@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/background_proof.go

@@ -0,0 +1,163 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"time"
+)
+
+func (o *backgroundObserver) observe(ctx context.Context, recorded RelaxedIdentity) backgroundObservation {
+	refuse := func(code Code) backgroundObservation { return backgroundObservation{code: code} }
+	revoke := func(code Code, observed RelaxedIdentity) backgroundObservation {
+		ids := []RelaxedIdentity{recorded}
+		if validRelaxedIdentity(observed) && observed != recorded {
+			ids = append(ids, observed)
+		}
+		return backgroundObservation{code: code, revoke: true, identities: ids}
+	}
+	if o == nil || o.accounts == nil || o.groups == nil || o.app == nil || o.appID == "" || o.now == nil {
+		return refuse(ErrUnavailable)
+	}
+	if !validRelaxedIdentity(recorded) {
+		return refuse(ErrDenied)
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if c := nativeContextCode(ctx); c != "" {
+		return refuse(c)
+	}
+	a, c := o.accounts.LookupRelaxedAccount(ctx, recorded.Username)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		if c == ErrDenied {
+			return revoke(c, RelaxedIdentity{})
+		}
+		return refuse(c)
+	}
+	if !nativeFresh(a.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if a.Kind != "local" {
+		return refuse(ErrUnsupported)
+	}
+	if !a.StateKnown {
+		return refuse(ErrUnavailable)
+	}
+	if !a.Exists || !a.Enabled {
+		return revoke(ErrDenied, a.Identity)
+	}
+	if a.Identity != recorded {
+		return revoke(ErrSuspended, a.Identity)
+	}
+	if !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
+		return refuse(ErrUnavailable)
+	}
+	if a.Expired || !a.PasswordUsable {
+		return revoke(ErrDenied, a.Identity)
+	}
+	if a.PrimaryGID == 0 {
+		return refuse(ErrDenied)
+	}
+	g, c := o.groups.LookupRelaxedGroups(ctx, a)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return refuse(c)
+	}
+	if !nativeFresh(g.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
+		return refuse(ErrStale)
+	}
+	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
+		return refuse(ErrUnavailable)
+	}
+	if slices.Contains(g.Groups, uint32(0)) {
+		return refuse(ErrDenied)
+	}
+	app, c := o.app.observeBackgroundApp(ctx, a, o.appID)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		if c == ErrDenied {
+			return revoke(c, a.Identity)
+		}
+		return refuse(c)
+	}
+	if !nativeFresh(app.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if !app.Known || !app.OfflineEquivalent {
+		return refuse(ErrUnavailable)
+	}
+	if app.Identity != recorded || app.AppID != o.appID {
+		return refuse(ErrDenied)
+	}
+	if !app.Allowed {
+		return revoke(ErrDenied, a.Identity)
+	}
+	oldest := a.CheckedAt
+	for _, at := range []time.Time{g.CheckedAt, app.CheckedAt} {
+		if at.Before(oldest) {
+			oldest = at
+		}
+	}
+	if !nativeFresh(oldest, o.now()) {
+		return refuse(ErrStale)
+	}
+	groups := slices.Clone(g.Groups)
+	slices.Sort(groups)
+	groups = slices.Compact(groups)
+	return backgroundObservation{snapshot: backgroundSnapshot{recorded, a.PrimaryGID, groups, g.Admin, oldest, true}}
+}
+
+func (o *backgroundObserver) revalidate(ctx context.Context, old backgroundSnapshot) backgroundObservation {
+	if !old.valid {
+		return backgroundObservation{code: ErrDenied}
+	}
+	current := o.observe(ctx, old.identity)
+	if current.code != "" {
+		return current
+	}
+	next := current.snapshot
+	if old.gid != next.gid || old.admin != next.admin || !slices.Equal(old.groups, next.groups) {
+		return backgroundObservation{code: ErrStale}
+	}
+	return current
+}
+
+// Pure selection only: a trusted owner must enumerate ALL stored owner/issuer,
+// delegation and running/consumed identities under its existing admission order.
+// Incomplete enumeration fences the owner. This never changes authority or Q.
+func backgroundIdentityClosure(seeds, recorded []RelaxedIdentity, complete bool) ([]RelaxedIdentity, Code) {
+	// 256 authority records, at most four identity roles each, plus old/new seed.
+	if !complete || len(seeds) == 0 || len(seeds) > 2 || len(recorded) > 1024 {
+		return nil, ErrCleanupRequired
+	}
+	for _, set := range [][]RelaxedIdentity{seeds, recorded} {
+		for _, id := range set {
+			if !validRelaxedIdentity(id) {
+				return nil, ErrCleanupRequired
+			}
+		}
+	}
+	selected := slices.Clone(seeds)
+	for changed := true; changed; {
+		changed = false
+		for _, id := range recorded {
+			if slices.Contains(selected, id) {
+				continue
+			}
+			for _, known := range selected {
+				if relaxedRelated(id, known) {
+					selected = append(selected, id)
+					changed = true
+					break
+				}
+			}
+		}
+	}
+	slices.SortFunc(selected, func(a, b RelaxedIdentity) int {
+		return cmp.Or(cmp.Compare(a.UID, b.UID), cmp.Compare(a.Username, b.Username))
+	})
+	return slices.Compact(selected), ""
+}

