@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/_executor/move_linux_test.go

@@ -1,460 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"bufio"
-	"context"
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestMoveRejectsSymlinkHardlinkFIFOAndDestinationParent(t *testing.T) {
-	base := t.TempDir()
-	stage := filepath.Join(base, "stage")
-	dest := filepath.Join(base, "dest")
-	os.Mkdir(stage, 0700)
-	os.Mkdir(dest, 0700)
-	os.WriteFile(filepath.Join(stage, "source"), []byte("a"), 0600)
-	di, err := bindDirectory(dest)
-	if err != nil {
-		t.Fatal(err)
-	}
-	w := subprocessWriter{Staging: stage, Executable: "/must-not-run", PackageUID: os.Getuid()}
-	op := Operation{Job: "job", Name: "out", Staging: "source", Size: 1}
-	d := Delegation{Root: dest, Directory: di}
-	guard := func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
-		t.Fatal("attack reached publish")
-		return MoveReceipt{}, nil
-	}
-	for _, kind := range []string{"symlink", "hardlink", "fifo", "dest-parent"} {
-		t.Run(kind, func(t *testing.T) {
-			p := filepath.Join(stage, kind)
-			switch kind {
-			case "symlink":
-				os.Symlink(filepath.Join(stage, "source"), p)
-			case "hardlink":
-				os.Link(filepath.Join(stage, "source"), p)
-				defer os.Remove(p)
-			case "fifo":
-				syscall.Mkfifo(p, 0600)
-			case "dest-parent":
-				os.Symlink(dest, filepath.Join(base, "alias"))
-				d.Root = filepath.Join(base, "alias")
-				p = filepath.Join(stage, "source")
-			}
-			op.Staging = filepath.Base(p)
-			if _, err := w.Move(context.Background(), Subject{UID: 1200, GID: 100, Groups: []int{100}}, op, d, guard); err == nil {
-				t.Fatal("attack accepted")
-			}
-		})
-	}
-}
-func TestMoveChild(t *testing.T) {
-	mode := os.Getenv("W3_MOVE_CHILD")
-	if mode == "" {
-		return
-	}
-	if delay, err := time.ParseDuration(os.Getenv("W3_SLOW_DIR_SYNC")); err == nil {
-		sync := syncPublished
-		syncPublished = func(dir *os.File) error { time.Sleep(delay); return sync(dir) }
-	}
-	var err error
-	switch mode {
-	case "move-child":
-		err = runMoveChild()
-	case "part-cleanup-child":
-		err = runPartCleanupChild()
-	case "source-cleanup-child":
-		err = runSourceCleanupChild()
-	}
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	os.Exit(0)
-}
-func TestMoveRealUIDLargeFileReceiptAndCleanup(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root Linux fixture required")
-	}
-	base := t.TempDir()
-	os.Chmod(base, 0755)
-	os.Chmod(filepath.Dir(base), 0755)
-	stage := filepath.Join(base, "stage")
-	dest := filepath.Join(base, "dest")
-	os.Mkdir(stage, 0700)
-	os.Mkdir(dest, 0700)
-	pkg := Subject{UID: 1400, GID: 1400, Groups: []int{1400}}
-	s := Subject{Username: "admin-fixture", UID: 1200, GID: 100, Groups: []int{100}, Admin: true}
-	os.Chown(stage, pkg.UID, pkg.GID)
-	os.Chown(dest, s.UID, s.GID)
-	source := filepath.Join(stage, "large")
-	f, err := os.Create(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	size := int64(1 << 30)
-	f.Truncate(size)
-	f.WriteAt([]byte("end"), size-3)
-	f.Close()
-	// The producer's private inode is unreadable by the destination subject.
-	// The privileged parent must hand off its already-open read-only FD.
