@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/grant_readonly_test.go

@@ -1,180 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-type readOnlyRootStub struct{ path string }
-
-func (r *readOnlyRootStub) readOnlyRootPath() string                        { return r.path }
-func (r *readOnlyRootStub) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
-
-type readOnlyGrantValidatorStub struct {
-	root  readOnlyRootWitness
-	after func()
-}
-
-func (v readOnlyGrantValidatorStub) ValidateOperation(ctx context.Context, a NativeActor, r DataRequest, g Grant) (GrantUseValidation, Code) {
-	p, c := (grantOperationStub{after: v.after}).ValidateOperation(ctx, a, r, g)
-	p.root = v.root
-	return p, c
-}
-
-type metadataProcessStub struct {
-	*operationFixture
-	result   *readOnlyResult
-	released bool
-}
-
-func (p *metadataProcessStub) readOnlyMetadata() (*readOnlyResult, bool, error) {
-	return p.result, p.result != nil, nil
-}
-func (p *metadataProcessStub) releaseReadOnlyMetadata() error { p.released = true; return nil }
-func (p *metadataProcessStub) readOnlyLeaseReady(n uint32) Code {
-	if !p.released {
-		return ErrBusy
-	}
-	if p.result.Code != "" || uint64(n) > p.result.Bytes {
-		return ErrLimit
-	}
-	return ""
-}
-func readOnlyGrantControl(t *testing.T, g Grant, action Action, op, nonce, ticket byte, args any) DataRequest {
-	t.Helper()
-	r := grantControl(t, g, op, nonce, ticket, 1)
-	r.Op = action
-	r.Args, _ = json.Marshal(args)
-	return r
-}
-func TestGrantReadOnlyUsesExistingReservationForStatAndList(t *testing.T) {
-	for _, action := range []Action{ActionStat, ActionList} {
-		t.Run(string(action), func(t *testing.T) {
-			s, repo, c, carrier, g, _ := grantCohortFixture(t)
-			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
-			s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: "/trusted/root"}}
-			var args any = StatArgs{Segments: []string{"fixture"}}
-			if action == ActionList {
-				args = ListArgs{Segments: []string{}, Limit: 20}
-			}
-			r := readOnlyGrantControl(t, g, action, '1', '2', '3', args)
-			if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
-				t.Fatal(code)
-			}
-			op := c.operations[r.OperationID]
-			if op.work == nil || op.work.Action != action || op.work.RootPath != "/trusted/root" {
-				t.Fatal("fixed work lost", op)
-			}
-			if code := s.chunk(context.Background(), operationPeer{42, 0}, carrier, grantControl(t, g, '1', '4', '5', 1)); code == "" {
-				t.Fatal("read lease changed admitted action")
-			}
-		})
-	}
-}
-func TestGrantReadOnlyMetadataRevalidatesBeforePublication(t *testing.T) {
-	for _, kind := range []string{"valid", "revoked", "fence", "native", "root", "pending", "peer", "wrong-args", "ticket", "revoke-during-validation", "fence-during-validation"} {
-		t.Run(kind, func(t *testing.T) {
-			s, repo, c, carrier, g, _ := grantCohortFixture(t)
-			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
-			root := &readOnlyRootStub{path: "/trusted/root"}
-			s.services.operations = readOnlyGrantValidatorStub{root: root}
-			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Entry: &Entry{Name: "canary"}}}
-			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
-			args := StatArgs{Segments: []string{"fixture"}}
-			r := readOnlyGrantControl(t, g, ActionStat, '1', '2', '3', args)
-			if code := s.start(context.Background(), operationPeer{42, 0}, carrier, r); code != "" {
-				t.Fatal(code)
-			}
-			r = readOnlyGrantControl(t, g, ActionStat, '1', '4', '5', args)
-			peer := operationPeer{42, 0}
-			switch kind {
-			case "revoked":
-				repo.store.Grants[0].State = GrantRevoked
-				repo.store.Grants[0].Reason = ErrRevoked
-				repo.store.Grants[0].Revision++
-				repo.store.Grants[0].RevokedAt = g.CreatedAt
