dovenest

dovenest/server/src/fs.rs
fs.rs
⎇
Raw
1//! Safe filesystem access: every operation resolves
2//! `<server-root>/<user-root>/<requested-path>`, canonicalizes it and verifies
3//! the result is still inside the user's root (blocks `..` and symlink escapes).
4
5use std::io::Read;
6use std::path::{Component, Path, PathBuf};
7use std::time::UNIX_EPOCH;
8
9use chrono::DateTime;
10
11use api_types::{Entry, FileKind};
12
13use crate::error::ApiError;
14
15#[derive(Debug, thiserror::Error)]
16pub enum FsError {
17 #[error("folder not found")]
18 NotFound,
19 #[error("not a folder")]
20 NotADirectory,
21 #[error("access denied")]
22 Forbidden,
23 #[error("the configured folder no longer exists")]
24 RootMissing,
25 #[error("already exists")]
26 Conflict,
27 #[error("{0}")]
28 Invalid(String),
29}
30
31impl From<FsError> for ApiError {
32 fn from(e: FsError) -> Self {
33 use axum::http::StatusCode as S;
34 let status = match &e {
35 FsError::NotFound => S::NOT_FOUND,
36 FsError::NotADirectory => S::BAD_REQUEST,
37 FsError::Forbidden => S::FORBIDDEN,
38 FsError::RootMissing => S::NOT_FOUND,
39 FsError::Conflict => S::CONFLICT,
40 FsError::Invalid(_) => S::BAD_REQUEST,
41 };
42 ApiError::new(status, e.to_string())
43 }
44}
45
46/// Resolve a user root (path relative to the server root) to a canonical
47/// absolute path, verified to be inside the server root.
48pub fn resolve_root(server_root: &Path, root_rel: &str) -> Result<PathBuf, FsError> {
49 let candidate = server_root.join(root_rel);
50 let canonical = candidate.canonicalize().map_err(|_| FsError::RootMissing)?;
51 ensure_within(server_root, &canonical)?;
52 if !canonical.is_dir() {
53 return Err(FsError::RootMissing);
54 }
55 Ok(canonical)
56}
57
58/// Resolve a requested path (relative to a user root) safely.
59pub fn resolve_path(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<PathBuf, FsError> {
60 let root_abs = resolve_root(server_root, root_rel)?;
61 let req = Path::new(req_rel);
62 for c in req.components() {
63 if matches!(c, Component::ParentDir) {
64 return Err(FsError::Forbidden);
65 }
66 }
67 let full = root_abs.join(req);
68 let full = full.canonicalize().map_err(|e| match e.kind() {
69 std::io::ErrorKind::NotFound => FsError::NotFound,
70 _ => FsError::Forbidden,
71 })?;
72 ensure_within(&root_abs, &full)?;
73 Ok(full)
74}
75
76/// Resolve a share target that is a single file (relative to the server root).
77/// Unlike [`resolve_path`], the target itself is the file — there is no
78/// directory root beneath it.
79pub fn resolve_file(server_root: &Path, rel: &str) -> Result<PathBuf, FsError> {
80 let full = server_root.join(rel);
81 let full = full.canonicalize().map_err(|e| match e.kind() {
82 std::io::ErrorKind::NotFound => FsError::NotFound,
83 _ => FsError::Forbidden,
84 })?;
85 ensure_within(server_root, &full)?;
86 Ok(full)
87}
88
89fn ensure_within(base: &Path, p: &Path) -> Result<(), FsError> {
90 if p == base || p.starts_with(base) {
91 Ok(())
92 } else {
93 Err(FsError::Forbidden)
94 }
95}
96
97/// List a directory (blocking — call via spawn_blocking).
98pub fn list_dir(dir: &Path) -> Result<Vec<Entry>, FsError> {
99 let rd = std::fs::read_dir(dir).map_err(|e| match e.kind() {
100 std::io::ErrorKind::NotFound => FsError::NotFound,
101 std::io::ErrorKind::NotADirectory => FsError::NotADirectory,
102 _ => FsError::Forbidden,
103 })?;
104
105 // Pass 1: names only. Walking the directory stream is inherently
106 // sequential, but it is also the only part that has to be: every field
107 // below comes from a per-entry syscall, which pass 2 can do in parallel.
108 // The values here are the fallbacks used when that syscall fails.
109 let mut rows: Vec<(Entry, PathBuf)> = Vec::new();
110 for e in rd.flatten() {
111 let entry = Entry {
112 name: e.file_name().to_string_lossy().into_owned(),
113 is_dir: false,
114 size: 0,
115 mtime: EPOCH_MTIME.to_string(),
116 kind: FileKind::Binary,
117 };
118 rows.push((entry, e.path()));
119 }
120
121 // Pass 2: the per-entry syscalls — metadata plus the content sniff.
122 describe_rows(&mut rows);
123
124 let mut entries: Vec<Entry> = rows.into_iter().map(|(e, _)| e).collect();
125 // Folders first, then case-insensitive name. Sorting after pass 2 means
126 // the parallel fan-out cannot affect the order.
127 entries.sort_by(|a, b| {
128 b.is_dir
129 .cmp(&a.is_dir)
130 .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
131 .then_with(|| a.name.cmp(&b.name))
132 });
133 Ok(entries)
134}
135
136// ---------------------------------------------------------------------------
137// Content sniffing
138// ---------------------------------------------------------------------------
139
140/// How many leading bytes we read to classify a file. Every magic number
141/// `infer` knows lives in the first few dozen bytes; 256 also gives the
142/// text/binary heuristic enough to work with. Measured at ~4.6 µs per file,
143/// against ~1.4 µs for the `metadata` call in the same pass.
144const SNIFF_BYTES: usize = 256;
145
146/// Entries per thread, and the point below which parallelism is not worth it.
147/// Measured on a 22-core machine: at 50 entries fan-out is a wash (thread
148/// spawn costs about as much as the work), at 200 it is already 2x.
149const SNIFF_CHUNK: usize = 256;
150
151/// Process-wide ceiling on threads spawned for sniffing, so many concurrent
152/// listings of large directories cannot multiply into a thread explosion.
153/// One listing alone can use the whole budget; the next one degrades to fewer
154/// threads, and eventually to serial, instead of queueing.
155static SNIFF_BUDGET: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
156
157fn sniff_budget_total() -> usize {
158 static TOTAL: std::sync::LazyLock<usize> = std::sync::LazyLock::new(|| {
159 std::thread::available_parallelism()
160 .map(|n| n.get())
161 .unwrap_or(1)
162 });
163 *TOTAL
164}
165
166/// Claimed helper threads, returned to [`SNIFF_BUDGET`] on drop.
167struct SniffPermit(usize);
168
169impl SniffPermit {
170 /// Claim up to `want` helper threads, or fewer when the budget is thin.
