Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  mathiasandClaude Opus 5.5
|
6325c2b414 | ||
|
mathiasandClaude Opus 5.5
|
b3d782b25e | ||
|
mathiasandClaude Opus 5.5
|
e548b97ba4 |
@@ -1,25 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
|
||||
chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
|
||||
)
|
||||
|
||||
// buildJWTValidator runs OIDC discovery under policy, so a 502 from an auth
|
||||
// upstream that is not serving yet on a cold boot is retried instead of
|
||||
// exiting (#83). It honours ctx between attempts.
|
||||
func buildJWTValidator(
|
||||
ctx context.Context, logger *slog.Logger, issuer, audience string, policy startupretry.Policy,
|
||||
) (*chassisauth.JWTValidator, error) {
|
||||
return startupretry.Do(ctx, policy, func(ctx context.Context) (*chassisauth.JWTValidator, error) {
|
||||
v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
|
||||
if err != nil {
|
||||
logger.Warn("oidc discovery not ready, retrying", "err", err)
|
||||
}
|
||||
return v, err
|
||||
})
|
||||
}
|
||||
@@ -1,86 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
|
||||
)
|
||||
|
||||
// fakeIssuer answers OIDC discovery with 502 for the first fail requests, as
|
||||
// ingress does while dex is not yet serving on a cold boot (#83), then with a
|
||||
// real discovery document and an empty JWKS.
|
||||
func fakeIssuer(t *testing.T, fail int32) (*httptest.Server, *atomic.Int32) {
|
||||
t.Helper()
|
||||
var discoveries atomic.Int32
|
||||
mux := http.NewServeMux()
|
||||
var srv *httptest.Server
|
||||
mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
|
||||
if discoveries.Add(1) <= fail {
|
||||
w.WriteHeader(http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = io.WriteString(w, `{"issuer":"`+srv.URL+`","jwks_uri":"`+srv.URL+`/keys"}`)
|
||||
})
|
||||
mux.HandleFunc("/keys", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = io.WriteString(w, `{"keys":[]}`)
|
||||
})
|
||||
srv = httptest.NewServer(mux)
|
||||
t.Cleanup(srv.Close)
|
||||
return srv, &discoveries
|
||||
}
|
||||
|
||||
var fastPolicy = startupretry.Policy{Attempts: 8, Base: time.Millisecond, Max: 5 * time.Millisecond}
|
||||
|
||||
func TestBuildJWTValidatorRetriesDiscovery502sThenSucceeds(t *testing.T) {
|
||||
srv, discoveries := fakeIssuer(t, 3)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
v, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
|
||||
require.NoError(t, err)
|
||||
assert.NotNil(t, v)
|
||||
assert.Equal(t, int32(4), discoveries.Load(), "three 502s, then the successful discovery")
|
||||
}
|
||||
|
||||
func TestBuildJWTValidatorGivesUpAfterTheBudgetWithTheLastError(t *testing.T) {
|
||||
srv, discoveries := fakeIssuer(t, 1000)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
|
||||
_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "status 502")
|
||||
assert.Equal(t, int32(8), discoveries.Load(), "bounded: exactly the attempt budget")
|
||||
}
|
||||
|
||||
func TestBuildJWTValidatorStopsRetryingWhenTheContextIsCancelled(t *testing.T) {
|
||||
srv, _ := fakeIssuer(t, 1000)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
slow := startupretry.Policy{Attempts: 8, Base: time.Hour, Max: time.Hour}
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() {
|
||||
_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", slow)
|
||||
done <- err
|
||||
}()
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
cancel()
|
||||
select {
|
||||
case err := <-done:
|
||||
assert.ErrorIs(t, err, context.Canceled)
|
||||
case <-time.After(3 * time.Second):
|
||||
t.Fatal("did not return after the context was cancelled")
|
||||
}
|
||||
}
|
||||
@@ -381,9 +381,15 @@ func main() {
|
||||
//
|
||||
// The budget stays bounded: retrying forever would turn a misconfiguration
|
||||
// into a process that looks alive and never serves.
|
||||
jwtValidator, err := buildJWTValidator(ctx, logger,
|
||||
os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"),
|
||||
startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second})
|
||||
jwtValidator, err := startupretry.Do(ctx,
|
||||
startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second},
|
||||
func(ctx context.Context) (*chassisauth.JWTValidator, error) {
|
||||
v, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
|
||||
if err != nil {
|
||||
logger.Warn("oidc discovery not ready, retrying", "err", err)
|
||||
}
|
||||
return v, err
|
||||
})
|
||||
if err != nil {
|
||||
logger.Error("build jwt validator", "err", err)
|
||||
os.Exit(1)
|
||||
|
||||
+6
-6
@@ -34,9 +34,9 @@ require (
|
||||
github.com/rogpeppe/go-internal v1.15.0 // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
golang.org/x/net v0.55.0 // indirect
|
||||
golang.org/x/net v0.26.0 // indirect
|
||||
golang.org/x/oauth2 v0.21.0 // indirect
|
||||
golang.org/x/term v0.43.0 // indirect
|
||||
golang.org/x/term v0.28.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
google.golang.org/protobuf v1.34.2 // indirect
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
||||
@@ -66,9 +66,9 @@ require (
|
||||
github.com/lestrrat-go/option v1.0.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
||||
github.com/segmentio/asm v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.51.0 // indirect
|
||||
golang.org/x/sync v0.21.0 // indirect
|
||||
golang.org/x/sys v0.45.0 // indirect
|
||||
golang.org/x/text v0.39.0 // indirect
|
||||
golang.org/x/crypto v0.32.0 // indirect
|
||||
golang.org/x/sync v0.17.0 // indirect
|
||||
golang.org/x/sys v0.31.0 // indirect
|
||||
golang.org/x/text v0.29.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
)
|
||||
|
||||
+14
-14
@@ -117,42 +117,42 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
|
||||
golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
|
||||
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
|
||||
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
|
||||
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
|
||||
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
|
||||
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||
golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
|
||||
golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
|
||||
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
|
||||
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
|
||||
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
|
||||
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
|
||||
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
|
||||
golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
|
||||
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
|
||||
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
|
||||
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
|
||||
golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -3,15 +3,18 @@ package api
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
|
||||
)
|
||||
|
||||
// ContentHash returns the lowercase hex sha256 of b. It is the note's
|
||||
@@ -91,14 +94,23 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
|
||||
rel = filepath.ToSlash(rel)
|
||||
}
|
||||
|
||||
rel, abs, err := resolveWithin(brainDir, rel)
|
||||
// The path is caller-supplied (brain_update): resolve it as brain_edit
|
||||
// does, knowledge/ and wiki/ notes only, and read and rewrite it through
|
||||
// the brain root, never through a symlink (hyperguild#169).
