merge: integrate proxyctl ticket 07

# Conflicts: # cmd/proxyctl/main.go # internal/securefs/securefs.go
2026-07-17 03:53:04 +08:00
parent 4ca935e79b b28ebca2d7
commit b88c44cdef
15 changed files with 1242 additions and 53 deletions
@@ -1,15 +1,23 @@
 package main

 import (
+	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
+	"strings"
+	"syscall"

 	tea "github.com/charmbracelet/bubbletea"
+	"golang.org/x/sys/unix"

 	"proxyctl/internal/app"
 	"proxyctl/internal/dockerdaemon"
+	"proxyctl/internal/operationlock"
+	"proxyctl/internal/oplog"
 	"proxyctl/internal/profile"
 	"proxyctl/internal/shell"
 	"proxyctl/internal/target"
@@ -54,42 +62,72 @@ func runWithEnvironment(args []string, input io.Reader, output io.Writer, enviro
 func runWithEnvironmentAndTargets(args []string, input io.Reader, output io.Writer, environment profile.IdentityEnvironment, files shell.FileSystem, executable string, systemTargets []target.Target) error {
 	profileConfiguration, err := profile.ResolveConfiguration(environment)
 	if err != nil {
+		if len(args) == 1 && args[0] == "doctor" {
+			fmt.Fprintf(output, "[FAIL] identity resolution — %s\n", profile.RedactText(err.Error()))
+		}
 		return err
 	}
 	shellConfiguration, err := shell.ResolveConfiguration(environment)
 	if err != nil {
+		if len(args) == 1 && args[0] == "doctor" {
+			fmt.Fprintf(output, "[FAIL] Shell Target configuration — %s\n", profile.RedactText(err.Error()))
+		}
 		return err
 	}
 	shellTarget := shell.New(shellConfiguration, files, environment)
-
-	if len(args) != 0 {
-		if len(args) != 2 || args[0] != "shell" || (args[1] != "install" && args[1] != "uninstall") {
-			return fmt.Errorf("usage: proxyctl [shell install|shell uninstall]")
-		}
-		availability := shellTarget.Availability(context.Background())
-		if !availability.Available {
-			return fmt.Errorf("Shell Target unavailable: %s", availability.Evidence)
-		}
-		if args[1] == "install" {
-			if err := shellTarget.Install(context.Background(), executable); err != nil {
-				return err
-			}
-			fmt.Fprintln(output, "Shell integration installed; restart or source your Shell startup file once.")
-			return nil
-		}
-		if err := shellTarget.Uninstall(context.Background()); err != nil {
-			return err
-		}
-		fmt.Fprintln(output, "Shell integration uninstalled.")
-		return nil
-	}
-
-	store := profile.NewOwnedFileStoreAt(profileConfiguration.Path, profileConfiguration.Owner, profileConfiguration.TrustedRoot)
 	if systemTargets == nil {
 		systemTargets = []target.Target{dockerdaemon.New(dockerdaemon.DefaultConfiguration(), nil, nil)}
 	}
 	targets := append([]target.Target{shellTarget}, systemTargets...)
-	application, err := app.NewWithTargets(store, targets)
+	stateDirectory := filepath.Dir(shellConfiguration.RecoveryFile)
+	mutationLock := operationlock.NewOwned(filepath.Join(stateDirectory, "operation.lock"), profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
+	logger := oplog.NewOwned(filepath.Join(stateDirectory, "operations.log"), 64*1024, 3, profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
+	store := profile.NewOwnedFileStoreAt(profileConfiguration.Path, profileConfiguration.Owner, profileConfiguration.TrustedRoot)
+
+	if len(args) != 0 {
+		switch {
+		case len(args) == 2 && args[0] == "shell" && (args[1] == "install" || args[1] == "uninstall"):
+			availability := shellTarget.Availability(context.Background())
+			if !availability.Available {
+				return fmt.Errorf("Shell Target unavailable: %s", availability.Evidence)
+			}
+			unlock, err := mutationLock.Lock(context.Background())
+			if err != nil {
+				return fmt.Errorf("lock proxyctl mutation: %w", err)
+			}
+			defer unlock()
+			operation := "shell-" + args[1]
+			var operationErr error
+			if args[1] == "install" {
+				operationErr = shellTarget.Install(context.Background(), executable)
+			} else {
+				operationErr = shellTarget.Uninstall(context.Background())
+			}
+			result, detail := "success", "Shell integration changed"
+			if operationErr != nil {
+				result, detail = "failure", operationErr.Error()
+			}
+			_ = logger.Write(app.LogEntry{Operation: operation, Target: shellTarget.ID(), Result: result, Detail: detail})
+			if operationErr != nil {
+				return operationErr
+			}
+			if args[1] == "install" {
+				fmt.Fprintln(output, "Shell integration installed; restart or source your Shell startup file once.")
