@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/grant_authority_test.go

@@ -0,0 +1,510 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"math"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+type memoryGrantRepository struct {
+	policy        GrantPolicy
+	store         GrantStore
+	fail          Code
+	qFailure      Code
+	q             GrantQuiescence
+	inTransaction bool
+	commits       int
+}
+
+func (r *memoryGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
+	r.q = q
+	if r.qFailure != "" {
+		return r.qFailure
+	}
+	return r.fail
+}
+func (r *memoryGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
+	r.inTransaction = true
+	defer func() { r.inTransaction = false }()
+	b, _ := json.Marshal(r.store)
+	next, c := DecodeGrantStore(bytes.NewReader(b))
+	if c != "" {
+		return c
+	}
+	write, c := fn(r.policy, &next)
+	if c != "" {
+		return c
+	}
+	if write {
+		if r.fail != "" {
+			return r.fail
+		}
+		r.store = next
+		r.commits++
+	}
+	return ""
+}
+
+type consentStub struct {
+	selection ConsentSelection
+	code      Code
+	after     func()
+}
+
+func (s *consentStub) ValidateConsent(_ context.Context, _ NativeActor, _ string, _ ScopeKind, _ []Action) (ConsentSelection, Code) {
+	if s.after != nil {
+		s.after()
+	}
+	return s.selection, s.code
+}
+
+type cohortStub struct {
+	drain func(context.Context, GrantDrainKey) (GrantQuiescence, Code)
+}
+
+func (s cohortStub) DrainGrant(ctx context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
+	return s.drain(ctx, key)
+}
+func completeGrantProof(key GrantDrainKey) GrantQuiescence {
+	return GrantQuiescence{Key: key, ChildrenReaped: true, RelayClosed: true, LeasesClosed: true, FDsClosed: true, EffectsRecorded: true}
+}
+func grantAuthorityFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepository, *NativeProvider, *fakeNativeSession, *fakeLocalAccount, *consentStub, SessionCarriers, time.Time) {
+	t.Helper()
+	p, s, a, carriers, now := nativeFixture()
+	store, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if c != "" {
+		t.Fatal(c)
+	}
+	g := store.Grants[0]
+	r := &memoryGrantRepository{policy: GrantPolicy{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, ApprovalBinding: g.ApprovalBinding, CapabilityDigest: g.CapabilityDigest, Enabled: true}, store: GrantStore{Schema: testAuthoritySchema, Revision: 1, Grants: []Grant{}}}
+	scope := g.Scope
+	scope.Kind = ScopePersonal
+	scope.Segments = []string{"chosen"}
+	validator := &consentStub{selection: ConsentSelection{Principal: a.value.Principal, SessionRef: s.value.SessionRef, Scope: scope, Binding: g.LastValidated, CheckedAt: now}}
+	auth, c := NewGrantAuthority(r, p, validator, cohortStub{func(ctx context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
+		return completeGrantProof(key), ""
+	}})
+	if c != "" {
+		t.Fatal(c)
+	}
+	auth.now = func() time.Time { return now }
+	return auth, r, p, s, a, validator, carriers, now
+}
+func prepareGrant(t *testing.T, a *GrantAuthority, c SessionCarriers, kind ScopeKind) Intent {
+	t.Helper()
+	i, code := a.Prepare(context.Background(), c, grantRef('5'), kind, []Action{ActionRead})
+	if code != "" {
+		t.Fatal(code)
+	}
+	return i
+}
+func confirmGrant(t *testing.T, a *GrantAuthority, r *memoryGrantRepository, c SessionCarriers, i Intent) Grant {
+	t.Helper()
+	g, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision)
+	if code != "" {
+		t.Fatal(code)
+	}
+	return g
+}
+func grantRef(c byte) string { return string(bytes.Repeat([]byte{c}, 64)) }
