Fix CI: rewrite let-chains for MSRV 1.86, fix rocksdb bugs, add --locked to workflow

Author: parv68

.github/workflows/ci.yml

@@ -27,36 +27,36 @@ jobs:
 
       - name: Clippy (1.86 compatible crates)
         if: matrix.rust == '1.86'
-        run: cargo clippy -p aegis-core -p aegis-cli -p aegis-test-utils -p aegis-ffi
+        run: cargo clippy -p aegis-core -p aegis-cli -p aegis-test-utils -p aegis-ffi --locked
 
       - name: Clippy (full workspace)
-        if: matrix.rust != '1.85'
-        run: cargo clippy --workspace --all-features -- -D warnings
+        if: matrix.rust != '1.86'
+        run: cargo clippy --workspace --all-features --locked -- -D warnings
         continue-on-error: ${{ matrix.rust == 'nightly' }}
 
       - name: Build
-        run: cargo build --workspace
+        run: cargo build --workspace --locked
 
       - name: Build with features
-        run: cargo build --workspace --features postgres,mysql
+        run: cargo build --workspace --features postgres,mysql --locked
 
       - name: Test (default features)
-        run: cargo test --workspace
+        run: cargo test --workspace --locked
 
       - name: Test (no default features)
-        run: cargo test --workspace --no-default-features
+        run: cargo test --workspace --no-default-features --locked
 
       - name: Test (sqlite)
-        run: cargo test --workspace --features sqlite
+        run: cargo test --workspace --features sqlite --locked
 
       - name: Test (postgres)
-        run: cargo test --workspace --features postgres
+        run: cargo test --workspace --features postgres --locked
 
       - name: Test (mysql)
-        run: cargo test --workspace --features mysql
+        run: cargo test --workspace --features mysql --locked
 
       - name: Test (rocksdb)
-        run: cargo test --workspace --features rocksdb
+        run: cargo test --workspace --features rocksdb --locked
 
       - name: Install wasm-pack
         uses: taiki-e/install-action@v2

crates/aegis-core/src/engine/analysis/graph.rs

@@ -20,10 +20,10 @@ impl GraphEngine {
     ) -> AegisResult<ReachabilityReport> {
         // Cache check
         let cache_key = format!("reach:{}:{}:{}", resource.as_str(), max_depth, max_nodes);
-        if let Some(ttl) = cache_ttl_ms
-            && let Some(cached) = self.get_cached_analysis(&cache_key, ttl)
-        {
-            return Ok(cached);
+        if let Some(ttl) = cache_ttl_ms {
+            if let Some(cached) = self.get_cached_analysis(&cache_key, ttl) {
+                return Ok(cached);
+            }
         }
 
         let start = Instant::now();
@@ -210,10 +210,10 @@ impl GraphEngine {
     }
 
     fn set_cached_analysis(&self, key: &str, value: &impl serde::Serialize, ttl_ms: u64) {
-        if let Ok(mut cache) = self.analysis_cache.lock()
-            && let Ok(json) = serde_json::to_string(value)
-        {
-            cache.insert(key.to_string(), (Instant::now(), ttl_ms, json));
+        if let Ok(mut cache) = self.analysis_cache.lock() {
+            if let Ok(json) = serde_json::to_string(value) {
+                cache.insert(key.to_string(), (Instant::now(), ttl_ms, json));
+            }
         }
     }
 }

crates/aegis-core/src/engine/cache.rs

@@ -108,10 +108,10 @@ impl DecisionCache {
         self.access_order.retain(|k| k != &key);
 
         // Evict LRU entry if at capacity
-        if self.entries.len() >= self.capacity
-            && let Some(lru_key) = self.access_order.pop_front()
-        {
-            self.entries.remove(&lru_key);
+        if self.entries.len() >= self.capacity {
+            if let Some(lru_key) = self.access_order.pop_front() {
+                self.entries.remove(&lru_key);
+            }
         }
 
         self.access_order.push_back(key.clone());
@@ -228,10 +228,10 @@ impl TraversalCache {
         self.access_order.retain(|k| k != &key);
 
         // Evict LRU entry if at capacity
-        if self.entries.len() >= self.capacity
-            && let Some(lru_key) = self.access_order.pop_front()
-        {
-            self.entries.remove(&lru_key);
+        if self.entries.len() >= self.capacity {
+            if let Some(lru_key) = self.access_order.pop_front() {
+                self.entries.remove(&lru_key);
+            }
         }
 
         self.access_order.push_back(key.clone());