171 fn claim(want: usize) -> Self {
172 use std::sync::atomic::Ordering;
173 let total = sniff_budget_total();
174 let mut granted = 0;
175 let _ = SNIFF_BUDGET.fetch_update(Ordering::AcqRel, Ordering::Acquire, |in_flight| {
176 granted = want.min(total.saturating_sub(in_flight));
177 (granted > 0).then_some(in_flight + granted)
178 });
179 Self(granted)
180 }
181}
182
183impl Drop for SniffPermit {
184 fn drop(&mut self) {
185 if self.0 > 0 {
186 SNIFF_BUDGET.fetch_sub(self.0, std::sync::atomic::Ordering::AcqRel);
187 }
188 }
189}
190
191/// Fill in each row from its own syscalls — `metadata` and the content sniff —
192/// fanning them out across threads for big directories.
193///
194/// The calling thread takes a chunk too, so `n` helper threads process `n + 1`
195/// chunks and a zero-thread grant is simply the serial path.
196fn describe_rows(rows: &mut [(Entry, PathBuf)]) {
197 fn describe(rows: &mut [(Entry, PathBuf)]) {
198 for (entry, path) in rows {
199 // Follows symlinks; a broken link keeps the caller's fallbacks and
200 // so shows up as an empty file.
201 if let Ok(m) = std::fs::metadata(&path) {
202 entry.is_dir = m.is_dir();
203 entry.size = m.len();
204 entry.mtime = mtime_str(&m);
205 }
206 entry.kind = detect_kind(path, entry.is_dir);
207 }
208 }
209
210 if rows.len() < SNIFF_CHUNK {
211 describe(rows);
212 return;
213 }
214 // One chunk per helper thread plus one for this thread.
215 let want = rows.len().div_ceil(SNIFF_CHUNK).saturating_sub(1);
216 let permit = SniffPermit::claim(want);
217 if permit.0 == 0 {
218 describe(rows);
219 return;
220 }
221 let chunk = rows.len().div_ceil(permit.0 + 1);
222 std::thread::scope(|s| {
223 let mut rest = rows;
224 // Hand every chunk but the last to a helper thread.
225 while rest.len() > chunk {
226 let (head, tail) = rest.split_at_mut(chunk);
227 s.spawn(|| describe(head));
228 rest = tail;
229 }
230 describe(rest);
231 });
232}
233
234/// Classify a directory entry by reading its first [`SNIFF_BYTES`] bytes.
235///
236/// Blocking — called from `list_dir` (itself under `spawn_blocking`), on
237/// several threads at once for large directories. An unreadable file is
238/// reported as [`FileKind::Binary`] rather than failing the whole listing.
239///
240// ponytail: one open() per entry, fanned out but not cached. Measured warm on
241// 22 cores: 5000 entries take 29 ms serially and 6.9 ms across threads. The
242// remaining ceiling is a cold cache or a network filesystem (NFS/SMB), where
243// each entry costs a round trip. If that shows up: cache by (dev, ino, mtime),
244// or skip the sniff for zero-byte files.
245pub fn detect_kind(path: &Path, is_dir: bool) -> FileKind {
246 if is_dir {
247 return FileKind::Dir;
248 }
249 let mut head = [0u8; SNIFF_BYTES];
250 // A read error is *not* the same as an empty file: an empty file is text
251 // (it opens in the editor), an unreadable one gets no viewer offered.
252 match std::fs::File::open(path).and_then(|mut f| f.read(&mut head)) {
253 Ok(n) => kind_from_bytes(&head[..n], path),
254 Err(_) => FileKind::Binary,
255 }
256}
257
258/// The pure half of [`detect_kind`], so it can be unit-tested without a disk.
259///
260/// `path` is consulted only for the SVG case: SVG is XML text with no magic
261/// number, but browsers render it as an image, so the extension is the only
262/// thing that can tell us to offer an image preview.
263fn kind_from_bytes(head: &[u8], path: &Path) -> FileKind {
264 if let Some(t) = infer::get(head) {
265 // PDF is filed under `Archive` by `infer`, so match the MIME first.
266 if t.mime_type() == "application/pdf" {
267 return FileKind::Pdf;
268 }
269 return match t.matcher_type() {
270 infer::MatcherType::Image => FileKind::Image,
271 infer::MatcherType::Video => FileKind::Video,
272 infer::MatcherType::Audio => FileKind::Audio,
273 infer::MatcherType::Archive => FileKind::Archive,
274 infer::MatcherType::Text => FileKind::Text,
275 // App / Book / Font / Doc / Custom: recognized, but nothing we
276 // can show in the browser.
277 _ => FileKind::Binary,
278 };
279 }
280 if !looks_like_text(head) {
281 return FileKind::Binary;
282 }
283 let ext = path
284 .extension()
285 .map(|e| e.to_string_lossy().to_lowercase())
286 .unwrap_or_default();
287 if ext == "svg" {
288 FileKind::Image
289 } else {
290 FileKind::Text
291 }
292}
293
294/// Text heuristic for the files `infer` has no signature for (plain text,
295/// source code, most config formats): no NUL byte, and the head decodes as
296/// UTF-8 once a truncated trailing character is discounted.
297///
298/// An empty file counts as text — it opens in the editor, which is what you
299/// want for a file you just created.
300fn looks_like_text(head: &[u8]) -> bool {
301 if head.contains(&0) {
302 return false;
303 }
304 match std::str::from_utf8(head) {
305 Ok(_) => true,
306 // A multi-byte character cut in half by the read boundary is fine;
307 // anything else is not text. `error_len() == None` means "unexpected
308 // end of input", i.e. truncation.
309 Err(e) => e.error_len().is_none() && e.valid_up_to() + 4 > head.len(),
310 }
311}
312
313/// Reported when a file's modification time is unavailable or unrepresentable.
314const EPOCH_MTIME: &str = "1970-01-01T00:00:00Z";
315
316fn mtime_str(m: &std::fs::Metadata) -> String {
317 let dt: Option<DateTime<chrono::Utc>> = m
318 .modified()
319 .ok()
320 .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
321 .and_then(|d| DateTime::from_timestamp(d.as_secs() as i64, 0));
322 dt.map(|d| d.to_rfc3339_opts(chrono::SecondsFormat::Secs, true))
323 .unwrap_or_else(|| EPOCH_MTIME.to_string())
324}
325
326// ---------------------------------------------------------------------------
327// Mutations (milestone 3): mkdir, rename, remove, move, copy, upload
328// ---------------------------------------------------------------------------
329
330/// Resolve a directory that must exist (relative to a user root). Used as the
331/// base for operations that target the *parent* of the item.
332pub fn resolve_dir(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<PathBuf, FsError> {
333 let full = resolve_path(server_root, root_rel, req_rel)?;
334 if !full.is_dir() {
335 return Err(FsError::NotADirectory);
336 }
337 Ok(full)
338}
339
340/// Validate a new single-component name (for rename / new folder).
341fn validate_name(name: &str) -> Result<(), FsError> {
342 let p = Path::new(name);
343 if name.is_empty()
344 || p.components().count() != 1
345 || name == "."
