HMAC-Protected Circuit Breaker

use hmac_circuit_breaker::{
    state::CircuitBreakerFile,
    writer::{write_state, ServiceObservation},
};
use std::collections::BTreeMap;
use std::path::Path;

fn run_health_checks() -> Result<(), Box<dyn std::error::Error>> {
    let path = Path::new("/var/run/myapp/circuit_breaker.json");
    let secret = std::env::var("HMAC_SECRET").expect("HMAC_SECRET must be set");

    // Load previous state to accumulate consecutive failure counts.
    // Safe on first run — returns empty map if file doesn't exist yet.
    let previous: BTreeMap<_, _> = std::fs::read_to_string(path)
        .ok()
        .and_then(|s| serde_json::from_str::<CircuitBreakerFile>(&s).ok())
        .map(|f| f.algorithms)
        .unwrap_or_default();

    let observations = vec![
        ServiceObservation { name: "payments".into(), passed: true,  error: None },
        ServiceObservation { name: "auth".into(),     passed: false,
                             error: Some("connection refused".into()) },
    ];

    write_state(path, &observations, &previous, 3, &secret)?;
    Ok(())
}

use hmac_circuit_breaker::{CircuitBreakerConfig, CircuitBreakerHandle};
use std::path::PathBuf;
use std::time::Duration;

#[tokio::main]
async fn main() {
    let config = CircuitBreakerConfig::builder()
        .state_file(PathBuf::from("/var/run/myapp/circuit_breaker.json"))
        .secret(std::env::var("HMAC_SECRET").expect("HMAC_SECRET must be set"))
        .threshold(3)
        .reload_interval(Duration::from_secs(60))
        .build();

    let handle = CircuitBreakerHandle::new(config);
    handle.load().await;    // initial load at startup
    let _reload = handle.spawn_reload();  // background refresh; returns JoinHandle

    if handle.is_tripped("auth").await { /* return 503 */ }

    if let Some(state) = handle.get("payments").await {
        println!("{}: {} failures", state.status, state.consecutive_failures);
    }

    // Full snapshot of all tracked services (for health/status endpoints)
    let all = handle.snapshot().await;
    for (name, state) in &all {
        println!("{name}: {}", state.status);
    }
}

use axum::{Router, routing::post};
use hmac_circuit_breaker::{CircuitBreakerConfig, CircuitBreakerHandle};
use hmac_circuit_breaker::middleware::circuit_breaker_layer;

async fn my_handler() -> &'static str { "ok" }

#[tokio::main]
async fn main() {
    let config = CircuitBreakerConfig::builder()
        .state_file("/var/run/myapp/circuit_breaker.json".into())
        .secret(std::env::var("HMAC_SECRET").expect("HMAC_SECRET must be set"))
        // Require a secret value on the bypass header (production best practice)
        .bypass_header_secret(Some(
            std::env::var("BYPASS_SECRET").expect("BYPASS_SECRET must be set")
        ))
        .build();

    let handle = CircuitBreakerHandle::new(config.clone());
    handle.load().await;
    let _reload = handle.spawn_reload();

    // Map "/encrypt/{service}" → service name for circuit lookup
    let extractor = |path: &str| -> Option<String> {
        let parts: Vec<&str> = path.trim_start_matches('/').splitn(3, '/').collect();
        if parts.first() == Some(&"encrypt") {
            parts.get(1).map(|s| s.to_string())
        } else {
            None
        }
    };

    let app = Router::new()
        .route("/encrypt/:service", post(my_handler))
        .layer(circuit_breaker_layer(
            handle.shared_state(),
            handle.runtime_state(),
            config,
            extractor,
        ));

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000").await.unwrap();
    axum::serve(listener, app).await.unwrap();
}

let handle = CircuitBreakerHandle::new(config);
let reload_task = handle.spawn_reload();

// ... run your application ...

// On shutdown signal:
reload_task.abort();
let _ = reload_task.await; // JoinError::is_cancelled() is expected

# Complete producer + consumer round-trip
cargo run --example basic

# axum middleware demo
cargo run --example with_axum --features axum

cargo test
cargo test --features axum

// Minimal production config
let config = CircuitBreakerConfig::builder()
    .state_file("/var/run/myapp/circuit_breaker.json".into())
    .secret(std::env::var("HMAC_SECRET").expect("HMAC_SECRET must be set"))
    .bypass_header_secret(Some(
        std::env::var("BYPASS_SECRET").expect("BYPASS_SECRET must be set")
    ))
    .strict_hmac(true)  // reject unsigned files once all producers are upgraded
    .build();

// Disable bypass entirely (e.g. you handle recovery out-of-band)
let config = CircuitBreakerConfig::builder()
    .bypass_header(None::<&str>)
    .build();

{
  "updated_at": "2026-02-27T15:22:41Z",
  "threshold": 3,
  "integrity_hash": "7b1def6802fabaed287c41786162e5648f47010d…",
  "algorithms": {
    "auth": {
      "consecutive_failures": 3,
      "reason": "connection refused: 127.0.0.1:5432",
      "since": "2026-02-27T14:00:00Z",
      "status": "tripped"
    },
    "payments": {
      "consecutive_failures": 0,
      "status": "closed"
    }
  }
}

{"auth":{"consecutive_failures":1,"reason":"timeout","status":"open"},"db":{"consecutive_failures":0,"status":"closed"}}

import json, hmac, hashlib
from datetime import datetime, timezone

def write_circuit_state(path: str, algorithms: dict, secret: str) -> None:
    """Write a HMAC-signed circuit breaker state file."""
    # CRITICAL: sort_keys=True is required — Rust serde_json sorts keys alphabetically.
    # Using sort_keys=False produces a different byte sequence and the HMAC will fail.
    algorithms_json = json.dumps(algorithms, separators=(',', ':'), sort_keys=True)

    mac = hmac.new(secret.encode(), algorithms_json.encode(), hashlib.sha256)
    integrity_hash = mac.hexdigest()

    state = {
        "updated_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
        "threshold": 3,
        "integrity_hash": integrity_hash,
        "algorithms": dict(sorted(algorithms.items())),  # outer map also sorted
    }
    with open(path, "w") as f:
        json.dump(state, f, indent=2)

# Example usage
algorithms = {
    "payments": {"status": "closed", "consecutive_failures": 0},
    "auth":     {"status": "tripped", "consecutive_failures": 3,
                 "since": "2026-02-27T14:00:00Z",
                 "reason": "connection refused"},
}
write_circuit_state("/var/run/myapp/circuit_breaker.json", algorithms, "my-secret")

# Build canonical JSON manually (outer keys and inner keys must be alphabetically sorted)
ALGORITHMS_JSON='{"auth":{"consecutive_failures":3,"reason":"timeout","status":"tripped"},"payments":{"consecutive_failures":0,"status":"closed"}}'
SECRET="my-secret"

HASH=$(echo -n "$ALGORITHMS_JSON" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}')
echo "integrity_hash: $HASH"