security.go RawHistoryFolder

1// Package sessionsecurity supplies a coherent defensive session gate to
2// boundaries outside the Wayland display goroutine. It owns no window state.
3package sessionsecurity
4
5import (
6	"errors"
7	"math"
8	"sync/atomic"
9
10	"github.com/bnema/neferwl/internal/ports"
11)
12
13var (
14	ErrGenerationExhausted = errors.New("session security generation exhausted")
15	ErrStaleRelease        = errors.New("session security release does not own protection")
16)
17
18// Gate's zero value is an unlocked session. The packed atomic prevents readers
19// from observing a generation from one transition and protection from another.
20// Only the display owner calls Engage and Release.
21type Gate struct{ state atomic.Uint64 }
22
23func unpack(state uint64) ports.SecurityState {
24	return ports.SecurityState{Generation: ports.LockGeneration(state >> 1), Protected: state&1 != 0}
25}
26
27func (g *Gate) Snapshot() ports.SecurityState { return unpack(g.state.Load()) }
28
29// Engage creates a new protected generation, including orphan-owner takeover.
30func (g *Gate) Engage() (ports.SecurityState, error) {
31	for {
32		old := g.state.Load()
33		if old>>1 == math.MaxUint64>>1 {
34			return unpack(old), ErrGenerationExhausted
35		}
36		next := ((old>>1)+1)<<1 | 1
37		if g.state.CompareAndSwap(old, next) {
38			return unpack(next), nil
39		}
40	}
41}
42
43func (g *Gate) Release(expected ports.LockGeneration) (ports.SecurityState, error) {
44	for {
45		old := g.state.Load()
46		state := unpack(old)
47		if !state.Protected || state.Generation != expected {
48			return state, ErrStaleRelease
49		}
50		// Reserve the final generation for protection. Publishing it unlocked
51		// would make every later Engage fail without being able to protect.
52		if old>>1 >= (math.MaxUint64>>1)-1 {
53			return state, ErrGenerationExhausted
54		}
55		next := ((old >> 1) + 1) << 1
56		if g.state.CompareAndSwap(old, next) {
57			return unpack(next), nil
58		}
59	}
60}
61
62var _ ports.SessionSecurityController = (*Gate)(nil)