hyperguild/ingestion/internal/search/brainroot_test.go

package search

import (
	"os"
	"path/filepath"
	"strings"
	"sync"
	"sync/atomic"
	"syscall"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
)

// hyperguild#157 option 1: search walked and read the brain by path, so a
// symlink anywhere in the Syncthing-shared brain dir (wiki/<w>/<h>/leak.md ->
// /any/file) put the target's contents in brain_query results (reproduced in
// the PR #156 review). Search now walks and reads through an os.Root on the
// brain dir and only reads regular files.

const sentinel157 = "zqsentinelonefiftyseven"

func searchBrain(t *testing.T) (brain, facts, outside string) {
	t.Helper()
	brain = t.TempDir()
	facts = filepath.Join(brain, "wiki", "w", "facts")
	require.NoError(t, os.MkdirAll(facts, 0o755))
	require.NoError(t, os.MkdirAll(filepath.Join(brain, "knowledge"), 0o755))
	outside = filepath.Join(t.TempDir(), "secret.md")
	require.NoError(t, os.WriteFile(outside, []byte("# secret\n\n"+sentinel157), 0o644))
	return brain, facts, outside
}

func leaked(rs []Result) int {
	n := 0
	for _, r := range rs {
		n += strings.Count(r.Excerpt+r.Title, sentinel157)
	}
	return n
}

func TestQueryDoesNotFollowASymlinkInTheWiki(t *testing.T) {
	brain, facts, outside := searchBrain(t)
	require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
	require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("# real\n\nzqrealnote"), 0o644))
	rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
	require.NoError(t, err)
	assert.Zero(t, leaked(rs))
	rs, err = Query(brain, QueryOptions{Query: "zqrealnote", Limit: 10})
	require.NoError(t, err)
	assert.Len(t, rs, 1, "regular notes are still found")
}

func TestQueryDoesNotFollowASymlinkedDirectory(t *testing.T) {
	brain, _, outside := searchBrain(t)
	require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(brain, "wiki", "linked")))
	rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
	require.NoError(t, err)
	assert.Zero(t, leaked(rs))
}

// A search root that is a symlink staying inside the brain (wiki/<w> -> ..)
// was followed by fs.WalkDir, aliasing raw/ and root files into results
// (PR #166 review). The root is now Lstat-checked and skipped.
func TestQueryDoesNotFollowASymlinkedWingRootInsideTheBrain(t *testing.T) {
	brain, _, _ := searchBrain(t)
	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("# r\n\nzqrawonly"), 0o644))
	require.NoError(t, os.Symlink("..", filepath.Join(brain, "wiki", "alias")))
	rs, err := Query(brain, QueryOptions{Query: "zqrawonly", Wing: "alias", Limit: 10})
	require.NoError(t, err)
	assert.Empty(t, rs)
}

// With a hall the search root is wiki/<wing>/<hall>; a symlinked <wing> with
// a real <hall> directory under its target was followed (PR #166 round 2).
func TestQueryDoesNotFollowASymlinkedWingUnderAWingAndHallRoot(t *testing.T) {
	brain, _, _ := searchBrain(t)
	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw", "facts"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "facts", "r.md"), []byte("# r\n\nzqrawhall"), 0o644))
	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(brain, "wiki", "alias")))
	rs, err := Query(brain, QueryOptions{Query: "zqrawhall", Wing: "alias", Hall: "facts", Limit: 10})
	require.NoError(t, err)
	assert.Empty(t, rs)
}

// swapInto keeps renaming a regular note, and either a symlink to outside or
// a FIFO, into path. Each FIFO has a writer held open (as any local process
// can): a FIFO with no writer reads EOF at once, which would let a reader
// that skips the handle check pass (PR #161 round 2: with a held writer, a
// bypass of readOpened hung Query after 5 iterations).
// startSwap runs swapInto until the test ends and waits for it before
// t.TempDir's cleanup (hyperguild#162).
// It returns the count of symlinks or FIFOs actually renamed into path
// (hyperguild#177: a swapper whose every swap fails tests nothing).
func startSwap(t *testing.T, path, outside string, fifo bool) *atomic.Int64 {
	t.Helper()
	var stop atomic.Bool
	var swaps atomic.Int64
	var wg sync.WaitGroup
	wg.Add(1)
	go func() { defer wg.Done(); swapInto(path, outside, fifo, &stop, &swaps) }()
	t.Cleanup(func() { stop.Store(true); wg.Wait() })
	return &swaps
}

