Implement native RLV state and permissions (#79)

tools/check_milestone_10_issue_79.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Audit issue 79's native RLV state, inventory, lock, and permission boundary."""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+import generate_api_shims
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SOURCE = ROOT / "crates" / "libremetaverse-rlv" / "src" / "state.rs"
+GENERATED = ROOT / "crates" / "libremetaverse-rlv" / "src" / "generated.rs"
+TESTS = ROOT / "crates" / "libremetaverse-rlv" / "tests" / "state_semantics.rs"
+COMPAT = ROOT / "tests" / "compat" / "tests" / "rlv_inventory_map_semantics.rs"
+DOC = ROOT / "crates" / "libremetaverse-rlv" / "README.md"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+CATALOG = ROOT / "api" / "public-api.json"
+STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
+
+TYPES = {
+    "T:LibreMetaverse.RLV.CameraRestrictions": "crate::state::CameraRestrictions",
+    "T:LibreMetaverse.RLV.CameraSettings": "crate::state::CameraSettings",
+    "T:LibreMetaverse.RLV.EventArguments.RestrictionUpdatedEventArgs":
+        "crate::state::RestrictionUpdatedEventArgs",
+    "T:LibreMetaverse.RLV.InventoryMap": "crate::state::InventoryMap",
+    "T:LibreMetaverse.RLV.LockedFolderPublic": "crate::state::LockedFolderPublic",
+    "T:LibreMetaverse.RLV.RlvBlacklist": "crate::state::RlvBlacklist",
+    "T:LibreMetaverse.RLV.RlvInventoryItem": "crate::state::RlvInventoryItem",
+    "T:LibreMetaverse.RLV.RlvPermissionsService": "crate::state::RlvPermissionsService",
+    "T:LibreMetaverse.RLV.RlvRestrictionManager": "crate::state::RlvRestrictionManager",
+    "T:LibreMetaverse.RLV.RlvSharedFolder": "crate::state::RlvSharedFolder",
+}
+
+
+def require_markers(path: Path, markers: tuple[str, ...]) -> None:
+    text = path.read_text()
+    missing = [marker for marker in markers if marker not in text]
+    if missing:
+        raise SystemExit(f"{path.name}: audit evidence missing: " + ", ".join(missing))
+
+
+def catalog_members() -> set[str]:
+    catalog = json.loads(CATALOG.read_text())
+    assembly = next(
+        value for value in catalog["assemblies"]
+        if value["identity"]["name"] == "LibreMetaverse.RLV"
+    )
+    return {
+        member["doc_id"]
+        for api_type in assembly["types"]
+        if api_type["doc_id"] in TYPES
+        for member in api_type["members"]
+    }
+
+
+def generated_type_block(text: str, doc_id: str) -> str:
+    marker = f"/// C# type: `{doc_id}`."
+    start = text.find(marker)
+    if start < 0:
+        raise SystemExit(f"generated declaration is missing for {doc_id}")
+    next_type = text.find("/// C# type:", start + len(marker))
+    return text[start:] if next_type < 0 else text[start:next_type]
+
+
+def main() -> None:
+    for api_type, declaration in TYPES.items():
+        if generate_api_shims.NATIVE_DECLARATIONS.get(api_type) != declaration:
+            raise SystemExit(f"issue 79 native declaration is missing for {api_type}")
+    members = catalog_members()
+    missing = sorted(members - set(generate_api_shims.NATIVE_MEMBER_BODIES))
+    if missing:
+        raise SystemExit("issue 79 native members missing: " + ", ".join(missing))
+
+    source = SOURCE.read_text()
+    if STUB_RE.search(source):
+        raise SystemExit("issue 79 owned Rust stubs remain in state.rs")
+    generated = GENERATED.read_text()
+    for api_type in TYPES:
+        if STUB_RE.search(generated_type_block(generated, api_type)):
+            raise SystemExit(f"issue 79 owned generated stubs remain for {api_type}")
+
+    require_markers(SOURCE, (
+        "MAX_RLV_INVENTORY_FOLDERS", "MAX_RLV_INVENTORY_ITEMS",
+        "MAX_RLV_RESTRICTIONS", "pub struct InventoryMap",
+        "pub struct RlvRestrictionManager", "pub struct RlvPermissionsService",
+        "pub struct CameraRestrictions", "pub struct LockedFolderPublic",
+        "pub struct RlvBlacklist", "fn build_locked_folders",
+        "fn secure_allowed", "fn rebuild_locked_folders", "fn emit",
+        "state.revision", "Arc<RwLock", "ImmutableDictionary", "CancellationToken",
+    ))
+    require_markers(TESTS, (
+        "dispatches_after_unlocking", "concurrent_independent_sources",
+        "stale_revision", "counts_repeated_inputs_before_deduplication",
+        "blacklist_is_case_insensitive", "camera_restrictions_apply",
+        "constructor_field_order", "secure_rules_take_precedence",
+        "recursive_folder_locks", "snapshots remain immutable",
+    ))
+    require_markers(COMPAT, (
+        "try_get_folder_when_name_contains_slash",
+        "try_get_folder_prefers_exact_slash_match",
+        "try_get_folder_skips_hidden_folder",
+        "find_folders_containing_by_prim_id",
+        "find_folders_containing_by_attachment_point_single_result",
+        "find_folders_containing_by_wearable_type",
+    ))
+    require_markers(DOC, (
+        "pure state boundary", "immutable dictionary/list membership snapshots",
+        "after manager locks are released", "secure and explicit", "no network",
+        "ubuntu-latest",
+    ))
+    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_79.py",))
+    print(
+        "issue 79 audit: native restriction state, inventory maps, recursive locks, "
+        "camera aggregation, blacklist, permission precedence, concurrency evidence, "
+        "compatibility tests, and docs are present"
+    )
+
+
+if __name__ == "__main__":
+    main()