|
||||
t, err := notes.Resolve(brainDir, rel, notes.ScopeNotes)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
|
||||
prior, err := os.ReadFile(abs)
|
||||
rel = t.Rel
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return "", "", "", fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
|
||||
prior, err := bfs.ReadRegular(rel)
|
||||
if err != nil {
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
return "", "", "", fmt.Errorf("note %q does not exist: use brain_write to create", rel)
|
||||
}
|
||||
return "", "", "", fmt.Errorf("read target: %w", err)
|
||||
@@ -164,7 +176,7 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
|
||||
return "", "", "", err
|
||||
}
|
||||
out := []byte(stamped)
|
||||
if err := os.WriteFile(abs, out, 0o644); err != nil {
|
||||
if err := bfs.WriteRegular(rel, out); err != nil {
|
||||
return "", "", "", fmt.Errorf("write: %w", err)
|
||||
}
|
||||
return rel, ContentHash(out), priorHash, nil
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
)
|
||||
|
||||
// brain_update passed the caller's path through resolveWithin, a lexical
|
||||
// containment check only: any file in the brain could be superseded
|
||||
// (classification.yaml, raw/, sessions/), and a final symlink was written
|
||||
// through. It now resolves like brain_edit: knowledge/ and wiki/ notes only,
|
||||
// read and rewritten through the brain root.
|
||||
func TestUpdateNoteRefusesPathsOutsideKnowledgeAndWikiNotes(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
files := map[string]string{
|
||||
"classification.yaml": "levels: {}\n",
|
||||
"raw/r.md": "raw\n",
|
||||
"sessions/s.jsonl": "{}\n",
|
||||
"wiki/w/facts/ok.md": "---\ntitle: ok\n---\nold\n",
|
||||
"knowledge/k.md": "---\ntitle: k\n---\nold\n",
|
||||
"wiki/w/facts/x.txt": "txt\n",
|
||||
}
|
||||
for rel, body := range files {
|
||||
p := filepath.Join(brain, filepath.FromSlash(rel))
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(p), 0o755))
|
||||
require.NoError(t, os.WriteFile(p, []byte(body), 0o644))
|
||||
}
|
||||
for _, rel := range []string{"classification.yaml", "raw/r.md", "sessions/s.jsonl", "wiki/w/facts/x.txt", "wiki/w/../../raw/r.md"} {
|
||||
_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "replaced"})
|
||||
assert.Error(t, err, rel)
|
||||
}
|
||||
for rel, body := range files {
|
||||
if rel == "wiki/w/facts/ok.md" || rel == "knowledge/k.md" {
|
||||
continue
|
||||
}
|
||||
got, err := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, body, string(got), rel)
|
||||
}
|
||||
for _, rel := range []string{"wiki/w/facts/ok.md", "knowledge/k.md"} {
|
||||
_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "new body"})
|
||||
require.NoError(t, err, "positive control: %s", rel)
|
||||
got, _ := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
|
||||
assert.Contains(t, string(got), "new body")
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateNoteDoesNotWriteThroughASymlinkedNote(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
victim := filepath.Join(brain, "raw", "victim.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), filepath.Join(facts, "l.md")))
|
||||
_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/l.md", Content: "replaced"})
|
||||
assert.Error(t, err)
|
||||
got, _ := os.ReadFile(victim)
|
||||
assert.Equal(t, "untouched\n", string(got))
|
||||
}
|
||||
|
||||
// The note is swapped between a regular file and an in-brain symlink to a
|
||||
// raw/ file while UpdateNote runs: the read and the write each refuse a
|
||||
// symlink, so the raw/ file is never rewritten.
|
||||
func TestUpdateNoteNeverRewritesASymlinkSwappedInForTheNote(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
victim := filepath.Join(brain, "raw", "victim.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
note := filepath.Join(facts, "n.md")
|
||||
body := "---\ntitle: n\n---\nold\n"
|
||||
require.NoError(t, os.WriteFile(note, []byte(body), 0o644))
|
||||
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
tmp := note + ".swap"
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
_ = os.Remove(tmp)
|
||||
if i%2 == 0 {
|
||||
_ = os.WriteFile(tmp, []byte(body), 0o644)
|
||||
} else {
|
||||
_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
|
||||
}
|
||||
_ = os.Rename(tmp, note)
|
||||
}
|
||||
}()
|
||||
ok := 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
if _, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/n.md", Content: "new"}); err == nil {
|
||||
ok++
|
||||
}
|
||||
}
|
||||
stop.Store(true)
|
||||
wg.Wait()
|
||||
got, _ := os.ReadFile(victim)
|
||||
assert.Equal(t, "untouched\n", string(got))
|
||||
assert.Positive(t, ok, "positive control: some updates reach the regular note")
|
||||
}
|
||||
@@ -2,18 +2,12 @@ package brain
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// noteEntry is one row in a Wing _index.md.
