fix(node): pin non-blob denial and map unreadable store to 503

Add regression coverage ensuring non-blob paths deny with 404, cover the storage acquire timeout on the blob route, pin size-mismatch and metadata parse error branches, map unreadable-store faults to 503, and make the 1s delivery-timeout test deadline-safe.

Refs #407

Author: euxaristia

crates/gitlawb-node/src/api/repos.rs

@@ -584,6 +584,11 @@ pub async fn get_blob(
         if e.downcast_ref::<smart_http::GitServiceTimeout>().is_some() {
             return AppError::Timeout("git service timed out".into());
         }
+        if e.to_string().contains("object store not readable") {
+            return AppError::Overloaded(
+                "object store temporarily unavailable, retry shortly".into(),
+            );
+        }
         AppError::Internal(e)
     })?;
 
@@ -4008,10 +4013,7 @@ mod tests {
         )
         .await;
         assert_eq!(response.status(), StatusCode::OK);
-        assert_eq!(
-            state.git_blob_semaphore.available_permits(),
-            MAX_CONCURRENT_BLOB_READS - 1
-        );
+        assert!(state.git_blob_semaphore.available_permits() <= MAX_CONCURRENT_BLOB_READS - 1);
         // Keep the body alive without ever polling it; the timer must run anyway.
         tokio::time::timeout(std::time::Duration::from_secs(5), async {
             while state.git_blob_semaphore.available_permits() != MAX_CONCURRENT_BLOB_READS {
@@ -4047,11 +4049,77 @@ mod tests {
         let response =
             blob_route_request_path(state, "z6blobunreadable", "file.txt", "203.0.113.31:5000")
                 .await;
-        assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
         use http_body_util::BodyExt;
         let bytes = response.into_body().collect().await.unwrap().to_bytes();
         let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
-        assert_eq!(body["message"], crate::error::INTERNAL_ERROR_MESSAGE);
+        assert_eq!(body["error"], "overloaded");
+    }
+
+    #[cfg(unix)]
+    #[sqlx::test]
+    async fn blob_route_returns_not_found_on_non_blob_path(pool: sqlx::PgPool) {
+        use axum::http::StatusCode;
+        use http_body_util::BodyExt;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let fake = write_fake_git(
+            tmp.path(),
+            "#!/bin/sh\nif [ \"$1\" = rev-parse ]; then exit 0; fi\nif [ \"$2\" = --batch-check ]; then echo '1111111111111111111111111111111111111111 tree 1024'; exit 0; fi\nexit 1\n",
+        );
+        let state = f4_state_with_repo(pool, tmp.path(), &fake, "z6blobtree", "repo", false).await;
+        let response =
+            blob_route_request_path(state, "z6blobtree", "somedir", "203.0.113.31:5000").await;
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+        let bytes = response.into_body().collect().await.unwrap().to_bytes();
+        let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(body["error"], "not_found");
+    }
+
+    #[sqlx::test]
+    async fn blob_route_acquire_timeout_sheds_503_and_releases_permits(pool: sqlx::PgPool) {
+        use axum::http::StatusCode;
+        use http_body_util::BodyExt;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let repos_dir = tmp.path().to_path_buf();
+        let mut state = crate::test_support::test_state(pool.clone()).await;
+        let endpoint = crate::test_support::silent_http_endpoint().await;
+        let tigris =
+            crate::git::tigris::TigrisClient::for_testing_with_endpoint("test-bucket", &endpoint)
+                .await;
+        state.repo_store = crate::git::repo_store::RepoStore::new(repos_dir, Some(tigris), pool);
+        state.push_limiter_trust = crate::rate_limit::TrustedProxy::None;
+        let mut cfg = (*state.config).clone();
+        cfg.git_acquire_timeout_secs = 1;
+        state.config = Arc::new(cfg);
+
+        // Repo exists in DB but not on disk, so acquire attempts Tigris and times out.
+        state
+            .db
+            .upsert_mirror_repo("z6blobacqtimeout", "repo", "/unused", None, false)
+            .await
+            .unwrap();
+
+        let response = blob_route_request_path(
+            state.clone(),
+            "z6blobacqtimeout",
+            "file.txt",
+            "203.0.113.31:5000",
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+        let bytes = response.into_body().collect().await.unwrap().to_bytes();
+        let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(body["error"], "overloaded");
+        assert!(state.git_read_semaphore.available_permits() > 0);
+        assert_eq!(
+            state.git_blob_semaphore.available_permits(),
+            MAX_CONCURRENT_BLOB_READS
+        );
+        assert!(state
+            .git_read_per_caller
+            .try_acquire("203.0.113.31")
+            .is_some());
     }
 
