@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/grant_readonly_test.go

@@ -0,0 +1,180 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+type readOnlyRootStub struct{ path string }
+
+func (r *readOnlyRootStub) readOnlyRootPath() string                        { return r.path }
+func (r *readOnlyRootStub) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
+
+type readOnlyGrantValidatorStub struct {
+	root  readOnlyRootWitness
+	after func()
+}
+
+func (v readOnlyGrantValidatorStub) ValidateOperation(ctx context.Context, a NativeActor, r DataRequest, g Grant) (GrantUseValidation, Code) {
+	p, c := (grantOperationStub{after: v.after}).ValidateOperation(ctx, a, r, g)
+	p.root = v.root
+	return p, c
+}
+
+type metadataProcessStub struct {
+	*operationFixture
+	result   *readOnlyResult
+	released bool
+}
+
+func (p *metadataProcessStub) readOnlyMetadata() (*readOnlyResult, bool, error) {
+	return p.result, p.result != nil, nil
+}
+func (p *metadataProcessStub) releaseReadOnlyMetadata() error { p.released = true; return nil }
+func (p *metadataProcessStub) readOnlyLeaseReady(n uint32) Code {
+	if !p.released {
+		return ErrBusy
+	}
+	if p.result.Code != "" || uint64(n) > p.result.Bytes {
+		return ErrLimit
+	}
+	return ""
+}
+func readOnlyGrantControl(t *testing.T, g Grant, action Action, op, nonce, ticket byte, args any) DataRequest {
+	t.Helper()
+	r := grantControl(t, g, op, nonce, ticket, 1)
+	r.Op = action
+	r.Args, _ = json.Marshal(args)
+	return r
+}
+func TestGrantReadOnlyUsesExistingReservationForStatAndList(t *testing.T) {
+	for _, action := range []Action{ActionStat, ActionList} {
+		t.Run(string(action), func(t *testing.T) {
+			s, repo, c, carrier, g, _ := grantCohortFixture(t)
+			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
+			s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: "/trusted/root"}}
+			var args any = StatArgs{Segments: []string{"fixture"}}
+			if action == ActionList {
+				args = ListArgs{Segments: []string{}, Limit: 20}
+			}
+			r := readOnlyGrantControl(t, g, action, '1', '2', '3', args)
+			if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
+				t.Fatal(code)
+			}
+			op := c.operations[r.OperationID]
+			if op.work == nil || op.work.Action != action || op.work.RootPath != "/trusted/root" {
+				t.Fatal("fixed work lost", op)
+			}
+			if code := s.chunk(context.Background(), operationPeer{42, 0}, carrier, grantControl(t, g, '1', '4', '5', 1)); code == "" {
+				t.Fatal("read lease changed admitted action")
+			}
+		})
+	}
+}
+func TestGrantReadOnlyMetadataRevalidatesBeforePublication(t *testing.T) {
+	for _, kind := range []string{"valid", "revoked", "fence", "native", "root", "pending", "peer", "wrong-args", "ticket", "revoke-during-validation", "fence-during-validation"} {
+		t.Run(kind, func(t *testing.T) {
+			s, repo, c, carrier, g, _ := grantCohortFixture(t)
+			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
+			root := &readOnlyRootStub{path: "/trusted/root"}
+			s.services.operations = readOnlyGrantValidatorStub{root: root}
+			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Entry: &Entry{Name: "canary"}}}
+			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
+			args := StatArgs{Segments: []string{"fixture"}}
+			r := readOnlyGrantControl(t, g, ActionStat, '1', '2', '3', args)
+			if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
+				t.Fatal(code)
+			}
+			r = readOnlyGrantControl(t, g, ActionStat, '1', '4', '5', args)
+			peer := operationPeer{42, 0}
+			switch kind {
+			case "revoked":
+				repo.store.Grants[0].State = GrantRevoked
+				repo.store.Grants[0].Reason = ErrRevoked
+				repo.store.Grants[0].Revision++
