@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/grant_authority_test.go

@@ -1,510 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"math"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-type memoryGrantRepository struct {
-	policy        GrantPolicy
-	store         GrantStore
-	fail          Code
-	qFailure      Code
-	q             GrantQuiescence
-	inTransaction bool
-	commits       int
-}
-
-func (r *memoryGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
-	r.q = q
-	if r.qFailure != "" {
-		return r.qFailure
-	}
-	return r.fail
-}
-func (r *memoryGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
-	r.inTransaction = true
-	defer func() { r.inTransaction = false }()
-	b, _ := json.Marshal(r.store)
-	next, c := DecodeGrantStore(bytes.NewReader(b))
-	if c != "" {
-		return c
-	}
-	write, c := fn(r.policy, &next)
-	if c != "" {
-		return c
-	}
-	if write {
-		if r.fail != "" {
-			return r.fail
-		}
-		r.store = next
-		r.commits++
-	}
-	return ""
-}
-
-type consentStub struct {
-	selection ConsentSelection
-	code      Code
-	after     func()
-}
-
-func (s *consentStub) ValidateConsent(_ context.Context, _ NativeActor, _ string, _ ScopeKind, _ []Action) (ConsentSelection, Code) {
-	if s.after != nil {
-		s.after()
-	}
-	return s.selection, s.code
-}
-
-type cohortStub struct {
-	drain func(context.Context, GrantDrainKey) (GrantQuiescence, Code)
-}
-
-func (s cohortStub) DrainGrant(ctx context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
-	return s.drain(ctx, key)
-}
-func completeGrantProof(key GrantDrainKey) GrantQuiescence {
-	return GrantQuiescence{Key: key, ChildrenReaped: true, RelayClosed: true, LeasesClosed: true, FDsClosed: true, EffectsRecorded: true}
-}
-func grantAuthorityFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepository, *NativeProvider, *fakeNativeSession, *fakeLocalAccount, *consentStub, SessionCarriers, time.Time) {
-	t.Helper()
-	p, s, a, carriers, now := nativeFixture()
-	store, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-	if c != "" {
-		t.Fatal(c)
-	}
-	g := store.Grants[0]
-	r := &memoryGrantRepository{policy: GrantPolicy{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, ApprovalBinding: g.ApprovalBinding, CapabilityDigest: g.CapabilityDigest, Enabled: true}, store: GrantStore{Schema: testAuthoritySchema, Revision: 1, Grants: []Grant{}}}
-	scope := g.Scope
-	scope.Kind = ScopePersonal
-	scope.Segments = []string{"chosen"}
-	validator := &consentStub{selection: ConsentSelection{Principal: a.value.Principal, SessionRef: s.value.SessionRef, Scope: scope, Binding: g.LastValidated, CheckedAt: now}}
-	auth, c := NewGrantAuthority(r, p, validator, cohortStub{func(ctx context.Context, key GrantDrainKey) (GrantQuiescence, Code) {
-		return completeGrantProof(key), ""
-	}})
-	if c != "" {
-		t.Fatal(c)
-	}
-	auth.now = func() time.Time { return now }
-	return auth, r, p, s, a, validator, carriers, now
-}
-func prepareGrant(t *testing.T, a *GrantAuthority, c SessionCarriers, kind ScopeKind) Intent {
-	t.Helper()
-	i, code := a.Prepare(context.Background(), c, grantRef('5'), kind, []Action{ActionRead})
-	if code != "" {
-		t.Fatal(code)
-	}
-	return i
-}
-func confirmGrant(t *testing.T, a *GrantAuthority, r *memoryGrantRepository, c SessionCarriers, i Intent) Grant {
-	t.Helper()
-	g, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision)
-	if code != "" {
-		t.Fatal(code)
-	}
-	return g
-}
-func grantRef(c byte) string { return string(bytes.Repeat([]byte{c}, 64)) }
-func admissionFor(t *testing.T, p *NativeProvider, c SessionCarriers, g Grant) GrantAdmission {
