kobako 0.27.0 → 0.29.0

data/crates/kobako-wasmtime/tests/preamble_flags.rs

@@ -0,0 +1,70 @@
+//! A flag the bundled guest does not recognise meets the unrecognised
+//! path: a critical one must refuse the invocation under
+//! its own class, and an advisory one must leave the run untouched.
+
+mod support;
+
+use kobako_runtime::{Completion, Entry, Runtime};
+use kobako_transport::envelope::{Flag, Origin, Outcome, Preamble};
+
+/// The Outcome and what the script printed, or `None` when the Guest
+/// Binary has not been built outside CI. The script prints before it
+/// answers, so empty stdout means it never ran.
+fn eval_with_flag(critical: bool) -> Option<(Outcome, Vec<u8>)> {
+    let driver = support::bundled_driver()?;
+    let mut preamble = Preamble::default();
+    preamble.flags = vec![Flag {
+        name: "no_such_flag".into(),
+        value: String::new(),
+        critical,
+    }];
+
+    let snapshot = driver
+        .invoke(
+            Entry::Eval {
+                source: b"puts 'ran'; 1 + 1",
+            },
+            &preamble,
+            None,
+            &[],
+        )
+        .expect("the invocation must start");
+    let Completion::Outcome(outcome) = snapshot.completion else {
+        panic!("the invocation must answer rather than trap");
+    };
+    Some((outcome, snapshot.stdout.bytes))
+}
+
+// @behavior MR-017
+#[test]
+fn a_critical_flag_the_guest_does_not_recognise_refuses_the_invocation() {
+    let Some((outcome, stdout)) = eval_with_flag(true) else {
+        return;
+    };
+    let Outcome::Panic(panic) = outcome else {
+        panic!("a critical flag the guest does not recognise must answer with a Panic");
+    };
+
+    assert_eq!(
+        (panic.origin, panic.error.name.as_str(), stdout.as_slice()),
+        (Origin::Sandbox, "Kobako::UnsupportedFlagError", &b""[..]),
+        "a critical flag the bundled guest does not recognise through Driver#invoke must \
+         refuse the invocation as the Sandbox's Kobako::UnsupportedFlagError before the \
+         script runs"
+    );
+}
+
+// @behavior MR-018
+#[test]
+fn an_advisory_flag_the_guest_does_not_recognise_is_skipped() {
+    let Some(answer) = eval_with_flag(false) else {
+        return;
+    };
+
+    assert_eq!(
+        answer,
+        (Outcome::Ok(vec![0x02]), b"ran\n".to_vec()),
+        "an advisory flag the bundled guest does not recognise through Driver#invoke must be \
+         skipped, leaving the invocation's value as it would be without the flag"
+    );
+}

data/crates/kobako-wasmtime/tests/snippet_compile.rs

@@ -0,0 +1,95 @@
+//! The bundled guest compiles a Preamble's source snippets on an instance
+//! of their own. What comes back has to replay in a later invocation in
+//! place of the source, under the same flags a replay would apply, and
+//! two compiles of the same Preamble have to agree byte for byte so
+//! either can stand in for the other.
+
+mod support;
+
+use kobako_runtime::{Completion, Entry, Runtime};
+use kobako_transport::envelope::{Flag, Outcome, Preamble, Snippet, Snippets};
+
+use support::bundled_driver as driver;
+
+fn preamble_with(entries: Vec<Snippet>) -> Preamble {
+    let mut preamble = Preamble::default();
+    preamble.snippets = Snippets { entries };
+    preamble
+}
+
+fn greeter() -> Preamble {
+    preamble_with(vec![Snippet::Source {
+        name: "Greeter".into(),
+        body: "module Greeter; def self.hi = 'hi'; end".into(),
+    }])
+}
+
+// @behavior MR-024
+#[test]
+fn compiled_snippets_replay_in_a_later_invocation() {
+    let Some(driver) = driver() else {
+        return;
+    };
+    let bytecodes = driver
+        .compile(&greeter())
+        .expect("a source snippet that parses must compile");
+    let replay = preamble_with(
+        bytecodes
+            .into_iter()
+            .map(|body| Snippet::Bytecode { body })
+            .collect(),
+    );
+
+    let snapshot = driver
+        .invoke(
+            Entry::Eval {
+                source: b"Greeter.hi",
+            },
+            &replay,
+            None,
+            &[],
+        )
+        .expect("the invocation must start");
+
+    assert!(
+        matches!(snapshot.completion, Completion::Outcome(Outcome::Ok(ref value)) if value == b"\xa2hi"),
+        "bytecode from Driver#compile, sent back as bytecode snippets, must define what the \
+         source did for a later invocation"
+    );
+}
+
+// @behavior MR-023
+#[test]
+fn compiling_the_same_preamble_twice_yields_the_same_bytes() {
+    let Some(driver) = driver() else {
+        return;
+    };
+
+    assert_eq!(
+        driver.compile(&greeter()),
+        driver.compile(&greeter()),
+        "the same Preamble through Driver#compile on two fresh instances must answer \
+         byte-identical bytecode"
+    );
+}
+
+// @behavior MR-025
+#[test]
+fn a_critical_flag_the_guest_does_not_recognise_leaves_nothing_compiled() {
+    let Some(driver) = driver() else {
+        return;
+    };
+    let mut preamble = greeter();
+    preamble.flags = vec![Flag {
+        name: "no_such_flag".into(),
+        value: String::new(),
+        critical: true,
+    }];
+
+    assert_eq!(
+        driver.compile(&preamble),
+        None,
+        "a critical flag the bundled guest does not recognise through Driver#compile must \
+         leave nothing compiled, since compiling applies the flags a replay would"
+    );
+}