package/templates/native-go/backend/internal/helper/background_proof_contract.go

@@ -0,0 +1,46 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// S4 is an unconnected root-side observation seam, not a job admission API.
+// Production assembly deliberately installs no offline observers. These types
+// carry neither a session nor an IP and cannot mint a NativeActor.
+type backgroundAppProof struct {
+	Identity                          RelaxedIdentity
+	AppID                             string
+	Known, Allowed, OfflineEquivalent bool
+	CheckedAt                         time.Time
+}
+type backgroundAppObserver interface {
+	observeBackgroundApp(context.Context, RelaxedAccount, string) (backgroundAppProof, Code)
+}
+type backgroundObserver struct {
+	accounts RelaxedAccountProvider
+	groups   RelaxedGroupProvider
+	app      backgroundAppObserver
+	appID    string // compiled DSM registration privilege ID, not a request field
+	now      func() time.Time
+}
+type backgroundSnapshot struct {
+	identity  RelaxedIdentity
+	gid       uint32
+	groups    []uint32
+	admin     bool
+	checkedAt time.Time // oldest observation; never extended by a later lookup
+	valid     bool
+}
+
+// Revoke is an instruction to the existing authority owner, NOT durable R/Q.
+// Every nonempty Code stops admission/output. The owner must latch revocation,
+// enumerate the complete store, durably revoke, and drain outside its locks.
+type backgroundObservation struct {
+	snapshot   backgroundSnapshot
+	code       Code
+	revoke     bool
+	identities []RelaxedIdentity
+}

