restricted_paths: test read_only manifest-id recording

Summary:
## This stack
Decouple restricted_paths config from the manifest_id store (T277178795). Replace `path_acls` (path -> ACL) with per-path `PathRestrictionMetadata` carrying the REPO_REGION ACL and optional permission-request group, so a future `read_only` flag can freeze manifest-id-store growth without dropping enforcement. Thrift `path_acls` is retained as a parser fallback. The configerator thrift source is the separately-published D109697491.

## This diff (no-op)
Test-only: end-to-end coverage for the `read_only` behaviour introduced earlier in the stack (D109827082). No production code changes.

Two tests in the `restricted_paths` integration suite. First, that `read_only` stops new manifest-id-store recording: a contrast test runs the same fixture writable (derivation records one entry per manifest type -- Hg, HgAugmented, Fsnode, ContentManifest) and then with every config path `read_only` (records nothing), exercising all four per-entry derivation gates end-to-end. Second, that `read_only` paths still count as restricted: with all config paths `read_only`, both `may_have_restricted_paths()` and `has_restricted_paths()` stay true across every `AclManifestMode` (Disabled/Shadow/Both/Authoritative), since `read_only` gates recording only, never detection or enforcement.

Small test-infra additions support these: a `with_config_paths_read_only` builder toggle (default false, so existing tests are unchanged), `manifest_id_store_entries` exposed on the scenario result for structural assertions, and a `build_repo_only` helper for predicate-only tests.

Follow-up: the `mapping.rs` `track_all_restricted_paths` backfill `!read_only` filter is not covered here -- it is reachable only via the untopological `derive_from_predecessor` path. `AclManifest` derivation does not branch on `read_only`.

___

Differential Revision: D109838120

fbshipit-source-id: 31719d168a4b9c68e1a96112e78d4f2cbe975f91

Author: gustavoavena

eden/mononoke/repo_attributes/restricted_paths/test/main.rs

@@ -5,6 +5,7 @@
  * GNU General Public License version 2.
  */
 
+use std::collections::HashSet;
 use std::str::FromStr;
 
 use anyhow::Result;
@@ -1391,6 +1392,120 @@ async fn test_single_dir_restricted_and_unrestricted(fb: FacebookInit) -> Result
     Ok(())
 }
 
