WIP: Support validation for buffa view types

[advait-specter]

buffa generates a borrowed FooView<'a> alongside every owned Foo, but the plugin only emitted validators for the owned side. Now it emits both:

impl Validate for MapMin { ... }
impl Validate for __buffa::view::MapMinView<'_> { ... }

Handlers can validate a decoded view in place and skip to_owned_message(). #[connect_impl] still converts to owned; switching it is a follow-up.

The win is skipping the owned decode, not faster checking. Decode + validate on a string-heavy message (repeated string under a per-item regex) runs at 0.71–0.75x the owned path. Validate alone is a wash — both shapes read &str at the point of comparison — and on map fields the view is slower, because it has work to do that the owned decoder already did. A view still allocates for repeated, map, and nested-message fields; only strings and bytes borrow.

items	owned decode+validate	view decode+validate	ratio
8	242.73 ns	172.98 ns	0.71x
64	1.7289 µs	1.2967 µs	0.75x
512	12.923 µs	9.6724 µs	0.75x

How it works

Both bodies come from the same emitters. Rule checks read through &x[..], valid on String/&str, Vec<u8>/&[u8], and Vec<T>/RepeatedView<T>, so only three things branch on the target shape:

• impl target — Foo vs __buffa::view::FooView<'_>
• oneof enum module — __buffa::oneof:: vs __buffa::view::oneof::
• how a map field is read

At -O LLVM folds (&s[..]).len() and s.as_str().len() to the same symbol, so the rewrite costs the owned path nothing. Two bindings that used to clone — the optional-scalar inner and the wrapper value — now borrow, so the owned path drops an allocation each.

Map fields are the one semantic difference

Protobuf specifies that "if there are duplicate map keys the last key seen is used", and an owned HashMap gets that from the decoder. A MapView is the raw wire entry list with no such step applied, so the view body rebuilds the canonical map: one linear pass indexing each key to its last occurrence, then pair counts and entry loops driven off that index.

let mut __pv_last: ::buffa::__private::HashMap<_, usize> =
    ::buffa::__private::HashMap::with_capacity_and_hasher(self.val.len(), Default::default());
for (__pv_i, (__pv_k, _)) in self.val.iter().enumerate() {
    __pv_last.insert(__pv_k, __pv_i);
}
// map.min_pairs reads __pv_last.len()
for (__pv_i, (key, value)) in self.val.iter().enumerate() {
    if __pv_last.get(key) != Some(&__pv_i) {
        continue; // stale entry: a later one wins
    }

Without it, a payload padded with duplicate keys clears map.min_pairs on the view and then fails on the owned message the handler converts to. The index hashes with ::buffa::__private::HashMap, the same foldhash state buffa builds its owned maps with, so both shapes make the same tradeoff over the same untrusted keys.

buffa ships len_unique/iter_unique for this, but both are documented O(n²) — fine for the serialization path they were written for, wrong here, where the map is attacker-sized input to a validator. At 16k entries that is ~320 ms per call versus ~289 µs for the index. Filed upstream.

The conformance crate grows a [lib] target so the bench can reach the same generated types the executor validates, and benches/map_bench.rs is the first benchmark in the repo.

One index per map field, built only where the field carries rules. The owned body keeps reading the HashMap directly — it shares the loop scaffolding, so its map loops now carry an .enumerate() index it ignores, which optimises out (measured below).

Cost of the map path

Real generated validators, timed on validate() alone. Two field shapes differing only in per-entry rule weight — MapValues is map<string, string> with map.values.string.min_len, MapKeysPattern the same map with a map.keys.string.pattern regex:

entries	owned	view	ratio	owned (regex)	view (regex)	ratio
16	45.9 ns	197.1 ns	4.30x	182.9 ns	319.3 ns	1.75x
64	173.7 ns	656.8 ns	3.78x	733.3 ns	1.1338 µs	1.55x
256	766.3 ns	2.3940 µs	3.12x	2.9182 µs	4.2839 µs	1.47x
1024	3.5246 µs	9.3408 µs	2.65x	11.855 µs	16.969 µs	1.43x
4096	15.367 µs	38.030 µs	2.47x	48.482 µs	69.692 µs	1.44x

Both sides are linear, so the ratio narrows as n grows and the fixed index build is amortized: 4.30x down to 2.47x under a cheap min_len check, 1.75x down to 1.44x under a regex. This is per-map-field in isolation; end to end the decode saving dominates, hence the 0.71–0.75x above.

Reproduce with cargo bench -p protovalidate-buffa-conformance.

New views option

Must match how the message crate was generated:

opt: value	Message crate built with
views=true (default)	buffa defaults — generate_views(true), ungated
views=feature:NAME	gate_impls_on_crate_features(true); stamps the matching #[cfg(feature = "NAME")] on view impls
views=false	generate_views(false)

Testing

Conformance validates every case twice — owned and view — and a disagreement fails the case on its own. 2872/2872, so a green run asserts spec conformance and owned/view parity. Verified the check bites by gutting the view emitter: FAIL (failed: 758). A message with an owned validator but no view one is also a failure, so the check cannot go quiet by covering less.

Violations compare as a set, not a sequence: map iteration order is undefined and the two shapes differ (owned follows its hasher, which isn't stable between decodes; the view follows wire order), so positional comparison would flag divergence where verdicts match.

The upstream corpus has no duplicate-key case, so that path gets its own behavioural tests against real generated types in the conformance crate. tests/view_impls.rs covers emission in CI, and the workspace build type-checks every emitted view validator across the cases corpus.

Error messages are unchanged: --strict_message fails the same 157 lines before and after, and --strict_error passes 2872/2872 on both.

Generated validator code roughly doubles (70,167 → 141,267 lines over the corpus); views=false opts out.

Owned validators are unchanged in behaviour but not byte-identical: 125 of 865 owned impls in the corpus differ textually. The changes are the slice-borrow forms (as_str()/as_slice() → &x[..], which LLVM folds to the same symbol), an extra block scope around map bodies, .enumerate() on map loops binding an index the owned side ignores, and two clone() calls dropped from the optional-scalar and wrapper bindings. Owned map validation measures within noise of base across 16–4096 entries — the dead counter is optimised out — and no owned impl gained or lost a rule.

Lazy views (lazy_views: true) remain unsupported — different types, fallible field access, needs its own design.

Review order

6 commits, each independently green. The first two are pure refactors, so it bisects cleanly:

1. refactor: emit slice-borrow expressions in validator codegen
2. refactor: thread a target Shape through the emit layer
3. feat: emit Validate impls for buffa view types
4. test: assert owned/view parity in the conformance run
5. perf: hash the view map index with buffa's foldhash state
6. test: fail a case when its view validator is missing