ef16d48a8c
Every non-KV mutating op now runs the same before/after interceptor machinery: - docs create/update/delete (+ group) — create/update honor the M4 data transform; - files create/update/delete (+ group) — allow/deny only (the blob is never surfaced to the hook, value = None); - queue enqueue (+ shared) — transform-capable; after reports the message id; - pubsub publish_durable (+ shared topic) — transform-capable; - http request — all verbs funnel through two svc.request sites; collection = method, key = url, body not surfaced. ictx threaded into the free-fn/handle paths that lacked it (http was _ictx; queue/pubsub per-app publish). validate_bundle_for generalized to a per-service allowed-ops map (kv set/delete; docs/files create/update/delete; queue enqueue; pubsub publish; http request) — unknown service/op still rejected. INVARIANT enforced + verified: every allowed (service, op) has a matching runtime hook, so no validated-but-unhooked fail-open. Pinned by a new docs-create deny journey (11 interceptor journeys green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
875 lines
31 KiB
Rust
875 lines
31 KiB
Rust
//! §9.4 Service Interceptors, end to end via `pic` — the KV allow/deny slice.
|
|
//!
|
|
//! A `[[interceptors]]` marker binds a script to run BEFORE `kv::set`/`delete`.
|
|
//! The interceptor reads the operation context (`ctx.request.body` — service,
|
|
//! action, collection, key, value) and returns `#{ allowed: bool, reason }`; a
|
|
//! `false` denies the op (the write never happens, the caller gets an error).
|
|
//! A group's interceptor is inherited by a descendant app; from §9.4 M2 the
|
|
//! `before` markers on the chain run as an ORDERED CHAIN (ancestor→app), so a
|
|
//! group guard and an app guard both run — a single deny short-circuits.
|
|
|
|
use std::fs;
|
|
|
|
use tempfile::TempDir;
|
|
|
|
use crate::common;
|
|
use crate::common::cleanup::{AppGuard, GroupGuard};
|
|
|
|
fn manifest_dir() -> TempDir {
|
|
let dir = TempDir::new().expect("tempdir");
|
|
fs::create_dir_all(dir.path().join("scripts")).expect("scripts dir");
|
|
dir
|
|
}
|
|
|
|
fn app_script_id(env: &common::TestEnv, app: &str, name: &str) -> String {
|
|
let ls = common::pic_as(env)
|
|
.args(["scripts", "ls", "--app", app])
|
|
.output()
|
|
.expect("scripts ls");
|
|
let table = String::from_utf8(ls.stdout).unwrap();
|
|
table
|
|
.lines()
|
|
.map(common::cells)
|
|
.find(|c| c.get(2) == Some(&name))
|
|
.and_then(|c| c.first().map(|s| (*s).to_string()))
|
|
.unwrap_or_else(|| panic!("script `{name}` not found:\n{table}"))
|
|
}
|
|
|
|
fn invoke_body(env: &common::TestEnv, id: &str) -> serde_json::Value {
|
|
let out = common::pic_as(env)
|
|
.args(["scripts", "invoke", id])
|
|
.output()
|
|
.expect("scripts invoke");
|
|
assert!(
|
|
out.status.success(),
|
|
"invoke failed: {}",
|
|
String::from_utf8_lossy(&out.stderr)
|
|
);
|
|
serde_json::from_slice(&out.stdout).expect("invoke body is JSON")
|
|
}
|
|
|
|
/// A guard that denies a `kv::set` of the key `"secret"` and allows everything
|
|
/// else, reading the op context from `ctx.request.body`.
|
|
const GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "set" && op.key == "secret" {
|
|
#{ allowed: false, reason: "the `secret` key is protected" }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// A writer that tries a denied set (caught), then a permitted set.
|
|
const WRITER: &str = r#"
|
|
let denied = false;
|
|
try { kv::collection("c").set("secret", 1); } catch(e) { denied = true; }
|
|
kv::collection("c").set("ok", 2);
|
|
#{ denied: denied }
|
|
"#;
|
|
|
|
/// A permissive guard an app might define to try to SHADOW a group's guard by
|
|
/// re-using its script name. The seal must make the group's guard win anyway.
