@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/cohort_publication_test.go

@@ -0,0 +1,105 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestCohortPolicyRetryBusyOnlyAndBounded(t *testing.T) {
+	calls := 0
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	begin := time.Now()
+	if err := retryCohortPolicy(ctx, func() error { calls++; return errBusy }); !errors.Is(err, errBusy) {
+		t.Fatal(err)
+	}
+	if calls < 2 || time.Since(begin) > time.Second {
+		t.Fatal("unbounded or missing busy retry", calls)
+	}
+	calls = 0
+	if err := retryCohortPolicy(context.Background(), func() error { calls++; return errTrust }); !errors.Is(err, errTrust) || calls != 1 {
+		t.Fatal("nonbusy refusal retried", err, calls)
+	}
+	calls = 0
+	if err := retryCohortPolicy(context.Background(), func() error {
+		calls++
+		if calls == 1 {
+			return errBusy
+		}
+		return nil
+	}); err != nil || calls != 2 {
+		t.Fatal(err, calls)
+	}
+}
+func TestCohortFenceRetryRevalidatesUnderPolicyLock(t *testing.T) {
+	for _, change := range []string{"release", "epoch", "inventory", "stopped"} {
+		t.Run(change, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			before, _ := readRecord(c.StateDir, c.Owner)
+			lock, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR, 0600)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer lock.Close()
+			if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+				t.Fatal(err)
+			}
+			attempted := make(chan struct{})
+			result := make(chan error, 1)
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			go func() {
+				once := false
+				result <- retryCohortPolicy(ctx, func() error {
+					err := fenceRecord(c.Client, before.Lifecycle.Epoch, "unit-stopped")
+					if !once {
+						once = true
+						close(attempted)
+					}
+					return err
+				})
+			}()
+			<-attempted
+			r, _ := readRecord(c.StateDir, c.Owner)
+			switch change {
+			case "epoch":
+				r.Lifecycle.Epoch = strings.Repeat("e", 64)
+			case "inventory":
+				r.Inventory.Version = "9.0.0-0001"
+			case "stopped":
+				r.Lifecycle.Phase = "stopped"
+			}
+			if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+				t.Fatal(err)
+			}
+			saved, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_UN); err != nil {
+				t.Fatal(err)
+			}
+			err = <-result
+			if change == "release" {
+				if err != nil {
+					t.Fatal(err)
+				}
+				current, _ := readRecord(c.StateDir, c.Owner)
+				if current.Lifecycle.Phase != "fenced" {
+					t.Fatal(current)
+				}
+			} else {
+				if !errors.Is(err, errTrust) {
+					t.Fatal("changed authority retried/accepted", err)
+				}
+				after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+				if string(after) != string(saved) {
+					t.Fatal("changed authority overwritten")
+				}
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/cohort_test.go

@@ -0,0 +1,372 @@
+package helper
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+type operationFixture struct {
+	childFixture
+	stopped bool
+	pending bool
+	stuck   bool
+	leases  int
+}
+
+func (f *operationFixture) chunk(n uint32) error { f.pending = true; f.leases++; return nil }
+func (f *operationFixture) idle() (bool, error)  { return !f.pending, nil }
+func (f *operationFixture) stopRelay() {
+	f.stopped = true
+	if !f.stuck {
+		f.pending = false
+	}
+}
+func (f *operationFixture) relayStopped() bool { return f.stopped && !f.pending }
+
+func cohortFixture(t *testing.T) (*operationCohort, *NativeProvider, SessionCarriers, NativeActor, operationBinding, *[]*operationFixture) {
+	t.Helper()
+	p, _, _, carrier, now := nativeFixture()
+	actor, code := p.Resolve(context.Background(), carrier)
+	if code != "" {
+		t.Fatal(code)
+	}
+	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: strings.Repeat("d", 64), RegistryDigest: strings.Repeat("e", 64)}
