[Init] Initial commit - NetMesh terminal manager

electron/plugins/filesystemBroker.test.cjs

@@ -0,0 +1,392 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const fsp = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+
+const { PluginFilesystemBroker, MAX_FILESYSTEM_BYTES } = require("./filesystemBroker.cjs");
+const { RPC_ERRORS } = require("./rpcRouter.cjs");
+
+function createRoot(context) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "netcatty-plugin-filesystem-"));
+  context.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  return fs.realpathSync(root);
+}
+
+function runtimeContext(authorization) {
+  return {
+    runtimeId: "runtime-1",
+    authorization,
+    assertActive: async () => {},
+  };
+}
+
+async function openTestDirectoryHandle(directoryPath) {
+  const stats = await fsp.stat(directoryPath);
+  const directory = await fsp.opendir(directoryPath);
+  return {
+    stat: async () => stats,
+    read: () => directory.read(),
+    close: async () => {
+      try { await directory.close(); }
+      catch (error) { if (error?.code !== "ERR_DIR_CLOSED") throw error; }
+    },
+  };
+}
+
+test("filesystem broker uses canonical authorization for bounded read, write, stat, and list", async (context) => {
+  const root = createRoot(context);
+  const source = path.join(root, "source.txt");
+  const target = path.join(root, "target.txt");
+  await Promise.all([
+    fsp.writeFile(source, "hello"),
+    fsp.writeFile(target, "prior"),
+  ]);
+  const charges = [];
+  const broker = new PluginFilesystemBroker({
+    quotaManager: { chargeBytes: (...args) => charges.push(args) },
+    openDirectoryHandle: openTestDirectoryHandle,
+  });
+
+  const readAuthorization = await broker.describeReadAuthorization({ path: source });
+  assert.deepEqual(readAuthorization.resourceKinds, ["exact"]);
+  assert.deepEqual(
+    await broker.readFile({ path: source }, runtimeContext(readAuthorization)),
+    { data: "hello" },
+  );
+  assert.equal((await broker.stat({ path: source }, runtimeContext(readAuthorization))).kind, "file");
+
+  const writeAuthorization = await broker.describeWriteAuthorization({
+    path: target,
+    data: "world",
+    overwrite: true,
+  });
+  assert.deepEqual(writeAuthorization.resourceKinds, ["exact"]);
+  await broker.writeFile({
+    path: target,
+    data: "world",
+    overwrite: true,
+  }, runtimeContext(writeAuthorization));
+  assert.equal(await fsp.readFile(target, "utf8"), "world");
+  const overwriteAuthorization = await broker.describeWriteAuthorization({
+    path: target,
+    data: "short",
+    overwrite: true,
+  });
+  await broker.writeFile(
+    { path: target, data: "short", overwrite: true },
+    runtimeContext(overwriteAuthorization),
+  );
+  assert.equal(await fsp.readFile(target, "utf8"), "short");
+
+  const listAuthorization = await broker.describeReadAuthorization({ path: root }, "directory");
+  assert.deepEqual(listAuthorization.resourceKinds, ["directory"]);
+  const list = await broker.readDirectory({ path: root }, runtimeContext(listAuthorization));
+  assert.deepEqual(list.entries.map(({ name }) => name), ["source.txt", "target.txt"]);
+  assert.deepEqual(charges, [
+    ["runtime-1", "filesystem", 5],
+    ["runtime-1", "filesystem", 5],
+    ["runtime-1", "filesystem", 5],
+  ]);
+});
+
+test("filesystem authorization removes trailing directory separators before permission", async (context) => {
+  const root = createRoot(context);
+  const requestedPath = `${root}${path.sep}`;
+  await fsp.writeFile(path.join(root, "entry.txt"), "entry");
+  const broker = new PluginFilesystemBroker({ openDirectoryHandle: openTestDirectoryHandle });
+  const statAuthorization = broker.describeReadAuthorization({ path: requestedPath }, "exact");
+  const listAuthorization = broker.describeReadAuthorization({ path: requestedPath }, "directory");
+
+  assert.deepEqual(statAuthorization.resources, [root]);
+  assert.deepEqual(listAuthorization.resources, [root]);
+  assert.equal(
+    (await broker.stat({ path: requestedPath }, runtimeContext(statAuthorization))).kind,
+    "directory",
+  );
+  assert.deepEqual(
+    (await broker.readDirectory({ path: requestedPath }, runtimeContext(listAuthorization))).entries,
+    [{ name: "entry.txt", kind: "file" }],
+  );
+});
+
+test("filesystem write quota is enforced before mutating the target", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "target.txt");
+  await fsp.writeFile(target, "original");
+  const broker = new PluginFilesystemBroker({
