@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/relaxed_invalidation.go

@@ -0,0 +1,200 @@
+package helper
+
+import (
+	"context"
+	"math"
+)
+
+// A deleted account cannot supply its former UID. Select its recorded identity
+// by the validated native name, never drop invalidation because lookup failed.
+func (r *relaxedProvider) invalidateName(ctx context.Context, name string, observed ...RelaxedIdentity) Code {
+	a := r.authority
+	a.mu.Lock()
+	selected := map[RelaxedIdentity]bool{}
+	related := func(id RelaxedIdentity) bool {
+		if id.Username == name {
+			return true
+		}
+		for _, current := range observed {
+			if validRelaxedIdentity(current) && relaxedRelated(id, current) {
+				return true
+			}
+		}
+		return false
+	}
+	for id := range r.principals {
+		if related(id) {
+			selected[id] = true
+		}
+	}
+	code := a.transaction(func(s *GrantStore) (bool, Code) {
+		for _, g := range s.Grants {
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && related(relaxedPrincipalIdentity(p)) {
+					selected[relaxedPrincipalIdentity(p)] = true
+				}
+			}
+		}
+		return false, ""
+	})
+	if code != "" {
+		a.mu.Unlock()
+		return ErrCleanupRequired
+	}
+	if len(selected) == 0 {
+		a.mu.Unlock()
+		return ""
+	}
+	ids := make([]RelaxedIdentity, 0, len(selected))
+	for id := range selected {
+		ids = append(ids, id)
+	}
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Observed identity changes use the existing S3 transaction/order, never an
+// auxiliary store. Old generations are denied before R and never reused.
+func (r *relaxedProvider) invalidate(ctx context.Context, ids []RelaxedIdentity) Code {
+	if r == nil || r.authority == nil {
+		return ErrUnavailable
+	}
+	r.authority.mu.Lock()
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Takes ownership of the held admission lock; all exit paths release it.
+func (r *relaxedProvider) invalidateLocked(ctx context.Context, ids []RelaxedIdentity, prospective ...RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	a := r.authority
+	selected := map[RelaxedIdentity]bool{}
+	blocked := map[RelaxedIdentity]bool{}
+	for _, id := range append(append([]RelaxedIdentity{}, ids...), prospective...) {
+		if !validRelaxedIdentity(id) || r.blocked[id] {
+			a.fenced = true
+			a.mu.Unlock()
+			return ErrCleanupRequired
+		}
+		blocked[id] = true
+	}
+	for id := range blocked {
+		r.blocked[id] = true
+	}
+	for _, id := range ids {
+		selected[id] = true
+		delete(r.principals, id)
+	}
+	for id, pending := range a.intents {
+		if selected[relaxedActorIdentity(pending.actor)] {
+			delete(a.intents, id)
+		}
+	}
+	keys := []GrantDrainKey{}
+	code := safeGrantCode(a.repository.Transact(func(policy GrantPolicy, s *GrantStore) (bool, Code) {
+		if policy != a.policy || !policy.Enabled || a.fenced {
+			return false, ErrFenced
+		}
+		// Plan all revisions first, so overflow or malformed authority cannot partly R.
+		indices := []int{}
+		for n, g := range s.Grants {
+			affected := false
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && selected[relaxedPrincipalIdentity(p)] {
+					affected = true
+				}
+			}
+			if !affected {
+				continue
+			}
+			revision := g.Revision
+			if g.State != GrantRevoked {
+				if revision == math.MaxUint64 || s.Revision == math.MaxUint64 {
+					return false, ErrLimit
+				}
+				revision++
+				indices = append(indices, n)
+			}
+			keys = append(keys, GrantDrainKey{policy.Epoch, g.ID, revision})
+		}
+		for _, n := range indices {
+			g := &s.Grants[n]
+			g.State = GrantRevoked
+			g.Reason = ErrRevoked
+			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
+			g.Revision++
+		}
+		if len(indices) > 0 {
+			s.Revision++
+		}
+		return len(indices) > 0, ""
+	}))
+	if code != "" {
+		a.fenced = true
+		clear(a.intents)
+	}
+	a.mu.Unlock()
+	complete := code == ""
+	// The caller's operations on foreign shared grants must stop without rewriting
+	// those grants. This seam must prove actual owned-child/relay completion.
