| 1 | package attachment |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "context" |
| 6 | "crypto/sha256" |
| 7 | "encoding/base64" |
| 8 | "encoding/hex" |
| 9 | "encoding/json" |
| 10 | "image" |
| 11 | "image/color" |
| 12 | "image/png" |
| 13 | "os" |
| 14 | "path/filepath" |
| 15 | "strings" |
| 16 | "sync" |
| 17 | "testing" |
| 18 | |
| 19 | "reasonix/internal/sessioncontent" |
| 20 | ) |
| 21 | |
| 22 | func TestPrepareAndCommitRoundTrip(t *testing.T) { |
| 23 | svc := testService(t) |
| 24 | raw := opaquePNG(t, 8, 8) |
| 25 | prepared, err := svc.PrepareBatch(t.Context(), []Source{{DisplayName: "shot.png", Bytes: raw, DeclaredMIME: "image/png"}}) |
| 26 | if err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | refs, err := svc.CommitBatch(t.Context(), prepared) |
| 30 | if err != nil { |
| 31 | t.Fatal(err) |
| 32 | } |
| 33 | if len(refs) != 1 || refs[0].Width != 8 || refs[0].MIME() != "image/png" { |
| 34 | t.Fatalf("refs = %+v", refs) |
| 35 | } |
| 36 | got, err := svc.ReadVerified(t.Context(), refs[0]) |
| 37 | if err != nil { |
| 38 | t.Fatal(err) |
| 39 | } |
| 40 | if !bytes.Equal(got, raw) { |
| 41 | t.Fatal("persisted bytes diverged from the original") |
| 42 | } |
| 43 | sum := sha256.Sum256(raw) |
| 44 | if refs[0].Content.Digest != hex.EncodeToString(sum[:]) { |
| 45 | t.Fatal("object identity is not the original digest") |
| 46 | } |
| 47 | } |
| 48 | |
| 49 | func TestPrepareBatchRejectsPartialFailure(t *testing.T) { |
| 50 | svc := testService(t) |
| 51 | _, err := svc.PrepareBatch(t.Context(), []Source{ |
| 52 | {DisplayName: "ok.png", Bytes: opaquePNG(t, 2, 2)}, |
| 53 | {DisplayName: "bad.bin", Bytes: []byte("not-an-image")}, |
| 54 | }) |
| 55 | if !Is(err, CodeUnsupported) { |
| 56 | t.Fatalf("err = %v", err) |
| 57 | } |
| 58 | } |
| 59 | |
| 60 | func TestPrepareBatchRejectsDeclaredMIMEMismatch(t *testing.T) { |
| 61 | svc := testService(t) |
| 62 | _, err := svc.PrepareBatch(t.Context(), []Source{{ |
| 63 | DisplayName: "spoof.png", Bytes: opaquePNG(t, 2, 2), DeclaredMIME: "image/jpeg", |
| 64 | }}) |
| 65 | if !Is(err, CodeUnsupported) { |
| 66 | t.Fatalf("err = %v", err) |
| 67 | } |
| 68 | } |
| 69 | |
| 70 | func TestPrepareBatchUsesWorkspaceRootNotProcessCWD(t *testing.T) { |
| 71 | svc := testService(t) |
| 72 | cwd := t.TempDir() |
| 73 | workspace := t.TempDir() |
| 74 | original, err := os.Getwd() |
| 75 | if err != nil { |
| 76 | t.Fatal(err) |
| 77 | } |
| 78 | if err := os.Chdir(cwd); err != nil { |
| 79 | t.Fatal(err) |
| 80 | } |
| 81 | t.Cleanup(func() { _ = os.Chdir(original) }) |
| 82 | if err := os.WriteFile(filepath.Join(cwd, "same.png"), opaquePNG(t, 2, 2), 0o600); err != nil { |
| 83 | t.Fatal(err) |
| 84 | } |
| 85 | want := opaquePNG(t, 4, 4) |
| 86 | if err := os.WriteFile(filepath.Join(workspace, "same.png"), want, 0o600); err != nil { |
| 87 | t.Fatal(err) |
| 88 | } |
| 89 | prepared, err := svc.PrepareBatch(t.Context(), []Source{{Path: "same.png", WorkspaceRoot: workspace}}) |
| 90 | if err != nil { |
| 91 | t.Fatal(err) |
| 92 | } |
| 93 | if !bytes.Equal(prepared.Items[0].Bytes, want) || prepared.Items[0].Width != 4 { |
