Hare/wip-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(fs): bind external scopes to current execution lineage

Browse Source 
Add fail-closed Composition lifetime attestation for non-root scopes; preserve pinned deployment-root semantics and principal visibility. Fetch and dispatch bind optional published scope refs inside the refreshed backend boundary.

Validation: cargo test -p wip-fs-server (25 unit, 8 HTTP, 31 extension tests and 1 doc-test); Nix clippy for FS and public example with -D warnings; git diff --check.
This commit is contained in:
Hare
2026-10-08 03:56:17 +09:00
parent 827bef8478
commit a7186173b4
6 changed files with 619 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/wip-fs-server/tests/support/scoped.rs
+456
View File
@@ -0,0 +1,456 @@
//! External non-root scope regression coverage, sharing the memory backend.
use super::*;
struct ScopedObject {
inner: Object,
reference: Option<String>,
}
impl WipObject for ScopedObject {
fn name(&self) -> &str {
self.inner.name()
}
fn reference(&self) -> Option<&str> {
self.reference.as_deref()
}
fn validator(&self) -> Option<&Validator> {
self.inner.validator()
}
fn requires_validator(&self, _: &InterfaceRef, operation: &str) -> bool {
operation == "read"
}
}
impl FileRead for ScopedObject {
fn read(&self, offset: Option<u64>, length: Option<u64>) -> wip::OperationResult<wip::Bytes> {
FileRead::read(&self.inner, offset, length)
}
}
struct ScopedComposition {
shared: Arc<Shared>,
associations: BTreeMap<String, (Arc<Node>, Scope)>,
interfaces: Vec<RegisteredInterface<wip_fs_server::FileReadDefinition>>,
with_refs: bool,
}
impl Composition<Entry> for ScopedComposition {
type Object = ScopedObject;
fn scope(
&self,
path: &str,
entry: &Entry,
context: &ExecutionContext,
) -> Result<Option<Scope>, HostError> {
assert!(matches!(
self.shared.transaction.try_lock(),
Err(TryLockError::WouldBlock)
));
assert_eq!(path, entry.path);
self.shared.record("scope", path, context);
assert_eq!(
entry.validator,
Entry::snapshot(entry.path.clone(), entry.node.clone()).validator
);
let nodes = self.shared.nodes.lock().unwrap();
// Self-scope also requires current membership; ordinary pinned-leaf
// execution intentionally need not check its path mapping.
Ok(self.associations.get(path).and_then(|(identity, scope)| {
(Arc::ptr_eq(identity, &entry.node)
&& nodes
.get(path)
.is_some_and(|node| Arc::ptr_eq(node, identity)))
.then(|| scope.clone())
}))
}
fn publish(
&self,
entry: Entry,
context: &ExecutionContext,
) -> Result<PublishedObject<ScopedObject>, HostError> {
assert!(matches!(
self.shared.transaction.try_lock(),
Err(TryLockError::WouldBlock)
));
self.shared.record("scoped_publish", &entry.path, context);
let path = entry.path.clone();
let regular = entry.kind() == EntryKind::Regular;
let reference = self
.with_refs
.then(|| format!("published-object-{}", entry.node.id));
let mut publication = PublishedObject::new(ScopedObject {
inner: Object {
entry,
custom: self.interfaces[0].reference().clone(),
shared: self.shared.clone(),
context: context.clone(),
},
reference,
});
// Containers expose no interfaces but remain valid fetch subjects.
