mathiasandClaude Opus 5.5
eedb110be5
Ingest pipeline readers (readSourcePage and loadSchema feed the LLM prompt; reviseOrCreate; injectSourceRefs; BackfillRefs list and reads) and classification.Load read through brainfs: symlinked or special files no longer reach the prompt, written pages or the I1 sovereignty config, and a FIFO no longer hangs ingest or startup. A symlinked/special classification.yaml is a hard error; an absent one still yields defaults. Refs #157. Adversarial review: BLOCKED, BLOCKED, PASS. Follow-ups: #158 (write paths), #179 (FIFO tripwire). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Mathias <mthbqv@gmail.com>
47 lines
1.5 KiB
Go
47 lines
1.5 KiB
Go
package classification
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// hyperguild#157 slice 6: Load read classification.yaml with os.ReadFile. It
|
|
// sets the I1 sovereignty levels; a symlinked file must not be trusted as the
|
|
// config (a hard error, as for a malformed file), and a FIFO must not hang
|
|
// startup.
|
|
func TestLoadRefusesASymlinkedOrFIFOClassificationFile(t *testing.T) {
|
|
ok := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(ok, "classification.yaml"), []byte("wings:\n w: confidential\n"), 0o644))
|
|
_, err := Load(ok)
|
|
require.NoError(t, err, "positive control")
|
|
|
|
linked := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(linked, "real.yaml"), []byte("wings:\n w: public\n"), 0o644))
|
|
require.NoError(t, os.Symlink("real.yaml", filepath.Join(linked, "classification.yaml")))
|
|
_, err = Load(linked)
|
|
assert.Error(t, err, "an in-brain symlink is not trusted as the config")
|
|
|
|
fifo := t.TempDir()
|
|
require.NoError(t, syscall.Mkfifo(filepath.Join(fifo, "classification.yaml"), 0o644))
|
|
w, err := os.OpenFile(filepath.Join(fifo, "classification.yaml"), os.O_RDWR, 0)
|
|
require.NoError(t, err)
|
|
defer func() { _ = w.Close() }()
|
|
done := make(chan error, 1)
|
|
go func() { _, err := Load(fifo); done <- err }()
|
|
select {
|
|
case err := <-done:
|
|
assert.Error(t, err)
|
|
case <-time.After(3 * time.Second):
|
|
t.Fatal("Load hung on a FIFO")
|
|
}
|
|
|
|
_, err = Load(t.TempDir())
|
|
assert.NoError(t, err, "an absent file is still not an error")
|
|
}
|