@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/app-shutdown.test.js

@@ -408,6 +408,126 @@ async function testAppShutdownExitAfterPhasesExits() {
         failRun && failRun.code === 1 && failRun.signal === null);
 }
 
+async function testAppShutdownPidLock() {
+  // Single-instance file lock. Verifies the advertised contract: acquire
+  // writes our PID + creates the file, a LIVE foreign holder refuses the
+  // acquire, release removes the file, and a stale lock (dead holder) is
+  // reaped + re-acquired. The cross-process refusal is exercised with a
+  // real child process because a second handle in THIS process shares our
+  // PID and is treated as self (the guard keys off `pid !== process.pid`).
+  var fs   = helpers.fs;
+  var os   = helpers.os;
+  var path = helpers.path;
+  var cp   = require("node:child_process");
+  var dir      = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-pidlock-"));
+  var lockPath = path.join(dir, "svc.pid");
+
+  // Config-time tier: empty path rejected at construction.
+  var badThrew = null;
+  try { b.appShutdown.pidLock(""); } catch (e) { badThrew = e; }
+  check("pidLock: empty path rejected at construction",
+        badThrew && badThrew.code === "app-shutdown/bad-pidlock-path");
+
+  var lock  = b.appShutdown.pidLock(lockPath);
+  var child = null;
+  try {
+    check("pidLock: path exposed on handle",       lock.path === lockPath);
+    check("pidLock: held() false before acquire",  lock.held() === false);
+
+    // Fresh acquire writes our PID and creates the lock file.
+    lock.acquire();
+    check("pidLock: held() true after acquire",    lock.held() === true);
+    check("pidLock: lock file created",            fs.existsSync(lockPath) === true);
+    check("pidLock: file records our PID",
+          parseInt(fs.readFileSync(lockPath, "utf8").trim(), 10) === process.pid);
+
+    // Owner re-acquire is a no-op (idempotent).
+    lock.acquire();
+    check("pidLock: owner re-acquire is a no-op",  lock.held() === true);
+
+    // Release removes the file and drops ownership.
+    lock.release();
+    check("pidLock: held() false after release",   lock.held() === false);
+    check("pidLock: file removed on release",      fs.existsSync(lockPath) === false);
+
+    // A LIVE foreign PID holding the lock must refuse a fresh acquire.
+    child = cp.spawn(process.execPath, ["-e", "setInterval(function () {}, 1e9)"],
+      { stdio: "ignore" });
+    await helpers.waitUntil(function () { return typeof child.pid === "number"; },
+      { timeoutMs: 5000, label: "pidLock: foreign child spawned" });
+    fs.writeFileSync(lockPath, String(child.pid) + "\n");
+    var foreignThrew = null;
+    try { lock.acquire(); } catch (e) { foreignThrew = e; }
+    check("pidLock: acquire refused while a live foreign PID holds the lock",
+          foreignThrew && foreignThrew.code === "app-shutdown/pidlock-held");
+    check("pidLock: refused acquirer does not claim ownership", lock.held() === false);
+
+    // Stale lock (holder dead) is reaped + re-acquired.
+    var exited = false;
+    child.on("exit", function () { exited = true; });
+    child.kill("SIGKILL");
+    await helpers.waitUntil(function () { return exited; },
+      { timeoutMs: 5000, label: "pidLock: foreign holder exited" });
+    child = null;
+    lock.acquire();
+    check("pidLock: stale lock reaped + re-acquired after holder died",
+          lock.held() === true && fs.existsSync(lockPath) === true);
+    check("pidLock: reaped file now records our PID",
+          parseInt(fs.readFileSync(lockPath, "utf8").trim(), 10) === process.pid);
+  } finally {
+    if (child) { try { child.kill("SIGKILL"); } catch (_e) { /* gone */ } }
+    try { lock.release(); } catch (_e) { /* best-effort */ }
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
+// #501 — pidLock.acquire() must ADOPT a lockfile that already records our own
+// PID (a parent wrote it and handed off, or start() re-acquires after leaving
+// its own live pidfile) instead of unlink+O_EXCL-recreate. The reap path opens
+// a no-pidfile window a concurrent daemon.stop misreads as "no-pidfile"; the
+// self-PID must be held in place with no unlink.
+async function testPidLockAdoptsSelfPidWithoutUnlink() {
+  var fs   = helpers.fs;
+  var os   = helpers.os;
+  var path = helpers.path;
+  var dir      = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-pidlock-adopt-"));
+  var lockPath = path.join(dir, "svc.pid");
+
+  // Model a parent that wrote our PID into the lockfile and handed off.