+func admissionFor(t *testing.T, p *NativeProvider, c SessionCarriers, g Grant) GrantAdmission {
+	t.Helper()
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	return GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}
+}
+func TestGrantAuthorityConsentCASAndReplay(t *testing.T) {
+	a, r, _, s, _, v, c, _ := grantAuthorityFixture(t)
+	i := prepareGrant(t, a, c, ScopePersonal)
+	if _, code := a.Confirm(context.Background(), c, i.ID, grantRef('8'), r.store.Revision); code != ErrDenied {
+		t.Fatal(code)
+	}
+	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision+1); code != ErrStale {
+		t.Fatal(code)
+	}
+	g := confirmGrant(t, a, r, c, i)
+	if g.State != GrantActive || g.Revision != 1 || g.Owner != v.selection.Principal || g.LastValidated != v.selection.Binding || r.store.Revision != 2 || len(r.store.Grants) != 1 || s.calls < 3 {
+		t.Fatal("confirm did not durably bind fresh consent")
+	}
+	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrReplay {
+		t.Fatal(code)
+	}
+	g.Actions[0] = ActionCreate
+	g.Scope.Segments[0] = "mutated"
+	if r.store.Grants[0].Actions[0] != ActionRead || r.store.Grants[0].Scope.Segments[0] != "chosen" {
+		t.Fatal("mutable authority alias")
+	}
+}
+func TestGrantAuthoritySingleWinner(t *testing.T) {
+	a, r, _, _, _, _, c, _ := grantAuthorityFixture(t)
+	i := prepareGrant(t, a, c, ScopePersonal)
+	// The native stubs count calls, so serialize their observations separately.
+	_, s, acct, _, now := nativeFixture()
+	lock := &sync.Mutex{}
+	a.native = NewNativeProvider(lockedSession{lock, s.value}, lockedAccount{lock, acct.value})
+	a.native.now = func() time.Time { return now }
+	var wins atomic.Int32
+	var wg sync.WaitGroup
+	for n := 0; n < 16; n++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, 1)
+			if code == "" {
+				wins.Add(1)
+			} else if code != ErrReplay && code != ErrStale {
+				t.Error(code)
+			}
+		}()
+	}
+	wg.Wait()
+	if wins.Load() != 1 || len(r.store.Grants) != 1 {
+		t.Fatal(wins.Load())
+	}
+}
+
+type lockedSession struct {
+	mu    *sync.Mutex
+	value NativeSession
+}
+
+func (s lockedSession) ValidateSession(context.Context, SessionCarriers) (NativeSession, Code) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.value, ""
+}
+
+type lockedAccount struct {
+	mu    *sync.Mutex
+	value LocalAccount
+}
+
+func (a lockedAccount) LookupLocalAccount(context.Context, string) (LocalAccount, Code) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.value, ""
+}
+func TestGrantAuthorityIntentLimitsAndExpiry(t *testing.T) {
+	a, r, _, _, _, _, c, now := grantAuthorityFixture(t)
+	var first Intent
+	for n := 0; n < MaxLiveIntents; n++ {
+		i := prepareGrant(t, a, c, ScopePersonal)
+		if n == 0 {
+			first = i
+		}
+	}
+	if _, code := a.Prepare(context.Background(), c, grantRef('5'), ScopePersonal, []Action{ActionRead}); code != ErrBusy {
+		t.Fatal(code)
+	}
+	a.now = func() time.Time { return now.Add(IntentTTL) }
+	if _, code := a.Confirm(context.Background(), c, first.ID, first.SummaryDigest, r.store.Revision); code != ErrExpired {
+		t.Fatal(code)
+	}
+	if len(r.store.Grants) != 0 {
+		t.Fatal("expired intent wrote authority")
+	}
+}
+func TestGrantAuthorityFreshRoleScopeAndSession(t *testing.T) {
+	tests := []struct {
+		name   string
+		change func(*GrantAuthority, *memoryGrantRepository, *fakeNativeSession, *fakeLocalAccount, *consentStub)
+		want   Code
+	}{
+		{"session", func(_ *GrantAuthority, _ *memoryGrantRepository, s *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
