dovenest

dovenest/server/src/fs.rs
fs.rs
⎇
Raw
1//! Safe filesystem access: every operation resolves
2//! `<server-root>/<user-root>/<requested-path>`, canonicalizes it and verifies
3//! the result is still inside the user's root (blocks `..` and symlink escapes).
4
5use std::io::Read;
6use std::path::{Component, Path, PathBuf};
7use std::time::UNIX_EPOCH;
8
9use chrono::DateTime;
10
11use api_types::{Entry, FileKind};
12
13use crate::error::ApiError;
14
15#[derive(Debug, thiserror::Error)]
16pub enum FsError {
17 #[error("folder not found")]
18 NotFound,
19 #[error("not a folder")]
20 NotADirectory,
21 #[error("access denied")]
22 Forbidden,
23 #[error("the configured folder no longer exists")]
24 RootMissing,
25 #[error("already exists")]
26 Conflict,
27 #[error("{0}")]
28 Invalid(String),
29}
30
31impl From<FsError> for ApiError {
32 fn from(e: FsError) -> Self {
33 use axum::http::StatusCode as S;
34 match &e {
35 FsError::NotFound => {
36 ApiError::localized(S::NOT_FOUND, e.to_string(), "err_fs_not_found")
37 }
38 FsError::NotADirectory => {
39 ApiError::localized(S::BAD_REQUEST, e.to_string(), "err_fs_not_a_dir")
40 }
41 FsError::Forbidden => {
42 ApiError::localized(S::FORBIDDEN, e.to_string(), "err_fs_forbidden")
43 }
44 FsError::RootMissing => {
45 ApiError::localized(S::NOT_FOUND, e.to_string(), "err_fs_root_missing")
46 }
47 FsError::Conflict => ApiError::localized(S::CONFLICT, e.to_string(), "err_fs_conflict"),
48 // Dynamic message (e.g. an invalid name), not a fixed string.
49 FsError::Invalid(_) => ApiError::new(S::BAD_REQUEST, e.to_string()),
50 }
51 }
52}
53
54/// Resolve a user root (path relative to the server root) to a canonical
55/// absolute path, verified to be inside the server root.
56pub fn resolve_root(server_root: &Path, root_rel: &str) -> Result<PathBuf, FsError> {
57 let candidate = server_root.join(root_rel);
58 let canonical = candidate.canonicalize().map_err(|_| FsError::RootMissing)?;
59 ensure_within(server_root, &canonical)?;
60 if !canonical.is_dir() {
61 return Err(FsError::RootMissing);
62 }
63 Ok(canonical)
64}
65
66/// Resolve a requested path (relative to a user root) safely.
67pub fn resolve_path(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<PathBuf, FsError> {
68 let root_abs = resolve_root(server_root, root_rel)?;
69 let req = Path::new(req_rel);
70 for c in req.components() {
71 if matches!(c, Component::ParentDir) {
72 return Err(FsError::Forbidden);
73 }
74 }
75 let full = root_abs.join(req);
76 let full = full.canonicalize().map_err(|e| match e.kind() {
77 std::io::ErrorKind::NotFound => FsError::NotFound,
78 _ => FsError::Forbidden,
79 })?;
80 ensure_within(&root_abs, &full)?;
81 Ok(full)
82}
83
84/// Resolve a share target that is a single file (relative to the server root).
85/// Unlike [`resolve_path`], the target itself is the file — there is no
86/// directory root beneath it.
87pub fn resolve_file(server_root: &Path, rel: &str) -> Result<PathBuf, FsError> {
88 let full = server_root.join(rel);
89 let full = full.canonicalize().map_err(|e| match e.kind() {
90 std::io::ErrorKind::NotFound => FsError::NotFound,
91 _ => FsError::Forbidden,
92 })?;
93 ensure_within(server_root, &full)?;
94 Ok(full)
95}
96
97fn ensure_within(base: &Path, p: &Path) -> Result<(), FsError> {
98 if p == base || p.starts_with(base) {
99 Ok(())
100 } else {
101 Err(FsError::Forbidden)
102 }
103}
104
105/// List a directory (blocking — call via spawn_blocking).
106pub fn list_dir(dir: &Path) -> Result<Vec<Entry>, FsError> {
107 let rd = std::fs::read_dir(dir).map_err(|e| match e.kind() {
108 std::io::ErrorKind::NotFound => FsError::NotFound,
109 std::io::ErrorKind::NotADirectory => FsError::NotADirectory,
110 _ => FsError::Forbidden,
111 })?;
112
113 // Pass 1: names only. Walking the directory stream is inherently
114 // sequential, but it is also the only part that has to be: every field
115 // below comes from a per-entry syscall, which pass 2 can do in parallel.
116 // The values here are the fallbacks used when that syscall fails.
117 let mut rows: Vec<(Entry, PathBuf)> = Vec::new();
118 for e in rd.flatten() {
119 let entry = Entry {
120 name: e.file_name().to_string_lossy().into_owned(),
121 is_dir: false,
122 size: 0,
123 mtime: EPOCH_MTIME.to_string(),
124 kind: FileKind::Binary,
125 };
126 rows.push((entry, e.path()));
127 }
128
129 // Pass 2: the per-entry syscalls — metadata plus the content sniff.
130 describe_rows(&mut rows);
131
132 let mut entries: Vec<Entry> = rows.into_iter().map(|(e, _)| e).collect();
133 // Folders first, then case-insensitive name. Sorting after pass 2 means
134 // the parallel fan-out cannot affect the order.
135 entries.sort_by(|a, b| {
136 b.is_dir
137 .cmp(&a.is_dir)
138 .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
139 .then_with(|| a.name.cmp(&b.name))
140 });
141 Ok(entries)
142}
143
144// ---------------------------------------------------------------------------
145// Content sniffing
146// ---------------------------------------------------------------------------
147
148/// How many leading bytes we read to classify a file. Every magic number
149/// `infer` knows lives in the first few dozen bytes; 256 also gives the
150/// text/binary heuristic enough to work with. Measured at ~4.6 µs per file,
151/// against ~1.4 µs for the `metadata` call in the same pass.
152const SNIFF_BYTES: usize = 256;
153
154/// Entries per thread, and the point below which parallelism is not worth it.
155/// Measured on a 22-core machine: at 50 entries fan-out is a wash (thread
156/// spawn costs about as much as the work), at 200 it is already 2x.
157const SNIFF_CHUNK: usize = 256;
158
159/// Process-wide ceiling on threads spawned for sniffing, so many concurrent
160/// listings of large directories cannot multiply into a thread explosion.
161/// One listing alone can use the whole budget; the next one degrades to fewer
162/// threads, and eventually to serial, instead of queueing.
163static SNIFF_BUDGET: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
164
165fn sniff_budget_total() -> usize {
166 static TOTAL: std::sync::LazyLock<usize> = std::sync::LazyLock::new(|| {
167 std::thread::available_parallelism()
168 .map(|n| n.get())
169 .unwrap_or(1)
170 });
171 *TOTAL
172}
173
174/// Claimed helper threads, returned to [`SNIFF_BUDGET`] on drop.
