Fix bugs

Author: owjs3901

crates/vespera_macro/src/router_codegen/export.rs

@@ -30,6 +30,15 @@ impl Parse for ExportAppInput {
 
             match ident_str.as_str() {
                 "dir" => {
+                    // Reject a repeated `dir` with a spanned error instead of
+                    // silently letting the later value overwrite the earlier
+                    // one — matches the `vespera!` arg parser's duplicate guard.
+                    if dir.is_some() {
+                        return Err(syn::Error::new(
+                            ident.span(),
+                            "duplicate field `dir` in export_app! macro",
+                        ));
+                    }
                     input.parse::<syn::Token![=]>()?;
                     dir = Some(input.parse()?);
                 }
@@ -90,4 +99,21 @@ mod tests {
         assert_eq!(input.name.to_string(), "MyApp");
         assert_eq!(input.dir.unwrap().value(), "api");
     }
+
+    #[test]
+    fn test_export_app_input_duplicate_dir() {
+        // A repeated `dir` must be a spanned compile error, not a silent
+        // last-wins overwrite.
+        let tokens = quote::quote!(MyApp, dir = "api", dir = "other");
+        let result: syn::Result<ExportAppInput> = syn::parse2(tokens);
+        assert!(result.is_err(), "duplicate `dir` must be rejected");
+        assert!(
+            result
+                .err()
+                .unwrap()
+                .to_compile_error()
+                .to_string()
+                .contains("duplicate field `dir`")
+        );
+    }
 }

crates/vespera_macro/src/router_codegen/input.rs

@@ -222,10 +222,21 @@ fn parse_tag_struct(input: ParseStream) -> syn::Result<TagConfig> {
 
     let mut name: Option<String> = None;
     let mut description: Option<String> = None;
+    // Reject a repeated tag field (e.g. `name = ..., name = ...`) with a
+    // spanned error instead of silently letting the later value overwrite the
+    // earlier one — matches the top-level `vespera!` arg parser and
+    // `parse_security_scheme_struct`.
+    let mut seen_fields = HashSet::<String>::new();
 
     while !content.is_empty() {
         let ident: syn::Ident = content.parse()?;
         let ident_str = ident.to_string();
+        if !seen_fields.insert(ident_str.clone()) {
+            return Err(syn::Error::new(
+                ident.span(),
+                format!("duplicate tag field: `{ident_str}`"),
+            ));
+        }
         content.parse::<syn::Token![=]>()?;
         let value: LitStr = content.parse()?;
 
@@ -616,10 +627,21 @@ fn parse_server_struct(input: ParseStream) -> syn::Result<ServerConfig> {
 
     let mut url: Option<String> = None;
     let mut description: Option<String> = None;
+    // Reject a repeated server field (e.g. `url = ..., url = ...`) with a
+    // spanned error instead of silently letting the later value overwrite the
+    // earlier one — matches the top-level `vespera!` arg parser and
+    // `parse_security_scheme_struct`.
+    let mut seen_fields = HashSet::<String>::new();
 
     while !content.is_empty() {
         let ident: syn::Ident = content.parse()?;
         let ident_str = ident.to_string();
+        if !seen_fields.insert(ident_str.clone()) {
+            return Err(syn::Error::new(
+                ident.span(),
+                format!("duplicate server field: `{ident_str}`"),
+            ));
+        }
 
         match ident_str.as_str() {
             "url" => {

crates/vespera_macro/src/router_codegen/input_tests.rs

@@ -641,3 +641,36 @@ fn test_security_scheme_duplicate_field_rejected() {
     assert!(result.is_err(), "duplicate scheme field must be rejected");
     assert!(result.err().unwrap().to_string().contains("duplicate"));
 }
+
+#[test]
+fn test_tag_duplicate_field_rejected() {
+    // A repeated tag field (e.g. `name = ..., name = ...`) must be a spanned
+    // compile error, not a silent last-wins overwrite.
+    let tokens = quote::quote!(tags = [{ name = "a", name = "b" }]);
+    let result: syn::Result<AutoRouterInput> = syn::parse2(tokens);
+    assert!(result.is_err(), "duplicate tag field must be rejected");
+    assert!(
+        result
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("duplicate tag field")
+    );
+}
+
+#[test]
+fn test_server_duplicate_field_rejected() {
+    // A repeated server field (e.g. `url = ..., url = ...`) must be a spanned
+    // compile error, not a silent last-wins overwrite.
+    let tokens =
+        quote::quote!(servers = [{ url = "http://localhost:3000", url = "http://other:3000" }]);
+    let result: syn::Result<AutoRouterInput> = syn::parse2(tokens);
+    assert!(result.is_err(), "duplicate server field must be rejected");
+    assert!(
+        result
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("duplicate server field")
+    );
+}

libs/vespera-bridge/src/main/java/com/devfive/vespera/bridge/VesperaProxyController.java

