| | @@ -0,0 +1,429 @@ |
| 1 | +//! The `git` binary, behind the ports the application declares. |
| 2 | +//! |
| 3 | +//! One module owns *how* Steid invokes git — see [`run_git`] — so that isolation and |
| 4 | +//! error handling cannot drift between call sites. Milestone 4's protocol commands |
| 5 | +//! belong here too rather than growing a second recipe. |
| 6 | + |
| 7 | +use std::{ |
| 8 | + ffi::OsStr, |
| 9 | + io, |
| 10 | + path::PathBuf, |
| 11 | + process::{Output, Stdio}, |
| 12 | +}; |
| 13 | + |
| 14 | +use tokio::process::Command; |
| 15 | + |
| 16 | +use crate::{ |
| 17 | + application::port::{GitStorage, GitStorageError}, |
| 18 | + domain::{OrgName, RepoName}, |
| 19 | +}; |
| 20 | + |
| 21 | +/// Environment variables that redirect where git reads and writes data. |
| 22 | +/// |
| 23 | +/// Steid's own environment must not reach into a repository's layout. These are set |
| 24 | +/// whenever a process is spawned from inside a git hook, which is exactly the shape |
| 25 | +/// Milestone 5 will have, and the failure is silent — objects land somewhere else and |
| 26 | +/// the repository looks empty. |
| 27 | +const REDIRECTING_VARS: &[&str] = &[ |
| 28 | + "GIT_ALTERNATE_OBJECT_DIRECTORIES", |
| 29 | + "GIT_DIR", |
| 30 | + "GIT_INDEX_FILE", |
| 31 | + "GIT_OBJECT_DIRECTORY", |
| 32 | + "GIT_WORK_TREE", |
| 33 | +]; |
| 34 | + |
| 35 | +/// Bare repositories on disk, laid out as `{data_dir}/{handle}/{name}.git`. |
| 36 | +#[derive(Debug, Clone)] |
| 37 | +pub struct DiskGitStorage { |
| 38 | + data_dir: PathBuf, |
| 39 | +} |
| 40 | + |
| 41 | +impl DiskGitStorage { |
| 42 | + pub fn new(data_dir: impl Into<PathBuf>) -> Self { |
| 43 | + Self { |
| 44 | + data_dir: data_dir.into(), |
| 45 | + } |
| 46 | + } |
| 47 | +} |
| 48 | + |
| 49 | +impl GitStorage for DiskGitStorage { |
| 50 | + async fn init_bare(&self, handle: &OrgName, name: &RepoName) -> Result<(), GitStorageError> { |
| 51 | + let path = self.repo_path(handle, name); |
| 52 | + |
| 53 | + // `git init` on an existing repository exits 0 and re-initialises in silence, |
| 54 | + // so this check has to be ours. A directory with no matching record is an |
| 55 | + // orphan from a create that died between the two writes; adopting it would |
| 56 | + // resurface a private repository's objects under a fresh record. |
| 57 | + if path.exists() { |
| 58 | + return Err(GitStorageError::AlreadyExists); |
| 59 | + } |
| 60 | + |
| 61 | + // No `create_dir_all` for the parent: `git init` creates missing directories. |
| 62 | + run_git([ |
| 63 | + OsStr::new("init"), |
| 64 | + OsStr::new("--bare"), |
| 65 | + OsStr::new("--quiet"), |
| 66 | + // Skip the template directory, which otherwise seeds every repository with |
| 67 | + // sixteen `.sample` hooks. Steid installs its own hooks later, and they |
| 68 | + // would be noise to work around. |
| 69 | + OsStr::new("--template="), |
| 70 | + // Explicit, so the host's `init.defaultBranch` cannot decide what the |
| 71 | + // default branch of a Steid repository is. |
| 72 | + OsStr::new("--initial-branch=main"), |
| 73 | + // `RepoName` already forbids a leading hyphen; this makes it impossible for |
| 74 | + // a path to be read as a flag at the boundary where it costs nothing. |
