| | | 1 | | using System.Text; |
| | | 2 | | using System.Text.Json; |
| | | 3 | | using System.Text.Json.Serialization; |
| | | 4 | | using System.Text.Json.Serialization.Metadata; |
| | | 5 | | |
| | | 6 | | namespace AsyncResponse.DurableFlows.Internal; |
| | | 7 | | |
| | | 8 | | internal static class DurableFlowStoreShared |
| | | 9 | | { |
| | | 10 | | /// <summary> |
| | | 11 | | /// Upper bound for TTL values handed to server-clock date arithmetic (~68 years). SQL Server's |
| | | 12 | | /// <c>DATEADD</c> takes <c>int</c> seconds, and MySQL/Oracle datetime types stop at year 9999, |
| | | 13 | | /// so an absurd <see cref="DurableFlowOptions.StateExpiry"/> (for example |
| | | 14 | | /// <see cref="TimeSpan.MaxValue"/>) would overflow inside the database. Clamping mirrors |
| | | 15 | | /// <see cref="AddSaturating(DateTime, TimeSpan)"/> on the client side: huge expiries saturate |
| | | 16 | | /// to "effectively never" instead of failing every write. |
| | | 17 | | /// </summary> |
| | 3 | 18 | | private static readonly TimeSpan MaxServerClockTtl = TimeSpan.FromSeconds(int.MaxValue); |
| | | 19 | | |
| | 3 | 20 | | private static readonly JsonSerializerOptions Options = new() |
| | 3 | 21 | | { |
| | 3 | 22 | | DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull, |
| | 3 | 23 | | TypeInfoResolver = DurableFlowStoreJsonContext.Default |
| | 3 | 24 | | }; |
| | | 25 | | |
| | | 26 | | private static JsonTypeInfo<FlowState> FlowStateTypeInfo |
| | 3 | 27 | | => (JsonTypeInfo<FlowState>)Options.GetTypeInfo(typeof(FlowState)); |
| | | 28 | | |
| | | 29 | | public static void ValidateCreate(string flowId, FlowState state, TimeSpan ttl) |
| | | 30 | | { |
| | 3 | 31 | | ValidateWrite(flowId, state, ttl); |
| | 3 | 32 | | if (state.Revision != 0) |
| | 2 | 33 | | throw new ArgumentException("A new flow ledger must start at revision zero.", nameof(state)); |
| | 3 | 34 | | } |
| | | 35 | | |
| | | 36 | | public static void ValidateUpdate(string flowId, FlowState state, long expectedRevision, TimeSpan ttl) |
| | | 37 | | { |
| | 3 | 38 | | ValidateWrite(flowId, state, ttl); |
| | 3 | 39 | | if (expectedRevision < 0) |
| | 2 | 40 | | throw new ArgumentOutOfRangeException(nameof(expectedRevision), "The expected revision cannot be negative.") |
| | 3 | 41 | | if (state.Revision != checked(expectedRevision + 1)) |
| | 2 | 42 | | throw new ArgumentException("The new flow-state revision must increment the expected revision by one.", name |
| | 3 | 43 | | } |
| | | 44 | | |
| | 3 | 45 | | public static string Serialize(FlowState state) => JsonSerializer.Serialize(state, FlowStateTypeInfo); |
| | | 46 | | |
| | | 47 | | /// <summary> |
| | | 48 | | /// Serializes a ledger for a full-state write and enforces the store's <c>MaxStateBytes</c> |
| | | 49 | | /// budget. Without the guard an oversized ledger surfaces as the provider's opaque payload |
| | | 50 | | /// error (DynamoDB 400 KB item cap, Cosmos 2 MB, MongoDB 16 MB) which the executor retries |
| | | 51 | | /// into the dead-letter queue with no hint at the real cause. Throwing here keeps the same |
| | | 52 | | /// at-least-once semantics (run fails → retries → DLQ = operator alarm) but names the cause. |
| | | 53 | | /// </summary> |
