gunnar-store 1.5.0

//! **`gunnar_store::object` against `gix-object`, over the same bytes.**
//!
//! `src/object.rs` exists so that the appliance does not link seven crates to
//! read four grammars. That is only worth having if it reads them *the same
//! way*, and a decoder checked against fixtures the same author wrote is a
//! decoder checked against its own opinion (one implementation, no twin).
//!
//! So `gix-object` stays — as a **dev-dependency**, an implementation with no
//! stake in gunnar's answer. Every case below decodes with both and compares
//! the fields gunnar actually reads. The three tests at the end are the ones
//! that matter most: they are the shapes that are easy to get wrong, and each
//! one was written *before* the code that passes it.

use gunnar_store::gix_hash::{Kind as HashKind, ObjectId};
use gunnar_store::object::{self, EntryKind, Kind};

const SHA1: HashKind = HashKind::Sha1;

fn oid(byte: u8) -> ObjectId {
    ObjectId::from_bytes_or_panic(&[byte; 20])
}

fn hex(id: &ObjectId) -> String {
    id.to_string()
}

// ───────────────────────────────────────────────────────────────────────────
// Fixtures
// ───────────────────────────────────────────────────────────────────────────

fn commit_bytes(parents: &[ObjectId], extra_headers: &str, message: &str) -> Vec<u8> {
    let mut s = format!("tree {}\n", hex(&oid(0x11)));
    for p in parents {
        s.push_str(&format!("parent {}\n", hex(p)));
    }
    s.push_str("author A U Thor <author@example.com> 1700000000 +0200\n");
    s.push_str("committer C O Mitter <committer@example.com> 1723200000 -0730\n");
    s.push_str(extra_headers);
    s.push('\n');
    s.push_str(message);
    s.into_bytes()
}

fn tree_bytes(entries: &[(&str, &str, ObjectId)]) -> Vec<u8> {
    let mut out = Vec::new();
    for (mode, name, id) in entries {
        out.extend_from_slice(mode.as_bytes());
        out.push(b' ');
        out.extend_from_slice(name.as_bytes());
        out.push(0);
        out.extend_from_slice(id.as_bytes());
    }
    out
}

fn tag_bytes(target: &ObjectId, ty: &str) -> Vec<u8> {
    format!(
        "object {}\ntype {ty}\ntag v1.0\ntagger T Agger <tag@example.com> 1700000000 +0000\n\nrelease\n",
        hex(target)
    )
    .into_bytes()
}

// ───────────────────────────────────────────────────────────────────────────
// Commits
// ───────────────────────────────────────────────────────────────────────────

/// Every parent count the walk can meet: root, linear, merge, octopus.
#[test]
fn commit_links_agree_with_gix_for_every_parent_count() {
    for n in [0usize, 1, 2, 7] {
        let parents: Vec<ObjectId> = (0..n).map(|i| oid(0x20 + i as u8)).collect();
        let bytes = commit_bytes(&parents, "", "a message\n");

        let mut mine = Vec::new();
        let tree = object::commit_links(&bytes, SHA1, &mut mine).expect("gunnar decodes");

        let mut iter = gix_object::CommitRefIter::from_bytes(&bytes, SHA1);
        let gix_tree = iter.tree_id().expect("gix decodes");
        let gix_parents: Vec<ObjectId> = gix_object::CommitRefIter::from_bytes(&bytes, SHA1)
            .parent_ids()
            .collect();

        assert_eq!(tree, gix_tree, "{n} parents: tree");
        assert_eq!(mine, gix_parents, "{n} parents: parents");
        assert_eq!(mine, parents, "{n} parents: and the fixture agrees too");
    }
}