+  fs.writeFileSync(lockPath, String(process.pid) + "\n");
+  var inoBefore = null;
+  try { inoBefore = fs.statSync(lockPath).ino; } catch (_e) { /* stat best-effort */ }
+
+  // Spy the fs singleton pidLock writes through: the self-PID adopt path must
+  // NEVER unlink the lockfile (that is the no-pidfile window the bug opens).
+  var origUnlink = fs.unlinkSync;
+  var unlinkedSelf = false;
+  fs.unlinkSync = function (p) {
+    if (p === lockPath) unlinkedSelf = true;
+    return origUnlink.apply(fs, arguments);
+  };
+
+  var lock = b.appShutdown.pidLock(lockPath);
+  try {
+    lock.acquire();
+    check("pidLock adopt: held() true after adopting self-PID", lock.held() === true);
+    check("pidLock adopt: self-PID lockfile never unlinked",     unlinkedSelf === false);
+    check("pidLock adopt: lockfile still present",               fs.existsSync(lockPath) === true);
+    check("pidLock adopt: lockfile still records our PID",
+          parseInt(fs.readFileSync(lockPath, "utf8").trim(), 10) === process.pid);
+    // On POSIX the inode is a strong witness that no unlink+recreate happened.
+    // (Windows ino is unreliable; the unlink spy above is the win32 witness.)
+    if (process.platform !== "win32" && inoBefore !== null) {
+      check("pidLock adopt: inode preserved (no unlink+recreate)",
+            fs.statSync(lockPath).ino === inoBefore);
+    }
+  } finally {
+    fs.unlinkSync = origUnlink;
+    try { lock.release(); } catch (_e) { /* best-effort */ }
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+  }
+}
+
 async function run() {
   testAppShutdownSurface();
   await testAppShutdownEmpty();
@@ -428,9 +548,16 @@ async function run() {
   await testAppShutdownWatchdogForcesExitOnHang();
   testAppShutdownExitAfterPhasesValidation();
   await testAppShutdownExitAfterPhasesExits();
+  await testAppShutdownPidLock();
+  await testPidLockAdoptsSelfPidWithoutUnlink();
 }
 
-module.exports = { run: run };
+module.exports = {
+  run: run,
+  _tests: {
+    testPidLockAdoptsSelfPidWithoutUnlink: testPidLockAdoptsSelfPidWithoutUnlink,
+  },
+};
 
 if (require.main === module) {
   run().then(

package/lib/vendor/blamejs/test/layer-0-primitives/archive-adapters.test.js

@@ -0,0 +1,271 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * Layer 0 — b.archive.adapters source-bytes adapter contract.
+ *
+ * Exercises the random-access adapters through the real consumer path:
+ *   - b.archive.adapters.fs      — local-file fd + range() reads, close,
+ *                                  out-of-range / bad-arg / abort refusals.
+ *   - b.archive.adapters.http    — HTTP Range requests against a real
+ *                                  loopback server (never a real network),
+ *                                  driven through the documented opts.client
+ *                                  seam. The framework's b.httpClient refuses
+ *                                  loopback via the SSRF guard by design, so a
+ *                                  shape-compatible real loopback client is
+ *                                  injected — it performs genuine 127.0.0.1
+ *                                  round-trips, exercising the adapter's real
+ *                                  Range-header / Accept-Ranges / 206 path.
+ *   - b.archive.adapters.isRandomAccessAdapter  — shape predicate.
+ *   - b.archive.adapters.isTrustedStreamAdapter — shape predicate.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var b       = helpers.b;
+var os      = require("node:os");
+var path    = require("node:path");
+var fs      = require("node:fs");
+var http    = require("node:http");
+var stream  = require("node:stream");
+
+// A real loopback HTTP client in the shape b.archive.adapters.http expects
+// of opts.client (documented override seam: "client: b.httpClient"). Does
+// genuine 127.0.0.1 I/O — not a response fake — so the adapter's HEAD +
+// Range-GET code path runs end-to-end without weakening the SSRF guard.
+function _loopbackClient() {
+  return {
+    request: function (o) {
+      return new Promise(function (resolve, reject) {
+        var u = new URL(o.url);
+        var req = http.request({
+          hostname: u.hostname,
+          port:     u.port,
+          path:     u.pathname,
+          method:   o.method,
+          headers:  o.headers,
+        }, function (res) {
+          var chunks = [];
+          res.on("data", function (c) { chunks.push(c); });
+          res.on("end", function () {
+            resolve({ status: res.statusCode, headers: res.headers, body: Buffer.concat(chunks) });
+          });
+        });
+        req.on("error", reject);
+        req.end();
+      });
+    },
+  };
+}
+
+// Loopback server: HEAD advertises Accept-Ranges + Content-Length; GET with
+// a `Range: bytes=a-b` header returns 206 Partial Content sliced from the
+// payload. `opts.noAcceptRanges` omits the header so the adapter's no-range
+// refusal can be exercised.