| 75 | + OsStr::new("--"), |
| 76 | + path.as_os_str(), |
| 77 | + ]) |
| 78 | + .await |
| 79 | + .map(|_| ()) |
| 80 | + } |
| 81 | + |
| 82 | + async fn remove(&self, handle: &OrgName, name: &RepoName) -> Result<(), GitStorageError> { |
| 83 | + let path = self.repo_path(handle, name); |
| 84 | + |
| 85 | + // `tokio::fs` rather than `std::fs`: removing a repository with real history |
| 86 | + // walks every loose object, which is long enough to stall a runtime worker. |
| 87 | + match tokio::fs::remove_dir_all(&path).await { |
| 88 | + Ok(()) => Ok(()), |
| 89 | + // Compensation must not fail because there was nothing left to undo. |
| 90 | + Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(()), |
| 91 | + Err(error) => Err(GitStorageError::backend(error)), |
| 92 | + } |
| 93 | + } |
| 94 | + |
| 95 | + fn repo_path(&self, handle: &OrgName, name: &RepoName) -> PathBuf { |
| 96 | + // Nothing is sanitised here. `OrgName` and `RepoName` already made traversal |
| 97 | + // impossible, and re-checking at the call site is how that responsibility gets |
| 98 | + // diffused until nobody owns it. |
| 99 | + self.data_dir |
| 100 | + .join(handle.as_str()) |
| 101 | + .join(format!("{name}.git")) |
| 102 | + } |
| 103 | +} |
| 104 | + |
| 105 | +/// Runs `git` and fails on a non-zero exit. |
| 106 | +/// |
| 107 | +/// The single place that decides how Steid invokes git, so every call site gets the |
| 108 | +/// same isolation from the host: no ambient configuration, no redirected object |
| 109 | +/// storage, no inherited stdin. Never depends on the working directory — callers pass |
| 110 | +/// absolute paths. |
| 111 | +async fn run_git<I, S>(args: I) -> Result<Output, GitStorageError> |
| 112 | +where |
| 113 | + I: IntoIterator<Item = S>, |
| 114 | + S: AsRef<OsStr>, |
| 115 | +{ |
| 116 | + let mut command = Command::new("git"); |
| 117 | + command |
| 118 | + .args(args) |
| 119 | + // Host configuration must not leak into repositories Steid creates, for the |
| 120 | + // same reason `--initial-branch` is passed explicitly. |
| 121 | + .env("GIT_CONFIG_GLOBAL", "/dev/null") |
| 122 | + .env("GIT_CONFIG_SYSTEM", "/dev/null") |
| 123 | + .stdin(Stdio::null()); |
| 124 | + |
| 125 | + for variable in REDIRECTING_VARS { |
| 126 | + command.env_remove(variable); |
| 127 | + } |
| 128 | + |
| 129 | + // `output()` pipes stdout and stderr and waits without blocking the runtime. |
| 130 | + let output = command |
| 131 | + .output() |
| 132 | + .await |
| 133 | + .map_err(|error| GitStorageError::backend(format!("could not run git: {error}")))?; |
| 134 | + |
| 135 | + if !output.status.success() { |
| 136 | + // Carry git's own words. "command failed" sends the next person to read this |
| 137 | + // code instead of reading the error. |
| 138 | + return Err(GitStorageError::backend(format!( |
| 139 | + "git exited with {}: {}", |
| 140 | + output.status, |
| 141 | + String::from_utf8_lossy(&output.stderr).trim() |
| 142 | + ))); |
| 143 | + } |
| 144 | + |
| 145 | + Ok(output) |
| 146 | +} |
| 147 | + |
| 148 | +#[cfg(test)] |
| 149 | +mod tests { |
| 150 | + use std::path::Path; |
| 151 | + |
| 152 | + use tempfile::TempDir; |
| 153 | + |
| 154 | + use super::*; |
| 155 | + |
