@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/control.go

@@ -1,424 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"time"
-)
-
-// Process identity rejects reboot/PID reuse and executable replacement.
-// Linux Stop authenticates the owning supervisor socket; only that parent signals its child.
-type Process struct {
-	Inventory Inventory `json:"inventory"`
-	Mode      string    `json:"mode,omitempty"` // must be supervised; old unsupervised records fail closed
-	PID       int       `json:"pid"`
-	Boot      string    `json:"boot"`
-	Start     string    `json:"start"`
-	Device    uint64    `json:"device"`
-	Inode     uint64    `json:"inode"`
-}
-
-type Processes interface {
-	Stop(Process) error
-	Start(Inventory) error
-}
-type Controller struct {
-	Client
-	Processes Processes
-	Observe   Observation
-	Boot      func() (string, error)
-}
-
-func waitHealthy(ctx context.Context, probe func(context.Context) bool) error {
-	for ctx.Err() == nil {
-		if probe(ctx) {
-			return nil
-		}
-		timer := time.NewTimer(20 * time.Millisecond)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			return ctx.Err()
-		case <-timer.C:
-		}
-	}
-	return ctx.Err()
-}
-
-func writeProtected(dir, name string, value any) error {
-	b, err := json.Marshal(value)
-	if err != nil {
-		return err
-	}
-	f, err := os.CreateTemp(dir, ".transition-*")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	mode := fs.FileMode(0644)
-	if name == "observer-diagnostic.json" || name == "process.json" || strings.HasPrefix(name, "completion-") {
-		mode = 0600
-	}
-	if err := f.Chmod(mode); err != nil {
-		f.Close()
-		return err
-	}
-	if _, err := f.Write(b); err != nil {
-		f.Close()
-		return err
-	}
-	if err := f.Sync(); err != nil {
-		f.Close()
-		return err
-	}
-	if err := f.Close(); err != nil {
-		return err
-	}
-	if err := os.Rename(f.Name(), filepath.Join(dir, name)); err != nil {
-		return err
-	}
-	d, err := os.Open(dir)
-	if err != nil {
-		return err
-	}
-	defer d.Close()
-	return d.Sync()
-}
-
-func writeProcess(dir string, p Process) error { return writeProtected(dir, "process.json", p) }
-
-func readProcess(dir string, owner uint32) (Process, error) {
-	var p Process
-	if err := protected(dir, owner, true); err != nil {
-		return p, err
-	}
-	path := filepath.Join(dir, "process.json")
-	if err := protected(path, owner, false); err != nil {
-		return p, err
-	}
-	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return p, err
-	}
-	defer f.Close()
-	d := json.NewDecoder(io.LimitReader(f, 4097))
-	d.DisallowUnknownFields()
-	if d.Decode(&p) != nil || d.Decode(new(any)) != io.EOF || !p.Inventory.Valid() || p.Mode != "supervised" || p.PID <= 1 || p.Boot == "" || p.Start == "" || p.Inode == 0 {
-		return p, errTrust
-	}
-	return p, nil
-}
-
-// Control is called only by the verified root executable from a fixed DSM
-// task. Package hooks and CGI handlers never call this function.
-func (c Controller) Control(ctx context.Context, action string) error {
-	if ctx.Err() != nil {
-		return ctx.Err()
-	}
-	if action != "enable" && action != "recover" && action != "teardown" && action != "disable" && action != "repair" {
-		return errors.New("unsupported lifecycle action")
-	}
-	if !c.Expected.Valid() || c.Processes == nil {
-		return errTrust
-	}
-	if err := protected(c.StateDir, c.Owner, true); err != nil {
-		return err
-	}
-	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	if err := protected(f.Name(), c.Owner, false); err != nil {
-		return err
-	}
-	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-		return errors.New("lifecycle busy")
-	}
-	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	if errors.Is(err, fs.ErrNotExist) {
-		r = Record{Inventory: c.Expected}
-	}
-	if action == "repair" {
-		if err != nil {
-			return err
-		}
-		return c.repair(r)
-	}
-	starting := action == "enable" || action == "recover"
-	if action == "recover" && (err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil) {
-		return errors.New("explicit enable approval required")
-	}
-	// A stopped approval referencing a completion must have the private,
-	// digest-bound proof; missing/corrupt artifacts are not completion.