| | | 54 | | /// <exception cref="FlowStateTooLargeException">The serialized state exceeds <paramref name="maxStateBytes"/>.</exc |
| | | 55 | | public static string SerializeBounded(string flowId, FlowState state, long? maxStateBytes, string providerName) |
| | | 56 | | { |
| | 3 | 57 | | var json = Serialize(state); |
| | 3 | 58 | | if (maxStateBytes is { } limit) |
| | | 59 | | { |
| | 2 | 60 | | long size = Encoding.UTF8.GetByteCount(json); |
| | 2 | 61 | | if (size > limit) |
| | 2 | 62 | | throw new FlowStateTooLargeException(flowId, size, limit, providerName); |
| | | 63 | | } |
| | | 64 | | |
| | 3 | 65 | | return json; |
| | | 66 | | } |
| | | 67 | | |
| | | 68 | | /// <summary> |
| | | 69 | | /// Materializes a loaded ledger row. Unreadable JSON, an unknown schema version, a revision |
| | | 70 | | /// that does not match the stored row, and an identity-mismatched ledger |
| | | 71 | | /// (<c>state.FlowId != flowId</c>) all load as absent — the read-side mirror of the write-side |
| | | 72 | | /// key/identity validation in <see cref="ValidateCreate"/>, so a row copied or restored under |
| | | 73 | | /// the wrong key can never resurrect as that flow. |
| | | 74 | | /// </summary> |
| | | 75 | | public static FlowState? ReadState(string flowId, string stateJson, long revision) |
| | | 76 | | { |
| | 3 | 77 | | var state = Deserialize(stateJson); |
| | 3 | 78 | | return state is not null |
| | 3 | 79 | | && state.Revision == revision |
| | 3 | 80 | | && string.Equals(state.FlowId, flowId, StringComparison.Ordinal) |
| | 3 | 81 | | ? state |
| | 3 | 82 | | : null; |
| | | 83 | | } |
| | | 84 | | |
| | | 85 | | /// <summary> |
| | | 86 | | /// <paramref name="instant"/> + <paramref name="ttl"/>, saturating at |
| | | 87 | | /// <see cref="DateTime.MaxValue"/> instead of throwing: an absurd |
| | | 88 | | /// <see cref="DurableFlowOptions.StateExpiry"/> then means "effectively never expires" rather |
| | | 89 | | /// than failing every write with an <see cref="ArgumentOutOfRangeException"/>. |
| | | 90 | | /// </summary> |
| | | 91 | | public static DateTime AddSaturating(DateTime instant, TimeSpan ttl) |
| | 2 | 92 | | => ttl > DateTime.MaxValue - instant ? DateTime.MaxValue : instant + ttl; |
| | | 93 | | |
| | | 94 | | /// <inheritdoc cref="AddSaturating(DateTime, TimeSpan)"/> |
| | | 95 | | public static DateTimeOffset AddSaturating(DateTimeOffset instant, TimeSpan ttl) |
| | 2 | 96 | | => ttl > DateTimeOffset.MaxValue - instant ? DateTimeOffset.MaxValue : instant + ttl; |
| | | 97 | | |
| | | 98 | | /// <summary>TTL clamped for server-clock date arithmetic; see <see cref="MaxServerClockTtl"/>.</summary> |
| | | 99 | | public static TimeSpan ServerClockTtl(TimeSpan ttl) |
| | 3 | 100 | | => ttl > MaxServerClockTtl ? MaxServerClockTtl : ttl; |
| | | 101 | | |
| | | 102 | | /// <summary>Whole milliseconds of <see cref="ServerClockTtl"/>, for stores that bind the TTL as a number.</summary> |
| | | 103 | | public static long ServerClockTtlMilliseconds(TimeSpan ttl) |
| | 3 | 104 | | => (long)ServerClockTtl(ttl).TotalMilliseconds; |
| | | 105 | | |
| | | 106 | | public static FlowState? Deserialize(string json) |
| | | 107 | | { |
| | | 108 | | try |
| | | 109 | | { |
| | 3 | 110 | | var state = JsonSerializer.Deserialize(json, DurableFlowStoreJsonContext.Default.FlowState); |
