@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_session_contract.go

@@ -0,0 +1,72 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper/jobcontract"
+)
+
+// A session job is deliberately not a NativeActor or a native grant. DSM owns
+// authorization of every File Station request. Only the existing SDK owner
+// mutates this state; an HTTP task returns one bounded counter-only completion.
+type sdkSessionFiles interface {
+	CheckSession(context.Context, api.Authenticator, *http.Request) (filestation.SessionIdentity, error)
+	JobSelection(context.Context, filestation.SessionIdentity, string) error
+	JobStep(context.Context, *http.Request, filestation.SessionIdentity, string, jobcontract.Step) (jobcontract.Result, error)
+}
+
+// Public display projection, excluding compiled bindings and authority data.
+type sdkSessionWorker struct {
+	ID       string               `json:"id"`
+	Revision uint64               `json:"revision"`
+	Actions  []jobcontract.Action `json:"actions"`
+	MaxBytes uint64               `json:"maxBytes"`
+}
+type sdkSessionPending struct {
+	request          sdkJobRequest
+	identity         filestation.SessionIdentity
+	session, summary string
+	expires          time.Duration
+}
+type sdkSessionCompletion struct {
+	result jobcontract.Result
+	code   Code
+}
+type sdkSessionJob struct {
+	request               sdkJobRequest
+	identity              filestation.SessionIdentity
+	session, attach       string
+	carriers              SessionCarriers // transient; never journaled
+	deadline, last, total time.Duration
+	receipt               sdkJobReceipt
+	done                  chan sdkSessionCompletion
+	cancel                context.CancelFunc
+	terminal, uncertain   bool
+}
+type sdkSessionCursor struct {
+	identity filestation.SessionIdentity
+	session  string
+	admin    bool
+	offset   int
+	revision uint64
+	expires  time.Duration
+}
+type sdkSessionJobs struct {
+	owner    *sdkJobOwner
+	files    sdkSessionFiles
+	auth     api.Authenticator
+	key      [32]byte
+	pending  map[string]sdkSessionPending
+	jobs     map[string]*sdkSessionJob
+	history  map[string]sdkJournalRecord
+	cursors  map[string]sdkSessionCursor
+	counts   map[string]int
+	second   time.Duration
+	revision uint64
+}