-	t.Helper()
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	return GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}
-}
-func TestGrantAuthorityConsentCASAndReplay(t *testing.T) {
-	a, r, _, s, _, v, c, _ := grantAuthorityFixture(t)
-	i := prepareGrant(t, a, c, ScopePersonal)
-	if _, code := a.Confirm(context.Background(), c, i.ID, grantRef('8'), r.store.Revision); code != ErrDenied {
-		t.Fatal(code)
-	}
-	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision+1); code != ErrStale {
-		t.Fatal(code)
-	}
-	g := confirmGrant(t, a, r, c, i)
-	if g.State != GrantActive || g.Revision != 1 || g.Owner != v.selection.Principal || g.LastValidated != v.selection.Binding || r.store.Revision != 2 || len(r.store.Grants) != 1 || s.calls < 3 {
-		t.Fatal("confirm did not durably bind fresh consent")
-	}
-	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrReplay {
-		t.Fatal(code)
-	}
-	g.Actions[0] = ActionCreate
-	g.Scope.Segments[0] = "mutated"
-	if r.store.Grants[0].Actions[0] != ActionRead || r.store.Grants[0].Scope.Segments[0] != "chosen" {
-		t.Fatal("mutable authority alias")
-	}
-}
-func TestGrantAuthoritySingleWinner(t *testing.T) {
-	a, r, _, _, _, _, c, _ := grantAuthorityFixture(t)
-	i := prepareGrant(t, a, c, ScopePersonal)
-	// The native stubs count calls, so serialize their observations separately.
-	_, s, acct, _, now := nativeFixture()
-	lock := &sync.Mutex{}
-	a.native = NewNativeProvider(lockedSession{lock, s.value}, lockedAccount{lock, acct.value})
-	a.native.now = func() time.Time { return now }
-	var wins atomic.Int32
-	var wg sync.WaitGroup
-	for n := 0; n < 16; n++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			_, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, 1)
-			if code == "" {
-				wins.Add(1)
-			} else if code != ErrReplay && code != ErrStale {
-				t.Error(code)
-			}
-		}()
-	}
-	wg.Wait()
-	if wins.Load() != 1 || len(r.store.Grants) != 1 {
-		t.Fatal(wins.Load())
-	}
-}
-
-type lockedSession struct {
-	mu    *sync.Mutex
-	value NativeSession
-}
-
-func (s lockedSession) ValidateSession(context.Context, SessionCarriers) (NativeSession, Code) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	return s.value, ""
-}
-
-type lockedAccount struct {
-	mu    *sync.Mutex
-	value LocalAccount
-}
-
-func (a lockedAccount) LookupLocalAccount(context.Context, string) (LocalAccount, Code) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	return a.value, ""
-}
-func TestGrantAuthorityIntentLimitsAndExpiry(t *testing.T) {
-	a, r, _, _, _, _, c, now := grantAuthorityFixture(t)
-	var first Intent
-	for n := 0; n < MaxLiveIntents; n++ {
-		i := prepareGrant(t, a, c, ScopePersonal)
-		if n == 0 {
-			first = i
-		}
-	}
-	if _, code := a.Prepare(context.Background(), c, grantRef('5'), ScopePersonal, []Action{ActionRead}); code != ErrBusy {
-		t.Fatal(code)
-	}
-	a.now = func() time.Time { return now.Add(IntentTTL) }
-	if _, code := a.Confirm(context.Background(), c, first.ID, first.SummaryDigest, r.store.Revision); code != ErrExpired {
-		t.Fatal(code)
-	}
-	if len(r.store.Grants) != 0 {
-		t.Fatal("expired intent wrote authority")
-	}
-}
-func TestGrantAuthorityFreshRoleScopeAndSession(t *testing.T) {
-	tests := []struct {
-		name   string
-		change func(*GrantAuthority, *memoryGrantRepository, *fakeNativeSession, *fakeLocalAccount, *consentStub)
-		want   Code
-	}{
-		{"session", func(_ *GrantAuthority, _ *memoryGrantRepository, s *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
-			s.value.SessionRef = grantRef('9')
