feat: read and validate curated FK annotations at the pinned commit (P5)

2026-08-13 04:56:03 +02:00
parent 60e4048d4b
commit b00b7f17c9
5 changed files with 369 additions and 1 deletions
@@ -0,0 +1,150 @@
+import { execFile } from "node:child_process";
+import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { afterEach, expect, test } from "vitest";
+import { GitWorkspaceRepository } from "../src/workspaces/git-repository.js";
+import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
+
+const runFile = promisify(execFile);
+const temporaryRoots: string[] = [];
+
+afterEach(() => {
+  temporaryRoots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true }));
+});
+
+async function git(cwd: string, args: string[]): Promise<string> {
+  const { stdout } = await runFile("git", args, { cwd });
+  return stdout.trim();
+}
+
+function config(root: string, remoteUrl: string): WorkspaceRegistryConfig {
+  return {
+    root,
+    remoteUrl,
+    branch: "main",
+    gitAuthorName: "Workspace Registry Test",
+    gitAuthorEmail: "workspace-registry@example.invalid",
+    installationId: "test",
+    secretRoots: [],
+    maxImportBytes: 1024,
+    maxImportEntries: 1,
+  };
+}
+
+interface RepoFixture {
+  root: string;
+  remote: string;
+  source: string;
+  commit: string;
+}
+
+async function makeRepo(id: string, annotations: string | Buffer | "dir" | "symlink"): Promise<RepoFixture> {
+  const root = mkdtempSync(join(tmpdir(), "thoth-annotations-git-"));
+  temporaryRoots.push(root);
+  const remote = join(root, "remote.git");
+  const source = join(root, "source");
+  await git(root, ["init", "--bare", "--initial-branch=main", remote]);
+  mkdirSync(source);
+  await git(source, ["init", "--initial-branch=main"]);
+  await git(source, ["config", "user.name", "Annotations Test"]);
+  await git(source, ["config", "user.email", "annotations@example.invalid"]);
+  writeFileSync(join(source, "thoth-workspaces.yaml"),
+    `schema_version: 1\nworkspaces: [{id: ${id}, name: Workspace}]\n`);
+  mkdirSync(join(source, id, "schema"), { recursive: true });
+  writeFileSync(join(source, id, "workspace.yaml"), `workspace:\n  schema_version: 3\n  id: ${id}\n`);
+  const annotationsPath = join(source, id, "schema", "annotations.yaml");
+  if (annotations === "dir") {
+    mkdirSync(annotationsPath, { recursive: true });
+    writeFileSync(join(annotationsPath, "child.txt"), "not a blob\n");
+  } else if (annotations === "symlink") {
+    writeFileSync(join(source, id, "target.yaml"), "tables: {}\n");
+    symlinkSync("target.yaml", annotationsPath);
+  } else {
+    writeFileSync(annotationsPath, annotations);
+  }
+  await git(source, ["add", "-A"]);
+  await git(source, ["commit", "-m", "initial"]);
+  await git(source, ["remote", "add", "origin", remote]);
+  await git(source, ["push", "origin", "main"]);
+  const commit = await git(source, ["rev-parse", "HEAD"]);
+  return { root, remote, source, commit };
+}
+
+async function bootstrapped(fixture: RepoFixture): Promise<GitWorkspaceRepository> {
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+  return repository;
+}
+
+test("reads a regular annotation blob at the exact commit", async () => {
+  const fixture = await makeRepo("research", "tables: {}\n");
+  const repository = await bootstrapped(fixture);
+
+  const object = await repository.annotationsObject(fixture.commit, "research");
+
+  expect(object).toBeDefined();
+  expect(object!.blobId).toMatch(/^[0-9a-f]{40}$/);
+  expect(object!.contents.toString("utf8")).toBe("tables: {}\n");
+});
+
+test("returns undefined when the annotation object is absent", async () => {
+  const fixture = await makeRepo("research", "tables: {}\n");
+  const repository = await bootstrapped(fixture);
+
+  await expect(repository.annotationsObject(fixture.commit, "absent")).resolves.toBeUndefined();
+});
+
+test("refuses a tree at the annotation path", async () => {
+  const fixture = await makeRepo("clinical", "dir");
+  const repository = await bootstrapped(fixture);
+
+  await expect(repository.annotationsObject(fixture.commit, "clinical"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
+test("refuses a symlink at the annotation path", async () => {
+  const fixture = await makeRepo("research", "symlink");
+  const repository = await bootstrapped(fixture);
+
+  await expect(repository.annotationsObject(fixture.commit, "research"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
+test("refuses oversized and non-UTF-8 annotation blobs", async () => {
+  const oversized = await makeRepo("research", Buffer.concat([
+    Buffer.from("tables: {}\n"),
+    Buffer.alloc(16 * 1024 * 1024, 0x78),
+  ]));
+  const repository = await bootstrapped(oversized);
+  await expect(repository.annotationsObject(oversized.commit, "research"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+
+  const nonUtf8 = await makeRepo("research", Buffer.from([0x74, 0x61, 0x62, 0xff, 0xfe, 0x00]));
+  const repository2 = await bootstrapped(nonUtf8);
+  await expect(repository2.annotationsObject(nonUtf8.commit, "research"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
+test("refuses malformed ids and revisions before Git", async () => {
+  const fixture = await makeRepo("research", "tables: {}\n");
+  const repository = await bootstrapped(fixture);
+
+  await expect(repository.annotationsObject(fixture.commit, "workspace-docs"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+  await expect(repository.annotationsObject(fixture.commit, "../research"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+  await expect(repository.annotationsObject("HEAD", "research"))
+    .rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
+test("redacts Git failures while reading the annotation blob", async () => {
+  const fixture = await makeRepo("research", "tables: {}\n");
+  const repository = await bootstrapped(fixture);
+  rmSync(repository.repoPath, { recursive: true, force: true });
+
+  const error = await repository.annotationsObject(fixture.commit, "research").catch((failure: unknown) => failure);
+  expect(error).toMatchObject({ code: "git_unavailable", message: "Workspace Git operation failed" });
+  expect((error as Error).message).not.toContain(fixture.root);
+});