Edouard Vanbelle
515 lines
22 KiB
Plaintext
515 lines
22 KiB
Plaintext
# =============================================================
|
||
# OxiCloud – Copy-folder ref_count regression
|
||
# =============================================================
|
||
# Regression test for the ref_count drift found on Ed's sandbox
|
||
# (2026-08-22) and traced to the copy-folder path. When a folder
|
||
# is copied, every file inside gets duplicated as a NEW file row
|
||
# pointing at the SAME blob(s) — dedup wins bytes-on-disk, but
|
||
# `storage.blobs.ref_count` MUST bump by the number of new refs.
|
||
# If it doesn't, dedup GC will reap a blob that a live file row
|
||
# still references → dangling reference → user gets 404 on
|
||
# download of the copied file.
|
||
#
|
||
# Covers two paths so the CDC boundary can't hide a regression:
|
||
#
|
||
# 1. Small file (`copy-ref-small.txt`) → single legacy whole-
|
||
# file blob. `storage.blobs.ref_count` counted directly on
|
||
# the file's content hash.
|
||
# 2. 2 MB file (`copy-ref-cdc.bin`) → FastCDC produces multiple
|
||
# distinct chunks. Whole-file `content_hash` still resolves
|
||
# through the dedup API.
|
||
#
|
||
# Both fixtures are DEDICATED — unique content so ref_count
|
||
# assertions are absolute (== 1, == 2). Do NOT reuse these
|
||
# fixtures in other hurl files or absolute assertions here will
|
||
# flake.
|
||
#
|
||
# Deletion is TWO STEPS in OxiCloud:
|
||
# `DELETE /api/folders/{id}` → moves to trash (ref_count
|
||
# unchanged; children still
|
||
# reference the blob).
|
||
# `DELETE /api/trash/{id}` → permanent purge; NOW
|
||
# ref_count decrements. If it
|
||
# hits 0, blob row is deleted
|
||
# synchronously (`exists=false`).
|
||
# So the test purges trash after every folder-delete step —
|
||
# skipping that would make the assertions wrong regardless of
|
||
# whether the copy-side bug is present.
|
||
#
|
||
# `/api/dedup/check/{hash}` returns `ref_count` only for admin
|
||
# callers (regular users get `null` for anti-enumeration). This
|
||
# suite requires the admin token; setup.hurl seeds it.
|
||
#
|
||
# Run:
|
||
# hurl --variables-file tests/api/test.env --test \
|
||
# tests/api/copy_folder_ref_count.hurl
|
||
# =============================================================
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# Step 1 — Login (admin, required for ref_count in dedup API)
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/auth/login
|
||
Content-Type: application/json
|
||
{
|
||
"username": "{{username}}",
|
||
"password": "{{password}}"
|
||
}
|
||
|
||
HTTP 200
|
||
[Captures]
|
||
token: jsonpath "$.access_token"
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# Step 2 — Baseline sweep: run `blobs_consistency` before we
|
||
# touch anything and capture the finding count. Later
|
||
# sweeps assert equality with this baseline instead of
|
||
# `== 0` — so a stale finding from a previous test's
|
||
# leftover state doesn't flunk this test, only NEW
|
||
# drift introduced by our copy/delete does.
|
||
#
|
||
# Trigger returns `outcome.count = stats.finding_count`
|
||
# for recoverable tenants (see
|
||
# `scheduler/recoverable.rs::JobOutcome::ok_with` in
|
||
# the Completed branch). `outcome.outcome == "ok"`
|
||
# means the run walked the whole subject; it does NOT
|
||
# mean zero findings.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/admin/jobs/blobs_consistency/trigger
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Captures]
|
||
baseline_findings: jsonpath "$.outcome.count"
|
||
[Asserts]
|
||
jsonpath "$.ok" == true
|
||
jsonpath "$.outcome.outcome" == "ok"
|
||
|
||
|
||
# =============================================================
|
||
# Scenario A — small file (single legacy whole-file blob)
|
||
# =============================================================
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A1 — Create source folder
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/folders
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"name": "hurl-ref-source-small"
|
||
}
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
src_small_id: jsonpath "$.id"
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A2 — Upload the small fixture. Content is unique to this
|
||
# test, so ref_count starts at exactly 1 (no dedup
|
||
# collision with any other fixture in the suite).
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/files/upload
|
||
Authorization: Bearer {{token}}
|
||
[MultipartFormData]
|
||
folder_id: {{src_small_id}}
|
||
file: file,fixtures/copy-ref-small.txt; text/plain
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
small_file_id: jsonpath "$.id"
|
||
[Asserts]
|
||
jsonpath "$.content_hash" == "2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3"
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A3 — Baseline: exactly one live reference.
