didbot_schema/

check.rs

//! Checking one JSON value against one [`Schema`].
//!
//! The walk is ordinary; the parts worth reading are the three places where
//! the specification says to be *permissive* and it would be easy to be
//! strict instead. An object property no schema declares is kept. A `$type`
//! outside an open union's `refs` is kept. A `knownValues` list is not a
//! constraint at all. Each of those is a record written by a client that
//! knows a newer version of a lexicon than this server does, and refusing any
//! of them turns a schema addition into an outage.
//!
//! Errors carry a path — `artifacts[2]`, `object.a` — because the whole
//! value of validating on write is that the client is told which field is
//! wrong while it still has the field in hand.

use serde_json::Value;
use unicode_segmentation::UnicodeSegmentation;

use super::{Catalog, Def, IntegerSchema, ObjectSchema, Schema, StringSchema};
use crate::format;

/// How deep a schema may nest before the walk gives up.
///
/// Refs can point at each other, so a cycle is reachable from a lexicon
/// document alone and does not need a malicious record to trigger it. Real
/// records are three or four levels deep; this is a stack guard, not a
/// modelling limit.
pub const MAX_SCHEMA_DEPTH: usize = 32;

/// The root of an error path, for a failure about the record as a whole.
const ROOT: &str = "<record>";

/// Why a record does not satisfy its lexicon.
///
/// One flat error rather than an enum per constraint. The caller is an HTTP
/// layer turning this into a 400 and the reader is the client that wrote the
/// record, so the field that matters is the path, and a message it can print
/// beats a variant it would have to match on.
#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
#[error("`{path}` {reason}")]
pub struct InvalidRecord {
    /// Where in the record the failure is, as a dotted and indexed path.
    pub path: String,
    /// What was wrong, in a sentence.
    pub reason: String,
}

impl InvalidRecord {
    /// A failure at a path.
    pub fn at(path: &str, reason: impl Into<String>) -> Self {
        Self {
            path: path.to_owned(),
            reason: reason.into(),
        }
    }

    /// The same failure, with its path placed under `parent`. The root of a
    /// nested object is `""` until its caller places it.
    #[must_use]
    pub fn under(self, parent: &str) -> Self {
        let path = if self.path.is_empty() {
            parent.to_owned()
        } else {
            format!("{parent}.{}", self.path)
        };
        Self {
            path,
            reason: self.reason,
        }
    }

    /// The collection has no record definition in this catalog.
    pub(super) fn no_such_record(collection: &str) -> Self {
        Self::at(
            ROOT,
            format!("`{collection}` has no record definition in this deployment's lexicons"),
        )
    }
}

/// Names the JSON kind of a value, for an error message.
fn kind_of(value: &Value) -> &'static str {
    match value {
        Value::Null => "null",
        Value::Bool(_) => "a boolean",
        Value::Number(n) if n.is_f64() => "a fractional number",
        Value::Number(_) => "an integer",
        Value::String(_) => "a string",
        Value::Array(_) => "an array",
        Value::Object(_) => "an object",
    }
}

/// Extends an error path with a property name.
fn child(path: &str, name: &str) -> String {
    if path == ROOT {
        name.to_owned()
    } else {
        format!("{path}.{name}")
    }
}

/// Extends an error path with an array index.
fn index(path: &str, at: usize) -> String {
    format!("{path}[{at}]")
}

/// Checks a record body against a record definition's schema.
pub(super) fn check(
    catalog: &Catalog,
    document: &str,
    schema: &Schema,
    record: &Value,
) -> Result<(), InvalidRecord> {
    check_value(catalog, document, schema, record, ROOT, 0)
}