346 || name == ".."
347 || name.contains(['/', '\\', '\0'])
348 {
349 return Err(FsError::Invalid("invalid name".to_string()));
350 }
351 Ok(())
352}
353
354/// Create a directory (and any missing parents) inside a user root.
355pub fn mkdir(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<(), FsError> {
356 let full = resolve_path_or_new(server_root, root_rel, req_rel)?;
357 if full.exists() {
358 return Err(FsError::Conflict);
359 }
360 std::fs::create_dir_all(&full).map_err(|e| io_err(e, &full))?;
361 Ok(())
362}
363
364/// Resolve a path that does not need to exist yet, but whose *parent* must.
365fn resolve_path_or_new(
366 server_root: &Path,
367 root_rel: &str,
368 req_rel: &str,
369) -> Result<PathBuf, FsError> {
370 let root_abs = resolve_root(server_root, root_rel)?;
371 let req = Path::new(req_rel);
372 for c in req.components() {
373 if matches!(c, Component::ParentDir) {
374 return Err(FsError::Forbidden);
375 }
376 }
377 let full = root_abs.join(req);
378 // The parent must exist and stay inside the root.
379 let parent = full
380 .parent()
381 .filter(|p| !p.as_os_str().is_empty())
382 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?;
383 let parent = parent.canonicalize().map_err(|e| io_err(e, parent))?;
384 ensure_within(&root_abs, &parent)?;
385 Ok(full)
386}
387
388/// Rename (or move within the same directory) an item.
389pub fn rename_item(
390 server_root: &Path,
391 root_rel: &str,
392 req_rel: &str,
393 new_name: &str,
394 overwrite: bool,
395) -> Result<(), FsError> {
396 validate_name(new_name)?;
397 let from = resolve_path(server_root, root_rel, req_rel)?;
398 let parent = from
399 .parent()
400 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?;
401 let to = parent.join(new_name);
402 // Renaming onto itself is a no-op (the overwrite path below would
403 // delete the file before the rename).
404 if to == from {
405 return Ok(());
406 }
407 if to.exists() {
408 if !overwrite || to.is_dir() || from.is_dir() {
409 return Err(FsError::Conflict);
410 }
411 std::fs::remove_file(&to).map_err(|e| io_err(e, &to))?;
412 }
413 std::fs::rename(&from, &to).map_err(|e| io_err(e, &to))?;
414 Ok(())
415}
416
417/// Delete a file or a directory tree. Returns whether it was a directory.
418pub fn remove_item(server_root: &Path, root_rel: &str, req_rel: &str) -> Result<bool, FsError> {
419 let full = resolve_path(server_root, root_rel, req_rel)?;
420 let is_dir = full.is_dir();
421 if is_dir {
422 std::fs::remove_dir_all(&full).map_err(|e| io_err(e, &full))?;
423 } else {
424 std::fs::remove_file(&full).map_err(|e| io_err(e, &full))?;
425 }
426 Ok(is_dir)
427}
428
429/// Overwrite an existing file's contents (the editor's save path).
430///
431/// The file must already exist and be a regular file. If `expected_mtime`
432/// (whole unix seconds) is provided and differs from the file's current mtime,
433/// the file changed on disk since it was read → `Conflict` (409). Returns the
434/// file's new mtime (unix seconds) after a successful write.
435pub fn save_file(
436 server_root: &Path,
437 root_rel: &str,
438 req_rel: &str,
439 content: &[u8],
440 expected_mtime: Option<i64>,
441) -> Result<i64, FsError> {
442 let full = resolve_path(server_root, root_rel, req_rel)?; // must exist
443 let meta = std::fs::metadata(&full).map_err(|_| FsError::NotFound)?;
444 if meta.is_dir() {
445 return Err(FsError::NotADirectory);
446 }
447 if let Some(expected) = expected_mtime {
448 let cur = meta
449 .modified()
450 .ok()
451 .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
452 .map(|d| d.as_secs() as i64)
453 .unwrap_or(-1);
454 if cur != expected {
455 return Err(FsError::Conflict);
456 }
457 }
458 std::fs::write(&full, content).map_err(|e| io_err(e, &full))?;
459 // Read the new mtime so the client can anchor the next conflict check.
460 let new_meta = std::fs::metadata(&full).map_err(|_| FsError::NotFound)?;
461 let mtime = new_meta
462 .modified()
463 .ok()
464 .and_then(|t| t.duration_since(UNIX_EPOCH).ok())
465 .map(|d| d.as_secs() as i64)
466 .unwrap_or(0);
467 Ok(mtime)
468}
469
470fn io_err(e: std::io::Error, p: &Path) -> FsError {
471 tracing::warn!(error = %e, path = %p.display(), "filesystem error");
472 match e.kind() {
473 std::io::ErrorKind::NotFound => FsError::NotFound,
474 _ => FsError::Forbidden,
475 }
476}
477
478/// True if `a` is `b` or a descendant of `b` (both canonical).
479pub(crate) fn is_within_or_eq(base: &Path, p: &Path) -> bool {
480 p == base || p.starts_with(base)
481}
482
483/// Move an item (possibly across roots). `dst_dir_rel` is the destination
484/// directory (relative to `dst_root_rel`); the item keeps its base name.
485pub fn move_item(
486 server_root: &Path,
487 src_root_rel: &str,
488 src_rel: &str,
489 dst_root_rel: &str,
490 dst_dir_rel: &str,
491 overwrite: bool,
492) -> Result<(), FsError> {
493 let from = resolve_path(server_root, src_root_rel, src_rel)?;
494 let dst_dir = resolve_dir(server_root, dst_root_rel, dst_dir_rel)?;
495 let name = from
496 .file_name()
497 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?
498 .to_owned();
499 let to = dst_dir.join(&name);
500
501 // A no-op (item already at the destination) — treat as success.
502 if to == from {
503 return Ok(());
504 }
505
506 // Refuse moving a directory into itself or a descendant.
507 if from.is_dir() && is_within_or_eq(&from, &dst_dir) {
508 return Err(FsError::Invalid(
509 "cannot move a folder into itself".to_string(),
510 ));
511 }
512 check_move_conflict(&to, &from, overwrite)?;
513
514 match std::fs::rename(&from, &to) {
515 Ok(()) => Ok(()),
516 Err(e) if e.kind() == std::io::ErrorKind::CrossesDevices => {
517 copy_recursive(&from, &to)?;
518 if from.is_dir() {
519 std::fs::remove_dir_all(&from).map_err(|_| FsError::Forbidden)?;
520 } else {
521 std::fs::remove_file(&from).map_err(|_| FsError::Forbidden)?;
522 }
523 Ok(())
524 }
525 Err(e) => Err(io_err(e, &to)),
526 }
527}
528
529/// Copy an item (possibly across roots).
