`test/vienna-boundaries.cjs`

56 lines
// Calibrated deny-by-default process boundary guard; fixture I/O is explicitly allowlisted.
const fs=require('node:fs'),url=require('node:url');
const {syncBuiltinESMExports}=require('node:module');
const rawReadFile=fs.readFileSync.bind(fs),rawWriteFile=fs.writeFileSync.bind(fs);
let lastJournalEvent, drifted=false;
const rawWrite=fs.writeSync.bind(fs), rawOpen=fs.openSync.bind(fs), rawClose=fs.closeSync.bind(fs);
const reads=new Set(JSON.parse(process.env.VIENNA_ALLOWED_READS||'[]'));
const writes=new Set(JSON.parse(process.env.VIENNA_ALLOWED_WRITES||'[]'));
const dirs=new Set(JSON.parse(process.env.VIENNA_ALLOWED_DIRS||'[]'));
const fdPaths=new Map();
const p=x=>x instanceof URL?url.fileURLToPath(x):typeof x==='number'?fdPaths.get(x):String(x);
function deny(name){rawWrite(2,'BOUNDARY_DENIED:'+name+'\n');throw new Error('Boundary blocked: '+name);}
function canRead(x){return reads.has(p(x))||writes.has(p(x))||dirs.has(p(x));}
function canWrite(x){const name=p(x);return writes.has(name)||[...writes].some(base=>typeof name==='string'&&name.startsWith(base+'.pending-'));}
fs.openSync=function(file,flags,...rest){
  const writing=typeof flags==='number'?Boolean(flags&(fs.constants.O_WRONLY|fs.constants.O_RDWR|fs.constants.O_CREAT|fs.constants.O_APPEND|fs.constants.O_TRUNC)):flags!=='r';
  if(writing?!canWrite(file):!canRead(file)) return deny('fs.openSync');
  const fd=rawOpen(file,flags,...rest);fdPaths.set(fd,p(file));return fd;
};
fs.closeSync=function(fd){const r=rawClose(fd);fdPaths.delete(fd);return r;};
for(const name of ['readFileSync','readFile','createReadStream']){const orig=fs[name].bind(fs);fs[name]=function(file,...rest){if(!canRead(file))return deny('fs.'+name);return orig(file,...rest);};}
for(const name of ['writeFileSync','appendFileSync']){const orig=fs[name].bind(fs);fs[name]=function(file,...rest){if(!canWrite(file))return deny('fs.'+name);if(p(file)?.endsWith('.jsonl')) {try{lastJournalEvent=JSON.parse(String(rest[0]));}catch{}}if(process.env.VIENNA_FAIL_SUCCESS_APPEND==='1'&&String(rest[0]).includes('\"type\":\"success\"'))throw new Error('Simulated crash after confirmed mutation before success append');return orig(file,...rest);};}
for(const name of ['mkdirSync','rmdirSync']){const orig=fs[name].bind(fs);fs[name]=function(file,...rest){if(!dirs.has(p(file)))return deny('fs.'+name);return orig(file,...rest);};}
for(const name of ['writeSync','writevSync']){const orig=fs[name].bind(fs);fs[name]=function(fd,...rest){if(fd!==1&&fd!==2&&!canWrite(fd))return deny('fs.'+name);return orig(fd,...rest);};}
const rawRename=fs.renameSync.bind(fs);fs.renameSync=function(from,to){if(!canWrite(from)||!writes.has(p(to)))return deny('fs.renameSync');return rawRename(from,to);};
for(const name of ['writeFile','appendFile','rename','unlink','rm','rmdir','mkdir','copyFile','cp','link','symlink','truncate','chmod','chown','utimes','open','createWriteStream']) {
  if(typeof fs[name]==='function') fs[name]=()=>deny('fs.'+name);
  if(fs.promises[name])fs.promises[name]=()=>deny('fs.promises.'+name);
}
const pr=fs.promises.readFile.bind(fs.promises);fs.promises.readFile=async(file,...rest)=>{if(!canRead(file))return deny('fs.promises.readFile');return pr(file,...rest);};
for(const [mod,names] of Object.entries({'node:child_process':['spawn','spawnSync','exec','execSync','execFile','fork'],'node:http':['request','get'],'node:https':['request','get'],'node:net':['connect','createConnection','createServer'],'node:tls':['connect'],'node:dns':['lookup','resolve'],'node:dgram':['createSocket']}))for(const name of names)require(mod)[name]=()=>deny(mod+'.'+name);
require('node:net').Socket.prototype.connect=()=>deny('net.Socket.connect');
globalThis.fetch=()=>deny('fetch');
// Clock seam lives only in the test preload. The shipped CLI never accepts a clock override.
Date.now=()=>Date.parse('2026-09-08T12:00:00.000Z');
syncBuiltinESMExports();

const rawFsync=fs.fsyncSync.bind(fs);
fs.fsyncSync=function(fd){
  const result=rawFsync(fd);
  if(lastJournalEvent?.type==='intent'&&!drifted&&process.env.VIENNA_EXTERNAL_DRIFT){
    drifted=true;
    const file=process.env.VIENNA_EXTERNAL_DRIFT;
    const current=JSON.parse(rawReadFile(file,'utf8'));
    if(process.env.VIENNA_DRIFT_STORE==='1')current.store.id='gid://shopify/Shop/888';else current.records[0].onHand=9;
    rawWriteFile(file,JSON.stringify(current,null,2)+'\n');
  }
  if(lastJournalEvent?.type==='header'&&process.env.VIENNA_HOLD_LOCK==='1') {
    // Only a test process pauses. Parent test launches a competing actual CLI here.
    process.stdout.write('TEST_LOCK_HELD\n');
    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,700);
  }
  return result;
};
syncBuiltinESMExports();