+	gate := newAdmission(Binding{Boot: "boot", Install: "install"})
+	gate.observe(gate.binding, 1, true, now)
+	children := new([]*operationFixture)
+	c := newOperationCohort(i, strings.Repeat("f", 64), 42, gate, func() bool { return true })
+	c.now = func() time.Time { return now }
+	c.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
+		f := &operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}
+		*children = append(*children, f)
+		return f, nil
+	}
+	b := operationBinding{Inventory: i, Epoch: c.epoch, OperationID: fmt.Sprintf("%064x", 1), Nonce: fmt.Sprintf("%064x", 2), GrantID: strings.Repeat("1", 64), GrantRevision: 1}
+	return c, p, carrier, actor, b, children
+}
+func TestCohortPeerBindingActorReplayAndLimits(t *testing.T) {
+	for _, name := range []string{"peer", "uid", "inventory", "epoch", "zero-actor", "expired-actor", "root", "groups", "nonce", "revision"} {
+		t.Run(name, func(t *testing.T) {
+			c, p, carrier, a, b, children := cohortFixture(t)
+			peer := operationPeer{PID: 42, UID: 0}
+			switch name {
+			case "peer":
+				peer.PID = 43
+			case "uid":
+				peer.UID = 1
+			case "inventory":
+				b.Inventory.RegistryDigest = strings.Repeat("0", 64)
+			case "epoch":
+				b.Epoch = strings.Repeat("0", 64)
+			case "zero-actor":
+				a = NativeActor{}
+			case "expired-actor":
+				p.now = func() time.Time { return c.now().Add(3 * time.Second) }
+			case "root":
+				a.account.UID = 0
+			case "groups":
+				a.account.Groups = nil
+			case "nonce":
+				b.Nonce = "bad"
+			case "revision":
+				b.GrantRevision = 0
+			}
+			if c.start(context.Background(), peer, p, carrier, a, b) == "" || len(*children) != 0 {
+				t.Fatal("invalid work started")
+			}
+		})
+	}
+	c, p, carrier, a, b, children := cohortFixture(t)
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != ErrReplay {
+		t.Fatal(code)
+	}
+	b.OperationID = fmt.Sprintf("%064x", 3)
+	b.Nonce = fmt.Sprintf("%064x", 4)
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	b.OperationID = fmt.Sprintf("%064x", 5)
+	b.Nonce = fmt.Sprintf("%064x", 6)
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != ErrBusy || len(*children) != 2 {
+		t.Fatal(code)
+	}
+}
+func TestCohortChunkFenceAndCompletion(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	peer := operationPeer{42, 0}
+	if code := c.start(context.Background(), peer, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	if _, err := c.proof(); err == nil {
+		t.Fatal("live cohort completed")
+	}
+	if code := c.chunk(context.Background(), peer, p, carrier, b, MaxChunkBytes); code != "" {
+		t.Fatal(code)
+	}
+	if code := c.chunk(context.Background(), peer, p, carrier, b, 1); code != ErrBusy {
+		t.Fatal(code)
+	}
+	c.gate.fence("fixture")
+	if code := c.chunk(context.Background(), peer, p, carrier, b, 1); code != ErrFenced {
+		t.Fatal(code)
+	}
+	if len((*children)[0].signals) != 0 {
+		t.Fatal("signal preceded durable fence/drain")
+	}
+	if err := c.drain(context.Background(), time.Millisecond); err != nil {
+		t.Fatal(err)
+	}
+	q, err := c.proof()
+	if err != nil || q.Started != 1 || q.Reaped != 1 || !q.RelaysStopped {
+		t.Fatal(q, err)
+	}
+	if !(*children)[0].stopped {
+		t.Fatal("relay survived")
+	}
+	if code := c.start(context.Background(), peer, p, carrier, a, b); code != ErrFenced {
+		t.Fatal(code)
+	}
+}
+func TestCohortUnknownReapAndBlockedRelayNeverComplete(t *testing.T) {
+	for _, kind := range []string{"ECHILD", "relay"} {
+		t.Run(kind, func(t *testing.T) {
+			c, p, carrier, a, b, children := cohortFixture(t)
+			if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != "" {
+				t.Fatal(code)
+			}
+			f := (*children)[0]
+			if kind == "ECHILD" {
+				f.err = syscall.ECHILD
+			} else {
+				f.stuck = true
+				f.pending = true