175struct SniffPermit(usize);
176
177impl SniffPermit {
178 /// Claim up to `want` helper threads, or fewer when the budget is thin.
179 fn claim(want: usize) -> Self {
180 use std::sync::atomic::Ordering;
181 let total = sniff_budget_total();
182 let mut granted = 0;
183 let _ = SNIFF_BUDGET.fetch_update(Ordering::AcqRel, Ordering::Acquire, |in_flight| {
184 granted = want.min(total.saturating_sub(in_flight));
185 (granted > 0).then_some(in_flight + granted)
186 });
187 Self(granted)
188 }
189}
190
191impl Drop for SniffPermit {
192 fn drop(&mut self) {
193 if self.0 > 0 {
194 SNIFF_BUDGET.fetch_sub(self.0, std::sync::atomic::Ordering::AcqRel);
195 }
196 }
197}
198
199/// Fill in each row from its own syscalls — `metadata` and the content sniff —
200/// fanning them out across threads for big directories.
201///
202/// The calling thread takes a chunk too, so `n` helper threads process `n + 1`
203/// chunks and a zero-thread grant is simply the serial path.
204fn describe_rows(rows: &mut [(Entry, PathBuf)]) {
205 fn describe(rows: &mut [(Entry, PathBuf)]) {
206 for (entry, path) in rows {
207 // Follows symlinks; a broken link keeps the caller's fallbacks and
208 // so shows up as an empty file.
209 if let Ok(m) = std::fs::metadata(&path) {
210 entry.is_dir = m.is_dir();
211 entry.size = m.len();
212 entry.mtime = mtime_str(&m);
213 }
214 entry.kind = detect_kind(path, entry.is_dir);
215 }
216 }
217
218 if rows.len() < SNIFF_CHUNK {
219 describe(rows);
220 return;
221 }
222 // One chunk per helper thread plus one for this thread.
223 let want = rows.len().div_ceil(SNIFF_CHUNK).saturating_sub(1);
224 let permit = SniffPermit::claim(want);
225 if permit.0 == 0 {
226 describe(rows);
227 return;
228 }
229 let chunk = rows.len().div_ceil(permit.0 + 1);
230 std::thread::scope(|s| {
231 let mut rest = rows;
232 // Hand every chunk but the last to a helper thread.
233 while rest.len() > chunk {
234 let (head, tail) = rest.split_at_mut(chunk);
235 s.spawn(|| describe(head));
236 rest = tail;
237 }
238 describe(rest);
239 });
240}
241
242/// Classify a directory entry by reading its first [`SNIFF_BYTES`] bytes.
243///
244/// Blocking — called from `list_dir` (itself under `spawn_blocking`), on
245/// several threads at once for large directories. An unreadable file is
246/// reported as [`FileKind::Binary`] rather than failing the whole listing.
247///
248// ponytail: one open() per entry, fanned out but not cached. Measured warm on
249// 22 cores: 5000 entries take 29 ms serially and 6.9 ms across threads. The
250// remaining ceiling is a cold cache or a network filesystem (NFS/SMB), where
251// each entry costs a round trip. If that shows up: cache by (dev, ino, mtime),
252// or skip the sniff for zero-byte files.
253pub fn detect_kind(path: &Path, is_dir: bool) -> FileKind {
254 if is_dir {
255 return FileKind::Dir;
256 }
257 let mut head = [0u8; SNIFF_BYTES];
258 // A read error is *not* the same as an empty file: an empty file is text
259 // (it opens in the editor), an unreadable one gets no viewer offered.
260 match std::fs::File::open(path).and_then(|mut f| f.read(&mut head)) {
261 Ok(n) => kind_from_bytes(&head[..n], path),
262 Err(_) => FileKind::Binary,
263 }
264}
265
266/// The pure half of [`detect_kind`], so it can be unit-tested without a disk.
267///
268/// `path` is consulted only for the SVG case: SVG is XML text with no magic
269/// number, but browsers render it as an image, so the extension is the only
270/// thing that can tell us to offer an image preview.
271fn kind_from_bytes(head: &[u8], path: &Path) -> FileKind {
272 if let Some(t) = infer::get(head) {
273 // PDF is filed under `Archive` by `infer`, so match the MIME first.
274 if t.mime_type() == "application/pdf" {
275 return FileKind::Pdf;
276 }
277 return match t.matcher_type() {
278 infer::MatcherType::Image => FileKind::Image,
279 infer::MatcherType::Video => FileKind::Video,
280 infer::MatcherType::Audio => FileKind::Audio,
281 infer::MatcherType::Archive => FileKind::Archive,
282 infer::MatcherType::Text => FileKind::Text,
283 // App / Book / Font / Doc / Custom: recognized, but nothing we
284 // can show in the browser.
285 _ => FileKind::Binary,
286 };
287 }
288 if !looks_like_text(head) {
289 return FileKind::Binary;
290 }
291 let ext = path
292 .extension()
293 .map(|e| e.to_string_lossy().to_lowercase())
294 .unwrap_or_default();
295 if ext == "svg" {
296 FileKind::Image
297 } else {
298 FileKind::Text
299 }
300}
301
302/// Text heuristic for the files `infer` has no signature for (plain text,
303/// source code, most config formats): no NUL byte, and the head decodes as
304/// UTF-8 once a truncated trailing character is discounted.
305///
306/// An empty file counts as text — it opens in the editor, which is what you
307/// want for a file you just created.
308fn looks_like_text(head: &[u8]) -> bool {
309 if head.contains(&0) {
310 return false;
311 }
312 match std::str::from_utf8(head) {
313 Ok(_) => true,
314 // A multi-byte character cut in half by the read boundary is fine;
315 // anything else is not text. `error_len() == None` means "unexpected
316 // end of input", i.e. truncation.
317 Err(e) => e.error_len().is_none() && e.valid_up_to() + 4 > head.len(),
318 }
319}
320
321/// Reported when a file's modification time is unavailable or unrepresentable.
322const EPOCH_MTIME: &str = "1970-01-01T00:00:00Z";
323
324/// A file's modification time in whole unix seconds, or `None` when the
325/// platform cannot report one. The single place that converts a `SystemTime`.
326pub fn mtime_secs(m: &std::fs::Metadata) -> Option<i64> {
327 m.modified()
328 .ok()
329 .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
330 .map(|d| d.as_secs() as i64)
331}
332
333fn mtime_str(m: &std::fs::Metadata) -> String {
334 let dt: Option<DateTime<chrono::Utc>> =
335 mtime_secs(m).and_then(|s| DateTime::from_timestamp(s, 0));
336 dt.map(|d| d.to_rfc3339_opts(chrono::SecondsFormat::Secs, true))
337 .unwrap_or_else(|| EPOCH_MTIME.to_string())
338}
339
340// ---------------------------------------------------------------------------
341// Mutations (milestone 3): mkdir, rename, remove, move, copy, upload
342// ---------------------------------------------------------------------------
343
344/// Resolve a directory that must exist (relative to a user root). Used as the
345/// base for operations that target the *parent* of the item.
