Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: harden backend resource handles

Browse Source
This commit is contained in:
Hare
2026-07-08 20:44:04 +09:00
parent 57e96d3be8
commit e716ae44f0
4 changed files with 523 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/worker-runtime/src/resource.rs
+80
View File
@@ -254,3 +254,83 @@ pub fn validate_resource_handle_text(label: &str, value: &str) -> Result<(), Str
}
Ok(())
}
#[cfg(test)]
mod tests {
use super::*;
use crate::profile_archive::ProfileSourceGraphSummary;
use std::collections::BTreeMap;
fn graph() -> ProfileSourceGraphSummary {
ProfileSourceGraphSummary {
source_count: 1,
total_source_bytes: 4,
entrypoints: BTreeMap::from([(
"default".to_string(),
"profiles/default.dcdl".to_string(),
)]),
import_count: 0,
}
}
fn handle_for(bytes: &[u8]) -> BackendResourceHandle {
BackendResourceHandle {
kind: BackendResourceKind::ProfileSourceArchive,
workspace_id: "workspace-test".to_string(),
scope_id: Some("workspace-profile-source".to_string()),
runtime_id: Some("runtime-test".to_string()),
worker_id: Some("worker-test".to_string()),
resource_id: "profile-source-archive:test".to_string(),
digest: sha256_hex(bytes),
operation: BackendResourceOperation::FetchArchive,
expires_at_unix_seconds: 4_102_444_800,
nonce: "nonce-test".to_string(),
revision: sha256_hex(bytes),
generation: Some(1),
max_bytes: 1024,
content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
redaction: ResourceRedactionPolicy::RuntimeInternalOnly,
audit_correlation_id: "audit-test".to_string(),
profile_source_graph: Some(graph()),
}
}
#[test]
fn response_verification_detects_digest_mismatch() {
let bytes = b"archive-bytes";
let handle = handle_for(bytes);
let error = profile_source_archive_from_response(
&handle,
BackendResourceFetchResponse {
kind: BackendResourceKind::ProfileSourceArchive,
resource_id: handle.resource_id.clone(),
digest: handle.digest.clone(),
content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
bytes: b"tampered-bytes".to_vec(),
audit_correlation_id: handle.audit_correlation_id.clone(),
},
)
.unwrap_err();
assert!(matches!(error, BackendResourceError::DigestMismatch { .. }));
}
#[test]
fn response_verification_rejects_oversized_bytes() {
let bytes = b"archive-bytes";
let mut handle = handle_for(bytes);
handle.max_bytes = 2;
let error = profile_source_archive_from_response(
&handle,
BackendResourceFetchResponse {
kind: BackendResourceKind::ProfileSourceArchive,
resource_id: handle.resource_id.clone(),
digest: handle.digest.clone(),
content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
bytes: bytes.to_vec(),
audit_correlation_id: handle.audit_correlation_id.clone(),
},
)
.unwrap_err();
assert!(matches!(error, BackendResourceError::Oversized { .. }));
}
}
crates/worker-runtime/src/worker_backend.rs
+160 -8
View File
@@ -184,11 +184,6 @@ impl ProfileRuntimeWorkerFactory {
bundle.metadata.id
)
})?;
if let Some(cached) = self.profile_archive_cache.get(&handle.digest) {
return cached
.verify()
.map_err(|err| format!("failed to verify cached profile source archive: {err}"));
}
let client = self.resource_client.as_ref().ok_or_else(|| {
format!(
"config bundle {} requires a Backend resource client for profile source archive fetch",
@@ -204,10 +199,15 @@ impl ProfileRuntimeWorkerFactory {
.fetch_resource(fetch_request)
.await
.map_err(format_backend_resource_error)?;
let archive = profile_source_archive_from_response(&handle, response)
let fetched_archive = profile_source_archive_from_response(&handle, response)
.map_err(format_backend_resource_error)?;
self.profile_archive_cache.insert(archive.clone());
archive
if let Some(cached) = self.profile_archive_cache.get(&handle.digest) {
return cached
.verify()
.map_err(|err| format!("failed to verify cached profile source archive: {err}"));
}
self.profile_archive_cache.insert(fetched_archive.clone());
fetched_archive
.verify()
.map_err(|err| format!("failed to verify fetched profile source archive: {err}"))
}
@@ -701,6 +701,7 @@ where
#[cfg(test)]
mod tests {
use super::*;
use std::collections::{BTreeMap, VecDeque};
use std::fs;
use std::pin::Pin;
use std::process::Command;
@@ -711,6 +712,7 @@ mod tests {
ConfigBundleRef, CreateWorkerRequest, DirtyStatePolicy, MaterializerKind, ProfileSelector,
RepositorySelector, WorkingDirectoryRepository, WorkingDirectoryRequest,
};
use crate::execution::WorkerExecutionContext;
use crate::identity::RuntimeId;
use crate::management::RuntimeOptions;
use crate::observation::{TranscriptQuery, TranscriptRole};
@@ -854,6 +856,125 @@ mod tests {
.with_computed_digest()
}
fn sample_profile_archive() -> crate::profile_archive::ProfileSourceArchive {
let entrypoints =
BTreeMap::from([("default".to_string(), "profiles/default.dcdl".to_string())]);