+				repo.store.Grants[0].RevokedAt = g.CreatedAt
+			case "fence":
+				c.gate.fence("before metadata")
+			case "native":
+				s.services.operations = grantOperationStub{code: ErrDenied}
+			case "root":
+				s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: "/other"}}
+			case "revoke-during-validation":
+				s.services.operations = readOnlyGrantValidatorStub{root: root, after: func() {
+					repo.store.Grants[0].State = GrantRevoked
+					repo.store.Grants[0].Reason = ErrRevoked
+					repo.store.Grants[0].Revision++
+					repo.store.Grants[0].RevokedAt = g.CreatedAt
+				}}
+			case "fence-during-validation":
+				s.services.operations = readOnlyGrantValidatorStub{root: root, after: func() { c.gate.fence("during validation") }}
+			case "pending":
+				p.result = nil
+			case "peer":
+				peer.PID++
+			case "wrong-args":
+				r.Args = []byte(`{"segments":["other"]}`)
+			case "ticket":
+				r.Ticket = grantRef('3')
+			}
+			value, code := s.result(context.Background(), peer, carrier, r)
+			if kind == "valid" {
+				if code != "" || value == nil || value.Entry.Name != "canary" || !p.released {
+					t.Fatal(value, code)
+				}
+				value.Entry.Name = "changed"
+				if p.result.Entry.Name != "canary" {
+					t.Fatal("mutable metadata shared")
+				}
+			} else if code == "" || value != nil || p.released {
+				t.Fatal("unvalidated metadata escaped", kind, value, code)
+			}
+		})
+	}
+}
+
+func TestGrantReadOnlyChunkChecksFixedWorkAndRemainingBytes(t *testing.T) {
+	for _, kind := range []string{"valid", "unreleased", "remaining", "root", "action", "segments", "revoked", "fence", "native"} {
+		t.Run(kind, func(t *testing.T) {
+			s, repo, c, carriers, g, _ := grantCohortFixture(t)
+			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
+			root := &readOnlyRootStub{path: "/trusted/root"}
+			s.services.operations = readOnlyGrantValidatorStub{root: root}
+			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Bytes: 3}, released: kind != "unreleased"}
+			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
+			if code := s.start(context.Background(), operationPeer{42, 0}, carriers, grantControl(t, g, '1', '2', '3', 10)); code != "" {
+				t.Fatal(code)
+			}
+			r := grantControl(t, g, '1', '4', '5', 2)
+			switch kind {
+			case "remaining":
+				r = grantControl(t, g, '1', '4', '5', 4)
+			case "root":
+				s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: root.path}}
+			case "action":
+				r.Op = ActionStat
+				r.Args = []byte(`{"segments":["fixture"]}`)
+			case "segments":
+				r.Args = []byte(`{"segments":["other"],"maxBytes":2}`)
+			case "revoked":
+				repo.store.Grants[0].State = GrantRevoked
+				repo.store.Grants[0].Reason = ErrRevoked
+				repo.store.Grants[0].Revision++
+				repo.store.Grants[0].RevokedAt = g.CreatedAt
+			case "fence":
+				c.gate.fence("before lease")
+			case "native":
+				s.services.operations = grantOperationStub{code: ErrDenied}
+			}
+			code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, r)
+			if kind == "valid" {
+				if code != "" || c.operations[r.OperationID].bytes != 2 || !p.pending {
+					t.Fatal(code)
+				}
+			} else if code == "" || c.operations[r.OperationID].bytes != 0 || p.pending {
+				t.Fatal("invalid lease admitted", kind, code)
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/grant_repository_linux.go

@@ -0,0 +1,415 @@
+//go:build linux
+
+package helper
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"golang.org/x/sys/unix"
+)
+
+// FileGrantRepository pins a protected local directory and one root supervisor
+// owner using a lifetime flock. It is Linux/root-only; no injected UID bypass.