+			} else {
+				fmt.Fprintln(output, "Shell integration uninstalled.")
+			}
+			return nil
+		case len(args) == 1 && args[0] == "doctor":
+			checks := diagnosticChecks(profileConfiguration)
+			return runMaintenanceCommand(args, input, output, store, targets, mutationLock, logger, checks)
+		case len(args) == 1 && args[0] == "reset":
+			return runMaintenanceCommand(args, input, output, store, targets, mutationLock, logger, nil)
+		default:
+			return fmt.Errorf("usage: proxyctl [doctor|reset|shell install|shell uninstall]")
+		}
+	}
+
+	application, err := app.NewWithTargetsAndRuntime(store, targets, mutationLock, logger)
 	if err != nil {
 		return err
 	}
@@ -97,3 +135,112 @@ func runWithEnvironmentAndTargets(args []string, input io.Reader, output io.Writ
 	_, err = program.Run()
 	return err
 }
+
+func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, store *profile.FileStore, targets []target.Target, mutationLock app.MutationLock, logger app.OperationLogger, checks []target.Check) error {
+	if len(args) != 1 {
+		return errors.New("invalid maintenance command")
+	}
+	if args[0] == "doctor" {
+		state, err := store.ReadOnlyLoad()
+		profileCheck := target.Check{Name: "Profile validity", OK: err == nil, Evidence: "Profile configuration is valid"}
+		if err != nil {
+			profileCheck.Evidence = err.Error()
+		}
+		checks = append([]target.Check{profileCheck}, checks...)
+		report := app.NewMaintenance(state, targets, nil, nil).Doctor(context.Background(), checks)
+		fmt.Fprint(output, report.String())
+		if !report.Healthy() {
+			return errors.New("doctor found configuration problems")
+		}
+		return nil
+	}
+	if args[0] != "reset" {
+		return errors.New("invalid maintenance command")
+	}
+	fmt.Fprint(output, "Reset every managed Target and restore recorded original state? [y/N] ")
+	answer, _ := bufio.NewReader(input).ReadString('\n')
+	answer = strings.ToLower(strings.TrimSpace(answer))
+	if answer != "y" && answer != "yes" {
+		fmt.Fprintln(output, "Reset cancelled; no Targets changed.")
+		return nil
+	}
+	if mutationLock == nil {
+		return errors.New("mutation lock is not configured")
+	}
+	unlock, err := mutationLock.Lock(context.Background())
+	if err != nil {
+		return fmt.Errorf("lock proxyctl mutation: %w", err)
+	}
+	defer unlock()
+	state, err := store.Load()
+	if err != nil {
+		return err
+	}
+	result := app.NewMaintenance(state, targets, heldMutationLock{}, logger).Reset(context.Background(), true)
+	for _, item := range result.Targets {
+		if item.Skipped {
+			fmt.Fprintf(output, "%s: skipped (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
+			continue
+		}
+		if item.Err != nil {
+			fmt.Fprintf(output, "%s: failed (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Err.Error()))
+			continue
+		}
+		fmt.Fprintf(output, "%s: reset (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
+	}
+	return result.Err
+}
+
+type heldMutationLock struct{}
+
+func (heldMutationLock) Lock(context.Context) (func(), error) { return func() {}, nil }
+
+func diagnosticChecks(configuration profile.Configuration) []target.Check {
+	identity := target.Check{Name: "identity resolution", OK: true, Evidence: fmt.Sprintf("configuration owner %s (uid %d, gid %d)", configuration.Owner.Username, configuration.Owner.UID, configuration.Owner.GID)}
+	ok, evidence := storagePermissions(configuration)