346pub fn resolve_dir(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<PathBuf, FsError> {
347 let full = resolve_path(server_root, root_rel, req_rel)?;
348 if !full.is_dir() {
349 return Err(FsError::NotADirectory);
350 }
351 Ok(full)
352}
353
354/// Validate a new single-component name (for rename / new folder).
355fn validate_component(name: &str) -> Result<(), FsError> {
356 let p = Path::new(name);
357 if name.is_empty()
358 || p.components().count() != 1
359 || name == "."
360 || name == ".."
361 || name.contains(['/', '\\', '\0'])
362 {
363 return Err(FsError::Invalid("invalid name".to_string()));
364 }
365 Ok(())
366}
367
368/// Create a directory (and any missing parents) inside a user root.
369pub fn mkdir(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<(), FsError> {
370 let full = resolve_path_or_new(server_root, root_rel, req_rel)?;
371 if full.exists() {
372 return Err(FsError::Conflict);
373 }
374 std::fs::create_dir_all(&full).map_err(|e| io_err(e, &full))?;
375 Ok(())
376}
377
378/// Create an empty file. The parent must exist; the file must not.
379pub fn create_file(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<(), FsError> {
380 let full = resolve_path_or_new(server_root, root_rel, req_rel)?;
381 // create_new = O_EXCL: fails on an existing path, does not follow a symlink.
382 std::fs::File::create_new(&full).map_err(|e| match e.kind() {
383 std::io::ErrorKind::AlreadyExists => FsError::Conflict,
384 _ => io_err(e, &full),
385 })?;
386 Ok(())
387}
388
389/// Resolve a path that does not need to exist yet, but whose *parent* must.
390fn resolve_path_or_new(
391 server_root: &Path,
392 root_rel: &str,
393 req_rel: &str,
394) -> Result<PathBuf, FsError> {
395 let root_abs = resolve_root(server_root, root_rel)?;
396 let req = Path::new(req_rel);
397 for c in req.components() {
398 if matches!(c, Component::ParentDir) {
399 return Err(FsError::Forbidden);
400 }
401 }
402 let full = root_abs.join(req);
403 // The parent must exist and stay inside the root.
404 let parent = full
405 .parent()
406 .filter(|p| !p.as_os_str().is_empty())
407 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?;
408 let parent = parent.canonicalize().map_err(|e| io_err(e, parent))?;
409 ensure_within(&root_abs, &parent)?;
410 Ok(full)
411}
412
413/// Rename (or move within the same directory) an item.
414pub fn rename_item(
415 server_root: &Path,
416 root_rel: &str,
417 req_rel: &str,
418 new_name: &str,
419 overwrite: bool,
420) -> Result<(), FsError> {
421 validate_component(new_name)?;
422 let from = resolve_path(server_root, root_rel, req_rel)?;
423 let parent = from
424 .parent()
425 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?;
426 let to = parent.join(new_name);
427 // Renaming onto itself is a no-op (the overwrite path below would
428 // delete the file before the rename).
429 if to == from {
430 return Ok(());
431 }
432 if to.exists() {
433 if !overwrite || to.is_dir() || from.is_dir() {
434 return Err(FsError::Conflict);
435 }
436 std::fs::remove_file(&to).map_err(|e| io_err(e, &to))?;
437 }
438 std::fs::rename(&from, &to).map_err(|e| io_err(e, &to))?;
439 Ok(())
440}
441
442/// Delete a file or a directory tree. Returns whether it was a directory.
443pub fn remove_item(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<bool, FsError> {
444 let full = resolve_path(server_root, root_rel, req_rel)?;
445 let is_dir = full.is_dir();
446 if is_dir {
447 std::fs::remove_dir_all(&full).map_err(|e| io_err(e, &full))?;
448 } else {
449 std::fs::remove_file(&full).map_err(|e| io_err(e, &full))?;
450 }
451 Ok(is_dir)
452}
453
454/// Overwrite an existing file's contents (the editor's save path).
455///
456/// The file must already exist and be a regular file. If `expected_mtime`
457/// (whole unix seconds) is provided and differs from the file's current mtime,
458/// the file changed on disk since it was read → `Conflict` (409). Returns the
459/// file's new mtime (unix seconds) after a successful write.
460pub fn save_file(
461 server_root: &Path,
462 root_rel: &str,
463 req_rel: &str,
464 content: &[u8],
465 expected_mtime: Option<i64>,
466) -> Result<i64, FsError> {
467 let full = resolve_path(server_root, root_rel, req_rel)?; // must exist
468 write_checked(&full, content, expected_mtime)
469}
470
471/// The share-aware variant of [`save_file`]: for a *file* share the root is
472/// the file itself, so `target` (relative to `server_root`) points at the
473/// file — there is no directory root beneath it.
474pub fn save_file_at(
475 server_root: &Path,
476 target: &str,
477 content: &[u8],
478 expected_mtime: Option<i64>,
479) -> Result<i64, FsError> {
480 let full = resolve_file(server_root, target)?; // must exist
481 write_checked(&full, content, expected_mtime)
482}
483
484fn write_checked(full: &Path, content: &[u8], expected_mtime: Option<i64>) -> Result<i64, FsError> {
485 let meta = std::fs::metadata(full).map_err(|_| FsError::NotFound)?;
486 if meta.is_dir() {
487 return Err(FsError::NotADirectory);
488 }
489 if let Some(expected) = expected_mtime {
490 // No readable mtime means the check cannot pass: -1 never matches.
491 if mtime_secs(&meta).unwrap_or(-1) != expected {
492 return Err(FsError::Conflict);
493 }
494 }
495 std::fs::write(full, content).map_err(|e| io_err(e, full))?;
496 // Read the new mtime so the client can anchor the next conflict check.
497 let new_meta = std::fs::metadata(full).map_err(|_| FsError::NotFound)?;
498 Ok(mtime_secs(&new_meta).unwrap_or(0))
499}
500
501fn io_err(e: std::io::Error, p: &Path) -> FsError {
502 tracing::warn!(error = %e, path = %p.display(), "filesystem error");
503 match e.kind() {
504 std::io::ErrorKind::NotFound => FsError::NotFound,
505 _ => FsError::Forbidden,
506 }
507}
508
509/// True if `a` is `b` or a descendant of `b` (both canonical).
510pub(crate) fn is_within_or_eq(base: &Path, p: &Path) -> bool {
511 p == base || p.starts_with(base)
512}
513
514/// Move an item (possibly across roots). `dst_dir_rel` is the destination
515/// directory (relative to `dst_root_rel`); the item keeps its base name.
516pub fn move_item(
517 server_root: &Path,
518 src_root_rel: &str,
519 src_rel: &str,
520 dst_root_rel: &str,
521 dst_dir_rel: &str,
522 overwrite: bool,
523) -> Result<(), FsError> {
524 let from = resolve_path(server_root, src_root_rel, src_rel)?;
525 let dst_dir = resolve_dir(server_root, dst_root_rel, dst_dir_rel)?;
526 let name = from
527 .file_name()
528 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?
529 .to_owned();
530 let to = dst_dir.join(&name);
531
532 // A no-op (item already at the destination) — treat as success.
