v0.25.1

scripts/security_contracts.py

@@ -2,18 +2,20 @@
 """Source-level security invariants that must hold even before Rust runtime tests."""
 from __future__ import annotations
 from pathlib import Path
+from rust_source import rust_source, rust_tree
 
 ROOT = Path(__file__).resolve().parents[1]
 
 def read(path: str) -> str:
-    return (ROOT / path).read_text(encoding="utf-8")
+    target = ROOT / path
+    return rust_source(ROOT, path) if target.suffix == ".rs" else target.read_text(encoding="utf-8")
 
 def need(text: str, *needles: str) -> None:
     for needle in needles:
         if needle not in text:
             raise AssertionError(f"missing security invariant: {needle}")
 
-web = read("src/web_server.rs")
+web = rust_tree(ROOT, "src/web_server")
 htaccess = read("src/web_server/htaccess.rs")
 acl = read("src/acl.rs")
 admin = read("src/admin/mod.rs")
@@ -94,7 +96,7 @@ need(auth,
 
 # Web serving/admin code must not execute shell commands as part of request/config handling.
 for path, text in {
-    "src/web_server.rs": web,
+    "src/web_server/*.rs": web,
     "src/web_server/htaccess.rs": htaccess,
     "src/admin/mod.rs": admin,
 }.items():