Add restricted-paths admin command to list and delete manifest-id entries

Summary:
Cleaning up content-hash collisions in the ACL Manifest Store today means running ad-hoc SQL DELETEs against the production `restricted_paths_manifest_ids` XDB table. That is error-prone: a hand-written DELETE has no dry-run or confirmation step before it mutates prod, and the binary `manifest_id` column makes it easy to pass the wrong value and silently match nothing.

This adds a `mononoke-admin restricted-paths` command with `manifest-id-store list` and `manifest-id-store delete` subcommands that look up and remove entries by `manifest_id` for the repo selected on the command line, building on the store methods added in the parent commit. The subcommands are grouped under `manifest-id-store` so future restricted-paths tooling (backfills, path lookups, etc.) can be added alongside without crowding the top level. `delete` first prints the affected rows and prompts for confirmation (with `--force` to skip), so the operator sees exactly what will be removed before anything is deleted, and it warns if the number of rows actually deleted differs from the preview. The `--manifest-id` argument accepts the hash with or without a `0x` prefix and rejects empty or malformed hex up front rather than silently matching nothing. A colliding manifest id that spans several repos is cleaned up by running the command once per repo.

An integration test (`test-admin-restricted-paths.t`) covers listing, deletion, the empty-result paths, and invalid/empty manifest-id handling.

Reviewed By: gustavoavena

Differential Revision: D110107711

fbshipit-source-id: 0fe371ab0e468371fffff54207c88cae7f814ee0

Author: lmvasquezg

eden/mononoke/tools/admin/BUCK

@@ -51,12 +51,14 @@ rust_binary(
         "fbsource//third-party/rust:futures",
         "fbsource//third-party/rust:gix-hash",
         "fbsource//third-party/rust:gix-object",
+        "fbsource//third-party/rust:hex",
         "fbsource//third-party/rust:itertools",
         "fbsource//third-party/rust:maplit",
         "fbsource//third-party/rust:num-format",
         "fbsource//third-party/rust:prettytable-rs",
         "fbsource//third-party/rust:regex",
         "fbsource//third-party/rust:serde_json",
+        "fbsource//third-party/rust:smallvec",
         "fbsource//third-party/rust:strum",
         "fbsource//third-party/rust:thiserror",
         "fbsource//third-party/rust:tokio",
@@ -166,6 +168,7 @@ rust_binary(
         "//eden/mononoke/repo_attributes/repo_derived_data:repo_derived_data",
         "//eden/mononoke/repo_attributes/repo_identity:repo_identity",
         "//eden/mononoke/repo_attributes/repo_lock:repo_lock",
+        "//eden/mononoke/repo_attributes/restricted_paths:restricted_paths",
         "//eden/mononoke/repo_attributes/sql_query_config:sql_query_config",
         "//eden/mononoke/repo_factory:repo_factory",
         "//eden/mononoke/scs/if:source_control-rust",

eden/mononoke/tools/admin/Cargo.toml

@@ -75,6 +75,7 @@ git_symbolic_refs = { version = "0.1.0", path = "../../repo_attributes/git_symbo
 git_types = { version = "0.1.0", path = "../../git/git_types" }
 gix-hash = { version = "0.25.1", features = ["sha1"] }
 gix-object = "0.60.0"
+hex = { version = "0.4.3", features = ["alloc"] }
 history_manifest = { version = "0.1.0", path = "../../derived_data/history_manifest" }
 itertools = "0.15.0"
 justknobs_ext = { version = "0.1.0", path = "../../common/rust/justknobs_ext" }
@@ -122,6 +123,7 @@ repo_identity = { version = "0.1.0", path = "../../repo_attributes/repo_identity
 repo_lock = { version = "0.1.0", path = "../../repo_attributes/repo_lock/repo_lock" }
 repo_update_logger = { version = "0.1.0", path = "../../features/repo_update_logger" }
 requests_table = { version = "0.1.0", path = "../../features/async_requests/requests_table" }
+restricted_paths = { version = "0.1.0", path = "../../repo_attributes/restricted_paths" }
 sapling-dag = { version = "0.1.0", path = "../../../scm/lib/dag" }
 sapling-dag-types = { version = "0.1.0", path = "../../../scm/lib/dag/dag-types", features = ["for-tests"] }
 sapling-renderdag = { version = "0.1.0", path = "../../../scm/lib/renderdag" }
@@ -130,6 +132,7 @@ serde = { version = "1.0.219", features = ["derive", "rc"] }
 serde_json = { version = "1.0.140", features = ["alloc", "float_roundtrip", "raw_value", "unbounded_depth"] }
 skeleton_manifest = { version = "0.1.0", path = "../../derived_data/skeleton_manifest" }
 skeleton_manifest_v2 = { version = "0.1.0", path = "../../derived_data/skeleton_manifest_v2" }
+smallvec = { version = "1.15.2", features = ["impl_bincode", "serde", "specialization", "union", "write"] }
 sorted_vector_map = { version = "0.2.1", git = "https://github.com/facebookexperimental/rust-shed.git", branch = "main" }
 source_control = { version = "0.1.0", path = "../../scs/if" }
 sql_commit_graph_storage = { version = "0.1.0", path = "../../repo_attributes/commit_graph/sql_commit_graph_storage" }