533 if to == from {
534 return Ok(());
535 }
536
537 // Refuse moving a directory into itself or a descendant.
538 if from.is_dir() && is_within_or_eq(&from, &dst_dir) {
539 return Err(FsError::Invalid(
540 "cannot move a folder into itself".to_string(),
541 ));
542 }
543 check_move_conflict(&to, &from, overwrite)?;
544
545 match std::fs::rename(&from, &to) {
546 Ok(()) => Ok(()),
547 Err(e) if e.kind() == std::io::ErrorKind::CrossesDevices => {
548 copy_recursive(&from, &to)?;
549 if from.is_dir() {
550 std::fs::remove_dir_all(&from).map_err(|_| FsError::Forbidden)?;
551 } else {
552 std::fs::remove_file(&from).map_err(|_| FsError::Forbidden)?;
553 }
554 Ok(())
555 }
556 Err(e) => Err(io_err(e, &to)),
557 }
558}
559
560/// Copy an item (possibly across roots).
561pub fn copy_item(
562 server_root: &Path,
563 src_root_rel: &str,
564 src_rel: &str,
565 dst_root_rel: &str,
566 dst_dir_rel: &str,
567 overwrite: bool,
568) -> Result<(), FsError> {
569 let from = resolve_path(server_root, src_root_rel, src_rel)?;
570 let dst_dir = resolve_dir(server_root, dst_root_rel, dst_dir_rel)?;
571 let name = from
572 .file_name()
573 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?
574 .to_owned();
575 let to = dst_dir.join(&name);
576
577 // A no-op (item already at the destination) — treat as success.
578 if to == from {
579 return Ok(());
580 }
581
582 if from.is_dir() && is_within_or_eq(&from, &dst_dir) {
583 return Err(FsError::Invalid(
584 "cannot copy a folder into itself".to_string(),
585 ));
586 }
587 check_move_conflict(&to, &from, overwrite)?;
588 copy_recursive(&from, &to)?;
589 Ok(())
590}
591
592/// Conflict rules shared by move and copy:
593/// - target is a directory → always conflict (no silent merge)
594/// - target is a file → conflict unless overwriting a file with a file
595fn check_move_conflict(to: &Path, from: &Path, overwrite: bool) -> Result<(), FsError> {
596 if to.exists() {
597 let to_dir = to.is_dir();
598 let from_dir = from.is_dir();
599 if to_dir || from_dir || !overwrite {
600 return Err(FsError::Conflict);
601 }
602 }
603 Ok(())
604}
605
606/// Recursively copy a file or directory tree, preserving mtime.
607fn copy_recursive(src: &Path, dst: &Path) -> Result<(), FsError> {
608 let meta = std::fs::metadata(src).map_err(|e| io_err(e, src))?;
609 if meta.is_dir() {
610 std::fs::create_dir(dst).map_err(|e| io_err(e, dst))?;
611 for e in std::fs::read_dir(src)
612 .map_err(|e| io_err(e, src))?
613 .flatten()
614 {
615 copy_recursive(&e.path(), &dst.join(e.file_name()))?;
616 }
617 } else {
618 std::fs::copy(src, dst).map_err(|e| io_err(e, dst))?;
619 }
620 set_mtime(dst, meta.modified().ok());
621 Ok(())
622}
623
624fn set_mtime(p: &Path, t: Option<std::time::SystemTime>) {
625 if let (Some(t), Ok(f)) = (t, std::fs::File::open(p)) {
626 let _ = f.set_modified(t);
627 }
628}
629
630// ---------------------------------------------------------------------------
631// Tests
632// ---------------------------------------------------------------------------
633
634#[cfg(test)]
635mod tests {
636 use super::*;
637
638 /// A temp dir used as the "server root" with a small fixture tree:
639 ///
640 /// ```text
641 /// root/
642 /// docs/
643 /// inner/
644 /// hello.txt
645 /// a.txt
646 /// src/
647 /// main.rs
648 /// file.txt
649 /// ```
650 struct T {
651 tmp: tempfile::TempDir,
652 root: PathBuf,
653 }
654
655 impl T {
656 fn new() -> Self {
657 let tmp = tempfile::tempdir().unwrap();
658 let root = tmp.path().to_path_buf();
659 std::fs::create_dir_all(root.join("docs/inner")).unwrap();
660 std::fs::create_dir_all(root.join("src")).unwrap();
661 std::fs::write(root.join("docs/inner/hello.txt"), "hello").unwrap();
662 std::fs::write(root.join("docs/a.txt"), "a").unwrap();
663 std::fs::write(root.join("src/main.rs"), "fn main() {}").unwrap();
664 std::fs::write(root.join("file.txt"), "top file").unwrap();
665 Self { tmp, root }
666 }
667
668 /// A directory that lives *next to* the root (outside of it), for
669 /// symlink/escape tests. The tempdir name is unique, so the sibling
670 /// name is unique too.
671 fn sibling(&self, name: &str) -> PathBuf {
672 let base = self
673 .tmp
674 .path()
675 .file_name()
676 .unwrap()
677 .to_string_lossy()
678 .into_owned();
679 let p = self.tmp.path().with_file_name(format!("{base}-{name}"));
680 std::fs::create_dir_all(&p).unwrap();
681 p
682 }
683 }
684
685 // ---------- validate_component ----------
686
687 #[test]
688 fn validate_name_accepts_simple_names() {
689 for ok in ["a", "file.txt", "my folder", "Ünïcödé", "with-dash_1.2.3"] {
690 assert!(validate_component(ok).is_ok(), "{ok:?} should be valid");
691 }
692 }
693
694 #[test]
695 fn validate_name_rejects_traversal_and_paths() {
696 for bad in [
697 "", ".", "..", "a/b", "a\\b", "a\0b", "/abs", "../x", "x/../y", "x/", "/x",
698 ] {
699 assert!(
700 validate_component(bad).is_err(),
701 "{bad:?} should be invalid"
702 );
703 }
704 }
705
706 // ---------- resolve_root ----------
707
708 #[test]
709 fn resolve_root_whole_root_and_subdir() {
710 let t = T::new();
711 let root = t.root.canonicalize().unwrap();
712 // "." means the whole root.
713 assert_eq!(resolve_root(&root, ".").unwrap(), root);
714 assert_eq!(resolve_root(&root, "docs").unwrap(), root.join("docs"));
715 assert_eq!(
716 resolve_root(&root, "docs/inner").unwrap(),
717 root.join("docs/inner")
718 );
719 }
720
721 #[test]
722 fn resolve_root_rejects_escape_and_missing() {
723 let t = T::new();
724 let root = t.root.canonicalize().unwrap();
725 let sib = t.sibling("escape");
726 let sib_rel = sib.file_name().unwrap().to_string_lossy().into_owned();
727 // Escapes that land on *existing* paths outside the root.
728 for esc in [
729 "..".to_string(),
730 "docs/../..".to_string(),
731 format!("../{sib_rel}"),
732 ] {
733 assert!(
734 matches!(resolve_root(&root, &esc), Err(FsError::Forbidden)),
735 "{esc:?} should be forbidden"
736 );
737 }
738 // Escapes to non-existing paths simply don't exist.
