mirror of
https://github.com/Twigpine/node.git
synced 2026-11-08 17:55:53 -10:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 beardthelion
|
6cc97e48f2 | ||
|
beardthelion
|
02fba70bc6 | ||
|
beardthelion
|
a7257dce20 |
No files matched your search
+2
-2
@@ -156,8 +156,8 @@ GITLAWB_ENFORCE_OWNER_PUSH=true
|
||||
GITLAWB_P2P_BOOTSTRAP=
|
||||
|
||||
# ── Access control ────────────────────────────────────────────────────────
|
||||
# Reserved and currently inert. Repo reads are gated per repository by
|
||||
# is_public and path-scoped visibility rules; this flag changes nothing.
|
||||
# Reserved for private-read mode. Public/private repo read enforcement is not
|
||||
# wired in the current live release; do not rely on this for private repositories.
|
||||
GITLAWB_PUBLIC_READ=true
|
||||
|
||||
# Maximum git smart-HTTP pack request size, in bytes.
|
||||
|
||||
@@ -68,22 +68,6 @@ jobs:
|
||||
- name: Test release tag resolver
|
||||
run: scripts/test-resolve-release-tag.sh
|
||||
|
||||
triage-detector:
|
||||
name: triage detector matrix
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
# pr-triage.yml runs on pull_request_target and never checks out PR
|
||||
# code, so its inline detector can only be exercised here, where the
|
||||
# proposed workflow body IS the checked-out one.
|
||||
- name: Test inline-test detector
|
||||
run: node scripts/test-pr-triage-detect.mjs
|
||||
|
||||
test:
|
||||
name: test (${{ matrix.toolchain }})
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
@@ -76,221 +76,9 @@ jobs:
|
||||
// line after horizontal whitespace, covering bare, cfg(test), namespaced,
|
||||
// optional leading ::, and raw-identifier (r#test) forms. No head-file fetch
|
||||
// or lexer: needs-tests is advisory, not a merge gate.
|
||||
//
|
||||
// The final path component may also carry `test` as an underscore-delimited
|
||||
// segment, so third-party harnesses land without enumerating them one by one
|
||||
// (#[test_case(1)], #[wasm_bindgen_test]). It is deliberately a segment and
|
||||
// not a substring: a substring would also match #[contest] / #[latest], and a
|
||||
// false positive here SUPPRESSES needs-tests rather than adding it. This
|
||||
// heuristic has to fail loud, because a wrongly labeled PR gets corrected by
|
||||
// the author while a wrongly cleared one is invisible. That trade costs the
|
||||
// no-underscore harness names (#[rstest]), which stay unmatched on purpose.
|
||||
//
|
||||
// The segment classes are [A-Za-z0-9]+ rather than \w+ on purpose, so that `_`
|
||||
// is only ever the literal delimiter. \w+ contains `_`, which makes the repeat
|
||||
// ambiguous and backtracks exponentially: on this workflow's pull_request_target
|
||||
// trigger f.patch is fork-controlled, so `#[test` followed by a long `_a` run is
|
||||
// a permissionless stall of the triage job.
|
||||
// Rust allows whitespace, line breaks, and comments between the
|
||||
// attribute path and ] or (. A flat regex cannot decide that
|
||||
// boundary: `//` runs to end of line, and block comments NEST, which
|
||||
// is beyond regular languages — every enumeration of comment
|
||||
// spellings so far has either dropped a legal separator (regressing
|
||||
// real tests into needs-tests) or let unrelated patch records
|
||||
// complete each other (clearing needs-tests from a testless PR, the
|
||||
// invisible direction). So the closer is found by a token-aware
|
||||
// scan instead: it consumes horizontal whitespace, `//`-to-newline,
|
||||
// and depth-counted `/* */` runs, and accepts only when the first
|
||||
// real token after the attribute path is `]` or `(`.
|
||||
//
|
||||
// Association is positional: the scan starts on the attribute's own
|
||||
// added line and may continue ONLY through the immediately following
|
||||
// added lines (a context line, hunk header, or removal breaks the
|
||||
// chain). Unrelated `]`/`(` lines elsewhere in the patch can never
|
||||
// complete a path they do not adjoin. The continuation is bounded;
|
||||
// past the bound the scan gives up and reports NO inline test, which
|
||||
// fails toward the loud label rather than the silent clearance.
|
||||
//
|
||||
// The detector body is fenced by the TRIAGE_DETECTOR markers so
|
||||
// scripts/test-pr-triage-detect.mjs can extract and run it against
|
||||
// the committed case matrix. Keep the fenced block self-contained.
|
||||
// TRIAGE_DETECTOR_BEGIN
|
||||
const TEST_ATTR_PATH =
|
||||
"(?:cfg[ \\t]*\\([ \\t]*test[ \\t]*\\)|(?:::[ \\t]*)?(?:[\\w-]+[ \\t]*::[ \\t]*)*(?:r#)?(?:[A-Za-z0-9]+_)*test(?:_[A-Za-z0-9]+)*)";
|
||||
// Anchored to the start of one added line; group 1 is whatever
|
||||
// follows the path on that line, handed to the separator scan.
|
||||
const TEST_ATTR_LINE = new RegExp(
|
||||
"^[ \\t]*#\\[[ \\t]*" + TEST_ATTR_PATH + "([\\s\\S]*)$"
|
||||
);
|
||||
// An attribute split across more added lines than this is not a
|
||||
// spelling anyone writes; refusing to scan further keeps the walk
|
||||
// linear in the patch and fails toward the loud label.
|
||||
const MAX_ATTR_CONTINUATION_LINES = 16;
|
||||
// segs[0] is the remainder of the attribute's own line; each later
|
||||
// entry is the text of one immediately following added line. True
|
||||
// only when the first non-separator token across them is ] or (.
|
||||
// Single forward pass, no backtracking: fork-controlled input.
|
||||
function attrCloserFollows(segs) {
|
||||
let depth = 0; // open block-comment nesting carried across lines
|
||||
for (const seg of segs) {
|
||||
let i = 0;
|
||||
while (i < seg.length) {
|
||||
if (depth > 0) {
|
||||
if (seg.startsWith("/*", i)) { depth += 1; i += 2; }
|
||||
else if (seg.startsWith("*/", i)) { depth -= 1; i += 2; }
|
||||
else { i += 1; }
|
||||
continue;
|
||||
}
|
||||
const c = seg[i];
|
||||
if (c === " " || c === "\t") { i += 1; continue; }
|
||||
if (seg.startsWith("//", i)) break; // comment to end of line
|
||||
if (seg.startsWith("/*", i)) { depth = 1; i += 2; continue; }
|
||||
return c === "]" || c === "(";
|
||||
}
|
||||
// Line exhausted inside separators; the newline is itself a
|
||||
// separator, so continue on the next added line.
|
||||
}
|
||||
return false; // out of adjoined lines (or bound hit): stay loud
|
||||
}
|
||||
// Before the candidate scan, a pre-pass walks added patch lines
|
||||
// tracking Rust lexical state: raw strings (r#*", br#*", cr#*"),
|
||||
// block comments (/* */ with nesting), regular strings ("...",
|
||||
// which can span newlines), and line comments (//). An added line
|
||||
// that starts inside any of these is skipped as a candidate,
|
||||
// because a #[test_case] appearing there is lexical non-code, not
|
||||
// a real test attribute. State is only tracked across consecutive
|
||||
// added lines and reset at any break (context line, removal,
|
||||
// hunk header): context lines carry a partial view of the file,
|
||||
// so a " or r#" or /* there might be inside a string that opened
|
||||
// before the hunk's visible window, and treating it as an opener
|
||||
// would mark every later added line as non-code (a false negative
|
||||
// on a real #[test]). The tradeoff is that a non-code region
|
||||
// opened by a context line is invisible: an added #[test] inside
|
||||
// an existing raw string or block comment is scanned as code and
|
||||
// may match (a false positive, silent direction). This is accepted
|
||||
// because (1) the old detector had the same behavior, (2) the
|
||||
// pattern is rare, and (3) needs-tests is advisory, not a merge
|
||||
// gate. Scanning context lines to close this gap would re-introduce
|
||||
// the false negative, which affects the far more common case of a
|
||||
// context line carrying a stray " from a string that opened before
|
||||
// the visible window. Single forward pass, O(n) in patch length.
|
||||
function patchAddsInlineTest(patch) {
|
||||
const lines = patch.split("\n");
|
||||
const nonCodeStart = new Set();
|
||||
let rawHashes = -1; // -1 = not in raw string; >=0 = # count
|
||||
let blockDepth = 0;
|
||||
let inString = false;
|
||||
for (let i = 0; i < lines.length; i++) {
|
||||
const line = lines[i];
|
||||
if (!line) continue;
|
||||
const prefix = line[0];
|
||||
// Only scan added lines. Context and removal lines carry
|
||||
// a partial view of the file: a " or r#" or /* on a context
|
||||
// line might be inside a string that opened before the
|
||||
// hunk's visible window, and treating it as an opener would
|
||||
// mark every later added line as non-code (a false negative
|
||||
// on a real #[test]). So lexical state is only tracked across
|
||||
// consecutive added lines and reset at any break. A non-code
|
||||
// region opened by a context line is invisible; the candidate
|
||||
// is still scanned, which fails toward the loud label.
|
||||
if (prefix !== "+") {
|
||||
rawHashes = -1; blockDepth = 0; inString = false;
|
||||
continue;
|
||||
}
|
||||
const text = line.slice(1);
|
||||
if (rawHashes >= 0 || blockDepth > 0 || inString)
|
||||
nonCodeStart.add(i);
|
||||
let j = 0;
|
||||
while (j < text.length) {
|
||||
if (rawHashes >= 0) {
|
||||
if (text[j] === '"') {
|
||||
let h = 1;
|
||||
while (h <= rawHashes && text[j + h] === "#") h++;
|
||||
if (h > rawHashes) { rawHashes = -1; j += h; continue; }
|
||||
}
|
||||
j += 1; continue;
|
||||
}
|
||||
if (blockDepth > 0) {
|
||||
if (text.startsWith("/*", j)) { blockDepth += 1; j += 2; }
|
||||
else if (text.startsWith("*/", j)) { blockDepth -= 1; j += 2; }
|
||||
else { j += 1; }
|
||||
continue;
|
||||
}
|
||||
if (inString) {
|
||||
if (text[j] === "\\") { j += 2; continue; }
|
||||
if (text[j] === '"') { inString = false; j += 1; continue; }
|
||||
j += 1; continue;
|
||||
}
|
||||
// Recognize Rust char and byte-char literals ('X', '\X',
|
||||
// '\u{...}', b'X') so their contents never open string or
|
||||
// comment state. A char literal has a closing ' within a
|
||||
// bounded distance; a lifetime or label ('a, 'static,
|
||||
// 'label:) does not, so it falls through as a regular char.
|
||||
// This is not a skip-to-next-' rule: the lookahead is 2-4
|
||||
// chars, or bounded to 20 for \u escapes (at most 6 hex
|
||||
// digits), never unbounded.
|
||||
if (text[j] === "'") {
|
||||
let k = j + 1;
|
||||
if (text[k] === "\\") {
|
||||
k += 1;
|
||||
if (text[k] === "u" && text[k + 1] === "{") {
|
||||
const uBound = k + 20;
|
||||
while (k < uBound && text[k] && text[k] !== "}") k++;
|
||||
if (text[k] === "}") k++;
|
||||
} else {
|
||||
k += 1;
|
||||
}
|
||||
} else {
|
||||
k += 1;
|
||||
}
|
||||
if (text[k] === "'") { j = k + 1; continue; }
|
||||
// lifetime or label: just skip the apostrophe
|
||||
}
|
||||
if (text[j] === '"') { inString = true; j += 1; continue; }
|
||||
if (text.startsWith("//", j)) break;
|
||||
if (text.startsWith("/*", j)) { blockDepth = 1; j += 2; continue; }
|
||||
const prev = j > 0 ? text[j - 1] : "";
|
||||
const isIdent = /[A-Za-z0-9_]/.test(prev);
|
||||
if (!isIdent && text[j] === "r") {
|
||||
let k = j + 1, h = 0;
|
||||
while (text[k + h] === "#") h++;
|
||||
if (text[k + h] === '"') {
|
||||
rawHashes = h; j = k + h + 1; continue;
|
||||
}
|
||||
}
|
||||
if (!isIdent && (text[j] === "b" || text[j] === "c") && text[j + 1] === "r") {
|
||||
let k = j + 2, h = 0;
|
||||
while (text[k + h] === "#") h++;
|
||||
if (text[k + h] === '"') {
|
||||
rawHashes = h; j = k + h + 1; continue;
|
||||
}
|
||||
}
|
||||
j += 1;
|
||||
}
|
||||
}
|
||||
for (let i = 0; i < lines.length; i++) {
|
||||
if (lines[i][0] !== "+") continue;
|
||||
if (nonCodeStart.has(i)) continue;
|
||||
const m = TEST_ATTR_LINE.exec(lines[i].slice(1));
|
||||
if (m === null) continue;
|
||||
const segs = [m[1]];
|
||||
for (
|
||||
let j = i + 1;
|
||||
j < lines.length &&
|
||||
lines[j][0] === "+" &&
|
||||
segs.length <= MAX_ATTR_CONTINUATION_LINES;
|
||||
j++
|
||||
) {
|
||||
segs.push(lines[j].slice(1));
|
||||
}
|
||||
if (attrCloserFollows(segs)) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
// TRIAGE_DETECTOR_END
|
||||
const addsInlineTest = files.some(
|
||||
f => f.filename.endsWith(".rs") && !!f.patch && patchAddsInlineTest(f.patch)
|
||||
);
|
||||
const addsInlineTest = files.some(f =>
|
||||
f.filename.endsWith(".rs") && f.patch &&
|
||||
/^\+[ \t]*#\[[ \t]*(?:cfg[ \t]*\([ \t]*test[ \t]*\)|(?:::[ \t]*)?(?:[\w-]+[ \t]*::[ \t]*)*(?:r#)?test\b)/m.test(f.patch));
|
||||
const touchedTests =
|
||||
names.some(n => n.includes("/tests/") || n.endsWith("_test.rs")) || addsInlineTest;
|
||||
if (changedRust && !touchedTests) want.add("needs-tests");
|
||||
|
||||
+34
-231
@@ -20,15 +20,7 @@ on:
|
||||
type: string
|
||||
|
||||
concurrency:
|
||||
# Not keyed on the ref: two runs racing `imagetools create` on the same
|
||||
# moving tags could interleave, so runs of this workflow serialize outright.
|
||||
# GitHub keeps at most one running and one pending run per group; a newer
|
||||
# queued run replaces the pending one, and cancel-in-progress: false
|
||||
# protects only the run already executing. So a backfill dispatched while a
|
||||
# release is running, followed by a push to main, is replaced silently: the
|
||||
# remedy is to re-dispatch it once the running release completes, which the
|
||||
# push-only gate on the moving-tag step makes safe in any ordering.
|
||||
group: release
|
||||
group: release-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
# Least privilege by default; every job opts in to exactly what it needs.
|
||||
@@ -45,7 +37,6 @@ jobs:
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
environment: release
|
||||
outputs:
|
||||
release_created: ${{ steps.release.outputs.release_created }}
|
||||
tag_name: ${{ steps.release.outputs.tag_name }}
|
||||
@@ -87,7 +78,6 @@ jobs:
|
||||
# dispatch the release PR's head carries no check runs and the --locked
|
||||
# gate never validates it.
|
||||
actions: write
|
||||
environment: release
|
||||
steps:
|
||||
# Prefer the fresh `pr` output when this run just created/updated the
|
||||
# release PR; otherwise fall back to querying for an open release-please
|
||||
@@ -225,7 +215,6 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
environment: release
|
||||
steps:
|
||||
- name: Check out workflow scripts
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
@@ -237,7 +226,6 @@ jobs:
|
||||
env:
|
||||
DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
|
||||
@@ -249,9 +237,7 @@ jobs:
|
||||
- name: Checkout release tag
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
# Pin the commit the resolver verified; a tag ref re-resolved here
|
||||
# could have been moved between resolve and checkout.
|
||||
ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
|
||||
ref: ${{ steps.rel.outputs.tag }}
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
@@ -326,7 +312,6 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
environment: release
|
||||
steps:
|
||||
- name: Check out workflow scripts
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
@@ -338,14 +323,9 @@ jobs:
|
||||
env:
|
||||
DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
|
||||
# ghcr requires a lowercase repository path, and unlike metadata-action,
|
||||
# buildx's `--output name=` does no lowercasing, so a mixed-case owner
|
||||
# makes the digest push fail with "invalid reference format".
|
||||
echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Download digests
|
||||
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
||||
@@ -365,80 +345,24 @@ jobs:
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Create and push multi-arch manifest
|
||||
id: manifest
|
||||
env:
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
IMAGE: ${{ steps.rel.outputs.image }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# The docker matrix pushes one digest per arch leg; anything else is
|
||||
# a broken set, not a smaller multi-arch image.
|
||||
count="$(find /tmp/digests -maxdepth 1 -type f | wc -l)"
|
||||
if [ "$count" -ne 2 ]; then
|
||||
echo "::error::expected 2 arch digests in /tmp/digests, found $count"
|
||||
exit 1
|
||||
fi
|
||||
# ghcr requires a lowercase repository path.
|
||||
IMAGE="ghcr.io/${GITHUB_REPOSITORY,,}"
|
||||
MAJOR_MINOR="${VERSION%.*}"
|
||||
digests=""
|
||||
for f in /tmp/digests/*; do
|
||||
d="$(basename "$f")"
|
||||
case "$d" in
|
||||
*[!0-9a-f]*)
|
||||
echo "::error::digest filename is not lowercase sha256 hex: $d"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
if [ "${#d}" -ne 64 ]; then
|
||||
echo "::error::digest is not 64 hex chars: $d"
|
||||
exit 1
|
||||
fi
|
||||
digests="$digests $IMAGE@sha256:$d"
|
||||
digests="$digests $IMAGE@sha256:$(basename "$f")"
|
||||
done
|
||||
# The immutable tag always publishes. The moving tags are applied by
|
||||
# the gated step below, which never runs on workflow_dispatch.
|
||||
# shellcheck disable=SC2086
|
||||
docker buildx imagetools create -t "$IMAGE:$VERSION" $digests
|
||||
docker buildx imagetools create \
|
||||
-t "$IMAGE:$VERSION" \
|
||||
-t "$IMAGE:$MAJOR_MINOR" \
|
||||
-t "$IMAGE:latest" \
|
||||
$digests
|
||||
docker buildx imagetools inspect "$IMAGE:$VERSION"
|
||||
echo "digests=${digests# }" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Move floating tags
|
||||
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
|
||||
env:
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
IMAGE: ${{ steps.rel.outputs.image }}
|
||||
DIGESTS: ${{ steps.manifest.outputs.digests }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
MAJOR_MINOR="${VERSION%.*}"
|
||||
# :latest and :X.Y track the newest release. Only a push to main
|
||||
# carries a release-please-cut version, and release-please versions
|
||||
# are monotonic, so on this path the tags only ever advance. A
|
||||
# workflow_dispatch backfill republishes an existing tag and must
|
||||
# never move a pointer, so this step skips on dispatch. After a
|
||||
# backfill that is genuinely newest in its minor line, advance :X.Y
|
||||
# by hand: docker buildx imagetools create -t "$IMAGE:X.Y" <digests>.
|
||||
# The event gate alone does not bound a stale run: re-running an
|
||||
# older push run replays its stored needs outputs under the
|
||||
# original event and ref, and would move the pointers backward to
|
||||
# that run's version. Floor against live state instead: this run's
|
||||
# release already exists by now, so VERSION must be the newest
|
||||
# published release or the run is stale and the tags stay put. The
|
||||
# releases list is ordered by creation, not semver, so read every
|
||||
# page and take the semver maximum, not the first page's.
|
||||
tags="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
|
||||
-q '.[] | select(.draft == false) | .tag_name')" || {
|
||||
echo "::error::could not list releases to bound the moving tags"
|
||||
exit 1
|
||||
}
|
||||
floor="$(printf '%s\n' "$tags" \
|
||||
| { grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' || true; } \
|
||||
| sed 's/^v//' | sort -V | tail -n 1)"
|
||||
if [ -n "$floor" ] && [ "$floor" != "$VERSION" ]; then
|
||||
echo "::error::release v$floor is newer than this run's v$VERSION; refusing to move the moving tags backward (stale re-run?)"
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck disable=SC2086
|
||||
docker buildx imagetools create -t "$IMAGE:latest" -t "$IMAGE:$MAJOR_MINOR" $DIGESTS
|
||||
|
||||
- name: Release summary
|
||||
env:
|
||||
@@ -462,7 +386,6 @@ jobs:
|
||||
continue-on-error: ${{ startsWith(matrix.target, 'x86_64-pc-windows') }}
|
||||
permissions:
|
||||
contents: write
|
||||
environment: release
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
@@ -482,27 +405,10 @@ jobs:
|
||||
- target: x86_64-pc-windows-msvc
|
||||
os: windows-latest
|
||||
steps:
|
||||
- name: Check out workflow scripts
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Resolve release tag
|
||||
id: rel
|
||||
env:
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
shell: bash # matrix includes windows-latest, where run: defaults to pwsh
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "$RELEASE_TAG"
|
||||
|
||||
- name: Checkout release tag
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
# Pin the commit the resolver verified; a tag ref re-resolved here
|
||||
# could have been moved between resolve and checkout.
|
||||
ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
|
||||
ref: ${{ needs.release-please.outputs.tag_name }}
|
||||
persist-credentials: false
|
||||
|
||||
- name: Set up Rust toolchain
|
||||
@@ -548,7 +454,7 @@ jobs:
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
VERSION="${{ steps.rel.outputs.version }}"
|
||||
VERSION="${{ needs.release-please.outputs.version }}"
|
||||
BIN_DIR="target/${{ matrix.target }}/release"
|
||||
EXE=""
|
||||
case "${{ matrix.target }}" in *windows*) EXE=".exe" ;; esac
|
||||
@@ -568,7 +474,7 @@ jobs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
TARGET="${{ matrix.target }}"
|
||||
NAME="gitlawb-node-${{ steps.rel.outputs.version }}-${TARGET}"
|
||||
NAME="gitlawb-node-${{ needs.release-please.outputs.version }}-${TARGET}"
|
||||
BIN_DIR="target/${TARGET}/release"
|
||||
EXE=""
|
||||
case "$TARGET" in *windows*) EXE=".exe" ;; esac
|
||||
@@ -609,7 +515,7 @@ jobs:
|
||||
- name: Attach to release
|
||||
uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
|
||||
with:
|
||||
tag_name: ${{ steps.rel.outputs.tag }}
|
||||
tag_name: ${{ needs.release-please.outputs.tag_name }}
|
||||
files: |
|
||||
dist/*.tar.gz
|
||||
dist/*.zip
|
||||
@@ -622,9 +528,7 @@ jobs:
|
||||
# (release-binaries is skipped on dispatch, hence !cancelled()). Publishing
|
||||
# auth is npm Trusted Publishing (GitHub OIDC) — no NPM_TOKEN. Each
|
||||
# @gitlawb package must have this repo + workflow (release.yml) configured
|
||||
# as its trusted publisher on npmjs.com, scoped to the release environment
|
||||
# so a dispatched copy of this file on another ref cannot mint a token, or
|
||||
# publish fails loudly here —
|
||||
# as its trusted publisher on npmjs.com, or publish fails loudly here —
|
||||
# deliberately loud: the silent secret-guard skip is how 0.4.x–0.6.0
|
||||
# never reached npm.
|
||||
if: >-
|
||||
@@ -636,7 +540,6 @@ jobs:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # npm trusted publishing (OIDC) + provenance
|
||||
environment: release
|
||||
steps:
|
||||
- name: Check out workflow scripts
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
@@ -648,7 +551,6 @@ jobs:
|
||||
env:
|
||||
DISPATCH_TAG: ${{ inputs.npm_backfill_tag }}
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
|
||||
@@ -656,9 +558,7 @@ jobs:
|
||||
- name: Checkout release tag
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
# Pin the commit the resolver verified; a tag ref re-resolved here
|
||||
# could have been moved between resolve and checkout.
|
||||
ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
|
||||
ref: ${{ steps.rel.outputs.tag }}
|
||||
persist-credentials: false
|
||||
|
||||
# npm >= 11.5.1 performs the OIDC token exchange automatically when the
|
||||
@@ -671,23 +571,14 @@ jobs:
|
||||
- name: Ensure npm supports trusted publishing
|
||||
run: |
|
||||
set -euo pipefail
|
||||
npm install -g npm@11.19.1
|
||||
# Assert the pin took, so an accidental unpin or a drift off 11.19.1
|
||||
# fails loudly here instead of silently running a different npm on
|
||||
# the OIDC path.
|
||||
installed="$(npm --version)"
|
||||
echo "npm installed: $installed"
|
||||
if [ "$installed" != "11.19.1" ]; then
|
||||
echo "::error::npm is not the pinned 11.19.1 (got: $installed)"
|
||||
exit 1
|
||||
fi
|
||||
npm install -g npm@^11.5.1
|
||||
npm --version
|
||||
|
||||
- name: Lay in release binaries
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
TAG: ${{ steps.rel.outputs.tag }}
|
||||
ASSETS: ${{ steps.rel.outputs.assets }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# npm platform package -> Rust target triple (unix only; Windows is not
|
||||
@@ -704,18 +595,8 @@ jobs:
|
||||
target="${entry#*:}"
|
||||
archive="gitlawb-node-${VERSION}-${target}.tar.gz"
|
||||
echo "==> $pkg <- $archive"
|
||||
# Download by the asset id the resolver captured and uploader-
|
||||
# checked, not by name: release assets are mutable, and an id can
|
||||
# only ever point at the exact blob captured at resolve time.
|
||||
# The map keys are base64-encoded asset names.
|
||||
want="$(printf '%s' "$archive" | base64 -w0)"
|
||||
asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
|
||||
if [ -z "$asset_id" ]; then
|
||||
echo "::error::release $TAG has no asset $archive captured at resolve time"
|
||||
exit 1
|
||||
fi
|
||||
gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
|
||||
-H 'Accept: application/octet-stream' > "_dl/$archive"
|
||||
gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
|
||||
--pattern "$archive" --dir _dl --clobber
|
||||
tar -xzf "_dl/$archive" -C _dl
|
||||
src="_dl/gitlawb-node-${VERSION}-${target}"
|
||||
cp "$src/gl" "npm/packages/$pkg/gl"
|
||||
@@ -754,39 +635,14 @@ jobs:
|
||||
# Platform packages first, then the wrapper (so its optionalDependencies resolve).
|
||||
# Skip versions already on the registry so a rerun after a partial publish
|
||||
# is idempotent instead of erroring on the first existing package.
|
||||
# npm publish moves the latest dist-tag to whatever it publishes, so a
|
||||
# backfilled older version would hand :latest to stale code. Decide
|
||||
# the dist-tag per package from that package's own registry latest:
|
||||
# a partial publish can leave the platform packages ahead of the
|
||||
# wrapper. E404 means the package has never been published, so this
|
||||
# release gets latest; any other lookup failure must fail closed
|
||||
# rather than guess at the dist-tag and risk moving latest backward.
|
||||
# stderr goes to a file so a warning on a successful lookup cannot
|
||||
# leak into registry_latest; it is read only when the lookup fails.
|
||||
npm_err="$(mktemp)"
|
||||
trap 'rm -f -- "$npm_err"' EXIT
|
||||
for pkg in gl-darwin-arm64 gl-darwin-x64 gl-linux-arm64 gl-linux-x64 gl; do
|
||||
name="@gitlawb/$pkg"
|
||||
if npm view "$name@$VERSION" version >/dev/null 2>&1; then
|
||||
echo "==> $name@$VERSION already published, skipping"
|
||||
continue
|
||||
fi
|
||||
registry_latest="$(npm view "$name" dist-tags.latest 2>"$npm_err")" || {
|
||||
if ! grep -q E404 "$npm_err"; then
|
||||
cat "$npm_err" >&2
|
||||
echo "::error::npm dist-tags lookup failed for $name; not guessing the dist-tag"
|
||||
exit 1
|
||||
fi
|
||||
registry_latest=""
|
||||
}
|
||||
dist_tag="latest"
|
||||
if [ -n "$registry_latest" ] && \
|
||||
[ "$VERSION" != "$(printf '%s\n%s\n' "$registry_latest" "$VERSION" | sort -V | tail -1)" ]; then
|
||||
dist_tag="backfill"
|
||||
echo "::notice::$VERSION is older than $name@$registry_latest; publishing under dist-tag backfill"
|
||||
fi
|
||||
echo "==> npm publish $name@$VERSION (dist-tag $dist_tag)"
|
||||
npm publish "npm/packages/$pkg" --provenance --access public --tag "$dist_tag"
|
||||
echo "==> npm publish $name@$VERSION"
|
||||
npm publish "npm/packages/$pkg" --provenance --access public
|
||||
done
|
||||
|
||||
homebrew-bump:
|
||||
@@ -796,7 +652,6 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read # GITHUB_TOKEN downloads release assets; the tap push uses HOMEBREW_TAP_PAT
|
||||
environment: release
|
||||
steps:
|
||||
- name: Guard on secret
|
||||
id: guard
|
||||
@@ -810,22 +665,6 @@ jobs:
|
||||
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Check out workflow scripts
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Resolve release tag
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
id: rel
|
||||
env:
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "$RELEASE_TAG"
|
||||
|
||||
- name: Checkout tap repo
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
@@ -839,32 +678,15 @@ jobs:
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
TAG: ${{ steps.rel.outputs.tag }}
|
||||
ASSETS: ${{ steps.rel.outputs.assets }}
|
||||
VERSION: ${{ needs.release-please.outputs.version }}
|
||||
TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
|
||||
mkdir -p _sums
|
||||
# Hash the tarballs themselves, fetched by the asset id the resolver
|
||||
# captured and uploader-checked. The *.sha256 sidecars are mutable
|
||||
# release assets too; trusting them would trust the same surface.
|
||||
sha() {
|
||||
archive="gitlawb-node-${VERSION}-$1.tar.gz"
|
||||
want="$(printf '%s' "$archive" | base64 -w0)"
|
||||
asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
|
||||
if [ -z "$asset_id" ]; then
|
||||
echo "::error::release $TAG has no asset $archive captured at resolve time" >&2
|
||||
exit 1
|
||||
fi
|
||||
# errexit is off inside the $(...) this runs under, so a failed
|
||||
# download must exit the function itself instead of hashing a
|
||||
# truncated file.
|
||||
gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
|
||||
-H 'Accept: application/octet-stream' > "_sums/$archive" \
|
||||
|| exit 1
|
||||
sha256sum "_sums/$archive" | awk '{print $1}'
|
||||
}
|
||||
gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
|
||||
--pattern '*.tar.gz.sha256' --dir _sums --clobber
|
||||
sha() { awk '{print $1}' "_sums/gitlawb-node-${VERSION}-$1.tar.gz.sha256"; }
|
||||
SHA_MAC_ARM="$(sha aarch64-apple-darwin)"
|
||||
SHA_MAC_X64="$(sha x86_64-apple-darwin)"
|
||||
SHA_LNX_ARM="$(sha aarch64-unknown-linux-musl)"
|
||||
@@ -925,7 +747,7 @@ jobs:
|
||||
working-directory: tap
|
||||
env:
|
||||
HOMEBREW_TAP_PAT: ${{ secrets.HOMEBREW_TAP_PAT }}
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
VERSION: ${{ needs.release-please.outputs.version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git config user.name "github-actions[bot]"
|
||||
@@ -947,7 +769,6 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read # GITHUB_TOKEN checks out node; the web PR uses WEB_SYNC_PAT
|
||||
environment: release
|
||||
steps:
|
||||
- name: Guard on secret
|
||||
id: guard
|
||||
@@ -961,29 +782,11 @@ jobs:
|
||||
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Check out workflow scripts
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Resolve release tag
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
id: rel
|
||||
env:
|
||||
RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scripts/resolve-release-tag.sh "$RELEASE_TAG"
|
||||
|
||||
- name: Checkout node (release tag)
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
# Pin the commit the resolver verified; a tag ref re-resolved here
|
||||
# could have been moved between resolve and checkout.
|
||||
ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
|
||||
ref: ${{ needs.release-please.outputs.tag_name }}
|
||||
path: node
|
||||
persist-credentials: false
|
||||
|
||||
@@ -1003,8 +806,8 @@ jobs:
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
TAG: ${{ steps.rel.outputs.tag }}
|
||||
VERSION: ${{ needs.release-please.outputs.version }}
|
||||
TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets \
|
||||
@@ -1022,8 +825,8 @@ jobs:
|
||||
if: ${{ steps.guard.outputs.enabled == 'true' }}
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.WEB_SYNC_PAT }}
|
||||
VERSION: ${{ steps.rel.outputs.version }}
|
||||
TAG: ${{ steps.rel.outputs.tag }}
|
||||
VERSION: ${{ needs.release-please.outputs.version }}
|
||||
TAG: ${{ needs.release-please.outputs.tag_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# Canonical install scripts (source of truth lives in the node repo).
|
||||
|
||||
@@ -71,7 +71,7 @@ Known limitations:
|
||||
- Agent lifecycle revocation is not enforced by HTTP Signature authorization; do not rely on removing or revoking an agent record to block a compromised signer.
|
||||
- Read visibility is not a blanket data-classification boundary: task, IPFS-pin, and Arweave-anchor listings are not repository-gated; withheld path names can be visible to a root reader; and later visibility changes cannot retract content already announced or externally anchored.
|
||||
- Peer writes are signed by upgraded nodes, but strict signed-peer enforcement is opt-in during rolling upgrades.
|
||||
- GraphQL mutations require a signed identity (a verified signer bound to the acting DID), are limited to the agent-task queue, and are covered by a CI completeness fence that requires signer acquisition and actor binding on every registered mutation; repo writes are not exposed over GraphQL and remain REST-only.
|
||||
- Current GraphQL mutations require an authenticated signer, but there is no mutation-specific guardrail that prevents a future mutation from omitting that check.
|
||||
- Pull-request review comments do not yet have threaded line-level anchors, and merges do not enforce approval requirements.
|
||||
|
||||
See:
|
||||
|
||||
@@ -287,10 +287,8 @@ fn handle_connect<R: Read>(
|
||||
// this into one POST deadlocks a multi-round fetch (#117).
|
||||
//
|
||||
// git-receive-pack (push):
|
||||
// Git sends the ref-update command list (pkt-lines ending in a flush),
|
||||
// then the complete PACK blob only when a command has a non-zero new-oid.
|
||||
// A delete-only push sends no pack, and git holds its write pipe open for
|
||||
// the report-status response, so EOF cannot delimit the request (#369).
|
||||
// Git sends ref-update commands + the complete PACK blob, then closes its
|
||||
// write pipe. read_to_end is safe and correct here, a single POST.
|
||||
|
||||
let post_url = format!("{}/{}", repo_base, service);
|
||||
|
||||
@@ -298,7 +296,10 @@ fn handle_connect<R: Read>(
|
||||
return negotiate_upload_pack(&client, &post_url, service, signing_key, stdin, &mut stdout);
|
||||
}
|
||||
|
||||
let request_body = read_receive_pack_request(stdin)?;
|
||||
let mut request_body = Vec::new();
|
||||
stdin
|
||||
.read_to_end(&mut request_body)
|
||||
.context("reading receive-pack request")?;
|
||||
tracing::debug!("pack request: {} bytes from git", request_body.len());
|
||||
|
||||
if request_body.is_empty() {
|
||||
@@ -534,108 +535,6 @@ fn read_upload_pack_round<R: Read>(stdin: &mut R) -> Result<(Vec<u8>, RoundEnd)>
|
||||
}
|
||||
}
|
||||
|
||||
/// Read one git-receive-pack request: optional `shallow` lines, then EITHER a
|
||||
/// command list (pkt-lines terminated by a flush) or a push-cert block
|
||||
/// (pkt-lines terminated by a "push-cert-end" line), then the negotiated
|
||||
/// push-options block, then the pack ONLY when a command carries a non-zero
|
||||
/// new-oid.
|
||||
///
|
||||
/// A delete-only push sends no pack, and git holds its write pipe open waiting
|
||||
/// for the report-status response, so a plain read_to_end deadlocks the two
|
||||
/// (#369). A signed push is the other trap: when the client sends a push-cert
|
||||
/// it sends NO command list at all (the commands live inside the cert), so the
|
||||
/// request starts with a "push-cert" line and no flush ever arrives. The
|
||||
/// negotiated capability list is on the push-cert line, or on the first
|
||||
/// command line after its NUL when there is no cert. EOF at any point also
|
||||
/// ends the read, covering git versions that close the pipe early.
|
||||
fn read_receive_pack_request<R: Read>(stdin: &mut R) -> Result<Vec<u8>> {
|
||||
/// Read one pkt-line into `body` (length prefix + data), returning its data
|
||||
/// or `None` on flush or EOF. Malformed lengths bail rather than collapse
|
||||
/// into a synthesized flush (#192 F5).
|
||||
fn read_pkt<R: Read>(stdin: &mut R, body: &mut Vec<u8>) -> Result<Option<Vec<u8>>> {
|
||||
let mut len_bytes = [0u8; 4];
|
||||
match stdin.read_exact(&mut len_bytes) {
|
||||
Ok(()) => {}
|
||||
Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(None),
|
||||
Err(e) => return Err(e.into()),
|
||||
}
|
||||
let Ok(len_hex) = std::str::from_utf8(&len_bytes) else {
|
||||
bail!("malformed pkt-line length prefix: non-UTF-8 bytes {len_bytes:02x?}");
|
||||
};
|
||||
let Ok(pkt_len) = usize::from_str_radix(len_hex, 16) else {
|
||||
bail!("malformed pkt-line length prefix: non-hex {len_hex:?}");
|
||||
};
|
||||
body.extend_from_slice(&len_bytes);
|
||||
if pkt_len == 0 {
|
||||
return Ok(None);
|
||||
}
|
||||
if pkt_len < 4 {
|
||||
bail!("invalid pkt-line length: {pkt_len}");
|
||||
}
|
||||
let mut data = vec![0u8; pkt_len - 4];
|
||||
stdin
|
||||
.read_exact(&mut data)
|
||||
.context("reading pkt-line data")?;
|
||||
body.extend_from_slice(&data);
|
||||
Ok(Some(data))
|
||||
}
|
||||
|
||||
/// "<40-hex old> <40-hex new> <refname>" — the command shape, whether it
|
||||
/// appears in a command list or inside a push-cert.