data/crates/kobako-wasmtime/tests/support/mod.rs

@@ -0,0 +1,30 @@
+//! The bundled Guest Binary every integration test drives.
+
+use std::path::Path;
+use std::time::Duration;
+
+use kobako_runtime::Profile;
+use kobako_wasmtime::{Config, Driver};
+
+const WASM: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/../../data/kobako.wasm");
+
+/// A driver over the bundled Guest Binary, or `None` when it has not
+/// been built outside CI, where a missing build is a failure instead.
+pub fn bundled_driver() -> Option<Driver> {
+    if !Path::new(WASM).exists() {
+        assert!(
+            std::env::var_os("CI").is_none(),
+            "data/kobako.wasm missing under CI — run `bundle exec rake wasm:build`"
+        );
+        return None;
+    }
+    let mut config = Config::default();
+    config.timeout = Some(Duration::from_secs(10));
+    config.setup_timeout = Some(Duration::from_secs(10));
+    config.memory_limit = None;
+    config.stdout_limit = None;
+    config.stderr_limit = None;
+    config.open_file_limit = None;
+    config.profile = Profile::Hermetic;
+    Some(Driver::new(Path::new(WASM), config).expect("the Guest Binary must load"))
+}

data/crates/kobako-wasmtime/tests/unanswered_call.rs

@@ -0,0 +1,86 @@
+//! A Call the host could not answer as the Service meant still reaches the
+//! guest as an answer it can rescue, and the answer says why. The default
+//! frontends never hand the driver either failure, so only a handler
+//! written here reaches them.
+
+mod support;
+
+use std::sync::Arc;
+
+use kobako_runtime::{Completion, DispatchHandler, Entry, Runtime, Yielder};
+use kobako_transport::envelope::{Bindings, Call, Outcome, Preamble, Reply};
+
+/// Answers every Call with one byte more than a message carries.
+struct AnswersTooMuch;
+
+impl DispatchHandler for AnswersTooMuch {
+    fn dispatch(&self, _call: Call<'_>, _yielder: &mut dyn Yielder) -> Option<Reply> {
+        Some(Reply::Ok(vec![0xc0; (16 << 20) + 1]))
+    }
+}
+
+/// Breaks the handler contract by answering nothing.
+struct AnswersNothing;
+
+impl DispatchHandler for AnswersNothing {
+    fn dispatch(&self, _call: Call<'_>, _yielder: &mut dyn Yielder) -> Option<Reply> {
+        None
+    }
+}
+
+fn eval_against(handler: Arc<dyn DispatchHandler>, source: &[u8]) -> Option<Outcome> {
+    let driver = support::bundled_driver()?;
+    let mut preamble = Preamble::default();
+    preamble.bindings = Bindings {
+        paths: vec!["Svc".into()],
+    };
+    let snapshot = driver
+        .invoke(Entry::Eval { source }, &preamble, Some(handler), &[])
+        .expect("the invocation must start");
+    let Completion::Outcome(outcome) = snapshot.completion else {
+        panic!("the invocation must answer rather than trap");
+    };
+    Some(outcome)
+}
+
+// @behavior T-286
+#[test]
+fn an_answer_larger_than_a_message_raises_a_service_failure_naming_the_limit() {
+    let source = b"begin; Svc.go; rescue Kobako::ServiceError => e; e.message; end";
+    let Some(outcome) = eval_against(Arc::new(AnswersTooMuch), source) else {
+        return;
+    };
+
+    let mut expected = vec![0xd9, 0x4e];
+    expected.extend_from_slice(
+        b"Sandbox could not write the Service's answer: payload exceeds the 16 MiB limit",
+    );
+    assert_eq!(
+        outcome,
+        Outcome::Ok(expected),
+        "a Service answer past the message cap through Driver#invoke must raise a Service \
+         failure in the guest naming the limit"
+    );
+}
+
+// @behavior T-287
+#[test]
+fn a_call_the_host_could_not_answer_raises_a_transport_error_naming_why() {
+    let source = b"begin; Svc.go; rescue Kobako::Transport::Error => e; e.message; end";
+    let Some(outcome) = eval_against(Arc::new(AnswersNothing), source) else {
+        return;
+    };
+
+    let mut expected = vec![0xd9, 0x6a];
+    expected.extend_from_slice(
+        "a Sandbox callback raised an exception instead of returning a fault — please report \
+         this as a kobako bug"
+            .as_bytes(),
+    );
+    assert_eq!(
+        outcome,
+        Outcome::Ok(expected),
+        "a Call a handler answered with nothing through Driver#invoke must raise \
+         Kobako::Transport::Error in the guest naming why"
+    );
+}

