@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/helper/sdk_background_invalidation.go

@@ -0,0 +1,218 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"math"
+	"slices"
+)
+
+// Runs inside the SAME authority transaction after its parent mutation. Close
+// every affected output gate before fsync; record fan-out is one snapshot R.
+// selected additionally revokes a changed actor's delegation on foreign grants.
+func (a *GrantAuthority) sdkInvalidateDerivedLocked(s *GrantStore, selected map[RelaxedIdentity]bool) (bool, Code) {
+	changed := false
+	for n := range s.Background {
+		r := &s.Background[n]
+		bind := r.Binding.Binding
+		g := findGrant(s, bind.ParentGrant.ID)
+		badParent := g == nil || g.State != GrantActive || g.Revision != bind.ParentGrant.Revision || sdkInventory(g.Inventory) != bind.Inventory || g.LastValidated.Epoch != bind.Epoch || g.ApprovalBinding != bind.ApprovalBinding || g.CapabilityDigest != bind.CapabilityDigest
+		if !badParent && !selected[sdkIdentity(r.Binding.Actor)] && !selected[sdkIdentity(r.Issuer)] {
+			continue
+		}
+		if a.sdkJobs != nil {
+			for _, j := range a.sdkJobs.jobs {
+				if j.request.Control.Binding.ParentGrant.ID == bind.ParentGrant.ID && badParent || j.background != nil && j.background.id == bind.Delegation.ID {
+					a.sdkJobs.reject(j, ErrRevoked)
+				}
+			}
+		}
+		if r.State != "active" && r.State != "consumed" {
+			continue
+		}
+		if r.Binding.Binding.Delegation.Revision == math.MaxUint64 {
+			return false, ErrLimit
+		}
+		r.State = "revoked"
+		r.Reason = jobcontract.SafeReason(ErrRevoked)
+		r.Binding.Binding.Delegation.Revision++
+		changed = true
+	}
+	if a.sdkJobs != nil {
+		for _, j := range a.sdkJobs.jobs {
+			p := findGrant(s, j.request.Control.Binding.ParentGrant.ID)
+			if p == nil || p.State != GrantActive || p.Revision != j.request.Control.Binding.ParentGrant.Revision || j.actor.IdentityBasis() == "uid-username" && selected[relaxedActorIdentity(j.actor)] {
+				a.sdkJobs.reject(j, ErrRevoked)
+			}
+		}
+	}
+	for id, intent := range a.intents {
+		if intent.background != nil {
+			p := findGrant(s, intent.background.record.Binding.Binding.ParentGrant.ID)
+			if p == nil || p.State != GrantActive || selected[sdkIdentity(intent.background.record.Binding.Actor)] {
+				delete(a.intents, id)
+			}
+		}
+	}
+	return changed, ""
+}
+
+// Complete bounded index: repository owner/issuer + delegations + retained
+// journal + current owner/cohort. No caller-provided 'complete' bit is trusted.
+// Journal I/O precedes the grant transaction (never reenters grants.lock).
