feat(registry): add workspace-scoped artifact metadata
This commit is contained in:
@@ -0,0 +1,536 @@
|
||||
use super::common::TestDatabase;
|
||||
|
||||
use std::{
|
||||
fs,
|
||||
os::unix::fs::PermissionsExt,
|
||||
path::PathBuf,
|
||||
sync::atomic::{AtomicU64, Ordering},
|
||||
};
|
||||
|
||||
use crank_artifacts::{ArtifactRef, ArtifactStore};
|
||||
use crank_core::{Workspace, WorkspaceId, WorkspaceStatus};
|
||||
use crank_registry::{
|
||||
ArtifactSourceId, ArtifactSourceLifecycle, ArtifactSourceSensitivity,
|
||||
CreateArtifactSourceRequest, CreateWorkspaceRequest, DetachArtifactSourceRequest,
|
||||
ListArtifactSourcesQuery, RegistryError,
|
||||
};
|
||||
use serde_json::json;
|
||||
use time::{OffsetDateTime, format_description::well_known::Rfc3339};
|
||||
|
||||
static NEXT_ROOT: AtomicU64 = AtomicU64::new(0);
|
||||
|
||||
struct TestRoot(PathBuf);
|
||||
|
||||
impl TestRoot {
|
||||
fn new(name: &str) -> Self {
|
||||
let path = std::env::temp_dir().join(format!(
|
||||
"crank-registry-artifacts-{name}-{}-{}",
|
||||
std::process::id(),
|
||||
NEXT_ROOT.fetch_add(1, Ordering::Relaxed)
|
||||
));
|
||||
fs::create_dir(&path).unwrap();
|
||||
fs::set_permissions(&path, fs::Permissions::from_mode(0o700)).unwrap();
|
||||
Self(path)
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for TestRoot {
|
||||
fn drop(&mut self) {
|
||||
let _ = fs::set_permissions(&self.0, fs::Permissions::from_mode(0o700));
|
||||
let _ = fs::remove_dir_all(&self.0);
|
||||
}
|
||||
}
|
||||
|
||||
fn timestamp(value: &str) -> OffsetDateTime {
|
||||
OffsetDateTime::parse(value, &Rfc3339).unwrap()
|
||||
}
|
||||
|
||||
async fn create_workspace(registry: &crank_registry::PostgresRegistry, id: &str) -> WorkspaceId {
|
||||
let workspace_id = WorkspaceId::new(id);
|
||||
let created_at = timestamp("2026-08-26T10:00:00Z");
|
||||
registry
|
||||
.create_workspace(CreateWorkspaceRequest {
|
||||
workspace: &Workspace {
|
||||
id: workspace_id.clone(),
|
||||
slug: id.replace('_', "-"),
|
||||
display_name: id.to_owned(),
|
||||
status: WorkspaceStatus::Active,
|
||||
settings: json!({}),
|
||||
created_at,
|
||||
updated_at: created_at,
|
||||
},
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
workspace_id
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn source_relations_are_scoped_replayable_pageable_and_detachable() {
|
||||
let database = TestDatabase::new().await;
|
||||
let registry = database.registry().await;
|
||||
let workspace_a = create_workspace(®istry, "ws_artifacts_a").await;
|
||||
let workspace_b = create_workspace(®istry, "ws_artifacts_b").await;
|
||||
let root = TestRoot::new("relations");
|
||||
let store = ArtifactStore::open(&root.0).unwrap();
|
||||
let registered = store.put_registered(b"openapi: 3.1.0\n").unwrap();
|
||||
let source_id = ArtifactSourceId::new("src_shared");
|
||||
let created_at = timestamp("2026-08-26T10:01:00Z");
|
||||
|
||||
let created = registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
let replayed = registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at: timestamp("2026-08-26T10:02:00Z"),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(replayed, created);
|
||||
|
||||
assert!(matches!(
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/json",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at,
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
));
|
||||
assert!(matches!(
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Secret,
|
||||
created_at,
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
));
|
||||
let different = store.put_registered(b"openapi: 3.0.3\n").unwrap();
|
||||
assert!(matches!(
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
artifact: &different,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at,
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
));
|
||||
assert!(matches!(
|
||||
registry.get_artifact_source(&workspace_b, &source_id).await,
|
||||