530pub fn copy_item(
531 server_root: &Path,
532 src_root_rel: &str,
533 src_rel: &str,
534 dst_root_rel: &str,
535 dst_dir_rel: &str,
536 overwrite: bool,
537) -> Result<(), FsError> {
538 let from = resolve_path(server_root, src_root_rel, src_rel)?;
539 let dst_dir = resolve_dir(server_root, dst_root_rel, dst_dir_rel)?;
540 let name = from
541 .file_name()
542 .ok_or_else(|| FsError::Invalid("invalid path".to_string()))?
543 .to_owned();
544 let to = dst_dir.join(&name);
545
546 // A no-op (item already at the destination) — treat as success.
547 if to == from {
548 return Ok(());
549 }
550
551 if from.is_dir() && is_within_or_eq(&from, &dst_dir) {
552 return Err(FsError::Invalid(
553 "cannot copy a folder into itself".to_string(),
554 ));
555 }
556 check_move_conflict(&to, &from, overwrite)?;
557 copy_recursive(&from, &to)?;
558 Ok(())
559}
560
561/// Conflict rules shared by move and copy:
562/// - target is a directory → always conflict (no silent merge)
563/// - target is a file → conflict unless overwriting a file with a file
564fn check_move_conflict(to: &Path, from: &Path, overwrite: bool) -> Result<(), FsError> {
565 if to.exists() {
566 let to_dir = to.is_dir();
567 let from_dir = from.is_dir();
568 if to_dir || from_dir || !overwrite {
569 return Err(FsError::Conflict);
570 }
571 }
572 Ok(())
573}
574
575/// Recursively copy a file or directory tree, preserving mtime.
576fn copy_recursive(src: &Path, dst: &Path) -> Result<(), FsError> {
577 let meta = std::fs::metadata(src).map_err(|e| io_err(e, src))?;
578 if meta.is_dir() {
579 std::fs::create_dir(dst).map_err(|e| io_err(e, dst))?;
580 for e in std::fs::read_dir(src)
581 .map_err(|e| io_err(e, src))?
582 .flatten()
583 {
584 copy_recursive(&e.path(), &dst.join(e.file_name()))?;
585 }
586 } else {
587 std::fs::copy(src, dst).map_err(|e| io_err(e, dst))?;
588 }
589 set_mtime(dst, meta.modified().ok());
590 Ok(())
591}
592
593fn set_mtime(p: &Path, t: Option<std::time::SystemTime>) {
594 if let (Some(t), Ok(f)) = (t, std::fs::File::open(p)) {
595 let _ = f.set_modified(t);
596 }
597}
598
599// ---------------------------------------------------------------------------
600// Tests
601// ---------------------------------------------------------------------------
602
603#[cfg(test)]
604mod tests {
605 use super::*;
606
607 /// A temp dir used as the "server root" with a small fixture tree:
608 ///
609 /// ```text
610 /// root/
611 /// docs/
612 /// inner/
613 /// hello.txt
614 /// a.txt
615 /// src/
616 /// main.rs
617 /// file.txt
618 /// ```
619 struct T {
620 tmp: tempfile::TempDir,
621 root: PathBuf,
622 }
623
624 impl T {
625 fn new() -> Self {
626 let tmp = tempfile::tempdir().unwrap();
627 let root = tmp.path().to_path_buf();
628 std::fs::create_dir_all(root.join("docs/inner")).unwrap();
629 std::fs::create_dir_all(root.join("src")).unwrap();
630 std::fs::write(root.join("docs/inner/hello.txt"), "hello").unwrap();
631 std::fs::write(root.join("docs/a.txt"), "a").unwrap();
632 std::fs::write(root.join("src/main.rs"), "fn main() {}").unwrap();
633 std::fs::write(root.join("file.txt"), "top file").unwrap();
634 Self { tmp, root }
635 }
636
637 /// A directory that lives *next to* the root (outside of it), for
638 /// symlink/escape tests. The tempdir name is unique, so the sibling
639 /// name is unique too.
640 fn sibling(&self, name: &str) -> PathBuf {
641 let base = self
642 .tmp
643 .path()
644 .file_name()
645 .unwrap()
646 .to_string_lossy()
647 .into_owned();
648 let p = self.tmp.path().with_file_name(format!("{base}-{name}"));
649 std::fs::create_dir_all(&p).unwrap();
650 p
651 }
652 }
653
654 // ---------- validate_name ----------
655
656 #[test]
657 fn validate_name_accepts_simple_names() {
658 for ok in ["a", "file.txt", "my folder", "Ünïcödé", "with-dash_1.2.3"] {
659 assert!(validate_name(ok).is_ok(), "{ok:?} should be valid");
660 }
661 }
662
663 #[test]
664 fn validate_name_rejects_traversal_and_paths() {
665 for bad in [
666 "", ".", "..", "a/b", "a\\b", "a\0b", "/abs", "../x", "x/../y", "x/", "/x",
667 ] {
668 assert!(validate_name(bad).is_err(), "{bad:?} should be invalid");
669 }
670 }
671
672 // ---------- resolve_root ----------
673
674 #[test]
675 fn resolve_root_whole_root_and_subdir() {
676 let t = T::new();
677 let root = t.root.canonicalize().unwrap();
678 // "." means the whole root.
679 assert_eq!(resolve_root(&root, ".").unwrap(), root);
680 assert_eq!(resolve_root(&root, "docs").unwrap(), root.join("docs"));
681 assert_eq!(
682 resolve_root(&root, "docs/inner").unwrap(),
683 root.join("docs/inner")
684 );
685 }
686
687 #[test]
688 fn resolve_root_rejects_escape_and_missing() {
689 let t = T::new();
690 let root = t.root.canonicalize().unwrap();
691 let sib = t.sibling("escape");
692 let sib_rel = sib.file_name().unwrap().to_string_lossy().into_owned();
693 // Escapes that land on *existing* paths outside the root.
694 for esc in [
695 "..".to_string(),
696 "docs/../..".to_string(),
697 format!("../{sib_rel}"),
698 ] {
699 assert!(
700 matches!(resolve_root(&root, &esc), Err(FsError::Forbidden)),
701 "{esc:?} should be forbidden"
702 );
703 }
704 // Escapes to non-existing paths simply don't exist.
705 for esc in ["../no-such-dir", "a/b/../../..", "nope"] {
706 assert!(
707 matches!(resolve_root(&root, esc), Err(FsError::RootMissing)),
708 "{esc:?} should be missing"
709 );
710 }
711 // A file is not a valid root.
712 assert!(matches!(
713 resolve_root(&root, "file.txt"),
714 Err(FsError::RootMissing)
715 ));
716 }
717
718 #[cfg(unix)]
719 #[test]
720 fn resolve_root_rejects_symlink_escape() {
721 let t = T::new();
722 let root = t.root.canonicalize().unwrap();
723 let outside = t.sibling("outside");
724 std::os::unix::fs::symlink(&outside, root.join("link")).unwrap();
725 assert!(matches!(
726 resolve_root(&root, "link"),
727 Err(FsError::Forbidden)
728 ));
729 }
730
731 // ---------- resolve_path ----------
732
733 #[test]
734 fn resolve_path_traverses_inside_root() {
735 let t = T::new();
736 let root = t.root.canonicalize().unwrap();
737 // Empty relative path → the root itself.
