diff --git a/.quixos-subtree-source.json b/.quixos-subtree-source.json index 02680cb..96a6f76 100644 --- a/.quixos-subtree-source.json +++ b/.quixos-subtree-source.json @@ -1,7 +1,7 @@ { "version": 1, "sourceRepo": "https://gitea.internal.quixos.org/quixos/quixos.git", - "sourceCommit": "806b0430d952b5a9aab5b2a63496c272aced8e50", + "sourceCommit": "e8df5e3396060619b33ab3cf9458231ef220ccc7", "sourcePath": "quixos-protocol", "exportName": "quixos-protocol", "mirrorRemote": "https://repos.quixos.org/quixos-toolchain/quixos-protocol.git" diff --git a/src/capability-language/authoring-converge.ts b/src/capability-language/authoring-converge.ts index cba7d94..8ec4107 100644 --- a/src/capability-language/authoring-converge.ts +++ b/src/capability-language/authoring-converge.ts @@ -4,6 +4,7 @@ import { execFile as callback } from "node:child_process"; import { promisify } from "node:util"; import { randomUUID } from "node:crypto"; import { authoringContext } from "./authoring-context.js"; +import { managedResourcePath } from "./managed-source-path.js"; import { snapshotCommit } from "./checked-build.js"; import { profile } from "./profile.js"; import { @@ -85,6 +86,11 @@ export async function convergeAuthoring(start: string, target = "root") { const context = await authoringContext(start); const graphFile = path.join(context.workbench, ".quixos/resource-graph.json"); const graphBefore = await readFile(graphFile, "utf8"); + const graph = JSON.parse(graphBefore); + // Discovery resolves outer guest aliases. Persist those same physical + // selections, without accepting symlinks within the managed workbench. + for (const resource of graph.resources) + resource.directory = await managedResourcePath(context.workbench, resource.directory); const blockers: AuthoringBlocker[] = []; const nodes = new Map(); const selected = new Map(); @@ -247,9 +253,6 @@ export async function convergeAuthoring(start: string, target = "root") { profile("capture-recheck", recheckStarted, { repositories: complete.size }); // Persist successful selections even if another repository is still broken. // Recovery must not depend on all parents succeeding in the same invocation. - const graph = JSON.parse(graphBefore); - for (const resource of graph.resources) - resource.directory = path.relative(context.workbench, path.resolve(context.workbench, resource.directory)); const replacements = new Map(); for (const resource of graph.resources) { const source = complete.get(resource.directory); diff --git a/src/capability-language/managed-source-path.ts b/src/capability-language/managed-source-path.ts new file mode 100644 index 0000000..4cc39a0 --- /dev/null +++ b/src/capability-language/managed-source-path.ts @@ -0,0 +1,19 @@ +import { realpath } from "node:fs/promises"; +import path from "node:path"; + +/** Registration may name the workbench through its guest alias. Only that + * outer alias is permitted: resources and each checkout remain physical, + * directly contained directories. Persist the resulting root-relative path. + */ +export async function managedResourcePath(workbench: string, directory: string): Promise { + const root = await realpath(workbench); + const selected = path.resolve(root, directory); + const name = path.basename(selected); + const resources = path.dirname(selected); + if (path.basename(resources) !== "resources" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) + throw new Error(`Repository is outside the managed workbench: ${directory}`); + const relative = `resources/${name}`; + if ((await realpath(path.dirname(resources))) !== root || (await realpath(selected)) !== path.join(root, relative)) + throw new Error(`Managed repository path crosses a symlink or escapes the workbench: ${directory}`); + return relative; +} diff --git a/src/capability-language/pin-upgrades.ts b/src/capability-language/pin-upgrades.ts index 6dcc60b..b737964 100644 --- a/src/capability-language/pin-upgrades.ts +++ b/src/capability-language/pin-upgrades.ts @@ -22,6 +22,7 @@ import { type EvolutionReview, } from "../capability-model/index.js"; import { withFileLock } from "./file-lock.js"; +import { managedResourcePath } from "./managed-source-path.js"; const execFile = promisify(callback); type Source = { repository: string; commit: string }; export type UpgradeNode = { kind: "workspace" | "package" | "interface" | "build"; directory: string; source: Source }; @@ -98,7 +99,8 @@ const writeJournal = async (filename: string, journal: unknown) => { } }; -export const discoverUpgradeSpec = async (workbench: string): Promise => { +export const discoverUpgradeSpec = async (workbenchPath: string): Promise => { + const workbench = await fs.realpath(workbenchPath); const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8")); const root = await location(workbench, "root"); const nodes: UpgradeNode[] = [ @@ -110,11 +112,15 @@ export const discoverUpgradeSpec = async (workbench: string): Promise ({ - kind: entry.kind, - source: entry.source, - directory: path.relative(workbench, path.resolve(workbench, entry.directory)), - })), + ...