@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_display_test.go

@@ -0,0 +1,459 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSDKDisplayOwnerRedactionFreshnessAndBudget(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	before := len(f.o.controls)
+	v := newSDKJobViews(f.o)
+	ctx := context.Background()
+	p, c := v.ownerPage(ctx, f.carriers, "")
+	if c != "" || len(p.Items) != 1 {
+		t.Fatal(p, c)
+	}
+	raw, _ := json.Marshal(p)
+	for _, secret := range []string{"binding", "inputDigest", "sessionRef", "fixture", "username", "principal"} {
+		if strings.Contains(string(raw), secret) {
+			t.Fatal(string(raw))
+		}
+	}
+	if _, c = v.ownerPage(ctx, f.carriers, ""); c != "" {
+		t.Fatal(c)
+	}
+	if _, c = v.ownerPage(ctx, f.carriers, ""); c != ErrBusy {
+		t.Fatal("poll budget", c)
+	}
+	// Fresh access is checked even when the read budget/cache is populated.
+	f.native.appCode = ErrDenied
+	if _, c = v.ownerPage(ctx, f.carriers, ""); c != ErrDenied {
+		t.Fatal(c)
+	}
+	if len(f.o.controls) != before {
+		t.Fatal("read consumed mutation tickets")
+	}
+}
+func TestSDKDisplayCrossUserAdminAndSecretCanary(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	original := j.actor
+	// Another owner; the fresh caller must not inherit access through admin.
+	j.actor.account.Username = "private-canary"
+	j.actor.account.Principal.SubjectRef = grantRef('f')
+	f.native.groups.Admin = false
+	v := newSDKJobViews(f.o)
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || len(p.Items) != 0 {
+		t.Fatal(p, c)
+	}
+	if _, c = v.result(context.Background(), f.carriers, j.request.Control.Binding.Job.ID); c != ErrDenied {
+		t.Fatal(c)
+	}
+	if _, c = v.adminPage(context.Background(), f.carriers); c != ErrDenied {
+		t.Fatal(c)
+	}
+	f = sdkJobFixture(t)
+	if c = f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j = f.o.jobs[f.r.Control.Binding.Job.ID]
+	v = newSDKJobViews(f.o)
+	a, c := v.diagnose(context.Background(), f.carriers, false)
+	if c != "" {
+		t.Fatal(c)
+	}
+	b, c := v.diagnose(context.Background(), f.carriers, false)
+	if c != "" {
+		t.Fatal(c)
+	}
+	if a.Jobs[0].Alias == b.Jobs[0].Alias {
+		t.Fatal("stable export alias")
+	}
+	raw, _ := json.Marshal(a)
+	for _, s := range []string{j.request.Control.Binding.Job.ID, original.Username(), "fixture", "private-canary"} {
+		if strings.Contains(string(raw), s) {
+			t.Fatal("leak", string(raw))
+		}
+	}
+	j.receipt.Job.Progress.Phase = "/volume1/private-canary"
+	v.second-- // separate a new polling window for malformed snapshot validation
+	v.counts = map[uint32]int{}
+	if _, c = v.diagnose(context.Background(), f.carriers, false); c != ErrInvalid {
+		t.Fatal("malicious progress", c)
+	}
+}
+func TestSDKDisplayCursorAndRevision(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	for i := byte('5'); i <= '9'; i++ {
+		for k := 0; k < 2; k++ {
+			copy := *j
+			copy.request = j.request
+			copy.request.Control.Binding.Job.ID = grantRef(i)
+			if k == 1 {
+				copy.request.Control.Binding.Job.ID = "a" + copy.request.Control.Binding.Job.ID[1:]
+			}
+			f.o.jobs[copy.request.Control.Binding.Job.ID] = &copy
+		}
+	}
+	v := newSDKJobViews(f.o)
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || len(p.Items) != 10 || p.NextCursor == "" {
+		t.Fatal(p, c)
+	}
+	q, c := v.ownerPage(context.Background(), f.carriers, p.NextCursor)
+	if c != "" || len(q.Items) != 1 {
+		t.Fatal(q, c)
+	}
+	// Changing a visible field invalidates cursors independently of binding revision.