738 assert_eq!(resolve_path(&root, ".", "").unwrap(), root);
739 assert_eq!(
740 resolve_path(&root, "docs", "inner/hello.txt").unwrap(),
741 root.join("docs/inner/hello.txt")
742 );
743 assert_eq!(
744 resolve_path(&root, ".", "file.txt").unwrap(),
745 root.join("file.txt")
746 );
747 }
748
749 #[test]
750 fn resolve_path_rejects_parent_traversal() {
751 let t = T::new();
752 let root = t.root.canonicalize().unwrap();
753 for p in ["..", "../file.txt", "docs/../../file.txt", "a/../../b"] {
754 assert!(
755 matches!(resolve_path(&root, ".", p), Err(FsError::Forbidden)),
756 "{p:?} should be forbidden"
757 );
758 }
759 }
760
761 #[test]
762 fn resolve_path_missing_is_not_found() {
763 let t = T::new();
764 let root = t.root.canonicalize().unwrap();
765 assert!(matches!(
766 resolve_path(&root, "docs", "nope.txt"),
767 Err(FsError::NotFound)
768 ));
769 assert!(matches!(
770 resolve_path(&root, "missing-root", ""),
771 Err(FsError::RootMissing)
772 ));
773 }
774
775 #[cfg(unix)]
776 #[test]
777 fn resolve_path_rejects_symlink_escape() {
778 let t = T::new();
779 let root = t.root.canonicalize().unwrap();
780 let outside = t.sibling("outside");
781 let secret = outside.join("secret.txt");
782 std::fs::write(&secret, "top secret").unwrap();
783 std::os::unix::fs::symlink(&secret, root.join("evil")).unwrap();
784 assert!(matches!(
785 resolve_path(&root, ".", "evil"),
786 Err(FsError::Forbidden)
787 ));
788 // A symlink that stays inside the root is fine.
789 std::os::unix::fs::symlink(root.join("file.txt"), root.join("alias")).unwrap();
790 assert_eq!(
791 resolve_path(&root, ".", "alias").unwrap(),
792 root.join("file.txt")
793 );
794 }
795
796 // ---------- resolve_file / resolve_dir ----------
797
798 #[test]
799 fn resolve_file_targets_files() {
800 let t = T::new();
801 let root = t.root.canonicalize().unwrap();
802 assert_eq!(
803 resolve_file(&root, "file.txt").unwrap(),
804 root.join("file.txt")
805 );
806 assert!(matches!(
807 resolve_file(&root, "nope.txt"),
808 Err(FsError::NotFound)
809 ));
810 // Escape to an existing sibling file.
811 let sib = t.sibling("escape");
812 let sib_rel = sib.file_name().unwrap().to_string_lossy().into_owned();
813 std::fs::write(sib.join("s.txt"), "x").unwrap();
814 assert!(matches!(
815 resolve_file(&root, &format!("../{sib_rel}/s.txt")),
816 Err(FsError::Forbidden)
817 ));
818 }
819
820 #[test]
821 fn resolve_dir_requires_existing_directory() {
822 let t = T::new();
823 let root = t.root.canonicalize().unwrap();
824 assert_eq!(resolve_dir(&root, ".", "docs").unwrap(), root.join("docs"));
825 assert!(matches!(
826 resolve_dir(&root, ".", "file.txt"),
827 Err(FsError::NotADirectory)
828 ));
829 assert!(matches!(
830 resolve_dir(&root, ".", "nope"),
831 Err(FsError::NotFound)
832 ));
833 }
834
835 // ---------- list_dir ----------
836
837 #[test]
838 fn list_dir_sorts_folders_first_then_case_insensitive() {
839 let t = T::new();
840 let d = t.root.join("sortme");
841 std::fs::create_dir_all(d.join("Zeta")).unwrap();
842 std::fs::create_dir_all(d.join("alpha-dir")).unwrap();
843 std::fs::write(d.join("b.txt"), "x").unwrap();
844 std::fs::write(d.join("A.txt"), "x").unwrap();
845 std::fs::write(d.join("C.md"), "x").unwrap();
846 let entries = list_dir(&d).unwrap();
847 let names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect();
848 // Folders first (alpha-dir, Zeta), then files case-insensitively.
849 assert_eq!(names, vec!["alpha-dir", "Zeta", "A.txt", "b.txt", "C.md"]);
850 let a = &entries[2];
851 assert!(!a.is_dir);
852 assert_eq!(a.size, 1);
853 assert!(!a.mtime.is_empty());
854 }
855
856 #[test]
857 fn list_dir_error_cases() {
858 let t = T::new();
859 let root = t.root.canonicalize().unwrap();
860 assert!(matches!(
861 list_dir(&root.join("missing")),
862 Err(FsError::NotFound)
863 ));
864 assert!(matches!(
865 list_dir(&root.join("file.txt")),
866 Err(FsError::NotADirectory)
867 ));
868 }
869
870 #[cfg(unix)]
871 #[test]
872 fn list_dir_reports_broken_symlink_as_empty_file() {
873 let t = T::new();
874 let d = t.root.join("withlink");
875 std::fs::create_dir_all(&d).unwrap();
876 std::os::unix::fs::symlink(d.join("does-not-exist"), d.join("broken")).unwrap();
877 let entries = list_dir(&d).unwrap();
878 assert_eq!(entries.len(), 1);
879 assert_eq!(entries[0].name, "broken");
880 assert!(!entries[0].is_dir);
881 assert_eq!(entries[0].size, 0);
882 }
883
884 // ---------- mkdir ----------
885
886 #[test]
887 fn mkdir_creates_nested_dirs() {
888 let t = T::new();
889 let root = t.root.canonicalize().unwrap();
890 // The parent must exist; "new" first, then "new/sub".
891 mkdir(&root, ".", "new").unwrap();
892 assert!(root.join("new").is_dir());
893 mkdir(&root, ".", "new/sub").unwrap();
894 assert!(root.join("new/sub").is_dir());
895 }
896
897 #[test]
898 fn mkdir_rejects_conflict_and_bad_names() {
899 let t = T::new();
900 let root = t.root.canonicalize().unwrap();
901 assert!(matches!(mkdir(&root, ".", "docs"), Err(FsError::Conflict)));
902 assert!(matches!(
903 mkdir(&root, ".", "a/b/../../c"),
904 Err(FsError::Forbidden)
905 ));
906 assert!(matches!(
907 mkdir(&root, ".", "file.txt/x"),
908 Err(FsError::Forbidden) // parent is a file → ENOTDIR
909 ));
910 }
911
912 // ---------- rename ----------
913
914 #[test]
915 fn rename_moves_file_and_dir() {
916 let t = T::new();
917 let root = t.root.canonicalize().unwrap();
918 rename_item(&root, ".", "file.txt", "renamed.txt", false).unwrap();
919 assert!(!root.join("file.txt").exists());
920 assert_eq!(
921 std::fs::read_to_string(root.join("renamed.txt")).unwrap(),
922 "top file"
923 );
924 rename_item(&root, ".", "docs", "docs2", false).unwrap();
925 assert!(root.join("docs2/inner/hello.txt").exists());
926 }
927
928 #[test]
929 fn rename_conflicts_and_overwrite() {
930 let t = T::new();
931 let root = t.root.canonicalize().unwrap();
932 std::fs::write(root.join("other.txt"), "other").unwrap();
933 // Target file exists, no overwrite → conflict.
