Applications with Rullst I · Lesson 11 / 14

Useful errors, explicit limits

Users need to know what to do without receiving internal details.

Let's discover together

1
In this contract, broken JSON receives 400, invalid rules 422, missing targets 404 and database failure 503. Wrong content type can receive 415. These are not student grades: they communicate different HTTP outcomes and help the client respond.
2
DefaultBodyLimit caps the body at 4,096 bytes. A 5,000-letter title does not reach validation like a small field: the request receives 413. Body and title limits measure different things. Invalid parameter types can also be rejected before the handler.
3
Writes carrying an external Origin receive 403; the same-origin client uses the local address. This reduces one kind of browser request but neither authenticates people nor blocks local programs omitting Origin. Loopback and headers do not replace authorization.
4
A database failure returns storage_unavailable. Logs do not print titles, SQL, paths or credentials. The kit uses CSP and nosniff but promises no complete protection, per-person limits, auditing or availability. Lab tests check specific behavior, not security certification.

Your application workbench

The kit includes a complete app to investigate and modify. The excerpt below explains this step; the editor contains the indicated file. Rullst Academy does not compile or run this server in your browser.

File to study and modify

src/routes.rs

400  invalid JSON syntax
422  invalid title or priority
403  external Origin on a write
404  missing mission
413  body over 4096 bytes
503  storage unavailable

Extract the kit to a new folder and open a terminal beside Cargo.toml. Use Rust 1.96+; the first build may download dependencies and take time. Then open http://127.0.0.1:3010. Stop with Ctrl+C and run again after editing.

cargo test --locked
cargo run --locked

My files and GitHub

Download your draft and replace the indicated file in your extracted copy. The editor saves one file in this browser; your account saves assessments and XP. The ZIP excludes your edits. GitHub sends only the confirmed file; use Git manually for the whole app, excluding databases, backups and secrets.

Official links and next step

✦

YOUR MISSION

Distinguish format, rule, origin, target and storage errors.

Take it with you

Build a table with input, expected status and the user’s next action for three failures. Run one in a local test and check the mission count did not increase.

At your own pace

My files and GitHub

Every lesson can become your own record: code, notes or a practice plan. Saving a file to GitHub is optional and does not change your XP.

Student guide

The editor and downloads open when this lesson is available to your account. Check access below or return to the track map.

Checking your access to this lesson…

Your path, step by step

Download activity materials

Download the lesson example and a workbook for your notes. The ZIP includes a guide to organizing activities in one or more repositories. Publishing is optional; eligible accounts can also use the GitHub upload button.

Your file for this lesson

Edit the example or record what you learned. This space does not run code or grade answers. The draft is saved only in this browser, separately per account; you choose when to download or upload to GitHub.

The example may be only a snippet or outline. Changing the extension does not make it a complete program. The activity ZIP contains starting material; the edited-file button downloads your text.

My code or notes

use crate::{
    store::Store,
    validation::{self, Completion, NewMission},
};
use rullst::{
    Router,
    response::{IntoResponse, Response},
    server::{Extension, Json, Path, StatusCode, get},
    web::axum::{
        extract::{DefaultBodyLimit, Request, rejection::JsonRejection},
        middleware::{Next, from_fn},
    },
};
use serde_json::json;

fn error(status: StatusCode, code: &str) -> Response {
    (status, Json(json!({"error": code}))).into_response()
}
fn unavailable() -> Response {
    // No submitted text, SQL, paths or credentials in browser errors or logs.
    eprintln!("mission-board: database operation failed");
    error(StatusCode::SERVICE_UNAVAILABLE, "storage_unavailable")
}

async fn list(Extension(store): Extension<Store>) -> Response {
    match store.list().await {
        Ok(items) => Json(items).into_response(),
        Err(_) => unavailable(),
    }
}
async fn create(
    Extension(store): Extension<Store>,
    input: Result<Json<NewMission>, JsonRejection>,
) -> Response {
    let Json(input) = match input {
        Ok(value) => value,
        Err(e) => return error(e.status(), "invalid_json"),
    };
    let input = match validation::validate(input) {
        Ok(value) => value,
        Err(code) => return error(StatusCode::UNPROCESSABLE_ENTITY, code),
    };
    match store.create(input).await {
        Ok(item) => (StatusCode::CREATED, Json(item)).into_response(),
        Err(_) => unavailable(),
    }
}
async fn complete(
    Extension(store): Extension<Store>,
    Path(id): Path<i64>,
    input: Result<Json<Completion>, JsonRejection>,
) -> Response {
    let Json(input) = match input {
        Ok(value) => value,
        Err(e) => return error(e.status(), "invalid_json"),
    };
    match store.complete(id, input.done).await {
        Ok(true) => StatusCode::NO_CONTENT.into_response(),
        Ok(false) => error(StatusCode::NOT_FOUND, "not_found"),
        Err(_) => unavailable(),
    }
}
#[derive(Clone)]
struct Origins(Vec<String>);

async fn boundary(
    Extension(origins): Extension<Origins>,
    request: Request,
    next: Next,
) -> Response {
    // A loopback exercise, not an authentication/authorization system.
    if request.method() != "GET" && request.method() != "HEAD" {
        if let Some(origin) = request.headers().get("origin") {
            if !origin
                .to_str()
                .is_ok_and(|value| origins.0.iter().any(|allowed| allowed == value))
            {
                return error(StatusCode::FORBIDDEN, "invalid_origin");
            }
        }
    }
    let mut response = next.run(request).await;
    response
        .headers_mut()
        .insert("cache-control", "no-store".parse().unwrap());
    response
        .headers_mut()
        .insert("x-content-type-options", "nosniff".parse().unwrap());
    response.headers_mut().insert("content-security-policy", "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'".parse().unwrap());
    response
}

pub fn app(store: Store) -> Router {
    app_with_origins(store, &["http://127.0.0.1:3010", "http://localhost:3010"])
}

pub fn app_with_origins(store: Store, origins: &[&str]) -> Router {
    Router::new()
        .route(
            "/",
            get(|| async { rullst::response::Html(include_str!("../web/index.html")) }),
        )
        .route(
            "/app.js",
            get(|| async {
                (
                    [("content-type", "text/javascript; charset=utf-8")],
                    include_str!("../web/app.js"),
                )
            }),
        )
        .route(
            "/style.css",
            get(|| async {
                (
                    [("content-type", "text/css; charset=utf-8")],
                    include_str!("../web/style.css"),
                )
            }),
        )
        .route("/healthz", get(|| async { Json(json!({"status":"ok"})) }))
        .route("/api/missions", get(list).post(create))
        .route(
            "/api/missions/{id}/completion",
            rullst::web::axum::routing::put(complete),
        )
        .fallback(|| async { error(StatusCode::NOT_FOUND, "not_found") })
        .layer(DefaultBodyLimit::max(4096))
        .layer(from_fn(boundary))
        .layer(Extension(Origins(
            origins.iter().map(|v| (*v).into()).collect(),
        )))
        .layer(Extension(store))
}

File format

Your text will be saved in this browser when you edit it. On a shared computer, clear your drafts when finished.

Direct upload accepts up to 8 KiB of text in one file. Use downloads and the manual guide for projects with multiple files.

Useful errors, explicit limits

Let's discover together

Your application workbench

File to study and modify

Official links and next step

Now it's your turn

Decide before running

Take it with you

My files and GitHub

Your file for this lesson

Save to my GitHub

Rullstpetbot