+function _makeRangeServer(payload, opts) {
+  opts = opts || {};
+  return http.createServer(function (req, res) {
+    if (req.method === "HEAD") {
+      var h = { "content-length": String(payload.length) };
+      if (!opts.noAcceptRanges) h["accept-ranges"] = "bytes";
+      res.writeHead(200, h);
+      res.end();
+      return;
+    }
+    var m = /bytes=(\d+)-(\d+)/.exec(req.headers.range || "");
+    if (m) {
+      var start = Number(m[1]);
+      var end   = Number(m[2]);
+      var slice = payload.slice(start, end + 1);
+      res.writeHead(206, {
+        "content-length": String(slice.length),
+        "content-range":  "bytes " + start + "-" + end + "/" + payload.length,
+      });
+      res.end(slice);
+      return;
+    }
+    res.writeHead(200, { "content-length": String(payload.length) });
+    res.end(payload);
+  });
+}
+
+async function _expectReject(label, promise, codeRe) {
+  var threw = null;
+  try { await promise; } catch (e) { threw = e; }
+  check("archive.adapters " + label,
+    !!threw && codeRe.test(threw.code || ""));
+}
+
+async function testFsAdapter() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-adp-fs-"));
+  var fp  = path.join(dir, "payload.bin");
+  var payload = Buffer.from("0123456789ABCDEF-the-quick-brown-fox");
+  fs.writeFileSync(fp, payload);
+
+  var adapter = b.archive.adapters.fs(fp);
+  try {
+    check("adapters.fs: kind random-access", adapter.kind === "random-access");
+    check("adapters.fs: name",               adapter.name === "fs");
+    check("adapters.fs: size fstat'd",       adapter.size === payload.length);
+
+    var head = await adapter.range(0, 10);
+    check("adapters.fs: range(0,10) bytes",  head.toString() === payload.slice(0, 10).toString());
+    var mid = await adapter.range(10, 6);
+    check("adapters.fs: range(offset,len) bytes",
+      mid.toString() === payload.slice(10, 16).toString());
+    // Reusing the same fd across calls returns the whole trailer too.
+    var tail = await adapter.range(payload.length - 4, 4);
+    check("adapters.fs: trailing range bytes",
+      tail.toString() === payload.slice(payload.length - 4).toString());
+
+    // Refusals — read-past-EOF, bad offset, non-positive length.
+    await _expectReject("fs: read past EOF refused",
+      adapter.range(payload.length - 2, 8), /adapter\/out-of-range/);
+    await _expectReject("fs: negative offset refused",
+      adapter.range(-1, 4), /adapter\/bad-arg/);
+    await _expectReject("fs: zero length refused",
+      adapter.range(0, 0), /adapter\/bad-arg/);
+    await _expectReject("fs: non-integer length refused",
+      adapter.range(0, 1.5), /adapter\/bad-arg/);
+
+    // Predicate coverage against the live fs adapter.
+    check("adapters.isRandomAccessAdapter(fs) → true",
+      b.archive.adapters.isRandomAccessAdapter(adapter) === true);
+    check("adapters.isTrustedStreamAdapter(fs) → false",
+      b.archive.adapters.isTrustedStreamAdapter(adapter) === false);
+
+    // close() is idempotent; a range() after close fails closed.
+    adapter.close();
+    adapter.close();
+    await _expectReject("fs: range after close refused",
+      adapter.range(0, 4), /adapter\/closed/);
+  } finally {
+    adapter.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function testFsAbortSignal() {
+  var dir = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-adp-abort-"));
+  var fp  = path.join(dir, "payload.bin");
+  fs.writeFileSync(fp, Buffer.from("abcdefghij"));
+  var ac = new AbortController();
+  var adapter = b.archive.adapters.fs(fp, { signal: ac.signal });
+  try {
+    ac.abort();
+    var threw = null;
+    try { await adapter.range(0, 4); } catch (e) { threw = e; }
+    check("adapters.fs: aborted signal rejects range", !!threw);
+  } finally {
+    adapter.close();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function testHttpAdapter() {
+  var payload = Buffer.from("THE-QUICK-BROWN-FOX-0123456789-JUMPS");
+  var server = _makeRangeServer(payload);
+  var port = await helpers.listenOnRandomPort(server);
+  var url = "http://127.0.0.1:" + port + "/release.zip";
+  try {
+    var adapter = b.archive.adapters.http(url, { client: _loopbackClient() });
+    check("adapters.http: kind random-access", adapter.kind === "random-access");
+    check("adapters.http: name",               adapter.name === "http");
+
+    // First interaction resolves size via HEAD + Accept-Ranges probe.