-	if err := os.Chmod(source, 0600); err != nil {
-		t.Fatal(err)
-	}
-	os.Chown(source, pkg.UID, pkg.GID)
-	input, _ := os.Open(source)
-	wantHash := sha256.New()
-	io.Copy(wantHash, input)
-	input.Close()
-	exe, _ := os.Executable()
-	launcher := filepath.Join(base, "child")
-	os.WriteFile(launcher, []byte("#!/bin/sh\nexport W3_MOVE_CHILD=\"$1\"\nexec "+exe+" -test.run=^TestMoveChild$\n"), 0700)
-	di, _ := bindDirectory(dest)
-	d := Delegation{Root: dest, Directory: di}
-	op := Operation{Job: "job", Name: "out", Staging: "large", Size: size}
-	w := subprocessWriter{Staging: stage, Executable: launcher, PackageUID: pkg.UID, PackageGID: pkg.GID}
-	receipt, err := w.Move(context.Background(), s, op, d, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) { return publish() })
-	if err != nil || receipt.CleanupPending {
-		t.Fatal(receipt, err)
-	}
-	info, err := os.Stat(filepath.Join(dest, "out"))
-	if err != nil || info.Size() != size || info.Sys().(*syscall.Stat_t).Uid != uint32(s.UID) {
-		t.Fatal(info, err)
-	}
-	output, _ := os.Open(filepath.Join(dest, "out"))
-	gotHash := sha256.New()
-	io.Copy(gotHash, output)
-	output.Close()
-	if string(wantHash.Sum(nil)) != string(gotHash.Sum(nil)) {
-		t.Fatal("large file checksum")
-	}
-	if _, err = os.Stat(source); !os.IsNotExist(err) {
-		t.Fatal("source cleanup", err)
-	}
-	// Existing destination must remain complete; cleanup failure does not turn it
-	// into a retryable copy or remove the package source.
-	os.WriteFile(source, []byte("x"), 0600)
-	os.Chown(source, pkg.UID, pkg.GID)
-	op.Size = 1
-	if _, err = w.Move(context.Background(), s, op, d, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) { return publish() }); err == nil {
-		t.Fatal("overwrote existing final")
-	}
-	info, _ = os.Stat(filepath.Join(dest, "out"))
-	if info.Size() != size {
-		t.Fatal("changed final")
-	}
-}
-func TestMoveBoundedActualBytes(t *testing.T) {
-	// A reader can grow after stat. The child checks size+1, rather than copying
-	// arbitrary excess or silently truncating to the declaration.
-	src, err := os.CreateTemp(t.TempDir(), "source")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer src.Close()
-	src.WriteString("abcd")
-	src.Seek(0, 0)
-	out, err := os.CreateTemp(t.TempDir(), "out")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer out.Close()
-	if err = copyExact(out, src, 3); err == nil || !strings.Contains(err.Error(), "size") {
-		t.Fatal(err)
-	}
-}
-
-func TestMoveOpenPartResistsReplacementAndDestinationSwap(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root Linux fixture required")
-	}
-	for _, attack := range []string{"part", "directory"} {
-		t.Run(attack, func(t *testing.T) {
-			base := t.TempDir()
-			os.Chmod(base, 0755)
-			os.Chmod(filepath.Dir(base), 0755)
-			stage := filepath.Join(base, "stage")
-			dest := filepath.Join(base, "dest")
-			os.Mkdir(stage, 0700)
-			os.Mkdir(dest, 0700)
-			os.Chown(stage, 1400, 1400)
-			os.Chown(dest, 1200, 100)
-			source := filepath.Join(stage, "source")
-			os.WriteFile(source, []byte("original"), 0600)
-			os.Chown(source, 1400, 1400)
-			exe, _ := os.Executable()
-			launcher := filepath.Join(base, "child")
-			os.WriteFile(launcher, []byte("#!/bin/sh\nexport W3_MOVE_CHILD=\"$1\"\nexec "+exe+" -test.run=^TestMoveChild$\n"), 0700)
-			di, _ := bindDirectory(dest)
-			w := subprocessWriter{Staging: stage, Executable: launcher, PackageUID: 1400, PackageGID: 1400}
