@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/background_proof.go

@@ -1,163 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"cmp"
-	"context"
-	"slices"
-	"time"
-)
-
-func (o *backgroundObserver) observe(ctx context.Context, recorded RelaxedIdentity) backgroundObservation {
-	refuse := func(code Code) backgroundObservation { return backgroundObservation{code: code} }
-	revoke := func(code Code, observed RelaxedIdentity) backgroundObservation {
-		ids := []RelaxedIdentity{recorded}
-		if validRelaxedIdentity(observed) && observed != recorded {
-			ids = append(ids, observed)
-		}
-		return backgroundObservation{code: code, revoke: true, identities: ids}
-	}
-	if o == nil || o.accounts == nil || o.groups == nil || o.app == nil || o.appID == "" || o.now == nil {
-		return refuse(ErrUnavailable)
-	}
-	if !validRelaxedIdentity(recorded) {
-		return refuse(ErrDenied)
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	if c := nativeContextCode(ctx); c != "" {
-		return refuse(c)
-	}
-	a, c := o.accounts.LookupRelaxedAccount(ctx, recorded.Username)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		if c == ErrDenied {
-			return revoke(c, RelaxedIdentity{})
-		}
-		return refuse(c)
-	}
-	if !nativeFresh(a.CheckedAt, o.now()) {
-		return refuse(ErrStale)
-	}
-	if a.Kind != "local" {
-		return refuse(ErrUnsupported)
-	}
-	if !a.StateKnown {
-		return refuse(ErrUnavailable)
-	}
-	if !a.Exists || !a.Enabled {
-		return revoke(ErrDenied, a.Identity)
-	}
-	if a.Identity != recorded {
-		return revoke(ErrSuspended, a.Identity)
-	}
-	if !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
-		return refuse(ErrUnavailable)
-	}
-	if a.Expired || !a.PasswordUsable {
-		return revoke(ErrDenied, a.Identity)
-	}
-	if a.PrimaryGID == 0 {
-		return refuse(ErrDenied)
-	}
-	g, c := o.groups.LookupRelaxedGroups(ctx, a)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return refuse(c)
-	}
-	if !nativeFresh(g.CheckedAt, o.now()) {
-		return refuse(ErrStale)
-	}
-	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
-		return refuse(ErrStale)
-	}
-	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
-		return refuse(ErrUnavailable)
-	}
-	if slices.Contains(g.Groups, uint32(0)) {
-		return refuse(ErrDenied)
-	}
-	app, c := o.app.observeBackgroundApp(ctx, a, o.appID)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		if c == ErrDenied {
-			return revoke(c, a.Identity)
-		}
-		return refuse(c)
-	}
-	if !nativeFresh(app.CheckedAt, o.now()) {
-		return refuse(ErrStale)
-	}
-	if !app.Known || !app.OfflineEquivalent {
-		return refuse(ErrUnavailable)
-	}
-	if app.Identity != recorded || app.AppID != o.appID {
-		return refuse(ErrDenied)
-	}
-	if !app.Allowed {
-		return revoke(ErrDenied, a.Identity)
-	}
-	oldest := a.CheckedAt
-	for _, at := range []time.Time{g.CheckedAt, app.CheckedAt} {
-		if at.Before(oldest) {
-			oldest = at
-		}
-	}
-	if !nativeFresh(oldest, o.now()) {
-		return refuse(ErrStale)
-	}
-	groups := slices.Clone(g.Groups)
-	slices.Sort(groups)
-	groups = slices.Compact(groups)
-	return backgroundObservation{snapshot: backgroundSnapshot{recorded, a.PrimaryGID, groups, g.Admin, oldest, true}}
-}
-
-func (o *backgroundObserver) revalidate(ctx context.Context, old backgroundSnapshot) backgroundObservation {
-	if !old.valid {
-		return backgroundObservation{code: ErrDenied}
-	}
-	current := o.observe(ctx, old.identity)
-	if current.code != "" {
-		return current
-	}
-	next := current.snapshot
-	if old.gid != next.gid || old.admin != next.admin || !slices.Equal(old.groups, next.groups) {
-		return backgroundObservation{code: ErrStale}
-	}
-	return current
-}
-
-// Pure selection only: a trusted owner must enumerate ALL stored owner/issuer,
-// delegation and running/consumed identities under its existing admission order.
-// Incomplete enumeration fences the owner. This never changes authority or Q.
-func backgroundIdentityClosure(seeds, recorded []RelaxedIdentity, complete bool) ([]RelaxedIdentity, Code) {
-	// 256 authority records, at most four identity roles each, plus old/new seed.
-	if !complete || len(seeds) == 0 || len(seeds) > 2 || len(recorded) > 1024 {
-		return nil, ErrCleanupRequired
-	}
-	for _, set := range [][]RelaxedIdentity{seeds, recorded} {
-		for _, id := range set {
-			if !validRelaxedIdentity(id) {
-				return nil, ErrCleanupRequired
-			}
-		}
-	}
-	selected := slices.Clone(seeds)
-	for changed := true; changed; {
-		changed = false
-		for _, id := range recorded {
-			if slices.Contains(selected, id) {
-				continue
-			}
-			for _, known := range selected {
-				if relaxedRelated(id, known) {
-					selected = append(selected, id)
-					changed = true
-					break
-				}
-			}
-		}
-	}
-	slices.SortFunc(selected, func(a, b RelaxedIdentity) int {
-		return cmp.Or(cmp.Compare(a.UID, b.UID), cmp.Compare(a.Username, b.Username))
-	})
-	return slices.Compact(selected), ""
-}

