Public Access
M2's file transfer, built bottom-up: an SFTP session on the SSH layer, a transfer queue in a project of its own, and the two-pane browser the design asked for replacing the screen that said it did not exist. Remote listings carry names, sizes, modification times and a real drwxr-xr-x — nothing in this repository could render a POSIX mode before — and the queue moves one file at a time with progress, throughput and resume. The design import assumed this would be an SFTP subsystem channel on ISshConnection, beside the shell on a transport that is already up. SSH.NET does not offer that: SftpClient derives from BaseClient and owns its own transport, and there is no supported way to hand it an SshClient's session. So file transfer opens a second authenticated connection, and it is named for that rather than dressed up as a channel — OpenSftpAsync is on ISftpSessionFactory, not on a connection. The difference is visible to a user: the host records a second login, and a host whose password is typed each time asks for it again on this screen. It goes through the same host key gate, the same pin and the same two refusals a shell does, so a fingerprint approved for a terminal is approved here and one approved here reaches the other machines with the next sync. docs/design-import-gaps.md is corrected, and marked as the one row where what shipped differs from what it predicted. Nothing is written at its final name until it is complete. Every transfer goes to a .dodossh-part file beside its destination and is renamed into place at the end, so an interrupted transfer can never be mistaken for a finished one — which matters most for what this screen is actually for, which is copying a build artefact onto a server and then running it. A destination that already exists is refused outright rather than overwritten: the queue has no way to ask, and silently replacing a file somebody's process is serving is the worse of the two failures. The remote pane has DELETE and MKDIR so that refusal is not a dead end. A test against the container pins the assumption underneath all of this — that SFTP's rename does not clobber. Resume works within a run of the application and not across a restart, and the limit is deliberate rather than unfinished. Nothing records which source wrote a part file, and resuming one on the strength of its name matching is how a corrupt artefact gets delivered with nothing reporting a failure; a part file found at startup is started over. Making it survive a restart needs the preferences store this client still has not got. The offset a resume starts at is the part file's own length rather than the transfer's recorded progress: a cancellation can land between a write completing and the counter moving, and only one of those two is a fact about the bytes that are there. The queue and its connection outlive a lock, as shells do. LockAsync already argues that locking must not destroy work in flight — it is what somebody does when they walk away from the machine, which is exactly when a long transfer is most likely to be running — so TransfersViewModel is created once and the vault is attached on unlock and detached on lock. What locking takes is the host list, and it has to: those rows carry decrypted secrets. DodoSSH.Client.Transfer is a new project rather than more of Client.Ssh. The two answer different questions — one is about reaching a host, the other about moving bytes and what to do when moving them stops halfway — and this is the only client project that deliberately touches the local filesystem. Three defects the tests found, none of which review would have. SftpPath.Name answered an empty string for the root. NavigateRemoteAsync wrapped itself in the busy guard, so navigating from inside another command did nothing at all and the remote pane simply stayed empty after connecting, with no failure anywhere to explain it. And opening an SFTP session per test made two handshakes per test — this client learns a host key by being refused — which pushed the SSH assembly past sshd's MaxStartups and failed a different few unrelated tests each run; the session is shared through the fixture now, with the reason written where the next person will hit it. 1004 tests green across 18 projects, 24 of them new: the SFTP subsystem against the OpenSSH container, the queue against a real temporary directory and a fake host, and three more layout measurements because a screen this window has never laid out is a screen never checked. Not verified: the screen has not been looked at running. The layout harness measures it at the window's minimum in three shapes, which is the class of defect that has shipped here before, but reaching it in the application needs the compose stack, the migrations, the API and a browser sign-in. What is still absent — the status bar's transfer count, dragging between the panes, transferring a directory, and sftp over a bastion — is in docs/design-import-gaps.md.
