mirror of
https://github.com/block/buzz.git
synced 2026-10-27 20:41:57 +00:00
## Summary Finish the remaining database-store extraction tracked by [TheSentinel454/buzz#2](https://github.com/TheSentinel454/buzz/issues/2) in one reviewable PR. This consolidates the previously stacked domain slices after #6782 merged. It preserves the runtime/store boundary established by #6660, #6668, #6700, and #6782 while separating database runtime infrastructure from domain-owned persistence: - `runtime/` owns pool construction and sizing, writer/reader routing, read sessions and route proofs, transaction infrastructure, observability primitives, replica fencing, health support, migrations, and cross-cutting runtime tests. - `store/` owns domain records, SQL, row parsing, locks and invariants, `Db` domain methods, focused tests, and logical-operation datastore spans. - `lib.rs` remains a 57-line compatibility facade that preserves existing crate-root paths and `Db` method signatures through re-exports. Domain coverage includes API tokens, authentication allowlists, reminders, event queries, threads, reactions, feeds, users and DMs, push, workflows/runs/approvals, relay membership and invites, product feedback, moderation/admin moderation, relay admin actions/operators, git repositories, archived identities, usage, partition maintenance, deletion, channel membership inherited from merged #6782, and the final runtime/store layout. The branch has been rebased onto current `main`. Database changes that landed there were incorporated rather than overwritten: `relay_admin_actions.rs` and `relay_operators.rs` now live under `store/`, their 27 public `Db` wrappers and existing behavior remain intact, and every wrapper has exactly one fixed-name datastore span. Concurrent changes to migration, moderation, admin moderation, and error handling are also retained. ### Exact base and head - Base: `main` at `ed11c8d8bf0a17402be5cf243724f89471530d2f` - Head: `codex/issue-2-store-extraction` at `be24430472d1a87ac5c0d6026c620cd6caea3537` ### Related issue - Structural tracker: [TheSentinel454/buzz#2](https://github.com/TheSentinel454/buzz/issues/2) - Domain trackers: [#6](https://github.com/TheSentinel454/buzz/issues/6), [#7](https://github.com/TheSentinel454/buzz/issues/7), [#12](https://github.com/TheSentinel454/buzz/issues/12), [#13](https://github.com/TheSentinel454/buzz/issues/13) - Acceptance trackers: [#17](https://github.com/TheSentinel454/buzz/issues/17), [#19](https://github.com/TheSentinel454/buzz/issues/19) This supersedes #6783, #6784, #6787, #6788, #6789, #6792, #6820, #6794, #6796, #6797, #6798, #6799, #6804, #6805, #6806, #6808, #6809, #6811, #6812, #6813, #6814, #6815, and #6890. Their discussions remain available for review history. ### #17 / #19 acceptance - Preserves the metric names, fixed labels, transaction/lock timing boundaries, and privacy/cardinality constraints introduced by #6700. - Keeps exactly one datastore span per public logical operation, including the 27 relay-admin wrappers added on `main`. - Removes `store_ownership.rs`; physical ownership and focused source guards now enforce the boundary directly. - Leaves no `impl Db`, domain SQL, focused domain test group, or datastore span in `lib.rs`. - Preserves existing public paths such as `buzz_db::channel`, `buzz_db::event`, and `buzz_db::workflow` through crate-root re-exports while keeping internal `runtime` and `store` namespaces private. ### Non-goals - No SQL, schema, locking, transaction, retry, timeout, or client-visible behavior changes. - No generic store traits, domain handles, broad `PgExecutor` migration, new store crate, raw pool accessor, or broader directory reorganization. - No tracker issues are closed by this PR. ### Risk The cumulative diff is large but structural. Risk is primarily module-path, ownership, or conflict-resolution drift. It is mitigated by preserving public re-exports, comparing the newly moved `main` implementations to their upstream source, source guards, touched-crate compilation, PostgreSQL-backed test coverage, and an independent exact-head review on a separate clean Blox workstation. ### Testing Author workstation `buzz-tornquist-pr-6987-rebase`, rebased