openlatch-client 0.5.8

//! The machine hostname, as an identity signal (I-4 D-04).
//!
//! Moved here from `cli/commands/auth.rs`, where it existed to label a
//! generated API key, and memoised: the hostname cannot change inside a
//! daemon's lifetime, and this is now read on the event path rather than once
//! during an interactive login.
//!
//! # Resolution
//!
//! | Platform | Source |
//! |---|---|
//! | Unix | `gethostname(2)` |
//! | Windows | `%COMPUTERNAME%` |
//!
//! `COMPUTERNAME` is set by the system for **every** process, services
//! included — not only for interactive sessions, which is what the original
//! doc comment vouched for. It is the system-wide NetBIOS name, and it is what
//! the daemon reads.
//!
//! # Omitted, never truncated
//!
//! A name longer than 253 characters (the DNS limit) resolves to `None`. The
//! attribute is declared in the wire schema as a plain string with no
//! `maxLength`, so this resolver is what guarantees the shape — and a truncated
//! hostname is a *different host* to anyone reading it, which is worse than an
//! absent one.
//!
//! Unlike `hostid`, this is an **identity signal**: it is stamped only on Live
//! envelopes and only while the resident bundle carries
//! `capture_identity_signals: true`, exactly like `osuser` / `gitemail` /
//! `provideracct`.

use std::sync::OnceLock;

/// Test seam, honoured first on every platform. An empty value means unset.
const TEST_SEAM_ENV: &str = "OPENLATCH_TEST_HOSTNAME";

/// The DNS name limit. A hostname past it is omitted rather than truncated.
const MAX_HOSTNAME_LEN: usize = 253;

/// Resolved once per process.
static HOSTNAME: OnceLock<Option<String>> = OnceLock::new();

/// The machine hostname, or `None` when this host has no usable answer.
pub fn hostname() -> Option<String> {
    HOSTNAME.get_or_init(resolve).clone()
}

/// The uncached ladder. Separate from [`hostname`] so the tests can exercise
/// every case — one call to the memoised wrapper would freeze the first answer
/// for the whole test binary.
fn resolve() -> Option<String> {
    // `.ok().filter(..)`: an empty value is unset, as everywhere else in this
    // module tree.
    std::env::var(TEST_SEAM_ENV)
        .ok()
        .filter(|v| !v.is_empty())
        .or_else(system_hostname)
        .filter(|name| name.len() <= MAX_HOSTNAME_LEN)
}

/// Best-effort system hostname.
///
/// Returns `None` on any failure — every caller treats a missing hostname as a
/// missing attribute, and there is no error here a user could act on.
///
/// - Unix: `libc::gethostname` syscall, NUL-terminated into a 256-byte buffer
/// - Windows: `COMPUTERNAME`, which the system sets for every process
pub fn system_hostname() -> Option<String> {
    #[cfg(unix)]
    {
        use std::ffi::CStr;
        // HOST_NAME_MAX is 64 on Linux and 255 on macOS; 256 bytes covers both
        // plus the NUL terminator.
        let mut buf = [0u8; 256];
        // SAFETY: buf is 256 writable bytes; libc::gethostname writes a
        // NUL-terminated C string on success (ret == 0).
        let ret = unsafe { libc::gethostname(buf.as_mut_ptr() as *mut libc::c_char, buf.len()) };
        if ret != 0 {
            return None;
        }
        // No second unsafe block: POSIX leaves it UNSPECIFIED whether the
        // returned name is null-terminated when it had to be truncated, so
        // `CStr::from_ptr` could read past `buf`. glibc returns ENAMETOOLONG
        // (caught above) and musl terminates, so that was latent rather than
        // live — but the guarantee the old SAFETY comment asserted does not
        // exist. `from_bytes_until_nul` is bounded by the slice and simply
        // returns `Err` in exactly the unterminated case.
        let s = CStr::from_bytes_until_nul(&buf).ok()?.to_str().ok()?.trim();
        if s.is_empty() {
            None
        } else {
            Some(s.to_string())
        }
    }
    #[cfg(windows)]
    {
        let s = std::env::var("COMPUTERNAME").ok()?;
        let trimmed = s.trim();
        if trimmed.is_empty() {
            None
        } else {
            Some(trimmed.to_string())
        }
    }
    #[cfg(not(any(unix, windows)))]
    {
        None
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::daemon::identity::test_support::EnvGuard;
    use crate::daemon::identity::ENV_LOCK;

    /// Everything the resolver contracts for, through the uncached [`resolve`]
    /// under the shared environment lock.
    #[test]
    fn seam_is_honoured_and_an_over_long_name_is_omitted() {
        let _lock = ENV_LOCK.blocking_lock();
        let env = EnvGuard::clear();

        env.set(TEST_SEAM_ENV, "devbox-01");
        assert_eq!(resolve().as_deref(), Some("devbox-01"));

        // Empty is unset: the ladder falls through to the real hostname, which
        // on any runner is a non-empty name — and never the empty string.
        env.set(TEST_SEAM_ENV, "");
        assert_ne!(resolve().as_deref(), Some(""));
        assert_eq!(resolve(), system_hostname());
        env.unset(TEST_SEAM_ENV);

        // This is what replaces the `maxLength` the schema deliberately does
        // not carry (D-05): the boundary is exact, and past it the attribute is
        // OMITTED, never truncated.
        let at_limit = "a".repeat(MAX_HOSTNAME_LEN);
        env.set(TEST_SEAM_ENV, &at_limit);
        assert_eq!(resolve().as_deref(), Some(at_limit.as_str()));

        let past_limit = "a".repeat(MAX_HOSTNAME_LEN + 1);
        env.set(TEST_SEAM_ENV, &past_limit);
        assert_eq!(resolve(), None);
    }

    #[test]
    fn the_real_hostname_is_a_name_or_nothing() {
        let _lock = ENV_LOCK.blocking_lock();
        let _env = EnvGuard::clear();

        // The old form was `is_none_or(|s| !s.is_empty())`, which `None`
        // satisfies — so it asserted nothing about the resolver it is named
        // for, and replacing the whole body with `None` kept it green. What the
        // right assertion is depends on where the name comes from, so the two
        // platforms are asserted separately rather than behind one weak
        // predicate.

        // Unix reads `gethostname`, a syscall no environment variable can
        // clear, so a real host must answer with a real name.
        #[cfg(unix)]
        assert!(
            matches!(system_hostname().as_deref(), Some(s) if !s.is_empty()),
            "a real host resolves to a real name, never None or an empty string"
        );

        // Windows reads `COMPUTERNAME`, which `EnvGuard::clear` has just
        // removed — so `None` is the correct answer here, and asserting it is
        // what proves the resolver actually consults that variable rather than
        // finding the name some other way.
        #[cfg(windows)]
        assert_eq!(
            system_hostname(),
            None,
            "with COMPUTERNAME cleared there is no name to find"
        );
    }
}