Validate downloads before installing workspace files

internal/fileops/fileops.go

@@ -12,8 +12,8 @@ import (
 	"strings"
 )
 
-// ErrDirectorySyncUnsupported remains for legacy confined migration paths.
-// The retained replacement entry points do not perform directory syncing.
+// ErrDirectorySyncUnsupported is used only by the retained directory-promotion
+// implementation. Single-file replacement does not perform directory syncing.
 var ErrDirectorySyncUnsupported = errors.New("directory sync is unsupported")
 
 // ReplaceFileOptions describes the caller-owned parts of a byte-file
@@ -131,147 +131,21 @@ func replaceFileFromReader(dst string, source io.Reader, options ReplaceFileOpti
 	return nil
 }
 
-// InstallDownloadedTempFile installs a fully downloaded sibling temporary file
-// at dst. On failure before the rename, the caller retains ownership of tmpPath
-// and is responsible for cleanup.
-func InstallDownloadedTempFile(tmpPath, dst string, perm os.FileMode) error {
+// InstallSiblingTempFile installs a fully written and validated sibling
+// temporary file at dst. The caller retains ownership of tmpPath if installation
+// fails and is responsible for removing it.
+func InstallSiblingTempFile(tmpPath, dst string, perm os.FileMode) error {
 	if strings.TrimSpace(tmpPath) == "" || strings.TrimSpace(dst) == "" {
 		return fmt.Errorf("temp and destination paths are required")
 	}
-	if err := EnsureWorkspaceDirectory(filepath.Dir(dst)); err != nil {
-		return fmt.Errorf("create destination directory: %w", err)
+	if filepath.Clean(filepath.Dir(tmpPath)) != filepath.Clean(filepath.Dir(dst)) {
+		return fmt.Errorf("temporary file must be a sibling of the destination")
 	}
-	return installDownloadedTempFileConfined(tmpPath, dst, perm)
-}
-
-type temporaryFile interface {
-	io.Writer
-	Name() string
-	Sync() error
-	Close() error
-}
-
-type atomicReplacementOperations struct {
-	createTemp    func(string, string) (temporaryFile, error)
-	chmod         func(string, os.FileMode) error
-	rename        func(string, string) error
-	remove        func(string) error
-	syncDirectory func(string) error
-	syncFile      func(string) error
-}
-
-var systemAtomicReplacementOperations = atomicReplacementOperations{
-	createTemp: func(dir, pattern string) (temporaryFile, error) {
-		return os.CreateTemp(dir, pattern)
-	},
-	chmod:         os.Chmod,
-	rename:        os.Rename,
-	remove:        os.Remove,
-	syncDirectory: syncDirectory,
-	syncFile:      syncFile,
-}
-
-func replaceFileAtomicWithOperations(
-	dst string,
-	data []byte,
-	options ReplaceFileOptions,
-	ops atomicReplacementOperations,
-) error {
-	return replaceFileFromReaderWithOperations(dst, bytes.NewReader(data), options, ops)
-}
-
-func replaceFileFromReaderWithOperations(
-	dst string,
-	source io.Reader,
-	options ReplaceFileOptions,
-	ops atomicReplacementOperations,
-) (resultErr error) {
-	if strings.TrimSpace(dst) == "" {
-		return fmt.Errorf("destination path is required")
-	}
-
-	dir := filepath.Dir(dst)
-	tmp, err := ops.createTemp(dir, "."+filepath.Base(dst)+".tmp-*")
-	if err != nil {
-		return fmt.Errorf("create temp file: %w", err)
-	}
-	tmpPath := tmp.Name()
-	removeTmp := true
-	defer func() {
-		if removeTmp {
-			if err := ops.remove(tmpPath); err != nil {
-				cleanupErr := fmt.Errorf("remove temporary file: %w", err)
-				if resultErr == nil {
-					resultErr = cleanupErr
-				} else {
-					resultErr = errors.Join(resultErr, cleanupErr)
-				}
-			}
-		}
-	}()
-
-	if _, err := io.Copy(tmp, source); err != nil {
-		return closeTemporaryFileAfterError(tmp, fmt.Errorf("write temp file: %w", err))
-	}
-	if err := ops.chmod(tmpPath, options.Mode); err != nil {
-		return closeTemporaryFileAfterError(tmp, fmt.Errorf("set temp file permissions: %w", err))
-	}
-	if err := tmp.Sync(); err != nil {
-		return closeTemporaryFileAfterError(tmp, fmt.Errorf("sync temp file: %w", err))
-	}
-	if err := tmp.Close(); err != nil {
-		return fmt.Errorf("close temp file: %w", err)
-	}
-	if options.BeforeRename != nil {
-		if err := options.BeforeRename(); err != nil {
-			return fmt.Errorf("check before file replacement: %w", err)
-		}
-	}
-	if err := ops.rename(tmpPath, dst); err != nil {
-		return fmt.Errorf("install temp file: %w", err)
-	}
-	removeTmp = false
-	if err := ops.syncDirectory(dir); err != nil {
-		return fmt.Errorf("sync destination directory after replacement: %w", err)
-	}
-	return nil
-}
-
-func closeTemporaryFileAfterError(tmp temporaryFile, operationErr error) error {
-	if err := tmp.Close(); err != nil {
-		return errors.Join(operationErr, fmt.Errorf("close temporary file: %w", err))
-	}
-	return operationErr
-}
-
-func installDownloadedTempFileWithOperations(
-	tmpPath, dst string,
-	perm os.FileMode,
-	ops atomicReplacementOperations,
-) error {
-	if err := ops.chmod(tmpPath, perm); err != nil {
+	if err := os.Chmod(tmpPath, perm); err != nil {
 		return fmt.Errorf("set temp file permissions: %w", err)
 	}
-	if err := ops.syncFile(tmpPath); err != nil {
-		return fmt.Errorf("sync downloaded temp file: %w", err)
-	}
-	if err := ops.rename(tmpPath, dst); err != nil {
+	if err := os.Rename(tmpPath, dst); err != nil {
 		return fmt.Errorf("install downloaded file: %w", err)
 	}
-	if err := ops.syncDirectory(filepath.Dir(dst)); err != nil {
-		return fmt.Errorf("sync destination directory after downloaded-file replacement: %w", err)
-	}
 	return nil
 }
-
-func syncFile(path string) error {
-	file, err := os.Open(path)
-	if err != nil {
-		return err
-	}
-	if err := file.Sync(); err != nil {
-		_ = file.Close()
-		return err
-	}
-	return file.Close()
-}