fn check_discriminators(message: &ControlMessage) -> Result<(), CodecError>Expand description
Hold a namespace-plus-name pair to the Full Track Name cap.
Draft-14 Section 2.4.1: “The maximum total length of a Full Track Name is 4,096 bytes, computed as the sum of the lengths of each Track Namespace tuple field and the Track Name length field. If an endpoint receives a Full Track Name exceeding this length, it MUST close the session with a PROTOCOL_VIOLATION.”
The two lengths arrive as separate fields, so neither the namespace decoder nor the name decoder can settle this alone: a namespace at 4,000 bytes and a name at 500 are each legal by themselves. It has to live where a message decodes both.
Draft-14 states no separate cap on a Track Namespace on its own — that sentence arrives in draft-16 — so this pairwise sum is the only bound the draft gives. A control message may be 65,535 bytes, so without it a peer can hand the application a Full Track Name sixteen times the permitted size, and two relays that disagree about whether it was legal disagree about cache identity. Refuse a message whose discriminator disagrees with the fields beside it.
Several draft-14 messages carry a field that says which of the following
fields are on the wire — FETCH’s Fetch Type, SUBSCRIBE’s Filter Type,
SUBSCRIBE_OK’s ContentExists. This codec holds the optional halves in
Options and an enum, so a value can say one thing in its discriminator and
another in its body, and the two sides of the codec resolve that differently:
the encoder writes whatever the body holds, and the decoder reads whatever
the discriminator announces.
The result is a message that does not survive its own round trip. A FETCH whose type says Standalone and whose body is a joining pair encodes to a request id and a start where a namespace and a name belong, and comes back as a Standalone fetch of a track named after two integers — or, more often, as an error, which at least is honest. Refusing at the encoder keeps the two readings from ever diverging on the wire.