Clean namespace surfaces and add Docker publish smoke gate

Author: eboody

.gitignore

@@ -1,6 +1,7 @@
 target
 .nvimlog
 .tmp-playwright/
+rustc-ice-*.txt
 artifacts/visual/current
 artifacts/
 .playwright-browsers/

crates/app/src/auth.rs

@@ -1,5 +1,7 @@
 mod authenticate_flow;
 mod get_user_flow;
+pub mod password;
+pub mod repository;
 
 use std::sync::Arc;
 
@@ -8,7 +10,6 @@ use bon::Builder;
 use nutype::nutype;
 use secrecy::SecretString;
 use snafu::prelude::*;
-use strum_macros::Display;
 
 use domain::user;
 
@@ -19,62 +20,26 @@ type BoxError = Box<dyn std::error::Error + Send + Sync + 'static>;
 #[derive(Debug, Snafu)]
 pub enum Error {
     #[snafu(display("{source}"))]
-    Repository { source: RepositoryError },
+    Repository { source: repository::Error },
     #[snafu(display("auth password hashing failed: {source}"))]
-    HashPassword { source: PasswordHashError },
+    HashPassword { source: password::HashError },
     #[snafu(display("stored password hash parsing failed: {source}"))]
-    ParseStoredPasswordHash { source: PasswordHashError },
+    ParseStoredPasswordHash { source: password::HashError },
     #[snafu(display("invalid authenticated user id: {source}"))]
     InvalidAuthenticatedUserId { source: uuid::Error },
 }
 
-#[derive(Clone, Copy, Debug, Display)]
-pub enum RepositoryOperation {
-    #[strum(serialize = "find auth record by email")]
-    FindByEmail,
-    #[strum(serialize = "find auth record by id")]
-    FindById,
-}
-
-#[derive(Debug, Snafu)]
-pub enum RepositoryError {
-    #[snafu(display("auth repository query failed while {operation}: {source}"))]
-    Query {
-        operation: RepositoryOperation,
-        source: BoxError,
-    },
-    #[snafu(display("failed to decode auth username: {source}"))]
-    DecodeUsername { source: user::UsernameError },
-    #[snafu(display("failed to decode auth email: {source}"))]
-    DecodeEmail { source: user::EmailError },
-}
-
-#[derive(Debug)]
-pub struct PasswordHashError(BoxError);
-
-impl core::fmt::Display for PasswordHashError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "{}", self.0)
-    }
-}
-
-impl std::error::Error for PasswordHashError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        Some(&*self.0)
-    }
-}
-
 fn box_error(source: impl std::error::Error + Send + Sync + 'static) -> BoxError {
     Box::new(source)
 }
 
 impl Error {
     pub fn query_repository(
-        operation: RepositoryOperation,
+        operation: repository::Operation,
         source: impl std::error::Error + Send + Sync + 'static,
     ) -> Self {
         Self::Repository {
-            source: RepositoryError::Query {
+            source: repository::Error::Query {
                 operation,
                 source: box_error(source),
             },
@@ -83,27 +48,27 @@ impl Error {
 
     pub fn decode_username(source: user::UsernameError) -> Self {
         Self::Repository {
-            source: RepositoryError::DecodeUsername { source },
+            source: repository::Error::DecodeUsername { source },
         }
     }
 
     pub fn decode_email(source: user::EmailError) -> Self {
         Self::Repository {
-            source: RepositoryError::DecodeEmail { source },
+            source: repository::Error::DecodeEmail { source },
         }
     }
 
     pub fn hash_password(source: impl std::error::Error + Send + Sync + 'static) -> Self {
         Self::HashPassword {
-            source: PasswordHashError(box_error(source)),
+            source: password::HashError(box_error(source)),
         }
     }
 
     pub fn parse_stored_password_hash(
         source: impl std::error::Error + Send + Sync + 'static,
     ) -> Self {
         Self::ParseStoredPasswordHash {
-            source: PasswordHashError(box_error(source)),
+            source: password::HashError(box_error(source)),
         }
     }
 }
@@ -127,7 +92,7 @@ pub struct Record {
     pub id: user::Id,
     pub username: user::Username,
     pub email: user::Email,
-    pub password_hash: PasswordHash,
+    pub password_hash: password::Hash,
     pub session_hash: SessionHash,
 }
 
@@ -190,19 +155,14 @@ pub trait Repository: Send + Sync {
     async fn find_by_id(&self, user_id: &user::Id) -> Result<Option<Record>>;
 }
 