+// Lock paths, files and all parents are opened no-follow and checked by FD.
+type FileGrantRepository struct {
+	mu                         sync.Mutex
+	dir, owner, policy, grants *os.File
+	expected                   Inventory
+	known                      string // exact last observed/committed snapshot; detects online replay
+	poisoned, closed           bool
+	fault                      func(string) error // tests only; nil in production
+}
+
+func OpenFileGrantRepository(stateDir string, expected Inventory) (*FileGrantRepository, Code) {
+	if os.Geteuid() != 0 {
+		return nil, ErrDenied
+	}
+	if !expected.Valid() || expected.Protocol != DataProtocol {
+		return nil, ErrIncompatible
+	}
+	dir, err := openGrantDirectory(stateDir)
+	if err != nil {
+		return nil, ErrUnavailable
+	}
+	r := &FileGrantRepository{dir: dir, expected: expected}
+	fail := func(c Code) (*FileGrantRepository, Code) { r.Close(); return nil, c }
+	r.owner, err = r.openLock("grants-owner.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	if err = unix.Flock(int(r.owner.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		return fail(ErrBusy)
+	}
+	r.policy, err = r.openLock("policy.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	r.grants, err = r.openLock("grants.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	if c := r.cleanGrantTemps(); c != "" {
+		return fail(c)
+	}
+	if err = r.dir.Sync(); err != nil {
+		return fail(ErrUnavailable)
+	}
+	return r, ""
+}
+func openGrantDirectory(path string) (*os.File, error) {
+	if !filepath.IsAbs(path) || path != filepath.Clean(path) {
+		return nil, errTrust
+	}
+	fd, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	check := func(fd int) error {
+		var st unix.Stat_t
+		if err := unix.Fstat(fd, &st); err != nil {
+			return err
+		}
+		if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR || st.Mode&0022 != 0 {
+			return errTrust
+		}
+		return nil
+	}
+	if err = check(fd); err != nil {
+		unix.Close(fd)
+		return nil, err
+	}
+	for _, component := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
+		if component == "" {
+			continue
+		}
+		next, e := unix.Openat(fd, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		unix.Close(fd)
+		if e != nil {
+			return nil, e
+		}
+		fd = next
+		if err = check(fd); err != nil {
+			unix.Close(fd)
+			return nil, err
+		}
+	}
+	f := os.NewFile(uintptr(fd), path)
+	if err = lifetimeFilesystem(f); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+func (r *FileGrantRepository) openLock(name string) (*os.File, error) {
+	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_CREAT|unix.O_RDWR|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	if _, err = grantFileStat(f, 0600, 0); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+func grantFileStat(f *os.File, mode uint32, limit int64) (unix.Stat_t, error) {
+	var st unix.Stat_t
+	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
+		return st, err
+	}
+	if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Mode&07777 != mode || st.Nlink != 1 || st.Size < 0 || st.Size > limit {
+		return st, errTrust
+	}
+	return st, nil
+}
+func (r *FileGrantRepository) checkLock(f *os.File) error {
+	st, err := grantFileStat(f, 0600, 0)
+	if err != nil {
+		return err
+	}
+	var path unix.Stat_t
+	if err := unix.Fstatat(int(r.dir.Fd()), f.Name(), &path, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return err
+	}
+	if path.Dev != st.Dev || path.Ino != st.Ino || path.Mode != st.Mode || path.Nlink != 1 {
+		return errTrust
+	}
+	return nil
+}
+func (r *FileGrantRepository) withLocks(fn func() Code) Code {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed || r.poisoned {
+		return ErrFenced
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(r.dir.Fd()), &st) != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR {
+		r.poisoned = true
+		return ErrUnavailable
+	}
+	for _, f := range []*os.File{r.owner, r.policy, r.grants} {
+		if r.checkLock(f) != nil {
+			r.poisoned = true
+			return ErrUnavailable
+		}
+	}
+	if unix.Flock(int(r.policy.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
+		return ErrBusy
+	}
+	defer unix.Flock(int(r.policy.Fd()), unix.LOCK_UN)
+	if unix.Flock(int(r.grants.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
+		return ErrBusy
+	}
+	defer unix.Flock(int(r.grants.Fd()), unix.LOCK_UN)
+	return fn()
+}
+func (r *FileGrantRepository) read(name string, mode uint32, limit int64) ([]byte, error) {
+	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	defer f.Close()
+	if _, err := grantFileStat(f, mode, limit); err != nil {
+		return nil, err
+	}
+	b, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(b)) > limit {
+		return nil, errTrust
+	}
+	return b, nil
+}
+func (r *FileGrantRepository) readPolicy() (GrantPolicy, Code) {
+	// Existing approval snapshots are root:root 0644; they have no credentials.
