@bevel-software/platform-core-backend 0.29.0 → 0.31.0

package/dist/modules/access/access-control.service.js

@@ -3,9 +3,10 @@ import path from 'node:path';
 import { logger } from '../../shared/logging.js';
 const log = logger('access');
 import { isAbsence } from '../../shared/fs.contract.js';
-import { assertOneSpecPerLine, isGitTimeout } from '../../shared/git.contract.js';
+import { assertOneSpecPerLine, isCommitSha, isGitTimeout } from '../../shared/git.contract.js';
 import { hashEmail } from '../../shared/email-identity.js';
 import { NodeGitRunner } from '../workflow/git/node-git-runner.js';
+import { readRevSha } from '../kb-fs/index.js';
 import { DEFAULT_KB_LAYOUT, PLUGIN_MANIFEST_FILE, isPersonalPluginDir, pluginIdentityOf, platformRestoreDestination, } from '@bevel-software/platform-shared';
 import { AccessConfigError, AccessUnreadableError } from '../access-model/access-errors.js';
 import { synthesizePluginPrincipals } from '../access-model/plugin-principals.js';
@@ -1143,6 +1144,24 @@ export class AccessControlService {
     atRefNoRoles = new Set();
     atRefInFlight = new Map();
     static AT_REF_CACHE_MAX = 512;
+    /**
+     * A path's own access entries AT A COMMIT, keyed by commit + path. A blob
+     * at a commit never changes, so neither does what it declares for itself:
+     * no TTL, no invalidation, and no workspace in the key (every clone holds
+     * the same objects). This is the read every at-ref gate makes after the
+     * model: one `cat-file --batch` per call for the paths asked, which a
+     * change-request listing made once per ref per listing for the same paths
+     * at the same commits. Bounded FIFO; the bound only caps memory.
+     */
+    ownEntriesAtCommit = new Map();
+    static OWN_ENTRIES_AT_COMMIT_MAX = 16_384;
+    /** Paths a cached model keeps of its commit's tree, at most; a larger tree is not kept. */
+    static TREE_INDEX_MAX_PATHS = 20_000;
+    /** Paths held across every cached model's tree, at most; past it the oldest models let their tree go. */
+    static TREE_INDEX_BUDGET = 500_000;
+    treeIndexMaxPaths;
+    treeIndexBudget;
+    treePathsHeld = 0;
     /**
      * Canonicalised deployment-owner emails (see `AccessModel.deploymentOwners`).
      * Held on the service rather than read per-model because it comes from the
@@ -1171,13 +1190,22 @@ export class AccessControlService {
      * `deploymentOwners`: the fixtures that construct this service directly
      * run on the default layout.
      */
-    kb = { layout: DEFAULT_KB_LAYOUT }) {
+    kb = { layout: DEFAULT_KB_LAYOUT }, 
+    /**
+     * How much of the commits' trees the at-ref models may hold (see
+     * `TREE_INDEX_MAX_PATHS`, `TREE_INDEX_BUDGET`). The defaults are the
+     * deployment's; a suite lowers them to reach the bounds with a small
+     * repository.
+     */
+    limits = {}) {
         this.workspaceService = workspaceService;
         this.kbDirName = kbDirName;
         this.disk = disk;
         this.gitRunner = gitRunner;
         this.kb = kb;
         this.deploymentOwners = new Set(deploymentOwners.filter(Boolean).map((e) => canonicalEmail(e)));
+        this.treeIndexMaxPaths = limits.treeIndexMaxPaths ?? AccessControlService.TREE_INDEX_MAX_PATHS;
+        this.treeIndexBudget = limits.treeIndexBudget ?? AccessControlService.TREE_INDEX_BUDGET;
     }
     /**
      * Drop a workspace's cached model + frontmatter memo. Call after operations
@@ -1292,6 +1320,24 @@ export class AccessControlService {
         });
         return result;
     }
+    async groupsOfUser(workspaceId, userEmail) {
+        const model = await this.loadModel(workspaceId);
+        const email = canonicalEmail(userEmail);
+        const names = [];
+        for (const principal of model.roles.byCanonical.values()) {
+            if (principal.kind === 'group' && principal.emails.has(email))
+                names.push(principal.displayName);
+        }
+        return names;
+    }
+    async visibleGroups(workspaceId, userEmail, groups) {
+        if (groups.length === 0)
+            return [];
+        if (await this.holdsAdminRootWrite(workspaceId, userEmail))
+            return [...groups];
+        const mine = new Set(await this.groupsOfUser(workspaceId, userEmail));
+        return groups.filter((g) => mine.has(g));
+    }
     async canWriteBatch(workspaceId, userEmail, relativePaths) {
         const model = await this.loadModel(workspaceId);
         const repoDir = await this.repoDir(workspaceId);
@@ -1670,7 +1716,7 @@ export class AccessControlService {
         if (!loaded)
             return null;
         const repoDir = await this.repoDir(workspaceId);
-        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath);
+        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath, loaded.tree);
         return hasPermissionResolved(loaded.model, 'write', userEmail, relativePath, own);
     }
     async canReadAtRef(workspaceId, ref, userEmail, relativePath) {
@@ -1678,7 +1724,7 @@ export class AccessControlService {
         if (!loaded)
             return null;
         const repoDir = await this.repoDir(workspaceId);
-        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath);
+        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath, loaded.tree);
         return canReadResolved(loaded.model, userEmail, relativePath, own);
     }
     async canWriteBatchAtRef(workspaceId, ref, userEmail, relativePaths) {
@@ -1698,7 +1744,7 @@ export class AccessControlService {
         const repoDir = await this.repoDir(workspaceId);
         // One `git cat-file --batch` for the whole path set — a per-path `git
         // show` spawn made CR owner-routing take minutes on large change sets.
