@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/write_files_linux.go

@@ -0,0 +1,202 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"strconv"
+)
+
+// Anonymous staging is created by the actor in the destination directory, so
+// filesystem default ACL inheritance applies. No attacker-controlled stage name
+// is ever linked, renamed or unlinked. Missing O_TMPFILE / fixed-FD link support
+// refuses publish rather than falling back to check-then-rename.
+type actorFileWriter struct {
+	parent                    *readOnlyObject
+	file                      *os.File
+	before                    unix.Stat_t
+	work                      writeWork
+	acl                       readOnlyACL
+	receipt                   MutationReceipt
+	failed, attempted, closed bool
+	syncParent                func() error // fixed parent.Sync; fault injection only in tests
+}
+
+func openActorWriteTransfer(ctx context.Context, pin *pinnedReadOnlyRoot, w writeWork, acl readOnlyACL) (*actorFileWriter, Code) {
+	if c := w.validate(); c != "" {
+		return nil, c
+	}
+	if acl == nil {
+		return nil, ErrUnsupported
+	}
+	parentWork := readOnlyWork{RootPath: w.RootPath, Action: ActionStat, Segments: w.Segments[:len(w.Segments)-1]}
+	p, c := resolveReadOnly(ctx, pin, parentWork)
+	if c != "" {
+		return nil, c
+	}
+	ok := false
+	defer func() {
+		if !ok {
+			p.Close()
+		}
+	}()
+	if p.before.Mode&unix.S_IFMT != unix.S_IFDIR {
+		return nil, ErrDenied
+	}
+	for _, fd := range []int{int(p.nodes[p.root].file.Fd()), int(p.data.Fd())} {
+		if c := nativeObservationCode(ctx, acl.Authorize(ctx, w.Action, fd)); c != "" {
+			return nil, c
+		}
+	}
+	if c := p.check(); c != "" {
+		return nil, c
+	}
+	flags := unix.O_WRONLY | unix.O_CLOEXEC | unix.O_NOFOLLOW | unix.O_NONBLOCK
+	name := w.Segments[len(w.Segments)-1]
+	if w.Staged {
+		flags |= unix.O_TMPFILE
+		name = "."
+	} else {
+		flags |= unix.O_CREAT | unix.O_EXCL
+	}
+	fd, e := unix.Openat(int(p.data.Fd()), name, flags, 0666)
+	if e != nil {
+		if w.Staged && (errors.Is(e, unix.EOPNOTSUPP) || errors.Is(e, unix.EINVAL) || errors.Is(e, unix.EISDIR)) {
+			return nil, ErrUnsupported
+		}
+		if errors.Is(e, unix.EEXIST) {
+			return nil, ErrDenied
+		}
+		return nil, readOnlyError(e)
+	}
+	x := &actorFileWriter{parent: p, file: os.NewFile(uintptr(fd), "actor-write"), work: w, acl: acl, receipt: MutationReceipt{Created: true}, syncParent: p.data.Sync}
+	// A successful exclusive open is already a visible effect, even if following
+	// checks fail. Return the owned FD and partial receipt; never unlink its name.
