fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(suppress): don't over-decline a nearer descendant's own route/trigger

Browse Source 
A group's template suppression is "coarse by reference" (path for routes,
handler-name for triggers), and both resolution points dropped ANY inherited
row matching that reference across the whole subtree — including one a NEARER
descendant group deliberately re-declared. So an ancestor group G that declines
a far-ancestor's `/x` (or `audit` handler) would also silently kill a child
group H's OWN `/x` / `audit`-bound trigger at the same reference, violating the
documented "an owner can only decline what it inherits, never a descendant's
own rows" invariant.

Fix: gate each decline on the chain DEPTH of the suppressor vs the target's
owner — a suppressor at depth `d_s` may only decline a row whose owner is
strictly ABOVE it (`target_depth > d_s`):
- Routes: `list_route_suppressions` now returns `(app, path, suppressor_depth)`;
  the rebuild folds it to the min depth per `(app, path)` and
  `compile_effective_routes` skips an inherited route only when
  `route.depth > suppressor_depth`. (This also subsumes the old `depth > 0`
  inherited-only gate.)
- Triggers: the dispatch anti-join gains `AND sc.depth < c.depth` (the
  suppressor's chain depth below the trigger owner's), correlating on the outer
  `chain c` that every kv/docs/files/pubsub match query already binds.

An app's own suppression is depth 0 → still declines anything it inherits; a
group's suppression declines only what that group itself inherits. `sealed`
still overrides. No schema change.

Pinned by a new `compile_effective_routes` unit test (a depth-1 descendant
route survives a depth-2 suppression that declines a depth-3 template) and a
new `group_suppression` DB test (same for triggers); all existing suppression /
sealed / template journeys stay green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-07-13 22:17:01 +02:00
parent 31e6fc964d
commit 590b98b60f
7 changed files with 268 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
crates/manager-core/tests/group_route_templates.rs
View File

@@ -63,12 +63,18 @@ async fn app_under(pool: &PgPool, slug: &str, group: Uuid) -> Uuid {
/// ancestor-group templates, after nearest-wins shadowing.
async fn slice_paths(repo: &PostgresRouteRepository, app: Uuid) -> Vec<(String, Uuid)> {
let effective = repo.list_effective().await.expect("list_effective");
let suppressed = repo
let mut suppressed: std::collections::HashMap<(AppId, String), i32> =
std::collections::HashMap::new();
for (a, p, d) in repo
.list_route_suppressions()
.await
.expect("list_route_suppressions")
.into_iter()
.collect();
{
suppressed
.entry((a, p))
.and_modify(|x| *x = (*x).min(d))
.or_insert(d);
}
compile_effective_routes(&effective, &suppressed)
.into_iter()
.filter(|c| c.app_id == AppId::from(app))