+    quotaManager: { chargeBytes: () => { throw new Error("quota denied"); } },
+  });
+  const authorization = await broker.describeWriteAuthorization({
+    path: target,
+    data: "blocked",
+    overwrite: true,
+  });
+  await assert.rejects(
+    broker.writeFile({
+      path: target,
+      data: "blocked",
+      overwrite: true,
+    }, runtimeContext(authorization)),
+    /quota denied/,
+  );
+  assert.equal(await fsp.readFile(target, "utf8"), "original");
+});
+
+test("filesystem authorization descriptors never probe path existence before permission", async (context) => {
+  const root = createRoot(context);
+  const missing = path.join(root, "missing.txt");
+  let filesystemCalls = 0;
+  const broker = new PluginFilesystemBroker({
+    fileSystem: new Proxy({}, {
+      get() {
+        return async () => {
+          filesystemCalls += 1;
+          throw new Error("filesystem must not be queried while describing authorization");
+        };
+      },
+    }),
+  });
+  assert.deepEqual(broker.describeReadAuthorization({ path: missing }), {
+    permission: "filesystem.read",
+    resources: [missing],
+    resourceKinds: ["exact"],
+    reason: `Read ${missing}`,
+    operationId: `filesystem.read:${missing}`,
+  });
+  assert.deepEqual(broker.describeReadAuthorization({ path: root }, "directory").resourceKinds, ["directory"]);
+  assert.deepEqual(broker.describeWriteAuthorization({
+    path: missing,
+    data: "blocked",
+    overwrite: true,
+  }).resources, [missing]);
+  await assert.rejects(
+    broker.readFile({ path: missing }, runtimeContext(null)),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+  await assert.rejects(
+    broker.writeFile(
+      { path: missing, data: "blocked", overwrite: true },
+      runtimeContext(null),
+    ),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+  assert.equal(filesystemCalls, 0);
+});
+
+test("filesystem writes reject missing targets without opening or creating them", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "missing.txt");
+  let openCalls = 0;
+  const broker = new PluginFilesystemBroker({
+    fileSystem: {
+      ...fsp,
+      async open(...args) {
+        openCalls += 1;
+        return fsp.open(...args);
+      },
+    },
+  });
+  const authorization = broker.describeWriteAuthorization({
+    path: target,
+    data: "blocked",
+    overwrite: true,
+  });
+  await assert.rejects(
+    broker.writeFile(
+      { path: target, data: "blocked", overwrite: true },
+      runtimeContext(authorization),
+    ),
+    (error) => error.code === RPC_ERRORS.failedPrecondition,
+  );
+  assert.equal(openCalls, 0);
+  await assert.rejects(fsp.stat(target), (error) => error.code === "ENOENT");
+});
+
+test("filesystem path swaps after authorization fail closed", async (context) => {
+  const root = createRoot(context);
+  const first = path.join(root, "first.txt");
+  const second = path.join(root, "second.txt");
+  const link = path.join(root, "selected.txt");
+  await Promise.all([fsp.writeFile(first, "first"), fsp.writeFile(second, "second")]);
+  await fsp.symlink(first, link);
+  const broker = new PluginFilesystemBroker();
+  const authorization = await broker.describeReadAuthorization({ path: link });
+  await fsp.unlink(link);
+  await fsp.symlink(second, link);
+  await assert.rejects(
+    broker.readFile({ path: link }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+});
+
+test("filesystem directory replacement between authorization and open fails closed", async (context) => {
+  const root = createRoot(context);
+  const selected = path.join(root, "selected");
+  const replacement = path.join(root, "replacement");
+  const original = path.join(root, "original");
+  await Promise.all([
+    fsp.mkdir(selected),
+    fsp.mkdir(replacement),
+  ]);
+  await Promise.all([
+    fsp.writeFile(path.join(selected, "allowed.txt"), "allowed"),
+    fsp.writeFile(path.join(replacement, "secret.txt"), "secret"),
+  ]);
+  let swapped = false;
+  const broker = new PluginFilesystemBroker({
+    openDirectoryHandle: async (directoryPath) => {
+      if (!swapped) {
+        swapped = true;
+        await fsp.rename(selected, original);
+        await fsp.rename(replacement, selected);
+      }
+      return openTestDirectoryHandle(directoryPath);
+    },
+  });
+  const authorization = await broker.describeReadAuthorization({ path: selected }, "directory");
+  await assert.rejects(
+    broker.readDirectory({ path: selected }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+});
+
