ruvector/crates/ruvector-server
rUv eafba64fa5
fix(security): RUSTSEC advisories + clippy hardening in RuVector (#504)
* fix(security): RUSTSEC advisories + clippy hardening in RuVector

- Replace all bare `partial_cmp().unwrap()` calls on f32/f64 with
  `.unwrap_or(Ordering::Equal)` to prevent panics on NaN values in
  sorting/max-by operations across ruvllm, ruvector-dag, prime-radiant,
  and rvagent-wasm (12 sites in production code).
- Add input validation guards to the HTTP search endpoint: reject k=0,
  k > 10_000, empty vectors, and vectors exceeding 65_536 dimensions,
  preventing memory exhaustion via unbounded allocations.
- Harden LocalFsBackend::execute in rvagent-cli with env_clear() +
  safe-env allowlist (SEC-005), deadline-based timeout enforcement, and
  1 MB output truncation, matching the security posture of LocalShellBackend.
- Remove 129 occurrences of the deprecated `unused_unit = "allow"` lint
  and 3 occurrences of the removed `clippy::match_on_vec_items` lint from
  Cargo.toml files workspace-wide; both are no-ops in current Rust/Clippy.
- All 653+ tests across ruvector-core, ruvector-server, ruvector-dag,
  rvagent-cli, and prime-radiant pass with zero failures.

Note: `bytes` is already at 1.11.1 (>= 1.10.0); `paste` 1.0.15 is a
transitive dependency with no semver fix available upstream; `cargo audit`
returns clean.

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(ci): cargo fmt + restore workspace unused_unit lint allow

- Run cargo fmt --all across all 9 files that drifted from rustfmt style
  (prime-radiant/energy.rs, ruvector-dag/bottleneck.rs+reasoning_bank.rs,
   ruvector-server/points.rs, ruvllm/pretrain_pipeline.rs+report.rs+registry.rs,
   rvagent-cli/app.rs, rvagent-wasm/gallery.rs)
- Add [workspace.lints.clippy] unused_unit = "allow" to root Cargo.toml;
  the per-crate entries removed in the security commit were still needed —
  moving to workspace-level is cleaner and restores -D warnings CI pass

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(ci): remove unneeded unit return type in ruvix bench

Removes `-> ()` from the Fn bound in run_benchmark_with_kernel
(crates/ruvix/benches/src/ruvix.rs:50) — triggers clippy::unused_unit
under -D warnings. Clippy prefers `Fn(&mut Kernel)` without explicit
unit return.

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(ci): resolve rustfmt and clippy unused_unit failures

- Run cargo fmt --all to fix long closure formatting in 9 files
  (energy.rs, bottleneck.rs, reasoning_bank.rs, points.rs,
  pretrain_pipeline.rs, report.rs, registry.rs, app.rs, gallery.rs)
- Add unused_unit = "allow" to [lints.clippy] in ruvix-bench and
  ruvector-mincut Cargo.toml files to suppress the unused_unit lint
  that was previously suppressed globally and now fires on two
  Fn(&mut T) -> () and FnMut() -> () function bounds

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-05-23 05:40:24 -04:00
..
src fix(security): RUSTSEC advisories + clippy hardening in RuVector (#504) 2026-05-23 05:40:24 -04:00
Cargo.toml fix(security): RUSTSEC advisories + clippy hardening in RuVector (#504) 2026-05-23 05:40:24 -04:00
package.json feat: Publish 8 new npm packages 2025-12-02 18:44:00 +00:00
README.md docs: Add README files for all crates and update root README with crates table 2025-11-26 18:15:05 +00:00

Ruvector Server

Crates.io Documentation License: MIT Rust

High-performance REST API server for Ruvector vector databases.

ruvector-server provides a production-ready HTTP API built on Axum with CORS support, compression, and OpenAPI documentation. Exposes full Ruvector functionality via RESTful endpoints. Part of the Ruvector ecosystem.

Why Ruvector Server?