934 assert!(matches!(
935 rename_item(&root, ".", "file.txt", "other.txt", false),
936 Err(FsError::Conflict)
937 ));
938 // Overwrite a file target → replaces it.
939 rename_item(&root, ".", "file.txt", "other.txt", true).unwrap();
940 assert_eq!(
941 std::fs::read_to_string(root.join("other.txt")).unwrap(),
942 "top file"
943 );
944 // A dir target is never overwritten, even with the flag.
945 assert!(matches!(
946 rename_item(&root, ".", "other.txt", "docs", true),
947 Err(FsError::Conflict)
948 ));
949 // Renaming into a free slot works, then onto itself is a no-op.
950 rename_item(&root, ".", "other.txt", "free.txt", false).unwrap();
951 assert!(root.join("free.txt").exists());
952 rename_item(&root, ".", "free.txt", "free.txt", false).unwrap();
953 assert!(root.join("free.txt").exists());
954 assert!(root.join("free.txt").is_file());
955 }
956
957 #[test]
958 fn rename_validates_new_name() {
959 let t = T::new();
960 let root = t.root.canonicalize().unwrap();
961 for bad in ["a/b", "", ".", ".."] {
962 assert!(matches!(
963 rename_item(&root, ".", "file.txt", bad, false),
964 Err(FsError::Invalid(_))
965 ));
966 }
967 assert!(matches!(
968 rename_item(&root, ".", "missing", "x", false),
969 Err(FsError::NotFound)
970 ));
971 }
972
973 // ---------- remove ----------
974
975 #[test]
976 fn remove_file_and_dir() {
977 let t = T::new();
978 let root = t.root.canonicalize().unwrap();
979 assert!(!remove_item(&root, ".", "file.txt").unwrap());
980 assert!(!root.join("file.txt").exists());
981 assert!(remove_item(&root, ".", "docs").unwrap());
982 assert!(!root.join("docs").exists());
983 assert!(matches!(
984 remove_item(&root, ".", "file.txt"),
985 Err(FsError::NotFound)
986 ));
987 }
988
989 // ---------- save_file ----------
990
991 fn mtime_of(p: &Path) -> i64 {
992 std::fs::metadata(p)
993 .unwrap()
994 .modified()
995 .unwrap()
996 .duration_since(std::time::UNIX_EPOCH)
997 .unwrap()
998 .as_secs() as i64
999 }
1000
1001 #[test]
1002 fn save_file_updates_content_and_returns_new_mtime() {
1003 let t = T::new();
1004 let root = t.root.canonicalize().unwrap();
1005 let before = mtime_of(&root.join("file.txt"));
1006 // Sleep so the mtime actually advances (filesystem granularity).
1007 std::thread::sleep(std::time::Duration::from_millis(1100));
1008 let new = save_file(&root, ".", "file.txt", b"brand new", Some(before)).unwrap();
1009 assert_eq!(std::fs::read(root.join("file.txt")).unwrap(), b"brand new");
1010 assert!(new >= before);
1011 // A second save with the *returned* mtime succeeds.
1012 let new2 = save_file(&root, ".", "file.txt", b"again", Some(new)).unwrap();
1013 assert!(new2 >= new);
1014 // Without an expected mtime, always saves.
1015 let _ = save_file(&root, ".", "file.txt", b"force", None).unwrap();
1016 assert_eq!(std::fs::read(root.join("file.txt")).unwrap(), b"force");
1017 }
1018
1019 #[test]
1020 fn save_file_conflict_on_stale_mtime() {
1021 let t = T::new();
1022 let root = t.root.canonicalize().unwrap();
1023 std::thread::sleep(std::time::Duration::from_millis(1100));
1024 // The mtime we pass is older than the file's real mtime → conflict.
1025 assert!(matches!(
1026 save_file(&root, ".", "file.txt", b"x", Some(1)),
1027 Err(FsError::Conflict)
1028 ));
1029 }
1030
1031 #[test]
1032 fn save_file_error_cases() {
1033 let t = T::new();
1034 let root = t.root.canonicalize().unwrap();
1035 assert!(matches!(
1036 save_file(&root, ".", "nope.txt", b"x", None),
1037 Err(FsError::NotFound)
1038 ));
1039 assert!(matches!(
1040 save_file(&root, ".", "docs", b"x", None),
1041 Err(FsError::NotADirectory)
1042 ));
1043 assert!(matches!(
1044 save_file(&root, ".", "../evil.txt", b"x", None),
1045 Err(FsError::Forbidden)
1046 ));
1047 }
1048
1049 // ---------- move / copy ----------
1050
1051 #[test]
1052 fn move_file_and_dir_across_dirs() {
1053 let t = T::new();
1054 let root = t.root.canonicalize().unwrap();
1055 move_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1056 assert!(!root.join("file.txt").exists());
1057 assert!(root.join("src/file.txt").exists());
1058 move_item(&root, ".", "src", ".", "docs", false).unwrap();
1059 assert!(root.join("docs/src/main.rs").exists());
1060 assert!(!root.join("src").exists());
1061 }
1062
1063 #[test]
1064 fn move_refuses_into_self_and_conflicts() {
1065 let t = T::new();
1066 let root = t.root.canonicalize().unwrap();
1067 // A dir cannot be moved into itself or a descendant.
1068 assert!(matches!(
1069 move_item(&root, ".", "docs", ".", "docs", false),
1070 Err(FsError::Invalid(_))
1071 ));
1072 assert!(matches!(
1073 move_item(&root, ".", "docs", ".", "docs/inner", false),
1074 Err(FsError::Invalid(_))
1075 ));
1076 // A dir target always conflicts, even with overwrite: move the file
1077 // "x" into a folder that already contains a subfolder "x".
1078 std::fs::create_dir_all(root.join("mv/case/x")).unwrap();
1079 std::fs::create_dir_all(root.join("mv/out")).unwrap();
1080 std::fs::write(root.join("mv/out/x"), "a file named x").unwrap();
1081 assert!(matches!(
1082 move_item(&root, ".", "mv/out/x", ".", "mv/case", true),
1083 Err(FsError::Conflict)
1084 ));
1085 // File onto file: conflict without overwrite, replaced with.