739 for esc in ["../no-such-dir", "a/b/../../..", "nope"] {
740 assert!(
741 matches!(resolve_root(&root, esc), Err(FsError::RootMissing)),
742 "{esc:?} should be missing"
743 );
744 }
745 // A file is not a valid root.
746 assert!(matches!(
747 resolve_root(&root, "file.txt"),
748 Err(FsError::RootMissing)
749 ));
750 }
751
752 #[cfg(unix)]
753 #[test]
754 fn resolve_root_rejects_symlink_escape() {
755 let t = T::new();
756 let root = t.root.canonicalize().unwrap();
757 let outside = t.sibling("outside");
758 std::os::unix::fs::symlink(&outside, root.join("link")).unwrap();
759 assert!(matches!(
760 resolve_root(&root, "link"),
761 Err(FsError::Forbidden)
762 ));
763 }
764
765 // ---------- resolve_path ----------
766
767 #[test]
768 fn resolve_path_traverses_inside_root() {
769 let t = T::new();
770 let root = t.root.canonicalize().unwrap();
771 // Empty relative path → the root itself.
772 assert_eq!(resolve_path(&root, ".", "").unwrap(), root);
773 assert_eq!(
774 resolve_path(&root, "docs", "inner/hello.txt").unwrap(),
775 root.join("docs/inner/hello.txt")
776 );
777 assert_eq!(
778 resolve_path(&root, ".", "file.txt").unwrap(),
779 root.join("file.txt")
780 );
781 }
782
783 #[test]
784 fn resolve_path_rejects_parent_traversal() {
785 let t = T::new();
786 let root = t.root.canonicalize().unwrap();
787 for p in ["..", "../file.txt", "docs/../../file.txt", "a/../../b"] {
788 assert!(
789 matches!(resolve_path(&root, ".", p), Err(FsError::Forbidden)),
790 "{p:?} should be forbidden"
791 );
792 }
793 }
794
795 #[test]
796 fn resolve_path_missing_is_not_found() {
797 let t = T::new();
798 let root = t.root.canonicalize().unwrap();
799 assert!(matches!(
800 resolve_path(&root, "docs", "nope.txt"),
801 Err(FsError::NotFound)
802 ));
803 assert!(matches!(
804 resolve_path(&root, "missing-root", ""),
805 Err(FsError::RootMissing)
806 ));
807 }
808
809 #[cfg(unix)]
810 #[test]
811 fn resolve_path_rejects_symlink_escape() {
812 let t = T::new();
813 let root = t.root.canonicalize().unwrap();
814 let outside = t.sibling("outside");
815 let secret = outside.join("secret.txt");
816 std::fs::write(&secret, "top secret").unwrap();
817 std::os::unix::fs::symlink(&secret, root.join("evil")).unwrap();
818 assert!(matches!(
819 resolve_path(&root, ".", "evil"),
820 Err(FsError::Forbidden)
821 ));
822 // A symlink that stays inside the root is fine.
823 std::os::unix::fs::symlink(root.join("file.txt"), root.join("alias")).unwrap();
824 assert_eq!(
825 resolve_path(&root, ".", "alias").unwrap(),
826 root.join("file.txt")
827 );
828 }
829
830 // ---------- resolve_file / resolve_dir ----------
831
832 #[test]
833 fn resolve_file_targets_files() {
834 let t = T::new();
835 let root = t.root.canonicalize().unwrap();
836 assert_eq!(
837 resolve_file(&root, "file.txt").unwrap(),
838 root.join("file.txt")
839 );
840 assert!(matches!(
841 resolve_file(&root, "nope.txt"),
842 Err(FsError::NotFound)
843 ));
844 // Escape to an existing sibling file.
845 let sib = t.sibling("escape");
846 let sib_rel = sib.file_name().unwrap().to_string_lossy().into_owned();
847 std::fs::write(sib.join("s.txt"), "x").unwrap();
848 assert!(matches!(
849 resolve_file(&root, &format!("../{sib_rel}/s.txt")),
850 Err(FsError::Forbidden)
851 ));
852 }
853
854 #[test]
855 fn resolve_dir_requires_existing_directory() {
856 let t = T::new();
857 let root = t.root.canonicalize().unwrap();
858 assert_eq!(resolve_dir(&root, ".", "docs").unwrap(), root.join("docs"));
859 assert!(matches!(
860 resolve_dir(&root, ".", "file.txt"),
861 Err(FsError::NotADirectory)
862 ));
863 assert!(matches!(
864 resolve_dir(&root, ".", "nope"),
865 Err(FsError::NotFound)
866 ));
867 }
868
869 // ---------- list_dir ----------
870
871 #[test]
872 fn list_dir_sorts_folders_first_then_case_insensitive() {
873 let t = T::new();
874 let d = t.root.join("sortme");
875 std::fs::create_dir_all(d.join("Zeta")).unwrap();
876 std::fs::create_dir_all(d.join("alpha-dir")).unwrap();
877 std::fs::write(d.join("b.txt"), "x").unwrap();
878 std::fs::write(d.join("A.txt"), "x").unwrap();
879 std::fs::write(d.join("C.md"), "x").unwrap();
880 let entries = list_dir(&d).unwrap();
881 let names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect();
882 // Folders first (alpha-dir, Zeta), then files case-insensitively.
883 assert_eq!(names, vec!["alpha-dir", "Zeta", "A.txt", "b.txt", "C.md"]);
884 let a = &entries[2];
885 assert!(!a.is_dir);
886 assert_eq!(a.size, 1);
887 assert!(!a.mtime.is_empty());
888 }
889
890 #[test]
891 fn list_dir_error_cases() {
892 let t = T::new();
893 let root = t.root.canonicalize().unwrap();
894 assert!(matches!(
895 list_dir(&root.join("missing")),
896 Err(FsError::NotFound)
897 ));
898 assert!(matches!(
899 list_dir(&root.join("file.txt")),
900 Err(FsError::NotADirectory)
901 ));
902 }
903
904 #[cfg(unix)]
905 #[test]
906 fn list_dir_reports_broken_symlink_as_empty_file() {
907 let t = T::new();
908 let d = t.root.join("withlink");
909 std::fs::create_dir_all(&d).unwrap();
910 std::os::unix::fs::symlink(d.join("does-not-exist"), d.join("broken")).unwrap();
911 let entries = list_dir(&d).unwrap();
912 assert_eq!(entries.len(), 1);
913 assert_eq!(entries[0].name, "broken");
914 assert!(!entries[0].is_dir);
915 assert_eq!(entries[0].size, 0);
916 }
917
918 // ---------- mkdir ----------
919
920 #[test]
921 fn mkdir_creates_nested_dirs() {
922 let t = T::new();
923 let root = t.root.canonicalize().unwrap();
924 // The parent must exist; "new" first, then "new/sub".
