Merge branch 'r2/disk' into integration/round-1

This commit is contained in:
2026-08-23 13:15:02 -07:00
6 changed files with 1034 additions and 85 deletions
+109 -3
View File
@@ -83,9 +83,9 @@ pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
Ok(state) => Ok(Some(state)),
Err(e) => {
let backup = corrupt_backup_path(&path, &chrono::Utc::now());
let copied = if backup.exists() {
// Already kept a copy of this exact corruption this second;
// nothing to add.
let copied = if backup.exists() || corrupt_backups_full(&path) {
// Already kept a copy of this exact corruption this second, or
// kept as many as are worth keeping. Either way nothing to add.
Ok(())
} else {
fs::copy(&path, &backup).map(|_| ())
@@ -114,6 +114,50 @@ fn corrupt_backup_path(path: &std::path::Path, now: &chrono::DateTime<chrono::Ut
path.with_extension(format!("json.corrupt-{}.bak", now.format("%Y%m%d-%H%M%S")))
}
/// How many timestamped copies of one project's corrupt record are kept.
///
/// Timestamping fixed the "second corruption overwrote the first" bug and
/// introduced its opposite: [`load`] runs on every reconcile, every survey and
/// every reaper pass, so a record that is *persistently* unparseable — the
/// normal case, since nothing repairs it — mints a new copy every time the
/// clock's second changes. Nothing ever reads them back and nothing ever
/// removed them.
///
/// Four is enough for the only use there is: a human looking at what the file
/// held. See [`corrupt_backups_full`] for why the cap is applied before the
/// copy rather than by pruning after it.
const MAX_CORRUPT_BACKUPS: usize = 4;
/// Whether [`MAX_CORRUPT_BACKUPS`] copies of this record already exist.
///
/// Asked *before* the copy rather than pruning after it, so the cap is not
/// implemented by writing a file and deleting it again on every pass — and so
/// the copies that survive are the oldest, which are the ones taken closest to
/// whatever produced the corruption.
///
/// A directory that cannot be listed answers "not full": failing open here
/// costs at most one extra file, and failing closed would drop the very first
/// copy of a record nothing else has kept.
fn corrupt_backups_full(path: &std::path::Path) -> bool {
let (Some(dir), Some(stem)) = (path.parent(), path.file_stem()) else {
return false;
};
// `{stem}.json.corrupt-` — the same shape `corrupt_backup_path` builds, so
// this can never match another project's copies or an unrelated `.bak`.
let prefix = format!("{}.json.corrupt-", stem.to_string_lossy());
let Ok(entries) = fs::read_dir(dir) else {
return false;
};
entries
.flatten()
.filter(|e| {
let name = e.file_name().to_string_lossy().to_string();
name.starts_with(&prefix) && name.ends_with(".bak")
})
.count()
>= MAX_CORRUPT_BACKUPS
}
/// Whether a project has a migration record on disk *at all*, without parsing
/// it.
///
@@ -251,6 +295,22 @@ pub fn peek_ownerless_since(
/// the period below what has actually elapsed on the *marker's* terms, because
/// there is nothing to compare against but wall time; what it cannot do any
/// more is make every pin instantly reapable, which dating from the tag did.
///
/// ## Why the write re-checks `has_record`
///
/// Both reapers ask [`has_record`] and only call this when the answer is no,
/// which leaves a window: a [`save`] landing between the two runs its
/// `clear_ownerless_for_project` against a marker that does not exist yet, and
/// this then plants one — dated *now* — behind a perfectly valid record. The
/// marker is invisible while the record stands, so nothing notices. It only
/// matters later, if that record is legitimately lost: the pin is then already
/// fourteen days ownerless on its very first check and is reaped with **zero**
/// grace, which is the exact failure the tombstone exists to prevent.
///
/// So the write is followed by a second `has_record`, and a marker that turns
/// out to sit behind a record is removed again. The two orderings that remain
/// are both safe: a `save` completing *after* this re-check clears the marker
/// itself, and one completing before it is what the re-check sees.
pub fn note_ownerless_since(
project_id: &str,
tag: &str,
@@ -274,6 +334,19 @@ pub fn note_ownerless_since(
tag,
e
);
return None;
}
// A record that appeared while this was being written owns the pin,
// and a tombstone behind an owned pin is a fourteen-day head start
// on reaping it the moment that record is next lost.