| | 3 | 111 | | return state is not null && FlowStateSchema.IsReadable(state.SchemaVersion) ? state : null; |
| | | 112 | | } |
| | 2 | 113 | | catch (JsonException) |
| | | 114 | | { |
| | 2 | 115 | | return null; |
| | | 116 | | } |
| | 3 | 117 | | } |
| | | 118 | | |
| | | 119 | | /// <summary> |
| | | 120 | | /// Throttles opportunistic expired-state pruning: returns <c>true</c> at most once per |
| | | 121 | | /// <paramref name="interval"/> (a non-positive interval prunes on every operation, matching the |
| | | 122 | | /// channel packages). Loads already filter on expiry, so throttling never affects correctness. |
| | | 123 | | /// </summary> |
| | | 124 | | public static bool ShouldPrune(ref long lastTicks, TimeSpan interval) |
| | | 125 | | { |
| | 3 | 126 | | if (interval <= TimeSpan.Zero) |
| | 2 | 127 | | return true; |
| | | 128 | | |
| | 3 | 129 | | var now = DateTime.UtcNow.Ticks; |
| | 3 | 130 | | var last = Interlocked.Read(ref lastTicks); |
| | 3 | 131 | | return now - last >= interval.Ticks |
| | 3 | 132 | | && Interlocked.CompareExchange(ref lastTicks, now, last) == last; |
| | | 133 | | } |
| | | 134 | | |
| | | 135 | | /// <summary> |
| | | 136 | | /// Advisory-lock key for schema DDL, derived exactly like the channel/transport packages |
| | | 137 | | /// (FNV-1a over <c>asyncresponse:ddl:{schemaName}</c>) so flow-store DDL serializes with any |
| | | 138 | | /// channel/transport DDL running against the same schema. |
| | | 139 | | /// </summary> |
| | | 140 | | public static long SchemaLockKey(string schemaName) |
| | | 141 | | { |
| | | 142 | | const ulong offset = 14695981039346656037UL; |
| | | 143 | | const ulong prime = 1099511628211UL; |
| | 2 | 144 | | var hash = offset; |
| | 2 | 145 | | foreach (var b in Encoding.UTF8.GetBytes(SchemaLockResource(schemaName))) |
| | | 146 | | { |
| | 2 | 147 | | hash ^= b; |
| | 2 | 148 | | hash *= prime; |
| | | 149 | | } |
| | | 150 | | |
| | 2 | 151 | | return unchecked((long)hash); |
| | | 152 | | } |
| | | 153 | | |
| | | 154 | | /// <summary>SQL Server <c>sp_getapplock</c> resource name for schema DDL (shared with the channel/transport package |
| | | 155 | | public static string SchemaLockResource(string schemaName) |
| | 2 | 156 | | => $"asyncresponse:ddl:{schemaName}"; |
| | | 157 | | |
| | | 158 | | public static void ValidateIdentifier(string? value, string optionName, string providerName) |
| | | 159 | | { |
| | 3 | 160 | | if (string.IsNullOrWhiteSpace(value)) |
| | 2 | 161 | | throw new InvalidOperationException($"{optionName} must be configured."); |
| | | 162 | | |
| | 3 | 163 | | if (!(char.IsAsciiLetter(value[0]) || value[0] == '_')) |
| | 2 | 164 | | throw new InvalidOperationException($"{optionName} '{value}' must be a simple {providerName} identifier (let |
| | | 165 | | |
| | 3 | 166 | | foreach (var c in value) |
| | | 167 | | { |
| | 3 | 168 | | if (!(char.IsAsciiLetterOrDigit(c) || c == '_')) |
| | 2 | 169 | | throw new InvalidOperationException($"{optionName} '{value}' must be a simple {providerName} identifier |
| | | 170 | | } |
| | 3 | 171 | | } |
| | | 172 | | |
| | | 173 | | private static void ValidateWrite(string flowId, FlowState state, TimeSpan ttl) |
| | | 174 | | { |