|
||||
@@ -33,18 +27,13 @@ func BuildWingIndex(brainDir, wing string) error {
|
||||
return fmt.Errorf("invalid wing %q", wing)
|
||||
}
|
||||
wingDir := filepath.Join(brainDir, "wiki", w)
|
||||
// Listed and read through the brain root (hyperguild#157): a wing or
|
||||
// hall that is a symlink is not followed, and notes are regular files.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
if _, err := bfs.Lstat("wiki/" + w); errors.Is(err, fs.ErrNotExist) {
|
||||
if _, err := os.Stat(wingDir); os.IsNotExist(err) {
|
||||
return nil
|
||||
} else if err != nil {
|
||||
return fmt.Errorf("stat wing: %w", err)
|
||||
}
|
||||
|
||||
entries, err := collectWingEntries(bfs, "wiki/"+w)
|
||||
entries, err := collectWingEntries(wingDir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -69,47 +58,51 @@ func BuildWingIndex(brainDir, wing string) error {
|
||||
|
||||
// BuildAllWingIndexes regenerates _index.md for every wing under brain/wiki/.
|
||||
func BuildAllWingIndexes(brainDir string) error {
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
wings, err := bfs.ReadDirDirs("wiki")
|
||||
_ = bfs.Close()
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
wikiDir := filepath.Join(brainDir, "wiki")
|
||||
ents, err := os.ReadDir(wikiDir)
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
if err != nil {
|
||||
return fmt.Errorf("read wiki: %w", err)
|
||||
}
|
||||
for _, w := range wings {
|
||||
if err := BuildWingIndex(brainDir, w); err != nil {
|
||||
return fmt.Errorf("index %s: %w", w, err)
|
||||
for _, e := range ents {
|
||||
if !e.IsDir() {
|
||||
continue
|
||||
}
|
||||
if err := BuildWingIndex(brainDir, e.Name()); err != nil {
|
||||
return fmt.Errorf("index %s: %w", e.Name(), err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func collectWingEntries(bfs *brainfs.Brain, wingRel string) ([]noteEntry, error) {
|
||||
func collectWingEntries(wingDir string) ([]noteEntry, error) {
|
||||
var out []noteEntry
|
||||
halls, err := bfs.ReadDirDirs(wingRel)
|
||||
ents, err := os.ReadDir(wingDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read wing: %w", err)
|
||||
}
|
||||
for _, hall := range halls {
|
||||
for _, hallEnt := range ents {
|
||||
if !hallEnt.IsDir() {
|
||||
continue
|
||||
}
|
||||
hall := hallEnt.Name()
|
||||
if !IsValidHall(hall) {
|
||||
continue
|
||||
}
|
||||
hallRel := wingRel + "/" + hall
|
||||
names, err := bfs.ReadDirRegular(hallRel)
|
||||
hallDir := filepath.Join(wingDir, hall)
|
||||
notes, err := os.ReadDir(hallDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read hall %s: %w", hall, err)
|
||||
}
|
||||
for _, name := range names {
|
||||
if !strings.HasSuffix(name, ".md") || name == "_index.md" {
|
||||
for _, n := range notes {
|
||||
if n.IsDir() || !strings.HasSuffix(n.Name(), ".md") || n.Name() == "_index.md" {
|
||||
continue
|
||||
}
|
||||
slug := strings.TrimSuffix(name, ".md")
|
||||
title, created := readTitleAndCreatedIn(bfs, hallRel+"/"+name, slug)
|
||||
slug := strings.TrimSuffix(n.Name(), ".md")
|
||||
full := filepath.Join(hallDir, n.Name())
|
||||
title, created := readTitleAndCreated(full, slug)
|
||||
out = append(out, noteEntry{Hall: hall, Slug: slug, Title: title, Created: created})
|
||||
}
|
||||
}
|
||||
@@ -124,40 +117,9 @@ func readTitleAndCreated(path, slug string) (string, string) {
|
||||
return slug, ""
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
title, created := parseTitleAndCreated(f)
|
||||
if created == "" {
|
||||
if info, err := os.Stat(path); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return titleOrSlug(title, slug), created
|
||||
}
|
||||
|
||||
// readTitleAndCreatedIn is readTitleAndCreated through the brain root,
|
||||
// regular files only (hyperguild#157).
|
||||
func readTitleAndCreatedIn(bfs *brainfs.Brain, rel, slug string) (string, string) {
|
||||
content, err := bfs.ReadRegular(rel)
|
||||
if err != nil {
|
||||
return slug, ""
|
||||
}
|
||||
title, created := parseTitleAndCreated(bytes.NewReader(content))
|
||||
if created == "" {
|
||||
if info, err := bfs.Lstat(rel); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return titleOrSlug(title, slug), created
|
||||
}
|
||||
|
||||
func titleOrSlug(title, slug string) string {
|
||||
if title == "" {
|
||||
return strings.ReplaceAll(slug, "-", " ")
|
||||
}
|
||||
return title
|
||||
}
|
||||
|
||||
func parseTitleAndCreated(r io.Reader) (title, created string) {
|
||||
scanner := bufio.NewScanner(r)
|
||||
title, created := "", ""
|
||||
scanner := bufio.NewScanner(f)
|
||||
inFrontmatter := false
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
@@ -187,5 +149,13 @@ func parseTitleAndCreated(r io.Reader) (title, created string) {
|
||||
}
|
||||
}
|
||||
}
|
||||
if title == "" {
|
||||
title = strings.ReplaceAll(slug, "-", " ")
|
||||
}
|
||||
if created == "" {
|
||||
if info, err := os.Stat(path); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return title, created
|
||||
}
|
||||
|
||||
@@ -1,132 +0,0 @@
|
||||
package brain_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
func readIndex(t *testing.T, brainDir, wing string) string {
|
||||
t.Helper()
|
||||
b, _ := os.ReadFile(filepath.Join(brainDir, "wiki", wing, "_index.md"))
|
||||
return string(b)
|
||||
}
|
||||
|
||||
// hyperguild#157 slice 5: BuildWingIndex listed wiki/<wing>/<hall>/ with
|
||||
// os.ReadDir and opened each note by path, so a symlinked note put the
|
||||
// target's title into _index.md, and a FIFO hung the index build.
