Optimize compiletime

Author: owjs3901

crates/vespera/src/multipart.rs

@@ -205,6 +205,15 @@ impl std::error::Error for TypedMultipartError {
 }
 
 impl TypedMultipartError {
+    /// Build an invalid-enum error while bounding the attacker-controlled value stored in it.
+    #[must_use]
+    pub fn invalid_enum_value(field_name: String, value: &str) -> Self {
+        Self::InvalidEnumValue {
+            field_name,
+            value: truncate_reflected_value(value).into_owned(),
+        }
+    }
+
     /// The offending field name when the error carries one — used as the
     /// `path` in the JSON error envelope.
     fn field_name(&self) -> Option<&str> {
@@ -410,12 +419,45 @@ impl<'a> MeteredField<'a> {
 
     /// Read the whole field into owned bytes, metering every chunk against the
     /// aggregate cap.
-    pub async fn bytes(mut self) -> Result<axum::body::Bytes, TypedMultipartError> {
-        let mut acc: Vec<u8> = Vec::new();
+    pub async fn bytes(self) -> Result<axum::body::Bytes, TypedMultipartError> {
+        self.bytes_with_limit_inner(None, 0)
+            .await
+            .map(axum::body::Bytes::from)
+    }
+
+    /// Read the whole field into owned bytes with a hard per-field limit.
+    ///
+    /// The limit is checked before copying each chunk into the accumulator, and
+    /// every chunk is still counted against the request-wide aggregate cap.
+    pub async fn bytes_with_limit(
+        self,
+        limit_bytes: usize,
+        initial_capacity: usize,
+    ) -> Result<axum::body::Bytes, TypedMultipartError> {
+        self.bytes_with_limit_inner(Some(limit_bytes), initial_capacity)
+            .await
+            .map(axum::body::Bytes::from)
+    }
+
+    async fn bytes_with_limit_inner(
+        mut self,
+        limit: Option<usize>,
+        initial_capacity: usize,
+    ) -> Result<Vec<u8>, TypedMultipartError> {
+        let capacity = limit.map_or(initial_capacity, |limit| initial_capacity.min(limit));
+        let mut acc: Vec<u8> = Vec::with_capacity(capacity);
         while let Some(chunk) = self.chunk().await? {
+            if let Some(limit) = limit
+                && acc.len().saturating_add(chunk.len()) > limit
+            {
+                return Err(TypedMultipartError::FieldTooLarge {
+                    field_name: self.name().unwrap_or_default().to_string(),
+                    limit_bytes: limit,
+                });
+            }
             acc.extend_from_slice(&chunk);
         }
-        Ok(axum::body::Bytes::from(acc))
+        Ok(acc)
     }
 }
 
@@ -807,35 +849,19 @@ where
 /// When a limit is set the cumulative size is checked after each chunk
 /// and an over-limit chunk is rejected *before* it is copied in.
 async fn read_field_data(
-    mut field: MeteredField<'_>,
+    field: MeteredField<'_>,
     limit: Option<usize>,
     initial_capacity: usize,
-) -> Result<(MeteredField<'_>, Vec<u8>), TypedMultipartError> {
+) -> Result<(String, Vec<u8>), TypedMultipartError> {
     // Part counting now happens once per part in the derived loop
     // (`register_multipart_part`), so the field parsers no longer count.
     // Initial capacity is independent from the hard byte limit: tiny scalar
     // fields keep the 256B cap without preallocating 256B per bool/number.
-    let capacity = limit.map_or(initial_capacity, |limit| initial_capacity.min(limit));
-    let mut buf = Vec::with_capacity(capacity);
-    // `MeteredField::chunk` already counts each chunk against the request-wide
-    // `max_total_bytes` aggregate cap, so the per-field reader no longer calls
-    // `register_multipart_bytes` itself (doing so would double-count).
-    while let Some(chunk) = field.chunk().await? {
-        if let Some(limit) = limit
-            && buf.len().saturating_add(chunk.len()) > limit
-        {
-            // Reject BEFORE copying the over-limit chunk into the
-            // buffer — same acceptance condition (total <= limit),
-            // no wasted copy.
-            return Err(TypedMultipartError::FieldTooLarge {
-                field_name: field.name().unwrap_or_default().to_string(),
-                limit_bytes: limit,
-            });
-        }
-        buf.extend_from_slice(&chunk);
-    }
-
-    Ok((field, buf))
+    let field_name = field.name().unwrap_or_default().to_string();
+    let buf = field
+        .bytes_with_limit_inner(limit, initial_capacity)
+        .await?;
+    Ok((field_name, buf))
 }
 