     #[cfg(unix)]

crates/gitlawb-node/src/git/store.rs

@@ -1302,6 +1302,193 @@ exit 1
         );
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn bounded_file_read_guards_size_mismatch_and_metadata_parse() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let td = tempfile::TempDir::new().unwrap();
+        let script = td.path().join("fakegit");
+        let write_fake = |body: &str| {
+            std::fs::write(&script, body).unwrap();
+            let mut permissions = std::fs::metadata(&script).unwrap().permissions();
+            permissions.set_mode(0o755);
+            std::fs::set_permissions(&script, permissions).unwrap();
+        };
+
+        let oid = "c".repeat(40);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+
+        // 1. Size mismatch (emitted bytes fewer than declared size):
+        // Declares 20 bytes, emits 5 bytes ("hello"). max_bytes is 64 (so exceeded is false).
+        write_fake(&format!(
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"rev-parse\" ]; then echo {oid}; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then read spec; echo \"{oid} blob 20\"; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"blob\" ]; then printf hello; exit 0; fi\n\
+             exit 1\n"
+        ));
+        let err = super::read_file_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "main",
+            "mismatch.txt",
+            64,
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string()
+                .contains("size changed between metadata and content reads"),
+            "expected size mismatch error, got: {err:#}"
+        );
+
+        // 2. Metadata parse: missing fields (only 2 fields, no size)
+        write_fake(&format!(
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"rev-parse\" ]; then echo {oid}; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then read spec; echo \"{oid} blob\"; exit 0; fi\n\
+             exit 1\n"
+        ));
+        let err = super::read_file_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "main",
+            "bad.txt",
+            64,
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("omitted the object size"),
+            "expected missing fields error, got: {err:#}"
+        );
+
+        // 3. Metadata parse: non-hex OID
+        write_fake(
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"rev-parse\" ]; then echo nothex; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then read spec; echo \"not-a-valid-hex-oid-1234567890123456789012 blob 10\"; exit 0; fi\n\
+             exit 1\n"
+        );
+        let err = super::read_file_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "main",
+            "bad.txt",
+            64,
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("invalid object metadata"),
+            "expected non-hex oid error, got: {err:#}"
+        );
+
+        // 4. Metadata parse: trailing fields
+        write_fake(&format!(
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"rev-parse\" ]; then echo {oid}; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then read spec; echo \"{oid} blob 10 trailing-junk\"; exit 0; fi\n\
+             exit 1\n"
+        ));
+        let err = super::read_file_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "main",
+            "bad.txt",
+            64,
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("invalid object metadata"),
+            "expected trailing fields error, got: {err:#}"
+        );
+
+        // 5. Metadata parse: multi-record output
+        write_fake(&format!(
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"rev-parse\" ]; then echo {oid}; exit 0; fi\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then read spec; echo \"{oid} blob 10\n{oid} blob 10\"; exit 0; fi\n\
+             exit 1\n"
+        ));
+        let err = super::read_file_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "main",
+            "bad.txt",
+            64,
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("multiple object metadata records"),
+            "expected multi-record error, got: {err:#}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn blob_metadata_bounded_reprobe_budget_exhaustion_returns_timeout() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let td = tempfile::TempDir::new().unwrap();
+        let script = td.path().join("fakegit");
+        std::fs::write(
+            &script,
+            "#!/bin/sh\n\
+             if [ \"$1\" = \"cat-file\" ] && [ \"$2\" = \"--batch-check\" ]; then sleep 0.05; read spec; echo \"$spec missing\"; exit 0; fi\n\
+             exit 1\n",
+        )
+        .unwrap();
+        let mut permissions = std::fs::metadata(&script).unwrap().permissions();
+        permissions.set_mode(0o755);
+        std::fs::set_permissions(&script, permissions).unwrap();
+
+        let deadline = std::time::Instant::now() + std::time::Duration::from_millis(30);
+        let err = super::blob_metadata_bounded(
+            script.to_str().unwrap(),
+            td.path(),
+            "spec",
+            b"spec\n",
+            deadline,
+        )
+        .unwrap_err();
+        assert!(
+            err.downcast_ref::<crate::git::smart_http::GitServiceTimeout>()
+                .is_some(),
+            "exhausted reprobe budget must return GitServiceTimeout, got: {err:#}"
+        );
+    }
+
+    #[test]
+    fn read_file_bounded_denies_non_blob_paths() {
+        let td = tempfile::TempDir::new().unwrap();
+        let work = td.path();
+        let run = |args: &[&str]| {
+            let status = std::process::Command::new("git")
+                .args(args)
+                .current_dir(work)
+                .status()
+                .unwrap();
+            assert!(status.success(), "git {args:?} failed");
+        };
+        run(&["init", "-q"]);
+        run(&["config", "user.email", "t@t"]);
+        run(&["config", "user.name", "t"]);
+        std::fs::create_dir(work.join("subfolder")).unwrap();
+        std::fs::write(work.join("subfolder/file.txt"), b"contents").unwrap();
+        run(&["add", "subfolder"]);
+        run(&["commit", "-qm", "add directory"]);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
+
+        // "subfolder" resolves to a tree object in git, not a blob.
+        let read =
+            super::read_file_bounded("git", work, "main", "subfolder", 1024, deadline).unwrap();
+        assert_eq!(read, super::BoundedFileRead::Missing);
+    }
+
     #[test]
     fn resolve_head_bounded_covers_all_fallback_arms() {
         let td = tempfile::TempDir::new().unwrap();