139
crates/manager-core/tests/group_suppression.rs
View File

@@ -14,8 +14,6 @@
clippy::too_many_lines
)]
use std::collections::HashSet;
use picloud_manager_core::route_admin::compile_effective_routes;
use picloud_manager_core::route_repo::{PostgresRouteRepository, RouteRepository};
use picloud_manager_core::trigger_repo::{PostgresTriggerRepo, TriggerRepo};
@@ -77,12 +75,18 @@ async fn app_under(pool: &PgPool, slug: &str, group: Uuid) -> Uuid {
/// Whether `app`'s compiled route slice serves `/hello`.
async fn serves_hello(repo: &PostgresRouteRepository, app: Uuid) -> bool {
let effective = repo.list_effective().await.expect("list_effective");
let suppressed: HashSet<(AppId, String)> = repo
let mut suppressed: std::collections::HashMap<(AppId, String), i32> =
std::collections::HashMap::new();
for (a, p, d) in repo
.list_route_suppressions()
.await
.expect("list_route_suppressions")
.into_iter()
.collect();
{
suppressed
.entry((a, p))
.and_modify(|x| *x = (*x).min(d))
.or_insert(d);
}
compile_effective_routes(&effective, &suppressed)
.into_iter()
.any(|c| c.app_id == AppId::from(app) && format!("{:?}", c.path).contains("/hello"))
@@ -215,12 +219,18 @@ async fn group_suppression_declines_for_whole_subtree_only() {
.await
.expect("suppress sealed");
let effective = routes.list_effective().await.expect("list_effective");
let suppressed: HashSet<(AppId, String)> = routes
let mut suppressed: std::collections::HashMap<(AppId, String), i32> =
std::collections::HashMap::new();
for (app, path, depth) in routes
.list_route_suppressions()
.await
.expect("suppressions")
.into_iter()
.collect();
{
suppressed
.entry((app, path))
.and_modify(|x| *x = (*x).min(depth))
.or_insert(depth);
}
let a_serves_sealed = compile_effective_routes(&effective, &suppressed)
.into_iter()
.any(|cr| cr.app_id == AppId::from(a) && format!("{:?}", cr.path).contains("/sealed"));
@@ -259,3 +269,116 @@ async fn group_suppression_declines_for_whole_subtree_only() {
.execute(&pool)
.await;
}
/// Audit fix #3 (trigger side): a mid-tree group's suppression of an ancestor
/// template's handler name must NOT over-decline a NEARER descendant group's
/// OWN trigger that binds a same-named handler. `sc.depth < c.depth` in the
/// anti-join is the guard.
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn ancestor_suppression_does_not_over_decline_a_descendants_own_trigger() {
let Some(pool) = pool_or_skip().await else {
return;
};
let sfx = Uuid::new_v4().simple().to_string();
let admin = id1(
&pool,
"INSERT INTO admin_users (username, password_hash) VALUES ($1, 'x') RETURNING id",
&format!("od-{sfx}"),
)
.await;
// Chain: gg (root) → g → h → app a. gg AND h each own a handler of the SAME
// NAME plus a kv trigger bound to it. g suppresses that handler name.
let gg = group_under(&pool, &format!("od-gg-{sfx}"), None).await;
let g = group_under(&pool, &format!("od-g-{sfx}"), Some(gg)).await;
let h = group_under(&pool, &format!("od-h-{sfx}"), Some(g)).await;
let a = app_under(&pool, &format!("od-a-{sfx}"), h).await;
let name = format!("audit-{sfx}");
let mk_trigger = |owner: Uuid, name: String| {
let pool = pool.clone();
async move {
let handler: (Uuid,) = sqlx::query_as(
"INSERT INTO scripts (name, source, group_id) VALUES ($1, 'x', $2) RETURNING id",
)
.bind(&name)
.bind(owner)
.fetch_one(&pool)
.await
.expect("handler");
let t: (Uuid,) = sqlx::query_as(
"INSERT INTO triggers \
(group_id, script_id, kind, enabled, dispatch_mode, \
retry_max_attempts, retry_backoff, retry_base_ms, \
registered_by_principal, name) \
VALUES ($1, $2, 'kv', TRUE, 'async', 3, 'exponential', 1000, $3, $4) \
RETURNING id",
)
.bind(owner)
.bind(handler.0)
.bind(admin)
.bind(format!("t-{}", Uuid::new_v4().simple()))
.fetch_one(&pool)
.await
.expect("trigger");
sqlx::query(
"INSERT INTO kv_trigger_details (trigger_id, collection_glob, ops) \
VALUES ($1, '*', ARRAY['insert'])",
)
.bind(t.0)
.execute(&pool)
.await
.expect("kv details");
(handler.0, t.0)
}
};
let (gg_handler, gg_trig) = mk_trigger(gg, name.clone()).await;
let (h_handler, h_trig) = mk_trigger(h, name.clone()).await;
// g suppresses the handler name for its whole subtree.
sqlx::query(
"INSERT INTO template_suppressions (group_id, target_kind, reference) VALUES ($1, 'trigger', $2)",
)
.bind(g)
.bind(&name)
.execute(&pool)
.await
.expect("suppression");
let trig = PostgresTriggerRepo::new(pool.clone());
let m = trig
.list_matching_kv(AppId::from(a), "users", KvEventOp::Insert)
.await
.expect("match");
let ids: Vec<_> = m.iter().map(|x| x.trigger_id).collect();
assert!(
!ids.contains(&gg_trig.into()),
"the far-ancestor template (above the suppressor) must be declined"
);
assert!(
ids.contains(&h_trig.into()),
"the nearer descendant group's OWN trigger (below the suppressor) must survive"
);
// Cleanup (FK order).
let _ = sqlx::query("DELETE FROM triggers WHERE id = ANY($1)")
.bind(vec![gg_trig, h_trig])
.execute(&pool)
.await;
let _ = sqlx::query("DELETE FROM apps WHERE id = $1")
.bind(a)
.execute(&pool)
.await;
let _ = sqlx::query("DELETE FROM scripts WHERE id = ANY($1)")
.bind(vec![gg_handler, h_handler])
.execute(&pool)
.await;
let _ = sqlx::query("DELETE FROM groups WHERE id = ANY($1)")
.bind(vec![h, g, gg])
.execute(&pool)
.await;
let _ = sqlx::query("DELETE FROM admin_users WHERE id = $1")
.bind(admin)
.execute(&pool)
.await;
}

