appcore-peer-rpc 1.0.0

Peer-to-peer RPC contracts and validation for distributed AppCore.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

// =============================================================================
//        #######
//     ###       ###     F: nonce_tests.rs
//    ##   ## ##   ##    P: AppCore-Runtime
//         ## ##
//                       C: 2026/07/23 23:50:45 by dnettoRaw
//    ##   ## ##   ##    U: 2026/07/23 23:50:45 by dnettoRaw
//      ###########      S: 1.0.1-rc.8
// =============================================================================
// appcore-norm: test

use super::*;

fn test_path(name: &str) -> PathBuf {
    std::env::temp_dir()
        .join(format!(
            "appcore-peer-nonce-{name}-{}-{}",
            std::process::id(),
            now_nanos()
        ))
        .join("security/nonces.json")
}

#[test]
fn file_nonce_store_rejects_replay_across_instances_and_restart() {
    let path = test_path("restart");
    let first = FilePeerNonceStore::open(&path).unwrap();
    let second = FilePeerNonceStore::open(&path).unwrap();

    assert_eq!(first.check_and_record("nonce-a", 100, 10), Ok(()));
    assert_eq!(
        second.check_and_record("nonce-a", 100, 20),
        Err(PeerRpcError::NonceReplay)
    );
    drop(first);
    drop(second);

    let restarted = FilePeerNonceStore::open(&path).unwrap();
    assert_eq!(
        restarted.check_and_record("nonce-a", 100, 30),
        Err(PeerRpcError::NonceReplay)
    );
    assert_eq!(restarted.check_and_record("nonce-a", 200, 100), Ok(()));
    fs::remove_dir_all(path.parent().unwrap().parent().unwrap()).unwrap();
}

#[test]
fn file_nonce_store_serializes_concurrent_recording() {
    let path = test_path("concurrent");
    let first = FilePeerNonceStore::open(&path).unwrap();
    let second = FilePeerNonceStore::open(&path).unwrap();
    let first_thread = std::thread::spawn(move || first.check_and_record("nonce-a", 100, 10));
    let second_thread = std::thread::spawn(move || second.check_and_record("nonce-a", 100, 10));
    let results = [first_thread.join().unwrap(), second_thread.join().unwrap()];

    assert_eq!(results.iter().filter(|result| result.is_ok()).count(), 1);
    assert_eq!(
        results
            .iter()
            .filter(|result| **result == Err(PeerRpcError::NonceReplay))
            .count(),
        1
    );
    fs::remove_dir_all(path.parent().unwrap().parent().unwrap()).unwrap();
}

#[test]
fn file_nonce_store_fails_closed_on_corrupt_state() {
    let path = test_path("corrupt");
    let store = FilePeerNonceStore::open(&path).unwrap();
    store.check_and_record("nonce-a", 100, 10).unwrap();
    fs::write(&path, b"{partial").unwrap();
    set_private_path(&path);

    assert!(matches!(
        store.check_and_record("nonce-b", 100, 10),
        Err(PeerRpcError::InvalidEnvelope(reason)) if reason == "nonce_store_state_corrupt"
    ));
    fs::remove_dir_all(path.parent().unwrap().parent().unwrap()).unwrap();
}

#[cfg(unix)]
fn set_private_path(path: &Path) {
    use std::os::unix::fs::PermissionsExt;
    fs::set_permissions(path, fs::Permissions::from_mode(0o600)).unwrap();
}

#[cfg(not(unix))]
fn set_private_path(_path: &Path) {}