|
||||
func TestBuildWingIndexRefusesSymlinkedNotesAndSurvivesSwapRaces(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
facts := filepath.Join(b, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
|
||||
|
||||
require.NoError(t, brain.BuildWingIndex(b, "w"))
|
||||
idx := readIndex(t, b, "w")
|
||||
assert.Contains(t, idx, "zqinside", "positive control")
|
||||
assert.NotContains(t, idx, brainfstest.Sentinel)
|
||||
assert.NotContains(t, idx, "leak")
|
||||
assert.NotContains(t, idx, "inlink")
|
||||
|
||||
p := filepath.Join(facts, "r.md")
|
||||
read := func() string {
|
||||
_ = brain.BuildWingIndex(b, "w")
|
||||
return readIndex(t, b, "w")
|
||||
}
|
||||
brainfstest.AssertNoLeak(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: zqinside\n---\n", inBrain, 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoHang(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
||||
}
|
||||
|
||||
// A symlinked hall is skipped while a real hall next to it is indexed; a
|
||||
// symlinked wing is refused and nothing is written into its target.
|
||||
func TestBuildWingIndexSkipsASymlinkedHallAndRefusesASymlinkedWing(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "raw", "facts", "r.md"), []byte("---\ntitle: zqrawonly\n---\n"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "decisions"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "decisions", "d.md"), []byte("---\ntitle: zqrealhall\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(b, "wiki", "w", "facts")))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
|
||||
|
||||
require.NoError(t, brain.BuildWingIndex(b, "w"))
|
||||
idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
|
||||
require.NoError(t, err, "the wing index is written")
|
||||
assert.Contains(t, string(idx), "zqrealhall", "the real hall is indexed")
|
||||
assert.NotContains(t, string(idx), "zqrawonly", "the symlinked hall is not")
|
||||
|
||||
assert.Error(t, brain.BuildWingIndex(b, "alias"))
|
||||
_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
|
||||
assert.True(t, os.IsNotExist(err), "an index was written into the symlinked wing's target")
|
||||
}
|
||||
|
||||
// BuildAllWingIndexes indexes the real wings and skips a symlinked one.
|
||||
func TestBuildAllWingIndexesSkipsASymlinkedWing(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "n.md"), []byte("---\ntitle: zqrealwing\n---\n"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
|
||||
|
||||
require.NoError(t, brain.BuildAllWingIndexes(b))
|
||||
idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(idx), "zqrealwing")
|
||||
_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
|
||||
assert.True(t, os.IsNotExist(err))
|
||||
}
|
||||
|
||||
// A link to a symlinked note does not resolve: only regular files count as
|
||||
// entries, so StripUnresolvedLinks unwraps it.
|
||||
func TestStripUnresolvedLinksDoesNotCountASymlinkedNoteAsAnEntry(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
facts := filepath.Join(b, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("x"), 0o644))
|
||||
brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "ghost.md")))
|
||||
out, unlinked, err := brain.StripUnresolvedLinks(b, "see [[real]] and [[ghost]]")
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, out, "[[real]]", "positive control")
|
||||
assert.NotContains(t, out, "[[ghost]]")
|
||||
assert.Contains(t, unlinked, "ghost")
|
||||
}
|
||||
|
||||
// A linked tree (knowledge/ or wiki/) that is not a real directory is
|
||||
// skipped, not an error: StripUnresolvedLinks runs before every brain_write,
|
||||
// and an error there loses the learning.
|
||||
func TestStripUnresolvedLinksSkipsALinkedTreeThatIsNotARealDirectory(t *testing.T) {
|
||||
for name, mk := range map[string]func(t *testing.T, b string){
|
||||
"symlink to an in-brain dir": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "k"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("raw", "k"), filepath.Join(b, "knowledge")))
|
||||
},
|
||||
"dangling symlink": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.Symlink("nowhere", filepath.Join(b, "knowledge")))
|
||||
},
|
||||
"regular file": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "knowledge"), []byte("x"), 0o644))
|
||||
},
|
||||
} {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
|
||||
mk(t, b)
|
||||
out, _, err := brain.StripUnresolvedLinks(b, "learning [[real]] and [[gone]]")
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, out, "[[real]]", "links into wiki/ still resolve")
|
||||
assert.NotContains(t, out, "[[gone]]")
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1,16 +1,12 @@
|
||||
package brain
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"path"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// wikilinkRE matches [[target]] and [[target|Display Text]].
|
||||
@@ -102,40 +98,29 @@ var linkedTrees = []string{"knowledge", "wiki"}
|
||||
// one the audit will also resolve.
|
||||
func entryIndex(brainDir string) (map[string]struct{}, error) {
|
||||
index := map[string]struct{}{}
|
||||
// Walked through the brain root (hyperguild#157): only regular files
|
||||
// count as entries, so a symlinked .md name cannot make a link resolve.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
for _, dir := range linkedTrees {
|
||||
if _, err := bfs.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
|
||||
root := filepath.Join(brainDir, dir)
|
||||
if _, err := os.Stat(root); os.IsNotExist(err) {
|
||||
continue
|
||||
} else if err != nil {
|
||||
return nil, fmt.Errorf("stat %s: %w", dir, err)
|
||||
}
|
||||
var walkErr error
|
||||
err := bfs.WalkRegular(dir, func(rel string) error {
|
||||
if !strings.HasSuffix(rel, ".md") {
|
||||
err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if d.IsDir() || !strings.HasSuffix(path, ".md") {
|
||||
return nil
|
||||
}
|
||||
index[strings.TrimSuffix(path.Base(rel), ".md")] = struct{}{}
|
||||
rel, err := filepath.Rel(brainDir, path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rel = filepath.ToSlash(rel)
|
||||
index[strings.TrimSuffix(filepath.Base(rel), ".md")] = struct{}{}
|
||||
index[strings.TrimPrefix(strings.TrimSuffix(rel, ".md"), "wiki/")] = struct{}{}
|
||||
return nil
|
||||
}, func(rel string, err error) {
|
||||
// A linked tree that is not a real directory (a symlink, a
|
||||
// file) is skipped, as filepath.WalkDir did: this runs before
|
||||
// every brain_write, and an error here loses the learning.