|
||
# ─────────────────────────────────────────────────────────────
|
||
GET {{base_url}}/api/dedup/check/2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A4 — Create target folder + copy source into it. The batch
|
||
# endpoint is the single entry point every FE / WebDAV
|
||
# code path funnels through.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/folders
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"name": "hurl-ref-target-small"
|
||
}
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
tgt_small_id: jsonpath "$.id"
|
||
|
||
POST {{base_url}}/api/batch/folders/copy
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"folder_ids": ["{{src_small_id}}"],
|
||
"target_folder_id": "{{tgt_small_id}}"
|
||
}
|
||
|
||
HTTP 200
|
||
[Captures]
|
||
copy_small_root: jsonpath "$.successful[0].new_root_folder_id"
|
||
[Asserts]
|
||
jsonpath "$.stats.successful" == 1
|
||
jsonpath "$.stats.failed" == 0
|
||
jsonpath "$.successful[0].files_copied" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A5 — COPY-SIDE ASSERTION: ref_count must be exactly 2. The
|
||
# pre-fix bug left this at 1 — a subsequent GC would then
|
||
# reap the blob out from under the copied file.
|
||
# ─────────────────────────────────────────────────────────────
|
||
GET {{base_url}}/api/dedup/check/2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 2
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A5b — Sweep the ENTIRE blob table via `blobs_consistency`.
|
||
# Complements the single-hash probe above: if the copy
|
||
# path miscounted some OTHER blob shared by an unrelated
|
||
# row (e.g. a global thumbnail blob, an OS icon dedup
|
||
# hit), the single-hash probe wouldn't catch it. Delta
|
||
# vs `baseline_findings` isolates NEW drift from ambient.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/admin/jobs/blobs_consistency/trigger
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.ok" == true
|
||
jsonpath "$.outcome.outcome" == "ok"
|
||
jsonpath "$.outcome.count" == {{baseline_findings}}
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A6 — Soft-delete the copied folder tree (moves to trash).
|
||
# ref_count is EXPECTED to stay at 2 — trashed files
|
||
# still reference the blob per the `NOT is_trashed` gap
|
||
# the auditor deliberately closed (see
|
||
# `[[project_by_hash_drop_is_trashed_filter]]`). Asserting
|
||
# == 2 here makes the trash-vs-permanent boundary explicit
|
||
# so a future refactor that changed the semantics would
|
||
# surface at THIS line, not several steps downstream.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/folders/{{copy_small_root}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 204
|
||
|
||
GET {{base_url}}/api/dedup/check/2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 2
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A7 — Purge the copy folder permanently.
|
||
# `DELETE /api/trash/{id}` accepts the ORIGINAL resource
|
||
# id as the path param (verified in `trash_handler.rs::
|
||
# delete_permanently`) — no need to GET+filter the trash
|
||
# listing to translate. If soft-delete silently failed,
|
||
# the ref_count assertion two lines below catches it.
|
||
# ref_count must drop to exactly 1 (the source folder
|
||
# still holds its file). Guards the DECREMENT half of
|
||
# the invariant: a double-decrement here would go to 0
|
||
# and the next GC wipes the still-live original's blob.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/trash/{{copy_small_root}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
|
||
|
||
GET {{base_url}}/api/dedup/check/2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A8 — Soft-delete + purge the SOURCE folder (last holder).
|
||
# ref_count hits 0 → blob row deleted synchronously →
|
||
# `exists == false` on the next probe. Mirror pattern to
|
||
# `dedup_blob_cleanup.hurl` step 10, applied to folder-
|
||
# scoped delete.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/folders/{{src_small_id}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 204
|
||
|
||
|
||
DELETE {{base_url}}/api/trash/{{src_small_id}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
|
||
|
||
GET {{base_url}}/api/dedup/check/2d8eb13178cff0036a22e0c3c42446061e86579f9d59ea73c8343bccc2df0fd3
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == false
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# A9 — End-of-Scenario-A sweep. Scenario A introduced two file
|
||
# rows (source + copy), then deleted both. Net effect on
|
||
# the DB is zero — so the drift count must be exactly the
|
||
# baseline, no more, no less.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/admin/jobs/blobs_consistency/trigger
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.ok" == true
|
||
jsonpath "$.outcome.outcome" == "ok"
|
||
jsonpath "$.outcome.count" == {{baseline_findings}}
|
||
|
||
|
||
# =============================================================
|
||
# Scenario B — 2 MB multi-chunk file (CDC manifest path)
|
||
#
|
||
# Coverage note: `blobs_consistency` iterates every blob row
|
||
# (whole-file AND per-chunk) and checks each ref_count against
|
||
# the auditor SQL, so a chunk-level under-count is caught by
|
||
# the sweep in B5b. But the DEDICATED tenant for the CDC path
|
||
# is `manifest_consistency` (queued on a separate branch as of
|
||
# 2026-08-23) — when it lands, replace the `blobs_consistency`
|
||
# trigger in B5b/B9 with `manifest_consistency` (or run both
|
||
# in the batch) so the assertion is scoped to what actually
|
||
# describes the CDC invariant.
|
||
# =============================================================
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B1 — Source folder for the multi-chunk scenario. Isolated
