t5567: test lib-httpd CGI helpers under concurrent requests

Add a test that exercises the cgi-lib.sh primitives directly and the
apply-one-time-script.sh helper built on them, without a web server so the
races can be forced. The primitive tests fire several concurrent workers and
assert that cgi_claim and cgi_first_request pick exactly one winner; the
end-to-end test uses FIFOs to hold one request inside the helper while a
second claims and removes the marker, which is the overlap that used to answer
HTTP 500.

Signed-off-by: Michael Montalbo <mmontalbo@gmail.com>

Author: mmontalbo

t/meson.build

@@ -707,6 +707,7 @@ integration_tests = [
   't5564-http-proxy.sh',
   't5565-push-multiple.sh',
   't5566-push-group.sh',
+  't5567-one-time-script.sh',
   't5570-git-daemon.sh',
   't5571-pre-push-hook.sh',
   't5572-pull-submodule.sh',

t/t5567-one-time-script.sh

@@ -0,0 +1,139 @@
+#!/bin/sh
+
+test_description='lib-httpd CGI helpers are safe under concurrent requests
+
+The web server runs requests concurrently, and a single Git operation can have
+two requests to one endpoint in flight at once (for example a partial fetch
+that lazily fetches a missing promisor object). The CGI helpers under
+t/lib-httpd therefore keep any cross-request state through the primitives in
+cgi-lib.sh, which must remain safe when several requests race. Exercise those
+primitives directly, and exercise the apply-one-time-script.sh helper that is
+built on them, without a real web server so the races can be forced.
+'
+
+. ./test-lib.sh
+
+CGI_LIB="$TEST_DIRECTORY/lib-httpd/cgi-lib.sh"
+export CGI_LIB
+
+test_expect_success 'set up concurrency runner' '
+	# race N CMD: run N concurrent copies of "CMD <i>" and wait for all.
+	# Keeping the "&" inside a helper script (rather than a loop in a test
+	# body) is both chainlint-clean and gives each worker its own process.
+	write_script race <<-\EOF
+	n=$1
+	shift
+	i=0
+	while test $i -lt "$n"
+	do
+		i=$((i + 1))
+		"$@" "$i" &
+	done
+	wait
+	EOF
+'
+
+test_expect_success 'cgi_claim is won by exactly one concurrent request' '
+	rm -rf wins && mkdir wins &&
+	>marker &&
+	write_script claim-worker <<-\EOF &&
+	. "$CGI_LIB" &&
+	cgi_claim marker &&
+	>"wins/$1"
+	EOF
+
+	./race 8 ./claim-worker &&
+
+	echo 1 >expect &&
+	ls wins | wc -l | tr -d " " >actual &&
+	test_cmp expect actual
+'
+
+test_expect_success 'cgi_first_request succeeds exactly once' '
+	rm -rf wins state && mkdir wins &&
+	write_script first-worker <<-\EOF &&
+	. "$CGI_LIB" &&
+	cgi_first_request state &&
+	>"wins/$1"
+	EOF
+
+	./race 8 ./first-worker &&
+
+	echo 1 >expect &&
+	ls wins | wc -l | tr -d " " >actual &&
+	test_cmp expect actual
+'
+
+test_expect_success PIPE 'apply-one-time-script tolerates a concurrent request' '
+	rm -rf workdir fakebin &&
+	mkdir workdir fakebin &&
+	cp "$TEST_DIRECTORY"/lib-httpd/cgi-lib.sh workdir/ &&
+	ENTERED="$PWD/entered" &&
+	GATE="$PWD/gate" &&
+	DONE="$PWD/done" &&
+	export ENTERED GATE DONE &&
+	mkfifo "$ENTERED" "$GATE" "$DONE" &&
+
+	# Stand in for git-http-backend. The modify role returns a response
+	# containing "packfile", which the one-time script rewrites. The
+	# passthrough role returns a response that is left untouched, but first
+	# announces that it has entered the helper and then blocks, so that it
+	# is still in flight when the modify role claims and removes the marker.
+	write_script fakebin/git-http-backend <<-\EOF &&
+	printf "Status: 200 OK\r\n"
+	printf "Content-Type: application/x-git-result\r\n"
+	printf "\r\n"
+	if test "$ROLE" = modify
+	then
+		printf "packfile\n"
+	else
+		echo entered >"$ENTERED"
+		read released <"$GATE"
+		printf "refs\n"
+	fi
+	EOF
+
+	write_script workdir/one-time-script <<-\EOF &&
+	if grep packfile "$1" >/dev/null
+	then
+		sed "/packfile/q" "$1" &&
+		printf "REPLACED\n"
+	else
+		cat "$1"
+	fi
+	EOF
+
+	HELPER="$TEST_DIRECTORY/lib-httpd/apply-one-time-script.sh" &&
+	GIT_EXEC_PATH="$PWD/fakebin" &&
+	export GIT_EXEC_PATH &&
+
+	# Launch the passthrough request in the background. It enters the
+	# helper, signals us through ENTERED, blocks on GATE inside the fake
+	# backend, and signals DONE once it has run to completion (even if the
+	# helper fails, so that a broken helper fails this test instead of
+	# hanging it).
+	(
+		cd workdir &&
+		{ ROLE=passthrough sh "$HELPER" >../passthrough.out 2>../passthrough.err || true; } &&
+		echo done >"$DONE" &
+	) &&
+
+	read entered <"$ENTERED" &&
+
+	# Run the modifying request to completion while the passthrough request
+	# is still blocked.
+	(
+		cd workdir &&
+		ROLE=modify sh "$HELPER" >../modify.out 2>../modify.err
+	) &&
+
+	echo released >"$GATE" &&
+	read finished <"$DONE" &&
+
+	test_must_be_empty passthrough.err &&
+	test_must_be_empty modify.err &&
+	grep "Status: 200 OK" passthrough.out &&
+	grep "Status: 200 OK" modify.out
+'
+
+test_done