|
|
const PERMISSIVE_GUARD: &str = r#"#{ allowed: true }"#;
|
|
|
|
/// A guard that returns a map WITHOUT an `allowed` key — a malformed verdict.
|
|
/// The fail-closed contract must treat this as a deny.
|
|
const NO_VERDICT_GUARD: &str = r#"#{ note: "forgot to return allowed" }"#;
|
|
|
|
/// A writer over a group SHARED collection (finding 1: the shared handle must
|
|
/// be intercepted too, not just `kv::collection`).
|
|
const SHARED_WRITER: &str = r#"
|
|
let denied = false;
|
|
try { kv::shared_collection("catalog").set("secret", 1); } catch(e) { denied = true; }
|
|
kv::shared_collection("catalog").set("ok", 2);
|
|
#{ denied: denied }
|
|
"#;
|
|
|
|
/// A writer that only tries a single (guarded) set.
|
|
const ANY_WRITER: &str = r#"
|
|
let denied = false;
|
|
try { kv::collection("c").set("anything", 1); } catch(e) { denied = true; }
|
|
#{ denied: denied }
|
|
"#;
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn app_interceptor_denies_a_guarded_kv_write_and_allows_others() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("ic-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
// One apply deploys the guard + writer scripts AND registers the marker.
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"IC\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// The writer's guarded set is denied (caught), the permitted set goes through.
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"the `secret` set must be denied by the interceptor"
|
|
);
|
|
|
|
// `ok` was written; `secret` was not (the write never ran).
|
|
let ok = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["kv", "get", "--app", &app, "--collection", "c", "ok"])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(ok.contains('2'), "the allowed write must persist:\n{ok}");
|
|
let secret = common::pic_as(&env)
|
|
.args(["kv", "get", "--app", &app, "--collection", "c", "secret"])
|
|
.output()
|
|
.unwrap();
|
|
let secret_out = String::from_utf8_lossy(&secret.stdout);
|
|
assert!(
|
|
secret_out.trim() == "null" || secret_out.trim() == "()" || secret_out.trim().is_empty(),
|
|
"the denied write must NOT persist, got: {secret_out}"
|
|
);
|
|
}
|
|
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_group_interceptor_is_inherited_by_a_descendant_app() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let group = common::unique_slug("icg-grp");
|
|
let app = common::unique_slug("icg-app");
|
|
let _g = GroupGuard::new(&env.url, &env.token, &group);
|
|
common::pic_as(&env)
|
|
.args(["groups", "create", &group])
|
|
.assert()
|
|
.success();
|
|
|
|
// The GROUP owns the guard script + the interceptor marker.
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
|
|
fs::write(
|
|
dir.path().join("group.toml"),
|
|
format!(
|
|
"[group]\nslug = \"{group}\"\nname = \"ICG\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("group.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// An app UNDER the group inherits the interceptor (nearest-owner-wins), even
|
|
// though the marker + guard live on the group.
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app, "--group", &group])
|
|
.assert()
|
|
.success();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("app.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"ICApp\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("app.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"a descendant app must inherit the group's interceptor"
|
|
);
|
|
}
|
|
|
|
/// The seal (finding 2): a group's interceptor script is resolved AT THE GROUP,
|
|
/// so a descendant app cannot defeat a mandatory guard by defining a permissive
|
|
/// script of the same name. The app declares no interceptor of its own — it just
|
|
/// shadows the script name — and the group's strict guard must still win.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_descendant_cannot_shadow_a_group_interceptor_by_reusing_the_script_name() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let group = common::unique_slug("seal-grp");
|
|
let app = common::unique_slug("seal-app");
|
|
let _g = GroupGuard::new(&env.url, &env.token, &group);
|
|
common::pic_as(&env)
|
|
.args(["groups", "create", &group])
|
|
.assert()
|
|
.success();
|
|
|
|
// The group owns the strict guard + the interceptor marker.
