F

Author: ardatan

lib/executor/src/executors/error.rs

@@ -20,10 +20,12 @@ pub enum SubgraphExecutorError {
     RequestFailure(String, String),
     #[error("Failed to serialize variable \"{0}\": {1}")]
     VariablesSerializationFailure(String, String),
-    #[error("HMAC signature error: {0}")]
-    HMACSignatureError(String),
     #[error("Failed to serialize extension \"{0}\": {1}")]
     ExtensionSerializationFailure(String, String),
+    #[error("Failed to build HMAC expression for subgraph '{0}'. Please check your VRL expression for syntax errors. Diagnostic: {1}")]
+    HMACExpressionBuild(String, String),
+    #[error("HMAC signature error: {0}")]
+    HMACSignatureError(String),
 }
 
 impl From<SubgraphExecutorError> for GraphQLError {
@@ -69,6 +71,9 @@ impl SubgraphExecutorError {
                 "SUBGRAPH_EXTENSION_SERIALIZATION_FAILURE"
             }
             SubgraphExecutorError::HMACSignatureError(_) => "SUBGRAPH_HMAC_SIGNATURE_ERROR",
+            SubgraphExecutorError::HMACExpressionBuild(_, _) => {
+                "SUBGRAPH_HMAC_EXPRESSION_BUILD_FAILURE"
+            }
         }
     }
 }

lib/executor/src/executors/http.rs

@@ -3,8 +3,8 @@ use std::sync::Arc;
 
 use crate::executors::common::HttpExecutionResponse;
 use crate::executors::dedupe::{request_fingerprint, ABuildHasher, SharedResponse};
+use crate::utils::expression::execute_expression_with_value;
 use dashmap::DashMap;
-use hive_router_config::hmac_signature::BooleanOrExpression;
 use hive_router_config::HiveRouterConfig;
 use tokio::sync::OnceCell;
 
@@ -22,6 +22,7 @@ use hyper_util::client::legacy::{connect::HttpConnector, Client};
 use sha2::Sha256;
 use tokio::sync::Semaphore;
 use tracing::debug;
+use vrl::compiler::Program as VrlProgram;
 
 use crate::executors::common::HttpExecutionRequest;
 use crate::executors::error::SubgraphExecutorError;
@@ -42,6 +43,7 @@ pub struct HTTPSubgraphExecutor {
     pub semaphore: Arc<Semaphore>,
     pub config: Arc<HiveRouterConfig>,
     pub in_flight_requests: Arc<DashMap<u64, Arc<OnceCell<SharedResponse>>, ABuildHasher>>,
+    pub should_sign_hmac: BooleanOrProgram,
 }
 
 const FIRST_VARIABLE_STR: &[u8] = b",\"variables\":{";
@@ -52,6 +54,12 @@ pub type HttpClient = Client<HttpsConnector<HttpConnector>, Full<Bytes>>;
 
 type HmacSha256 = Hmac<Sha256>;
 
+#[derive(Debug)]
+pub enum BooleanOrProgram {
+    Boolean(bool),
+    Program(Box<VrlProgram>),
+}
+
 impl HTTPSubgraphExecutor {
     pub fn new(
         subgraph_name: String,
@@ -60,6 +68,7 @@ impl HTTPSubgraphExecutor {
         semaphore: Arc<Semaphore>,
         config: Arc<HiveRouterConfig>,
         in_flight_requests: Arc<DashMap<u64, Arc<OnceCell<SharedResponse>>, ABuildHasher>>,
+        should_sign_hmac: BooleanOrProgram,
     ) -> Self {
         let mut header_map = HeaderMap::new();
         header_map.insert(
@@ -79,6 +88,7 @@ impl HTTPSubgraphExecutor {
             semaphore,
             config,
             in_flight_requests,
+            should_sign_hmac,
         }
     }
 
@@ -126,9 +136,9 @@ impl HTTPSubgraphExecutor {
             body.put(CLOSE_BRACE);
         }
 
