@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/relaxed_invalidation.go

@@ -1,203 +0,0 @@
-//go:build !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/relaxed_invalidation.go:1
-package helper
-
-import (
-	"context"
-	"math"
-)
-
-// A deleted account cannot supply its former UID. Select its recorded identity
-// by the validated native name, never drop invalidation because lookup failed.
-func (r *relaxedProvider) invalidateName(ctx context.Context, name string, observed ...RelaxedIdentity) Code {
-	a := r.authority
-	a.mu.Lock()
-	selected := map[RelaxedIdentity]bool{}
-	related := func(id RelaxedIdentity) bool {
-		if id.Username == name {
-			return true
-		}
-		for _, current := range observed {
-			if validRelaxedIdentity(current) && relaxedRelated(id, current) {
-				return true
-			}
-		}
-		return false
-	}
-	for id := range r.principals {
-		if related(id) {
-			selected[id] = true
-		}
-	}
-	code := a.transaction(func(s *GrantStore) (bool, Code) {
-		for _, g := range s.Grants {
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis == "uid-username" && related(relaxedPrincipalIdentity(p)) {
-					selected[relaxedPrincipalIdentity(p)] = true
-				}
-			}
-		}
-		return false, ""
-	})
-	if code != "" {
-		a.mu.Unlock()
-		return ErrCleanupRequired
-	}
-	if len(selected) == 0 {
-		a.mu.Unlock()
-		return ""
-	}
-	ids := make([]RelaxedIdentity, 0, len(selected))
-	for id := range selected {
-		ids = append(ids, id)
-	}
-	return r.invalidateLocked(ctx, ids)
-}
-
-// Observed identity changes use the existing S3 transaction/order, never an
-// auxiliary store. Old generations are denied before R and never reused.
-func (r *relaxedProvider) invalidate(ctx context.Context, ids []RelaxedIdentity) Code {
-	if r == nil || r.authority == nil {
-		return ErrUnavailable
-	}
-	r.authority.mu.Lock()
-	return r.invalidateLocked(ctx, ids)
-}
-
-// Takes ownership of the held admission lock; all exit paths release it.
-func (r *relaxedProvider) invalidateLocked(ctx context.Context, ids []RelaxedIdentity, prospective ...RelaxedIdentity) Code {
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	a := r.authority
-	selected := map[RelaxedIdentity]bool{}
-	blocked := map[RelaxedIdentity]bool{}
-	for _, id := range append(append([]RelaxedIdentity{}, ids...), prospective...) {
-		if !validRelaxedIdentity(id) || r.blocked[id] {
-			a.fenced = true
-			a.mu.Unlock()
-			return ErrCleanupRequired
-		}
-		blocked[id] = true
-	}
-	for id := range blocked {
-		r.blocked[id] = true
-	}
-	for _, id := range ids {
-		selected[id] = true
-		delete(r.principals, id)
-	}
-	for id, pending := range a.intents {
-		if selected[relaxedActorIdentity(pending.actor)] {
-			delete(a.intents, id)
-		}
-	}
-	keys := []GrantDrainKey{}
-	code := safeGrantCode(a.repository.Transact(func(policy GrantPolicy, s *GrantStore) (bool, Code) {
-		if policy != a.policy || !policy.Enabled || a.fenced {
-			return false, ErrFenced
-		}
-		// Plan all revisions first, so overflow or malformed authority cannot partly R.
-		indices := []int{}
-		for n, g := range s.Grants {
-			affected := false
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis == "uid-username" && selected[relaxedPrincipalIdentity(p)] {
-					affected = true
-				}
-			}
-			if !affected {
-				continue
-			}
-			revision := g.Revision
-			if g.State != GrantRevoked {
-				if revision == math.MaxUint64 || s.Revision == math.MaxUint64 {
-					return false, ErrLimit
-				}
-				revision++
-				indices = append(indices, n)
-			}
-			keys = append(keys, GrantDrainKey{policy.Epoch, g.ID, revision})
-		}
-		for _, n := range indices {
-			g := &s.Grants[n]
-			g.State = GrantRevoked
-			g.Reason = ErrRevoked
-			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
-			g.Revision++
-		}
-		if len(indices) > 0 {
-			s.Revision++
-		}
-		return len(indices) > 0, ""
-	}))
-	if code != "" {
-		a.fenced = true
-		clear(a.intents)
-	}
-	a.mu.Unlock()
-	complete := code == ""
-	// The caller's operations on foreign shared grants must stop without rewriting
-	// those grants. This seam must prove actual owned-child/relay completion.