1086 std::fs::write(root.join("tmp-x.txt"), "x").unwrap();
1087 std::fs::write(root.join("tmp-y.txt"), "y").unwrap();
1088 std::fs::rename(root.join("tmp-x.txt"), root.join("tmp-target.txt")).unwrap();
1089 std::fs::rename(root.join("tmp-y.txt"), root.join("tmp-target2.txt")).unwrap();
1090 // Two distinct files with the same name in one folder.
1091 std::fs::create_dir_all(root.join("mv/dst")).unwrap();
1092 std::fs::create_dir_all(root.join("mv/out2")).unwrap();
1093 std::fs::write(root.join("mv/dst/dup.txt"), "old").unwrap();
1094 std::fs::write(root.join("mv/out2/dup.txt"), "new").unwrap();
1095 assert!(matches!(
1096 move_item(&root, ".", "mv/out2/dup.txt", ".", "mv/dst", false),
1097 Err(FsError::Conflict)
1098 ));
1099 move_item(&root, ".", "mv/out2/dup.txt", ".", "mv/dst", true).unwrap();
1100 assert_eq!(
1101 std::fs::read_to_string(root.join("mv/dst/dup.txt")).unwrap(),
1102 "new"
1103 );
1104 // Moving onto itself is a no-op success.
1105 move_item(&root, ".", "tmp-target.txt", ".", ".", false).unwrap();
1106 assert!(root.join("tmp-target.txt").exists());
1107 // Missing destination dir.
1108 assert!(matches!(
1109 move_item(&root, ".", "file.txt", ".", "nope", false),
1110 Err(FsError::NotFound)
1111 ));
1112 }
1113
1114 #[test]
1115 fn copy_file_and_dir_preserves_mtime() {
1116 let t = T::new();
1117 let root = t.root.canonicalize().unwrap();
1118 let before = mtime_of(&root.join("file.txt"));
1119 copy_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1120 let copy = root.join("src/file.txt");
1121 assert_eq!(std::fs::read(&copy).unwrap(), b"top file");
1122 assert_eq!(mtime_of(&copy), before);
1123 // Dir copy.
1124 copy_item(&root, ".", "docs", ".", "src", false).unwrap();
1125 assert_eq!(
1126 std::fs::read_to_string(root.join("src/docs/inner/hello.txt")).unwrap(),
1127 "hello"
1128 );
1129 // Originals still there.
1130 assert!(root.join("file.txt").exists());
1131 assert!(root.join("docs/a.txt").exists());
1132 }
1133
1134 #[test]
1135 fn copy_refuses_into_self_and_handles_conflict() {
1136 let t = T::new();
1137 let root = t.root.canonicalize().unwrap();
1138 assert!(matches!(
1139 copy_item(&root, ".", "docs", ".", "docs", false),
1140 Err(FsError::Invalid(_))
1141 ));
1142 assert!(matches!(
1143 copy_item(&root, ".", "docs", ".", "docs/inner", false),
1144 Err(FsError::Invalid(_))
1145 ));
1146 // First copy is fine, the second one conflicts, overwrite replaces.
1147 copy_item(&root, ".", "file.txt", ".", "src", false).unwrap();
1148 assert!(matches!(
1149 copy_item(&root, ".", "file.txt", ".", "src", false),
1150 Err(FsError::Conflict)
1151 ));
1152 std::fs::write(root.join("file.txt"), "v2").unwrap();
1153 copy_item(&root, ".", "file.txt", ".", "src", true).unwrap();
1154 assert_eq!(
1155 std::fs::read_to_string(root.join("src/file.txt")).unwrap(),
1156 "v2"
1157 );
1158 // Copying onto itself is a no-op success.
1159 copy_item(&root, ".", "src/file.txt", ".", "src", false).unwrap();
1160 assert_eq!(
1161 std::fs::read_to_string(root.join("src/file.txt")).unwrap(),
1162 "v2"
1163 );
1164 // Missing destination dir.
1165 assert!(matches!(
1166 copy_item(&root, ".", "file.txt", ".", "nope", false),
1167 Err(FsError::NotFound)
1168 ));
1169 }
1170
1171 #[test]
1172 fn copy_recursive_missing_source() {
1173 let t = T::new();
1174 let dst = t.tmp.path().join("dst");
1175 assert!(matches!(
1176 copy_recursive(&t.root.join("nope"), &dst),
1177 Err(FsError::NotFound)
1178 ));
1179 }
1180
1181 // ---------- is_within_or_eq ----------
1182
1183 #[test]
1184 fn is_within_or_eq_matrix() {
1185 let t = T::new();
1186 let root = t.root.canonicalize().unwrap();
1187 let docs = root.join("docs");
1188 assert!(is_within_or_eq(&docs, &docs));
1189 assert!(is_within_or_eq(&docs, &root.join("docs/inner")));
1190 assert!(!is_within_or_eq(&docs, &root));
1191 assert!(!is_within_or_eq(&docs, &root.join("src")));
1192 }
1193
1194 // ---------- content sniffing ----------
1195
1196 fn kind(bytes: &[u8], name: &str) -> FileKind {
1197 kind_from_bytes(bytes, Path::new(name))
1198 }
1199
1200 #[test]
1201 fn magic_numbers_classify_by_content() {
1202 let png = [0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A, 0, 0, 0, 0];
1203 // The name is a lie in every case: the bytes decide.
1204 assert_eq!(kind(&png, "notes.txt"), FileKind::Image);
1205 assert_eq!(kind(b"%PDF-1.7\n%aaa\n", "x.bin"), FileKind::Pdf);
1206 assert_eq!(
1207 kind(b"PK\x03\x04\x14\x00\x00\x00", "x.png"),
1208 FileKind::Archive
1209 );
1210 assert_eq!(
1211 kind(&[0x1F, 0x8B, 0x08, 0, 0, 0, 0, 0], "x"),
1212 FileKind::Archive
1213 );
1214 assert_eq!(
1215 kind(
1216 &[
1217 0, 0, 0, 0x20, b'f', b't', b'y', b'p', b'i', b's', b'o', b'm'
1218 ],
1219 "x"
1220 ),
1221 FileKind::Video
1222 );
1223 assert_eq!(
1224 kind(b"ID3\x04\x00\x00\x00\x00\x00\x00", "x"),
1225 FileKind::Audio
1226 );
1227 assert_eq!(kind(b"RIFF\x24\x00\x00\x00WAVEfmt ", "x"), FileKind::Audio);
1228 assert_eq!(kind(b"<!doctype html><p>hi", "x"), FileKind::Text);
1229 // Recognized but not viewable in a browser.
1230 assert_eq!(
1231 kind(&[0x00, 0x61, 0x73, 0x6d, 1, 0, 0, 0], "x.wasm"),
1232 FileKind::Binary
1233 );
1234 }
1235
1236 #[test]
1237 fn unsigned_files_fall_back_to_the_text_heuristic() {
1238 // No magic number: plain text, source, config.
