From 570188fa1a40987ae97486b1e07122ab66e040ef Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 17 Jul 2026 01:59:17 +0200 Subject: [PATCH] refactor(#2500): make NodeId genuinely opaque via a crate-private field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit argus flagged that `NodeId(pub u64)` contradicted the "opaque" doc — a pub inner field lets callers fabricate `NodeId(42)`. Make the field `pub(crate)` so an id can only originate from the graph's monotonic counter or serde deserialization, never a caller. Tests construct ids in-crate (unaffected); the derived Serialize/Deserialize round-trips fine. Doc keeps "opaque" — now accurate — with a line explaining the enforcement. --- hive-jobq/src/lib.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hive-jobq/src/lib.rs b/hive-jobq/src/lib.rs index b63e125c..4420362b 100644 --- a/hive-jobq/src/lib.rs +++ b/hive-jobq/src/lib.rs @@ -36,10 +36,14 @@ /// is deliberately *not* encoded in the id, so the id never changes as the tree /// grows or collapses. The hierarchical `1/1/2` path used in the UI is derived /// from the parent tree at render time. +/// +/// The inner field is crate-private: an id can only originate from the graph's +/// monotonic counter (or deserialization of a persisted graph), never be +/// fabricated by a caller — that is what makes it opaque. #[derive( Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, serde::Serialize, serde::Deserialize, )] -pub struct NodeId(pub u64); +pub struct NodeId(pub(crate) u64); /// A named counting semaphore. ///