|
||||
fn is_command(data: &[u8]) -> bool {
|
||||
data.len() >= 82
|
||||
&& data[..40].iter().all(|b| b.is_ascii_hexdigit())
|
||||
&& data[40] == b' '
|
||||
&& data[41..81].iter().all(|b| b.is_ascii_hexdigit())
|
||||
&& data[81] == b' '
|
||||
}
|
||||
|
||||
let mut body = Vec::new();
|
||||
let mut caps = String::new();
|
||||
let mut pack_expected = false;
|
||||
let mut in_cert = false;
|
||||
loop {
|
||||
let Some(data) = read_pkt(stdin, &mut body)? else {
|
||||
// Flush ends a command list; EOF ends anything. A cert has no
|
||||
// legal flush inside it, so the same break covers malformed
|
||||
// input without hanging.
|
||||
break;
|
||||
};
|
||||
if !in_cert && data.starts_with(b"push-cert") {
|
||||
in_cert = true;
|
||||
if let Some(nul) = data.iter().position(|&b| b == 0) {
|
||||
caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
|
||||
}
|
||||
continue;
|
||||
}
|
||||
if in_cert && data == b"push-cert-end\n" {
|
||||
break;
|
||||
}
|
||||
if is_command(&data) {
|
||||
if caps.is_empty() {
|
||||
if let Some(nul) = data.iter().position(|&b| b == 0) {
|
||||
caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
|
||||
}
|
||||
}
|
||||
if data[41..81].iter().any(|&b| b != b'0') {
|
||||
pack_expected = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
// When both are negotiated the push-options block follows the cert; when
|
||||
// only options are negotiated it follows the command flush. Either way it
|
||||
// is pkt-lines to a flush.
|
||||
if caps.split(' ').any(|c| c.starts_with("push-options")) {
|
||||
while read_pkt(stdin, &mut body)?.is_some() {}
|
||||
}
|
||||
if pack_expected {
|
||||
stdin
|
||||
.read_to_end(&mut body)
|
||||
.context("reading receive-pack pack")?;
|
||||
}
|
||||
Ok(body)
|
||||
}
|
||||
|
||||
/// POST one self-contained stateless-RPC request body and stream the response to
|
||||
/// `stdout`. Signs the request when `signing_key` is present, so every round of a
|
||||
/// private-repo fetch carries the caller's signature (the node visibility-gates
|
||||
@@ -2118,184 +2017,6 @@ mod tests {
|
||||
assert!(help.ends_with('\n'));
|
||||
}
|
||||
|
||||
// ── #369 delete-only push deadlock ───────────────────────────────────────
|
||||
|
||||
/// A delete-only receive-pack request ends at the command flush; git then
|
||||
/// holds the write pipe open for the report and sends no pack. A reader that
|
||||
/// blocks after the command list reproduces the hang that a Cursor (EOF)
|
||||
/// hides. The read must return at the flush, inside the timeout.
|
||||
#[test]
|
||||
fn delete_only_receive_pack_request_returns_at_command_flush() {
|
||||
let old = "a".repeat(40);
|
||||
let zero = "0".repeat(40);
|
||||
let mut seed = Vec::new();
|
||||
seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
|
||||
seed.extend_from_slice(b"0000"); // command-list flush; git then blocks
|
||||
|
||||
let (tx, rx) = std::sync::mpsc::channel::<()>();
|
||||
let mut reader = BlockAfterSeed {
|
||||
seed: io::Cursor::new(seed),
|
||||
gate: rx,
|
||||
};
|
||||
|
||||
let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
|
||||
let handle = std::thread::spawn(move || {
|
||||
let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
|
||||
});
|
||||
|
||||
let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
|
||||
let _ = tx.send(()); // unblock the reader so the thread can exit
|
||||
let _ = handle.join();
|
||||
|
||||
let body = got.expect(
|
||||
"read_receive_pack_request blocked past the command flush waiting for \
|
||||
a pack a delete-only push never sends (#369)",
|
||||
);
|
||||
assert!(
|
||||
body.ends_with(b"0000"),
|
||||
"the request body keeps the command list and its flush terminator"
|
||||
);
|
||||
}
|
||||
|
||||
/// A push carrying objects still reads the pack through to EOF, and the
|
||||
/// command flush sits between the commands and the pack in the body.
|
||||
#[test]
|
||||
fn receive_pack_request_with_pack_reads_through_eof() {
|
||||
let old = "a".repeat(40);
|
||||
let new = "b".repeat(40);
|
||||
let mut stream = Vec::new();
|
||||
stream.extend_from_slice(&pkt(&format!(
|
||||
"{old} {new} refs/heads/main\0 report-status-v2\n"
|
||||
)));
|
||||
stream.extend_from_slice(b"0000");
|
||||
stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
|
||||
|
||||
let mut stdin = io::Cursor::new(stream);
|
||||
let body = read_receive_pack_request(&mut stdin).unwrap();
|
||||
let pos = body.windows(4).position(|w| w == b"0000").unwrap();
|
||||
assert_eq!(
|
||||
&body[pos + 4..],
|
||||
b"PACK\x00\x00\x00\x02fakepack",
|
||||
"a non-zero new-oid means the pack follows the flush"
|
||||
);
|
||||
}
|
||||
|
||||
/// A signed delete-only push sends NO command list: the request starts
|
||||
/// with the "push-cert" line, the commands live inside the cert, and the
|
||||
/// cert ends with a "push-cert-end" pkt-line (not a flush). The reader
|
||||
/// must return after push-cert-end without waiting on the pipe.
|
||||
#[test]
|
||||
fn signed_delete_only_push_returns_after_push_cert_end() {
|
||||
let old = "a".repeat(40);
|
||||
let zero = "0".repeat(40);
|
||||
let mut seed = Vec::new();
|
||||
seed.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
|
||||
seed.extend_from_slice(&pkt("certificate version 0.1\n"));
|
||||
seed.extend_from_slice(&pkt("pusher did:key:z6Mk\n"));
|
||||
seed.extend_from_slice(&pkt("\n")); // empty line ends the headers
|
||||
seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
|
||||
seed.extend_from_slice(&pkt("sig-line\n"));
|
||||
seed.extend_from_slice(&pkt("push-cert-end\n"));
|
||||
// git now blocks for the report; the pipe stays open.
|
||||
|
||||
let (tx, rx) = std::sync::mpsc::channel::<()>();
|
||||
let mut reader = BlockAfterSeed {
|
||||
seed: io::Cursor::new(seed),
|
||||
gate: rx,
|
||||
};
|
||||
|
||||
let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
|
||||
let handle = std::thread::spawn(move || {
|
||||
let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
|
||||
});
|
||||
let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
|
||||
let _ = tx.send(());
|
||||
let _ = handle.join();
|
||||
|
||||
let body = got.expect(
|
||||
"read_receive_pack_request blocked past push-cert-end on a signed \
|
||||
delete-only push (#369)",
|
||||
);
|
||||
assert!(
|
||||
body.windows(6).any(|w| w == b"pusher"),
|
||||
"the cert block is part of the request body"
|
||||
);
|
||||
}
|
||||
|
||||
/// A signed pack-bearing push: cert with the commands inside, then the
|
||||
/// pack. Everything must land in the body.
|
||||
#[test]
|
||||
fn signed_pack_push_keeps_cert_and_pack() {
|
||||
let old = "a".repeat(40);
|
||||
let new = "b".repeat(40);
|
||||
let mut stream = Vec::new();
|
||||
stream.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
|
||||
stream.extend_from_slice(&pkt("certificate version 0.1\n"));
|
||||
stream.extend_from_slice(&pkt("\n"));
|
||||
stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
|
||||
stream.extend_from_slice(&pkt("push-cert-end\n"));
|
||||
stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
|
||||
|
||||
let mut stdin = io::Cursor::new(stream);
|
||||
let body = read_receive_pack_request(&mut stdin).unwrap();
|
||||
assert!(
|
||||
body.windows(5).any(|w| w == b"PACK\x00"),
|
||||
"the pack follows the cert into the body"
|
||||
);
|
||||
}
|
||||
|
||||
/// A negotiated push-options block is pkt-lines ending in its own flush.
|
||||
/// With no cert it follows the command flush; with a cert it follows
|
||||
/// push-cert-end.
|
||||
#[test]
|
||||
fn receive_pack_request_consumes_a_push_options_block() {
|
||||
let old = "a".repeat(40);
|
||||
let new = "b".repeat(40);
|
||||
let mut stream = Vec::new();
|
||||
stream.extend_from_slice(&pkt(&format!(
|
||||
"{old} {new} refs/heads/main\0 report-status-v2 push-options\n"
|
||||
)));
|
||||
stream.extend_from_slice(b"0000"); // command flush
|
||||
stream.extend_from_slice(&pkt("ci.skip\n"));
|
||||
stream.extend_from_slice(b"0000"); // options flush
|
||||
stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
|
||||
|
||||
let mut stdin = io::Cursor::new(stream);
|
||||
let body = read_receive_pack_request(&mut stdin).unwrap();
|
||||
assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
|
||||
assert!(
|
||||
body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
|
||||
"the pack lands after the options block"
|
||||
);
|
||||
}
|
||||
|
||||
/// Cert and options together: the cert comes first and the options block
|
||||
/// sits between push-cert-end and the pack.
|
||||
#[test]
|
||||
fn signed_push_with_options_reads_cert_then_options_then_pack() {
|
||||
let old = "a".repeat(40);
|
||||
let new = "b".repeat(40);
|
||||
let mut stream = Vec::new();
|
||||
stream.extend_from_slice(&pkt(
|
||||
"push-cert\0 report-status-v2 push-cert push-options\n",
|
||||
));
|
||||
stream.extend_from_slice(&pkt("certificate version 0.1\n"));
|
||||
stream.extend_from_slice(&pkt("\n"));
|
||||
stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
|
||||
stream.extend_from_slice(&pkt("push-cert-end\n"));
|
||||
stream.extend_from_slice(&pkt("ci.skip\n"));
|
||||
stream.extend_from_slice(b"0000"); // options flush
|
||||
stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
|
||||
|
||||
let mut stdin = io::Cursor::new(stream);
|
||||
let body = read_receive_pack_request(&mut stdin).unwrap();
|
||||
assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
|
||||
assert!(
|
||||
body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
|
||||
"the pack lands after the options block"
|
||||
);
|
||||
}
|
||||
|
||||
// ── #117 multi-round fetch negotiation ───────────────────────────────────
|
||||
|
||||
/// Encode a git pkt-line: 4-byte hex length (incl. the 4 bytes) + data.
|
||||
|
||||
@@ -95,36 +95,6 @@ fn upload_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
|
||||
out.stdout
|
||||
}
|
||||
|
||||
/// Run `git receive-pack --stateless-rpc [--advertise-refs] <repo>`, optionally
|
||||
/// feeding `input` on stdin. Returns raw stdout (the wire bytes). The receive
|
||||
/// half of `upload_pack`, used so the shim can serve a real push.
|
||||
fn receive_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
|
||||
let mut cmd = Command::new("git");
|
||||
cmd.arg("receive-pack").arg("--stateless-rpc");
|
||||
if advertise {
|
||||
cmd.arg("--advertise-refs");
|
||||
}
|
||||
cmd.arg(repo)
|
||||
.stdin(Stdio::piped())
|
||||
.stdout(Stdio::piped())
|
||||
.stderr(Stdio::piped());
|
||||
let mut child = cmd.spawn().expect("spawn git receive-pack");
|
||||
let mut stdin = child.stdin.take().unwrap();
|
||||
let input = input.to_vec();
|
||||
let writer = std::thread::spawn(move || {
|
||||
let _ = stdin.write_all(&input);
|
||||
// drop closes stdin
|
||||
});
|
||||
let out = child.wait_with_output().expect("wait receive-pack");
|
||||
writer.join().ok();
|
||||
assert!(
|
||||
out.status.success(),
|
||||
"git receive-pack failed: {}",
|
||||
String::from_utf8_lossy(&out.stderr)
|
||||
);
|
||||
out.stdout
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
enum ShimMode {
|
||||
/// Faithful v0 serving: pipe each POST to `git upload-pack --stateless-rpc`.
|
||||
@@ -248,21 +218,7 @@ fn handle_conn(stream: TcpStream, repo: &Path, mode: ShimMode, posts: &AtomicUsi
|
||||
reader.read_exact(&mut body).ok();
|
||||
}
|
||||
|
||||
let (content_type, payload) = if method == "GET" && target.contains("service=git-receive-pack")
|
||||
{
|
||||
// Receive-pack advertisement, same wrapper shape as upload-pack.
|
||||
let adv = receive_pack(repo, true, b"");
|
||||
let mut wrapped = pkt(b"# service=git-receive-pack\n");
|
||||
wrapped.extend_from_slice(b"0000");
|
||||
wrapped.extend_from_slice(&adv);
|
||||
("application/x-git-receive-pack-advertisement", wrapped)
|
||||
} else if method == "POST" && target.ends_with("/git-receive-pack") {
|
||||
posts.fetch_add(1, Ordering::SeqCst);
|
||||
(
|
||||
"application/x-git-receive-pack-result",
|
||||
receive_pack(repo, false, &body),
|
||||
)
|
||||
} else if method == "GET" && target.contains("/info/refs") {
|
||||
let (content_type, payload) = if method == "GET" && target.contains("/info/refs") {
|
||||
// v0 advertisement, wrapped exactly as the node's info_refs does.
|
||||
let adv = upload_pack(repo, true, b"");
|
||||
let mut wrapped = pkt(b"# service=git-upload-pack\n");
|
||||
@@ -337,34 +293,6 @@ fn fetch_with_helper(clone: &Path, node_url: &str) -> (bool, std::process::Outpu
|
||||
run_bounded(cmd, Duration::from_secs(30))
|
||||
}
|
||||
|
||||
/// Run `git push` in `local` through the helper, same wiring and hard timeout as
|
||||
/// [`fetch_with_helper`]. `args` carries the push spec, e.g.
|
||||
/// `["--delete", "doomed"]`.
|
||||
fn push_with_helper(local: &Path, node_url: &str, args: &[&str]) -> (bool, std::process::Output) {
|
||||
let helper_bin = PathBuf::from(env!("CARGO_BIN_EXE_git-remote-gitlawb"));
|
||||
let helper_dir = helper_bin.parent().unwrap().to_path_buf();
|
||||
let path_env = match std::env::var_os("PATH") {
|
||||
Some(p) => {
|
||||
let mut dirs = vec![helper_dir.clone()];
|
||||
dirs.extend(std::env::split_paths(&p));
|
||||
std::env::join_paths(dirs).unwrap()
|
||||
}
|
||||
None => helper_dir.clone().into_os_string(),
|
||||
};
|
||||
|
||||
let mut cmd = Command::new("git");
|
||||
cmd.arg("-C")
|
||||
.arg(local)
|
||||
.arg("push")
|
||||
.arg("origin")
|
||||
.args(args)
|
||||
.env("PATH", path_env)
|
||||
.env("LC_ALL", "C")
|
||||
.env("GITLAWB_NODE", node_url)
|
||||
.env("GITLAWB_KEY", "/nonexistent-key-for-anon-push");
|
||||
run_bounded(cmd, Duration::from_secs(30))
|
||||
}
|
||||
|
||||
/// A synthetic non-success `ExitStatus` used only on the unix timeout path, where
|
||||
/// `reap_group` has already consumed the child and the later `wait` returns ECHILD.
|
||||
/// The timeout branch already reports `completed == false`, so the exact status is
|
||||
@@ -1314,77 +1242,3 @@ fn run_bounded_bounds_join_when_leader_exits_leaving_a_pipe_holder() {
|
||||
held pipes do not stall the joins)"
|
||||
);
|
||||
}
|
||||
|
||||
/// #369 end-to-end: a real `git push --delete` through the helper completes.
|
||||
/// The receive-pack request for a delete-only push is commands + flush with NO
|
||||
/// pack, and git holds its write pipe open for the report — so a helper that
|
||||
/// reads stdin to EOF deadlocks against it. The shim pipes the POST to a real
|
||||
/// `git receive-pack --stateless-rpc`, so the branch actually has to be deleted
|
||||
/// server-side for the assertions to pass.
|
||||
#[test]
|
||||
fn real_git_push_delete_completes() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let server = dir.path().join("server.git");
|
||||
let local = dir.path().join("local");
|
||||
|
||||
// A bare repo holding the doomed branch, plus a live one.
|
||||
git(
|
||||
dir.path(),
|
||||
&[
|
||||
"init",
|
||||
"--bare",
|
||||
server.to_str().unwrap(),
|
||||
"--initial-branch=main",
|
||||
],
|
||||
);
|
||||
let work = dir.path().join("work");
|
||||
git(
|
||||
dir.path(),
|
||||
&["init", work.to_str().unwrap(), "--initial-branch=main"],
|
||||
);
|
||||
git(&work, &["config", "user.email", "t@t"]);
|
||||
git(&work, &["config", "user.name", "t"]);
|
||||
std::fs::write(work.join("f"), "x").unwrap();
|
||||
git(&work, &["add", "f"]);
|
||||
git(&work, &["commit", "-m", "c"]);
|
||||
git(&work, &["branch", "doomed"]);
|
||||
git(&work, &["push", server.to_str().unwrap(), "main", "doomed"]);
|
||||
|
||||
// The pusher: a local repo whose origin is the gitlawb remote pointing at
|
||||
// the shim. Nothing needs to be fetched first; git takes the old-oid from
|
||||
// the receive-pack advertisement.
|
||||
git(
|
||||
dir.path(),
|
||||
&["init", local.to_str().unwrap(), "--initial-branch=main"],
|
||||
);
|
||||
git(
|
||||
&local,
|
||||
&["remote", "add", "origin", "gitlawb://did:key:z6MkTest/repo"],
|
||||
);
|
||||
|
||||
let shim = start_shim(server.clone(), ShimMode::Normal);
|
||||
let (completed, out) = push_with_helper(&local, &shim.base_url, &["--delete", "doomed"]);
|
||||
let posts = shim.posts.load(Ordering::SeqCst);
|
||||
|
||||
assert!(
|
||||
completed,
|
||||
"git push --delete did not complete within the timeout (deadlock signature). stderr:\n{}",
|
||||
String::from_utf8_lossy(&out.stderr)
|
||||
);
|
||||
assert!(
|
||||
out.status.success(),
|
||||
"git push --delete failed. stderr:\n{}",
|
||||
String::from_utf8_lossy(&out.stderr)
|
||||
);
|
||||
assert_eq!(posts, 1, "a delete-only push is exactly one POST");
|
||||
let gone = Command::new("git")
|
||||
.arg("-C")
|
||||
.arg(&server)
|
||||
.args(["rev-parse", "--verify", "--quiet", "refs/heads/doomed"])
|
||||
.output()
|
||||
.unwrap();
|
||||
assert!(
|
||||
!gone.status.success(),
|
||||
"refs/heads/doomed must be deleted in the server repo"
|
||||
);
|
||||
}
|
||||
@@ -85,13 +85,6 @@ use serde::{Deserialize, Serialize};
|
||||
const MAGIC: &[u8] = b"GLENC";
|
||||
const VERSION: u8 = 2;
|
||||
|
||||
/// Upper bound on the blinded recipient list. The envelope author controls
|
||||
/// this count and `open_blob` pays one X25519 exchange per entry before it can
|
||||
/// answer "not a recipient", so the count has to be capped rather than
|
||||
/// optimized (#419). Legitimate envelopes carry a handful of authorized
|
||||
/// readers, so 256 is far above real use.
|
||||
const MAX_RECIPIENTS: usize = 256;
|
||||
|
||||
#[derive(Serialize, Deserialize)]
|
||||
struct Recipient {
|
||||
eph: String, // base64 ephemeral x25519 pubkey (32B)
|
||||
@@ -111,14 +104,6 @@ pub fn seal_blob(plaintext: &[u8], recipients: &[VerifyingKey]) -> Result<Vec<u8
|
||||
if recipients.is_empty() {
|
||||
return Err(anyhow::anyhow!("seal_blob: no recipients"));
|
||||
}
|
||||
// Same bound open_blob enforces: an envelope over the cap could never be
|
||||
// opened, so refuse to seal it (#419).
|
||||
if recipients.len() > MAX_RECIPIENTS {
|
||||
return Err(anyhow::anyhow!(
|
||||
"seal_blob: {} recipients, over the {MAX_RECIPIENTS} cap",
|
||||
recipients.len()
|
||||
));
|
||||
}
|
||||
let mut content_key = [0u8; 32];
|
||||
OsRng.fill_bytes(&mut content_key);
|
||||
let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key)
|
||||
@@ -177,14 +162,6 @@ pub fn open_blob(envelope: &[u8], keypair: &Keypair) -> Result<Vec<u8>> {
|
||||
let header: Header =
|
||||
serde_json::from_slice(envelope.get(p..p + hlen).context("truncated header")?)
|
||||
.context("decode header")?;
|
||||
// Reject before the recipient scan: every entry below is an X25519
|
||||
// exchange, and a non-recipient would run the whole list (#419).
|
||||
if header.recipients.len() > MAX_RECIPIENTS {
|
||||
return Err(anyhow::anyhow!(
|
||||
"envelope carries {} recipients, over the {MAX_RECIPIENTS} cap",
|
||||
header.recipients.len()
|
||||
));
|
||||
}
|
||||
let body = &envelope[p + hlen..];
|
||||
|
||||
// The raw scalar is kept alongside the box secret so the exchange can be
|
||||
@@ -361,72 +338,6 @@ mod tests {
|
||||
assert!(open_blob(&reframe(&header), &reader).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn over_cap_recipient_list_is_rejected_before_the_scan() {
|
||||
// #419: the envelope author controls the recipient count and each entry
|
||||
// costs an X25519 exchange, so the list is capped. Reframe a valid
|
||||
// envelope with MAX_RECIPIENTS + 1 junk entries.
|
||||
let reader = Keypair::generate();
|
||||
let env = seal_blob(b"private blob contents", &[reader.verifying_key()]).unwrap();
|
||||
|
||||
let mut p = MAGIC.len() + 1;
|
||||
let hlen = u32::from_le_bytes(env[p..p + 4].try_into().unwrap()) as usize;
|
||||
p += 4;
|
||||
let header_bytes = &env[p..p + hlen];
|
||||
let body = &env[p + hlen..];
|
||||
|
||||
let mut header: serde_json::Value = serde_json::from_slice(header_bytes).unwrap();
|
||||
let junk = serde_json::json!({
|
||||
"eph": B64.encode([0u8; 32]),
|
||||
"nonce": B64.encode([0u8; 24]),
|
||||
"wrap": B64.encode([0u8; 48]),
|
||||
});
|
||||
header["recipients"] = serde_json::Value::Array(vec![junk.clone(); MAX_RECIPIENTS + 1]);
|
||||
|
||||
let hj = serde_json::to_vec(&header).unwrap();
|
||||
let mut fat = Vec::new();
|
||||
fat.extend_from_slice(MAGIC);
|
||||
fat.push(VERSION);
|
||||
fat.extend_from_slice(&(hj.len() as u32).to_le_bytes());
|
||||
fat.extend_from_slice(&hj);
|
||||
fat.extend_from_slice(body);
|
||||
|
||||
let err = open_blob(&fat, &reader).unwrap_err();
|
||||
assert!(
|
||||
err.to_string().contains("recipients"),
|
||||
"expected the recipient-cap error, got: {err}"
|
||||
);
|
||||
|
||||
// Exactly at the cap the envelope is still processed end to end.
|
||||
header["recipients"] = serde_json::Value::Array(vec![junk; MAX_RECIPIENTS]);
|
||||
let hj = serde_json::to_vec(&header).unwrap();
|
||||
let mut at_cap = Vec::new();
|
||||
at_cap.extend_from_slice(MAGIC);
|
||||
at_cap.push(VERSION);
|
||||
at_cap.extend_from_slice(&(hj.len() as u32).to_le_bytes());
|
||||
at_cap.extend_from_slice(&hj);
|
||||
at_cap.extend_from_slice(body);
|
||||
let err = open_blob(&at_cap, &reader).unwrap_err();
|
||||
assert!(
|
||||
!err.to_string().contains("over the"),
|
||||
"at-cap envelope must reach the scan, got: {err}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn seal_refuses_a_recipient_list_over_the_cap() {
|
||||
// An envelope over the cap can never be opened, so seal must reject it
|
||||
// instead of minting one.
|
||||
let keys: Vec<VerifyingKey> = (0..MAX_RECIPIENTS + 1)
|
||||
.map(|_| Keypair::generate().verifying_key())
|
||||
.collect();
|
||||
let err = seal_blob(b"blob", &keys).unwrap_err();
|
||||
assert!(
|
||||
err.to_string().contains("recipients"),
|
||||
"expected the recipient-cap error, got: {err}"
|
||||
);
|
||||
}
|
||||
|
||||
/// Every standard low-order X25519 encoding must be detected by
|
||||
/// `yields_all_zero_shared_secret`, including encodings that do not
|
||||
/// decompress to an Edwards point (notably `u = p - 1`). The open side
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -298,573 +298,6 @@ mod authz_guard {
|
||||
}
|
||||
}
|
||||
|
||||
/// Completeness fence over the GraphQL mutation surface: the mirror of
|
||||
/// `every_in_scope_mutation_has_its_gate` for `graphql/mutation.rs`. Kept a
|
||||
/// SEPARATE guard with its own table (never folded into the REST rows above):
|
||||
/// a guard over a heterogeneous set must classify per member, and these
|
||||
/// same-named task rows belong to the GraphQL surface, not `api/tasks.rs`.
|
||||
///
|
||||
/// COMPLETENESS comes from the engine's own SDL (`schema.sdl()`), parsed as a
|
||||
/// structured AST (#219), NOT introspection and NOT a text parse of source.
|
||||
/// This matters: async-graphql OMITS `#[graphql(visible = false)]` fields from
|
||||
/// introspection while leaving them executable, so an introspection-sourced fence
|
||||
/// could be defeated by a hidden mutation. SDL includes those fields, so no
|
||||
/// visibility flag (and, via the AST parse, no brace-in-description quirk) can hide
|
||||
/// a live mutation. The SDL field set must equal the registered set: a new field with
|
||||
/// no row fails (a repo-write cannot slip in unlisted); a registered name absent from
|
||||
/// the schema fails (renamed or removed). The set is also cross-checked against
|
||||
/// introspection, so any field present in SDL but hidden from introspection fails
|
||||
/// named as a forbidden hidden mutation.
|
||||
///
|
||||
/// The MARKER check is the only source-scraped part, and it is not the
|
||||
/// completeness guarantee. Three honest limits, so a green check is not misread
|
||||
/// as full authorization coverage:
|
||||
/// 1. A present marker is not load-bearingness (the gate may not redden on a
|
||||
/// hostile probe: the #203 present-but-vacuous case). The adversarial tests
|
||||
/// in `graphql/mutation.rs` are the load-bearing layer.
|
||||
/// 2. A present marker is not gate-correctness (it may be the wrong bucket for
|
||||
/// the operation's resource: a repo-write registered as signer-self would
|
||||
/// pass, so INV-1 review remains the defense).
|
||||
/// 3. The marker check scrapes the comment-masked, brace-bounded resolver body;
|
||||
/// a `{`/`}` or a `did_matches(` inside a STRING literal is not masked, so it
|
||||
/// could mis-slice that body or satisfy the marker vacuously (the same
|
||||
/// vacuous-marker class as limit 1). Completeness is unaffected: it comes
|
||||
/// from the SDL AST, not from this scrape.
|
||||
#[test]
|
||||
fn every_graphql_mutation_has_its_gate() {
|
||||
// (Rust snake name, schema field in camelCase, expected gate markers). The
|
||||
// four are Bucket C signer-self: `/graphql` uses optional_signature, so each
|
||||
// resolver must call `require_signer(ctx)?` and bind the acting DID with
|
||||
// `did_matches(`. A repo-write would be Bucket A (`require_repo_owner(`).
|
||||
// Same-named REST rows live in the guard above against `api/tasks.rs`.
|
||||
let registered: &[(&str, &str, &[&str])] = &[
|
||||
(
|
||||
"create_task",
|
||||
"createTask",
|
||||
&["require_signer(ctx)?", "did_matches("],
|
||||
),
|
||||
(
|
||||
"claim_task",
|
||||
"claimTask",
|
||||
&["require_signer(ctx)?", "did_matches("],
|
||||
),
|
||||
(
|
||||
"complete_task",
|
||||
"completeTask",
|
||||
&["require_signer(ctx)?", "did_matches("],
|
||||
),
|
||||
(
|
||||
"fail_task",
|
||||
"failTask",
|
||||
&["require_signer(ctx)?", "did_matches("],
|
||||
),
|
||||
];
|
||||
|
||||
// Completeness + hidden-mutation cross-check against the REAL schema (#219),
|
||||
// delegated to the generic `assert_mutation_fence` so the SDL sourcing and the
|
||||
// cross-check are ALSO exercised by a synthetic hidden schema in
|
||||
// `fence_rejects_a_hidden_mutation` (INV-21). Because the real MutationRoot has no
|
||||
// hidden field today, that synthetic test — not a hypothetical production canary —
|
||||
// is what turns reverting the SDL source or deleting the cross-check RED.
|
||||
{
|
||||
use crate::graphql::mutation::MutationRoot;
|
||||
use crate::graphql::query::QueryRoot;
|
||||
use crate::graphql::subscription::SubscriptionRoot;
|
||||
let schema =
|
||||
async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
|
||||
let registered_camel: Vec<&str> = registered.iter().map(|(_, c, _)| *c).collect();
|
||||
assert_mutation_fence(&schema, ®istered_camel);
|
||||
}
|
||||
|
||||
// Marker present (source scrape; the vacuity limit, backstopped by the
|
||||
// adversarial tests): each resolver body carries every required gate marker.
|
||||
let masked = mask_comments(include_str!("../graphql/mutation.rs"));
|
||||
for (snake, _, markers) in registered {
|
||||
let body = resolver_body(&masked, snake);
|
||||
for marker in *markers {
|
||||
assert!(
|
||||
body.contains(marker),
|
||||
"GraphQL mutation `{snake}` is missing its gate marker `{marker}`: gate removed"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Version-safety self-check (#219, INV-21): the fence's completeness guarantee rests
|
||||
/// on `schema.sdl()` INCLUDING `visible = false` fields while introspection omits
|
||||
/// them. That is observed async-graphql behavior, not a documented contract, so pin
|
||||
/// it here: a synthetic schema with a hidden mutation must have that field in its
|
||||
/// SDL-derived set and NOT in its introspection-derived set. If a future
|
||||
/// async-graphql upgrade ever filters SDL by visibility, the first assertion flips
|
||||
/// RED — the assumption is load-bearing, not trusted.
|
||||
#[test]
|
||||
fn sdl_source_sees_hidden_mutations_that_introspection_omits() {
|
||||
use async_graphql::{EmptySubscription, Object, Schema};
|
||||
struct Q;
|
||||
#[Object]
|
||||
impl Q {
|
||||
async fn ping(&self) -> i32 {
|
||||
0
|
||||
}
|
||||
}
|
||||
struct M;
|
||||
#[Object]
|
||||
impl M {
|
||||
async fn visible_mut(&self) -> i32 {
|
||||
1
|
||||
}
|
||||
#[graphql(visible = false)]
|
||||
async fn hidden_mut(&self) -> i32 {
|
||||
2
|
||||
}
|
||||
}
|
||||
let schema = Schema::build(Q, M, EmptySubscription).finish();
|
||||
|
||||
// SDL source (the fix): includes the hidden field.
|
||||
let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
|
||||
assert!(
|
||||
sdl_fields.iter().any(|f| f == "hiddenMut"),
|
||||
"SDL-sourced set MUST include the visible=false mutation; if this is RED, \
|
||||
async-graphql started filtering SDL by visibility and the fence's \
|
||||
completeness guarantee is broken: {sdl_fields:?}"
|
||||
);
|
||||
|
||||
// Introspection (the fence's own helper): OMITS the hidden field. This is the
|
||||
// exact gap the fix closes — an introspection-sourced fence never sees `hiddenMut`.
|
||||
let introspected = introspection_mutation_fields(&schema);
|
||||
assert!(
|
||||
!introspected.iter().any(|f| f == "hiddenMut"),
|
||||
"introspection is expected to OMIT the visible=false mutation (that is the \
|
||||
gap the SDL source closes); got {introspected:?}"
|
||||
);
|
||||
|
||||
// The exact diff the fence computes: hidden ∈ (sdl \ introspection).
|
||||
let hidden: Vec<&String> = sdl_fields
|
||||
.iter()
|
||||
.filter(|f| !introspected.iter().any(|i| i == *f))
|
||||
.collect();
|
||||
assert_eq!(
|
||||
hidden,
|
||||
vec!["hiddenMut"],
|
||||
"the SDL-vs-introspection diff must surface exactly the hidden mutation"
|
||||
);
|
||||
}
|
||||
|
||||
/// INV-21 wiring guard (#219): drives the generic `assert_mutation_fence` — the SAME
|
||||
/// helper the real fence calls — against a synthetic schema whose mutation is
|
||||
/// `visible = false` and IS registered, so completeness passes and ONLY the
|
||||
/// hidden-from-introspection cross-check can fail. This is what makes the fence's SDL
|
||||
/// sourcing load-bearing without a production canary: reverting the source to
|
||||
/// introspection (the hidden field then absent from the SDL set) or deleting the
|
||||
/// cross-check removes this panic (or changes its message), turning the
|
||||
/// `should_panic` test RED. The real MutationRoot has no hidden field, so nothing on
|
||||
/// the real schema could catch that regression.
|
||||
#[test]
|
||||
#[should_panic(expected = "hidden from introspection")]
|
||||
fn fence_rejects_a_hidden_mutation() {
|
||||
use async_graphql::{EmptySubscription, Object, Schema};
|
||||
struct Q;
|
||||
#[Object]
|
||||
impl Q {
|
||||
async fn ping(&self) -> i32 {
|
||||
0
|
||||
}
|
||||
}
|
||||
struct M;
|
||||
#[Object]
|
||||
impl M {
|
||||
async fn visible_mut(&self) -> i32 {
|
||||
1
|
||||
}
|
||||
#[graphql(visible = false)]
|
||||
async fn hidden_mut(&self) -> i32 {
|
||||
2
|
||||
}
|
||||
}
|
||||
let schema = Schema::build(Q, M, EmptySubscription).finish();
|
||||
// Both fields registered, so completeness passes and only the cross-check fires.
|
||||
assert_mutation_fence(&schema, &["visibleMut", "hiddenMut"]);
|
||||
}
|
||||
|
||||
/// Deprecated-mutation guard (#219): a `#[graphql(deprecation = "...")]` mutation is
|
||||
/// executable and present in SDL, but GraphQL introspection omits it by default. The
|
||||
/// fence's introspection helper uses `includeDeprecated: true`, so a deprecated (but
|
||||
/// visible) mutation is NOT mistaken for a hidden one. With it registered, the fence
|
||||
/// must NOT panic. Remove `includeDeprecated: true` and this goes RED — the deprecated
|
||||
/// field would look hidden and false-red as a forbidden visible=false mutation.
|
||||
#[test]
|
||||
fn fence_admits_a_deprecated_mutation() {
|
||||
use async_graphql::{EmptySubscription, Object, Schema};
|
||||
struct Q;
|
||||
#[Object]
|
||||
impl Q {
|
||||
async fn ping(&self) -> i32 {
|
||||
0
|
||||
}
|
||||
}
|
||||
struct M;
|
||||
#[Object]
|
||||
impl M {
|
||||
async fn visible_mut(&self) -> i32 {
|
||||
1
|
||||
}
|
||||
#[graphql(deprecation = "use visibleMut")]
|
||||
async fn deprecated_mut(&self) -> i32 {
|
||||
2
|
||||
}
|
||||
}
|
||||
let schema = Schema::build(Q, M, EmptySubscription).finish();
|
||||
// Must not panic: the deprecated field is visible (present in introspection with
|
||||
// includeDeprecated) and registered, so it is neither hidden nor unclassified.
|
||||
assert_mutation_fence(&schema, &["visibleMut", "deprecatedMut"]);
|
||||
}
|
||||
|
||||
/// Completeness + hidden-mutation cross-check for a BUILT schema (#219). Generic over
|
||||
/// the schema type so the real fence AND the synthetic `fence_rejects_a_hidden_mutation`
|
||||
/// / `fence_admits_a_deprecated_mutation` tests drive the SAME sourcing and cross-check.
|
||||
/// Completeness is sourced from SDL (which includes `visible = false` fields); the
|
||||
/// cross-check fails any SDL field hidden from introspection. This genericity is the
|
||||
/// INV-21 fix: because the real MutationRoot has no hidden field, only a synthetic
|
||||
/// hidden schema through THIS helper makes reverting the SDL source or removing the
|
||||
/// cross-check RED, rather than leaving the class latent behind a production canary.
|
||||
fn assert_mutation_fence<Q, M, S>(
|
||||
schema: &async_graphql::Schema<Q, M, S>,
|
||||
registered_camel: &[&str],
|
||||
) where
|
||||
Q: async_graphql::ObjectType + 'static,
|
||||
M: async_graphql::ObjectType + 'static,
|
||||
S: async_graphql::SubscriptionType + 'static,
|
||||
{
|
||||
let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
|
||||
let introspected = introspection_mutation_fields(schema);
|
||||
// No SDL field may be hidden from introspection (a visible=false mutation).
|
||||
for f in &sdl_fields {
|
||||
assert!(
|
||||
introspected.iter().any(|i| i == f),
|
||||
"GraphQL mutation `{f}` is in the schema but hidden from introspection \
|
||||
(a `#[graphql(visible = false)]` field): hidden mutations are forbidden \
|
||||
by this fence — make it visible so its classification is enforceable, or \
|
||||
remove it"
|
||||
);
|
||||
}
|
||||
// Completeness both directions against the registered (camelCase) set.
