Artifact [e45597aff9]

Artifact e45597aff9981b1fcfac6a0d491dbd61baa50a28e6ed19714182f3b97652260a:

• File internal/sync/private_test.go — part of check-in [6273a0750d] at 2026-07-22 23:03:24 on branch trunk — fix: correct go.mod module path to go-libfossil (#76) (#117)

  * fix: correct go.mod module path to go-libfossil (#76)

  The module directive still declared github.com/danmestas/libfossil after the repository was renamed to go-libfossil. pkg.go.dev/godoc scraping matches the declared module path against its hosting path, so the stale path broke SDK doc generation.

  Rename the module path across all four in-repo modules (root, the two db/driver submodules, observer/otel, and docs/site) and every internal import, plus the release workflow, the doc-generation script, and the docs.

  No tag has been published under the go-libfossil path yet, so the cross-module requires cannot resolve from the proxy. Add replace directives pointing the in-repo requires at their local directories so GOWORK=off builds and the CI matrix resolve without a published version. These replaces are ignored by downstream consumers and can be dropped once new-path tags are cut.

  * Guard releases against replace directives; regenerate SDK docs

  The go-libfossil rename bridges the in-repo modules with `replace` directives. Go refuses a main module that carries them, so a tag cut while they are present breaks `go install .../cmd/libfossil@<tag>` and every `@version` fetch of the driver submodules. Add a Release workflow step that fails the job before anything is published if any tracked go.mod still contains a replace directive, so the bridge is a CI-enforced TODO rather than a silent landmine. The step comment records what unblocks a release: re-tag the submodules with the corrected module paths, bump the root requires, then drop the replace blocks.

  Regenerate the SDK reference docs. The previous pass only substituted URLs over the pre-existing generated files, leaving stale signatures (Repo.Timeline was still documented as taking LogOpts rather than TimelineOpts). Note that gomarkdoc must be run outside a git worktree — inside one it silently strips every source link.

  Also reword the README rename note, which read as though the import path had not changed, and re-sort the ncruces require block. (user: [email protected], size: 8264) [annotate] [blame] [check-ins using]

package sync

import (
	"context"
	"fmt"
	"path/filepath"
	"testing"

	"github.com/danmestas/go-libfossil/internal/blob"
	"github.com/danmestas/go-libfossil/internal/content"
	"github.com/danmestas/go-libfossil/internal/hash"
	"github.com/danmestas/go-libfossil/internal/repo"
	_ "github.com/danmestas/go-libfossil/internal/testdriver"
	"github.com/danmestas/go-libfossil/internal/xfer"
	"github.com/danmestas/go-libfossil/simio"
)

// newPrivateTestPair creates a server and client repo with matching project code.
// The server's nobody user is granted the given capabilities.
func newPrivateTestPair(t *testing.T, nobodyCaps string) (server, client *repo.Repo) {
	t.Helper()
	dir := t.TempDir()

	sPath := filepath.Join(dir, "server.fossil")
	s, err := repo.Create(sPath, "test", simio.CryptoRand{}, "")
	if err != nil {
		t.Fatalf("server repo: %v", err)
	}

	cPath := filepath.Join(dir, "client.fossil")
	c, err := repo.Create(cPath, "test", simio.CryptoRand{}, "")
	if err != nil {
		t.Fatalf("client repo: %v", err)
	}

	// Match project codes so sync works.
	var projCode string
	s.DB().QueryRow("SELECT value FROM config WHERE name='project-code'").Scan(&projCode)
	c.DB().Exec("UPDATE config SET value=? WHERE name='project-code'", projCode)

