Feat/identity hot reload

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["dhttp", "identity", "home", "api", "access", "log"]
 
 [workspace.package]
-version = "0.6.1-beta.1"
+version = "0.6.1-beta.2"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/genmeta/dhttp"
@@ -52,9 +52,9 @@ ddns = { package = "dyns", version = "0.7.0", features = [
     "mdns",
     "dquic-network",
 ] }
-h3x = { version = "0.6.0", features = [
+h3x = { version = "0.6.1-beta.1", features = [
     "dquic",
 ] }
-dhttp = { path = "dhttp", version = "0.6.1-beta.1" }
+dhttp = { path = "dhttp", version = "0.6.1-beta.2" }
 dhttp-access = { path = "access", version = "0.4.1-beta.1" }
 dhttp-log = { path = "log", version = "0.1.0" }

access/src/db/mod.rs

@@ -182,8 +182,12 @@ pub async fn init_access_database_for(
 mod tests {
     use std::path::PathBuf;
 
-    use crate::{action::RequestAction, matcher::LocationRulesMatcher};
-    use sea_orm::{ConnectionTrait, Statement};
+    use crate::{
+        action::RequestAction,
+        db::entities::location::{location, rule},
+        matcher::LocationRulesMatcher,
+    };
+    use sea_orm::{ColumnTrait, ConnectionTrait, EntityTrait, QueryFilter, Set, Statement};
 
     use super::service::location_service::LocationService;
     use super::*;
@@ -282,6 +286,49 @@ mod tests {
         assert!(!tables.contains(&"location_domain_rule_sets".to_string()));
     }
 
+    #[tokio::test]
+    async fn migration_deduplicates_existing_rules() {
+        use sea_orm_migration::MigratorTrait;
+
+        let db = sea_orm::Database::connect("sqlite::memory:").await.unwrap();
+        migration::Migrator::up(&db, Some(1)).await.unwrap();
+
+        let now = chrono::Utc::now();
+        let location_id = location::Entity::insert(location::ActiveModel {
+            pattern: Set("/api".parse().unwrap()),
+            created_at: Set(now),
+            updated_at: Set(now),
+            ..Default::default()
+        })
+        .exec(&db)
+        .await
+        .unwrap()
+        .last_insert_id;
+        let expr: crate::expr::exprs::LocationRuleExprs = "alice.pilot~".parse().unwrap();
+
+        for _ in 0..2 {
+            rule::Entity::insert(rule::ActiveModel {
+                location_id: Set(location_id),
+                action: Set(RequestAction::Allow),
+                exprs: Set(expr.clone()),
+                created_at: Set(now),
+                updated_at: Set(now),
+                ..Default::default()
+            })
+            .exec(&db)
+            .await
+            .unwrap();
+        }
+
+        migration::Migrator::up(&db, None).await.unwrap();
+        let rules = rule::Entity::find()
+            .filter(rule::Column::LocationId.eq(location_id))
+            .all(&db)
+            .await
+            .unwrap();
+        assert_eq!(rules.len(), 1);
+    }
+
     #[tokio::test]
     async fn appending_duplicate_rules_is_idempotent() {
         let test_home = TestHome::new("duplicate-rules");
@@ -323,6 +370,124 @@ mod tests {
         assert_eq!(rules.rules.len(), 1);
     }
 