/// The recursive step.
fn check_value(
    catalog: &Catalog,
    document: &str,
    schema: &Schema,
    value: &Value,
    path: &str,
    depth: usize,
) -> Result<(), InvalidRecord> {
    if depth > MAX_SCHEMA_DEPTH {
        return Err(InvalidRecord::at(
            path,
            format!("schema nests deeper than {MAX_SCHEMA_DEPTH} levels"),
        ));
    }
    match schema {
        Schema::Boolean { constant } => {
            let held = value.as_bool().ok_or_else(|| {
                InvalidRecord::at(
                    path,
                    format!("expected a boolean, found {}", kind_of(value)),
                )
            })?;
            if let Some(required) = constant {
                if held != *required {
                    return Err(InvalidRecord::at(
                        path,
                        format!("must be `{required}`, found `{held}`"),
                    ));
                }
            }
            Ok(())
        }
        Schema::Integer(rules) => check_integer(rules, value, path),
        Schema::String(rules) => check_string(rules, value, path),
        Schema::Bytes {
            min_length,
            max_length,
        } => check_bytes(*min_length, *max_length, value, path),
        Schema::CidLink => check_cid_link(value, path),
        Schema::Blob { accept, max_size } => check_blob(accept, *max_size, value, path),
        Schema::Array {
            items,
            min_length,
            max_length,
        } => {
            let held = value.as_array().ok_or_else(|| {
                InvalidRecord::at(path, format!("expected an array, found {}", kind_of(value)))
            })?;
            if let Some(least) = min_length {
                if held.len() < *least {
                    return Err(InvalidRecord::at(
                        path,
                        format!(
                            "holds {} items, fewer than the minimum of {least}",
                            held.len()
                        ),
                    ));
                }
            }
            if let Some(most) = max_length {
                if held.len() > *most {
                    return Err(InvalidRecord::at(
                        path,
                        format!("holds {} items, over the maximum of {most}", held.len()),
                    ));
                }
            }
            if let Some(element) = items {
                for (at, item) in held.iter().enumerate() {
                    check_value(
                        catalog,
                        document,
                        element,
                        item,
                        &index(path, at),
                        depth + 1,
                    )?;
                }
            }
            Ok(())
        }
        Schema::Object(rules) => check_object(catalog, document, rules, value, path, depth),
        Schema::Ref(reference) => {
            let Some((resolved, def)) = catalog.resolve(document, reference) else {
                return Err(InvalidRecord::at(
                    path,
                    format!("schema refers to `{reference}`, which this deployment cannot resolve"),
                ));
            };
            let target_document = resolved
                .split_once('#')
                .map(|(doc, _)| doc.to_owned())
                .unwrap_or_else(|| resolved.clone());
            match def {
                Def::Data(inner) => {
                    check_value(catalog, &target_document, inner, value, path, depth + 1)
                }
                Def::Record { record, .. } => {
                    check_value(catalog, &target_document, record, value, path, depth + 1)
                }
                // A token carries no data: the value *is* the token's
                // identifier, written out in full.
                Def::Token => match value.as_str() {
                    Some(held) if held == resolved => Ok(()),
                    Some(held) => Err(InvalidRecord::at(
                        path,
                        format!("must be the token `{resolved}`, found `{held}`"),
                    )),
                    None => Err(InvalidRecord::at(
                        path,
                        format!(
                            "expected the token `{resolved}` as a string, found {}",
                            kind_of(value)
                        ),
                    )),
                },
                Def::Method(method) => Err(InvalidRecord::at(
                    path,
                    format!(
                        "schema refers to `{resolved}`, which is a {} and holds no record data",
                        method.kind
                    ),
                )),
            }
        }
        Schema::Union { refs, closed } => {
            check_union(catalog, document, refs, *closed, value, path, depth)
        }
        Schema::Unknown => check_unknown(value, path),
        Schema::Null => {
            if value.is_null() {
                Ok(())
            } else {
                Err(InvalidRecord::at(
                    path,
                    format!("expected null, found {}", kind_of(value)),
                ))
            }
        }
        Schema::Token => {
            if value.is_string() {
                Ok(())
            } else {
                Err(InvalidRecord::at(
                    path,
                    format!(
                        "expected a token identifier as a string, found {}",
                        kind_of(value)
                    ),
                ))
            }
        }
        // A type this build has never heard of. Accepting the value is the
        // forward-compatible answer; see this module's header.
        Schema::Unrecognised(_) => Ok(()),
    }
}