259 lines
7.9 KiB
C#
259 lines
7.9 KiB
C#
using DodoSSH.Client.Ssh;
|
|
|
|
namespace DodoSSH.Client.Transfer.Tests;
|
|
|
|
/// <summary>
|
|
/// A remote filesystem in a dictionary.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Here rather than a container because what this suite is about is the queue's behaviour when a transfer
|
|
/// goes wrong halfway — a read that dies after so many bytes, a destination that appears while a transfer is
|
|
/// queued — and neither can be asked of a real server on cue. That the real server behaves as this fake
|
|
/// pretends is established separately, against sshd, in <c>SftpSessionTests</c>.
|
|
/// </remarks>
|
|
internal sealed class FakeSftpSession : ISftpSession
|
|
{
|
|
private readonly Dictionary<string, byte[]> files = new(StringComparer.Ordinal);
|
|
private readonly HashSet<string> directories = new(StringComparer.Ordinal) { "/", "/home/dodo" };
|
|
private readonly Lock gate = new();
|
|
|
|
/// <inheritdoc />
|
|
public bool IsConnected => true;
|
|
|
|
/// <inheritdoc />
|
|
public HostKeyPresentation HostKey { get; } = new("host.internal", 22, "ssh-ed25519", "SHA256:fake");
|
|
|
|
/// <inheritdoc />
|
|
public string HomeDirectory => "/home/dodo";
|
|
|
|
/// <summary>Throws once, this many bytes into the next read, and then stops doing so.</summary>
|
|
/// <remarks>
|
|
/// One-shot on purpose: every resume test is "it broke, then it did not", and a fake that kept failing
|
|
/// would need turning off at exactly the point the assertion is about.
|
|
/// </remarks>
|
|
public int? FailReadAfter { get; set; }
|
|
|
|
/// <summary>The offsets <see cref="OpenReadAsync"/> was asked to start at, in order.</summary>
|
|
/// <remarks>
|
|
/// The only direct evidence that a resume resumed. A test can see the right bytes on disk at the end
|
|
/// whether the second attempt started at the offset or at zero.
|
|
/// </remarks>
|
|
public List<long> ReadOffsets { get; } = [];
|
|
|
|
/// <summary>Puts a file on the fake host.</summary>
|
|
public void Seed(string path, byte[] content)
|
|
{
|
|
lock (gate)
|
|
{
|
|
files[path] = content;
|
|
directories.Add(SftpPath.Parent(path));
|
|
}
|
|
}
|
|
|
|
/// <summary>What is at a path, or null.</summary>
|
|
public byte[]? Read(string path)
|
|
{
|
|
lock (gate)
|
|
{
|
|
return files.GetValueOrDefault(path);
|
|
}
|
|
}
|
|
|
|
/// <summary>Whether anything is at a path.</summary>
|
|
public bool Exists(string path)
|
|
{
|
|
lock (gate)
|
|
{
|
|
return files.ContainsKey(path) || directories.Contains(path);
|
|
}
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
if (!directories.Contains(path))
|
|
{
|
|
throw new SftpPathException(path, $"{path} is not there.");
|
|
}
|
|
|
|
IReadOnlyList<SftpEntry> entries =
|
|
[
|
|
.. files
|
|
.Where(file => string.Equals(SftpPath.Parent(file.Key), path, StringComparison.Ordinal))
|
|
.Select(file => Describe(file.Key, file.Value.Length)),
|
|
];
|
|
|
|
return Task.FromResult(entries);
|
|
}
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task<SftpEntry?> StatAsync(string path, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
if (files.TryGetValue(path, out var content))
|
|
{
|
|
return Task.FromResult<SftpEntry?>(Describe(path, content.Length));
|
|
}
|
|
|
|
return Task.FromResult<SftpEntry?>(
|
|
directories.Contains(path)
|
|
? new SftpEntry(
|
|
SftpPath.Name(path),
|
|
path,
|
|
SftpEntryKind.Directory,
|
|
0,
|
|
DateTimeOffset.UnixEpoch,
|
|
"drwxr-xr-x")
|
|
: null);
|
|
}