/// The committer timestamp, including a **half-hour** zone.
///
/// `-0730` is the case a base-100 reading of the offset gets wrong, and the
/// only reason `seconds` is unaffected by it is that git writes the epoch and
/// the zone as separate fields. Both are checked.
#[test]
fn commit_facts_agree_with_gix_on_the_committer_time() {
    let bytes = commit_bytes(&[oid(0x33)], "", "msg\n");

    let mut mine = Vec::new();
    let (tree, when) = object::commit_facts(&bytes, SHA1, &mut mine).expect("gunnar decodes");

    let gix = gix_object::CommitRef::from_bytes(&bytes, SHA1).expect("gix decodes");
    let gix_committer = gix.committer().expect("gix decodes the committer");

    assert_eq!(tree, gix.tree(), "tree");
    assert_eq!(
        when,
        gix_committer.time().unwrap().seconds,
        "committer seconds"
    );
    assert_eq!(when, 1723200000);

    let full = object::commit(&bytes, SHA1).expect("gunnar decodes the whole commit");
    assert_eq!(
        full.committer.offset_seconds,
        gix_committer.time().unwrap().offset,
        "-0730 is minus seven and a half hours, not minus 730 minutes"
    );
    assert_eq!(full.committer.offset_seconds, -(7 * 3600 + 30 * 60));
}

/// A `gpgsig` header folds over many lines, each continuation beginning with a
/// space. A scanner that does not understand folding must still not mistake a
/// continuation for a header — and must not stop reading at one.
#[test]
fn a_folded_gpgsig_header_does_not_derail_the_scan() {
    let gpgsig = "gpgsig -----BEGIN PGP SIGNATURE-----\n \n iHUEABYKAB0WIQ\n parent deadbeef\n -----END PGP SIGNATURE-----\n";
    let parents = [oid(0x41), oid(0x42)];
    let bytes = commit_bytes(&parents, gpgsig, "signed\n");

    let mut mine = Vec::new();
    let tree = object::commit_links(&bytes, SHA1, &mut mine).unwrap();
    let gix_parents: Vec<ObjectId> = gix_object::CommitRefIter::from_bytes(&bytes, SHA1)
        .parent_ids()
        .collect();

    assert_eq!(mine, gix_parents);
    assert_eq!(
        mine, parents,
        "the ` parent deadbeef` line inside the signature is not a parent"
    );

    let (facts_tree, when) = object::commit_facts(&bytes, SHA1, &mut mine).unwrap();
    assert_eq!(facts_tree, tree);
    assert_eq!(
        when, 1723200000,
        "the committer is still found past the fold"
    );

    let full = object::commit(&bytes, SHA1).unwrap();
    let gix = gix_object::CommitRef::from_bytes(&bytes, SHA1).unwrap();
    assert_eq!(full.parents, parents.to_vec());
    assert_eq!(full.message, b"signed\n");
    // The control plane's `ListCommits` publishes this string, and the fold is
    // exactly where a naive "everything after the first blank line" split gets
    // it wrong — the signature's own blank continuation line comes first.
    assert_eq!(full.message, gix.message.to_vec(), "message");
    assert_eq!(full.tree, gix.tree(), "tree");
}

/// A name containing angle brackets: the split is on the **last** `>`.
#[test]
fn a_name_with_angle_brackets_splits_where_gix_splits_it() {
    let mut s = format!("tree {}\n", hex(&oid(0x11)));
    s.push_str("author A <weird> Thor <author@example.com> 1700000000 +0200\n");
    s.push_str("committer A <weird> Thor <author@example.com> 1700000000 +0200\n");
    s.push_str("\nmsg\n");
    let bytes = s.into_bytes();

    let mine = object::commit(&bytes, SHA1).unwrap();
    let gix = gix_object::CommitRef::from_bytes(&bytes, SHA1).unwrap();
    let gix_author = gix.author().unwrap();

    assert_eq!(mine.author.name, gix_author.name.to_vec(), "name");
    assert_eq!(mine.author.email, gix_author.email.to_vec(), "email");
    assert_eq!(mine.author.seconds, gix_author.time().unwrap().seconds);
}

