Handle dangling readonly mount links

Author: chubes4

packages/runtime-playground/src/mount-materialization.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto"
-import { cp, mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises"
+import { cp, lstat, mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path"
 import { materializationPhaseResult, namedFileTreeSkipPolicyNames, phpStringArrayLiteral, type MaterializationPhaseResult, type MountSpec } from "@automattic/wp-codebox-core"
@@ -83,7 +83,22 @@ export async function stageReadonlyPlaygroundMounts(mounts: MountSpec[]): Promis
         return mount
       }
       const source = join(root, `${index}-${basename(mount.source) || "mount"}`)
-      await cp(mount.source, source, { recursive: mount.type !== "file", dereference: true })
+      await stat(mount.source)
+      await cp(mount.source, source, {
+        recursive: mount.type !== "file",
+        dereference: true,
+        filter: async (candidate) => {
+          const entry = await lstat(candidate)
+          if (!entry.isSymbolicLink()) return true
+          try {
+            await stat(candidate)
+            return true
+          } catch (error) {
+            if ((error as NodeJS.ErrnoException).code === "ENOENT") return false
+            throw error
+          }
+        },
+      })
       return { ...mount, source }
     }))
     const failedMount = stagedMountResults.find((result) => result.status === "rejected")

tests/playground-readonly-mounts.test.ts

@@ -53,11 +53,20 @@ try {
   await symlink("missing.php", join(danglingSource, "build.sh"))
   await Promise.all(Array.from({ length: 500 }, (_, index) => writeFile(join(largeSource, `File${index}.php`), `<?php return ${index};\n`)))
   const stagingDirectoriesBefore = await readonlyStagingDirectories()
-  await assert.rejects(stageReadonlyPlaygroundMounts([
+  await using danglingStaging = await stageReadonlyPlaygroundMounts([
     { source: danglingSource, target: "/dangling", mode: "readonly" },
+  ])
+  const stagedDanglingSource = danglingStaging.mounts[0]?.source
+  assert.ok(stagedDanglingSource)
+  await assert.rejects(access(join(stagedDanglingSource, "build.sh")), /ENOENT/, "unresolved links must be omitted from isolated readonly staging")
+  const stagingDirectoriesWithDangling = await readonlyStagingDirectories()
+  assert.equal(stagingDirectoriesWithDangling.length, stagingDirectoriesBefore.length + 1)
+
+  await assert.rejects(stageReadonlyPlaygroundMounts([
+    { source: join(root, "missing-source"), target: "/missing", mode: "readonly" },
     { source: largeSource, target: "/large", mode: "readonly" },
   ]), /ENOENT/, "the source failure must not be masked by cleanup racing another mount copy")
-  assert.deepEqual(await readonlyStagingDirectories(), stagingDirectoriesBefore, "failed concurrent staging must remove its temporary root")
+  assert.deepEqual(await readonlyStagingDirectories(), stagingDirectoriesWithDangling, "failed concurrent staging must remove its temporary root")
 
   const beforeReadonlyHash = sha256(await readFile(readonlySource))
   const server = await startPlaygroundCliServer(spec, [