if regular {
for interface in &self.interfaces {
if interface
.reference()
.protocol_reference()
.validate_for_path(&path)
.is_ok()
{
publication = publication.expose(interface).unwrap();
}
}
}
Ok(publication)
}
}
struct ScopedPolicy;
impl ProjectionPolicy<Entry, ScopedObject> for ScopedPolicy {
type Principal = Principal;
fn object_visible(&self, principal: &Principal, entry: &Entry) -> bool {
!entry.hidden && (!matches!(principal, Principal::Limited) || entry.path != "/secret")
}
fn interface_visible(&self, principal: &Principal, interface: &InterfaceRef) -> bool {
!(matches!(principal, Principal::Limited)
&& interface.protocol_reference().scope == "/added")
}
}
type ScopedEngine = Projection<MemoryBackend, ScopedComposition, ScopedPolicy>;
fn scoped_engine(shared: Arc<Shared>, with_refs: bool) -> ScopedEngine {
configured_engine(shared, with_refs, None)
}
fn configured_engine(
shared: Arc<Shared>,
with_refs: bool,
interface_validator: Option<Validator>,
) -> ScopedEngine {
let mut registry = InterfaceRegistry::new();
let mut associations = BTreeMap::new();
let mut interfaces = Vec::new();
for path in ["/", "/secret", "/secret/nested", "/added"] {
let scope = Scope::new(path).unwrap();
let validator = if path == "/secret" {
interface_validator.clone()
} else {
None
};
interfaces.push(
registry
.register(
&scope,
"file.read",
wip_fs_server::FileReadDefinition,
validator,
)
.unwrap(),
);
associations.insert(path.into(), (shared.node(path), scope));
}
Projection::new(
MemoryBackend::new(shared.clone()),
registry,
ScopedComposition {
shared,
associations,
interfaces,
with_refs,
},
ScopedPolicy,
ResourceLimits::default(),
)
}
fn reference(scope: &str) -> wip_protocol::InterfaceReference {
wip_protocol::InterfaceReference {
scope: scope.into(),
name: "file.read".into(),
}
}
fn request(path: &str, scope: &str, scope_ref: Option<String>) -> CallOperationRequest {
CallOperationRequest {
target: Target {
path: path.into(),
validator: None,
},
interface: InterfaceTarget {
reference: reference(scope),
scope_ref,
validator: None,
},
operation: "read".into(),
arguments: BTreeMap::new(),
}
}
#[test]
fn nonroot_observe_fetch_call_with_optional_refs_over_http() {
for with_refs in [false, true] {
let fixture = Fixture::new();
let engine = scoped_engine(fixture.shared.clone(), with_refs);
let view = engine.view(&Principal::Admin);
let limits = ResourceLimits::default();
let endpoint = Endpoint::parse("https://example.test/scopes").unwrap();
let adapter = HttpAdapter::new(&view, &endpoint, limits);
for (path, scope) in [("/secret/nested/data", "/secret"), ("/added", "/added")] {
let observe = observe_request(path, 0);
let response = adapter.handle_http_with_context(
encode_observe_request(&endpoint, &observe, limits.wire).unwrap(),
&ExecutionContext::new(),
);
let DecodedResponse::Success(observed) =
decode_observe_response(&observe, &response, limits.wire).unwrap()
else {
panic!("observation must succeed");
};
assert!(observed.object.interfaces.contains(&reference(scope)));
let fetch = fetch_request(&reference(scope));
let response = adapter.handle_http_with_context(
encode_fetch_interface_request(&endpoint, &fetch, limits.wire).unwrap(),
&ExecutionContext::new(),
);
let DecodedResponse::Success(fetched) =
decode_fetch_interface_response(&fetch, &response, limits.wire).unwrap()
else {
panic!("fetch must succeed");
};
assert_eq!(
fetched.scope_ref,
with_refs.then(|| format!("published-object-{}", fixture.shared.node(scope).id))
);
let mut call = request(path, scope, fetched.scope_ref);
call.target.validator = observed.object.validator;
let response = adapter.handle_http_with_context(
encode_call_operation_request(&endpoint, &call, &fetched.descriptor, limits.wire)
.unwrap(),
&ExecutionContext::new(),
);
let DecodedResponse::Success(result) =
decode_call_operation_response(&call, &fetched.descriptor, &response, limits.wire)
.unwrap()
else {
panic!("call must succeed");
};
assert_eq!(result.result, Value::Bytes(b"hello memory".to_vec()));
if !with_refs {
call.interface.scope_ref = Some("ref-not-provided-by-publication".into());
assert_eq!(
view.call_operation(call).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceMismatch
);
}
}
assert!(
view.observe_object("/secret")
.unwrap()
.interfaces
.is_empty()
);
assert_eq!(
view.observe_object("/secret/nested/data")
.unwrap()
.interfaces,
[
reference("/"),
reference("/secret"),
reference("/secret/nested")
]
);
let limited = engine.view(&Principal::Limited);
for scope in ["/secret", "/secret/nested", "/added"] {
assert_eq!(
limited
.fetch_interface(&fetch_request(&reference(scope)))
.unwrap_err()
.code,
ProtocolErrorCode::InterfaceNotFound
);
}
assert_eq!(
limited
.observe_object("/secret/nested/data")
.unwrap_err()
.kind(),
wip_host::CallErrorKind::NotFound
);
assert!(
!limited
.observe_object("/added")
.unwrap()
.interfaces
.contains(&reference("/added"))
);
}
}
#[test]
fn scope_refs_and_object_validator_precedence_use_current_atomic_lineage() {
let fixture = Fixture::new();
let engine = scoped_engine(fixture.shared.clone(), true);
let view = engine.view(&Principal::Admin);
let mut call = request("/secret/nested/data", "/secret", Some("stale".into()));
call.target.validator = Some(vec![0]);
assert_eq!(
view.call_operation(call.clone()).unwrap_err().kind(),
wip_host::CallErrorKind::ValidatorMismatch
);
call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
assert_eq!(
view.call_operation(call.clone()).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceMismatch
);
call.interface.scope_ref = view
.fetch_interface(&fetch_request(&call.interface.reference))
.unwrap()
.scope_ref;
// Scope state changes do not retire its lifetime; the published ref is not
// its validator, and the hook runs on refreshed metadata under the lock.