-			case "fence":
-				c.gate.fence("before metadata")
-			case "native":
-				s.services.operations = grantOperationStub{code: ErrDenied}
-			case "root":
-				s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: "/other"}}
-			case "revoke-during-validation":
-				s.services.operations = readOnlyGrantValidatorStub{root: root, after: func() {
-					repo.store.Grants[0].State = GrantRevoked
-					repo.store.Grants[0].Reason = ErrRevoked
-					repo.store.Grants[0].Revision++
-					repo.store.Grants[0].RevokedAt = g.CreatedAt
-				}}
-			case "fence-during-validation":
-				s.services.operations = readOnlyGrantValidatorStub{root: root, after: func() { c.gate.fence("during validation") }}
-			case "pending":
-				p.result = nil
-			case "peer":
-				peer.PID++
-			case "wrong-args":
-				r.Args = []byte(`{"segments":["other"]}`)
-			case "ticket":
-				r.Ticket = grantRef('3')
-			}
-			value, code := s.result(context.Background(), peer, carrier, r)
-			if kind == "valid" {
-				if code != "" || value == nil || value.Entry.Name != "canary" || !p.released {
-					t.Fatal(value, code)
-				}
-				value.Entry.Name = "changed"
-				if p.result.Entry.Name != "canary" {
-					t.Fatal("mutable metadata shared")
-				}
-			} else if code == "" || value != nil || p.released {
-				t.Fatal("unvalidated metadata escaped", kind, value, code)
-			}
-		})
-	}
-}
-
-func TestGrantReadOnlyChunkChecksFixedWorkAndRemainingBytes(t *testing.T) {
-	for _, kind := range []string{"valid", "unreleased", "remaining", "root", "action", "segments", "revoked", "fence", "native"} {
-		t.Run(kind, func(t *testing.T) {
-			s, repo, c, carriers, g, _ := grantCohortFixture(t)
-			repo.store.Grants[0].Actions = []Action{ActionRead, ActionStat, ActionList}
-			root := &readOnlyRootStub{path: "/trusted/root"}
-			s.services.operations = readOnlyGrantValidatorStub{root: root}
-			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Bytes: 3}, released: kind != "unreleased"}
-			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
-			if code := s.start(context.Background(), operationPeer{42, 0}, carriers, grantControl(t, g, '1', '2', '3', 10)); code != "" {
-				t.Fatal(code)
-			}
-			r := grantControl(t, g, '1', '4', '5', 2)
-			switch kind {
-			case "remaining":
-				r = grantControl(t, g, '1', '4', '5', 4)
-			case "root":
-				s.services.operations = readOnlyGrantValidatorStub{root: &readOnlyRootStub{path: root.path}}
-			case "action":
-				r.Op = ActionStat
-				r.Args = []byte(`{"segments":["fixture"]}`)
-			case "segments":
-				r.Args = []byte(`{"segments":["other"],"maxBytes":2}`)
-			case "revoked":
-				repo.store.Grants[0].State = GrantRevoked
-				repo.store.Grants[0].Reason = ErrRevoked
-				repo.store.Grants[0].Revision++
-				repo.store.Grants[0].RevokedAt = g.CreatedAt
-			case "fence":
-				c.gate.fence("before lease")
-			case "native":
-				s.services.operations = grantOperationStub{code: ErrDenied}
-			}
-			code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, r)
-			if kind == "valid" {
-				if code != "" || c.operations[r.OperationID].bytes != 2 || !p.pending {
-					t.Fatal(code)
-				}
-			} else if code == "" || c.operations[r.OperationID].bytes != 0 || p.pending {
-				t.Fatal("invalid lease admitted", kind, code)
-			}
-		})
-	}
-}

package/templates/native-go/backend/internal/helper/grant_repository_linux.go

@@ -1,416 +0,0 @@
-//go:build linux && !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/grant_repository_linux.go:3
-package helper
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-
-	"golang.org/x/sys/unix"
-)
-
-// FileGrantRepository pins a protected local directory and one root supervisor
-// owner using a lifetime flock. It is Linux/root-only; no injected UID bypass.
