mathiasandClaude Opus 5.5
f969d97c16
Review of #172 (finding 1): notes.ReadScoped (brain_read, slice 2) had only outside-brain targets, which os.Root refuses on its own, so a reader bypassing brainfs's Lstat/SameFile stayed green. Adds a static in-brain link, a positive control and an in-brain swap race. Flip: replacing ReadRegularMax with os.OpenRoot().ReadFile turns it red 3/3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.7 KiB
Go
69 lines
2.7 KiB
Go
package notes
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
|
)
|
|
|
|
// hyperguild#157 slice 2: ReadScoped (brain_read) Lstat-checked the final
|
|
// component, then reopened by name with os.ReadFile: a swap after the check
|
|
// was followed, and a FIFO blocked the read. It now reads through brainfs.
|
|
func TestReadScopedRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
|
|
brain := t.TempDir()
|
|
facts := filepath.Join(brain, "wiki", "w", "facts")
|
|
require.NoError(t, os.MkdirAll(facts, 0o755))
|
|
p := filepath.Join(facts, "r.md")
|
|
read := func() string {
|
|
b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
|
|
return string(b)
|
|
}
|
|
require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
|
|
assert.Equal(t, "inside", read())
|
|
brainfstest.AssertNoLeak(t, p, "inside", 1500*time.Millisecond, read)
|
|
brainfstest.AssertNoHang(t, p, "inside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
|
}
|
|
|
|
func TestReadScopedRefusesANoteOverMaxNoteBytes(t *testing.T) {
|
|
brain := t.TempDir()
|
|
facts := filepath.Join(brain, "wiki", "w", "facts")
|
|
require.NoError(t, os.MkdirAll(facts, 0o755))
|
|
require.NoError(t, os.WriteFile(filepath.Join(facts, "big.md"), make([]byte, maxNoteBytes+1), 0o644))
|
|
_, err := ReadScoped(brain, "wiki/w/facts/big.md", ScopeNotes)
|
|
assert.ErrorIs(t, err, ErrTooLarge)
|
|
}
|
|
|
|
// hyperguild#171 (review of #172, finding 1): os.Root alone refuses links that
|
|
// leave the brain, so the outside-target race above stays green for a reader
|
|
// that skips brainfs's Lstat and SameFile checks. An in-brain target (raw/,
|
|
// outside ScopeNotes) is what tells them apart.
|
|
func TestReadScopedDoesNotReturnAnInBrainSymlinkTargetStaticallyOrDuringASampledSwapRace(t *testing.T) {
|
|
brain := t.TempDir()
|
|
facts := filepath.Join(brain, "wiki", "w", "facts")
|
|
require.NoError(t, os.MkdirAll(facts, 0o755))
|
|
target := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
|
|
|
|
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
|
|
b, err := ReadScoped(brain, "wiki/w/facts/inlink.md", ScopeNotes)
|
|
assert.Error(t, err, "static in-brain link")
|
|
assert.NotContains(t, string(b), brainfstest.Sentinel, "static in-brain link")
|
|
|
|
p := filepath.Join(facts, "r.md")
|
|
require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
|
|
b, err = ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "inside", string(b), "positive control: a regular note reads")
|
|
|
|
read := func() string {
|
|
b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
|
|
return string(b)
|
|
}
|
|
brainfstest.AssertNoLeakFrom(t, p, "inside", target, 1500*time.Millisecond, read)
|
|
}
|