prisma-risk / tsoracle / 26377626780

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(core): make WindowGrant valid-by-construction so first/last can't panic (#363)

WindowGrant had pub fields and Copy, so any caller could build one with
out-of-range values and call .last(), which packs via Timestamp::pack — an
assert! that bypasses the crate's panic-policy lint banning unwrap/expect on
non-test paths. The in-range invariant was enforced by the single try_grant
constructor, not by the type.

Make the fields private behind a checked try_new constructor: it rejects
count == 0, guards the u32 overflow of logical_start + count - 1, and validates
the range with a single Timestamp::try_pack on the last logical the grant emits
(logical_start <= last_logical <= LOGICAL_MAX, so the first boundary is covered
by implication). first()/last() stay infallible and are now documented as such
because construction was checked. try_grant builds through try_new? —
project_grant already guarantees in-range so it never fails in practice, but it
now propagates a CoreError instead of panicking and stays free of unwrap/expect.

Adds CoreError::LogicalRangeOutOfRange and its out-of-range gRPC mapping in
core_status. Cross-crate readers (service.rs, the leader_watch integration test)
move to the new physical_ms/logical_start/count/epoch accessors.

Closes #347

Coverage Stats

74 of 78 new or added lines in 2 files covered. (94.87%)

1 existing line in 1 file now uncovered.

11714 of 12352 relevant lines covered (94.83%)

554177.05 hits per line