-pub trait PasswordHasher: Send + Sync {
-    fn hash(&self, password: &str) -> Result<PasswordHash>;
-    fn verify(&self, password: &str, password_hash: &PasswordHash) -> Result<bool>;
-}
-
 #[derive(Clone)]
 pub struct ProviderImpl {
     repo: Arc<dyn Repository>,
-    hasher: Arc<dyn PasswordHasher>,
+    hasher: Arc<dyn password::Hasher>,
 }
 
 impl ProviderImpl {
-    pub fn new(repo: Arc<dyn Repository>, hasher: Arc<dyn PasswordHasher>) -> Self {
+    pub fn new(repo: Arc<dyn Repository>, hasher: Arc<dyn password::Hasher>) -> Self {
         Self { repo, hasher }
     }
 }
@@ -227,9 +187,6 @@ impl Provider for ProviderImpl {
     }
 }
 
-#[nutype(sanitize(trim), derive(Clone, Debug, PartialEq, Display))]
-pub struct PasswordHash(String);
-
 #[nutype(sanitize(trim), derive(Clone, Debug, PartialEq, Display))]
 pub struct SessionHash(String);
 
@@ -249,7 +206,7 @@ mod tests {
     #[test]
     fn repository_error_preserves_source() {
         let error = Error::query_repository(
-            RepositoryOperation::FindByEmail,
+            repository::Operation::FindByEmail,
             std::io::Error::other("db unavailable"),
         );
 
@@ -311,8 +268,8 @@ mod tests {
         user::Id::from_uuid(uuid::Uuid::new_v4())
     }
 
-    fn test_password_hash() -> PasswordHash {
-        PasswordHash::new("hash")
+    fn test_password_hash() -> password::Hash {
+        password::Hash::new("hash")
     }
 
     fn test_session_hash() -> SessionHash {
@@ -338,12 +295,12 @@ mod tests {
         ok: bool,
     }
 
-    impl PasswordHasher for TestHasher {
-        fn hash(&self, _password: &str) -> Result<PasswordHash> {
+    impl password::Hasher for TestHasher {
+        fn hash(&self, _password: &str) -> Result<password::Hash> {
             Ok(test_password_hash())
         }
 
-        fn verify(&self, _password: &str, _password_hash: &PasswordHash) -> Result<bool> {
+        fn verify(&self, _password: &str, _password_hash: &password::Hash) -> Result<bool> {
             Ok(self.ok)
         }
     }

crates/app/src/auth/authenticate_flow.rs

@@ -1,7 +1,7 @@
 use secrecy::{ExposeSecret, SecretString};
 use statum::{machine, state, transition};
 
-use super::{AuthenticatedUser, Credentials, PasswordHash, PasswordHasher, Record, Result};
+use super::{AuthenticatedUser, Credentials, Record, Result, password};
 use domain::user;
 
 #[derive(Clone, Debug)]
@@ -69,13 +69,13 @@ impl AuthenticateFlow<Incoming> {
 }
 
 impl AuthenticateFlow<RecordFound> {
-    pub(super) fn password_hash(&self) -> &PasswordHash {
+    pub(super) fn password_hash(&self) -> &password::Hash {
         &self.state_data.record.password_hash
     }
 
     pub(super) fn verify_password(
         self,
-        hasher: &dyn PasswordHasher,
+        hasher: &dyn password::Hasher,
     ) -> Result<PasswordCheckOutcome> {
         let verified =
             hasher.verify(self.password().expose_secret(), self.password_hash())?;
@@ -137,7 +137,7 @@ pub(super) enum PasswordCheckOutcome {
 impl LookupOutcome {
     pub(super) fn authenticate(
         self,
-        hasher: &dyn PasswordHasher,
+        hasher: &dyn password::Hasher,
     ) -> Result<Option<AuthenticatedUser>> {
         match self {
             Self::Found(found) => Ok(found.verify_password(hasher)?.into_user_option()),
@@ -174,7 +174,7 @@ mod tests {
             .id(user::Id::new_v4())
             .username(test_username())
             .email(test_email())
-            .password_hash(PasswordHash::new("hash"))
+            .password_hash(password::Hash::new("hash"))
             .session_hash(super::super::SessionHash::new("session"))
             .build()
     }
@@ -190,12 +190,12 @@ mod tests {
         ok: bool,
     }
 
-    impl PasswordHasher for TestHasher {
-        fn hash(&self, _password: &str) -> Result<PasswordHash> {
-            Ok(PasswordHash::new("unused"))
+    impl password::Hasher for TestHasher {
+        fn hash(&self, _password: &str) -> Result<password::Hash> {
+            Ok(password::Hash::new("unused"))
         }
 