	// Set nobody capabilities on server.
	s.DB().Exec("UPDATE user SET cap=? WHERE login='nobody'", nobodyCaps)

	t.Cleanup(func() {
		s.Close()
		c.Close()
	})
	return s, c
}

// syncViaHandler runs sync.Sync using a MockTransport backed by HandleSync.
func syncViaHandler(t *testing.T, serverRepo, clientRepo *repo.Repo, opts SyncOpts) *SyncResult {
	t.Helper()
	transport := &MockTransport{Handler: func(req *xfer.Message) *xfer.Message {
		resp, err := HandleSync(context.Background(), serverRepo, req)
		if err != nil {
			t.Fatalf("HandleSync: %v", err)
		}
		return resp
	}}

	var srvCode string
	serverRepo.DB().QueryRow("SELECT value FROM config WHERE name='server-code'").Scan(&srvCode)
	opts.ServerCode = srvCode

	var projCode string
	serverRepo.DB().QueryRow("SELECT value FROM config WHERE name='project-code'").Scan(&projCode)
	opts.ProjectCode = projCode

	result, err := Sync(context.Background(), clientRepo, transport, opts)
	if err != nil {
		t.Fatalf("Sync: %v", err)
	}
	return result
}

func TestSyncPrivateEndToEnd(t *testing.T) {
	// Server has 3 public blobs and 2 private blobs.
	// Client with Private=false gets only public.
	// Client with Private=true gets all.

	t.Run("without_private_flag", func(t *testing.T) {
		serverRepo, clientRepo := newPrivateTestPair(t, "oix")

		// Store 3 public blobs.
		publicUUIDs := make([]string, 3)
		for i := range 3 {
			data := []byte(fmt.Sprintf("public-blob-%d", i))
			_, uuid, err := blob.Store(serverRepo.DB(), data)
			if err != nil {
				t.Fatalf("blob.Store public: %v", err)
			}
			publicUUIDs[i] = uuid
		}

		// Store 2 private blobs.
		privateUUIDs := make([]string, 2)
		for i := range 2 {
			data := []byte(fmt.Sprintf("private-blob-%d", i))
			rid, uuid, err := blob.Store(serverRepo.DB(), data)
			if err != nil {
				t.Fatalf("blob.Store private: %v", err)
			}
			if err := content.MakePrivate(serverRepo.DB(), int64(rid)); err != nil {
				t.Fatalf("MakePrivate: %v", err)
			}
			privateUUIDs[i] = uuid
		}

		// Sync WITHOUT Private flag.
		syncViaHandler(t, serverRepo, clientRepo, SyncOpts{
			Pull:    true,
			Push:    true,
			Private: false,
		})

		// Public blobs should arrive.
		for _, uuid := range publicUUIDs {
			if _, ok := blob.Exists(clientRepo.DB(), uuid); !ok {
				t.Errorf("client missing public blob %s", uuid)
			}
		}

		// Private blobs should NOT arrive.
		for _, uuid := range privateUUIDs {
			if _, ok := blob.Exists(clientRepo.DB(), uuid); ok {
				t.Errorf("client has private blob %s without Private flag", uuid)
			}
		}
	})

	t.Run("with_private_flag", func(t *testing.T) {
		serverRepo, clientRepo := newPrivateTestPair(t, "oix")

		// Store 3 public blobs.
		publicUUIDs := make([]string, 3)
		for i := range 3 {
			data := []byte(fmt.Sprintf("public-blob-priv-%d", i))
			_, uuid, err := blob.Store(serverRepo.DB(), data)
			if err != nil {
				t.Fatalf("blob.Store public: %v", err)
			}
			publicUUIDs[i] = uuid
		}

		// Store 2 private blobs.
		privateUUIDs := make([]string, 2)
		privateRIDs := make([]int64, 2)
		for i := range 2 {
			data := []byte(fmt.Sprintf("private-blob-priv-%d", i))
			rid, uuid, err := blob.Store(serverRepo.DB(), data)
			if err != nil {
				t.Fatalf("blob.Store private: %v", err)
			}
			if err := content.MakePrivate(serverRepo.DB(), int64(rid)); err != nil {
				t.Fatalf("MakePrivate: %v", err)
			}
			privateUUIDs[i] = uuid
			privateRIDs[i] = int64(rid)
		}

		// Sync WITH Private flag.
		syncViaHandler(t, serverRepo, clientRepo, SyncOpts{
			Pull:    true,
			Push:    true,
			Private: true,
		})

