Add backing-store path ACL lookups

Summary:
Add the minimal path ACL lookup plumbing from EdenFS backing stores through Sapling backingstore FFI to EdenAPI /check_path_permission. The coroutine API returns structured per-path ACL entries and per-path errors so EdenFS can populate requestAcl data without changing the EdenFS Thrift API.

Keep this diff focused on the backing-store lookup surface. FilteredBackingStore unwraps the filter root and forwards to the backing store. Eagerepo now provides the small test-server implementation needed for path ACL lookups by reporting .slacl ancestors with its existing placeholder ACL name.

Reviewed By: SBones

Differential Revision: D104246343

fbshipit-source-id: bf5c89086504fd16314a1d1a257beef0b9c7c20a

Author: MichaelCuevas

eden/fs/store/BackingStore.h

@@ -21,6 +21,7 @@
 #include "eden/fs/model/ObjectId.h"
 #include "eden/fs/model/RootId.h"
 #include "eden/fs/model/TreeAuxDataFwd.h"
+#include "eden/fs/model/TreeEntry.h"
 #include "eden/fs/model/TreeFwd.h"
 #include "eden/fs/store/BackingStoreType.h"
 #include "eden/fs/store/ImportPriority.h"
@@ -342,6 +343,22 @@ class BackingStore : public RootIdCodec, public ObjectIdCodec {
     return true;
   }
 
+  /**
+   * Fetch rich ACL information for the given repo-relative paths at the
+   * specified checked-out root. Results are aligned with the input order.
+   */
+  virtual folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+  co_getPathAcls(
+      const RootId& rootId,
+      const std::vector<std::string>& paths,
+      const ObjectFetchContextPtr& context) {
+    (void)rootId;
+    (void)paths;
+    (void)context;
+    co_yield folly::coro::co_error(
+        std::runtime_error("co_getPathAcls() not supported"));
+  }
+
   /**
    * Prefetch all the blobs represented by the HashRange.
    *

eden/fs/store/FilteredBackingStore.cpp

@@ -612,6 +612,16 @@ ImmediateFuture<bool> FilteredBackingStore::checkPermission(
       FilteredObjectId::fromObjectId(manifestId).object());
 }
 
+folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+FilteredBackingStore::co_getPathAcls(
+    const RootId& rootId,
+    const std::vector<std::string>& paths,
+    const ObjectFetchContextPtr& context) {
+  auto [parsedRootId, _] = parseFilterIdFromRootId(rootId);
+  co_return co_await backingStore_->co_getPathAcls(
+      parsedRootId, paths, context);
+}
+
 folly::SemiFuture<folly::Unit> FilteredBackingStore::prefetchBlobs(
     ObjectIdRange ids,
     const ObjectFetchContextPtr& context) {

eden/fs/store/FilteredBackingStore.h

@@ -212,6 +212,12 @@ class FilteredBackingStore
       ObjectIdRange ids,
       const ObjectFetchContextPtr& context) override;
 
+  folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+  co_getPathAcls(
+      const RootId& rootId,
+      const std::vector<std::string>& paths,
+      const ObjectFetchContextPtr& context) override;
+
   ImmediateFuture<GetGlobFilesResult> getGlobFiles(
       const RootId& id,
       const std::vector<std::string>& globs,

eden/fs/store/ObjectStore.cpp

@@ -1117,4 +1117,12 @@ ImmediateFuture<bool> ObjectStore::checkPermissionIfExpired(
   return backingStore_->checkPermission(manifestId);
 }
 
+folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+ObjectStore::co_getPathAcls(
+    const RootId& rootId,
+    const std::vector<std::string>& paths,
+    const ObjectFetchContextPtr& context) const {
+  co_return co_await backingStore_->co_getPathAcls(rootId, paths, context);
+}
+
 } // namespace facebook::eden

eden/fs/store/ObjectStore.h

@@ -407,6 +407,12 @@ class ObjectStore : public IObjectStore,
       const ObjectId& manifestId,
       std::chrono::steady_clock::time_point lastCheck) const;
 
+  folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+  co_getPathAcls(
+      const RootId& rootId,
+      const std::vector<std::string>& paths,
+      const ObjectFetchContextPtr& context) const;
+
   /**
    * Get the BackingStore used by this ObjectStore
    */

eden/fs/store/sl/BUCK

@@ -46,6 +46,7 @@ cpp_library(
     srcs = ["SaplingBackingStore.cpp"],
     headers = ["SaplingBackingStore.h"],
     deps = [
+        "fbsource//third-party/fmt:fmt",
         "fbsource//third-party/re2:re2",
         ":sapling_import_request",
         ":sapling_object_id",

eden/fs/store/sl/SaplingBackingStore.cpp

@@ -10,10 +10,12 @@
 #include <algorithm>
 #include <chrono>
 #include <stdexcept>
+#include <string>
 #include <thread>
 #include <utility>
 #include <variant>
 
