fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(interceptors): harden the §9.4 slice — seal, fail-closed, re-entrancy, shared coverage

Browse Source 
An end-to-end audit of the (unmerged) interceptor slice surfaced seven ways a
KV allow/deny guard could be silently defeated or misbehave. Close all of them:

1. Shared-collection bypass — `kv::shared_collection(...).set/delete` skipped
   the hook entirely, so any `(kv, set/delete)` guard was circumvented by
   choosing the shared handle. `GroupKvHandle` now runs the same before-op hook.

2. Seal to the declaring owner — the marker resolved nearest-owner-wins but its
   script name was then re-resolved on the CALLER's chain, so a descendant app
   could shadow a group's mandatory guard with a same-named local script.
   `resolve_before` now returns the script sealed to the owner that declared the
   marker (one LEFT JOIN in manager-core), so the executor never re-resolves by
   name. A descendant can only override with its OWN explicit marker.

3. Re-entrancy — an "allow + audit-log" guard that itself wrote KV re-triggered
   itself to the depth cap and then DENIED the original write (plus ~8x
   resolve/compile/execute amplification). A thread-local guard makes a write
   performed by an interceptor bypass interception.

4. Fail-closed verdict — only `#{ allowed: false }` denied; a bare bool, a
   typo'd key, a non-bool, or a bare unit all ALLOWED. Now allow ONLY on an
   explicit `#{ allowed: true }`; every other shape denies.

5/6. Fail-closed edges — a dangling (missing/disabled) interceptor script and a
   missing engine back-reference now DENY instead of allowing.

7. AppInvoke coupling — resolution no longer routes through `invoke.resolve`, so
   installing a guard no longer denies writes to principals who hold KV-write
   but not AppInvoke.

The seam (`InterceptorService::resolve_before`) now returns an
`InterceptorResolution { None | Dangling | Run(ResolvedScript) }`; the executor
runs the sealed script straight through the shared `run_resolved_blocking` core
and drops its `InvokeService` dependency. executor-core stays Postgres-free.
No migration change (0073 unchanged).

Pinned by three new journeys in tests/interceptors.rs: the seal (a same-named
app script does NOT shadow the group's guard), shared-collection coverage, and
the fail-closed verdict. Full journey suite 157/157.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-07-13 21:20:20 +02:00
parent 2fc9476f9e
commit d08df88df5
7 changed files with 504 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