-	if starting && r.Lifecycle != nil && r.Lifecycle.Completion != "" {
-		if _, e := completionRecord(c.Client, r); e != nil {
-			return e
-		}
-	}
-	var next *Lifecycle
-	if starting {
-		if c.Observe == nil {
-			return errTrust
-		}
-		binding, e := c.Observe(ctx, c.Expected)
-		if e != nil {
-			return e
-		}
-		if action == "recover" && (r.Lifecycle.Binding.Boot != binding.Boot || r.Lifecycle.Binding.Install != binding.Install) {
-			return errors.New("installation continuity changed; enable approval required")
-		}
-		next, err = newLifecycle(binding)
-		if err != nil {
-			return err
-		}
-		if err := createLifetime(c.Client, next); err != nil {
-			return err
-		}
-	}
-	// Preserve the owned identity before fencing lets the supervisor unlink it.
-	owned, ownedErr := readProcess(c.RunDir, c.Owner)
-	// Never hold policy.lock across Stop/ACK. Autonomous fencing shares only
-	// this short lock, so a controller holding control.lock cannot deadlock it.
-	if err := policyUpdate(c.Client, func(r *Record) error {
-		if action == "disable" {
-			r.Enabled = false
-		}
-		r.Residual = true
-		if r.Lifecycle != nil && r.Lifecycle.Phase != "stopped" {
-			r.Lifecycle.Phase = "fenced"
-			r.Lifecycle.Completion = ""
-			if r.Lifecycle.Reason == "" {
-				r.Lifecycle.Reason = "admin-stop"
-			}
-		}
-		return nil
-	}); err != nil {
-		return err
-	}
-	if ownedErr != nil && !errors.Is(ownedErr, fs.ErrNotExist) {
-		return ownedErr
-	}
-	if err := c.teardownFor(r, owned); err != nil {
-		return err
-	}
-	if err := c.commitTeardown(r, owned, next); err != nil {
-		return err
-	}
-	if starting {
-		if err := c.Processes.Start(c.Expected); err != nil {
-			return err
-		}
-		return finalizeStart(c.Client, next.Epoch)
-	}
-	return nil
-}
-
-// Keep the post-teardown policy commit separate from socket reconciliation.
-func (c Controller) commitTeardown(before Record, owned Process, next *Lifecycle) error {
-	observed, err := readRecord(c.StateDir, c.Owner)
-	if err != nil {
-		return err
-	}
-	if !sameTeardownEpoch(observed, before) {
-		return errTrust
-	}
-	published := ""
-	if observed.Lifecycle != nil {
-		published = observed.Lifecycle.Completion
-	}
-	// Rename makes completion visible before the owner's directory fsync and
-	// lock release. Wait only for that publisher; every other error is final.
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	last := errBusy
-	// A budget expiry keeps the last lock refusal; it never certifies success.
-	_ = waitHealthy(ctx, func(context.Context) bool {
-		last = policyUpdate(c.Client, func(r *Record) error {
-			if !sameTeardownEpoch(*r, before) || !runtimeAbsent(c.Client) {
-				return errTrust
-			}
-			if published != "" && (r.Lifecycle == nil || r.Lifecycle.Completion != published) {
-				return errTrust
-			}
-			if r.Lifecycle != nil && r.Lifecycle.Completion != "" {
-				proof, err := completionRecord(c.Client, *r)
-				if err != nil {
-					return err
-				}
-				if owned.PID > 1 {
-					if proof.Repair != nil || proof.Process != owned {
-						return errTrust
-					}
-				} else if before.Lifecycle == nil || before.Lifecycle.Phase != "stopped" {
-					return errTrust
-				}
-			}
-			if next != nil {
-				*r = Record{Inventory: c.Expected, Enabled: true, Residual: true, Lifecycle: next}
-			} else {
-				r.Residual = false
-				if r.Lifecycle != nil {
-					r.Lifecycle.Phase = "stopped"
-				}
-			}
-			return nil
-		})
-		return !errors.Is(last, errBusy)
-	})
-	return last
-}
-
-func (c Controller) teardown() error {
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	p, err := readProcess(c.RunDir, c.Owner)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	return c.teardownFor(r, p)
-}
-
-func (c Controller) teardownFor(before Record, owned Process) error {
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	if !sameTeardownEpoch(r, before) {
-		return errTrust
-	}
-	if r.Lifecycle != nil && r.Lifecycle.Completion != "" {
-		if owned.PID == 0 && before.Lifecycle != nil && before.Lifecycle.Phase != "stopped" {
-			return errTrust // no pre-fence process identity to reconcile this exit
-		}
-		if _, err := completionRecord(c.Client, r); err != nil {
-			return err
-		}
-	}
-	return c.teardownRecord(r, owned)
-}
-
-// Phase, completion and enabled/residual flags may change while the owning
-// supervisor exits; inventory, epoch, binding and optional lease must not.