crates/aegis-core/src/engine/enforcement_history.rs

@@ -240,17 +240,18 @@ impl GraphEngine {
         }
 
         // Periodically purge expired events (every ~1000 records)
-        if cfg.max_days > 0
-            && let Ok(mut events) = self.enforcement_events.lock()
-            && events.len() % 1000 == 0
-        {
-            let cutoff = chrono::Utc::now() - chrono::Duration::days(cfg.max_days as i64);
-            let cutoff_str = cutoff.to_rfc3339();
-            while let Some(front) = events.front() {
-                if front.timestamp < cutoff_str {
-                    events.pop_front();
-                } else {
-                    break;
+        if cfg.max_days > 0 {
+            if let Ok(mut events) = self.enforcement_events.lock() {
+                if events.len() % 1000 == 0 {
+                    let cutoff = chrono::Utc::now() - chrono::Duration::days(cfg.max_days as i64);
+                    let cutoff_str = cutoff.to_rfc3339();
+                    while let Some(front) = events.front() {
+                        if front.timestamp < cutoff_str {
+                            events.pop_front();
+                        } else {
+                            break;
+                        }
+                    }
                 }
             }
         }

crates/aegis-core/src/engine/mod.rs

@@ -265,10 +265,10 @@ impl GraphEngine {
 
     /// Emit a structured log event through the registered callback (if any).
     fn emit_log(&self, level: hooks::LogLevel, message: &str, context: &str) {
-        if let Ok(guard) = self.logger.lock()
-            && let Some(ref logger) = *guard
-        {
-            logger(level, message, context);
+        if let Ok(guard) = self.logger.lock() {
+            if let Some(ref logger) = *guard {
+                logger(level, message, context);
+            }
         }
     }
 

crates/aegis-core/src/engine/partition.rs

@@ -53,10 +53,10 @@ impl PartitionManager {
 
     pub fn check_rate_limit(&self, partition_id: &PartitionId) -> AegisResult<()> {
         let key = partition_id.to_string();
-        if let Ok(map) = self.partitions.lock()
-            && let Some(state) = map.get(&key)
-        {
-            return state.rate_limiter.check(&key, RateLimitOp::Check);
+        if let Ok(map) = self.partitions.lock() {
+            if let Some(state) = map.get(&key) {
+                return state.rate_limiter.check(&key, RateLimitOp::Check);
+            }
         }
         // If no partition-specific state, use default
         self.default_partition

crates/aegis-core/src/engine/ratelimit.rs

@@ -75,14 +75,14 @@ impl TokenBucketRateLimiter {
 
         // Evict the least-recently-accessed entry if we need to insert a new key
         // and the map is at capacity.
-        if !buckets.contains_key(key)
-            && buckets.len() >= self.config.max_keys
-            && let Some(oldest_key) = buckets
+        if !buckets.contains_key(key) && buckets.len() >= self.config.max_keys {
+            if let Some(oldest_key) = buckets
                 .iter()
                 .min_by_key(|(_, state)| state.last_accessed)
                 .map(|(k, _)| k.clone())
-        {
-            buckets.remove(&oldest_key);
+            {
+                buckets.remove(&oldest_key);
+            }
         }
 
         let state = buckets.entry(key.to_string()).or_insert_with(|| {

crates/aegis-core/src/schema/parser.rs

@@ -209,16 +209,16 @@ pub fn lint_schema(schema: &Schema) -> LintResult {
 
         // Check condition syntax on permissions
         for (perm_name, perm_def) in &type_def.permissions {
-            if let Some(ref cond) = perm_def.condition
-                && let Err(e) = crate::engine::condition::parse_condition(cond)
-            {
-                diagnostics.push(LintDiagnostic {
+            if let Some(ref cond) = perm_def.condition {
+                if let Err(e) = crate::engine::condition::parse_condition(cond) {
+                    diagnostics.push(LintDiagnostic {
                         severity: LintSeverity::Error,
                         message: format!(
                             "permission '{perm_name}' on type '{type_name}' has invalid condition syntax: {e}"
                         ),
                         location: Some(format!("types.{type_name}.permissions.{perm_name}.condition")),
                     });
+                }
             }
         }
 

crates/aegis-core/src/schema/validator.rs

@@ -100,16 +100,16 @@ pub fn lint_schema(schema: &Schema, strict: bool) -> LintReport {
 
         // Check condition syntax validity on permissions
         for (perm_name, perm_def) in &type_def.permissions {
-            if let Some(ref cond) = perm_def.condition
-                && let Err(e) = crate::engine::condition::parse_condition(cond)
-            {
-                let msg = format!(
-                    "permission '{perm_name}' on type '{type_name}' has invalid condition syntax: {e}"
-                );
-                if strict {
-                    errors.push(msg);
-                } else {
-                    warnings.push(msg);
+            if let Some(ref cond) = perm_def.condition {
+                if let Err(e) = crate::engine::condition::parse_condition(cond) {
+                    let msg = format!(
+                        "permission '{perm_name}' on type '{type_name}' has invalid condition syntax: {e}"
+                    );
+                    if strict {
+                        errors.push(msg);
+                    } else {
+                        warnings.push(msg);
+                    }
                 }
             }
         }