-	identityCohort, ok := a.cohort.(relaxedIdentityCohort)
-	if !ok {
-		complete = false
-	} else {
-		for id := range selected {
-			if c := nativeObservationCode(ctx, identityCohort.drainRelaxedIdentity(ctx, id)); c != "" {
-				complete = false
-			}
-		}
-	}
-	for _, key := range keys {
-		q, c := a.drain(ctx, key)
-		if c != "" {
-			complete = false
-			continue
-		}
-		if code == "" {
-			a.mu.Lock()
-			saved := safeGrantCode(a.repository.SaveQuiescence(q))
-			a.mu.Unlock()
-			if saved != "" {
-				complete = false
-			}
-		}
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if !complete {
-		a.fenced = true
-		clear(a.intents)
-		if a.gate != nil {
-			a.gate.fenceLocked("relaxed-identity-cleanup-required")
-		}
-		return ErrCleanupRequired
-	}
-	for id := range blocked {
-		delete(r.blocked, id)
-	}
-	// The revoked grants remain revoked; a subsequent Resolve gets a new opaque
-	// generation and consent must create a new grant. Completed Q is not consent.
-	return ""
-}
-
-// This is the existing S2 owner/reaper, not a new identity process manager.
-func (c *operationCohort) drainRelaxedIdentity(ctx context.Context, id RelaxedIdentity) Code {
-	ctx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
-	defer cancel()
-	if err := c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
-		return op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id
-	}); err != nil {
-		return ErrCleanupRequired
-	}
-	if nativeContextCode(ctx) != "" {
-		return ErrCleanupRequired
-	}
-	for _, op := range c.operations {
-		if op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id {
-			return ErrCleanupRequired
-		}
-	}
-	return ""
-}

package/dist/templates/native-go/backend/internal/helper/repair.go

@@ -1,132 +0,0 @@
-package helper
-
-import (
-	"errors"
-	"io/fs"
-	"net"
-	"os"
-	"path/filepath"
-	"syscall"
-	"time"
-)
-
-type RepairCompletion struct {
-	Inventory Inventory `json:"inventory"`
-	Boot      string    `json:"boot"`
-	Lease     Lease     `json:"lease"`
-}
-
-// repair is entered with control.lock held. It never calls Processes.Stop or
-// Start: the lifetime lock proves quiescence without observing/signalling PIDs.
-func (c Controller) repair(r Record) error {
-	if r.Inventory.Package != c.Expected.Package || r.Lifecycle == nil || r.Lifecycle.Lease == nil {
-		return errTrust
-	}
-	if r.Lifecycle.Completion != "" {
-		if _, err := completionRecord(c.Client, r); err != nil {
-			return err
-		}
-	}
-	lock, err := acquireLifetime(c.Client, r.Lifecycle)
-	if err != nil {
-		return err
-	}
-	defer lock.Close()
-	// Persist denial before any unlink; neither crash nor later active unit can
-	// clear this epoch's latch. Preserve Enabled and the old inventory.
-	if err = policyUpdate(c.Client, func(current *Record) error {
-		if !sameRepairEpoch(*current, r) {
-			return errTrust
-		}
-		current.Residual = true
-		current.Lifecycle.Phase = "fenced"
-		current.Lifecycle.Reason = "admin-repair"
-		current.Lifecycle.Completion = ""
-		return nil
-	}); err != nil {
-		return err
-	}
-	entries, err := repairEntries(c.Client, r)
-	if err != nil {
-		return err
-	}
-	for name, st := range entries {
-		path := filepath.Join(c.RunDir, name)
-		now, err := os.Lstat(path)
-		if err != nil || !os.SameFile(st, now) || now.Mode() != st.Mode() {
-			return errTrust
-		}
-		if err = os.Remove(path); err != nil {
-			return err
-		}
-	}
-	if err = syncDirectory(c.RunDir); err != nil {
-		return err
-	}
-	return policyUpdate(c.Client, func(current *Record) error {
-		if !sameRepairEpoch(*current, r) || current.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
-			return errTrust
-		}
-		if err := validateLifetime(c.Client, current.Lifecycle, lock); err != nil {
-			return err
-		}
-		current.Lifecycle.Phase = "stopped"
-		return storeCompletion(c.Client, current, Completion{Epoch: current.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: current.Inventory, Boot: current.Lifecycle.Binding.Boot, Lease: *current.Lifecycle.Lease}})
-	})
-}
-
-// Both repair policy transactions compare the same immutable epoch witness.