if has_record(project_id).unwrap_or(false) {
log::debug!(
"A migration record for {} appeared while marking {} ownerless; \
the marker was dropped again",
project_id,
tag
);
clear_ownerless(project_id, tag);
}
None
}
@@ -339,6 +412,39 @@ pub fn clear_staging(project_id: &str) -> Result<(), String> {
mod tests {
use super::*;
#[test]
fn corrupt_copies_of_one_record_are_capped() {
// `load` runs on every reconcile, every survey and every reaper pass,
// and nothing repairs an unparseable record — so a persistently corrupt
// one minted a new timestamped copy every time the clock's second
// changed, and nothing ever removed them.
let dir = std::env::temp_dir().join(format!(
"triple-c-corrupt-cap-{}",
uuid::Uuid::new_v4().simple()
));
fs::create_dir_all(&dir).expect("temp dir");
let record = dir.join("some-project.json");
assert!(!corrupt_backups_full(&record), "an empty directory is not full");
for n in 0..MAX_CORRUPT_BACKUPS {
fs::write(
dir.join(format!("some-project.json.corrupt-2026010{}-000000.bak", n)),
"x",
)
.unwrap();
}
assert!(corrupt_backups_full(&record));
// Another project's copies, and an unrelated `.bak`, are not this
// record's — the prefix is the whole point of the naming.
let other = dir.join("other-project.json");
assert!(!corrupt_backups_full(&other));
fs::write(dir.join("some-project.json.bak"), "x").unwrap();
assert!(!corrupt_backups_full(&other));
fs::remove_dir_all(&dir).ok();
}
#[test]
fn project_ids_cannot_escape_the_migrations_directory() {
assert_eq!(sanitize("../../etc/passwd"), "______etc_passwd");
+176 -9
View File
@@ -1,9 +1,96 @@
use std::fs;
use std::path::PathBuf;
use std::path::{Path, PathBuf};
use std::sync::Mutex;
use crate::models::Project;
/// The sticky marker for `projects.json`: `projects.json.corrupt`, beside it.
///
/// Derived from the file rather than from `dirs::data_dir()` so the marker
/// always lands in the directory the store is actually using — and so the
/// writer can be tested against a temp directory.
fn corrupt_marker_for(file_path: &Path) -> PathBuf {
file_path.with_extension("json.corrupt")
}
/// `<data_dir>/triple-c/projects.json.corrupt`, whether or not it exists.
pub fn corrupt_marker_path() -> Option<PathBuf> {
dirs::data_dir().map(|d| corrupt_marker_for(&d.join("triple-c").join("projects.json")))
}
/// When this data directory last loaded a `projects.json` it could not parse,
/// as the RFC3339 instant recorded in the marker.
///
/// ## Why this outlives the load that wrote it
///
/// A corrupt load is *recoverable for the app* — the list starts empty and
/// everything keeps working — and that recovery is precisely what makes it
/// dangerous for anything that reasons about which projects exist. The
/// in-memory symptom does not survive: the first [`ProjectsStore::save`] after
/// the failure, which is as little as starting one project (`update_status`),
/// writes `[{that one project}]` over the file. From then on `projects.json`
/// parses, holds one id, and looks exactly like a user with one project — while
/// every *other* project's home and config volume is on the daemon claimed by
/// nobody.
///
/// The guard in `project_store_trust` keyed on "the list is empty and the file
/// exists", which that write silently ends. So the fact is recorded on disk
/// instead of inferred from the list's shape, and it is **sticky**: nothing in
/// this app clears it, because nothing in this app can reconstruct what the
/// unreadable file held. The refusal names the marker so a user who has
/// restored their list — or accepted the loss — can delete it deliberately.
pub fn corrupt_since() -> Option<String> {
let raw = fs::read_to_string(corrupt_marker_path()?).ok()?;
let trimmed = raw.trim();
if trimmed.is_empty() {
// The marker's presence is the signal; an empty one still means a
// corrupt load happened, it just cannot say when.
return Some("an unknown time".to_string());
}
Some(trimmed.lines().next().unwrap_or(trimmed).to_string())
}
/// Keep the bytes of an unparseable `projects.json`, and record that it
/// happened.
///
/// **The existing `.bak` is never overwritten.** A second corruption used to
/// clobber the first, and the first is the valuable one: it was taken before
/// the app rewrote the file with whatever it had in memory, so it is the only
/// copy that can still hold the full project list. Later ones are copies of an
/// already-degraded file and get a timestamped name.
fn record_corrupt_load(file_path: &Path, now: &chrono::DateTime<chrono::Utc>) {
let first = file_path.with_extension("json.bak");
let backup = if first.exists() {
file_path.with_extension(format!("json.corrupt-{}.bak", now.format("%Y%m%d-%H%M%S")))
} else {
first
};
if !backup.exists() {
if let Err(e) = fs::copy(file_path, &backup) {
log::error!("Failed to back up corrupted projects.json: {}", e);
} else {
log::error!(
"A copy of the unreadable projects.json was kept at {}",
backup.display()
);
}
}
let marker = corrupt_marker_for(file_path);
if marker.exists() {
// Sticky: the *first* corruption is the one that dates the loss.