/// Checks an integer and its bounds.
fn check_integer(rules: &IntegerSchema, value: &Value, path: &str) -> Result<(), InvalidRecord> {
    // `as_i64` is deliberately the whole type test. It says no to a boolean,
    // to a string of digits, and to `1.5` — atproto's data model has no
    // floats, so a fractional number is a different type and not a rounding
    // question.
    let held = value.as_i64().ok_or_else(|| {
        InvalidRecord::at(
            path,
            format!("expected an integer, found {}", kind_of(value)),
        )
    })?;
    if let Some(required) = rules.constant {
        if held != required {
            return Err(InvalidRecord::at(
                path,
                format!("must be `{required}`, found `{held}`"),
            ));
        }
    }
    if let Some(choices) = &rules.choices {
        if !choices.contains(&held) {
            return Err(InvalidRecord::at(
                path,
                format!("`{held}` is not one of the permitted values {choices:?}"),
            ));
        }
    }
    if let Some(least) = rules.minimum {
        if held < least {
            return Err(InvalidRecord::at(
                path,
                format!("`{held}` is below the minimum of {least}"),
            ));
        }
    }
    if let Some(most) = rules.maximum {
        if held > most {
            return Err(InvalidRecord::at(
                path,
                format!("`{held}` is above the maximum of {most}"),
            ));
        }
    }
    Ok(())
}

/// Checks a string, its lengths, its enumeration and its format.
fn check_string(rules: &StringSchema, value: &Value, path: &str) -> Result<(), InvalidRecord> {
    let held = value.as_str().ok_or_else(|| {
        InvalidRecord::at(path, format!("expected a string, found {}", kind_of(value)))
    })?;
    if let Some(required) = &rules.constant {
        if held != required {
            return Err(InvalidRecord::at(
                path,
                format!("must be `{required}`, found `{held}`"),
            ));
        }
    }
    if let Some(choices) = &rules.choices {
        if !choices.iter().any(|choice| choice == held) {
            return Err(InvalidRecord::at(
                path,
                format!("`{held}` is not one of the permitted values {choices:?}"),
            ));
        }
    }
    // Lengths are in UTF-8 bytes, which is what the specification says and is
    // not what a naive implementation counts. The two differ for every
    // non-ASCII string, and an emoji field with a byte limit read as a
    // character limit would be four times too permissive.
    let bytes = held.len();
    if let Some(least) = rules.min_length {
        if bytes < least {
            return Err(InvalidRecord::at(
                path,
                format!("is {bytes} bytes, under the minimum of {least}"),
            ));
        }
    }
    if let Some(most) = rules.max_length {
        if bytes > most {
            return Err(InvalidRecord::at(
                path,
                format!("is {bytes} bytes, over the maximum of {most}"),
            ));
        }
    }
    if rules.min_graphemes.is_some() || rules.max_graphemes.is_some() {
        // Counted only when asked, because segmentation is the expensive part
        // of validating a record and most fields do not declare it.
        let graphemes = held.graphemes(true).count();
        if let Some(least) = rules.min_graphemes {
            if graphemes < least {
                return Err(InvalidRecord::at(
                    path,
                    format!("is {graphemes} graphemes, under the minimum of {least}"),
                ));
            }
        }
        if let Some(most) = rules.max_graphemes {
            if graphemes > most {
                return Err(InvalidRecord::at(
                    path,
                    format!("is {graphemes} graphemes, over the maximum of {most}"),
                ));
            }
        }
    }
    if let Some(declared) = rules.format {
        format::check(declared, held).map_err(|reason| {
            InvalidRecord::at(path, format!("is not a valid {declared}: {reason}"))
        })?;
    }
    Ok(())
}

/// How many bytes a base64 string of this many characters decodes to.
///
/// Computed rather than decoded. The length bound is the only thing anything
/// here does with a `bytes` field — nothing in this server interprets the
/// payload — and arithmetic over the character count answers it without
/// pulling in a base64 decoder or deciding which padding dialect a client
/// used.
fn decoded_length(encoded: &str) -> usize {
    let significant = encoded.trim_end_matches('=').len();
    significant * 3 / 4
}

/// Checks a `bytes` value: `{"$bytes": "<base64>"}`.
fn check_bytes(
    min_length: Option<usize>,
    max_length: Option<usize>,
    value: &Value,
    path: &str,
) -> Result<(), InvalidRecord> {
    let encoded = value
        .as_object()
        .and_then(|object| object.get("$bytes"))
        .and_then(Value::as_str)
        .ok_or_else(|| {
            InvalidRecord::at(
                path,
                format!(
                    "expected a bytes object `{{\"$bytes\": \"…\"}}`, found {}",
                    kind_of(value)
                ),
            )
        })?;
    let length = decoded_length(encoded);
    if let Some(least) = min_length {
        if length < least {
            return Err(InvalidRecord::at(
                path,
                format!("decodes to {length} bytes, under the minimum of {least}"),
            ));
        }
    }
    if let Some(most) = max_length {
        if length > most {
            return Err(InvalidRecord::at(
                path,
                format!("decodes to {length} bytes, over the maximum of {most}"),
            ));
        }
    }
    Ok(())
}