+#include <fmt/format.h>
 #include <re2/re2.h>
 
 #include <folly/Executor.h>
@@ -280,7 +282,7 @@ void SaplingBackingStore::initializeOBCCounters() {
   getTreePerRepoLatencies_ = monitoring::OBCP99P95P50(
       monitoring::OdsCategoryId::ODS_EDEN,
       fmt::format("eden.store.sapling.fetch_tree_{}_us", repoName_),
-      {hostname});
+      {std::move(hostname)});
   isOBCEnabled_ = true;
 }
 #endif
@@ -2492,6 +2494,79 @@ ImmediateFuture<bool> SaplingBackingStore::checkPermission(
   return result.has_access;
 }
 
+folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+SaplingBackingStore::co_getPathAcls(
+    const RootId& rootId,
+    const std::vector<std::string>& paths,
+    const ObjectFetchContextPtr& context) {
+  auto self = shared_from_this();
+  // TODO(T272514471): Plumb ObjectFetchContext through the Sapling FFI so path
+  // ACL lookups are attributed in fetch traces like other backing-store calls.
+  (void)context;
+  co_await self->faultInjector_.co_checkAsync(
+      "SaplingBackingStore::getPathAcls", rootId.value());
+  co_return co_await folly::coro::co_withExecutor(
+      self->serverThreadPool_,
+      folly::coro::co_invoke(
+          [self, rootId = rootId, paths = std::vector<std::string>(paths)]()
+              -> folly::coro::Task<
+                  std::vector<folly::Try<std::vector<EntryAcl>>>> {
+            rust::Vec<rust::String> rustPaths;
+            rustPaths.reserve(paths.size());
+            std::copy(
+                paths.begin(), paths.end(), std::back_inserter(rustPaths));
+
+            auto result = sapling_backingstore_check_path_permissions(
+                *self->store_.get(),
+                rust::Str{rootId.value().data(), rootId.value().size()},
+                std::move(rustPaths));
+            if (result.error != nullptr) {
+              throw std::runtime_error(result.error->what());
+            }
+
+            std::vector<folly::Try<std::vector<EntryAcl>>> aclInfos;
+            aclInfos.reserve(paths.size());
+            if (result.data.size() != paths.size()) {
+              throw std::runtime_error(
+                  fmt::format(
+                      "path ACL lookup returned {} result(s) for {} path(s)",
+                      result.data.size(),
+                      paths.size()));
+            }
+
+            for (size_t index = 0; index < paths.size(); ++index) {
+              const auto& pathAclInfo = result.data[index];
+              std::string responsePath{pathAclInfo.path};
+              if (responsePath != paths[index]) {
+                throw std::runtime_error(
+                    fmt::format(
+                        "path ACL lookup returned response for {} at index {} instead of {}",
+                        responsePath,
+                        index,
+                        paths[index]));
+              }
+
+              std::string error{pathAclInfo.error};
+              if (!error.empty()) {
+                aclInfos.emplace_back(std::runtime_error(error));
+                continue;
+              }
+
+              std::vector<EntryAcl> entries;
+              entries.reserve(pathAclInfo.entries.size());
+              for (const auto& entry : pathAclInfo.entries) {
+                entries.push_back(
+                    EntryAcl{
+                        std::string{entry.restriction_root},
+                        std::string{entry.repo_region_acl},
+                        std::string{entry.permission_request_group}});
+              }
+              aclInfos.emplace_back(std::move(entries));
+            }
+            co_return aclInfos;
+          }));
+}
+
 void SaplingBackingStore::logBackingStoreFetch(
     const ObjectFetchContext& context,
     folly::Range<SlOidView*> slOids,

eden/fs/store/sl/SaplingBackingStore.h

@@ -672,6 +672,11 @@ class SaplingBackingStore final
       const std::vector<std::string>& prefixes) override;
 
   ImmediateFuture<bool> checkPermission(const ObjectId& manifestId) override;
+  folly::coro::now_task<std::vector<folly::Try<std::vector<EntryAcl>>>>
+  co_getPathAcls(
+      const RootId& rootId,
+      const std::vector<std::string>& paths,
+      const ObjectFetchContextPtr& context) override;
 
   /**
    * The worker runloop function.

eden/scm/lib/backingstore/src/backingstore.rs

@@ -39,6 +39,7 @@ use smallvec::SmallVec;
 use storemodel::BoxIterator;
 use storemodel::FileAuxData;
 use storemodel::FileStore;
+use storemodel::PathAclInfo;
 use storemodel::TreeAuxData;
 use storemodel::TreeEntry;
 use storemodel::TreeStore;
@@ -47,6 +48,7 @@ use types::FetchContext;
 use types::HgId;
 use types::Key;
 use types::RepoPath;
+use types::RepoPathBuf;
 use types::errors::KeyedError;
 
 use crate::ffi::ffi::BackingStoreErrorKind;
@@ -537,6 +539,22 @@ impl BackingStore {
         Ok(true)
     }
 
