@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/background/lock_test.go

@@ -0,0 +1,131 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func holdJournal(t *testing.T, s *Store) func() {
+	t.Helper()
+	root, err := s.openRoot()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+	f, err := root.OpenFile("lock", os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ready := make(chan error, 1)
+	release, done := make(chan struct{}), make(chan struct{})
+	go func() {
+		defer close(done)
+		defer f.Close()
+		err := unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+		ready <- err
+		if err != nil {
+			return
+		}
+		defer unix.Flock(int(f.Fd()), unix.LOCK_UN)
+		<-release
+	}()
+	if err := <-ready; err != nil {
+		t.Fatal(err)
+	}
+	return func() { close(release); <-done }
+}
+func TestRequestSubmitLockBudgetAndRetry(t *testing.T) {
+	s := NewRequestStore(filepath.Join(t.TempDir(), "background"))
+	release := holdJournal(t, s)
+	ctx, cancel := context.WithTimeout(context.Background(), RequestLockTimeout+time.Second)
+	defer cancel()
+	start := time.Now()
+	req := SubmitRequest{Key: "retry", Name: "copy", Data: []byte("copy"), Submitter: admin}
+	_, _, err := s.Submit(ctx, req)
+	elapsed := time.Since(start)
+	release()
+	if !errors.Is(err, ErrBusy) || elapsed < RequestLockTimeout || elapsed > RequestLockTimeout+500*time.Millisecond {
+		t.Fatalf("elapsed=%v err=%v", elapsed, err)
+	}
+	jobs, err := s.List(context.Background())
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("timed-out submit wrote: %+v %v", jobs, err)
+	}
+	first, dup, err := s.Submit(context.Background(), req)
+	if err != nil || dup {
+		t.Fatalf("retry: %v %v", dup, err)
+	}
+	again, dup, err := s.Submit(context.Background(), req)
+	if err != nil || !dup || again.ID != first.ID {
+		t.Fatalf("duplicate retry: %v %v", dup, err)
+	}
+}
+func TestJournalCancellationDoesNotWaitOrMutate(t *testing.T) {
+	for _, locked := range []bool{false, true} {
+		t.Run(map[bool]string{false: "free", true: "held"}[locked], func(t *testing.T) {
+			s := NewRequestStore(filepath.Join(t.TempDir(), "background"))
+			if locked {
+				release := holdJournal(t, s)
+				defer release()
+			}
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+			start := time.Now()
+			_, _, err := s.Submit(ctx, SubmitRequest{Key: "canceled", Name: "copy", Data: []byte("copy"), Submitter: admin})
+			if !errors.Is(err, context.Canceled) || time.Since(start) > 250*time.Millisecond {
+				t.Fatalf("cancellation: %v", err)
+			}
+		})
+	}
+}
+func TestWorkerCanWaitBeyondRequestLockBudget(t *testing.T) {
+	s := NewStore(filepath.Join(t.TempDir(), "background"))
+	release := holdJournal(t, s)
+	ctx, cancel := context.WithTimeout(context.Background(), RequestLockTimeout+250*time.Millisecond)
+	defer cancel()
+	_, err := s.List(ctx)
+	release()
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("worker wait changed: %v", err)
+	}
+}
+
+func TestRequestLockWaitHonorsEarlierDeadlineAndCancellation(t *testing.T) {
+	for _, deadline := range []bool{false, true} {
+		t.Run(map[bool]string{false: "cancel", true: "deadline"}[deadline], func(t *testing.T) {
+			s := NewRequestStore(filepath.Join(t.TempDir(), "background"))
+			release := holdJournal(t, s)
+			defer release()
+			var ctx context.Context
+			var cancel context.CancelFunc
+			if deadline {
+				ctx, cancel = context.WithTimeout(context.Background(), 50*time.Millisecond)
+			} else {
+				ctx, cancel = context.WithCancel(context.Background())
+			}
+			defer cancel()
+			done := make(chan error, 1)
+			go func() { _, err := s.List(ctx); done <- err }()
+			if !deadline {
+				time.AfterFunc(50*time.Millisecond, cancel)
+			}
+			want := context.Canceled
+			if deadline {
+				want = context.DeadlineExceeded
+			}
+			select {
+			case err := <-done:
+				if !errors.Is(err, want) {
+					t.Fatalf("got %v want %v", err, want)
+				}
+			case <-time.After(500 * time.Millisecond):
+				t.Fatal("context did not end lock wait")
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/background/owner_test.go

@@ -1,6 +1,7 @@
 package background
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -10,22 +11,12 @@ import (
 	"testing"
 )
 