|
||||
for f in &sdl_fields {
|
||||
assert!(
|
||||
registered_camel.contains(&f.as_str()),
|
||||
"unclassified GraphQL mutation `{f}`: add it to \
|
||||
every_graphql_mutation_has_its_gate with a deliberate gate \
|
||||
(`require_repo_owner(` for a repo-write, `did_matches(` for a task op)"
|
||||
);
|
||||
}
|
||||
for c in registered_camel {
|
||||
assert!(
|
||||
sdl_fields.iter().any(|f| f == c),
|
||||
"registered GraphQL mutation `{c}` is not in the schema \
|
||||
(renamed or removed); update the table"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// The mutation field names via the engine's introspection, run against a passed
|
||||
/// schema. STRUCTURED (names arrive as data). Uses `fields(includeDeprecated: true)`:
|
||||
/// GraphQL's default omits `@deprecated` fields, but a `#[graphql(deprecation = "...")]`
|
||||
/// mutation is still executable and present in SDL, so without this the cross-check
|
||||
/// above would false-red a deprecated mutation as a hidden (visible=false) one. Only a
|
||||
/// real visibility filter should trip that arm; deprecation is a lifecycle marker.
|
||||
fn introspection_mutation_fields<Q, M, S>(
|
||||
schema: &async_graphql::Schema<Q, M, S>,
|
||||
) -> Vec<String>
|
||||
where
|
||||
Q: async_graphql::ObjectType + 'static,
|
||||
M: async_graphql::ObjectType + 'static,
|
||||
S: async_graphql::SubscriptionType + 'static,
|
||||
{
|
||||
use async_graphql::Value;
|
||||
let resp = tokio::runtime::Runtime::new()
|
||||
.expect("tokio runtime")
|
||||
.block_on(schema.execute(
|
||||
"{ __schema { mutationType { fields(includeDeprecated: true) { name } } } }",
|
||||
));
|
||||
assert!(
|
||||
resp.errors.is_empty(),
|
||||
"schema introspection failed: {:?}",
|
||||
resp.errors
|
||||
);
|
||||
let mut names = Vec::new();
|
||||
if let Value::Object(root) = &resp.data {
|
||||
if let Some(Value::Object(sc)) = root.get("__schema") {
|
||||
if let Some(Value::Object(mt)) = sc.get("mutationType") {
|
||||
if let Some(Value::List(field_list)) = mt.get("fields") {
|
||||
for field in field_list {
|
||||
if let Value::Object(fo) = field {
|
||||
if let Some(Value::String(n)) = fo.get("name") {
|
||||
names.push(n.clone());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
names
|
||||
}
|
||||
|
||||
/// The mutation field names sourced from the built schema's SDL — the completeness
|
||||
/// source (#219). Builds the same DB-free schema as the introspection helper and runs
|
||||
/// its `.sdl()` (sync, no runtime needed) through [`mutation_field_names_from_sdl`].
|
||||
/// SDL includes `#[graphql(visible = false)]` fields, so this source cannot be
|
||||
/// defeated by hiding a mutation from introspection.
|
||||
fn graphql_mutation_fields_from_sdl() -> Vec<String> {
|
||||
use crate::graphql::mutation::MutationRoot;
|
||||
use crate::graphql::query::QueryRoot;
|
||||
use crate::graphql::subscription::SubscriptionRoot;
|
||||
let schema =
|
||||
async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
|
||||
mutation_field_names_from_sdl(&schema.sdl())
|
||||
}
|
||||
|
||||
/// The mutation type's field names extracted from an async-graphql SDL string via
|
||||
/// the engine's OWN parser AST (`async_graphql::parser::parse_schema`), NOT
|
||||
/// introspection. This is the completeness source (#219): unlike introspection,
|
||||
/// which async-graphql filters by `visible` (a `#[graphql(visible = false)]`
|
||||
/// mutation is executable but ABSENT from introspection), `schema.sdl()` includes
|
||||
/// every registered field, so a hidden mutation still appears here and must carry a
|
||||
/// classified row. Parsing the AST (not a brace/line text scan) means a `}` inside a
|
||||
/// field description cannot mis-slice the type block. camelCase, as async-graphql
|
||||
/// emits. An empty result on a navigation miss is safe: the set-equality in
|
||||
/// `every_graphql_mutation_has_its_gate` turns "no fields" into a loud failure for
|
||||
/// every registered name, never a vacuous pass.
|
||||
fn mutation_field_names_from_sdl(sdl: &str) -> Vec<String> {
|
||||
use async_graphql::parser::parse_schema;
|
||||
use async_graphql::parser::types::{TypeKind, TypeSystemDefinition};
|
||||
|
||||
let doc = parse_schema(sdl).expect("async-graphql SDL must parse");
|
||||
// The mutation root type name: from the `schema { mutation: X }` block if
|
||||
// present, else the GraphQL default "Mutation".
|
||||
let mutation_type = doc
|
||||
.definitions
|
||||
.iter()
|
||||
.find_map(|def| match def {
|
||||
TypeSystemDefinition::Schema(s) => s
|
||||
.node
|
||||
.mutation
|
||||
.as_ref()
|
||||
.map(|m| m.node.as_str().to_string()),
|
||||
_ => None,
|
||||
})
|
||||
.unwrap_or_else(|| "Mutation".to_string());
|
||||
// The fields of that object type.
|
||||
doc.definitions
|
||||
.iter()
|
||||
.find_map(|def| match def {
|
||||
TypeSystemDefinition::Type(t) if t.node.name.node.as_str() == mutation_type => {
|
||||
match &t.node.kind {
|
||||
TypeKind::Object(obj) => Some(
|
||||
obj.fields
|
||||
.iter()
|
||||
.map(|f| f.node.name.node.as_str().to_string())
|
||||
.collect::<Vec<_>>(),
|
||||
),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
_ => None,
|
||||
})
|
||||
.unwrap_or_default()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sdl_extractor_includes_a_hidden_visible_false_field() {
|
||||
// A field that would be hidden from introspection must still be listed from SDL.
|
||||
let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
|
||||
type QueryRoot { ping: Int! }\n\
|
||||
type MutationRoot { createTask: Int! hiddenMut: Int! }\n";
|
||||
let fields = mutation_field_names_from_sdl(sdl);
|
||||
assert!(
|
||||
fields.iter().any(|f| f == "createTask"),
|
||||
"visible field must be listed: {fields:?}"
|
||||
);
|
||||
assert!(
|
||||
fields.iter().any(|f| f == "hiddenMut"),
|
||||
"a visible=false field (present in SDL, hidden from introspection) MUST be \
|
||||
listed by the completeness source: {fields:?}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sdl_extractor_is_not_fooled_by_a_brace_in_a_field_description() {
|
||||
// A `}` inside a field description must not truncate the type block (the AST
|
||||
// parse is immune to the text-parse quirk the old design feared).
|
||||
let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
|
||||
type QueryRoot { ping: Int! }\n\
|
||||
type MutationRoot {\n\
|
||||
\"\"\"a description with a } brace and { another\"\"\"\n\
|
||||
createTask: Int!\n\
|
||||
claimTask: Int!\n\
|
||||
}\n";
|
||||
let fields = mutation_field_names_from_sdl(sdl);
|
||||
assert!(
|
||||
fields.iter().any(|f| f == "createTask") && fields.iter().any(|f| f == "claimTask"),
|
||||
"both fields must be extracted despite a brace in a description: {fields:?}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sdl_extractor_returns_empty_for_a_query_only_schema() {
|
||||
let sdl = "schema { query: QueryRoot }\ntype QueryRoot { ping: Int! }\n";
|
||||
assert!(
|
||||
mutation_field_names_from_sdl(sdl).is_empty(),
|
||||
"a schema with no mutation root yields no mutation fields (no panic)"
|
||||
);
|
||||
}
|
||||
|
||||
/// The comment-masked body of `async fn <snake>` in `graphql/mutation.rs`, bounded
|
||||
/// to the resolver's OWN braces (its `{ .. }`), for the marker check. Brace-matching
|
||||
/// on the comment-masked source means a `}` in a trailing helper cannot extend the
|
||||
/// body and a comment marker does not count. A `{`/`}` inside a STRING literal is
|
||||
/// not masked, a documented marker-check-only residual (limit 3); completeness does
|
||||
/// not use this.
|
||||
fn resolver_body(masked_src: &str, snake: &str) -> String {
|
||||
let needle = format!("async fn {snake}(");
|
||||
let start = masked_src.find(&needle).unwrap_or_else(|| {
|
||||
panic!("resolver `async fn {snake}(` not found in graphql/mutation.rs")
|
||||
});
|
||||
let open = start
|
||||
+ masked_src[start..]
|
||||
.find('{')
|
||||
.expect("resolver body opening brace");
|
||||
let mut depth = 0i32;
|
||||
let mut end = masked_src.len();
|
||||
for (i, c) in masked_src[open..].char_indices() {
|
||||
match c {
|
||||
'{' => depth += 1,
|
||||
'}' => {
|
||||
depth -= 1;
|
||||
if depth == 0 {
|
||||
end = open + i + 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
masked_src[open..end].to_string()
|
||||
}
|
||||
|
||||
/// `src` with `//` line comments and `/* */` block comments (nested) blanked to
|
||||
/// spaces, WITHOUT opening a comment inside a `"..."` string (so a `"https://"` does
|
||||
/// not erase the rest of its line). String CONTENTS are left intact, so a brace or
|
||||
/// a gate marker inside a string is not masked; for the marker check that is a
|
||||
/// documented vacuity residual (limit 3), and completeness does not use this at
|
||||
/// all. Char literals and raw/byte strings are not tracked (absent in resolver
|
||||
/// bodies); a `'"'` char or a raw string is the remaining narrow residual.
|
||||
fn mask_comments(src: &str) -> String {
|
||||
let chars: Vec<char> = src.chars().collect();
|
||||
let mut out = String::with_capacity(src.len());
|
||||
let mut i = 0;
|
||||
let mut block_depth = 0usize;
|
||||
let mut in_string = false;
|
||||
while i < chars.len() {
|
||||
let c = chars[i];
|
||||
let next = chars.get(i + 1).copied();
|
||||
if block_depth > 0 {
|
||||
if c == '/' && next == Some('*') {
|
||||
block_depth += 1;
|
||||
out.push_str(" ");
|
||||
i += 2;
|
||||
} else if c == '*' && next == Some('/') {
|
||||
block_depth -= 1;
|
||||
out.push_str(" ");
|
||||
i += 2;
|
||||
} else {
|
||||
out.push(if c == '\n' { '\n' } else { ' ' });
|
||||
i += 1;
|
||||
}
|
||||
} else if in_string {
|
||||
out.push(c);
|
||||
if c == '\\' {
|
||||
if let Some(n) = next {
|
||||
out.push(n);
|
||||
i += 2;
|
||||
} else {
|
||||
i += 1;
|
||||
}
|
||||
} else {
|
||||
if c == '"' {
|
||||
in_string = false;
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
} else if c == '"' {
|
||||
in_string = true;
|
||||
out.push('"');
|
||||
i += 1;
|
||||
} else if c == '/' && next == Some('/') {
|
||||
while i < chars.len() && chars[i] != '\n' {
|
||||
out.push(' ');
|
||||
i += 1;
|
||||
}
|
||||
} else if c == '/' && next == Some('*') {
|
||||
block_depth = 1;
|
||||
out.push_str(" ");
|
||||
i += 2;
|
||||
} else {
|
||||
out.push(c);
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// The SDL field set (the completeness source of truth, #219) is exactly the
|
||||
/// registered mutations. If async-graphql adds or renames a field, this reddens
|
||||
/// and forces the `every_graphql_mutation_has_its_gate` table to be updated. Uses
|
||||
/// SDL, not introspection: introspection omits `visible = false` fields, so an
|
||||
/// introspection-based pin here would go green while a hidden mutation existed.
|
||||
#[test]
|
||||
fn schema_lists_exactly_the_registered_mutations() {
|
||||
let mut fields = graphql_mutation_fields_from_sdl();
|
||||
fields.sort();
|
||||
assert_eq!(
|
||||
fields,
|
||||
vec!["claimTask", "completeTask", "createTask", "failTask"],
|
||||
"the SDL mutation field set is the authoritative discovered set"
|
||||
);
|
||||
}
|
||||
|
||||
/// The marker check is bounded to a resolver's OWN body and is comment- and
|
||||
/// string-aware: a `//` inside a `"https://"` string does not erase a real gate on
|
||||
/// that line (no false-red), and a trailing module helper's `did_matches(` does not
|
||||
/// rescue a resolver whose own gate was removed (no false-green).
|
||||
#[test]
|
||||
fn resolver_body_is_bounded_and_comment_and_string_aware() {
|
||||
let src = "\
|
||||
impl MutationRoot {
|
||||
async fn ok(&self) -> Result<u32> {
|
||||
let _ = (\"see https://x/y\", did_matches(a, b)); // URL string then gate, one line
|
||||
Ok(0)
|
||||
}
|
||||
async fn last(&self) -> Result<u32> {
|
||||
// did_matches( only in a comment
|
||||
Ok(0)
|
||||
}
|
||||
}
|
||||
fn helper() { let _ = did_matches(z, z); }
|
||||
#[cfg(test)]
|
||||
mod tests { async fn t() { let _ = did_matches(x, y); } }
|
||||
";
|
||||
let masked = mask_comments(src);
|
||||
assert!(
|
||||
resolver_body(&masked, "ok").contains("did_matches("),
|
||||
"a `//` inside a string must not erase the real gate on that line"
|
||||
);
|
||||
assert!(
|
||||
!resolver_body(&masked, "last").contains("did_matches("),
|
||||
"the marker check must be bounded to the resolver's own body (a trailing \
|
||||
helper's marker must not rescue a resolver whose gate was removed)"
|
||||
);
|
||||
}
|
||||
|
||||
/// Proves the comment-stripping that GUARD-1 added: a marker that appears only
|
||||
/// in a full-line comment (the real `replicas.rs` false-pass shape) must NOT
|
||||
/// satisfy a row.
|
||||
|
||||
@@ -39,11 +39,11 @@ pub async fn register_replica(
|
||||
) -> Result<(StatusCode, Json<serde_json::Value>)> {
|
||||
validate_replica_url(&req.url)?;
|
||||
|
||||
// The mutation response carries repo metadata (name, replica count), so
|
||||
// registration applies the same read-visibility decision as the listing:
|
||||
// a caller who may not read the repo gets the same 404 as a missing one.
|
||||
let (record, _rules) =
|
||||
crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
|
||||
let record = state
|
||||
.db
|
||||
.get_repo(&owner, &repo)
|
||||
.await?
|
||||
.ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
|
||||
|
||||
let replica_did = &auth.0;
|
||||
|
||||
@@ -93,10 +93,11 @@ pub async fn unregister_replica(
|
||||
Extension(auth): Extension<AuthenticatedDid>,
|
||||
Path((owner, repo)): Path<(String, String)>,
|
||||
) -> Result<Json<serde_json::Value>> {
|
||||
// Same gate as register_replica: removal mutates repo-scoped metadata and
|
||||
// its response discloses the replica count.
|
||||
let (record, _rules) =
|
||||
crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
|
||||
let record = state
|
||||
.db
|
||||
.get_repo(&owner, &repo)
|
||||
.await?
|
||||
.ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
|
||||
|
||||
let replica_did = &auth.0;
|
||||
state.db.unregister_replica(&record.id, replica_did).await?;
|
||||
|
||||
@@ -3186,21 +3186,10 @@ pub async fn list_refs(
|
||||
auth: Option<Extension<AuthenticatedDid>>,
|
||||
) -> Result<Json<serde_json::Value>> {
|
||||
let caller = auth.as_ref().map(|e| e.0 .0.as_str());
|
||||
let (record, _rules) =
|
||||
let (_record, _rules) =
|
||||
crate::api::authorize_repo_read(&state, &owner, &repo, caller, "/").await?;
|
||||
|
||||
// Build the filter from the canonical stored slug, NOT from the raw path
|
||||
// segments. `branch_cids.repo` is written as
|
||||
// `{normalize_owner_key(owner_did)}/{name}` (the push path builds the same
|
||||
// slug before calling `upsert_branch_cid`), and
|
||||
// `get_repo` resolves both `did:key:zX` and bare `zX` to the same record, so
|
||||
// a request in the full-DID form authorizes and then matches zero rows,
|
||||
// returning an empty page with a 200.
|
||||
let repo_slug = format!(
|
||||
"{}/{}",
|
||||
crate::db::normalize_owner_key(&record.owner_did),
|
||||
record.name
|
||||
);
|
||||
let repo_slug = format!("{owner}/{repo}");
|
||||
let refs = state.db.list_branch_cids(&repo_slug).await?;
|
||||
|
||||
Ok(Json(
|
||||
@@ -3877,12 +3866,6 @@ struct RefUpdate {
|
||||
ref_name: String,
|
||||
}
|
||||
|
||||
/// A git object id is 40 hex chars; length alone is not enough, since a peer
|
||||
/// can send 40 arbitrary bytes (#398).
|
||||
fn is_hex_sha(s: &str) -> bool {
|
||||
s.len() == 40 && s.bytes().all(|b| b.is_ascii_hexdigit())
|
||||
}
|
||||
|
||||
/// Parse git receive-pack pkt-line ref updates from the request body.
|
||||
/// Format per line: `<40-hex-old> <40-hex-new> <refname>[NUL capabilities]\n`
|
||||
fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
|
||||
@@ -3924,7 +3907,7 @@ fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
|
||||
.trim_end_matches('\n');
|
||||
|
||||
let parts: Vec<&str> = line.splitn(3, ' ').collect();
|
||||
if parts.len() == 3 && is_hex_sha(parts[0]) && is_hex_sha(parts[1]) {
|
||||
if parts.len() == 3 && parts[0].len() == 40 && parts[1].len() == 40 {
|
||||
updates.push(RefUpdate {
|
||||
old_sha: parts[0].to_string(),
|
||||
new_sha: parts[1].to_string(),
|
||||
@@ -4444,45 +4427,6 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
// #398: a peer-supplied pkt-line whose 40-byte "SHA" fields carry non-hex
|
||||
// content must be dropped, not forwarded into RefUpdate events, branch_cid
|
||||
// rows, and sync-notify JSON as a canonical-looking identifier.
|
||||
#[test]
|
||||
fn parse_ref_updates_requires_hex_shas() {
|
||||
let sha_a = "a".repeat(40);
|
||||
let sha_b = "b".repeat(40);
|
||||
let pkt = |old: &str, new: &str, refname: &str| {
|
||||
let line = format!("{old} {new} {refname}");
|
||||
format!("{:04x}{}0000", line.len() + 4, line).into_bytes()
|
||||
};
|
||||
|
||||
// Valid 40-hex old + new -> accepted.
|
||||
let updates = parse_ref_updates(&pkt(&sha_a, &sha_b, "refs/heads/main"));
|
||||
assert_eq!(updates.len(), 1);
|
||||
assert_eq!(updates[0].old_sha, sha_a);
|
||||
assert_eq!(updates[0].new_sha, sha_b);
|
||||
assert_eq!(updates[0].ref_name, "refs/heads/main");
|
||||
|
||||
// 40-byte non-hex fields -> dropped.
|
||||
let junk = "Z".repeat(40);
|
||||
assert!(parse_ref_updates(&pkt(&junk, &sha_b, "refs/heads/main")).is_empty());
|
||||
assert!(parse_ref_updates(&pkt(&sha_a, &junk, "refs/heads/main")).is_empty());
|
||||
|
||||
// Wrong lengths -> dropped.
|
||||
assert!(parse_ref_updates(&pkt(&"a".repeat(39), &sha_b, "refs/heads/main")).is_empty());
|
||||
assert!(parse_ref_updates(&pkt(&sha_a, &"b".repeat(41), "refs/heads/main")).is_empty());
|
||||
|
||||
// A bad line among good ones drops only the bad line.
|
||||
let sha_c = "c".repeat(40);
|
||||
let bad = pkt(&junk, &sha_b, "refs/heads/bad");
|
||||
let good = pkt(&sha_a, &sha_c, "refs/heads/good");
|
||||
let mut mixed = bad[..bad.len() - 4].to_vec(); // strip trailing flush
|
||||
mixed.extend_from_slice(&good);
|
||||
let updates = parse_ref_updates(&mixed);
|
||||
assert_eq!(updates.len(), 1);
|
||||
assert_eq!(updates[0].ref_name, "refs/heads/good");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn git_service_app_error_classifies_timeout_bad_request_and_git() {
|
||||
// GitServiceTimeout carried through anyhow -> 504 Timeout.
|
||||
@@ -8289,7 +8233,7 @@ mod tests {
|
||||
let add = server
|
||||
.mock("POST", mockito::Matcher::Any)
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"QmShouldNotHappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
//! #26 Split PR 2 — three-outcome recovery policy types.
|
||||
//!
|
||||
//! This module owns the recovery classification policy the reviewer
|
||||
//! demanded: only a trustworthy, protocol-defined absence authorizes
|
||||
//! a paid re-upload. Everything else stays non-terminal.
|
||||
//!
|
||||
//! Deliberately narrow: the ANS-104 codec lives in `ans104`, and the
|
||||
//! gateway probe, the `verify_anchor` path, and the public verify
|
||||
//! endpoint are deferred until the uploader, retrieval proof, and
|
||||
//! recovery consumer can be proven as one vertical slice (reviewer 2,
|
||||
//! round 5). A probe against a real provider contract — same-network
|
||||
//! upload/read pair, redirect-safe client, envelope-supplying read
|
||||
//! API, provider-documented absence evidence — belongs in that slice,
|
||||
//! not here. What ships here is the policy type plus the rule that
|
||||
//! only `DefinitivelyAbsent` permits spending another upload.
|
||||
|
||||
/// Outcome of a gateway probe for a persisted `item_id`.
|
||||
// Policy surface for the recovery slice: no construction on this
|
||||
// head (the probe arrives with the provider contract); the unit
|
||||
// test pins the rule meanwhile.
|
||||
#[allow(dead_code)]
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum ProbeOutcome {
|
||||
/// The persisted item was served back with a verifiable envelope
|
||||
/// bound to the requested id. No re-upload allowed.
|
||||
Present,
|
||||
/// Trustworthy, protocol-defined proof the item was never
|
||||
/// accepted. Authorizes re-upload. The exact evidence that
|
||||
/// establishes this is defined by the provider contract in the
|
||||
/// vertical slice that introduces the probe — never by a
|
||||
/// mock-only body shape.
|
||||
DefinitivelyAbsent,
|
||||
/// Anything else: transport failure, oversized body, bad
|
||||
/// signature, id mismatch, ambiguous gateway response. The
|
||||
/// outbox stays non-terminal.
|
||||
Indeterminate,
|
||||
}
|
||||
|
||||
impl ProbeOutcome {
|
||||
/// True iff the recovery code is allowed to spend another paid
|
||||
/// upload request. Only `DefinitivelyAbsent` qualifies.
|
||||
#[allow(dead_code)] // the recovery consumer lives in a later slice
|
||||
pub fn permits_reupload(self) -> bool {
|
||||
matches!(self, ProbeOutcome::DefinitivelyAbsent)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
/// Only `DefinitivelyAbsent` authorizes a paid re-upload. This is
|
||||
/// the policy the reviewer named: collapsing any ambiguous outcome
|
||||
/// to absent spends a second immutable upload for the same
|
||||
/// transition.
|
||||
#[test]
|
||||
fn only_definitively_absent_authorizes_reupload() {
|
||||
assert!(!ProbeOutcome::Present.permits_reupload());
|
||||
assert!(ProbeOutcome::DefinitivelyAbsent.permits_reupload());
|
||||
assert!(!ProbeOutcome::Indeterminate.permits_reupload());
|
||||
}
|
||||
}
|
||||
@@ -55,10 +55,7 @@ pub struct Config {
|
||||
#[arg(long, env = "GITLAWB_KEY", default_value = "~/.gitlawb/identity.pem")]
|
||||
pub key_path: String,
|
||||
|
||||
/// Reserved and currently inert: read access is enforced per repository
|
||||
/// through `is_public` and path-scoped visibility rules, not this flag.
|
||||
/// Setting it to false changes nothing; make a repo private through its
|
||||
/// own visibility instead.
|
||||
/// Reserved for private-read mode; per-repo read enforcement is not wired in alpha
|
||||
#[arg(long, env = "GITLAWB_PUBLIC_READ", default_value_t = true)]
|
||||
pub public_read: bool,
|
||||
|
||||
@@ -1637,28 +1634,6 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
/// #338: GITLAWB_PUBLIC_READ is inert, so its help must not claim read
|
||||
/// enforcement is missing; it must tell the operator the flag changes
|
||||
/// nothing and where the real control lives.
|
||||
#[test]
|
||||
fn public_read_help_describes_the_flag_as_inert() {
|
||||
use clap::CommandFactory;
|
||||
let cmd = Config::command();
|
||||
let arg = cmd
|
||||
.get_arguments()
|
||||
.find(|a| a.get_id() == "public_read")
|
||||
.expect("the argument must exist");
|
||||
let help = arg.get_help().map(|h| h.to_string()).unwrap_or_default();
|
||||
assert!(
|
||||
!help.contains("not wired"),
|
||||
"the help still claims read enforcement is unwired: {help}"
|
||||
);
|
||||
assert!(
|
||||
help.contains("inert"),
|
||||
"the help must say the flag is inert so an operator does not rely on it: {help}"
|
||||
);
|
||||
}
|
||||
|
||||
/// The flip must not strand an operator mid-upgrade.
|
||||
///
|
||||
/// Turning the gate on is a breaking change for any deployment whose pushers are
|
||||
|
||||
@@ -186,78 +186,57 @@ mod tests {
|
||||
.join("; ")
|
||||
}
|
||||
|
||||
/// N2: every GraphQL mutation requires a verified signer and binds the acting
|
||||
/// DID to it. Unsigned is rejected; a signer other than the claimed actor is
|
||||
/// N2: GraphQL mutations require a verified signer and bind the acting DID to
|
||||
/// it. Unsigned is rejected; a signer other than the claimed actor is
|
||||
/// rejected; the matching signer passes the auth gate.
|
||||
#[sqlx::test]
|
||||
async fn each_mutation_requires_and_binds_signer(pool: PgPool) {
|
||||
async fn mutation_requires_and_binds_signer(pool: PgPool) {
|
||||
let state = crate::test_support::test_state(pool).await;
|
||||
let schema = state.graphql_schema.as_ref();
|
||||
let actor = "did:key:zGQLACTORAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
let other = "did:key:zGQLOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
|
||||
let cases: Vec<(&str, String)> = vec![
|
||||
(
|
||||
"createTask",
|
||||
format!(
|
||||
r#"mutation {{ createTask(delegatorDid: "{actor}", input: {{ kind: "build", capability: "repo:write" }}) {{ id }} }}"#
|
||||
),
|
||||
),
|
||||
(
|
||||
"claimTask",
|
||||
format!(
|
||||
r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{actor}") {{ id }} }}"#
|
||||
),
|
||||
),
|
||||
(
|
||||
"completeTask",
|
||||
format!(
|
||||
r#"mutation {{ completeTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
|
||||
),
|
||||
),
|
||||
(
|
||||
"failTask",
|
||||
format!(
|
||||
r#"mutation {{ failTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
|
||||
),
|
||||
),
|
||||
];
|
||||
let assignee = "did:key:zASSIGNEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
let q = format!(
|
||||
r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{assignee}") {{ id }} }}"#
|
||||
);
|
||||
|
||||
for (name, q) in &cases {
|
||||
let resp = schema.execute(Request::new(q.as_str())).await;
|
||||
assert!(
|
||||
errors(&resp).contains("authentication required"),
|
||||
"{name}: unsigned mutation must be rejected: {}",
|
||||
errors(&resp)
|
||||
);
|
||||
// 1. Unsigned → rejected before any DB work.
|
||||
let resp = schema.execute(Request::new(&q)).await;
|
||||
assert!(
|
||||
errors(&resp).contains("authentication required"),
|
||||
"unsigned mutation must be rejected: {}",
|
||||
errors(&resp)
|
||||
);
|
||||
|
||||
let resp = schema
|
||||
.execute(Request::new(q.as_str()).data(AuthenticatedDid(other.into())))
|
||||
.await;
|
||||
assert!(
|
||||
errors(&resp).contains("authenticated signer"),
|
||||
"{name}: DID mismatch must be rejected: {}",
|
||||
errors(&resp)
|
||||
);
|
||||
// 2. Signed as someone other than the claimed assignee → rejected.
|
||||
let resp = schema
|
||||
.execute(Request::new(&q).data(AuthenticatedDid(
|
||||
"did:key:zOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".into(),
|
||||
)))
|
||||
.await;
|
||||
assert!(
|
||||
errors(&resp).contains("authenticated signer"),
|
||||
"DID mismatch must be rejected: {}",
|
||||
errors(&resp)
|
||||
);
|
||||
|
||||
let resp = schema
|
||||
.execute(Request::new(q.as_str()).data(AuthenticatedDid(actor.into())))
|
||||
.await;
|
||||
let errs = errors(&resp);
|
||||
assert!(
|
||||
!errs.contains("authentication required") && !errs.contains("authenticated signer"),
|
||||
"{name}: matching signer must pass the auth gate: {errs}"
|
||||
);
|
||||
if *name == "claimTask" {
|
||||
assert!(
|
||||
errs.contains("task not claimable"),
|
||||
"claim race / missing task must keep its business message: {errs}"
|
||||
);
|
||||
assert!(
|
||||
!errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
|
||||
"business error must not be rewritten as opaque DB error: {errs}"
|
||||
);
|
||||
}
|
||||
}
|
||||
// 3. Signed as the claimed assignee → passes the auth gate. The missing
|
||||
// task is a business error from claim_task, not a sqlx fault, so the
|
||||
// actionable message must survive (not the opaque DB string) (#250).
|
||||
let resp = schema
|
||||
.execute(Request::new(&q).data(AuthenticatedDid(assignee.into())))
|
||||
.await;
|
||||
let errs = errors(&resp);
|
||||
assert!(
|
||||
!errs.contains("authentication required") && !errs.contains("authenticated signer"),
|
||||
"matching signer must pass the auth gate: {errs}"
|
||||
);
|
||||
assert!(
|
||||
errs.contains("task not claimable"),
|
||||
"claim race / missing task must keep its business message: {errs}"
|
||||
);
|
||||
assert!(
|
||||
!errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
|
||||
"business error must not be rewritten as opaque DB error: {errs}"
|
||||
);
|
||||
}
|
||||
|
||||
/// #250: mutation DB faults must be opaque; create_task hits agent_tasks.
|
||||
|
||||
@@ -1508,6 +1508,9 @@ pub async fn pin_git_object(
|
||||
return Ok(String::new());
|
||||
}
|
||||
|
||||
// Compute the expected CIDv1 from the content bytes
|
||||
let expected_cid = Cid::from_git_object_bytes(data).to_string();
|
||||
|
||||
let url = format!(
|
||||
"{}/api/v0/add?cid-version=1&raw-leaves=true&pin=true",
|
||||
ipfs_api.trim_end_matches('/')
|
||||
@@ -1554,10 +1557,6 @@ pub async fn pin_git_object(
|
||||
.text()
|
||||
.await
|
||||
.map_err(|e| anyhow::anyhow!("IPFS add response body read failed: {e}"))?;
|
||||
// A 200 without a parseable Hash is not a successful pin. Fabricating the
|
||||
// caller-computed CID would record an address the backend never confirmed;
|
||||
// above its chunk threshold that raw CID is not even a stored block, so
|
||||
// every later cat fails permanently.
|
||||
let cid = body
|
||||
.lines()
|
||||
.filter(|l| !l.trim().is_empty())
|
||||
@@ -1566,17 +1565,7 @@ pub async fn pin_git_object(
|
||||
v["Hash"].as_str().map(|s| s.to_string())
|
||||
})
|
||||
.next_back()
|
||||
.ok_or_else(|| {
|
||||
anyhow::anyhow!(
|
||||
"IPFS /api/v0/add returned 200 without a usable Hash: {:.200}",
|
||||
body
|
||||
)
|
||||
})?;
|
||||
// The string still has to be a CID. A garbage Hash would be recorded and
|
||||
// later cat-ed the same way a missing one was, so reject it here.
|
||||
Cid::from_str(&cid).map_err(|e| {
|
||||
anyhow::anyhow!("IPFS /api/v0/add returned a Hash that is not a CID ({cid:.200}): {e}")
|
||||
})?;
|
||||
.unwrap_or(expected_cid.clone());
|
||||
|
||||
tracing::debug!(sha256 = %sha256_hex, %cid, "pinned git object to IPFS");
|
||||
Ok(cid)
|
||||
@@ -2234,16 +2223,16 @@ mod tests {
|
||||
endpoint
|
||||
}
|
||||
|
||||
/// A sleeping-but-live endpoint. Answers `200` with a conformant NDJSON add
|
||||
/// response after `delays[i]` for the i-th request it accepts (the last
|
||||
/// entry repeats), so a test can make one add slow and the next fast.
|
||||
/// Drains the full request, headers plus the declared `Content-Length`
|
||||
/// body, before sleeping: exactly as in `rejecting_endpoint`, answering
|
||||
/// early and closing would surface as a write failure on the client and
|
||||
/// turn a slow-but-healthy add into a different failure shape.
|
||||
/// A sleeping-but-live endpoint. Answers `200` with an empty body after
|
||||
/// `delays[i]` for the i-th request it accepts (the last entry repeats), so
|
||||
/// a test can make one add slow and the next fast. Drains the full request,
|
||||
/// headers plus the declared `Content-Length` body, before sleeping: exactly
|
||||
/// as in `rejecting_endpoint`, answering early and closing would surface as
|
||||
/// a write failure on the client and turn a slow-but-healthy add into a
|
||||
/// different failure shape.
|
||||
///
|
||||
/// The Hash is a fixed, real CID: the timing tests assert on pin counts,
|
||||
/// not on the recorded address.
|
||||
/// An empty body is a successful pin: `pin_git_object` falls back to the CID
|
||||
/// it computed from the bytes when the response carries no `Hash`.
|
||||
async fn delaying_endpoint(delays: Vec<Duration>) -> String {
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
@@ -2280,14 +2269,9 @@ mod tests {
|
||||
}
|
||||
}
|
||||
tokio::time::sleep(delay).await;
|
||||
let body = br#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4","Size":"12"}
|
||||
"#;
|
||||
let resp = format!(
|
||||
"HTTP/1.1 200 OK\r\nContent-Type: application/x-ndjson\r\nContent-Length: {}\r\n\r\n",
|
||||
body.len()
|
||||
);
|
||||
let _ = sock.write_all(resp.as_bytes()).await;
|
||||
let _ = sock.write_all(body).await;
|
||||
let _ = sock
|
||||
.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
|
||||
.await;
|
||||
let _ = sock.flush().await;
|
||||
});
|
||||
}
|
||||
@@ -2389,71 +2373,6 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
/// A 200 add response with no parseable Hash must surface as an add
|
||||
/// failure. Falling back to the caller-computed CID records an
|
||||
/// unverifiable address: above the backend's chunk threshold that raw
|
||||
/// CID is not a stored block, so every later cat 500s.
|
||||
#[tokio::test]
|
||||
async fn pin_git_object_rejects_a_200_without_a_hash() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Name":"object","Size":"19"}"#)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"a 200 without a Hash must be an add failure, not a fabricated CID: {result:?}"
|
||||
);
|
||||
}
|
||||
|
||||
/// A Hash that is a string but not a CID must also fail. It would be
|
||||
/// recorded into `encrypted_blobs.cid` and every later cat would miss.
|
||||
#[tokio::test]
|
||||
async fn pin_git_object_rejects_a_malformed_hash() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"not-a-cid","Size":"19"}"#)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"a Hash that is not a CID must be an add failure: {result:?}"
|
||||
);
|
||||
}
|
||||
|
||||
/// The Hash text goes into the error and `encrypted_pin` logs that error,
|
||||
/// so a backend answering with a huge invalid Hash must not produce an
|
||||
/// unbounded log entry.
|
||||
#[tokio::test]
|
||||
async fn pin_git_object_bounds_an_oversized_invalid_hash_in_the_error() {
|
||||
let long = "x".repeat(5000);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(format!(r#"{{"Hash":"{long}","Size":"19"}}"#))
|
||||
.create_async()
|
||||
.await;
|
||||
let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
|
||||
let err = result.expect_err("an invalid Hash must be an add failure");
|
||||
let msg = err.to_string();
|
||||
assert!(
|
||||
msg.len() < 1000,
|
||||
"the error must bound the echoed Hash, got {} bytes",
|
||||
msg.len()
|
||||
);
|
||||
assert!(
|
||||
!msg.contains(&long),
|
||||
"the error must not carry the full invalid Hash"
|
||||
);
|
||||
}
|
||||
|
||||
/// The permit-hold bound. `pin_new_objects` runs under a deferring
|
||||
/// `pin_semaphore`, so without a batch deadline the hold is O(N) with N
|
||||
/// chosen by the pusher. Five objects against an endpoint that takes 2s
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
mod ans104;
|
||||
mod api;
|
||||
mod arweave;
|
||||
mod arweave_v2;
|
||||
mod auth;
|
||||
mod bootstrap;
|
||||
mod cert;
|
||||
@@ -86,7 +84,7 @@ async fn main() -> Result<()> {
|
||||
|
||||
if !config.public_read {
|
||||
warn!(
|
||||
"GITLAWB_PUBLIC_READ=false has no effect; reads are gated per repository by is_public and path-scoped visibility rules, not this flag"
|
||||
"GITLAWB_PUBLIC_READ=false is reserved; per-repository private-read enforcement is not wired in alpha"
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -261,10 +261,6 @@ pub fn build_router(state: AppState) -> Router {
|
||||
.merge(Router::new().route("/api/v1/ipfs/pins", get(ipfs::list_pins)));
|
||||
|
||||
// ── Arweave permanent anchors ──────────────────────────────────────────
|
||||
// List endpoint only (public; issue #134 tracks surfacing
|
||||
// visibility rules on list). The verify endpoint and its probe
|
||||
// are deferred to the vertical slice with the uploader and a
|
||||
// real provider contract (reviewer 2, #26 split 2/4 round 5).
