@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/publication_test.go

@@ -0,0 +1,178 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// An approval rename is visible before the publisher's directory fsync and
+// policy.lock release. Reproduce that interval with real files and flock.
+func heldCompletion(t *testing.T, c Controller, f *fakeProcesses) (<-chan error, func()) {
+	t.Helper()
+	published := make(chan error, 1)
+	var lock *os.File
+	f.stopHook = func(p Process) error {
+		var err error
+		lock, err = os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_RDWR, 0)
+		if err == nil {
+			err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+		}
+		if err == nil {
+			err = cleanRuntime(c.Client, true)
+		}
+		if err == nil {
+			var r Record
+			r, err = readRecord(c.StateDir, c.Owner)
+			if err == nil {
+				r.Lifecycle.Phase = "stopped"
+				err = storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p})
+				if err == nil {
+					err = writeProtected(c.StateDir, "approval.json", r)
+				}
+			}
+		}
+		published <- err
+		return errTrust // owner completed before the controller socket operation
+	}
+	release := func() {
+		if lock != nil {
+			syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+			lock.Close()
+			lock = nil
+		}
+	}
+	return published, release
+}
+
+func TestControllerWaitsForCompletionPublisherUnlock(t *testing.T) {
+	for _, action := range []string{"teardown", "disable", "recover", "enable"} {
+		t.Run(action, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), action) }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before the completion publisher unlocked: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			release()
+			select {
+			case err := <-result:
+				if err != nil {
+					t.Fatal("exact owner completion refused after unlock", err)
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("controller did not finish after publisher unlock")
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			starts := 0
+			if action == "enable" || action == "recover" {
+				starts = 1
+			}
+			if r.Residual || r.Enabled != (action != "disable") || f.started != starts {
+				t.Fatal("incorrect post-teardown state", r, f.started)
+			}
+		})
+	}
+}
+
+func TestControllerRevalidatesCompletionAfterPublisherUnlock(t *testing.T) {
+	for _, kind := range []string{"epoch", "inventory", "binding", "lease", "proof", "digest", "missing-commit", "missing-proof", "mode", "symlink", "runtime"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), "recover") }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before revalidation: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			switch kind {
+			case "epoch":
+				r.Lifecycle.Epoch = strings.Repeat("e", 64)
+			case "inventory":
+				r.Inventory.Version = "9.0.0-0001"
+			case "binding":
+				r.Lifecycle.Binding.Entered++
+			case "lease":
+				r.Lifecycle.Lease = &Lease{Device: 1, Inode: 9}
+			case "proof":
+				p := f.current
+				p.Start = "different-owned-process"
+				if err := storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p}); err != nil {
+					t.Fatal(err)
+				}
+			case "digest":
+				r.Lifecycle.Completion = strings.Repeat("f", 64)
+			case "missing-commit":
+				r.Lifecycle.Completion = ""
+			case "missing-proof", "mode", "symlink":
+				path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+				var err error
+				if kind == "mode" {
+					err = os.Chmod(path, 0644)
+				} else {
+					err = os.Remove(path)
+					if err == nil && kind == "symlink" {
+						err = os.Symlink("approval.json", path)
+					}
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+			case "runtime":
+				if err := writeProcess(c.RunDir, f.current); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+				t.Fatal(err)
+			}
+			before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			release()
+			if err := <-result; err == nil || f.started != 0 {
+				t.Fatal("changed completion accepted", err, f.started)
+			}
+			after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if string(before) != string(after) {
+				t.Fatal("failure evidence overwritten")
+			}
+		})
+	}
+}
+
+func TestControllerCompletionPublisherWaitIsBounded(t *testing.T) {
+	c, f := controlFixture(t)
+	published, release := heldCompletion(t, c, f)
+	defer release()
+	result := make(chan error, 1)
+	go func() { result <- c.Control(context.Background(), "teardown") }()
+	if err := <-published; err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if !errors.Is(err, errBusy) {
+			t.Fatal("persistent publisher lock was accepted", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("unbounded publisher lock wait")
+	}
+}

package/dist/templates/native-go/backend/internal/helper/read_stream_cohort_linux_test.go

