feat(doctor): report object integrity failures

Author: KumamuKuma

src/rgit/doctor.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 from pathlib import Path
 from typing import Any
@@ -145,17 +146,20 @@ def _check_feature_payloads(store, findings: list[dict[str, Any]]) -> None:
                 fid,
             )
             continue
-        try:
-            payload = _load_json_object(store, digest)
-        except FileNotFoundError:
-            _add(
-                findings,
-                "error",
-                "missing_feature_payload_object",
-                "feature payload_hash does not resolve to an object",
-                fid,
-            )
+        payload_ok, payload_bytes = _check_object_reference(
+            store,
+            findings,
+            digest,
+            fid,
+            kind="feature_payload",
+            reference="feature payload_hash",
+            load_bytes=True,
+        )
+        if not payload_ok:
             continue
+        assert payload_bytes is not None
+        try:
+            payload = json.loads(payload_bytes)
         except (UnicodeDecodeError, json.JSONDecodeError):
             _add(
                 findings,
@@ -203,14 +207,14 @@ def _check_run_artifacts(store, findings: list[dict[str, Any]]) -> None:
                 rid,
             )
             continue
-        if not store.objects.path_for(digest).exists():
-            _add(
-                findings,
-                "error",
-                "missing_run_artifact_object",
-                "run artifact_hash does not resolve to an object",
-                rid,
-            )
+        _check_object_reference(
+            store,
+            findings,
+            digest,
+            rid,
+            kind="run_artifact",
+            reference="run artifact_hash",
+        )
 
 
 def _check_proposals(store, findings: list[dict[str, Any]]) -> None:
@@ -225,13 +229,14 @@ def _check_proposals(store, findings: list[dict[str, Any]]) -> None:
                 "proposal has no diff_ref",
                 pid,
             )
-        elif not store.objects.path_for(diff_ref).exists():
-            _add(
+        else:
+            _check_object_reference(
+                store,
                 findings,
-                "error",
-                "missing_proposal_diff_object",
-                "proposal diff_ref does not resolve to an object",
+                diff_ref,
                 pid,
+                kind="proposal_diff",
+                reference="proposal diff_ref",
             )
         try:
             candidates = json.loads(row["candidates"])
@@ -343,8 +348,61 @@ def _expected_endpoint(edge_type: str, side: str) -> str:
     return "known"
 
 
-def _load_json_object(store, digest: str) -> Any:
-    return json.loads(store.objects.get(digest))
+def _check_object_reference(
+    store,
+    findings: list[dict[str, Any]],
+    digest: str,
+    subject: str,
+    *,
+    kind: str,
+    reference: str,
+    load_bytes: bool = False,
+) -> tuple[bool, bytes | None]:
+    """Return validity and, when requested, the exact bytes that were hashed."""
+    if not store.objects.is_valid_digest(digest):
+        _add(
+            findings,
+            "error",
+            f"invalid_{kind}_reference",
+            f"{reference} is not a canonical lowercase sha256 digest",
+            subject,
+        )
+        return False, None
+    try:
+        if load_bytes:
+            data = store.objects.get(digest)
+            matches = hashlib.sha256(data).hexdigest() == digest
+        else:
+            data = None
+            matches = store.objects.verify(digest)
+    except FileNotFoundError:
+        _add(
+            findings,
+            "error",
+            f"missing_{kind}_object",
+            f"{reference} does not resolve to an object",
+            subject,
+        )
+        return False, None
+    except OSError:
+        _add(
+            findings,
+            "error",
+            f"unreadable_{kind}_object",
+            f"{kind.replace('_', ' ')} object cannot be read",
+            subject,
+        )
+        return False, None
+    if not matches:
+        _add(
+            findings,
+            "error",
+            f"corrupt_{kind}_object",
+            f"{kind.replace('_', ' ')} object does not match sha256 {digest}",
+            subject,
+        )
+        return False, None
+    return True, data
 
 
 def _add(

tests/test_doctor.py

@@ -103,6 +103,65 @@ def test_doctor_reports_missing_feature_payload_object(git_repo):
     assert "missing_feature_payload_object" in _codes(report, level="error")
 
