forjar 1.23.0

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

//! forjar#334: the apply gate for an unhonourable `disk_budget` preview request.
//!
//! Lives beside `apply_gates` rather than inside it only because that file is
//! at the repo's 500-line ceiling; the purpose is the same — pure decision
//! logic, testable without CLI orchestration.

/// Refuse rather than silently ignore a preview request.
///
/// `FORJAR_BUDGET_DRY_RUN` is a variable of the GENERATED REAPER, evaluated on
/// the target at the far end of a chain that strips it: `sudo bash
/// <<'FORJAR_SUDO'` resets the environment (sudo's `env_reset`) and `ssh host
/// bash` carries no `SendEnv`. forjar's own process never reads it. So an
/// operator who exported it in their shell got a real reclaim — 1.5 TB in the
/// reported incident — behind a `1 converged` line indistinguishable from the
/// preview they had asked for.
///
/// forjar cannot make an ambient variable survive that hop, so it says so
/// instead of proceeding. This is the repo's standing answer to "we cannot do
/// what you asked": refuse before mutating, and name the surfaces that can.
///
/// Scoped to runs that actually contain a `disk_budget`, so an unrelated apply
/// in a shell that happens to export the variable is not blocked; and exempt
/// from `--dry-run`, which mutates nothing and is itself one of the answers.
pub(crate) fn budget_dry_run_env_is_unhonoured(
    env_value: Option<&str>,
    has_disk_budget: bool,
) -> Option<String> {
    let requested = env_value.is_some_and(|v| v != "0");
    if !requested || !has_disk_budget {
        return None;
    }
    Some(
        "FORJAR_BUDGET_DRY_RUN is set, but this apply would reclaim disk anyway. \
         That variable belongs to the generated reaper and is read on the TARGET; \
         it survives neither `sudo` (env_reset) nor `ssh` (no SendEnv), so forjar \
         cannot honour it and will not pretend to. Two previews do work: \
         `forjar apply --dry-run` plans and executes nothing, and \
         `forjar codegen -r <id> --phase reaper > /tmp/reaper.sh && sh /tmp/reaper.sh` \
         runs the real reclaim logic in preview mode and deletes nothing. \
         Unset FORJAR_BUDGET_DRY_RUN to apply for real."
            .to_string(),
    )
}

/// Does the (already filtered and scoped) config still hold a `disk_budget`?
///
/// Honours the same selectors the executor does, so the gate cannot refuse an
/// apply that would not have touched a budget at all.
pub(crate) fn scope_holds_a_disk_budget(
    config: &crate::core::types::ForjarConfig,
    machine_filter: Option<&str>,
    resource_filter: Option<&str>,
    tag_filter: Option<&str>,
) -> bool {
    config.resources.iter().any(|(id, r)| {
        r.resource_type == crate::core::types::ResourceType::DiskBudget
            && resource_filter.is_none_or(|f| id == f)
            && tag_filter.is_none_or(|t| r.tags.iter().any(|x| x == t))
            && machine_filter.is_none_or(|m| r.machine.iter().any(|x| x == m))
    })
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::core::types::{MachineTarget, Resource, ResourceType};

    #[test]
    fn refuses_when_a_budget_is_in_scope() {
        let msg = budget_dry_run_env_is_unhonoured(Some("1"), true).expect("must refuse");
        assert!(
            msg.contains("forjar codegen"),
            "must name a real preview: {msg}"
        );
        assert!(msg.contains("--dry-run"));
        assert!(msg.contains("--phase reaper"));
    }

    #[test]
    fn zero_is_not_a_request() {
        assert!(budget_dry_run_env_is_unhonoured(Some("0"), true).is_none());
    }

    #[test]
    fn unset_is_not_a_request() {
        assert!(budget_dry_run_env_is_unhonoured(None, true).is_none());
    }

    #[test]
    fn does_not_block_an_apply_that_holds_no_budget() {
        assert!(budget_dry_run_env_is_unhonoured(Some("1"), false).is_none());
    }

    fn cfg(kinds: &[(&str, ResourceType)]) -> crate::core::types::ForjarConfig {
        let mut c = crate::core::types::ForjarConfig::default();
        for (id, t) in kinds {
            c.resources.insert(
                (*id).to_string(),
                Resource {
                    resource_type: t.clone(),
                    machine: MachineTarget::Single("intel".into()),
                    tags: vec!["disk".into()],
                    ..Default::default()
                },
            );
        }
        c
    }

    #[test]
    fn scope_sees_a_budget_only_when_the_filters_select_it() {
        let c = cfg(&[
            ("pkg", ResourceType::Package),
            ("budget", ResourceType::DiskBudget),
        ]);
        assert!(scope_holds_a_disk_budget(&c, None, None, None));
        assert!(scope_holds_a_disk_budget(&c, None, Some("budget"), None));
        assert!(!scope_holds_a_disk_budget(&c, None, Some("pkg"), None));
        assert!(scope_holds_a_disk_budget(&c, Some("intel"), None, None));
        assert!(!scope_holds_a_disk_budget(&c, Some("lambda"), None, None));
        assert!(scope_holds_a_disk_budget(&c, None, None, Some("disk")));
        assert!(!scope_holds_a_disk_budget(&c, None, None, Some("web")));
    }

    #[test]
    fn a_config_with_no_budget_is_never_in_scope() {
        let c = cfg(&[("pkg", ResourceType::Package)]);
        assert!(!scope_holds_a_disk_budget(&c, None, None, None));
    }
}