@@ -0,0 +1,156 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+func readStreamVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionReadStream}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, e := os.ReadFile(p.StateDir + "/grants.json")
+	if e != nil {
+		t.Fatal(e)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func readStreamVMWait(t *testing.T, fn func() bool) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err := waitHealthy(ctx, func(context.Context) bool { return fn() }); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestLinuxReadStreamRealChildProofBackpressureAndQ(t *testing.T) {
+	for _, kind := range []string{"complete", "acl", "groups", "disconnect", "epoch", "backpressure"} {
+		t.Run(kind, func(t *testing.T) {
+			p := readOnlyVMFixture(t)
+			proc := startVMHelper(t, p)
+			g := readStreamVMCreate(t, p)
+			defer func() {
+				if e := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); e != nil {
+					t.Error(e)
+				}
+			}()
+			expected := bytes.Repeat([]byte("s"), 2*MaxBoundedBytes)
+			if e := os.WriteFile("/tmp/m2-s5-operations/stream", expected, 0644); e != nil {
+				t.Fatal(e)
+			}
+			if kind == "backpressure" {
+				os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
+			}
+			if kind == "disconnect" {
+				os.WriteFile(p.RunDir+"/fixture-disconnect", nil, 0600)
+			}
+			r := readOnlyVMRequest(t, g, ActionReadStream, ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxTransferBytes})
+			if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+				t.Fatal(res)
+			}
+			metadata := grantVMMetadata(t, p, r)
+			if metadata.Code != "" || metadata.Bytes != uint64(len(expected)) {
+				t.Fatal(metadata)
+			}
+			chunk := r
+			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxChunkBytes})
+			lease := func() Code {
+				chunk.Nonce = readOnlyVMRef(t)
+				chunk.Ticket = readOnlyVMRef(t)
+				return grantVMCall(t, p, "operation.chunk", chunk).Code
+			}
+			if code := lease(); code != "" {
+				t.Fatal(code)
+			}
+			if kind == "backpressure" {
+				if code := lease(); code != ErrBusy {
+					t.Fatal("slow client accepted second outstanding lease", code)
+				}
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || res.Revoke == nil || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+				raw, e := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+				var q GrantQuiescence
+				if e != nil || json.Unmarshal(raw, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.AdmittedBytes != MaxChunkBytes {
+					t.Fatal(q, e)
+				}
+				if code := lease(); code == "" {
+					t.Fatal("lease after R/Q")
+				}
+				return
+			}
+			readStreamVMWait(t, func() bool {
+				b, _ := os.ReadFile(p.RunDir + "/fixture-progress")
+				n, _ := strconv.Atoi(string(b))
+				return n == MaxChunkBytes
+			})
+			switch kind {
+			case "acl":
+				os.WriteFile("/tmp/m2-s5-operations/deny-acl", nil, 0644)
+			case "groups":
+				os.WriteFile("/tmp/m2-s5-operations/group-change", nil, 0644)
+			case "epoch":
+				chunk.Epoch = grantRef('f')
+			}
+			if kind == "complete" {
+				for sent := MaxChunkBytes; sent < len(expected); {
+					code := lease()
+					if code == ErrBusy {
+						time.Sleep(time.Millisecond)
+						continue
+					}
+					if code != "" {
+						t.Fatal(sent, code)
+					}
+					sent += MaxChunkBytes
+				}
+			} else if kind != "disconnect" {
+				code := lease()
+				if kind != "acl" && code == "" {
+					t.Fatal("changed binding admitted", kind)
+				}
+			}
+			if kind == "epoch" {
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+			}
+			readStreamVMWait(t, func() bool {
+				_, e := os.Stat(p.RunDir + "/fixture-readonly-bytes")
+				return e == nil && len(processChildren(proc.PID)) == 1
+			})
+			b, e := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
+			if e != nil {
+				t.Fatal(e)
+			}
+			want := MaxChunkBytes
+			if kind == "complete" {
+				want = len(expected)
+			}
+			if len(b) != want || !bytes.Equal(b, expected[:want]) {
+				t.Fatal(kind, "unproved or truncated bytes", len(b), want)
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/read_transfer.go