eden/mononoke/tools/admin/src/commands.rs

@@ -60,5 +60,6 @@ mononoke_app::subcommands! {
     mod raw_blobstore;
     mod redaction;
     mod repo_info;
+    mod restricted_paths;
     mod slow_bookmark_mover;
 }

eden/mononoke/tools/admin/src/commands/restricted_paths.rs

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This software may be used and distributed according to the terms of the
+ * GNU General Public License version 2.
+ */
+
+mod delete;
+mod list;
+
+use anyhow::Context;
+use anyhow::Result;
+use anyhow::bail;
+use clap::Parser;
+use clap::Subcommand;
+use mononoke_app::MononokeApp;
+use mononoke_app::args::RepoArgs;
+use repo_identity::RepoIdentity;
+use restricted_paths::ManifestId;
+use restricted_paths::RestrictedPathsManifestIdStore;
+use smallvec::SmallVec;
+
+/// Inspect and manage restricted paths state for a repo.
+///
+/// Subcommands are grouped by the underlying state they operate on (e.g.
+/// `manifest-id-store`), leaving room for future restricted-paths tooling
+/// (backfills, path lookups, etc.) that is unrelated to the manifest-id store.
+#[derive(Parser)]
+pub struct CommandArgs {
+    #[clap(flatten)]
+    repo: RepoArgs,
+
+    #[clap(subcommand)]
+    subcommand: RestrictedPathsSubcommand,
+}
+
+#[facet::container]
+pub struct Repo {
+    #[facet]
+    restricted_paths_manifest_id_store: dyn RestrictedPathsManifestIdStore,
+    #[facet]
+    repo_identity: RepoIdentity,
+}
+
+#[derive(Subcommand)]
+pub enum RestrictedPathsSubcommand {
+    /// Inspect and manage the manifest-id store.
+    ManifestIdStore {
+        #[clap(subcommand)]
+        command: ManifestIdStoreSubcommand,
+    },
+}
+
+#[derive(Subcommand)]
+pub enum ManifestIdStoreSubcommand {
+    /// List the entries matching a manifest id in the selected repo.
+    List(list::ListArgs),
+    /// Delete the entries matching a manifest id in the selected repo.
+    Delete(delete::DeleteArgs),
+}
+
+/// Parse a manifest id from its hex representation.
+///
+/// Accepts an optional `0x`/`0X` prefix. The bytes are decoded with strict hex
+/// parsing rather than `ManifestId::from(&str)`, whose fallback silently treats
+/// invalid hex as raw ASCII bytes and would mask user mistakes.
+pub(crate) fn parse_manifest_id(s: &str) -> Result<ManifestId> {
+    let hex_str = s
+        .strip_prefix("0x")
+        .or_else(|| s.strip_prefix("0X"))
+        .unwrap_or(s);
+    let bytes = match hex::decode(hex_str) {
+        Ok(bytes) => bytes,
+        Err(e) => bail!("Invalid hex manifest_id {s:?}: {e}"),
+    };
+    if bytes.is_empty() {
+        bail!("Empty manifest_id {s:?}: a manifest id must be a non-empty hex string");
+    }
+    Ok(ManifestId::new(SmallVec::from_slice(&bytes)))
+}
+
+pub async fn run(app: MononokeApp, args: CommandArgs) -> Result<()> {
+    let ctx = app.new_basic_context();
+    let repo: Repo = app
+        .open_repo(&args.repo)
+        .await
+        .context("Failed to open repo")?;
+
+    match args.subcommand {
+        RestrictedPathsSubcommand::ManifestIdStore { command } => match command {
+            ManifestIdStoreSubcommand::List(args) => list::list(&ctx, &repo, args).await?,
+            ManifestIdStoreSubcommand::Delete(args) => delete::delete(&ctx, &repo, args).await?,
+        },
+    }
+    Ok(())
+}

