kyleandClaude Opus 5.5
5e55fe4c66
Task 04 added dependencies to toolkit and its git add line left out the lock file, so the driver stopped on an unclean tree. The lock change is folded into task 04's commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
54 lines
2.2 KiB
Markdown
54 lines
2.2 KiB
Markdown
# M3b task 03: a grant path that cannot be mounted is invalid
|
|
|
|
**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
|
|
**Commit subject:** `Refuse grant paths that cannot be mounted`
|
|
|
|
## Goal
|
|
|
|
From M3b, a grant's paths are mounted into the tool container as `--volume=<path>:<path>:ro`. In
|
|
that argument `:` and `,` are separators, so a path containing either would be read as something
|
|
else. A grant with such a path is **invalid**, which (as for every invalid grant) makes the whole
|
|
set invalid and denies every call until it is fixed.
|
|
|
|
## Files
|
|
|
|
- Copy: `crates/brokerd/tests/grants_mount.rs`
|
|
- Modify: `crates/brokerd/src/grants.rs`, `docs/implementer-log.md`
|
|
|
|
## The rule
|
|
|
|
In `check_grant`, the loop over `inner.constraints.paths` has two cases today: the path is `/`, or
|
|
it is not a valid path. Add a third, checked **only when the first two did not apply** (a path that
|
|
is already reported as invalid is not reported twice):
|
|
|
|
```rust
|
|
} else if path.contains([':', ',']) {
|
|
// Mounted as `--volume=<path>:<path>:ro`, where both are separators.
|
|
push(problems, file.clone(), None,
|
|
format!("{:?} cannot be mounted: it contains ':' or ','", path));
|
|
}
|
|
```
|
|
|
|
So a grant file with `paths = ["/home/kyle/a:b"]` gives exactly one problem, for that file, whose
|
|
text contains `cannot be mounted`. Other punctuation (space, `;`, `=`, `.`, `-`, `_`) stays fine.
|
|
|
|
## Steps
|
|
|
|
- [ ] **1. Copy.** `git switch m3b`, then
|
|
`cp docs/plans/M3b/files/crates/brokerd/tests/grants_mount.rs crates/brokerd/tests/`
|
|
- [ ] **2. See it fail.** `cargo test -p brokerd --test grants_mount`. Expected: 1 of 2 fails
|
|
(`a_path_with_a_colon_or_a_comma_makes_the_set_invalid`).
|
|
- [ ] **3. Add the rule.** Run `cargo fmt --all`.
|
|
- [ ] **4. See it pass.** `cargo test -p brokerd --test grants_mount --test grants`. Expected: 2 and
|
|
17 passed.
|
|
- [ ] **5. Run the gate.** `make gate`. Expected last line: `gate: ok`.
|
|
- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit`
|
|
|
|
## Done when
|
|
|
|
- Both suites pass; `make gate` prints `gate: ok`.
|
|
|
|
## Stop and report if
|
|
|
|
- A given test wants a path with `:` or `,` to be accepted, or wants two problems for one path.
|