/// Checks a `cid-link` value: `{"$link": "<cid>"}`.
fn check_cid_link(value: &Value, path: &str) -> Result<(), InvalidRecord> {
    let link = value
        .as_object()
        .and_then(|object| object.get("$link"))
        .and_then(Value::as_str)
        .ok_or_else(|| {
            InvalidRecord::at(
                path,
                format!(
                    "expected a cid-link object `{{\"$link\": \"…\"}}`, found {}",
                    kind_of(value)
                ),
            )
        })?;
    format::cid::validate(link).map_err(|reason| {
        InvalidRecord::at(path, format!("holds a link that is not a cid: {reason}"))
    })
}

/// Whether a MIME type matches one `accept` pattern.
///
/// Patterns are exact (`image/png`) or a wildcarded subtype (`image/*`), and
/// `*/*` accepts everything. Parameters after a `;` are ignored, because
/// `text/plain; charset=utf-8` is a `text/plain`.
fn mime_matches(pattern: &str, mime: &str) -> bool {
    let bare = mime.split(';').next().unwrap_or(mime).trim();
    if pattern == "*/*" {
        return true;
    }
    match pattern.split_once("/*") {
        Some((prefix, "")) => bare
            .split_once('/')
            .is_some_and(|(actual, _)| actual.eq_ignore_ascii_case(prefix)),
        _ => pattern.eq_ignore_ascii_case(bare),
    }
}

/// Checks a `blob` value.
fn check_blob(
    accept: &[String],
    max_size: Option<u64>,
    value: &Value,
    path: &str,
) -> Result<(), InvalidRecord> {
    let object = value.as_object().ok_or_else(|| {
        InvalidRecord::at(
            path,
            format!("expected a blob object, found {}", kind_of(value)),
        )
    })?;
    if object.get("$type").and_then(Value::as_str) != Some("blob") {
        return Err(InvalidRecord::at(
            path,
            "expected a blob object with `\"$type\": \"blob\"`",
        ));
    }
    let mime = object
        .get("mimeType")
        .and_then(Value::as_str)
        .ok_or_else(|| InvalidRecord::at(path, "blob has no `mimeType` string"))?;
    let size = object
        .get("size")
        .and_then(Value::as_u64)
        .ok_or_else(|| InvalidRecord::at(path, "blob has no non-negative `size`"))?;
    let reference = object
        .get("ref")
        .ok_or_else(|| InvalidRecord::at(path, "blob has no `ref`"))?;
    check_cid_link(reference, &child(path, "ref"))?;
    if let Some(most) = max_size {
        if size > most {
            return Err(InvalidRecord::at(
                path,
                format!("blob is {size} bytes, over the maximum of {most}"),
            ));
        }
    }
    if !accept.is_empty() && !accept.iter().any(|pattern| mime_matches(pattern, mime)) {
        return Err(InvalidRecord::at(
            path,
            format!("blob type `{mime}` is not one of the accepted types {accept:?}"),
        ));
    }
    Ok(())
}

/// Checks an `unknown` value.
///
/// `unknown` is not "anything". atproto's data model says the value is an
/// open object, and the three container shapes — bytes, cid-link and blob —
/// are excluded because each of them is a distinct node in the data model
/// rather than a map, and a consumer that re-encoded one as a plain object
/// would change what it is.
fn check_unknown(value: &Value, path: &str) -> Result<(), InvalidRecord> {
    let object = value.as_object().ok_or_else(|| {
        InvalidRecord::at(
            path,
            format!("expected an object, found {}", kind_of(value)),
        )
    })?;
    let container = if object.contains_key("$bytes") {
        Some("bytes")
    } else if object.contains_key("$link") {
        Some("a cid-link")
    } else if object.get("$type").and_then(Value::as_str) == Some("blob") {
        Some("a blob")
    } else {
        None
    };
    match container {
        None => Ok(()),
        Some(what) => Err(InvalidRecord::at(
            path,
            format!("holds {what}, which is not permitted where the schema says `unknown`"),
        )),
    }
}

/// Rewrites a ref into the `document#def` form a `$type` would be written in.
fn qualify(document: &str, reference: &str) -> String {
    match reference.split_once('#') {
        Some(("", name)) => format!("{document}#{name}"),
        Some(_) => reference.to_owned(),
        None => format!("{reference}#main"),
    }
}