(await Promise.all( + graph.resources.map( + async (entry: { kind: "interface" | "package" | "build"; directory: string; source: Source }) => ({ + kind: entry.kind, + source: entry.source, + directory: await managedResourcePath(workbench, entry.directory), + }), + ), + )), ]; let baseline: string | undefined; try { @@ -406,10 +412,7 @@ export const applyPinUpgrades = async ( previous.resources.map(async (entry: { kind: string; source: Source; directory: string }) => ({ kind: entry.kind, ...entry.source, - directory: await location( - plan.workbench, - path.relative(plan.workbench, path.resolve(plan.workbench, entry.directory)), - ), + directory: await location(plan.workbench, await managedResourcePath(plan.workbench, entry.directory)), })), ); for (const node of plan.nodes.filter((entry) => entry.kind !== "workspace")) { diff --git a/test/managed-source-path.test.ts b/test/managed-source-path.test.ts new file mode 100644 index 0000000..b6a7230 --- /dev/null +++ b/test/managed-source-path.test.ts @@ -0,0 +1,32 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs/promises"; +import os from "node:os"; +import path from "node:path"; +import { managedResourcePath } from "../src/capability-language/managed-source-path.js"; + +test("source registration permits an outer workbench alias, never nested checkout or resources symlinks", async (t) => { + const scratch = await fs.mkdtemp(path.join(os.tmpdir(), "qx-managed-source-path-")); + t.after(() => fs.rm(scratch, { recursive: true, force: true })); + const root = path.join(scratch, "retained/workbench"), + alias = path.join(scratch, "guest"), + outside = path.join(scratch, "outside"); + await fs.mkdir(path.join(root, "resources/Package"), { recursive: true }); + await fs.mkdir(outside); + await fs.symlink(root, alias); + for (const registered of [ + "resources/Package", + path.join(alias, "resources/Package"), + path.relative(root, path.join(alias, "resources/Package")), + ]) + assert.equal(await managedResourcePath(alias, registered), "resources/Package"); + await fs.symlink(path.join(root, "resources/Package"), path.join(root, "resources/Alias")); + await assert.rejects(managedResourcePath(root, "resources/Alias"), /crosses a symlink/); + await fs.symlink(outside, path.join(root, "resources/Escape")); + await assert.rejects(managedResourcePath(root, "resources/Escape"), /escapes the workbench/); + await fs.mkdir(path.join(outside, "resources/Package"), { recursive: true }); + await assert.rejects(managedResourcePath(root, path.join(outside, "resources/Package")), /escapes the workbench/); + await fs.rename(path.join(root, "resources"), path.join(root, "relocated-resources")); + await fs.symlink(path.join(root, "relocated-resources"), path.join(root, "resources")); + await assert.rejects(managedResourcePath(root, "resources/Package"), /crosses a symlink/); +}); diff --git a/test/pin-upgrades.test.ts b/test/pin-upgrades.test.ts index 0508a2b..ef90479 100644 --- a/test/pin-upgrades.test.ts +++ b/test/pin-upgrades.test.ts @@ -176,6 +176,9 @@ for (const dependencyKind of ["interface", "build"] as const) test(`${dependencyKind} pin upgrades publish children before parent locks and resume without republishing completed nodes`, async (context) => { const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-test-")); context.after(() => fs.rm(workbench, { recursive: true, force: true })); + const alias = `${workbench}-guest-alias`; + await fs.symlink(workbench, alias); + context.after(() => fs.unlink(alias)); const from = "a".repeat(40), to = "b".repeat(40), framework = "c".repeat(40); @@ -244,7 +247,15 @@ for (const dependencyKind of ["interface", "build"] as const) await fs.mkdir(path.join(workbench, ".quixos"), { recursive: true }); await fs.writeFile( path.join(workbench, ".quixos/resource-graph.json"), - JSON.stringify({ resources: [{ ...sources[1], source: { resolver: "git", ...sources[1].source } }] }), + JSON.stringify({ + resources: [ + { + ...sources[1], + directory: path.join(alias, sources[1].directory), + source: { resolver: "git", ...sources[1].source }, + }, + ], + }), ); assert.deepEqual( plan.nodes.map((node) => node.directory), @@ -275,6 +286,7 @@ for (const dependencyKind of ["interface", "build"] as const) assert.deepEqual(published, ["resources/Named", "root"]); const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8")); assert.equal(graph.resources.length, 1); + assert.equal(graph.resources[0].directory, "resources/Named"); assert.equal(graph.resources[0].source.commit, to); const next = await planPinUpgrades(workbench, { nodes: [sources[0], { ...sources[1], source: graph.resources[0].source }],