Err(RegistryError::SourceNotFound { .. })
|
||||
));
|
||||
|
||||
let shared_in_b = registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_b,
|
||||
source_id: &source_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Secret,
|
||||
created_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(shared_in_b.blob.digest, created.blob.digest);
|
||||
assert_ne!(shared_in_b.sensitivity, created.sensitivity);
|
||||
let raw_pool = database.raw_pool().await;
|
||||
let blob_count =
|
||||
sqlx::query_scalar::<_, i64>("select count(*) from artifact_blobs where digest = $1")
|
||||
.bind(registered.artifact_ref().digest_hex())
|
||||
.fetch_one(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(blob_count, 1);
|
||||
let total_blob_count: i64 = sqlx::query_scalar("select count(*) from artifact_blobs")
|
||||
.fetch_one(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
total_blob_count, 1,
|
||||
"conflicting replay must roll back blob metadata"
|
||||
);
|
||||
|
||||
for id in ["src_page_a", "src_page_b"] {
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &ArtifactSourceId::new(id),
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Public,
|
||||
created_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
let first = registry
|
||||
.list_artifact_sources(ListArtifactSourcesQuery {
|
||||
workspace_id: &workspace_a,
|
||||
cursor: None,
|
||||
limit: 2,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(first.items.len(), 2);
|
||||
let second = registry
|
||||
.list_artifact_sources(ListArtifactSourcesQuery {
|
||||
workspace_id: &workspace_a,
|
||||
cursor: first.next_cursor.as_ref(),
|
||||
limit: 2,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(second.items.len(), 1);
|
||||
assert!(second.next_cursor.is_none());
|
||||
let listed_ids = first
|
||||
.items
|
||||
.iter()
|
||||
.chain(second.items.iter())
|
||||
.map(|source| source.source_id.as_str())
|
||||
.collect::<Vec<_>>();
|
||||
assert_eq!(listed_ids, vec!["src_page_a", "src_page_b", "src_shared"]);
|
||||
assert!(
|
||||
first
|
||||
.items
|
||||
.iter()
|
||||
.chain(second.items.iter())
|
||||
.all(|source| source.workspace_id == workspace_a)
|
||||
);
|
||||
assert!(matches!(
|
||||
registry
|
||||
.list_artifact_sources(ListArtifactSourcesQuery {
|
||||
workspace_id: &workspace_b,
|
||||
cursor: first.next_cursor.as_ref(),
|
||||
limit: 2,
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::InvalidArtifactSource { field: "cursor" })
|
||||
));
|
||||
|
||||
sqlx::query(
|
||||
"insert into artifact_sources
|
||||
(workspace_id, source_id, blob_digest, mime_type, sensitivity, lifecycle,
|
||||
created_at, updated_at)
|
||||
select $1, 'src_bulk_' || lpad(value::text, 3, '0'), $2,
|
||||
'application/yaml', 'public', 'active', $3, $3
|
||||
from generate_series(0, 100) as value",
|
||||
)
|
||||
.bind(workspace_a.as_str())
|
||||
.bind(registered.artifact_ref().digest_hex())
|
||||
.bind(created_at)
|
||||
.execute(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
let capped = registry
|
||||
.list_artifact_sources(ListArtifactSourcesQuery {
|
||||
workspace_id: &workspace_a,
|
||||
cursor: None,
|
||||
limit: u32::MAX,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(capped.items.len(), 100);
|
||||
let tail = registry
|
||||
.list_artifact_sources(ListArtifactSourcesQuery {
|
||||
workspace_id: &workspace_a,
|
||||
cursor: capped.next_cursor.as_ref(),
|
||||
limit: u32::MAX,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(tail.items.len(), 4);
|
||||
assert!(tail.next_cursor.is_none());
|
||||
|
||||
let invalid_id = ArtifactSourceId::new(format!("src_{}", "x".repeat(129)));
|
||||
assert!(matches!(
|
||||
registry
|
||||
.get_artifact_source(&workspace_a, &invalid_id)
|
||||
.await,
|
||||
Err(RegistryError::InvalidArtifactSource { field: "source_id" })
|
||||
));
|
||||
assert!(matches!(
|
||||
registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &invalid_id,
|
||||
