Pool host-approved restricted code with scoped and fair graph execution

test/candidate-metadata.test.ts

@@ -28,23 +28,74 @@ test("concurrent candidate reservations enforce aggregate and owner limits and r
 
 test("metadata files reserve parse/index space before allocation and refuse oversized or linked inputs", async () => {
   const root = await mkdtemp(join(tmpdir(), "qx-metadata-budget-"));
-  const budget = new CandidateMetadataBudget({ bytes: 512, ownerBytes: 512, candidates: 2 });
+  const budget = new CandidateMetadataBudget({ bytes: 450, ownerBytes: 450, candidates: 2 });
   const scope = budget.acquire("workspace");
   try {
     const file = join(root, "metadata.json");
     await writeFile(file, '{"ok":true}');
-    assert.equal(new TextDecoder().decode(await readCandidateMetadata(file, scope, 100)), '{"ok":true}');
-    assert.equal(scope.bytes, 12 * 32);
+    const input = await readCandidateMetadata(file, scope, 100);
+    assert.equal(new TextDecoder().decode(input.bytes), '{"ok":true}');
+    const withInput = scope.bytes;
+    input.releaseInput();
+    input.releaseInput();
+    const first = scope.bytes;
+    assert.equal(withInput - first, (Buffer.byteLength('{"ok":true}') + 1) * 3);
+    assert.ok(first > 12 * 3, "Decoded tree and derived metadata are reserved before parsing");
     await assert.rejects(readCandidateMetadata(file, scope, 100), /CANDIDATE_METADATA_LIMIT/);
-    assert.equal(scope.bytes, 12 * 32);
+    assert.equal(scope.bytes, first, "Rejected tree allocation releases its transient input buffer");
     await assert.rejects(readCandidateMetadata(file, scope, 5), /CANDIDATE_METADATA_FILE_LIMIT/);
     await symlink(file, join(root, "linked"));
     await assert.rejects(readCandidateMetadata(join(root, "linked"), scope, 100), { code: "ELOOP" });
     await assert.rejects(readCandidateMetadata(root, scope, 100), /CANDIDATE_METADATA_FILE_LIMIT/);
-    assert.equal(scope.bytes, 12 * 32);
+    assert.equal(scope.bytes, first);
   } finally {
     scope.release();
     await rm(root, { recursive: true, force: true });
   }
   assert.equal(budget.snapshot().bytes, 0);
 });
+
+test("JSON structure accounting is independent of indentation and covers strings, values and dense nodes", async () => {
+  const root = await mkdtemp(join(tmpdir(), "qx-metadata-shape-"));
+  const budget = new CandidateMetadataBudget();
+  try {
+    for (const value of [{}, [null, true, false, 1, -3.5e8], { 'a"b': '雪\\"', nodes: [{}, {}, {}] }]) {
+      const measured = [];
+      for (const spaces of [0, 4]) {
+        const file = join(root, "metadata.json"),
+          text = JSON.stringify(value, null, spaces);
+        await writeFile(file, text);
+        const scope = budget.acquire("test");
+        try {
+          const input = await readCandidateMetadata(file, scope, 10000);
+          assert.deepEqual(JSON.parse(new TextDecoder().decode(input.bytes)), value);
+          input.releaseInput();
+          measured.push(scope.bytes);
+        } finally {
+          scope.release();
+        }
+      }
+      assert.equal(measured[0], measured[1], "Whitespace changes input storage, not the allocated JSON shape");
+      assert.ok(measured[0] >= 128);
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+  assert.equal(budget.snapshot().bytes, 0);
+});
+
+test("transient leases release exactly once, including after their parent closes", () => {
+  const budget = new CandidateMetadataBudget({ bytes: 1000, ownerBytes: 600, candidates: 3 });
+  const scope = budget.acquire("a");
+  scope.charge(200);
+  const release = scope.reserve(300);
+  assert.throws(() => scope.reserve(101), /CANDIDATE_METADATA_LIMIT/);
+  release();
+  release();
+  assert.equal(scope.bytes, 200);
+  const afterClose = scope.reserve(100);
+  scope.release();
+  afterClose();
+  assert.equal(scope.bytes, 0);
+  assert.equal(budget.snapshot().bytes, 0);
+});