@@ -469,7 +469,8 @@ private CompletableFuture<ResponseEntity<?>> dispatchAsyncFlow(
                 appName, method, path, query, headers, body);
         return VesperaBridge.dispatch(wireReq)
                 .thenApplyAsync(
-                        wireResp -> buildResponseEntityFromWire(wireResp, method),
+                        wireResp -> buildCappedResponseEntityFromWire(
+                                wireResp, method, maxBufferedResponseBytes),
                         asyncResponseExecutor)
                 // The async executor uses AbortPolicy (NOT CallerRunsPolicy):
                 // under saturation the heavy wire response build must NOT run on
@@ -911,6 +912,25 @@ static ResponseEntity<?> buildResponseEntityFromWire(byte[] wire, String method)
                 new WireBodyResource(wire, bodyOff, bytesToExpose), httpHeaders, status);
     }
 
+    /**
+     * Build the buffered {@code ASYNC} response entity, enforcing the
+     * {@code vespera.bridge.max-buffered-response-bytes} cap FIRST — parity with
+     * the {@code SYNC} path ({@link #dispatchSync} via
+     * {@link #rejectOversizedBufferedResponse}). Without this a custom
+     * {@link DispatchModeResolver} returning {@link DispatchMode#ASYNC} would
+     * heap-buffer an arbitrarily large Rust response (retained through
+     * {@link WireBodyResource} until Spring finishes writing it), defeating the
+     * cap and risking OOM / GC pressure. Runs on the async response executor
+     * (NOT the Tokio completion thread), so the cap check stays off the native
+     * worker. Package-private + static so the cap wiring is unit-testable
+     * without a live JNI dispatch.
+     */
+    static ResponseEntity<?> buildCappedResponseEntityFromWire(
+            byte[] wire, String method, long maxBufferedResponseBytes) {
+        rejectOversizedBufferedResponse(wire, maxBufferedResponseBytes);
+        return buildResponseEntityFromWire(wire, method);
+    }
+
     static final class BodyPermittingOutputStream extends OutputStream {
         private final OutputStream delegate;
         private final String method;

libs/vespera-bridge/src/test/java/com/devfive/vespera/bridge/ProxyControllerBodyHeaderTest.java

@@ -57,6 +57,46 @@ void asyncRejectionMapsTo503AndOtherFailuresPropagate() {
                 () -> VesperaProxyController.asyncFailureToResponse(new RuntimeException("boom")));
     }
 
+    // ── ASYNC buffered-response cap parity with SYNC ─────────────────────
+
+    /** Build a wire response {@code [u32 BE headerLen | header JSON | body]}. */
+    private static byte[] wireResponseWithBody(int bodyLen) {
+        String json =
+                "{\"v\":1,\"status\":200,\"headers\":{\"content-type\":\"application/json\"},"
+                        + "\"metadata\":{\"version\":\"0.1.0\"}}";
+        byte[] hb = json.getBytes(StandardCharsets.UTF_8);
+        byte[] body = new byte[bodyLen];
+        java.util.Arrays.fill(body, (byte) 'x');
+        ByteBuffer buf = ByteBuffer.allocate(4 + hb.length + bodyLen);
+        buf.putInt(hb.length);
+        buf.put(hb);
+        buf.put(body);
+        return buf.array();
+    }
+
+    @Test
+    void asyncResponseEnforcesMaxBufferedResponseCap() {
+        // A custom DispatchModeResolver returning ASYNC must honour the same
+        // max-buffered-response cap as SYNC (dispatchSync), or it heap-buffers
+        // an unbounded Rust response. The capped builder the async flow now
+        // uses rejects an oversized body with 413, lets a within-cap body
+        // through, and treats cap = 0 as unlimited (never rejects).
+        byte[] oversized = wireResponseWithBody(100);
+        ResponseStatusException tooLarge = assertThrows(
+                ResponseStatusException.class,
+                () -> VesperaProxyController.buildCappedResponseEntityFromWire(oversized, "GET", 10));
+        assertEquals(413, tooLarge.getStatusCode().value());
+
+        byte[] small = wireResponseWithBody(5);
+        ResponseEntity<?> ok =
+                VesperaProxyController.buildCappedResponseEntityFromWire(small, "GET", 1000);
+        assertEquals(200, ok.getStatusCode().value());
+
+        ResponseEntity<?> unlimited =
+                VesperaProxyController.buildCappedResponseEntityFromWire(oversized, "GET", 0);
+        assertEquals(200, unlimited.getStatusCode().value());
+    }
+
     @Test
     void duplicateCookieHeadersAreSemicolonJoined() {
         MockHttpServletRequest req = new MockHttpServletRequest("GET", "/x");