-			s := Subject{UID: 1200, GID: 100, Groups: []int{100}}
-			receipt, err := w.Move(context.Background(), s, Operation{Job: "job", Staging: "source", Name: "out", Size: 8}, Delegation{Root: dest, Directory: di}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
-				if attack == "part" {
-					entries, _ := os.ReadDir(dest)
-					for _, ent := range entries {
-						if strings.HasSuffix(ent.Name(), ".part") {
-							p := filepath.Join(dest, ent.Name())
-							os.Remove(p)
-							os.WriteFile(p, []byte("replacement"), 0600)
-							os.Chown(p, s.UID, s.GID)
-						}
-					}
-				} else {
-					os.Rename(dest, dest+"-moved")
-					os.Mkdir(dest, 0700)
-					os.Chown(dest, s.UID, s.GID)
-				}
-				return publish()
-			})
-			if attack == "part" {
-				if err == nil {
-					t.Fatal("unlinked part published")
-				}
-				if _, x := os.Stat(filepath.Join(dest, "out")); !os.IsNotExist(x) {
-					t.Fatal("replacement became final")
-				}
-				entries, _ := os.ReadDir(dest)
-				if len(entries) != 1 {
-					t.Fatal("replacement part removed", entries)
-				}
-				_ = receipt
-
-			} else {
-				if err == nil {
-					t.Fatal("changed destination published")
-				}
-				for _, path := range []string{dest, dest + "-moved"} {
-					if _, x := os.Stat(filepath.Join(path, "out")); !os.IsNotExist(x) {
-						t.Fatal("swap wrote final", path)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestPublishProtocolChild(t *testing.T) {
-	if os.Getenv("W3_PUBLISH_FAULT") != "1" {
-		return
-	}
-	reader := bufio.NewReader(os.Stdin)
-	reader.ReadBytes('\n')
-	json.NewEncoder(os.Stdout).Encode(childEvent{Kind: "part", Part: directoryIdentity{Inode: uint64(os.Getpid())}})
-	reader.ReadString('\n')
-	json.NewEncoder(os.Stdout).Encode(childEvent{Kind: "ready"})
-	reader.ReadString('\n')
-	json.NewEncoder(os.Stdout).Encode(childEvent{Kind: "malformed"})
-	time.Sleep(time.Minute)
-	os.Exit(1)
-}
-func TestPublishLostReplyDrainsChildBeforeCommitLockRelease(t *testing.T) {
-	base := t.TempDir()
-	stage := filepath.Join(base, "stage")
-	dest := filepath.Join(base, "dest")
-	os.Mkdir(stage, 0700)
-	os.Mkdir(dest, 0700)
-	os.WriteFile(filepath.Join(stage, "source"), []byte("x"), 0600)
-	exe, _ := os.Executable()
-	launcher := filepath.Join(base, "child")
-	os.WriteFile(launcher, []byte("#!/bin/sh\nexport W3_PUBLISH_FAULT=1\nexec "+exe+" -test.run=^TestPublishProtocolChild$\n"), 0700)
-	di, _ := bindDirectory(dest)
-	w := subprocessWriter{Staging: stage, Executable: launcher, PackageUID: os.Getuid()}
-	pid := 0
-	ctx := context.WithValue(context.Background(), partRecordKey{}, func(part partMetadata) error { pid = int(part.Part.Inode); return nil })
-	_, err := w.Move(ctx, Subject{UID: 1200, GID: 100, Groups: []int{100}}, Operation{Job: "job", Staging: "source", Name: "out", Size: 1}, Delegation{Root: dest, Directory: di}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
-		receipt, err := publish()
-		if err == nil {
-			t.Fatal("malformed reply accepted")
-		}
-		if pid == 0 || syscall.Kill(pid, 0) != syscall.ESRCH {
-			t.Fatal("child survived commit lock release", pid)
-		}
-		return receipt, err
-	})
-	if err == nil {
-		t.Fatal("lost reply succeeded")
-	}
-}
-
-// B3: a slow directory fsync after link (large file, loaded volume) outlives the
-// receipt bound. The child is drained; the exact part inode already under the
-// final name is a commit, not an uncertain result, and is never written twice.