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
|
|
fs::write(
|
|
dir.path().join("group.toml"),
|
|
format!(
|
|
"[group]\nslug = \"{group}\"\nname = \"Seal\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("group.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// The app under the group defines its OWN script named `guard` (permissive)
|
|
// but declares NO interceptor. The seal must keep the group's guard in force.
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app, "--group", &group])
|
|
.assert()
|
|
.success();
|
|
fs::write(
|
|
dir.path().join("scripts/guard_permissive.rhai"),
|
|
PERMISSIVE_GUARD,
|
|
)
|
|
.unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("app.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"SealApp\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard_permissive.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("app.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"the group's guard is sealed — a same-named app script must NOT shadow it"
|
|
);
|
|
}
|
|
|
|
/// Finding 1: a `(kv, set)` interceptor covers group SHARED-collection writes,
|
|
/// not just `kv::collection`. Otherwise `kv::shared_collection(...).set(...)`
|
|
/// would be a silent bypass of the guard.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn an_interceptor_guards_shared_collection_writes() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let group = common::unique_slug("shc-grp");
|
|
let app = common::unique_slug("shc-app");
|
|
let _g = GroupGuard::new(&env.url, &env.token, &group);
|
|
common::pic_as(&env)
|
|
.args(["groups", "create", &group])
|
|
.assert()
|
|
.success();
|
|
|
|
// The group owns a shared `catalog` collection, the guard, and the marker.
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), GUARD).unwrap();
|
|
fs::write(
|
|
dir.path().join("group.toml"),
|
|
format!(
|
|
"[group]\nslug = \"{group}\"\nname = \"Shc\"\n\ncollections = [\"catalog\"]\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("group.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app, "--group", &group])
|
|
.assert()
|
|
.success();
|
|
fs::write(dir.path().join("scripts/shared_writer.rhai"), SHARED_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("app.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"ShcApp\"\n\n\
|
|
[[scripts]]\nname = \"shared_writer\"\nfile = \"scripts/shared_writer.rhai\"\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("app.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "shared_writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"the shared-collection write of `secret` must be denied by the interceptor"
|
|
);
|
|
}
|
|
|
|
/// Finding 4: the verdict is fail-closed. An interceptor that returns a map with
|
|
/// no `allowed` key (a malformed verdict) DENIES the op — a guard must never
|
|
/// allow by omission.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_malformed_verdict_fails_closed() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("fc-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), NO_VERDICT_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), ANY_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"FC\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"a verdict map with no `allowed` key must fail closed (deny)"
|
|
);
|
|
}
|
|
|
|
// --- §9.4 M8: docs (a representative non-KV service) -----------------------
|
|
|
|
/// A `(docs, create)` guard that denies creating a doc whose `data.kind` is
|
|
/// `"secret"`, reading the written value from `ctx.request.body.value`. Proves a
|
|
/// non-KV service funnels through the same before/after machinery and that the
|
|
/// created document's data is surfaced to the hook.
|
|
const DOCS_GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "create" && op.value.kind == "secret" {
|
|
#{ allowed: false, reason: "secret docs are protected" }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// A writer that tries a denied `docs::create` (caught), then a permitted one,
|
|
/// and reports how many docs actually landed in the collection.
|
|
const DOCS_WRITER: &str = r#"
|
|
let denied = false;
|
|
try { docs::collection("c").create(#{ kind: "secret", n: 1 }); } catch(e) { denied = true; }
|
|
docs::collection("c").create(#{ kind: "public", n: 2 });
|
|
let all = docs::collection("c").find(#{});
|
|
#{ denied: denied, count: all.len() }
|
|
"#;
|
|
|
|
/// §9.4 M8: `[[interceptors]] service = "docs" ops = ["create"]` guards
|
|
/// `docs::collection(...).create(...)` through the same before/after machinery
|
|
/// as KV — a guarded shape is denied (the doc is never created), an unguarded
|
|
/// one is allowed.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn an_interceptor_guards_docs_create() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("icd-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), DOCS_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), DOCS_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"ICD\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nservice = \"docs\"\nops = [\"create\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// The guarded (secret) create is denied; the public one lands — so exactly
|
|
// one doc exists in the collection.