 
+def test_doctor_reports_corrupt_feature_payload_object(git_repo):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    fid = store.add_feature(_cap())
+    payload_hash = store.conn.execute(
+        "SELECT payload_hash FROM features WHERE id=?", (fid,)
+    ).fetchone()["payload_hash"]
+    _object_path(store, payload_hash).write_bytes(b"[]")
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "corrupt_feature_payload_object" in _codes(report, level="error")
+    assert "malformed_feature_payload_json" not in _codes(report)
+
+
+def test_doctor_hashes_the_same_feature_payload_bytes_it_parses(
+    git_repo, monkeypatch
+):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    fid = store.add_feature(_cap())
+    payload_hash = store.conn.execute(
+        "SELECT payload_hash FROM features WHERE id=?", (fid,)
+    ).fetchone()["payload_hash"]
+    real_get = store.objects.get
+
+    def tamper_before_read(digest):
+        _object_path(store, payload_hash).write_bytes(b"[]")
+        return real_get(digest)
+
+    monkeypatch.setattr(store.objects, "get", tamper_before_read)
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "corrupt_feature_payload_object" in _codes(report, level="error")
+    assert "malformed_feature_payload_json" not in _codes(report)
+
+
+def test_doctor_reports_feature_payload_read_race(git_repo, monkeypatch):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    store.add_feature(_cap())
+
+    def deny_read(digest):
+        raise PermissionError("simulated read race")
+
+    monkeypatch.setattr(store.objects, "get", deny_read)
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "unreadable_feature_payload_object" in _codes(report, level="error")
+
+
 def test_doctor_reports_missing_run_artifact_object(git_repo):
     from rgit.doctor import run_doctor
 
@@ -116,6 +175,20 @@ def test_doctor_reports_missing_run_artifact_object(git_repo):
     assert "missing_run_artifact_object" in _codes(report, level="error")
 
 
+def test_doctor_reports_corrupt_run_artifact_object(git_repo):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    artifact_hash = store.objects.put(b"artifact")
+    _run(store, artifact=artifact_hash)
+    _object_path(store, artifact_hash).write_bytes(b"tampered")
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "corrupt_run_artifact_object" in _codes(report, level="error")
+
+
 def test_doctor_reports_missing_proposal_diff_object(git_repo):
     from rgit.doctor import run_doctor
 
@@ -129,6 +202,50 @@ def test_doctor_reports_missing_proposal_diff_object(git_repo):
     assert "missing_proposal_diff_object" in _codes(report, level="error")
 
 
+def test_doctor_reports_corrupt_proposal_diff_object(git_repo):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    diff_ref = store.objects.put(b"diff")
+    _proposal(store, diff=diff_ref)
+    _object_path(store, diff_ref).write_bytes(b"tampered")
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "corrupt_proposal_diff_object" in _codes(report, level="error")
+
+
+def test_doctor_reports_invalid_object_reference_without_path_lookup(git_repo):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    _run(store, artifact="../outside")
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "invalid_run_artifact_reference" in _codes(report, level="error")
+
+
+def test_doctor_reports_unreadable_object(git_repo, monkeypatch):
+    from rgit.doctor import run_doctor
+
+    store = Store.init(git_repo)
+    artifact_hash = store.objects.put(b"artifact")
+    _run(store, artifact=artifact_hash)
+
+    def deny_read(digest):
+        raise PermissionError("simulated unreadable object")
+
+    monkeypatch.setattr(store.objects, "verify", deny_read)
+
+    report = run_doctor(store)
+
+    assert report["ok"] is False
+    assert "unreadable_run_artifact_object" in _codes(report, level="error")
+
+
 def test_doctor_reports_malformed_proposal_candidates_json(git_repo):
     from rgit.doctor import run_doctor