-		}, ErrStale},
-		{"disabled account", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, acct *fakeLocalAccount, _ *consentStub) {
-			acct.value.Enabled = false
-		}, ErrDenied},
-		{"scope replacement", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
-			v.selection.Scope.ObjectRef = grantRef('9')
-		}, ErrStale},
-		{"unknown proof", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
-			v.selection.Binding.ScopeProof = ""
-		}, ErrSuspended},
-		{"ACL denial", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, v *consentStub) {
-			v.code = ErrDenied
-		}, ErrDenied},
-		{"approval changed", func(_ *GrantAuthority, r *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
-			r.policy.ApprovalBinding = grantRef('9')
-		}, ErrFenced},
-		{"new epoch", func(_ *GrantAuthority, r *memoryGrantRepository, _ *fakeNativeSession, _ *fakeLocalAccount, _ *consentStub) {
-			r.policy.Epoch = grantRef('9')
-		}, ErrFenced},
-		{"role removed", func(_ *GrantAuthority, _ *memoryGrantRepository, _ *fakeNativeSession, acct *fakeLocalAccount, _ *consentStub) {
-			acct.value.Admin = false
-		}, ErrStale},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			a, r, _, s, acct, v, c, _ := grantAuthorityFixture(t)
-			v.selection.Scope.Kind = ScopeShared
-			i := prepareGrant(t, a, c, ScopeShared)
-			tt.change(a, r, s, acct, v)
-			if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != tt.want {
-				t.Fatalf("%q want %q", code, tt.want)
-			}
-			if len(r.store.Grants) != 0 {
-				t.Fatal("invalid confirm persisted")
-			}
-		})
-	}
-	a, _, _, _, acct, v, c, _ := grantAuthorityFixture(t)
-	acct.value.Admin = false
-	v.selection.Scope.Kind = ScopeShared
-	if _, code := a.Prepare(context.Background(), c, grantRef('5'), ScopeShared, []Action{ActionRead}); code != ErrDenied {
-		t.Fatal(code)
-	}
-}
-func TestGrantAuthorityFenceWinsConfirmOutsideIO(t *testing.T) {
-	a, r, _, _, _, v, c, _ := grantAuthorityFixture(t)
-	i := prepareGrant(t, a, c, ScopePersonal)
-	v.after = func() { a.Fence() }
-	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrFenced {
-		t.Fatal(code)
-	}
-	if len(r.store.Grants) != 0 {
-		t.Fatal("fence lost to confirm")
-	}
-}
-func TestGrantAuthorityRevokeRBeforeQAndIndividual(t *testing.T) {
-	a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
-	one := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	two := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	admitted := admissionFor(t, p, c, one)
-	other := admissionFor(t, p, c, two)
-	entered := make(chan GrantDrainKey, 1)
-	release := make(chan struct{})
-	a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) {
-		entered <- k
-		<-release
-		return completeGrantProof(k), ""
-	}}
-	type outcome struct {
-		r RevokeResult
-		c Code
-	}
-	done := make(chan outcome, 1)
-	go func() {
-		result, code := a.Revoke(context.Background(), c, one.ID, one.Revision, 3)
-		done <- outcome{result, code}
-	}()
-	key := <-entered
-	if r.store.Grants[0].State != GrantRevoked || r.store.Revision != 4 || key.Revision != 2 {
-		t.Fatal("drain before durable R")
-	}
-	if code := a.WithGrantAdmission(admitted, func(Grant, NativeActor) Code { t.Fatal("admitted after R"); return "" }); code != ErrRevoked {
-		t.Fatal(code)
-	}
-	if code := a.WithGrantAdmission(other, func(Grant, NativeActor) Code { return "" }); code != "" {
-		t.Fatal("unrelated grant stopped", code)
-	}
-	close(release)
-	result := <-done
-	if result.c != "" || !result.r.Revoked || !result.r.Drained || result.r.Revision != 2 {
-		t.Fatal(result)
-	}