+// With every config restricted path flipped to read_only, derivation must not
+// record new manifest-id-store entries -- while the same writable paths still do.
+#[mononoke::fbinit_test]
+async fn test_read_only_config_paths_record_no_new_manifest_id_entries(
+    fb: FacebookInit,
+) -> Result<()> {
+    let restricted_paths = vec![(
+        NonRootMPath::new("restricted/dir")?,
+        MononokeIdentity::from_str("REPO_REGION:restricted_acl")?,
+    )];
+    // A file directly under the restricted root, so the directory is materialized
+    // in the derived manifests and is eligible for recording.
+    let file_path_changes = vec![("restricted/dir/a", None)];
+
+    // Baseline: writable config paths record one manifest-id-store entry per
+    // manifest type for the restricted root.
+    let writable = RestrictedPathsTestDataBuilder::new()
+        .with_config_restricted_paths(restricted_paths.clone())
+        .with_file_path_changes(file_path_changes.clone())
+        .build(fb)
+        .await?
+        .observe_restricted_paths_scenario(&[])
+        .await?;
+
+    let recorded_types: HashSet<ManifestType> = writable
+        .manifest_id_store_entries
+        .iter()
+        .map(|entry| entry.manifest_type.clone())
+        .collect();
+    assert_eq!(
+        recorded_types,
+        HashSet::from([
+            ManifestType::Hg,
+            ManifestType::HgAugmented,
+            ManifestType::Fsnode,
+            ManifestType::ContentManifest,
+        ]),
+        "writable restricted paths should record an entry for every manifest type, got {:?}",
+        writable.manifest_id_store_entries,
+    );
+
+    // Same fixture with every config path marked read_only: no new entries are
+    // recorded. The store stays empty because every recording site (the four
+    // per-entry derivation gates) consults read_only via
+    // should_record_manifest_id_entry.
+    let read_only = RestrictedPathsTestDataBuilder::new()
+        .with_config_restricted_paths(restricted_paths)
+        .with_config_paths_read_only(true)
+        .with_file_path_changes(file_path_changes)
+        .build(fb)
+        .await?
+        .observe_restricted_paths_scenario(&[])
+        .await?;
+    assert!(
+        read_only.manifest_id_store_entries.is_empty(),
+        "read_only restricted paths must not record new manifest-id entries, got {:?}",
+        read_only.manifest_id_store_entries,
+    );
+
+    Ok(())
+}
+
+// read_only gates derivation recording only; it must NOT change whether a repo
+// is considered to have restricted paths. With every config path read_only,
+// both may_have_restricted_paths and has_restricted_paths must stay true across
+// every AclManifest mode. (read_only is deliberately true here precisely to
+// prove these predicates ignore it.)
+#[mononoke::fbinit_test]
+async fn test_read_only_config_paths_still_count_as_restricted(fb: FacebookInit) -> Result<()> {
+    let restricted_paths = vec![
+        (
+            NonRootMPath::new("restricted/dir")?,
+            MononokeIdentity::from_str("REPO_REGION:restricted_acl")?,
+        ),
+        (
+            NonRootMPath::new("other/secret")?,
+            MononokeIdentity::from_str("REPO_REGION:other_acl")?,
+        ),
+    ];
+
+    for mode in [
+        AclManifestMode::Disabled,
+        AclManifestMode::Shadow,
+        AclManifestMode::Both,
+        AclManifestMode::Authoritative,
+    ] {
+        let repo = RestrictedPathsTestDataBuilder::new()
+            .with_config_restricted_paths(restricted_paths.clone())
+            .with_config_paths_read_only(true)
+            .with_acl_manifest_mode(mode)
+            .build(fb)
+            .await?
+            .build_repo_only()
+            .await?;
+
+        // `has_restricted_paths` is the load-bearing, read_only-agnostic check in
+        // every mode. `may_have_restricted_paths` additionally confirms no mode
+        // starts reporting the repo as unrestricted; it short-circuits on the
+        // mode for non-Disabled, so it is strongest in Disabled mode.
+        assert!(
+            repo.restricted_paths().may_have_restricted_paths(),
+            "may_have_restricted_paths must be true for read-only paths in mode {mode:?}",
+        );
+        assert!(
+            repo.restricted_paths()
+                .config_based()
+                .has_restricted_paths(),
+            "has_restricted_paths must be true for read-only paths in mode {mode:?}",
+        );
+    }
+
+    Ok(())
+}
+
 // Multiple restricted directories generate multiple entries in the manifest
 #[mononoke::fbinit_test]
 async fn test_multiple_restricted_dirs(fb: FacebookInit) -> Result<()> {

eden/mononoke/repo_attributes/restricted_paths/test/utils.rs

@@ -70,6 +70,8 @@ pub const TEST_CLIENT_MAIN_ID: &str = "user:myusername0";
 
 pub struct RestrictedPathsScenarioResult {
     pub scuba_logs: Vec<ScubaAccessLogSample>,
+    /// All entries present in the manifest-id store after the scenario ran.
+    pub manifest_id_store_entries: Vec<RestrictedPathManifestIdEntry>,
 }
 
 struct RestrictedPathsScenario {
@@ -93,6 +95,9 @@ pub struct RestrictedPathsTestData {
     enforcement_scenarios: Vec<(Vec<EnforcementConditionSet>, bool)>,
     /// Config-backed restrictions written into `RestrictedPathsConfig.path_acls`.
     config_restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
+    /// When true, every config restricted path is marked `read_only` in its
+    /// `PathRestrictionMetadata`.
+    config_paths_read_only: bool,
     /// AclManifest-backed restrictions materialized as `.slacl` files.
     acl_manifest_restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
     acl_manifest_mode: AclManifestMode,
@@ -105,6 +110,7 @@ pub struct RestrictedPathsTestData {
 #[derive(Clone)]
 pub struct RestrictedPathsTestDataBuilder {
     config_restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
+    config_paths_read_only: bool,
     acl_manifest_restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
     acl_manifest_mode: AclManifestMode,
     tooling_allowlist_group: Option<String>,
@@ -341,6 +347,7 @@ impl RestrictedPathsTestDataBuilder {
     pub fn new() -> Self {
         Self {
             config_restricted_paths: vec![],
+            config_paths_read_only: false,
             acl_manifest_restricted_paths: vec![],
             acl_manifest_mode: AclManifestMode::Disabled,
             tooling_allowlist_group: None,
@@ -373,6 +380,13 @@ impl RestrictedPathsTestDataBuilder {
         self
     }
 
