2 Commits

Include renames

Author	SHA1	Message	Date
Dario Gabriel LipicarandClaude Opus 5	a26de03070	feat(windows): port logos_socket_paths and add a cross target ... logos_socket_paths.cpp is the only POSIX-bound file in logos-protocol. All of it is unix-domain-socket machinery, and on Windows the local transport is named pipes (QLocalServer maps a name to \\.\pipe\<name>), where none of the assumptions hold: a pipe has no inode to lstat/chown/chmod -- access comes from a security descriptor set at CreateNamedPipe time -- and a pipe cannot outlive its last handle, so a hard-killed process leaves nothing behind. isSocketDead and reapStaleSockets are therefore not merely unimplemented on Windows, they are vacuous: the state they detect cannot arise. Both return the fail-closed answer (false / 0), matching the documented contract that an endpoint is never reported dead unless certain. applySocketPerms deliberately does NOT no-op. With no policy requested it returns true, as on POSIX. But when LOGOS_SOCKET_GROUP or LOGOS_SOCKET_MODE *are* set it fails with an explanatory error, because silently returning true would leave the endpoint more permissive than the operator asked for -- the one direction this file is careful never to go (cf. the chgrp-then-chmod ordering in the POSIX branch). Granting a pipe to a group needs a DACL plus a group->SID resolver; until that exists, refuse loudly. Also gates qt6.wrapQtAppsNoGuiHook behind !isWindows and sets dontWrapQtApps. Both halves are required: the hook does not even evaluate for a mingw host, it would be inert anyway (wrap-qt-apps-hook.sh skips anything that is not ELF or Mach-O), and qtbase's setup hook hard-errors in qtPreHook unless dontWrapQtApps is set. Header contract updated per function. POSIX branch unchanged and still compiles. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-05 22:00:55 -03:00
Dario LipicarandClaude Opus 4.8	6401e30ae1	feat: group-shareable local sockets, stale-socket reaper, bind-failure detection (#20) ... * feat: group-shareable local sockets, stale-socket reaper, bind-failure detection The QtRO local transport binds each module's unix socket at 0777 & ~umask (0755) with no way for a second OS user to reach it, discards the listen result so a failed bind surfaces only as clients hanging, and never cleans up the socket file — a hard-killed logos_host leaks it forever. Add a Qt-free helper (logos_socket_paths.{h,cpp}) usable from both the qt_remote and plain transport paths: - applySocketPerms(path): chgrp + chmod a bound socket per LOGOS_SOCKET_GROUP / LOGOS_SOCKET_MODE (chgrp-then-chmod so a half-applied policy is only ever too strict). No-op when unset, so default behaviour is unchanged. Connecting to an AF_UNIX socket needs write permission, so 0660 is what lets a group member in. - isSocketDead(path): S_ISSOCK && owned-by-us && non-blocking connect returns ECONNREFUSED/ENOENT. Fails closed on any other outcome, so it never reports a live socket or a regular file dead. - reapStaleSockets(dir, prefix): unlink only the dead sockets, never a regular file that shares the prefix (e.g. a *.lgx build artefact). Wire it into RemoteTransportHost::publishObject and QtRemoteRegistry: - construct QRemoteObjectRegistryHost empty and listen via setRegistryUrl() so a bind failure is observed and logged (with lastError() + the socket path) instead of leaving a silently-broken host; - apply the socket-access policy to the freshly-bound local: socket. The env-driven policy means every process in a node's tree (daemon, logos_host subprocesses, their children) applies the same rule to every socket it binds without threading config through each layer — the daemon exports the vars once. Adds test_socket_paths.cpp (8 gtests): mode/group application, no-op default, bad-mode rejection, live/dead/regular-file classification, and the reaper keeping live sockets and regular files while removing only dead ones. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * review: harden socket helpers (gid overflow, socket-owner check, empty-prefix guard, dedup path) Addressing automated review feedback on the socket helpers: - resolveGid(): validate strtoul() errno/range so an out-of-range numeric LOGOS_SOCKET_GROUP is rejected instead of silently truncating to a wrong gid. - applySocketPerms(): when a policy is requested, stat the path first and refuse unless it's a socket we own (S_ISSOCK + st_uid == geteuid()), so a malformed URL can never chmod/chown a stray file. No-op fast path when the env is unset. - reapStaleSockets(): refuse an empty prefix (would make every dead socket the process owns a deletion candidate). - Extract the duplicated `localSocketFilePath()` (Qt QLocalServer name->path rule) into a shared qt_remote/qt_socket_path.h so RemoteTransportHost and QtRemoteRegistry can't drift. Adds tests: non-socket path refused (mode unchanged), empty-prefix reaper no-op. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat: transport-aware token validator hook on ModuleProxy (#22) * feat: transport-aware token validator hook on ModuleProxy Adds an injectable authorizer so a host (the logoscore daemon) can accept tokens the built-in issued-token scan doesn't know — specifically operator-issued named tokens validated against a persistent store — with per-token expiry and local_only enforced against the transport the call arrived on. - ModuleProxy::setTokenValidator(std::function<bool(token, transportProtocol)>). isAuthorized() consults it ONLY after the existing m_tokens + TokenManager scan fails, so installing a validator is purely additive: it can grant, never revoke, access the built-in path already allows. Empty (default) = today's behaviour exactly. - callRemoteMethod() gains a defaulted `transportProtocol` ("local"). The QtRO local path (RemoteTransportHost) uses the default; PlainTransportHost::onCall passes the real wire ("tcp" | "tcp_ssl", fail-closed to non-local on an unexpected protocol) so a local_only token presented over the network is rejected. One ModuleProxy is shared across a provider's transports, so the transport can't be inferred — it must be threaded per call, which the defaulted arg does without changing the QtRO replica's 3-arg call. The daemon backs the validator with TokenStore::lookupByToken; other modules keep the default (no validator) and are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * review: split callRemoteMethod into explicit 3-arg + 4-arg overloads; include <utility> Addressing review feedback: - Replace the defaulted transportProtocol argument with two explicit Q_INVOKABLE overloads. The Qt meta-object system matches methods by their full parameter list and doesn't apply C++ default arguments, so the QtRO/local 3-arg call must remain a real 3-arg method rather than relying on moc's reduced-arity generation. The 3-arg form forwards to the transport-aware 4-arg form with "local"; PlainTransportHost keeps calling the 4-arg form with the real wire. - Include <utility> explicitly in module_proxy.h for std::move rather than relying on an indirect include. Full protocol suite green (160/160). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-21 23:19:12 -03:00