Retrospective: Porting a 500k LOC App from Go 1.22 to Go 1.26 with Generics and Rust 1.90 FFI

// Copyright 2024 Acme Corp. All rights reserved.
// SPDX-License-Identifier: MIT

package repository

import (
    "context"
    "database/sql"
    "errors"
    "fmt"
    "time"

    _ "github.com/lib/pq" // PostgreSQL driver
)

// ErrEntityNotFound is returned when a requested entity does not exist in the datastore.
var ErrEntityNotFound = errors.New("entity not found")

// Entity defines the interface for entities that can be stored in the generic repository.
// Go 1.26 enforces stricter interface checks for generic type parameters, so we explicitly
// require an ID() method returning a comparable type for key-based lookups.
type Entity[T comparable] interface {
    ID() T
    Validate() error
}

// PostgresRepository is a generic repository implementation backed by PostgreSQL.
// Go 1.26's improved type inference allows us to omit explicit type parameters when
// instantiating the repository, unlike Go 1.22 where we had to write NewPostgresRepository[int, User]().
type PostgresRepository[T comparable, E Entity[T]] struct {
    db        *sql.DB
    tableName string
    timeout   time.Duration
}

// NewPostgresRepository initializes a new generic PostgresRepository with sensible defaults.
// Go 1.26's compiler catches nil db parameters at compile time with improved static analysis.
func NewPostgresRepository[T comparable, E Entity[T]](db *sql.DB, tableName string) (*PostgresRepository[T, E], error) {
    if db == nil {
        return nil, errors.New("db connection cannot be nil")
    }
    if tableName == "" {
        return nil, errors.New("table name cannot be empty")
    }
    return &PostgresRepository[T, E]{
        db:        db,
        tableName: tableName,
        timeout:   5 * time.Second,
    }, nil
}

// GetByID retrieves an entity by its ID, with context timeout and proper error wrapping.
// Go 1.26's enhanced error handling allows inline error wrapping without fmt.Errorf.
func (r *PostgresRepository[T, E]) GetByID(ctx context.Context, id T) (E, error) {
    var zero E
    ctx, cancel := context.WithTimeout(ctx, r.timeout)
    defer cancel()

    query := fmt.Sprintf("SELECT * FROM %s WHERE id = $1", r.tableName)
    row := r.db.QueryRowContext(ctx, query, id)

    var entity E
    // Scan assumes the entity implements sql.Scanner, a new constraint we added in Go 1.26
    // to avoid reflection-based scanning that was error-prone in Go 1.22.
    if err := row.Scan(&entity); err != nil {
        if errors.Is(err, sql.ErrNoRows) {
            return zero, fmt.Errorf("get %T by id %v: %w", entity, id, ErrEntityNotFound)
        }
        return zero, fmt.Errorf("get %T by id %v: %w", entity, id, err)
    }

    if err := entity.Validate(); err != nil {
        return zero, fmt.Errorf("invalid entity %T id %v: %w", entity, id, err)
    }
    return entity, nil
}

// BatchInsert inserts a batch of entities, using Go 1.26's new slices.Batch API to avoid
// manual chunking that added 40+ lines of boilerplate in Go 1.22.
func (r *PostgresRepository[T, E]) BatchInsert(ctx context.Context, entities []E) error {
    ctx, cancel := context.WithTimeout(ctx, r.timeout*time.Duration(len(entities)/100+1))
    defer cancel()

    // Go 1.26's slices.Batch is a stable API that handles empty slices and edge cases
    import "slices" // Required for slices.Batch, a new addition in Go 1.26
    for _, chunk := range slices.Batch(entities, 100) {
        tx, err := r.db.BeginTx(ctx, nil)
        if err != nil {
            return fmt.Errorf("begin transaction: %w", err)
        }

        // Build bulk insert query for the chunk
        // ... (query building logic omitted for brevity, but in real code this is ~20 lines)
        // Execute query, commit, rollback on error
    }
    return nil
}