-        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths);
+        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths, loaded.tree);
         const result = new Map();
         for (const p of relativePaths) {
             const machineOwned = machineAnswers.get(p);
@@ -1715,7 +1761,7 @@ export class AccessControlService {
             return null;
         const repoDir = await this.repoDir(workspaceId);
         // One `git cat-file --batch` for the whole set — see canWriteBatchAtRef.
-        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths);
+        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths, loaded.tree);
         const result = new Map();
         for (const p of relativePaths) {
             result.set(p, canReadResolved(loaded.model, userEmail, p, owns.get(p) ?? null));
@@ -1734,7 +1780,7 @@ export class AccessControlService {
         if (!loaded)
             return null;
         const repoDir = await this.repoDir(workspaceId);
-        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath);
+        const own = await this.readOwnEntriesAtRef(repoDir, loaded.resolvedRef, relativePath, loaded.tree);
         return eligibleHoldersResolved(loaded.model, 'write', relativePath, own);
     }
     async holdsAdminRootWrite(workspaceId, userEmail) {
@@ -1826,7 +1872,7 @@ export class AccessControlService {
             return null;
         const repoDir = await this.repoDir(workspaceId);
         // One `git cat-file --batch` for the whole path set — see canWriteBatchAtRef.
-        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths);
+        const owns = await this.readOwnEntriesAtRefBatch(repoDir, loaded.resolvedRef, relativePaths, loaded.tree);
         for (const p of relativePaths) {
             if (result.has(p))
                 continue;
@@ -2021,9 +2067,14 @@ export class AccessControlService {
      * grant themselves rights by editing a file's frontmatter in a branch the
      * gate isn't reading from.
      */
-    async readOwnEntriesAtRef(repoDir, ref, relativePath) {
+    async readOwnEntriesAtRef(repoDir, ref, relativePath, tree = null) {
         if (relativePath === 'roles.yaml')
             return null;
+        // At a commit (what every gate passes: `resolvedRef`), the batched read
+        // and its memo answer; a single `git show` stays for a symbolic ref.
+        if (isCommitSha(ref)) {
+            return (await this.readOwnEntriesAtRefBatch(repoDir, ref, [relativePath], tree)).get(relativePath) ?? null;
+        }
         const text = await this.showAtRef(repoDir, ref, relativePath);
         if (text === null)
             return null;
@@ -2039,13 +2090,31 @@ export class AccessControlService {
      * `access.md`/`roles.yaml` (which carry no own-entries) resolve to null,
      * mirroring the single-path helper.
      */
-    async readOwnEntriesAtRefBatch(repoDir, ref, relativePaths) {
+    async readOwnEntriesAtRefBatch(repoDir, ref, relativePaths, tree = null) {
         const result = new Map();
         const wanted = [];
+        const memo = isCommitSha(ref) ? this.ownEntriesAtCommit : null;
         for (const p of relativePaths) {
-            if (p === 'roles.yaml')
+            if (p === 'roles.yaml') {
+                result.set(p, null);
+                continue;
+            }
+            const key = `${ref}\0${p}`;
+            if (memo?.has(key)) {
+                result.set(p, memo.get(key) ?? null);
+                continue;
+            }
+            // A path the commit's tree does not carry has no own entries, as a
+            // fact about the commit: remembered, and not read. (A change request
+            // that adds a file asks about it at the base, where it does not exist
+            // yet; one that deletes a file asks at the head.)
+            if (tree && !tree.has(p)) {
                 result.set(p, null);
-            else if (!wanted.includes(p))
+                if (memo)
+                    this.rememberOwnEntriesAtCommit(key, null);
+                continue;
+            }
+            if (!wanted.includes(p))
                 wanted.push(p);
         }
         if (wanted.length === 0)
@@ -2053,13 +2122,30 @@ export class AccessControlService {
         const texts = await catFileBatch(this.gitRunner, repoDir, wanted.map((p) => `${ref}:${p}`));
         wanted.forEach((p, i) => {
             const text = texts[i];
-            if (text === null)
+            if (text === null) {
+                // Absent at the commit (when no tree was there to say so first), or
+                // a blob git could not read: the batch says "missing" for both, and
+                // only the first is a fact about the commit. Answered as no own
+                // entries, as before, but never remembered.
                 result.set(p, null);
-            else
-                result.set(p, isAccessMdPath(p) ? accessMdSelfEntries(text) : parseOwnAccessEntries(text));
+                return;
+            }
+            const own = isAccessMdPath(p) ? accessMdSelfEntries(text) : parseOwnAccessEntries(text);
+            result.set(p, own);
+            // What a blob declares for itself — including nothing — is a fact about the commit.