/// **A recorded divergence, found by this test and not by inspection.**
///
/// A commit with no message has no blank line to end its headers. `gix-object`
/// **rejects** it; gunnar reads it and calls the message empty. The first draft
/// of this test asserted that both accept it, and gix's `Err` is what said
/// otherwise.
///
/// gunnar keeps the lenient reading deliberately. This module never *writes*
/// an object, so nothing downstream can inherit a malformation from it, and on
/// the serve path the bytes go into the pack verbatim regardless of what the
/// decoder thought. Refusing here would turn one odd object in a repository's
/// history into a failed clone of the whole repository, which is the trade the
/// tolerance is made against.
#[test]
fn a_headers_only_commit_is_where_gunnar_is_deliberately_more_tolerant_than_gix() {
    let mut s = format!("tree {}\n", hex(&oid(0x11)));
    s.push_str("author A <a@e> 1 +0000\ncommitter C <c@e> 2 +0000\n");
    let bytes = s.into_bytes();

    let mine = object::commit(&bytes, SHA1).expect("gunnar reads it");
    assert_eq!(mine.tree, oid(0x11));
    assert!(mine.message.is_empty());

    assert!(
        gix_object::CommitRef::from_bytes(&bytes, SHA1).is_err(),
        "gix refuses a commit with no blank line; if this ever starts passing, \
         the divergence documented in src/object.rs is stale"
    );

    // The two traversal readers agree with the full one.
    let mut parents = Vec::new();
    assert_eq!(
        object::commit_links(&bytes, SHA1, &mut parents).unwrap(),
        oid(0x11)
    );
    assert_eq!(
        object::commit_facts(&bytes, SHA1, &mut parents).unwrap(),
        (oid(0x11), 2)
    );
}

/// A commit whose committer line has no time is worth an ordering, not a
/// clone. This is the one documented divergence from a strict reader, and it
/// is the behaviour the call sites already had via `.unwrap_or_default()`.
#[test]
fn an_unreadable_committer_time_is_zero_and_not_an_error() {
    let mut s = format!("tree {}\n", hex(&oid(0x11)));
    s.push_str("parent ");
    s.push_str(&hex(&oid(0x55)));
    s.push_str("\ncommitter C O Mitter <c@e>\n\nmsg\n");
    let bytes = s.into_bytes();

    let mut parents = Vec::new();
    let (tree, when) = object::commit_facts(&bytes, SHA1, &mut parents).unwrap();
    assert_eq!(tree, oid(0x11));
    assert_eq!(parents, vec![oid(0x55)]);
    assert_eq!(when, 0);
}

#[test]
fn a_commit_with_no_tree_is_an_error_in_all_three_readers() {
    let bytes = b"parent 1111111111111111111111111111111111111111\n\nmsg\n";
    let mut parents = Vec::new();
    assert!(object::commit_links(bytes, SHA1, &mut parents).is_err());
    assert!(object::commit_facts(bytes, SHA1, &mut parents).is_err());
    assert!(object::commit(bytes, SHA1).is_err());
    assert!(gix_object::CommitRef::from_bytes(bytes, SHA1).is_err());
}

#[test]
fn a_short_oid_in_a_header_is_an_error() {
    let bytes = b"tree 1111\n\nmsg\n";
    let mut parents = Vec::new();
    assert!(object::commit_links(bytes, SHA1, &mut parents).is_err());
}

/// `parents` belongs to the caller and is refilled, not appended to.
#[test]
fn the_parent_buffer_is_cleared_between_commits() {
    let mut parents = vec![oid(0xEE); 4];
    let bytes = commit_bytes(&[oid(0x60)], "", "m\n");
    object::commit_links(&bytes, SHA1, &mut parents).unwrap();
    assert_eq!(parents, vec![oid(0x60)]);
}

// ───────────────────────────────────────────────────────────────────────────
// Trees
// ───────────────────────────────────────────────────────────────────────────

