dofs: Allow writes beside nested mounts

Use descendant-only checks while following symlink targets so an ancestor directory may contain a read-only mount without making writable siblings read-only.

Author: aron-cf

packages/dofs/src/fs/mount-guard.test.ts

@@ -340,6 +340,18 @@ describe("writeFile under a read-only mount", () => {
     });
   });
 
+  it("allows writes through a symlink to a directory that contains a read-only mount", async () => {
+    await withDB((db) => {
+      mkdir(db, "/workspace/scratch", { recursive: true }, () => 0);
+      symlink(db, "/workspace", "/link", () => 0);
+      stageMount(db, "/workspace/r2", "read-only");
+
+      writeFileSync(db, "/link/scratch/file.txt", new Uint8Array([1]), {}, () => 0);
+
+      expect(resolveInode(db, "/workspace/scratch/file.txt")?.type).toBe("file");
+    });
+  });
+
   it("allows writes under a read-write mount", async () => {
     await withDB(async (db) => {
       mkdir(db, "/workspace/rw", { recursive: true }, () => 0);

packages/dofs/src/fs/mount-guard.ts

@@ -51,8 +51,12 @@ export function getReadOnlyMountRoots(db: Database): readonly string[] {
 // Both shapes must be blocked so a read-only mount survives both
 // vectors. Mirrors the predicate that lived in
 // GuardedWorkspaceFilesystem before the data-layer move.
+function isAtOrBelowRoot(path: string, root: string): boolean {
+  return path === root || path.startsWith(`${root}/`);
+}
+
 function overlapsRoot(path: string, root: string): boolean {
-  return path === root || path.startsWith(`${root}/`) || root.startsWith(`${path}/`);
+  return isAtOrBelowRoot(path, root) || root.startsWith(`${path}/`);
 }
 
 // Throws EROFS when the path overlaps any read-only mount root.
@@ -69,6 +73,18 @@ export function assertNotReadOnly(db: Database, path: string): void {
   }
 }
 
+// Point writes only need to reject paths at or below a read-only root.
+// Unlike recursive removal, walking through an ancestor of a mount does
+// not modify the protected subtree.
+export function assertNotInReadOnlyMount(db: Database, path: string): void {
+  const roots = getReadOnlyMountRoots(db);
+  for (const root of roots) {
+    if (isAtOrBelowRoot(path, root)) {
+      throw createWorkspaceError("EROFS", `read-only mount at ${root}: cannot modify`, path);
+    }
+  }
+}
+
 // Variant for callers that already know the path is canonicalised
 // and want to reject a single descendant during a recursive walk
 // (rm's walkPostOrder). Returns the matching root or undefined; the

packages/dofs/src/fs/writeFile.ts

@@ -8,7 +8,7 @@ import { stageBlob } from "../sync/blobs.js";
 import { buildManifest } from "../sync/manifests.js";
 import { pathOf } from "../sync/paths.js";
 import { getBlobBytes } from "./blobCache.js";
-import { assertNotReadOnly } from "./mount-guard.js";
+import { assertNotInReadOnlyMount, assertNotReadOnly } from "./mount-guard.js";
 import { invalidateResolveExact } from "./resolveCache.js";
 import {
   allocatePendingInode,
@@ -92,7 +92,7 @@ function resolveParent(
       countSymlinkFollow(follows, canonical);
       const target = node.link_target ?? "";
       const targetParts = symlinkTargetParts(target, realParts);
-      assertNotReadOnly(db, clampedPathFromParts(targetParts));
+      assertNotInReadOnlyMount(db, clampedPathFromParts(targetParts));
       if (target.startsWith("/")) {
         inodeStack.splice(1);
         realParts.splice(0);
@@ -275,7 +275,7 @@ function resolveWriteTarget(
     const realLinkParts = canonicalizePath(direct.canonicalPath).parts;
     targetParts = symlinkTargetParts(node.link_target ?? "", realLinkParts.slice(0, -1));
     targetCanonical = clampedPathFromParts(targetParts);
-    assertNotReadOnly(db, targetCanonical);
+    assertNotInReadOnlyMount(db, targetCanonical);
     const finalPart = targetParts.at(-1);
     if (finalPart === undefined || finalPart === "" || finalPart === "." || finalPart === "..") {
       resolveParent(db, [...targetParts, "__write_target__"], targetCanonical, follows);