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true, "count": 1 }),
|
|
"the `secret` docs::create must be denied; only the public doc is created"
|
|
);
|
|
}
|
|
|
|
// --- §9.4 M2: ordered before-chain + cycle guard --------------------------
|
|
|
|
/// A group before-interceptor that denies only `kv::set` of key `"group-key"`.
|
|
const GROUP_CHAIN_GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "set" && op.key == "group-key" {
|
|
#{ allowed: false, reason: "group guard" }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// An app before-interceptor that denies only `kv::set` of key `"app-key"`.
|
|
const APP_CHAIN_GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "set" && op.key == "app-key" {
|
|
#{ allowed: false, reason: "app guard" }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// A writer that probes all three keys: the group-guarded one, the app-guarded
|
|
/// one, and a free key. Proves BOTH chain entries run (ancestor→app).
|
|
const CHAIN_WRITER: &str = r#"
|
|
let g = false;
|
|
let a = false;
|
|
let free = false;
|
|
try { kv::collection("c").set("group-key", 1); } catch(e) { g = true; }
|
|
try { kv::collection("c").set("app-key", 1); } catch(e) { a = true; }
|
|
try { kv::collection("c").set("free", 1); free = true; } catch(e) {}
|
|
#{ group_denied: g, app_denied: a, free_ok: free }
|
|
"#;
|
|
|
|
/// M2: a group AND a descendant app each declare a `(kv, set)` before
|
|
/// interceptor. Both run in one write path, ordered ancestor→app: the group's
|
|
/// guard denies its key, the app's guard denies its key, and a key neither
|
|
/// guards passes — so BOTH chain entries demonstrably execute (a group denial
|
|
/// cannot be bypassed by a descendant, and the app adds its own on top).
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_before_chain_runs_group_then_app_interceptors_in_order() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let group = common::unique_slug("chain-grp");
|
|
let app = common::unique_slug("chain-app");
|
|
let _g = GroupGuard::new(&env.url, &env.token, &group);
|
|
common::pic_as(&env)
|
|
.args(["groups", "create", &group])
|
|
.assert()
|
|
.success();
|
|
|
|
// The group owns its guard + marker.
|
|
let dir = manifest_dir();
|
|
fs::write(
|
|
dir.path().join("scripts/group_guard.rhai"),
|
|
GROUP_CHAIN_GUARD,
|
|
)
|
|
.unwrap();
|
|
fs::write(
|
|
dir.path().join("group.toml"),
|
|
format!(
|
|
"[group]\nslug = \"{group}\"\nname = \"Chain\"\n\n\
|
|
[[scripts]]\nname = \"group_guard\"\nfile = \"scripts/group_guard.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"group_guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("group.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// The app under the group owns its OWN guard + marker + writer.
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app, "--group", &group])
|
|
.assert()
|
|
.success();
|
|
fs::write(dir.path().join("scripts/app_guard.rhai"), APP_CHAIN_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), CHAIN_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("app.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"ChainApp\"\n\n\
|
|
[[scripts]]\nname = \"app_guard\"\nfile = \"scripts/app_guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"app_guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("app.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "group_denied": true, "app_denied": true, "free_ok": true }),
|
|
"both the group's and the app's before interceptors must run (ancestor→app)"
|
|
);
|
|
}
|
|
|
|
/// A self-referential interceptor: the `(kv, set)` guard itself performs a
|
|
/// `kv::set` (the very op it guards) before allowing. Without a re-entry break
|
|
/// that nested write would re-resolve to this same interceptor and recurse
|
|
/// forever. The RE-ENTRANCY guard catches it — writes performed BY an
|
|
/// interceptor bypass interception — so the audit write lands and the original
|
|
/// write proceeds, with no recursion and no deny.