/// Every mode git writes, plus the two spellings of a tree mode.
#[test]
fn tree_entries_agree_with_gix_on_oid_and_kind() {
    let entries = [
        ("100644", "readme", oid(0x01)),
        ("100755", "run.sh", oid(0x02)),
        ("120000", "link", oid(0x03)),
        ("40000", "dir", oid(0x04)),
        ("040000", "dir2", oid(0x05)),
        ("160000", "submodule", oid(0x06)),
    ];
    let bytes = tree_bytes(&entries);

    let mine: Vec<_> = object::TreeIter::from_bytes(&bytes, SHA1)
        .collect::<Result<Vec<_>, _>>()
        .expect("gunnar decodes");
    let gix: Vec<_> = gix_object::TreeRefIter::from_bytes(&bytes, SHA1)
        .collect::<Result<Vec<_>, _>>()
        .expect("gix decodes");

    assert_eq!(mine.len(), gix.len());
    assert_eq!(mine.len(), entries.len());
    for (m, g) in mine.iter().zip(gix.iter()) {
        assert_eq!(m.oid, g.oid.to_owned(), "oid");
        let same_kind = match g.mode.kind() {
            gix_object::tree::EntryKind::Tree => m.kind == EntryKind::Tree,
            gix_object::tree::EntryKind::Blob => m.kind == EntryKind::Blob,
            gix_object::tree::EntryKind::BlobExecutable => m.kind == EntryKind::BlobExecutable,
            gix_object::tree::EntryKind::Link => m.kind == EntryKind::Link,
            gix_object::tree::EntryKind::Commit => m.kind == EntryKind::Commit,
        };
        assert!(
            same_kind,
            "kind: gunnar {:?} vs gix {:?}",
            m.kind,
            g.mode.kind()
        );
    }

    // The distinction the closure walk actually turns on.
    assert_eq!(mine[3].kind, EntryKind::Tree, "`40000` is a tree");
    assert_eq!(mine[4].kind, EntryKind::Tree, "`040000` is the same tree");
    assert_eq!(
        mine[5].kind,
        EntryKind::Commit,
        "a gitlink is not ours to send"
    );
}

#[test]
fn an_empty_tree_yields_no_entries() {
    assert_eq!(object::TreeIter::from_bytes(&[], SHA1).count(), 0);
}

/// A truncated oid must be an error, not a short read that looks fine.
#[test]
fn a_tree_whose_last_oid_is_truncated_is_an_error() {
    let mut bytes = tree_bytes(&[("100644", "a", oid(0x01))]);
    bytes.truncate(bytes.len() - 3);
    let got: Result<Vec<_>, _> = object::TreeIter::from_bytes(&bytes, SHA1).collect();
    assert!(got.is_err());
    assert!(gix_object::TreeRefIter::from_bytes(&bytes, SHA1)
        .collect::<Result<Vec<_>, _>>()
        .is_err());
}

/// After an error the iterator stops. Resynchronising in a corrupt buffer
/// produces entries that look well-formed and are not.
#[test]
fn a_failed_tree_iterator_does_not_keep_yielding() {
    let mut bytes = tree_bytes(&[("100644", "a", oid(0x01))]);
    bytes.extend_from_slice(b"99xx bad\0short");
    let mut it = object::TreeIter::from_bytes(&bytes, SHA1);
    assert!(it.next().unwrap().is_ok());
    assert!(it.next().unwrap().is_err());
    assert!(it.next().is_none());
}

// ───────────────────────────────────────────────────────────────────────────
// Tags
// ───────────────────────────────────────────────────────────────────────────

