Repository navigation
Conversation
Generalize the existing getSecure/getRaw GET path into one method-agnostic primitive: raw Bytes body, non-throwing status codes, response headers, same redirect/proxy/TLS/size defaults. getSecure and getRaw become Get specializations. Spec: docs/changes/016-http-client-byte-level-methods.md.
…ent Http.Client helpers Protocol code inside nhcore (the S3 signer in change 017, FileUpload's content hash) needs the raw digest, a chainable HMAC and hex encoding, and today reaches for crypton/Data.ByteArray and Bytes.unwrap directly. Per the neohaskell#748 review ("add it to the Bytes/Core module instead of unwrapping"), the primitives now live in Crypto, which already owns that boundary. signWith is re-expressed on hmacSha256 + toHex (one implementation; output unchanged, pinned by a test). Known-answer tests: FIPS 180-4 SHA-256 vectors, RFC 4231 HMAC case 2, hex. Spec: docs/changes/021-crypto-sha256-hmac-hex.md (touches core-primitives). Also adds the one-line Haddock the doc-ratchet wants on Http.Client's existing helpers and regenerates codemap: undocumented_exports 560 -> 545, undocumented_doctest_modules 315 -> 314. Gates: ./dev check 0; ./dev test Crypto 24/0; ./dev test Http.Client 37/0; ./dev doctest 0 failures; ./dev lint No hints; ./dev codemap-check OK; ./dev spec-check 021 OK; git diff --check 0.
Local-shaped facade: S3Config + createBlobStore, four BlobStore ops over Http.Client.sendSecure/sendRaw with hand-written SigV4 (crypton/memory, already dependencies). Pure SigV4 module tested against the AWS S3 API reference vectors; facade tested against an in-process WAI fake S3 that speaks only the S3 wire protocol. Spec: docs/changes/017-s3-blob-store.md.
…elpers SigV4 now calls Crypto.sha256 / Crypto.hmacSha256 / Crypto.toHex (change 021) instead of importing crypton and Data.ByteArray and unwrapping Bytes — the neohaskell#748 review rule. Public API and the AWS test vectors are unchanged. Adds the one-line Haddock on S3/SigV4 helpers plus two doctests (isDnsBucketName, sha256Hex) so the doc-ratchet improves; codemap regenerated. Gates: ./dev check 0; ./dev test Service.FileUpload.BlobStore.S3 23/0; ./dev doctest 0 failures; ./dev lint No hints; ./dev codemap-check OK; ./dev spec-check 017 OK; git diff --check 0.
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
|
Hey, thanks for this PR! Two things to reconcile:
Thanks! |
…tion ClientRawSpec's sendRaw and getRaw status examples send real loopback HTTP to an in-process Warp server, so they are integration / http:real with exact selector attestations in test-surfaces.json. The scheme check, methodName and the closed-port network error stay unit / none. Amp-Thread-ID: https://ampcode.com/threads/T-01a11c53-f9bd-70df-81b8-4369dbfd3e1b
isDnsBucketName only checked length and characters, so a..b, -ab, ab-, a.-b and a-.b were accepted. Every dot-separated label must now be non-empty and start and end with a letter or digit; createBlobStore rejects such names before any store exists to send a request. Amp-Thread-ID: https://ampcode.com/threads/T-01a11c53-f9bd-70df-81b8-4369dbfd3e1b
…egration S3Spec's store, retrieve, exists, delete, status-mapping and key examples send real loopback HTTP to the FakeS3 Warp listener, so they are integration / http:real with exact selector attestations. Signer and configuration cases, including the new bucket-label checks, and the closed-port unreachable case stay unit / none. Amp-Thread-ID: https://ampcode.com/threads/T-01a11c53-f9bd-70df-81b8-4369dbfd3e1b
… so 021 selectors resolve The C1/C2 locators named "abc" and "Jefe" in quotes, but the hspec source escapes them, so the exact-title selector never matched. Rename the two example titles and their locators; every assertion is unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-01a11c53-f9bd-70df-81b8-4369dbfd3e1b
Integration criteria may name nhcore-test-core locators (change 016), but the --criteria-runtime --report gate in test-service read only the service report, so every core locator failed report mode. test-core now tees its direct output to nhcore-test-core.report under pipefail and uploads it fail-closed; test-service needs test-core, downloads that artifact and gates on the concatenation of both reports. workflow-check contract 6 freezes the wiring with self-test regressions. Amp-Thread-ID: https://ampcode.com/threads/T-01a11c53-f9bd-70df-81b8-4369dbfd3e1b
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apps running on several machines can keep uploaded files in an S3-compatible object store instead of one machine's disk. Configure
Service.FileUpload.BlobStore.S3.createBlobStorewith an existing bucket, endpoint, region and credentials; the existing upload, download and deduplication code keeps using the same BlobStore interface. Local storage remains the default, and existing files are not moved.The backend uses Core HTTP and Crypto helpers from #905. It signs path-style requests with SigV4, requires HTTPS outside literal loopback, does not retry or follow redirects, treats only 404 as missing, and keeps authentication/transport failures as errors. Multipart uploads and bucket creation are outside this PR.
Review follow-up
a..b,-ab,ab-,a.-banda-.b, before any request. Tests cover valid dotted/hyphenated names and the 3/63-character bounds.integration / http:realwith exact attestations. Pure signing/configuration tests stayunit / none; the refused-connection example has no answering server fixture.main; this PR intentionally includes feat(http-client): add byte-level sendSecure/sendRaw and Crypto sha256/hmacSha256/toHex primitives #905 until that dependency lands. No published history was rewritten.Verification
Local macOS checks with the pinned toolchain:
These checks use a local S3-protocol fixture, not a live S3 provider. The full PostgreSQL/Hurl suite was not rerun. Still a draft; no final maintainer approval is claimed.
Migration: none. Spec 017. Depends on #905. Closes #370.