+	storage := target.Check{Name: "storage permissions", OK: ok, Evidence: evidence}
+	return []target.Check{identity, storage}
+}
+
+func storagePermissions(configuration profile.Configuration) (bool, string) {
+	ok, evidence := writableLocation(configuration.Path)
+	info, err := os.Stat(configuration.Path)
+	if os.IsNotExist(err) {
+		return ok, evidence + "; Profile configuration does not exist yet"
+	}
+	if err != nil {
+		return false, evidence + "; Profile configuration cannot be inspected: " + err.Error()
+	}
+	if info.Mode().Perm() != 0o600 {
+		return false, fmt.Sprintf("%s; Profile configuration mode is %o, want 600", evidence, info.Mode().Perm())
+	}
+	if stat, present := info.Sys().(*syscall.Stat_t); present && int(stat.Uid) != configuration.Owner.UID {
+		return false, fmt.Sprintf("%s; Profile configuration owner uid is %d, want %d", evidence, stat.Uid, configuration.Owner.UID)
+	}
+	return ok, evidence + "; Profile configuration is owner-only"
+}
+
+// writableLocation observes current authority without creating or changing files.
+func writableLocation(path string) (bool, string) {
+	candidate := path
+	for {
+		info, err := os.Stat(candidate)
+		if err == nil {
+			if !info.IsDir() {
+				candidate = filepath.Dir(candidate)
+			}
+			if err := unix.Access(candidate, unix.W_OK); err != nil {
+				return false, candidate + " is not writable: " + err.Error()
+			}
+			return true, candidate + " is writable"
+		}
+		if !os.IsNotExist(err) {
+			return false, candidate + " cannot be inspected: " + err.Error()
+		}
+		parent := filepath.Dir(candidate)
+		if parent == candidate {
+			return false, path + " has no writable existing ancestor"
+		}
+		candidate = parent
+	}
+}
@@ -0,0 +1,211 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"proxyctl/internal/operationlock"
+	"proxyctl/internal/oplog"
+	"proxyctl/internal/profile"
+	"proxyctl/internal/target"
+)
+
+type failingIdentityEnvironment struct{}
+
+func (failingIdentityEnvironment) CurrentUser() (profile.UserIdentity, error) {
+	return profile.UserIdentity{}, errors.New("identity lookup failed")
+}
+func (failingIdentityEnvironment) LookupUser(string) (profile.UserIdentity, error) {
+	return profile.UserIdentity{}, os.ErrNotExist
+}
+func (failingIdentityEnvironment) LookupEnv(string) (string, bool) { return "", false }
+
+type processFakeTarget struct {
+	id    string
+	state target.State
+	err   error
+	calls int
+}
+
+func (f *processFakeTarget) ID() string                      { return f.id }
+func (f *processFakeTarget) Description() target.Description { return target.Description{Name: f.id} }
+func (f *processFakeTarget) Availability(context.Context) target.Availability {
+	return target.Availability{Available: true, Evidence: "fake executable found"}
+}
+func (f *processFakeTarget) Confirmation(bool) string { return "" }
+func (f *processFakeTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
+	return target.Inspection{State: f.state, Evidence: "fake evidence for http://alice:secret@proxy.test"}
+}
+func (f *processFakeTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
+	f.calls++
+	if f.err == nil {
+		f.state = target.Disabled
+	}
+	return target.OperationResult{Inspection: target.Inspection{State: f.state, Evidence: "re-inspected fake state"}, Err: f.err}
+}