#[test]
fn tag_targets_agree_with_gix() {
    for ty in ["commit", "tree", "blob", "tag"] {
        let target = oid(0x77);
        let bytes = tag_bytes(&target, ty);

        let mine = object::tag(&bytes, SHA1).expect("gunnar decodes");
        let gix = gix_object::TagRef::from_bytes(&bytes, SHA1).expect("gix decodes");

        assert_eq!(mine.target, gix.target(), "{ty}: target");
        assert_eq!(mine.target, target);
        assert_eq!(
            mine.target_kind,
            Kind::from_bytes(ty.as_bytes()),
            "{ty}: type"
        );
        assert_eq!(object::tag_target(&bytes, SHA1).unwrap(), gix.target());
    }
}

#[test]
fn a_tag_with_no_object_header_is_an_error() {
    let bytes = b"type commit\ntag v1\n\nmsg\n";
    assert!(object::tag(bytes, SHA1).is_err());
}

// ───────────────────────────────────────────────────────────────────────────
// The kind mapping
// ───────────────────────────────────────────────────────────────────────────

/// The contract's two delta codes cannot come out of a resolved read, and this
/// is the one place that is enforced.
#[test]
fn the_delta_codes_do_not_resolve_to_a_kind() {
    use gunnar_store::git_storage_trait::ObjType;
    assert_eq!(Kind::resolved(ObjType::Commit), Some(Kind::Commit));
    assert_eq!(Kind::resolved(ObjType::Tree), Some(Kind::Tree));
    assert_eq!(Kind::resolved(ObjType::Blob), Some(Kind::Blob));
    assert_eq!(Kind::resolved(ObjType::Tag), Some(Kind::Tag));
    assert_eq!(Kind::resolved(ObjType::OfsDelta), None);
    assert_eq!(Kind::resolved(ObjType::RefDelta), None);
}

/// The four names are git's, and they are what error messages print.
#[test]
fn the_kind_names_are_gits_own() {
    for (mine, gix) in [
        (Kind::Commit, gix_object::Kind::Commit),
        (Kind::Tree, gix_object::Kind::Tree),
        (Kind::Blob, gix_object::Kind::Blob),
        (Kind::Tag, gix_object::Kind::Tag),
    ] {
        assert_eq!(mine.to_string(), gix.to_string());
        assert_eq!(Kind::from_bytes(mine.as_str().as_bytes()), Some(mine));
    }
}

/// ★ The named lookup finds exactly the asked-for entry, byte-compared.
///
/// `TreeIter` drops names on purpose (its callers walk edges); the log's path
/// filter is the caller that cannot, and this is its primitive. The absent arm
/// is the identity-value guard: a lookup that returned the first entry for any
/// name would pass the present arms alone.
#[test]
fn a_named_lookup_finds_its_entry_and_only_its_entry() {
    let entries = [
        ("100644", "readme", oid(0x01)),
        ("40000", "src", oid(0x02)),
        ("100644", "readme2", oid(0x03)),
    ];
    let bytes = tree_bytes(&entries);

    let readme = object::tree_entry_named(&bytes, SHA1, b"readme")
        .expect("decodes")
        .expect("present");
    assert_eq!(readme.oid, oid(0x01));
    assert_eq!(readme.kind, EntryKind::Blob);

    let src = object::tree_entry_named(&bytes, SHA1, b"src")
        .expect("decodes")
        .expect("present");
    assert_eq!(src.oid, oid(0x02));
    assert_eq!(src.kind, EntryKind::Tree);

    // A PREFIX of a real name is not the name.
    assert!(object::tree_entry_named(&bytes, SHA1, b"read")
        .expect("decodes")
        .is_none());
    assert!(object::tree_entry_named(&bytes, SHA1, b"absent")
        .expect("decodes")
        .is_none());

    // The corruption rule is the iterator's: a torn tree is an error even when
    // the tear sits after the entry being asked for was already parsed... and
    // BEFORE it too — never a resynchronised guess.
    let mut torn = tree_bytes(&entries);
    torn.truncate(torn.len() - 3);
    assert!(object::tree_entry_named(&torn, SHA1, b"absent").is_err());
}