eden/mononoke/tools/admin/src/commands/restricted_paths/delete.rs

@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This software may be used and distributed according to the terms of the
+ * GNU General Public License version 2.
+ */
+
+use std::io::Write;
+
+use anyhow::Result;
+use clap::Args;
+use context::CoreContext;
+use restricted_paths::manifest_id_store::RestrictedPathsManifestIdStoreRef;
+
+use super::Repo;
+use super::parse_manifest_id;
+
+#[derive(Args)]
+pub struct DeleteArgs {
+    /// The manifest id to delete, in hex (an optional `0x` prefix is accepted).
+    #[clap(long)]
+    manifest_id: String,
+    /// Skip the interactive confirmation prompt.
+    #[clap(long)]
+    force: bool,
+}
+
+pub async fn delete(ctx: &CoreContext, repo: &Repo, args: DeleteArgs) -> Result<()> {
+    let manifest_id = parse_manifest_id(&args.manifest_id)?;
+    let store = repo.restricted_paths_manifest_id_store();
+    let entries = store
+        .get_all_paths_by_manifest_id(ctx, &manifest_id)
+        .await?;
+
+    if entries.is_empty() {
+        println!("No entries found for manifest_id {manifest_id}; nothing to delete.");
+        return Ok(());
+    }
+
+    let expected = entries.len();
+    println!("Found {expected} entries for manifest_id {manifest_id}:");
+    println!("manifest_type\tpath");
+    for (manifest_type, path) in &entries {
+        println!("{manifest_type}\t{path}");
+    }
+
+    if !args.force {
+        // The prompt reads from stdin, which would block the tokio runtime, so
+        // run it on the blocking pool.
+        let confirmed = tokio::task::spawn_blocking(move || -> Result<bool> {
+            print!(
+                "Are you sure you want to delete {expected} manifest entries from the DB? [y/N]: "
+            );
+            std::io::stdout().flush()?;
+
+            let mut input = String::new();
+            std::io::stdin().read_line(&mut input)?;
+            let answer = input.trim().to_lowercase();
+            Ok(answer == "y" || answer == "yes")
+        })
+        .await??;
+
+        if !confirmed {
+            println!("Aborted.");
+            return Ok(());
+        }
+    }
+
+    let deleted = store.delete_by_manifest_id(ctx, &manifest_id).await?;
+    println!("Deleted {deleted} rows.");
+    if deleted != expected as u64 {
+        println!(
+            "Warning: deleted {deleted} rows but {expected} were shown in the preview; the table changed between listing and deletion."
+        );
+    }
+    Ok(())
+}

eden/mononoke/tools/admin/src/commands/restricted_paths/list.rs

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This software may be used and distributed according to the terms of the
+ * GNU General Public License version 2.
+ */
+
+use anyhow::Result;
+use clap::Args;
+use context::CoreContext;
+use restricted_paths::manifest_id_store::RestrictedPathsManifestIdStoreRef;
+
+use super::Repo;
+use super::parse_manifest_id;
+
+#[derive(Args)]
+pub struct ListArgs {
+    /// The manifest id to look up, in hex (an optional `0x` prefix is accepted).
+    #[clap(long)]
+    manifest_id: String,
+}
+
+pub async fn list(ctx: &CoreContext, repo: &Repo, args: ListArgs) -> Result<()> {
+    let manifest_id = parse_manifest_id(&args.manifest_id)?;
+    let store = repo.restricted_paths_manifest_id_store();
+    let entries = store
+        .get_all_paths_by_manifest_id(ctx, &manifest_id)
+        .await?;
+
+    if entries.is_empty() {
+        println!("No entries found for manifest_id {manifest_id}");
+        return Ok(());
+    }
+
+    println!("manifest_type\tpath");
+    for (manifest_type, path) in entries {
+        println!("{manifest_type}\t{path}");
+    }
+    Ok(())
+}