fix: bound filesystem execution and preserve guarantees

crates/wip-fs-server/tests/end_to_end.rs

@@ -10,14 +10,14 @@ use tempfile::tempdir;
 use wip_fs_server::{AccessMode, ServerConfig, TransportSecurity, WipFsServer};
 use wip_https::{
     BatchRequest, BatchRequestItem, BatchRequestKind, BatchResponse, BatchSuccess, DecodedResponse,
-    Endpoint, JSON_CONTENT_TYPE, Route, decode_batch_request, decode_batch_response,
+    Endpoint, JSON_CONTENT_TYPE, Limits, Route, decode_batch_request, decode_batch_response,
     decode_call_operation_response, decode_fetch_interface_response, decode_fetch_response,
     decode_fetch_tree_response, encode_batch_request, encode_call_operation_request,
     encode_fetch_interface_request, encode_fetch_request, encode_fetch_tree_request,
 };
 use wip_protocol::{
     CallOperationRequest, FetchInterfaceRequest, FetchRequest, FetchTreeRequest, InterfaceTarget,
-    Target, Value,
+    ProtocolErrorCode, Target, Value,
 };
 
 #[test]
@@ -256,6 +256,83 @@ fn call_argument_decoding_does_not_mask_missing_target() {
     );
 }
 
+#[test]
+fn backend_invalid_unicode_path_is_not_found_not_internal() {
+    let temporary = tempdir().expect("temporary root");
+    let config = ServerConfig::for_root(temporary.path());
+    let limits = config.limits.wire;
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("https://localhost/wip").expect("endpoint");
+    let request = FetchRequest {
+        path: "/bad\0name".into(),
+    };
+    let response = server
+        .handle_http(encode_fetch_request(&endpoint, &request, limits).expect("encode fetch"));
+    assert_eq!(response.status(), http::StatusCode::NOT_FOUND);
+    match decode_fetch_response(&request, &response, limits).expect("decode missing response") {
+        DecodedResponse::ProtocolFailure { error, .. } => {
+            assert_eq!(error.code, ProtocolErrorCode::NotFound);
+        }
+        DecodedResponse::Success(_) => panic!("backend-invalid path must not resolve"),
+    }
+}
+
+#[test]
+fn read_response_size_failure_preserves_non_commit_guarantee() {
+    let temporary = tempdir().expect("temporary root");
+    std::fs::write(temporary.path().join("large"), vec![b'x'; 2_000]).expect("write file");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.wire = Limits::new(4_096, 1_024, 64, 64).expect("wire limits");
+    let limits = config.limits.wire;
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("https://localhost/wip").expect("endpoint");
+
+    let fetch_request = FetchRequest {
+        path: "/large".into(),
+    };
+    let response = server.handle_http(
+        encode_fetch_request(&endpoint, &fetch_request, limits).expect("encode fetch"),
+    );
+    let file =
+        success(decode_fetch_response(&fetch_request, &response, limits).expect("decode fetch"));
+    let interface_request = FetchInterfaceRequest {
+        interface: file.interfaces[0].clone(),
+    };
+    let response = server.handle_http(
+        encode_fetch_interface_request(&endpoint, &interface_request, limits)
+            .expect("encode interface fetch"),
+    );
+    let interface = success(
+        decode_fetch_interface_response(&interface_request, &response, limits)
+            .expect("decode interface"),
+    );
+    let call = CallOperationRequest {
+        target: Target {
+            path: "/large".into(),
+            validator: file.validator,
+        },
+        interface: InterfaceTarget {
+            reference: file.interfaces[0].clone(),
+            validator: None,
+        },
+        operation: "read".into(),
+        arguments: BTreeMap::from([("length".into(), Value::Integer(1_500))]),
+    };
+    let response = server.handle_http(
+        encode_call_operation_request(&endpoint, &call, &interface.descriptor, limits)
+            .expect("encode read call"),
+    );
+    assert_eq!(response.status(), http::StatusCode::PAYLOAD_TOO_LARGE);
+    match decode_call_operation_response(&call, &interface.descriptor, &response, limits)
+        .expect("decode resource failure")
+    {
+        DecodedResponse::ProtocolFailure { error, .. } => {
+            assert_eq!(error.code, ProtocolErrorCode::ResourceLimitExceeded);
+        }
+        DecodedResponse::Success(_) => panic!("oversized read response must fail"),
+    }
+}
+
 fn assert_batch_successes(batch: &BatchResponse) {
     assert_eq!(batch.responses.len(), 3);
     assert!(matches!(