|
|
const SELF_REF_GUARD: &str = r#"
|
|
kv::collection("audit").set("seen", ctx.request.body.key);
|
|
#{ allowed: true }
|
|
"#;
|
|
|
|
/// A writer whose single guarded set triggers the self-referential guard.
|
|
const SELF_REF_WRITER: &str = r#"
|
|
kv::collection("c").set("x", 1);
|
|
#{ done: true }
|
|
"#;
|
|
|
|
/// M2 (cycle safety): a self-referential interceptor completes cleanly rather
|
|
/// than recursing. Documented outcome — the RE-ENTRANCY guard is what catches
|
|
/// it here (the interceptor's own guarded write bypasses interception, so
|
|
/// `run_before` is never re-entered and the identity cycle guard is never
|
|
/// reached). The observable result: the writer finishes, both the audit write
|
|
/// and the original write persist.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_self_referential_interceptor_does_not_recurse() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("selfref-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), SELF_REF_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), SELF_REF_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"SelfRef\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// No recursion / depth error: the writer completes and returns its map.
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "done": true }),
|
|
"the self-referential interceptor must complete without recursing"
|
|
);
|
|
|
|
// Both writes landed: the interceptor's audit write (bypassed interception)
|
|
// and the original guarded write.
|
|
let seen = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["kv", "get", "--app", &app, "--collection", "audit", "seen"])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(
|
|
seen.contains('x'),
|
|
"the interceptor's own write must persist (re-entrancy bypass):\n{seen}"
|
|
);
|
|
let x = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["kv", "get", "--app", &app, "--collection", "c", "x"])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(x.contains('1'), "the original write must persist:\n{x}");
|
|
}
|
|
|
|
// --- §9.4 M4: data transform (before) -------------------------------------
|
|
|
|
/// A before-interceptor that REWRITES the written value via `data` for the key
|
|
/// `"doc"` (allow + transform), passing everything else through unchanged.
|
|
const TRANSFORM_GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "set" && op.key == "doc" {
|
|
#{ allowed: true, data: #{ redacted: true } }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// A writer that sets `doc` to a raw value and reads back what was stored.
|
|
const TRANSFORM_WRITER: &str = r#"
|
|
kv::collection("c").set("doc", #{ secret: "raw" });
|
|
kv::collection("c").get("doc")
|
|
"#;
|
|
|
|
/// M4: a before-interceptor that returns `#{ allowed: true, data: ... }` rewrites
|
|
/// the value actually written — the store holds the transform, not the original.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_before_interceptor_transforms_the_written_value() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("xf-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), TRANSFORM_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), TRANSFORM_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"XF\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
// The writer reads back the STORED value — it must be the transform.
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "redacted": true }),
|
|
"the stored value must be the interceptor's `data` transform, not the original"
|
|
);
|
|
}
|
|
|
|
// --- §9.4 M3: after-hooks --------------------------------------------------
|
|
|
|
/// An AFTER-interceptor on `delete` that reads the write's outcome
|
|
/// (`op.result`, the was-present bool) and DENIES when a key was actually
|
|
/// removed. It cannot roll the delete back (the write already committed) — the
|
|
/// deny only surfaces as an error to the caller.
|
|
const AFTER_DELETE_GUARD: &str = r#"
|
|
let op = ctx.request.body;
|
|
if op.action == "delete" && op.result == true {
|
|
#{ allowed: false, reason: "an existing key was deleted" }
|
|
} else {
|
|
#{ allowed: true }
|
|
}
|
|
"#;
|
|
|
|
/// A writer that seeds a key, deletes it (triggering the after-hook), then
|
|
/// checks whether the key survived.
