@codyswann/lisa 4.72.6 → 4.73.0

package/all/copy-overwrite/scripts/lib/npm-update-rails-mysql-daemon.mjs

@@ -0,0 +1,227 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Selected native daemon observations never expose container environment or credentials. */
+import { required } from "./npm-update-contract.mjs";
+import { runProcess } from "./npm-update-process-core.mjs";
+import { createHash } from "node:crypto";
+import { publicFailure } from "./npm-update-invariants.mjs";
+import {
+  assertDockerQualified,
+  runtimeTime,
+} from "./npm-update-rails-tool-identity.mjs";
+
+const FIELDS =
+  "{{json .Id}}\t{{json .Name}}\t{{json .Config.Labels}}\t{{json .Image}}\t{{json .State.Running}}\t{{json .Mounts}}\t{{json .NetworkSettings.Ports}}";
+const fields = bytes =>
+  bytes
+    .toString()
+    .trim()
+    .split("\t")
+    .map(value => JSON.parse(value));
+
+const COMMAND_PHASES = Object.freeze({
+  pull: "Docker pull",
+  image: "Docker image",
+  ps: "Docker census",
+  create: "Docker create",
+  start: "Docker start",
+  stop: "Docker stop",
+  container: "Docker container",
+  exec: "MySQL query",
+});
+const PHASES = new Set([
+  "command",
+  "Rails prepare",
+  ...Object.values(COMMAND_PHASES),
+]);
+
+/** Data descriptors avoid invoking an unknown error's getters while retaining bounded native buffers. */
+export function mysqlErrorData(error, name) {
+  return error !== null &&
+    (typeof error === "object" || typeof error === "function")
+    ? Object.getOwnPropertyDescriptor(error, name)?.value
+    : undefined;
+}
+
+function captureFingerprint(value) {
+  return Buffer.isBuffer(value) && value.length <= 3145728
+    ? Object.freeze({
+        bytes: value.length,
+        sha256: createHash("sha256").update(value).digest("hex"),
+      })
+    : null;
+}
+
+/** Only typed status and hashes leave a native failure; its original capture stays in memory. */
+export function mysqlObservation(error, phase) {
+  required(PHASES.has(phase), "MySQL native diagnostic phase differs");
+  const code = mysqlErrorData(error, "code");
+  const native = publicFailure(error);
+  return Object.freeze({
+    phase,
+    status: Number.isInteger(code) && code >= 0 && code <= 255 ? code : null,
+    signal: /\bsignal=(SIG[A-Z]+)\b/.exec(native)?.[1] ?? null,
+    native,
+    stdout: captureFingerprint(mysqlErrorData(error, "stdout")),
+    stderr: captureFingerprint(mysqlErrorData(error, "stderr")),
+  });
+}
+
+/** Native failure status is useful; SQL, credentials, capture and argv are never diagnostics. */
+export function mysqlFailure(error, stage, phase = stage) {
+  required(
+    stage === "command" || stage === "Rails prepare",
+    "MySQL native diagnostic stage differs"
+  );
+  const observation = mysqlObservation(error, phase);
+  return Object.assign(
+    new Error(`npm updater: MySQL native ${stage} failed`, { cause: error }),
+    {
+      code: observation.status,
+      observation,
+    }
+  );
+}
+
+function ownedContainer(values, state) {
+  const [id, name, labels, imageId, running] = values;
+  required(
+    values.length === 7 &&
+      /^[a-f0-9]{64}$/.test(id) &&
+      name === `/${state.name}` &&
+      Object.keys(labels).join(",") === "lisa.npm.mysql" &&
+      labels["lisa.npm.mysql"] === state.nonce &&
+      imageId === state.imageId &&
+      (state.containerId === null || id === state.containerId) &&
+      typeof running === "boolean",
+    "MySQL container ownership differs"
+  );
+  return { id, running };
+}
+
+function ownedMounts(mounts, storage) {
+  const expected = storage.files.map(file => ({
+    Type: "bind",
+    Source: file.file,
+    Destination: `/run/lisa-${file.name}`,
+    RW: false,
+  }));
+  required(
+    Array.isArray(mounts) &&
+      mounts.length === 4 &&