 /// Default cap for tiny scalar multipart fields when no explicit

crates/vespera/src/multipart/scalar_parsers.rs

@@ -10,8 +10,8 @@ use std::borrow::Cow;
 
 use super::{
     DEFAULT_STRING_FIELD_LIMIT_BYTES, MeteredField, STRING_INITIAL_CAPACITY_BYTES,
-    TINY_SCALAR_INITIAL_CAPACITY_BYTES, TryFromFieldWithState, TypedMultipartError, read_field_data,
-    str_to_bool, tiny_scalar_limit,
+    TINY_SCALAR_INITIAL_CAPACITY_BYTES, TryFromFieldWithState, TypedMultipartError,
+    read_field_data, str_to_bool, tiny_scalar_limit, truncate_reflected_value,
 };
 
 impl<S: Send + Sync> TryFromFieldWithState<S> for String {
@@ -25,10 +25,10 @@ impl<S: Send + Sync> TryFromFieldWithState<S> for String {
         // `Some(usize::MAX)` (set by the derive macro) and stays unbounded;
         // an explicit byte size wins as `Some(n)`.
         let limit = limit_bytes.unwrap_or(DEFAULT_STRING_FIELD_LIMIT_BYTES);
-        let (field, data) =
+        let (field_name, data) =
             read_field_data(field, Some(limit), STRING_INITIAL_CAPACITY_BYTES).await?;
         Self::from_utf8(data).map_err(|e| TypedMultipartError::WrongFieldType {
-            field_name: field.name().unwrap_or_default().to_string(),
+            field_name,
             wanted: Cow::Borrowed("String"),
             source: e.to_string(),
         })
@@ -43,21 +43,24 @@ impl<S: Send + Sync> TryFromFieldWithState<S> for bool {
         limit_bytes: Option<usize>,
         _state: &S,
     ) -> Result<Self, TypedMultipartError> {
-        let (field, data) = read_field_data(
+        let (field_name, data) = read_field_data(
             field,
             Some(tiny_scalar_limit(limit_bytes)),
             TINY_SCALAR_INITIAL_CAPACITY_BYTES,
         )
         .await?;
         let text = std::str::from_utf8(&data).map_err(|e| TypedMultipartError::WrongFieldType {
-            field_name: field.name().unwrap_or_default().to_string(),
+            field_name: field_name.clone(),
             wanted: Cow::Borrowed("bool"),
             source: e.to_string(),
         })?;
         str_to_bool(text).ok_or_else(|| TypedMultipartError::WrongFieldType {
-            field_name: field.name().unwrap_or_default().to_string(),
+            field_name,
             wanted: Cow::Borrowed("bool"),
-            source: format!("invalid boolean value: `{text}`"),
+            source: format!(
+                "invalid boolean value: `{}`",
+                truncate_reflected_value(text)
+            ),
         })
     }
 }
@@ -73,21 +76,21 @@ macro_rules! impl_try_from_field_for_number {
                     limit_bytes: Option<usize>,
                     _state: &S,
                 ) -> Result<Self, TypedMultipartError> {
-                    let (field, data) = read_field_data(
+                    let (field_name, data) = read_field_data(
                         field,
                         Some(tiny_scalar_limit(limit_bytes)),
                         TINY_SCALAR_INITIAL_CAPACITY_BYTES,
                     ).await?;
                     let text = std::str::from_utf8(&data).map_err(|e| {
                         TypedMultipartError::WrongFieldType {
-                            field_name: field.name().unwrap_or_default().to_string(),
+                            field_name: field_name.clone(),
                             wanted: Cow::Borrowed(stringify!($ty)),
                             source: e.to_string(),
                         }
                     })?;
                     text.trim().parse::<$ty>().map_err(|e| {
                         TypedMultipartError::WrongFieldType {
-                            field_name: field.name().unwrap_or_default().to_string(),
+                            field_name,
                             wanted: Cow::Borrowed(stringify!($ty)),
                             source: e.to_string(),
                         }
@@ -110,22 +113,22 @@ impl<S: Send + Sync> TryFromFieldWithState<S> for char {
         limit_bytes: Option<usize>,
         _state: &S,
     ) -> Result<Self, TypedMultipartError> {
-        let (field, data) = read_field_data(
+        let (field_name, data) = read_field_data(
             field,
             Some(tiny_scalar_limit(limit_bytes)),
             TINY_SCALAR_INITIAL_CAPACITY_BYTES,
         )
         .await?;
         let text = std::str::from_utf8(&data).map_err(|e| TypedMultipartError::WrongFieldType {
-            field_name: field.name().unwrap_or_default().to_string(),
+            field_name: field_name.clone(),
             wanted: Cow::Borrowed("char"),
             source: e.to_string(),
         })?;
         let mut chars = text.chars();
         match (chars.next(), chars.next()) {
             (Some(c), None) => Ok(c),
             _ => Err(TypedMultipartError::WrongFieldType {
-                field_name: field.name().unwrap_or_default().to_string(),
+                field_name,
                 wanted: Cow::Borrowed("char"),
                 source: "expected exactly one character".to_string(),
             }),