|
|
const AFTER_DELETE_WRITER: &str = r#"
|
|
kv::collection("c").set("k", 1);
|
|
let after_denied = false;
|
|
try { kv::collection("c").delete("k"); } catch(e) { after_denied = true; }
|
|
let still = kv::collection("c").has("k");
|
|
#{ after_denied: after_denied, still: still }
|
|
"#;
|
|
|
|
/// M3: an after-hook runs with the write's `result` in its payload, can DENY
|
|
/// (surfacing an error to the caller), but CANNOT roll the write back. The
|
|
/// delete's `result` (was-present = true) drives the deny, and the key is gone
|
|
/// afterwards despite the error.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn an_after_hook_sees_the_result_and_cannot_roll_back() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("after-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), AFTER_DELETE_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), AFTER_DELETE_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"After\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"delete\"]\nphase = \"after\"\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "after_denied": true, "still": false }),
|
|
"the after-hook must see result==true and deny, but the delete must have persisted"
|
|
);
|
|
}
|
|
|
|
// --- §9.4 M5: per-interceptor timeout -------------------------------------
|
|
|
|
/// A guard that never returns — it must be interrupted by its per-hook timeout
|
|
/// rather than hanging the guarded write.
|
|
const SLOW_GUARD: &str = r#"
|
|
loop {}
|
|
"#;
|
|
|
|
/// A writer whose single guarded set triggers the runaway guard.
|
|
const SLOW_WRITER: &str = r#"
|
|
let denied = false;
|
|
try { kv::collection("c").set("k", 1); } catch(e) { denied = true; }
|
|
#{ denied: denied }
|
|
"#;
|
|
|
|
/// M5: a `timeout_ms` on the marker bounds the hook — a runaway `loop {}` guard
|
|
/// is interrupted and the op is DENIED (fail closed) within the budget, rather
|
|
/// than hanging the write path. The write must not persist.
|
|
#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
|
|
#[test]
|
|
fn a_runaway_interceptor_is_denied_by_its_timeout() {
|
|
let Some(fx) = common::fixture_or_skip() else {
|
|
return;
|
|
};
|
|
let env = common::admin_env(fx);
|
|
let app = common::unique_slug("to-app");
|
|
let _a = AppGuard::new(&env.url, &env.token, &app);
|
|
common::pic_as(&env)
|
|
.args(["apps", "create", &app])
|
|
.assert()
|
|
.success();
|
|
|
|
let dir = manifest_dir();
|
|
fs::write(dir.path().join("scripts/guard.rhai"), SLOW_GUARD).unwrap();
|
|
fs::write(dir.path().join("scripts/writer.rhai"), SLOW_WRITER).unwrap();
|
|
fs::write(
|
|
dir.path().join("picloud.toml"),
|
|
format!(
|
|
"[app]\nslug = \"{app}\"\nname = \"TO\"\n\n\
|
|
[[scripts]]\nname = \"guard\"\nfile = \"scripts/guard.rhai\"\n\n\
|
|
[[scripts]]\nname = \"writer\"\nfile = \"scripts/writer.rhai\"\n\n\
|
|
[[interceptors]]\nscript = \"guard\"\nops = [\"set\"]\ntimeout_ms = 100\n"
|
|
),
|
|
)
|
|
.unwrap();
|
|
common::pic_as(&env)
|
|
.args(["apply", "--file"])
|
|
.arg(dir.path().join("picloud.toml"))
|
|
.assert()
|
|
.success();
|
|
|
|
let body = invoke_body(&env, &app_script_id(&env, &app, "writer"));
|
|
assert_eq!(
|
|
body,
|
|
serde_json::json!({ "denied": true }),
|
|
"a runaway interceptor must be timed out and the op denied (fail closed)"
|
|
);
|
|
|
|
// The write must not have landed.
|
|
let k = String::from_utf8(
|
|
common::pic_as(&env)
|
|
.args(["kv", "get", "--app", &app, "--collection", "c", "k"])
|
|
.output()
|
|
.unwrap()
|
|
.stdout,
|
|
)
|
|
.unwrap();
|
|
assert!(
|
|
k.trim() == "null" || k.trim() == "()" || k.trim().is_empty(),
|
|
"the timed-out write must NOT persist, got: {k}"
|
|
);
|
|
}
|