925 mkdir(&root, ".", "new").unwrap();
926 assert!(root.join("new").is_dir());
927 mkdir(&root, ".", "new/sub").unwrap();
928 assert!(root.join("new/sub").is_dir());
929 }
930
931 #[test]
932 fn mkdir_rejects_conflict_and_bad_names() {
933 let t = T::new();
934 let root = t.root.canonicalize().unwrap();
935 assert!(matches!(mkdir(&root, ".", "docs"), Err(FsError::Conflict)));
936 assert!(matches!(
937 mkdir(&root, ".", "a/b/../../c"),
938 Err(FsError::Forbidden)
939 ));
940 assert!(matches!(
941 mkdir(&root, ".", "file.txt/x"),
942 Err(FsError::Forbidden) // parent is a file → ENOTDIR
943 ));
944 }
945
946 // ---------- rename ----------
947
948 #[test]
949 fn rename_moves_file_and_dir() {
950 let t = T::new();
951 let root = t.root.canonicalize().unwrap();
952 rename_item(&root, ".", "file.txt", "renamed.txt", false).unwrap();
953 assert!(!root.join("file.txt").exists());
954 assert_eq!(
955 std::fs::read_to_string(root.join("renamed.txt")).unwrap(),
956 "top file"
957 );
958 rename_item(&root, ".", "docs", "docs2", false).unwrap();
959 assert!(root.join("docs2/inner/hello.txt").exists());
960 }
961
962 #[test]
963 fn rename_conflicts_and_overwrite() {
964 let t = T::new();
965 let root = t.root.canonicalize().unwrap();
966 std::fs::write(root.join("other.txt"), "other").unwrap();
967 // Target file exists, no overwrite → conflict.
968 assert!(matches!(
969 rename_item(&root, ".", "file.txt", "other.txt", false),
970 Err(FsError::Conflict)
971 ));
972 // Overwrite a file target → replaces it.
973 rename_item(&root, ".", "file.txt", "other.txt", true).unwrap();
974 assert_eq!(
975 std::fs::read_to_string(root.join("other.txt")).unwrap(),
976 "top file"
977 );
978 // A dir target is never overwritten, even with the flag.
979 assert!(matches!(
980 rename_item(&root, ".", "other.txt", "docs", true),
981 Err(FsError::Conflict)
982 ));
983 // Renaming into a free slot works, then onto itself is a no-op.
984 rename_item(&root, ".", "other.txt", "free.txt", false).unwrap();
985 assert!(root.join("free.txt").exists());
986 rename_item(&root, ".", "free.txt", "free.txt", false).unwrap();
987 assert!(root.join("free.txt").exists());
988 assert!(root.join("free.txt").is_file());
989 }
990
991 #[test]
992 fn rename_validates_new_name() {
993 let t = T::new();
994 let root = t.root.canonicalize().unwrap();
995 for bad in ["a/b", "", ".", ".."] {
996 assert!(matches!(
997 rename_item(&root, ".", "file.txt", bad, false),
998 Err(FsError::Invalid(_))
999 ));
1000 }
1001 assert!(matches!(
1002 rename_item(&root, ".", "missing", "x", false),
1003 Err(FsError::NotFound)
1004 ));
1005 }
1006
1007 // ---------- remove ----------
1008
1009 #[test]
1010 fn remove_file_and_dir() {
1011 let t = T::new();
1012 let root = t.root.canonicalize().unwrap();
1013 assert!(!remove_item(&root, ".", "file.txt").unwrap());
1014 assert!(!root.join("file.txt").exists());
1015 assert!(remove_item(&root, ".", "docs").unwrap());
1016 assert!(!root.join("docs").exists());
1017 assert!(matches!(
1018 remove_item(&root, ".", "file.txt"),
1019 Err(FsError::NotFound)
1020 ));
1021 }
1022
1023 // ---------- save_file ----------
1024
1025 fn mtime_of(p: &Path) -> i64 {
1026 std::fs::metadata(p)
1027 .unwrap()
1028 .modified()
1029 .unwrap()
1030 .duration_since(std::time::UNIX_EPOCH)
1031 .unwrap()
1032 .as_secs() as i64
1033 }
1034
1035 #[test]
1036 fn save_file_updates_content_and_returns_new_mtime() {
1037 let t = T::new();
1038 let root = t.root.canonicalize().unwrap();
1039 let before = mtime_of(&root.join("file.txt"));
1040 // Sleep so the mtime actually advances (filesystem granularity).
1041 std::thread::sleep(std::time::Duration::from_millis(1100));
1042 let new = save_file(&root, ".", "file.txt", b"brand new", Some(before)).unwrap();
1043 assert_eq!(std::fs::read(root.join("file.txt")).unwrap(), b"brand new");
1044 assert!(new >= before);
1045 // A second save with the *returned* mtime succeeds.
1046 let new2 = save_file(&root, ".", "file.txt", b"again", Some(new)).unwrap();
1047 assert!(new2 >= new);
1048 // Without an expected mtime, always saves.
1049 let _ = save_file(&root, ".", "file.txt", b"force", None).unwrap();
1050 assert_eq!(std::fs::read(root.join("file.txt")).unwrap(), b"force");
1051 }
1052
1053 #[test]
1054 fn save_file_conflict_on_stale_mtime() {
1055 let t = T::new();
1056 let root = t.root.canonicalize().unwrap();
1057 std::thread::sleep(std::time::Duration::from_millis(1100));
1058 // The mtime we pass is older than the file's real mtime → conflict.
1059 assert!(matches!(
1060 save_file(&root, ".", "file.txt", b"x", Some(1)),
1061 Err(FsError::Conflict)
1062 ));
1063 }
1064
1065 #[test]
1066 fn save_file_error_cases() {
1067 let t = T::new();
1068 let root = t.root.canonicalize().unwrap();
1069 assert!(matches!(
1070 save_file(&root, ".", "nope.txt", b"x", None),
1071 Err(FsError::NotFound)
1072 ));
1073 assert!(matches!(
1074 save_file(&root, ".", "docs", b"x", None),
1075 Err(FsError::NotADirectory)
1076 ));
1077 assert!(matches!(
1078 save_file(&root, ".", "../evil.txt", b"x", None),
1079 Err(FsError::Forbidden)
1080 ));
1081 }
1082
1083 // ---------- move / copy ----------
1084
1085 #[test]
1086 fn move_file_and_dir_across_dirs() {
1087 let t = T::new();
1088 let root = t.root.canonicalize().unwrap();
1089 move_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1090 assert!(!root.join("file.txt").exists());
1091 assert!(root.join("src/file.txt").exists());
1092 move_item(&root, ".", "src", ".", "docs", false).unwrap();
1093 assert!(root.join("docs/src/main.rs").exists());
1094 assert!(!root.join("src").exists());
1095 }
1096
1097 #[test]
1098 fn move_refuses_into_self_and_conflicts() {
1099 let t = T::new();
1100 let root = t.root.canonicalize().unwrap();
1101 // A dir cannot be moved into itself or a descendant.
1102 assert!(matches!(
1103 move_item(&root, ".", "docs", ".", "docs", false),
1104 Err(FsError::Invalid(_))
1105 ));
1106 assert!(matches!(
1107 move_item(&root, ".", "docs", ".", "docs/inner", false),
1108 Err(FsError::Invalid(_))
1109 ));
1110 // A dir target always conflicts, even with overwrite: move the file
1111 // "x" into a folder that already contains a subfolder "x".
