prisma-risk / tsoracle / 26487708055

95%

push

github

refactor(core): PeerEndpoint newtype hoists scheme-less contract to type system (#560)

Introduce `tsoracle_core::PeerEndpoint(String)`, a newtype whose `try_from`
enforces the scheme-less `host:port` contract that consensus peer endpoints
have always been required to honor: no `http://` / `https://` prefix,
non-empty, numeric port in `1..=65535`, with bracketed IPv6 supported. The
type's `serde::Deserialize` re-validates so a malformed value cannot enter
the in-memory representation from the wire or from postcard-backed storage.

Migrated fields (in-process types, no wire-format change):
  * `TsoPeer.endpoint: String -> PeerEndpoint`
  * `LeaderState::Follower::leader_endpoint: Option<String> -> Option<PeerEndpoint>`
  * `ServingState::NotServing::leader_endpoint` and the `step_down` /
    `publish_not_serving` signatures flow the typed value end-to-end.

`tsoracle-server::fence::endpoint_is_scheme_less` and its `debug_assert`
guard branch are deleted: the type system now makes a scheme-bearing
follower hint unrepresentable, so the historical silent-prod-trap (a
TLS-configured client silently drops `http(s)://` hints, leaving the
leader unreachable via redirect) cannot recur. The epoch-monotonicity
guard is retained.

`OpenraftPeer.{service,admin}_endpoint` stay `String` on the type itself
to preserve the postcard wire format used by openraft membership log
entries (no `MAX_READABLE_VERSION` bump required). The `ServiceEndpoint`
trait now returns `Option<PeerEndpoint>` (parsed on each call), with
malformed or empty input silently mapping to `None` to match the
historical empty-as-sentinel pattern.

Wire-format compatibility is preserved at the proto boundaries: the
server converts `Option<PeerEndpoint>` back to `Option<String>` when
populating `LeaderHint.leader_endpoint`, and the client continues to
parse the wire `String` through `PeerEndpoint::try_from` at receive time.

Test fixtures that latently violated the contract (`http://...` /
`mem://...`... (continued)

221 of 235 new or added lines in 11 files covered. (94.04%)

13694 of 14426 relevant lines covered (94.93%)

385966.18 hits per line