expected_updated_at: None,
|
||||
detached_at: created_at,
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::InvalidArtifactSource { field: "source_id" })
|
||||
));
|
||||
|
||||
let detached_at = timestamp("2026-08-26T10:03:00Z");
|
||||
let detached = registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
expected_updated_at: Some(created.updated_at),
|
||||
detached_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(detached.lifecycle, ArtifactSourceLifecycle::Detached);
|
||||
let retry = registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
expected_updated_at: Some(created.updated_at),
|
||||
detached_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(retry, detached);
|
||||
assert!(matches!(
|
||||
registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &source_id,
|
||||
expected_updated_at: Some(created.updated_at),
|
||||
detached_at: timestamp("2026-08-26T10:04:00Z"),
|
||||
})
|
||||
.await,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
));
|
||||
assert_eq!(
|
||||
registry
|
||||
.get_artifact_source(&workspace_a, &source_id)
|
||||
.await
|
||||
.unwrap()
|
||||
.lifecycle,
|
||||
ArtifactSourceLifecycle::Detached
|
||||
);
|
||||
assert!(matches!(
|
||||
registry
|
||||
.read_artifact_source(&store, &workspace_a, &source_id)
|
||||
.await,
|
||||
Err(RegistryError::SourceUnavailable)
|
||||
));
|
||||
assert_eq!(
|
||||
store.read(registered.artifact_ref()).unwrap(),
|
||||
b"openapi: 3.1.0\n"
|
||||
);
|
||||
|
||||
let concurrent_id = ArtifactSourceId::new("src_concurrent");
|
||||
let concurrent = registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_a,
|
||||
source_id: &concurrent_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
let first_registry = registry.clone();
|
||||
let second_registry = registry.clone();
|
||||
let first_workspace = workspace_a.clone();
|
||||
let second_workspace = workspace_a.clone();
|
||||
let first_id = concurrent_id.clone();
|
||||
let second_id = concurrent_id.clone();
|
||||
let (first_detach, second_detach) = tokio::join!(
|
||||
async move {
|
||||
first_registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &first_workspace,
|
||||
source_id: &first_id,
|
||||
expected_updated_at: Some(concurrent.updated_at),
|
||||
detached_at: timestamp("2026-08-26T10:05:00Z"),
|
||||
})
|
||||
.await
|
||||
},
|
||||
async move {
|
||||
second_registry
|
||||
.detach_artifact_source(DetachArtifactSourceRequest {
|
||||
workspace_id: &second_workspace,
|
||||
source_id: &second_id,
|
||||
expected_updated_at: Some(concurrent.updated_at),
|
||||
detached_at: timestamp("2026-08-26T10:06:00Z"),
|
||||
})
|
||||
.await
|
||||
}
|
||||
);
|
||||
assert_eq!(
|
||||
usize::from(first_detach.is_ok()) + usize::from(second_detach.is_ok()),
|
||||
1
|
||||
);
|
||||
assert_eq!(
|
||||
usize::from(matches!(
|
||||
first_detach,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
)) + usize::from(matches!(
|
||||
second_detach,
|
||||
Err(RegistryError::SourceConflict { .. })
|
||||
)),
|
||||
1
|
||||
);
|
||||
|
||||
database.cleanup().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn verified_read_returns_only_digest_and_size_verified_bytes() {
|
||||
let database = TestDatabase::new().await;
|
||||
let registry = database.registry().await;
|
||||
let workspace_id = create_workspace(®istry, "ws_verified_read").await;
|
||||
let root = TestRoot::new("verified-read");
|
||||
let store = ArtifactStore::open(&root.0).unwrap();
|
||||
let bytes = b"openapi: 3.1.0\ninfo: {}\n";
|
||||
let registered = store.put_registered(bytes).unwrap();
|
||||
let valid_id = ArtifactSourceId::new("src_valid");
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_id,
|
||||
source_id: &valid_id,
|
||||
artifact: ®istered,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Secret,
|
||||
created_at: timestamp("2026-08-26T11:00:00Z"),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
let verified = registry
|
||||