| 156 | + /// The `TempDir` is returned alongside the storage because dropping it deletes the |
| 157 | + /// data directory — binding it to `_` would remove the fixture mid-test. |
| 158 | + fn storage() -> (TempDir, DiskGitStorage) { |
| 159 | + let dir = TempDir::new().expect("temp dir"); |
| 160 | + let storage = DiskGitStorage::new(dir.path()); |
| 161 | + (dir, storage) |
| 162 | + } |
| 163 | + |
| 164 | + fn handle() -> OrgName { |
| 165 | + OrgName::new("jamesgill").expect("valid handle") |
| 166 | + } |
| 167 | + |
| 168 | + fn repo_name(value: &str) -> RepoName { |
| 169 | + RepoName::new(value).expect("valid repository name") |
| 170 | + } |
| 171 | + |
| 172 | + /// Asks git about a repository, so assertions test what git believes rather than |
| 173 | + /// what the directory looks like. |
| 174 | + fn git_says(path: &Path, args: &[&str]) -> String { |
| 175 | + let output = std::process::Command::new("git") |
| 176 | + .arg("-C") |
| 177 | + .arg(path) |
| 178 | + .args(args) |
| 179 | + .output() |
| 180 | + .expect("git should be on PATH"); |
| 181 | + |
| 182 | + assert!( |
| 183 | + output.status.success(), |
| 184 | + "git {args:?} failed: {}", |
| 185 | + String::from_utf8_lossy(&output.stderr) |
| 186 | + ); |
| 187 | + |
| 188 | + String::from_utf8_lossy(&output.stdout).trim().to_owned() |
| 189 | + } |
| 190 | + |
| 191 | + #[tokio::test] |
| 192 | + async fn init_bare_creates_a_bare_repository() { |
| 193 | + let (_dir, storage) = storage(); |
| 194 | + |
| 195 | + storage |
| 196 | + .init_bare(&handle(), &repo_name("steid")) |
| 197 | + .await |
| 198 | + .expect("should create"); |
| 199 | + |
| 200 | + let path = storage.repo_path(&handle(), &repo_name("steid")); |
| 201 | + assert!(path.is_dir(), "expected a repository at {path:?}"); |
| 202 | + assert_eq!( |
| 203 | + git_says(&path, &["rev-parse", "--is-bare-repository"]), |
| 204 | + "true" |
| 205 | + ); |
| 206 | + } |
| 207 | + |
| 208 | + #[tokio::test] |
| 209 | + async fn a_new_repository_is_empty() { |
| 210 | + // Empty, like GitHub: no initial commit and no branch yet. |
| 211 | + let (_dir, storage) = storage(); |
| 212 | + storage |
| 213 | + .init_bare(&handle(), &repo_name("steid")) |
| 214 | + .await |
| 215 | + .expect("should create"); |
| 216 | + |
| 217 | + let path = storage.repo_path(&handle(), &repo_name("steid")); |
| 218 | + |
| 219 | + assert_eq!(git_says(&path, &["for-each-ref"]), ""); |
| 220 | + } |
| 221 | + |
| 222 | + #[tokio::test] |
| 223 | + async fn a_new_repository_defaults_to_main() { |
| 224 | + // Pinned so the host's `init.defaultBranch` cannot decide this. It currently |
| 225 | + // agrees on this machine, which is exactly why a drift would go unnoticed. |
| 226 | + let (_dir, storage) = storage(); |
| 227 | + storage |
| 228 | + .init_bare(&handle(), &repo_name("steid")) |
| 229 | + .await |
| 230 | + .expect("should create"); |
| 231 | + |
| 232 | + let path = storage.repo_path(&handle(), &repo_name("steid")); |
| 233 | + |
| 234 | + assert_eq!( |
| 235 | + git_says(&path, &["symbolic-ref", "HEAD"]), |
| 236 | + "refs/heads/main" |
| 237 | + ); |
| 238 | + } |
| 239 | + |
| 240 | + #[tokio::test] |
| 241 | + async fn no_sample_hooks_are_installed() { |
| 242 | + // Pins `--template=`. A default init seeds sixteen `.sample` files. |