+test("filesystem directory listing fails closed without a handle-bound adapter", async (context) => {
+  const root = createRoot(context);
+  await fsp.writeFile(path.join(root, "entry.txt"), "entry");
+  const broker = new PluginFilesystemBroker();
+  const authorization = broker.describeReadAuthorization({ path: root }, "directory");
+  await assert.rejects(
+    broker.readDirectory({ path: root }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.unsupported,
+  );
+});
+
+test("filesystem writes recheck runtime activity immediately before mutation", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "target.txt");
+  await fsp.writeFile(target, "original");
+  let active = true;
+  let armed = false;
+  const broker = new PluginFilesystemBroker({
+    fileSystem: {
+      ...fsp,
+      async stat(filePath, options) {
+        const stats = await fsp.stat(filePath, options);
+        if (armed) active = false;
+        return stats;
+      },
+    },
+  });
+  const authorization = await broker.describeWriteAuthorization({
+    path: target,
+    data: "replacement",
+    overwrite: true,
+  });
+  armed = true;
+  await assert.rejects(broker.writeFile({
+    path: target,
+    data: "replacement",
+    overwrite: true,
+  }, {
+    ...runtimeContext(authorization),
+    assertActive: async () => { if (!active) throw new Error("runtime stopped"); },
+  }), /runtime stopped/);
+  assert.equal(await fsp.readFile(target, "utf8"), "original");
+});
+
+test("filesystem reads reject a replacement inode opened after authorization", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "selected.txt");
+  const original = path.join(root, "original.txt");
+  const replacement = path.join(root, "replacement.txt");
+  await Promise.all([
+    fsp.writeFile(target, "allowed"),
+    fsp.writeFile(replacement, "secret"),
+  ]);
+  let swapped = false;
+  const broker = new PluginFilesystemBroker({
+    fileSystem: {
+      ...fsp,
+      async open(filePath, flags, mode) {
+        if (!swapped) {
+          swapped = true;
+          await fsp.rename(target, original);
+          await fsp.rename(replacement, target);
+        }
+        return fsp.open(filePath, flags, mode);
+      },
+    },
+  });
+  const authorization = broker.describeReadAuthorization({ path: target });
+  await assert.rejects(
+    broker.readFile({ path: target }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+});
+
+test("filesystem writes reject a replacement inode opened after authorization", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "selected.txt");
+  const original = path.join(root, "original.txt");
+  const replacement = path.join(root, "replacement.txt");
+  await Promise.all([
+    fsp.writeFile(target, "allowed"),
+    fsp.writeFile(replacement, "secret"),
+  ]);
+  let swapped = false;
+  const broker = new PluginFilesystemBroker({
+    fileSystem: {
+      ...fsp,
+      async open(filePath, flags, mode) {
+        if (!swapped) {
+          swapped = true;
+          await fsp.rename(target, original);
+          await fsp.rename(replacement, target);
+        }
+        return fsp.open(filePath, flags, mode);
+      },
+    },
+  });
+  const authorization = broker.describeWriteAuthorization({
+    path: target,
+    data: "overwritten",
+    overwrite: true,
+  });
+  await assert.rejects(
+    broker.writeFile({
+      path: target,
+      data: "overwritten",
+      overwrite: true,
+    }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.permissionDenied,
+  );
+  assert.equal(await fsp.readFile(original, "utf8"), "allowed");
+  assert.equal(await fsp.readFile(target, "utf8"), "secret");
+});
+
+test("filesystem broker rejects oversized and non-canonical payloads", async (context) => {
+  const root = createRoot(context);
+  const target = path.join(root, "target.bin");
+  const broker = new PluginFilesystemBroker();
+  assert.throws(() => broker.validateWrite({
+    path: target,
+    data: "YQ",
+    encoding: "base64",
+  }), /not canonical/);
+  assert.throws(() => broker.validateWrite({
+    path: target,
+    data: "a".repeat(MAX_FILESYSTEM_BYTES + 1),
+  }), (error) => error.code === RPC_ERRORS.resourceExhausted);
+  assert.throws(() => broker.validateRead({ path: `${target}\0suffix` }), /absolute/);
+
+  await fsp.writeFile(target, "12345");
+  const authorization = await broker.describeReadAuthorization({ path: target, maxBytes: 4 });
+  await assert.rejects(
+    broker.readFile({ path: target, maxBytes: 4 }, runtimeContext(authorization)),
+    (error) => error.code === RPC_ERRORS.resourceExhausted,
+  );
+});