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+			defer cancel()
+			if c.drain(ctx, time.Millisecond) == nil {
+				t.Fatal("unknown quiescence accepted")
+			}
+			if _, err := c.proof(); err == nil {
+				t.Fatal("invalid proof")
+			}
+			if kind == "ECHILD" && len(f.signals) != 0 {
+				t.Fatal("foreign child signalled")
+			}
+		})
+	}
+}
+func TestCohortRevalidationCancelsWithoutGrantRollback(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	peer := operationPeer{42, 0}
+	if code := c.start(context.Background(), peer, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	p.accounts.(*fakeLocalAccount).value.Groups = []uint32{999}
+	if code := c.chunk(context.Background(), peer, p, carrier, b, 1); code != ErrStale {
+		t.Fatal(code)
+	}
+	if !(*children)[0].stopped {
+		t.Fatal("invalid identity left relay live")
+	}
+	if code := c.chunk(context.Background(), peer, p, carrier, b, 1); code != ErrCanceled {
+		t.Fatal(code)
+	}
+	if c.drain(context.Background(), time.Millisecond) != nil {
+		t.Fatal("drain failed")
+	}
+}
+
+func TestCohortPackageLimitGrantDrainAndReplayRetention(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	peer := operationPeer{42, 0}
+	bindings := []operationBinding{}
+	for n := 0; n < 4; n++ {
+		subject := fmt.Sprintf("%064x", 100+n/2)
+		p.accounts.(*fakeLocalAccount).value.Principal.SubjectRef = subject
+		a, code := p.Resolve(context.Background(), carrier)
+		if code != "" {
+			t.Fatal(code)
+		}
+		b.OperationID = fmt.Sprintf("%064x", 10+n)
+		b.Nonce = fmt.Sprintf("%064x", 20+n)
+		b.GrantID = fmt.Sprintf("%064x", 30+n/2)
+		if code := c.start(context.Background(), peer, p, carrier, a, b); code != "" {
+			t.Fatal(code)
+		}
+		bindings = append(bindings, b)
+	}
+	p.accounts.(*fakeLocalAccount).value.Principal.SubjectRef = fmt.Sprintf("%064x", 500)
+	a, code := p.Resolve(context.Background(), carrier)
+	if code != "" {
+		t.Fatal(code)
+	}
+	b.OperationID = fmt.Sprintf("%064x", 99)
+	b.Nonce = fmt.Sprintf("%064x", 98)
+	if code := c.start(context.Background(), peer, p, carrier, a, b); code != ErrBusy {
+		t.Fatal(code)
+	}
+	if err := c.cancelGrant(context.Background(), bindings[0].GrantID, 1); err != nil {
+		t.Fatal(err)
+	}
+	if len(c.operations) != 2 || !(*children)[0].reaped || !(*children)[1].reaped || (*children)[2].stopped {
+		t.Fatal("per-grant drain affected wrong cohort")
+	}
+	// A completed ID remains burned even when slots become available.
+	if code := c.start(context.Background(), peer, p, carrier, a, bindings[0]); code != ErrReplay {
+		t.Fatal(code)
+	}
+	if err := c.drain(context.Background(), time.Millisecond); err != nil {
+		t.Fatal(err)
+	}
+	q, err := c.proof()
+	if err != nil || q.Reaped != 4 {
+		t.Fatal(q, err)
+	}
+}
+func TestCohortChunkBoundsAndForeignBinding(t *testing.T) {
+	for _, kind := range []string{"zero", "large", "total", "foreign", "helper-dead"} {
+		t.Run(kind, func(t *testing.T) {
+			c, p, carrier, a, b, _ := cohortFixture(t)
+			peer := operationPeer{42, 0}
+			if code := c.start(context.Background(), peer, p, carrier, a, b); code != "" {
+				t.Fatal(code)
+			}
+			n := uint32(1)
+			want := ErrLimit
+			switch kind {
+			case "zero":
+				n = 0
+			case "large":
+				n = MaxChunkBytes + 1
+			case "total":
+				c.operations[b.OperationID].bytes = MaxBoundedBytes
+			case "foreign":
+				b.GrantRevision++
+				want = ErrDenied
+			case "helper-dead":
+				c.helperLive = func() bool { return false }
+				want = ErrDenied
+			}
+			if code := c.chunk(context.Background(), peer, p, carrier, b, n); code != want {
+				t.Fatal(code)
+			}
+		})
+	}
+}
+func TestCohortAdmissionOrdersObserverFence(t *testing.T) {
+	c, p, carrier, a, b, _ := cohortFixture(t)
+	// Fence delivered during native lookup must win before spawn.