-        let should_sign_hmac = match &self.config.hmac_signature.enabled {
-            BooleanOrExpression::Boolean(b) => *b,
-            BooleanOrExpression::Expression(expr) => {
+        let should_sign_hmac = match &self.should_sign_hmac {
+            BooleanOrProgram::Boolean(b) => *b,
+            BooleanOrProgram::Program(expr) => {
                 // .subgraph
                 let subgraph_value = VrlValue::Object(BTreeMap::from([(
                     "name".into(),
@@ -140,7 +150,7 @@ impl HTTPSubgraphExecutor {
                     ("subgraph".into(), subgraph_value),
                     ("request".into(), request_value),
                 ]));
-                let result = expr.execute_with_value(target_value);
+                let result = execute_expression_with_value(expr, target_value);
                 match result {
                     Ok(VrlValue::Boolean(b)) => b,
                     Ok(_) => {

lib/executor/src/executors/map.rs

@@ -6,7 +6,9 @@ use std::{
 
 use bytes::{BufMut, Bytes, BytesMut};
 use dashmap::DashMap;
-use hive_router_config::{override_subgraph_urls::UrlOrExpression, HiveRouterConfig};
+use hive_router_config::{
+    hmac_signature::BooleanOrExpression, override_subgraph_urls::UrlOrExpression, HiveRouterConfig,
+};
 use http::Uri;
 use hyper_tls::HttpsConnector;
 use hyper_util::{
@@ -25,7 +27,7 @@ use crate::{
         },
         dedupe::{ABuildHasher, SharedResponse},
         error::SubgraphExecutorError,
-        http::{HTTPSubgraphExecutor, HttpClient},
+        http::{BooleanOrProgram, HTTPSubgraphExecutor, HttpClient},
     },
     response::graphql_error::GraphQLError,
     utils::expression::{compile_expression, execute_expression_with_value},
@@ -297,13 +299,24 @@ impl SubgraphExecutorMap {
             .or_insert_with(|| Arc::new(Semaphore::new(self.max_connections_per_host)))
             .clone();
 
+        let should_sign_hmac = match &self.config.hmac_signature.enabled {
+            BooleanOrExpression::Boolean(b) => BooleanOrProgram::Boolean(*b),
+            BooleanOrExpression::Expression { expression } => {
+                let program = compile_expression(expression, None).map_err(|err| {
+                    SubgraphExecutorError::HMACExpressionBuild(subgraph_name.to_string(), err)
+                })?;
+                BooleanOrProgram::Program(Box::new(program))
+            }
+        };
+
         let executor = HTTPSubgraphExecutor::new(
             subgraph_name.to_string(),
             endpoint_uri,
             self.client.clone(),
             semaphore,
             self.config.clone(),
             self.in_flight_requests.clone(),
+            should_sign_hmac,
         );
 
         self.executors_by_subgraph

lib/router-config/src/hmac_signature.rs

@@ -1,8 +1,6 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::primitives::expression::Expression;
-
 #[derive(Debug, Clone, Deserialize, Serialize, Default, JsonSchema)]
 pub struct HMACSignatureConfig {
     // Whether to sign outgoing requests with HMAC signatures.
@@ -34,9 +32,10 @@ fn default_extension_name() -> String {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, JsonSchema)]
+#[serde(untagged)]
 pub enum BooleanOrExpression {
     Boolean(bool),
-    Expression(Expression),
+    Expression { expression: String },
 }
 
 impl Default for BooleanOrExpression {
@@ -49,7 +48,7 @@ impl HMACSignatureConfig {
     pub fn is_disabled(&self) -> bool {
         match &self.enabled {
             BooleanOrExpression::Boolean(b) => !*b,
-            BooleanOrExpression::Expression(_) => {
+            BooleanOrExpression::Expression { expression: _ } => {
                 // If it's an expression, we consider it enabled for the purpose of this check.
                 false
             }