205
crates/picloud-cli/tests/interceptors.rs
View File

@@ -66,6 +66,30 @@ kv::collection("c").set("ok", 2);
#{ denied: denied }
"#;
/// A permissive guard an app might define to try to SHADOW a group's guard by
/// re-using its script name. The seal must make the group's guard win anyway.
const PERMISSIVE_GUARD: &str = r#"#{ allowed: true }"#;
/// A guard that returns a map WITHOUT an `allowed` key — a malformed verdict.
/// The fail-closed contract must treat this as a deny.
const NO_VERDICT_GUARD: &str = r#"#{ note: "forgot to return allowed" }"#;
/// A writer over a group SHARED collection (finding 1: the shared handle must
/// be intercepted too, not just `kv::collection`).
const SHARED_WRITER: &str = r#"
let denied = false;
try { kv::shared_collection("catalog").set("secret", 1); } catch(e) { denied = true; }
kv::shared_collection("catalog").set("ok", 2);
#{ denied: denied }
"#;
/// A writer that only tries a single (guarded) set.
const ANY_WRITER: &str = r#"
let denied = false;
try { kv::collection("c").set("anything", 1); } catch(e) { denied = true; }
#{ denied: denied }
"#;
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
#[test]
fn app_interceptor_denies_a_guarded_kv_write_and_allows_others() {
@@ -191,3 +215,184 @@ fn a_group_interceptor_is_inherited_by_a_descendant_app() {
"a descendant app must inherit the group's interceptor"
);
}
/// The seal (finding 2): a group's interceptor script is resolved AT THE GROUP,
/// so a descendant app cannot defeat a mandatory guard by defining a permissive
/// script of the same name. The app declares no interceptor of its own — it just
/// shadows the script name — and the group's strict guard must still win.
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
#[test]
fn a_descendant_cannot_shadow_a_group_interceptor_by_reusing_the_script_name() {
let Some(fx) = common::fixture_or_skip() else {
return;
};
let env = common::admin_env(fx);
let group = common::unique_slug("seal-grp");
let app = common::unique_slug("seal-app");
let _g = GroupGuard::new(&env.url, &env.token, &group);
common::pic_as(&env)
.args(["groups", "create", &group])
.assert()
.success();
// The group owns the strict guard + the interceptor marker.
let dir = manifest_dir();
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
fs::write(
dir.path().join("group.toml"),
format!(
"[group]\nslug = \"{group}\"\nname = \"Seal\"\n\n\
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
),
)
.unwrap();
common::pic_as(&env)
.args(["apply", "--file"])
.arg(dir.path().join("group.toml"))
.assert()
.success();
// The app under the group defines its OWN script named `guard` (permissive)
// but declares NO interceptor. The seal must keep the group's guard in force.
let _a = AppGuard::new(&env.url, &env.token, &app);
common::pic_as(&env)
.args(["apps", "create", &app, "--group", &group])
.assert()
.success();
fs::write(
dir.path().join("scripts/guard_permissive.rhai"),
PERMISSIVE_GUARD,
)
.unwrap();
fs::write(dir.path().join("scripts/writer.rhai"), WRITER).unwrap();
fs::write(
dir.path().join("app.toml"),
format!(
"[app]\nslug = \"{app}\"\nname = \"SealApp\"\n\n\
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard_permissive.rhai\"\n\n\
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n"
),
)
.unwrap();
common::pic_as(&env)
.args(["apply", "--file"])
.arg(dir.path().join("app.toml"))
.assert()
.success();
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
assert_eq!(
body,
serde_json::json!({ "denied": true }),
"the group's guard is sealed — a same-named app script must NOT shadow it"
);
}
/// Finding 1: a `(kv, set)` interceptor covers group SHARED-collection writes,
/// not just `kv::collection`. Otherwise `kv::shared_collection(...).set(...)`
/// would be a silent bypass of the guard.
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
#[test]
fn an_interceptor_guards_shared_collection_writes() {
let Some(fx) = common::fixture_or_skip() else {
return;
};
let env = common::admin_env(fx);
let group = common::unique_slug("shc-grp");
let app = common::unique_slug("shc-app");
let _g = GroupGuard::new(&env.url, &env.token, &group);
common::pic_as(&env)
.args(["groups", "create", &group])
.assert()
.success();
// The group owns a shared `catalog` collection, the guard, and the marker.
let dir = manifest_dir();
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
fs::write(
dir.path().join("group.toml"),
format!(
"[group]\nslug = \"{group}\"\nname = \"Shc\"\n\ncollections = [\"catalog\"]\n\n\
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
),
)
.unwrap();
common::pic_as(&env)
.args(["apply", "--file"])
.arg(dir.path().join("group.toml"))
.assert()
.success();
let _a = AppGuard::new(&env.url, &env.token, &app);
common::pic_as(&env)
.args(["apps", "create", &app, "--group", &group])
.assert()
.success();
fs::write(dir.path().join("scripts/shared_writer.rhai"), SHARED_WRITER).unwrap();
fs::write(
dir.path().join("app.toml"),
format!(
"[app]\nslug = \"{app}\"\nname = \"ShcApp\"\n\n\
[[scripts]]\nname = \"shared_writer\"\nfile = \"scripts/shared_writer.rhai\"\n"
),
)
.unwrap();
common::pic_as(&env)
.args(["apply", "--file"])
.arg(dir.path().join("app.toml"))
.assert()
.success();
let body = invoke_body(&env, &app_script_id(&env, &app, "shared_writer"));
assert_eq!(
body,
serde_json::json!({ "denied": true }),
"the shared-collection write of `secret` must be denied by the interceptor"
);
}
/// Finding 4: the verdict is fail-closed. An interceptor that returns a map with
/// no `allowed` key (a malformed verdict) DENIES the op — a guard must never
/// allow by omission.
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
#[test]
fn a_malformed_verdict_fails_closed() {
let Some(fx) = common::fixture_or_skip() else {
return;
};
let env = common::admin_env(fx);
let app = common::unique_slug("fc-app");
let _a = AppGuard::new(&env.url, &env.token, &app);
common::pic_as(&env)
.args(["apps", "create", &app])
.assert()
.success();
let dir = manifest_dir();
fs::write(dir.path().join("scripts/guard.rhai"), NO_VERDICT_GUARD).unwrap();
fs::write(dir.path().join("scripts/writer.rhai"), ANY_WRITER).unwrap();
fs::write(
dir.path().join("picloud.toml"),
format!(
"[app]\nslug = \"{app}\"\nname = \"FC\"\n\n\
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
),
)
.unwrap();
common::pic_as(&env)
.args(["apply", "--file"])
.arg(dir.path().join("picloud.toml"))
.assert()
.success();
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
assert_eq!(
body,
serde_json::json!({ "denied": true }),
"a verdict map with no `allowed` key must fail closed (deny)"
);
}