+	ok = true
+	if unix.Fstat(fd, &x.before) != nil || x.before.Mode&unix.S_IFMT != unix.S_IFREG || x.before.Dev != p.before.Dev {
+		x.failed = true
+		return x, ErrPartial
+	}
+	if c := x.check(ctx); c != "" {
+		x.failed = true
+		return x, ErrPartial
+	}
+	return x, ""
+}
+func (x *actorFileWriter) Receipt() MutationReceipt       { return x.receipt }
+func (x *actorFileWriter) check(ctx context.Context) Code { return x.checkAction(ctx, x.work.Action) }
+func (x *actorFileWriter) checkAction(ctx context.Context, action Action) Code {
+	if x.closed {
+		return ErrCanceled
+	}
+	if c := nativeContextCode(ctx); c != "" {
+		return c
+	}
+	if c := x.parent.check(); c != "" {
+		return c
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(x.file.Fd()), &st) != nil || !sameReadOnlyObject(st, x.before) || st.Size != int64(x.receipt.BytesWritten) {
+		return ErrStale
+	}
+	links := uint64(1)
+	if x.work.Staged && !x.receipt.Published {
+		links = 0
+	}
+	if uint64(st.Nlink) != links {
+		return ErrDenied
+	}
+	if !x.work.Staged || x.receipt.Published {
+		var named unix.Stat_t
+		if unix.Fstatat(int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], &named, unix.AT_SYMLINK_NOFOLLOW) != nil || !sameReadOnlyObject(st, named) {
+			return ErrStale
+		}
+	}
+	for _, fd := range []int{int(x.parent.nodes[x.parent.root].file.Fd()), int(x.parent.data.Fd()), int(x.file.Fd())} {
+		if c := nativeObservationCode(ctx, x.acl.Authorize(ctx, action, fd)); c != "" {
+			return c
+		}
+	}
+	return nativeContextCode(ctx)
+}
+func (x *actorFileWriter) WriteChunk(ctx context.Context, b []byte) (MutationReceipt, Code) {
+	if x.failed || x.attempted || x.closed {
+		return x.receipt, ErrPartial
+	}
+	if len(b) == 0 || len(b) > MaxChunkBytes || uint64(len(b)) > x.work.MaxBytes-x.receipt.BytesWritten {
+		return x.receipt, ErrLimit
+	}
+	if c := x.check(ctx); c != "" {
+		x.failed = true
+		return x.receipt, ErrPartial
+	}
+	n, e := x.file.Write(b)
+	x.receipt.BytesWritten += uint64(n)
+	if e != nil || n != len(b) {
+		x.failed = true
+		return x.receipt, ErrPartial
+	}
+	if c := x.check(ctx); c != "" {
+		x.failed = true
+		return x.receipt, ErrPartial
+	}
+	return x.receipt, ""
+}
+func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
+	if x.attempted {
+		return x.receipt, ErrReplay
+	}
+	x.attempted = true
+	if x.failed || x.closed {
+		return x.receipt, ErrPartial
+	}
+	action := x.work.Action
+	if x.work.Staged {
+		action = ActionPublish
+	}
+	if c := x.checkAction(ctx, action); c != "" {
+		return x.receipt, c
+	}
+	if !x.work.Staged && x.receipt.BytesWritten != x.work.MaxBytes {
+		return x.receipt, ErrPartial
+	}
+	if e := x.file.Sync(); e != nil {
+		return x.receipt, ErrPartial
+	}
+	if c := x.checkAction(ctx, action); c != "" {
+		return x.receipt, c
+	}
+	if x.work.Staged {
+		// Atomic no-replace on kernels without renameat2. O_TMPFILE has no source
+		// name; linkat follows only this actor's live descriptor alias. No unlink of
+		// the destination is ever performed, including failure/foreign replacement.
+		e := unix.Linkat(unix.AT_FDCWD, "/proc/self/fd/"+strconv.Itoa(int(x.file.Fd())), int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], unix.AT_SYMLINK_FOLLOW)
+		if e != nil {
+			if errors.Is(e, unix.EEXIST) {
+				return x.receipt, ErrDenied
+			}
+			return x.receipt, ErrUnsupported
+		}
+	}
+	x.receipt.Published = true
+	if c := x.checkAction(ctx, action); c != "" {
+		return x.receipt, ErrCommitUncertain
+	}
+	if e := x.syncParent(); e != nil {
+		return x.receipt, ErrCommitUncertain
+	}
+	if c := x.checkAction(ctx, action); c != "" {
+		return x.receipt, ErrCommitUncertain
+	}
+	x.receipt.Committed = true
+	return x.receipt, ""
+}
+func (x *actorFileWriter) Close() {
+	if x.closed {
+		return
+	}
+	x.closed = true
+	x.file.Close()
+	x.parent.Close()
+}

package/templates/native-go/backend/internal/helper/write_files_linux_test.go

@@ -0,0 +1,199 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"golang.org/x/sys/unix"
+	"os"
+	"testing"
