json-database 1.0.3a1__tar.gz → 1.0.4a2__tar.gz

{json_database-1.0.3a1 → json_database-1.0.4a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: json_database
-Version: 1.0.3a1
+Version: 1.0.4a2
 Summary: searchable json database with persistence
 Author-email: jarbasAI <jarbasai@mailfence.com>
 License: MIT

{json_database-1.0.3a1 → json_database-1.0.4a2}/json_database/__init__.py

@@ -4,7 +4,7 @@ import os
 from os import makedirs, remove
 from os.path import expanduser, isdir, dirname, exists, isfile, join
 from pprint import pprint
-from tempfile import gettempdir
+from tempfile import gettempdir, mkstemp
 
 from combo_lock import ComboLock
 
@@ -135,8 +135,64 @@ class JsonStorage(dict):
             path = expanduser(path)
             if dirname(path) and not isdir(dirname(path)):
                 makedirs(dirname(path))
-            with open(path, 'w', encoding="utf-8") as f:
-                json.dump(self, f, indent=4, ensure_ascii=False)
+            self._atomic_write(path, json.dumps(self, indent=4,
+                                                ensure_ascii=False))
+
+    @staticmethod
+    def _atomic_write(path, data):
+        """Replace the file at ``path`` with ``data`` in one step.
+
+        Writing directly into the destination truncates it before the new
+        content is on disk, so a power cut or a full disk leaves a
+        half-written file that no longer parses. Instead the data goes to a
+        temporary file in the same directory, is flushed all the way to the
+        disk, and then replaces the destination with ``os.replace``, which
+        is atomic. A reader always sees either the old file or the new one.
+
+        The temporary file sits beside the destination until the replace,
+        so a store needs room for both copies. On a full partition even a
+        write that makes the file smaller can now fail.
+        """
+        # Follow the symlink and replace what it points at. os.replace on
+        # the link would put a regular file where the link was, quietly
+        # detaching the file the rest of the system shares.
+        real_path = os.path.realpath(path)
+        directory = dirname(real_path) or "."
+        if exists(real_path) and not os.access(real_path, os.W_OK):
+            # os.replace only needs write access to the directory, so a
+            # read-only destination would otherwise be overwritten. Refuse
+            # it, the same way a plain open(path, 'w') does.
+            raise PermissionError(f"file is not writable: {path}")
+        fd, tmp_path = mkstemp(dir=directory, prefix=".tmp_", suffix=".json")
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                f.write(data)
+                f.flush()
+                os.fsync(f.fileno())
+            if exists(real_path):
+                stat = os.stat(real_path)
+                # mkstemp creates the temp file 0600; keep the permissions
+                # the destination already had
+                os.chmod(tmp_path, stat.st_mode & 0o777)
+                if os.name == "posix" and os.geteuid() == 0:
+                    # os.replace keeps the temp file's owner, so a root run
+                    # would hand the file to root and lock the service that
+                    # owns it out. Only root can give a file away; for any
+                    # other user the owner cannot change anyway.
+                    os.chown(tmp_path, stat.st_uid, stat.st_gid)
+            os.replace(tmp_path, real_path)
+        except BaseException:
+            if exists(tmp_path):
+                remove(tmp_path)
+            raise
+        if os.name == "posix":
+            # the rename itself is only on disk once the directory is
+            # flushed; without this a crash can bring back the old file
+            dir_fd = os.open(directory, os.O_RDONLY)
+            try:
+                os.fsync(dir_fd)
+            finally:
+                os.close(dir_fd)
 
     def remove(self):
         with self.lock:

{json_database-1.0.3a1 → json_database-1.0.4a2}/json_database/version.py

@@ -1,8 +1,8 @@
 # START_VERSION_BLOCK
 VERSION_MAJOR = 1
 VERSION_MINOR = 0
-VERSION_BUILD = 3
-VERSION_ALPHA = 1
+VERSION_BUILD = 4
+VERSION_ALPHA = 2
 # END_VERSION_BLOCK
 
 __version__ = f"{VERSION_MAJOR}.{VERSION_MINOR}.{VERSION_BUILD}" + (f"a{VERSION_ALPHA}" if VERSION_ALPHA else "")

{json_database-1.0.3a1 → json_database-1.0.4a2}/json_database.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: json_database
-Version: 1.0.3a1
+Version: 1.0.4a2
 Summary: searchable json database with persistence
 Author-email: jarbasAI <jarbasai@mailfence.com>
 License: MIT