-func sameTeardownEpoch(current, before Record) bool {
-	if current.Inventory != before.Inventory {
-		return false
-	}
-	a, b := current.Lifecycle, before.Lifecycle
-	if a == nil || b == nil {
-		return a == nil && b == nil
-	}
-	if a.Epoch != b.Epoch || a.Binding != b.Binding {
-		return false
-	}
-	if a.Lease == nil || b.Lease == nil {
-		return a.Lease == nil && b.Lease == nil
-	}
-	return *a.Lease == *b.Lease
-}
-
-// Reconcile runtime against the approval and pre-fence owned process witness.
-func (c Controller) teardownRecord(r Record, owned Process) error {
-	p, err := readProcess(c.RunDir, c.Owner)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	if err == nil {
-		if p != owned || p.Inventory.Package != c.Expected.Package {
-			return errTrust
-		}
-		if err := c.Processes.Stop(p); err != nil {
-			if c.waitTeardownCompletion(r, owned) == nil {
-				return nil
-			}
-			return err
-		}
-	} else if owned.PID > 1 {
-		// The owner can unlink after our approval snapshot but before this read.
-		// Absence alone is never success, including the artifact-before-commit gap.
-		if c.waitTeardownCompletion(r, owned) == nil {
-			return nil
-		}
-		return errTrust
-	}
-	if errors.Is(err, fs.ErrNotExist) && r.Lifecycle != nil && r.Lifecycle.Phase == "fenced" {
-		// Runtime unlink followed by a crash is not committed completion. Only
-		// a verified new boot + absent /run artifacts permits explicit repair.
-		if c.Boot == nil || !runtimeAbsent(c.Client) {
-			return errTrust
-		}
-		boot, e := c.Boot()
-		if e != nil || boot == "" || boot == r.Lifecycle.Binding.Boot {
-			return errTrust
-		}
-	}
-	if err := cleanRuntime(c.Client, err == nil); err != nil {
-		if c.waitTeardownCompletion(r, owned) == nil {
-			return nil
-		}
-		return err
-	}
-	return nil
-}
-
-func (c Controller) waitTeardownCompletion(before Record, owned Process) error {
-	if before.Lifecycle == nil || owned.PID <= 1 || owned.Inventory != before.Inventory || owned.Boot != before.Lifecycle.Binding.Boot {
-		return errTrust
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	return waitHealthy(ctx, func(context.Context) bool {
-		r, err := readRecord(c.StateDir, c.Owner)
-		if err != nil || !sameTeardownEpoch(r, before) {
-			return false
-		}
-		proof, err := completionRecord(c.Client, r)
-		return err == nil && proof.Process == owned && runtimeAbsent(c.Client)
-	})
-}
-
-// cleanRuntime is shared by verified controller and owned supervisor cleanup.
-// The caller must first prove child teardown; it never signals a recorded PID.