+      expected.every(want =>
+        mounts.some(actual =>
+          Object.entries(want).every(([key, value]) => actual[key] === value)
+        )
+      ) &&
+      mounts.some(
+        mount =>
+          mount.Type === "tmpfs" && mount.Destination === "/var/lib/mysql"
+      ),
+    "MySQL container mount ownership differs"
+  );
+}
+
+function ownedPort(ports, state) {
+  const bindings = ports?.["3306/tcp"];
+  required(
+    ports &&
+      Object.keys(ports).every(
+        key => key === "3306/tcp" || ports[key] === null
+      ) &&
+      Array.isArray(bindings) &&
+      bindings.length === 1 &&
+      bindings[0].HostIp === "127.0.0.1" &&
+      /^[1-9]\d{0,4}$/.test(bindings[0].HostPort) &&
+      Number(bindings[0].HostPort) <= 65535 &&
+      (state.port === null || state.port === bindings[0].HostPort),
+    "MySQL private loopback port differs"
+  );
+  state.port = bindings[0].HostPort;
+}
+
+async function inspectContainer(call, target, state, storage, deadline) {
+  const result = await call(
+    ["container", "inspect", target, "--format", FIELDS],
+    undefined,
+    [0, 1],
+    deadline
+  );
+  if (result.code === 1) {
+    required(
+      (result.stdout.length === 0 || result.stdout.equals(Buffer.from("\n"))) &&
+        result.stderr.toString().trim() ===
+          `Error response from daemon: No such container: ${target}`,
+      "MySQL container absence is unproved"
+    );
+    return null;
+  }
+  const values = fields(result.stdout);
+  const observed = ownedContainer(values, state);
+  ownedMounts(values[5], storage);
+  if (observed.running) ownedPort(values[6], state);
+  return observed;
+}
+
+/** Every command rechecks immutable client, private storage and the same daemon/phase. */
+export function createMysqlDaemon(docker, storage, state, deadline) {
+  const call = async (args, input, allowed = [0], limit = deadline) => {
+    storage.validate();
+    await assertDockerQualified(docker, limit);
+    try {
+      return await runProcess(docker.path, args, {
+        env: docker.env,
+        input,
+        allowed,
+        timeout: runtimeTime(limit, args[0] === "pull" ? 1800000 : 10000),
+        maximum: 262144,
+      });
+    } catch (error) {
+      throw mysqlFailure(error, "command", COMMAND_PHASES[args[0]]);
+    }
+  };
+  return {
+    call,
+    inspect: (target, limit = deadline) =>
+      inspectContainer(call, target, state, storage, limit),
+    async census(limit = deadline) {
+      const result = await call(
+        ["ps", "-aq", "--no-trunc"],
+        undefined,
+        [0],
+        limit
+      );
+      const ids = result.stdout.toString().trim().split(/\s+/).filter(Boolean);
+      required(
+        ids.length <= 10000 && ids.every(id => /^[a-f0-9]{64}$/.test(id)),
+        "MySQL daemon census is invalid"
+      );
+      return ids;
+    },
+    async qualifyImage() {
+      await call(["pull", "--platform", "linux/amd64", state.image]);
+      const image = fields(
+        (
+          await call([
+            "image",
+            "inspect",
+            state.image,
+            "--format",
+            "{{json .Id}}\t{{json .Os}}\t{{json .Architecture}}\t{{json .RepoDigests}}",
+          ])
+        ).stdout
+      );
+      required(
+        image.length === 4 &&
+          /^sha256:[a-f0-9]{64}$/.test(image[0]) &&
+          image[1] === "linux" &&
+          image[2] === "amd64" &&
+          Array.isArray(image[3]) &&
+          image[3].includes(state.image),
+        "MySQL immutable image platform differs"
+      );
+      state.imageId = image[0];
+    },
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-rails-mysql-resource.mjs

@@ -0,0 +1,176 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Pending allocation, owned mutations and cleanup share the original absolute phase. */