+func (f *processFakeTarget) DiagnosticChecks(context.Context, *profile.Profile) []target.Check {
+	return []target.Check{{Name: "required commands", OK: true, Evidence: "fake helper found"}, {Name: "write authority", OK: true, Evidence: "fake location writable"}}
+}
+
+func TestDoctorCommandUsesFakeTargetsAndIsolatedXDGWithoutMutation(t *testing.T) {
+	xdg := filepath.Join(t.TempDir(), "xdg-config")
+	store := profile.NewFileStore(filepath.Join(xdg, "proxyctl", "profiles.json"))
+	fake := &processFakeTarget{id: "fake", state: target.External}
+	var output bytes.Buffer
+	if err := runMaintenanceCommand([]string{"doctor"}, strings.NewReader(""), &output, store, []target.Target{fake}, nil, nil, []target.Check{{Name: "identity resolution", OK: true, Evidence: "fake user"}, {Name: "storage permissions", OK: true, Evidence: xdg}}); err != nil {
+		t.Fatal(err)
+	}
+	text := output.String()
+	for _, want := range []string{"Profile validity", "identity resolution", "storage permissions", "Target availability", "External", "required commands", "write authority"} {
+		if !strings.Contains(text, want) {
+			t.Errorf("doctor output missing %q: %s", want, text)
+		}
+	}
+	if strings.Contains(text, "secret") {
+		t.Fatalf("doctor leaked credentials: %s", text)
+	}
+	if fake.calls != 0 {
+		t.Fatalf("doctor mutated fake Target %d times", fake.calls)
+	}
+	if _, err := os.Stat(xdg); !os.IsNotExist(err) {
+		t.Fatalf("doctor created isolated XDG path: %v", err)
+	}
+}
+
+func TestDoctorReportsIdentityResolutionFailureStructurally(t *testing.T) {
+	var output bytes.Buffer
+	err := runWithEnvironment([]string{"doctor"}, strings.NewReader(""), &output, failingIdentityEnvironment{}, nil, "/test/proxyctl")
+	if err == nil || !strings.Contains(output.String(), "[FAIL] identity resolution") || !strings.Contains(output.String(), "identity lookup failed") {
+		t.Fatalf("doctor identity failure err=%v output=%q", err, output.String())
+	}
+}
+
+func TestDoctorReturnsFailureWhenAnyCheckFails(t *testing.T) {
+	store := profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json"))
+	fake := &processFakeTarget{id: "fake", state: target.Drifted}
+	var output bytes.Buffer
+	err := runMaintenanceCommand([]string{"doctor"}, strings.NewReader(""), &output, store, []target.Target{fake}, nil, nil, []target.Check{{Name: "identity", OK: true, Evidence: "ok"}})
+	if err == nil || !strings.Contains(output.String(), "[FAIL]") {
+		t.Fatalf("unhealthy doctor err=%v output=%q", err, output.String())
+	}
+}
+
+func TestDoctorStoragePermissionCheckIsReadOnly(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "proxyctl", "profiles.json")
+	writeConfig(t, path, `{"profiles":[]}`)
+	if err := os.Chmod(path, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	configuration := profile.Configuration{Path: path, Owner: profile.UserIdentity{UID: os.Getuid(), GID: os.Getgid()}}
+	checks := diagnosticChecks(configuration)
+	if checks[1].OK || !strings.Contains(checks[1].Evidence, "want 600") {
+		t.Fatalf("storage check = %#v", checks[1])
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o644 {
+		t.Fatalf("doctor permission check changed mode to %o", info.Mode().Perm())
+	}
+}
+
+func TestMaintenanceCommandsRunThroughBuiltBinaryWithIsolatedXDG(t *testing.T) {
+	root := t.TempDir()
+	binary := filepath.Join(root, "proxyctl")
+	build := exec.Command("go", "build", "-o", binary, ".")
