PiCloud

fabi/PiCloud

Fork 0

Commit Graph

Author	SHA1	Message	Date
MechaCat02	36272c8dac	test(groups): pin the anon + isolation gates on the queue and pubsub services `GroupQueueServiceImpl` shipped with ZERO tests; `GroupPubsubServiceImpl` had four that exercised neither boundary — its resolver always resolved and its principal was always an instance Owner (who bypasses the capability check). So on the two newest shared services, both the isolation boundary and the anonymous fail-closed gate were unpinned — and they matter most here: a shared-queue consumer is materialized into EVERY descendant app, so an unauthorized enqueue is attacker-controlled input fanned out as script execution across a whole subtree. Both now get the pair their three older siblings have: `unrelated_app_gets_collection_not_shared` (with a positive control, so a reject-everything impl can't pass it) and an anon/non-editor fail-closed test that also confirms reads (depth) stay open. Mutation-verified: swapping `script_gate_require_principal` for `script_gate` — the one-token edit that would let an unauthenticated public route enqueue into any ancestor group's shared queue — makes the anonymous enqueue succeed, and the test catches it exactly there. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-15 07:27:53 +02:00
MechaCat02	ccd3644aa4	feat(shared-queues): group-keyed queue store + enqueue service + SDK (D3.1) The producer side of shared durable queues: - migration 0065 group_queue_messages (mirrors 0034, keyed by (group_id, collection); CASCADE on group delete). - GroupQueueRepo/PostgresGroupQueueRepo: enqueue + the competing-consumer claim (FOR UPDATE SKIP LOCKED) + ack/nack/drop_exhausted/reclaim/depth. - GroupQueueService trait (shared) + GroupQueueServiceImpl: resolve owning group (kind='queue') from cx.app_id's chain, require editor+ (GroupQueueEnqueue, fails closed on anon), size-cap, enqueue. - SDK: `queue::shared_collection("name")` -> GroupQueueHandle with `.enqueue(msg[, opts])` / `.depth()` / `.depth_pending()`; wired through Services + the picloud binary. - authz: Capability::GroupQueueEnqueue(GroupId), editor+ / script:write. Deterministic test proves competing consumers claim each message exactly once. Consumption wiring (materialized consumers + dispatcher branch) lands in D3.2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-02 22:08:21 +02:00

Author

SHA1

Message

Date

MechaCat02

36272c8dac

test(groups): pin the anon + isolation gates on the queue and pubsub services

`GroupQueueServiceImpl` shipped with ZERO tests; `GroupPubsubServiceImpl` had four
that exercised neither boundary — its resolver always resolved and its principal
was always an instance Owner (who bypasses the capability check). So on the two
newest shared services, both the isolation boundary and the anonymous fail-closed
gate were unpinned — and they matter most here: a shared-queue consumer is
materialized into EVERY descendant app, so an unauthorized enqueue is
attacker-controlled input fanned out as script execution across a whole subtree.

Both now get the pair their three older siblings have:
`unrelated_app_gets_collection_not_shared` (with a positive control, so a
reject-everything impl can't pass it) and an anon/non-editor fail-closed test that
also confirms reads (depth) stay open.

Mutation-verified: swapping `script_gate_require_principal` for `script_gate` —
the one-token edit that would let an unauthenticated public route enqueue into any
ancestor group's shared queue — makes the anonymous enqueue succeed, and the test
catches it exactly there.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 07:27:53 +02:00

MechaCat02

ccd3644aa4

feat(shared-queues): group-keyed queue store + enqueue service + SDK (D3.1)

The producer side of shared durable queues:
- migration 0065 group_queue_messages (mirrors 0034, keyed by (group_id,
  collection); CASCADE on group delete).
- GroupQueueRepo/PostgresGroupQueueRepo: enqueue + the competing-consumer
  claim (FOR UPDATE SKIP LOCKED) + ack/nack/drop_exhausted/reclaim/depth.
- GroupQueueService trait (shared) + GroupQueueServiceImpl: resolve owning
  group (kind='queue') from cx.app_id's chain, require editor+
  (GroupQueueEnqueue, fails closed on anon), size-cap, enqueue.
- SDK: `queue::shared_collection("name")` -> GroupQueueHandle with
  `.enqueue(msg[, opts])` / `.depth()` / `.depth_pending()`; wired through
  Services + the picloud binary.
- authz: Capability::GroupQueueEnqueue(GroupId), editor+ / script:write.

Deterministic test proves competing consumers claim each message exactly
once. Consumption wiring (materialized consumers + dispatcher branch) lands
in D3.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-02 22:08:21 +02:00

2 Commits