+func (a *GrantAuthority) sdkIdentitiesLocked() ([]RelaxedIdentity, Code) {
+	identities := []RelaxedIdentity{}
+	add := func(id RelaxedIdentity) Code {
+		if !validRelaxedIdentity(id) {
+			return ErrCleanupRequired
+		}
+		if !slices.Contains(identities, id) {
+			identities = append(identities, id)
+		}
+		if len(identities) > 1024 {
+			return ErrLimit
+		}
+		return ""
+	}
+	if a.sdkBackground != nil {
+		records, c := a.sdkBackground.journal.Records()
+		if c != "" {
+			return nil, ErrCleanupRequired
+		}
+		for _, r := range records {
+			if c := add(sdkIdentity(r.Intent.Actor)); c != "" {
+				return nil, c
+			}
+		}
+	}
+	c := a.transaction(func(s *GrantStore) (bool, Code) {
+		if len(s.Background) > 0 && a.sdkBackground == nil {
+			return false, ErrCleanupRequired
+		}
+		for _, g := range s.Grants {
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" {
+					if c := add(relaxedPrincipalIdentity(p)); c != "" {
+						return false, c
+					}
+				}
+			}
+		}
+		for _, r := range s.Background {
+			for _, p := range []jobcontract.Principal{r.Binding.Actor, r.Issuer} {
+				if c := add(sdkIdentity(p)); c != "" {
+					return false, c
+				}
+			}
+		}
+		return false, ""
+	})
+	if c != "" {
+		return nil, c
+	}
+	if a.sdkJobs != nil {
+		for _, j := range a.sdkJobs.jobs {
+			if j.actor.IdentityBasis() == "uid-username" {
+				if c := add(relaxedActorIdentity(j.actor)); c != "" {
+					return nil, c
+				}
+			}
+		}
+		for _, op := range a.sdkJobs.grants.cohort.operations {
+			if op.actor.IdentityBasis() == "uid-username" {
+				if c := add(relaxedActorIdentity(op.actor)); c != "" {
+					return nil, c
+				}
+			}
+		}
+	}
+	return identities, ""
+}
+func (a *GrantAuthority) sdkIdentityClosureLocked(seeds []RelaxedIdentity) ([]RelaxedIdentity, Code) {
+	recorded, c := a.sdkIdentitiesLocked()
+	if c != "" {
+		return nil, c
+	}
+	result := []RelaxedIdentity{}
+	for _, seed := range seeds {
+		closure, c := backgroundIdentityClosure([]RelaxedIdentity{seed}, recorded, true)
+		if c != "" {
+			return nil, c
+		}
+		for _, id := range closure {
+			if !slices.Contains(result, id) {
+				result = append(result, id)
+			}
+		}
+	}
+	return result, ""
+}
+func (b *sdkBackgroundOwner) finishRevokedLocked(j *sdkJob) Code {
+	if j.terminal {
+		return ""
+	}
+	if j.journalUncertain {
+		return ErrCleanupRequired
+	}
+	c := b.jobs.grants.cohort
+	if j.op != nil {
+		if _, exists := c.operations[j.op.binding.OperationID]; exists {
+			return ErrCleanupRequired
+		}
+		if j.op.process != nil {
+			if _, exists := c.receipts[j.op.binding.OperationID]; !exists {
+				return ErrCleanupRequired
+			}
+		}
+	}
+	if code := b.journal.Cancel(j.request.Control.Binding); code != "" {
+		b.fenceLocked(j, code)
+		return ErrCleanupRequired
+	}
+	r := j.receipt
+	now := uint64(max(b.jobs.grants.authority.now().UnixMilli(), int64(r.Job.AcceptedAt)))
+	r.Job.State = jobcontract.Canceled
+	r.Job.Reason = jobcontract.ReasonCanceled
+	r.Job.CancelRequested = true
+	r.Job.Drained = true
+	r.Job.FinishedAt = &now
+	r.Result = nil
+	if code := b.journal.Finish(r); code != "" {
+		b.fenceLocked(j, code)
+		return ErrCleanupRequired
+	}
+	j.receipt = r
+	j.terminal = true
+	j.carriers = SessionCarriers{}
+	return ""
+}
+func (b *sdkBackgroundOwner) finishParentLocked(id string) Code {
+	for _, j := range b.jobs.jobs {
+		if j.background != nil && j.request.Control.Binding.ParentGrant.ID == id && j.failure != "" {
+			if c := b.finishRevokedLocked(j); c != "" {
+				return c
+			}
+		}
+	}
+	return ""
+}
+func (b *sdkBackgroundOwner) finishIdentitiesLocked(selected map[RelaxedIdentity]bool) Code {
+	for _, j := range b.jobs.jobs {
+		if j.background != nil && selected[j.background.snapshot.identity] && j.failure != "" {
+			if c := b.finishRevokedLocked(j); c != "" {
+				return c
+			}
+		}
+	}
+	return ""
+}
+func (b *sdkBackgroundOwner) invalidateIdentities(ctx context.Context, ids []RelaxedIdentity) Code {
+	a := b.jobs.grants.authority
+	if a.native == nil || a.native.relaxed == nil {
+		a.Fence()
+		return ErrCleanupRequired
+	}
+	return a.native.relaxed.invalidate(ctx, ids)
+}

package/templates/native-go/backend/internal/helper/sdk_background_lease.go

@@ -0,0 +1,218 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"time"
+)
+
+// SDK-only monotonic source for the lifetime of one owner. Never serialize the
+// monotonic baseline or reconstruct it from a retained wall-clock deadline.