@@ -0,0 +1,40 @@
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// Stream is a staged fixed read action. It has no public socket/generator/CGI
+// enablement until DSM FD ACL and end-to-end CGI proof pass.
+const MaxStreamReplayEntries = MaxPackageOperations * (MaxTransferBytes/MaxChunkBytes + MaxReplayEntries)
+
+func readDataCeiling(a Action) uint64 {
+	if a == ActionReadStream {
+		return MaxTransferBytes
+	}
+	return MaxBoundedBytes
+}
+func (op *cohortOperation) expired(now time.Time) bool {
+	if op.admittedAt.IsZero() {
+		return false
+	}
+	stream := op.work != nil && op.work.Action == ActionReadStream || op.writeWork != nil && op.writeWork.Action == ActionWriteStream
+	if !stream {
+		return now.Sub(op.admittedAt) >= BoundedTimeout
+	}
+	last := op.lastActivity
+	if last.IsZero() {
+		last = op.admittedAt
+	}
+	return now.Before(op.admittedAt) || now.Before(last) || now.Sub(op.admittedAt) >= StreamTotalTimeout || now.Sub(last) >= StreamIdleTimeout
+}
+
+// Internal child stream interface. Only a fixed actor-opened FD implementation
+// is constructed by bootstrap. Caller transport supplies leases, never a source.
+// A successful chunk includes fresh child FD ACL/object checks. Root separately
+// binds subject/session/ticket/grant/revision/epoch under the S3 admission lock.
+type readStreamSource interface {
+	ReadChunk(context.Context, uint32) ([]byte, Code)
+	Close()
+}

package/dist/templates/native-go/backend/internal/helper/read_transfer_linux.go

@@ -0,0 +1,109 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"io"
+)
+
+// Child-only FD source. Bounded reads retain S5's eager validation/buffer;
+// streams retain the captured object and allocate at most one leased chunk.
+// No caller path, range, URL, executable, or root-opened readable FD is accepted.
+type actorReadTransfer struct {
+	ctx               context.Context
+	object            *readOnlyObject
+	work              readOnlyWork
+	acl               readOnlyACL
+	buffer            []byte
+	remaining, offset uint64
+}
+
+func openActorReadTransfer(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (*actorReadTransfer, readOnlyResult) {
+	fail := func(c Code) (*actorReadTransfer, readOnlyResult) { return nil, readOnlyResult{Code: c} }
+	if code := w.validate(); code != "" {
+		return fail(code)
+	}
+	if w.Action != ActionRead && w.Action != ActionReadStream {
+		return fail(ErrUnsupported)
+	}
+	if acl == nil {
+		return fail(ErrUnsupported)
+	}
+	o, code := resolveReadOnly(ctx, pin, w)
+	if code != "" {
+		return fail(code)
+	}
+	ok := false
+	defer func() {
+		if !ok {
+			o.Close()
+		}
+	}()
+	if code := authorizeReadOnly(ctx, o, w, acl); code != "" {
+		return fail(code)
+	}
+	if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
+		return fail(ErrDenied)
+	}
+	if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
+		return fail(ErrLimit)
+	}
+	src := &actorReadTransfer{ctx: ctx, object: o, work: w, acl: acl, remaining: uint64(o.before.Size)}
+	if w.Action == ActionRead {
+		b, err := io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
+		if err != nil {
+			return fail(readOnlyError(err))
+		}
+		if uint64(len(b)) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		if uint64(len(b)) != src.remaining {
+			return fail(ErrStale)
+		}
+		src.buffer = b
+	}
+	if code := src.check(); code != "" {
+		return fail(code)
+	}
+	ok = true
+	return src, readOnlyResult{Bytes: src.remaining}
+}
+func (s *actorReadTransfer) check() Code {
+	if code := authorizeReadOnly(s.ctx, s.object, s.work, s.acl); code != "" {
+		return code
+	}
+	return readOnlyUnchanged(int(s.object.data.Fd()), s.object.before)
+}
+func (s *actorReadTransfer) Next(n uint32) ([]byte, Code) {
+	if n == 0 || n > MaxChunkBytes || uint64(n) > s.remaining {
+		return nil, ErrLimit
+	}
+	if code := s.check(); code != "" {
+		return nil, code
+	}
+	var b []byte
+	if s.work.Action == ActionRead {
+		b = s.buffer[s.offset : s.offset+uint64(n)]
+	} else {
+		b = make([]byte, n)
+		if _, err := io.ReadFull(s.object.data, b); err != nil {
+			return nil, ErrStale
+		}
+	}
+	if code := s.check(); code != "" {
+		return nil, code
+	}
+	s.remaining -= uint64(n)
+	s.offset += uint64(n)
+	return b, ""
+}
+func (s *actorReadTransfer) Close() { s.object.Close(); s.buffer = nil }
+
+var _ readStreamSource = (*actorReadTransfer)(nil)
+
+func (s *actorReadTransfer) ReadChunk(ctx context.Context, n uint32) ([]byte, Code) {
+	original := s.ctx
+	s.ctx = ctx
+	defer func() { s.ctx = original }()
+	return s.Next(n)
+}

package/dist/templates/native-go/backend/internal/helper/read_transfer_linux_test.go