|
||||
let arweave_routes = Router::new().route("/api/v1/arweave/anchors", get(arweave::list_anchors));
|
||||
|
||||
// ── Bounty routes (write — require HTTP Signature) ─────────────────
|
||||
|
||||
@@ -207,136 +207,6 @@ mod tests {
|
||||
}
|
||||
}
|
||||
|
||||
/// `list_refs` must resolve both owner-DID forms to the SAME refs.
|
||||
/// `branch_cids.repo` is written as `{normalize_owner_key(owner_did)}/{name}`
|
||||
/// (`api/repos.rs:2643` -> `:2754`), and `get_repo` resolves `did:key:zX` and
|
||||
/// bare `zX` to one repo, so both path forms authorize. Reading the table with
|
||||
/// the raw path segments instead of the canonical slug returns an empty page
|
||||
/// with a 200, which is a denial rendered as success. The second repo pins the
|
||||
/// other direction: the filter must not widen to another owner's refs.
|
||||
#[sqlx::test]
|
||||
async fn list_refs_resolves_both_owner_did_forms_to_the_canonical_slug(pool: PgPool) {
|
||||
let owner_did = "did:key:zREFSCANON";
|
||||
let other_did = "did:key:zREFSOTHER";
|
||||
let state = test_state(pool).await;
|
||||
|
||||
for did in [owner_did, other_did] {
|
||||
let mut repo = seed_repo(did, "refs-canon");
|
||||
repo.is_public = true;
|
||||
// Same repo name under two owners, so the name-derived disk_path
|
||||
// from the helper would collide on its unique constraint.
|
||||
repo.disk_path = format!("/tmp/refs-canon-{}", crate::db::normalize_owner_key(did));
|
||||
state.db.create_repo(&repo).await.expect("seed repo");
|
||||
// Exactly the slug the production push path writes.
|
||||
let slug = format!("{}/{}", crate::db::normalize_owner_key(did), "refs-canon");
|
||||
let cid = format!("bafy{}", crate::db::normalize_owner_key(did));
|
||||
state
|
||||
.db
|
||||
.upsert_branch_cid(
|
||||
&slug,
|
||||
"refs/heads/main",
|
||||
&"1".repeat(64),
|
||||
&cid,
|
||||
"did:key:zNODE",
|
||||
)
|
||||
.await
|
||||
.expect("seed branch cid");
|
||||
}
|
||||
|
||||
async fn body_for(state: &crate::state::AppState, owner: &str) -> String {
|
||||
let router = crate::server::build_router(state.clone());
|
||||
let resp = router
|
||||
.oneshot(
|
||||
Request::builder()
|
||||
.method(Method::GET)
|
||||
.uri(format!("/api/v1/repos/{owner}/refs-canon/refs"))
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::OK,
|
||||
"both owner-DID forms resolve to the same repo, so both must authorize"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
String::from_utf8_lossy(&bytes).into_owned()
|
||||
}
|
||||
|
||||
for owner in ["zREFSCANON", "did:key:zREFSCANON"] {
|
||||
let body = body_for(&state, owner).await;
|
||||
assert!(
|
||||
body.contains("bafyzREFSCANON"),
|
||||
"?owner={owner} must return the ref written under the canonical slug, \
|
||||
not an empty page with a 200. body was: {body}"
|
||||
);
|
||||
assert!(
|
||||
!body.contains("bafyzREFSOTHER"),
|
||||
"?owner={owner} must not return another owner's refs. body was: {body}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// The read gate on `list_refs`, driven in the deny direction. Without this
|
||||
/// the slug regression above proves only that the query key is right: every
|
||||
/// repo it seeds is public, so deleting `authorize_repo_read` outright leaves
|
||||
/// it green. A private repo must answer an anonymous caller with the same 404
|
||||
/// a missing repo gets, and must not put a CID in the body on the way out.
|
||||
#[sqlx::test]
|
||||
async fn list_refs_denies_an_anonymous_caller_on_a_private_repo(pool: PgPool) {
|
||||
let owner_did = "did:key:zREFSPRIV";
|
||||
let state = test_state(pool).await;
|
||||
|
||||
let mut repo = seed_repo(owner_did, "refs-private");
|
||||
repo.is_public = false;
|
||||
state.db.create_repo(&repo).await.expect("seed repo");
|
||||
state
|
||||
.db
|
||||
.upsert_branch_cid(
|
||||
&format!(
|
||||
"{}/{}",
|
||||
crate::db::normalize_owner_key(owner_did),
|
||||
"refs-private"
|
||||
),
|
||||
"refs/heads/main",
|
||||
&"1".repeat(64),
|
||||
"bafyzREFSPRIVSECRET",
|
||||
"did:key:zNODE",
|
||||
)
|
||||
.await
|
||||
.expect("seed branch cid");
|
||||
|
||||
for owner in ["zREFSPRIV", "did:key:zREFSPRIV"] {
|
||||
let router = crate::server::build_router(state.clone());
|
||||
let resp = router
|
||||
.oneshot(
|
||||
Request::builder()
|
||||
.method(Method::GET)
|
||||
.uri(format!("/api/v1/repos/{owner}/refs-private/refs"))
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::NOT_FOUND,
|
||||
"anonymous read of a private repo must 404, not disclose it (owner form {owner})"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
let body = String::from_utf8_lossy(&bytes);
|
||||
assert!(
|
||||
!body.contains("bafyzREFSPRIVSECRET"),
|
||||
"the deny body must not carry a pinned CID. body was: {body}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// Proves the harness end to end: a migrated DB, a seeded repo, and the
|
||||
/// owner gate on an ALREADY-gated endpoint (`PUT /visibility`, gated by
|
||||
/// `require_owner`). Non-owner is rejected; owner succeeds. Mounts the
|
||||
@@ -3735,300 +3605,6 @@ mod tests {
|
||||
assert_eq!(resp.status(), StatusCode::NOT_FOUND, "absent repo → 404");
|
||||
}
|
||||
|
||||
/// #435: register_replica / unregister_replica apply the same read-visibility
|
||||
/// gate as list_replicas. Both mutate caller-bound replica metadata and their
|
||||
/// responses disclose the replica count, so a non-reader of a private repo
|
||||
/// gets the same 404 as a missing repo and nothing is written. Authorized
|
||||
/// readers keep self-registering and self-removing.
|
||||
#[sqlx::test]
|
||||
async fn replica_register_unregister_are_read_visibility_gated(pool: PgPool) {
|
||||
use crate::db::VisibilityMode;
|
||||
let owner = "did:key:zREPMUTOWNERRRRRRRRRRRRRRRRRRRRRRRRRR";
|
||||
let reader = "did:key:zREPMUTREADERRRRRRRRRRRRRRRRRRRRRRRRR";
|
||||
let stranger = "did:key:zREPMUTSTRGRRRRRRRRRRRRRRRRRRRRRRRRR";
|
||||
let state = test_state(pool).await;
|
||||
|
||||
let mut priv_repo = seed_repo(owner, "repmut-priv");
|
||||
priv_repo.is_public = false;
|
||||
state
|
||||
.db
|
||||
.create_repo(&priv_repo)
|
||||
.await
|
||||
.expect("seed private repo");
|
||||
let pub_repo = seed_repo(owner, "repmut-pub");
|
||||
state
|
||||
.db
|
||||
.create_repo(&pub_repo)
|
||||
.await
|
||||
.expect("seed public repo");
|
||||
// A listed reader of the private repo keeps mutation rights.
|
||||
state
|
||||
.db
|
||||
.set_visibility_rule(
|
||||
&priv_repo.id,
|
||||
"/",
|
||||
VisibilityMode::B,
|
||||
&[reader.to_string()],
|
||||
owner,
|
||||
)
|
||||
.await
|
||||
.expect("seed reader rule");
|
||||
|
||||
let router = || {
|
||||
Router::new()
|
||||
.route(
|
||||
"/api/v1/repos/{owner}/{repo}/replicas",
|
||||
axum::routing::put(crate::api::replicas::register_replica)
|
||||
.delete(crate::api::replicas::unregister_replica),
|
||||
)
|
||||
.with_state(state.clone())
|
||||
};
|
||||
let replica_url = "https://replica.example.com/me";
|
||||
let body = || Body::from(format!(r#"{{"url":"{replica_url}"}}"#));
|
||||
let leaks = |bytes: &[u8]| {
|
||||
let text = String::from_utf8_lossy(bytes);
|
||||
text.contains(replica_url) || text.contains(&priv_repo.id)
|
||||
};
|
||||
|
||||
// Private repo, non-reader stranger: register → 404, nothing written.
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
stranger,
|
||||
Method::PUT,
|
||||
&format!("/api/v1/repos/{owner}/repmut-priv/replicas"),
|
||||
body(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::NOT_FOUND,
|
||||
"a non-reader must not register on a private repo"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
!leaks(&bytes),
|
||||
"a denied register body must not leak the replica url or repo data"
|
||||
);
|
||||
assert!(
|
||||
state
|
||||
.db
|
||||
.list_replicas(&priv_repo.id)
|
||||
.await
|
||||
.unwrap()
|
||||
.is_empty(),
|
||||
"a denied register must not create a replica row"
|
||||
);
|
||||
|
||||
// Private repo, non-reader stranger: unregister → 404.
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
stranger,
|
||||
Method::DELETE,
|
||||
&format!("/api/v1/repos/{owner}/repmut-priv/replicas"),
|
||||
Body::empty(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::NOT_FOUND,
|
||||
"a non-reader must not unregister on a private repo"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
!leaks(&bytes),
|
||||
"a denied unregister body must not leak the replica url or repo data"
|
||||
);
|
||||
|
||||
// Private repo, listed reader: register → 201, unregister → 200.
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
reader,
|
||||
Method::PUT,
|
||||
&format!("/api/v1/repos/{owner}/repmut-priv/replicas"),
|
||||
body(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::CREATED,
|
||||
"a listed reader keeps self-registration on a private repo"
|
||||
);
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
reader,
|
||||
Method::DELETE,
|
||||
&format!("/api/v1/repos/{owner}/repmut-priv/replicas"),
|
||||
Body::empty(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::OK,
|
||||
"a listed reader keeps self-removal on a private repo"
|
||||
);
|
||||
|
||||
// Public repo, authenticated stranger: register → 201.
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
stranger,
|
||||
Method::PUT,
|
||||
&format!("/api/v1/repos/{owner}/repmut-pub/replicas"),
|
||||
body(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::CREATED,
|
||||
"public-repo registration stays open to any authenticated replica"
|
||||
);
|
||||
|
||||
// Owner self-registration is still refused.
|
||||
let resp = router()
|
||||
.oneshot(signed_request_as(
|
||||
owner,
|
||||
Method::PUT,
|
||||
&format!("/api/v1/repos/{owner}/repmut-pub/replicas"),
|
||||
body(),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::BAD_REQUEST,
|
||||
"the owner still cannot register as their own replica"
|
||||
);
|
||||
}
|
||||
|
||||
/// #435 end-to-end: drive the replica mutations through the PRODUCTION
|
||||
/// router (`app` → require_signature → handler) with real RFC-9421
|
||||
/// signatures, so the whole verify-then-authorize stack is exercised, not
|
||||
/// just the handler with an injected DID. A stranger on a private repo
|
||||
/// gets the same 404 as a missing repo with nothing written; a listed
|
||||
/// reader registers and removes itself.
|
||||
#[sqlx::test]
|
||||
async fn replica_mutations_enforce_visibility_through_real_signature_e2e(pool: PgPool) {
|
||||
use crate::db::VisibilityMode;
|
||||
use gitlawb_core::http_sig::sign_request;
|
||||
use gitlawb_core::identity::Keypair;
|
||||
|
||||
let owner_kp = Keypair::generate();
|
||||
let owner_did = owner_kp.did().to_string();
|
||||
// Short owner form in the path keeps the signed @path byte-identical
|
||||
// to what the node sees (no colons) while did_matches still resolves.
|
||||
let short = owner_did.split(':').next_back().unwrap().to_string();
|
||||
let stranger_kp = Keypair::generate();
|
||||
let reader_kp = Keypair::generate();
|
||||
let reader_did = reader_kp.did().to_string();
|
||||
|
||||
let state = test_state(pool.clone()).await;
|
||||
let mut repo = seed_repo(&owner_did, "sig-repl-priv");
|
||||
repo.is_public = false;
|
||||
state
|
||||
.db
|
||||
.create_repo(&repo)
|
||||
.await
|
||||
.expect("seed private repo");
|
||||
state
|
||||
.db
|
||||
.set_visibility_rule(&repo.id, "/", VisibilityMode::B, &[reader_did], &owner_did)
|
||||
.await
|
||||
.expect("seed reader rule");
|
||||
|
||||
let router = app(pool).await;
|
||||
let path = format!("/api/v1/repos/{short}/sig-repl-priv/replicas");
|
||||
let replica_url = "https://replica.example.com/e2e";
|
||||
let reg_body: &[u8] = br#"{"url":"https://replica.example.com/e2e"}"#;
|
||||
let leaks = |bytes: &[u8]| {
|
||||
let text = String::from_utf8_lossy(bytes);
|
||||
text.contains(replica_url) || text.contains(&repo.id)
|
||||
};
|
||||
let signed_req = |kp: &Keypair, method: &str, body: &'static [u8]| {
|
||||
let signed = sign_request(kp, method, &path, body);
|
||||
Request::builder()
|
||||
.method(method)
|
||||
.uri(&path)
|
||||
.header(axum::http::header::CONTENT_TYPE, "application/json")
|
||||
.header("content-digest", signed.content_digest)
|
||||
.header("signature-input", signed.signature_input)
|
||||
.header("signature", signed.signature)
|
||||
.body(Body::from(body))
|
||||
.unwrap()
|
||||
};
|
||||
|
||||
// Stranger (verified signature, not a reader) → 404, no row written.
|
||||
let resp = router
|
||||
.clone()
|
||||
.oneshot(signed_req(&stranger_kp, "PUT", reg_body))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::NOT_FOUND,
|
||||
"a verified non-reader must not register on a private repo"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
!leaks(&bytes),
|
||||
"a denied register body must not leak the replica url or repo data"
|
||||
);
|
||||
assert!(
|
||||
state.db.list_replicas(&repo.id).await.unwrap().is_empty(),
|
||||
"a denied register must not create a replica row"
|
||||
);
|
||||
|
||||
// Stranger DELETE → 404.
|
||||
let resp = router
|
||||
.clone()
|
||||
.oneshot(signed_req(&stranger_kp, "DELETE", b""))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::NOT_FOUND,
|
||||
"a verified non-reader must not unregister on a private repo"
|
||||
);
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
!leaks(&bytes),
|
||||
"a denied unregister body must not leak the replica url or repo data"
|
||||
);
|
||||
|
||||
// Listed reader: PUT → 201, DELETE → 200.
|
||||
let resp = router
|
||||
.clone()
|
||||
.oneshot(signed_req(&reader_kp, "PUT", reg_body))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::CREATED,
|
||||
"a listed reader registers through the real middleware"
|
||||
);
|
||||
let resp = router
|
||||
.clone()
|
||||
.oneshot(signed_req(&reader_kp, "DELETE", b""))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
resp.status(),
|
||||
StatusCode::OK,
|
||||
"a listed reader unregisters through the real middleware"
|
||||
);
|
||||
}
|
||||
|
||||
/// #94 sibling: list_labels is read-visibility-gated. A public repo's labels
|
||||
/// stay anonymously listable; a private repo's label names must not leak to a
|
||||
/// non-reader (404). A listed reader of the private repo reads the label; the
|
||||
@@ -6374,7 +5950,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyshouldnothappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -6500,7 +6076,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyshouldnothappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -6690,7 +6266,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyshouldnothappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -8510,7 +8086,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyprovtest"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -8570,7 +8146,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyproviderhash"}"#)
|
||||
.expect(2)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -8829,7 +8405,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyshouldnothappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -8952,7 +8528,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"bafyshouldnothappen"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -9054,7 +8630,7 @@ mod tests {
|
||||
let m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"x"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -9118,7 +8694,7 @@ mod tests {
|
||||
server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
|
||||
.with_body(r#"{"Hash":"x"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18483,9 +18059,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18553,9 +18127,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18623,9 +18195,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18695,9 +18265,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18761,9 +18329,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18825,9 +18391,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -18963,9 +18527,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -19044,9 +18606,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -19107,9 +18667,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -19208,9 +18766,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
@@ -19296,9 +18852,7 @@ mod tests {
|
||||
let _m = server
|
||||
.mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
|
||||
.with_status(200)
|
||||
.with_body(
|
||||
r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#,
|
||||
)
|
||||
.with_body(r#"{"Hash":"bafyprovider"}"#)
|
||||
.expect_at_least(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
+25
-16
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -64,16 +65,24 @@ async fn cmd_list(node: String, capability: Option<String>) -> Result<()> {
|
||||
.get(&path)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
// Keep the bespoke 404 hint (older node without the agents API) ahead of
|
||||
// read_json; every other status routes through it (capped + sanitized error).
|
||||
if resp.status() == reqwest::StatusCode::NOT_FOUND {
|
||||
let status = resp.status();
|
||||
|
||||
if status == reqwest::StatusCode::NOT_FOUND {
|
||||
anyhow::bail!(
|
||||
"this node does not yet support the agents API (v0.3+)\n\
|
||||
upgrade the node or check GITLAWB_NODE is pointing to the right server"
|
||||
);
|
||||
}
|
||||
|
||||
let body = crate::http::read_json(resp, "list agents").await?;
|
||||
let body: Value = resp
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON from node — is GITLAWB_NODE correct?")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("list agents failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let agents = body["agents"].as_array().cloned().unwrap_or_default();
|
||||
|
||||
@@ -116,15 +125,24 @@ async fn cmd_show(did: String, node: String) -> Result<()> {
|
||||
.get(&format!("/api/v1/agents/{did}"))
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
// Keep the bespoke 404 hint ahead of read_json; other statuses route through it.
|
||||
if resp.status() == reqwest::StatusCode::NOT_FOUND {
|
||||
let status = resp.status();
|
||||
|
||||
if status == reqwest::StatusCode::NOT_FOUND {
|
||||
anyhow::bail!(
|
||||
"agent not found, or this node does not yet support the agents API (v0.3+)\n\
|
||||
upgrade the node or check GITLAWB_NODE is pointing to the right server"
|
||||
);
|
||||
}
|
||||
|
||||
let agent = crate::http::read_json(resp, "agent").await?;
|
||||
let agent: Value = resp
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON from node — is GITLAWB_NODE correct?")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = agent["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("agent not found ({status}): {msg}");
|
||||
}
|
||||
|
||||
let full_did = agent["did"].as_str().unwrap_or("?");
|
||||
let trust = agent["trust_score"].as_f64().unwrap_or(0.0);
|
||||
@@ -205,14 +223,11 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_list(server.url(), None).await.unwrap_err();
|
||||
assert!(err.to_string().contains("agents API"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -223,14 +238,11 @@ mod tests {
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"internal error"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_list(server.url(), None).await.unwrap_err();
|
||||
assert!(err.to_string().contains("list agents failed"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -257,7 +269,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"agent not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -265,8 +276,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("agents API") || err.to_string().contains("not found"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
|
||||
+50
-104
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -220,7 +221,13 @@ async fn cmd_create(
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "create bounty").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("create bounty failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let id = body["id"].as_str().unwrap_or("?");
|
||||
println!("Bounty created: {id}");
|
||||
@@ -256,14 +263,11 @@ async fn cmd_list(
|
||||
u
|
||||
};
|
||||
|
||||
let body = crate::http::read_json(
|
||||
client
|
||||
.get_authed(&url)
|
||||
.await
|
||||
.context("failed to connect to node")?,
|
||||
"bounties",
|
||||
)
|
||||
.await?;
|
||||
let resp = client
|
||||
.get_authed(&url)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
let bounties = body["bounties"].as_array();
|
||||
if let Some(arr) = bounties {
|
||||
@@ -287,7 +291,13 @@ async fn cmd_show(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
|
||||
let client = signed_client(&node, dir.as_deref());
|
||||
let resp = client.get_authed(&format!("/api/v1/bounties/{id}")).await?;
|
||||
|
||||
let body = crate::http::read_json(resp, "show bounty").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("not found");
|
||||
anyhow::bail!("bounty not found: {msg}");
|
||||
}
|
||||
|
||||
println!("{}", serde_json::to_string_pretty(&body)?);
|
||||
Ok(())
|
||||
@@ -311,7 +321,13 @@ async fn cmd_claim(
|
||||
)
|
||||
.await?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "claim").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("claim failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("Bounty {id} claimed. Deadline starts now.");
|
||||
Ok(())
|
||||
@@ -330,7 +346,13 @@ async fn cmd_submit(id: String, pr: String, node: String, dir: Option<PathBuf>)
|
||||
)
|
||||
.await?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "submit").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("submit failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("Bounty {id} submitted with PR {pr}. Awaiting creator approval.");
|
||||
Ok(())
|
||||
@@ -354,7 +376,13 @@ async fn cmd_approve(
|
||||
)
|
||||
.await?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "approve").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("approve failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("Bounty {id} approved! Payout released to agent.");
|
||||
Ok(())
|
||||
@@ -373,7 +401,13 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
)
|
||||
.await?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "cancel").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("cancel failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("Bounty {id} cancelled. Tokens refunded.");
|
||||
Ok(())
|
||||
@@ -381,11 +415,8 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
|
||||
async fn cmd_stats(node: String) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
// Route through read_json so a node denial (403/404/5xx, incl. a non-JSON
|
||||
// body) surfaces as an error instead of a fake `Bounty Stats` with every
|
||||
// counter zeroed (#186, the denial-as-success class #123 fixes elsewhere).
|
||||
let body =
|
||||
crate::http::read_json(client.get("/api/v1/bounties/stats").await?, "bounty stats").await?;
|
||||
let resp = client.get("/api/v1/bounties/stats").await?;
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
let open = body["open"].as_i64().unwrap_or(0);
|
||||
let claimed = body["claimed"].as_i64().unwrap_or(0);
|
||||
@@ -522,7 +553,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -530,8 +560,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("not found"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -548,86 +576,4 @@ mod tests {
|
||||
|
||||
cmd_stats(server.url()).await.unwrap();
|
||||
}
|
||||
|
||||
/// #186 (F1): a node denial on the stats endpoint must surface as an error,
|
||||
/// not print a fake `Bounty Stats` with every counter zeroed. RED before the
|
||||
/// fix (unwrap_or_default + no status check -> Ok with zeros), GREEN after
|
||||
/// (read_json bails on the non-2xx).
|
||||
#[tokio::test]
|
||||
async fn cmd_stats_surfaces_denial_not_fake_result() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let m = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"forbidden"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_stats(server.url())
|
||||
.await
|
||||
.expect_err("a 403 must be an error, not a zeroed fake result");
|
||||
assert!(err.to_string().contains("403"), "err={err}");
|
||||
// Pin the mock hit explicitly. The status assertion above already fails
|
||||
// when the route does not match (mockito answers an unmatched route with
|
||||
// 501, so "403" is absent), but that proof is incidental to mockito's
|
||||
// fallback status; assert the hit directly so it survives a reworded
|
||||
// assertion.
|
||||
m.assert_async().await;
|
||||
}
|
||||
|
||||
/// #186 (F1): the same denial-as-error behavior across the non-2xx response
|
||||
/// classes, not just 403 — a 404 and a 500 (incl. a non-JSON body) must each
|
||||
/// surface as an error with the status, never a zeroed fake result.
|
||||
#[tokio::test]
|
||||
async fn cmd_stats_surfaces_denial_across_status_classes() {
|
||||
for (status, body, json) in [
|
||||
(404, r#"{"message":"not found"}"#, true),
|
||||
(500, "internal boom", false),
|
||||
] {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let mut m = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
|
||||
.with_status(status)
|
||||
.with_body(body);
|
||||
if json {
|
||||
m = m.with_header("content-type", "application/json");
|
||||
}
|
||||
let m = m.expect(1).create_async().await;
|
||||
|
||||
let err = cmd_stats(server.url()).await.unwrap_err().to_string();
|
||||
assert!(
|
||||
err.contains(&status.to_string()),
|
||||
"status {status} must surface as an error, got: {err}"
|
||||
);
|
||||
m.assert_async().await;
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_repo_scoped_surfaces_denial_not_empty() {
|
||||
// `gl bounty list --repo owner/name` hits the gated /repos/{o}/{n}/bounties;
|
||||
// a 404 must Err, not silently print nothing.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/repos/alice/secret/bounties".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_list(Some("alice/secret".to_string()), None, server.url(), None).await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"bounty list --repo must Err on a gated 404"
|
||||
);
|
||||
// Prove the gated repo-scoped path was actually requested: without this,
|
||||
// an unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+48
-613
@@ -4,6 +4,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -89,7 +90,12 @@ async fn resolve_repo(
|
||||
did.split(':').next_back().unwrap_or(&did).to_string()
|
||||
} else {
|
||||
let client = signed_client(node, dir);
|
||||
let info = crate::http::read_json(client.get_authed("/").await?, "node info").await?;
|
||||
let info: Value = client
|
||||
.get_authed("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch node info")?;
|
||||
let did = info["did"].as_str().context("node info missing 'did'")?;
|
||||
did.split(':').next_back().unwrap_or(did).to_string()
|
||||
};
|
||||
@@ -102,7 +108,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
|
||||
let client = signed_client(&node, dir.as_deref());
|
||||
let path = format!("/api/v1/repos/{owner}/{name}/certs");
|
||||
let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
|
||||
let resp: Value = client
|
||||
.get_authed(&path)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to list certificates")?;
|
||||
|
||||
let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
|
||||
|
||||
@@ -136,10 +147,14 @@ async fn cmd_show(
|
||||
let client = signed_client(&node, dir.as_deref());
|
||||
let id = resolve_cert_id(&client, &owner, &name, &id).await?;
|
||||
|
||||
// Fetch the certificate. read_json checks status first and surfaces the node's
|
||||
// capped+sanitized message on a non-2xx (a bounded error read, not the whole body).
|
||||
// Fetch the certificate
|
||||
let path = format!("/api/v1/repos/{owner}/{name}/certs/{id}");
|
||||
let cert = crate::http::read_json(client.get_authed(&path).await?, "certificate").await?;
|
||||
let resp = client
|
||||
.get_authed(&path)
|
||||
.await?
|
||||
.error_for_status()
|
||||
.context("certificate not found")?;
|
||||
let cert: Value = resp.json().await.context("certificate not found")?;
|
||||
|
||||
let cert_id = cert["id"].as_str().unwrap_or("?");
|
||||
let ref_name = cert["ref_name"].as_str().unwrap_or("?");
|
||||
@@ -184,20 +199,27 @@ async fn cmd_show(
|
||||
|
||||
// Contextual only — the verdict above stands on its own, so a node-info
|
||||
// hiccup here must not turn a successfully displayed certificate into an
|
||||
// error exit. Route the lookup through read_json so a denial or a capped
|
||||
// error body yields a reportable reason instead of an opaque None, and keep
|
||||
// "carried no DID" distinct from "the lookup failed": an empty DID must not
|
||||
// reach the comparison and fabricate a mismatch warning.
|
||||
let current: std::result::Result<String, String> = match client.get("/").await {
|
||||
Ok(resp) => match crate::http::read_json(resp, "node info").await {
|
||||
Ok(info) => did_from_node_info(&info),
|
||||
Err(e) => Err(e.to_string()),
|
||||
},
|
||||
Err(e) => Err(e.to_string()),
|
||||
// error exit.
|
||||
let current_node_did = match client.get("/").await {
|
||||
Ok(resp) => resp
|
||||
.json::<Value>()
|
||||
.await
|
||||
.ok()
|
||||
.and_then(|info| info["did"].as_str().map(str::to_string)),
|
||||
Err(_) => None,
|
||||
};
|
||||
let current_node_did = current.as_ref().ok().cloned();
|
||||
for line in did_check_report(¤t, node_did) {
|
||||
println!("{line}");
|
||||
match current_node_did.as_deref() {
|
||||
Some(current) if current == node_did => {
|
||||
println!(" Issuing node DID matches the node being queried.");
|
||||
}
|
||||
Some(current) => {
|
||||
println!(" WARNING: Certificate node DID ({node_did}) does not match");
|
||||
println!(" current node DID ({current}).");
|
||||
println!(" This certificate was issued by a different node.");
|
||||
}
|
||||
None => {
|
||||
println!(" NOTE: could not fetch current node info — skipping node-DID comparison.");
|
||||
}
|
||||
}
|
||||
|
||||
if require_valid {
|
||||
@@ -225,46 +247,6 @@ async fn cmd_show(
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Pull the node's DID out of a `GET /` body for the comparison in `cmd_show`.
|
||||
///
|
||||
/// A missing OR empty `did` is a failure, not a value: letting `""` through
|
||||
/// would reach the comparison and print a mismatch WARNING against a DID the
|
||||
/// node never claimed, which reads as "issued by a different node" when the
|
||||
/// truth is that the lookup told us nothing.
|
||||
fn did_from_node_info(info: &serde_json::Value) -> std::result::Result<String, String> {
|
||||
match info["did"].as_str() {
|
||||
Some(did) if !did.is_empty() => Ok(did.to_string()),
|
||||
_ => Err("node info response carried no DID".to_string()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Select the report lines for the node-DID comparison in `cmd_show`.
|
||||
///
|
||||
/// `current` is the current node's DID, or the reason it could not be
|
||||
/// determined. A comparison verdict (match or WARNING) is only produced when a
|
||||
/// real DID was obtained; otherwise the report degrades to a could-not-compare
|
||||
/// hint naming the reason, plus the offline-verification guidance. The signature
|
||||
/// verdict printed above stands on its own either way — this block only answers
|
||||
/// *which* node issued the certificate.
|
||||
fn did_check_report(current: &std::result::Result<String, String>, node_did: &str) -> Vec<String> {
|
||||
match current {
|
||||
Ok(current) if current == node_did => {
|
||||
vec![" Issuing node DID matches the node being queried.".to_string()]
|
||||
}
|
||||
Ok(current) => vec![
|
||||
format!(" WARNING: Certificate node DID ({node_did}) does not match"),
|
||||
format!(" current node DID ({current})."),
|
||||
" This certificate was issued by a different node.".to_string(),
|
||||
],
|
||||
Err(reason) => vec![
|
||||
format!(" Could not fetch the current node's DID ({reason}), so the comparison"),
|
||||
" with the certificate's node DID is unavailable.".to_string(),
|
||||
" To verify offline, use the node's Ed25519 public key derived from:".to_string(),
|
||||
format!(" did:key → {node_did}"),
|
||||
],
|
||||
}
|
||||
}
|
||||
|
||||
/// Rebuild the node's canonical signing payload (field order must match
|
||||
/// gitlawb-node/src/cert.rs::issue_ref_certificate exactly) and verify the
|
||||
/// certificate's Ed25519 signature against the key embedded in `node_did`.
|
||||
@@ -317,7 +299,14 @@ async fn resolve_cert_id(client: &NodeClient, owner: &str, name: &str, id: &str)
|
||||
}
|
||||
|
||||
let path = format!("/api/v1/repos/{owner}/{name}/certs?prefix={id}");
|
||||
let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
|
||||
let resp: Value = client
|
||||
.get_authed(&path)
|
||||
.await?
|
||||
.error_for_status()
|
||||
.context("failed to list certificates")?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to list certificates")?;
|
||||
|
||||
let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
|
||||
let matches: Vec<String> = certs
|
||||
@@ -416,558 +405,4 @@ mod tests {
|
||||
);
|
||||
assert!(garbage.is_err(), "malformed signature must not verify");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_surfaces_denial_not_empty() {
|
||||
// A gated 404 on the repo-scoped certs read must Err, not print "No certificates".
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/certs$".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
|
||||
assert!(result.is_err(), "cert list must Err on a gated 404");
|
||||
// Prove the gated certs path was actually requested: without this, an
|
||||
// unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolve_repo_surfaces_denial() {
|
||||
// A slash-free repo with an empty identity dir forces the GET / node-info
|
||||
// fetch. A gated 404 there must Err (surfacing the status), proving the
|
||||
// read_json conversion is load-bearing rather than silently ignored.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
|
||||
let _m = server
|
||||
.mock("GET", "/")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
// The `GET /` node-info lookup after the cert loads is a fail-soft diagnostic:
|
||||
// a response-level failure degrades to a could-not-compare hint and the command
|
||||
// completes Ok, never a fabricated mismatch warning and never a fatal Err. The
|
||||
// cert fetch itself stays fail-closed. A >=36-char id skips resolve_cert_id so
|
||||
// only two mocks are needed.
|
||||
#[tokio::test]
|
||||
async fn cmd_show_completes_with_degraded_hint_when_node_info_denied() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(
|
||||
r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
|
||||
)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let result = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_ok(),
|
||||
"cert show must complete despite a denied node-info lookup"
|
||||
);
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_show_degrades_on_malformed_node_info() {
|
||||
// A 2xx node-info body that fails to parse degrades the same way a denial
|
||||
// does: hint printed, command completes Ok.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(
|
||||
r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
|
||||
)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_body("not json")
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let result = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_ok(),
|
||||
"cert show must complete despite malformed node info"
|
||||
);
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_show_degrades_when_node_info_lacks_did() {
|
||||
// A 2xx node-info body with no `did` routes to the degraded hint, not a
|
||||
// fabricated empty-DID mismatch warning; the command completes Ok.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(
|
||||
r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
|
||||
)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body("{}")
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let result = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_ok(),
|
||||
"cert show must complete when node info lacks a DID"
|
||||
);
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
// Must-not case: the certificate fetch itself stays fail-closed. A gated 404
|
||||
// aborts the command with the status surfaced, and the node-info lookup is
|
||||
// never reached (the expect(0) assert proves it never ran).
|
||||
#[tokio::test]
|
||||
async fn cmd_show_surfaces_denied_certificate() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"did":"n"}"#)
|
||||
.expect(0)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_show_reports_matching_node_did() {
|
||||
// Pins the unchanged success path: node info fetched, DIDs compared, Ok.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(
|
||||
r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
|
||||
)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"did":"n"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let result = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(result.is_ok(), "cert show must report a matching node DID");
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_show_warns_on_mismatching_node_did() {
|
||||
// A real, differing node DID drives the WARNING branch end to end; the
|
||||
// command still completes Ok.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let long_id = "a".repeat(36);
|
||||
let _cert = server
|
||||
.mock(
|
||||
"GET",
|
||||
format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(
|
||||
r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
|
||||
)
|
||||
.create_async()
|
||||
.await;
|
||||
let _root = server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"did":"did:key:other"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let result = cmd_show(
|
||||
"alice/secret".to_string(),
|
||||
long_id,
|
||||
server.url(),
|
||||
None,
|
||||
false,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_ok(),
|
||||
"cert show must warn, not fail, on a mismatching node DID"
|
||||
);
|
||||
_cert.assert_async().await;
|
||||
_root.assert_async().await;
|
||||
}
|
||||
|
||||
// ── --verify issuer anchoring ────────────────────────────────────────────
|
||||
//
|
||||
// Every other cmd_show test passes require_valid=false, so the whole
|
||||
// `if require_valid` block went unexecuted. It is the security-bearing half of
|
||||
// the command: a valid signature only proves the certificate is internally
|
||||
// consistent (a hostile node can mint a keypair, name it in node_did, and
|
||||
// self-sign), so --verify must additionally anchor the issuer to a DID the
|
||||
// caller trusts. These drive all four outcomes plus the must-not case.
|
||||
//
|
||||
// The certificate must carry a REAL signature over the canonical payload:
|
||||
// with a bogus one, --verify bails on the signature and never reaches the
|
||||
// anchoring, which would make every assertion below vacuous.
|
||||
fn signed_cert(node_kp: &gitlawb_core::identity::Keypair) -> (String, String) {
|
||||
let node_did = node_kp.did().as_str().to_string();
|
||||
let id = "a".repeat(36); // >= 36 chars skips resolve_cert_id's prefix lookup
|
||||
let payload = serde_json::json!({
|
||||
"repo_id": "repo-1",
|
||||
"ref": "refs/heads/main",
|
||||
"old": "0".repeat(40),
|
||||
"new": "b".repeat(40),
|
||||
"pusher": "did:key:z6MkPusher",
|
||||
"node": node_did,
|
||||
"ts": "2026-07-22T00:00:00+00:00",
|
||||
});
|
||||
let sig = node_kp.sign_b64(&serde_json::to_vec(&payload).unwrap());
|
||||
let body = serde_json::json!({
|
||||
"id": id,
|
||||
"repo_id": "repo-1",
|
||||
"ref_name": "refs/heads/main",
|
||||
"old_sha": "0".repeat(40),
|
||||
"new_sha": "b".repeat(40),
|
||||
"pusher_did": "did:key:z6MkPusher",
|
||||
"node_did": node_did,
|
||||
"signature": sig,
|
||||
"issued_at": "2026-07-22T00:00:00+00:00",
|
||||
})
|
||||
.to_string();
|
||||
(id, body)
|
||||
}
|
||||
|
||||
/// Mount the cert fetch, plus a `GET /` answering with `node_info` (a JSON
|
||||
/// body) or a denial when `None`.
|
||||
async fn cert_server(
|
||||
server: &mut mockito::Server,
|
||||
id: &str,
|
||||
cert_body: &str,
|
||||
node_info: Option<&str>,
|
||||
) -> (mockito::Mock, mockito::Mock) {
|
||||
let cert = server
|
||||
.mock("GET", format!("/api/v1/repos/alice/r/certs/{id}").as_str())
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(cert_body)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let root = match node_info {
|
||||
Some(b) => {
|
||||
server
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(b)
|
||||
.create_async()
|
||||
.await
|
||||
}
|
||||
None => {
|
||||
server
|
||||
.mock("GET", "/")
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.create_async()
|
||||
.await
|
||||
}
|
||||
};
|
||||
(cert, root)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verify_ok_when_issuing_node_is_the_queried_node() {
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
let (id, body) = signed_cert(&kp);
|
||||
let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
|
||||
|
||||
let got = cmd_show("alice/r".to_string(), id, server.url(), None, true, None).await;
|
||||
assert!(got.is_ok(), "valid sig + matching issuer must pass");
|
||||
cert.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verify_bails_when_issuer_is_a_different_node() {
|
||||
// The self-signing-hostile-node case: the signature verifies against the
|
||||
// key the cert names, but that key is not the node we queried.
