# stream checkpoint policy decoding

`9a2b697`→[main](/content/gh/entireio/cli/commits/main/index.html)·

pfleidi·3w ago·2 files·+29 added/-2 removed

Decode policy JSON from a bounded reader instead of materializing the blob contents first.

This keeps policy reads small and rejects oversized policy blobs before parsing.

## Sessions

9a6f4f9b4c41View transcript

[?\
Checkpoint Policy Command and Feature ImprovementsCodex·GPT-5.5·4 steps](/content/gh/entireio/cli/session/019ef6e7-b75d-7050-920a-93eed6d34c27#timeline-9a6f4f9b4c41/index.html)

## Changes

2

- cmd/entire/cli/checkpointpolicy

- Mstore.go+18/-2

- Mstore\_test.go+11

```
4 unmodified lines

5
6
7
8
9
10
11
5 unmodified lines

17
18
19
20
21
22
23
24
81 unmodified lines

106
107
108
106
109
110
111
112
113
114
115
116
117
118
111
119
120
121
122
123
124
125
126
127
128
129
130

4 unmodified lines

"encoding/json"
	"errors"
	"fmt"
	"io"

"github.com/entireio/cli/cmd/entire/cli/checkpoint"
	"github.com/entireio/cli/cmd/entire/cli/jsonutil"
5 unmodified lines

const PolicyFileName = "policy.json"

const maxPolicyFileBytes = 64 * 1024

const RefName = plumbing.ReferenceName("refs/entire/policies/checkpoint")

type Source string
81 unmodified lines

if err != nil {
		return State{}, fmt.Errorf("read %s: %w", PolicyFileName, err)
	}
	content, err := file.Contents()
	if file.Size > maxPolicyFileBytes {
		return State{}, fmt.Errorf("parse %s: file exceeds %d bytes", PolicyFileName, maxPolicyFileBytes)
	}
	reader, err := file.Reader()
	if err != nil {
		return State{}, fmt.Errorf("read %s contents: %w", PolicyFileName, err)
	}
	defer reader.Close()

var policy Policy
	if err := json.Unmarshal([]byte(content), &policy); err != nil {
decoder := json.NewDecoder(io.LimitReader(reader, maxPolicyFileBytes))
	if err := decoder.Decode(&policy); err != nil {
		return State{}, fmt.Errorf("parse %s: %w", PolicyFileName, err)
	}
	var trailingValue json.RawMessage
	if err := decoder.Decode(&trailingValue); !errors.Is(err, io.EOF) {
		if err == nil {
			return State{}, fmt.Errorf("parse %s: multiple JSON values", PolicyFileName)
		}
		return State{}, fmt.Errorf("parse %s: %w", PolicyFileName, err)
	}
	return State{Policy: Normalize(policy), Source: source, Hash: hash}, nil
```

Mcmd/entire/cli/checkpointpolicy/store.go+18/-2

```
2 unmodified lines

3
4
5
6
7
8
9
43 unmodified lines

53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

2 unmodified lines

import (
	"context"
	"encoding/json"
	"strings"
	"testing"

"github.com/entireio/cli/cmd/entire/cli/checkpoint"
43 unmodified lines

require.ErrorContains(t, err, "parse policy.json")
}

func TestReadLocalPolicyRejectsOversizedJSON(t *testing.T) {
	t.Parallel()
	repo := initPolicyRepo(t)
	data := []byte(`{"checkpoint_version":"branch-v1","checkpoint_min_version":"` + strings.Repeat("a", 70*1024) + `"}`)
	writeRawPolicyCommit(t, repo, data, plumbing.ZeroHash)

_, err := checkpointpolicy.ReadLocal(t.Context(), repo)
	require.ErrorContains(t, err, "parse policy.json")
}

func TestReadLocalPolicyAllowsUnsupportedPolicy(t *testing.T) {
	t.Parallel()
	repo := initPolicyRepo(t)