-func TestMoveLostReceiptAfterLinkConvergesToCommitted(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root Linux fixture required")
-	}
-	defer func(old time.Duration) { publishReceiptTimeout = old }(publishReceiptTimeout)
-	publishReceiptTimeout = time.Second
-	base := t.TempDir()
-	os.Chmod(base, 0755)
-	os.Chmod(filepath.Dir(base), 0755)
-	stage := filepath.Join(base, "stage")
-	dest := filepath.Join(base, "dest")
-	os.Mkdir(stage, 0700)
-	os.Mkdir(dest, 0700)
-	pkg := Subject{UID: 1400, GID: 1400, Groups: []int{1400}}
-	s := Subject{Username: "normal-fixture", UID: 1216, GID: 100, Groups: []int{100}}
-	os.Chown(stage, pkg.UID, pkg.GID)
-	os.Chown(dest, s.UID, s.GID)
-	source := filepath.Join(stage, "big")
-	size := int64(1 << 30)
-	f, err := os.OpenFile(source, os.O_CREATE|os.O_WRONLY, 0600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	wantHash := sha256.New()
-	block := make([]byte, 1<<20)
-	for i := int64(0); i < size/int64(len(block)); i++ {
-		block[0], block[len(block)-1] = byte(i), byte(i>>8)
-		f.Write(block)
-		wantHash.Write(block)
-	}
-	f.Close()
-	os.Chown(source, pkg.UID, pkg.GID)
-	exe, _ := os.Executable()
-	launcher := filepath.Join(base, "child")
-	os.WriteFile(launcher, []byte("#!/bin/sh\nexport W3_MOVE_CHILD=\"$1\" W3_SLOW_DIR_SYNC=4s\nexec "+exe+" -test.run=^TestMoveChild$\n"), 0700)
-	di, _ := bindDirectory(dest)
-	w := subprocessWriter{Staging: stage, Executable: launcher, PackageUID: pkg.UID, PackageGID: pkg.GID}
-	var part directoryIdentity
-	ctx := context.WithValue(context.Background(), partRecordKey{}, func(p partMetadata) error { part = p.Part; return nil })
-	publishes := 0
-	receipt, err := w.Move(ctx, s, Operation{Job: "job", Name: "out.bin", Staging: "big", Size: size}, Delegation{Root: dest, Directory: di}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
-		publishes++
-		return publish()
-	})
-	if err != nil || publishes != 1 {
-		t.Fatal("lost receipt after link stayed uncertain", receipt, err, publishes)
-	}
-	final, err := os.Open(filepath.Join(dest, "out.bin"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer final.Close()
-	got, _ := fileIdentity(final)
-	info, _ := final.Stat()
-	if got != part || info.Size() != size || info.Sys().(*syscall.Stat_t).Uid != uint32(s.UID) || info.Sys().(*syscall.Stat_t).Nlink != 1 {
-		t.Fatal("final is not the copied part", got, part, info.Size())
-	}
-	gotHash := sha256.New()
-	io.Copy(gotHash, final)
-	if string(gotHash.Sum(nil)) != string(wantHash.Sum(nil)) {
-		t.Fatal("final checksum")
-	}
-	if entries, _ := os.ReadDir(dest); len(entries) != 1 {
-		t.Fatal("part left behind", entries)
-	}
-	if _, err = os.Stat(source); !os.IsNotExist(err) {
-		t.Fatal("source cleanup", err)
-	}
-}
-
-func TestPublishedPartMatchesOnlyTheRecordedInode(t *testing.T) {
-	dest := t.TempDir()
-	os.WriteFile(filepath.Join(dest, "part"), []byte("abc"), 0600)
-	os.WriteFile(filepath.Join(dest, "other"), []byte("abc"), 0600)
-	os.Link(filepath.Join(dest, "part"), filepath.Join(dest, "out"))
-	dir, _ := os.Open(dest)
-	defer dir.Close()
-	di, _ := fileIdentity(dir)
-	part, _ := os.Open(filepath.Join(dest, "part"))
-	pi, _ := fileIdentity(part)
-	part.Close()
-	op := Operation{Name: "out", Size: 3, Subject: Subject{UID: os.Getuid()}, Part: &partMetadata{Directory: di, Part: pi, Destination: dest}}
-	w := subprocessWriter{}
-	if !w.PublishedPart(context.Background(), op) {
-		t.Fatal("recorded part under final name not recognized")
-	}
-	for name, mutate := range map[string]func(*Operation){
-		"other inode": func(o *Operation) { o.Name = "other" },
