address review: backup group bits, skip no-op fchown

apps/cadcraft/src/control_server.rs

@@ -250,18 +250,17 @@ fn parse_line(bytes: &[u8]) -> Line {
         Ok(v) => v,
         Err(e) => return Line::Reject(format!("bad JSON ({e}); expected one JSON request object per line; closing the connection")),
     };
-    let Value::Object(mut obj) = msg else {
+    let Some(obj) = msg.as_object() else {
         return Line::Reject("not a control request (expected a JSON object); closing the connection".into());
     };
-    let Some(Value::String(method)) = obj.remove("method") else {
+    let Some(method) = obj.get("method").and_then(Value::as_str) else {
         return Line::Reject("not a control request (missing string `method`); closing the connection".into());
     };
-    // Moved out of the parsed object, not cloned: `params` can be most of the line.
     Line::Request {
-        id: obj.remove("id").unwrap_or(Value::Null),
-        method,
-        params: obj.remove("params").unwrap_or(json!({})),
-        token: obj.remove("token").and_then(|t| if let Value::String(t) = t { Some(t) } else { None }),
+        id: obj.get("id").cloned().unwrap_or(Value::Null),
+        method: method.to_string(),
+        params: obj.get("params").cloned().unwrap_or(json!({})),
+        token: obj.get("token").and_then(Value::as_str).map(str::to_string),
     }
 }
 

crates/engine/src/atomic_write.rs

@@ -71,6 +71,8 @@ pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: im
     let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
     let write = (|| {
         if let Some(permissions) = permissions {
+            #[cfg(unix)]
+            let permissions = keep_group(&file, path, permissions);
             file.set_permissions(permissions)?;
         }
         fill(&mut file)?;
@@ -90,6 +92,20 @@ pub fn write_atomic_with(path: &Path, permissions: Option<Permissions>, fill: im
     Ok(())
 }
 
+/// `permissions` for the new file when `path` already exists: the group bits mean "this group" only
+/// if the file is still in the old file's group, so the group is restored first. When it can't be
+/// (the user is not a member of it), the group bits are dropped rather than handed to another group.
+#[cfg(unix)]
+fn keep_group(file: &File, path: &Path, permissions: Permissions) -> Permissions {
+    use std::os::unix::fs::{MetadataExt, PermissionsExt, fchown};
+    let Ok(old) = std::fs::symlink_metadata(path) else { return permissions };
+    // A file already in the old group needs no change (and a restrictive syscall policy may refuse a no-op fchown).
+    if !old.is_file() || file.metadata().is_ok_and(|m| m.gid() == old.gid()) || fchown(file, None, Some(old.gid())).is_ok() {
+        return permissions;
+    }
+    Permissions::from_mode(permissions.mode() & !0o070)
+}
+
 /// Flush `dir` so a rename just made in it survives a crash or power loss (POSIX records a
 /// rename in the directory, not in the file). Best effort: some file systems (network shares)
 /// refuse to sync a directory, and the file itself is already on disk.
@@ -231,6 +247,33 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    /// The replacement keeps the old file's group (when the user is in another group, as `id -G`
+    /// says) together with its mode, so the group bits never name a different group.
+    #[cfg(unix)]
+    #[test]
+    fn keeps_the_group_and_mode_of_the_file_it_replaces() {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt, chown};
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-grp-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("out.bin");
+        std::fs::write(&dest, b"old").unwrap();
+        std::fs::set_permissions(&dest, Permissions::from_mode(0o640)).unwrap();
+        let own = std::fs::metadata(&dest).unwrap().gid();
+        let other = std::process::Command::new("id")
+            .arg("-G")
+            .output()
+            .ok()
+            .and_then(|o| String::from_utf8_lossy(&o.stdout).split_whitespace().filter_map(|g| g.parse::<u32>().ok()).find(|g| *g != own));
+        if let Some(gid) = other {
+            chown(&dest, None, Some(gid)).unwrap();
+        }
+        let want = std::fs::metadata(&dest).unwrap();
+        write_atomic(&dest, b"new").unwrap();
+        let got = std::fs::metadata(&dest).unwrap();
+        assert_eq!((got.gid(), got.mode() & 0o777), (want.gid(), 0o640));
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[cfg(unix)]
     #[test]
     fn does_not_follow_a_planted_temp_symlink() {

crates/engine/src/cmd/array.rs

@@ -177,16 +177,8 @@ fn create(s: &mut Session, objs: &[Handle], base: Vec2, p: ArrayParams, assoc: b
     Ok(json!({ "created": n }))
 }
 
-/// The most objects EXPLODE of one associative array makes from its source objects (ten times the
-/// default MAXARRAY).
-const MAX_EXPLODED_OBJECTS: usize = 1_000_000;
-
 /// EXPLODE of an associative array: every item becomes the objects of its block (the source
 /// objects, or a replacement block's reference), in world coordinates. `None` for other objects.
-///
-/// An array that would explode into more than [`MAX_EXPLODED_OBJECTS`] objects (items times the
-/// objects of the source block, which a file sets freely) is not expanded here: `None`, so EXPLODE
-/// takes the array block's own items.
 pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
     let EntityKind::Insert(ins) = &e.kind else { return None };
     let p = d.array_params(e)?;
@@ -200,12 +192,7 @@ pub(crate) fn explode_array(d: &Drawing, e: &Entity) -> Option<Vec<Entity>> {
             _ => None,
         };
         match source {
-            Some((im, b)) => {
-                if out.len().saturating_add(b.entities.len()) > MAX_EXPLODED_OBJECTS {
-                    return None;
-                }
-                out.extend(b.entities.iter().map(|se| placed(&item, se, &im)));
-            }
+            Some((im, b)) => out.extend(b.entities.iter().map(|se| placed(&item, se, &im))),
             None => out.push(item),
         }
     }

