133 lines
11 KiB
TypeScript
133 lines
11 KiB
TypeScript
/** Owned disposable PostgreSQL acceptance only. Native license GET is genuine
|
|
* localhost HTTP; external stop/restart enforcement remains SYNTHETIC. */
|
|
import assert from "node:assert/strict"
|
|
import { createHash, generateKeyPairSync, randomUUID, sign } from "node:crypto"
|
|
import { mkdtemp, rm, writeFile } from "node:fs/promises"
|
|
import { dirname, resolve, sep } from "node:path"
|
|
import { assertOwnedBandwidthSql } from "./bandwidth-admission-process.sql-helper.js"
|
|
import { canonicalBandwidthNodeValue } from "./bandwidth-node-bootstrap.js"
|
|
import { bandwidthOperatorEnrollmentGrantSchema } from "./bandwidth-operator-enrollment.js"
|
|
import { createBandwidthOperatorWriterComposition } from "./bandwidth-operator-writer-composition.js"
|
|
import { BandwidthOperatorWriterFenceUnknown } from "./bandwidth-operator-writer-window.js"
|
|
import { bandwidthPeerRefKey, type BandwidthPeerRef } from "./bandwidth-peer-reference.js"
|
|
import type { createOwnedExternalRegistryHarness } from "./bandwidth-external-node-registry.sql-helper.js"
|
|
|
|
type Harness = Awaited<ReturnType<typeof createOwnedExternalRegistryHarness>>
|
|
type Signed = Awaited<ReturnType<Harness["createSignedSource"]>>
|
|
export async function acceptOwnedOperatorWriterComposition(f: Harness, signed: Signed): Promise<string[]> {
|
|
assertOwnedBandwidthSql(); assert.equal(process.env.MMAPP_OWN_BANDWIDTH_EXTERNAL_REGISTRY, "true")
|
|
assert.equal(typeof signed.node.openWithOwnershipFence, "function")
|
|
const state = resolve(process.env.MCP_STATE_DIR!), folder = await mkdtemp(resolve(state, "operator-writer-"))
|
|
assert.equal(dirname(folder), state)
|
|
const trustKeyFile = resolve(folder, "trust.pem"), grantFile = resolve(folder, "grant.json")
|
|
const keys = generateKeyPairSync("ed25519"), sha = (bytes: Buffer | string) => createHash("sha256").update(bytes).digest("hex")
|
|
await writeFile(trustKeyFile, keys.publicKey.export({ type: "spki", format: "pem" }), { flag: "wx", mode: 0o600 })
|
|
const { Client } = await import("pg"), originalQuery = Client.prototype.query
|
|
const rival = await f.owner.connect(), pids = new Set<number>(), checks: string[] = []
|
|
let allowedPeer: BandwidthPeerRef | undefined, syntheticStopped = true, externalHeld = false, removeAfterCommit = false
|
|
let leaseOpens = 0, physicalDestroys = 0, credentialReads = 0, rivalChecks = 0
|
|
let diagnostic = { began: Date.now(), queries: 0, rawOwnership: 0, commitAttempted: false, commitAcknowledged: false, boundary: "construction" }
|
|
async function assertHeld() {
|
|
assert(externalHeld, "synthetic external fence must stay held")
|
|
assert.equal(pids.size, 1, "one physical configured source PID; no nested control checkout")
|
|
const pid = [...pids][0]
|
|
const held = await rival.query("SELECT EXISTS(SELECT 1 FROM pg_catalog.pg_locks WHERE locktype='advisory' AND pid=$1 AND classid=0::pg_catalog.oid AND objid=8723116::pg_catalog.oid AND objsubid=1 AND mode='ExclusiveLock' AND granted) AS held", [pid])
|
|
assert.equal(held.rows[0].held, true)
|
|
const shared = await rival.query("SELECT pg_catalog.pg_try_advisory_lock_shared(8723116) AS acquired")
|
|
if (shared.rows[0].acquired === true) { await rival.query("SELECT pg_catalog.pg_advisory_unlock_shared(8723116)"); assert.fail("rival native shared handoff entered exclusive operator window") }
|
|
rivalChecks++
|
|
}
|
|
Client.prototype.query = function(this: InstanceType<typeof Client>, ...args: unknown[]) {
|
|
const physical = this as unknown as { connectionParameters: { user: string; database: string }; processID: number }
