package_boundary.rs (2266B)
1 #![forbid(unsafe_code)] 2 3 const ROOT: &str = include_str!("../src/lib.rs"); 4 const PUBLIC_API: &str = include_str!("../contracts/api_baselines/radrootsd.txt"); 5 const FLAKE: &str = include_str!("../flake.nix"); 6 7 #[test] 8 fn implementation_modules_are_private_and_api_is_owned() { 9 for module in ["app", "core", "host_nostr", "transport"] { 10 assert!(ROOT.contains(&format!("mod {module};"))); 11 assert!(!ROOT.contains(&format!("pub mod {module};"))); 12 assert!(!PUBLIC_API.contains(&format!("radrootsd::{module}::"))); 13 } 14 assert!(PUBLIC_API.contains("pub struct radrootsd::RadrootsdRunError")); 15 assert!(PUBLIC_API.contains("pub async fn radrootsd::run_daemon()")); 16 for dependency in ["anyhow::", "jsonrpsee::", "nostr::", "sqlx::"] { 17 assert!(!PUBLIC_API.contains(dependency), "leaked {dependency}"); 18 } 19 } 20 21 #[test] 22 fn public_error_is_redacted_and_source_free() { 23 let source = std::fs::read_to_string("src/lib.rs").expect("root source"); 24 for required in [ 25 "formatter.write_str(\"RadrootsdRunError\")", 26 "formatter.write_str(\"daemon execution failed\")", 27 "impl Error for RadrootsdRunError {}", 28 ] { 29 assert!(source.contains(required), "missing {required}"); 30 } 31 assert!(!PUBLIC_API.contains("std::io::Error")); 32 } 33 34 #[test] 35 fn nix_outputs_are_real_owned_and_exactly_bounded() { 36 for required in [ 37 "github:radrootslabs/lib/3563f3b5a4331eb2cb3f925cafc9de524d844228", 38 "\"aarch64-darwin\"", 39 "\"x86_64-linux\"", 40 "craneLib.buildPackage", 41 "craneLib.mkCargoDerivation", 42 "program = \"${package}/bin/radrootsd\"", 43 "default = (daemonOutputs system).package", 44 "default = (daemonOutputs system).check", 45 "default = (daemonOutputs system).app", 46 ] { 47 assert!( 48 FLAKE.contains(required), 49 "missing governed Nix source: {required}" 50 ); 51 } 52 for forbidden in [ 53 "writeShellApplication", 54 "git rev-parse", 55 "repo_root", 56 "devShells", 57 "nixosModules", 58 "aarch64-linux", 59 "x86_64-darwin", 60 ] { 61 assert!( 62 !FLAKE.contains(forbidden), 63 "forbidden Nix surface is present: {forbidden}" 64 ); 65 } 66 }