+	// Decode strict schema 2 independently from the grant schema 1 authority.
+	b, err := r.read("approval.json", 0644, 4096)
+	if err != nil {
+		return GrantPolicy{}, ErrUnavailable
+	}
+	var record Record
+	if c := decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
+		return GrantPolicy{}, c
+	}
+	if record.Schema != 2 || record.Inventory != r.expected || record.Lifecycle == nil || !record.Lifecycle.valid() {
+		return GrantPolicy{}, ErrIncompatible
+	}
+	canonical, err := json.Marshal(record)
+	if err != nil {
+		return GrantPolicy{}, ErrInternal
+	}
+	sum := sha256.Sum256(canonical)
+	p := GrantPolicy{Inventory: record.Inventory, Epoch: record.Lifecycle.Epoch, ApprovalBinding: hex.EncodeToString(sum[:]), CapabilityDigest: record.Inventory.RegistryDigest, Enabled: record.Enabled && !record.Residual && record.Lifecycle.Phase == "running"}
+	return p, ""
+}
+func snapshotDigest(b []byte) string { sum := sha256.Sum256(b); return hex.EncodeToString(sum[:]) }
+func (r *FileGrantRepository) load() (GrantStore, Code) {
+	b, err := r.read("grants.json", 0600, MaxGrantStoreBytes)
+	if errors.Is(err, unix.ENOENT) && r.known == "" {
+		return GrantStore{Schema: GrantSchema, Revision: 1, Grants: []Grant{}}, ""
+	}
+	if err != nil {
+		r.poisoned = true
+		return GrantStore{}, ErrUnavailable
+	}
+	digest := snapshotDigest(b)
+	if r.known != "" && digest != r.known {
+		r.poisoned = true
+		return GrantStore{}, ErrStale
+	}
+	s, c := DecodeGrantStore(bytes.NewReader(b))
+	if c != "" {
+		r.poisoned = true
+		return GrantStore{}, c
+	}
+	r.known = digest
+	return s, ""
+}
+func (r *FileGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
+	if fn == nil {
+		return ErrInvalid
+	}
+	return r.withLocks(func() Code {
+		p, c := r.readPolicy()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		s, c := r.load()
+		if c != "" {
+			return c
+		}
+		old := cloneAuthorityStore(s)
+		write, c := fn(p, &s)
+		if c = safeGrantCode(c); c != "" {
+			return c
+		}
+		if !write {
+			return ""
+		}
+		b, err := json.Marshal(s)
+		if err != nil {
+			return ErrInvalid
+		}
+		if _, c := DecodeGrantStore(bytes.NewReader(b)); c != "" {
+			return c
+		}
+		if c := validateGrantTransition(old, s, p); c != "" {
+			return c
+		}
+		c = r.commit("grants.json", b)
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		r.known = snapshotDigest(b)
+		return ""
+	})
+}
+func (r *FileGrantRepository) atStage(stage string) error {
+	if r.fault != nil {
+		return r.fault(stage)
+	}
+	return nil
+}
+func (r *FileGrantRepository) commit(name string, b []byte) Code {
+	id, c := randomGrantID()
+	if c != "" {
+		return c
+	}
+	temp := ".grant-transition-" + id
+	fd, err := unix.Openat(int(r.dir.Fd()), temp, unix.O_CREAT|unix.O_EXCL|unix.O_WRONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return ErrUnavailable
+	}
+	f := os.NewFile(uintptr(fd), temp)
+	defer f.Close()
+	defer unix.Unlinkat(int(r.dir.Fd()), temp, 0)