-func TestOwnerAdmissionIsAtomicAndGatePersists(t *testing.T) {
-	s, dir := newStore(t)
+func TestFreshOwnerAdmissionIsAtomicAcrossProcesses(t *testing.T) {
+	_, dir := newStore(t)
 	ctx := context.Background()
 	owner := Submitter{User: "normal", UID: "1025"}
 	req := SubmitRequest{Key: "one", Name: "a", Data: []byte("x"), Submitter: owner}
-	if _, _, err := s.Submit(ctx, req); !errors.Is(err, ErrOrdinaryDisabled) {
-		t.Fatalf("default gate: %v", err)
-	}
-	if err := s.SetOrdinaryUsers(ctx, true); err != nil {
-		t.Fatal(err)
-	}
 	fresh := NewStore(dir)
-	st, _ := fresh.Status(ctx)
-	if !st.AllowOrdinaryUsers {
-		t.Fatal("gate not durable")
-	}
 	var wg sync.WaitGroup
 	var mu sync.Mutex
 	accepted := 0
@@ -46,25 +37,26 @@ func TestOwnerAdmissionIsAtomicAndGatePersists(t *testing.T) {
 		}(i)
 	}
 	wg.Wait()
-	if accepted != MaxOwnerPending {
-		t.Fatalf("concurrent owner jobs %d", accepted)
-	}
-	if err := fresh.SetOrdinaryUsers(ctx, false); err != nil {
+	raw, err := os.ReadFile(filepath.Join(dir, "journal.json"))
+	if err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := s.Submit(ctx, req); !errors.Is(err, ErrOrdinaryDisabled) {
-		t.Fatalf("gate changed after caller admission: %v", err)
+	if bytes.Contains(raw, []byte("allowOrdinaryUsers")) || bytes.Contains(raw, []byte(`"enabled"`)) {
+		t.Fatal("obsolete switches persisted")
+	}
+	if accepted != MaxOwnerPending {
+		t.Fatalf("concurrent owner jobs %d", accepted)
 	}
 }
 func TestOwnerByteQuotaIncludesReservedResult(t *testing.T) {
 	s, _ := newStore(t)
 	ctx := context.Background()
 	submit(t, s, "one", make([]byte, MaxInputBytes))
-	_, _, err := s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes), Submitter: admin, Admin: true})
+	_, _, err := s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes), Submitter: admin})
 	if !errors.Is(err, ErrOwnerQuota) {
 		t.Fatalf("owner byte quota: %v", err)
 	}
-	if _, _, err = s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes-2*resultReserve), Submitter: admin, Admin: true}); err != nil {
+	if _, _, err = s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes-2*resultReserve), Submitter: admin}); err != nil {
 		t.Fatal(err)
 	}
 }

package/templates/native-go/backend/internal/background/runner_test.go

@@ -181,7 +181,7 @@ func TestRunnerRunsJobsOneAfterAnother(t *testing.T) {
 	})
 	var ids []string
 	for _, k := range []string{"ka", "kb", "kc"} {
-		job, _, err := s.Submit(context.Background(), SubmitRequest{Key: k, Name: "a.txt", Data: []byte(k), Submitter: Submitter{User: k, UID: "1025"}, Admin: true})
+		job, _, err := s.Submit(context.Background(), SubmitRequest{Key: k, Name: "a.txt", Data: []byte(k), Submitter: Submitter{User: k, UID: "1025"}})
 		if err != nil {
 			t.Fatal(err)
 		}