+	j.receipt.Job.Progress.Sequence++
+	now := f.c.now()
+	f.c.now = func() time.Time { return now.Add(time.Second) }
+	f.s.authority.now = f.c.now
+	if _, c = v.ownerPage(context.Background(), f.carriers, p.NextCursor); c != ErrStale {
+		t.Fatal(c)
+	}
+}
+func TestSDKDisplayCancelRequiresFreshAdminOrOwner(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	v := newSDKJobViews(f.o)
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" {
+		t.Fatal(c)
+	}
+	if c = v.cancel(context.Background(), f.carriers, p.Items[0].JobID, p.Revision+1); c != ErrStale {
+		t.Fatal(c)
+	}
+	if c = v.cancel(context.Background(), f.carriers, p.Items[0].JobID, p.Revision); c != "" {
+		t.Fatal(c)
+	}
+	if !f.o.jobs[p.Items[0].JobID].receipt.Job.Drained {
+		t.Fatal("missing Q")
+	}
+	if v.aggregate().Availability != "unavailable" {
+		t.Fatal("enabled production")
+	}
+}
+func TestSDKDisplayUnknownTotalNeverSuccess(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	j.receipt.Job.Progress = jobcontract.Progress{Phase: "starting", CompletedUnits: 1}
+	v := newSDKJobViews(f.o)
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || p.Items[0].Progress.TotalUnits != nil || p.Items[0].State == jobcontract.Succeeded {
+		t.Fatal(p, c)
+	}
+}
+
+func TestSDKDisplayAdminCancelsForeignButCannotReadResult(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	j.actor.account.Principal.SubjectRef = grantRef('f')
+	v := newSDKJobViews(f.o)
+	rows, c := v.adminPage(context.Background(), f.carriers)
+	if c != "" || len(rows) != 1 {
+		t.Fatal(rows, c)
+	}
+	raw, _ := json.Marshal(rows)
+	for _, key := range []string{"progress", "acceptedAt", "bytesRead", "username", "worker", "binding"} {
+		if strings.Contains(string(raw), key) {
+			t.Fatal(string(raw))
+		}
+	}
+	if _, c = v.result(context.Background(), f.carriers, rows[0].JobID); c != ErrDenied {
+		t.Fatal(c)
+	}
+	f.native.groups.Admin = false
+	if c = v.cancel(context.Background(), f.carriers, rows[0].JobID, rows[0].Revision); c != ErrDenied {
+		t.Fatal(c)
+	}
+	f.native.groups.Admin = true
+	f.native.afterApp = func() { f.native.groups.Admin = false }
+	if c = v.cancel(context.Background(), f.carriers, rows[0].JobID, rows[0].Revision); c == "" {
+		t.Fatal("lost admin role still canceled")
+	}
+	f.native.afterApp = nil
+	f.native.groups.Admin = true
+	if c = v.cancel(context.Background(), f.carriers, rows[0].JobID, rows[0].Revision); c != "" {
+		t.Fatal(c)
+	}
+}
+func TestSDKDisplayCursorBindingAndIngressCap(t *testing.T) {
+	for _, kind := range []string{"session", "inventory", "epoch", "revision", "expired", "forged"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			if c := f.submit(); c != "" {
+				t.Fatal(c)
+			}
+			v := newSDKJobViews(f.o)
+			a, c := v.actor(context.Background(), f.carriers)
+			if c != "" {
+				t.Fatal(c)
+			}
+			if _, c = v.snapshot(); c != "" {
+				t.Fatal(c)
+			}
+			p := f.s.authority.policy
+			cur := sdkStatusCursor{principal: a.Principal(), session: a.SessionRef(), inventory: p.Inventory, epoch: p.Epoch, revision: v.revision, offset: 0, expires: f.c.now().Add(time.Second)}
+			switch kind {
+			case "session":
+				cur.session = grantRef('a')
+			case "inventory":
+				cur.inventory.Version = "wrong"
+			case "epoch":
+				cur.epoch = grantRef('a')
+			case "revision":
+				cur.revision++
+			case "expired":
+				cur.expires = f.c.now()
+			}
+			if kind != "forged" {
+				v.cursors["cursor"] = cur
+			}
+			if _, c = v.ownerPage(context.Background(), f.carriers, "cursor"); c != ErrStale {
+				t.Fatal(c)
+			}
+		})
+	}
+	v := newSDKJobViews(nil)
+	for i := 0; i < 8; i++ {
+		if !v.enter() {
+			t.Fatal(i)
+		}
+	}
+	if v.enter() {
+		t.Fatal("ninth status admitted")
+	}
+	v.leave()
+	if !v.enter() {
+		t.Fatal("slot not released")
+	}
+}
+func TestSDKDisplayBackgroundSummaryAndLostReply(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, 0)
+	v := newSDKJobViews(f.o)