-		"absent":      func(o *Operation) { o.Name = "missing" },
-		"size":        func(o *Operation) { o.Size = 4 },
-		"owner":       func(o *Operation) { o.Subject.UID++ },
-		"directory":   func(o *Operation) { p := *o.Part; p.Directory.Inode++; o.Part = &p },
-	} {
-		o := op
-		mutate(&o)
-		if w.PublishedPart(context.Background(), o) {
-			t.Fatal("accepted", name)
-		}
-	}
-}
-
-// When serve dies its end of the child's control pipe closes. The child must
-// stop copying and remove its part instead of filling it until the copy ends.
-func TestMoveChildStopsAndRemovesPartWhenParentDies(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root Linux fixture required")
-	}
-	base := t.TempDir()
-	os.Chmod(base, 0755)
-	os.Chmod(filepath.Dir(base), 0755)
-	dest := filepath.Join(base, "dest")
-	os.Mkdir(dest, 0700)
-	s := Subject{UID: 1200, GID: 100, Groups: []int{100}}
-	os.Chown(dest, s.UID, s.GID)
-	size := int64(2 << 30)
-	source, err := os.Create(filepath.Join(base, "large"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer source.Close()
-	source.Truncate(size)
-	di, _ := bindDirectory(dest)
-	dir, err := openDirectory(dest)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer dir.Close()
-	exe, _ := os.Executable()
-	launcher := filepath.Join(base, "child")
-	os.WriteFile(launcher, []byte("#!/bin/sh\nexport W3_MOVE_CHILD=\"$1\"\nexec "+exe+" -test.run=^TestMoveChild$\n"), 0700)
-	cmd := command(context.Background(), launcher, []string{"move-child"})
-	input, err := cmd.StdinPipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	output, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	cmd.ExtraFiles = []*os.File{source, dir}
-	if err = cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer cmd.Cancel()
-	spec := moveSpec{SourceUID: 0, Subject: s, Destination: dest, Directory: di, Name: "out", Size: size, Part: partMetadata{Temporary: ".synopkgland-job-orphan.part", Directory: di, Destination: dest}}
-	json.NewEncoder(input).Encode(spec)
-	var ev childEvent
-	line, err := bufio.NewReader(output).ReadBytes('\n')
-	if err != nil || json.Unmarshal(line, &ev) != nil || ev.Kind != "part" {
-		t.Fatal("child part", string(line), err)
-	}
-	input.Write([]byte("C\n"))
-	time.Sleep(200 * time.Millisecond)
-	input.Close()
-	exited := make(chan error, 1)
-	go func() { exited <- cmd.Wait() }()
-	select {
-	case err = <-exited:
-		if err == nil {
-			t.Fatal("orphaned child reported success")
-		}
-	case <-time.After(5 * time.Second):
-		t.Fatal("child kept copying after its parent's pipe closed")
-	}
-	entries, _ := os.ReadDir(dest)
-	if len(entries) != 0 {
-		t.Fatal("orphaned child left files", entries)
-	}
-}

package/dist/templates/_executor/move_validation.go

@@ -1,46 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"log"
-	"time"
-)
-
-type moveValidationStageKey struct{}
-
-type moveValidationObservation struct {
-	stage    string
-	deadline bool
-}
-
-func moveValidationStage(ctx context.Context, stage string) {
-	if out, ok := ctx.Value(moveValidationStageKey{}).(*moveValidationObservation); ok {
-		out.stage = stage
-	}
-}
-
-func moveValidationDeadline(ctx context.Context, err error) bool {
-	deadline := ctx.Err() == context.DeadlineExceeded || errors.Is(err, context.DeadlineExceeded)
-	if deadline {
-		if out, ok := ctx.Value(moveValidationStageKey{}).(*moveValidationObservation); ok {
-			out.deadline = true
-		}
-	}
-	return deadline
-}
-
-// Only fixed stage/code labels and a validated job identifier are logged. No
-// account, request, credential, grant, path or DSM command output is included.