crates/aegis-core/src/storage/rocksdb.rs

@@ -1,6 +1,3 @@
-use crate::engine::enforcement_history::EnforcementEvent;
-use crate::engine::policy_lifecycle::PolicyDraft;
-use crate::engine::scheduler::{AnalysisRun, AnalysisSchedule};
 use crate::error::{AegisError, AegisResult};
 use crate::storage::traits::{
     BackendType, IntegrityReport, PolicyVersion, StorageBackend, StorageMeta, StorageTransaction,
@@ -12,12 +9,9 @@ use crate::types::{
     TupleMutation,
 };
 use chrono::{DateTime, Utc};
-use rocksdb::{
-    BlockBasedOptions, Cache, ColumnFamily, ColumnFamilyDescriptor, DB, DBIterator, Direction,
-    IteratorMode, Options,
-};
-use serde_json;
+use rocksdb::{BlockBasedOptions, Cache, ColumnFamily, DB, Direction, IteratorMode, Options};
 use std::collections::HashMap;
+use std::sync::Arc;
 use uuid::Uuid;
 
 const CF_META: &str = "meta";
@@ -59,7 +53,7 @@ fn tuple_from_value(value: &[u8]) -> AegisResult<RelationshipTuple> {
 }
 
 pub struct RocksDbStorage {
-    db: DB,
+    db: Arc<DB>,
     node_id: Uuid,
     revision_mutex: std::sync::Mutex<()>,
     actor_identity: std::sync::Mutex<Option<String>>,
@@ -91,8 +85,10 @@ impl RocksDbStorage {
             CF_ENFORCEMENT_EVENTS,
         ];
 
-        let db = DB::open_cf(&opts, path, cfs)
-            .map_err(|e| AegisError::StorageConnection(e.to_string()))?;
+        let db = Arc::new(
+            DB::open_cf(&opts, path, cfs)
+                .map_err(|e| AegisError::StorageConnection(e.to_string()))?,
+        );
 
         // Initialize revision if not present
         let cf_meta = db
@@ -123,7 +119,7 @@ impl RocksDbStorage {
 
         Ok(Self {
             db,
-            node_id,
+            node_id: Uuid::new_v4(),
             revision_mutex: std::sync::Mutex::new(()),
             actor_identity: std::sync::Mutex::new(None),
         })
@@ -276,7 +272,7 @@ impl RocksDbStorage {
         &self,
         partition_id: &PartitionId,
         tuple: &RelationshipTuple,
-        revision: Revision,
+        _revision: Revision,
     ) -> AegisResult<()> {
         let cf_tuples = self
             .db
@@ -315,7 +311,7 @@ impl RocksDbStorage {
         &self,
         partition_id: &PartitionId,
         key: &TupleKey,
-        revision: Revision,
+        _revision: Revision,
     ) -> AegisResult<()> {
         let cf_tuples = self
             .db
@@ -1092,7 +1088,7 @@ impl StorageBackend for RocksDbStorage {
 
         let next_cursor = if (offset as usize + tuples.len()) < total {
             Some(PaginationCursor {
-                offset: offset + limit,
+                offset: offset + limit as u64,
                 revision,
             })
         } else {
@@ -1111,7 +1107,7 @@ impl StorageBackend for RocksDbStorage {
     }
 
     fn current_token(&self) -> AegisResult<RevisionToken> {
-        let revision = self.current_revision()?;
+        let revision = self.current_revision(&PartitionId::default())?;
         Ok(RevisionToken::new(revision, self.node_id))
     }
 
@@ -1220,8 +1216,8 @@ impl StorageBackend for RocksDbStorage {
                     break;
                 }
 
+                let event_obj = event["object"].as_str().unwrap_or("").to_string();
                 if let Some(obj) = object {
-                    let event_obj = event["object"].as_str().unwrap_or("");
                     if event_obj != obj.as_str() {
                         continue;
                     }
@@ -1250,7 +1246,7 @@ impl StorageBackend for RocksDbStorage {
                     action,
                     subject: event["subject"].as_str().unwrap_or("").to_string(),
                     relation: event["relation"].as_str().unwrap_or("").to_string(),
-                    object: event_obj.to_string(),
+                    object: event_obj,
                     timestamp,
                     metadata,
                     identity,
@@ -1733,7 +1729,7 @@ impl StorageBackend for RocksDbStorage {
         while iter.valid() {
             if let (Some(key), Some(value)) = (iter.key(), iter.value()) {
                 let key_str = String::from_utf8_lossy(key);
-                if let Ok(version_num) = key_str.parse::<u32>() {
+                if key_str.parse::<u32>().is_ok() {
                     if let Ok(pv) = serde_json::from_slice::<PolicyVersion>(value) {
                         versions.push(pv);
                     }
@@ -1904,7 +1900,7 @@ impl StorageBackend for RocksDbStorage {
 
 /// A RocksDB transaction using WriteBatch for atomicity.
 pub struct RocksDbTransaction {
-    db: DB,
+    db: Arc<DB>,
     partition_id: String,
     batch: rocksdb::WriteBatch,
     cf_tuples: rocksdb::ColumnFamily,