|
|
if (physical.connectionParameters.user === signed.runtimeRole && physical.connectionParameters.database === f.databaseName) pids.add(physical.processID)
|
|
return Reflect.apply(originalQuery, this, args)
|
|
} as typeof Client.prototype.query
|
|
const composition = createBandwidthOperatorWriterComposition({
|
|
config: { ...f.root, trustKeyFile, grantFile, trustKeySha256: sha(keys.publicKey.export({ type: "spki", format: "der" })) },
|
|
nodeSource: { ...signed.node, async openWithOwnershipFence(scope, guard, ownership) {
|
|
leaseOpens++; diagnostic.boundary = "source-open"
|
|
const session = await signed.node.openWithOwnershipFence(scope, guard, async fence => {
|
|
diagnostic.rawOwnership++; diagnostic.boundary = "raw-ownership"
|
|
await ownership(fence)
|
|
})
|
|
let closed = false
|
|
return { ...session, close() { if (!closed) { closed = true; physicalDestroys++ }; session.close() }, connection: {
|
|
release: session.connection.release.bind(session.connection),
|
|
async query(text, values, options) {
|
|
diagnostic.queries++; diagnostic.boundary = text === "COMMIT" ? "commit" : "driver-query"
|
|
if (text === "COMMIT") diagnostic.commitAttempted = true
|
|
const result = await session.connection.query(text, values, options)
|
|
// Opening lock and PID queries precede the held phase; all registry
|
|
// queries thereafter must preserve the same session exclusion.
|
|
if (!text.includes("pg_try_advisory_lock(") && !text.includes("pg_backend_pid()")) await assertHeld()
|
|
if (text === "COMMIT" && "command" in result && result.command === "COMMIT") diagnostic.commitAcknowledged = true
|
|
if (text === "COMMIT" && removeAfterCommit) { removeAfterCommit = false; await rm(grantFile) }
|
|
return result
|
|
},
|
|
} }
|
|
} },
|
|
observationSource: { async read(peer, scope) {
|
|
diagnostic.boundary = "before-credentials"; assert(allowedPeer)
|
|
assert.equal(bandwidthPeerRefKey(peer), bandwidthPeerRefKey(allowedPeer)); await assertHeld()
|
|
credentialReads++; return f.readPeerSnapshot(peer, scope)
|
|
} },
|
|
externalStop: { async acquire(original, scope) {
|
|
assert(syntheticStopped); assert.equal(original.grant.executorInventorySha256, sha("OWNED SYNTHETIC STOP/RESTART FIXTURE"))
|
|
scope.signal?.throwIfAborted(); externalHeld = true
|
|
return { async assertCurrent(current, requested) {
|
|
assert(syntheticStopped && externalHeld); assert.equal(current.grant.grantId, original.grant.grantId)
|
|
requested.signal?.throwIfAborted(); assert(Date.now() < requested.deadlineAt)
|
|
}, close() { externalHeld = false } }
|
|
} },
|
|
})
|
|
async function publish(peer: BandwidthPeerRef) {
|
|
const snapshot = await f.readPeerSnapshot(peer, f.scope()); assert(snapshot)
|
|
const now = Date.now(), grant = bandwidthOperatorEnrollmentGrantSchema.parse({ format: "mmapp-bandwidth-operator-enrollment-v1", ...f.root,
|
|
grantId: randomUUID(), operatorId: "owned-writer-window", executorInventorySha256: sha("OWNED SYNTHETIC STOP/RESTART FIXTURE"),
|
|
executorsStoppedAt: now - 1000, issuedAt: now - 1000, expiresAt: now + 120000, peerRef: peer, sourceProof: snapshot.sourceProof,
|
|
authorityGeneration: snapshot.authorityGeneration, routingEndpointEpoch: snapshot.endpoint.routingEndpointEpoch,
|
|
claims: [{ kind: "system-id", value: "OWNED-SHARED-SYSTEM" }, { kind: "software-id", value: "OWNED-SHARED-SOFTWARE" }] })
|
|
const bytes = Buffer.from(canonicalBandwidthNodeValue(grant))
|
|
await writeFile(grantFile, JSON.stringify({ format: "mmapp-bandwidth-operator-enrollment-envelope-v1", payload: bytes.toString("base64url"), signature: sign(null, bytes, keys.privateKey).toString("base64url") }), { mode: 0o600 })