package/templates/native-go/backend/internal/helper/background_proof_test.go

@@ -0,0 +1,161 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"slices"
+	"testing"
+	"time"
+)
+
+type offlineFake struct {
+	proof backgroundAppProof
+	code  Code
+	after func()
+}
+
+func (f *offlineFake) observeBackgroundApp(ctx context.Context, a RelaxedAccount, app string) (backgroundAppProof, Code) {
+	if _, ok := ctx.Deadline(); !ok {
+		panic("no deadline")
+	}
+	if f.after != nil {
+		f.after()
+	}
+	return f.proof, f.code
+}
+func offlineFixture(t *testing.T) (*backgroundObserver, *relaxedFake, *offlineFake, RelaxedIdentity) {
+	_, _, p, f, _, _, _ := relaxedFixture(t)
+	app := &offlineFake{proof: backgroundAppProof{Identity: f.account.Identity, AppID: "FixturePrivilege", Known: true, Allowed: true, OfflineEquivalent: true, CheckedAt: p.now()}}
+	return &backgroundObserver{f, f, app, "FixturePrivilege", p.now}, f, app, f.account.Identity
+}
+func TestBackgroundLogoutAndOldestProof(t *testing.T) {
+	o, f, _, id := offlineFixture(t)
+	f.sessionCode = ErrDenied // logout cannot affect a non-session observer
+	f.account.CheckedAt = o.now().Add(-time.Second)
+	got := o.observe(context.Background(), id)
+	if got.code != "" || !got.snapshot.valid || got.snapshot.checkedAt != f.account.CheckedAt {
+		t.Fatalf("%+v", got)
+	}
+	f.groups.Groups[0] = 999
+	if slices.Contains(got.snapshot.groups, uint32(999)) {
+		t.Fatal("aliased credentials")
+	}
+	if got.snapshot.identity != id {
+		t.Fatal("identity")
+	}
+}
+func TestBackgroundRefusals(t *testing.T) {
+	cases := []struct {
+		name   string
+		change func(*backgroundObserver, *relaxedFake, *offlineFake)
+		code   Code
+		revoke bool
+	}{
+		{"nil account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.accounts = nil }, ErrUnavailable, false},
+		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.groups = nil }, ErrUnavailable, false},
+		{"nil app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.app = nil }, ErrUnavailable, false},
+		{"missing compiled App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.appID = "" }, ErrUnavailable, false},
+		{"unknown state", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.StateKnown = false }, ErrUnavailable, false},
+		{"disabled", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Enabled = false }, ErrDenied, true},
+		{"deleted no tuple", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.account.Exists = false
+			f.account.Identity = RelaxedIdentity{}
+		}, ErrDenied, true},
+		{"lookup denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.accountCode = ErrDenied }, ErrDenied, true},
+		{"UID change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.UID++ }, ErrSuspended, true},
+		{"name change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.Username = "Alice" }, ErrSuspended, true},
+		{"LDAP", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Kind = "ldap" }, ErrUnsupported, false},
+		{"expiry unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.ExpiryKnown = false }, ErrUnavailable, false},
+		{"password unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PasswordKnown = false }, ErrUnavailable, false},
+		{"expired", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Expired = true }, ErrDenied, true},
+		{"root GID", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PrimaryGID = 0 }, ErrDenied, false},
+		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = nil }, ErrUnavailable, false},
+		{"partial groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Complete = false }, ErrUnavailable, false},
+		{"unknown admin", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.AdminKnown = false }, ErrUnavailable, false},
+		{"group root", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = []uint32{0} }, ErrDenied, false},
+		{"incoherent groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Identity.UID++ }, ErrStale, false},
+		{"App unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Known = false }, ErrUnavailable, false},
+		{"App IP semantics unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.OfflineEquivalent = false }, ErrUnavailable, false},
+		{"wrong App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.AppID = "other" }, ErrDenied, false},
+		{"wrong App actor", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Identity.UID++ }, ErrDenied, false},
+		{"App revoke", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Allowed = false }, ErrDenied, true},
+		{"App denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = ErrDenied }, ErrDenied, true},
+		{"raw error", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = "secret native error" }, ErrUnavailable, false},
+		{"old account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.account.CheckedAt = o.now().Add(-3 * time.Second)
+		}, ErrStale, false},
+		{"future groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.groups.CheckedAt = o.now().Add(time.Nanosecond)
+		}, ErrStale, false},
+		{"zero App time", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.CheckedAt = time.Time{} }, ErrStale, false},
+		{"aged during app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			now := o.now()
+			a.after = func() { o.now = func() time.Time { return now.Add(3 * time.Second) } }
+		}, ErrStale, false},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			o, f, a, id := offlineFixture(t)
+			tt.change(o, f, a)
+			got := o.observe(context.Background(), id)
+			if got.code != tt.code || got.revoke != tt.revoke || got.snapshot.valid {
+				t.Fatalf("got %+v want %s revoke %v", got, tt.code, tt.revoke)
+			}
+			if got.revoke && !slices.Contains(got.identities, id) {
+				t.Fatal("lost old identity")
+			}
+		})
+	}
+	var nilObserver *backgroundObserver
+	if nilObserver.observe(context.Background(), RelaxedIdentity{}).code != ErrUnavailable {
+		t.Fatal("nil allowed")
+	}
+}
+func TestBackgroundCredentialChangeAndCancellation(t *testing.T) {
+	for _, what := range []string{"groups", "gid", "admin"} {
+		t.Run(what, func(t *testing.T) {
+			o, f, _, id := offlineFixture(t)
+			old := o.observe(context.Background(), id).snapshot
+			switch what {
+			case "groups":
+				f.groups.Groups = []uint32{}
+			case "gid":
+				f.account.PrimaryGID++
+				f.groups.PrimaryGID++
+			case "admin":
+				f.groups.Admin = !f.groups.Admin
+			}
+			if got := o.revalidate(context.Background(), old); got.code != ErrStale || got.snapshot.valid || got.revoke {
+				t.Fatalf("%+v", got)
+			}
+		})
+	}
+	o, _, app, id := offlineFixture(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	app.after = cancel
+	if got := o.observe(ctx, id); got.code != ErrCanceled || got.snapshot.valid {
+		t.Fatal(got.code)
+	}
+}
+func TestBackgroundIdentityClosure(t *testing.T) {
+	old := RelaxedIdentity{1001, "alice"}
+	renamed := RelaxedIdentity{1001, "alice2"}
+	reused := RelaxedIdentity{2001, "alice2"}
+	unrelated := RelaxedIdentity{3001, "bob"}
+	// Complete root-side records include owner/issuer, all delegation actors,
+	// and consumed/running jobs. Order must not hide transitive old associations.
+	got, c := backgroundIdentityClosure([]RelaxedIdentity{old}, []RelaxedIdentity{reused, unrelated, renamed, old}, true)
+	if c != "" || len(got) != 3 || !slices.Contains(got, reused) || slices.Contains(got, unrelated) {
+		t.Fatalf("%v %s", got, c)
+	}
+	for _, complete := range []bool{false, true} {
+		records := []RelaxedIdentity{old}
+		if complete {
+			records = append(records, RelaxedIdentity{})
+		}
+		if _, c := backgroundIdentityClosure([]RelaxedIdentity{old}, records, complete); c != ErrCleanupRequired {
+			t.Fatal("incomplete index allowed", c)
+		}
+	}
+}