+	p.accounts.(*fakeLocalAccount).after = func() { c.gate.fence("native-race") }
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != ErrFenced {
+		t.Fatal(code)
+	}
+}
+
+func TestCohortExpiredOperationStopsRelay(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	peer := operationPeer{42, 0}
+	if code := c.start(context.Background(), peer, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	c.operations[b.OperationID].admittedAt = c.now().Add(-BoundedTimeout)
+	if code := c.chunk(context.Background(), peer, p, carrier, b, 1); code != ErrTimeout || !(*children)[0].stopped {
+		t.Fatal(code)
+	}
+}
+func TestCohortReplayWindowFullDoesNotEvict(t *testing.T) {
+	c, p, carrier, a, b, _ := cohortFixture(t)
+	for n := 0; n < MaxReplayEntries; n++ {
+		c.seen[fmt.Sprintf("op:%064x", n+1000)] = true
+		c.seen[fmt.Sprintf("nonce:%064x", n+2000)] = true
+	}
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != ErrBusy {
+		t.Fatal(code)
+	}
+	if len(c.seen) != 2*MaxReplayEntries {
+		t.Fatal("replay history evicted")
+	}
+}
+func TestCohortPartialBootstrapRetainsChildUntilReaped(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	factory := c.startChild
+	c.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
+		child, _ := factory(a, b)
+		return child, ErrDenied
+	}
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != ErrCleanupRequired {
+		t.Fatal(code)
+	}
+	if len(c.operations) != 1 || !(*children)[0].stopped {
+		t.Fatal("partial child lost")
+	}
+	if _, err := c.proof(); err == nil {
+		t.Fatal("unreaped child completed")
+	}
+	if c.drain(context.Background(), time.Millisecond) != nil {
+		t.Fatal("drain failed")
+	}
+	q, err := c.proof()
+	if err != nil || q.Reaped != 1 {
+		t.Fatal(q, err)
+	}
+}
+
+func TestCohortCompletionArtifactRejectsIncompleteProof(t *testing.T) {
+	for _, q := range []CohortCompletion{{Started: 2, Reaped: 1, RelaysStopped: true}, {Started: 2, Reaped: 2}, {Started: 0, Reaped: 0, RelaysStopped: true}, {Started: MaxReplayEntries + 1, Reaped: MaxReplayEntries + 1, RelaysStopped: true}} {
+		c, f := controlFixture(t)
+		r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced")}
+		record(t, c.Client, r)
+		if err := cleanRuntime(c.Client, true); err != nil {
+			t.Fatal(err)
+		}
+		if completeRecord(c.Client, r.Lifecycle.Epoch, f.current, &q) == nil {
+			t.Fatal("invalid cohort completed", q)
+		}
+	}
+}
+
+func TestCohortCompletionArtifactRoundTrip(t *testing.T) {
+	c, f := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("fenced")}
+	record(t, c.Client, r)
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	q := CohortCompletion{Started: 2, Reaped: 2, RelaysStopped: true}
+	if err := completeRecord(c.Client, r.Lifecycle.Epoch, f.current, &q); err != nil {
+		t.Fatal(err)
+	}
+	current, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(c.Client, current)
+	if err != nil || proof.Cohort == nil || *proof.Cohort != q {
+		t.Fatal(proof, err)
+	}
+}
+
+func TestCohortIdleOperationDeadlineCancelsBeforeNewLease(t *testing.T) {
+	c, p, carrier, a, b, children := cohortFixture(t)
+	if code := c.start(context.Background(), operationPeer{42, 0}, p, carrier, a, b); code != "" {
+		t.Fatal(code)
+	}
+	admitted := c.now()
+	c.now = func() time.Time { return admitted.Add(BoundedTimeout) }
+	if err := c.poll(); err != nil {
+		t.Fatal(err)
+	}
+	if !(*children)[0].stopped || len((*children)[0].signals) == 0 {
+		t.Fatal("idle operation survived deadline")
+	}
+	if _, err := c.proof(); err == nil {
+		t.Fatal("signal is not quiescence")
+	}
+}