.read_artifact_source(&store, &workspace_id, &valid_id)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(verified.bytes, bytes);
|
||||
|
||||
let raw_pool = database.raw_pool().await;
|
||||
let missing_ref = ArtifactRef::from_digest_hex(&"f".repeat(64)).unwrap();
|
||||
let missing_id = ArtifactSourceId::new("src_missing");
|
||||
sqlx::query(
|
||||
"insert into artifact_blobs
|
||||
(digest, artifact_ref, size_bytes, storage_lifecycle, created_at, updated_at)
|
||||
values ($1, $2, 12, 'available', $3, $3)",
|
||||
)
|
||||
.bind(missing_ref.digest_hex())
|
||||
.bind(missing_ref.as_str())
|
||||
.bind(timestamp("2026-08-26T11:01:00Z"))
|
||||
.execute(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
sqlx::query(
|
||||
"insert into artifact_sources
|
||||
(workspace_id, source_id, blob_digest, mime_type, sensitivity, lifecycle,
|
||||
created_at, updated_at)
|
||||
values ($1, $2, $3, 'application/yaml', 'internal', 'active', $4, $4)",
|
||||
)
|
||||
.bind(workspace_id.as_str())
|
||||
.bind(missing_id.as_str())
|
||||
.bind(missing_ref.digest_hex())
|
||||
.bind(timestamp("2026-08-26T11:01:00Z"))
|
||||
.execute(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(matches!(
|
||||
registry
|
||||
.read_artifact_source(&store, &workspace_id, &missing_id)
|
||||
.await,
|
||||
Err(RegistryError::SourceUnavailable)
|
||||
));
|
||||
assert!(
|
||||
registry
|
||||
.get_artifact_source(&workspace_id, &missing_id)
|
||||
.await
|
||||
.is_ok()
|
||||
);
|
||||
|
||||
let wrong_size_id = ArtifactSourceId::new("src_wrong_size");
|
||||
let wrong_size = store.put_registered(b"different source").unwrap();
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_id,
|
||||
source_id: &wrong_size_id,
|
||||
artifact: &wrong_size,
|
||||
mime_type: "application/yaml",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at: timestamp("2026-08-26T11:02:00Z"),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
sqlx::query("update artifact_blobs set size_bytes = size_bytes + 1 where digest = $1")
|
||||
.bind(wrong_size.artifact_ref().digest_hex())
|
||||
.execute(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(matches!(
|
||||
registry
|
||||
.read_artifact_source(&store, &workspace_id, &wrong_size_id)
|
||||
.await,
|
||||
Err(RegistryError::SourceIntegrity)
|
||||
));
|
||||
|
||||
let unavailable = store.put_registered(b"temporarily unavailable").unwrap();
|
||||
let unavailable_id = ArtifactSourceId::new("src_unavailable");
|
||||
registry
|
||||
.create_artifact_source(CreateArtifactSourceRequest {
|
||||
workspace_id: &workspace_id,
|
||||
source_id: &unavailable_id,
|
||||
artifact: &unavailable,
|
||||
mime_type: "text/plain",
|
||||
sensitivity: ArtifactSourceSensitivity::Internal,
|
||||
created_at: timestamp("2026-08-26T11:03:00Z"),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
sqlx::query("update artifact_blobs set storage_lifecycle = 'unavailable' where digest = $1")
|
||||
.bind(unavailable.artifact_ref().digest_hex())
|
||||
.execute(&raw_pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(matches!(
|
||||
registry
|
||||
.read_artifact_source(&store, &workspace_id, &unavailable_id)
|
||||
.await,
|
||||
Err(RegistryError::SourceUnavailable)
|
||||
));
|
||||
|
||||
let tampered = root
|
||||
.0
|
||||
.join("sha256")
|
||||
.join(registered.artifact_ref().digest_hex().get(..2).unwrap())
|
||||
.join(registered.artifact_ref().digest_hex());
|
||||
fs::set_permissions(&tampered, fs::Permissions::from_mode(0o600)).unwrap();
|
||||
fs::write(&tampered, vec![b'x'; bytes.len()]).unwrap();
|
||||
assert!(matches!(
|
||||
registry
|
||||
.read_artifact_source(&store, &workspace_id, &valid_id)
|
||||
.await,
|
||||
Err(RegistryError::SourceIntegrity)
|
||||
));
|
||||
assert!(
|
||||
registry
|
||||
.get_artifact_source(&workspace_id, &valid_id)
|
||||
.await
|
||||
.is_ok()
|
||||
);
|
||||
|
||||
database.cleanup().await;
|
||||
}
|
||||
Reference in New Issue
Block a user