-	if _, code := a.Revoke(context.Background(), c, one.ID, 1, 3); code != ErrStale {
-		t.Fatal("CAS replay", code)
-	}
-}
-func TestGrantAuthorityQuiescenceRequiresEveryProof(t *testing.T) {
-	for _, part := range []string{"children", "relay", "leases", "fds", "effects", "binding", "timeout", "nil"} {
-		t.Run(part, func(t *testing.T) {
-			a, r, _, _, _, _, c, _ := grantAuthorityFixture(t)
-			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-			a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) {
-				if _, ok := ctx.Deadline(); !ok {
-					t.Fatal("no drain deadline")
-				}
-				q := completeGrantProof(k)
-				switch part {
-				case "children":
-					q.ChildrenReaped = false
-				case "relay":
-					q.RelayClosed = false
-				case "leases":
-					q.LeasesClosed = false
-				case "fds":
-					q.FDsClosed = false
-				case "effects":
-					q.EffectsRecorded = false
-				case "binding":
-					q.Key.Epoch = grantRef('9')
-				case "timeout":
-					return q, ErrTimeout
-				}
-				return q, ""
-			}}
-			if part == "nil" {
-				a.cohort = nil
-			}
-			result, code := a.Revoke(context.Background(), c, g.ID, 1, 2)
-			if !result.Revoked || result.Drained || code != ErrCleanupRequired || r.store.Grants[0].State != GrantRevoked {
-				t.Fatalf("false Q: %#v %q", result, code)
-			}
-			// Idempotent status/drain retry requires CURRENT CAS and cannot un-revoke.
-			a.cohort = cohortStub{func(ctx context.Context, k GrantDrainKey) (GrantQuiescence, Code) { return completeGrantProof(k), "" }}
-			result, code = a.Revoke(context.Background(), c, g.ID, 2, 3)
-			if code != "" || !result.Drained || r.store.Revision != 3 {
-				t.Fatal(result, code)
-			}
-		})
-	}
-}
-func TestGrantAuthorityCommitFailureNeverReportsR(t *testing.T) {
-	for _, failure := range []Code{ErrUnavailable, ErrCommitUncertain} {
-		t.Run(string(failure), func(t *testing.T) {
-			a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
-			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-			admission := admissionFor(t, p, c, g)
-			r.fail = failure
-			result, code := a.Revoke(context.Background(), c, g.ID, 1, 2)
-			if result.Revoked || result.Drained || code != failure {
-				t.Fatal(result, code)
-			}
-			if code = a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("new admission after failed R"); return "" }); code != ErrFenced {
-				t.Fatal(code)
-			}
-		})
-	}
-}
-func TestGrantAuthorityRestartAndUnknownContinuitySuspend(t *testing.T) {
-	a, r, p, _, _, v, c, _ := grantAuthorityFixture(t)
-	g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	admission := admissionFor(t, p, c, g)
-	admission.Continuous = false
-	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("unknown continuity"); return "" }); code != ErrSuspended {
-		t.Fatal(code)
-	}
-	if r.store.Grants[0].State != GrantSuspended || r.store.Grants[0].Revision != 2 {
-		t.Fatal("suspension not durable")
-	}
-	admission.Continuous = true
-	admission.Revision = 2
-	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { return "" }); code != ErrSuspended {
-		t.Fatal("auto unsuspend", code)
-	}
-	fresh := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	if fresh.ID == g.ID {
-		t.Fatal("ID reuse")
-	}
-	// Opening authority ALWAYS suspends active records, even identical epoch.
-	reopened, code := NewGrantAuthority(r, p, v, a.cohort)
-	if code != "" {
-		t.Fatal(code)
-	}
-	reopened.now = a.now
-	if r.store.Grants[1].State != GrantSuspended {
-		t.Fatal("restored active grant")
-	}
-	// Revoked tombstones survive both reconciliation and reconsent.
