8cfcdb8e5f
Phase G0 Day 2 ships storaged: aws-sdk-go-v2 wrapper + chi routes
binding 127.0.0.1:3211 with 256 MiB MaxBytesReader, Content-Length
up-front 413, and a 4-slot non-blocking semaphore returning 503 +
Retry-After:5 when full. Acceptance smoke (6/6 probes) PASSES against
the dedicated MinIO bucket lakehouse-go-primary, isolated from the
Rust system's lakehouse bucket during coexistence.
Cross-lineage scrum on the shipped code:
- Opus 4.7 (opencode): 1 BLOCK + 3 WARN + 3 INFO
- Qwen3-coder (openrouter): 2 BLOCK + 1 WARN + 1 INFO (3 false positives)
- Kimi K2-0905 (openrouter, after route-shopping past opencode's 4k
cap and the direct adapter's empty-content reasoning bug):
1 BLOCK + 2 WARN + 1 INFO
Fixed:
C1 buildRegistry ctx cancel footgun → context.Background()
(Opus + Kimi convergent; future credential refresh chains)
C2 MaxBytesReader unwrap through manager.Uploader multipart
goroutines → Content-Length up-front 413 + string-suffix fallback
(Opus + Kimi convergent; latent 500-instead-of-413 in 5-256 MiB range)
C3 Bucket.List unbounded accumulation → MaxListResults=10_000 cap
(Opus + Kimi convergent; OOM guard)
S1 PUT response Content-Type: application/json (Opus single-reviewer)
Strict validateKey policy (J approved): rejects empty, >1024B, NUL,
leading "/", ".." path components, CR/LF/tab control characters.
DELETE exposed at HTTP layer (J approved option A) for symmetry +
smoke ergonomics.
Build clean, vet clean, all unit tests pass, smoke 6/6 PASS after
every fix round. go.mod 1.23 → 1.24 (required by aws-sdk-go-v2).
Process finding worth recording: opencode caps non-streaming Kimi at
max_tokens=4096; the direct kimi.com adapter consumed 8192 tokens of
reasoning but surfaced empty content; openrouter/moonshotai/kimi-k2-0905
delivered structured output in ~33s. Future Kimi scrums should default
to that route.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package main
|
|
|
|
import "testing"
|
|
|
|
func TestValidateKey(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
key string
|
|
wantErr bool
|
|
}{
|
|
{"happy path", "data/workers_500k.parquet", false},
|
|
{"deeply nested", "a/b/c/d/e/f/g.txt", false},
|
|
{"empty", "", true},
|
|
{"too long", string(make([]byte, 1025)), true},
|
|
{"NUL byte", "foo\x00bar", true},
|
|
{"leading slash", "/foo/bar", true},
|
|
{"dotdot component", "data/../etc/passwd", true},
|
|
{"dotdot at end", "data/..", true},
|
|
{"dotdot at start", "../etc", true},
|
|
{"single dot is fine", "data/./x.txt", false},
|
|
{"dotdot embedded is fine", "data/.. /x.txt", false}, // not a path component
|
|
{"newline", "foo\nbar", true},
|
|
{"carriage return", "foo\rbar", true},
|
|
{"tab", "foo\tbar", true},
|
|
{"unicode is fine", "résumé/data.txt", false},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
err := validateKey(tc.key)
|
|
if tc.wantErr && err == nil {
|
|
t.Errorf("expected error for %q, got nil", tc.key)
|
|
}
|
|
if !tc.wantErr && err != nil {
|
|
t.Errorf("expected ok for %q, got %v", tc.key, err)
|
|
}
|
|
})
|
|
}
|
|
}
|