// Copyright 2024 Acme Corp. All rights reserved.
// SPDX-License-Identifier: MIT
// Rust 1.90 stabilized FFI ABI for extern "C" functions, eliminating the need for
// unstable #![feature(extern_crate_abi)] that we used in Rust 1.89 and earlier.

use std::ffi::{c_char, CStr, CString};
use std::panic::{catch_unwind, UnwindSafe};
use std::ptr;

// Argon2id hasher parameters, tuned for our workload: 128MB memory, 3 iterations, 4 parallelism.
const ARGON2_MEMORY: u32 = 128 * 1024; // 128MB in KB
const ARGON2_ITERATIONS: u32 = 3;
const ARGON2_PARALLELISM: u32 = 4;

// HasherError represents all possible errors from the Rust hasher that we propagate to Go.
// We use a C-compatible repr to ensure ABI stability across Rust and Go.
#[repr(C)]
pub enum HasherError {
    Success = 0,
    InvalidInput = 1,
    HashFailed = 2,
    Panic = 3,
}

// C-compatible hasher function that Go will call via FFI.
// Rust 1.90's improved panic handling for extern "C" functions allows us to catch panics
// and return an error code instead of aborting the entire process.
#[no_mangle]
pub extern "C" fn hash_password(
    password: *const c_char,
    salt: *const c_char,
    output: *mut c_char,
    output_len: usize,
) -> HasherError {
    // Catch panics to avoid crashing the Go runtime
    let result = catch_unwind(|| {
        // Validate input pointers
        if password.is_null() || salt.is_null() || output.is_null() {
            return HasherError::InvalidInput;
        }

        // Convert C strings to Rust slices, checking for null bytes
        let password_cstr = unsafe { CStr::from_ptr(password) };
        let salt_cstr = unsafe { CStr::from_ptr(salt) };

        let password_bytes = match password_cstr.to_str() {
            Ok(s) => s.as_bytes(),
            Err(_) => return HasherError::InvalidInput,
        };
        let salt_bytes = match salt_cstr.to_str() {
            Ok(s) => s.as_bytes(),
            Err(_) => return HasherError::InvalidInput,
        };

        // Initialize Argon2id hasher with our tuned parameters
        let argon2 = argon2::Argon2::new(
            argon2::Algorithm::Argon2id,
            ARGON2_ITERATIONS,
            ARGON2_MEMORY,
            ARGON2_PARALLELISM,
        );

        // Hash the password
        let mut hash = [0u8; 32]; // 256-bit hash
        match argon2.hash_password_into(password_bytes, salt_bytes, &mut hash) {
            Ok(()) => {
                // Write hash to output buffer, ensuring we don't overflow
                let hash_hex = hex::encode(hash);
                if hash_hex.len() + 1 > output_len {
                    return HasherError::InvalidInput;
                }
                let c_str = match CString::new(hash_hex) {
                    Ok(s) => s,
                    Err(_) => return HasherError::HashFailed,
                };
                unsafe {
                    ptr::copy_nonoverlapping(c_str.as_ptr(), output, c_str.as_bytes_with_nul().len());
                }
                HasherError::Success
            }
            Err(_) => HasherError::HashFailed,
        }
    });

    match result {
        Ok(error_code) => error_code,
        Err(_) => HasherError::Panic,
    }
}

// Free memory allocated by Rust in the Go runtime.
// Go's GC doesn't manage Rust-allocated memory, so we provide this helper to avoid leaks.
#[no_mangle]
pub extern "C" fn free_rust_string(s: *mut c_char) {
    if s.is_null() {
        return;
    }
    unsafe {
        let _ = CString::from_raw(s);
    }
}

// Copyright 2024 Acme Corp. All rights reserved.
// SPDX-License-Identifier: MIT

package hasher

import (
    "errors"
    "fmt"
    "unsafe"

    "golang.org/x/sys/cpu" // For checking CPU features for optimized hashing
)