-// Each operation emits at most eight diagnostics, even for a 24-hour move.
-func (e *Executor) observeMoveValidation(ctx context.Context, d Delegation, job string, remaining *int) (Subject, string, bool) {
-	observation := moveValidationObservation{stage: "policy"}
-	started := time.Now()
-	s, code := e.validateMove(context.WithValue(ctx, moveValidationStageKey{}, &observation), d)
-	deadline := observation.deadline || ctx.Err() == context.DeadlineExceeded
-	if *remaining > 0 {
-		log.Printf("move validation job=%s stage=%s code=%q elapsed_ms=%d deadline=%t canceled=%t", job, observation.stage, code, time.Since(started).Milliseconds(), deadline, ctx.Err() == context.Canceled)
-		*remaining--
-	}
-	return s, code, code == "EXECUTOR_PAUSED" && deadline && ctx.Err() != context.Canceled
-}

package/dist/templates/_executor/move_validation_test.go

@@ -1,187 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-type slowMoveDSM struct {
-	*fakeDSM
-	armed   atomic.Bool
-	timeout bool
-	checked chan struct{}
-	entered chan struct{}
-	nested  bool
-}
-
-func (d *slowMoveDSM) API(ctx context.Context, runner, op string, params map[string]any) (json.RawMessage, error) {
-	if op == "files.checkPermission" && d.armed.CompareAndSwap(true, false) {
-		if d.entered != nil {
-			close(d.entered)
-		}
-		if d.nested {
-			close(d.checked)
-			return nil, context.DeadlineExceeded
-		}
-		if d.timeout {
-			<-ctx.Done()
-			close(d.checked)
-			return nil, ctx.Err()
-		}
-		select {
-		case <-time.After(300 * time.Millisecond):
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		}
-		close(d.checked)
-	}
-	return d.fakeDSM.API(ctx, runner, op, params)
-}
-
-func TestNormalMoveNestedDSMTimeoutDoesNotCancel(t *testing.T) {
-	e, f, _ := setup(t)
-	id := longGrant(t, e)
-	d := &slowMoveDSM{fakeDSM: f, nested: true, checked: make(chan struct{})}
-	e.DSM = d
-	w := &barrierMoveWriter{make(chan struct{}), make(chan struct{}), make(chan struct{})}
-	e.Writer = w
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	if r := offline(e, "files.moveFromStaging", moveParams(id, "nested-timeout")); !r.OK {
-		t.Fatal(r)
-	}
-	<-w.copying
-	d.armed.Store(true)
-	select {
-	case <-d.checked:
-	case <-time.After(7 * time.Second):
-		t.Fatal("no validation")
-	}
-	time.Sleep(50 * time.Millisecond)
-	close(w.release)
-	waitState(t, e, "nested-timeout", "committed")
-}
-
-func TestNormalMoveSlowOrTimedOutRevalidationDoesNotCancel(t *testing.T) {
-	for _, timeout := range []bool{false, true} {
-		t.Run(map[bool]string{false: "slow", true: "deadline"}[timeout], func(t *testing.T) {
-			e, f, _ := setup(t)
-			if f.user.Admin {
-				t.Fatal("requires normal subject")
-			}
-			id := longGrant(t, e)
-			d := &slowMoveDSM{fakeDSM: f, timeout: timeout, checked: make(chan struct{})}
-			e.DSM = d
-			w := &barrierMoveWriter{make(chan struct{}), make(chan struct{}), make(chan struct{})}
-			e.Writer = w
-			if err := e.startOperations(context.Background()); err != nil {
-				t.Fatal(err)
-			}
-			defer e.stopOperations()
-			if r := offline(e, "files.moveFromStaging", moveParams(id, "normal-long")); !r.OK {
-				t.Fatal(r)
-			}
-			<-w.copying
-			d.armed.Store(true)
-			select {
-			case <-d.checked:
-			case <-time.After(moveValidationTimeout + 7*time.Second):
-				t.Fatal("no periodic validation")
-			}
-			// Allow the returned validation result to reach its cancellation decision.