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
let (id, body) = signed_cert(&kp);
|
||||
let other = gitlawb_core::identity::Keypair::generate();
|
||||
let info = format!(r#"{{"did":"{}"}}"#, other.did().as_str());
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
|
||||
|
||||
let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(err.contains("expected issuer"), "got: {err}");
|
||||
cert.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verify_bails_when_node_info_denied_and_no_expect_node() {
|
||||
// Fail closed: with no trusted DID to anchor against, --verify must NOT
|
||||
// fall through to a pass just because the signature checked out.
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
let (id, body) = signed_cert(&kp);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
|
||||
|
||||
let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(err.contains("cannot anchor the issuer"), "got: {err}");
|
||||
cert.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verify_ok_when_expect_node_anchors_a_denied_lookup() {
|
||||
// --expect-node supplies the trust anchor the denied lookup could not, so
|
||||
// the same denial that fails the case above now passes.
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
let (id, body) = signed_cert(&kp);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
|
||||
|
||||
let got = cmd_show(
|
||||
"alice/r".to_string(),
|
||||
id,
|
||||
server.url(),
|
||||
None,
|
||||
true,
|
||||
Some(kp.did().as_str().to_string()),
|
||||
)
|
||||
.await;
|
||||
assert!(got.is_ok(), "explicit anchor must pass");
|
||||
cert.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verify_bails_on_a_bad_signature_before_anchoring() {
|
||||
// The must-not: a forged certificate naming the queried node must fail on
|
||||
// the signature, even though its issuer would otherwise anchor cleanly.
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
let (id, body) = signed_cert(&kp);
|
||||
let forged = body.replace(&"b".repeat(40), &"c".repeat(40));
|
||||
let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let (cert, _root) = cert_server(&mut server, &id, &forged, Some(&info)).await;
|
||||
|
||||
let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(err.contains("signature did not verify"), "got: {err}");
|
||||
cert.assert_async().await;
|
||||
}
|
||||
|
||||
// The must-not case for the DID extraction: an empty or missing `did` has to
|
||||
// become a could-not-compare reason. If it leaks through as a value, the
|
||||
// comparison below fabricates a mismatch WARNING against a DID the node
|
||||
// never claimed.
|
||||
#[test]
|
||||
fn did_from_node_info_rejects_empty_and_missing() {
|
||||
assert!(did_from_node_info(&serde_json::json!({"did": "n"})).is_ok());
|
||||
for body in [
|
||||
serde_json::json!({"did": ""}),
|
||||
serde_json::json!({}),
|
||||
serde_json::json!({"did": 7}),
|
||||
] {
|
||||
let got = did_from_node_info(&body);
|
||||
assert!(
|
||||
got.is_err(),
|
||||
"must not yield a comparable DID: {body} -> {got:?}"
|
||||
);
|
||||
}
|
||||
// And the reason it produces must route to the degraded hint, never a verdict.
|
||||
let report =
|
||||
did_check_report(&did_from_node_info(&serde_json::json!({"did": ""})), "n").join("\n");
|
||||
assert!(
|
||||
!report.contains("WARNING"),
|
||||
"fabricated a mismatch: {report}"
|
||||
);
|
||||
assert!(report.contains("Could not fetch"), "got: {report}");
|
||||
}
|
||||
|
||||
// did_check_report is the three-way selector between the match text, the
|
||||
// mismatch WARNING, and the degraded could-not-compare hint. Substring
|
||||
// asserts (not full-line equality) so cosmetic wording edits don't break them.
|
||||
|
||||
#[test]
|
||||
fn did_check_report_match() {
|
||||
let report = did_check_report(&Ok("n".to_string()), "n").join("\n");
|
||||
assert!(
|
||||
report.contains("matches the node being queried"),
|
||||
"got: {report}"
|
||||
);
|
||||
assert!(!report.contains("WARNING"), "got: {report}");
|
||||
assert!(!report.contains("Could not fetch"), "got: {report}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn did_check_report_mismatch() {
|
||||
let report = did_check_report(&Ok("did:key:other".to_string()), "n").join("\n");
|
||||
assert!(report.contains("WARNING"), "got: {report}");
|
||||
assert!(report.contains("does not match"), "got: {report}");
|
||||
assert!(report.contains("did:key:other"), "got: {report}");
|
||||
assert!(!report.contains("Could not fetch"), "got: {report}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn did_check_report_missing_did_reason() {
|
||||
let report =
|
||||
did_check_report(&Err("node info response carried no DID".to_string()), "n").join("\n");
|
||||
assert!(report.contains("Could not fetch"), "got: {report}");
|
||||
assert!(
|
||||
report.contains("node info response carried no DID"),
|
||||
"got: {report}"
|
||||
);
|
||||
assert!(report.contains("verify offline"), "got: {report}");
|
||||
// The must-not case: no real DID was obtained, so no comparison verdict
|
||||
// may be claimed in either direction.
|
||||
assert!(!report.contains("WARNING"), "got: {report}");
|
||||
assert!(
|
||||
!report.contains("matches the node being queried"),
|
||||
"got: {report}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn did_check_report_lookup_error_reason() {
|
||||
let report =
|
||||
did_check_report(&Err("node info failed (403): denied".to_string()), "n").join("\n");
|
||||
assert!(report.contains("Could not fetch"), "got: {report}");
|
||||
assert!(report.contains("403"), "got: {report}");
|
||||
assert!(report.contains("verify offline"), "got: {report}");
|
||||
assert!(!report.contains("WARNING"), "got: {report}");
|
||||
}
|
||||
}
|
||||
+14
-32
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Args;
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -45,7 +46,12 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
|
||||
did.split(':').next_back().unwrap_or(&did).to_string()
|
||||
} else {
|
||||
let client = NodeClient::new(&args.node, None);
|
||||
let info = crate::http::read_json(client.get("/").await?, "node info").await?;
|
||||
let info: Value = client
|
||||
.get("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch node info")?;
|
||||
let did = info["did"].as_str().context("node missing DID")?;
|
||||
did.split(':').next_back().unwrap_or(did).to_string()
|
||||
};
|
||||
@@ -62,7 +68,13 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "changelog").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("changelog failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let events = body["events"].as_array().cloned().unwrap_or_default();
|
||||
|
||||
@@ -204,7 +216,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repo not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -216,8 +227,6 @@ mod tests {
|
||||
};
|
||||
let err = run(args).await.unwrap_err();
|
||||
assert!(err.to_string().contains("changelog failed"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -265,31 +274,4 @@ mod tests {
|
||||
let err = rt.block_on(run(args)).unwrap_err();
|
||||
assert!(err.to_string().contains("no repo specified"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolve_via_run_surfaces_denial() {
|
||||
// A slash-free repo with an empty identity dir forces the inline GET /
|
||||
// node-info fetch during resolution. A gated 404 there must Err (surfacing
|
||||
// the status), proving the read_json conversion is load-bearing.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
|
||||
let _m = server
|
||||
.mock("GET", "/")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = run(ChangelogArgs {
|
||||
repo: Some("noslash".to_string()),
|
||||
limit: 20,
|
||||
node: server.url(),
|
||||
dir: Some(dir.path().to_path_buf()),
|
||||
})
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+1
-269
@@ -10,7 +10,6 @@ use anyhow::{Context, Result};
|
||||
use gitlawb_core::http_sig::sign_request;
|
||||
use gitlawb_core::identity::Keypair;
|
||||
use icaptcha_client::IcaptchaCfg;
|
||||
use serde_json::Value;
|
||||
|
||||
/// Max times we'll fetch a fresh proof and retry a 403-iCaptcha response
|
||||
/// (absorbs proof expiry / first-seen replay).
|
||||
@@ -320,7 +319,7 @@ pub(crate) async fn read_body_capped(mut resp: reqwest::Response, cap: usize) ->
|
||||
/// Strip terminal-dangerous characters from (and cap the length of) a
|
||||
/// node-supplied error string before surfacing it. The node a caller talks to
|
||||
/// could be hostile and embed escape sequences in its error body; those must not
|
||||
/// reach the terminal verbatim. We drop the C0/C1 control bytes (which
|
||||
/// reach the terminal verbatim (INV-6). We drop the C0/C1 control bytes (which
|
||||
/// defangs ANSI/OSC escapes) AND the Unicode bidi/format controls (which
|
||||
/// `char::is_control` does not cover — they can reorder the displayed line).
|
||||
pub(crate) fn sanitize_node_msg(s: &str) -> String {
|
||||
@@ -330,60 +329,6 @@ pub(crate) fn sanitize_node_msg(s: &str) -> String {
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Read a JSON response, surfacing a node denial/error instead of parsing it as
|
||||
/// the requested resource. On a non-2xx status it returns an `Err` carrying the
|
||||
/// node's sanitized `message` plus the status; on success it parses the
|
||||
/// body and propagates a parse error, so a truncated/garbage 2xx body is an error
|
||||
/// rather than a silently-empty success (the denial-as-success bug #123 fixes).
|
||||
/// `what` names the resource for the error text (e.g. "repo", "commits").
|
||||
///
|
||||
/// Callers must route gated reads through this rather than `resp.json().await?`:
|
||||
/// the bare parse renders a gated 404/5xx body back as the resource.
|
||||
/// Cap on the error body `read_json` reads before parsing a node's `message`.
|
||||
/// Matches the capped-read bound used on the sync error path; large enough for any
|
||||
/// legitimate error, small enough that a hostile node cannot exhaust memory.
|
||||
const ERROR_BODY_CAP: usize = 8 * 1024;
|
||||
|
||||
pub(crate) async fn read_json(resp: reqwest::Response, what: &str) -> Result<Value> {
|
||||
let status = resp.status();
|
||||
if !status.is_success() {
|
||||
// Bound the error read: `resp.json()` would buffer and parse the WHOLE
|
||||
// body, so a hostile node could stream an arbitrarily large valid JSON
|
||||
// error and exhaust this process's memory (#186). Read a small capped body
|
||||
// first, then best-effort extract `message`. The error body may also be
|
||||
// non-JSON (503 degraded, 413 body-limit from middleware), so a parse miss
|
||||
// falls back to the capped raw text; an empty body to the status alone.
|
||||
let raw = read_body_capped(resp, ERROR_BODY_CAP).await.text;
|
||||
// Preserve the prior contract: surface the JSON `message` when present in
|
||||
// the capped body, else the status alone ("request failed") — a non-JSON
|
||||
// or message-less body (503 degraded, 413 body-limit) never surfaces raw
|
||||
// node bytes. A body whose `message` sits past the cap parses as truncated
|
||||
// garbage here and correctly falls back rather than being buffered whole.
|
||||
//
|
||||
// Fall back to `error` before giving up: the node's shared AppError
|
||||
// envelope carries both keys, but the task API answers with `error` alone
|
||||
// (`{"error":"task not found"}` in gitlawb-node/src/api/tasks.rs), so
|
||||
// reading only `message` blanked every `gl task` denial to the generic
|
||||
// "request failed". `sync.rs`'s hand-rolled reader already reads both; this
|
||||
// matches it.
|
||||
let msg = serde_json::from_str::<Value>(&raw)
|
||||
.ok()
|
||||
.and_then(|b| {
|
||||
b.get("message")
|
||||
.or_else(|| b.get("error"))
|
||||
.and_then(|m| m.as_str())
|
||||
.map(str::to_owned)
|
||||
})
|
||||
.unwrap_or_else(|| "request failed".to_owned());
|
||||
anyhow::bail!("{what} failed ({status}): {}", sanitize_node_msg(&msg));
|
||||
}
|
||||
// Success: a truncated/garbage 2xx body must be an `Err`, not `Ok(Null)` that
|
||||
// a caller then renders as an empty success.
|
||||
resp.json()
|
||||
.await
|
||||
.with_context(|| format!("invalid JSON in {what} response"))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
@@ -1323,217 +1268,4 @@ mod tests {
|
||||
let out = sanitize_node_msg("ok \u{0627}\u{200D}b");
|
||||
assert_eq!(out, "ok \u{0627}\u{200D}b");
|
||||
}
|
||||
|
||||
// ── read_json (status-checked, bounded, sanitized read; #123) ────────
|
||||
|
||||
/// Drive a real `reqwest::Response` off a mockito mock so `read_json` sees an
|
||||
/// actual HTTP status + body, the same shape the gated read arms produce.
|
||||
async fn response_for(
|
||||
server: &mut Server,
|
||||
status: usize,
|
||||
body: &str,
|
||||
json: bool,
|
||||
) -> reqwest::Response {
|
||||
let mut m = server.mock("GET", "/x").with_status(status).with_body(body);
|
||||
if json {
|
||||
m = m.with_header("content-type", "application/json");
|
||||
}
|
||||
let _m = m.create_async().await;
|
||||
NodeClient::new(server.url(), None).get("/x").await.unwrap()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_returns_body_on_2xx() {
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(
|
||||
&mut server,
|
||||
200,
|
||||
r#"{"name":"r","owner_did":"did:gitlawb:z"}"#,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
let v = read_json(resp, "repo").await.unwrap();
|
||||
assert_eq!(v["name"], "r");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_404_surfacing_message_and_status() {
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(
|
||||
&mut server,
|
||||
404,
|
||||
r#"{"message":"repository 'o/r' not found"}"#,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("404"), "err={err}");
|
||||
assert!(err.contains("not found"), "err={err}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_500_surfacing_message() {
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 500, r#"{"message":"internal boom"}"#, true).await;
|
||||
let err = read_json(resp, "commits").await.unwrap_err().to_string();
|
||||
assert!(err.contains("500"), "err={err}");
|
||||
assert!(err.contains("internal boom"), "err={err}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_non_json_error_body_with_fallback() {
|
||||
// 503 with a plain-text (middleware) body: no `message` field to surface.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 503, "service unavailable", false).await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("503"), "err={err}");
|
||||
assert!(err.contains("request failed"), "err={err}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_sanitizes_control_and_bidi_in_message() {
|
||||
// A hostile node embeds ESC, BEL, and a right-to-left override in
|
||||
// the error message; none may reach the terminal verbatim.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(
|
||||
&mut server,
|
||||
404,
|
||||
r#"{"message":"a\u001b[31mb\u0007c\u202ed"}"#,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
|
||||
assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
|
||||
assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_garbage_2xx_body() {
|
||||
// The #123 correctness point: a 200 with a non-JSON/truncated body must be
|
||||
// an `Err`, NOT `Ok(Null)` that a caller renders as an empty success.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 200, "this is not json", false).await;
|
||||
assert!(read_json(resp, "repo").await.is_err());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_empty_2xx_body() {
|
||||
// A zero-byte 200 body must be an `Err`, not a silent `Ok(Null)`.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 200, "", false).await;
|
||||
assert!(read_json(resp, "repo").await.is_err());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_non_2xx_json_without_message_or_error() {
|
||||
// A non-2xx JSON body carrying NEITHER key is the real fallback case.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 403, r#"{"detail":"forbidden"}"#, true).await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("403"), "err={err}");
|
||||
assert!(err.contains("request failed"), "err={err}");
|
||||
// The body's own text must not leak when no recognised key carries it.
|
||||
assert!(!err.contains("forbidden"), "raw body leaked: {err}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_surfaces_error_key_when_message_absent() {
|
||||
// The task API answers with `error` alone — see
|
||||
// gitlawb-node/src/api/tasks.rs `{"error":"task not found"}`. Reading only
|
||||
// `message` blanked those denials to the generic "request failed", so the
|
||||
// user was told nothing about why the call failed.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 404, r#"{"error":"task not found"}"#, true).await;
|
||||
let err = read_json(resp, "task show").await.unwrap_err().to_string();
|
||||
assert!(err.contains("404"), "err={err}");
|
||||
assert!(err.contains("task not found"), "reason not surfaced: {err}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_prefers_message_over_error_key() {
|
||||
// The shared AppError envelope carries both; `message` is the human text
|
||||
// and must win over the machine code in `error`.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(
|
||||
&mut server,
|
||||
500,
|
||||
r#"{"error":"db_error","message":"database unavailable"}"#,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("database unavailable"), "err={err}");
|
||||
assert!(
|
||||
!err.contains("db_error"),
|
||||
"machine code won over message: {err}"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn read_json_sanitizes_error_key_text() {
|
||||
// The `error` fallback goes through the same sanitizer as `message`; a
|
||||
// hostile node must not reach the terminal through the new path. The
|
||||
// controls are JSON \u escapes so the body stays VALID JSON — embedding
|
||||
// them raw would fail the parse and pass this test vacuously.
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(
|
||||
&mut server,
|
||||
404,
|
||||
r#"{"error":"a\u001b[31mb\u0007c\u202ed"}"#,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
let err = read_json(resp, "task show").await.unwrap_err().to_string();
|
||||
// Proves the parse succeeded and the `error` key was read, not the
|
||||
// "request failed" fallback (which would make the asserts below vacuous).
|
||||
assert!(err.contains("task show failed (404"), "err={err}");
|
||||
assert!(
|
||||
!err.contains("request failed"),
|
||||
"fell back, sanitizer untested: {err}"
|
||||
);
|
||||
assert!(
|
||||
err.contains('a') && err.contains('d'),
|
||||
"text dropped: {err}"
|
||||
);
|
||||
assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
|
||||
assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
|
||||
assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
|
||||
}
|
||||
|
||||
/// #186 (F2): the non-2xx error path must read a CAPPED body, not buffer and
|
||||
/// parse the whole thing — a hostile node can stream an arbitrarily large valid
|
||||
/// JSON error. Place the `message` field AFTER more than the cap of padding: the
|
||||
/// bounded read stops before it, so it must be ABSENT from the surfaced error.
|
||||
/// RED before the fix (`resp.json()` parses the full body → the far message
|
||||
/// appears), GREEN after (capped read truncates → fallback → far message gone).
|
||||
/// The status is still surfaced, so a legitimate small error is unaffected.
|
||||
#[tokio::test]
|
||||
async fn read_json_bounds_the_error_body_read() {
|
||||
let mut server = Server::new_async().await;
|
||||
// >8 KiB of padding, then the marker message at the very end of the body.
|
||||
let big = format!(
|
||||
r#"{{"padding":"{}","message":"FARMARKER_BEYOND_CAP"}}"#,
|
||||
"A".repeat(16 * 1024)
|
||||
);
|
||||
let resp = response_for(&mut server, 500, &big, true).await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("500"), "bounded read still errors: {err}");
|
||||
assert!(
|
||||
!err.contains("FARMARKER_BEYOND_CAP"),
|
||||
"the error body read must be capped: a message beyond the cap must not be surfaced, err={err}"
|
||||
);
|
||||
}
|
||||
|
||||
/// #186 (F2): an EMPTY non-2xx body is its own input class — the capped read
|
||||
/// yields "", the JSON parse fails, and it falls back to the status alone
|
||||
/// ("request failed"), never a panic or a spurious success.
|
||||
#[tokio::test]
|
||||
async fn read_json_errs_on_empty_non_2xx_body() {
|
||||
let mut server = Server::new_async().await;
|
||||
let resp = response_for(&mut server, 502, "", false).await;
|
||||
let err = read_json(resp, "repo").await.unwrap_err().to_string();
|
||||
assert!(err.contains("502"), "err={err}");
|
||||
assert!(err.contains("request failed"), "err={err}");
|
||||
}
|
||||
}
|
||||
+49
-72
@@ -3,7 +3,7 @@
|
||||
use anyhow::{Context, Result};
|
||||
use chrono::Utc;
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::json;
|
||||
use serde_json::{json, Value};
|
||||
use std::path::PathBuf;
|
||||
use uuid::Uuid;
|
||||
|
||||
@@ -166,7 +166,12 @@ async fn resolve_repo(
|
||||
did.split(':').next_back().unwrap_or(&did).to_string()
|
||||
} else {
|
||||
let client = NodeClient::new(node, None);
|
||||
let info = crate::http::read_json(client.get("/").await?, "node info").await?;
|
||||
let info: Value = client
|
||||
.get("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch node info")?;
|
||||
let did = info["did"].as_str().context("node info missing 'did'")?;
|
||||
did.split(':').next_back().unwrap_or(did).to_string()
|
||||
};
|
||||
@@ -217,7 +222,13 @@ async fn cmd_create(
|
||||
.post(&path, &request_body)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let result = crate::http::read_json(resp, "create issue").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("create issue failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let id = result["id"].as_str().unwrap_or("?");
|
||||
println!("✓ Created issue #{id}");
|
||||
@@ -234,7 +245,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
|
||||
let client = signed_client(&node, dir.as_deref());
|
||||
let path = format!("/api/v1/repos/{owner}/{name}/issues");
|
||||
let resp = crate::http::read_json(client.get_authed(&path).await?, "issues").await?;
|
||||
let resp: Value = client
|
||||
.get_authed(&path)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to list issues")?;
|
||||
|
||||
let issues = resp["issues"].as_array().cloned().unwrap_or_default();
|
||||
|
||||
@@ -272,7 +288,13 @@ async fn cmd_show(repo: String, id: String, node: String, dir: Option<PathBuf>)
|
||||
.get_authed(&path)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let issue = crate::http::read_json(resp, "show").await?;
|
||||
let status = resp.status();
|
||||
let issue: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = issue["message"].as_str().unwrap_or("issue not found");
|
||||
anyhow::bail!("show failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let title = issue["title"].as_str().unwrap_or("(no title)");
|
||||
let status = issue["status"].as_str().unwrap_or("?");
|
||||
@@ -303,7 +325,13 @@ async fn cmd_close(repo: String, id: String, node: String, dir: Option<PathBuf>)
|
||||
.post(&format!("{path}/close"), &body)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let _ = crate::http::read_json(resp, "close issue").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("close issue failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✗ Closed issue {id}");
|
||||
Ok(())
|
||||
@@ -328,7 +356,13 @@ async fn cmd_issue_comment(
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let _ = crate::http::read_json(resp, "comment").await?;
|
||||
let code = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !code.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("comment failed ({code}): {msg}");
|
||||
}
|
||||
|
||||
println!("· Comment posted on issue {id}");
|
||||
Ok(())
|
||||
@@ -343,15 +377,14 @@ async fn cmd_issue_comments(
|
||||
let (owner, name) = resolve_repo(&repo, &node, dir.as_deref()).await?;
|
||||
let client = signed_client(&node, dir.as_deref());
|
||||
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get_authed(&format!(
|
||||
"/api/v1/repos/{owner}/{name}/issues/{id}/comments"
|
||||
))
|
||||
.await?,
|
||||
"issue comments",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get_authed(&format!(
|
||||
"/api/v1/repos/{owner}/{name}/issues/{id}/comments"
|
||||
))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
|
||||
let comments = resp["comments"].as_array().cloned().unwrap_or_default();
|
||||
if comments.is_empty() {
|
||||
@@ -481,7 +514,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repo not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -496,8 +528,6 @@ mod tests {
|
||||
|
||||
assert!(result.is_err());
|
||||
assert!(result.unwrap_err().to_string().contains("repo not found"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -545,7 +575,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"issue not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -559,8 +588,6 @@ mod tests {
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("show failed"), "got: {err}");
|
||||
assert!(err.to_string().contains("issue not found"), "got: {err}");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -609,7 +636,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"issue not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -622,8 +648,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("close issue failed"), "got: {err}");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -670,7 +694,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"issue not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -684,8 +707,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("issue not found"), "got: {err}");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -743,48 +764,4 @@ mod tests {
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_surfaces_denial_not_empty() {
|
||||
// A gated 404 on the issue-list read must Err, not print "No issues".
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/issues$".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
|
||||
assert!(result.is_err(), "issue list must Err on a gated 404");
|
||||
// Prove the gated issues path was actually requested: without this, an
|
||||
// unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolve_repo_surfaces_denial() {
|
||||
// A slash-free repo with an empty identity dir forces the GET / node-info
|
||||
// fetch. A gated 404 there must Err (surfacing the status), proving the
|
||||
// read_json conversion is load-bearing rather than silently ignored.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
|
||||
let _m = server
|
||||
.mock("GET", "/")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+154
-836
File diff suppressed because it is too large.
Load diff
+8
-94
@@ -84,7 +84,14 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
|
||||
let _guard = TmpGuard(tmp_root);
|
||||
|
||||
println!("Cloning source (this may take a while for large repos)...");
|
||||
clone_mirror(&source, &mirror_path)?;
|
||||
let clone_status = Command::new("git")
|
||||
.args(["clone", "--mirror", &source, mirror_path.to_str().unwrap()])
|
||||
.status()
|
||||
.context("failed to run git clone — is git installed?")?;
|
||||
|
||||
if !clone_status.success() {
|
||||
bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
|
||||
}
|
||||
|
||||
// ── 4. Create the repo on Twigpine ─────────────────────────────────────
|
||||
println!("Creating repo on Twigpine node...");
|
||||
@@ -136,25 +143,6 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// `git clone --mirror <source> <dest>`. The destination is passed as an
|
||||
/// OS-native path so a non-UTF-8 temp dir (e.g. a TMPDIR with non-UTF-8 bytes)
|
||||
/// does not panic on a `to_str()` conversion.
|
||||
fn clone_mirror(source: &str, dest: &std::path::Path) -> Result<()> {
|
||||
// allow-unbounded-git: gl is the client CLI; this clone runs in the user's
|
||||
// terminal with no server-side permit or disconnect to survive. The
|
||||
// bounded-runner rule governs node request handlers. Same spawn as before,
|
||||
// only relocated into this helper.
|
||||
let status = Command::new("git")
|
||||
.args(["clone", "--mirror", source])
|
||||
.arg(dest)
|
||||
.status()
|
||||
.context("failed to run git clone — is git installed?")?;
|
||||
if !status.success() {
|
||||
bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Extract the repo name from a git URL.
|
||||
/// - `https://github.com/owner/repo` → `"repo"`
|
||||
/// - `https://github.com/owner/repo.git` → `"repo"`
|
||||
@@ -237,80 +225,6 @@ mod tests {
|
||||
assert_eq!(extract_repo_name("https://example.com/.git"), None);
|
||||
}
|
||||
|
||||
// #417: a non-UTF-8 destination path must reach git as an OS-native arg, not
|
||||
// panic on a `to_str()` conversion.
|
||||
#[cfg(unix)]
|
||||
#[test]
|
||||
fn test_clone_mirror_non_utf8_dest() {
|
||||
use std::ffi::OsStr;
|
||||
use std::os::unix::ffi::OsStrExt;
|
||||
|
||||
let tmp = tempfile::TempDir::new().unwrap();
|
||||
let src = tmp.path().join("src.git");
|
||||
let st = Command::new("git")
|
||||
.args(["init", "--bare"])
|
||||
.arg(&src)
|
||||
.status()
|
||||
.unwrap();
|
||||
assert!(st.success());
|
||||
|
||||
let dest = tmp.path().join(OsStr::from_bytes(b"mirror-\xffdest"));
|
||||
clone_mirror(src.to_str().unwrap(), &dest).unwrap();
|
||||
assert!(dest.join("HEAD").exists());
|
||||
}
|
||||
|
||||
// #417 end-to-end: the real trigger is `std::env::temp_dir()` itself
|
||||
// returning a non-UTF-8 path (a TMPDIR with non-UTF-8 bytes), because the
|
||||
// mirror dest is built from it. Env is process-global, so this test
|
||||
// re-execs the test binary in a child with a non-UTF-8 TMPDIR rather than
|
||||
// mutating this process's env.
|
||||
#[cfg(unix)]
|
||||
#[test]
|
||||
fn test_clone_mirror_under_non_utf8_tmpdir() {
|
||||
use std::ffi::OsStr;
|
||||
use std::os::unix::ffi::OsStrExt;
|
||||
|
||||
if std::env::var_os("GL_MIRROR_NONUTF8_TMPDIR").is_none() {
|
||||
// Parent: a source repo under a normal path, a TMPDIR whose name
|
||||
// is not UTF-8, and a child run of this same test under that env.
|
||||
let parent = tempfile::TempDir::new().unwrap();
|
||||
let src = parent.path().join("src.git");
|
||||
let st = Command::new("git")
|
||||
.args(["init", "--bare"])
|
||||
.arg(&src)
|
||||
.status()
|
||||
.unwrap();
|
||||
assert!(st.success());
|
||||
let bad_tmp = parent.path().join(OsStr::from_bytes(b"tmp-\xff"));
|
||||
std::fs::create_dir_all(&bad_tmp).unwrap();
|
||||
|
||||
let status = Command::new(std::env::current_exe().unwrap())
|
||||
.args([
|
||||
"mirror::tests::test_clone_mirror_under_non_utf8_tmpdir",
|
||||
"--exact",
|
||||
])
|
||||
.env("GL_MIRROR_NONUTF8_TMPDIR", "1")
|
||||
.env("GL_MIRROR_SRC", &src)
|
||||
.env("TMPDIR", &bad_tmp)
|
||||
.status()
|
||||
.unwrap();
|
||||
assert!(status.success(), "child failed under non-UTF-8 TMPDIR");
|
||||
return;
|
||||
}
|
||||
|
||||
// Child: the same path shape run() computes — temp_dir() joined with
|
||||
// the mirror dest. It must be non-UTF-8 or the test proves nothing.
|
||||
let src = std::env::var("GL_MIRROR_SRC").unwrap();
|
||||
let tmp_root = std::env::temp_dir().join("gl-mirror-child");
|
||||
let dest = tmp_root.join("repo");
|
||||
assert!(
|
||||
dest.to_str().is_none(),
|
||||
"fixture broken: dest under a non-UTF-8 TMPDIR must be non-UTF-8"
|
||||
);
|
||||
clone_mirror(&src, &dest).unwrap();
|
||||
assert!(dest.join("HEAD").exists());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_create_repo_conflict_error() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
|
||||
+31
-296
@@ -79,7 +79,12 @@ pub async fn run(args: PeerArgs) -> Result<()> {
|
||||
|
||||
async fn cmd_list(node: String) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
let resp = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
|
||||
let resp: Value = client
|
||||
.get("/api/v1/peers")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to list peers")?;
|
||||
|
||||
let peers = resp["peers"].as_array().cloned().unwrap_or_default();
|
||||
let count = resp["count"].as_u64().unwrap_or(peers.len() as u64);
|
||||
@@ -180,20 +185,18 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
|
||||
let keypair = load_keypair_from_dir(dir.as_deref())?;
|
||||
let my_did = keypair.did().to_string();
|
||||
|
||||
// Fetch our node's public URL so we can announce it to the peer. This lookup
|
||||
// is a deliberate fail-soft diagnostic: it only improves the URL we advertise.
|
||||
// A response-level failure (denial, error, garbage body) falls back to the
|
||||
// --node value with a visible note rather than aborting; only a transport
|
||||
// failure on the GET itself is fatal. The announce below keeps the
|
||||
// fail-closed read_json check.
|
||||
// Fetch our node's public URL so we can announce it to the peer
|
||||
let local_client = NodeClient::new(&node, None);
|
||||
let my_url = match crate::http::read_json(local_client.get("/").await?, "node info").await {
|
||||
Ok(info) => info["public_url"].as_str().unwrap_or(&node).to_string(),
|
||||
Err(e) => {
|
||||
eprintln!("note: local node info unavailable ({e}); announcing {node}");
|
||||
node.clone()
|
||||
}
|
||||
};
|
||||
let node_info: Value = local_client
|
||||
.get("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch local node info")?;
|
||||
let my_url = node_info["public_url"]
|
||||
.as_str()
|
||||
.unwrap_or(&node)
|
||||
.to_string();
|
||||
|
||||
// Announce our local node to the remote peer
|
||||
let body = serde_json::to_vec(&serde_json::json!({
|
||||
@@ -269,7 +272,12 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
|
||||
async fn cmd_ping(did: String, node: String) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
let path = format!("/api/v1/peers/{did}/ping");
|
||||
let resp = crate::http::read_json(client.get(&path).await?, "ping peer").await?;
|
||||
let resp: Value = client
|
||||
.get(&path)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to ping peer")?;
|
||||
|
||||
let url = resp["http_url"].as_str().unwrap_or("?");
|
||||
let reachable = resp["reachable"].as_bool().unwrap_or(false);
|
||||
@@ -289,7 +297,12 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
let encoded = urlencoding::encode(&did);
|
||||
let path = format!("/api/v1/resolve/{encoded}");
|
||||
let resp = crate::http::read_json(client.get(&path).await?, "resolve DID").await?;
|
||||
let resp: Value = client
|
||||
.get(&path)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to resolve DID")?;
|
||||
|
||||
let source = resp["source"].as_str().unwrap_or("not found");
|
||||
let http_url = resp["http_url"].as_str().unwrap_or("(none)");
|
||||
@@ -312,8 +325,8 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{
|
||||
announced_peer_summary, cmd_add, cmd_list, cmd_ping, cmd_resolve, local_add_refusal,
|
||||
local_add_report, remote_announce_failure,
|
||||
announced_peer_summary, cmd_add, local_add_refusal, local_add_report,
|
||||
remote_announce_failure,
|
||||
};
|
||||
use reqwest::StatusCode;
|
||||
use serde_json::json;
|
||||
@@ -606,282 +619,4 @@ mod tests {
|
||||
"legitimate text mangled: {warning:?}"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_surfaces_denial_not_empty() {
|
||||
// A node error must Err, not print "No known peers" as if the list were empty.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("GET", "/api/v1/peers")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = cmd_list(server.url()).await.unwrap_err();
|
||||
assert!(err.to_string().contains("500"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_ping_surfaces_denial_not_unreachable() {
|
||||
// A node error must Err, not print a fabricated "unreachable" peer.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("GET", "/api/v1/peers/peer1/ping")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = cmd_ping("peer1".to_string(), server.url())
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_resolve_surfaces_denial_not_notfound() {
|
||||
// A node error must Err, not print "Source: not found" as if resolved-absent.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/api/v1/resolve/".to_string()),
|
||||
)
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = cmd_resolve("peer1".to_string(), server.url())
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("500"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
// cmd_add needs a local identity to build my_did before the GET /.
|
||||
fn identity_dir() -> tempfile::TempDir {
|
||||
let dir = tempfile::TempDir::new().unwrap();
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
std::fs::write(
|
||||
dir.path().join("identity.pem"),
|
||||
kp.to_pem().unwrap().as_bytes(),
|
||||
)
|
||||
.unwrap();
|
||||
dir
|
||||
}
|
||||
|
||||
/// Mock a successful announce that requires `http_url` in the POSTed body.
|
||||
/// The `{}` response body matters: it leaves `node_url` absent, so cmd_add
|
||||
/// skips the follow-up local peer-list POST.
|
||||
async fn announce_ok_mock(server: &mut mockito::ServerGuard, http_url: &str) -> mockito::Mock {
|
||||
announce_mock_with_body(server, http_url, "{}").await
|
||||
}
|
||||
|
||||
/// Like [`announce_ok_mock`] but with a custom response body, for tests
|
||||
/// that need `node_url` populated so the follow-up local add runs.
|
||||
async fn announce_mock_with_body(
|
||||
server: &mut mockito::ServerGuard,
|
||||
http_url: &str,
|
||||
body: &str,
|
||||
) -> mockito::Mock {
|
||||
server
|
||||
.mock("POST", "/api/v1/peers/announce")
|
||||
.match_body(mockito::Matcher::PartialJson(serde_json::json!({
|
||||
"http_url": http_url,
|
||||
})))
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(body)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await
|
||||
}
|
||||
|
||||
// The local `GET /` lookup in cmd_add is a fail-soft diagnostic: a denied
|
||||
// or error node-info response must fall back to announcing the --node URL
|
||||
// (with a stderr note), not abort the command before the announce POST.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_announces_fallback_url_when_node_info_denied() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"internal"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = announce_ok_mock(&mut remote, &local.url()).await;
|
||||
|
||||
let dir = identity_dir();
|
||||
cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap();
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
}
|
||||
|
||||
// Same fallback for a 200 node-info response whose body is not JSON.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_falls_back_on_malformed_node_info() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_body("not json")
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = announce_ok_mock(&mut remote, &local.url()).await;
|
||||
|
||||
let dir = identity_dir();
|
||||
cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap();
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
}
|
||||
|
||||
// Must-not case: the announce POST itself stays fail-closed. A denied
|
||||
// announce surfaces as an Err naming the status, never a printed success.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_surfaces_denied_announce() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"public_url":"https://pub.example"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = remote
|
||||
.mock("POST", "/api/v1/peers/announce")
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let dir = identity_dir();
|
||||
let err = cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("403"), "got: {err}");
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
}
|
||||
|
||||
// Success path unchanged: a usable node-info response announces its
|
||||
// public_url; the --node fallback must not leak in.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_uses_public_url_when_lookup_succeeds() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"public_url":"https://pub.example"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = announce_ok_mock(&mut remote, "https://pub.example").await;
|
||||
|
||||
let dir = identity_dir();
|
||||
cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap();
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
}
|
||||
|
||||
// When the peer's announce response carries a node_url, cmd_add posts the
|
||||
// peer back to the local node's peer list; a successful local POST is the
|
||||
// one case that prints the added line.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_adds_peer_to_local_list_on_success() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"public_url":"https://pub.example"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _local_add = local
|
||||
.mock("POST", "/api/v1/peers/announce")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"status":"added"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = announce_mock_with_body(
|
||||
&mut remote,
|
||||
"https://pub.example",
|
||||
r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
|
||||
)
|
||||
.await;
|
||||
|
||||
let dir = identity_dir();
|
||||
cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap();
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
_local_add.assert_async().await;
|
||||
}
|
||||
|
||||
// The local add stays best-effort: a failing local POST must not fail the
|
||||
// command (the announce to the remote peer already succeeded), it only
|
||||
// changes the printed outcome.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_stays_ok_when_local_add_fails() {
|
||||
let mut local = mockito::Server::new_async().await;
|
||||
let _info = local
|
||||
.mock("GET", "/")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"public_url":"https://pub.example"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _local_add = local
|
||||
.mock("POST", "/api/v1/peers/announce")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let mut remote = mockito::Server::new_async().await;
|
||||
let _announce = announce_mock_with_body(
|
||||
&mut remote,
|
||||
"https://pub.example",
|
||||
r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
|
||||
)
|
||||
.await;
|
||||
|
||||
let dir = identity_dir();
|
||||
cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap();
|
||||
_info.assert_async().await;
|
||||
_announce.assert_async().await;
|
||||
_local_add.assert_async().await;
|
||||
}
|
||||
}
|
||||
+73
-321
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -264,7 +265,13 @@ async fn cmd_create(
|
||||
.post(&format!("/api/v1/repos/{owner}/{repo}/pulls"), &payload)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let pr = crate::http::read_json(resp, "create PR").await?;
|
||||
let status = resp.status();
|
||||
let pr: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = pr["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("create PR failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let number = pr["number"].as_i64().unwrap_or(0);
|
||||
println!("✓ Opened PR #{number}: {title}");
|
||||
@@ -279,13 +286,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
let owner = resolve_owner(&keypair);
|
||||
let client = NodeClient::new(&node, None);
|
||||
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
|
||||
.await?,
|
||||
"pull requests",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
|
||||
let prs = resp["pulls"].as_array().cloned().unwrap_or_default();
|
||||
if prs.is_empty() {
|
||||
@@ -324,13 +330,12 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
|
||||
let owner = resolve_owner(&keypair);
|
||||
let client = NodeClient::new(&node, None);
|
||||
|
||||
let pr = crate::http::read_json(
|
||||
client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
|
||||
.await?,
|
||||
"pull request",
|
||||
)
|
||||
.await?;
|
||||
let pr: Value = client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
|
||||
let title = pr["title"].as_str().unwrap_or("?");
|
||||
let status = pr["status"].as_str().unwrap_or("?");
|
||||
@@ -348,25 +353,15 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
|
||||
}
|
||||
|
||||
// Show reviews
|
||||
// A denied sub-fetch degrades this section rather than aborting: the header
|
||||
// above has already printed, so a bare `?` here leaves a half-rendered PR and
|
||||
// skips the comments below it. Mirrors `gl status`'s unavailable-section line.