-func cleanRuntime(c Client, hasProcess bool) error {
-	for _, name := range []string{"helper.sock", "supervisor.sock"} {
-		path := filepath.Join(c.RunDir, name)
-		st, e := os.Lstat(path)
-		if e == nil {
-			s, ok := st.Sys().(*syscall.Stat_t)
-			if !ok || s.Uid != c.Owner || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm()&0002 != 0 {
-				return errTrust
-			}
-			conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
-			if err == nil {
-				conn.Close()
-				return errors.New("unidentified live socket")
-			}
-			if !errors.Is(err, syscall.ECONNREFUSED) && !errors.Is(err, fs.ErrNotExist) {
-				return err
-			}
-			if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
-				return err
-			}
-		} else if !errors.Is(e, fs.ErrNotExist) {
-			return e
-		}
-	}
-	if hasProcess {
-		return os.Remove(filepath.Join(c.RunDir, "process.json"))
-	}
-	return nil
-}

package/dist/templates/native-go/backend/internal/helper/control_test.go

@@ -1,250 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func staleSocket(t *testing.T, p string) {
-	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: p, Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	l.SetUnlinkOnClose(false)
-	l.Close()
-}
-
-type fakeProcesses struct {
-	current          Process
-	stopped, started int
-	stopErr          error
-	stopHook         func(Process) error
-}
-
-func (f *fakeProcesses) Stop(want Process) error {
-	if f.stopHook != nil {
-		return f.stopHook(want)
-	}
-	if f.stopErr != nil {
-		return f.stopErr
-	}
-	if want != f.current {
-		return errTrust
-	}
-	f.stopped++
-	return nil
-}
-func (f *fakeProcesses) Start(Inventory) error { f.started++; return nil }
-
-func controlFixture(t *testing.T) (Controller, *fakeProcesses) {
-	c := fixture(t)
-	p := Process{Inventory: c.Expected, Mode: "supervised", PID: 1234, Boot: "fixture-boot", Start: "100", Device: 1, Inode: 2}
-	f := &fakeProcesses{current: p}
-	ctl := Controller{Client: c, Processes: f, Observe: func(context.Context, Inventory) (Binding, error) { return testBinding(), nil }}
-	record(t, c, Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")})
-	if err := writeProcess(c.RunDir, p); err != nil {
-		t.Fatal(err)
-	}
-	return ctl, f
-}
-
-func TestTeardownAndRecoveryVerifyOwnedProcess(t *testing.T) {
-	for _, kind := range []string{"pid", "boot", "start", "inode", "digest", "package"} {
-		t.Run(kind, func(t *testing.T) {
-			c, f := controlFixture(t)
-			switch kind {
-			case "pid":
-				f.current.PID++
-			case "boot":
-				f.current.Boot = "new-boot"
-			case "start":
-				f.current.Start = "reused"
-			case "inode":
-				f.current.Inode++
-			case "digest":
-				f.current.Inventory.PayloadDigest = "foreign"
-			case "package":
-				f.current.Inventory.Package = "Other"
-			}
-			if c.Control(context.Background(), "recover") == nil || f.stopped != 0 || f.started != 0 {
-				t.Fatal("foreign process touched")
-			}
-			if _, err := os.Stat(filepath.Join(c.RunDir, "process.json")); err != nil {
-				t.Fatal("failure evidence removed")
-			}
-		})
-	}
-	c, f := controlFixture(t)
-	if err := c.Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	if f.stopped != 1 || f.started != 0 {
-		t.Fatal(f)
-	}
-	if _, err := os.Stat(filepath.Join(c.RunDir, "process.json")); !os.IsNotExist(err) {
-		t.Fatal(err)
-	}
-	if err := c.Control(context.Background(), "recover"); err != nil || f.started != 1 {
-		t.Fatalf("%v %+v", err, f)
-	}
-}
-
-func TestDisableIsDurableAndPrecedesFailedCleanup(t *testing.T) {
-	c, f := controlFixture(t)
-	f.stopErr = errors.New("fixture stop failed")
-	if c.Control(context.Background(), "disable") == nil {
-		t.Fatal("cleanup falsely succeeded")
-	}
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || r.Enabled || !r.Residual {
-		t.Fatalf("%+v %v", r, err)
-	}
-	s := c.Status(context.Background())
-	if s.State != "not-enabled" || s.Cleanup != "required" {
-		t.Fatal(s)
-	}
-	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
-		t.Fatal("old recovery resurrected disabled integration")
-	}
-	f.stopErr = nil
-	if err := c.Control(context.Background(), "disable"); err != nil {
-		t.Fatal(err)
-	}
-	r, _ = readRecord(c.StateDir, c.Owner)
-	if r.Enabled || r.Residual {
-		t.Fatal(r)
-	}
-	if err := c.Control(context.Background(), "enable"); err != nil || f.started != 1 {
-		t.Fatalf("%v %+v", err, f)
-	}
-}
-
-func TestMissingApprovalAndUnknownActionCannotStart(t *testing.T) {
-	c, f := controlFixture(t)
-	os.Remove(filepath.Join(c.StateDir, "approval.json"))
-	if c.Control(context.Background(), "recover") == nil {
-		t.Fatal("recover without approval")
-	}
-	if c.Control(context.Background(), "arbitrary-command") == nil || f.started != 0 {
-		t.Fatal("arbitrary action accepted")
-	}
-}
-
-func TestSocketResidueCannotUnlinkForeignFilesOrLiveListeners(t *testing.T) {
-	for _, kind := range []string{"file", "symlink", "live", "stale"} {
-		t.Run(kind, func(t *testing.T) {
-			c, f := controlFixture(t)
-			// This test covers migration cleanup of pre-M1g owned stale sockets.