package/templates/native-go/backend/internal/background/schedule.go

@@ -95,12 +95,6 @@ func (s *Store) CreateSchedule(ctx context.Context, r ScheduleRequest, a Access)
 		return out, false, ErrInvalid
 	}
 	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		if !j.Enabled {
-			return false, ErrDisabled
-		}
-		if !a.Admin && !j.AllowOrdinaryUsers {
-			return false, ErrOrdinaryDisabled
-		}
 		for _, sc := range j.Schedules {
 			if sc.Owner == a.Owner && sc.Key == r.Key {
 				if sc.SourceJobID != r.JobID || sc.IntervalSeconds != r.IntervalSeconds {
@@ -161,9 +155,6 @@ func (s *Store) SetSchedule(ctx context.Context, id string, enabled bool, a Acce
 			if !a.Admin {
 				return false, ErrInvalid
 			}
-			if !j.Enabled {
-				return false, ErrDisabled
-			}
 			if _, err := readCopy(root, sc.ID, sc.InputDigest, sc.InputBytes); err != nil {
 				return false, err
 			}
@@ -211,7 +202,13 @@ func (s *Store) DeleteSchedule(ctx context.Context, id string, a Access) error {
 		return true, nil
 	})
 }
-func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) bool {
+
+type tickCopy struct {
+	schedule Schedule
+	err      error
+}
+
+func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool, copies map[string]tickCopy) bool {
 	changed := false
 	now := s.now().UTC()
 	for i := range j.Schedules {
@@ -236,17 +233,23 @@ func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) b
 		due := sc.NextAt
 		period := time.Duration(sc.IntervalSeconds) * time.Second
 		count := uint64(now.Sub(due)/period) + 1
+		// Preparation happens without the journal lock. A concurrent disable,
+		// deletion, reapproval or tick invalidates that snapshot. Do not advance
+		// its checkpoint unless this admission still uses the exact schedule.
+		copy, prepared := copies[sc.ID]
+		if !recovering && count == 1 && now.Sub(due) <= ScheduleWindow && (!prepared || copy.schedule != *sc) {
+			continue
+		}
 		sc.NextAt = due.Add(time.Duration(count) * period)
 		changed = true
 		// Recovery deliberately skips even a just-due tick. There is no startup burst.
-		if recovering || !j.Enabled || count > 1 || now.Sub(due) > ScheduleWindow {
+		if recovering || count > 1 || now.Sub(due) > ScheduleWindow {
 			sc.Missed += count
 			sc.LastMissedAt = due
 			sc.Reason = "missed"
 			continue
 		}
-		data, err := readCopy(root, sc.ID, sc.InputDigest, sc.InputBytes)
-		if err != nil {
+		if copy.err != nil {
 			sc.Enabled = false
 			sc.Reason = "input-unavailable"
 			sc.Missed++
@@ -259,11 +262,11 @@ func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) b
 		switch {
 		case pending >= MaxOwnerPending:
 			reason = "owner-queue-full"
-		case ownerBytes+int64(len(data)+resultReserve) > MaxOwnerBytes:
+		case ownerBytes+int64(sc.InputBytes+resultReserve) > MaxOwnerBytes:
 			reason = "owner-quota-exceeded"
 		case countPending >= MaxQueued-ManualQueueReserve:
 			reason = "queue-full"
-		case used+int64(len(data)+resultReserve) > s.limits.MaxTotalBytes:
+		case used+int64(sc.InputBytes+resultReserve) > s.limits.MaxTotalBytes:
 			reason = "quota-exceeded"
 		}
 		if reason != "" {
@@ -279,7 +282,17 @@ func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) b
 			sc.Reason = "unavailable"
 			continue
 		}
-		if err := writeInput(root, id, data); err != nil {
+		// Private inputs are immutable. Link the verified schedule copy instead
+		// of reading, hashing and copying its contents under the journal lock.
+		// The worker checks the digest again when it consumes the linked input.
+		if err := root.Link(inputs+"/"+sc.ID, inputs+"/"+id); err != nil {
+			sc.Missed++
+			sc.LastMissedAt = due
+			sc.Reason = "unavailable"
+			continue
+		}
+		if err := syncDir(root, inputs); err != nil {
+			_ = root.Remove(inputs + "/" + id)
 			sc.Missed++
 			sc.LastMissedAt = due
 			sc.Reason = "unavailable"
@@ -296,5 +309,28 @@ func (s *Store) reconcileSchedules(root *os.Root, j *journal, recovering bool) b
 // Tick advances each durable checkpoint and creates a job in the same commit.
 // Multiple processes therefore cannot admit the same schedule trigger twice.
 func (s *Store) Tick(ctx context.Context) error {
-	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) { return s.reconcileSchedules(root, j, false), nil })
+	schedules, err := s.Schedules(ctx, Access{Admin: true})
+	if err != nil {
+		return err
+	}
+	root, err := s.openRoot()
+	if err != nil {
+		return err
+	}
+	defer root.Close()
+	copies := make(map[string]tickCopy)
+	now := s.now().UTC()
+	for _, sc := range schedules {
+		if !sc.Enabled || sc.WorkerRevision != s.revision || !validInterval(sc.IntervalSeconds) || sc.NextAt.IsZero() || sc.NextAt.After(now) || now.Sub(sc.NextAt) > ScheduleWindow {
+			continue
+		}
+		_, err := s.readScheduleCopy(ctx, root, sc.ID, sc.InputDigest, sc.InputBytes)
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		copies[sc.ID] = tickCopy{schedule: sc, err: err}
+	}
+	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
+		return s.reconcileSchedules(root, j, false, copies), nil
+	})
 }