package/templates/native-go/backend/internal/helper/background_proof_contract.go

@@ -1,46 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"time"
-)
-
-// S4 is an unconnected root-side observation seam, not a job admission API.
-// Production assembly deliberately installs no offline observers. These types
-// carry neither a session nor an IP and cannot mint a NativeActor.
-type backgroundAppProof struct {
-	Identity                          RelaxedIdentity
-	AppID                             string
-	Known, Allowed, OfflineEquivalent bool
-	CheckedAt                         time.Time
-}
-type backgroundAppObserver interface {
-	observeBackgroundApp(context.Context, RelaxedAccount, string) (backgroundAppProof, Code)
-}
-type backgroundObserver struct {
-	accounts RelaxedAccountProvider
-	groups   RelaxedGroupProvider
-	app      backgroundAppObserver
-	appID    string // compiled DSM registration privilege ID, not a request field
-	now      func() time.Time
-}
-type backgroundSnapshot struct {
-	identity  RelaxedIdentity
-	gid       uint32
-	groups    []uint32
-	admin     bool
-	checkedAt time.Time // oldest observation; never extended by a later lookup
-	valid     bool
-}
-
-// Revoke is an instruction to the existing authority owner, NOT durable R/Q.
-// Every nonempty Code stops admission/output. The owner must latch revocation,
-// enumerate the complete store, durably revoke, and drain outside its locks.
-type backgroundObservation struct {
-	snapshot   backgroundSnapshot
-	code       Code
-	revoke     bool
-	identities []RelaxedIdentity
-}