crates/vespera/src/multipart/tests.rs

@@ -203,6 +203,42 @@ fn test_error_display_invalid_enum_value() {
     );
 }
 
+#[test]
+fn invalid_enum_value_constructor_stores_bounded_value() {
+    // A clearly-oversized attacker value (far beyond the cap), so the bounded
+    // reflection is unambiguously shorter than the input.  The real security
+    // property is the CONSTANT ceiling (`cap + marker`), which holds no matter
+    // how huge the input is — a value only marginally over the cap can render a
+    // few chars longer than the input once the marker is appended, but it is
+    // still bounded, so that constant bound is what we assert.
+    let oversized = "가".repeat(MAX_REFLECTED_VALUE_CHARS * 4);
+    let err = TypedMultipartError::invalid_enum_value("status".to_string(), &oversized);
+
+    match err {
+        TypedMultipartError::InvalidEnumValue { value, .. } => {
+            assert!(value.ends_with("... (truncated)"));
+            assert!(
+                value.chars().count()
+                    <= MAX_REFLECTED_VALUE_CHARS + "... (truncated)".chars().count()
+            );
+            assert!(value.chars().count() < oversized.chars().count());
+        }
+        _ => panic!("expected InvalidEnumValue"),
+    }
+}
+
+#[test]
+fn invalid_bool_message_reflects_bounded_value() {
+    let oversized = "x".repeat(MAX_REFLECTED_VALUE_CHARS + 10);
+    let message = format!(
+        "invalid boolean value: `{}`",
+        truncate_reflected_value(&oversized)
+    );
+
+    assert!(message.contains("... (truncated)"));
+    assert!(!message.contains(&oversized));
+}
+
 #[test]
 fn test_error_display_nameless_field() {
     let err = TypedMultipartError::NamelessField;

crates/vespera/src/validated.rs

@@ -4,10 +4,12 @@
 //!
 //! ```ignore
 //! use vespera::{Validated, Schema, axum::Json};
+//! use garde::Validate;
 //!
-//! #[derive(serde::Deserialize, Schema)]
+//! #[derive(serde::Deserialize, Schema, Validate)]
 //! struct CreateUser {
 //!     #[schema(min_length = 3, max_length = 32)]
+//!     #[garde(length(min = 3, max = 32))]
 //!     username: String,
 //! }
 //!
@@ -34,7 +36,11 @@ use ::axum::{
 };
 use ::garde::Validate;
 use ::serde::{Serialize, Serializer, ser::SerializeStruct};
-use std::{fmt::Display, marker::PhantomData};
+use std::{
+    fmt::Display,
+    marker::PhantomData,
+    ops::{Deref, DerefMut},
+};
 
 /// Extractor wrapper that validates the inner extractor's output via
 /// [`garde::Validate`] before handing it to the handler.
@@ -151,6 +157,32 @@ impl<C, T> ValidatedWith<C, T> {
     pub fn into_inner(self) -> T {
         self.0
     }
+
+    /// Borrow the extracted value.
+    #[must_use]
+    pub const fn get(&self) -> &T {
+        &self.0
+    }
+
+    /// Mutably borrow the extracted value.
+    #[must_use]
+    pub const fn get_mut(&mut self) -> &mut T {
+        &mut self.0
+    }
+}
+
+impl<C, T> Deref for ValidatedWith<C, T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl<C, T> DerefMut for ValidatedWith<C, T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
 }
 
 impl<U> ValidatePayload for Json<U>

crates/vespera_core/src/openapi.rs

@@ -42,11 +42,21 @@ pub struct Contact {
 pub struct License {
     /// License name
     pub name: String,
+    /// SPDX license expression or identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identifier: Option<String>,
     /// License URL
     #[serde(skip_serializing_if = "Option::is_none")]
     pub url: Option<String>,
 }
 
+#[allow(clippy::ref_option)] // serde skip_serializing_if mandates &Option<T> signature
+fn is_empty_components(value: &Option<Components>) -> bool {
+    value
+        .as_ref()
+        .is_none_or(|components| !has_any_component_map(components))
+}
+
 /// API information
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -132,7 +142,7 @@ pub struct OpenApi {
     /// Path definitions
     pub paths: BTreeMap<String, PathItem>,
     /// Components (reusable components)
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(skip_serializing_if = "is_empty_components")]
     pub components: Option<Components>,
     /// Security requirements
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -216,6 +226,8 @@ fn merge_path_item(into: &mut PathItem, other: PathItem) {
         parameters,
         summary,
         description,
+        ref_path,
+        servers,
     } = other;
     if into.get.is_none() {
         into.get = get;
@@ -250,6 +262,12 @@ fn merge_path_item(into: &mut PathItem, other: PathItem) {
     if into.description.is_none() {
         into.description = description;
     }
+    if into.ref_path.is_none() {
+        into.ref_path = ref_path;
+    }
+    if into.servers.is_none() {
+        into.servers = servers;
+    }
 }
 
 impl OpenApi {