+import { randomBytes } from "node:crypto";
+import { required } from "./npm-update-contract.mjs";
+import {
+  runtimeTime,
+  assertDockerQualified,
+} from "./npm-update-rails-tool-identity.mjs";
+import {
+  createMysqlStorage,
+  assertMysqlRoot,
+} from "./npm-update-rails-mysql-storage.mjs";
+import { createMysqlDaemon } from "./npm-update-rails-mysql-daemon.mjs";
+export { assertMysqlRoot } from "./npm-update-rails-mysql-storage.mjs";
+export { mysqlFailure } from "./npm-update-rails-mysql-daemon.mjs";
+
+const IMAGE =
+  "mysql@sha256:80f4933e3835f9dc4d35a28ec500d7986cb4414e6c6821c5461239cb7beb8995";
+
+async function allocate(daemon, storage, state) {
+  await daemon.qualifyImage();
+  const mounts = storage.files.flatMap(file => [
+    "--mount",
+    `type=bind,src=${file.file},dst=/run/lisa-${file.name},readonly`,
+  ]);
+  state.pending = true;
+  const created = await daemon.call([
+    "create",
+    "--platform",
+    "linux/amd64",
+    "--name",
+    state.name,
+    "--label",
+    `lisa.npm.mysql=${state.nonce}`,
+    "--publish",
+    "127.0.0.1::3306",
+    ...mounts,
+    "--mount",
+    "type=tmpfs,dst=/var/lib/mysql,tmpfs-mode=0700",
+    "--env",
+    "MYSQL_ROOT_PASSWORD_FILE=/run/lisa-root-password",
+    IMAGE,
+    "--partial-revokes=ON",
+  ]);
+  const id = created.stdout.toString().trim();
+  required(/^[a-f0-9]{64}$/.test(id), "MySQL native create identity malformed");
+  state.containerId = id;
+  state.pending = false;
+  await daemon.inspect(id);
+  await daemon.call(["start", id]);
+  required(
+    (await daemon.inspect(id))?.running === true,
+    "MySQL owned container is not running"
+  );
+}
+
+async function closeResource(daemon, storage, state, before, deadline) {
+  const cleanupDeadline = Math.min(deadline, Date.now() + 10000);
+  runtimeTime(cleanupDeadline);
+  const observed =
+    state.pending || state.containerId
+      ? await daemon.inspect(state.containerId ?? state.name, cleanupDeadline)
+      : null;
+  if (observed) {
+    if (observed.running)
+      await daemon.call(
+        ["stop", "--time", "1", observed.id],
+        undefined,
+        [0],
+        cleanupDeadline
+      );
+    const stopped = await daemon.inspect(observed.id, cleanupDeadline);
+    required(stopped && !stopped.running, "MySQL owned container did not stop");
+    await daemon.call(
+      ["container", "rm", stopped.id],
+      undefined,
+      [0],
+      cleanupDeadline
+    );
+    required(
+      (await daemon.inspect(stopped.id, cleanupDeadline)) === null &&
+        (await daemon.inspect(state.name, cleanupDeadline)) === null,
+      "MySQL owned container remains"
+    );
+  }
+  const after = await daemon.census(cleanupDeadline);
+  required(
+    before.every(id => after.includes(id)),
+    "MySQL foreign daemon census changed"
+  );
+  state.foreignPreserved = true;
+  storage.remove();
+  state.closed = true;
+}
+
+/** One pending authority recovers lost native replies; cleanup failure never hides opening failure. */
+export async function openMysqlResource({
+  root,
+  deadline,
+  docker,
+  user,
+  password,
+}) {
+  required(
+    /^lisa_[a-f0-9]{24}$/.test(user) && /^[a-f0-9]{64}$/.test(password),
+    "MySQL synthetic account identity differs"
+  );
+  runtimeTime(deadline);
+  assertMysqlRoot(root);
+  await assertDockerQualified(docker, deadline);
+  const nonce = randomBytes(32).toString("hex");
+  const state = {
+    nonce,
+    name: `lisa-npm-mysql-${nonce}`,
+    image: IMAGE,
+    pending: false,
+    containerId: null,
+    imageId: null,
+    port: null,
+    closed: false,
+    foreignPreserved: false,
+  };
+  const storage = createMysqlStorage(
+    root,
+    { nonce, name: state.name, image: IMAGE },
+    user,