+    /// Mark every config restricted path as `read_only` in its
+    /// `PathRestrictionMetadata`. Defaults to false.
+    pub fn with_config_paths_read_only(mut self, read_only: bool) -> Self {
+        self.config_paths_read_only = read_only;
+        self
+    }
+
     pub fn with_acl_manifest_restricted_paths(
         mut self,
         restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
@@ -534,6 +548,7 @@ impl RestrictedPathsTestDataBuilder {
             expected_scuba_logs: self.expected_scuba_logs,
             enforcement_scenarios: self.enforcement_scenarios,
             config_restricted_paths: self.config_restricted_paths,
+            config_paths_read_only: self.config_paths_read_only,
             acl_manifest_restricted_paths: self.acl_manifest_restricted_paths,
             acl_manifest_mode: self.acl_manifest_mode,
             repo_regions_config: self.repo_regions_config,
@@ -589,6 +604,13 @@ impl RestrictedPathsTestData {
         Ok(())
     }
 
+    /// Build a scenario repo without running derivation or access operations.
+    /// For tests that only inspect config-derived predicates such as
+    /// `may_have_restricted_paths`.
+    pub async fn build_repo_only(&self) -> Result<TestRepo> {
+        Ok(self.setup_scenario_repo(&[]).await?.repo)
+    }
+
     /// Runs the standard access scenario and returns the Scuba rows it emitted.
     pub async fn observe_restricted_paths_scenario(
         &self,
@@ -614,8 +636,16 @@ impl RestrictedPathsTestData {
             .await?;
         tokio::time::sleep(std::time::Duration::from_millis(200)).await;
 
+        let manifest_id_store_entries = scenario
+            .repo
+            .restricted_paths()
+            .config_based()
+            .manifest_id_store()
+            .get_all_entries(&self.ctx)
+            .await?;
         Ok(RestrictedPathsScenarioResult {
             scuba_logs: deserialize_scuba_log_file(&scenario.log_path)?,
+            manifest_id_store_entries,
         })
     }
 
@@ -645,8 +675,16 @@ impl RestrictedPathsTestData {
             .await?;
         tokio::time::sleep(std::time::Duration::from_millis(200)).await;
 
+        let manifest_id_store_entries = scenario
+            .repo
+            .restricted_paths()
+            .config_based()
+            .manifest_id_store()
+            .get_all_entries(&self.ctx)
+            .await?;
         Ok(RestrictedPathsScenarioResult {
             scuba_logs: deserialize_scuba_log_file(&scenario.log_path)?,
+            manifest_id_store_entries,
         })
     }
 
@@ -996,6 +1034,7 @@ impl RestrictedPathsTestData {
                     .sorted()
                     .collect::<Vec<_>>(),
                 manifest_id_store_entries
+                    .clone()
                     .into_iter()
                     .sorted()
                     .collect::<Vec<_>>()
@@ -1018,7 +1057,10 @@ impl RestrictedPathsTestData {
         println!(
             "Scenario {scenario_idx} finished SUCCESSFULLY with expect_enforcement: {expect_enforcement} and enforcement_condition_sets: {enforcement_condition_sets:#?}"
         );
-        Ok(RestrictedPathsScenarioResult { scuba_logs })
+        Ok(RestrictedPathsScenarioResult {
+            scuba_logs,
+            manifest_id_store_entries,
+        })
     }
 
     async fn setup_scenario_repo(
@@ -1031,6 +1073,7 @@ impl RestrictedPathsTestData {
         let repo = setup_test_repo(
             &self.ctx,
             self.config_restricted_paths.clone(),
+            self.config_paths_read_only,
             self.acl_manifest_mode,
             self.tooling_allowlist_group.clone(),
             acls,
@@ -1245,6 +1288,7 @@ fn setup_acl_file(acls: Acls) -> Result<std::path::PathBuf> {
 async fn setup_test_repo(
     ctx: &CoreContext,
     config_restricted_paths: Vec<(NonRootMPath, MononokeIdentity)>,
+    config_paths_read_only: bool,
     acl_manifest_mode: AclManifestMode,
     tooling_allowlist_group: Option<String>,
     acls: Acls,
@@ -1267,7 +1311,7 @@ async fn setup_test_repo(
                 PathRestrictionMetadata {
                     repo_region_acl: acl,
                     permission_request_group: None,
-                    read_only: false,
+                    read_only: config_paths_read_only,
                 },
             )
         })