func swapInto(path, outside string, fifo bool, stop *atomic.Bool, swaps *atomic.Int64) {
	tmp := path + ".swap"
	// Writers stay open until the swapper exits, so a reader parked on a
	// FIFO stays parked (closing one would hand the reader EOF and hide the
	// hang). Past the fd limit, new FIFOs simply have no writer.
	var writers []*os.File
	defer func() {
		for _, w := range writers {
			_ = w.Close()
		}
	}()
	for i := 0; !stop.Load(); i++ {
		_ = os.Remove(tmp)
		var made error
		switch {
		case i%2 == 0:
			_ = os.WriteFile(tmp, []byte("# r\n\nzqinside "+"zqracenote"), 0o644)
		case fifo:
			if made = syscall.Mkfifo(tmp, 0o644); made == nil {
				if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
					writers = append(writers, w)
				}
			}
		default:
			made = os.Symlink(outside, tmp)
		}
		if err := os.Rename(tmp, path); err == nil && made == nil && i%2 == 1 {
			swaps.Add(1)
		}
	}
}

func TestQueryLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
	brain, facts, outside := searchBrain(t)
	swaps := startSwap(t, filepath.Join(facts, "r.md"), outside, false)
	leaks, iters, insideReads := 0, 0, 0
	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
		rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
		require.NoError(t, err)
		leaks += leaked(rs)
		// Positive control (hyperguild#177): a Query that always errors
		// returns nothing and so never leaks.
		rs, err = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
		require.NoError(t, err)
		if len(rs) > 0 {
			insideReads++
		}
	}
	if leaks > 0 {
		t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
	}
	require.Positive(t, swaps.Load(), "no symlink was swapped in: the race did not run")
	require.Positive(t, insideReads, "no Query returned the inside note")
}

func TestQueryDoesNotHangUnderAFIFOSwapRace(t *testing.T) {
	brain, facts, outside := searchBrain(t)
	startSwap(t, filepath.Join(facts, "r.md"), outside, true)
	done := make(chan struct{})
	go func() {
		for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
			_, _ = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
		}
		close(done)
	}()
	select {
	case <-done:
	case <-time.After(6 * time.Second):
		if f, err := os.OpenFile(filepath.Join(facts, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
			_ = f.Close()
		}
		t.Fatal("search hung on a swapped-in FIFO")
	}
}

// hydrate (vector-only hits) reads by relative path; it must refuse a symlink.
func TestHydrateRefusesASymlink(t *testing.T) {
	brain, facts, outside := searchBrain(t)
	require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
	r, err := hydrate(brain, "wiki/w/facts/leak.md")
	assert.Error(t, err)
	assert.NotContains(t, r.Excerpt, sentinel157)
}

// hyperguild#171: os.Root refuses links that leave the brain on its own, so
// the outside-target cases above would stay green for a caller that read
// without brainfs's Lstat and SameFile checks. These targets are inside the
// brain (raw/, which is not a search root).
func inBrainTarget(t *testing.T, brain string) string {
	t.Helper()
	return brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
}

func TestQueryDoesNotReturnAnInBrainSymlinkTargetDuringASampledSwapRace(t *testing.T) {
	brain, facts, _ := searchBrain(t)
	target := inBrainTarget(t, brain)
	read := func() string {
		// Both terms, so the regular note is a possible hit: a reader that
		// never returns the inside note would pass vacuously (#177 floor).
		rs, _ := Query(brain, QueryOptions{Query: brainfstest.Sentinel + " zqinside", Limit: 10})
		s := ""
		for _, r := range rs {
			s += r.Title + r.Excerpt
		}
		return s
	}
	brainfstest.AssertNoLeakFrom(t, filepath.Join(facts, "r.md"), "# r\n\nzqinside", target, 1500*time.Millisecond, read)
	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
	assert.NotContains(t, read(), brainfstest.Sentinel, "static in-brain link")
}

func TestHydrateRefusesAnInBrainSymlinkAndDoesNotReturnItsTargetDuringASampledSwapRace(t *testing.T) {
	brain, facts, _ := searchBrain(t)
	target := inBrainTarget(t, brain)
	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
	r, err := hydrate(brain, "wiki/w/facts/inlink.md")
	assert.Error(t, err)
	assert.NotContains(t, r.Excerpt+r.Title, brainfstest.Sentinel)

	p := filepath.Join(facts, "r.md")
	require.NoError(t, os.WriteFile(p, []byte("# r\n\nzqinside"), 0o644))
	r, err = hydrate(brain, "wiki/w/facts/r.md")
	require.NoError(t, err)
	assert.Contains(t, r.Excerpt, "zqinside", "positive control: a regular note hydrates")
	brainfstest.AssertNoLeakFrom(t, p, "# r\n\nzqinside", target, 1500*time.Millisecond, func() string {
		r, _ := hydrate(brain, "wiki/w/facts/r.md")
		return r.Title + r.Excerpt
	})
}