package/templates/native-go/backend/internal/helper/background_proof_test.go

@@ -1,161 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"slices"
-	"testing"
-	"time"
-)
-
-type offlineFake struct {
-	proof backgroundAppProof
-	code  Code
-	after func()
-}
-
-func (f *offlineFake) observeBackgroundApp(ctx context.Context, a RelaxedAccount, app string) (backgroundAppProof, Code) {
-	if _, ok := ctx.Deadline(); !ok {
-		panic("no deadline")
-	}
-	if f.after != nil {
-		f.after()
-	}
-	return f.proof, f.code
-}
-func offlineFixture(t *testing.T) (*backgroundObserver, *relaxedFake, *offlineFake, RelaxedIdentity) {
-	_, _, p, f, _, _, _ := relaxedFixture(t)
-	app := &offlineFake{proof: backgroundAppProof{Identity: f.account.Identity, AppID: "FixturePrivilege", Known: true, Allowed: true, OfflineEquivalent: true, CheckedAt: p.now()}}
-	return &backgroundObserver{f, f, app, "FixturePrivilege", p.now}, f, app, f.account.Identity
-}
-func TestBackgroundLogoutAndOldestProof(t *testing.T) {
-	o, f, _, id := offlineFixture(t)
-	f.sessionCode = ErrDenied // logout cannot affect a non-session observer
-	f.account.CheckedAt = o.now().Add(-time.Second)
-	got := o.observe(context.Background(), id)
-	if got.code != "" || !got.snapshot.valid || got.snapshot.checkedAt != f.account.CheckedAt {
-		t.Fatalf("%+v", got)
-	}
-	f.groups.Groups[0] = 999
-	if slices.Contains(got.snapshot.groups, uint32(999)) {
-		t.Fatal("aliased credentials")
-	}
-	if got.snapshot.identity != id {
-		t.Fatal("identity")
-	}
-}
-func TestBackgroundRefusals(t *testing.T) {
-	cases := []struct {
-		name   string
-		change func(*backgroundObserver, *relaxedFake, *offlineFake)
-		code   Code
-		revoke bool
-	}{
-		{"nil account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.accounts = nil }, ErrUnavailable, false},
-		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.groups = nil }, ErrUnavailable, false},
-		{"nil app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.app = nil }, ErrUnavailable, false},
-		{"missing compiled App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.appID = "" }, ErrUnavailable, false},
-		{"unknown state", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.StateKnown = false }, ErrUnavailable, false},
-		{"disabled", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Enabled = false }, ErrDenied, true},
-		{"deleted no tuple", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
-			f.account.Exists = false
-			f.account.Identity = RelaxedIdentity{}
-		}, ErrDenied, true},
-		{"lookup denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.accountCode = ErrDenied }, ErrDenied, true},
-		{"UID change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.UID++ }, ErrSuspended, true},
-		{"name change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.Username = "Alice" }, ErrSuspended, true},
-		{"LDAP", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Kind = "ldap" }, ErrUnsupported, false},
-		{"expiry unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.ExpiryKnown = false }, ErrUnavailable, false},
-		{"password unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PasswordKnown = false }, ErrUnavailable, false},
-		{"expired", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Expired = true }, ErrDenied, true},
-		{"root GID", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PrimaryGID = 0 }, ErrDenied, false},
-		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = nil }, ErrUnavailable, false},
-		{"partial groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Complete = false }, ErrUnavailable, false},
-		{"unknown admin", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.AdminKnown = false }, ErrUnavailable, false},
-		{"group root", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = []uint32{0} }, ErrDenied, false},
-		{"incoherent groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Identity.UID++ }, ErrStale, false},
-		{"App unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Known = false }, ErrUnavailable, false},
-		{"App IP semantics unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.OfflineEquivalent = false }, ErrUnavailable, false},
-		{"wrong App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.AppID = "other" }, ErrDenied, false},
-		{"wrong App actor", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Identity.UID++ }, ErrDenied, false},
-		{"App revoke", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Allowed = false }, ErrDenied, true},
-		{"App denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = ErrDenied }, ErrDenied, true},
-		{"raw error", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = "secret native error" }, ErrUnavailable, false},
-		{"old account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
-			f.account.CheckedAt = o.now().Add(-3 * time.Second)
-		}, ErrStale, false},
-		{"future groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
-			f.groups.CheckedAt = o.now().Add(time.Nanosecond)
-		}, ErrStale, false},
-		{"zero App time", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.CheckedAt = time.Time{} }, ErrStale, false},
-		{"aged during app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
-			now := o.now()
-			a.after = func() { o.now = func() time.Time { return now.Add(3 * time.Second) } }
-		}, ErrStale, false},
-	}
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			o, f, a, id := offlineFixture(t)
-			tt.change(o, f, a)
-			got := o.observe(context.Background(), id)
-			if got.code != tt.code || got.revoke != tt.revoke || got.snapshot.valid {
-				t.Fatalf("got %+v want %s revoke %v", got, tt.code, tt.revoke)
-			}
-			if got.revoke && !slices.Contains(got.identities, id) {
-				t.Fatal("lost old identity")
-			}
-		})
-	}
-	var nilObserver *backgroundObserver
-	if nilObserver.observe(context.Background(), RelaxedIdentity{}).code != ErrUnavailable {
-		t.Fatal("nil allowed")
-	}
-}
-func TestBackgroundCredentialChangeAndCancellation(t *testing.T) {
-	for _, what := range []string{"groups", "gid", "admin"} {
-		t.Run(what, func(t *testing.T) {
-			o, f, _, id := offlineFixture(t)
-			old := o.observe(context.Background(), id).snapshot
-			switch what {
-			case "groups":
-				f.groups.Groups = []uint32{}
-			case "gid":
-				f.account.PrimaryGID++
-				f.groups.PrimaryGID++
-			case "admin":
-				f.groups.Admin = !f.groups.Admin
-			}
-			if got := o.revalidate(context.Background(), old); got.code != ErrStale || got.snapshot.valid || got.revoke {
-				t.Fatalf("%+v", got)
-			}
-		})
-	}
-	o, _, app, id := offlineFixture(t)
-	ctx, cancel := context.WithCancel(context.Background())
-	app.after = cancel
-	if got := o.observe(ctx, id); got.code != ErrCanceled || got.snapshot.valid {
-		t.Fatal(got.code)
-	}
-}
-func TestBackgroundIdentityClosure(t *testing.T) {
-	old := RelaxedIdentity{1001, "alice"}
-	renamed := RelaxedIdentity{1001, "alice2"}
-	reused := RelaxedIdentity{2001, "alice2"}
-	unrelated := RelaxedIdentity{3001, "bob"}
-	// Complete root-side records include owner/issuer, all delegation actors,
-	// and consumed/running jobs. Order must not hide transitive old associations.
-	got, c := backgroundIdentityClosure([]RelaxedIdentity{old}, []RelaxedIdentity{reused, unrelated, renamed, old}, true)
-	if c != "" || len(got) != 3 || !slices.Contains(got, reused) || slices.Contains(got, unrelated) {
-		t.Fatalf("%v %s", got, c)
-	}
-	for _, complete := range []bool{false, true} {
-		records := []RelaxedIdentity{old}
-		if complete {
-			records = append(records, RelaxedIdentity{})
-		}
-		if _, c := backgroundIdentityClosure([]RelaxedIdentity{old}, records, complete); c != ErrCleanupRequired {
-			t.Fatal("incomplete index allowed", c)
-		}
-	}
-}