dofs: Commit through the mutated hardlink

Remember the lexical and effective paths that authorized a buffered mutation so final release does not depend on which hardlink alias closes last.

Author: aron-cf

packages/dofs/src/fs/mount-guard.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, it } from "vitest";
 
 import type { Database } from "../storage.js";
 import { stageBlob } from "../sync/blobs.js";
+import { link } from "./link.js";
 import { mkdir } from "./mkdir.js";
 import {
   assertNotReadOnly,
@@ -193,6 +194,24 @@ describe("writeFile under a read-only mount", () => {
     });
   });
 
+  it("commits writable hardlink mutations when a read-only alias closes last", async () => {
+    await withDB((db) => {
+      mkdir(db, "/mnt", {}, () => 0);
+      writeFileSync(db, "/outside.txt", new TextEncoder().encode("seed"), {}, () => 0);
+      link(db, "/outside.txt", "/mnt/file.txt");
+      stageMount(db, "/mnt", "read-only");
+
+      openWriteBufferSync(db, "/outside.txt");
+      openWriteBufferSync(db, "/mnt/file.txt");
+      writeRangeSync(db, "/outside.txt", new TextEncoder().encode("done"), 0, {}, () => 1);
+      releaseWriteBufferSync(db, "/outside.txt", () => 2);
+      expect(() => releaseWriteBufferSync(db, "/mnt/file.txt", () => 2)).not.toThrow();
+
+      expect(new TextDecoder().decode(readRangeSync(db, "/outside.txt", 0, 4))).toBe("done");
+      expect(new TextDecoder().decode(readRangeSync(db, "/mnt/file.txt", 0, 4))).toBe("done");
+    });
+  });
+
   it("evicts rejected dirty bytes before a later read-only open", async () => {
     await withDB((db) => {
       mkdir(db, "/mnt", {}, () => 0);

packages/dofs/src/fs/writeBuffer.ts

@@ -29,6 +29,11 @@ export interface WriteBufferEntry {
   // Mode the caller wants persisted on release. Defaults to the
   // inode's existing mode at open time when the caller has none.
   mode: number;
+  // Lexical and effective paths used by the most recent successful
+  // mutation. Dirty release validates these paths rather than whichever
+  // hardlink alias happens to close last.
+  dirtyPath?: string;
+  dirtyTargetPath?: string;
   // Pending-create state. When set, no inode row exists yet; release
   // will INSERT the node + dirent + chunks in one transaction. The
   // synthetic inode id used to key this entry in the cache is stored

packages/dofs/src/fs/writeFile.ts

@@ -154,7 +154,7 @@ interface ChunkRef {
 }
 
 type WriteTarget =
-  | { kind: "existing"; inode: number }
+  | { kind: "existing"; inode: number; canonicalPath: string }
   | { kind: "create"; parentInode: number; leafName: string; canonicalPath: string };
 
 interface DirectWriteTarget {
@@ -275,7 +275,11 @@ function resolveWriteTarget(
       );
     }
     if (node.type !== "symlink") {
-      return { kind: "existing", inode: direct.existingInode };
+      return {
+        kind: "existing",
+        inode: direct.existingInode,
+        canonicalPath: direct.canonicalPath,
+      };
     }
 
     countSymlinkFollow(follows, canonical);
@@ -603,7 +607,10 @@ function resolveFileInode(db: Database, path: string): { inode: number; mode: nu
   return { inode: node.inode, mode: node.mode };
 }
 
-function resolveWritableFileInode(db: Database, path: string): { inode: number; mode: number } {
+function resolveWritableFileInode(
+  db: Database,
+  path: string,
+): { inode: number; mode: number; canonicalPath: string } {
   const { parts, path: canonical } = canonicalizePath(path);
   if (parts.length === 0) {
     throw createWorkspaceError("EISDIR", "cannot write to the root directory", canonical);
@@ -616,7 +623,7 @@ function resolveWritableFileInode(db: Database, path: string): { inode: number;
   if (mode === undefined) {
     throw createWorkspaceError("ENOENT", `no such file: ${canonical}`, canonical);
   }
-  return { inode: target.inode, mode };
+  return { inode: target.inode, mode, canonicalPath: target.canonicalPath };
 }
 
 function directTargetForPath(db: Database, path: string): DirectWriteTarget {
@@ -820,7 +827,11 @@ export function releaseWriteBufferSync(db: Database, path: string, now: () => nu
   const buffered = entry.buf.subarray(0, entry.size);
 
   try {
-    resolveWritableFileInode(db, path);
+    if (entry.dirtyPath === undefined || entry.dirtyTargetPath === undefined) {
+      throw createWorkspaceError("EIO", `buffer has no writable path: ${canonical}`, canonical);
+    }
+    assertNotReadOnly(db, entry.dirtyPath);
+    assertNotReadOnly(db, entry.dirtyTargetPath);
     db.transactionSync(() => {
       if (entry.size === 0) {
         // An empty file owns no chunk rows; clear any old ones the
@@ -931,6 +942,7 @@ function commitPendingBuffer(db: Database, entry: WriteBufferEntry, now: () => n
     throw error;
   }
   promotePendingToInode(db, pendingInode, realInode);
+  entry.dirty = false;
   return realInode;
 }
 
@@ -1028,7 +1040,11 @@ export function writeRangeSync(
     return bytes.byteLength;
   }
 
-  const { inode, mode: existingMode } = resolveWritableFileInode(db, path);
+  const {
+    inode,
+    mode: existingMode,
+    canonicalPath: targetPath,
+  } = resolveWritableFileInode(db, path);
   const mode = (options.mode ?? existingMode) & 0o7777;
   const buffered = getWriteBuffer(db, inode);
 
@@ -1046,6 +1062,8 @@ export function writeRangeSync(
     if (writeEnd > buffered.size) buffered.size = writeEnd;
     buffered.mode = mode;
     buffered.dirty = true;
+    buffered.dirtyPath = canonical;
+    buffered.dirtyTargetPath = targetPath;
     return bytes.byteLength;
   }
 
@@ -1103,7 +1121,7 @@ export function truncateFileSync(
     return;
   }
 
-  const { inode, mode } = resolveWritableFileInode(db, path);
+  const { inode, mode, canonicalPath: targetPath } = resolveWritableFileInode(db, path);
   const buffered = getWriteBuffer(db, inode);
 
   if (buffered !== undefined) {
@@ -1114,6 +1132,8 @@ export function truncateFileSync(
     }
     buffered.size = size;
     buffered.dirty = true;
+    buffered.dirtyPath = canonical;
+    buffered.dirtyTargetPath = targetPath;
     return;
   }