+)
+
+func TestWriteExclusivePartialAndNoForeignUnlink(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	w := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new"}, MaxBytes: 10}
+	x, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer x.Close()
+	r, c := x.WriteChunk(context.Background(), []byte("abc"))
+	if c != "" || r.BytesWritten != 3 || r.Committed {
+		t.Fatal(r, c)
+	}
+	if _, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{}); c == "" {
+		t.Fatal("duplicate create")
+	}
+	if e := os.Rename(root+"/new", root+"/moved"); e != nil {
+		t.Fatal(e)
+	}
+	os.WriteFile(root+"/new", []byte("foreign"), 0644)
+	r, c = x.WriteChunk(context.Background(), []byte("def"))
+	if c != ErrPartial || r.BytesWritten != 3 {
+		t.Fatal(r, c)
+	}
+	x.Close()
+	b, _ := os.ReadFile(root + "/new")
+	if string(b) != "foreign" {
+		t.Fatal("foreign path damaged")
+	}
+}
+func TestWriteStageFixedFDNoOverwriteAndCommitGap(t *testing.T) {
+	for _, kind := range []string{"success", "exists", "fsync-gap", "acl", "cancel"} {
+		t.Run(kind, func(t *testing.T) {
+			pin, root := readOnlyFixture(t)
+			w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"published"}, MaxBytes: MaxTransferBytes, Staged: true}
+			acl := &writeTestACL{}
+			x, c := openActorWriteTransfer(context.Background(), pin, w, acl)
+			if c != "" {
+				t.Fatal(c)
+			}
+			defer x.Close()
+			if _, e := os.Stat(root + "/published"); !os.IsNotExist(e) {
+				t.Fatal("stage visible at destination")
+			}
+			for n := 0; n < 32; n++ {
+				r, c := x.WriteChunk(context.Background(), bytes.Repeat([]byte("x"), MaxChunkBytes))
+				if c != "" || r.BytesWritten != uint64((n+1)*MaxChunkBytes) {
+					t.Fatal(r, c)
+				}
+			}
+			switch kind {
+			case "exists":
+				os.WriteFile(root+"/published", []byte("foreign"), 0644)
+			case "fsync-gap":
+				x.syncParent = func() error { return unix.EIO }
+			case "acl":
+				acl.deny = true
+			}
+			ctx := context.Background()
+			if kind == "cancel" {
+				cancelCtx, cancel := context.WithCancel(ctx)
+				cancel()
+				ctx = cancelCtx
+			}
+			r, c := x.Commit(ctx)
+			switch kind {
+			case "success":
+				if c != "" || !r.Committed || !r.Published {
+					t.Fatal(r, c)
+				}
+			case "fsync-gap":
+				if c != ErrCommitUncertain || r.Committed || !r.Published {
+					t.Fatal(r, c)
+				}
+			default:
+				if c == "" || r.Committed || r.Published {
+					t.Fatal(r, c)
+				}
+			}
+			if kind == "exists" {
+				b, _ := os.ReadFile(root + "/published")
+				if string(b) != "foreign" {
+					t.Fatal("overwritten")
+				}
+			}
+			if _, c = x.Commit(context.Background()); c != ErrReplay {
+				t.Fatal("duplicate commit", c)
+			}
+		})
+	}
+}
+
+type writeTestACL struct{ deny bool }
+
+func (a *writeTestACL) Authorize(context.Context, Action, int) Code {
+	if a.deny {
+		return ErrDenied
+	}
+	return ""
+}
+
+type writeActionACL struct{ deny Action }
+
+func (a writeActionACL) Authorize(_ context.Context, action Action, _ int) Code {
+	if action == a.deny {
+		return ErrDenied
+	}
+	return ""
+}
+func TestWritePublishRechecksPublishACLInActor(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"final"}, MaxBytes: 10, Staged: true}
+	x, c := openActorWriteTransfer(context.Background(), pin, w, writeActionACL{deny: ActionPublish})
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer x.Close()
+	if _, c = x.WriteChunk(context.Background(), []byte("abc")); c != "" {
+		t.Fatal(c)
+	}
+	if r, c := x.Commit(context.Background()); c != ErrDenied || r.Published {
+		t.Fatal("published without publish ACL", r, c)
+	}
+}
+
+func TestWriteDiskFullHasExactPartialReceipt(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM")
+	}
+	root := t.TempDir()
+	if e := unix.Mount("tmpfs", root, "tmpfs", 0, "size=64k,mode=0755"); e != nil {
+		t.Fatal(e)
+	}
+	defer unix.Unmount(root, 0)
+	pin, c := pinReadOnlyRoot(root)
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer pin.Close()