+			s.value.SessionRef = grantRef('9')
+		}, ErrStale},
+		{"disabled account", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, acct *fakeLocalAccount, _ *consentStub) {
+			acct.value.Enabled = false
+		}, ErrDenied},
+		{"scope replacement", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
+			v.selection.Scope.ObjectRef = grantRef('9')
+		}, ErrStale},
+		{"unknown proof", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
+			v.selection.Binding.ScopeProof = ""
+		}, ErrSuspended},
+		{"ACL denial", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
+			v.code = ErrDenied
+		}, ErrDenied},
+		{"approval changed", func(_ *GrantAuthority, r *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
+			r.policy.ApprovalBinding = grantRef('9')
+		}, ErrFenced},
+		{"new epoch", func(_ *GrantAuthority, r *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
+			r.policy.Epoch = grantRef('9')
+		}, ErrFenced},
+		{"role removed", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, acct *fakeLocalAccount, _ *consentStub) {
+			acct.value.Admin = false
+		}, ErrStale},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a, r, _, s, acct, v, c, _ := grantAuthorityFixture(t)
+			v.selection.Scope.Kind = ScopeShared
+			i := prepareGrant(t, a, c, ScopeShared)
+			tt.change(a, r, s, acct, v)
+			if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != tt.want {
+				t.Fatalf("%q want %q", code, tt.want)
+			}
+			if len(r.store.Grants) != 0 {
+				t.Fatal("invalid confirm persisted")
+			}
+		})
+	}
+	a, _, _, _, acct, v, c, _ := grantAuthorityFixture(t)
+	acct.value.Admin = false
+	v.selection.Scope.Kind = ScopeShared
+	if _, code := a.Prepare(context.Background(), c, grantRef('5'), ScopeShared, []Action{ActionRead}); code != ErrDenied {
+		t.Fatal(code)
+	}
+}
+func TestGrantAuthorityFenceWinsConfirmOutsideIO(t *testing.T) {
+	a, r, _, _, _, v, c, _ := grantAuthorityFixture(t)
+	i := prepareGrant(t, a, c, ScopePersonal)
+	v.after = func() { a.Fence() }
+	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrFenced {
+		t.Fatal(code)
+	}
+	if len(r.store.Grants) != 0 {
+		t.Fatal("fence lost to confirm")
+	}
+}
+func TestGrantAuthorityRevokeRBeforeQAndIndividual(t *testing.T) {
+	a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
+	one := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	two := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	admitted := admissionFor(t, p, c, one)
+	other := admissionFor(t, p, c, two)
+	entered := make(chan GrantDrainKey, 1)
+	release := make(chan struct{})
+	a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) {
+		entered <- k
+		<-release
+		return completeGrantProof(k), ""
+	}}
+	type outcome struct {
+		r RevokeResult
+		c Code
+	}
+	done := make(chan outcome, 1)
+	go func() {
+		result, code := a.Revoke(context.Background(), c, one.ID, one.Revision, 3)
+		done <- outcome{result, code}
+	}()
+	key := <-entered
+	if r.store.Grants[0].State != GrantRevoked || r.store.Revision != 4 || key.Revision != 2 {
+		t.Fatal("drain before durable R")
+	}
+	if code := a.WithGrantAdmission(admitted, func(Grant, NativeActor) Code { t.Fatal("admitted after R"); return "" }); code != ErrRevoked {
+		t.Fatal(code)
+	}
+	if code := a.WithGrantAdmission(other, func(Grant, NativeActor) Code { return "" }); code != "" {
+		t.Fatal("unrelated grant stopped", code)
+	}
+	close(release)
+	result := <-done
+	if result.c != "" || !result.r.Revoked || !result.r.Drained || result.r.Revision != 2 {
+		t.Fatal(result)
+	}