-	if _, code := reopened.Revoke(context.Background(), c, g.ID, 2, r.store.Revision); code != "" {
-		t.Fatal(code)
-	}
-	_, code = NewGrantAuthority(r, p, v, a.cohort)
-	if code != "" || r.store.Grants[0].State != GrantRevoked {
-		t.Fatal("tombstone resurrected", code)
-	}
-}
-func TestGrantAuthorityBoundsAndAuthorization(t *testing.T) {
-	a, r, p, s, acct, v, c, _ := grantAuthorityFixture(t)
-	g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	acct.value.Admin = false
-	acct.value.Principal.SubjectRef = grantRef('9')
-	acct.value.Principal.InstanceRef = grantRef('8')
-	s.value.AccountInstanceRef = acct.value.Principal.InstanceRef
-	if _, code := a.Revoke(context.Background(), c, g.ID, 1, 2); code != ErrDenied {
-		t.Fatal("other person revoked", code)
-	}
-	admission := admissionFor(t, p, c, g)
-	if code := a.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("other person's data"); return "" }); code != ErrDenied {
-		t.Fatal(code)
-	}
-	acct.value.Admin = true
-	if result, code := a.Revoke(context.Background(), c, g.ID, 1, 2); code != "" || !result.Revoked {
-		t.Fatal("admin safe revoke", code)
-	}
-	v.selection.Principal = acct.value.Principal
-	v.selection.SessionRef = s.value.SessionRef
-	// Tombstones occupy the cap and never get evicted for new consent.
-	original := r.store.Grants[0]
-	for len(r.store.Grants) < MaxGrants {
-		n := original
-		n.ID = uniqueGrantTestID(len(r.store.Grants))
-		r.store.Grants = append(r.store.Grants, n)
-	}
-	if _, code := a.Confirm(context.Background(), c, prepareGrant(t, a, c, ScopePersonal).ID, grantRef('9'), r.store.Revision); code != ErrDenied {
-		t.Fatal(code)
-	}
-	i := prepareGrant(t, a, c, ScopePersonal)
-	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrLimit {
-		t.Fatal("cap", code)
-	}
-	r.store.Grants = r.store.Grants[:1]
-	r.store.Revision = math.MaxUint64
-	i = prepareGrant(t, a, c, ScopePersonal)
-	if _, code := a.Confirm(context.Background(), c, i.ID, i.SummaryDigest, r.store.Revision); code != ErrLimit {
-		t.Fatal("revision overflow", code)
-	}
-}
-func uniqueGrantTestID(n int) string {
-	b := make([]byte, 32)
-	b[0] = byte(n)
-	b[1] = byte(n >> 8)
-	const digits = "0123456789abcdef"
-	out := make([]byte, 64)
-	for i, v := range b {
-		out[i*2] = digits[v>>4]
-		out[i*2+1] = digits[v&15]
-	}
-	return string(out)
-}
-
-func TestGrantAuthorityFailedSuspensionLatchesDeny(t *testing.T) {
-	for _, failure := range []string{"overflow", "size", "disk"} {
-		t.Run(failure, func(t *testing.T) {
-			a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
-			g := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-			proof := admissionFor(t, p, c, g)
-			proof.Continuous = false
-			switch failure {
-			case "overflow":
-				r.store.Revision = math.MaxUint64
-			case "size":
-				r.fail = ErrLimit
-			case "disk":
-				r.fail = ErrUnavailable
-			}
-			if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("unknown continuity admitted"); return "" }); code == "" {
-				t.Fatal("suspension failure succeeded")
-			}
-			proof.Continuous = true
-			r.fail = ""
-			if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { t.Fatal("failed suspension resurrected"); return "" }); code != ErrFenced {
-				t.Fatal(code)
-			}
-		})
-	}
-}
-func TestGrantAuthorityBusyQDoesNotStopOtherGrants(t *testing.T) {
-	a, r, p, _, _, _, c, _ := grantAuthorityFixture(t)
-	one := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	two := confirmGrant(t, a, r, c, prepareGrant(t, a, c, ScopePersonal))
-	proof := admissionFor(t, p, c, two)
-	r.qFailure = ErrBusy
-	result, code := a.Revoke(context.Background(), c, one.ID, 1, 3)
-	if code != ErrCleanupRequired || !result.Revoked || result.Drained {
-		t.Fatal(result, code)
-	}
-	if code := a.WithGrantAdmission(proof, func(Grant, NativeActor) Code { return "" }); code != "" {
-		t.Fatal("Q lock contention stopped unrelated grant", code)
-	}
-}