+	if output, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("build proxyctl: %v\n%s", err, output)
+	}
+	environment := isolatedProcessEnvironment(root)
+
+	doctor := exec.Command(binary, "doctor")
+	doctor.Env = environment
+	doctorOutput, doctorErr := doctor.CombinedOutput()
+	if doctorErr == nil || !strings.Contains(string(doctorOutput), "[FAIL]") || !strings.Contains(string(doctorOutput), "Target availability") {
+		t.Fatalf("doctor process err=%v output=%q", doctorErr, doctorOutput)
+	}
+
+	cancel := exec.Command(binary, "reset")
+	cancel.Env = environment
+	cancel.Stdin = strings.NewReader("no\n")
+	cancelOutput, err := cancel.CombinedOutput()
+	if err != nil || !strings.Contains(string(cancelOutput), "Reset cancelled") {
+		t.Fatalf("cancel process err=%v output=%q", err, cancelOutput)
+	}
+
+	confirmed := exec.Command(binary, "reset")
+	confirmed.Env = environment
+	confirmed.Stdin = strings.NewReader("yes\n")
+	confirmedOutput, err := confirmed.CombinedOutput()
+	if err != nil || !strings.Contains(string(confirmedOutput), "shell: skipped (Disabled)") {
+		t.Fatalf("confirmed process err=%v output=%q", err, confirmedOutput)
+	}
+	if _, err := os.Stat(filepath.Join(root, "home", ".bashrc")); !os.IsNotExist(err) {
+		t.Fatalf("process smoke test touched a Shell startup file: %v", err)
+	}
+}
+
+func isolatedProcessEnvironment(root string) []string {
+	blocked := map[string]bool{"HOME": true, "XDG_CONFIG_HOME": true, "XDG_STATE_HOME": true, "SHELL": true, "SUDO_USER": true, "HTTP_PROXY": true, "http_proxy": true, "HTTPS_PROXY": true, "https_proxy": true, "ALL_PROXY": true, "all_proxy": true, "NO_PROXY": true, "no_proxy": true}
+	environment := make([]string, 0, len(os.Environ())+4)
+	for _, item := range os.Environ() {
+		name, _, _ := strings.Cut(item, "=")
+		if !blocked[name] {
+			environment = append(environment, item)
+		}
+	}
+	return append(environment,
+		"HOME="+filepath.Join(root, "home"),
+		"XDG_CONFIG_HOME="+filepath.Join(root, "config"),
+		"XDG_STATE_HOME="+filepath.Join(root, "state"),
+		"SHELL=/bin/fish",
+	)
+}
+
+func TestResetCommandCancellationAndTruthfulPartialFailureWithFakeTargets(t *testing.T) {
+	root := t.TempDir()
+	config := filepath.Join(root, "xdg-config", "proxyctl", "profiles.json")
+	writeConfig(t, config, `{"profiles":[]}`)
+	store := profile.NewFileStore(config)
+	good := &processFakeTarget{id: "good", state: target.Enabled}
+	bad := &processFakeTarget{id: "bad", state: target.Drifted, err: errors.New("remove http://bob:hunter2@proxy.test failed")}
+	external := &processFakeTarget{id: "external", state: target.External}
+	stateDir := filepath.Join(root, "xdg-state", "proxyctl")
+	lock := operationlock.New(filepath.Join(stateDir, "operation.lock"))
+	logger := oplog.New(filepath.Join(stateDir, "operations.log"), 1024, 1)
+
+	var output bytes.Buffer
+	if err := runMaintenanceCommand([]string{"reset"}, strings.NewReader("no\n"), &output, store, []target.Target{good, bad, external}, lock, logger, nil); err != nil {
+		t.Fatal(err)
+	}
+	if good.calls+bad.calls+external.calls != 0 || !strings.Contains(output.String(), "cancelled") {
+		t.Fatalf("cancel result output=%q calls=%d/%d/%d", output.String(), good.calls, bad.calls, external.calls)
+	}
+
+	output.Reset()
+	err := runMaintenanceCommand([]string{"reset"}, strings.NewReader("yes\n"), &output, store, []target.Target{good, bad, external}, lock, logger, nil)
+	if err == nil {
+		t.Fatal("partial reset returned success")
+	}
+	text := output.String()
+	if good.calls != 1 || bad.calls != 1 || external.calls != 0 || !strings.Contains(text, "good: reset (Disabled)") || !strings.Contains(text, "bad: failed (Drifted)") || !strings.Contains(text, "external: skipped (External)") {
+		t.Fatalf("partial reset output=%q calls=%d/%d/%d", text, good.calls, bad.calls, external.calls)
+	}
+	if strings.Contains(text, "hunter2") || strings.Contains(err.Error(), "hunter2") {
+		t.Fatalf("reset leaked credentials: output=%q err=%v", text, err)
+	}
+	logData, readErr := os.ReadFile(filepath.Join(stateDir, "operations.log"))
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if strings.Contains(string(logData), "hunter2") || strings.Contains(string(logData), "bob:") {
+		t.Fatalf("log leaked full authenticated URL: %s", logData)
+	}
+}