+	summary, c := v.backgroundSummary(context.Background(), f.carriers, i.ID)
+	if c != "" {
+		t.Fatal(c)
+	}
+	if summary.JobID == "" || summary.StoreRevision != f.repo.store.Revision || summary.SummaryDigest != i.SummaryDigest || summary.Input.Steps[0].Segments[0] != "fixture" {
+		t.Fatal(summary)
+	}
+	summary.Input.Steps[0].Segments[0] = "altered"
+	again, c := v.backgroundSummary(context.Background(), f.carriers, i.ID)
+	if c != "" || again.Input.Steps[0].Segments[0] != "fixture" {
+		t.Fatal("aliased summary", again, c)
+	}
+	if _, c = v.lookupIntent(context.Background(), f.carriers, i.ID); c != ErrUnavailable {
+		t.Fatal(c)
+	}
+	f.confirm(t, i)
+	found, c := v.lookupIntent(context.Background(), f.carriers, i.ID)
+	if c != "" || found.JobID != summary.JobID {
+		t.Fatal(found, c)
+	}
+	f.native.groups.Admin = false
+	if c = v.cancel(context.Background(), f.carriers, found.JobID, found.Revision); c != ErrUnsupported {
+		t.Fatal("background bypassed revoke", c)
+	}
+	f.native.appCode = ErrDenied
+	if _, c = v.lookupIntent(context.Background(), f.carriers, i.ID); c != ErrDenied {
+		t.Fatal(c)
+	}
+}
+
+func TestSDKDisplayOneBudgetAcrossQueriesAndViews(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	v := newSDKJobViews(f.o)
+	if _, c := v.diagnose(context.Background(), f.carriers, false); c != "" {
+		t.Fatal(c)
+	}
+	if _, c := v.lookupIntent(context.Background(), f.carriers, f.r.Control.Intent.ID); c != "" {
+		t.Fatal(c)
+	}
+	if _, c := newSDKJobViews(f.o).ownerPage(context.Background(), f.carriers, ""); c != ErrBusy {
+		t.Fatal("fresh view bypassed shared UID budget", c)
+	}
+}
+func TestSDKDisplayExportCapAndForeignTotals(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	for n := 0; n < 15; n++ {
+		id := fmt.Sprintf("%064x", n+20)
+		copy := *j
+		f.o.jobs[id] = &copy
+	}
+	v := newSDKJobViews(f.o)
+	d, c := v.diagnose(context.Background(), f.carriers, false)
+	if c != "" || len(d.Jobs) != 10 || d.Total != 16 || !d.Truncated {
+		t.Fatal(d, c)
+	}
+	page, c := v.adminQuery(context.Background(), f.carriers, "")
+	if c != "" || len(page.Items) != 10 || page.NextCursor == "" {
+		t.Fatal(page, c)
+	}
+}
+
+func TestSDKDisplayBackgroundRevokeProjection(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, 0)
+	r := f.confirm(t, i)
+	v := newSDKJobViews(f.o)
+	page, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" {
+		t.Fatal(c)
+	}
+	d := page.Items[0].Delegation
+	if d == nil || d.State != "active" || d.Revision != r.Binding.Binding.Delegation.Revision || d.StoreRevision != f.repo.store.Revision {
+		t.Fatal(d)
+	}
+	receipt, c := v.revoke(context.Background(), f.carriers, page.Items[0].JobID, page.Revision, d.Revision, d.StoreRevision)
+	if c != "" || !receipt.Revoked || !receipt.Drained {
+		t.Fatal(receipt, c)
+	}
+	page, c = v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || page.Items[0].Delegation.State != "revoked" || !page.Items[0].Drained {
+		t.Fatal(page, c)
+	}
+}
+
+func TestSDKDisplayResultRequiresFreshOwnerAndParentButStatusSurvivesRevoke(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+	r := jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}
+	f.event(t, sdkJobEvent{Kind: "step-result", Result: &r})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-result", Step: 1}})
+	f.event(t, sdkJobEvent{Kind: "result", Result: &r})
+	f.children[0].reaped = true
+	f.o.poll(context.Background())
+	v := newSDKJobViews(f.o)
+	got, c := v.result(context.Background(), f.carriers, f.r.Control.Binding.Job.ID)
+	if c != "" || got != r {
+		t.Fatal(got, c)
+	}
+	f.repo.store.Grants[0].State = GrantRevoked
+	f.repo.store.Grants[0].Revision++
+	f.repo.store.Grants[0].RevokedAt = f.c.now().UnixMilli()
+	f.repo.store.Grants[0].Reason = ErrRevoked
+	if _, c = v.result(context.Background(), f.carriers, f.r.Control.Binding.Job.ID); c == "" {
+		t.Fatal("revoked parent revealed result")
+	}
+	// Fresh window for read-only status; this does not manufacture a new job key.