package/templates/native-go/backend/internal/helper/sdk_session_fence_test.go

@@ -0,0 +1,215 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Characterize the existing observer contract, rather than relaxing admission:
+// a recoverable package-wide suspension still cancels already-running jobs.
+func TestSDKSessionRecoverableObserverSuspension(t *testing.T) {
+	for _, kind := range []string{"reload", "query-deadline"} {
+		t.Run(kind, func(t *testing.T) {
+			f, files, _ := sessionFixture(t)
+			files.block = make(chan struct{})
+			a := sessionSubmit(t, f)
+			f.carriers.Cookie = "id=bob-session"
+			b := sessionSubmit(t, f)
+			if c := f.o.poll(context.Background()); c != "" {
+				t.Fatal(c)
+			}
+			g, now := f.c.gate, f.c.now()
+			epoch := f.c.epoch
+			g.observeUnit(g.binding, 1, "", false, true, 0, now)
+			if kind == "reload" {
+				g.requestUnitCheck(true, now)
+			} else if !g.deferUnitDeadline(0, now, now, observerEvent{Phase: "get-all", ErrorClass: "deadline"}) {
+				t.Fatal("no pending query")
+			}
+			want := "reload-revalidating"
+			if kind == "query-deadline" {
+				want = "query-revalidating"
+			}
+			if g.readiness(now) != want || g.reason() != "" {
+				t.Fatal("not recoverable", g.readiness(now), g.reason())
+			}
+			if r := sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code != Code("revalidating") || len(r.Data) != 0 {
+				t.Fatal("pending request", r.Code)
+			}
+			for _, method := range []string{"jobs.prepare", "jobs.attach"} {
+				var args any = sdkPrepareArgs{Worker: f.r.Control.Binding.Worker, Parent: jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, Input: f.r.Input}
+				if method == "jobs.attach" {
+					args = sdkAttachArgs{JobID: b.JobID, AttachID: b.AttachID}
+				}
+				if r := sessionCall(f, method, args); r.Code != Code("revalidating") || len(r.Data) != 0 {
+					t.Fatal("pending mutation", method, r.Code)
+				}
+			}
+			if c := f.o.poll(context.Background()); c != "" {
+				t.Fatal(c)
+			}
+			for _, id := range []string{a.JobID, b.JobID} {
+				j := f.o.session.jobs[id]
+				if !j.terminal || j.receipt.Job.State != jobcontract.Canceled || j.receipt.Job.Reason != jobcontract.SafeReason(ErrFenced) || !j.receipt.Job.EffectsUnknown || j.receipt.Job.Drained {
+					t.Fatal("missing conservative terminal", j.receipt)
+				}
+			}
+			if kind == "reload" {
+				g.requestUnitCheck(false, now)
+			}
+			serial, _ := g.unitProbe(now)
+			g.observeUnit(g.binding, 1, "", false, true, serial, now)
+			if !f.o.session.ready() || f.c.epoch != epoch {
+				t.Fatal("same owner failed to recover")
+			}
+			if r := sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code != "" {
+				t.Fatal("status did not recover", r.Code)
+			}
+			for _, id := range []string{a.JobID, b.JobID} {
+				if !f.o.session.jobs[id].terminal {
+					t.Fatal("canceled job resumed")
+				}
+			}
+			// A new prepare/submit creates a fresh id and repeats selection checks.
+			f.carriers.Cookie = "id=alice-session"
+			r := sessionCall(f, "jobs.status", sdkStatusArgs{})
+			var page sdkJobPage
+			if json.Unmarshal(r.Data, &page) != nil || len(page.Items) != 1 || page.Items[0].SafeReason != jobcontract.Fenced {
+				t.Fatal("fence projection", string(r.Data))
+			}
+			fresh := sessionSubmit(t, f)
+			if fresh.JobID == a.JobID || fresh.JobID == b.JobID {
+				t.Fatal("resumed old id")
+			}
+			files.mu.Lock()
+			files.revoked = true
+			files.mu.Unlock()
+			if r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{Worker: f.r.Control.Binding.Worker, Parent: jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, Input: f.r.Input}); r.Code != ErrDenied {
+				t.Fatal("resubmit bypassed authorization", r.Code)
+			}
+			close(files.block)
+		})
+	}
+}
+
+type perSessionExpiryFiles struct {
+	*sessionFilesFake
+	bobExpired atomic.Bool
+}
+
+func (f *perSessionExpiryFiles) CheckSession(ctx context.Context, a api.Authenticator, r *http.Request) (filestation.SessionIdentity, error) {
+	c, _ := r.Cookie("id")
+	if c != nil && strings.HasPrefix(c.Value, "bob") && f.bobExpired.Load() {
+		return filestation.SessionIdentity{}, api.ErrNoSession
+	}
+	return f.sessionFilesFake.CheckSession(ctx, a, r)
+}
+func TestSDKSessionExpiryDoesNotFenceOtherUser(t *testing.T) {
+	f, base, _ := sessionFixture(t)
+	base.block = make(chan struct{})
+	files := &perSessionExpiryFiles{sessionFilesFake: base}
+	f.o.session.files = files
+	alice := sessionSubmit(t, f)
+	f.carriers.Cookie = "id=bob-session"
+	bob := sessionSubmit(t, f)
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	files.bobExpired.Store(true)
+	close(base.block)
+	for n := 0; n < 100; n++ {
+		if c := f.o.poll(context.Background()); c != "" {
+			t.Fatal(c)
+		}
+		if f.o.session.jobs[alice.JobID].terminal && f.o.session.jobs[bob.JobID].terminal {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	if j := f.o.session.jobs[alice.JobID]; j.receipt.Job.State != jobcontract.Succeeded || !j.receipt.Job.Drained {
+		t.Fatal("foreign logout affected alice", j.receipt)
+	}
+	if j := f.o.session.jobs[bob.JobID]; j.receipt.Job.State != jobcontract.Canceled || j.receipt.Job.Reason != jobcontract.SafeReason(ErrDenied) {
+		t.Fatal("expired bob", j.receipt)
+	}
+	if !f.o.session.ready() || f.c.gate.reason() != "" || f.o.grants.authority.fenced {
+		t.Fatal("logout fenced shared authority")
+	}
+	f.carriers.Cookie = "id=alice-session"
+	if r := sessionCall(f, "jobs.result", sdkResultArgs{JobID: alice.JobID}); r.Code != "" {
+		t.Fatal("alice result", r.Code)
+	}
+}
+
+func TestSDKSessionLeaseExpiryStaysJobLocal(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	files.block = make(chan struct{})
+	a := sessionSubmit(t, f)
+	*now = 3 * time.Second
+	f.carriers.Cookie = "id=bob-session"
+	b := sessionSubmit(t, f)
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	*now = 6 * time.Second // exact first lease boundary; bob still has three seconds
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	if j := f.o.session.jobs[a.JobID]; !j.terminal || j.receipt.Job.Reason != jobcontract.SafeReason(ErrExpired) {
+		t.Fatal("lease boundary", j.receipt)
+	}
+	if f.o.session.jobs[b.JobID].terminal || !f.o.session.ready() {
+		t.Fatal("foreign lease expiry affected bob")
+	}
+	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{JobID: b.JobID, AttachID: b.AttachID}); r.Code != "" {
+		t.Fatal("bob attach", r.Code)
+	}
+	close(files.block)
+}
+
+func TestSDKSessionStickyFenceRemainsDistinct(t *testing.T) {
+	f, _, _ := sessionFixture(t)
+	f.c.gate.fence("unit-changed")
+	if r := sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code != ErrFenced || len(r.Data) != 0 {
+		t.Fatal("sticky fence", r.Code)
+	}
+	if safeGrantCode(Code("revalidating")) != Code("revalidating") {
+		t.Fatal("lost wire status")
+	}
+}
+
+func TestSDKSessionRevalidatingNeverMasksTerminalAuthority(t *testing.T) {
+	for _, kind := range []string{"cohort", "authority", "observer", "deadline"} {
+		t.Run(kind, func(t *testing.T) {
+			f, _, _ := sessionFixture(t)
+			g, now := f.c.gate, f.c.now()
+			g.observeUnit(g.binding, 1, "", false, true, 0, now)
+			if !g.deferUnitDeadline(0, now, now, observerEvent{Phase: "get-all", ErrorClass: "deadline"}) {
+				t.Fatal("no query pending")
+			}
+			switch kind {
+			case "cohort":
+				f.c.fenced = true
+			case "authority":
+				f.o.grants.authority.fenced = true
+			case "observer":
+				g.fence("unit-changed")
+			case "deadline":
+				f.c.now = func() time.Time { return now.Add(3 * time.Second) }
+			}
+			if r := sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code != ErrFenced || len(r.Data) != 0 {
+				t.Fatal("terminal misclassified", kind, r.Code)
+			}
+		})
+	}
+}