-// Lock paths, files and all parents are opened no-follow and checked by FD.
-type FileGrantRepository struct {
-	mu                         sync.Mutex
-	dir, owner, policy, grants *os.File
-	expected                   Inventory
-	known                      string // exact last observed/committed snapshot; detects online replay
-	poisoned, closed           bool
-	fault                      func(string) error // tests only; nil in production
-}
-
-func OpenFileGrantRepository(stateDir string, expected Inventory) (*FileGrantRepository, Code) {
-	if os.Geteuid() != 0 {
-		return nil, ErrDenied
-	}
-	if !expected.Valid() || expected.Protocol != DataProtocol {
-		return nil, ErrIncompatible
-	}
-	dir, err := openGrantDirectory(stateDir)
-	if err != nil {
-		return nil, ErrUnavailable
-	}
-	r := &FileGrantRepository{dir: dir, expected: expected}
-	fail := func(c Code) (*FileGrantRepository, Code) { r.Close(); return nil, c }
-	r.owner, err = r.openLock("grants-owner.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	if err = unix.Flock(int(r.owner.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		return fail(ErrBusy)
-	}
-	r.policy, err = r.openLock("policy.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	r.grants, err = r.openLock("grants.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	if c := r.cleanGrantTemps(); c != "" {
-		return fail(c)
-	}
-	if err = r.dir.Sync(); err != nil {
-		return fail(ErrUnavailable)
-	}
-	return r, ""
-}
-func openGrantDirectory(path string) (*os.File, error) {
-	if !filepath.IsAbs(path) || path != filepath.Clean(path) {
-		return nil, errTrust
-	}
-	fd, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	check := func(fd int) error {
-		var st unix.Stat_t
-		if err := unix.Fstat(fd, &st); err != nil {
-			return err
-		}
-		if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR || st.Mode&0022 != 0 {
-			return errTrust
-		}
-		return nil
-	}
-	if err = check(fd); err != nil {
-		unix.Close(fd)
-		return nil, err
-	}
-	for _, component := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
-		if component == "" {
-			continue
-		}
-		next, e := unix.Openat(fd, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-		unix.Close(fd)
-		if e != nil {
-			return nil, e
-		}
-		fd = next
-		if err = check(fd); err != nil {
-			unix.Close(fd)
-			return nil, err
-		}
-	}
-	f := os.NewFile(uintptr(fd), path)
-	if err = lifetimeFilesystem(f); err != nil {
-		f.Close()
-		return nil, err
-	}
-	return f, nil
-}
-func (r *FileGrantRepository) openLock(name string) (*os.File, error) {
-	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_CREAT|unix.O_RDWR|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0600)
-	if err != nil {
-		return nil, err
-	}
-	f := os.NewFile(uintptr(fd), name)
-	if _, err = grantFileStat(f, 0600, 0); err != nil {
-		f.Close()
-		return nil, err
-	}
-	return f, nil
-}
-func grantFileStat(f *os.File, mode uint32, limit int64) (unix.Stat_t, error) {
-	var st unix.Stat_t
-	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
-		return st, err
-	}
-	if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Mode&07777 != mode || st.Nlink != 1 || st.Size < 0 || st.Size > limit {
-		return st, errTrust
-	}
-	return st, nil
-}
-func (r *FileGrantRepository) checkLock(f *os.File) error {
-	st, err := grantFileStat(f, 0600, 0)
-	if err != nil {
-		return err
-	}
-	var path unix.Stat_t
-	if err := unix.Fstatat(int(r.dir.Fd()), f.Name(), &path, unix.AT_SYMLINK_NOFOLLOW); err != nil {
-		return err
-	}
-	if path.Dev != st.Dev || path.Ino != st.Ino || path.Mode != st.Mode || path.Nlink != 1 {
-		return errTrust
-	}
-	return nil
-}
