restricted_paths: introduce read_only and gate derivation on it

Summary:
## This stack
Decouple restricted_paths config from the manifest_id store (T277178795). Replace `path_acls` (path -> ACL) with per-path `PathRestrictionMetadata` carrying the REPO_REGION ACL and optional permission-request group, so a future `read_only` flag can freeze manifest-id-store growth without dropping enforcement. Thrift `path_acls` is retained as a parser fallback. The configerator thrift source is the separately-published D109697491.

## This diff (behaviour change)
One of the most important changes for T277178795.
This will let us specify that a tent config is read-only, meaning we'll rely on it only for old manifest ids.

This will be used once we migrate all the existing fbsource tents to `.slacl`, which is the long-term, scalable solution.

Reviewed By: lmvasquezg

Differential Revision: D109827082

fbshipit-source-id: 8c00360c8b1797f8e73025bc1e049cce6994064e

Author: gustavoavena

eden/mononoke/derived_data/mercurial_derivation/src/mapping.rs

@@ -353,12 +353,14 @@ async fn track_all_restricted_paths(
         return Ok(());
     }
 
-    // Get the configured restricted paths
+    // Get the configured restricted paths. Skip read-only roots: derivation must
+    // not record new manifest-id-store entries for them.
     let restricted_dirs: Vec<PathOrPrefix> = restricted_paths
         .config()
         .path_restriction_metadata
-        .keys()
-        .map(|non_root_mpath| PathOrPrefix::Path(non_root_mpath.clone().into()))
+        .iter()
+        .filter(|(_, metadata)| !metadata.read_only)
+        .map(|(non_root_mpath, _)| PathOrPrefix::Path(non_root_mpath.clone().into()))
         .collect();
 
     if restricted_dirs.is_empty() {

eden/mononoke/metaconfig/parser/src/convert/repo.rs

@@ -1400,6 +1400,7 @@ fn merge_path_restriction_metadata(
                 PathRestrictionMetadata {
                     repo_region_acl,
                     permission_request_group,
+                    read_only: raw.read_only.unwrap_or(false),
                 },
             ))
         })
@@ -1426,6 +1427,7 @@ fn merge_path_restriction_metadata(
                     PathRestrictionMetadata {
                         repo_region_acl: legacy_acl,
                         permission_request_group: None,
+                        read_only: false,
                     },
                 );
             }
@@ -1656,7 +1658,8 @@ mod tests {
     }
 
     /// What it tests: a legacy `path_acls` entry with no `path_restriction_metadata`.
-    /// Expected: it is folded into metadata with no explicit request group.
+    /// Expected: it is folded into metadata with no explicit request group and
+    /// `read_only = false`.
     #[mononoke::test]
     fn test_merge_path_acls_fallback_defaults() {
         let mut raw = empty_raw_restricted_paths_config();
@@ -1670,6 +1673,7 @@ mod tests {
         let md = cfg.path_restriction_metadata.get(&path).expect("entry");
         assert_eq!(md.repo_region_acl.to_string(), "REPO_REGION:acl1");
         assert_eq!(md.permission_request_group, None);
+        assert!(!md.read_only, "legacy path_acls entries are not read-only");
     }
 
     /// What it tests: a malformed `repo_region_acl` string in `path_acls`.
@@ -1716,15 +1720,15 @@ mod tests {
     }
 
     /// What it tests: a `path_restriction_metadata` entry with explicit request
-    /// group, no legacy `path_acls`.
+    /// group and `read_only = true`, no legacy `path_acls`.
     /// Expected: all explicit fields are preserved.
     #[mononoke::test]
     fn test_merge_metadata_only_explicit_fields() {
         let mut raw = empty_raw_restricted_paths_config();
         raw.path_restriction_metadata = Some(
             [(
                 "foo".to_string(),
-                raw_metadata("REPO_REGION:acl1", Some("GROUP:reviewers"), None),
+                raw_metadata("REPO_REGION:acl1", Some("GROUP:reviewers"), Some(true)),
             )]
             .into_iter()
             .collect(),
@@ -1739,6 +1743,7 @@ mod tests {
             md.permission_request_group.as_ref().map(|i| i.to_string()),
             Some("GROUP:reviewers".to_string())
         );
+        assert!(md.read_only, "explicit read_only=true is honored");
     }
 