-        fn verify(&self, _password: &str, _password_hash: &PasswordHash) -> Result<bool> {
+        fn verify(&self, _password: &str, _password_hash: &password::Hash) -> Result<bool> {
             Ok(self.ok)
         }
     }

crates/app/src/auth/get_user_flow.rs

@@ -96,7 +96,7 @@ mod tests {
             .id(user::Id::new_v4())
             .username(user::Username::try_new("person").expect("valid username"))
             .email(user::Email::try_new("person@example.com").expect("valid email"))
-            .password_hash(super::super::PasswordHash::new("hash"))
+            .password_hash(super::super::password::Hash::new("hash"))
             .session_hash(super::super::SessionHash::new("session"))
             .build()
     }

crates/app/src/auth/password.rs

@@ -0,0 +1,26 @@
+use nutype::nutype;
+
+use super::{BoxError, Result};
+
+#[derive(Debug)]
+pub struct HashError(pub(super) BoxError);
+
+impl core::fmt::Display for HashError {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+impl std::error::Error for HashError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        Some(&*self.0)
+    }
+}
+
+pub trait Hasher: Send + Sync {
+    fn hash(&self, password: &str) -> Result<Hash>;
+    fn verify(&self, password: &str, password_hash: &Hash) -> Result<bool>;
+}
+
+#[nutype(sanitize(trim), derive(Clone, Debug, PartialEq, Display))]
+pub struct Hash(String);

crates/app/src/auth/repository.rs

@@ -0,0 +1,26 @@
+use domain::user;
+use snafu::prelude::*;
+use strum_macros::Display;
+
+use super::BoxError;
+
+#[derive(Clone, Copy, Debug, Display)]
+pub enum Operation {
+    #[strum(serialize = "find auth record by email")]
+    FindByEmail,
+    #[strum(serialize = "find auth record by id")]
+    FindById,
+}
+
+#[derive(Debug, Snafu)]
+pub enum Error {
+    #[snafu(display("auth repository query failed while {operation}: {source}"))]
+    Query {
+        operation: Operation,
+        source: BoxError,
+    },
+    #[snafu(display("failed to decode auth username: {source}"))]
+    DecodeUsername { source: user::UsernameError },
+    #[snafu(display("failed to decode auth email: {source}"))]
+    DecodeEmail { source: user::EmailError },
+}

crates/app/src/chat/audit.rs

@@ -0,0 +1,52 @@
+use async_trait::async_trait;
+use bon::Builder;
+use nutype::nutype;
+use strum_macros::{Display, EnumString};
+
+use super::{Result, chat};
+
+#[derive(Clone, Debug, Builder)]
+pub struct Entry {
+    pub room_id: chat::room::Id,
+    pub actor_id: chat::UserId,
+    pub action: Action,
+    pub metadata: Vec<(Key, Value)>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Display, EnumString)]
+pub enum Action {
+    #[strum(serialize = "chat.room.create")]
+    RoomCreate,
+    #[strum(serialize = "chat.room.join")]
+    RoomJoin,
+    #[strum(serialize = "chat.message.post")]
+    MessagePost,
+    #[strum(serialize = "chat.message.moderate")]
+    MessageModerate,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Display, EnumString)]
+pub enum Key {
+    #[strum(serialize = "room_id")]
+    RoomId,
+    #[strum(serialize = "message_id")]
+    MessageId,
+    #[strum(serialize = "status")]
+    Status,
+    #[strum(serialize = "decision")]
+    Decision,
+    #[strum(serialize = "reason")]
+    Reason,
+    #[strum(serialize = "timestamp_ms")]
+    TimestampMs,
+    #[strum(serialize = "role")]
+    Role,
+}
+
+#[nutype(sanitize(trim), derive(Clone, Debug, PartialEq, Display))]
+pub struct Value(String);
+
+#[async_trait]
+pub trait Log: Send + Sync {
+    async fn record(&self, entry: Entry) -> Result<()>;
+}

crates/app/src/chat/create_room_flow.rs

@@ -1,6 +1,6 @@
 use statum::{machine, state, transition};
 
-use super::{AuditAction, AuditKey, AuditValue, CreateRoom, RoomRole};
+use super::{CreateRoom, RoomRole, audit};
 use domain::chat;
 
 #[derive(Clone, Debug, PartialEq)]
@@ -123,10 +123,10 @@ impl CreateRoomFlow<OwnerMembershipAdded> {
             .record(service.audit_entry(
                 room_id,
                 created_by,
-                AuditAction::RoomCreate,
+                audit::Action::RoomCreate,
                 vec![(
-                    AuditKey::RoomId,
-                    AuditValue::new(room_id.as_uuid().to_string()),
+                    audit::Key::RoomId,
+                    audit::Value::new(room_id.as_uuid().to_string()),
                 )],
             ))
             .await?;