From e1f569cc3eac4b6ad29bb6424f2a8766c54944a1 Mon Sep 17 00:00:00 2001 From: Claude Fable 5 Date: Sat, 5 Sep 2026 10:10:00 +0400 Subject: [PATCH] fix(core): probeWritable(at:) always cleans up the probe file, even on partial failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two leak paths: (a) AtomicFile.write renames the temp file onto the probe path and THEN fsyncs the containing directory — if that last fsync throws, the probe file already exists on disk but the old code returned false without ever attempting removal; (b) if the explicit removeItem call itself threw, there was no retry, so a transient File Provider removal failure left the file behind permanently. Fix: an unconditional `defer` now checks fileExists and retries removeItem regardless of which branch returned early. The function only reports true when the explicit write, fsync (inside AtomicFile.write), AND removal all succeeded AND the file is confirmed gone afterward. New test: a FileManager subclass whose removeItem(at:) throws on its first call (AtomicFile.write itself never touches this injected FileManager — it uses raw Darwin/POSIX calls, not FileManager, so this only intercepts the explicit removal + the defer's retry) asserts the function returns false AND no probe file remains — verified this actually needs the defer by temporarily removing it and confirming the same test then fails with a leftover ".redline-probe-" file (see this branch's history for the discarded revert). The directory-fsync failure path has no injectable seam (raw fsync(2) on an already-open fd, not parameterized by any FileManager or other substitutable dependency, and not reproducible via chmod or other standard test techniques) — documented in the test rather than simulated. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp --- .../Support/TransportSettings.swift | 19 +++++++- .../TransportSettingsTests.swift | 43 +++++++++++++++++++ 2 files changed, 61 insertions(+), 1 deletion(-) diff --git a/Sources/ShotdeckCore/Support/TransportSettings.swift b/Sources/ShotdeckCore/Support/TransportSettings.swift index cf907f1..c278d61 100644 --- a/Sources/ShotdeckCore/Support/TransportSettings.swift +++ b/Sources/ShotdeckCore/Support/TransportSettings.swift @@ -189,16 +189,33 @@ public enum OneDriveLocator { fileManager: FileManager = .default ) -> Bool { let probeURL = folder.appendingPathComponent(".redline-probe-\(UUID().uuidString)") + // Belt-and-suspenders cleanup, unconditional: AtomicFile.write renames the temp + // file onto probeURL and THEN fsyncs the containing directory — if that last + // fsync throws, the probe file already exists on disk but the catch below + // returns false before ever reaching the explicit removeItem call. And if the + // explicit removeItem itself throws, this is the only retry it gets. Either + // way, never leave the probe file behind just because we're about to return. + defer { + if fileManager.fileExists(atPath: probeURL.path) { + try? fileManager.removeItem(at: probeURL) + } + } + do { try AtomicFile.write(Data(), to: probeURL) } catch { return false } + do { try fileManager.removeItem(at: probeURL) } catch { return false } - return true + + // Only true when the explicit removal above actually succeeded AND the file is + // confirmed gone — never trust a removeItem call that returned without throwing + // as proof of anything on a File Provider domain. + return !fileManager.fileExists(atPath: probeURL.path) } } diff --git a/Tests/ShotdeckCoreTests/TransportSettingsTests.swift b/Tests/ShotdeckCoreTests/TransportSettingsTests.swift index 835cfef..3eb787f 100644 --- a/Tests/ShotdeckCoreTests/TransportSettingsTests.swift +++ b/Tests/ShotdeckCoreTests/TransportSettingsTests.swift @@ -160,6 +160,49 @@ func probeWritableFalseForAPlainFilePath() throws { #expect(!OneDriveLocator.probeWritable(at: filePath)) } +/// The write itself succeeds (a real probe file lands on disk via AtomicFile.write, +/// which never touches this injected FileManager — it uses raw POSIX calls), but the +/// FIRST call to `removeItem(at:)` throws, simulating a transient File Provider +/// removal failure. probeWritable's own defer-based cleanup must retry and succeed +/// (the second call through this same override falls through to `super`), so no +/// probe file is left behind even though the function correctly still reports false +/// (the removal it explicitly attempted did fail). +private final class ThrowOnceOnRemoveFileManager: FileManager, @unchecked Sendable { + private let lock = NSLock() + private var hasThrown = false + + override func removeItem(at URL: URL) throws { + lock.lock() + let shouldThrow = !hasThrown + hasThrown = true + lock.unlock() + if shouldThrow { + throw NSError(domain: "ShotdeckCoreTests.ThrowOnceOnRemove", code: 1) + } + try super.removeItem(at: URL) + } +} + +@Test +func probeWritableFalseAndLeavesNoProbeFileWhenRemoveItemThrowsOnce() throws { + // Directory fsync failure (the OTHER way probeWritable's cleanup can be needed) has + // no injectable seam: AtomicFile.write's directory fsync is a raw Darwin fsync(2) + // call on an already-open file descriptor, not parameterized by any FileManager or + // other dependency this test can substitute, and there is no portable way to make + // fsync(2) itself fail via chmod or other standard test techniques (fsync failures + // are OS/filesystem/hardware-level events). Covering the removeItem-throws path + // (below) is what this test does; the fsync-throws path is covered by code + // inspection only — the same `defer` block guards both. + let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-probe-remove-throws") + defer { try? FileManager.default.removeItem(at: dir) } + let injectedFileManager = ThrowOnceOnRemoveFileManager() + + #expect(!OneDriveLocator.probeWritable(at: dir, fileManager: injectedFileManager)) + + let leftovers = try FileManager.default.contentsOfDirectory(atPath: dir.path) + #expect(leftovers.isEmpty) +} + struct TransportDefaultsSuite { let name: String let defaults: UserDefaults