+	identityCohort, ok := a.cohort.(relaxedIdentityCohort)
+	if !ok {
+		complete = false
+	} else {
+		for id := range selected {
+			if c := nativeObservationCode(ctx, identityCohort.drainRelaxedIdentity(ctx, id)); c != "" {
+				complete = false
+			}
+		}
+	}
+	for _, key := range keys {
+		q, c := a.drain(ctx, key)
+		if c != "" {
+			complete = false
+			continue
+		}
+		if code == "" {
+			a.mu.Lock()
+			saved := safeGrantCode(a.repository.SaveQuiescence(q))
+			a.mu.Unlock()
+			if saved != "" {
+				complete = false
+			}
+		}
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if !complete {
+		a.fenced = true
+		clear(a.intents)
+		if a.gate != nil {
+			a.gate.fenceLocked("relaxed-identity-cleanup-required")
+		}
+		return ErrCleanupRequired
+	}
+	for id := range blocked {
+		delete(r.blocked, id)
+	}
+	// The revoked grants remain revoked; a subsequent Resolve gets a new opaque
+	// generation and consent must create a new grant. Completed Q is not consent.
+	return ""
+}
+
+// This is the existing S2 owner/reaper, not a new identity process manager.
+func (c *operationCohort) drainRelaxedIdentity(ctx context.Context, id RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
+	defer cancel()
+	if err := c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
+		return op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id
+	}); err != nil {
+		return ErrCleanupRequired
+	}
+	if nativeContextCode(ctx) != "" {
+		return ErrCleanupRequired
+	}
+	for _, op := range c.operations {
+		if op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id {
+			return ErrCleanupRequired
+		}
+	}
+	return ""
+}

package/templates/native-go/backend/internal/helper/repair.go

@@ -0,0 +1,132 @@
+package helper
+
+import (
+	"errors"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+type RepairCompletion struct {
+	Inventory Inventory `json:"inventory"`
+	Boot      string    `json:"boot"`
+	Lease     Lease     `json:"lease"`
+}
+
+// repair is entered with control.lock held. It never calls Processes.Stop or
+// Start: the lifetime lock proves quiescence without observing/signalling PIDs.
+func (c Controller) repair(r Record) error {
+	if r.Inventory.Package != c.Expected.Package || r.Lifecycle == nil || r.Lifecycle.Lease == nil {
+		return errTrust
+	}
+	if r.Lifecycle.Completion != "" {
+		if _, err := completionRecord(c.Client, r); err != nil {
+			return err
+		}
+	}
+	lock, err := acquireLifetime(c.Client, r.Lifecycle)
+	if err != nil {
+		return err
+	}
+	defer lock.Close()
+	// Persist denial before any unlink; neither crash nor later active unit can
+	// clear this epoch's latch. Preserve Enabled and the old inventory.
+	if err = policyUpdate(c.Client, func(current *Record) error {
+		if !sameRepairEpoch(*current, r) {
+			return errTrust
+		}
+		current.Residual = true
+		current.Lifecycle.Phase = "fenced"
+		current.Lifecycle.Reason = "admin-repair"
+		current.Lifecycle.Completion = ""
+		return nil
+	}); err != nil {
+		return err
+	}
+	entries, err := repairEntries(c.Client, r)
+	if err != nil {
+		return err
+	}
+	for name, st := range entries {
+		path := filepath.Join(c.RunDir, name)
+		now, err := os.Lstat(path)
+		if err != nil || !os.SameFile(st, now) || now.Mode() != st.Mode() {
+			return errTrust
+		}
+		if err = os.Remove(path); err != nil {
+			return err
+		}
+	}
+	if err = syncDirectory(c.RunDir); err != nil {
+		return err
+	}
+	return policyUpdate(c.Client, func(current *Record) error {
+		if !sameRepairEpoch(*current, r) || current.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
+			return errTrust
+		}
+		if err := validateLifetime(c.Client, current.Lifecycle, lock); err != nil {
+			return err
+		}
+		current.Lifecycle.Phase = "stopped"
+		return storeCompletion(c.Client, current, Completion{Epoch: current.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: current.Inventory, Boot: current.Lifecycle.Binding.Boot, Lease: *current.Lifecycle.Lease}})
+	})
+}
+
+// Both repair policy transactions compare the same immutable epoch witness.