+    password
+  );
+  const daemon = createMysqlDaemon(docker, storage, state, deadline);
+  let before = [];
+  let closing;
+  const close = () =>
+    (closing ??= closeResource(daemon, storage, state, before, deadline));
+  try {
+    before = await daemon.census();
+    await allocate(daemon, storage, state);
+    return {
+      state,
+      close,
+      async query(sql, application = false) {
+        required(
+          !state.closed &&
+            (await daemon.inspect(state.containerId))?.running === true,
+          "MySQL query ownership is not running"
+        );
+        const result = await daemon.call(
+          [
+            "exec",
+            "-i",
+            state.containerId,
+            "mysql",
+            `--defaults-extra-file=/run/lisa-${application ? "app" : "admin"}.cnf`,
+            "--batch",
+            "--raw",
+            "--skip-column-names",
+          ],
+          sql
+        );
+        return result.stdout.toString();
+      },
+    };
+  } catch (error) {
+    try {
+      await close();
+    } catch (cleanup) {
+      throw new AggregateError(
+        [error, cleanup],
+        "MySQL open and owned cleanup failed",
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}

package/all/copy-overwrite/scripts/lib/npm-update-rails-mysql-storage.mjs

@@ -0,0 +1,201 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Private file and inode authority is separate from the Docker mutation protocol. */
+import {
+  lstatSync,
+  realpathSync,
+  mkdirSync,
+  writeFileSync,
+  openSync,
+  fstatSync,
+  closeSync,
+  readdirSync,
+  unlinkSync,
+  rmdirSync,
+} from "node:fs";
+import { join, isAbsolute } from "node:path";
+import { randomBytes, createHash } from "node:crypto";
+import { required } from "./npm-update-contract.mjs";
+import { readBytes } from "./npm-update-process-core.mjs";
+import { canonicalJson } from "./automation-provenance-contract.mjs";
+
+const digest = bytes => createHash("sha256").update(bytes).digest("hex");
+
+/** Aliases, public storage and mount syntax cannot become allocation authority. */
+export function assertMysqlRoot(root) {
+  const st = lstatSync(root);
+  required(
+    isAbsolute(root) &&
+      realpathSync(root) === root &&
+      !/[\n\r,]/.test(root) &&
+      st.isDirectory() &&
+      !st.isSymbolicLink() &&
+      st.uid === process.getuid() &&
+      (st.mode & 0o077) === 0,
+    "MySQL root is aliased or not private owned storage"
+  );
+  return { dev: st.dev, ino: st.ino };
+}
+
+/** Credentials never enter argv, Docker environment values or exported diagnostics. */
+function privateFiles(directory, user, password, created) {
+  const rootPassword = randomBytes(32).toString("hex");
+  const values = {
+    "root-password": rootPassword,
+    "admin.cnf": `[client]\nuser=root\npassword=${rootPassword}\nhost=127.0.0.1\nprotocol=TCP\nget-server-public-key=1\n`,
+    "app.cnf": `[client]\nuser=${user}\npassword=${password}\nhost=127.0.0.1\nprotocol=TCP\nget-server-public-key=1\n`,
+  };
+  return Object.entries(values).map(([name, value]) => {
+    const file = join(directory, name);
+    return { name, ...privateWrite(file, value, created) };
+  });
+}
+
+/** Exclusive descriptor ownership is recorded before a write can fail partially. */
+function privateWrite(file, value, created) {
+  const fd = openSync(file, "wx", 0o600);
+  try {
+    const st = fstatSync(fd);
+    const owned = { file, dev: st.dev, ino: st.ino };
+    created.push(owned);
+    writeFileSync(fd, value);
+    return { ...owned, sha256: digest(Buffer.from(value)) };
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Only exclusively created private inodes can be removed after construction failure. */
+function removeConstruction(root, rootId, directory, dirId, created) {