+func newSDKEpochClock() sdkBackgroundClock {
+	origin := time.Now()
+	return func() (time.Time, time.Duration, bool) {
+		now := time.Now()
+		elapsed := now.Sub(origin)
+		return now, elapsed, elapsed >= 0
+	}
+}
+
+// Every step/chunk/result must enter this guard. The callback has the same
+// nonblocking/no-I/O rule as WithGrantAdmission and runs at its SAME ordering
+// point. A successful consume is never a lease for the entire job.
+func (b *sdkBackgroundOwner) admit(ctx context.Context, id string, step uint64, reserve func() Code) Code {
+	j := b.job(id)
+	if j == nil || j.background == nil || !j.background.consumed || reserve == nil || step >= uint64(len(j.request.Input.Steps)) {
+		return ErrInvalid
+	}
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	r, p, c := b.check(ctx, j)
+	if c != "" {
+		if c == ErrFenced {
+			b.observerFenced()
+			return c
+		}
+		b.invalidateJob(ctx, j, c)
+		return c
+	}
+	a := b.jobs.grants.authority
+	cohort := b.jobs.grants.cohort
+	a.mu.Lock()
+	c = a.transaction(func(s *GrantStore) (bool, Code) {
+		current := findBackground(s, id)
+		if current == nil || current.State != "consumed" || current.ExecutionKey != j.request.Control.Intent.ID || current.Binding.Binding.Delegation.Revision != r.Binding.Binding.Delegation.Revision {
+			return false, ErrRevoked
+		}
+		if c := b.clockCheck(j, *current); c != "" {
+			return false, c
+		}
+		if c := nativeContextCode(ctx); c != "" {
+			return false, c
+		}
+		now := a.now()
+		if !nativeFresh(j.background.snapshot.checkedAt, now) || !nativeFresh(p.CheckedAt, now) {
+			return false, ErrStale
+		}
+		if c := b.parentLocked(s, *current, j.request.Input, p); c != "" {
+			return false, c
+		}
+		if !cohort.allowed() {
+			return false, ErrFenced
+		}
+		if j.failure != "" || j.op == nil || j.op.canceled || cohort.operations[j.op.binding.OperationID] != j.op {
+			return false, ErrCanceled
+		}
+		return false, safeGrantCode(reserve())
+	})
+	a.mu.Unlock()
+	if c != "" {
+		if c == ErrFenced {
+			b.observerFenced()
+			return c
+		}
+		b.invalidateJob(ctx, j, c)
+	}
+	return c
+}
+
+// Existing owner loop polling: expired/unknown proofs latch denial and drain.
+// There are at most 16 pending + 2 active background jobs. No new queue/owner
+// goroutine, no dispatch, and progress cannot refresh any deadline.