/// Checks a union: an object whose `$type` chooses the schema.
fn check_union(
    catalog: &Catalog,
    document: &str,
    refs: &[String],
    closed: bool,
    value: &Value,
    path: &str,
    depth: usize,
) -> Result<(), InvalidRecord> {
    let object = value.as_object().ok_or_else(|| {
        InvalidRecord::at(
            path,
            format!("expected an object, found {}", kind_of(value)),
        )
    })?;
    let declared = object
        .get("$type")
        .and_then(Value::as_str)
        .ok_or_else(|| InvalidRecord::at(path, "a union member must carry a `$type`"))?;
    let wanted = qualify(document, declared);
    let chosen = refs
        .iter()
        .find(|reference| qualify(document, reference) == wanted);
    match chosen {
        Some(reference) => check_value(
            catalog,
            document,
            &Schema::Ref(reference.clone()),
            value,
            path,
            depth + 1,
        ),
        // An open union is open: a variant added to the lexicon after this
        // binary was built arrives here, and carrying it is the entire point
        // of the distinction from a closed one.
        None if !closed => Ok(()),
        None => Err(InvalidRecord::at(
            path,
            format!("`{declared}` is not one of this closed union's types {refs:?}"),
        )),
    }
}

/// Checks an object: required, nullable, declared properties, and the rest.
fn check_object(
    catalog: &Catalog,
    document: &str,
    rules: &ObjectSchema,
    value: &Value,
    path: &str,
    depth: usize,
) -> Result<(), InvalidRecord> {
    let object = value.as_object().ok_or_else(|| {
        InvalidRecord::at(
            path,
            format!("expected an object, found {}", kind_of(value)),
        )
    })?;

    for name in &rules.required {
        if !object.contains_key(name) {
            return Err(InvalidRecord::at(
                &child(path, name),
                "is required and is missing",
            ));
        }
    }

    for (name, held) in object {
        let Some(schema) = rules.properties.get(name) else {
            // The unknown-field rule. A property no schema declares is
            // carried through untouched, so a client written against a newer
            // lexicon does not lose data by writing to an older server.
            continue;
        };
        let here = child(path, name);
        if held.is_null() {
            if rules.nullable.contains(name) {
                continue;
            }
            return Err(InvalidRecord::at(
                &here,
                "is null, and the schema does not declare it nullable",
            ));
        }
        check_value(catalog, document, schema, held, &here, depth + 1)?;
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::json;

    fn catalog(document: Value) -> Catalog {
        let doc: didbot_lexicon::lexicon::LexiconDoc =
            serde_json::from_value(document).expect("the test document parses");
        Catalog::from_documents(std::iter::once(&doc)).expect("the test document is a schema")
    }

    fn one_field(schema: Value) -> Catalog {
        catalog(json!({
            "lexicon": 1,
            "id": "com.example.thing",
            "defs": {"main": {"type": "record", "key": "tid", "record": {
                "type": "object",
                "properties": {"field": schema}
            }}}
        }))
    }

    fn check_field(catalog: &Catalog, value: Value) -> Result<(), InvalidRecord> {
        catalog.validate_record("com.example.thing", &json!({"field": value}))
    }

    #[test]
    fn an_undeclared_property_is_carried_rather_than_refused() {
        let catalog = one_field(json!({"type": "string"}));
        assert!(catalog
            .validate_record(
                "com.example.thing",
                &json!({"field": "ok", "inventedLater": {"deeply": ["nested"]}})
            )
            .is_ok());
    }

    #[test]
    fn lengths_are_bytes_and_graphemes_are_clusters() {
        let catalog = one_field(json!({"type": "string", "maxLength": 3, "maxGraphemes": 2}));
        // Two graphemes, four bytes: over the byte limit, under the cluster one.
        assert!(check_field(&catalog, json!("éé")).is_err());
        assert!(check_field(&catalog, json!("ab")).is_ok());
        let catalog = one_field(json!({"type": "string", "maxGraphemes": 1}));
        // One family emoji: eleven code points, one grapheme cluster.
        assert!(check_field(&catalog, json!("👩‍👩‍👦‍👦")).is_ok());
        assert!(check_field(&catalog, json!("ab")).is_err());
    }