-func (r *FileGrantRepository) withLocks(fn func() Code) Code {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed || r.poisoned {
-		return ErrFenced
-	}
-	var st unix.Stat_t
-	if unix.Fstat(int(r.dir.Fd()), &st) != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR {
-		r.poisoned = true
-		return ErrUnavailable
-	}
-	for _, f := range []*os.File{r.owner, r.policy, r.grants} {
-		if r.checkLock(f) != nil {
-			r.poisoned = true
-			return ErrUnavailable
-		}
-	}
-	if unix.Flock(int(r.policy.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
-		return ErrBusy
-	}
-	defer unix.Flock(int(r.policy.Fd()), unix.LOCK_UN)
-	if unix.Flock(int(r.grants.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
-		return ErrBusy
-	}
-	defer unix.Flock(int(r.grants.Fd()), unix.LOCK_UN)
-	return fn()
-}
-func (r *FileGrantRepository) read(name string, mode uint32, limit int64) ([]byte, error) {
-	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	f := os.NewFile(uintptr(fd), name)
-	defer f.Close()
-	if _, err := grantFileStat(f, mode, limit); err != nil {
-		return nil, err
-	}
-	b, err := io.ReadAll(io.LimitReader(f, limit+1))
-	if err != nil {
-		return nil, err
-	}
-	if int64(len(b)) > limit {
-		return nil, errTrust
-	}
-	return b, nil
-}
-func (r *FileGrantRepository) readPolicy() (GrantPolicy, Code) {
-	// Existing approval snapshots are root:root 0644; they have no credentials.
-	// Decode strict schema 2 independently from the grant schema 1 authority.
-	b, err := r.read("approval.json", 0644, 4096)
-	if err != nil {
-		return GrantPolicy{}, ErrUnavailable
-	}
-	var record Record
-	if c := decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
-		return GrantPolicy{}, c
-	}
-	if record.Schema != 2 || record.Inventory != r.expected || record.Lifecycle == nil || !record.Lifecycle.valid() {
-		return GrantPolicy{}, ErrIncompatible
-	}
-	canonical, err := json.Marshal(record)
-	if err != nil {
-		return GrantPolicy{}, ErrInternal
-	}
-	sum := sha256.Sum256(canonical)
-	p := GrantPolicy{Inventory: record.Inventory, Epoch: record.Lifecycle.Epoch, ApprovalBinding: hex.EncodeToString(sum[:]), CapabilityDigest: record.Inventory.RegistryDigest, Enabled: record.Enabled && !record.Residual && record.Lifecycle.Phase == "running"}
-	return p, ""
-}
-func snapshotDigest(b []byte) string { sum := sha256.Sum256(b); return hex.EncodeToString(sum[:]) }
-func (r *FileGrantRepository) load() (GrantStore, Code) {
-	b, err := r.read("grants.json", 0600, MaxGrantStoreBytes)
-	if errors.Is(err, unix.ENOENT) && r.known == "" {
-		return GrantStore{Schema: GrantSchema, Revision: 1, Grants: []Grant{}}, ""
-	}
-	if err != nil {
-		r.poisoned = true
-		return GrantStore{}, ErrUnavailable
-	}
-	digest := snapshotDigest(b)
-	if r.known != "" && digest != r.known {
-		r.poisoned = true
-		return GrantStore{}, ErrStale
-	}
-	s, c := DecodeGrantStore(bytes.NewReader(b))
-	if c != "" {
-		r.poisoned = true
-		return GrantStore{}, c
-	}
-	r.known = digest
-	return s, ""
-}
-func (r *FileGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
-	if fn == nil {
-		return ErrInvalid
-	}
-	return r.withLocks(func() Code {
-		p, c := r.readPolicy()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		s, c := r.load()
-		if c != "" {
-			return c
-		}
-		old := cloneAuthorityStore(s)
-		write, c := fn(p, &s)
-		if c = safeGrantCode(c); c != "" {
-			return c
-		}
-		if !write {
-			return ""
-		}
-		b, err := json.Marshal(s)
-		if err != nil {
-			return ErrInvalid
-		}
-		if _, c := DecodeGrantStore(bytes.NewReader(b)); c != "" {
-			return c
-		}
-		if c := validateGrantTransition(old, s, p); c != "" {
-			return c
-		}