  • Fast: Built on Axum and Tokio for high throughput
  • Production Ready: CORS, compression, tracing built-in
  • RESTful API: Standard HTTP endpoints for all operations
  • OpenAPI: Auto-generated API documentation
  • Multi-Collection: Support multiple vector collections

Features

Core Capabilities

  • Vector CRUD: Insert, get, update, delete vectors
  • Search API: k-NN search with filtering
  • Batch Operations: Bulk insert and search
  • Collection Management: Create and manage collections
  • Health Checks: Liveness and readiness probes

Advanced Features

  • CORS Support: Configurable cross-origin requests
  • Compression: GZIP response compression
  • Tracing: Request tracing with tower-http
  • Rate Limiting: Request rate limiting (planned)
  • Authentication: API key auth (planned)

Installation

Add ruvector-server to your Cargo.toml:

[dependencies]
ruvector-server = "0.1.1"

Quick Start

Start Server

use ruvector_server::{Server, ServerConfig};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Configure server
    let config = ServerConfig {
        host: "0.0.0.0".to_string(),
        port: 8080,
        cors_origins: vec!["*".to_string()],
        enable_compression: true,
        ..Default::default()
    };

    // Create and start server
    let server = Server::new(config)?;
    server.run().await?;

    Ok(())
}

API Endpoints

# Health check
GET /health

# Collections
POST   /collections              # Create collection
GET    /collections              # List collections
GET    /collections/{name}       # Get collection info
DELETE /collections/{name}       # Delete collection

# Vectors
POST   /collections/{name}/vectors       # Insert vector(s)
GET    /collections/{name}/vectors/{id}  # Get vector
DELETE /collections/{name}/vectors/{id}  # Delete vector

# Search
POST   /collections/{name}/search        # k-NN search
POST   /collections/{name}/search/batch  # Batch search

Example Requests

# Create collection
curl -X POST http://localhost:8080/collections \
  -H "Content-Type: application/json" \
  -d '{
    "name": "documents",
    "dimensions": 384,
    "distance_metric": "cosine"
  }'

# Insert vector
curl -X POST http://localhost:8080/collections/documents/vectors \
  -H "Content-Type: application/json" \
  -d '{
    "id": "doc-1",
    "vector": [0.1, 0.2, 0.3, ...],
    "metadata": {"title": "Hello World"}
  }'

# Search
curl -X POST http://localhost:8080/collections/documents/search \
  -H "Content-Type: application/json" \
  -d '{
    "vector": [0.1, 0.2, 0.3, ...],
    "k": 10,
    "filter": {"category": "tech"}
  }'

API Overview

Server Configuration

pub struct ServerConfig {
    pub host: String,
    pub port: u16,
    pub cors_origins: Vec<String>,
    pub enable_compression: bool,
    pub max_body_size: usize,
    pub request_timeout: Duration,
}

Response Types

// Search response
pub struct SearchResponse {
    pub results: Vec<SearchResult>,
    pub took_ms: u64,
}

pub struct SearchResult {
    pub id: String,
    pub score: f32,
    pub vector: Option<Vec<f32>>,
    pub metadata: Option<serde_json::Value>,
}

// Collection info
pub struct CollectionInfo {
    pub name: String,
    pub dimensions: usize,
    pub count: usize,
    pub distance_metric: String,
}

Error Handling

// API errors return standard format
pub struct ApiError {
    pub code: String,
    pub message: String,
    pub details: Option<serde_json::Value>,
}

// HTTP status codes:
// 200 - Success
// 201 - Created
// 400 - Bad Request
// 404 - Not Found
// 500 - Internal Error

Docker Deployment

FROM rust:1.77 as builder
WORKDIR /app
COPY . .
RUN cargo build --release -p ruvector-server

FROM debian:bookworm-slim
COPY --from=builder /app/target/release/ruvector-server /usr/local/bin/
EXPOSE 8080
CMD ["ruvector-server"]
docker build -t ruvector-server .
docker run -p 8080:8080 ruvector-server

Documentation

License

MIT License - see LICENSE for details.


Part of Ruvector - Built by rUv

Star on GitHub

Documentation | Crates.io | GitHub