data/crates/kobako-wasmtime/tests/unsupported_call.rs

@@ -0,0 +1,51 @@
+//! A host frontend of its own may answer a guest's Call as unsupported;
+//! the bundled guest must then hand its script a refusal it can rescue,
+//! rather than a broken exchange. The default frontends serve every Call,
+//! so only a handler written here reaches that answer.
+
+mod support;
+
+use std::sync::Arc;
+
+use kobako_runtime::{Completion, DispatchHandler, Entry, Runtime, Yielder};
+use kobako_transport::envelope::{Bindings, Call, Outcome, Preamble, Reply, Unsupported};
+
+struct ServesNoCall;
+
+impl DispatchHandler for ServesNoCall {
+    fn dispatch(&self, _call: Call<'_>, _yielder: &mut dyn Yielder) -> Option<Reply> {
+        Some(Reply::Unsupported(Unsupported::new("no calls here")))
+    }
+}
+
+// @behavior T-279
+#[test]
+fn a_call_the_host_does_not_serve_raises_unsupported_error_in_the_guest() {
+    let Some(driver) = support::bundled_driver() else {
+        return;
+    };
+    let mut preamble = Preamble::default();
+    preamble.bindings = Bindings {
+        paths: vec!["Svc".into()],
+    };
+    let source = b"begin; Svc.go; rescue Kobako::UnsupportedError => e; e.message; end";
+
+    let snapshot = driver
+        .invoke(
+            Entry::Eval { source },
+            &preamble,
+            Some(Arc::new(ServesNoCall)),
+            &[],
+        )
+        .expect("the invocation must start");
+
+    let Completion::Outcome(outcome) = snapshot.completion else {
+        panic!("the invocation must answer rather than trap");
+    };
+    assert_eq!(
+        outcome,
+        Outcome::Ok(b"\xadno calls here".to_vec()),
+        "a Service call answered as unsupported through Driver#invoke must raise \
+         Kobako::UnsupportedError carrying the host's message"
+    );
+}

data/ext/kobako/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kobako"
-version = "0.27.0"
+version = "0.29.0"
 edition = "2021"
 authors = ["Aotokitsuruya <contact@aotoki.me>"]
 license = "Apache-2.0"
@@ -10,7 +10,9 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-magnus = { version = "0.8.2", features = ["rb-sys"] }
+# 0.9.3 keeps `$!` when Rust catches an exception, which a Filesystem or
+# Service callback running while Ruby handles one would otherwise clear.
+magnus = { version = "0.9.3", features = ["rb-sys"] }
 # Raw Ruby FFI for the GVL release/re-acquire calls magnus does not wrap
 # (`rb_thread_call_without_gvl` / `rb_thread_call_with_gvl`). Pinned to the
 # rb-sys magnus resolves so both share one binding instance.