|
||||
if rel == dir && errors.Is(err, brainfs.ErrNotRegular) {
|
||||
slog.Warn("link check: skipping a linked tree that is not a real directory", "dir", dir)
|
||||
return
|
||||
}
|
||||
if walkErr == nil {
|
||||
walkErr = fmt.Errorf("%s: %w", rel, err)
|
||||
}
|
||||
})
|
||||
if err == nil {
|
||||
err = walkErr
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("walk %s: %w", dir, err)
|
||||
}
|
||||
|
||||
@@ -4,9 +4,12 @@ import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// seeAlsoHeader is the markdown heading used to group cross-wing links.
|
||||
@@ -197,6 +200,12 @@ func fileExists(p string) bool {
|
||||
// section headers. Rejects same-wing pairs (a tunnel is by definition
|
||||
// cross-wing) and missing notes.
|
||||
func WriteTunnel(brainDir, sourcePath, targetPath string) error {
|
||||
if err := checkNotePath(sourcePath); err != nil {
|
||||
return fmt.Errorf("source: %w", err)
|
||||
}
|
||||
if err := checkNotePath(targetPath); err != nil {
|
||||
return fmt.Errorf("target: %w", err)
|
||||
}
|
||||
srcWing, err := wingOf(sourcePath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("source: %w", err)
|
||||
@@ -209,20 +218,50 @@ func WriteTunnel(brainDir, sourcePath, targetPath string) error {
|
||||
return fmt.Errorf("tunnel must cross wings; got both in %q", srcWing)
|
||||
}
|
||||
|
||||
srcFull := filepath.Join(brainDir, filepath.FromSlash(sourcePath))
|
||||
tgtFull := filepath.Join(brainDir, filepath.FromSlash(targetPath))
|
||||
if _, err := os.Stat(srcFull); err != nil {
|
||||
// Both notes are read and rewritten through the brain root, regular
|
||||
// files only: brain_tunnel passes caller-supplied paths, and the brain is
|
||||
// a Syncthing folder that can hold symlinks.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
srcContent, err := bfs.ReadRegular(sourcePath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("source note: %w", err)
|
||||
}
|
||||
if _, err := os.Stat(tgtFull); err != nil {
|
||||
tgtContent, err := bfs.ReadRegular(targetPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("target note: %w", err)
|
||||
}
|
||||
|
||||
if err := appendSeeAlso(srcFull, wikilinkOf(targetPath)); err != nil {
|
||||
if out, changed, err := withSeeAlso(srcContent, wikilinkOf(targetPath)); err != nil {
|
||||
return fmt.Errorf("update source: %w", err)
|
||||
} else if changed {
|
||||
if err := bfs.WriteRegular(sourcePath, out); err != nil {
|
||||
return fmt.Errorf("update source: %w", err)
|
||||
}
|
||||
}
|
||||
if err := appendSeeAlso(tgtFull, wikilinkOf(sourcePath)); err != nil {
|
||||
if out, changed, err := withSeeAlso(tgtContent, wikilinkOf(sourcePath)); err != nil {
|
||||
return fmt.Errorf("update target: %w", err)
|
||||
} else if changed {
|
||||
if err := bfs.WriteRegular(targetPath, out); err != nil {
|
||||
return fmt.Errorf("update target: %w", err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// checkNotePath accepts only a clean, local wiki/<wing>/<hall>/.../<slug>.md
|
||||
// path: no "." or ".." segments, no empty segments, no leading slash.
|
||||
func checkNotePath(p string) error {
|
||||
if p == "" || path.Clean(p) != p || !filepath.IsLocal(p) || !strings.HasSuffix(p, ".md") {
|
||||
return fmt.Errorf("not a clean wiki note path: %q", p)
|
||||
}
|
||||
for _, part := range strings.Split(p, "/") {
|
||||
if part == "" || part == "." || part == ".." {
|
||||
return fmt.Errorf("not a clean wiki note path: %q", p)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -248,16 +287,13 @@ func wingOf(relPath string) (string, error) {
|
||||
return parts[1], nil
|
||||
}
|
||||
|
||||
// appendSeeAlso inserts `- [[link]]` under the file's See also section,
|
||||
// creating the section if absent. No-op when the link is already present.
|
||||
func appendSeeAlso(filePath, link string) error {
|
||||
content, err := os.ReadFile(filePath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// withSeeAlso returns content with `- [[link]]` under its See also section,
|
||||
// creating the section if absent. changed is false when the link is already
|
||||
// present.
|
||||
func withSeeAlso(content []byte, link string) (out []byte, changed bool, err error) {
|
||||
wikilink := "[[" + link + "]]"
|
||||
if strings.Contains(string(content), wikilink) {
|
||||
return nil
|
||||
return content, false, nil
|
||||
}
|
||||
|
||||
bullet := "- " + wikilink
|
||||
@@ -266,8 +302,7 @@ func appendSeeAlso(filePath, link string) error {
|
||||
// No section yet — append a fresh one. Always emit a trailing
|
||||
// newline so subsequent appends don't merge into the previous line.
