ra8_c6link_mdl_service_internal.h File Reference

Private bounded-allocation seam for the portable media service. More...

#include <stddef.h>
#include "ra8_attributes.h"
#include "ra8_err.h"
#include "ra8_mdl_http.h"

Include dependency graph for ra8_c6link_mdl_service_internal.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
bool	priv_c6link_mdl_decode_allocation_fits (size_t used, size_t len, size_t capacity)
	Decide whether one aligned protobuf allocation fits an arena.
bool	ra8_mdl_service_field_valid_test (const char *text, size_t cap)
	Judge one decoded request header exactly as dispatch does.
bool	ra8_mdl_service_response_valid_test (const ra8_mdl_http_response_t *response)
	Judge one backend terminal response exactly as dispatch does.
ra8_err_t	ra8_mdl_service_check_size_test (size_t len, size_t response_cap)
	Judge one packed-response length exactly as dispatch does.

Detailed Description

Private bounded-allocation seam for the portable media service.

Exposes the pure allocation-fit predicate and the three pure validators to focused host tests; production allocation, dispatch, and ownership remain in ra8_c6link_mdl_service.c.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_c6link_mdl_service_internal.h.

Function Documentation

priv_c6link_mdl_decode_allocation_fits()

bool priv_c6link_mdl_decode_allocation_fits	(	size_t	used,
		size_t	len,
		size_t	capacity )

Decide whether one aligned protobuf allocation fits an arena.

Rejects pre-alignment overflow before proving both total and remaining capacity for the fixed eight-byte protobuf alignment.

Parameters

[in]	used	Bytes already consumed from the arena.
[in]	len	Requested allocation length before alignment.
[in]	capacity	Total arena byte capacity.

Returns

Whether the aligned request fits without arithmetic overflow.

Return values

true	Alignment and remaining-capacity checks both succeed.
false	Length arithmetic overflows or the request exceeds capacity.

Precondition

All inputs are byte counts representable by size_t.

Alignment is the fixed media-service protobuf alignment.

Postcondition

No state or storage is modified.

True guarantees used + aligned(len) <= capacity.

Note

Pure, reentrant, and exposed only for focused private tests.

Since

0.1.0

Definition at line 101 of file ra8_c6link_mdl_service.c.

References k_mdl_decode_align_mask, and RA8_PRIV.

Referenced by internal_mdl_decode_alloc().

ra8_mdl_service_check_size_test()

ra8_err_t ra8_mdl_service_check_size_test	(	size_t	len,
		size_t	response_cap )

Judge one packed-response length exactly as dispatch does.

Forwards unchanged to the module-private capacity predicate every pack path consults before it writes a byte into caller storage.

Parameters

[in]	len	Packed length the generated codec reported.
[in]	response_cap	Capacity of the caller's response buffer.

Returns

Canonical capacity status.

Return values

k_ra8_ok	The packed response fits and is non-empty.
k_ra8_err_invalid_size	The length is zero or exceeds capacity.

Precondition

Both arguments are byte counts representable by size_t.

response_cap is the actual writable response capacity.

Postcondition

No service or caller state is modified.

Success guarantees a following pack of len bytes is in bounds.

Note

Test helper; pure and reentrant.

MC/DC:

The zero-length condition is unreachable through dispatch: every generated response carries a non-default protocol version, so the codec never reports zero. Only this seam can vary it independently of the capacity condition.

Since

0.1.0

Definition at line 700 of file ra8_c6link_mdl_service.c.

References internal_mdl_check_response_size(), and RA8_TEST_HELPER.

ra8_mdl_service_field_valid_test()

bool ra8_mdl_service_field_valid_test	(	const char *	text,
		size_t	cap )

Judge one decoded request header exactly as dispatch does.

Forwards unchanged to the module-private predicate, so a focused test drives the shipped bound and line-discipline logic rather than a copy.

Parameters

[in]	text	Candidate decoded protobuf string, or null.
[in]	cap	Maximum extent including the terminating NUL.

Returns

Header validity.

Return values

true	Text terminates before cap and contains no CR or LF.
false	Pointer, bound, termination, or line discipline is invalid.

Precondition

cap is nonzero.

Non-null text is readable for at least cap bytes.

Postcondition

No service or caller state is modified.

True authorizes passing the string to the backend.

Note

Test helper; pure and reentrant.

MC/DC:

The CR/LF decision cannot be driven to its two single-byte vectors through ra8_mdl_service_dispatch, whose decoded strings would each need a distinct hand-packed protobuf request per condition.

Since

0.1.0

Definition at line 690 of file ra8_c6link_mdl_service.c.

References internal_mdl_request_field_valid(), and RA8_TEST_HELPER.

ra8_mdl_service_response_valid_test()

bool ra8_mdl_service_response_valid_test

(

const ra8_mdl_http_response_t *

response

)

Judge one backend terminal response exactly as dispatch does.

Forwards unchanged to the module-private predicate that gates every COMPLETE response before its headers reach the generated packer.

Parameters

[in]

response

Candidate status and selected headers.

Returns

Response validity.

Return values

true	Status is HTTP-shaped and every header is bounded single-line.
false	Status or a selected header violates the protocol contract.

Precondition

response is non-null and fully initialized.

Every array member is readable for its declared extent.

Postcondition

No service or caller state is modified.

True authorizes protobuf packing of every selected header.

Note

Test helper; pure and reentrant.

MC/DC:

Six conditions needing seven vectors. Reaching them through the public dispatch would require a backend that returns a different single malformed header per pull, which the read seam cannot express one condition at a time.

Since

0.1.0

Definition at line 695 of file ra8_c6link_mdl_service.c.

References internal_mdl_response_valid(), and RA8_TEST_HELPER.