Private response-validation seams for the media RPC client. More...

#include <stddef.h>
#include "ra8_attributes.h"
#include "ra8_c6link_mdl.h"
#include "ra8_media_download.pb-c.h"

Include dependency graph for ra8_c6link_mdl_internal.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
bool	ra8_c6link_mdl_http_field_valid_test (const char *text, size_t cap)
	Judge one decoded HTTP header exactly as the client does.
bool	ra8_c6link_mdl_http_response_valid_test (const Ra8__Mdl__Chunk *msg)
	Judge one decoded response's HTTP metadata exactly as the client does.
bool	ra8_c6link_mdl_chunk_semantics_valid_test (const Ra8__Mdl__Chunk *msg)
	Judge one decoded response's state semantics exactly as the client does.
ra8_err_t	ra8_c6link_mdl_take_cancelled_test (ra8_c6link_t link, ra8_mdl_session_t session, const uint8_t *packed, size_t len)
	Judge one cancellation acknowledgement exactly as the client does.

Detailed Description

Private response-validation seams for the media RPC client.

Exposes the three pure predicates that judge a decoded response to focused host tests. Transport, correlation, and session ownership all remain private to ra8_c6link_mdl.c; nothing here changes what production runs.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_c6link_mdl_internal.h.

Function Documentation

◆ ra8_c6link_mdl_chunk_semantics_valid_test()

bool ra8_c6link_mdl_chunk_semantics_valid_test ( const Ra8__Mdl__Chunk * msg )

Judge one decoded response's state semantics exactly as the client does.

Forwards unchanged to the module-private predicate that enforces the data/digest/status combination each state permits, plus the overflow-safe relationship between offset, data length, and declared total.

Parameters

[in] msg Decoded generated chunk.

Returns: Semantic validity.

Return values

true	State, size, status, and digest fields are mutually coherent.
false	A state-specific rule or the total-covers-data rule is broken.

Precondition: msg is non-null and decoded into a live bounded arena.; Binary-data lengths describe their decoded buffers.

Postcondition: No decoded or session state is modified.; True guarantees the later bounded copies are size-safe.

Note: Test helper; pure and reentrant.

MC/DC:: Five decisions across four mutually exclusive states, up to six conditions each. Every vector needs one field of one state changed in isolation, which a transport fault cannot express without a new injection per condition.

Since: 0.1.0

Definition at line 464 of file ra8_c6link_mdl.c.

References internal_mdl_chunk_semantics_valid(), and RA8_TEST_HELPER.

◆ ra8_c6link_mdl_http_field_valid_test()

bool ra8_c6link_mdl_http_field_valid_test	(	const char *	text,
		size_t	cap )

Judge one decoded HTTP header exactly as the client does.

Forwards unchanged to the module-private predicate, so a focused test drives the shipped bound and line-discipline logic rather than a copy. An absent header is valid; the C6 service sends the empty string for one it did not observe.

Parameters

[in]	text	Candidate decoded protobuf string, or null for absent.
[in]	cap	Maximum extent including the terminating NUL.

Returns: Header validity.

Return values

true	Absent, or terminates before `cap` with no CR or LF.
false	The header is unterminated or carries a header-injection byte.

Precondition: cap is nonzero.; Non-null text is readable for at least cap bytes.

Postcondition: No decoded or session state is modified.; True authorizes copying the header into the public response.

Note: Test helper; pure and reentrant.

MC/DC:: The CR/LF decision needs one vector per byte class, and the C6 model would need a distinct hand-packed terminal response per vector to reach them.

Since: 0.1.0

Definition at line 454 of file ra8_c6link_mdl.c.

References internal_mdl_http_field_valid(), and RA8_TEST_HELPER.

◆ ra8_c6link_mdl_http_response_valid_test()

bool ra8_c6link_mdl_http_response_valid_test ( const Ra8__Mdl__Chunk * msg )

Judge one decoded response's HTTP metadata exactly as the client does.

Forwards unchanged to the module-private predicate that separates a non-terminal response, which must carry no metadata at all, from a COMPLETE response, whose status must be HTTP-shaped and whose four selected headers must each be bounded single-line text.

Parameters

[in] msg Decoded generated chunk.

Returns: Metadata validity.

Return values

true	The metadata matches what this response's state permits.
false	A status or header rule for that state is violated.

Precondition: msg is non-null and decoded into a live bounded arena.; Every string member is null or NUL-terminated within its bound.

Postcondition: No decoded or session state is modified.; True authorizes the state-specific semantic checks that follow.

Note: Test helper; pure and reentrant.

MC/DC:: Two decisions, six conditions in the terminal one. Driving them through the modelled transport would need one malformed-header fault per condition, and the non-terminal decision would need a data response carrying metadata that the service is structurally unable to emit.

Since: 0.1.0

Definition at line 459 of file ra8_c6link_mdl.c.

References internal_mdl_http_response_valid(), and RA8_TEST_HELPER.

◆ ra8_c6link_mdl_take_cancelled_test()

ra8_err_t ra8_c6link_mdl_take_cancelled_test	(	ra8_c6link_t *	link,
		ra8_mdl_session_t *	session,
		const uint8_t *	packed,
		size_t	len )

Judge one cancellation acknowledgement exactly as the client does.

Builds the fields of the take context the cancelled path reads and runs the identical decode-and-correlate path, so a test observes the client's real acceptance rule rather than a reimplementation of it.

Parameters

[in,out]	link	Open link whose bounded arena decodes the message.
[in,out]	session	Caller session the acknowledgement must correlate to.
[in]	packed	Packed generated Cancelled bytes.
[in]	len	Valid bytes at `packed`.

Returns: Decode status.

Return values

k_ra8_ok	A matching acknowledgement deactivated `session`.
k_ra8_err_protocol_error	Decode or correlation validation failed.

Precondition: link is open and session carries the expected job identity.; packed is readable for len bytes.

Postcondition: Success makes session inactive; failure preserves its state.; The decoded message is released before return; no decoded pointer escapes into session or to the caller.

Note: Test helper; not thread-safe for a shared link or session.

Since: 0.1.0

Definition at line 445 of file ra8_c6link_mdl.c.

References internal_mdl_take_cancelled(), k_mdl_take_cancelled, and RA8_TEST_HELPER.

Functions

Detailed Description

Function Documentation

◆ ra8_c6link_mdl_chunk_semantics_valid_test()

◆ ra8_c6link_mdl_http_field_valid_test()

◆ ra8_c6link_mdl_http_response_valid_test()

◆ ra8_c6link_mdl_take_cancelled_test()