		// All public blobs should arrive.
		for _, uuid := range publicUUIDs {
			if _, ok := blob.Exists(clientRepo.DB(), uuid); !ok {
				t.Errorf("client missing public blob %s", uuid)
			}
		}

		// All private blobs should arrive AND be marked private on client.
		for _, uuid := range privateUUIDs {
			rid, ok := blob.Exists(clientRepo.DB(), uuid)
			if !ok {
				t.Errorf("client missing private blob %s", uuid)
				continue
			}
			if !content.IsPrivate(clientRepo.DB(), int64(rid)) {
				t.Errorf("blob %s should be in client's private table", uuid)
			}
		}

		// Public blobs should NOT be in private table.
		for _, uuid := range publicUUIDs {
			rid, ok := blob.Exists(clientRepo.DB(), uuid)
			if !ok {
				continue
			}
			if content.IsPrivate(clientRepo.DB(), int64(rid)) {
				t.Errorf("public blob %s should not be in private table", uuid)
			}
		}
	})

	t.Run("no_x_capability", func(t *testing.T) {
		// Server's nobody lacks 'x' capability — pragma send-private rejected.
		serverRepo, clientRepo := newPrivateTestPair(t, "oi") // no 'x'

		// Store a private blob on server.
		data := []byte("secret-no-cap")
		rid, uuid, err := blob.Store(serverRepo.DB(), data)
		if err != nil {
			t.Fatalf("blob.Store: %v", err)
		}
		content.MakePrivate(serverRepo.DB(), int64(rid))

		// Also store a public blob.
		pubData := []byte("public-no-cap")
		_, pubUUID, err := blob.Store(serverRepo.DB(), pubData)
		if err != nil {
			t.Fatalf("blob.Store public: %v", err)
		}

		// Sync with Private=true, but server denies it.
		syncViaHandler(t, serverRepo, clientRepo, SyncOpts{
			Pull:    true,
			Push:    true,
			Private: true,
		})

		// Public blob should arrive.
		if _, ok := blob.Exists(clientRepo.DB(), pubUUID); !ok {
			t.Error("client missing public blob")
		}

		// Private blob should NOT arrive (server denied send-private).
		if _, ok := blob.Exists(clientRepo.DB(), uuid); ok {
			t.Error("client has private blob despite lacking 'x' capability")
		}
	})
}

func TestSyncPrivateArtifactTransition(t *testing.T) {
	// Server has a private blob. Client syncs with Private=true.
	// Server makes it public. Client syncs again — private status clears.

	serverRepo, clientRepo := newPrivateTestPair(t, "oix")

	// Store a blob and mark private on server.
	data := []byte("transitioning-artifact")
	uuid := hash.SHA1(data)
	rid, _, err := blob.Store(serverRepo.DB(), data)
	if err != nil {
		t.Fatalf("blob.Store: %v", err)
	}
	content.MakePrivate(serverRepo.DB(), int64(rid))

	// Phase 1: sync with Private=true — client gets the private blob.
	syncViaHandler(t, serverRepo, clientRepo, SyncOpts{
		Pull:    true,
		Push:    true,
		Private: true,
	})

	clientRID, ok := blob.Exists(clientRepo.DB(), uuid)
	if !ok {
		t.Fatal("client missing blob after first sync")
	}
	if !content.IsPrivate(clientRepo.DB(), int64(clientRID)) {
		t.Fatal("blob should be private on client after first sync")
	}

	// Phase 2: server makes blob public.
	if err := content.MakePublic(serverRepo.DB(), int64(rid)); err != nil {
		t.Fatalf("MakePublic: %v", err)
	}

	// Sync again — the server will emit igot without IsPrivate=true,
	// and the client should clear the private status.
	syncViaHandler(t, serverRepo, clientRepo, SyncOpts{
		Pull:    true,
		Push:    true,
		Private: true,
	})

	if content.IsPrivate(clientRepo.DB(), int64(clientRID)) {
		t.Error("blob should no longer be private on client after transition")
	}
}