fixture.shared.controls.lock().unwrap().bump_ancestor = Some("/secret".into());
fixture.shared.seen.lock().unwrap().clear();
view.call_operation(call).unwrap();
let seen = fixture.shared.seen.lock().unwrap();
let resolves: Vec<_> = seen
.iter()
.filter(|event| event.stage == "resolve")
.map(|event| event.path.as_str())
.collect();
assert_eq!(resolves, ["/secret/nested/data"]);
assert!(
seen.iter()
.any(|event| event.stage == "scope" && event.path == "/secret")
);
}
#[test]
fn nonroot_interface_validator_checks_follow_scope_ref_checks() {
let fixture = Fixture::new();
let engine = configured_engine(fixture.shared.clone(), true, Some(Validator::new(vec![7])));
let view = engine.view(&Principal::Admin);
let fetched = view
.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap();
assert_eq!(fetched.validator, Some(vec![7]));
let mut call = request("/secret/nested/data", "/secret", Some("stale".into()));
call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
assert_eq!(
view.call_operation(call.clone()).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceMismatch
);
call.interface.scope_ref = fetched.scope_ref;
assert_eq!(
view.call_operation(call.clone()).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceValidatorRequired
);
call.interface.validator = Some(vec![8]);
assert_eq!(
view.call_operation(call.clone()).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceValidatorMismatch
);
assert!(
fixture
.shared
.node(&call.target.path)
.calls
.lock()
.unwrap()
.is_empty()
);
call.interface.validator = fetched.validator;
view.call_operation(call).unwrap();
}
#[test]
fn visibility_and_replacement_races_reject_before_dispatch() {
for replace in [false, true] {
let fixture = Fixture::new();
let engine = scoped_engine(fixture.shared.clone(), false);
let view = engine.view(&Principal::Admin);
let mut call = request("/secret/nested/data", "/secret", None);
call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
let leaf = fixture.shared.node(&call.target.path);
if replace {
fixture.shared.controls.lock().unwrap().replace_ancestor = Some("/secret".into());
} else {
fixture.shared.controls.lock().unwrap().hide_ancestor = Some("/secret".into());
}
assert_eq!(
view.call_operation(call).unwrap_err().kind(),
wip_host::CallErrorKind::NotFound
);
assert!(leaf.calls.lock().unwrap().is_empty());
assert_eq!(
view.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap_err()
.code,
ProtocolErrorCode::InterfaceNotFound
);
}
}
#[test]
fn deletion_replacement_and_self_scope_do_not_reuse_registry_lifetimes() {
for with_refs in [false, true] {
let fixture = Fixture::new();
let engine = scoped_engine(fixture.shared.clone(), with_refs);
let view = engine.view(&Principal::Admin);
let old_scope = fixture.shared.node("/secret");
let old_ref = view
.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap()
.scope_ref;
fixture.shared.nodes.lock().unwrap().remove("/secret");
assert_eq!(
view.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap_err()
.code,
ProtocolErrorCode::InterfaceNotFound
);
// Reuse even the same id/public ref: refs cannot attest a lifetime.
fixture.shared.nodes.lock().unwrap().insert(
"/secret".into(),
Arc::new(Node {
id: old_scope.id,
kind: EntryKind::Directory,
data: Mutex::new(old_scope.data.lock().unwrap().clone()),
calls: Mutex::new(Vec::new()),
}),
);
assert_eq!(
view.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap_err()
.code,
ProtocolErrorCode::InterfaceNotFound
);
let mut call = request("/secret/nested/data", "/secret", old_ref);
call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
assert_eq!(
view.call_operation(call).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceMismatch
);
assert!(
fixture
.shared
.node("/secret/nested/data")
.calls
.lock()
.unwrap()
.is_empty()
);
// Fresh registration/engine attests the new publication.
let republished = scoped_engine(fixture.shared.clone(), with_refs);
republished
.view(&Principal::Admin)
.fetch_interface(&fetch_request(&reference("/secret")))
.unwrap();
// Scope == target: ordinary execution pins the old leaf, but cannot
// attest it as the current scope after its mapping is replaced.
let leaf = fixture.shared.node("/added");
let mut call = request("/added", "/added", None);
call.target.validator = view.observe_object("/added").unwrap().validator;
fixture.shared.controls.lock().unwrap().replace_mapping = true;
assert_eq!(
view.call_operation(call).unwrap_err().kind(),
wip_host::CallErrorKind::InterfaceMismatch
);
assert!(leaf.calls.lock().unwrap().is_empty());
assert_eq!(
view.fetch_interface(&fetch_request(&reference("/added")))
.unwrap_err()
.code,
ProtocolErrorCode::InterfaceNotFound
);
}
}