+	if _, code := a.Revoke(context.Background(), c, one.ID, 1, 3); code != ErrStale {
+		t.Fatal("CAS replay", code)
+	}
+}
+func TestGrantAuthorityQuiescenceRequiresEveryProof(t *testing.T) {
+	for _, part := range []string{"children", "relay", "leases", "fds", "effects", "binding", "timeout", "nil"} {
+		t.Run(part, func(t *testing.T) {
+			a, r, _, _, _, _, c, _ := grantAuthorityFixture(t)
+			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+			a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) {
+				if _, ok := ctx.Deadline(); !ok {
+					t.Fatal("no drain deadline")
+				}
+				q := completeGrantProof(k)
+				switch part {
+				case "children":
+					q.ChildrenReaped = false
+				case "relay":
+					q.RelayClosed = false
+				case "leases":
+					q.LeasesClosed = false
+				case "fds":
+					q.FDsClosed = false
+				case "effects":
+					q.EffectsRecorded = false
+				case "binding":
+					q.Key.Epoch = grantRef('9')
+				case "timeout":
+					return q, ErrTimeout
+				}
+				return q, ""
+			}}
+			if part == "nil" {
+				a.cohort = nil
+			}
+			result, code := a.Revoke(context.Background(), c, g.ID, 1, 2)
+			if !result.Revoked || result.Drained || code != ErrCleanupRequired || r.store.Grants[0].State != GrantRevoked {
+				t.Fatalf("false Q: %#v %q", result, code)
+			}
+			// Idempotent status/drain retry requires CURRENT CAS and cannot un-revoke.
+			a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) { return completeGrantProof(k), "" }}
+			result, code = a.Revoke(context.Background(), c, g.ID, 2, 3)
+			if code != "" || !result.Drained || r.store.Revision != 3 {
+				t.Fatal(result, code)
+			}
+		})
+	}
+}
+func TestGrantAuthorityCommitFailureNeverReportsR(t *testing.T) {
+	for _, failure := range []Code{ErrUnavailable, ErrCommitUncertain} {
+		t.Run(string(failure), func(t *testing.T) {
+			a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
+			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+			admission := admissionFor(t, p, c, g)
+			r.fail = failure
+			result, code := a.Revoke(context.Background(), c, g.ID, 1, 2)
+			if result.Revoked || result.Drained || code != failure {
+				t.Fatal(result, code)
+			}
+			if code = a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("new admission after failed R"); return "" }); code != ErrFenced {
+				t.Fatal(code)
+			}
+		})
+	}
+}
+func TestGrantAuthorityRestartAndUnknownContinuitySuspend(t *testing.T) {
+	a, r, p, _, _, v, c, _ := grantAuthorityFixture(t)
+	g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	admission := admissionFor(t, p, c, g)
+	admission.Continuous = false
+	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("unknown continuity"); return "" }); code != ErrSuspended {
+		t.Fatal(code)
+	}
+	if r.store.Grants[0].State != GrantSuspended || r.store.Grants[0].Revision != 2 {
+		t.Fatal("suspension not durable")
+	}
+	admission.Continuous = true
+	admission.Revision = 2
+	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { return "" }); code != ErrSuspended {
+		t.Fatal("auto unsuspend", code)
+	}
+	fresh := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	if fresh.ID == g.ID {
+		t.Fatal("ID reuse")
+	}
+	// Opening authority ALWAYS suspends active records, even identical epoch.
+	reopened, code := NewGrantAuthority(r, p, v, a.cohort)
+	if code != "" {
+		t.Fatal(code)
+	}
+	reopened.now = a.now
+	if r.store.Grants[1].State != GrantSuspended {
+		t.Fatal("restored active grant")
+	}
+	// Revoked tombstones survive both reconciliation and reconsent.