package/templates/native-go/backend/internal/background/schedule_test.go

@@ -195,8 +195,11 @@ func TestScheduleBoundsQuotasAndModeRevocation(t *testing.T) {
 	if missed != 6 {
 		t.Fatalf("missed %d", missed)
 	}
-	_ = s.SetEnabled(ctx, false)
-	_ = s.SetEnabled(ctx, true)
+	for _, sc := range list {
+		if _, err := s.SetSchedule(ctx, sc.ID, false, Access{Admin: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
 	*now = now.Add(time.Hour)
 	_ = s.Tick(ctx)
 	list, _ = s.Schedules(ctx, Access{Admin: true})
@@ -244,7 +247,7 @@ func TestScheduleReservesFourManualQueueSlots(t *testing.T) {
 	s, now, _, sc := scheduledStore(t)
 	ctx := context.Background()
 	for i := 0; i < 12; i++ {
-		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Admin: true, Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
+		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -258,13 +261,13 @@ func TestScheduleReservesFourManualQueueSlots(t *testing.T) {
 		t.Fatal(list)
 	}
 	for i := 12; i < 16; i++ {
-		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Admin: true, Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
+		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "manual", Data: []byte("x"), Submitter: Submitter{User: "other", UID: fmt.Sprint(2000 + i)}})
 		if err != nil {
 			t.Fatalf("reserved slot: %v", err)
 		}
 	}
 }
-func TestRetainedCopyQuotaHistoryAndOrdinaryScheduleGate(t *testing.T) {
+func TestRetainedCopyQuotaHistoryAndOrdinarySchedule(t *testing.T) {
 	s, now, source, _ := scheduledStore(t)
 	ctx := context.Background()
 	if err := s.Recover(ctx); err != nil {
@@ -283,15 +286,13 @@ func TestRetainedCopyQuotaHistoryAndOrdinaryScheduleGate(t *testing.T) {
 		t.Fatalf("retained quota %d", bytes)
 	}
 	owner := Submitter{User: "normal1", UID: "1025"}
-	_ = s.SetOrdinaryUsers(ctx, true)
 	j, _, err := s.Submit(ctx, SubmitRequest{Key: "user", Name: "copy", Data: []byte("copy"), Submitter: owner})
 	if err != nil {
 		t.Fatal(err)
 	}
 	_, _ = s.Claim(ctx)
 	_ = s.Finish(ctx, j.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 4}})
-	_ = s.SetOrdinaryUsers(ctx, false)
-	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "user", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: owner}); !errors.Is(err, ErrOrdinaryDisabled) {
+	if _, _, err := s.CreateSchedule(ctx, ScheduleRequest{Key: "user", JobID: j.ID, IntervalSeconds: 3600, Consent: true}, Access{Owner: owner}); err != nil {
 		t.Fatal(err)
 	}
 	for i := 0; i < MaxHistory+2; i++ {
@@ -322,7 +323,7 @@ func TestGlobalQuotaReservesResultBeforeRetainedCopyAdmission(t *testing.T) {
 	s, _ := newStore(t)
 	ctx := context.Background()
 	s.limits.MaxTotalBytes = resultReserve + 1
-	_, _, err := s.Submit(ctx, SubmitRequest{Key: "oversized-total", Name: "copy", Data: []byte("xx"), Submitter: admin, Admin: true})
+	_, _, err := s.Submit(ctx, SubmitRequest{Key: "oversized-total", Name: "copy", Data: []byte("xx"), Submitter: admin})
 	if !errors.Is(err, ErrQuota) {
 		t.Fatalf("result reservation overflow admitted: %v", err)
 	}
@@ -333,3 +334,35 @@ func TestGlobalQuotaReservesResultBeforeRetainedCopyAdmission(t *testing.T) {
 		t.Fatalf("retained copy quota %v", err)
 	}
 }
+
+func TestTickReadsCopyOutsideLockAndRechecksRevocation(t *testing.T) {
+	s, now, _, sc := scheduledStore(t)
+	*now = now.Add(time.Hour)
+	entered, resume := make(chan struct{}), make(chan struct{})
+	s.readScheduleCopy = func(ctx context.Context, root *os.Root, id, digest string, size int) ([]byte, error) {
+		close(entered)
+		<-resume
+		return readCopy(root, id, digest, size)
+	}
+	done := make(chan error, 1)
+	go func() { done <- s.Tick(context.Background()) }()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("tick never prepared copy")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 250*time.Millisecond)
+	defer cancel()
+	_, err := s.SetSchedule(ctx, sc.ID, false, Access{Owner: admin})
+	close(resume)
+	if tickErr := <-done; tickErr != nil {
+		t.Fatal(tickErr)
+	}
+	if err != nil {
+		t.Fatalf("copy read held journal lock: %v", err)
+	}
+	jobs, err := s.List(context.Background())
+	if err != nil || len(jobs) != 1 {
+		t.Fatalf("revoked snapshot admitted: %+v %v", jobs, err)
+	}
+}