1112 std::fs::create_dir_all(root.join("mv/case/x")).unwrap();
1113 std::fs::create_dir_all(root.join("mv/out")).unwrap();
1114 std::fs::write(root.join("mv/out/x"), "a file named x").unwrap();
1115 assert!(matches!(
1116 move_item(&root, ".", "mv/out/x", ".", "mv/case", true),
1117 Err(FsError::Conflict)
1118 ));
1119 // File onto file: conflict without overwrite, replaced with.
1120 std::fs::write(root.join("tmp-x.txt"), "x").unwrap();
1121 std::fs::write(root.join("tmp-y.txt"), "y").unwrap();
1122 std::fs::rename(root.join("tmp-x.txt"), root.join("tmp-target.txt")).unwrap();
1123 std::fs::rename(root.join("tmp-y.txt"), root.join("tmp-target2.txt")).unwrap();
1124 // Two distinct files with the same name in one folder.
1125 std::fs::create_dir_all(root.join("mv/dst")).unwrap();
1126 std::fs::create_dir_all(root.join("mv/out2")).unwrap();
1127 std::fs::write(root.join("mv/dst/dup.txt"), "old").unwrap();
1128 std::fs::write(root.join("mv/out2/dup.txt"), "new").unwrap();
1129 assert!(matches!(
1130 move_item(&root, ".", "mv/out2/dup.txt", ".", "mv/dst", false),
1131 Err(FsError::Conflict)
1132 ));
1133 move_item(&root, ".", "mv/out2/dup.txt", ".", "mv/dst", true).unwrap();
1134 assert_eq!(
1135 std::fs::read_to_string(root.join("mv/dst/dup.txt")).unwrap(),
1136 "new"
1137 );
1138 // Moving onto itself is a no-op success.
1139 move_item(&root, ".", "tmp-target.txt", ".", ".", false).unwrap();
1140 assert!(root.join("tmp-target.txt").exists());
1141 // Missing destination dir.
1142 assert!(matches!(
1143 move_item(&root, ".", "file.txt", ".", "nope", false),
1144 Err(FsError::NotFound)
1145 ));
1146 }
1147
1148 #[test]
1149 fn copy_file_and_dir_preserves_mtime() {
1150 let t = T::new();
1151 let root = t.root.canonicalize().unwrap();
1152 let before = mtime_of(&root.join("file.txt"));
1153 copy_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1154 let copy = root.join("src/file.txt");
1155 assert_eq!(std::fs::read(&copy).unwrap(), b"top file");
1156 assert_eq!(mtime_of(&copy), before);
1157 // Dir copy.
1158 copy_item(&root, ".", "docs", ".", "src", false).unwrap();
1159 assert_eq!(
1160 std::fs::read_to_string(root.join("src/docs/inner/hello.txt")).unwrap(),
1161 "hello"
1162 );
1163 // Originals still there.
1164 assert!(root.join("file.txt").exists());
1165 assert!(root.join("docs/a.txt").exists());
1166 }
1167
1168 #[test]
1169 fn copy_refuses_into_self_and_handles_conflict() {
1170 let t = T::new();
1171 let root = t.root.canonicalize().unwrap();
1172 assert!(matches!(
1173 copy_item(&root, ".", "docs", ".", "docs", false),
1174 Err(FsError::Invalid(_))
1175 ));
1176 assert!(matches!(
1177 copy_item(&root, ".", "docs", ".", "docs/inner", false),
1178 Err(FsError::Invalid(_))
1179 ));
1180 // First copy is fine, the second one conflicts, overwrite replaces.
1181 copy_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1182 assert!(matches!(
1183 copy_item(&root, ".", "file.txt", ".", "src", false),
1184 Err(FsError::Conflict)
1185 ));
1186 std::fs::write(root.join("file.txt"), "v2").unwrap();
1187 copy_item(&root, ".", "file.txt", ".", "src", true).unwrap();
1188 assert_eq!(
1189 std::fs::read_to_string(root.join("src/file.txt")).unwrap(),
1190 "v2"
1191 );
1192 // Copying onto itself is a no-op success.
1193 copy_item(&root, ".", "src/file.txt", ".", "src", false).unwrap();
1194 assert_eq!(
1195 std::fs::read_to_string(root.join("src/file.txt")).unwrap(),
1196 "v2"
1197 );
1198 // Missing destination dir.
1199 assert!(matches!(
1200 copy_item(&root, ".", "file.txt", ".", "nope", false),
1201 Err(FsError::NotFound)
1202 ));
1203 }
1204
1205 #[test]
1206 fn copy_recursive_missing_source() {
1207 let t = T::new();
1208 let dst = t.tmp.path().join("dst");
1209 assert!(matches!(
1210 copy_recursive(&t.root.join("nope"), &dst),
1211 Err(FsError::NotFound)
1212 ));
1213 }
1214
1215 // ---------- is_within_or_eq ----------
1216
1217 #[test]
1218 fn is_within_or_eq_matrix() {
1219 let t = T::new();
1220 let root = t.root.canonicalize().unwrap();
1221 let docs = root.join("docs");
1222 assert!(is_within_or_eq(&docs, &docs));
1223 assert!(is_within_or_eq(&docs, &root.join("docs/inner")));
1224 assert!(!is_within_or_eq(&docs, &root));
1225 assert!(!is_within_or_eq(&docs, &root.join("src")));
1226 }
1227
1228 // ---------- content sniffing ----------
1229
1230 fn kind(bytes: &[u8], name: &str) -> FileKind {
1231 kind_from_bytes(bytes, Path::new(name))
1232 }
1233
1234 #[test]
1235 fn magic_numbers_classify_by_content() {
1236 let png = [0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 0];
1237 // The name is a lie in every case: the bytes decide.
1238 assert_eq!(kind(&png, "notes.txt"), FileKind::Image);
1239 assert_eq!(kind(b"%PDF-1.7\n%aaa\n", "x.bin"), FileKind::Pdf);
1240 assert_eq!(
1241 kind(b"PK\x03\x04\x14\x00\x00\x00", "x.png"),
1242 FileKind::Archive
1243 );
1244 assert_eq!(
1245 kind(&[0x1F, 0x8B, 0x08, 0, 0, 0, 0, 0], "x"),
1246 FileKind::Archive
1247 );
1248 assert_eq!(
1249 kind(
1250 &[
1251 0, 0, 0, 0x20, b'f', b't', b'y', b'p', b'i', b's', b'o', b'm'
1252 ],
1253 "x"
1254 ),
1255 FileKind::Video
1256 );
1257 assert_eq!(
1258 kind(b"ID3\x04\x00\x00\x00\x00\x00\x00", "x"),
1259 FileKind::Audio
1260 );
1261 assert_eq!(kind(b"RIFF\x24\x00\x00\x00WAVEfmt ", "x"), FileKind::Audio);
1262 assert_eq!(kind(b"<!doctype html><p>hi", "x"), FileKind::Text);
1263 // Recognized but not viewable in a browser.