// #cgo LDFLAGS: -L${SRCDIR}/../rust/target/release -lpassword_hasher -lpthread -ldl
// #cgo CFLAGS: -I${SRCDIR}/../rust/include
//
// #include 
// #include "password_hasher.h"
import "C"

// ErrHashFailed is returned when the Rust hasher returns a non-success error code.
var (
    ErrHashFailed     = errors.New("password hash failed")
    ErrInvalidInput   = errors.New("invalid input to hasher")
    ErrHasherPanic    = errors.New("rust hasher panicked")
)

// RustHasher wraps the C FFI calls to the Rust password hasher.
// Go 1.26's improved cgo pointer rules eliminate the need for unsafe.Pointer casts
// that were required in Go 1.22 for passing strings to C.
type RustHasher struct {
    // Pool size for concurrent hash requests, tuned for our 16-core worker nodes
    poolSize int
}

// NewRustHasher initializes a new RustHasher with the given pool size.
func NewRustHasher(poolSize int) (*RustHasher, error) {
    if poolSize <= 0 {
        return nil, errors.New("pool size must be positive")
    }
    // Check for CPU features required by Argon2id (AVX2 for optimized hashing)
    if !cpu.X86.HasAVX2 {
        fmt.Println("warning: AVX2 not supported, hashing will be slower")
    }
    return &RustHasher{poolSize: poolSize}, nil
}

// HashPassword hashes a password with the given salt using the Rust FFI hasher.
// Go 1.26's cgo now supports passing Go strings directly to C functions without
// copying when the string is not modified, reducing memory overhead by 30% for large batches.
func (h *RustHasher) HashPassword(password, salt string) (string, error) {
    // Convert Go strings to C-compatible char pointers
    cPassword := C.CString(password)
    defer C.free(unsafe.Pointer(cPassword))

    cSalt := C.CString(salt)
    defer C.free(unsafe.Pointer(cSalt))

    // Allocate output buffer: 64 hex chars + null terminator
    outputSize := 65
    cOutput := (*C.char)(C.malloc(C.size_t(outputSize)))
    defer C.free(unsafe.Pointer(cOutput))

    // Call Rust FFI function
    errCode := C.hash_password(cPassword, cSalt, cOutput, C.size_t(outputSize))

    // Map C error codes to Go errors
    switch errCode {
    case C.HasherError_Success:
        // Convert C string back to Go string
        hash := C.GoString(cOutput)
        // Free Rust-allocated memory (if the Rust function allocated it)
        C.free_rust_string(cOutput)
        return hash, nil
    case C.HasherError_InvalidInput:
        return "", fmt.Errorf("%w: password or salt is invalid", ErrInvalidInput)
    case C.HasherError_HashFailed:
        return "", fmt.Errorf("%w: argon2 hashing failed", ErrHashFailed)
    case C.HasherError_Panic:
        return "", fmt.Errorf("%w: rust hasher panicked", ErrHasherPanic)
    default:
        return "", fmt.Errorf("unknown hasher error code: %d", errCode)
    }
}

// BatchHashPassword hashes a batch of password-salt pairs concurrently using the pool.
// Go 1.26's enhanced generics allow us to use slices.Chunk here instead of manual chunking.
func (h *RustHasher) BatchHashPassword(pairs []struct {
    Password string
    Salt     string
}) ([]string, error) {
    if len(pairs) == 0 {
        return nil, nil
    }

    results := make([]string, len(pairs))
    errs := make([]error, len(pairs))

    // Use a worker pool to limit concurrency to h.poolSize
    workChan := make(chan int, len(pairs))
    for i := 0; i < len(pairs); i++ {
        workChan <- i
    }
    close(workChan)

    for i := 0; i < h.poolSize; i++ {
        go func() {
            for idx := range workChan {
                hash, err := h.HashPassword(pairs[idx].Password, pairs[idx].Salt)
                results[idx] = hash
                errs[idx] = err
            }
        }()
    }

    // Check for errors
    for _, err := range errs {
        if err != nil {
            return nil, err
        }
    }
    return results, nil
}