|
||||
let reviews = match crate::http::read_json(
|
||||
client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
|
||||
))
|
||||
.await?,
|
||||
"reviews",
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(v) => v["reviews"].as_array().cloned().unwrap_or_default(),
|
||||
Err(e) => {
|
||||
println!("\nReviews unavailable ({e})");
|
||||
Vec::new()
|
||||
}
|
||||
};
|
||||
let reviews: Value = client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
|
||||
))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
let reviews = reviews["reviews"].as_array().cloned().unwrap_or_default();
|
||||
if !reviews.is_empty() {
|
||||
println!("\nReviews ({}):", reviews.len());
|
||||
for r in &reviews {
|
||||
@@ -391,22 +386,15 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
|
||||
}
|
||||
|
||||
// Show comments
|
||||
let comments = match crate::http::read_json(
|
||||
client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
|
||||
))
|
||||
.await?,
|
||||
"comments",
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(v) => v["comments"].as_array().cloned().unwrap_or_default(),
|
||||
Err(e) => {
|
||||
println!("\nComments unavailable ({e})");
|
||||
Vec::new()
|
||||
}
|
||||
};
|
||||
let comments: Value = client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
|
||||
))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
let comments = comments["comments"].as_array().cloned().unwrap_or_default();
|
||||
if !comments.is_empty() {
|
||||
println!("\nComments ({}):", comments.len());
|
||||
for c in &comments {
|
||||
@@ -430,13 +418,12 @@ async fn cmd_diff(repo: String, number: u64, node: String, dir: Option<PathBuf>)
|
||||
let owner = resolve_owner(&keypair);
|
||||
let client = NodeClient::new(&node, None);
|
||||
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
|
||||
.await?,
|
||||
"diff",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
|
||||
let diff = resp["diff"].as_str().unwrap_or("");
|
||||
if diff.is_empty() {
|
||||
@@ -460,7 +447,13 @@ async fn cmd_merge(repo: String, number: u64, node: String, dir: Option<PathBuf>
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let result = crate::http::read_json(resp, "merge").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("merge failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let sha = result["merge_sha"].as_str().unwrap_or("?");
|
||||
println!("✓ Merged PR #{number}");
|
||||
@@ -492,7 +485,13 @@ async fn cmd_review(
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let _ = crate::http::read_json(resp, "review").await?;
|
||||
let code = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !code.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("review failed ({code}): {msg}");
|
||||
}
|
||||
|
||||
let icon = match status.as_str() {
|
||||
"approved" => "✓",
|
||||
@@ -522,7 +521,13 @@ async fn cmd_comment(
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let _ = crate::http::read_json(resp, "comment").await?;
|
||||
let code = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !code.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("comment failed ({code}): {msg}");
|
||||
}
|
||||
|
||||
println!("· Comment posted on PR #{number}");
|
||||
Ok(())
|
||||
@@ -533,15 +538,14 @@ async fn cmd_comments(repo: String, number: u64, node: String, dir: Option<PathB
|
||||
let owner = resolve_owner(&keypair);
|
||||
let client = NodeClient::new(&node, None);
|
||||
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
|
||||
))
|
||||
.await?,
|
||||
"comments",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get(&format!(
|
||||
"/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
|
||||
))
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON")?;
|
||||
|
||||
let comments = resp["comments"].as_array().cloned().unwrap_or_default();
|
||||
if comments.is_empty() {
|
||||
@@ -682,7 +686,6 @@ mod tests {
|
||||
.with_status(422)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"branch not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -700,8 +703,6 @@ mod tests {
|
||||
|
||||
assert!(result.is_err());
|
||||
assert!(result.unwrap_err().to_string().contains("branch not found"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -799,7 +800,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"PR not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -813,8 +813,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("PR not found"), "got: {err}");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -899,250 +897,4 @@ mod tests {
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
// ── Gated PR reads surface node denials, not empty/stub renders (#123) ──
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_surfaces_denial_not_empty() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/pulls$".to_string()))
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_list(
|
||||
"myrepo".to_string(),
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"cmd_list must Err on 404, not print 'No pull requests'"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_view_surfaces_denial_not_stub() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
// The PR fetch is first; a 404 there errors before the reviews/comments reads.
|
||||
let _m = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_view(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"cmd_view must Err on 404, not print a stub PR"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_diff_surfaces_denial_not_empty() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/diff$".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_diff(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"cmd_diff must Err on 404, not print 'No diff'"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_comments_surfaces_denial_not_empty() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_comments(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(result.is_err(), "cmd_comments must Err on a gated 404");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
/// A denied sub-fetch must not abort `gl pr view` after the header has
|
||||
/// already printed. The header is fatal; reviews and comments degrade.
|
||||
#[tokio::test]
|
||||
async fn cmd_view_continues_when_reviews_are_denied() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _pr = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _reviews = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
|
||||
)
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"forbidden"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
// The load-bearing assertion: this mock is only hit if rendering
|
||||
// continued past the denied reviews fetch.
|
||||
let _comments = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"comments":[]}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let r = cmd_view(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
r.is_ok(),
|
||||
"cmd_view must finish rendering when reviews are denied"
|
||||
);
|
||||
_comments.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_view_continues_when_comments_are_denied() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _pr = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _reviews = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
|
||||
)
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"reviews":[]}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let _comments = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
|
||||
)
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"forbidden"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let r = cmd_view(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
r.is_ok(),
|
||||
"cmd_view must finish rendering when comments are denied"
|
||||
);
|
||||
_comments.assert_async().await;
|
||||
}
|
||||
|
||||
/// The must-not case: with no header there is nothing to render partially,
|
||||
/// so a denied header stays fatal. Softening it would resurrect
|
||||
/// denial-as-success for the whole command.
|
||||
#[tokio::test]
|
||||
async fn cmd_view_header_denial_stays_fatal() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _pr = server
|
||||
.mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let r = cmd_view(
|
||||
"myrepo".to_string(),
|
||||
1,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await;
|
||||
assert!(r.is_err(), "a denied PR header must stay fatal");
|
||||
_pr.assert_async().await;
|
||||
}
|
||||
}
|
||||
+28
-29
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -93,7 +94,12 @@ async fn resolve_owner_repo(
|
||||
did.split(':').next_back().unwrap_or(&did).to_string()
|
||||
} else {
|
||||
let client = NodeClient::new(node, None);
|
||||
let info = crate::http::read_json(client.get("/").await?, "node info").await?;
|
||||
let info: Value = client
|
||||
.get("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch node info")?;
|
||||
let did = info["did"].as_str().context("node missing DID")?;
|
||||
did.split(':').next_back().unwrap_or(did).to_string()
|
||||
};
|
||||
@@ -114,7 +120,13 @@ async fn cmd_set(branch: String, repo: String, node: String, dir: Option<PathBuf
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "protect").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("protect failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✓ Branch '{branch}' is now protected in {owner}/{name}");
|
||||
println!(" Only the repo owner can push to this branch.");
|
||||
@@ -140,7 +152,13 @@ async fn cmd_remove(
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "unprotect").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("unprotect failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✓ Branch '{branch}' is no longer protected in {owner}/{name}");
|
||||
Ok(())
|
||||
@@ -157,7 +175,13 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "list protected branches").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("list protected branches failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let branches = body["protected_branches"]
|
||||
.as_array()
|
||||
@@ -235,7 +259,6 @@ mod tests {
|
||||
.with_status(400)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"only the repo owner can protect branches"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -248,8 +271,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("protect failed"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -361,26 +382,4 @@ mod tests {
|
||||
assert_eq!(owner, "alice");
|
||||
assert_eq!(name, "myrepo");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolve_owner_repo_surfaces_denial() {
|
||||
// A slash-free repo with an empty identity dir forces the GET / node-info
|
||||
// fetch. A gated 404 there must Err (surfacing the status), proving the
|
||||
// read_json conversion is load-bearing rather than silently ignored.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
|
||||
let _m = server
|
||||
.mock("GET", "/")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Args;
|
||||
use serde_json::json;
|
||||
use serde_json::{json, Value};
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -59,7 +59,16 @@ pub async fn run(args: RegisterArgs) -> Result<()> {
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let payload = crate::http::read_json(resp, "registration").await?;
|
||||
let status = resp.status();
|
||||
let payload: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = payload
|
||||
.get("message")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("unknown error");
|
||||
anyhow::bail!("registration failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
// Save bootstrap UCAN
|
||||
let ucan = payload.get("ucan").and_then(|v| v.as_str()).unwrap_or("");
|
||||
@@ -166,7 +175,6 @@ mod tests {
|
||||
.with_status(401)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"invalid signature"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -183,8 +191,6 @@ mod tests {
|
||||
.unwrap_err()
|
||||
.to_string()
|
||||
.contains("invalid signature"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
|
||||
+83
-164
@@ -303,7 +303,13 @@ async fn cmd_create(
|
||||
.post("/api/v1/repos", &body)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let payload = crate::http::read_json(resp, "create").await?;
|
||||
let status = resp.status();
|
||||
let payload: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = payload["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("create failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let clone_url = payload["clone_url"].as_str().unwrap_or("");
|
||||
let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
|
||||
@@ -323,7 +329,12 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
|
||||
let url = format!("/api/v1/repos?owner={owner}");
|
||||
let repos = crate::http::read_json(client.get(&url).await?, "list repos").await?;
|
||||
let repos: Value = client
|
||||
.get(&url)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to list repos")?;
|
||||
let repos = repos.as_array().context("expected array")?;
|
||||
|
||||
if repos.is_empty() {
|
||||
@@ -392,13 +403,20 @@ async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
// A non-existent (or unreadable/quarantined) repo is a real 404 from the
|
||||
// node — surface it plainly instead of printing a stub card with `?` fields
|
||||
// and a placeholder owner DID.
|
||||
if resp.status().as_u16() == 404 {
|
||||
anyhow::bail!("repository '{owner}/{name}' not found");
|
||||
if !resp.status().is_success() {
|
||||
if resp.status().as_u16() == 404 {
|
||||
anyhow::bail!("repository '{owner}/{name}' not found");
|
||||
}
|
||||
let status = resp.status();
|
||||
let msg = resp
|
||||
.json::<Value>()
|
||||
.await
|
||||
.ok()
|
||||
.and_then(|v| v["message"].as_str().map(String::from))
|
||||
.unwrap_or_else(|| "request failed".to_string());
|
||||
anyhow::bail!("repo info failed ({status}): {msg}");
|
||||
}
|
||||
// Every other status routes through read_json: a 2xx yields the parsed body,
|
||||
// any other non-2xx yields the node's capped + sanitized message, and
|
||||
// the error read is bounded rather than buffering the whole hostile body.
|
||||
let r = crate::http::read_json(resp, "repo info").await?;
|
||||
let r: Value = resp.json().await.context("parse repo info")?;
|
||||
|
||||
let owner_did = r["owner_did"].as_str().unwrap_or(&owner);
|
||||
let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
|
||||
@@ -457,7 +475,12 @@ async fn cmd_replica_register(
|
||||
.await
|
||||
.context("failed to connect to origin node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "replica register").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("replica register failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["replica_count"].as_i64().unwrap_or(0);
|
||||
println!("Registered as replica of {owner}/{name}");
|
||||
@@ -484,7 +507,12 @@ async fn cmd_replica_unregister(repo: String, node: String, dir: Option<PathBuf>
|
||||
.await
|
||||
.context("failed to connect to origin node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "replica unregister").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("replica unregister failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["replica_count"].as_i64().unwrap_or(0);
|
||||
println!("Unregistered as replica of {owner}/{name} ({count} replicas remaining)");
|
||||
@@ -504,7 +532,12 @@ async fn cmd_replicas(repo: String, node: String, dir: Option<PathBuf>) -> Resul
|
||||
.get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/replicas"))
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let body = crate::http::read_json(resp, "replicas list").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("replicas list failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["replica_count"].as_i64().unwrap_or(0);
|
||||
println!("{owner}/{name}: {count} replicas");
|
||||
@@ -540,7 +573,12 @@ pub(crate) async fn cmd_commits(
|
||||
};
|
||||
|
||||
let url = format!("/api/v1/repos/{owner}/{name}/commits?branch={branch}&limit={limit}");
|
||||
let resp = crate::http::read_json(client.get(&url).await?, "commits").await?;
|
||||
let resp: Value = client
|
||||
.get(&url)
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch commits")?;
|
||||
|
||||
let commits = resp["commits"].as_array().cloned().unwrap_or_default();
|
||||
if commits.is_empty() {
|
||||
@@ -593,7 +631,13 @@ async fn cmd_fork(
|
||||
.post(&format!("/api/v1/repos/{owner}/{repo_name}/fork"), &body)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let result = crate::http::read_json(resp, "fork").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON response")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("fork failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let fork_name = result["name"].as_str().unwrap_or(&repo_name);
|
||||
let owner_did = result["owner_did"].as_str().unwrap_or("?");
|
||||
@@ -631,7 +675,13 @@ async fn cmd_label_add(
|
||||
.post(&format!("/api/v1/repos/{owner}/{name}/labels"), &body)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let result = crate::http::read_json(resp, "add label").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("add label failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let added = result["added"].as_bool().unwrap_or(true);
|
||||
if added {
|
||||
@@ -656,7 +706,13 @@ async fn cmd_label_remove(
|
||||
.delete(&format!("/api/v1/repos/{owner}/{name}/labels/{label}"), &[])
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let _ = crate::http::read_json(resp, "remove label").await?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("remove label failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("- Label removed: {label} from {owner}/{name}");
|
||||
Ok(())
|
||||
@@ -669,21 +725,18 @@ async fn cmd_label_list(repo: String, node: String, dir: Option<PathBuf>) -> Res
|
||||
// read their own labels, while public repos stay anonymously listable.
|
||||
let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
|
||||
|
||||
// Marry both refactors: main's get_maybe_signed (read-visibility gating —
|
||||
// public repos stay anon-listable, private-repo owner signs) carrying the
|
||||
// PR's read_json status-check-before-parse (#186: bounded error read, no
|
||||
// parse-before-status). get_authed from the PR is dropped in favor of
|
||||
// get_maybe_signed so the visibility gate is preserved.
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
|
||||
.await
|
||||
.context("failed to connect to node")?,
|
||||
"list labels",
|
||||
)
|
||||
.await?;
|
||||
let resp = client
|
||||
.get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("list labels failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let labels = resp["labels"].as_array().cloned().unwrap_or_default();
|
||||
let labels = body["labels"].as_array().cloned().unwrap_or_default();
|
||||
if labels.is_empty() {
|
||||
println!("No labels on {owner}/{name}");
|
||||
} else {
|
||||
@@ -856,7 +909,6 @@ mod tests {
|
||||
.with_status(409)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository already exists"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -872,8 +924,6 @@ mod tests {
|
||||
|
||||
assert!(result.is_err());
|
||||
assert!(result.unwrap_err().to_string().contains("already exists"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -942,33 +992,6 @@ mod tests {
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_list_repos_surfaces_denial() {
|
||||
// A node error must Err with the status, not trip the vague "expected
|
||||
// array" fallback that hides the node's actual response.
|
||||
let dir = TempDir::new().unwrap();
|
||||
write_identity(&dir);
|
||||
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/repos\?owner=".to_string()),
|
||||
)
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_list(server.url(), Some(dir.path().to_path_buf()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("500"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_cmd_commits_empty() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
@@ -1068,7 +1091,6 @@ mod tests {
|
||||
.with_status(400)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"you already have a repo named myrepo"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -1084,8 +1106,6 @@ mod tests {
|
||||
err.to_string().contains("already have a repo"),
|
||||
"got: {err}"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -1458,7 +1478,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -1471,106 +1490,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("not found"), "got: {err}");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_repo.assert_async().await;
|
||||
}
|
||||
|
||||
// ── Gated CLI reads surface node denials, not empty renders (#123) ──
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_commits_surfaces_denial_not_empty() {
|
||||
// A gated 404 must Err, not print "No commits" as if the repo were empty.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/commits".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_commits(
|
||||
"alice/secret".to_string(),
|
||||
"main".to_string(),
|
||||
20,
|
||||
server.url(),
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(result.is_err(), "cmd_commits must Err on 404");
|
||||
assert!(result.unwrap_err().to_string().contains("not found"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn cmd_label_list_surfaces_denial_not_empty() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/labels".to_string()),
|
||||
)
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let result = cmd_label_list("alice/secret".to_string(), server.url(), None).await;
|
||||
assert!(result.is_err(), "cmd_label_list must Err on 404");
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
// cmd_info keeps its bespoke 404 message ahead of read_json...
|
||||
#[tokio::test]
|
||||
async fn cmd_info_404_keeps_bespoke_message() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("GET", "/api/v1/repos/alice/secret")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"gone"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = cmd_info("alice/secret".to_string(), server.url(), None)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(
|
||||
err.contains("repository 'alice/secret' not found"),
|
||||
"bespoke 404 text lost: {err}"
|
||||
);
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
// ...and every other non-2xx routes through read_json (capped + sanitized).
|
||||
#[tokio::test]
|
||||
async fn cmd_info_500_routes_through_read_json() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _m = server
|
||||
.mock("GET", "/api/v1/repos/alice/secret")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = cmd_info("alice/secret".to_string(), server.url(), None)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(
|
||||
err.contains("repo info failed"),
|
||||
"read_json label lost: {err}"
|
||||
);
|
||||
assert!(err.contains("500"), "status not surfaced: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -1769,7 +1688,7 @@ mod vet_merge_deny_arms {
|
||||
}
|
||||
|
||||
// An authenticated caller DENIED with a 403 must surface an error, never
|
||||
// render a repo card (deny-as-success is the client-contract break).
|
||||
// render a repo card (deny-as-success is the INV-8 client-contract break).
|
||||
#[tokio::test]
|
||||
async fn cmd_info_403_denied_surfaces_error_not_card() {
|
||||
let dir = TempDir::new().unwrap();
|
||||
|
||||
+22
-56
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -86,7 +87,13 @@ async fn cmd_add(repo: String, node: String, dir: Option<PathBuf>) -> Result<()>
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "star").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("star failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["star_count"].as_i64().unwrap_or(0);
|
||||
println!("Starred {owner}/{name} ({count} stars total)");
|
||||
@@ -104,7 +111,13 @@ async fn cmd_remove(repo: String, node: String, dir: Option<PathBuf>) -> Result<
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "unstar").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("unstar failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["star_count"].as_i64().unwrap_or(0);
|
||||
println!("Unstarred {owner}/{name} ({count} stars remaining)");
|
||||
@@ -123,7 +136,13 @@ async fn cmd_count(repo: String, node: String, dir: Option<PathBuf>) -> Result<(
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "star count").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("star count failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let count = body["star_count"].as_i64().unwrap_or(0);
|
||||
println!("{owner}/{name}: {count} stars");
|
||||
@@ -223,7 +242,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repo not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -235,8 +253,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("star failed"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -283,7 +299,6 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"repo not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
@@ -295,8 +310,6 @@ mod tests {
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("unstar failed"));
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -334,51 +347,4 @@ mod tests {
|
||||
assert_eq!(owner, "alice");
|
||||
assert_eq!(name, "myrepo");
|
||||
}
|
||||
|
||||
// U15 (#186): a converted handler must inherit read_json's capped + sanitized
|
||||
// error path end-to-end. A hostile 500 whose `message` carries terminal-control
|
||||
// + bidi bytes and is long must reach the terminal neither verbatim nor unbounded.
|
||||
#[tokio::test]
|
||||
async fn cmd_add_hostile_error_is_sanitized_and_bounded() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap();
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
std::fs::write(
|
||||
dir.path().join("identity.pem"),
|
||||
kp.to_pem().unwrap().as_bytes(),
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
// ESC + a long run + a right-to-left override, all inside the node message
|
||||
// (JSON \u escapes so the source has no raw control bytes).
|
||||
let hostile = format!(r#"{{"message":"a\u001b[31m{}b\u202ec"}}"#, "Z".repeat(500));
|
||||
let _m = server
|
||||
.mock("PUT", mockito::Matcher::Regex(r"/star$".to_string()))
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(hostile)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_add(
|
||||
"myrepo".to_string(),
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
|
||||
assert!(
|
||||
!err.contains('\u{1b}'),
|
||||
"ESC leaked to the terminal: {err:?}"
|
||||
);
|
||||
assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
|
||||
// Bounded: sanitize_node_msg caps the surfaced message, so the 500-char run
|
||||
// cannot flood the error string.
|
||||
assert!(err.len() < 300, "error not bounded ({} bytes)", err.len());
|
||||
assert!(err.contains("star failed"), "handler label lost: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+15
-166
@@ -41,9 +41,17 @@ pub async fn run(args: StatusArgs) -> Result<()> {
|
||||
let client = NodeClient::new(&args.node, None);
|
||||
if let Some(ref did) = maybe_did {
|
||||
let short_key = did.split(':').next_back().unwrap_or(did);
|
||||
let resp = client.get(&format!("/api/v1/agents/{short_key}")).await;
|
||||
if let Some(line) = trust_line(resp).await {
|
||||
println!("{line}");
|
||||
match client.get(&format!("/api/v1/agents/{short_key}")).await {
|
||||
Ok(resp) if resp.status().is_success() => {
|
||||
if let Ok(body) = resp.json::<Value>().await {
|
||||
let score = body["trust_score"].as_f64().unwrap_or(0.0);
|
||||
let bar = trust_bar(score);
|
||||
println!(" trust {score:.2} {bar}");
|
||||
}
|
||||
}
|
||||
_ => {
|
||||
println!(" trust — not registered (run `gl register`)");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -77,10 +85,8 @@ pub async fn run(args: StatusArgs) -> Result<()> {
|
||||
let pr_resp = client
|
||||
.get(&format!("/api/v1/repos/{short_owner}/{repo_name}/pulls"))
|
||||
.await;
|
||||
if let Some(line) = section_unavailable_line("PRs", &pr_resp) {
|
||||
println!("{line}");
|
||||
} else if let Ok(r) = pr_resp {
|
||||
if let Ok(body) = crate::http::read_json(r, "pull requests").await {
|
||||
if let Ok(r) = pr_resp {
|
||||
if let Ok(body) = r.json::<Value>().await {
|
||||
let prs = body["pulls"].as_array().cloned().unwrap_or_default();
|
||||
let open: Vec<_> = prs
|
||||
.iter()
|
||||
@@ -106,10 +112,8 @@ pub async fn run(args: StatusArgs) -> Result<()> {
|
||||
let issue_resp = client
|
||||
.get(&format!("/api/v1/repos/{short_owner}/{repo_name}/issues"))
|
||||
.await;
|
||||
if let Some(line) = section_unavailable_line("issues", &issue_resp) {
|
||||
println!("{line}");
|
||||
} else if let Ok(r) = issue_resp {
|
||||
if let Ok(body) = crate::http::read_json(r, "issues").await {
|
||||
if let Ok(r) = issue_resp {
|
||||
if let Ok(body) = r.json::<Value>().await {
|
||||
let issues = body["issues"].as_array().cloned().unwrap_or_default();
|
||||
let open: Vec<_> = issues
|
||||
.iter()
|
||||
@@ -136,40 +140,6 @@ pub async fn run(args: StatusArgs) -> Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The status line for a repo section (PRs / issues) whose gated read returned a
|
||||
/// non-2xx: the denial must surface, never render as "no open ...".
|
||||
/// Returns `None` for a success (the caller renders the body) or a transport error
|
||||
/// (the section degrades silently — R5 — so the multi-section `gl status` never
|
||||
/// hard-fails on one denied read).
|
||||
fn section_unavailable_line(label: &str, resp: &Result<reqwest::Response>) -> Option<String> {
|
||||
match resp {
|
||||
Ok(r) if !r.status().is_success() => {
|
||||
Some(format!(" {label:<10}unavailable ({})", r.status()))
|
||||
}
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
/// The `trust` status line for the caller's own identity. A genuine 404 means the
|
||||
/// identity is not registered; any OTHER non-2xx (403/429/5xx) is a failed lookup
|
||||
/// and must surface as unavailable rather than fabricating an unregistered state
|
||||
/// A transport error degrades silently — the node-unreachable line below
|
||||
/// already surfaces it — matching `section_unavailable_line`.
|
||||
async fn trust_line(resp: Result<reqwest::Response>) -> Option<String> {
|
||||
match resp {
|
||||
Ok(r) if r.status().is_success() => {
|
||||
let body = r.json::<Value>().await.ok()?;
|
||||
let score = body["trust_score"].as_f64().unwrap_or(0.0);
|
||||
Some(format!(" trust {score:.2} {}", trust_bar(score)))
|
||||
}
|
||||
Ok(r) if r.status() == reqwest::StatusCode::NOT_FOUND => {
|
||||
Some(" trust — not registered (run `gl register`)".to_string())
|
||||
}
|
||||
Ok(r) => Some(format!(" trust unavailable ({})", r.status())),
|
||||
Err(_) => None,
|
||||
}
|
||||
}
|
||||
|
||||
/// Render a simple ASCII trust bar: 0.75 → "███░"
|
||||
fn trust_bar(score: f64) -> String {
|
||||
let filled = (score * 4.0).round() as usize;
|
||||
@@ -410,125 +380,4 @@ mod tests {
|
||||
fn trust_bar_quarter() {
|
||||
assert_eq!(trust_bar(0.25), "█░░░");
|
||||
}
|
||||
|
||||
// ── gl status section denial surfacing (#123, R5) ────────────────────
|
||||
|
||||
async fn get_response(
|
||||
server: &mut mockito::Server,
|
||||
status: usize,
|
||||
) -> Result<reqwest::Response> {
|
||||
let _m = server
|
||||
.mock("GET", "/x")
|
||||
.with_status(status)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"pulls":[]}"#)
|
||||
.create_async()
|
||||
.await;
|
||||
NodeClient::new(server.url(), None).get("/x").await
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn gated_section_surfaces_unavailable_not_empty() {
|
||||
// A gated 404 on a status section must surface "unavailable", never be
|
||||
// treated as "no open PRs".
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let resp = get_response(&mut server, 404).await;
|
||||
assert_eq!(
|
||||
section_unavailable_line("PRs", &resp),
|
||||
Some(format!(" {:<10}unavailable (404 Not Found)", "PRs"))
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn success_section_returns_none_for_body_render() {
|
||||
// A 2xx returns None so the caller renders the body as before.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let resp = get_response(&mut server, 200).await;
|
||||
assert!(section_unavailable_line("issues", &resp).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn transport_error_degrades_silently() {
|
||||
// A transport error (not a status) must NOT surface — the section
|
||||
// degrades silently so gl status never hard-fails on one bad read (R5).
|
||||
let err: Result<reqwest::Response> = Err(anyhow::anyhow!("connection refused"));
|
||||
assert!(section_unavailable_line("PRs", &err).is_none());
|
||||
}
|
||||
|
||||
// ── trust_line: a 404 means unregistered; any OTHER failure must surface as
|
||||
// unavailable, never fabricate an unregistered verdict. ───────────────
|
||||
async fn agents_resp(
|
||||
server: &mut mockito::Server,
|
||||
status: usize,
|
||||
body: &str,
|
||||
) -> Result<reqwest::Response> {
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"^/api/v1/agents/".to_string()),
|
||||
)
|
||||
.with_status(status)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(body)
|
||||
.create_async()
|
||||
.await;
|
||||
NodeClient::new(server.url(), None)
|
||||
.get("/api/v1/agents/zTest")
|
||||
.await
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn trust_line_registered_shows_score_only() {
|
||||
let mut s = mockito::Server::new_async().await;
|
||||
let line = trust_line(agents_resp(&mut s, 200, r#"{"trust_score":0.5}"#).await)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(line.contains("0.50"), "line={line}");
|
||||
assert!(!line.contains("not registered"), "line={line}");
|
||||
assert!(!line.contains("unavailable"), "line={line}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn trust_line_404_is_not_registered() {
|
||||
let mut s = mockito::Server::new_async().await;
|
||||
let line = trust_line(agents_resp(&mut s, 404, r#"{"message":"agent not found"}"#).await)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(line.contains("not registered"), "line={line}");
|
||||
assert!(!line.contains("unavailable"), "line={line}");
|
||||
}
|
||||
|
||||
// Load-bearing: a 403 for an existing identity is a denied lookup, not proof it is unregistered.
|
||||
#[tokio::test]
|
||||
async fn trust_line_403_is_unavailable_not_registered() {
|
||||
let mut s = mockito::Server::new_async().await;
|
||||
let line = trust_line(agents_resp(&mut s, 403, r#"{"message":"forbidden"}"#).await)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(
|
||||
line.contains("unavailable") && line.contains("403"),
|
||||
"line={line}"
|
||||
);
|
||||
assert!(!line.contains("not registered"), "line={line}");
|
||||
}
|
||||
|
||||
// Load-bearing: a 5xx is a failed lookup, not an unregistered verdict.
|
||||
#[tokio::test]
|
||||
async fn trust_line_500_is_unavailable_not_registered() {
|
||||
let mut s = mockito::Server::new_async().await;
|
||||
let line = trust_line(agents_resp(&mut s, 500, r#"{"message":"boom"}"#).await)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(line.contains("unavailable"), "line={line}");
|
||||
assert!(!line.contains("not registered"), "line={line}");
|
||||
}
|
||||
|
||||
// Load-bearing: a transport error degrades silently, never fabricates unregistered.
|
||||
#[tokio::test]
|
||||
async fn trust_line_transport_error_is_silent() {
|
||||
let resp = NodeClient::new("http://127.0.0.1:1", None)
|
||||
.get("/api/v1/agents/zTest")
|
||||
.await;
|
||||
assert!(trust_line(resp).await.is_none());
|
||||
}
|
||||
}
|
||||
+2
-82
@@ -75,9 +75,8 @@ pub async fn run(args: SyncArgs) -> Result<()> {
|
||||
SyncCmd::Status => {
|
||||
let client = NodeClient::new(&args.node, None);
|
||||
// Just show peer list and node stats for now
|
||||
let stats =
|
||||
crate::http::read_json(client.get("/api/v1/stats").await?, "node stats").await?;
|
||||
let peers = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
|
||||
let stats: serde_json::Value = client.get("/api/v1/stats").await?.json().await?;
|
||||
let peers: serde_json::Value = client.get("/api/v1/peers").await?.json().await?;
|
||||
println!("Node stats:");
|
||||
println!(" repos: {}", stats["repos"].as_i64().unwrap_or(0));
|
||||
println!(" agents: {}", stats["agents"].as_i64().unwrap_or(0));
|
||||
@@ -163,7 +162,6 @@ mod tests {
|
||||
// Valid JSON: the parse-without-status-check bug deserializes this
|
||||
// into a zero-count success struct and prints "✓ sync triggered".
|
||||
.with_body(r#"{"message":"unauthorized"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let (args, _dir) = trigger_args(server.url());
|
||||
@@ -172,8 +170,6 @@ mod tests {
|
||||
err.to_string().contains("401"),
|
||||
"expected 401 surfaced, got: {err}"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -184,7 +180,6 @@ mod tests {
|
||||
.with_status(429)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"slow down"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let (args, _dir) = trigger_args(server.url());
|
||||
@@ -193,8 +188,6 @@ mod tests {
|
||||
err.to_string().contains("429"),
|
||||
"expected 429 surfaced, got: {err}"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -211,7 +204,6 @@ mod tests {
|
||||
// BEL (\u0007); serde decodes them to real control bytes a naive
|
||||
// client would print. (The status-check bug fake-successes here.)
|
||||
.with_body("{\"message\":\"pwned\\u001b[31m\\u0007bad\"}")
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let (args, _dir) = trigger_args(server.url());
|
||||
@@ -223,8 +215,6 @@ mod tests {
|
||||
s.contains("pwned") && s.contains("bad"),
|
||||
"message text dropped: {s:?}"
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -250,7 +240,6 @@ mod tests {
|
||||
.mock("POST", "/api/v1/sync/trigger")
|
||||
.with_status(401)
|
||||
.with_body("A".repeat(2_000_000))
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let (args, _dir) = trigger_args(server.url());
|
||||
@@ -262,8 +251,6 @@ mod tests {
|
||||
"error message not bounded: {} chars",
|
||||
s.len()
|
||||
);
|
||||
// Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -294,71 +281,4 @@ mod tests {
|
||||
(0, 0)
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn status_surfaces_stats_denial_not_fake_zeros() {
|
||||
// A node error on /stats must Err, not print "0 repos / 0 agents / 0 pushes".
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let stats = server
|
||||
.mock("GET", "/api/v1/stats")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
// A peers mock so the pre-fix path reaches a clean success rather than a
|
||||
// 501 on an unmocked route; after the fix the /stats denial bails first.
|
||||
let _peers = server
|
||||
.mock("GET", "/api/v1/peers")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"count":0,"peers":[]}"#)
|
||||
.create_async()
|
||||
.await;
|
||||
let args = SyncArgs {
|
||||
cmd: SyncCmd::Status,
|
||||
node: server.url(),
|
||||
dir: None,
|
||||
};
|
||||
let err = run(args).await.unwrap_err();
|
||||
assert!(
|
||||
err.to_string().contains("500"),
|
||||
"expected 500 surfaced, got: {err}"
|
||||
);
|
||||
stats.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn status_surfaces_peers_denial() {
|
||||
// /stats succeeds but /peers denies — the peers read must Err too, not
|
||||
// print "Known peers: 0".