+    #[tokio::test]
+    async fn concurrent_appends_are_idempotent() {
+        let test_home = TestHome::new("concurrent-duplicate-rules");
+        let home = test_home.home();
+        let identity: identity::Name<'static> = "alice.pilot".parse().unwrap();
+        let db = init_identity_access_database(&home, identity.borrow())
+            .await
+            .unwrap();
+        let service = LocationService::new(&db);
+        let location = "/api".parse().unwrap();
+        let expr: crate::expr::exprs::LocationRuleExprs = "alice.pilot~".parse().unwrap();
+
+        let (first, second) = tokio::join!(
+            service.append_rule_with_id(&location, RequestAction::Allow, expr.clone()),
+            service.append_rule_with_id(&location, RequestAction::Allow, expr),
+        );
+        let first = first.unwrap();
+        let second = second.unwrap();
+
+        assert_eq!(first.id, second.id);
+        assert_eq!(
+            service
+                .list_rules_by_pattern(&location)
+                .await
+                .unwrap()
+                .rules
+                .len(),
+            1
+        );
+    }
+
+    async fn insert_duplicate_rule(db: &DatabaseConnection, original: &rule::Model) {
+        db.execute_unprepared("DROP INDEX idx_location_rules_logical_unique")
+            .await
+            .unwrap();
+
+        let now = chrono::Utc::now();
+        rule::Entity::insert(rule::ActiveModel {
+            location_id: Set(original.location_id),
+            action: Set(original.action),
+            exprs: Set(original.exprs.clone()),
+            created_at: Set(now),
+            updated_at: Set(now),
+            ..Default::default()
+        })
+        .exec(db)
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn removing_rule_by_sequence_removes_duplicate_rows() {
+        let test_home = TestHome::new("remove-duplicate-by-sequence");
+        let home = test_home.home();
+        let identity: identity::Name<'static> = "alice.pilot".parse().unwrap();
+        let db = init_identity_access_database(&home, identity.borrow())
+            .await
+            .unwrap();
+        let service = LocationService::new(&db);
+        let original = service
+            .append_rule_with_id(
+                &"/api".parse().unwrap(),
+                RequestAction::Allow,
+                "alice.pilot~".parse().unwrap(),
+            )
+            .await
+            .unwrap();
+
+        insert_duplicate_rule(&db, &original).await;
+        service
+            .remove_rules(&"/api".parse().unwrap(), [0])
+            .await
+            .unwrap();
+
+        assert!(
+            service
+                .list_rules_by_pattern(&"/api".parse().unwrap())
+                .await
+                .unwrap()
+                .rules
+                .is_empty()
+        );
+    }
+
+    #[tokio::test]
+    async fn removing_rule_by_id_removes_duplicate_rows() {
+        let test_home = TestHome::new("remove-duplicate-by-id");
+        let home = test_home.home();
+        let identity: identity::Name<'static> = "alice.pilot".parse().unwrap();
+        let db = init_identity_access_database(&home, identity.borrow())
+            .await
+            .unwrap();
+        let service = LocationService::new(&db);
+        let original = service
+            .append_rule_with_id(
+                &"/api".parse().unwrap(),
+                RequestAction::Allow,
+                "alice.pilot~".parse().unwrap(),
+            )
+            .await
+            .unwrap();
+
+        insert_duplicate_rule(&db, &original).await;
+        service
+            .remove_rules_by_ids(&"/api".parse().unwrap(), [original.id])
+            .await
+            .unwrap();
+
+        assert!(
+            service
+                .list_rules_by_pattern(&"/api".parse().unwrap())
+                .await
+                .unwrap()
+                .rules
+                .is_empty()
+        );
+    }
+
     #[tokio::test]
     async fn location_service_location_only_crud() {
         let test_home = TestHome::new("location-crud");

access/src/db/service/error.rs

@@ -92,8 +92,8 @@ pub enum RemoveRulesError {
     BeginTransaction { source: DbErr },
     #[snafu(display("failed to locate location rule set before removing rules"))]
     MatchLocation { source: MatchLocationError },
-    #[snafu(display("failed to select location rule ids for removal"))]
-    LoadRuleIds { source: DbErr },
+    #[snafu(display("failed to select location rules for removal"))]
+    LoadRules { source: DbErr },
     #[snafu(display("location rule cannot be removed"))]
     Rule { source: RemoveRuleFailed },
     #[snafu(display("failed to delete location rules"))]
@@ -126,6 +126,8 @@ pub enum MatchOrCreateLocationError {
     MatchLocation { source: MatchLocationError },
     #[snafu(display("failed to insert location rule set"))]
     InsertLocation { source: DbErr },
+    #[snafu(display("location rule set disappeared after a conflicting insert"))]
+    LocationMissing,
 }
 
 #[derive(Debug, snafu::Snafu)]
@@ -143,6 +145,8 @@ pub enum AppendRuleError {
     LoadInsertedRule { source: DbErr },
     #[snafu(display("inserted location rule `{id}` could not be loaded"))]
     InsertedRuleMissing { id: i32 },
+    #[snafu(display("conflicting location rule could not be loaded"))]
+    ConflictingRuleMissing,
     #[snafu(display("failed to commit transaction after appending location rule"))]
     Commit { source: DbErr },
 }