+	x, c := openActorWriteTransfer(context.Background(), pin, writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"full"}, MaxBytes: MaxBoundedBytes}, fixtureReadOnlyACL{})
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer x.Close()
+	var r MutationReceipt
+	for n := 0; n < 16; n++ {
+		r, c = x.WriteChunk(context.Background(), bytes.Repeat([]byte("x"), MaxChunkBytes))
+		if c != "" {
+			break
+		}
+	}
+	if c != ErrPartial || r.BytesWritten != MaxChunkBytes || r.Committed {
+		t.Fatal(r, c)
+	}
+	info, e := os.Stat(root + "/full")
+	if e != nil || info.Size() != int64(r.BytesWritten) {
+		t.Fatal(info, e)
+	}
+}
+
+func TestWriteConcurrentPublishHasOneWinnerAndNoOverwrite(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	w := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"winner"}, MaxBytes: 10, Staged: true}
+	first, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer first.Close()
+	second, c := openActorWriteTransfer(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer second.Close()
+	first.WriteChunk(context.Background(), []byte("first"))
+	second.WriteChunk(context.Background(), []byte("second"))
+	start := make(chan struct{})
+	result := make(chan Code, 2)
+	for _, x := range []*actorFileWriter{first, second} {
+		go func(x *actorFileWriter) { <-start; _, c := x.Commit(context.Background()); result <- c }(x)
+	}
+	close(start)
+	a, b := <-result, <-result
+	if !(a == "" && b == ErrDenied || b == "" && a == ErrDenied) {
+		t.Fatal(a, b)
+	}
+	data, e := os.ReadFile(root + "/winner")
+	if e != nil || string(data) != "first" && string(data) != "second" {
+		t.Fatal(string(data), e)
+	}
+}

package/templates/native-go/backend/internal/helper/write_intent_linux.go

@@ -0,0 +1,116 @@
+package helper
+
+import (
+	"encoding/json"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"strings"
+)
+
+type fileWriteIntents struct{ repository *FileGrantRepository }
+
+func (j fileWriteIntents) Reserve(b operationBinding, actor Principal, w writeWork) Code {
+	r := j.repository
+	if r == nil {
+		return ErrUnavailable
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed || r.poisoned || b.Inventory != r.expected || !allReferences(b.Epoch, b.OperationID, b.Nonce, b.GrantID) || b.GrantRevision == 0 || w.validate() != "" || actor.Kind != "local" || !allReferences(actor.SubjectRef, actor.InstanceRef) {
+		return ErrDenied
+	}
+	fd, e := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if e != nil {
+		return ErrUnavailable
+	}
+	directory := os.NewFile(uintptr(fd), "write-intents")
+	limit := 4*MaxGrants + 2*MaxReplayEntries + 32
+	names, e := directory.Readdirnames(limit)
+	directory.Close()
+	if len(names) == limit {
+		return ErrBusy
+	}
+	if e != nil && len(names) == 0 {
+		return ErrUnavailable
+	}
+	count := 0
+	for _, name := range names {
+		if strings.HasPrefix(name, "write-intent-") {
+			count++
+		}
+	}
+	// Retained immutable records deliberately cap lifetime mutation attempts.
+	// No eviction, restart reset or cleanup of unknown filesystem effects.
+	if count >= MaxReplayEntries {
+		return ErrBusy
+	}
+	data, e := json.Marshal(struct {
+		Binding operationBinding `json:"binding"`
+		Actor   Principal        `json:"actor"`
+		Work    writeWork        `json:"work"`
+	}{b, actor, w})
+	if e != nil || len(data) > MaxControlBytes {
+		return ErrLimit
+	}
+	fd, e = unix.Openat(int(r.dir.Fd()), "write-intent-"+b.OperationID+".json", unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
+	if errors.Is(e, unix.EEXIST) {
+		return ErrReplay
+	}
+	if e != nil {
+		return ErrUnavailable
+	}
+	f := os.NewFile(uintptr(fd), "write-intent")
+	defer f.Close()
+	if _, e := grantFileStat(f, 0600, 0); e != nil {
+		return ErrUnavailable
+	}
+	n, e := f.Write(data)
+	if e != nil || n != len(data) {
+		return ErrUnavailable
+	}
+	if f.Sync() != nil || f.Close() != nil || r.dir.Sync() != nil {
+		return ErrCommitUncertain
+	}
+	return ""
+}
+
+// Only final observed receipts are persisted. Missing/partial records remain
+// uncertain; their immutable intent prevents replay across a supervisor restart.