+func (b *sdkBackgroundOwner) poll(ctx context.Context) Code {
+	for _, j := range b.jobs.jobs {
+		if j.background == nil || j.terminal {
+			continue
+		}
+		if j.failure != "" {
+			a := b.jobs.grants.authority
+			a.mu.Lock()
+			fenced := a.fenced
+			a.mu.Unlock()
+			if fenced || j.journalUncertain {
+				return ErrCleanupRequired
+			}
+			if c := b.invalidateJob(ctx, j, j.failure); c != "" {
+				return c
+			}
+			continue
+		}
+		if _, _, c := b.check(ctx, j); c != "" {
+			if c == ErrFenced {
+				b.observerFenced()
+				return c
+			}
+			if c := b.invalidateJob(ctx, j, c); c != "" {
+				return c
+			}
+		}
+	}
+	return ""
+}
+
+type sdkBackgroundRevokeResult struct {
+	DelegationID string `json:"delegationId"`
+	Revision     uint64 `json:"revision"`
+	Revoked      bool   `json:"revoked"`
+	Drained      bool   `json:"drained"`
+}
+
+func (b *sdkBackgroundOwner) revoke(ctx context.Context, carriers SessionCarriers, id string, revision, storeRevision uint64) (sdkBackgroundRevokeResult, Code) {
+	result := sdkBackgroundRevokeResult{}
+	if !allReferences(id) || revision == 0 || storeRevision == 0 {
+		return result, ErrInvalid
+	}
+	a := b.jobs.grants.authority
+	actor, c := a.actor(ctx, carriers, nil)
+	if c != "" {
+		return result, c
+	}
+	j := b.job(id)
+	a.mu.Lock()
+	c = a.transaction(func(s *GrantStore) (bool, Code) {
+		if c := nativeContextCode(ctx); c != "" {
+			return false, c
+		}
+		if !nativeFresh(actor.account.CheckedAt, a.now()) {
+			return false, ErrStale
+		}
+		r := findBackground(s, id)
+		if r == nil {
+			return false, ErrDenied
+		}
+		if !actor.Admin() && sdkIdentity(r.Binding.Actor) != relaxedActorIdentity(actor) {
+			return false, ErrDenied
+		}
+		if s.Revision != storeRevision || r.Binding.Binding.Delegation.Revision != revision {
+			return false, ErrStale
+		}
+		if j != nil {
+			b.jobs.reject(j, ErrRevoked)
+		}
+		result.DelegationID = id
+		result.Revision = revision
+		if r.State == "revoked" || r.State == "expired" || r.State == "suspended" {
+			return false, ""
+		}
+		if revision == ^uint64(0) || s.Revision == ^uint64(0) {
+			return false, ErrLimit
+		}
+		r.State = "revoked"
+		r.Reason = jobcontract.SafeReason(ErrRevoked)
+		r.Binding.Binding.Delegation.Revision++
+		s.Revision++
+		result.Revision++
+		return true, ""
+	})
+	if c != "" && result.DelegationID != "" {
+		b.fenceLocked(j, c)
+	}
+	a.mu.Unlock()
+	if c != "" {
+		if result.DelegationID != "" && j != nil {
+			b.drainJob(ctx, j)
+		}
+		return result, c
+	}
+	result.Revoked = true
+	if j == nil {
+		return result, ErrCleanupRequired
+	} // old epoch needs separate lifetime proof
+	if c := b.drainJob(ctx, j); c != "" {
+		return result, c
+	}
+	result.Drained = true
+	return result, ""
+}
+func (b *sdkBackgroundOwner) drainJob(ctx context.Context, j *sdkJob) Code {
+	a := b.jobs.grants.authority
+	a.mu.Lock()
+	c := b.journal.Cancel(j.request.Control.Binding)
+	if c != "" {
+		b.fenceLocked(j, c)
+	}
+	a.mu.Unlock()
+	drainCtx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
+	defer cancel()
+	err := b.jobs.grants.cohort.drainSelected(drainCtx, TerminateGrace, func(op *cohortOperation) bool { return op == j.op })
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if c != "" || err != nil {
+		b.fenceLocked(j, ErrCleanupRequired)
+		return ErrCleanupRequired
+	}
+	return b.finishRevokedLocked(j)
+}
+
+// An observer/lifecycle fence closes every output immediately, but signals
+// belong to the existing owner after its durable lifecycle fence, as in S2.