| | 3 | 175 | | ArgumentException.ThrowIfNullOrWhiteSpace(flowId); |
| | 3 | 176 | | ArgumentNullException.ThrowIfNull(state); |
| | 3 | 177 | | if (!string.Equals(state.FlowId, flowId, StringComparison.Ordinal)) |
| | 2 | 178 | | throw new ArgumentException("The flow state id must match the store key.", nameof(state)); |
| | 3 | 179 | | if (state.SchemaVersion != FlowStateSchema.Current) |
| | 2 | 180 | | throw new ArgumentException("The flow state must use the current schema version.", nameof(state)); |
| | 3 | 181 | | if (ttl <= TimeSpan.Zero) |
| | 2 | 182 | | throw new ArgumentOutOfRangeException(nameof(ttl), "TTL must be greater than zero."); |
| | 3 | 183 | | } |
| | | 184 | | } |
| | | 185 | | |
| | | 186 | | /// <summary> |
| | | 187 | | /// Thrown when a serialized durable-flow ledger exceeds the store's configured |
| | | 188 | | /// <c>MaxStateBytes</c> budget. Internal on purpose: this shared source is compiled into every |
| | | 189 | | /// store package, so a public type here would surface as identically-named colliding public types |
| | | 190 | | /// when a host references two store packages. Callers catch it as its |
| | | 191 | | /// <see cref="InvalidOperationException"/> base; the message carries the diagnosis. |
| | | 192 | | /// </summary> |
| | | 193 | | internal sealed class FlowStateTooLargeException(string flowId, long serializedSizeBytes, long maxStateBytes, string pro |
| | | 194 | | : InvalidOperationException( |
| | | 195 | | $"Flow '{flowId}' state serialized to {serializedSizeBytes} bytes, exceeding the {providerName} MaxStateBytes li |
| | | 196 | | "flow state exceeded the provider's size limit. Keep large payloads in your own storage and pass references in f |
| | | 197 | | "see docs/durable-flows.md (ledger-size note).") |
| | | 198 | | { |
| | | 199 | | /// <summary>The flow whose ledger write was rejected.</summary> |
| | | 200 | | public string FlowId { get; } = flowId; |
| | | 201 | | |
| | | 202 | | /// <summary>Serialized ledger size in UTF-8 bytes.</summary> |
| | | 203 | | public long SerializedSizeBytes { get; } = serializedSizeBytes; |
| | | 204 | | |
| | | 205 | | /// <summary>The configured budget the write exceeded.</summary> |
| | | 206 | | public long MaxStateBytes { get; } = maxStateBytes; |
| | | 207 | | } |
| | | 208 | | |
| | | 209 | | /// <summary> |
| | | 210 | | /// Source-generated JSON metadata for <see cref="FlowState"/> so the store packages never fall back |
| | | 211 | | /// to reflection-based serialization (trim/AOT-safe). Compiled into each store package alongside |
| | | 212 | | /// <see cref="DurableFlowStoreShared"/>, so every assembly gets its own generated context. Metadata |
| | | 213 | | /// mode (no fast-path writer) so writes honor <see cref="DurableFlowStoreShared"/>'s options |
| | | 214 | | /// (WhenWritingNull) and the persisted bytes are unchanged; reads use the context's bare default |
| | | 215 | | /// options, matching the previous options-less <c>Deserialize<FlowState>(json)</c> call. |
| | | 216 | | /// </summary> |
| | | 217 | | [JsonSourceGenerationOptions(GenerationMode = JsonSourceGenerationMode.Metadata)] |
| | | 218 | | [JsonSerializable(typeof(FlowState))] |
| | | 219 | | internal sealed partial class DurableFlowStoreJsonContext : JsonSerializerContext; |