|
||
# from Scenario A so deletion order can't mask a bug (e.g.
|
||
# a shared blob whose counter goes negative).
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/folders
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"name": "hurl-ref-source-cdc"
|
||
}
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
src_cdc_id: jsonpath "$.id"
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B2 — Upload the 2 MB dedicated fixture. Deterministic per-
|
||
# position content → FastCDC produces multiple distinct
|
||
# chunks (no chunk-level dedup with any other fixture).
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/files/upload
|
||
Authorization: Bearer {{token}}
|
||
[MultipartFormData]
|
||
folder_id: {{src_cdc_id}}
|
||
file: file,fixtures/copy-ref-cdc.bin; application/octet-stream
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
cdc_file_id: jsonpath "$.id"
|
||
[Asserts]
|
||
jsonpath "$.content_hash" == "fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83"
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B3 — Baseline. If exists=false here, the whole-file hash
|
||
# isn't registered in `storage.blobs` for CDC uploads on
|
||
# this build — swap to a chunk-hash probe or a
|
||
# blobs_consistency-driven assertion. See
|
||
# `docs/plan/recovery.md`.
|
||
# ─────────────────────────────────────────────────────────────
|
||
GET {{base_url}}/api/dedup/check/fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B4 — Target folder + folder copy.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/folders
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"name": "hurl-ref-target-cdc"
|
||
}
|
||
|
||
HTTP 201
|
||
[Captures]
|
||
tgt_cdc_id: jsonpath "$.id"
|
||
|
||
POST {{base_url}}/api/batch/folders/copy
|
||
Authorization: Bearer {{token}}
|
||
Content-Type: application/json
|
||
{
|
||
"folder_ids": ["{{src_cdc_id}}"],
|
||
"target_folder_id": "{{tgt_cdc_id}}"
|
||
}
|
||
|
||
HTTP 200
|
||
[Captures]
|
||
copy_cdc_root: jsonpath "$.successful[0].new_root_folder_id"
|
||
[Asserts]
|
||
jsonpath "$.stats.successful" == 1
|
||
jsonpath "$.successful[0].files_copied" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B5 — CDC copy-side assertion: ref_count == 2.
|
||
# ─────────────────────────────────────────────────────────────
|
||
GET {{base_url}}/api/dedup/check/fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 2
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B5b — Full-DB sweep after CDC copy. Multi-chunk path
|
||
# exercises the manifest side of the ref-count invariant
|
||
# — a bug that skips one chunk out of N would leak that
|
||
# chunk without touching the single whole-file assertion
|
||
# above. Sweep catches it.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/admin/jobs/blobs_consistency/trigger
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.ok" == true
|
||
jsonpath "$.outcome.outcome" == "ok"
|
||
jsonpath "$.outcome.count" == {{baseline_findings}}
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B6 — Soft-delete copy: ref_count stays at 2.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/folders/{{copy_cdc_root}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 204
|
||
|
||
GET {{base_url}}/api/dedup/check/fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 2
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B7 — Purge copy from trash directly by folder id: ref_count → 1.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/trash/{{copy_cdc_root}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
|
||
|
||
GET {{base_url}}/api/dedup/check/fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == true
|
||
jsonpath "$.ref_count" == 1
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B8 — Soft-delete + purge SOURCE: ref_count → 0, blob purged.
|
||
# ─────────────────────────────────────────────────────────────
|
||
DELETE {{base_url}}/api/folders/{{src_cdc_id}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 204
|
||
|
||
|
||
DELETE {{base_url}}/api/trash/{{src_cdc_id}}
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
|
||
|
||
GET {{base_url}}/api/dedup/check/fb1e63c28bb792e0f69cd16cd7595989f83c218cf70894e07d1f811ab1dc6f83
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.exists" == false
|
||
|
||
|
||
# ─────────────────────────────────────────────────────────────
|
||
# B9 — End-of-Scenario-B sweep. All Scenario B rows gone;
|
||
# finding count must be back at baseline.
|
||
# ─────────────────────────────────────────────────────────────
|
||
POST {{base_url}}/api/admin/jobs/blobs_consistency/trigger
|
||
Authorization: Bearer {{token}}
|
||
|
||
HTTP 200
|
||
[Asserts]
|
||
jsonpath "$.ok" == true
|
||
jsonpath "$.outcome.outcome" == "ok"
|
||
jsonpath "$.outcome.count" == {{baseline_findings}}
|
||
|
||
|
||
# =============================================================
|
||
# Cleanup — soft-delete + purge the two empty target folders so
|
||
# the run leaves nothing behind. Same direct-by-id pattern as
|
||
# above; no trash-listing filter needed.
|
||
# =============================================================
|
||
DELETE {{base_url}}/api/folders/{{tgt_small_id}}
|
||
Authorization: Bearer {{token}}
|
||
HTTP 204
|
||
|
||
DELETE {{base_url}}/api/trash/{{tgt_small_id}}
|
||
Authorization: Bearer {{token}}
|
||
HTTP 200
|
||
|
||
|
||
DELETE {{base_url}}/api/folders/{{tgt_cdc_id}}
|
||
Authorization: Bearer {{token}}
|
||
HTTP 204
|
||
|
||
DELETE {{base_url}}/api/trash/{{tgt_cdc_id}}
|
||
Authorization: Bearer {{token}}
|
||
HTTP 200
|