14
crates/manager-core/tests/sealed_templates.rs
View File

@@ -15,8 +15,6 @@
clippy::too_many_lines
)]
use std::collections::HashSet;
use picloud_manager_core::route_admin::compile_effective_routes;
use picloud_manager_core::route_repo::{PostgresRouteRepository, RouteRepository};
use picloud_manager_core::trigger_repo::{PostgresTriggerRepo, TriggerRepo};
@@ -111,12 +109,18 @@ async fn route_template(pool: &PgPool, group: Uuid, script: Uuid, path: &str, se
/// Whether `app`'s compiled route slice serves `path`.
async fn serves(repo: &PostgresRouteRepository, app: Uuid, path: &str) -> bool {
let effective = repo.list_effective().await.expect("list_effective");
let suppressed: HashSet<(AppId, String)> = repo
let mut suppressed: std::collections::HashMap<(AppId, String), i32> =
std::collections::HashMap::new();
for (a, p, d) in repo
.list_route_suppressions()
.await
.expect("list_route_suppressions")
.into_iter()
.collect();
{
suppressed
.entry((a, p))
.and_modify(|x| *x = (*x).min(d))
.or_insert(d);
}
compile_effective_routes(&effective, &suppressed)
.into_iter()
.any(|c| c.app_id == AppId::from(app) && format!("{:?}", c.path).contains(path))

14
crates/manager-core/tests/template_suppression.rs
View File

@@ -15,8 +15,6 @@
clippy::too_many_lines
)]
use std::collections::HashSet;
use picloud_manager_core::route_admin::compile_effective_routes;
use picloud_manager_core::route_repo::{PostgresRouteRepository, RouteRepository};
use picloud_manager_core::trigger_repo::{PostgresTriggerRepo, TriggerRepo};
@@ -65,12 +63,18 @@ async fn app_under(pool: &PgPool, slug: &str, group: Uuid) -> Uuid {
/// Whether `app`'s compiled route slice serves `/hello`.
async fn serves_hello(repo: &PostgresRouteRepository, app: Uuid) -> bool {
let effective = repo.list_effective().await.expect("list_effective");
let suppressed: HashSet<(AppId, String)> = repo
let mut suppressed: std::collections::HashMap<(AppId, String), i32> =
std::collections::HashMap::new();
for (a, p, d) in repo
.list_route_suppressions()
.await
.expect("list_route_suppressions")
.into_iter()
.collect();
{
suppressed
.entry((a, p))
.and_modify(|x| *x = (*x).min(d))
.or_insert(d);
}
compile_effective_routes(&effective, &suppressed)
.into_iter()
.any(|c| c.app_id == AppId::from(app) && format!("{:?}", c.path).contains("/hello"))