version(),
Some(Version::SortRand)
);
let generated_trace = invalid_response.headers()[TRACE_ID_HEADER.as_str()]
.to_str()
.unwrap();
assert_eq!(generated_trace.len(), 32);
assert_ne!(generated_trace, "canary-invalid-traceparent");
assert!(!writer.output().contains("canary-invalid-traceparent"));
}
#[tokio::test(flavor = "current_thread")]
async fn structured_boundary_error_carries_the_same_safe_ids() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
let dispatch = tracing::Dispatch::new(tracing_subscriber::registry());
let _dispatch_guard = tracing::dispatcher::set_default(&dispatch);
let response = error_probe_app()
.oneshot(
Request::builder()
.uri("/error")
.header("x-request-id", "request-boundary-error")
.header(
"traceparent",
"00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
)
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(response.status(), StatusCode::BAD_REQUEST);
assert_eq!(
response.headers()[REQUEST_ID_HEADER],
"request-boundary-error"
);
assert_eq!(
response.headers()[TRACE_ID_HEADER],
"0af7651916cd43dd8448eb211c80319c"
);
let body = to_bytes(response.into_body(), 16 * 1024).await.unwrap();
let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
assert_eq!(payload["error"]["request_id"], "request-boundary-error");
assert_eq!(
payload["error"]["trace_id"],
"0af7651916cd43dd8448eb211c80319c"
);
}
#[tokio::test(flavor = "current_thread")]
async fn boundary_status_matrix_keeps_ids_and_redacts_internal_causes() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
let writer = SharedLogWriter::default();
let subscriber = crank_observability::build_subscriber(
ObservabilityConfig::new(
ServiceIdentity::try_new("admin-api", "test", "test").unwrap(),
"info",
RedactionLimits::default(),
),
writer.clone(),
)
.unwrap();
let app = Router::new()
.route(
"/bad-request",
get(|| async { Err::<(), _>(admin_api::error::ApiError::validation("invalid")) }),
)
.route(
"/unauthorized",
get(|| async {
Err::<(), _>(admin_api::error::ApiError::unauthorized("unauthorized"))
}),
)
.route(
"/forbidden",
get(|| async { Err::<(), _>(admin_api::error::ApiError::forbidden("forbidden")) }),
)
.route(
"/internal",
get(|| async {
Err::<(), _>(admin_api::error::ApiError::internal(
"postgres://canary-user:canary-password@private-host/database",
))
}),
)
.route(
"/rate-limited",
get(|| async { StatusCode::TOO_MANY_REQUESTS }),
)
.layer(axum::middleware::from_fn(apply_request_context));
let responses = async {
let mut responses = Vec::new();
for (path, status) in [
("/bad-request", StatusCode::BAD_REQUEST),
("/unauthorized", StatusCode::UNAUTHORIZED),
("/forbidden", StatusCode::FORBIDDEN),
("/missing", StatusCode::NOT_FOUND),
("/rate-limited", StatusCode::TOO_MANY_REQUESTS),
("/internal", StatusCode::INTERNAL_SERVER_ERROR),
] {
let response = app
.clone()
.oneshot(
Request::builder()
.uri(path)
.header(REQUEST_ID_HEADER.as_str(), "matrix-request-id")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(response.status(), status);
assert_eq!(response.headers()[REQUEST_ID_HEADER], "matrix-request-id");
assert_eq!(response.headers()[TRACE_ID_HEADER].as_bytes().len(), 32);
responses.push(to_bytes(response.into_body(), 16 * 1024).await.unwrap());
}
responses
};
let dispatch = tracing::Dispatch::new(subscriber);
let _dispatch_guard = tracing::dispatcher::set_default(&dispatch);
let responses = responses.await;
let combined = responses
.iter()
.flat_map(|body| body.iter().copied())
.collect::<Vec<_>>();
assert!(
!combined
.windows("canary-password".len())
.any(|value| value == b"canary-password")
);
assert!(!writer.output().contains("canary-password"));
let internal_event: serde_json::Value = writer
.output()
.lines()
.map(|line| serde_json::from_str(line).unwrap())
.find(|event: &serde_json::Value| event["event"] == "admin.response.internal_error")
.unwrap();
assert_eq!(internal_event["request_id"], "matrix-request-id");
assert_eq!(internal_event["trace_id"].as_str().unwrap().len(), 32);
}
#[tokio::test(flavor = "current_thread")]
async fn covers_valid_invalid_and_absent_traceparent() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
@@ -163,6 +303,14 @@ async fn replaces_multiple_request_id_headers_with_one_uuid_v7() {
REQUEST_ID_HEADER,
HeaderValue::from_static("second-request-id"),
);
request.headers_mut().append(
"traceparent",
HeaderValue::from_static("00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"),
);
request.headers_mut().append(
"traceparent",
HeaderValue::from_static("00-1af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"),
);
let response = probe_app().oneshot(request).await.unwrap();
let generated = response.headers()[REQUEST_ID_HEADER].to_str().unwrap();
@@ -173,6 +321,9 @@ async fn replaces_multiple_request_id_headers_with_one_uuid_v7() {
uuid::Uuid::parse_str(generated).unwrap().get_version(),
Some(Version::SortRand)
);
let trace_id = response.headers()[TRACE_ID_HEADER].to_str().unwrap();
assert_ne!(trace_id, "0af7651916cd43dd8448eb211c80319c");
assert_ne!(trace_id, "1af7651916cd43dd8448eb211c80319c");
}
fn probe_app() -> Router {
@@ -181,6 +332,15 @@ fn probe_app() -> Router {
.layer(axum::middleware::from_fn(apply_request_context))
}
fn error_probe_app() -> Router {
Router::new()
.route(
"/error",
get(|| async { Err::<(), _>(admin_api::error::ApiError::validation("invalid")) }),
)
.layer(axum::middleware::from_fn(apply_request_context))
}
fn trace_probe_app() -> Router {
Router::new()
.route("/trace", get(observed_traceparent))