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let _stats = server
|
||||
.mock("GET", "/api/v1/stats")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"repos":1,"agents":2,"pushes":3}"#)
|
||||
.create_async()
|
||||
.await;
|
||||
let peers = server
|
||||
.mock("GET", "/api/v1/peers")
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let args = SyncArgs {
|
||||
cmd: SyncCmd::Status,
|
||||
node: server.url(),
|
||||
dir: None,
|
||||
};
|
||||
let err = run(args).await.unwrap_err();
|
||||
assert!(
|
||||
err.to_string().contains("500"),
|
||||
"expected 500 surfaced, got: {err}"
|
||||
);
|
||||
peers.assert_async().await;
|
||||
}
|
||||
}
|
||||
+47
-176
@@ -190,14 +190,13 @@ async fn cmd_create(
|
||||
"delegator_did": delegator_did,
|
||||
}))?;
|
||||
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.post("/api/v1/tasks", &body)
|
||||
.await
|
||||
.context("failed to create task")?,
|
||||
"create task",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.post("/api/v1/tasks", &body)
|
||||
.await
|
||||
.context("failed to create task")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
@@ -216,25 +215,26 @@ async fn cmd_list(
|
||||
if let Some(a) = &assignee_did {
|
||||
path.push_str(&format!("&assignee_did={}", urlencoding::encode(a)));
|
||||
}
|
||||
let resp = crate::http::read_json(
|
||||
client.get(&path).await.context("failed to list tasks")?,
|
||||
"list tasks",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get(&path)
|
||||
.await
|
||||
.context("failed to list tasks")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn cmd_view(id: String, node: String) -> Result<()> {
|
||||
let client = NodeClient::new(&node, None);
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.get(&format!("/api/v1/tasks/{}", id))
|
||||
.await
|
||||
.context("failed to get task")?,
|
||||
"view task",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.get(&format!("/api/v1/tasks/{}", id))
|
||||
.await
|
||||
.context("failed to get task")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
@@ -245,14 +245,13 @@ async fn cmd_claim(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
|
||||
let client = NodeClient::new(&node, Some(keypair));
|
||||
|
||||
let body = serde_json::to_vec(&json!({ "assignee_did": assignee_did }))?;
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.post(&format!("/api/v1/tasks/{}/claim", id), &body)
|
||||
.await
|
||||
.context("failed to claim task")?,
|
||||
"claim task",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.post(&format!("/api/v1/tasks/{}/claim", id), &body)
|
||||
.await
|
||||
.context("failed to claim task")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
@@ -268,14 +267,13 @@ async fn cmd_complete(
|
||||
let client = NodeClient::new(&node, Some(keypair));
|
||||
|
||||
let body = serde_json::to_vec(&json!({ "result": result, "by_did": by_did }))?;
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.post(&format!("/api/v1/tasks/{}/complete", id), &body)
|
||||
.await
|
||||
.context("failed to complete task")?,
|
||||
"complete task",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.post(&format!("/api/v1/tasks/{}/complete", id), &body)
|
||||
.await
|
||||
.context("failed to complete task")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
@@ -291,14 +289,13 @@ async fn cmd_fail(
|
||||
let client = NodeClient::new(&node, Some(keypair));
|
||||
|
||||
let body = serde_json::to_vec(&json!({ "reason": reason, "by_did": by_did }))?;
|
||||
let resp = crate::http::read_json(
|
||||
client
|
||||
.post(&format!("/api/v1/tasks/{}/fail", id), &body)
|
||||
.await
|
||||
.context("failed to fail task")?,
|
||||
"fail task",
|
||||
)
|
||||
.await?;
|
||||
let resp: Value = client
|
||||
.post(&format!("/api/v1/tasks/{}/fail", id), &body)
|
||||
.await
|
||||
.context("failed to fail task")?
|
||||
.json()
|
||||
.await
|
||||
.context("invalid JSON response")?;
|
||||
print_json(&resp);
|
||||
Ok(())
|
||||
}
|
||||
@@ -382,12 +379,11 @@ mod tests {
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"internal error"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
// A node 5xx must surface as an Err, not be printed as if it were a task.
|
||||
let err = cmd_create(
|
||||
// Should still succeed (prints JSON, doesn't check status code)
|
||||
cmd_create(
|
||||
"deploy".to_string(),
|
||||
"agent:task".to_string(),
|
||||
None,
|
||||
@@ -399,9 +395,7 @@ mod tests {
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("500"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
// ── list ─────────────────────────────────────────────────────────
|
||||
@@ -475,16 +469,11 @@ mod tests {
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
// A 404 must surface as an Err, not be printed as if it were a task.
|
||||
let err = cmd_view("nope".to_string(), server.url())
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
// cmd_view doesn't check status — it prints the JSON
|
||||
cmd_view("nope".to_string(), server.url()).await.unwrap();
|
||||
}
|
||||
|
||||
// ── claim ────────────────────────────────────────────────────────
|
||||
@@ -636,122 +625,4 @@ mod tests {
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
// ── denial surfaces: a node 4xx/5xx must Err, not render as success ──
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_list_tasks_surfaces_denial() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
|
||||
let _m = server
|
||||
.mock(
|
||||
"GET",
|
||||
mockito::Matcher::Regex(r"/api/v1/tasks\?".to_string()),
|
||||
)
|
||||
.with_status(500)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"boom"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_list(None, None, 50, server.url()).await.unwrap_err();
|
||||
assert!(err.to_string().contains("500"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_claim_task_surfaces_denial() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap();
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
std::fs::write(
|
||||
dir.path().join("identity.pem"),
|
||||
kp.to_pem().unwrap().as_bytes(),
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let _m = server
|
||||
.mock("POST", "/api/v1/tasks/task-x/claim")
|
||||
.with_status(403)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"forbidden"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_claim(
|
||||
"task-x".to_string(),
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("403"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_complete_task_surfaces_denial() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap();
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
std::fs::write(
|
||||
dir.path().join("identity.pem"),
|
||||
kp.to_pem().unwrap().as_bytes(),
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let _m = server
|
||||
.mock("POST", "/api/v1/tasks/task-x/complete")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"not found"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_complete(
|
||||
"task-x".to_string(),
|
||||
None,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_fail_task_surfaces_denial() {
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap();
|
||||
let kp = gitlawb_core::identity::Keypair::generate();
|
||||
std::fs::write(
|
||||
dir.path().join("identity.pem"),
|
||||
kp.to_pem().unwrap().as_bytes(),
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let _m = server
|
||||
.mock("POST", "/api/v1/tasks/task-x/fail")
|
||||
.with_status(409)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"already terminal"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
|
||||
let err = cmd_fail(
|
||||
"task-x".to_string(),
|
||||
None,
|
||||
server.url(),
|
||||
Some(dir.path().to_path_buf()),
|
||||
)
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("409"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+25
-26
@@ -2,6 +2,7 @@
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Args, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use crate::http::NodeClient;
|
||||
@@ -98,7 +99,12 @@ async fn resolve_owner_repo(
|
||||
did.split(':').next_back().unwrap_or(&did).to_string()
|
||||
} else {
|
||||
let client = NodeClient::new(node, None);
|
||||
let info = crate::http::read_json(client.get("/").await?, "node info").await?;
|
||||
let info: Value = client
|
||||
.get("/")
|
||||
.await?
|
||||
.json()
|
||||
.await
|
||||
.context("failed to fetch node info")?;
|
||||
let did = info["did"].as_str().context("node missing DID")?;
|
||||
did.split(':').next_back().unwrap_or(did).to_string()
|
||||
};
|
||||
@@ -129,7 +135,12 @@ async fn cmd_set(
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "visibility set").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("visibility set failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✓ Visibility rule set on {owner}/{name}: {path_glob} (mode {mode})");
|
||||
if path_glob != "/" {
|
||||
@@ -157,7 +168,12 @@ async fn cmd_remove(
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let _ = crate::http::read_json(resp, "visibility remove").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("visibility remove failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✓ Visibility rule removed from {owner}/{name}: {path_glob}");
|
||||
Ok(())
|
||||
@@ -175,7 +191,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
|
||||
let body = crate::http::read_json(resp, "visibility list").await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("visibility list failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let rules = body["rules"].as_array().cloned().unwrap_or_default();
|
||||
if rules.is_empty() {
|
||||
@@ -298,26 +319,4 @@ mod tests {
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolve_owner_repo_surfaces_denial() {
|
||||
// A slash-free repo with an empty identity dir forces the GET / node-info
|
||||
// fetch. A gated 404 there must Err (surfacing the status), proving the
|
||||
// read_json conversion is load-bearing rather than silently ignored.
|
||||
let mut server = mockito::Server::new_async().await;
|
||||
let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
|
||||
let _m = server
|
||||
.mock("GET", "/")
|
||||
.with_status(404)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(r#"{"message":"denied"}"#)
|
||||
.expect(1)
|
||||
.create_async()
|
||||
.await;
|
||||
let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
|
||||
.await
|
||||
.unwrap_err();
|
||||
assert!(err.to_string().contains("404"), "got: {err}");
|
||||
_m.assert_async().await;
|
||||
}
|
||||
}
|
||||
+35
-34
@@ -110,17 +110,17 @@ async fn cmd_create(
|
||||
"events": event_list,
|
||||
}))?;
|
||||
|
||||
// #186: read_json status-checks before parsing and bounds the error body, so
|
||||
// a denial (or a hostile oversized error) fails here instead of being parsed
|
||||
// whole. `what` preserves main's "create webhook failed (...)" message prefix.
|
||||
let hook = crate::http::read_json(
|
||||
client
|
||||
.post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
|
||||
.await
|
||||
.context("failed to connect to node")?,
|
||||
"create webhook",
|
||||
)
|
||||
.await?;
|
||||
let resp = client
|
||||
.post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let status = resp.status();
|
||||
let hook: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = hook["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("create webhook failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let id = hook["id"].as_str().unwrap_or("?");
|
||||
let hook_events = hook["events"]
|
||||
@@ -157,15 +157,16 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
|
||||
|
||||
// get_signed (not get) attaches the RFC 9421 signature — plain get() never
|
||||
// signs, and the node owner-gates this route, so an unsigned GET 401s.
|
||||
// #186: read_json status-checks + bounds the error body; `what` preserves
|
||||
// main's "list webhooks failed (...)" message prefix.
|
||||
let body = crate::http::read_json(
|
||||
client
|
||||
.get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
|
||||
.await?,
|
||||
"list webhooks",
|
||||
)
|
||||
.await?;
|
||||
let resp = client
|
||||
.get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
|
||||
.await?;
|
||||
let status = resp.status();
|
||||
let body: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = body["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("list webhooks failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
let hooks = body
|
||||
.get("webhooks")
|
||||
@@ -206,20 +207,20 @@ async fn cmd_delete(repo: String, id: String, node: String, dir: Option<PathBuf>
|
||||
let client = NodeClient::new(&node, Some(keypair));
|
||||
|
||||
let payload = serde_json::to_vec(&serde_json::json!({}))?;
|
||||
// #186: read_json status-checks + bounds the error body; `what` preserves
|
||||
// main's "delete webhook failed (...)" message prefix. The success body is
|
||||
// unused, so discard it.
|
||||
let _ = crate::http::read_json(
|
||||
client
|
||||
.delete(
|
||||
&format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
|
||||
&payload,
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?,
|
||||
"delete webhook",
|
||||
)
|
||||
.await?;
|
||||
let resp = client
|
||||
.delete(
|
||||
&format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
|
||||
&payload,
|
||||
)
|
||||
.await
|
||||
.context("failed to connect to node")?;
|
||||
let status = resp.status();
|
||||
let result: Value = resp.json().await.context("invalid JSON")?;
|
||||
|
||||
if !status.is_success() {
|
||||
let msg = result["message"].as_str().unwrap_or("unknown error");
|
||||
anyhow::bail!("delete webhook failed ({status}): {msg}");
|
||||
}
|
||||
|
||||
println!("✓ Webhook {id} deleted");
|
||||
Ok(())
|
||||
|
||||
@@ -1,356 +0,0 @@
|
||||
//! Completeness gate for #186, itself proven load-bearing by reverting a
|
||||
//! converted handler and watching this go red.
|
||||
//!
|
||||
//! The client handlers converted in #186 must read node responses through
|
||||
//! `crate::http::read_json` — status-first, capped error read, sanitized message.
|
||||
//! The bypass this fix removed is *parse-before-status*: a `resp.json().await`
|
||||
//! whose result is only checked against the status AFTER parsing, which lets a
|
||||
//! hostile node stream an unbounded JSON error and print its `message` unsanitized.
|
||||
//!
|
||||
//! This test scans the converted source files and fails if that idiom returns —
|
||||
//! a `.json().await` call (not `read_json`) with an `.is_success()` check within a
|
||||
//! few lines AFTER it. A status check BEFORE the parse (the `KEEP` probes in
|
||||
//! repo.rs) reads as status-first and is not flagged. If a converted site is
|
||||
//! reverted to the bypass, this goes RED.
|
||||
//!
|
||||
//! The gate does not hand-list the files to scan; it DERIVES them: every
|
||||
//! `src/*.rs` that references `read_json` (except `http.rs`, where it is defined)
|
||||
//! is a converted handler and is scanned for the bypass idiom.
|
||||
//!
|
||||
//! Derivation alone has a blind spot: it keys on the very `read_json` marker a
|
||||
//! full revert deletes. A converted handler with a single node call (register.rs)
|
||||
//! reverted to `resp.json().await` loses `read_json` entirely, drops out of the
|
||||
//! derived set, and its bypass goes unscanned. So `CONVERTED_IN_186` is the
|
||||
//! authoritative required set and the gate asserts the derived surface EQUALS it,
|
||||
//! failing closed in both directions:
|
||||
//!
|
||||
//! - a pinned file missing from the derived set was reverted off `read_json`
|
||||
//! (the blind-spot escape), so the gate goes RED;
|
||||
//! - a file that uses `read_json` but is not pinned is a conversion that was
|
||||
//! never enrolled, so its own later revert would escape unseen; RED until it
|
||||
//! is added to the pin.
|
||||
//!
|
||||
//! Equality is what extends the protection to handlers converted after #186, not
|
||||
//! just the original sixteen: a conversion cannot ship unpinned, and a pinned
|
||||
//! surface cannot be deconverted silently.
|
||||
//!
|
||||
//! Pre-existing bypasses in files this PR did not convert (e.g. init.rs,
|
||||
//! mirror.rs, profile.rs) are known debt, tracked separately and out of scope.
|
||||
//! They do not use `read_json`, so the derivation excludes them and they are not
|
||||
//! pinned.
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
/// Files that define/host `read_json` rather than consume it as a converted
|
||||
/// handler. Excluded from the scanned set even though they reference the symbol.
|
||||
const NOT_A_HANDLER: &[&str] = &["http.rs"];
|
||||
|
||||
/// The authoritative converted-handler surface: every non-`http.rs` file whose
|
||||
/// node-response reads route through `read_json`. The gate asserts the derived
|
||||
/// `read_json` set EQUALS this exactly, so a new conversion must be added here
|
||||
/// (the gate is RED until it is) and a pinned surface cannot be reverted off
|
||||
/// `read_json` without tripping the gate. Both directions fail closed, which is
|
||||
/// what protects post-#186 conversions, not only the original sixteen.
|
||||
const CONVERTED_IN_186: &[&str] = &[
|
||||
"agent.rs",
|
||||
"bounty.rs",
|
||||
"cert.rs",
|
||||
"changelog.rs",
|
||||
"issue.rs",
|
||||
"mcp.rs",
|
||||
"peer.rs",
|
||||
"pr.rs",
|
||||
"protect.rs",
|
||||
"register.rs",
|
||||
"repo.rs",
|
||||
"star.rs",
|
||||
"status.rs",
|
||||
"sync.rs",
|
||||
"task.rs",
|
||||
"visibility.rs",
|
||||
"webhook.rs",
|
||||
];
|
||||
|
||||
/// Derive the converted-handler surface: every `src/*.rs` that references
|
||||
/// `read_json`, minus the definition site(s). This is the set the equality check
|
||||
/// compares against `CONVERTED_IN_186`; a newly-converted handler surfaces here
|
||||
/// and must then be pinned (the gate is RED until it is).
|
||||
fn scanned_handlers(src: &Path) -> Vec<(String, String)> {
|
||||
let mut handlers = Vec::new();
|
||||
for entry in std::fs::read_dir(src).expect("read src dir") {
|
||||
let path = entry.expect("dir entry").path();
|
||||
if path.extension().and_then(|e| e.to_str()) != Some("rs") {
|
||||
continue;
|
||||
}
|
||||
let file_name = path
|
||||
.file_name()
|
||||
.and_then(|n| n.to_str())
|
||||
.expect("file name")
|
||||
.to_string();
|
||||
if NOT_A_HANDLER.contains(&file_name.as_str()) {
|
||||
continue;
|
||||
}
|
||||
let text = std::fs::read_to_string(&path)
|
||||
.unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
|
||||
if has_read_json_call_site(&text) {
|
||||
handlers.push((file_name, text));
|
||||
}
|
||||
}
|
||||
handlers.sort();
|
||||
handlers
|
||||
}
|
||||
|
||||
/// Does this file actually CALL `read_json`, as opposed to merely mentioning it?
|
||||
///
|
||||
/// Membership in the derived set must key on a call site, never on the text of
|
||||
/// the file. A textual `contains("read_json")` matched prose too, so a handler
|
||||
/// fully reverted off `read_json` kept its membership on the strength of a
|
||||
/// leftover comment ("previously routed through read_json"). Still-derived means
|
||||
/// the pinned-vs-derived equality below never fired, and the reverted file went
|
||||
/// on being scanned as though it were converted, so the deconversion — which
|
||||
/// drops the cap and the sanitizer — shipped green. Requiring the trailing `(`
|
||||
/// on a non-comment line also drops test names and doc references.
|
||||
fn has_read_json_call_site(text: &str) -> bool {
|
||||
text.lines().any(|l| {
|
||||
let t = l.trim_start();
|
||||
!t.starts_with("//") && t.contains("read_json(")
|
||||
})
|
||||
}
|
||||
|
||||
/// How far above a parse site to look for its status check.
|
||||
///
|
||||
/// The widest legitimate gap in the tree is `sync.rs`'s hand-rolled status-first
|
||||
/// `Trigger` arm, whose `.status()` sits 19 lines above its parse; 24 leaves a
|
||||
/// little headroom. Wider is weaker, so this should shrink if that arm is ever
|
||||
/// routed through `read_json` like its siblings.
|
||||
const STATUS_LOOKBACK: usize = 24;
|
||||
|
||||
/// Does `line` open a JSON parse — `.json().await`, or a turbofish
|
||||
/// `.json::<T>().await`, or the head of a split-line chain (`.json(` /
|
||||
/// `.json::<T>(` whose `()` / `.await` continue on following lines)?
|
||||
///
|
||||
/// Lines routed through `read_json` are never parse sites (that IS the fix).
|
||||
fn opens_json_parse(line: &str) -> bool {
|
||||
if line.contains("read_json") {
|
||||
return false;
|
||||
}
|
||||
// A `.json(` token starts every reqwest JSON parse, bare or turbofished,
|
||||
// single- or split-line. We anchor on it and let the window below confirm
|
||||
// the `.await` / status check; anchoring on `.json(` alone is what catches
|
||||
// `resp.json::<Value>().await` and `resp\n .json()\n .await` chains
|
||||
// that the old bare-`.json().await` substring missed.
|
||||
line.contains(".json()") || line.contains(".json::<")
|
||||
}
|
||||
|
||||
/// Within `window` (the parse-site line joined with the few lines after it), is
|
||||
/// the parse actually completed with `.await` and then checked against the
|
||||
/// status? A completed parse whose `.is_success()` lands AFTER it is the
|
||||
/// parse-before-status bypass. A status check BEFORE the parse (KEEP probes)
|
||||
/// never appears in this after-the-parse window, so it is not flagged.
|
||||
fn window_is_bypass(window: &str) -> bool {
|
||||
// The parse must actually resolve — guards against matching a `.json`-shaped
|
||||
// token that never awaits. Split-line chains put `.await` a line or two down,
|
||||
// which the joined window still contains.
|
||||
let completes = window.contains(".await");
|
||||
completes && window.contains(".is_success()")
|
||||
}
|
||||
|
||||
/// Is there a FULL non-success guard ABOVE this parse site — one that exits for
|
||||
/// every non-2xx status, not merely a bespoke branch for one code?
|
||||
///
|
||||
/// `window_is_bypass` only recognises a status check that lands AFTER the parse,
|
||||
/// so it describes one specific bypass and says nothing about a parse with no
|
||||
/// status check anywhere. That shape is the more dangerous revert (it renders a
|
||||
/// denial body as a successful result with no check at all). Requiring positive
|
||||
/// evidence of a guard first turns the rule from "detect one bad ordering" into
|
||||
/// "require the good ordering".
|
||||
///
|
||||
/// The evidence must cover the whole non-success range. "Any `.status()`
|
||||
/// nearby" is not enough: agent.rs legitimately keeps a 404-only hint
|
||||
/// (`resp.status() == StatusCode::NOT_FOUND`) ahead of its `read_json` call,
|
||||
/// and a revert that swaps that call for `resp.json().await?` would still see
|
||||
/// the 404 check in the lookback — while a 500's JSON denial body renders as an
|
||||
/// empty agent list again. A single-status equality (or a `matches!(…, 404 |
|
||||
/// 501)` enumeration) guards its own arm and nothing else, so it does not
|
||||
/// count. What counts:
|
||||
///
|
||||
/// - `.is_success()` — the canonical spelling; sync.rs binds the status to a
|
||||
/// variable first, so this token is matched on its own rather than as a
|
||||
/// `.status()` suffix;
|
||||
/// - a RANGE comparison over `as_u16()` (`>= 400` and friends), which reads the
|
||||
/// whole class rather than enumerating codes.
|
||||
///
|
||||
/// The `special_404_hint_is_not_a_guard` mutation test below keeps this
|
||||
/// distinction honest against the real agent.rs source.
|
||||
fn has_full_status_guard_above(lookback: &str) -> bool {
|
||||
if lookback.contains(".is_success()") {
|
||||
return true;
|
||||
}
|
||||
lookback.contains("as_u16() >=")
|
||||
|| lookback.contains("as_u16() >")
|
||||
|| lookback.contains("as_u16() <=")
|
||||
|| lookback.contains("as_u16() <")
|
||||
}
|
||||
|
||||
/// The scan shared by the gate and the mutation regression: every raw parse
|
||||
/// site in `text` is classified as an after-the-parse bypass (`offenders`) or a
|
||||
/// parse with no full status guard above it (`unguarded`). Factored out so the
|
||||
/// mutation test exercises EXACTLY the logic the gate runs, not a paraphrase of
|
||||
/// it.
|
||||
fn scan_handler(name: &str, text: &str) -> (Vec<String>, Vec<String>) {
|
||||
let mut offenders = Vec::new();
|
||||
let mut unguarded = Vec::new();
|
||||
let lines: Vec<&str> = text.lines().collect();
|
||||
for (i, line) in lines.iter().enumerate() {
|
||||
if !opens_json_parse(line) {
|
||||
continue;
|
||||
}
|
||||
// Join the parse-site line with the following lines so a split-line
|
||||
// chain's `.await` and an after-the-parse `.is_success()` are both in
|
||||
// view. Status-first probes put `.is_success()` on an EARLIER line, so
|
||||
// it is outside this window and stays green.
|
||||
let window = lines[i..(i + 6).min(lines.len())].join("\n");
|
||||
if window_is_bypass(&window) {
|
||||
offenders.push(format!("{name}:{}", i + 1));
|
||||
continue;
|
||||
}
|
||||
// A parse that never resolves is not a read; only a completed parse
|
||||
// can render a denial body as a result.
|
||||
if !window.contains(".await") {
|
||||
continue;
|
||||
}
|
||||
let lookback = lines[i.saturating_sub(STATUS_LOOKBACK)..i].join("\n");
|
||||
if !has_full_status_guard_above(&lookback) {
|
||||
unguarded.push(format!("{name}:{}", i + 1));
|
||||
}
|
||||
}
|
||||
(offenders, unguarded)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn converted_handlers_never_parse_before_status() {
|
||||
let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
|
||||
let handlers = scanned_handlers(&src);
|
||||
|
||||
// Deriving the set is the whole point of the fix; if the tree ever stops
|
||||
// using `read_json` the gate would silently pass on an empty set.
|
||||
assert!(
|
||||
!handlers.is_empty(),
|
||||
"derived no converted handlers from src/*.rs read_json usage — the gate \
|
||||
would vacuously pass; check the derivation"
|
||||
);
|
||||
|
||||
// The pin is the authoritative required set: the derived `read_json` surface
|
||||
// must EQUAL it, failing closed in both directions. A pinned file that drops
|
||||
// out was reverted off `read_json` (register.rs, its single call, is the
|
||||
// motivating case) and its bypass would escape the derived scan. A derived
|
||||
// file that is not pinned is a conversion nobody enrolled, so ITS later revert
|
||||
// would escape the same way; force it into the pin now. Equality is what
|
||||
// extends the protection to handlers converted after #186.
|
||||
let derived: Vec<&str> = handlers.iter().map(|(n, _)| n.as_str()).collect();
|
||||
let deconverted: Vec<&str> = CONVERTED_IN_186
|
||||
.iter()
|
||||
.copied()
|
||||
.filter(|f| !derived.contains(f))
|
||||
.collect();
|
||||
assert!(
|
||||
deconverted.is_empty(),
|
||||
"pinned handler(s) no longer route node responses through read_json: a \
|
||||
parse-before-status revert would otherwise escape the derived scan. \
|
||||
Re-route through crate::http::read_json (or drop from CONVERTED_IN_186 if \
|
||||
the surface was intentionally deconverted): {deconverted:?}"
|
||||
);
|
||||
let unpinned: Vec<&str> = derived
|
||||
.iter()
|
||||
.copied()
|
||||
.filter(|f| !CONVERTED_IN_186.contains(f))
|
||||
.collect();
|
||||
assert!(
|
||||
unpinned.is_empty(),
|
||||
"handler(s) use read_json but are absent from CONVERTED_IN_186: add them so \
|
||||
the gate protects them against a later parse-before-status revert (an \
|
||||
unpinned conversion drops out of both the scan and this check when \
|
||||
reverted): {unpinned:?}"
|
||||
);
|
||||
|
||||
let mut offenders = Vec::new();
|
||||
let mut unguarded = Vec::new();
|
||||
for (name, text) in &handlers {
|
||||
let (o, u) = scan_handler(name, text);
|
||||
offenders.extend(o);
|
||||
unguarded.extend(u);
|
||||
}
|
||||
|
||||
assert!(
|
||||
offenders.is_empty(),
|
||||
"parse-before-status bypass present in converted handler(s) — route the read \
|
||||
through crate::http::read_json (status-first, capped, sanitized): {offenders:?}"
|
||||
);
|
||||
assert!(
|
||||
unguarded.is_empty(),
|
||||
"node response parsed with NO full status guard above it in a converted \
|
||||
handler — the denial body is being rendered as a result. Route the read \
|
||||
through crate::http::read_json (status-first, capped, sanitized): {unguarded:?}"
|
||||
);
|
||||
}
|
||||
|
||||
/// Mutation regression for the special-404 escape: agent.rs (and the agent-show
|
||||
/// / repo-info paths shaped like it) keeps a legitimate 404-only hint ahead of
|
||||
/// its `read_json` call. Revert that call to a raw `resp.json().await?` and the
|
||||
/// 404 equality is the only status evidence in the lookback — under the old
|
||||
/// "any `.status()` nearby" rule the fence stayed green while a 500's denial
|
||||
/// body rendered as an empty agent list. This test performs that exact revert
|
||||
/// on the REAL agent.rs source and requires the scan to flag the mutant, so the
|
||||
/// full-guard distinction in `has_full_status_guard_above` cannot regress to a
|
||||
/// mere proximity check without going red here.
|
||||
#[test]
|
||||
fn special_404_hint_is_not_a_guard() {
|
||||
let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
|
||||
let text = std::fs::read_to_string(src.join("agent.rs")).expect("read agent.rs");
|
||||
|
||||
// The mutation must stay real: it requires the idiom it reverts. If
|
||||
// agent.rs drops the 404 hint or the read_json call, this needs re-basing
|
||||
// on whichever handler carries the special-404 idiom then.
|
||||
assert!(
|
||||
text.contains("StatusCode::NOT_FOUND"),
|
||||
"agent.rs no longer carries the special-404 hint this mutation reverts; \
|
||||
re-anchor the mutation on the handler that does"
|
||||
);
|
||||
let lines: Vec<&str> = text.lines().collect();
|
||||
let not_found_line = lines
|
||||
.iter()
|
||||
.position(|l| l.contains("StatusCode::NOT_FOUND"))
|
||||
.unwrap();
|
||||
let read_json_line = lines[not_found_line..]
|
||||
.iter()
|
||||
.position(|l| l.contains("read_json"))
|
||||
.map(|off| not_found_line + off)
|
||||
.expect(
|
||||
"agent.rs has no read_json call after its 404 hint; re-anchor the \
|
||||
mutation on the handler that carries the idiom",
|
||||
);
|
||||
|
||||
// The revert under test: the guarded helper call becomes a raw parse.
|
||||
let mut mutant: Vec<String> = lines.iter().map(|l| l.to_string()).collect();
|
||||
mutant[read_json_line] = " let body: serde_json::Value = resp.json().await?;".to_string();
|
||||
let mutant = mutant.join("\n");
|
||||
|
||||
let (_, unguarded) = scan_handler("agent.rs[mutant]", &mutant);
|
||||
assert!(
|
||||
unguarded
|
||||
.iter()
|
||||
.any(|hit| hit.starts_with("agent.rs[mutant]:")),
|
||||
"the special-404 revert was not flagged: a 404-only equality upstream is \
|
||||
being accepted as a full status guard, which reopens the escape this \
|
||||
mutation pins (expected an unguarded hit, got {unguarded:?})"
|
||||
);
|
||||
|
||||
// Positive control: the unmutated file must stay green, or the fence is
|
||||
// flagging the legitimate hint rather than the revert.
|
||||
let (offenders, unguarded) = scan_handler("agent.rs", &text);
|
||||
assert!(
|
||||
offenders.is_empty() && unguarded.is_empty(),
|
||||
"unmutated agent.rs trips the fence; the guard classifier is wrong, not \
|
||||
the handler: offenders={offenders:?} unguarded={unguarded:?}"
|
||||
);
|
||||
}
|
||||
@@ -355,13 +355,7 @@ fn submit_answer(
|
||||
/// Returns `None` when stdin isn't a usable interactive source (e.g. an agent),
|
||||
/// so the caller surfaces a clear "couldn't auto-solve" error instead.
|
||||
fn interactive_prompt(challenge: &Challenge) -> Option<String> {
|
||||
use std::io::{stderr, stdin, IsTerminal, Write};
|
||||
// An open but silent stdin (a pipe an orchestrator holds open, an agent
|
||||
// harness) has no one to answer: `read_line` would block forever. Only a
|
||||
// terminal can be interactive.
|
||||
if !stdin().is_terminal() {
|
||||
return None;
|
||||
}
|
||||
use std::io::{stderr, stdin, Write};
|
||||
let mut err = stderr();
|
||||
let _ = writeln!(
|
||||
err,
|
||||
@@ -767,68 +761,4 @@ mod tests {
|
||||
);
|
||||
assert_eq!(non_empty.api_key.as_deref(), Some("secret-bearer"));
|
||||
}
|
||||
|
||||
/// #345: an open-but-silent non-TTY stdin must not hang the prompt. The
|
||||
/// child runs `interactive_prompt` with a held-open, empty pipe as stdin:
|
||||
/// without the terminal check `read_line` blocks forever; with it the
|
||||
/// child returns `None` and exits.
|
||||
#[test]
|
||||
fn interactive_prompt_skips_open_silent_pipe() {
|
||||
const CHILD_ENV: &str = "ICAPTCHA_PROMPT_PIPE_CHILD";
|
||||
if std::env::var_os(CHILD_ENV).is_some() {
|
||||
let ch = Challenge {
|
||||
challenge_id: "c".into(),
|
||||
kind: "arithmetic".into(),
|
||||
difficulty: 1,
|
||||
prompt: "What is 1 + 1?".into(),
|
||||
token: "t".into(),
|
||||
pow: None,
|
||||
};
|
||||
assert!(interactive_prompt(&ch).is_none());
|
||||
println!("prompt-skipped");
|
||||
return;
|
||||
}
|
||||
let exe = std::env::current_exe().expect("current test binary");
|
||||
let mut child = std::process::Command::new(exe)
|
||||
.args([
|
||||
"--exact",
|
||||
"tests::interactive_prompt_skips_open_silent_pipe",
|
||||
"--nocapture",
|
||||
])
|
||||
.env(CHILD_ENV, "1")
|
||||
.stdin(std::process::Stdio::piped())
|
||||
.stdout(std::process::Stdio::piped())
|
||||
.stderr(std::process::Stdio::null())
|
||||
.spawn()
|
||||
.expect("spawn child test");
|
||||
// The parent keeps the write end open with no data, which is exactly
|
||||
// the shape that hung: an open, silent, non-terminal stdin.
|
||||
let _held_stdin = child.stdin.take();
|
||||
let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
|
||||
loop {
|
||||
match child.try_wait().expect("poll child") {
|
||||
Some(status) => {
|
||||
assert!(status.success(), "child exited with {status}");
|
||||
let mut out = String::new();
|
||||
std::io::Read::read_to_string(
|
||||
&mut child.stdout.take().expect("child stdout"),
|
||||
&mut out,
|
||||
)
|
||||
.expect("read child stdout");
|
||||
assert!(
|
||||
out.contains("prompt-skipped"),
|
||||
"child test body did not run: {out}"
|
||||
);
|
||||
return;
|
||||
}
|
||||
None if std::time::Instant::now() < deadline => {
|
||||
std::thread::sleep(std::time::Duration::from_millis(50));
|
||||
}
|
||||
None => {
|
||||
let _ = child.kill();
|
||||
panic!("interactive_prompt blocked on an open, silent non-TTY stdin");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -30,8 +30,8 @@ fn solve_arithmetic(prompt: &str) -> Option<i64> {
|
||||
while let Some(op) = tokens.next() {
|
||||
let n: i64 = tokens.next()?.parse().ok()?;
|
||||
match op {
|
||||
"+" => acc = acc.checked_add(n)?,
|
||||
"-" => acc = acc.checked_sub(n)?,
|
||||
"+" => acc += n,
|
||||
"-" => acc -= n,
|
||||
_ => return None,
|
||||
}
|
||||
}
|
||||
@@ -45,15 +45,15 @@ fn solve_algebra(prompt: &str) -> Option<i64> {
|
||||
let (lhs, rhs) = eq.split_once('=')?;
|
||||
let (al, cl) = parse_linear(lhs.trim())?;
|
||||
let (ar, cr) = parse_linear(rhs.trim())?;
|
||||
let denom = al.checked_sub(ar)?;
|
||||
let denom = al - ar;
|
||||
if denom == 0 {
|
||||
return None;
|
||||
}
|
||||
let num = cr.checked_sub(cl)?;
|
||||
if num.checked_rem(denom)? != 0 {
|
||||
let num = cr - cl;
|
||||
if num % denom != 0 {
|
||||
return None;
|
||||
}
|
||||
num.checked_div(denom)
|
||||
Some(num / denom)
|
||||
}
|
||||
|
||||
/// Parse a linear expression in `x` into `(coeff_of_x, constant)`.
|
||||
@@ -76,12 +76,12 @@ fn parse_linear(s: &str) -> Option<(i64, i64)> {
|
||||
let m: i64 = it.next()?.parse().ok()?;
|
||||
match op {
|
||||
"+" => (1, m),
|
||||
"-" => (1, m.checked_neg()?),
|
||||
"-" => (1, -m),
|
||||
_ => return None,
|
||||
}
|
||||
}
|
||||
};
|
||||
return Some((a.checked_mul(coeff_inner)?, a.checked_mul(const_inner)?));
|
||||
return Some((a * coeff_inner, a * const_inner));
|
||||
}
|
||||
|
||||
// Sum of `±`-separated terms.
|
||||
@@ -99,10 +99,10 @@ fn parse_linear(s: &str) -> Option<(i64, i64)> {
|
||||
"-" => -1,
|
||||
_ => cpart.parse().ok()?,
|
||||
};
|
||||
coeff = coeff.checked_add(sign.checked_mul(c)?)?;
|
||||
coeff += sign * c;
|
||||
} else {
|
||||
let n: i64 = t.parse().ok()?;
|
||||
konst = konst.checked_add(sign.checked_mul(n)?)?;
|
||||
konst += sign * n;
|
||||
}
|
||||
sign = 1;
|
||||
}
|
||||
@@ -127,26 +127,23 @@ fn solve_sequence(prompt: &str) -> Option<i64> {
|
||||
fn next_in_sequence(n: &[i64]) -> Option<i64> {
|
||||
let last = *n.last()?;
|
||||
|
||||
// Arithmetic: constant first difference. An overflowing difference means
|
||||
// the pattern doesn't fit, not that the answer wraps.
|
||||
if let Some(d) = n[1].checked_sub(n[0]) {
|
||||
if n.windows(2).all(|w| w[1].checked_sub(w[0]) == Some(d)) {
|
||||
return last.checked_add(d);
|
||||
}
|
||||
// Arithmetic: constant first difference.
|
||||
let d = n[1] - n[0];
|
||||
if n.windows(2).all(|w| w[1] - w[0] == d) {
|
||||
return Some(last + d);
|
||||
}
|
||||
|
||||
// Geometric: constant integer ratio.
|
||||
if n.iter().all(|&v| v != 0) && n[1].checked_rem(n[0]) == Some(0) {
|
||||
if let Some(r) = n[1].checked_div(n[0]) {
|
||||
if r != 0 && n.windows(2).all(|w| w[0].checked_mul(r) == Some(w[1])) {
|
||||
return last.checked_mul(r);
|
||||
}
|
||||
if n.iter().all(|&v| v != 0) && n[0] != 0 && n[1] % n[0] == 0 {
|
||||
let r = n[1] / n[0];
|
||||
if r != 0 && n.windows(2).all(|w| w[1] == w[0] * r) {
|
||||
return Some(last * r);
|
||||
}
|
||||
}
|
||||
|
||||
// Fibonacci-like: each term is the sum of the two before it.
|
||||
if n.len() >= 3 && (2..n.len()).all(|i| n[i - 1].checked_add(n[i - 2]) == Some(n[i])) {
|
||||
return n[n.len() - 1].checked_add(n[n.len() - 2]);
|
||||
if n.len() >= 3 && (2..n.len()).all(|i| n[i] == n[i - 1] + n[i - 2]) {
|
||||
return Some(n[n.len() - 1] + n[n.len() - 2]);
|
||||
}
|
||||
|
||||
// Squares: all perfect squares with consecutive roots.
|
||||
@@ -154,7 +151,7 @@ fn next_in_sequence(n: &[i64]) -> Option<i64> {
|
||||
if let Some(roots) = roots {
|
||||
if roots.windows(2).all(|w| w[1] == w[0] + 1) {
|
||||
let nr = roots[roots.len() - 1] + 1;
|
||||
return nr.checked_mul(nr);
|
||||
return Some(nr * nr);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -163,16 +160,12 @@ fn next_in_sequence(n: &[i64]) -> Option<i64> {
|
||||
.iter()
|
||||
.enumerate()
|
||||
.all(|(i, &v)| if i % 2 == 0 { v >= 0 } else { v < 0 });
|
||||
let mags: Option<Vec<i64>> = n.iter().map(|v| v.checked_abs()).collect();
|
||||
if signs_alternate {
|
||||
if let Some(mags) = mags {
|
||||
if let Some(md) = mags[1].checked_sub(mags[0]) {
|
||||
if mags.windows(2).all(|w| w[1].checked_sub(w[0]) == Some(md)) {
|
||||
let next_sign: i64 = if last >= 0 { -1 } else { 1 };
|
||||
return next_sign.checked_mul(mags[mags.len() - 1].checked_add(md)?);
|
||||
}
|
||||
}
|
||||
}
|
||||
let mags: Vec<i64> = n.iter().map(|v| v.abs()).collect();
|
||||
let md = mags[1] - mags[0];
|
||||
if signs_alternate && mags.windows(2).all(|w| w[1] - w[0] == md) {
|
||||
let next_mag = mags[mags.len() - 1] + md;
|
||||
let next_sign = if last >= 0 { -1 } else { 1 };
|
||||
return Some(next_sign * next_mag);
|
||||
}
|
||||
|
||||
None
|
||||
@@ -186,7 +179,7 @@ fn isqrt_exact(v: i64) -> Option<i64> {
|
||||
let r = (v as f64).sqrt().round() as i64;
|
||||
[r - 1, r, r + 1]
|
||||
.into_iter()
|
||||
.find(|&cand| cand >= 0 && cand.checked_mul(cand) == Some(v))
|
||||
.find(|&cand| cand >= 0 && cand * cand == v)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
@@ -274,80 +267,4 @@ mod tests {
|
||||
assert_eq!(solve("anagram", "Unscramble: tca"), None);
|
||||
assert_eq!(solve("riddle", "What has keys but no locks?"), None);
|
||||
}
|
||||
|
||||
// #345: prompts are attacker/service-controlled and every literal can be a
|
||||
// valid i64 while the evaluation still overflows. Overflow must return
|
||||
// None (unsolvable), never a debug panic or a wrapped wrong answer.