| 243 | + let (_dir, storage) = storage(); |
| 244 | + storage |
| 245 | + .init_bare(&handle(), &repo_name("steid")) |
| 246 | + .await |
| 247 | + .expect("should create"); |
| 248 | + |
| 249 | + let hooks = storage |
| 250 | + .repo_path(&handle(), &repo_name("steid")) |
| 251 | + .join("hooks"); |
| 252 | + |
| 253 | + let samples = std::fs::read_dir(&hooks) |
| 254 | + .map(|entries| entries.count()) |
| 255 | + .unwrap_or(0); |
| 256 | + assert_eq!(samples, 0, "expected no templated hooks in {hooks:?}"); |
| 257 | + } |
| 258 | + |
| 259 | + #[tokio::test] |
| 260 | + async fn init_bare_creates_the_handle_directory() { |
| 261 | + let (dir, storage) = storage(); |
| 262 | + assert!(!dir.path().join("jamesgill").exists()); |
| 263 | + |
| 264 | + storage |
| 265 | + .init_bare(&handle(), &repo_name("steid")) |
| 266 | + .await |
| 267 | + .expect("should create"); |
| 268 | + |
| 269 | + assert!(dir.path().join("jamesgill").is_dir()); |
| 270 | + } |
| 271 | + |
| 272 | + #[tokio::test] |
| 273 | + async fn one_handle_can_own_several_repositories() { |
| 274 | + let (_dir, storage) = storage(); |
| 275 | + |
| 276 | + for name in ["steid", "foo.js", ".github"] { |
| 277 | + storage |
| 278 | + .init_bare(&handle(), &repo_name(name)) |
| 279 | + .await |
| 280 | + .unwrap_or_else(|error| panic!("{name} should create: {error}")); |
| 281 | + } |
| 282 | + |
| 283 | + for name in ["steid", "foo.js", ".github"] { |
| 284 | + assert!(storage.repo_path(&handle(), &repo_name(name)).is_dir()); |
| 285 | + } |
| 286 | + } |
| 287 | + |
| 288 | + #[tokio::test] |
| 289 | + async fn init_bare_refuses_a_repository_that_already_exists() { |
| 290 | + let (_dir, storage) = storage(); |
| 291 | + storage |
| 292 | + .init_bare(&handle(), &repo_name("steid")) |
| 293 | + .await |
| 294 | + .expect("should create"); |
| 295 | + |
| 296 | + let error = storage |
| 297 | + .init_bare(&handle(), &repo_name("steid")) |
| 298 | + .await |
| 299 | + .expect_err("should refuse"); |
| 300 | + |
| 301 | + assert!(matches!(error, GitStorageError::AlreadyExists)); |
| 302 | + } |
| 303 | + |
| 304 | + #[tokio::test] |
| 305 | + async fn a_refused_init_leaves_the_existing_repository_alone() { |
| 306 | + // git would happily re-initialise in place. The point of refusing is that |
| 307 | + // whatever is already there is not touched. |
| 308 | + let (_dir, storage) = storage(); |
| 309 | + storage |
| 310 | + .init_bare(&handle(), &repo_name("steid")) |
| 311 | + .await |
| 312 | + .expect("should create"); |
| 313 | + |
| 314 | + let path = storage.repo_path(&handle(), &repo_name("steid")); |
| 315 | + let marker = path.join("objects").join("marker"); |
| 316 | + std::fs::write(&marker, b"existing data").expect("write marker"); |
| 317 | + |
| 318 | + let _ = storage.init_bare(&handle(), &repo_name("steid")).await; |
| 319 | + |
| 320 | + assert_eq!( |
| 321 | + std::fs::read(&marker).expect("marker should survive"), |
| 322 | + b"existing data" |
| 323 | + ); |
| 324 | + } |
| 325 | + |
| 326 | + #[tokio::test] |
| 327 | + async fn repo_path_creates_nothing() { |
| 328 | + let (dir, storage) = storage(); |
| 329 | + |
| 330 | + let path = storage.repo_path(&handle(), &repo_name("never-created")); |
| 331 | + |
| 332 | + assert!(!path.exists()); |