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task<Stream> OpenReadAsync(string path, long offset, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
ReadOffsets.Add(offset);
|
|
|
|
if (!files.TryGetValue(path, out var content))
|
|
{
|
|
throw new SftpPathException(path, $"{path} is not there.");
|
|
}
|
|
|
|
var failAfter = FailReadAfter;
|
|
FailReadAfter = null;
|
|
|
|
return Task.FromResult<Stream>(
|
|
new BrittleStream(content.AsSpan((int)offset).ToArray(), failAfter));
|
|
}
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task<Stream> OpenWriteAsync(string path, long offset, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
var existing = files.GetValueOrDefault(path, []);
|
|
|
|
return Task.FromResult<Stream>(new CommittingStream(
|
|
existing.AsSpan(0, (int)Math.Min(offset, existing.Length)).ToArray(),
|
|
content =>
|
|
{
|
|
lock (gate)
|
|
{
|
|
files[path] = content;
|
|
}
|
|
}));
|
|
}
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task CreateDirectoryAsync(string path, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
directories.Add(path);
|
|
}
|
|
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task DeleteAsync(string path, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
if (!files.Remove(path) && !directories.Remove(path))
|
|
{
|
|
throw new SftpPathException(path, $"{path} is not there.");
|
|
}
|
|
}
|
|
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public Task RenameAsync(string fromPath, string toPath, CancellationToken cancellationToken)
|
|
{
|
|
lock (gate)
|
|
{
|
|
if (!files.TryGetValue(fromPath, out var content))
|
|
{
|
|
throw new SftpPathException(fromPath, $"{fromPath} is not there.");
|
|
}
|
|
|
|
// SFTP's rename does not replace, and the queue's promise never to overwrite rests on it. A fake
|
|
// that clobbered would make the one test about that promise pass for the wrong reason.
|
|
if (files.ContainsKey(toPath))
|
|
{
|
|
throw new SftpPathException(toPath, $"{toPath} is already there.");
|
|
}
|
|
|
|
files.Remove(fromPath);
|
|
files[toPath] = content;
|
|
}
|
|
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public ValueTask DisposeAsync() => ValueTask.CompletedTask;
|
|
|
|
private static SftpEntry Describe(string path, int length) => new(
|
|
SftpPath.Name(path),
|
|
path,
|
|
SftpEntryKind.File,
|
|
length,
|
|
DateTimeOffset.UnixEpoch,
|
|
"-rw-r--r--");
|
|
|
|
/// <summary>A read that dies partway through, the way a dropped connection does.</summary>
|
|
private sealed class BrittleStream(byte[] content, int? failAfter) : MemoryStream(content, writable: false)
|
|
{
|
|
public override int Read(Span<byte> buffer)
|
|
{
|
|
Guard();
|
|
|
|
return base.Read(buffer);
|
|
}
|
|
|
|
public override ValueTask<int> ReadAsync(
|
|
Memory<byte> buffer,
|
|
CancellationToken cancellationToken = default)
|
|
{
|
|
Guard();
|
|
|
|
return base.ReadAsync(buffer, cancellationToken);
|
|
}
|
|
|
|
private void Guard()
|
|
{
|
|
if (failAfter is { } limit && Position >= limit)
|
|
{
|
|
throw new IOException("The connection dropped.");
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>A write that lands on the fake host when it is disposed.</summary>
|
|
private sealed class CommittingStream(byte[] prefix, Action<byte[]> commit) : MemoryStream()
|
|
{
|
|
private bool committed;
|
|
|
|
public override void Close()
|
|
{
|
|
if (!committed)
|
|
{
|
|
committed = true;
|
|
commit([.. prefix, .. ToArray()]);
|
|
}
|
|
|
|
base.Close();
|
|
}
|
|
}
|
|
}
|