return;
}
if let Err(e) = fs::write(&marker, now.to_rfc3339()) {
log::error!(
"Could not record the corrupt projects.json load at {}: {} — orphan detection will \
not know the project list is incomplete",
marker.display(),
e
);
}
}
pub struct ProjectsStore {
projects: Mutex<Vec<Project>>,
file_path: PathBuf,
@@ -43,20 +130,14 @@ impl ProjectsStore {
Ok(parsed) => (parsed, migrated),
Err(e) => {
log::error!("Failed to parse migrated projects.json: {}. Starting with empty list.", e);
let backup = file_path.with_extension("json.bak");
if let Err(be) = fs::copy(&file_path, &backup) {
log::error!("Failed to back up corrupted projects.json: {}", be);
}
record_corrupt_load(&file_path, &chrono::Utc::now());
(Vec::new(), false)
}
}
}
Err(e) => {
log::error!("Failed to parse projects.json: {}. Starting with empty list.", e);
let backup = file_path.with_extension("json.bak");
if let Err(be) = fs::copy(&file_path, &backup) {
log::error!("Failed to back up corrupted projects.json: {}", be);
}
record_corrupt_load(&file_path, &chrono::Utc::now());
(Vec::new(), false)
}
}
@@ -203,3 +284,89 @@ impl ProjectsStore {
}
}
}
#[cfg(test)]
mod tests {
use super::*;
fn temp_dir(tag: &str) -> PathBuf {
let dir = std::env::temp_dir().join(format!(
"triple-c-store-{}-{}",
tag,
uuid::Uuid::new_v4().simple()
));
fs::create_dir_all(&dir).expect("temp dir");
dir
}
#[test]
fn a_corrupt_load_leaves_a_marker_the_next_write_cannot_erase() {
// H-3, the whole chain in one test. `ProjectsStore::new()` swallows an
// unparseable file into an empty list *without rewriting it*, and the
// first `save()` after that — as little as `update_status()` — writes
// `[{one project}]` over it. Everything the old guard keyed on ("the
// list is empty and the file exists") is gone at that point, while
// every *other* project's volumes are still on the daemon claimed by
// nobody.
let dir = temp_dir("corrupt");
let file = dir.join("projects.json");
fs::write(&file, "{ this is not a project list").unwrap();
let now = chrono::Utc::now();
record_corrupt_load(&file, &now);
let marker = corrupt_marker_for(&file);
assert!(marker.exists(), "the corrupt load must be recorded on disk");
assert_eq!(fs::read_to_string(&marker).unwrap(), now.to_rfc3339());
assert!(
dir.join("projects.json.bak").exists(),
"the unreadable bytes must be kept"
);
// The write that used to erase the evidence. The marker is a separate
// file, so it does not care.
fs::write(&file, r#"[{"id":"the-one-project-started-since"}]"#).unwrap();
assert!(marker.exists());
fs::remove_dir_all(&dir).ok();
}
#[test]
fn a_second_corruption_keeps_the_first_copy_and_the_first_date() {
// The `.bak` used to be a fixed name, so a second corruption clobbered
// the first — and the first is the only copy taken before the app
// rewrote the file with whatever it had in memory, i.e. the only one
// that can still hold the full project list.
let dir = temp_dir("second");
let file = dir.join("projects.json");
fs::write(&file, "original bytes").unwrap();
let first = chrono::DateTime::parse_from_rfc3339("2026-01-01T00:00:00Z")
.unwrap()
.with_timezone(&chrono::Utc);
record_corrupt_load(&file, &first);
fs::write(&file, "degraded bytes").unwrap();
let second = chrono::DateTime::parse_from_rfc3339("2026-06-01T00:00:00Z")
.unwrap()
.with_timezone(&chrono::Utc);
record_corrupt_load(&file, &second);
assert_eq!(
fs::read_to_string(dir.join("projects.json.bak")).unwrap(),
"original bytes",
"the first copy must survive the second corruption"
);
assert_eq!(
fs::read_to_string(dir.join("projects.json.corrupt-20260601-000000.bak")).unwrap(),
"degraded bytes"
);
// And the marker still dates the loss from the first failure, which is
// when the project list actually stopped being complete.
assert_eq!(
fs::read_to_string(corrupt_marker_for(&file)).unwrap(),
first.to_rfc3339()
);
fs::remove_dir_all(&dir).ok();
}
}