+	v.second--
+	v.counts = map[uint32]int{}
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || !p.Items[0].Drained || p.Items[0].KnownEffects.Entries != 1 {
+		t.Fatal(p, c)
+	}
+}
+
+func TestSDKDisplayFencedAuthorityNeverBypassesFreshNativeProof(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	if c := f.o.cancel(context.Background(), operationPeer{42, 0}, f.carriers, f.r.Control.Binding); c != "" {
+		t.Fatal(c)
+	}
+	f.c.gate.fence("cleanup-required")
+	commits := f.repo.commits
+	v := newSDKJobViews(f.o)
+	p, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != ErrFenced || len(p.Items) != 0 {
+		t.Fatal(p, c)
+	}
+	if f.repo.commits != commits || f.c.gate.allow(f.c.now()) {
+		t.Fatal("history read restored authority")
+	}
+}
+
+func TestSDKDisplayAdminCancelBackgroundUsesDurableRevoke(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, 0)
+	f.confirm(t, i)
+	v := newSDKJobViews(f.o)
+	rows, c := v.adminPage(context.Background(), f.carriers)
+	if c != "" || len(rows) != 1 {
+		t.Fatal(rows, c)
+	}
+	if c = v.cancel(context.Background(), f.carriers, rows[0].JobID, rows[0].Revision); c != "" {
+		t.Fatal(c)
+	}
+	if f.repo.store.Background[0].State != "revoked" || !f.o.jobs[rows[0].JobID].receipt.Job.Drained {
+		t.Fatal("admin bypassed durable background R/Q")
+	}
+}
+
+type sdkDisplaySlowRepository struct {
+	GrantRepository
+	calls int
+	after func()
+}
+
+func (r *sdkDisplaySlowRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
+	code := r.GrantRepository.Transact(fn)
+	r.calls++
+	if r.calls == 2 {
+		r.after()
+	}
+	return code
+}
+func TestSDKDisplayConsentSummaryDoesNotOutliveFreshProof(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	i := f.prepare(t, 0)
+	f.s.authority.repository = &sdkDisplaySlowRepository{GrantRepository: f.repo, after: func() { f.wall = f.wall.Add(3 * time.Second) }}
+	if _, c := newSDKJobViews(f.o).backgroundSummary(context.Background(), f.carriers, i.ID); c != ErrStale {
+		t.Fatal("stale summary after repository wait", c)
+	}
+}
+
+func TestSDKDisplayAggregateUsesSharedCohortAndNoIdentity(t *testing.T) {
+	f := sdkJobFixture(t)
+	f.c.operations[grantRef('a')] = &cohortOperation{actor: relaxedActor(t, f.s.services.native, f.carriers)}
+	a := newSDKJobViews(f.o).aggregate()
+	if a.Active != 1 || a.Jobs != 0 || a.ChildCeiling != 4 || a.Availability != "unavailable" {
+		t.Fatal("aggregate hid M2 slot", a)
+	}
+	raw, _ := json.Marshal(a)
+	if strings.Contains(string(raw), f.native.session.Username) || strings.Contains(string(raw), grantRef('a')) {
+		t.Fatal(string(raw))
+	}
+}