     /// What it tests: a path present in BOTH maps with the SAME repo_region_acl.
@@ -1752,7 +1757,7 @@ mod tests {
         raw.path_restriction_metadata = Some(
             [(
                 "foo".to_string(),
-                raw_metadata("REPO_REGION:acl1", Some("GROUP:reviewers"), None),
+                raw_metadata("REPO_REGION:acl1", Some("GROUP:reviewers"), Some(true)),
             )]
             .into_iter()
             .collect(),
@@ -1767,6 +1772,7 @@ mod tests {
             Some("GROUP:reviewers".to_string()),
             "new field wins on matching ACL"
         );
+        assert!(md.read_only);
     }
 
     /// What it tests: a path present in BOTH maps with DIFFERENT repo_region_acl.
@@ -1815,4 +1821,24 @@ mod tests {
             "expected repo_region_acl parse error, got: {msg}"
         );
     }
+
+    /// What it tests: `read_only` absent on a metadata entry.
+    /// Expected: it defaults to false.
+    #[mononoke::test]
+    fn test_merge_read_only_absent_defaults_false() {
+        let mut raw = empty_raw_restricted_paths_config();
+        raw.path_restriction_metadata = Some(
+            [(
+                "foo".to_string(),
+                raw_metadata("REPO_REGION:acl1", None, None),
+            )]
+            .into_iter()
+            .collect(),
+        );
+
+        let cfg = raw.convert().unwrap();
+
+        let path = NonRootMPath::new("foo").unwrap();
+        assert!(!cfg.path_restriction_metadata.get(&path).unwrap().read_only);
+    }
 }

eden/mononoke/metaconfig/types/src/lib.rs

@@ -2575,14 +2575,19 @@ pub struct EnforcementConditionSet {
 /// Restriction metadata for a single restricted path.
 ///
 /// Supersedes the bare path -> ACL mapping that `path_acls` used to carry: it
-/// holds the REPO_REGION ACL and an optional permission-request group.
+/// holds the REPO_REGION ACL, an optional permission-request group, and a
+/// `read_only` flag. When `read_only` is true, derivation stops recording new
+/// manifest-id-store entries for the path; enforcement on existing entries and
+/// config-based authorization are unaffected.
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub struct PathRestrictionMetadata {
     /// REPO_REGION ACL protecting this path.
     pub repo_region_acl: MononokeIdentity,
     /// AMP group clients are redirected to when requesting access, instead of
     /// exposing the REPO_REGION ACL. If `None`, defaults to `repo_region_acl`.
     pub permission_request_group: Option<MononokeIdentity>,
+    /// When true, no new manifest-id-store entries are derived for this path.
+    pub read_only: bool,
 }
 
 impl PathRestrictionMetadata {

eden/mononoke/mononoke_api/src/test/test_restricted_paths.rs

@@ -1174,6 +1174,7 @@ fn build_path_restriction_metadata(
                 PathRestrictionMetadata {
                     repo_region_acl: MononokeIdentity::from_str(acl_str)?,
                     permission_request_group: None,
+                    read_only: false,
                 },
             ))
         })

eden/mononoke/mononoke_api_hg/src/tree.rs

@@ -672,6 +672,7 @@ mod tests {
                         repo_region_acl: MononokeIdentity::from_str(acl_str)
                             .expect("Failed to parse MononokeIdentity"),
                         permission_request_group: None,
+                        read_only: false,
                     },
                 )
             })

eden/mononoke/repo_attributes/restricted_paths/src/restriction_info/tests.rs

@@ -542,6 +542,7 @@ fn restricted_paths_for_repo_with_mode_and_path_acls(
                 PathRestrictionMetadata {
                     repo_region_acl: acl.parse()?,
                     permission_request_group: None,
+                    read_only: false,
                 },
             ))
         })

eden/mononoke/repo_attributes/restricted_paths/src/test_utils.rs

@@ -63,6 +63,7 @@ impl RestrictedPathsConfigBuilder {
             PathRestrictionMetadata {
                 repo_region_acl: MononokeIdentity::from_str(identity)?,
                 permission_request_group: None,
+                read_only: false,
             },
         );
         Ok(self)