    #[test]
    fn a_fractional_number_is_not_an_integer() {
        let catalog = one_field(json!({"type": "integer"}));
        assert!(check_field(&catalog, json!(3)).is_ok());
        assert!(check_field(&catalog, json!(3.5)).is_err());
        assert!(check_field(&catalog, json!(true)).is_err());
    }

    #[test]
    fn known_values_are_advisory_and_enum_is_not() {
        let open = one_field(json!({"type": "string", "knownValues": ["a", "b"]}));
        assert!(check_field(&open, json!("something-else")).is_ok());
        let closed = one_field(json!({"type": "string", "enum": ["a", "b"]}));
        assert!(check_field(&closed, json!("something-else")).is_err());
    }

    #[test]
    fn null_needs_permission_and_required_needs_presence() {
        let catalog = catalog(json!({
            "lexicon": 1,
            "id": "com.example.thing",
            "defs": {"main": {"type": "record", "key": "tid", "record": {
                "type": "object",
                "required": ["a"],
                "nullable": ["b"],
                "properties": {"a": {"type": "string"}, "b": {"type": "string"}}
            }}}
        }));
        assert!(catalog
            .validate_record("com.example.thing", &json!({"a": "x"}))
            .is_ok());
        assert!(catalog
            .validate_record("com.example.thing", &json!({"a": "x", "b": null}))
            .is_ok());
        assert!(catalog
            .validate_record("com.example.thing", &json!({"b": "y"}))
            .is_err());
        assert!(catalog
            .validate_record("com.example.thing", &json!({"a": null}))
            .is_err());
    }

    #[test]
    fn an_open_union_carries_a_type_it_has_never_seen_and_a_closed_one_does_not() {
        let document = |closed: bool| {
            catalog(json!({
                "lexicon": 1,
                "id": "com.example.thing",
                "defs": {
                    "main": {"type": "record", "key": "tid", "record": {
                        "type": "object",
                        "properties": {"field": {
                            "type": "union",
                            "refs": ["#known"],
                            "closed": closed
                        }}
                    }},
                    "known": {"type": "object", "properties": {"a": {"type": "integer"}}}
                }
            }))
        };
        let novel = json!({"$type": "com.example.other#variant", "a": 1});
        assert!(check_field(&document(false), novel.clone()).is_ok());
        assert!(check_field(&document(true), novel).is_err());
        // A member matching a ref is still checked through it.
        assert!(check_field(
            &document(false),
            json!({"$type": "com.example.thing#known", "a": "not a number"})
        )
        .is_err());
        // And a member with no `$type` cannot be dispatched at all.
        assert!(check_field(&document(false), json!({"a": 1})).is_err());
    }

    #[test]
    fn a_ref_cycle_stops_at_the_depth_guard_rather_than_the_stack() {
        let catalog = catalog(json!({
            "lexicon": 1,
            "id": "com.example.thing",
            "defs": {
                "main": {"type": "record", "key": "tid", "record": {
                    "type": "object", "properties": {"field": {"type": "ref", "ref": "#loop"}}
                }},
                "loop": {"type": "object", "properties": {"field": {"type": "ref", "ref": "#loop"}}}
            }
        }));
        let mut nested = json!({});
        for _ in 0..64 {
            nested = json!({"field": nested});
        }
        let error = check_field(&catalog, nested).expect_err("the guard fires");
        assert!(error.reason.contains("nests deeper"), "{error}");
    }

    #[test]
    fn mime_patterns_wildcard_only_the_subtype() {
        assert!(mime_matches("image/*", "image/png"));
        assert!(mime_matches("*/*", "anything/at-all"));
        assert!(mime_matches("text/plain", "text/plain; charset=utf-8"));
        assert!(!mime_matches("image/*", "text/plain"));
        assert!(!mime_matches("image/png", "image/jpeg"));
    }

    #[test]
    fn base64_lengths_are_counted_without_decoding() {
        assert_eq!(decoded_length("b25l"), 3);
        assert_eq!(decoded_length("asdfasdfasdfasdf"), 12);
        assert_eq!(decoded_length("b25lb25l=="), 6);
    }

    #[test]
    fn the_path_names_the_field_that_failed() {
        let catalog = one_field(json!({
            "type": "array",
            "items": {"type": "string", "maxLength": 2}
        }));
        let error = check_field(&catalog, json!(["ok", "ok", "too long"])).expect_err("refused");
        assert_eq!(error.path, "field[2]");
    }
}