|
||||
trimmed := strings.TrimRight(string(content), "\n")
|
||||
out := trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"
|
||||
return os.WriteFile(filePath, []byte(out), 0o644)
|
||||
return []byte(trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"), true, nil
|
||||
}
|
||||
|
||||
// Section exists — splice the bullet in just before the next `## `
|
||||
@@ -293,12 +328,11 @@ func appendSeeAlso(filePath, link string) error {
|
||||
b.WriteByte('\n')
|
||||
}
|
||||
if err := scanner.Err(); err != nil {
|
||||
return err
|
||||
return nil, false, err
|
||||
}
|
||||
if !inserted {
|
||||
// section was the last thing in the file — just append bullet
|
||||
out := strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"
|
||||
return os.WriteFile(filePath, []byte(out), 0o644)
|
||||
return []byte(strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"), true, nil
|
||||
}
|
||||
return os.WriteFile(filePath, []byte(b.String()), 0o644)
|
||||
return []byte(b.String()), true, nil
|
||||
}
|
||||
|
||||
@@ -0,0 +1,141 @@
|
||||
package brain_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
)
|
||||
|
||||
// brain_tunnel passes caller-supplied source and target paths to WriteTunnel,
|
||||
// which checked only "wiki/<wing>/..." and then joined them onto the brain
|
||||
// dir: ".." segments resolved outside the brain and appendSeeAlso rewrote the
|
||||
// file there.
|
||||
func TestWriteTunnelRefusesATargetThatTraversesOutOfTheBrain(t *testing.T) {
|
||||
brain0 := t.TempDir()
|
||||
src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
|
||||
require.NoError(t, os.WriteFile(src, []byte("---\ntitle: S\n---\nbody\n"), 0o644))
|
||||
victim := filepath.Join(t.TempDir(), "victim.md")
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
|
||||
up := strings.Repeat("../", strings.Count(filepath.Clean(brain0), "/")+3)
|
||||
target := "wiki/b/x/" + up + strings.TrimPrefix(victim, "/")
|
||||
err := brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target)
|
||||
assert.Error(t, err)
|
||||
got, rerr := os.ReadFile(victim)
|
||||
require.NoError(t, rerr)
|
||||
assert.Equal(t, "untouched\n", string(got), "a file outside the brain was modified")
|
||||
}
|
||||
|
||||
func TestWriteTunnelRefusesUncleanOrNonWikiPaths(t *testing.T) {
|
||||
brain0 := t.TempDir()
|
||||
for _, p := range []string{"wiki/a/facts/s.md", "wiki/b/facts/t.md", "wiki/b/facts/t.txt", "raw/r.md"} {
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(filepath.Join(brain0, p)), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brain0, p), []byte("x\n"), 0o644))
|
||||
}
|
||||
for _, target := range []string{
|
||||
"wiki/b/facts/../../../raw/r.md",
|
||||
"wiki/b/./facts/t.md",
|
||||
"wiki/b//facts/t.md",
|
||||
"/wiki/b/facts/t.md",
|
||||
"wiki/b/facts/t.txt",
|
||||
"wiki/b/facts/",
|
||||
} {
|
||||
assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target), target)
|
||||
}
|
||||
for _, p := range []string{"raw/r.md", "wiki/b/facts/t.txt"} {
|
||||
got, err := os.ReadFile(filepath.Join(brain0, p))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "x\n", string(got), p)
|
||||
}
|
||||
require.NoError(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"), "positive control")
|
||||
got, err := os.ReadFile(filepath.Join(brain0, "wiki", "b", "facts", "t.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "[[a/facts/s]]")
|
||||
}
|
||||
|
||||
func TestWriteTunnelDoesNotWriteThroughASymlinkedNote(t *testing.T) {
|
||||
brain0 := t.TempDir()
|
||||
src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
|
||||
require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
|
||||
tdir := filepath.Join(brain0, "wiki", "b", "facts")
|
||||
require.NoError(t, os.MkdirAll(tdir, 0o755))
|
||||
victim := filepath.Join(t.TempDir(), "victim.md")
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(victim, filepath.Join(tdir, "t.md")))
|
||||
assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"))
|
||||
got, err := os.ReadFile(victim)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "untouched\n", string(got))
|
||||
|
||||
// The same with a link to a file elsewhere in the brain, which os.Root
|
||||
// would follow.
|
||||
inVictim := filepath.Join(brain0, "raw", "v.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(inVictim), 0o755))
|
||||
require.NoError(t, os.WriteFile(inVictim, []byte("untouched\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "v.md"), filepath.Join(tdir, "u.md")))
|
||||
assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/u.md"))
|
||||
got, err = os.ReadFile(inVictim)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "untouched\n", string(got))
|
||||
got, err = os.ReadFile(src)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "x\n", string(got), "the source is not touched when the target is refused")
|
||||
}
|
||||
|
||||
// The target is swapped between a regular note and a symlink to an in-brain
|
||||
// file outside wiki/ while WriteTunnel runs: the read and the write each
|
||||
// refuse a symlink, so the other file is never rewritten.
|
||||
func TestWriteTunnelNeverRewritesASymlinkSwappedInForTheTarget(t *testing.T) {
|
||||
brain0 := t.TempDir()
|
||||
src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
|
||||
require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
|
||||
tdir := filepath.Join(brain0, "wiki", "b", "facts")
|
||||
require.NoError(t, os.MkdirAll(tdir, 0o755))
|
||||
victim := filepath.Join(brain0, "raw", "victim.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
tgt := filepath.Join(tdir, "t.md")
|
||||
require.NoError(t, os.WriteFile(tgt, []byte("t\n"), 0o644))
|
||||
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
tmp := tgt + ".swap"
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
_ = os.Remove(tmp)
|
||||
if i%2 == 0 {
|
||||
_ = os.WriteFile(tmp, []byte("t\n"), 0o644)
|
||||
} else {
|
||||
_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
|
||||
}
|
||||
_ = os.Rename(tmp, tgt)
|
||||
}
|
||||
}()
|
||||
ok := 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
if brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md") == nil {
|
||||
ok++
|
||||
}
|
||||
_ = os.WriteFile(src, []byte("x\n"), 0o644)
|
||||
}
|
||||
stop.Store(true)
|
||||
wg.Wait()
|
||||
got, err := os.ReadFile(victim)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "untouched\n", string(got), "the swapped-in symlink's target was rewritten")
|
||||
assert.Positive(t, ok, "positive control: some tunnels were written to the regular target")
|
||||
}
|
||||
@@ -104,27 +104,6 @@ func (b *Brain) ReadDirRegular(relDir string) ([]string, error) {
|
||||
return names, nil
|
||||
}
|
||||
|
||||
// ReadDirDirs lists the real subdirectories directly in a brain-relative
|
||||
// directory, by name. Every component of relDir must be a real directory
|
||||
// (ErrNotRegular otherwise); symlinks to directories are left out.