1264 assert_eq!(
1265 kind(&[0x00, 0x61, 0x73, 0x6d, 1, 0, 0, 0], "x.wasm"),
1266 FileKind::Binary
1267 );
1268 }
1269
1270 #[test]
1271 fn unsigned_files_fall_back_to_the_text_heuristic() {
1272 // No magic number: plain text, source, config.
1273 assert_eq!(kind(b"hello world\n", "notes"), FileKind::Text);
1274 assert_eq!(kind(b"fn main() {}\n", "main.rs"), FileKind::Text);
1275 assert_eq!(
1276 kind("# über\nkey: wert\n".as_bytes(), "c.yaml"),
1277 FileKind::Text
1278 );
1279 // Extensionless text files work, which the old extension list missed.
1280 assert_eq!(kind(b"all:\n\tcargo build\n", "Makefile"), FileKind::Text);
1281 // Empty file → editable.
1282 assert_eq!(kind(b"", "new.txt"), FileKind::Text);
1283 // A NUL byte means binary, whatever the name says. (ELF has no
1284 // `infer` signature, so this is the path that catches it.)
1285 assert_eq!(
1286 kind(&[0x7F, b'E', b'L', b'F', 2, 1, 1, 0, 0], "run.txt"),
1287 FileKind::Binary
1288 );
1289 assert_eq!(kind(&[0xC3, 0x28, 0xFF, 0xFE], "x.txt"), FileKind::Binary);
1290 }
1291
1292 #[test]
1293 fn svg_is_offered_as_an_image() {
1294 // SVG is XML text with no magic number, but browsers draw it, so the
1295 // extension is the only signal available.
1296 let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\"></svg>";
1297 assert_eq!(kind(svg, "logo.svg"), FileKind::Image);
1298 assert_eq!(kind(svg, "logo.txt"), FileKind::Text);
1299 }
1300
1301 #[test]
1302 fn truncated_utf8_at_the_read_boundary_is_still_text() {
1303 // 255 ASCII bytes plus the first byte of a 2-byte character: the read
1304 // cut a character in half, which must not read as binary.
1305 let mut b = vec![b'a'; SNIFF_BYTES - 1];
1306 b.push(0xC3);
1307 assert_eq!(kind(&b, "x.txt"), FileKind::Text);
1308 }
1309
1310 #[test]
1311 fn detect_kind_reads_from_disk() {
1312 let t = T::new();
1313 assert_eq!(detect_kind(&t.root.join("docs"), true), FileKind::Dir);
1314 assert_eq!(detect_kind(&t.root.join("file.txt"), false), FileKind::Text);
1315 // Unreadable / missing → Binary, never a failed listing.
1316 assert_eq!(detect_kind(&t.root.join("nope"), false), FileKind::Binary);
1317 }
1318
1319 /// `SNIFF_BUDGET` is process-wide, so the two tests that assert on it must
1320 /// not run at the same time as each other.
1321 static BUDGET_TESTS: std::sync::Mutex<()> = std::sync::Mutex::new(());
1322
1323 /// A directory big enough to take the fan-out path must produce exactly
1324 /// what the serial path would. Pass 2 fills `is_dir`, `size`, `mtime` and
1325 /// `kind`, all on worker threads, so a chunk-boundary mistake would show up
1326 /// as a row carrying another row's metadata or the untouched placeholders.
1327 #[test]
1328 fn parallel_rows_match_serial() {
1329 use std::sync::atomic::Ordering;
1330 let _guard = BUDGET_TESTS.lock().unwrap();
1331 let t = T::new();
1332 let big = t.root.join("big");
1333 std::fs::create_dir_all(&big).unwrap();
1334 // Well over SNIFF_CHUNK, so several chunks are handed out.
1335 let n = SNIFF_CHUNK * 3 + 7;
1336 for i in 0..n {
1337 let p = big.join(format!("f{i:05}"));
1338 // Every file gets a distinct length, so `size` pins the row identity.
1339 let pad = vec![b'A'; i];
1340 let mut body = match i % 3 {
1341 0 => vec![0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A],
1342 1 => b"plain text\n".to_vec(),
1343 _ => vec![0u8, 1, 2, 3],
1344 };
1345 body.extend_from_slice(&pad);
1346 std::fs::write(&p, &body).unwrap();
1347 }
1348 std::fs::create_dir(big.join("a-subdir")).unwrap();
1349
1350 let entries = list_dir(&big).unwrap();
1351 assert_eq!(entries.len(), n + 1);
1352
1353 // Every row must agree with what a single-threaded read of that same
1354 // file reports: kind, size and directory flag.
1355 for e in &entries {
1356 let p = big.join(&e.name);
1357 let m = std::fs::metadata(&p).unwrap();
1358 assert_eq!(e.is_dir, m.is_dir(), "{}", e.name);
1359 assert_eq!(e.size, m.len(), "size mismatch on {}", e.name);
1360 assert_eq!(e.mtime, mtime_str(&m), "mtime mismatch on {}", e.name);
1361 assert_eq!(
1362 e.kind,
1363 detect_kind(&p, e.is_dir),
1364 "kind mismatch on {}",
1365 e.name
1366 );
1367 }
1368
1369 // Sanity: several kinds are actually present, so the loop above is not
1370 // trivially true, and the directory sorts first.
1371 let kinds: Vec<FileKind> = entries.iter().map(|e| e.kind).collect();
1372 assert!(kinds.contains(&FileKind::Image));
1373 assert!(kinds.contains(&FileKind::Text));
1374 assert!(kinds.contains(&FileKind::Binary));
1375 assert_eq!(entries[0].name, "a-subdir");
1376 assert_eq!(entries[0].kind, FileKind::Dir);
1377
1378 // The thread budget is fully returned once the listing is done.
1379 assert_eq!(SNIFF_BUDGET.load(Ordering::Acquire), 0);
1380 }
1381
1382 #[test]
1383 fn sniff_permit_never_exceeds_the_budget() {
1384 use std::sync::atomic::Ordering;
1385 let _guard = BUDGET_TESTS.lock().unwrap();
1386 let total = sniff_budget_total();
1387 let a = SniffPermit::claim(total * 2);
1388 assert_eq!(a.0, total, "a single claim is capped at the total");
1389 // Nothing left: the next listing runs serially rather than queueing.
1390 let b = SniffPermit::claim(4);
1391 assert_eq!(b.0, 0);
1392 drop(a);
1393 drop(b);
1394 assert_eq!(SNIFF_BUDGET.load(Ordering::Acquire), 0);
1395 }
1396
1397 #[test]
1398 fn list_dir_reports_kinds() {
1399 let t = T::new();
1400 std::fs::write(
1401 t.root.join("docs/pic.dat"),
1402 [0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A],
1403 )
1404 .unwrap();
1405 let entries = list_dir(&t.root.join("docs")).unwrap();
1406 let kind_of = |n: &str| entries.iter().find(|e| e.name == n).unwrap().kind;
1407 assert_eq!(kind_of("inner"), FileKind::Dir);
1408 assert_eq!(kind_of("a.txt"), FileKind::Text);
1409 assert_eq!(kind_of("pic.dat"), FileKind::Image);
1410 }
1411}
1412