-func sameRepairEpoch(current, original Record) bool {
-	if current.Inventory != original.Inventory || current.Lifecycle == nil || original.Lifecycle == nil {
-		return false
-	}
-	got, want := current.Lifecycle, original.Lifecycle
-	return got.Epoch == want.Epoch && got.Lease != nil && want.Lease != nil && *got.Lease == *want.Lease
-}
-
-// Preflight every entry before deleting any, then recheck inode at unlink.
-// Missing entries permit retry after an interrupted repair, never proof alone.
-func repairEntries(c Client, r Record) (map[string]os.FileInfo, error) {
-	if err := protected(c.RunDir, c.Owner, true); err != nil {
-		return nil, err
-	}
-	entries := map[string]os.FileInfo{}
-	for _, name := range []string{"helper.sock", "supervisor.sock", "process.json"} {
-		path := filepath.Join(c.RunDir, name)
-		st, err := os.Lstat(path)
-		if errors.Is(err, fs.ErrNotExist) {
-			continue
-		}
-		if err != nil {
-			return nil, err
-		}
-		s, ok := st.Sys().(*syscall.Stat_t)
-		if !ok || s.Uid != c.Owner {
-			return nil, errTrust
-		}
-		if name == "process.json" {
-			p, err := readProcess(c.RunDir, c.Owner)
-			if err != nil || st.Mode().Perm() != 0600 || s.Nlink != 1 || p.Inventory != r.Inventory || p.Boot != r.Lifecycle.Binding.Boot {
-				return nil, errTrust
-			}
-		} else {
-			mode := fs.FileMode(0660)
-			if name == "supervisor.sock" {
-				mode = 0600
-			}
-			if st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != mode {
-				return nil, errTrust
-			}
-			conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
-			if err == nil {
-				conn.Close()
-				return nil, errTrust
-			}
-			if !errors.Is(err, syscall.ECONNREFUSED) {
-				return nil, errTrust
-			}
-		}
-		entries[name] = st
-	}
-	return entries, nil
-}

package/dist/templates/native-go/backend/internal/helper/repair_test.go

@@ -1,271 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-)
-
-// Write the wire format independently of production constructors. This also
-// checks strict approval parsing and the pre-R2 parser's refusal of lease.
-func repairFixture(t *testing.T) (Controller, *fakeProcesses, string) {
-	t.Helper()
-	c, f := controlFixture(t)
-	f.stopErr = errTrust
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(c.StateDir, "lifetime-"+r.Lifecycle.Epoch+".lock")
-	if err := os.WriteFile(path, []byte(r.Lifecycle.Epoch), 0600); err != nil {
-		t.Fatal(err)
-	}
-	st, _ := os.Lstat(path)
-	stat := st.Sys().(*syscall.Stat_t)
-	b, _ := json.Marshal(r)
-	var wire map[string]any
-	json.Unmarshal(b, &wire)
-	wire["lifecycle"].(map[string]any)["lease"] = map[string]any{"device": uint64(stat.Dev), "inode": stat.Ino}
-	b, _ = json.Marshal(wire)
-	if err := os.WriteFile(filepath.Join(c.StateDir, "approval.json"), b, 0644); err != nil {
-		t.Fatal(err)
-	}
-	staleSocket(t, filepath.Join(c.RunDir, "helper.sock"))
-	staleSocket(t, filepath.Join(c.RunDir, "supervisor.sock"))
-	os.Chmod(filepath.Join(c.RunDir, "helper.sock"), 0660)
-	os.Chmod(filepath.Join(c.RunDir, "supervisor.sock"), 0600)
-	return c, f, path
-}
-
-func TestRepairCommitsQuiescenceWithoutSignalOrStart(t *testing.T) {
-	for _, disabled := range []bool{false, true} {
-		c, f, _ := repairFixture(t)
-		if disabled {
-			// Wire read will succeed only when the new lease field is implemented.