|
||||
func (b *Brain) ReadDirDirs(relDir string) ([]string, error) {
|
||||
relDir = filepath.ToSlash(relDir)
|
||||
if err := b.realDir(relDir); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ents, err := fs.ReadDir(b.root.FS(), relDir)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var names []string
|
||||
for _, e := range ents {
|
||||
if e.Type().IsDir() {
|
||||
names = append(names, e.Name())
|
||||
}
|
||||
}
|
||||
return names, nil
|
||||
}
|
||||
|
||||
// ReadRegular reads a brain-relative path, refusing anything that is not a
|
||||
// regular file, both before the open and on the opened handle.
|
||||
func (b *Brain) ReadRegular(rel string) ([]byte, error) {
|
||||
@@ -249,3 +228,41 @@ func (b *Brain) WalkRegular(relDir string, fn func(rel string) error, onErr func
|
||||
return fn(p)
|
||||
})
|
||||
}
|
||||
|
||||
// WriteRegular replaces the contents of an existing regular file at a
|
||||
// brain-relative path. It never creates a file and never writes through a
|
||||
// final symlink: os.Root.OpenFile follows an in-root final symlink even with
|
||||
// O_NOFOLLOW (verified on go1.27), so the path is Lstat-ed through the root
|
||||
// first and the opened handle must be that same file (os.SameFile), which
|
||||
// also catches a swap between the two. O_NONBLOCK keeps a FIFO from blocking
|
||||
// the open. Intermediate in-brain symlinks are still followed (os.Root keeps
|
||||
// the write inside the brain; hyperguild#167).
|
||||
func (b *Brain) WriteRegular(rel string, data []byte) error {
|
||||
rel = filepath.ToSlash(rel)
|
||||
lfi, err := b.root.Lstat(rel)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !lfi.Mode().IsRegular() {
|
||||
return fmt.Errorf("%s: %w", rel, ErrNotRegular)
|
||||
}
|
||||
f, err := b.root.OpenFile(rel, os.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
fi, err := f.Stat()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !fi.Mode().IsRegular() || !os.SameFile(lfi, fi) {
|
||||
return fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
|
||||
}
|
||||
if err := f.Truncate(0); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := f.Write(data); err != nil {
|
||||
return err
|
||||
}
|
||||
return f.Close()
|
||||
}
|
||||
|
||||
@@ -263,20 +263,48 @@ func TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink(t *testing.
|
||||
assert.Positive(t, ok, "positive control: the regular file is read")
|
||||
}
|
||||
|
||||
func TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents(t *testing.T) {
|
||||
func TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "real"), 0o755))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "other"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "other"), filepath.Join(dir, "a", "linked")))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "f.md"), []byte("f"), 0o644))
|
||||
require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
|
||||
outside := filepath.Join(t.TempDir(), "o.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("untouched"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
|
||||
require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "f.md"), 0o644))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "n.md"), []byte("old content"), 0o644))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
|
||||
names, err := b.ReadDirDirs("a")
|
||||
assert.Error(t, b.WriteRegular("l.md", []byte("x")))
|
||||
got, _ := os.ReadFile(outside)
|
||||
assert.Equal(t, "untouched", string(got))
|
||||
|
||||
// A symlink to another file inside the brain: os.Root would allow it,
|
||||
// only O_NOFOLLOW refuses it.
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "in.md"), []byte("inside"), 0o644))
|
||||
require.NoError(t, os.Symlink("in.md", filepath.Join(dir, "il.md")))
|
||||
assert.Error(t, b.WriteRegular("il.md", []byte("x")))
|
||||
got, _ = os.ReadFile(filepath.Join(dir, "in.md"))
|
||||
assert.Equal(t, "inside", string(got))
|
||||
|
||||
// A reader held open, so a non-blocking write open would succeed. The
|
||||
// Lstat type check refuses the FIFO first; the handle check and
|
||||
// O_NONBLOCK matter only if it is swapped in after the Lstat.
|
||||
r, err := os.OpenFile(filepath.Join(dir, "f.md"), os.O_RDONLY|syscall.O_NONBLOCK, 0)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"real"}, names)
|
||||
_, err = b.ReadDirDirs("alias")
|
||||
assert.ErrorIs(t, err, ErrNotRegular)
|
||||
defer func() { _ = r.Close() }()
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- b.WriteRegular("f.md", []byte("x")) }()
|
||||
select {
|
||||
case err := <-done:
|
||||
assert.Error(t, err)
|
||||
case <-time.After(3 * time.Second):
|
||||
t.Fatal("WriteRegular hung on a FIFO")
|
||||
}
|
||||
|
||||
assert.Error(t, b.WriteRegular("../"+filepath.Base(filepath.Dir(outside))+"/o.md", []byte("x")))
|
||||
assert.Error(t, b.WriteRegular("missing.md", []byte("x")), "does not create files")
|
||||
|
||||
require.NoError(t, b.WriteRegular("n.md", []byte("new")))
|
||||
got, _ = os.ReadFile(filepath.Join(dir, "n.md"))
|
||||
assert.Equal(t, "new", string(got), "truncated and rewritten")
|
||||
}
|
||||
|
||||
@@ -0,0 +1,92 @@
|
||||
package session
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// session_log passed the caller's session_id straight into
|
||||
// filepath.Join(sessionsDir, id+".jsonl") and opened it O_CREATE|O_APPEND:
|
||||
// path segments in the id created or appended files anywhere the pod could
|
||||
// write. The id is now a plain name, and the open does not follow a final
|
||||
// symlink.