branch ending at exact head `be24430472d1a87ac5c0d6026c620cd6caea3537`: - `cargo fmt --all --check` - `cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings` - `cargo test -p buzz-db --lib` — 113 passed, 240 PostgreSQL tests intentionally ignored - `cargo test -p buzz-db --test observability_source` — 2 passed - PostgreSQL-backed `buzz-db` coverage under native PostgreSQL — 235 passed in the shared serial run; the five shared-state/config-sensitive cases passed as isolated reruns against fresh schemas, including the two owner-limit tests with their fixture's `BUZZ_MAX_COMMUNITIES_PER_OWNER=3` - `cargo test -p buzz-relay --lib -- --test-threads=1` under native PostgreSQL/Redis — 991 passed; the three current-month partition-sensitive identity-archive cases passed after provisioning the August 2026 test partition; 87 infrastructure-marked tests remained ignored - Source/diff guards — relay-admin implementation bodies match current `main`; all 27 public wrapper signatures are retained; exactly one datastore span wraps each wrapper; `lib.rs` has zero `impl Db` blocks and zero datastore spans; no duplicate top-level relay-admin modules or `store_ownership.rs`; `error.rs` matches current `main` Independent clean review workstation `buzz-tornquist-pr-6987-review`, detached at exact head `be24430472d1a87ac5c0d6026c620cd6caea3537`: - `cargo fmt --all --check` - `cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings` - `cargo test -p buzz-db --lib` — 113 passed, 240 ignored - `cargo test -p buzz-db --test observability_source` — 2 passed - Exact-head ownership/re-export/instrumentation audit — no remaining actionable findings --------- Signed-off-by: OpenAI Codex <codex@openai.com> Signed-off-by: tornquist <tornquist@squareup.com> Co-authored-by: OpenAI Codex <codex@openai.com>
82 lines
2.6 KiB
Rust
82 lines
2.6 KiB
Rust
#[test]
|
|
fn database_metrics_and_slow_logs_exclude_sensitive_or_unbounded_fields() {
|
|
let implementation = include_str!("../src/runtime/observability.rs");
|
|
let datastore_macro = include_str!("../../buzz-datastore-tracing/src/lib.rs");
|
|
let instrumentation = format!("{implementation}\n{datastore_macro}");
|
|
|
|
for forbidden in [
|
|
"\"community\" =>",
|
|
"\"event_id\" =>",
|
|
"\"event_kind\" =>",
|
|
"\"kind\" =>",
|
|
"\"sql\" =>",
|
|
"\"query\" =>",
|
|
"\"query_id\" =>",
|
|
"\"d_tag\" =>",
|
|
"\"coordinate\" =>",
|
|
"community =",
|
|
"event_id =",
|
|
"event_kind =",
|
|
"sql =",
|
|
"query_id =",
|
|
"d_tag =",
|
|
"coordinate =",
|
|
] {
|
|
assert!(
|
|
!instrumentation.contains(forbidden),
|
|
"database instrumentation must not expose {forbidden}"
|
|
);
|
|
}
|
|
|
|
assert!(datastore_macro.contains("name: LitStr"));
|
|
assert!(datastore_macro.contains("\"operation\" => #name"));
|
|
assert!(datastore_macro.contains("elapsed_ms ="));
|
|
assert!(
|
|
datastore_macro.contains("parent: None"),
|
|
"slow warnings must not inherit dynamic datastore span fields"
|
|
);
|
|
// The runtime tracing-layer assertion covers field names because a source
|
|
// search would also match ordinary local variables such as `record_error`.
|
|
}
|
|
|
|
#[test]
|
|
fn relay_admin_db_wrappers_have_exactly_one_datastore_span() {
|
|
for (domain, source) in [
|
|
(
|
|
"relay_admin_actions",
|
|
include_str!("../src/store/relay_admin_actions.rs"),
|
|
),
|
|
(
|
|
"relay_operators",
|
|
include_str!("../src/store/relay_operators.rs"),
|
|
),
|
|
] {
|
|
let db_impl = source
|
|
.split_once("impl crate::Db {")
|
|
.unwrap_or_else(|| panic!("{domain} must own its Db wrappers"))
|
|
.1
|
|
.split_once("\n#[cfg(test)]")
|
|
.unwrap_or_else(|| panic!("{domain} Db wrappers must precede focused tests"))
|
|
.0;
|
|
let mut pending_spans = 0;
|
|
let mut methods = 0;
|
|
|
|
for line in db_impl.lines() {
|
|
if line.contains("#[datastore_span(") {
|
|
pending_spans += 1;
|
|
}
|
|
if line.trim_start().starts_with("pub async fn ") {
|
|
assert_eq!(pending_spans, 1, "{domain} wrapper `{line}` span count");
|
|
pending_spans = 0;
|
|
methods += 1;
|
|
}
|
|
}
|
|
|
|
assert!(methods > 0, "{domain} must own public Db wrappers");
|
|
assert_eq!(
|
|
pending_spans, 0,
|
|
"{domain} has an unattached datastore span"
|
|
);
|
|
}
|
|
}
|