1239 assert_eq!(kind(b"hello world\n", "notes"), FileKind::Text);
1240 assert_eq!(kind(b"fn main() {}\n", "main.rs"), FileKind::Text);
1241 assert_eq!(
1242 kind("# über\nkey: wert\n".as_bytes(), "c.yaml"),
1243 FileKind::Text
1244 );
1245 // Extensionless text files work, which the old extension list missed.
1246 assert_eq!(kind(b"all:\n\tcargo build\n", "Makefile"), FileKind::Text);
1247 // Empty file → editable.
1248 assert_eq!(kind(b"", "new.txt"), FileKind::Text);
1249 // A NUL byte means binary, whatever the name says. (ELF has no
1250 // `infer` signature, so this is the path that catches it.)
1251 assert_eq!(
1252 kind(&[0x7F, b'E', b'L', b'F', 2, 1, 1, 0, 0], "run.txt"),
1253 FileKind::Binary
1254 );
1255 assert_eq!(kind(&[0xC3, 0x28, 0xFF, 0xFE], "x.txt"), FileKind::Binary);
1256 }
1257
1258 #[test]
1259 fn svg_is_offered_as_an_image() {
1260 // SVG is XML text with no magic number, but browsers draw it, so the
1261 // extension is the only signal available.
1262 let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\"></svg>";
1263 assert_eq!(kind(svg, "logo.svg"), FileKind::Image);
1264 assert_eq!(kind(svg, "logo.txt"), FileKind::Text);
1265 }
1266
1267 #[test]
1268 fn truncated_utf8_at_the_read_boundary_is_still_text() {
1269 // 255 ASCII bytes plus the first byte of a 2-byte character: the read
1270 // cut a character in half, which must not read as binary.
1271 let mut b = vec![b'a'; SNIFF_BYTES - 1];
1272 b.push(0xC3);
1273 assert_eq!(kind(&b, "x.txt"), FileKind::Text);
1274 }
1275
1276 #[test]
1277 fn detect_kind_reads_from_disk() {
1278 let t = T::new();
1279 assert_eq!(detect_kind(&t.root.join("docs"), true), FileKind::Dir);
1280 assert_eq!(detect_kind(&t.root.join("file.txt"), false), FileKind::Text);
1281 // Unreadable / missing → Binary, never a failed listing.
1282 assert_eq!(detect_kind(&t.root.join("nope"), false), FileKind::Binary);
1283 }
1284
1285 /// `SNIFF_BUDGET` is process-wide, so the two tests that assert on it must
1286 /// not run at the same time as each other.
1287 static BUDGET_TESTS: std::sync::Mutex<()> = std::sync::Mutex::new(());
1288
1289 /// A directory big enough to take the fan-out path must produce exactly
1290 /// what the serial path would. Pass 2 fills `is_dir`, `size`, `mtime` and
1291 /// `kind`, all on worker threads, so a chunk-boundary mistake would show up
1292 /// as a row carrying another row's metadata or the untouched placeholders.
1293 #[test]
1294 fn parallel_rows_match_serial() {
1295 use std::sync::atomic::Ordering;
1296 let _guard = BUDGET_TESTS.lock().unwrap();
1297 let t = T::new();
1298 let big = t.root.join("big");
1299 std::fs::create_dir_all(&big).unwrap();
1300 // Well over SNIFF_CHUNK, so several chunks are handed out.
1301 let n = SNIFF_CHUNK * 3 + 7;
1302 for i in 0..n {
1303 let p = big.join(format!("f{i:05}"));
1304 // Every file gets a distinct length, so `size` pins the row identity.
1305 let pad = vec![b'A'; i];
1306 let mut body = match i % 3 {
1307 0 => vec![0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A],
1308 1 => b"plain text\n".to_vec(),
1309 _ => vec![0u8, 1, 2, 3],
1310 };
1311 body.extend_from_slice(&pad);
1312 std::fs::write(&p, &body).unwrap();
1313 }
1314 std::fs::create_dir(big.join("a-subdir")).unwrap();
1315
1316 let entries = list_dir(&big).unwrap();
1317 assert_eq!(entries.len(), n + 1);
1318
1319 // Every row must agree with what a single-threaded read of that same
1320 // file reports: kind, size and directory flag.
1321 for e in &entries {
1322 let p = big.join(&e.name);
1323 let m = std::fs::metadata(&p).unwrap();
1324 assert_eq!(e.is_dir, m.is_dir(), "{}", e.name);
1325 assert_eq!(e.size, m.len(), "size mismatch on {}", e.name);
1326 assert_eq!(e.mtime, mtime_str(&m), "mtime mismatch on {}", e.name);
1327 assert_eq!(
1328 e.kind,
1329 detect_kind(&p, e.is_dir),
1330 "kind mismatch on {}",
1331 e.name
1332 );
1333 }
1334
1335 // Sanity: several kinds are actually present, so the loop above is not
1336 // trivially true, and the directory sorts first.
1337 let kinds: Vec<FileKind> = entries.iter().map(|e| e.kind).collect();
1338 assert!(kinds.contains(&FileKind::Image));
1339 assert!(kinds.contains(&FileKind::Text));
1340 assert!(kinds.contains(&FileKind::Binary));
1341 assert_eq!(entries[0].name, "a-subdir");
1342 assert_eq!(entries[0].kind, FileKind::Dir);
1343
1344 // The thread budget is fully returned once the listing is done.
1345 assert_eq!(SNIFF_BUDGET.load(Ordering::Acquire), 0);
1346 }
1347
1348 #[test]
1349 fn sniff_permit_never_exceeds_the_budget() {
1350 use std::sync::atomic::Ordering;
1351 let _guard = BUDGET_TESTS.lock().unwrap();
1352 let total = sniff_budget_total();
1353 let a = SniffPermit::claim(total * 2);
1354 assert_eq!(a.0, total, "a single claim is capped at the total");
1355 // Nothing left: the next listing runs serially rather than queueing.
1356 let b = SniffPermit::claim(4);
1357 assert_eq!(b.0, 0);
1358 drop(a);
1359 drop(b);
1360 assert_eq!(SNIFF_BUDGET.load(Ordering::Acquire), 0);
1361 }
1362
1363 #[test]
1364 fn list_dir_reports_kinds() {
1365 let t = T::new();
1366 std::fs::write(
1367 t.root.join("docs/pic.dat"),
1368 [0x89, b'P', b'N', b'G', 0x0D, 0x0A, 0x1A, 0x0A],
1369 )
1370 .unwrap();
1371 let entries = list_dir(&t.root.join("docs")).unwrap();
1372 let kind_of = |n: &str| entries.iter().find(|e| e.name == n).unwrap().kind;
1373 assert_eq!(kind_of("inner"), FileKind::Dir);
1374 assert_eq!(kind_of("a.txt"), FileKind::Text);
1375 assert_eq!(kind_of("pic.dat"), FileKind::Image);
1376 }
1377}
1378