-		c = r.commit("grants.json", b)
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		r.known = snapshotDigest(b)
-		return ""
-	})
-}
-func (r *FileGrantRepository) atStage(stage string) error {
-	if r.fault != nil {
-		return r.fault(stage)
-	}
-	return nil
-}
-func (r *FileGrantRepository) commit(name string, b []byte) Code {
-	id, c := randomGrantID()
-	if c != "" {
-		return c
-	}
-	temp := ".grant-transition-" + id
-	fd, err := unix.Openat(int(r.dir.Fd()), temp, unix.O_CREAT|unix.O_EXCL|unix.O_WRONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
-	if err != nil {
-		return ErrUnavailable
-	}
-	f := os.NewFile(uintptr(fd), temp)
-	defer f.Close()
-	defer unix.Unlinkat(int(r.dir.Fd()), temp, 0)
-	if err = f.Chmod(0600); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("write"); err != nil {
-		return ErrUnavailable
-	}
-	if n, err := f.Write(b); err != nil || n != len(b) {
-		return ErrUnavailable
-	}
-	if err = r.atStage("file-sync"); err != nil {
-		return ErrUnavailable
-	}
-	if err = f.Sync(); err != nil {
-		return ErrUnavailable
-	}
-	if err = f.Close(); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("rename"); err != nil {
-		return ErrUnavailable
-	}
-	if err = unix.Renameat(int(r.dir.Fd()), temp, int(r.dir.Fd()), name); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("after-rename"); err != nil {
-		return ErrCommitUncertain
-	}
-	if err = r.atStage("directory-sync"); err != nil {
-		return ErrCommitUncertain
-	}
-	if err = r.dir.Sync(); err != nil {
-		return ErrCommitUncertain
-	}
-	return ""
-}
-func (r *FileGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
-	if !completeQuiescence(q) {
-		return ErrInvalid
-	}
-	return r.withLocks(func() Code {
-		p, c := r.readPolicy()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		if q.Key.Epoch != p.Epoch {
-			return ErrStale
-		}
-		s, c := r.load()
-		if c != "" {
-			return c
-		}
-		g := findGrant(&s, q.Key.GrantID)
-		if g == nil || g.State != GrantRevoked || g.Revision != q.Key.Revision {
-			return ErrStale
-		}
-		// One opaque-name proof per tombstone, <=256; never authority on restart.
-		b, err := json.Marshal(q)
-		if err != nil {
-			return ErrInternal
-		}
-		c = r.commit("grant-q-"+g.ID+".json", b)
-		if c != "" {
-			r.poisoned = true
-		}
-		return c
-	})
-}
-func (r *FileGrantRepository) Close() error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed {
-		return nil
-	}
-	r.closed = true
-	var err error
-	for _, f := range []*os.File{r.grants, r.policy, r.owner, r.dir} {
-		if f != nil {
-			err = errors.Join(err, f.Close())
-		}
-	}
-	return err
-}
-
-// The owner lock excludes every other writer. Orphan temp names are never
-// authority. Only exact generated names and protected, singly linked root files
-// are removed. Bound enumeration and refuse unknown/untrusted residues.
-func (r *FileGrantRepository) cleanGrantTemps() Code {
-	fd, err := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return ErrUnavailable
-	}
-	listing := os.NewFile(uintptr(fd), "state-listing")
-	defer listing.Close()
-	names, err := listing.Readdirnames(4097)
-	if err != nil && err != io.EOF {
-		return ErrUnavailable
-	}
-	if len(names) > 4096 {
-		return ErrLimit
-	}
-	for _, name := range names {
-		if !strings.HasPrefix(name, ".grant-transition-") {
-			continue
-		}
-		if !allReferences(strings.TrimPrefix(name, ".grant-transition-")) {
-			return ErrCleanupRequired
-		}
-		if _, err := r.read(name, 0600, MaxGrantStoreBytes); err != nil {
-			return ErrCleanupRequired
-		}
-		if err := unix.Unlinkat(int(r.dir.Fd()), name, 0); err != nil {
-			return ErrCleanupRequired
-		}
-	}
-	return ""
-}