fix: stream bounded journal scans

docs/install/dwh-auth-server.md

@@ -278,29 +278,52 @@ if sudo python3 -c '
 import pathlib, subprocess, sys
 max_journal_bytes = 1_048_576
 max_journal_lines = 10_000
-try:
-    actual_keys = {pathlib.Path(path).read_bytes() for path in sys.argv[2:]}
-    process = subprocess.Popen(
-        ["journalctl", "-u", "dwh-auth", "--since", sys.argv[1], "--no-pager", "--output=cat"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-    )
-except OSError:
-    raise SystemExit(2)
-bytes_seen = 0
-try:
-    for line_number, line in enumerate(process.stdout, 1):
-        if line_number > max_journal_lines or bytes_seen + len(line) > max_journal_bytes:
-            process.kill()
-            process.wait()
-            raise SystemExit(2)
-        bytes_seen += len(line)
-        if b"thtdwh_v1" in line or b"secret_sha256" in line or any(key in line for key in actual_keys):
-            raise SystemExit(1)
-finally:
+max_chunk_bytes = 65_536
+actual_keys = {pathlib.Path(path).read_bytes() for path in sys.argv[2:]}
+needles = (b"thtdwh_v1", b"secret_sha256", *actual_keys)
+max_needle_length = max(map(len, needles))
+process = subprocess.Popen(
+    ["journalctl", "-u", "dwh-auth", "--since", sys.argv[1], "--no-pager", "--output=cat"],
+    stdout=subprocess.PIPE,
+    stderr=subprocess.DEVNULL,
+)
+def stop_child():
     if process.poll() is None:
         process.kill()
     process.wait()
+bytes_seen = 0
+line_count = 0
+line_open = False
+carry = b""
+try:
+    while True:
+        remaining = max_journal_bytes - bytes_seen
+        if remaining == 0:
+            if process.stdout.read1(1):
+                raise SystemExit(2)
+            break
+        chunk = process.stdout.read1(min(max_chunk_bytes, remaining))
+        if not chunk:
+            break
+        bytes_seen += len(chunk)
+        searchable = carry + chunk
+        if any(needle in searchable for needle in needles):
+            raise SystemExit(1)
+        carry = searchable[-(max_needle_length - 1):]
+        for byte in chunk:
+            if byte == 10:
+                line_count += 1
+                line_open = False
+                if line_count > max_journal_lines:
+                    raise SystemExit(2)
+            else:
+                line_open = True
+    if line_open:
+        line_count += 1
+        if line_count > max_journal_lines:
+            raise SystemExit(2)
+finally:
+    stop_child()
 if process.returncode != 0:
     raise SystemExit(2)
 ' "$since" "$v1_key_file" "$legacy_key_file"; then