@@ -0,0 +1,118 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"testing"
+)
+
+func TestActorReadStreamChunkACLAndChange(t *testing.T) {
+	for _, kind := range []string{"valid", "acl", "replacement", "hardlink", "mutation", "oversize", "cancel"} {
+		t.Run(kind, func(t *testing.T) {
+			pin, root := readOnlyFixture(t)
+			data := bytes.Repeat([]byte("z"), 2*MaxChunkBytes)
+			os.WriteFile(root+"/file", data, 0644)
+			acl := &changingTransferACL{}
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			w := readWork(pin, "file")
+			w.Action = ActionReadStream
+			w.MaxBytes = MaxTransferBytes
+			src, result := openActorReadTransfer(ctx, pin, w, acl)
+			if result.Code != "" || src == nil || result.Bytes != uint64(len(data)) {
+				t.Fatal(result)
+			}
+			defer src.Close()
+			b, code := src.Next(MaxChunkBytes)
+			if code != "" || len(b) != MaxChunkBytes {
+				t.Fatal(code)
+			}
+			switch kind {
+			case "acl":
+				acl.deny = true
+			case "replacement":
+				os.Rename(root+"/file", root+"/old")
+				os.WriteFile(root+"/file", data, 0644)
+			case "hardlink":
+				os.Link(root+"/file", root+"/alias")
+			case "mutation":
+				os.WriteFile(root+"/file", data[:1], 0644)
+			case "cancel":
+				cancel()
+			}
+			n := uint32(MaxChunkBytes)
+			if kind == "oversize" {
+				n++
+			}
+			b, code = src.Next(n)
+			if kind == "valid" {
+				if code != "" || len(b) != MaxChunkBytes || acl.calls < 6 {
+					t.Fatal(code, acl.calls)
+				}
+			} else if code == "" || len(b) != 0 {
+				t.Fatal("unproved chunk escaped", code, len(b))
+			}
+		})
+	}
+}
+
+type changingTransferACL struct {
+	deny  bool
+	calls int
+}
+
+func (a *changingTransferACL) Authorize(context.Context, Action, int) Code {
+	a.calls++
+	if a.deny {
+		return ErrDenied
+	}
+	return ""
+}
+
+func TestActorReadStreamMaximumHasNoWholeFileBuffer(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	f, e := os.Create(root + "/maximum")
+	if e != nil {
+		t.Fatal(e)
+	}
+	if e = f.Truncate(MaxTransferBytes); e != nil {
+		t.Fatal(e)
+	}
+	f.Close()
+	w := readWork(pin, "maximum")
+	w.Action = ActionReadStream
+	w.MaxBytes = MaxTransferBytes
+	ctx, cancel := context.WithTimeout(context.Background(), StreamTotalTimeout)
+	defer cancel()
+	src, result := openActorReadTransfer(ctx, pin, w, fixtureReadOnlyACL{})
+	if result.Code != "" || src == nil || src.buffer != nil || result.Bytes != MaxTransferBytes {
+		t.Fatal(result)
+	}
+	defer src.Close()
+	for n := 0; n < MaxTransferBytes/MaxChunkBytes; n++ {
+		b, code := src.Next(MaxChunkBytes)
+		if code != "" || len(b) != MaxChunkBytes {
+			t.Fatal(n, code)
+		}
+	}
+	if _, code := src.Next(1); code != ErrLimit {
+		t.Fatal("read beyond transfer ceiling", code)
+	}
+}
+
+func TestReadStreamOutputWatchErrorSurvivesSuccessfulChunk(t *testing.T) {
+	p := newLinuxOperationRelay(nil, nil, nil, nil)
+	p.outputWatch = make(chan error, 1)
+	p.outputWatchDone = false
+	p.outputWatch <- io.ErrClosedPipe
+	p.pending = make(chan operationRelayOutcome, 1)
+	p.pending <- operationRelayOutcome{}
+	if _, err := p.idle(); err == nil {
+		t.Fatal("successful chunk erased disconnect")
+	}
+	if _, err := p.idle(); err == nil {
+		t.Fatal("disconnect observation lost")
+	}
+}