let sources = BTreeMap::from([(
"profiles/default.dcdl".to_string(),
r#"{
slug = "default";
description = "Default";
scope = "workspace_read";
}"#
.to_string(),
)]);
crate::profile_archive::ProfileSourceArchive::build(
crate::profile_archive::ProfileSourceArchiveInput {
id: "profile-source-archive:test".to_string(),
entrypoints,
imports: BTreeMap::new(),
sources,
},
)
.unwrap()
}
fn handle_for_archive(
archive: &crate::profile_archive::ProfileSourceArchive,
) -> crate::resource::BackendResourceHandle {
crate::resource::BackendResourceHandle {
kind: crate::resource::BackendResourceKind::ProfileSourceArchive,
workspace_id: "workspace-test".to_string(),
scope_id: Some("workspace-profile-source".to_string()),
runtime_id: Some("runtime-test".to_string()),
worker_id: Some("worker-test".to_string()),
resource_id: archive.reference.id.clone(),
digest: archive.reference.digest.clone(),
operation: crate::resource::BackendResourceOperation::FetchArchive,
expires_at_unix_seconds: 4_102_444_800,
nonce: "nonce-test".to_string(),
revision: archive.reference.digest.clone(),
generation: Some(1),
max_bytes: crate::resource::DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
content_type: crate::resource::PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
redaction: crate::resource::ResourceRedactionPolicy::RuntimeInternalOnly,
audit_correlation_id: "audit-test".to_string(),
profile_source_graph: Some(archive.reference.source_graph.clone()),
}
}
fn response_for_archive(
handle: &crate::resource::BackendResourceHandle,
archive: &crate::profile_archive::ProfileSourceArchive,
) -> crate::resource::BackendResourceFetchResponse {
crate::resource::BackendResourceFetchResponse {
kind: crate::resource::BackendResourceKind::ProfileSourceArchive,
resource_id: handle.resource_id.clone(),
digest: handle.digest.clone(),
content_type: crate::resource::PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
bytes: archive.content.clone(),
audit_correlation_id: handle.audit_correlation_id.clone(),
}
}
#[derive(Clone)]
struct SequencedResourceClient {
responses: Arc<
Mutex<
VecDeque<
Result<
crate::resource::BackendResourceFetchResponse,
crate::resource::BackendResourceError,
>,
>,
>,
>,
call_count: Arc<AtomicUsize>,
}
#[async_trait]
impl crate::resource::BackendResourceClient for SequencedResourceClient {
async fn fetch_resource(
&self,
_request: crate::resource::BackendResourceFetchRequest,
) -> Result<
crate::resource::BackendResourceFetchResponse,
crate::resource::BackendResourceError,
> {
self.call_count.fetch_add(1, Ordering::SeqCst);
self.responses
.lock()
.unwrap()
.pop_front()
.expect("missing sequenced resource response")
}
}
fn spawn_request_with_bundle(
bundle: crate::config_bundle::ConfigBundle,
) -> WorkerExecutionSpawnRequest {
let worker_ref = crate::identity::WorkerRef::new(
RuntimeId::new("runtime-test").unwrap(),
crate::identity::WorkerId::new("worker-test").unwrap(),
);
WorkerExecutionSpawnRequest {
worker_ref: worker_ref.clone(),
request: CreateWorkerRequest {
profile: ProfileSelector::RuntimeDefault,
config_bundle: ConfigBundleRef {
id: bundle.metadata.id.clone(),
digest: bundle.metadata.digest.clone(),
},
initial_input: None,
working_directory_request: None,
working_directory: None,
},
context: WorkerExecutionContext::new(worker_ref, Arc::new(|_, _| panic!("unused"))),
working_directory: None,
config_bundle: Some(bundle),
}
}
fn create_request(_name: &str) -> CreateWorkerRequest {
let bundle = test_bundle();
CreateWorkerRequest {
@@ -906,6 +1027,37 @@ mod tests {
}
}
#[tokio::test]
async fn cached_profile_archive_still_requires_backend_authorization() {
let archive = sample_profile_archive();
let handle = handle_for_archive(&archive);
let call_count = Arc::new(AtomicUsize::new(0));
let client = SequencedResourceClient {
responses: Arc::new(Mutex::new(VecDeque::from([
Ok(response_for_archive(&handle, &archive)),
Err(crate::resource::BackendResourceError::Expired),
]))),
call_count: call_count.clone(),
};
let factory = ProfileRuntimeWorkerFactory::new(tempfile::tempdir().unwrap().path())
.with_resource_client(Arc::new(client));
let mut bundle = test_bundle();
bundle.profile_source_archive_handle = Some(handle);
bundle = bundle.with_computed_digest();
factory
.resolve_profile_source_archive(&bundle, &spawn_request_with_bundle(bundle.clone()))
.await
.expect("first fetch should authorize and cache archive");
let err = factory
.resolve_profile_source_archive(&bundle, &spawn_request_with_bundle(bundle.clone()))
.await
.unwrap_err();
assert!(err.contains("expired"), "unexpected error: {err}");
assert_eq!(call_count.load(Ordering::SeqCst), 2);
}
#[test]
fn builtin_profile_selector_is_not_double_prefixed() {
assert_eq!(