+func sameRepairEpoch(current, original Record) bool {
+	if current.Inventory != original.Inventory || current.Lifecycle == nil || original.Lifecycle == nil {
+		return false
+	}
+	got, want := current.Lifecycle, original.Lifecycle
+	return got.Epoch == want.Epoch && got.Lease != nil && want.Lease != nil && *got.Lease == *want.Lease
+}
+
+// Preflight every entry before deleting any, then recheck inode at unlink.
+// Missing entries permit retry after an interrupted repair, never proof alone.
+func repairEntries(c Client, r Record) (map[string]os.FileInfo, error) {
+	if err := protected(c.RunDir, c.Owner, true); err != nil {
+		return nil, err
+	}
+	entries := map[string]os.FileInfo{}
+	for _, name := range []string{"helper.sock", "supervisor.sock", "process.json"} {
+		path := filepath.Join(c.RunDir, name)
+		st, err := os.Lstat(path)
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		s, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || s.Uid != c.Owner {
+			return nil, errTrust
+		}
+		if name == "process.json" {
+			p, err := readProcess(c.RunDir, c.Owner)
+			if err != nil || st.Mode().Perm() != 0600 || s.Nlink != 1 || p.Inventory != r.Inventory || p.Boot != r.Lifecycle.Binding.Boot {
+				return nil, errTrust
+			}
+		} else {
+			mode := fs.FileMode(0660)
+			if name == "supervisor.sock" {
+				mode = 0600
+			}
+			if st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != mode {
+				return nil, errTrust
+			}
+			conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
+			if err == nil {
+				conn.Close()
+				return nil, errTrust
+			}
+			if !errors.Is(err, syscall.ECONNREFUSED) {
+				return nil, errTrust
+			}
+		}
+		entries[name] = st
+	}
+	return entries, nil
+}

package/templates/native-go/backend/internal/helper/repair_test.go

@@ -0,0 +1,271 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+// Write the wire format independently of production constructors. This also
+// checks strict approval parsing and the pre-R2 parser's refusal of lease.
+func repairFixture(t *testing.T) (Controller, *fakeProcesses, string) {
+	t.Helper()
+	c, f := controlFixture(t)
+	f.stopErr = errTrust
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(c.StateDir, "lifetime-"+r.Lifecycle.Epoch+".lock")
+	if err := os.WriteFile(path, []byte(r.Lifecycle.Epoch), 0600); err != nil {
+		t.Fatal(err)
+	}
+	st, _ := os.Lstat(path)
+	stat := st.Sys().(*syscall.Stat_t)
+	b, _ := json.Marshal(r)
+	var wire map[string]any
+	json.Unmarshal(b, &wire)
+	wire["lifecycle"].(map[string]any)["lease"] = map[string]any{"device": uint64(stat.Dev), "inode": stat.Ino}
+	b, _ = json.Marshal(wire)
+	if err := os.WriteFile(filepath.Join(c.StateDir, "approval.json"), b, 0644); err != nil {
+		t.Fatal(err)
+	}
+	staleSocket(t, filepath.Join(c.RunDir, "helper.sock"))
+	staleSocket(t, filepath.Join(c.RunDir, "supervisor.sock"))
+	os.Chmod(filepath.Join(c.RunDir, "helper.sock"), 0660)
+	os.Chmod(filepath.Join(c.RunDir, "supervisor.sock"), 0600)
+	return c, f, path
+}
+
+func TestRepairCommitsQuiescenceWithoutSignalOrStart(t *testing.T) {
+	for _, disabled := range []bool{false, true} {
+		c, f, _ := repairFixture(t)
+		if disabled {
+			// Wire read will succeed only when the new lease field is implemented.