|
|
allowedPeer = peer
|
|
}
|
|
async function register() {
|
|
pids.clear(); diagnostic = { began: Date.now(), queries: 0, rawOwnership: 0, commitAttempted: false, commitAcknowledged: false, boundary: "original-authority" }
|
|
try { return await composition.register({ deadlineAt: Date.now() + 5000 }) }
|
|
catch (error) {
|
|
console.error("Owned writer window diagnostic:", JSON.stringify({ elapsedMs: Date.now() - diagnostic.began, queries: diagnostic.queries,
|
|
rawOwnership: diagnostic.rawOwnership, commitAttempted: diagnostic.commitAttempted, commitAcknowledged: diagnostic.commitAcknowledged,
|
|
boundary: diagnostic.boundary, physicalPids: pids.size, code: error && typeof error === "object" && "code" in error ? String(error.code).slice(0, 100) : "unclassified" }))
|
|
throw error
|
|
}
|
|
}
|
|
const coreTables = ["bandwidth_attempts", "bandwidth_node_occupancy", "bandwidth_attempt_events"]
|
|
try {
|
|
const occupied = await f.owner.query("SELECT o.node_id FROM mmapp_control.bandwidth_node_occupancy o JOIN mmapp_control.bandwidth_attempts a ON a.attempt_id=o.attempt_id WHERE a.state='unknown_busy'")
|
|
assert(occupied.rows.length > 0, "the caller must establish genuine journal UNKNOWN occupancy first")
|
|
const before = await f.digest(coreTables), claims = { "system-id": "OWNED-SHARED-SYSTEM", "software-id": "OWNED-SHARED-SOFTWARE" }
|
|
const managedPeer: BandwidthPeerRef = { kind: "server", serverId: await f.managedEndpoint(claims) }
|
|
await publish(managedPeer); const managed = await register()
|
|
const externalPeer: BandwidthPeerRef = { kind: "external", enrollmentId: f.externalEndpoint(claims) }
|
|
await publish(externalPeer); const external = await register()
|
|
assert.equal(managed.canonicalNodeId, external.canonicalNodeId)
|
|
assert(occupied.rows.some(row => row.node_id === managed.canonicalNodeId), "safe alias reuses the occupied canonical")
|
|
assert.equal(await f.digest(coreTables), before)
|
|
assert.equal(leaseOpens, 2); assert.equal(physicalDestroys, 2); assert(credentialReads > 0 && rivalChecks > 0)
|
|
checks.push("actual writer composition: original Ed25519 grant before synthetic external Q; genuine localhost managed/external license GET and actual registries reuse the same UNKNOWN-occupied canonical with unchanged journal/owners")
|
|
checks.push("each operation uses one configured physical PID and session-exclusive 8723116 through credentials and registry COMMIT; rival native shared acquisition refuses, raw ownership checks avoid nested source checkout, final owner destroys")
|
|
await publish(externalPeer); removeAfterCommit = true
|
|
await assert.rejects(register(), error => error instanceof BandwidthOperatorWriterFenceUnknown && error.automaticReplay === false)
|
|
assert.equal(removeAfterCommit, false); assert(diagnostic.commitAcknowledged)
|
|
assert.equal(physicalDestroys, 3); assert.equal(await f.digest(coreTables), before)
|
|
const reads = credentialReads, opens = leaseOpens
|
|
syntheticStopped = false; await publish(externalPeer); await assert.rejects(register())
|
|
assert.equal(credentialReads, reads); assert.equal(leaseOpens, opens)
|
|
checks.push("actual acknowledged COMMIT followed by grant withdrawal returns owner UNKNOWN without replay; revoked synthetic external stop rejects before configured lease and credentials; production stop issuer remains absent")
|
|
return checks
|
|
} finally {
|
|
composition.close(); Client.prototype.query = originalQuery; rival.release(true)
|
|
assert.equal(dirname(folder), state); assert(folder.startsWith(state + sep)); await rm(folder, { recursive: true, force: true })
|
|
}
|
|
}
|