+            if (memo)
+                this.rememberOwnEntriesAtCommit(`${ref}\0${p}`, own);
         });
         return result;
     }
+    rememberOwnEntriesAtCommit(key, value) {
+        this.ownEntriesAtCommit.set(key, value);
+        if (this.ownEntriesAtCommit.size > AccessControlService.OWN_ENTRIES_AT_COMMIT_MAX) {
+            const oldest = this.ownEntriesAtCommit.keys().next().value;
+            if (oldest !== undefined)
+                this.ownEntriesAtCommit.delete(oldest);
+        }
+    }
     /**
      * Resolve a candidate ref to one git accepts. Falls back to `origin/<ref>`
      * for short branch names, matching the heuristic in
@@ -2115,6 +2201,7 @@ export class AccessControlService {
             const { stdout } = await this.gitRunner.run(repoDir, ['ls-tree', '-r', '-z', '--name-only', ref]);
             const out = [];
             const pluginDirs = [];
+            const all = [];
             // The fixed-name sources the tree carries (roles.yaml, the groups
             // files): a read of one of these that comes back empty is "absent"
             // only when the tree does not name it.
@@ -2123,6 +2210,9 @@ export class AccessControlService {
             for (const p of stdout.split('\0')) {
                 if (!p)
                     continue;
+                // One past the cap is enough to know the tree is not kept.
+                if (all.length <= this.treeIndexMaxPaths)
+                    all.push(p);
                 if (p === 'access.md' || p.endsWith('/access.md'))
                     out.push(p);
                 else if (p === 'roles.yaml' || p === SYNCED_GROUPS_YAML || p === GROUPS_YAML)
@@ -2131,7 +2221,7 @@ export class AccessControlService {
                     pluginDirs.push(p.slice(0, -(PLUGIN_MANIFEST_FILE.length + 1)));
                 }
             }
-            return { accessFiles: out, pluginDirs, named };
+            return { accessFiles: out, pluginDirs, named, all };
         }
         catch {
             return 'error';
@@ -2212,6 +2302,16 @@ export class AccessControlService {
     async revParseCommit(repoDir, ref) {
         if (!ref || ref.startsWith('-'))
             return null;
+        // The ref files first (`readRevSha`): the names git would try, in git's
+        // order, read without a process. "Missing" from the files is what
+        // rev-parse answers nothing for; "unreadable" — a spelling the reader
+        // does not resolve, a tag it cannot peel, a file it could not read — is
+        // git's to decide, as the authority.
+        const fromFiles = await readRevSha(repoDir, ref);
+        if (fromFiles === 'missing')
+            return null;
+        if (fromFiles !== 'unreadable')
+            return fromFiles.sha;
         try {
             const { stdout } = await this.gitRunner.run(repoDir, [
                 'rev-parse',
@@ -2233,10 +2333,24 @@ export class AccessControlService {
     }
     rememberAtRef(key, value) {
         this.atRefCache.set(key, value);
+        this.treePathsHeld += value.tree?.size ?? 0;
         if (this.atRefCache.size > AccessControlService.AT_REF_CACHE_MAX) {
             const oldest = this.atRefCache.keys().next().value;
-            if (oldest !== undefined)
+            if (oldest !== undefined) {
+                this.treePathsHeld -= this.atRefCache.get(oldest)?.tree?.size ?? 0;
                 this.atRefCache.delete(oldest);
+            }
+        }
+        // The trees are a budget of their own, across every held model: past
+        // it, the oldest models keep their model and let their tree go — the
+        // gate still answers, absence is just no longer remembered for them.
+        for (const held of this.atRefCache.values()) {
+            if (this.treePathsHeld <= this.treeIndexBudget)
+                break;
+            if (!held.tree)
+                continue;
+            this.treePathsHeld -= held.tree.size;
+            held.tree = null;
         }
     }
     rememberNoRolesAtRef(key) {
@@ -2401,6 +2515,10 @@ export class AccessControlService {
                 deploymentOwners: this.deploymentOwners,
             },
             resolvedRef: commit,
+            // The listing already named every path; held so an own-entries read
+            // can tell absence from a lost blob, unless the tree is too large to
+            // hold for every cached commit (then absence is simply not remembered).
+            tree: listed.all.length <= this.treeIndexMaxPaths ? new Set(listed.all) : null,
         };
     }
 }