+    var size = await adapter.resolveSize();
+    check("adapters.http: HEAD resolves size", size === payload.length);
+    check("adapters.http: size accessor now set", adapter.size === payload.length);
+
+    var head = await adapter.range(0, 9);
+    check("adapters.http: Range 206 head bytes",
+      head.toString() === payload.slice(0, 9).toString());
+    var mid = await adapter.range(20, 6);
+    check("adapters.http: Range 206 mid bytes",
+      mid.toString() === payload.slice(20, 26).toString());
+
+    await _expectReject("http: read past EOF refused",
+      adapter.range(payload.length - 2, 10), /adapter\/out-of-range/);
+    await _expectReject("http: zero length refused",
+      adapter.range(0, 0), /adapter\/bad-arg/);
+
+    check("adapters.isRandomAccessAdapter(http) → true",
+      b.archive.adapters.isRandomAccessAdapter(adapter) === true);
+  } finally {
+    await new Promise(function (r) { server.close(r); });
+  }
+}
+
+async function testHttpNoRangeSupport() {
+  var payload = Buffer.from("no-range-support-here");
+  var server = _makeRangeServer(payload, { noAcceptRanges: true });
+  var port = await helpers.listenOnRandomPort(server);
+  var url = "http://127.0.0.1:" + port + "/norange.zip";
+  try {
+    var adapter = b.archive.adapters.http(url, { client: _loopbackClient() });
+    // Server omits Accept-Ranges: bytes → adapter must refuse.
+    await _expectReject("http: server without Accept-Ranges refused",
+      adapter.resolveSize(), /adapter\/no-range/);
+  } finally {
+    await new Promise(function (r) { server.close(r); });
+  }
+}
+
+function testShapePredicates() {
+  // Random-access shape produced by fs / buffer / objectStore / http.
+  var bufAdapter = b.archive.adapters.buffer(Buffer.from("hello-buffer"));
+  check("adapters.isRandomAccessAdapter(buffer) → true",
+    b.archive.adapters.isRandomAccessAdapter(bufAdapter) === true);
+  check("adapters.isTrustedStreamAdapter(buffer) → false",
+    b.archive.adapters.isTrustedStreamAdapter(bufAdapter) === false);
+
+  // Trusted-sequential shape produced by trustedStream.
+  var pt = new stream.PassThrough();
+  var tsAdapter = b.archive.adapters.trustedStream(pt);
+  try {
+    check("adapters.isTrustedStreamAdapter(trustedStream) → true",
+      b.archive.adapters.isTrustedStreamAdapter(tsAdapter) === true);
+    check("adapters.isRandomAccessAdapter(trustedStream) → false",
+      b.archive.adapters.isRandomAccessAdapter(tsAdapter) === false);
+  } finally {
+    tsAdapter.close();
+  }
+
+  // Garbage / partial shapes are rejected by both predicates — the
+  // predicates require BOTH the kind tag AND the discriminating member.
+  check("isRandomAccessAdapter(null) → false",
+    b.archive.adapters.isRandomAccessAdapter(null) === false);
+  check("isRandomAccessAdapter(kind-only, no range) → false",
+    b.archive.adapters.isRandomAccessAdapter({ kind: "random-access" }) === false);
+  check("isRandomAccessAdapter(trusted shape) → false",
+    b.archive.adapters.isRandomAccessAdapter(tsAdapterShape()) === false);
+  check("isTrustedStreamAdapter({}) → false",
+    b.archive.adapters.isTrustedStreamAdapter({}) === false);
+  check("isTrustedStreamAdapter(kind-only, no readable) → false",
+    b.archive.adapters.isTrustedStreamAdapter({ kind: "trusted-sequential" }) === false);
+  check("isTrustedStreamAdapter(random-access adapter) → false",
+    b.archive.adapters.isTrustedStreamAdapter(bufAdapter) === false);
+}
+
+// A plain trusted-sequential-shaped object (no range fn) — used to prove
+// isRandomAccessAdapter refuses it even though it has a kind tag.
+function tsAdapterShape() {
+  return { kind: "trusted-sequential", readable: {} };
+}
+
+async function run() {
+  await testFsAdapter();
+  await testFsAbortSignal();
+  await testHttpAdapter();
+  await testHttpNoRangeSupport();
+  testShapePredicates();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", (e && e.stack) || e); process.exit(1); }
+  );
+}