| 333 | + assert_eq!( |
| 334 | + std::fs::read_dir(dir.path()) |
| 335 | + .expect("data dir should exist") |
| 336 | + .count(), |
| 337 | + 0, |
| 338 | + "repo_path must be pure" |
| 339 | + ); |
| 340 | + } |
| 341 | + |
| 342 | + #[tokio::test] |
| 343 | + async fn repo_path_lands_under_the_data_directory() { |
| 344 | + let (dir, storage) = storage(); |
| 345 | + |
| 346 | + let path = storage.repo_path(&handle(), &repo_name("steid")); |
| 347 | + |
| 348 | + assert_eq!(path, dir.path().join("jamesgill").join("steid.git")); |
| 349 | + } |
| 350 | + |
| 351 | + #[tokio::test] |
| 352 | + async fn remove_deletes_the_repository() { |
| 353 | + let (_dir, storage) = storage(); |
| 354 | + storage |
| 355 | + .init_bare(&handle(), &repo_name("steid")) |
| 356 | + .await |
| 357 | + .expect("should create"); |
| 358 | + |
| 359 | + storage |
| 360 | + .remove(&handle(), &repo_name("steid")) |
| 361 | + .await |
| 362 | + .expect("should remove"); |
| 363 | + |
| 364 | + assert!(!storage.repo_path(&handle(), &repo_name("steid")).exists()); |
| 365 | + } |
| 366 | + |
| 367 | + #[tokio::test] |
| 368 | + async fn removing_what_is_not_there_succeeds() { |
| 369 | + // Compensation runs when a create failed, which may be before anything landed. |
| 370 | + let (_dir, storage) = storage(); |
| 371 | + |
| 372 | + storage |
| 373 | + .remove(&handle(), &repo_name("never-created")) |
| 374 | + .await |
| 375 | + .expect("should succeed with nothing to do"); |
| 376 | + } |
| 377 | + |
| 378 | + #[tokio::test] |
| 379 | + async fn a_compensated_create_can_be_retried() { |
| 380 | + // The whole point of `remove`: create, fail to record it, undo, try again. |
| 381 | + let (_dir, storage) = storage(); |
| 382 | + |
| 383 | + storage |
| 384 | + .init_bare(&handle(), &repo_name("steid")) |
| 385 | + .await |
| 386 | + .expect("should create"); |
| 387 | + storage |
| 388 | + .remove(&handle(), &repo_name("steid")) |
| 389 | + .await |
| 390 | + .expect("should remove"); |
| 391 | + storage |
| 392 | + .init_bare(&handle(), &repo_name("steid")) |
| 393 | + .await |
| 394 | + .expect("should create again"); |
| 395 | + } |
| 396 | + |
| 397 | + #[tokio::test] |
| 398 | + async fn removing_one_repository_leaves_its_neighbours() { |
| 399 | + let (_dir, storage) = storage(); |
| 400 | + storage |
| 401 | + .init_bare(&handle(), &repo_name("steid")) |
| 402 | + .await |
| 403 | + .expect("should create"); |
| 404 | + storage |
| 405 | + .init_bare(&handle(), &repo_name("keeper")) |
| 406 | + .await |
| 407 | + .expect("should create"); |
| 408 | + |
| 409 | + storage |
| 410 | + .remove(&handle(), &repo_name("steid")) |
| 411 | + .await |
| 412 | + .expect("should remove"); |
| 413 | + |
| 414 | + assert!(storage.repo_path(&handle(), &repo_name("keeper")).is_dir()); |
| 415 | + } |
| 416 | + |
| 417 | + #[tokio::test] |
| 418 | + async fn a_failing_git_invocation_carries_gits_own_message() { |
| 419 | + let error = run_git(["not-a-real-subcommand"]) |
| 420 | + .await |
| 421 | + .expect_err("should fail"); |
| 422 | + |
| 423 | + let message = error.to_string(); |
| 424 | + assert!( |
| 425 | + message.contains("not-a-real-subcommand"), |
| 426 | + "expected git's own words, got: {message}" |
| 427 | + ); |
| 428 | + } |
| 429 | +} |