@synopackageland/templates 0.35.5 → 0.37.0

package/templates/native-rust-delegate/backend/src/delegate.rs

@@ -6,6 +6,7 @@
 use crate::routes::{Config, internal, utc_now};
 use serde::Deserialize;
 use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
 use std::fs::OpenOptions;
 use std::io::{ErrorKind, Write};
 use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt};
@@ -31,12 +32,25 @@ fn valid_job_id(id: &str) -> bool {
 
 fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
     let p: SaveReport = params.decode()?;
-    if !valid_job_id(&p.job_id) {
+    if !valid_job_id(&p.job_id) || !valid_job_id(&p.delegation_id) {
         return Err(Error::bad_request(
             "job_id must be 1 to 128 letters, digits, '.', '_' or '-'",
         ));
     }
-    let staging = cfg.data_dir.join("executor-staging");
+    let owner = format!(
+        "{:x}",
+        Sha256::digest(format!("{}\0{}", ctx.user, p.delegation_id).as_bytes())
+    );
+    let job_id = format!(
+        "{:x}-{}",
+        Sha256::digest(format!("{}\0{}\0{}", ctx.user, p.delegation_id, p.job_id).as_bytes()),
+        &owner[..32]
+    );
+    let staging = cfg
+        .data_dir
+        .join("executor-staging")
+        .join("owners")
+        .join(&owner);
     std::fs::DirBuilder::new()
         .recursive(true)
         .mode(0o700)
@@ -44,7 +58,8 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .map_err(internal)?;
     let name = format!("report-{}.txt", p.job_id);
     let path = staging.join(&name);
-    // A retried save sends the file it wrote the first time.
+    // An admitted or uncertain save retries the original source.
+    let mut created = false;
     match OpenOptions::new()
         .write(true)
         .create_new(true)
@@ -52,6 +67,7 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .open(&path)
     {
         Ok(mut file) => {
+            created = true;
             let report = format!("Report for {}, {}\n", ctx.user, utc_now());
             file.write_all(report.as_bytes()).map_err(internal)?;
         }
@@ -59,10 +75,20 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         Err(e) => return Err(internal(e)),
     }
     let size = std::fs::metadata(&path).map_err(internal)?.len();
-    ctx.runtime(
+    let result: Result<Value, Error> = ctx.runtime(
         "delegate.move_from_staging",
-        &json!({"delegation_id": p.delegation_id, "job_id": p.job_id, "staging": name, "name": name, "size": size}),
-    )
+        &json!({"delegation_id": p.delegation_id, "job_id": job_id, "staging": format!("owners/{owner}/{name}"), "name": name, "size": size}),
+    );
+    // A transport failure may already have been admitted; keep its source.
+    if created
+        && result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.code == "DELEGATION_DENIED")
+    {
+        std::fs::remove_file(&path).map_err(internal)?;
+    }
+    result
 }
 
 #[cfg(test)]
@@ -106,11 +132,26 @@ mod tests {
         let (_dir, cfg) = setup();
         let reply = save(&cfg, "alice", &moved());
         assert_eq!(reply.data, json!({"state": "queued"}));
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(reply.services[0].1["staging"].as_str().unwrap());
         assert!(std::fs::read_to_string(&path).unwrap().contains("alice"));
         let meta = std::fs::metadata(&path).unwrap();
         assert_eq!(meta.permissions().mode() & 0o777, 0o600);
-        let params = json!({"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": meta.len()});
+        let owner = reply.services[0].1["staging"]
+            .as_str()
+            .unwrap()
+            .split('/')
+            .nth(1)
+            .unwrap();
+        assert!(
+            reply.services[0].1["job_id"]
+                .as_str()
+                .unwrap()
+                .ends_with(&format!("-{}", &owner[..32]))
+        );
+        let params = json!({"delegation_id": "d1", "job_id": reply.services[0].1["job_id"], "staging": reply.services[0].1["staging"], "name": "report-job-1.txt", "size": meta.len()});
         assert_eq!(
             reply.services,
             vec![("delegate.move_from_staging".to_string(), params)]
@@ -118,29 +159,43 @@ mod tests {
     }
 
     #[test]
-    fn a_repeated_save_sends_the_same_file_again() {
+    fn retries_reuse_only_the_same_owner_and_grant_source() {
         let (_dir, cfg) = setup();
         let first = save(&cfg, "alice", &moved()).services;
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(first[0].1["staging"].as_str().unwrap());
         let report = std::fs::read_to_string(&path).unwrap();
-        assert_eq!(save(&cfg, "bob", &moved()).services, first);
+        assert_eq!(save(&cfg, "alice", &moved()).services, first);
+        let other = save(&cfg, "bob", &moved()).services;
+        assert_ne!(other[0].1["staging"], first[0].1["staging"]);
+        assert_ne!(other[0].1["job_id"], first[0].1["job_id"]);
+        let other_path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(other[0].1["staging"].as_str().unwrap());
+        assert!(std::fs::read_to_string(other_path).unwrap().contains("bob"));
         assert_eq!(std::fs::read_to_string(&path).unwrap(), report);
     }
 
     #[test]
-    fn save_passes_on_the_executors_refusal() {
+    fn rejection_removes_new_source_but_timeout_keeps_retry() {
         let (_dir, cfg) = setup();
-        let services: Services = [(
-            "delegate.move_from_staging",
-            Box::new(|_: &Value| {
-                Err(Error::new(
-                    "DELEGATION_DENIED",
-                    "The destination is no longer allowed.",
-                ))
-            }) as _,
-        )]
-        .into();
-        assert_eq!(save(&cfg, "alice", &services).code(), "DELEGATION_DENIED");
+        for (code, retained) in [("DELEGATION_DENIED", false), ("EXECUTOR_TIMEOUT", true)] {
+            let services: Services = [(
+                "delegate.move_from_staging",
+                Box::new(move |_: &Value| Err(Error::new(code, "Save failed"))) as _,
+            )]
+            .into();
+            let reply = save(&cfg, "alice", &services);
+            assert_eq!(reply.code(), code);
+            let path = cfg
+                .data_dir
+                .join("executor-staging")
+                .join(reply.services[0].1["staging"].as_str().unwrap());
+            assert_eq!(path.exists(), retained);
+        }
     }
 
     #[test]