{json_database-1.0.3a1 → json_database-1.0.4a2}/test/test_storage.py

@@ -390,3 +390,121 @@ class TestJsonStorage:
         with open(temp_db_path, 'r') as f:
             data = json.load(f)
         assert data == {}
+
+
+class TestJsonStorageAtomicWrite:
+    """store() must never leave a half-written file on disk."""
+
+    def test_crash_before_replace_keeps_original(self, temp_db_path,
+                                                 monkeypatch):
+        """A crash after the temp file is written keeps the old file intact."""
+        storage = JsonStorage(temp_db_path, disable_lock=True)
+        storage["key"] = "original"
+        storage.store()
+
+        def boom(src, dst):
+            raise OSError("simulated power cut")
+
+        monkeypatch.setattr(os, "replace", boom)
+        storage["key"] = "new value"
+        with pytest.raises(OSError):
+            storage.store()
+
+        with open(temp_db_path, 'r') as f:
+            data = json.load(f)
+        assert data == {"key": "original"}
+
+    def test_crash_before_replace_leaves_no_temp_file(self, temp_db_path,
+                                                      monkeypatch):
+        """The temp file is cleaned up when the replace fails."""
+        storage = JsonStorage(temp_db_path, disable_lock=True)
+        storage["key"] = "original"
+        storage.store()
+
+        def boom(src, dst):
+            raise OSError("simulated power cut")
+
+        monkeypatch.setattr(os, "replace", boom)
+        with pytest.raises(OSError):
+            storage.store()
+
+        folder = os.path.dirname(temp_db_path)
+        assert [f for f in os.listdir(folder) if f.startswith(".tmp_")] == []
+
+    def test_store_writes_through_replace(self, temp_db_path, monkeypatch):
+        """The destination is only ever touched by os.replace."""
+        calls = []
+        real_replace = os.replace
+
+        def spy(src, dst):
+            calls.append((src, dst))
+            real_replace(src, dst)
+
+        monkeypatch.setattr(os, "replace", spy)
+        storage = JsonStorage(temp_db_path, disable_lock=True)
+        storage["key"] = "value"
+        storage.store()
+
+        assert len(calls) == 1
+        assert calls[0][1] == temp_db_path
+        assert os.path.dirname(calls[0][0]) == os.path.dirname(temp_db_path)
+
+    def test_store_keeps_file_permissions(self, temp_db_path):
+        """Rewriting a file does not change its permissions."""
+        storage = JsonStorage(temp_db_path, disable_lock=True)
+        storage.store()
+        os.chmod(temp_db_path, 0o600)
+
+        storage["key"] = "value"
+        storage.store()
+
+        assert os.stat(temp_db_path).st_mode & 0o777 == 0o600
+
+    def test_stored_file_is_always_parseable(self, temp_db_path):
+        """Repeated stores of growing data always leave valid json."""
+        storage = JsonStorage(temp_db_path, disable_lock=True)
+        for i in range(20):
+            storage[f"key{i}"] = "x" * (i * 100)
+            storage.store()
+            with open(temp_db_path, 'r') as f:
+                assert json.load(f) == dict(storage)
+
+    def test_symlinked_destination_stays_a_symlink(self, tmp_path):
+        """A dotfile pointing at shared state must keep pointing at it.
+
+        ``~/.config/hivemind/_identity.json -> /mnt/state/identity.json`` is
+        a normal setup. Replacing the link with a regular file freezes the
+        shared file and nothing says so.
+        """
+        target = tmp_path / "shared.json"
+        target.write_text("{}")
+        link = tmp_path / "link.json"
+        link.symlink_to(target)
+
+        storage = JsonStorage(str(link), disable_lock=True)
+        storage["key"] = "value"
+        storage.store()
+
+        assert link.is_symlink()
+        assert json.loads(target.read_text()) == {"key": "value"}
+
+    @pytest.mark.skipif(os.name != "posix" or os.geteuid() != 0,
+                        reason="only root can give a file away")
+    def test_root_store_keeps_the_owner_of_the_file(self, tmp_path):
+        """`sudo hivemind-core add-client` must not hand the db to root.
+
+        os.replace keeps the temp file's owner, so without a chown the
+        unprivileged service that owns the file can no longer write it.
+        """
+        import pwd
+        owner = pwd.getpwnam("nobody")
+        db_file = tmp_path / "clients.json"
+        db_file.write_text("{}")
+        os.chown(db_file, owner.pw_uid, owner.pw_gid)
+
+        storage = JsonStorage(str(db_file), disable_lock=True)
+        storage["key"] = "value"
+        storage.store()
+
+        stat = os.stat(db_file)
+        assert (stat.st_uid, stat.st_gid) == (owner.pw_uid, owner.pw_gid)