|
||||
|
||||
#[test]
|
||||
fn arithmetic_overflow_returns_none() {
|
||||
assert_eq!(
|
||||
solve("arithmetic", "What is 9223372036854775807 + 1?"),
|
||||
None
|
||||
);
|
||||
assert_eq!(
|
||||
solve("arithmetic", "What is -9223372036854775808 - 1?"),
|
||||
None
|
||||
);
|
||||
// Boundary-adjacent values still solve.
|
||||
assert_eq!(
|
||||
solve("arithmetic", "What is 9223372036854775806 + 1?").as_deref(),
|
||||
Some("9223372036854775807")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn algebra_overflow_returns_none() {
|
||||
// num = i64::MIN, denom = -1: the quotient overflows.
|
||||
assert_eq!(
|
||||
solve("algebra", "Solve for x: x + 1 = 2x + -9223372036854775807"),
|
||||
None
|
||||
);
|
||||
// sign * coefficient overflows at i64::MIN.
|
||||
assert_eq!(
|
||||
solve("algebra", "Solve for x: x - -9223372036854775808x = 1"),
|
||||
None
|
||||
);
|
||||
// A large but solvable equation still solves.
|
||||
assert_eq!(
|
||||
solve("algebra", "Solve for x: 4611686018427387904x + 0 = 0").as_deref(),
|
||||
Some("0")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sequence_overflow_returns_none() {
|
||||
// First difference overflows (1 - i64::MIN).
|
||||
assert_eq!(
|
||||
solve(
|
||||
"sequence",
|
||||
"What is the next number in this sequence? -9223372036854775808, 1, 9223372036854775806, ?"
|
||||
),
|
||||
None
|
||||
);
|
||||
// i64::MIN in an alternating-sign candidate: abs() overflows.
|
||||
assert_eq!(
|
||||
solve(
|
||||
"sequence",
|
||||
"What is the next number in this sequence? 1, -9223372036854775808, 3, ?"
|
||||
),
|
||||
None
|
||||
);
|
||||
// Perfect-square check near i64::MAX: candidate root squared overflows.
|
||||
assert_eq!(
|
||||
solve(
|
||||
"sequence",
|
||||
"What is the next number in this sequence? 9223372036854775807, 9223372036854775800, 9223372036854775801, ?"
|
||||
),
|
||||
None
|
||||
);
|
||||
// Geometric next term overflows (r = 2, last * 2 > i64::MAX).
|
||||
assert_eq!(
|
||||
solve(
|
||||
"sequence",
|
||||
"What is the next number in this sequence? 2305843009213693951, 4611686018427387902, 9223372036854775804, ?"
|
||||
),
|
||||
None
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,134 +0,0 @@
|
||||
//! #345 end-to-end: `obtain_proof` must not block or crash when stdin is an
|
||||
//! open, silent non-TTY and the challenge can't be solved deterministically.
|
||||
//!
|
||||
//! The unit seam can't fake a process stdin, so the parent spawns this test
|
||||
//! binary with a held-open pipe as stdin and the child runs the real
|
||||
//! `obtain_proof` against a mocked iCaptcha service over HTTP. Before the fix
|
||||
//! the child blocked in `read_line` forever (unsolvable type) or panicked /
|
||||
//! submitted a wrapped answer (overflowing arithmetic). After the fix it
|
||||
//! exits promptly with the "cannot solve" error.
|
||||
|
||||
use std::process::{Command, Stdio};
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use icaptcha_client::{obtain_proof, IcaptchaCfg};
|
||||
|
||||
const CHILD_ENV: &str = "ICAPTCHA_STDIN_E2E_CHILD";
|
||||
const URL_ENV: &str = "ICAPTCHA_STDIN_E2E_URL";
|
||||
const CHILD_TIMEOUT: Duration = Duration::from_secs(15);
|
||||
|
||||
/// Child entry point: fetch the challenge from the mock service and run the
|
||||
/// full solve loop. Both scenarios must reach the same clean error.
|
||||
fn run_child() {
|
||||
let url = std::env::var(URL_ENV).expect("child needs the mock url");
|
||||
let cfg = IcaptchaCfg {
|
||||
url,
|
||||
did: "did:key:zTEST".to_string(),
|
||||
level: 1,
|
||||
api_key: None,
|
||||
};
|
||||
let err = obtain_proof(&cfg, None).expect_err("the challenge is unsolvable");
|
||||
assert!(
|
||||
err.to_string().contains("cannot solve iCaptcha challenge"),
|
||||
"expected the unsolvable-challenge error, got: {err}"
|
||||
);
|
||||
println!("child-finished-cleanly");
|
||||
}
|
||||
|
||||
/// Spawn the child with a held-open, empty pipe as stdin, wait with a
|
||||
/// deadline, and assert it printed the clean-exit marker.
|
||||
fn run_scenario(prompt_type: &str, prompt: &str, expect_answer_calls: usize) {
|
||||
let mut server = mockito::Server::new();
|
||||
let challenge = server
|
||||
.mock("POST", "/v1/challenge")
|
||||
.with_status(200)
|
||||
.with_header("content-type", "application/json")
|
||||
.with_body(format!(
|
||||
r#"{{"challengeId":"c1","type":"{prompt_type}","difficulty":1,"prompt":"{prompt}","token":"tok-1"}}"#
|
||||
))
|
||||
.expect(1)
|
||||
.create();
|
||||
// No answer may be submitted: an unsolvable prompt must produce no
|
||||
// request to /v1/answer (a wrapped wrong answer would still hit it).
|
||||
let answer = server
|
||||
.mock("POST", "/v1/answer")
|
||||
.expect(expect_answer_calls)
|
||||
.create();
|
||||
|
||||
let exe = std::env::current_exe().expect("current test binary");
|
||||
let mut cmd = Command::new(exe);
|
||||
cmd.args([
|
||||
"--exact",
|
||||
"obtain_proof_does_not_block_on_silent_non_tty_stdin",
|
||||
"--nocapture",
|
||||
])
|
||||
.env(CHILD_ENV, "1")
|
||||
.env(URL_ENV, server.url())
|
||||
.stdin(Stdio::piped())
|
||||
.stdout(Stdio::piped())
|
||||
.stderr(Stdio::piped());
|
||||
// The solver client honors proxy env; force direct connections so the
|
||||
// loopback mock is always reachable regardless of the runner's env.
|
||||
for var in [
|
||||
"HTTP_PROXY",
|
||||
"http_proxy",
|
||||
"HTTPS_PROXY",
|
||||
"https_proxy",
|
||||
"ALL_PROXY",
|
||||
"all_proxy",
|
||||
"REQUEST_METHOD",
|
||||
] {
|
||||
cmd.env_remove(var);
|
||||
}
|
||||
cmd.env("NO_PROXY", "*");
|
||||
let mut child = cmd.spawn().expect("spawn child");
|
||||
|
||||
// Hold the write end open with no data: exactly the shape that hung.
|
||||
let _held_stdin = child.stdin.take();
|
||||
|
||||
let deadline = Instant::now() + CHILD_TIMEOUT;
|
||||
loop {
|
||||
match child.try_wait().expect("poll child") {
|
||||
Some(_) => break,
|
||||
None if Instant::now() < deadline => std::thread::sleep(Duration::from_millis(50)),
|
||||
None => {
|
||||
let _ = child.kill();
|
||||
panic!("obtain_proof blocked on an open, silent non-TTY stdin");
|
||||
}
|
||||
}
|
||||
}
|
||||
let out = child.wait_with_output().expect("collect child output");
|
||||
let stdout = String::from_utf8_lossy(&out.stdout);
|
||||
let stderr = String::from_utf8_lossy(&out.stderr);
|
||||
assert!(
|
||||
out.status.success(),
|
||||
"child failed: status {:?}\nstdout: {stdout}\nstderr: {stderr}",
|
||||
out.status.code()
|
||||
);
|
||||
assert!(
|
||||
stdout.contains("child-finished-cleanly"),
|
||||
"child body did not run to completion: {stdout}"
|
||||
);
|
||||
assert!(
|
||||
!stderr.contains("panicked"),
|
||||
"child panicked instead of returning a clean error: {stderr}"
|
||||
);
|
||||
challenge.assert();
|
||||
answer.assert();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn obtain_proof_does_not_block_on_silent_non_tty_stdin() {
|
||||
if std::env::var_os(CHILD_ENV).is_some() {
|
||||
run_child();
|
||||
return;
|
||||
}
|
||||
|
||||
// An unsolvable challenge type falls through to the interactive prompt,
|
||||
// which must decline the non-TTY stdin instead of blocking on read_line.
|
||||
run_scenario("anagram", "listen", 0);
|
||||
|
||||
// An arithmetic prompt whose evaluation overflows i64 must also end at
|
||||
// the unsolvable error: no panic, and no wrapped answer submitted.
|
||||
run_scenario("arithmetic", "What is 9223372036854775807 + 1?", 0);
|
||||
}
|
||||
@@ -41,7 +41,7 @@ Owner focus: protocol/auth.
|
||||
- Close default-open repo write authorization and wire trusted UCAN delegation into repository permissions.
|
||||
- Close the remaining visibility gaps: restrict or document task, pin, and anchor metadata routes, and publish an irreversible-publication policy.
|
||||
- Add UCAN revocation or blocklisting, with an emergency compromised-key runbook.
|
||||
- GraphQL mutations require a verified signer (shipped, #87). Keep the surface limited to the agent-task queue; do not expose an owner-gated repo-write mutation over GraphQL without its owner-gate and REST parity. The `every_graphql_mutation_has_its_gate` fence forces any new mutation to be classified in its table (discovered from the schema SDL, with an introspection cross-check for hidden fields, so none can slip in unlisted) and requires `require_signer` plus actor binding in each registered resolver; the owner-gate and REST parity themselves stay the INV-1 review check, not something the fence proves.
|
||||
- Add mutation-aware GraphQL auth before GraphQL becomes a public write API surface.
|
||||
- Harden peer registration and outbound peer calls against SSRF and peer-list poisoning.
|
||||
- After all live peers upgrade, enable signed peer writes by default.
|
||||
|
||||
|
||||
@@ -95,7 +95,7 @@ Live-network blockers to prioritize:
|
||||
- GraphQL POST is still open for compatibility; GraphQL mutations should get mutation-aware auth before it becomes a public write API surface.
|
||||
- Push authorization is still not capability-complete. A valid DID signature is authentication, not authorization. Owner checks are now enforced on every branch, protected or not (`GITLAWB_ENFORCE_OWNER_PUSH`, on by default); what remains is that a UCAN `git/push` capability is not yet honored, so a delegated or CI key cannot push.
|
||||
- UCAN chain validation is incomplete and UCAN revocation/blocklisting is not implemented as an operator feature.
|
||||
- Private repository reads are enforced per repository through `is_public` and path-scoped visibility rules. `GITLAWB_PUBLIC_READ` remains reserved and inert.
|
||||
- Private repository reads are not enforced. `is_public` and `GITLAWB_PUBLIC_READ` exist, but per-repository private-read behavior is not wired.
|
||||
- Peer URLs are self-asserted by DIDs. Signatures prove control of the DID key when present, not ownership/safety of the announced URL.
|
||||
- Outbound peer fetch/ping/sync paths should be reviewed for SSRF protections before accepting arbitrary public peer registrations.
|
||||
|
||||
@@ -146,16 +146,8 @@ Risks:
|
||||
## Obvious live-network priorities
|
||||
|
||||
1. Implement repo write authorization: owner checks, UCAN capability checks, and clear delegation semantics for push/PR/issue/bounty operations.
|
||||
2. Private reads are already enforced per repository (`is_public` plus path-scoped rules); retire the reserved and inert `GITLAWB_PUBLIC_READ` flag or document it as permanently reserved.
|
||||
2. Implement private-read enforcement or remove private repo affordances until it exists.
|
||||
3. Add UCAN revocation/blocklisting and operator docs for emergency key compromise.
|
||||
4. Harden peer registration and outbound fetch behavior against SSRF and peer-list poisoning.
|
||||
5. Add Docker/installer/release smoke tests to CI.
|
||||
6. Label PoS/economics docs consistently with the current live contract and rewards status.
|
||||
|
||||
## Status updates (post-snapshot)
|
||||
|
||||
These entries record security-posture changes after the 2026-05-28 inspection above. They do not rewrite that snapshot's command output or test counts.
|
||||
|
||||
### 2026-08-30: GraphQL mutation auth and completeness fence (#87, #219)
|
||||
|
||||
At `main` from `bfc44f92` onward, GraphQL mutations require a verified signer bound to the acting DID. The surface stays limited to the agent-task queue; repo writes are not exposed over GraphQL. PR #219 adds `every_graphql_mutation_has_its_gate`, a CI completeness fence that discovers mutations from the built schema SDL (with an introspection cross-check for hidden fields) and requires signer acquisition plus actor binding in each registered resolver.
|
||||
@@ -1,33 +0,0 @@
|
||||
import { createData, EthereumSigner } from "arbundles";
|
||||
import { createHash } from "node:crypto";
|
||||
import base64url from "base64url";
|
||||
|
||||
const data = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{};':\",./<>?`~";
|
||||
const tags = [
|
||||
{ name: "tag1", value: "value1" },
|
||||
{ name: "tag2", value: "value2" },
|
||||
];
|
||||
const anchor = "thisSentenceIs32BytesLongTrustMe";
|
||||
const target = "OXcT1sVRSA5eGwt2k6Yuz8-3e3g9WJi5uSE99CWqsBs";
|
||||
const signer = new EthereumSigner("8da4ef21b864d2cc526dbdb2a120bd2874c36c9d0a1fb7f8c63d7f7a8b41de8f");
|
||||
|
||||
const item = createData(data, signer, { anchor, target, tags });
|
||||
// Sign so the captured signature is real: `createData` alone leaves a
|
||||
// zeroed placeholder, whose id is just sha256(zeros).
|
||||
await item.sign(signer);
|
||||
const raw = item.getRaw();
|
||||
const id = item.id;
|
||||
|
||||
// `item.signature` is base64url(rawSignature). Decode and sha256.
|
||||
const sigBytes = base64url.toBuffer(item.signature);
|
||||
const idCheck = base64url.encode(createHash("sha256").update(sigBytes).digest());
|
||||
if (idCheck !== id) {
|
||||
console.error(`MISMATCH: id=${id} sha256(sig)=${idCheck}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.log("id =", id);
|
||||
console.log("signature_b64=", item.signature);
|
||||
console.log("signature_len=", sigBytes.length);
|
||||
console.log("binary_len =", raw.length);
|
||||
console.log("binary_hex =", raw.toString("hex"));
|
||||
@@ -1,40 +0,0 @@
|
||||
import { createData, SolanaSigner } from "arbundles";
|
||||
import bs58 from "bs58";
|
||||
import { getPublicKey } from "@noble/ed25519";
|
||||
import { createHash } from "node:crypto";
|
||||
import base64url from "base64url";
|
||||
|
||||
// Deterministic Ed25519 keypair from seed 0x01 * 32.
|
||||
const seed = Buffer.alloc(32, 0x01);
|
||||
const pub = await getPublicKey(seed);
|
||||
const secret64 = Buffer.concat([seed, Buffer.from(pub)]);
|
||||
const signer = new SolanaSigner(bs58.encode(secret64));
|
||||
|
||||
const data = "hello gitlawb ed25519 golden";
|
||||
const tags = [
|
||||
{ name: "App-Name", value: "gitlawb" },
|
||||
{ name: "Schema", value: "gitlawb/ref-update/v1" },
|
||||
];
|
||||
|
||||
const item = createData(data, signer, { tags });
|
||||
await item.sign(signer);
|
||||
const raw = Buffer.from(item.getRaw());
|
||||
const id = item.id;
|
||||
const sigBytes = base64url.toBuffer(item.signature);
|
||||
const idCheck = base64url.encode(createHash("sha256").update(sigBytes).digest());
|
||||
if (idCheck !== id) {
|
||||
console.error(`MISMATCH: id=${id} sha256(sig)=${idCheck}`);
|
||||
process.exit(1);
|
||||
}
|
||||
const sigData = await item.getSignatureData();
|
||||
console.log("id =", id);
|
||||
console.log("signature_b64=", item.signature);
|
||||
console.log("signature_len=", sigBytes.length);
|
||||
console.log("owner_b64 =", item.owner);
|
||||
console.log("owner_len =", base64url.toBuffer(item.owner).length);
|
||||
console.log("sigtype =", item.signatureType);
|
||||
console.log("binary_len =", raw.length);
|
||||
console.log("binary_hex =", raw.toString("hex"));
|
||||
console.log("deephash_hex =", Buffer.from(sigData).toString("hex"));
|
||||
console.log("data_b64 =", base64url.encode(Buffer.from(data)));
|
||||
console.log("isValid =", await item.isValid());
|
||||
@@ -1,39 +0,0 @@
|
||||
ANS-104 golden vectors, captured from arbundles 0.10.x.
|
||||
|
||||
To regenerate: run `npm ci` in scripts/, then `node ans104_golden_ed25519.mjs`.
|
||||
|
||||
Ed25519 vector (the interop pin used by
|
||||
`ans104::tests::dataitem_matches_arbundles_golden_vector`):
|
||||
captured by = scripts/ans104_golden_ed25519.mjs (deterministic seed
|
||||
0x01 * 32 via SolanaSigner, sigtype 2, `await item.sign`)
|
||||
data = "hello gitlawb ed25519 golden"
|
||||
tags = [{name:"App-Name",value:"gitlawb"},
|
||||
{name:"Schema",value:"gitlawb/ref-update/v1"}]
|
||||
target = absent
|
||||
anchor = absent
|
||||
|
||||
Outputs:
|
||||
signature_type = 2 (Ed25519)
|
||||
signature_len = 64 bytes
|
||||
owner_len = 32 bytes
|
||||
binary_len = 192 bytes
|
||||
id = SGrcBs-ITTyzvd7eIB5kk2GdBWoxB_iTi9iJ6KOe_RE (base64url of sha256(signature))
|
||||
deephash_hex = f15c82431767f14ac9e66ab8e995a8cd08e094be3773245163b53c12feb50aefc55d9f8c1098fabcfbf11a462706d347
|
||||
(arbundles `getSignatureData` 8-element fold)
|
||||
|
||||
binary_hex:
|
||||
0200da41825fd44ca3b2705af18fce86ed6d04d0204331965d9af5d5cb1a740fcc6587ee81501b1d7928c54c0f174fde8893560d785db4d988a3161113b10a2028038a88e3dd7409f195fd52db2d3cba5d72ca6709bf1d94121bf3748801b40f6f5c00000200000000000000300000000000000004104170702d4e616d650e6769746c6177620c536368656d612a6769746c6177622f7265662d7570646174652f76310068656c6c6f206769746c617762206564323535313920676f6c64656e
|
||||
|
||||
The Rust side will:
|
||||
1. Parse binary via DataItem::from_binary (signature_type, signature,
|
||||
owner, target, anchor, tags, data).
|
||||
2. Compute deep_hash via DataItem::deep_hash (the 8-element arbundles
|
||||
fold) and compare to deephash_hex above.
|
||||
3. Verify the Ed25519 signature via DataItem::verify_data_item WITHOUT
|
||||
re-signing.
|
||||
4. Assert sha256(signature_bytes) base64url-encodes to the captured id.
|
||||
5. Assert to_binary round-trips byte-exact (signature slot preserved).
|
||||
|
||||
Legacy Ethereum script (scripts/ans104_golden.mjs) now signs before
|
||||
capture as well; its output is illustrative only — the node verifies
|
||||
Ed25519 (sigtype 2) on the verify path.
|
||||
Generated
-1624
File diff suppressed because it is too large.
Load diff
@@ -1,15 +0,0 @@
|
||||
{
|
||||
"name": "ans104-golden",
|
||||
"version": "0.0.0",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"dependencies": {
|
||||
"@noble/ed25519": "^1.7.5",
|
||||
"arbundles": "^0.10.0",
|
||||
"base64url": "^3.0.1",
|
||||
"bs58": "^4.0.1"
|
||||
},
|
||||
"overrides": {
|
||||
"ws": "^8.21.0"
|
||||
}
|
||||
}
|
||||
@@ -1,6 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
shopt -s extglob
|
||||
|
||||
tag="${1-}"
|
||||
: "${GITHUB_OUTPUT:?GITHUB_OUTPUT must be set}"
|
||||
@@ -12,79 +11,13 @@ case "$tag" in
|
||||
;;
|
||||
esac
|
||||
|
||||
# Right-anchored on purpose: v[0-9]* leaves the tail unbounded and accepts
|
||||
# v1.2.3.4.5, v1_x, v1-any-branch-name, and bare v1. Every existing tag is
|
||||
# plain vX.Y.Z (release-please, release-type: simple, no prerelease channel).
|
||||
case "$tag" in
|
||||
v+([0-9]).+([0-9]).+([0-9])) ;;
|
||||
v[0-9]*) ;;
|
||||
*)
|
||||
printf '%s\n' "::error::'$tag' does not look like a release tag (vX.Y.Z)"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Provenance, enforced only in CI where a token is present. The environment
|
||||
# gate restricts which REF a dispatch may run from; this restricts which TAG
|
||||
# the input may name: it must be a tag the release flow already published,
|
||||
# pointing at a commit main already contains. Otherwise a write-access user
|
||||
# could plant a v99.99.99 tag on unreviewed content and backfill-publish it.
|
||||
if [ -n "${GH_TOKEN:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
|
||||
release_meta="$(gh release view "$tag" --repo "$GITHUB_REPOSITORY" \
|
||||
--json author,targetCommitish -q '.author.login + " " + .targetCommitish' \
|
||||
2>/dev/null)" || {
|
||||
printf '%s\n' "::error::no GitHub release exists for tag $tag"
|
||||
exit 1
|
||||
}
|
||||
release_author="${release_meta%% *}"
|
||||
release_target="${release_meta##* }"
|
||||
# A hand-created release on a valid tag does not qualify. Not a hard bound
|
||||
# (a workflow run can mint a bot-authored release), but it removes the
|
||||
# cheapest path to publishing attacker-uploaded release assets.
|
||||
if [ "$release_author" != "github-actions[bot]" ]; then
|
||||
printf '%s\n' "::error::release $tag was authored by $release_author, not the release automation"
|
||||
exit 1
|
||||
fi
|
||||
# Same boundary for the assets the npm backfill republishes: a release
|
||||
# asset replaced by a collaborator login is attacker-mutable content. The
|
||||
# captured name/id pairs go to GITHUB_OUTPUT so the download step fetches
|
||||
# by immutable asset id; a delete+reupload between here and the download
|
||||
# produces a new id and fails closed. Names are emitted base64-encoded:
|
||||
# an asset name is attacker-controlled text, and whitespace in it would
|
||||
# otherwise let a crafted name shift the positional fields.
|
||||
assets="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$tag" \
|
||||
-q '.assets[] | (.name | @base64) + " " + (.id | tostring) + " " + (.uploader.login // "unknown")')"
|
||||
uploaders="$(printf '%s\n' "$assets" | awk 'NF {print $3}' | sort -u)"
|
||||
if [ -n "$uploaders" ] && [ "$uploaders" != "github-actions[bot]" ]; then
|
||||
printf '%s\n' "::error::release $tag has assets not uploaded by the release automation: $uploaders"
|
||||
exit 1
|
||||
fi
|
||||
{
|
||||
printf '%s\n' 'assets<<GHAE'
|
||||
printf '%s\n' "$assets" | awk 'NF {print $1, $2}'
|
||||
printf '%s\n' 'GHAE'
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
# Resolve through the fully-qualified tag ref to a commit SHA: an
|
||||
# unqualified name can resolve to a same-named branch and vouch for the
|
||||
# wrong commit, the same shadowing the refs/tags/ checkout prefix avoids.
|
||||
# The SHA is emitted so checkouts pin the verified commit instead of
|
||||
# re-resolving a tag that could be moved between resolve and checkout.
|
||||
tag_commit="$(gh api "repos/$GITHUB_REPOSITORY/commits/refs/tags/$tag" -q .sha)"
|
||||
# The tag must still point at the commit the release was created against.
|
||||
# Reachable-from-main alone accepts a tag moved to any other main commit.
|
||||
if [ "$tag_commit" != "$release_target" ]; then
|
||||
printf '%s\n' "::error::tag $tag points at $tag_commit but release $tag was created against $release_target (tag moved)"
|
||||
exit 1
|
||||
fi
|
||||
status="$(gh api "repos/$GITHUB_REPOSITORY/compare/main...$tag_commit" -q .status)"
|
||||
case "$status" in
|
||||
identical|behind) ;;
|
||||
*)
|
||||
printf '%s\n' "::error::tag $tag is not reachable from main (compare: $status)"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
printf '%s\n' "tag_commit=$tag_commit" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
printf '%s\n' "tag=$tag" >> "$GITHUB_OUTPUT"
|
||||
printf '%s\n' "version=${tag#v}" >> "$GITHUB_OUTPUT"
|
||||
@@ -1,297 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
// Case matrix for the inline-test detector embedded in
|
||||
// .github/workflows/pr-triage.yml. The workflow runs on pull_request_target
|
||||
// and deliberately never checks out PR code, so the detector cannot be tested
|
||||
// where it runs; this script extracts the fenced TRIAGE_DETECTOR block from
|
||||
// the committed workflow body and exercises it here, where pr-checks.yml DOES
|
||||
// check out the proposed workflow. If the fence markers move or the block
|
||||
// stops being self-contained, this script fails loudly rather than testing a
|
||||
// stale copy.
|
||||
//
|
||||
// The matrix encodes the review contract for the detector
|
||||
// (Gitlawb/node#277): legal Rust separators between the attribute path and
|
||||
// its ]/( delimiter must be accepted (line comments, nested block comments,
|
||||
// splits onto immediately following added lines), while unrelated patch
|
||||
// records - delimiter-looking lines before the path, later in the hunk, or in
|
||||
// another hunk - must never complete a path they do not adjoin. False
|
||||
// positives here SUPPRESS the needs-tests label silently (they set
|
||||
// touchedTests, which clears the label), while false negatives apply it
|
||||
// (the loud, corrigible direction). So every uncertain path in the detector
|
||||
// is required to answer "no inline test".
|
||||
|
||||
import { readFileSync } from "node:fs";
|
||||
import { dirname, join } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
|
||||
const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
|
||||
const workflow = readFileSync(
|
||||
join(repoRoot, ".github/workflows/pr-triage.yml"),
|
||||
"utf8"
|
||||
);
|
||||
|
||||
const BEGIN = "// TRIAGE_DETECTOR_BEGIN";
|
||||
const END = "// TRIAGE_DETECTOR_END";
|
||||
const begin = workflow.indexOf(BEGIN);
|
||||
const end = workflow.indexOf(END);
|
||||
if (begin === -1 || end === -1 || end <= begin) {
|
||||
console.error("FAIL: TRIAGE_DETECTOR fence not found in pr-triage.yml");
|
||||
process.exit(1);
|
||||
}
|
||||
const block = workflow.slice(begin + BEGIN.length, end);
|
||||
|
||||
let patchAddsInlineTest;
|
||||
try {
|
||||
const factory = new Function(`${block}\nreturn patchAddsInlineTest;`);
|
||||
patchAddsInlineTest = factory();
|
||||
} catch (err) {
|
||||
console.error(
|
||||
"FAIL: fenced detector block is not self-contained JavaScript:",
|
||||
err.message
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// Each patch is the `patch` field GitHub's listFiles API returns: hunk
|
||||
// headers plus +/-/space-prefixed lines, no ---/+++ file headers.
|
||||
const cases = [
|
||||
// ── Accepted spellings ────────────────────────────────────────────────
|
||||
["bare same-line", "@@ -1,0 +1,2 @@\n+#[test]\n+fn a() {}", true],
|
||||
["cfg(test)", "@@ -1,0 +1,1 @@\n+#[cfg(test)]", true],
|
||||
["indented with inner space", "@@ -1,0 +1,1 @@\n+ #[ test ]", true],
|
||||
[
|
||||
"namespaced with args",
|
||||
'@@ -1,0 +1,1 @@\n+#[tokio::test(flavor = "multi_thread")]',
|
||||
true,
|
||||
],
|
||||
["test_case harness", "@@ -1,0 +1,1 @@\n+#[test_case(1)]", true],
|
||||
["wasm_bindgen_test harness", "@@ -1,0 +1,1 @@\n+#[wasm_bindgen_test]", true],
|
||||
["raw identifier", "@@ -1,0 +1,1 @@\n+#[r#test]", true],
|
||||
[
|
||||
"line comment then closer on next added line",
|
||||
"@@ -1,0 +1,2 @@\n+#[test // rationale\n+]",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"nested block comment, same line",
|
||||
"@@ -1,0 +1,1 @@\n+#[test /* outer /* inner */ outer */]",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"block comment spanning added lines",
|
||||
"@@ -1,0 +1,3 @@\n+#[test /* why\n+ still why */ ]\n+fn a() {}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"path-only line, ( on the immediately following added line",
|
||||
"@@ -1,0 +1,2 @@\n+#[test_case\n+(1)]",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"whitespace-only continuation before closer",
|
||||
"@@ -1,0 +1,3 @@\n+#[test\n+\t\n+]",
|
||||
true,
|
||||
],
|
||||
// ── Rejected spellings and adversarial shapes ─────────────────────────
|
||||
["rstest stays excluded", "@@ -1,0 +1,1 @@\n+#[rstest]", false],
|
||||
["substring #[testable]", "@@ -1,0 +1,1 @@\n+#[testable]", false],
|
||||
["substring #[contest]", "@@ -1,0 +1,1 @@\n+#[contest]", false],
|
||||
[
|
||||
"delimiter-looking line BEFORE the path",
|
||||
"@@ -1,0 +1,2 @@\n+(\n+#[test_case",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"raw-string fixture path + unrelated ( later in the same hunk",
|
||||
'@@ -1,0 +1,5 @@\n+let s = r#"\n+#[test_case\n+not a separator token\n+"#;\n+let t = (1);',
|
||||
false,
|
||||
],
|
||||
[
|
||||
"path at end of one hunk, closer in another hunk",
|
||||
"@@ -1,0 +1,1 @@\n+#[test_case\n@@ -10,0 +11,1 @@\n+(1)]",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"closer only on a context line",
|
||||
"@@ -1,1 +1,1 @@\n+#[test_case\n (1)]",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"closer only on a removed line",
|
||||
"@@ -1,1 +1,1 @@\n+#[test_case\n-(1)]",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"unfinished block comment never closes",
|
||||
"@@ -1,0 +1,2 @@\n+#[test /*\n+ still open",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"continuation bound exceeded stays loud",
|
||||
"@@ -1,0 +1,40 @@\n+#[test /*\n" + "+ filler\n".repeat(30) + "+ */ ]",
|
||||
false,
|
||||
],
|
||||
[
|
||||
"raw-string fixture with adjoining closer",
|
||||
'@@ -1,0 +1,4 @@\n+const FIXTURE: &str = r#"\n+#[test_case\n+(1)]\n+"#;',
|
||||
false,
|
||||
],
|
||||
[
|
||||
"block comment with adjoining closer",
|
||||
'@@ -1,0 +1,4 @@\n+/* this is a comment\n+#[test_case\n+(1)]\n+end of comment */',
|
||||
false,
|
||||
],
|
||||
[
|
||||
"raw string with no hash delimiters",
|
||||
'@@ -1,0 +1,4 @@\n+let s = r"\n+#[test_case\n+(1)]\n+";',
|
||||
false,
|
||||
],
|
||||
[
|
||||
"raw string closes then real test attribute on next line",
|
||||
'@@ -1,0 +1,2 @@\n+let s = r#""#;\n+#[test_case(1)]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"block comment closes then real test attribute on next line",
|
||||
'@@ -1,0 +1,2 @@\n+/* c */\n+#[test]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"multiline regular string with test attribute inside",
|
||||
'@@ -1,0 +1,3 @@\n+const S: &str = "\n+#[test]\n+";',
|
||||
false,
|
||||
],
|
||||
[
|
||||
"regular string closes then real test on next line",
|
||||
'@@ -1,0 +1,2 @@\n+let s = "text";\n+#[test]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"char literal with double quote then real test",
|
||||
"@@ -1,0 +1,4 @@\n+const QUOTE: char = '\"';\n+#[test]\n+fn real_test() {\n+ assert_eq!(QUOTE as u32, 34);\n+}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"byte char literal with double quote then real test",
|
||||
"@@ -1,0 +1,4 @@\n+const QUOTE: u8 = b'\"';\n+#[test]\n+fn real_test() {\n+ assert_eq!(QUOTE, 34);\n+}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"char literal with escaped quote then real test",
|
||||
"@@ -1,0 +1,4 @@\n+const Q: char = '\\'';\n+#[test]\n+fn real_test() {\n+ assert_eq!(Q as u32, 39);\n+}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"char literal with escaped backslash then real test",
|
||||
"@@ -1,0 +1,4 @@\n+const Q: char = '\\\\';\n+#[test]\n+fn real_test() {\n+ assert_eq!(Q as u32, 92);\n+}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"char literal with unicode escape then real test",
|
||||
"@@ -1,0 +1,4 @@\n+const Q: char = '\\u{2764}';\n+#[test]\n+fn real_test() {\n+ assert_eq!(Q as u32, 10084);\n+}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"lifetime in type then real test",
|
||||
"@@ -1,0 +1,3 @@\n+fn foo<'a>(x: &'a str) {}\n+#[test]\n+fn real_test() {}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"label then real test",
|
||||
"@@ -1,0 +1,3 @@\n+'label: loop {}\n+#[test]\n+fn real_test() {}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"static lifetime then real test",
|
||||
"@@ -1,0 +1,3 @@\n+const S: &'static str = \"hi\";\n+#[test]\n+fn real_test() {}",
|
||||
true,
|
||||
],
|
||||
[
|
||||
"context line with stray closing quote then real test",
|
||||
'@@ -1,1 +1,2 @@\n );"\n+#[test]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"context line with stray opening quote then real test",
|
||||
'@@ -1,1 +1,2 @@\n let s = "\n+#[test]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"r# inside string on context line then real test",
|
||||
'@@ -1,1 +1,2 @@\n let s = "r#";\n+#[test]',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"/* inside string on context line then real test",
|
||||
'@@ -1,1 +1,2 @@\n let s = "/*";\n+#[test]',
|
||||
true,
|
||||
],
|
||||
// Known limitation: a non-code region opened by a context line is invisible
|
||||
// to the pre-pass (context lines are not scanned). An added #[test] inside
|
||||
// an existing raw string or block comment is scanned as code and may match.
|
||||
// This is a false positive (silent direction), accepted because the old
|
||||
// detector had the same behavior, the pattern is rare, and needs-tests is
|
||||
// advisory. Scanning context lines to close this gap would re-introduce a
|
||||
// false negative on the far more common case of a context line with a stray
|
||||
// " from a string that opened before the visible window.
|
||||
[
|
||||
"known limitation: #[test] inside context-opened raw string (FP)",
|
||||
'@@ -1,1 +1,2 @@\n const FIX: &str = r#"\n+#[test]\n "#;',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"known limitation: #[test_case] inside context-opened raw string (FP)",
|
||||
'@@ -1,1 +1,3 @@\n const FIX: &str = r#"\n+#[test_case\n+(1)]\n "#;',
|
||||
true,
|
||||
],
|
||||
[
|
||||
"known limitation: #[test] inside context-opened block comment (FP)",
|
||||
'@@ -1,1 +1,2 @@\n /*\n+#[test]\n */',
|
||||
true,
|
||||
],
|
||||
];
|
||||
|
||||
let failures = 0;
|
||||
for (const [name, patch, expected] of cases) {
|
||||
const got = patchAddsInlineTest(patch);
|
||||
if (got !== expected) {
|
||||
failures += 1;
|
||||
console.error(`FAIL: ${name}: expected ${expected}, got ${got}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Runtime probe: the detector walks fork-controlled input on
|
||||
// pull_request_target, so a pathological head must not stall the job. The
|
||||
// long `_a` run is the historical exponential-backtracking shape for the
|
||||
// attribute-path regex; the comment run exercises the scanner loop.
|
||||
const probes = [
|
||||
["long _a run", "@@ -1,0 +1,1 @@\n+#[test" + "_a".repeat(30000), false],
|
||||
[
|
||||
"long unclosed comment line",
|
||||
"@@ -1,0 +1,1 @@\n+#[test /*" + " *".repeat(30000),
|
||||
false,
|
||||
],
|
||||
[
|
||||
"long malformed \\u{ escape run (quadratic guard)",
|
||||
"@@ -1,0 +1,1 @@\n+" + "'\\u{".repeat(30000),
|
||||
false,
|
||||
],
|
||||
];
|
||||
for (const [name, patch, expected] of probes) {
|
||||
const t0 = process.hrtime.bigint();
|
||||
const got = patchAddsInlineTest(patch);
|
||||
const ms = Number(process.hrtime.bigint() - t0) / 1e6;
|
||||
if (got !== expected) {
|
||||
failures += 1;
|
||||
console.error(`FAIL: probe ${name}: expected ${expected}, got ${got}`);
|
||||
}
|
||||
if (ms > 1000) {
|
||||
failures += 1;
|
||||
console.error(`FAIL: probe ${name}: took ${ms.toFixed(0)}ms (>1000ms)`);
|
||||
}
|
||||
}
|
||||
|
||||
if (failures) {
|
||||
console.error(`${failures} failure(s) across ${cases.length + probes.length} cases`);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`ok: ${cases.length + probes.length} detector cases passed`);
|
||||
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user