feat: group-shareable local sockets, stale-socket reaper, bind-failure detection (#20)

* feat: group-shareable local sockets, stale-socket reaper, bind-failure detection The QtRO local transport binds each module's unix socket at 0777 & ~umask (0755) with no way for a second OS user to reach it, discards the listen result so a failed bind surfaces only as clients hanging, and never cleans up the socket file — a hard-killed logos_host leaks it forever. Add a Qt-free helper (logos_socket_paths.{h,cpp}) usable from both the qt_remote and plain transport paths: - applySocketPerms(path): chgrp + chmod a bound socket per LOGOS_SOCKET_GROUP / LOGOS_SOCKET_MODE (chgrp-then-chmod so a half-applied policy is only ever too strict). No-op when unset, so default behaviour is unchanged. Connecting to an AF_UNIX socket needs write permission, so 0660 is what lets a group member in. - isSocketDead(path): S_ISSOCK && owned-by-us && non-blocking connect returns ECONNREFUSED/ENOENT. Fails closed on any other outcome, so it never reports a live socket or a regular file dead. - reapStaleSockets(dir, prefix): unlink only the dead sockets, never a regular file that shares the prefix (e.g. a *.lgx build artefact). Wire it into RemoteTransportHost::publishObject and QtRemoteRegistry: - construct QRemoteObjectRegistryHost empty and listen via setRegistryUrl() so a bind failure is observed and logged (with lastError() + the socket path) instead of leaving a silently-broken host; - apply the socket-access policy to the freshly-bound local: socket. The env-driven policy means every process in a node's tree (daemon, logos_host subprocesses, their children) applies the same rule to every socket it binds without threading config through each layer — the daemon exports the vars once. Adds test_socket_paths.cpp (8 gtests): mode/group application, no-op default, bad-mode rejection, live/dead/regular-file classification, and the reaper keeping live sockets and regular files while removing only dead ones. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * review: harden socket helpers (gid overflow, socket-owner check, empty-prefix guard, dedup path) Addressing automated review feedback on the socket helpers: - resolveGid(): validate strtoul() errno/range so an out-of-range numeric LOGOS_SOCKET_GROUP is rejected instead of silently truncating to a wrong gid. - applySocketPerms(): when a policy is requested, stat the path first and refuse unless it's a socket we own (S_ISSOCK + st_uid == geteuid()), so a malformed URL can never chmod/chown a stray file. No-op fast path when the env is unset. - reapStaleSockets(): refuse an empty prefix (would make every dead socket the process owns a deletion candidate). - Extract the duplicated `localSocketFilePath()` (Qt QLocalServer name->path rule) into a shared qt_remote/qt_socket_path.h so RemoteTransportHost and QtRemoteRegistry can't drift. Adds tests: non-socket path refused (mode unchanged), empty-prefix reaper no-op. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat: transport-aware token validator hook on ModuleProxy (#22) * feat: transport-aware token validator hook on ModuleProxy Adds an injectable authorizer so a host (the logoscore daemon) can accept tokens the built-in issued-token scan doesn't know — specifically operator-issued named tokens validated against a persistent store — with per-token expiry and local_only enforced against the transport the call arrived on. - ModuleProxy::setTokenValidator(std::function<bool(token, transportProtocol)>). isAuthorized() consults it ONLY after the existing m_tokens + TokenManager scan fails, so installing a validator is purely additive: it can grant, never revoke, access the built-in path already allows. Empty (default) = today's behaviour exactly. - callRemoteMethod() gains a defaulted `transportProtocol` ("local"). The QtRO local path (RemoteTransportHost) uses the default; PlainTransportHost::onCall passes the real wire ("tcp" | "tcp_ssl", fail-closed to non-local on an unexpected protocol) so a local_only token presented over the network is rejected. One ModuleProxy is shared across a provider's transports, so the transport can't be inferred — it must be threaded per call, which the defaulted arg does without changing the QtRO replica's 3-arg call. The daemon backs the validator with TokenStore::lookupByToken; other modules keep the default (no validator) and are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * review: split callRemoteMethod into explicit 3-arg + 4-arg overloads; include <utility> Addressing review feedback: - Replace the defaulted transportProtocol argument with two explicit Q_INVOKABLE overloads. The Qt meta-object system matches methods by their full parameter list and doesn't apply C++ default arguments, so the QtRO/local 3-arg call must remain a real 3-arg method rather than relying on moc's reduced-arity generation. The 3-arg form forwards to the transport-aware 4-arg form with "local"; PlainTransportHost keeps calling the 4-arg form with the real wire. - Include <utility> explicitly in module_proxy.h for std::move rather than relying on an indirect include. Full protocol suite green (160/160). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-30 21:41:10 +00:00 · 2026-07-21 23:19:12 -03:00
parent ef24bd70d9
commit 6401e30ae1
11 changed files with 635 additions and 18 deletions
@@ -64,7 +64,19 @@ bool ModuleProxy::saveToken(const QString& from_module_name, const QString& toke
    return true;
 }

+void ModuleProxy::setTokenValidator(TokenValidator validator)
+{
+    m_validator = std::move(validator);
+}
+
+// QtRO / local path: RemoteTransportHost only ever serves a local socket, so
+// the wire is "local". Forwards to the transport-aware overload.
 QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString& methodName, const QVariantList& args)
+{
+    return callRemoteMethod(authToken, methodName, args, QStringLiteral("local"));
+}
+
+QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString& methodName, const QVariantList& args, const QString& transportProtocol)
 {
    if (!m_provider) {
        qWarning() << "ModuleProxy: Cannot call method on null provider:" << methodName;
@@ -94,7 +106,7 @@ QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString&
    // capability_module token exchange. Everything past this point is a real
    // business-method dispatch and MUST be authorized.

-    if (!isAuthorized(authToken)) {
+    if (!isAuthorized(authToken, transportProtocol)) {
        qWarning() << "ModuleProxy: rejecting unauthorized call to" << methodName
                   << "- auth token not recognized";
        // Structured rejection instead of a bare QVariant() so a NEW consumer can
@@ -164,7 +176,7 @@ bool ModuleProxy::informModuleToken(const QString& authToken, const QString& mod
    return m_provider->informModuleToken(moduleName, token);
 }

-bool ModuleProxy::isAuthorized(const QString& authToken) const
+bool ModuleProxy::isAuthorized(const QString& authToken, const QString& transportProtocol) const
 {
    // Fail closed: an empty token is never valid, even if some empty value
    // somehow ended up in a token store.
@@ -188,7 +200,19 @@ bool ModuleProxy::isAuthorized(const QString& authToken) const
    for (const QString& key : TokenManager::instance().getTokenKeys()) {
        authorized |= constantTimeEquals(authToken, TokenManager::instance().getToken(key));
    }
-    return authorized;
+    if (authorized) {
+        return true;
+    }
+
+    // Not one of our own issued tokens — give a host-installed validator the
+    // chance to accept it for this transport. This is how operator-issued named
+    // tokens (validated against the daemon's TokenStore, with expiry and
+    // local_only enforced by `transportProtocol`) authorize a call without
+    // being pre-registered in the in-process stores above.
+    if (m_validator) {
+        return m_validator(authToken, transportProtocol);
+    }
+    return false;
 }

 namespace {