+    #[instrument(level = "trace", skip(self, paths))]
+    pub fn check_path_permissions(
+        &self,
+        hg_cs_id: &str,
+        paths: Vec<String>,
+    ) -> Result<Vec<PathAclInfo>> {
+        let hg_cs_id = HgId::from_hex(hg_cs_id.as_bytes())?;
+        let path_bufs = paths
+            .into_iter()
+            .map(RepoPathBuf::from_string)
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+        self.maybe_reload()
+            .treestore
+            .check_path_permissions(hg_cs_id, path_bufs)
+    }
+
     #[instrument(level = "trace", skip(self))]
     pub fn witness_file_read(&self, path: &RepoPath, local: bool, pid: u32) {
         let inner = self.inner.load();

eden/scm/lib/backingstore/src/ffi.rs

@@ -262,6 +262,23 @@ pub(crate) mod ffi {
         error: UniquePtr<SaplingBackingStoreError>,
     }
 
+    pub struct PathAclEntry {
+        restriction_root: String,
+        repo_region_acl: String,
+        permission_request_group: String,
+    }
+
+    pub struct PathAclInfo {
+        path: String,
+        error: String,
+        entries: Vec<PathAclEntry>,
+    }
+
+    pub struct GetPathAclInfosResult {
+        data: Vec<PathAclInfo>,
+        error: UniquePtr<SaplingBackingStoreError>,
+    }
+
     extern "Rust" {
         type BackingStore;
 
@@ -349,6 +366,12 @@ pub(crate) mod ffi {
             manifest_id: &[u8],
         ) -> CheckPermissionResult;
 
+        pub fn sapling_backingstore_check_path_permissions(
+            store: &BackingStore,
+            hg_cs_id: &str,
+            paths: Vec<String>,
+        ) -> GetPathAclInfosResult;
+
         pub fn sapling_backingstore_witness_file_read(
             store: &BackingStore,
             path: &str,
@@ -880,6 +903,92 @@ pub fn sapling_backingstore_check_permission(
     }
 }
 
+pub fn sapling_backingstore_check_path_permissions(
+    store: &BackingStore,
+    hg_cs_id: &str,
+    paths: Vec<String>,
+) -> ffi::GetPathAclInfosResult {
+    let requested_paths = paths.clone();
+    match store.check_path_permissions(hg_cs_id, paths) {
+        Ok(results) => {
+            let mut results = results.into_iter();
+            let mut data = Vec::with_capacity(requested_paths.len());
+            for requested_path in requested_paths {
+                let Some(result) = results.next() else {
+                    data.push(ffi::PathAclInfo {
+                        path: requested_path.clone(),
+                        error: format!("path ACL lookup returned no result for {requested_path}"),
+                        entries: Vec::new(),
+                    });
+                    continue;
+                };
+
+                let storemodel::PathAclInfo {
+                    path,
+                    entries,
+                    error,
+                } = result;
+                let response_path = path.to_string();
+                if response_path != requested_path {
+                    let error = format!(
+                        "path ACL lookup returned response for {response_path} instead of {requested_path}"
+                    );
+                    data.push(ffi::PathAclInfo {
+                        path: requested_path,
+                        error,
+                        entries: Vec::new(),
+                    });
+                    continue;
+                }
+
+                let Some(error) = error else {
+                    let entries = entries
+                        .into_iter()
+                        .map(|entry| ffi::PathAclEntry {
+                            restriction_root: entry.restriction_root.to_string(),
+                            repo_region_acl: entry.repo_region_acl,
+                            permission_request_group: entry.permission_request_group,
+                        })
+                        .collect();
+                    data.push(ffi::PathAclInfo {
+                        path: requested_path,
+                        error: String::new(),
+                        entries,
+                    });
+                    continue;
+                };
+
+                data.push(ffi::PathAclInfo {
+                    path: requested_path,
+                    error,
+                    entries: Vec::new(),
+                });
+            }
+
+            if let Some(extra) = results.next() {
+                let extra_count = 1 + results.count();
+                return ffi::GetPathAclInfosResult {
+                    data: Vec::new(),
+                    error: into_backingstore_err(anyhow!(
+                        "path ACL lookup returned {} extra result(s), starting with {}",
+                        extra_count,
+                        extra.path
+                    )),
+                };
+            }
+
+            ffi::GetPathAclInfosResult {
+                data,
+                error: UniquePtr::null(),
+            }
+        }
+        Err(error) => ffi::GetPathAclInfosResult {
+            data: Vec::new(),
+            error: into_backingstore_err(error),
+        },
+    }
+}
+
 pub fn sapling_backingstore_witness_file_read(
     store: &BackingStore,
     path: &str,