| 94 | t.Fatal("prepared the process-directory image") |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | func TestPrepareBatchRejectsSymlinkAndChangedFile(t *testing.T) { |
| 99 | svc := testService(t) |
| 100 | root := t.TempDir() |
| 101 | target := filepath.Join(root, "real.png") |
| 102 | if err := os.WriteFile(target, opaquePNG(t, 2, 2), 0o600); err != nil { |
| 103 | t.Fatal(err) |
| 104 | } |
| 105 | link := filepath.Join(root, "link.png") |
| 106 | if err := os.Symlink(target, link); err != nil { |
| 107 | t.Fatal(err) |
| 108 | } |
| 109 | if _, err := svc.PrepareBatch(t.Context(), []Source{{Path: link}}); !Is(err, CodeUnsafe) { |
| 110 | t.Fatalf("symlink err = %v", err) |
| 111 | } |
| 112 | |
| 113 | path := filepath.Join(root, "changing.png") |
| 114 | if err := os.WriteFile(path, opaquePNG(t, 2, 2), 0o600); err != nil { |
| 115 | t.Fatal(err) |
| 116 | } |
| 117 | src := Source{Path: path} |
| 118 | raw, err := src.loadBytes(DefaultPolicy()) |
| 119 | if err != nil { |
| 120 | t.Fatal(err) |
| 121 | } |
| 122 | if len(raw) == 0 { |
| 123 | t.Fatal("expected bytes") |
| 124 | } |
| 125 | } |
| 126 | |
| 127 | func TestCommitDoesNotReturnPartialRefs(t *testing.T) { |
| 128 | svc := NewService(nil, nil) |
| 129 | _, err := svc.CommitBatch(t.Context(), PreparedImages{Items: []PreparedImage{{DisplayName: "a", Bytes: opaquePNG(t, 2, 2)}}}) |
| 130 | if err == nil { |
| 131 | t.Fatal("expected store failure") |
| 132 | } |
| 133 | } |
| 134 | |
| 135 | func TestDraftsCannotBeGuessedByDigest(t *testing.T) { |
| 136 | svc := testService(t) |
| 137 | prepared, err := svc.PrepareBatch(t.Context(), []Source{{Bytes: opaquePNG(t, 2, 2)}}) |
| 138 | if err != nil { |
| 139 | t.Fatal(err) |
| 140 | } |
| 141 | refs, err := svc.CommitBatch(t.Context(), prepared) |
| 142 | if err != nil { |
| 143 | t.Fatal(err) |
| 144 | } |
| 145 | draft := svc.Drafts().Issue("session-a", refs[0]) |
| 146 | if _, ok := svc.Drafts().Lookup("session-b", draft.ID); ok { |
| 147 | t.Fatal("draft leaked across scopes") |
| 148 | } |
| 149 | if _, ok := svc.Drafts().Lookup("session-a", refs[0].Content.Digest); ok { |
| 150 | t.Fatal("digest acted as a draft credential") |
| 151 | } |
| 152 | got, err := svc.Drafts().Resolve("session-a", []string{draft.ID}) |
| 153 | if err != nil || got[0].Content.Digest != refs[0].Content.Digest { |
| 154 | t.Fatalf("resolve = %v %v", got, err) |
| 155 | } |
| 156 | svc.Drafts().Release("session-a", draft.ID) |
| 157 | if _, err := svc.Drafts().Resolve("session-a", []string{draft.ID}); !Is(err, CodeMissing) { |
| 158 | t.Fatalf("released draft err = %v", err) |
| 159 | } |
| 160 | } |
| 161 | |
| 162 | func TestPrepareVariantIsDeterministicAndRebuildsAfterEviction(t *testing.T) { |
| 163 | svc := testService(t) |
| 164 | raw := opaquePNG(t, 2000, 100) |
| 165 | prepared, err := svc.PrepareBatch(t.Context(), []Source{{Bytes: raw}}) |
| 166 | if err != nil { |
| 167 | t.Fatal(err) |
| 168 | } |
| 169 | refs, err := svc.CommitBatch(t.Context(), prepared) |
| 170 | if err != nil { |
| 171 | t.Fatal(err) |
| 172 | } |
| 173 | first, err := svc.PrepareVariant(t.Context(), refs[0], VariantPolicyV1) |
