permission_persister.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/storage/permission_persister.h>
 
#include <entropic/types/logging.h>
 
#include <algorithm>
#include <fstream>
#include <sstream>
#include <string>
#include <vector>
 
namespace entropic {
 
namespace {
auto logger = entropic::log::get("storage.permission_persister");
} // anonymous namespace
 
PermissionPersister::PermissionPersister(
        const std::filesystem::path& config_dir)
    : config_path_(config_dir / "config.local.yaml") {}
 
static std::string read_file(const std::filesystem::path& path) {
    std::ifstream in(path);
    if (!in.is_open()) return "";
    std::ostringstream ss;
    ss << in.rdbuf();
    return ss.str();
}
 
static bool write_file(const std::filesystem::path& path,
                       const std::string& content) {
    std::filesystem::create_directories(path.parent_path());
    std::ofstream out(path);
    if (!out.is_open()) return false;
    out << content;
    return out.good();
}
 
static std::vector<std::string> split_lines(const std::string& content) {
    std::vector<std::string> lines;
    std::istringstream iss(content);
    std::string line;
    while (std::getline(iss, line)) {
        lines.push_back(line);
    }
    return lines;
}
 
static bool list_contains(const std::vector<std::string>& lines,
                          size_t start, std::string_view pattern) {
    std::string needle = "- " + std::string(pattern);
    for (size_t i = start + 1; i < lines.size(); ++i) {
        auto pos = lines[i].find_first_not_of(' ');
        if (pos == std::string::npos) continue;
        auto trimmed = lines[i].substr(pos);
        if (!trimmed.starts_with("- ")) break;
        if (trimmed == needle) return true;
    }
    return false;
}
 
static auto find_list_end(std::vector<std::string>& lines,
                          size_t list_start) {
    auto ins = lines.begin()
             + static_cast<long>(list_start) + 1;
    while (ins != lines.end()) {
        auto pos = ins->find_first_not_of(' ');
        bool is_item = pos != std::string::npos
                    && ins->substr(pos).starts_with("- ");
        if (!is_item) break;
        ++ins;
    }
    return ins;
}
 
static auto find_section_end(std::vector<std::string>& lines,
                             std::vector<std::string>::iterator start) {
    auto it = start + 1;
    while (it != lines.end() && !it->empty()
           && ((*it)[0] == ' ' || (*it)[0] == '\t')) {
        ++it;
    }
    return it;
}
 
static std::string join_lines(const std::vector<std::string>& lines) {
    std::ostringstream out;
    for (size_t i = 0; i < lines.size(); ++i) {
        out << lines[i];
        if (i + 1 < lines.size()) out << '\n';
    }
    auto result = out.str();
    if (!result.empty() && result.back() != '\n') {
        result += '\n';
    }
    return result;
}
 
static bool insert_permission_item(std::vector<std::string>& lines,
                                   std::string_view pattern,
                                   const std::string& perms_key,
                                   const std::string& list_line,
                                   const std::string& item) {
    auto perms_it = std::find(lines.begin(), lines.end(), perms_key);
    if (perms_it == lines.end()) {
        lines.push_back(perms_key);
        lines.push_back(list_line);
        lines.push_back(item);
    } else if (auto list_it = std::find(perms_it, lines.end(), list_line);
               list_it == lines.end()) {
        // v2.3.10: previously this block did
        //     lines.insert(pos, item); lines.insert(pos, list_line);
        // — but `pos` is invalidated after the first insert (vector
        // iterator-invalidation rules), so the second insert ran on a
        // stale iterator (UB; surfaces as SIGSEGV on glibc). Now we
        // insert the sub-key (`  deny:` or `  allow:`) first, then the
        // item one slot past it. Surfaced by the v2.3.10 coverage
        // tests for permission_persister.
        auto pos = find_section_end(lines, perms_it);
        pos = lines.insert(pos, list_line);
        lines.insert(pos + 1, item);
    } else {
        size_t idx = static_cast<size_t>(
            std::distance(lines.begin(), list_it));
        if (list_contains(lines, idx, pattern)) {
            return false;
        }
        lines.insert(find_list_end(lines, idx), item);
    }
    return true;
}
 
bool PermissionPersister::save_permission(std::string_view pattern,
                                          bool allow) {
    std::lock_guard lock(write_mutex_);
 
    auto lines = split_lines(read_file(config_path_));
    const char* list_key = allow ? "allow" : "deny";
    std::string perms_key = "permissions:";
    std::string list_line = std::string("  ") + list_key + ":";
    std::string item = "    - " + std::string(pattern);
 
    if (!insert_permission_item(lines, pattern, perms_key, list_line, item)) {
        return true;  // already present — nothing to write
    }
 
    if (!write_file(config_path_, join_lines(lines))) {
        logger->error("Failed to write permission to {}",
                      config_path_.string());
        return false;
    }
 
    logger->info("Saved permission {}: {}",
                 allow ? "allow" : "deny", pattern);
    return true;
}
 
} // namespace entropic