+			r, e := readRecord(c.StateDir, c.Owner)
+			if e != nil {
+				t.Fatal(e)
+			}
+			r.Enabled = false
+			record(t, c.Client, r)
+		}
+		if err := c.Control(context.Background(), "repair"); err != nil {
+			t.Fatal("repair refused valid lifetime evidence", err)
+		}
+		r, e := readRecord(c.StateDir, c.Owner)
+		if e != nil || r.Residual || r.Enabled == disabled || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" {
+			t.Fatalf("bad commit: %+v %v", r, e)
+		}
+		if _, e := completionRecord(c.Client, r); e != nil {
+			t.Fatal(e)
+		}
+		if !runtimeAbsent(c.Client) || f.stopped != 0 || f.started != 0 {
+			t.Fatal("repair signalled or started", f)
+		}
+		if err := c.Control(context.Background(), "repair"); err != nil {
+			t.Fatal("retry not idempotent", err)
+		}
+		if disabled {
+			if c.Control(context.Background(), "recover") == nil {
+				t.Fatal("disabled repair revived integration")
+			}
+		} else if err := c.Control(context.Background(), "recover"); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestRepairRefusesMissingLegacyBusyAndForeignEvidence(t *testing.T) {
+	for _, kind := range []string{"legacy", "pre-r2-m1g", "missing", "symlink", "replacement", "hardlink", "mode", "content", "busy", "foreign-process", "live", "foreign-socket"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f, path := repairFixture(t)
+			switch kind {
+			case "legacy":
+				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true})
+			case "pre-r2-m1g":
+				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true, Lifecycle: testLifecycle("fenced")})
+			case "missing":
+				os.Remove(path)
+			case "symlink":
+				os.Remove(path)
+				os.Symlink("/etc/passwd", path)
+			case "replacement":
+				os.Rename(path, path+".old")
+				os.WriteFile(path, []byte(testLifecycle("running").Epoch), 0600)
+			case "hardlink":
+				os.Link(path, path+".alias")
+			case "mode":
+				os.Chmod(path, 0644)
+			case "content":
+				os.WriteFile(path, []byte("wrong epoch"), 0600)
+			case "busy":
+				h, e := os.OpenFile(path, os.O_RDWR, 0)
+				if e != nil {
+					t.Fatal(e)
+				}
+				defer h.Close()
+				if e = syscall.Flock(int(h.Fd()), syscall.LOCK_EX); e != nil {
+					t.Fatal(e)
+				}
+			case "foreign-process":
+				p := f.current
+				p.Inventory.Version = "9.0.0-9999"
+				writeProcess(c.RunDir, p)
+			case "live":
+				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
+				live(t, c.Client, c.Expected, nil)
+			case "foreign-socket":
+				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
+				os.WriteFile(filepath.Join(c.RunDir, "supervisor.sock"), []byte("foreign"), 0600)
+			}
+			if c.Control(context.Background(), "repair") == nil {
+				t.Fatal("unsafe repair accepted", kind)
+			}
+			if _, e := os.Lstat(filepath.Join(c.RunDir, "process.json")); e != nil {
+				t.Fatal("failure evidence removed", e)
+			}
+			if _, e := os.Lstat(filepath.Join(c.RunDir, "helper.sock")); e != nil {
+				t.Fatal("partial deletion before preflight", e)
+			}
+			if f.stopped != 0 || f.started != 0 {
+				t.Fatal("repair touched process", f)
+			}
+		})
+	}
+}
+
+func TestRepairRetriesInterruptedUnlinkAndOrphanProof(t *testing.T) {
+	for _, gap := range []string{"fence", "one-socket", "all-sockets", "all-runtime", "orphan-proof"} {
+		t.Run(gap, func(t *testing.T) {
+			c, f, _ := repairFixture(t)
+			r, e := readRecord(c.StateDir, c.Owner)
+			if e != nil {
+				t.Fatal(e)
+			}
+			r.Residual = true
+			r.Lifecycle.Phase = "fenced"
+			r.Lifecycle.Reason = "admin-repair"
+			record(t, c.Client, r)
+			if gap != "fence" {
+				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
+			}
+			if gap == "all-sockets" || gap == "all-runtime" || gap == "orphan-proof" {
+				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
+			}
+			if gap == "all-runtime" || gap == "orphan-proof" {
+				os.Remove(filepath.Join(c.RunDir, "process.json"))
+			}
+			if gap == "orphan-proof" {
+				// A correctly bound private artifact without the approval digest is
+				// still an uncommitted repair, not permission to recover.