|
||||
func TestAppendRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
dir := filepath.Join(root, "sessions")
|
||||
for _, id := range []string{"../x", "a/b", "/abs", ".", "..", ".hidden", "", "a\\b", "a\x00b"} {
|
||||
assert.Error(t, Append(dir, id, Entry{SessionID: id}), "%q", id)
|
||||
}
|
||||
ents, _ := os.ReadDir(root)
|
||||
for _, e := range ents {
|
||||
assert.Equal(t, "sessions", e.Name(), "nothing created beside the sessions dir")
|
||||
}
|
||||
for _, id := range []string{"1557b2e1-bf0d-5c4f-bbe3-0754d087e356", "_routing", "2026-05-05-infra.plan", "0"} {
|
||||
require.NoError(t, Append(dir, id, Entry{SessionID: id}), "positive control: %q", id)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppendDoesNotWriteThroughASymlinkedLog(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
dir := filepath.Join(root, "sessions")
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
victim := filepath.Join(root, "victim.md")
|
||||
require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "victim.md"), filepath.Join(dir, "s.jsonl")))
|
||||
assert.Error(t, Append(dir, "s", Entry{SessionID: "s"}))
|
||||
got, _ := os.ReadFile(victim)
|
||||
assert.Equal(t, "untouched\n", string(got))
|
||||
}
|
||||
|
||||
func TestReadRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(root, "x.jsonl"), []byte(`{"session_id":"x"}`+"\n"), 0o644))
|
||||
_, err := Read(filepath.Join(root, "sessions"), "../x")
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
// A name that starts plainly and then climbs out with ".." is exactly what the
|
||||
// ban on "/" in the id's tail stops: filepath.Join cleans "a/../../x" to a
|
||||
// path beside the sessions dir without needing sessions/a to exist. The
|
||||
// assertion is on the refusal itself (ErrInvalidID), not on any error.
|
||||
func TestAppendRefusesAnIDThatClimbsOutAfterAPlainPrefix(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
dir := filepath.Join(root, "sessions")
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
for _, id := range []string{"a/../../escape", "a/../../../escape", "a/../b"} {
|
||||
err := Append(dir, id, Entry{SessionID: id})
|
||||
assert.ErrorIs(t, err, ErrInvalidID, "%q", id)
|
||||
}
|
||||
_, err := os.Lstat(filepath.Join(root, "escape.jsonl"))
|
||||
assert.True(t, errors.Is(err, os.ErrNotExist), "nothing created beside the sessions dir")
|
||||
_, err = os.Lstat(filepath.Join(dir, "b.jsonl"))
|
||||
assert.True(t, errors.Is(err, os.ErrNotExist), "no in-dir alias created either")
|
||||
}
|
||||
|
||||
// Append does no Lstat type check, so O_NONBLOCK is the only thing that keeps
|
||||
// a FIFO named <id>.jsonl with no reader from blocking session_log forever.
|
||||
func TestAppendReturnsPromptlyOnAFIFOLogWithNoReader(t *testing.T) {
|
||||
dir := filepath.Join(t.TempDir(), "sessions")
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
fifo := filepath.Join(dir, "s.jsonl")
|
||||
require.NoError(t, syscall.Mkfifo(fifo, 0o644))
|
||||
done := make(chan error, 1)
|
||||
go func() { done <- Append(dir, "s", Entry{SessionID: "s"}) }()
|
||||
select {
|
||||
case err := <-done:
|
||||
assert.Error(t, err, "a FIFO with no reader is refused, not written")
|
||||
case <-time.After(3 * time.Second):
|
||||
// Unblock the stuck open so the goroutine and TempDir cleanup finish.
|
||||
if r, err := os.OpenFile(fifo, os.O_RDONLY|syscall.O_NONBLOCK, 0); err == nil {
|
||||
defer r.Close() //nolint:errcheck
|
||||
}
|
||||
<-done
|
||||
t.Fatal("Append blocked on a FIFO log with no reader")
|
||||
}
|
||||
}
|
||||
@@ -9,6 +9,8 @@ import (
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
@@ -42,13 +44,32 @@ type Attempt struct {
|
||||
RunnerOutput string `json:"runner_output,omitempty"`
|
||||
}
|
||||
|
||||
// idPattern is a plain file name: session_log takes the id from the caller,
|
||||
// and a path segment in it created or appended files anywhere the pod could
|
||||
// write (hyperguild#169).
|
||||
var idPattern = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$`)
|
||||
|
||||
// ErrInvalidID is returned when a session id is not a plain file name.
|
||||
var ErrInvalidID = errors.New("session id is not a plain name")
|
||||
|
||||
func checkID(sessionID string) error {
|
||||
if !idPattern.MatchString(sessionID) {
|
||||
return fmt.Errorf("%w: %q", ErrInvalidID, sessionID)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Append writes entry as a single JSON line to sessionsDir/{sessionID}.jsonl.
|
||||
// The open does not follow a final symlink.
|
||||
func Append(sessionsDir, sessionID string, entry Entry) error {
|
||||
if err := checkID(sessionID); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(sessionsDir, 0o755); err != nil {
|
||||
return fmt.Errorf("create sessions dir: %w", err)
|
||||
}
|
||||
path := filepath.Join(sessionsDir, sessionID+".jsonl")
|
||||
f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
|
||||
f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open session log: %w", err)
|
||||
}
|
||||
@@ -70,6 +91,9 @@ func Append(sessionsDir, sessionID string, entry Entry) error {
|
||||
|
||||
// Read returns all entries for sessionID. Returns empty slice if no log exists.
|
||||
func Read(sessionsDir, sessionID string) ([]Entry, error) {
|
||||
if err := checkID(sessionID); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
path := filepath.Join(sessionsDir, sessionID+".jsonl")
|
||||
f, err := os.Open(path)
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
|
||||
Reference in New Issue
Block a user