eden/mononoke/repo_attributes/restricted_paths/test/utils.rs

@@ -1267,6 +1267,7 @@ async fn setup_test_repo(
                 PathRestrictionMetadata {
                     repo_region_acl: acl,
                     permission_request_group: None,
+                    read_only: false,
                 },
             )
         })

eden/mononoke/repo_attributes/restricted_paths_common/src/config_based.rs

@@ -90,9 +90,87 @@ impl RestrictedPathsConfigBased {
     }
 
     /// Whether derivation should record a new manifest-id-store entry for this
-    /// path.
+    /// path: true only when the path is a restriction root AND not read-only.
+    /// Distinct from `is_restriction_root` (which stays read-only-agnostic) so
+    /// that enforcement on already-recorded entries is never weakened.
     pub fn should_record_manifest_id_entry(&self, path: &NonRootMPath) -> bool {
-        // TODO(T277178795): rely on `read_only` from PathRestrictionMetadata
-        self.get_metadata_for_path(path).is_some()
+        self.get_metadata_for_path(path)
+            .is_some_and(|metadata| !metadata.read_only)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::str::FromStr;
+    use std::sync::Arc;
+
+    use anyhow::Result;
+    use mononoke_macros::mononoke;
+    use mononoke_types::RepositoryId;
+    use sql_construct::SqlConstruct;
+
+    use super::*;
+    use crate::manifest_id_store::SqlRestrictedPathsManifestIdStoreBuilder;
+
+    fn metadata(acl: &str, read_only: bool) -> PathRestrictionMetadata {
+        PathRestrictionMetadata {
+            repo_region_acl: MononokeIdentity::from_str(acl).expect("valid identity"),
+            permission_request_group: None,
+            read_only,
+        }
+    }
+
+    fn config_based_with_metadata(
+        entries: Vec<(&str, PathRestrictionMetadata)>,
+    ) -> Result<RestrictedPathsConfigBased> {
+        let path_restriction_metadata = entries
+            .into_iter()
+            .map(|(path, md)| Ok((NonRootMPath::new(path)?, md)))
+            .collect::<Result<_>>()?;
+        let store = Arc::new(
+            SqlRestrictedPathsManifestIdStoreBuilder::with_sqlite_in_memory()?
+                .with_repo_id(RepositoryId::new(0)),
+        );
+        Ok(RestrictedPathsConfigBased::new(
+            RestrictedPathsConfig {
+                path_restriction_metadata,
+                ..Default::default()
+            },
+            store,
+            None,
+        ))
+    }
+
+    /// What it tests: the derivation recording gate honors `read_only`.
+    /// Expected: a writable root records; a read-only root does not; a
+    /// non-restriction path does not. `is_restriction_root` stays
+    /// read-only-agnostic so enforcement on existing entries is never weakened.
+    #[mononoke::test]
+    fn test_should_record_manifest_id_entry_respects_read_only() -> Result<()> {
+        let config_based = config_based_with_metadata(vec![
+            ("writable", metadata("REPO_REGION:acl1", false)),
+            ("frozen", metadata("REPO_REGION:acl2", true)),
+        ])?;
+
+        let writable = NonRootMPath::new("writable")?;
+        let frozen = NonRootMPath::new("frozen")?;
+        let other = NonRootMPath::new("other")?;
+
+        assert!(config_based.should_record_manifest_id_entry(&writable));
+        assert!(config_based.is_restriction_root(&writable));
+
+        assert!(
+            !config_based.should_record_manifest_id_entry(&frozen),
+            "read_only roots must not record new manifest-id entries"
+        );
+        assert!(
+            config_based.is_restriction_root(&frozen),
+            "read_only roots are still restriction roots"
+        );
+
+        assert!(!config_based.should_record_manifest_id_entry(&other));
+        assert!(!config_based.is_restriction_root(&other));
+
+        Ok(())
     }
 }

eden/mononoke/servers/scs/scs_methods/src/methods/commit_restricted_paths.rs

@@ -415,6 +415,7 @@ mod tests {
                         repo_region_acl: MononokeIdentity::from_str(acl_str)
                             .context("Failed to parse MononokeIdentity from ACL string")?,
                         permission_request_group: None,
+                        read_only: false,
                     },
                 ))
             })