+				proof := Completion{Epoch: r.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: r.Inventory, Boot: r.Lifecycle.Binding.Boot, Lease: *r.Lifecycle.Lease}}
+				if e := writeProtected(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json", proof); e != nil {
+					t.Fatal(e)
+				}
+			}
+			if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+				t.Fatal("crash gap recovered without repair")
+			}
+			if e := c.Control(context.Background(), "repair"); e != nil {
+				t.Fatal("retry failed", e)
+			}
+			r, e = readRecord(c.StateDir, c.Owner)
+			if e != nil || r.Residual {
+				t.Fatal("retry incomplete", e)
+			}
+		})
+	}
+}
+
+func TestRepairProofWriteFailureKeepsLatchAfterUnlink(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	r, e := readRecord(c.StateDir, c.Owner)
+	if e != nil {
+		t.Fatal(e)
+	}
+	proof := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+	os.Mkdir(proof, 0700) // deterministic failure after runtime unlink, before proof commit
+	if c.Control(context.Background(), "repair") == nil {
+		t.Fatal("proof failure committed")
+	}
+	r, e = readRecord(c.StateDir, c.Owner)
+	if e != nil || !r.Residual || r.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
+		t.Fatal("lost crash intent", e)
+	}
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("uncommitted repair revived")
+	}
+	os.Remove(proof)
+	if e := c.Control(context.Background(), "repair"); e != nil {
+		t.Fatal(e)
+	}
+	os.Remove(proof)
+	if c.Control(context.Background(), "recover") == nil {
+		t.Fatal("missing committed proof accepted")
+	}
+}
+
+func TestRepairAcrossPayloadRetainsOldApprovalAndRequiresEnable(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	c.Expected.Version = "2.0.0-0002"
+	if e := c.Control(context.Background(), "repair"); e != nil {
+		t.Fatal(e)
+	}
+	r, e := readRecord(c.StateDir, c.Owner)
+	if e != nil || r.Inventory.Version != "1.0.0-0001" {
+		t.Fatal("repair expanded approval", e)
+	}
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("old inventory recovered")
+	}
+	if e := c.Control(context.Background(), "enable"); e != nil {
+		t.Fatal(e)
+	}
+}
+
+func TestRepairCanceledBeforeMutation(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if e := c.Control(ctx, "repair"); !errors.Is(e, context.Canceled) {
+		t.Fatal(e)
+	}
+	if f.stopped != 0 || f.started != 0 {
+		t.Fatal(f)
+	}
+}
+
+func TestRepairAfterAutonomousCompletionKeepsLifetimeAuthority(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "admin-stop"); err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, r.Lifecycle.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(c.Client, got)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Residual || !got.Enabled || got.Lifecycle.Epoch != r.Lifecycle.Epoch || proof.Repair == nil || f.stopped != 0 || f.started != 0 {
+		t.Fatal("Repair lost lifetime authority or touched a PID")
+	}
+}