feat: publish Gamertan Tend preview source

Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist.

AI-assisted: OpenAI Codex helped implement, test, and audit this preview.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/state/state.go

@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package state
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const SchemaVersion = 1
+
+type Record struct {
+	SchemaVersion   int    `json:"schema_version"`
+	Strategy        string `json:"strategy"`
+	ActiveSlot      string `json:"active_slot"`
+	ActiveRelease   string `json:"active_release"`
+	PreviousSlot    string `json:"previous_slot,omitempty"`
+	PreviousRelease string `json:"previous_release,omitempty"`
+	UpdatedAt       string `json:"updated_at"`
+}
+
+func Load(path, root, strategy string) (Record, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return Record{}, err
+	}
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.DisallowUnknownFields()
+	var record Record
+	if err := dec.Decode(&record); err != nil {
+		return Record{}, fmt.Errorf("decode state: %w", err)
+	}
+	var extra any
+	if err := dec.Decode(&extra); !errors.Is(err, io.EOF) {
+		return Record{}, errors.New("state contains trailing data")
+	}
+	if err := record.Validate(root, strategy); err != nil {
+		return Record{}, err
+	}
+	return record, nil
+}
+
+func (r Record) Validate(root, strategy string) error {
+	if r.SchemaVersion != SchemaVersion {
+		return errors.New("state schema version is unsupported")
+	}
+	if r.Strategy != strategy {
+		return errors.New("state strategy does not match configuration")
+	}
+	if strategy == "blue_green" && (r.ActiveSlot != "blue" && r.ActiveSlot != "green") {
+		return errors.New("active slot is invalid")
+	}
+	if strategy == "singleton_candidate" && r.ActiveSlot != "singleton" {
+		return errors.New("singleton state slot is invalid")
+	}
+	if err := releaseBelow(root, r.ActiveRelease); err != nil {
+		return fmt.Errorf("active release: %w", err)
+	}
+	if r.PreviousRelease != "" {
+		if err := releaseBelow(root, r.PreviousRelease); err != nil {
+			return fmt.Errorf("previous release: %w", err)
+		}
+	}
+	if strategy == "blue_green" && r.PreviousRelease != "" && r.PreviousSlot == r.ActiveSlot {
+		return errors.New("previous slot must differ from active slot")
+	}
+	if _, err := time.Parse(time.RFC3339, r.UpdatedAt); err != nil {
+		return errors.New("state timestamp is invalid")
+	}
+	return nil
+}
+
+func Store(path, root string, record Record) error {
+	if err := record.Validate(root, record.Strategy); err != nil {
+		return err
+	}
+	if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return errors.New("state file must not be a symlink")
+	} else if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	b, err := json.MarshalIndent(record, "", "  ")
+	if err != nil {
+		return err
+	}
+	b = append(b, '\n')
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(dir, ".tend-state-")
+	if err != nil {
+		return err
+	}
+	name := tmp.Name()
+	ok := false
+	defer func() {
+		_ = tmp.Close()
+		if !ok {
+			_ = os.Remove(name)
+		}
+	}()
+	if err := tmp.Chmod(0o644); err != nil {
+		return err
+	}
+	if _, err := tmp.Write(b); err != nil {
+		return err
+	}
+	if err := tmp.Sync(); err != nil {
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(name, path); err != nil {
+		return err
+	}
+	ok = true
+	return syncDir(dir)
+}
+
+func releaseBelow(root, path string) error {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return errors.New("must be a clean absolute path")
+	}
+	releases := filepath.Join(root, "releases")
+	rel, err := filepath.Rel(releases, path)
+	if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || strings.ContainsRune(rel, filepath.Separator) {
+		return errors.New("must be one direct child of the release directory")
+	}
+	return nil
+}
+func syncDir(path string) error {
+	dir, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}

internal/state/state_test.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package state
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "service")
+	release := filepath.Join(root, "releases", "sha256-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	if err := os.MkdirAll(release, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "state.json")
+	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: release, UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
+	if err := Store(path, root, record); err != nil {
+		t.Fatal(err)
+	}
+	loaded, err := Load(path, root, "singleton_candidate")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.ActiveRelease != release {
+		t.Fatalf("release=%q", loaded.ActiveRelease)
+	}
+	if err := os.Remove(path); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(filepath.Join(root, "elsewhere"), path); err != nil {
+		t.Fatal(err)
+	}
+	if err := Store(path, root, record); err == nil {
+		t.Fatal("expected symlink refusal")
+	}
+}
+func TestRecordRejectsReleaseOutsideRoot(t *testing.T) {
+	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: "/tmp/other/release", UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
+	if err := record.Validate("/opt/example", "singleton_candidate"); err == nil {
+		t.Fatal("expected path refusal")
+	}
+}