| 174 | if err != nil { |
| 175 | t.Fatal(err) |
| 176 | } |
| 177 | if first.Width != VariantMaxDim || first.MIME != "image/png" { |
| 178 | t.Fatalf("variant = %+v", first) |
| 179 | } |
| 180 | second, err := svc.PrepareVariant(t.Context(), refs[0], VariantPolicyV1) |
| 181 | if err != nil { |
| 182 | t.Fatal(err) |
| 183 | } |
| 184 | if !bytes.Equal(first.Bytes, second.Bytes) || first.Digest != second.Digest { |
| 185 | t.Fatal("variant bytes were not stable") |
| 186 | } |
| 187 | svc.Cache().remove(variantKey{digest: refs[0].Content.Digest, version: VariantPolicyV1, width: first.Width, height: first.Height, format: "png"}) |
| 188 | rebuilt, err := svc.PrepareVariant(t.Context(), refs[0], VariantPolicyV1) |
| 189 | if err != nil { |
| 190 | t.Fatal(err) |
| 191 | } |
| 192 | if !bytes.Equal(first.Bytes, rebuilt.Bytes) { |
| 193 | t.Fatal("rebuilt variant diverged") |
| 194 | } |
| 195 | } |
| 196 | |
| 197 | func TestPrepareVariantCacheHitProbesAndReplacementRevalidatesOriginal(t *testing.T) { |
| 198 | svc := testService(t) |
| 199 | raw := opaquePNG(t, 2000, 100) |
| 200 | prepared, err := svc.PrepareBatch(t.Context(), []Source{{DisplayName: "original.png", Bytes: raw}}) |
| 201 | if err != nil { |
| 202 | t.Fatal(err) |
| 203 | } |
| 204 | refs, err := svc.CommitBatch(t.Context(), prepared) |
| 205 | if err != nil { |
| 206 | t.Fatal(err) |
| 207 | } |
| 208 | ref := refs[0] |
| 209 | if _, err = svc.PrepareVariant(t.Context(), ref, VariantPolicyV1); err != nil { |
| 210 | t.Fatal(err) |
| 211 | } |
| 212 | objectPath := filepath.Join(svc.Store().Root(), "objects", ref.Content.Digest[:2], ref.Content.Digest[2:4], ref.Content.Digest) |
| 213 | backup := objectPath + ".verified" |
| 214 | if err = os.Rename(objectPath, backup); err != nil { |
| 215 | t.Fatal(err) |
| 216 | } |
| 217 | if _, err = svc.PrepareVariant(t.Context(), ref, VariantPolicyV1); err == nil { |
| 218 | t.Fatal("cache hit bypassed the bounded original-object probe") |
| 219 | } |
| 220 | corrupt := bytes.Repeat([]byte{'x'}, len(raw)) |
| 221 | if err = os.WriteFile(objectPath, corrupt, 0600); err != nil { |
| 222 | t.Fatal(err) |
| 223 | } |
| 224 | if _, err = svc.PrepareVariant(t.Context(), ref, VariantPolicyV1); err == nil { |
| 225 | t.Fatal("replacement object reused a variant without full validation") |
| 226 | } |
| 227 | if err = os.Remove(objectPath); err != nil { |
| 228 | t.Fatal(err) |
| 229 | } |
| 230 | if err = os.Rename(backup, objectPath); err != nil { |
| 231 | t.Fatal(err) |
| 232 | } |
| 233 | if _, err = svc.PrepareVariant(t.Context(), ref, VariantPolicyV1); err != nil { |
| 234 | t.Fatalf("restored original did not rebuild the variant: %v", err) |
| 235 | } |
| 236 | } |
| 237 | |
| 238 | func TestVariantCancelIsolatesWaiters(t *testing.T) { |
| 239 | cache := NewVariantCache(DefaultCacheBytes, 1) |
| 240 | raw := opaquePNG(t, 1800, 1800) |
| 241 | ref := AttachmentRef{Version: RefVersion, Content: sessioncontent.Ref{Digest: strings.Repeat("a", 64), Bytes: int64(len(raw)), MediaType: "image/png"}, Width: 1800, Height: 1800} |
| 242 | ctx, cancel := context.WithCancel(t.Context()) |
| 243 | var wg sync.WaitGroup |
