test(vfs): cover path canonicalization and lock aliasing on the memory backend

Adds tests asserting canonical_native_path/resolve_native_path reject
escaping and drive-letter components, and that the in-memory VFS treats
equivalent path spellings as one lock domain and one file, matching the
native backends' contract. Also switches two String clones in MemVfs
away from unnecessary to_string() calls.

Author: farhan-syah

src/vfs/memory.rs

@@ -125,7 +125,7 @@ impl Vfs for MemVfs {
             }
             (OpenMode::CreateNew | OpenMode::CreateOrOpen, false) => {
                 let inode = Arc::new(Mutex::new(MemInode { data: Vec::new() }));
-                files.insert(path.to_string(), inode.clone());
+                files.insert(path.clone(), inode.clone());
                 (inode, true)
             }
         };
@@ -155,7 +155,7 @@ impl Vfs for MemVfs {
     async fn list_dir(&self, path: &str) -> Result<Vec<String>> {
         let path = canonical_native_path(path)?;
         let prefix = if path.ends_with('/') {
-            path.to_string()
+            path.clone()
         } else {
             format!("{path}/")
         };

src/vfs/traits.rs

@@ -636,6 +636,50 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_logical_path_normalizes_its_separators_and_leading_slash() {
+        for spelling in ["/seg/abc", "seg/abc", "seg\\abc", "/seg/abc/"] {
+            assert_eq!(canonical_native_path(spelling).unwrap(), "/seg/abc");
+        }
+        assert_eq!(canonical_native_path("").unwrap(), "/");
+        assert_eq!(canonical_native_path("/").unwrap(), "/");
+    }
+
+    #[test]
+    fn a_parent_or_current_directory_component_never_resolves() {
+        for escape in ["../escaped", "a/../../escaped", "./a", "a//b", "a/./b"] {
+            assert!(
+                canonical_native_path(escape).is_err(),
+                "{escape:?} must not canonicalize"
+            );
+        }
+    }
+
+    #[test]
+    fn a_drive_letter_component_is_rejected_wherever_it_appears() {
+        // Rejected on every target, not just the one that gives it meaning.
+        // A platform prefix is only recognised in leading position, so a drive
+        // letter deeper in the path parses as an ordinary name — and pushing it
+        // would replace the root outright rather than extend it.
+        for drive in ["C:", "a/C:/b", "C:/escaped", "a/C:"] {
+            assert!(
+                canonical_native_path(drive).is_err(),
+                "{drive:?} must not canonicalize"
+            );
+        }
+    }
+
+    #[test]
+    fn a_resolved_path_always_stays_under_its_root() {
+        let root = std::path::Path::new("/srv/pagedb");
+        assert_eq!(
+            resolve_native_path(root, "seg/abc").unwrap(),
+            root.join("seg").join("abc")
+        );
+        assert!(resolve_native_path(root, "../escaped").is_err());
+        assert!(resolve_native_path(root, "a/C:/b").is_err());
+    }
+
     #[test]
     fn readfile_len_accepts_u32_max() {
         assert_eq!(checked_readfile_len(u32::MAX as usize).unwrap(), u32::MAX);
@@ -656,7 +700,16 @@ mod tests {
     #[test]
     fn read_count_rejects_overreported_completion() {
         let err = checked_read_count(11, 10).unwrap_err();
-        assert!(matches!(err, crate::errors::PagedbError::Io(_)));
+        assert!(
+            matches!(
+                err,
+                crate::errors::PagedbError::VfsContractViolated {
+                    operation: "read_at",
+                    ..
+                }
+            ),
+            "expected VfsContractViolated, got {err:?}"
+        );
     }
 
     #[test]
@@ -796,7 +849,16 @@ mod tests {
     fn write_progress_rejects_overreported_count() {
         let mut offset = 7;
         let err = checked_write_progress(&mut offset, 11, 10).unwrap_err();
-        assert!(matches!(err, crate::errors::PagedbError::Io(_)));
+        assert!(
+            matches!(
+                err,
+                crate::errors::PagedbError::VfsContractViolated {
+                    operation: "write_at",
+                    ..
+                }
+            ),
+            "expected VfsContractViolated, got {err:?}"
+        );
         assert_eq!(offset, 7, "failed progress must not advance offset");
     }
 

tests/vfs_memory.rs

@@ -208,3 +208,51 @@ async fn read_mode_handle_cannot_write() {
     let err = g.write_at(0, b"nope").await.err().unwrap();
     assert!(matches!(err, PagedbError::ReadOnly));
 }
+
+/// The in-memory backend is the one nearly every test runs on, so it has to
+/// honour the same logical-path contract as the native backends. Spellings that
+/// name one file must occupy one lock domain here too, or the suite stops being
+/// able to catch path aliasing at all.
+#[tokio::test(flavor = "current_thread")]
+async fn equivalent_spellings_share_one_lock_domain() {
+    let vfs = MemVfs::new();
+    let held = vfs.lock_exclusive("/db.lock").await.unwrap();
+    for alias in ["db.lock", "/db.lock", "db.lock/"] {
+        assert!(
+            matches!(
+                vfs.lock_exclusive(alias).await,
+                Err(pagedb::PagedbError::AlreadyLocked)
+            ),
+            "{alias:?} must contend with the held lock"
+        );
+    }
+    drop(held);
+    vfs.lock_exclusive("db.lock").await.unwrap();
+}
+
+/// Equivalent spellings must also name one file.
+#[tokio::test(flavor = "current_thread")]
+async fn equivalent_spellings_name_one_file() {
+    let vfs = MemVfs::new();
+    let mut f = vfs.open("seg/one", OpenMode::CreateNew).await.unwrap();
+    f.write_at(0, b"payload").await.unwrap();
+    drop(f);
+
+    let mut buf = [0u8; 7];
+    let g = vfs.open("/seg/one", OpenMode::Read).await.unwrap();
+    assert_eq!(g.read_at(0, &mut buf).await.unwrap(), 7);
+    assert_eq!(&buf, b"payload");
+    assert_eq!(vfs.list_dir("/seg").await.unwrap(), vec!["one".to_string()]);
+}
+
+/// A path that escapes the root is rejected by the in-memory backend as well.
+#[tokio::test(flavor = "current_thread")]
+async fn a_path_that_escapes_the_root_is_rejected() {
+    let vfs = MemVfs::new();
+    for escape in ["../escaped", "a/../../escaped", "a/C:/b"] {
+        assert!(
+            vfs.open(escape, OpenMode::CreateNew).await.is_err(),
+            "{escape:?} must not open"
+        );
+    }
+}