-			// A schema-2 incomplete transaction is tested separately and cannot use
-			// absent runtime alone as completion proof.
-			record(t, c.Client, Record{Inventory: c.Expected, Enabled: true})
-			os.Remove(filepath.Join(c.RunDir, "process.json"))
-			p := filepath.Join(c.RunDir, "helper.sock")
-			switch kind {
-			case "file":
-				os.WriteFile(p, []byte("foreign"), 0600)
-			case "symlink":
-				os.Symlink("foreign", p)
-			case "live":
-				live(t, c.Client, c.Expected, nil)
-			case "stale":
-				staleSocket(t, p)
-			}
-			err := c.Control(context.Background(), "teardown")
-			if kind == "stale" {
-				if err != nil {
-					t.Fatal(err)
-				}
-				if _, err := os.Lstat(p); !os.IsNotExist(err) {
-					t.Fatal("stale socket not removed")
-				}
-			} else {
-				if err == nil {
-					t.Fatal("foreign residue accepted")
-				}
-				if _, err := os.Lstat(p); err != nil {
-					t.Fatal("foreign residue removed")
-				}
-			}
-			if f.stopped != 0 {
-				t.Fatal("unrecorded process signalled")
-			}
-		})
-	}
-}
-
-func TestLifecycleGateBlocksResidueAndAllowsCleanStoppedState(t *testing.T) {
-	c, _ := controlFixture(t)
-	if c.CheckStopped(context.Background()) == nil {
-		t.Fatal("process residue accepted")
-	}
-	if err := c.Control(context.Background(), "teardown"); err != nil {
-		t.Fatal(err)
-	}
-	if err := c.CheckStopped(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	record(t, c.Client, Record{Inventory: c.Expected, Enabled: false, Residual: true})
-	if c.CheckStopped(context.Background()) == nil {
-		t.Fatal("failed disable accepted")
-	}
-}
-
-func TestStartupProbesShareOneDeadline(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
-	defer cancel()
-	err := waitHealthy(ctx, func(probeCtx context.Context) bool {
-		if probeCtx != ctx {
-			t.Fatal("probe got an independent deadline")
-		}
-		<-probeCtx.Done()
-		return false
-	})
-	if !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatal(err)
-	}
-	if err := waitHealthy(context.Background(), func(context.Context) bool { return true }); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestSupervisorSocketResidueAlsoBlocksLifecycle(t *testing.T) {
-	c, _ := controlFixture(t)
-	os.Remove(filepath.Join(c.RunDir, "process.json"))
-	p := filepath.Join(c.RunDir, "supervisor.sock")
-	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: p, Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer l.Close()
-	if c.CheckStopped(context.Background()) == nil {
-		t.Fatal("unidentified supervisor accepted")
-	}
-	if c.Control(context.Background(), "teardown") == nil {
-		t.Fatal("live supervisor ignored")
-	}
-}
-
-func TestOnlySupervisedProcessRecordsAreReadable(t *testing.T) {
-	for _, mode := range []string{"", "supervised", "unknown"} {
-		c, f := controlFixture(t)
-		p := f.current
-		p.Mode = mode
-		if err := writeProcess(c.RunDir, p); err != nil {
-			t.Fatal(err)
-		}
-		got, err := readProcess(c.RunDir, c.Owner)
-		if mode != "supervised" {
-			if err == nil {
-				t.Fatal("unsupervised process mode accepted")
-			}
-		} else if err != nil || got != p {
-			t.Fatalf("mode %q: %+v %v", mode, got, err)
-		}
-	}
-}