+	if _, code := reopened.Revoke(context.Background(), c, g.ID, 2, r.store.Revision); code != "" {
+		t.Fatal(code)
+	}
+	_, code = NewGrantAuthority(r, p, v, a.cohort)
+	if code != "" || r.store.Grants[0].State != GrantRevoked {
+		t.Fatal("tombstone resurrected", code)
+	}
+}
+func TestGrantAuthorityBoundsAndAuthorization(t *testing.T) {
+	a, r, p, s, acct, v, c, _ := grantAuthorityFixture(t)
+	g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	acct.value.Admin = false
+	acct.value.Principal.SubjectRef = grantRef('9')
+	acct.value.Principal.InstanceRef = grantRef('8')
+	s.value.AccountInstanceRef = acct.value.Principal.InstanceRef
+	if _, code := a.Revoke(context.Background(), c, g.ID, 1, 2); code != ErrDenied {
+		t.Fatal("other person revoked", code)
+	}
+	admission := admissionFor(t, p, c, g)
+	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("other person's data"); return "" }); code != ErrDenied {
+		t.Fatal(code)
+	}
+	acct.value.Admin = true
+	if result, code := a.Revoke(context.Background(), c, g.ID, 1, 2); code != "" || !result.Revoked {
+		t.Fatal("admin safe revoke", code)
+	}
+	v.selection.Principal = acct.value.Principal
+	v.selection.SessionRef = s.value.SessionRef
+	// Tombstones occupy the cap and never get evicted for new consent.
+	original := r.store.Grants[0]
+	for len(r.store.Grants) < MaxGrants {
+		n := original
+		n.ID = uniqueGrantTestID(len(r.store.Grants))
+		r.store.Grants = append(r.store.Grants, n)
+	}
+	if _, code := a.Confirm(context.Background(), c, prepareGrant(t, a, c, ScopePersonal).ID, grantRef('9'), r.store.Revision); code != ErrDenied {
+		t.Fatal(code)
+	}
+	i := prepareGrant(t, a, c, ScopePersonal)
+	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrLimit {
+		t.Fatal("cap", code)
+	}
+	r.store.Grants = r.store.Grants[:1]
+	r.store.Revision = math.MaxUint64
+	i = prepareGrant(t, a, c, ScopePersonal)
+	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrLimit {
+		t.Fatal("revision overflow", code)
+	}
+}
+func uniqueGrantTestID(n int) string {
+	b := make([]byte, 32)
+	b[0] = byte(n)
+	b[1] = byte(n >> 8)
+	const digits = "0123456789abcdef"
+	out := make([]byte, 64)
+	for i, v := range b {
+		out[i*2] = digits[v>>4]
+		out[i*2+1] = digits[v&15]
+	}
+	return string(out)
+}
+
+func TestGrantAuthorityFailedSuspensionLatchesDeny(t *testing.T) {
+	for _, failure := range []string{"overflow", "size", "disk"} {
+		t.Run(failure, func(t *testing.T) {
+			a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
+			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+			proof := admissionFor(t, p, c, g)
+			proof.Continuous = false
+			switch failure {
+			case "overflow":
+				r.store.Revision = math.MaxUint64
+			case "size":
+				r.fail = ErrLimit
+			case "disk":
+				r.fail = ErrUnavailable
+			}
+			if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("unknown continuity admitted"); return "" }); code == "" {
+				t.Fatal("suspension failure succeeded")
+			}
+			proof.Continuous = true
+			r.fail = ""
+			if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("failed suspension resurrected"); return "" }); code != ErrFenced {
+				t.Fatal(code)
+			}
+		})
+	}
+}
+func TestGrantAuthorityBusyQDoesNotStopOtherGrants(t *testing.T) {
+	a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
+	one := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	two := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
+	proof := admissionFor(t, p, c, two)
+	r.qFailure = ErrBusy
+	result, code := a.Revoke(context.Background(), c, one.ID, 1, 3)
+	if code != ErrCleanupRequired || !result.Revoked || result.Drained {
+		t.Fatal(result, code)
+	}
+	if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { return "" }); code != "" {
+		t.Fatal("Q lock contention stopped unrelated grant", code)
+	}
+}