-			time.Sleep(50 * time.Millisecond)
-			close(w.release)
-			waitState(t, e, "normal-long", "committed")
-			grant, err := e.Store.Get(id)
-			if err != nil || grant.Revoked {
-				t.Fatal("transient failure revoked grant", grant, err)
-			}
-		})
-	}
-}
-
-func TestMoveCancellationReportsReason(t *testing.T) {
-	for _, action := range []string{"delegate.revoke", "delegate.disable", "files.cancelOperation"} {
-		t.Run(action, func(t *testing.T) {
-			e, f, _ := setup(t)
-			id := longGrant(t, e)
-			w := &barrierMoveWriter{make(chan struct{}), make(chan struct{}), make(chan struct{})}
-			e.Writer = w
-			if err := e.startOperations(context.Background()); err != nil {
-				t.Fatal(err)
-			}
-			defer e.stopOperations()
-			if r := offline(e, "files.moveFromStaging", moveParams(id, "reason")); !r.OK {
-				t.Fatal(r)
-			}
-			<-w.copying
-			params := map[string]any{"delegation_id": id, "job_id": "reason"}
-			if action == "delegate.disable" {
-				f.user.Admin = true
-				params = map[string]any{}
-			}
-			if r := request(e, action, params); !r.OK {
-				t.Fatal(r)
-			}
-			waitState(t, e, "reason", "canceled")
-			r := offline(e, "files.operationStatus", paramsForStatus(id, "reason"))
-			b, _ := json.Marshal(r.Result)
-			var out struct {
-				Reason string `json:"reason"`
-			}
-			json.Unmarshal(b, &out)
-			want := map[string]string{"delegate.revoke": "grant-revoked", "delegate.disable": "integration-disabled", "files.cancelOperation": "operation-canceled-by-user"}[action]
-			if out.Reason != want {
-				t.Fatal("missing readable reason", string(b))
-			}
-			select {
-			case <-w.published:
-				t.Fatal("published after cancellation")
-			default:
-			}
-		})
-	}
-}
-
-func TestNormalRevokeDuringBlockedValidationCancelsImmediately(t *testing.T) {
-	e, f, _ := setup(t)
-	id := longGrant(t, e)
-	d := &slowMoveDSM{fakeDSM: f, timeout: true, checked: make(chan struct{}), entered: make(chan struct{})}
-	e.DSM = d
-	w := &barrierMoveWriter{make(chan struct{}), make(chan struct{}), make(chan struct{})}
-	e.Writer = w
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	if r := offline(e, "files.moveFromStaging", moveParams(id, "blocked-revoke")); !r.OK {
-		t.Fatal(r)
-	}
-	<-w.copying
-	d.armed.Store(true)
-	select {
-	case <-d.entered:
-	case <-time.After(7 * time.Second):
-		t.Fatal("validation not entered")
-	}
-	if r := request(e, "delegate.revoke", map[string]any{"delegation_id": id}); !r.OK {
-		t.Fatal(r)
-	}
-	op := waitState(t, e, "blocked-revoke", "canceled") // Two seconds, not the 30s validation budget.
-	if op.Reason != "grant-revoked" {
-		t.Fatal(op)
-	}
-	select {
-	case <-w.published:
-		t.Fatal("published after revoke")
-	default:
-	}
-}
-func paramsForStatus(id, job string) map[string]any {
-	return map[string]any{"delegation_id": id, "job_id": job}
-}