+func (b *sdkBackgroundOwner) observerFenced() {
+	a := b.jobs.grants.authority
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for _, j := range b.jobs.jobs {
+		b.jobs.reject(j, ErrFenced)
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_background_snapshot.go

@@ -0,0 +1,110 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"dsmapp/internal/helper/jobcontract"
+	"math"
+	"reflect"
+)
+
+func cloneSDKBackgrounds(rs []jobcontract.BackgroundRecord) []jobcontract.BackgroundRecord {
+	if rs == nil {
+		return nil
+	}
+	out := make([]jobcontract.BackgroundRecord, len(rs))
+	copy(out, rs)
+	for n := range out {
+		if d := out[n].Binding.Binding.Delegation; d != nil {
+			v := *d
+			out[n].Binding.Binding.Delegation = &v
+		}
+	}
+	return out
+}
+func findBackground(s *GrantStore, id string) *jobcontract.BackgroundRecord {
+	for n := range s.Background {
+		r := &s.Background[n]
+		if r.Binding.Binding.Delegation != nil && r.Binding.Binding.Delegation.ID == id {
+			return r
+		}
+	}
+	return nil
+}
+func validateSDKBackgroundStore(s GrantStore) Code {
+	seen := map[string]bool{}
+	jobs := map[string]bool{}
+	keys := map[string]bool{}
+	for _, g := range s.Grants {
+		seen[g.ID] = true
+	}
+	for _, r := range s.Background {
+		if c := jobcontract.ValidateBackground(r); c != "" {
+			return sdkCode(c)
+		}
+		b := r.Binding.Binding
+		id := b.Delegation.ID
+		if seen[id] || jobs[b.Job.ID] {
+			return ErrInvalid
+		}
+		seen[id] = true
+		jobs[b.Job.ID] = true
+		if r.ExecutionKey != "" {
+			if keys[r.ExecutionKey] {
+				return ErrReplay
+			}
+			keys[r.ExecutionKey] = true
+		}
+		g := findGrant(&s, b.ParentGrant.ID)
+		if g == nil {
+			return ErrInvalid
+		}
+		if r.State == "active" || r.State == "consumed" {
+			if g.State != GrantActive || g.Revision != b.ParentGrant.Revision || sdkInventory(g.Inventory) != b.Inventory || g.ApprovalBinding != b.ApprovalBinding || g.CapabilityDigest != b.CapabilityDigest || g.LastValidated.Epoch != b.Epoch {
+				return ErrDenied
+			}
+		}
+	}
+	return ""
+}
+func validateSDKBackgroundTransition(old, next GrantStore, p GrantPolicy) Code {
+	for _, before := range old.Background {
+		after := findBackground(&next, before.Binding.Binding.Delegation.ID)
+		if after == nil {
+			return ErrDenied
+		}
+		if reflect.DeepEqual(before, *after) {
+			continue
+		}
+		revision := before.Binding.Binding.Delegation.Revision
+		if revision == math.MaxUint64 || after.Binding.Binding.Delegation.Revision != revision+1 {
+			return ErrStale
+		}
+		if before.State != "active" && before.State != "consumed" {
+			return ErrDenied
+		}
+		if after.State != "revoked" && after.State != "expired" && after.State != "suspended" && !(before.State == "active" && after.State == "consumed") {
+			return ErrDenied
+		}
+		normalized := cloneSDKBackgrounds([]jobcontract.BackgroundRecord{*after})[0]
+		normalized.Binding.Binding.Delegation.Revision = revision
+		normalized.State = before.State
+		normalized.Reason = before.Reason
+		if before.State == "active" && after.State == "consumed" {
+			normalized.ExecutionKey = before.ExecutionKey
+		}
+		if !reflect.DeepEqual(before, normalized) {
+			return ErrDenied
+		}
+	}
+	for _, r := range next.Background {
+		if findBackground(&old, r.Binding.Binding.Delegation.ID) != nil {
+			continue
+		}
+		b := r.Binding.Binding
+		if next.Schema != 2 || r.State != "active" || b.Delegation.Revision != 1 || b.Epoch != p.Epoch || b.Inventory != sdkInventory(p.Inventory) || b.ApprovalBinding != p.ApprovalBinding || b.CapabilityDigest != p.CapabilityDigest || !p.Enabled {
+			return ErrDenied
+		}
+	}
+	return ""
+}