-			r, e := readRecord(c.StateDir, c.Owner)
-			if e != nil {
-				t.Fatal(e)
-			}
-			r.Enabled = false
-			record(t, c.Client, r)
-		}
-		if err := c.Control(context.Background(), "repair"); err != nil {
-			t.Fatal("repair refused valid lifetime evidence", err)
-		}
-		r, e := readRecord(c.StateDir, c.Owner)
-		if e != nil || r.Residual || r.Enabled == disabled || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" {
-			t.Fatalf("bad commit: %+v %v", r, e)
-		}
-		if _, e := completionRecord(c.Client, r); e != nil {
-			t.Fatal(e)
-		}
-		if !runtimeAbsent(c.Client) || f.stopped != 0 || f.started != 0 {
-			t.Fatal("repair signalled or started", f)
-		}
-		if err := c.Control(context.Background(), "repair"); err != nil {
-			t.Fatal("retry not idempotent", err)
-		}
-		if disabled {
-			if c.Control(context.Background(), "recover") == nil {
-				t.Fatal("disabled repair revived integration")
-			}
-		} else if err := c.Control(context.Background(), "recover"); err != nil {
-			t.Fatal(err)
-		}
-	}
-}
-
-func TestRepairRefusesMissingLegacyBusyAndForeignEvidence(t *testing.T) {
-	for _, kind := range []string{"legacy", "pre-r2-m1g", "missing", "symlink", "replacement", "hardlink", "mode", "content", "busy", "foreign-process", "live", "foreign-socket"} {
-		t.Run(kind, func(t *testing.T) {
-			c, f, path := repairFixture(t)
-			switch kind {
-			case "legacy":
-				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true})
-			case "pre-r2-m1g":
-				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true, Lifecycle: testLifecycle("fenced")})
-			case "missing":
-				os.Remove(path)
-			case "symlink":
-				os.Remove(path)
-				os.Symlink("/etc/passwd", path)
-			case "replacement":
-				os.Rename(path, path+".old")
-				os.WriteFile(path, []byte(testLifecycle("running").Epoch), 0600)
-			case "hardlink":
-				os.Link(path, path+".alias")
-			case "mode":
-				os.Chmod(path, 0644)
-			case "content":
-				os.WriteFile(path, []byte("wrong epoch"), 0600)
-			case "busy":
-				h, e := os.OpenFile(path, os.O_RDWR, 0)
-				if e != nil {
-					t.Fatal(e)
-				}
-				defer h.Close()
-				if e = syscall.Flock(int(h.Fd()), syscall.LOCK_EX); e != nil {
-					t.Fatal(e)
-				}
-			case "foreign-process":
-				p := f.current
-				p.Inventory.Version = "9.0.0-9999"
-				writeProcess(c.RunDir, p)
-			case "live":
-				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
-				live(t, c.Client, c.Expected, nil)
-			case "foreign-socket":
-				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
-				os.WriteFile(filepath.Join(c.RunDir, "supervisor.sock"), []byte("foreign"), 0600)
-			}
-			if c.Control(context.Background(), "repair") == nil {
-				t.Fatal("unsafe repair accepted", kind)
-			}
-			if _, e := os.Lstat(filepath.Join(c.RunDir, "process.json")); e != nil {
-				t.Fatal("failure evidence removed", e)
-			}
-			if _, e := os.Lstat(filepath.Join(c.RunDir, "helper.sock")); e != nil {
-				t.Fatal("partial deletion before preflight", e)
-			}
-			if f.stopped != 0 || f.started != 0 {
-				t.Fatal("repair touched process", f)
-			}
-		})
-	}
-}
-
-func TestRepairRetriesInterruptedUnlinkAndOrphanProof(t *testing.T) {
-	for _, gap := range []string{"fence", "one-socket", "all-sockets", "all-runtime", "orphan-proof"} {
-		t.Run(gap, func(t *testing.T) {
-			c, f, _ := repairFixture(t)
-			r, e := readRecord(c.StateDir, c.Owner)
-			if e != nil {
-				t.Fatal(e)
-			}
-			r.Residual = true
-			r.Lifecycle.Phase = "fenced"
-			r.Lifecycle.Reason = "admin-repair"
-			record(t, c.Client, r)
-			if gap != "fence" {
-				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
-			}
-			if gap == "all-sockets" || gap == "all-runtime" || gap == "orphan-proof" {
-				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
-			}
-			if gap == "all-runtime" || gap == "orphan-proof" {
-				os.Remove(filepath.Join(c.RunDir, "process.json"))
-			}
-			if gap == "orphan-proof" {
-				// A correctly bound private artifact without the approval digest is
-				// still an uncommitted repair, not permission to recover.
