services_hardening_publication_submission_contract.rs (2047B)
1 #![forbid(unsafe_code)] 2 3 use serde_json::json; 4 5 const CONTRACT: &str = 6 include_str!("../contracts/services_hardening/publication_submission.v1.json"); 7 8 #[test] 9 fn exact_committed_submission_contract_is_closed() { 10 let contract: serde_json::Value = serde_json::from_str(CONTRACT).expect("contract JSON"); 11 assert_eq!(contract["schema"], "radroots.rhi.publication-submission"); 12 assert_eq!(contract["schema_version"], 1); 13 assert_eq!(contract["contract_version"], 1); 14 assert_eq!(contract["source"]["maximum_signed_event_bytes"], 32_768); 15 assert_eq!( 16 contract["source"]["required_bindings"], 17 json!([ 18 "requested_outbox_id", 19 "outbox_event_id_equals_event_id", 20 "outbox_event_sha256_equals_event_sha256", 21 "sha256_exact_stored_bytes_equals_event_sha256" 22 ]) 23 ); 24 assert_eq!(contract["sealed_capability"]["forgeable"], false); 25 assert_eq!(contract["sealed_capability"]["cloneable"], false); 26 assert_eq!(contract["retry_and_recovery"]["parse_event"], false); 27 assert_eq!(contract["retry_and_recovery"]["rebuild_event"], false); 28 assert_eq!(contract["retry_and_recovery"]["reserialize_event"], false); 29 assert_eq!(contract["retry_and_recovery"]["resign_event"], false); 30 assert_eq!(contract["effects"]["sqlite_read"], true); 31 assert_eq!(contract["effects"]["sqlite_mutation"], false); 32 assert_eq!(contract["effects"]["relay_or_network"], false); 33 for forbidden in [ 34 "caller_forged_committed_publication", 35 "unbounded_blob_decode", 36 "json_or_event_deserialization", 37 "event_rebuild", 38 "event_reserialization", 39 "event_resigning", 40 "raw_sqlite_handle", 41 "relay_io", 42 "hidden_retry_loop", 43 ] { 44 assert!( 45 contract["forbidden"] 46 .as_array() 47 .expect("forbidden inventory") 48 .iter() 49 .any(|value| value == forbidden), 50 "missing forbidden boundary {forbidden}" 51 ); 52 } 53 }