| 244 | wg.Add(2) |
| 245 | var canceled, succeeded error |
| 246 | go func() { |
| 247 | defer wg.Done() |
| 248 | _, canceled = cache.Prepare(ctx, ref, raw, VariantPolicyV1) |
| 249 | }() |
| 250 | go func() { |
| 251 | defer wg.Done() |
| 252 | _, succeeded = cache.Prepare(t.Context(), ref, raw, VariantPolicyV1) |
| 253 | }() |
| 254 | cancel() |
| 255 | wg.Wait() |
| 256 | if canceled == nil || !Is(canceled, CodeCanceled) { |
| 257 | t.Fatalf("canceled waiter err = %v", canceled) |
| 258 | } |
| 259 | if succeeded != nil { |
| 260 | t.Fatalf("remaining waiter err = %v", succeeded) |
| 261 | } |
| 262 | } |
| 263 | |
| 264 | func TestCollectJSONRefsFindsNestedAttachments(t *testing.T) { |
| 265 | ref := sessioncontent.Ref{Digest: strings.Repeat("ab", 32), Bytes: 12, IndexDigest: strings.Repeat("cd", 32)} |
| 266 | payload := jsonMarshal(map[string]any{ |
| 267 | "message": map[string]any{ |
| 268 | "image_inputs": []any{map[string]any{ |
| 269 | "kind": "attachment", |
| 270 | "attachment": map[string]any{ |
| 271 | "v": 1, |
| 272 | "content": map[string]any{"digest": ref.Digest, "bytes": ref.Bytes, "indexDigest": ref.IndexDigest}, |
| 273 | }, |
| 274 | }}, |
| 275 | }, |
| 276 | }) |
| 277 | got := CollectJSONRefs(payload) |
| 278 | if len(got) != 1 || got[0].Digest != ref.Digest || got[0].Bytes != ref.Bytes { |
| 279 | t.Fatalf("got = %+v", got) |
| 280 | } |
| 281 | } |
| 282 | |
| 283 | func TestNormalizeDisplayNameStripsPathAndControls(t *testing.T) { |
| 284 | if got := NormalizeDisplayName("../secret/\x00shot.png"); got != "shot.png" { |
| 285 | t.Fatalf("got %q", got) |
| 286 | } |
| 287 | } |
| 288 | |
| 289 | func TestViewImagePolicyRejectsOversize(t *testing.T) { |
| 290 | svc := testService(t).WithPolicy(Policy{MaxBytes: 32, MaxPixels: 4, MaxCount: 1, MaxBatchBytes: 32}) |
| 291 | _, err := svc.PrepareBatch(t.Context(), []Source{{Bytes: opaquePNG(t, 8, 8)}}) |
| 292 | if !Is(err, CodeSize) { |
| 293 | t.Fatalf("err = %v", err) |
| 294 | } |
| 295 | } |
| 296 | |
| 297 | func testService(t *testing.T) *Service { |
| 298 | t.Helper() |
| 299 | return NewService(sessioncontent.New(t.TempDir()), NewVariantCache(8<<20, 2)) |
| 300 | } |
| 301 | |
| 302 | func opaquePNG(t *testing.T, w, h int) []byte { |
| 303 | t.Helper() |
| 304 | img := image.NewRGBA(image.Rect(0, 0, w, h)) |
| 305 | for y := range h { |
| 306 | for x := range w { |
| 307 | img.Set(x, y, color.RGBA{R: 20, G: 40, B: 60, A: 255}) |
| 308 | } |
| 309 | } |
| 310 | var buf bytes.Buffer |
| 311 | if err := png.Encode(&buf, img); err != nil { |
| 312 | t.Fatal(err) |
| 313 | } |
| 314 | return buf.Bytes() |
| 315 | } |
| 316 | |
| 317 | func jsonMarshal(v any) []byte { |
| 318 | buf, err := json.Marshal(v) |
| 319 | if err != nil { |
| 320 | panic(err) |
| 321 | } |
| 322 | return buf |
| 323 | } |
| 324 | |
| 325 | func TestTinyPNGDetect(t *testing.T) { |
| 326 | raw, err := base64.StdEncoding.DecodeString("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==") |
| 327 | if err != nil { |
| 328 | t.Fatal(err) |
| 329 | } |
| 330 | if DetectMIME(raw) != "image/png" { |
| 331 | t.Fatal(DetectMIME(raw)) |
| 332 | } |
| 333 | } |
| 334 |