+  const nowRoot = assertMysqlRoot(root);
+  const nowDir = assertMysqlRoot(directory);
+  const inDirectory = created.filter(file =>
+    file.file.startsWith(`${directory}/`)
+  );
+  required(
+    nowRoot.dev === rootId.dev &&
+      nowRoot.ino === rootId.ino &&
+      nowDir.dev === dirId.dev &&
+      nowDir.ino === dirId.ino &&
+      readdirSync(directory).sort().join(",") ===
+        inDirectory
+          .map(file => file.file.slice(directory.length + 1))
+          .sort()
+          .join(","),
+    "MySQL partial storage ownership changed"
+  );
+  for (const file of created) {
+    const st = lstatSync(file.file);
+    required(
+      st.isFile() &&
+        !st.isSymbolicLink() &&
+        st.nlink === 1 &&
+        st.uid === process.getuid() &&
+        (st.mode & 0o077) === 0 &&
+        st.dev === file.dev &&
+        st.ino === file.ino,
+      "MySQL partial file ownership changed"
+    );
+  }
+  for (const file of inDirectory) unlinkSync(file.file);
+  rmdirSync(directory);
+  for (const file of created.filter(file => !inDirectory.includes(file)))
+    unlinkSync(file.file);
+}
+
+/** Re-read immutable private bytes and directory census before every daemon operation. */
+function validateStorage(storage) {
+  const {
+    root,
+    directory,
+    rootId,
+    dirId,
+    registration,
+    registrationBytes,
+    files,
+  } = storage;
+  const nowRoot = assertMysqlRoot(root);
+  const nowDir = assertMysqlRoot(directory);
+  required(
+    nowRoot.dev === rootId.dev &&
+      nowRoot.ino === rootId.ino &&
+      nowDir.dev === dirId.dev &&
+      nowDir.ino === dirId.ino &&
+      readBytes(registration).equals(registrationBytes),
+    "MySQL private ownership changed"
+  );
+  required(
+    readdirSync(directory).sort().join(",") ===
+      files
+        .map(file => file.name)
+        .sort()
+        .join(","),
+    "MySQL private ownership contains foreign data"
+  );
+  for (const file of files) {
+    const st = lstatSync(file.file);
+    required(
+      st.dev === file.dev &&
+        st.ino === file.ino &&
+        digest(readBytes(file.file)) === file.sha256,
+      "MySQL private file ownership changed"
+    );
+  }
+}
+
+/** A fixed registration prevents the enclosing updater from deleting outstanding resource authority. */
+export function createMysqlStorage(root, identity, user, password) {
+  const rootId = assertMysqlRoot(root);
+  const directory = join(root, `rails-mysql-${identity.nonce}`);
+  mkdirSync(directory, { mode: 0o700 });
+  const dirId = assertMysqlRoot(directory);
+  const created = [];
+  let files;
+  const registration = join(
+    root,
+    `namespace-${identity.nonce.slice(0, 16)}.json`
+  );
+  try {
+    privateWrite(
+      registration,
+      `${canonicalJson({ version: 1, kind: "rails-mysql", ...identity, directory })}\n`,
+      created
+    );
+    files = privateFiles(directory, user, password, created);
+  } catch (error) {
+    try {
+      removeConstruction(root, rootId, directory, dirId, created);
+    } catch (cleanup) {
+      throw new AggregateError(
+        [error, cleanup],
+        "MySQL partial storage cleanup refused",
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+  const storage = {
+    root,
+    rootId,
+    directory,
+    dirId,
+    files,
+    registration,
+    registrationBytes: readBytes(registration),
+  };
+  return {
+    files,
+    validate: () => validateStorage(storage),
+    remove() {
+      validateStorage(storage);
+      for (const file of files) unlinkSync(file.file);
+      rmdirSync(directory);
+      required(
+        !readdirSync(root).includes(directory.slice(root.length + 1)),
+        "MySQL private directory remains"
+      );
+      unlinkSync(registration);
+    },
+  };
+}