+func (j fileWriteIntents) Record(b operationBinding, m MutationReceipt, code Code) Code {
+	r := j.repository
+	if r == nil {
+		return ErrUnavailable
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed || r.poisoned || b.Inventory != r.expected || !allReferences(b.OperationID) || code != "" && !code.Valid() {
+		return ErrDenied
+	}
+	if _, e := r.read("write-intent-"+b.OperationID+".json", 0600, MaxControlBytes); e != nil {
+		return ErrCleanupRequired
+	}
+	data, e := json.Marshal(struct {
+		Binding operationBinding `json:"binding"`
+		Receipt MutationReceipt  `json:"receipt"`
+		Code    Code             `json:"code"`
+	}{b, m, code})
+	if e != nil {
+		return ErrInvalid
+	}
+	name := "write-receipt-" + b.OperationID + ".json"
+	old, e := r.read(name, 0600, MaxControlBytes)
+	if e == nil {
+		if string(old) != string(data) {
+			return ErrReplay
+		}
+		if r.dir.Sync() != nil {
+			return ErrCommitUncertain
+		}
+		return ""
+	}
+	if !errors.Is(e, unix.ENOENT) {
+		return ErrCleanupRequired
+	}
+	return r.commit(name, data)
+}

package/templates/native-go/backend/internal/helper/write_intent_linux_test.go

@@ -0,0 +1,74 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"os"
+	"testing"
+)
+
+func TestWriteIntentSurvivesRestartAndBoundsLifetimeRetries(t *testing.T) {
+	dir, i, record := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	j := fileWriteIntents{r}
+	b := operationBinding{i, record.Lifecycle.Epoch, grantRef('a'), grantRef('b'), grantRef('c'), 1}
+	actor := Principal{Kind: "local", SubjectRef: grantRef('1'), InstanceRef: grantRef('2')}
+	w := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: 10}
+	if c := j.Reserve(b, actor, w); c != "" {
+		t.Fatal(c)
+	}
+	if c := j.Reserve(b, actor, w); c != ErrReplay {
+		t.Fatal(c)
+	}
+	name := dir + "/write-intent-" + b.OperationID + ".json"
+	var st unix.Stat_t
+	if e := unix.Stat(name, &st); e != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0777 != 0600 || st.Nlink != 1 {
+		t.Fatal(st, e)
+	}
+	r.Close()
+	r = openRootGrantRepository(t, dir, i)
+	j = fileWriteIntents{r}
+	if c := j.Reserve(b, actor, w); c != ErrReplay {
+		t.Fatal("restart replay", c)
+	}
+	// Partial/crashed immutable records remain denial evidence, never removed.
+	if e := os.WriteFile(dir+"/write-intent-"+grantRef('d')+".json", []byte("partial"), 0600); e != nil {
+		t.Fatal(e)
+	}
+	b.OperationID = grantRef('d')
+	if c := j.Reserve(b, actor, w); c != ErrReplay {
+		t.Fatal(c)
+	}
+}
+
+func TestWriteFinalReceiptFsyncGapKeepsIntentAndRefusesChangedRetry(t *testing.T) {
+	dir, i, record := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	j := fileWriteIntents{r}
+	b := operationBinding{i, record.Lifecycle.Epoch, grantRef('a'), grantRef('b'), grantRef('c'), 1}
+	actor := Principal{Kind: "local", SubjectRef: grantRef('1'), InstanceRef: grantRef('2')}
+	w := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: 10}
+	if c := j.Reserve(b, actor, w); c != "" {
+		t.Fatal(c)
+	}
+	m := MutationReceipt{Created: true, Published: true, BytesWritten: 10, Committed: true}
+	r.fault = func(stage string) error {
+		if stage == "after-rename" {
+			return unix.EIO
+		}
+		return nil
+	}
+	if c := j.Record(b, m, ""); c != ErrCommitUncertain {
+		t.Fatal(c)
+	}
+	r.fault = nil
+	if c := j.Record(b, m, ""); c != "" {
+		t.Fatal(c)
+	}
+	m.BytesWritten--
+	if c := j.Record(b, m, ""); c != ErrReplay {
+		t.Fatal("changed receipt", c)
+	}
+	if c := j.Reserve(b, actor, w); c != ErrReplay {
+		t.Fatal("uncertain mutation replay", c)
+	}
+}