-				proof := Completion{Epoch: r.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: r.Inventory, Boot: r.Lifecycle.Binding.Boot, Lease: *r.Lifecycle.Lease}}
-				if e := writeProtected(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json", proof); e != nil {
-					t.Fatal(e)
-				}
-			}
-			if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-				t.Fatal("crash gap recovered without repair")
-			}
-			if e := c.Control(context.Background(), "repair"); e != nil {
-				t.Fatal("retry failed", e)
-			}
-			r, e = readRecord(c.StateDir, c.Owner)
-			if e != nil || r.Residual {
-				t.Fatal("retry incomplete", e)
-			}
-		})
-	}
-}
-
-func TestRepairProofWriteFailureKeepsLatchAfterUnlink(t *testing.T) {
-	c, f, _ := repairFixture(t)
-	r, e := readRecord(c.StateDir, c.Owner)
-	if e != nil {
-		t.Fatal(e)
-	}
-	proof := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
-	os.Mkdir(proof, 0700) // deterministic failure after runtime unlink, before proof commit
-	if c.Control(context.Background(), "repair") == nil {
-		t.Fatal("proof failure committed")
-	}
-	r, e = readRecord(c.StateDir, c.Owner)
-	if e != nil || !r.Residual || r.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
-		t.Fatal("lost crash intent", e)
-	}
-	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-		t.Fatal("uncommitted repair revived")
-	}
-	os.Remove(proof)
-	if e := c.Control(context.Background(), "repair"); e != nil {
-		t.Fatal(e)
-	}
-	os.Remove(proof)
-	if c.Control(context.Background(), "recover") == nil {
-		t.Fatal("missing committed proof accepted")
-	}
-}
-
-func TestRepairAcrossPayloadRetainsOldApprovalAndRequiresEnable(t *testing.T) {
-	c, f, _ := repairFixture(t)
-	c.Expected.Version = "2.0.0-0002"
-	if e := c.Control(context.Background(), "repair"); e != nil {
-		t.Fatal(e)
-	}
-	r, e := readRecord(c.StateDir, c.Owner)
-	if e != nil || r.Inventory.Version != "1.0.0-0001" {
-		t.Fatal("repair expanded approval", e)
-	}
-	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-		t.Fatal("old inventory recovered")
-	}
-	if e := c.Control(context.Background(), "enable"); e != nil {
-		t.Fatal(e)
-	}
-}
-
-func TestRepairCanceledBeforeMutation(t *testing.T) {
-	c, f, _ := repairFixture(t)
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	if e := c.Control(ctx, "repair"); !errors.Is(e, context.Canceled) {
-		t.Fatal(e)
-	}
-	if f.stopped != 0 || f.started != 0 {
-		t.Fatal(f)
-	}
-}
-
-func TestRepairAfterAutonomousCompletionKeepsLifetimeAuthority(t *testing.T) {
-	c, f, _ := repairFixture(t)
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "admin-stop"); err != nil {
-		t.Fatal(err)
-	}
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, r.Lifecycle.Epoch, f.current); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.Control(context.Background(), "repair"); err != nil {
-		t.Fatal(err)
-	}
-	got, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		t.Fatal(err)
-	}
-	proof, err := completionRecord(c.Client, got)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.Residual || !got.Enabled || got.Lifecycle.Epoch != r.Lifecycle.Epoch || proof.Repair == nil || f.stopped != 0 || f.started != 0 {
-		t.Fatal("Repair lost lifetime authority or touched a PID")
-	}
-}