+	if err = f.Chmod(0600); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("write"); err != nil {
+		return ErrUnavailable
+	}
+	if n, err := f.Write(b); err != nil || n != len(b) {
+		return ErrUnavailable
+	}
+	if err = r.atStage("file-sync"); err != nil {
+		return ErrUnavailable
+	}
+	if err = f.Sync(); err != nil {
+		return ErrUnavailable
+	}
+	if err = f.Close(); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("rename"); err != nil {
+		return ErrUnavailable
+	}
+	if err = unix.Renameat(int(r.dir.Fd()), temp, int(r.dir.Fd()), name); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("after-rename"); err != nil {
+		return ErrCommitUncertain
+	}
+	if err = r.atStage("directory-sync"); err != nil {
+		return ErrCommitUncertain
+	}
+	if err = r.dir.Sync(); err != nil {
+		return ErrCommitUncertain
+	}
+	return ""
+}
+func (r *FileGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
+	if !completeQuiescence(q) {
+		return ErrInvalid
+	}
+	return r.withLocks(func() Code {
+		p, c := r.readPolicy()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		if q.Key.Epoch != p.Epoch {
+			return ErrStale
+		}
+		s, c := r.load()
+		if c != "" {
+			return c
+		}
+		g := findGrant(&s, q.Key.GrantID)
+		if g == nil || g.State != GrantRevoked || g.Revision != q.Key.Revision {
+			return ErrStale
+		}
+		// One opaque-name proof per tombstone, <=256; never authority on restart.
+		b, err := json.Marshal(q)
+		if err != nil {
+			return ErrInternal
+		}
+		c = r.commit("grant-q-"+g.ID+".json", b)
+		if c != "" {
+			r.poisoned = true
+		}
+		return c
+	})
+}
+func (r *FileGrantRepository) Close() error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
+		return nil
+	}
+	r.closed = true
+	var err error
+	for _, f := range []*os.File{r.grants, r.policy, r.owner, r.dir} {
+		if f != nil {
+			err = errors.Join(err, f.Close())
+		}
+	}
+	return err
+}
+
+// The owner lock excludes every other writer. Orphan temp names are never
+// authority. Only exact generated names and protected, singly linked root files
+// are removed. Bound enumeration and refuse unknown/untrusted residues.
+func (r *FileGrantRepository) cleanGrantTemps() Code {
+	fd, err := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return ErrUnavailable
+	}
+	listing := os.NewFile(uintptr(fd), "state-listing")
+	defer listing.Close()
+	names, err := listing.Readdirnames(4097)
+	if err != nil && err != io.EOF {
+		return ErrUnavailable
+	}
+	if len(names) > 4096 {
+		return ErrLimit
+	}
+	for _, name := range names {
+		if !strings.HasPrefix(name, ".grant-transition-") {
+			continue
+		}
+		if !allReferences(strings.TrimPrefix(name, ".grant-transition-")) {
+			return ErrCleanupRequired
+		}
+		if _, err := r.read(name, 0600, MaxGrantStoreBytes); err != nil {
+			return ErrCleanupRequired
+		}
+		if err := unix.Unlinkat(int(r.dir.Fd()), name, 0); err != nil {
+			return ErrCleanupRequired
+		}
+	}
+	return ""
+}