crates/engine/src/cmd/blocks/extract.rs

@@ -2,7 +2,7 @@
 //! block name and values, or one row per reference with its handle, layer, position and
 //! rotation — returned, written to a CSV file and/or inserted as a table. Tags match in any case.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::BTreeMap;
 
 use cadcraft_doc::{EntityKind, Insert};
 use cadcraft_geom::Vec2;
@@ -88,34 +88,17 @@ fn matches(spec: &str, text: &str) -> bool {
     spec.split(',').any(|p| wildcard(p.trim(), text))
 }
 
-/// The constant attribute values of a block definition whose tags `tags` selects.
-fn constants(b: &cadcraft_doc::Block, tags: &str) -> Vec<(String, String)> {
-    let mut v: Vec<(String, String)> = Vec::new();
-    for e in b.entities.iter() {
-        if let EntityKind::AttDef(a) = &e.kind
-            && a.constant
-            && matches(tags, &a.tag.to_ascii_uppercase())
-            && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
-        {
-            v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
-        }
-    }
-    v
-}
-
-/// The attribute values of `ins` that `o.tags` selects: its own, then the constant ones of its
-/// block (`consts`, read once per block). Values no column shows are not copied.
-fn values(ins: &Insert, consts: &[(String, String)], tags: &str) -> Vec<(String, String)> {
-    let mut v: Vec<(String, String)> = ins
-        .attribs
-        .iter()
-        .map(|a| (a.tag.to_ascii_uppercase(), a))
-        .filter(|(t, _)| matches(tags, t))
-        .map(|(t, a)| (t, a.text.value.clone()))
-        .collect();
-    for (t, val) in consts {
-        if !v.iter().any(|(k, _)| k.eq_ignore_ascii_case(t)) {
-            v.push((t.clone(), val.clone()));
+/// The attribute values of `ins`: its own, then the constant ones of its block.
+fn values(d: &cadcraft_doc::Drawing, ins: &Insert) -> Vec<(String, String)> {
+    let mut v: Vec<(String, String)> = ins.attribs.iter().map(|a| (a.tag.to_ascii_uppercase(), a.text.value.clone())).collect();
+    if let Some(b) = d.block(&ins.block) {
+        for e in b.entities.iter() {
+            if let EntityKind::AttDef(a) = &e.kind
+                && a.constant
+                && !v.iter().any(|(t, _)| t.eq_ignore_ascii_case(&a.tag))
+            {
+                v.push((a.tag.to_ascii_uppercase(), a.text.value.clone()));
+            }
         }
     }
     v
@@ -130,7 +113,6 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
         d.model.iter().chain(d.layouts.iter().flat_map(|l| l.entities.iter())).cloned().collect()
     };
     let mut out = Vec::new();
-    let mut consts: HashMap<String, Vec<(String, String)>> = HashMap::new();
     for e in &ents {
         let EntityKind::Insert(ins) = &e.kind else { continue };
         let anonymous = ins.block.starts_with('*') || d.block(&ins.block).is_some_and(|b| b.anonymous);
@@ -139,17 +121,12 @@ fn found(s: &Session, p: &Value, o: &Options) -> Result<Vec<Found>> {
         }
         let block = d.block(&ins.block).map(|b| b.name.clone()).unwrap_or_else(|| ins.block.clone());
         out.push(Found {
+            block,
             handle: e.handle.hex(),
             layer: e.common.layer.clone(),
             at: ins.insert.xy(),
             rotation: ins.rotation.to_degrees(),
-            block: block.clone(),
-            values: values(
-                ins,
-                // Keyed by the resolved definition's exact name: `Part` and `PART` can both exist.
-                consts.entry(block.clone()).or_insert_with(|| d.block(&ins.block).map(|b| constants(b, &o.tags)).unwrap_or_default()),
-                &o.tags,
-            ),
+            values: values(d, ins),
         });
     }
     Ok(out)

crates/engine/src/cmd/file.rs

@@ -601,6 +601,21 @@ pub fn save_keeps_current(_path: &std::path::Path) -> bool {
     false
 }
 
+/// The mode of a new backup: no more open than the drawing (`src_mode`, group `src_gid`) nor than the
+/// `.bak` it replaces (`old`: mode and group). The backup keeps the old `.bak`'s group, so when that
+/// differs from the drawing's group the group bits are dropped: that group could not read the drawing.
+#[cfg(unix)]
+fn backup_mode(src_mode: u32, src_gid: u32, old: Option<(u32, u32)>) -> u32 {
+    let mut mode = src_mode & 0o777;
+    if let Some((old_mode, old_gid)) = old {
+        mode &= old_mode;
+        if old_gid != src_gid {
+            mode &= !0o070;
+        }
+    }
+    mode
+}
+
 /// Before `path` is replaced: copy it to its `.bak`, streamed and written atomically too
 /// ([`crate::atomic_write::write_atomic_with`]). Nothing
 /// to keep when there is no file yet. A file that doesn't look like a drawing
@@ -625,14 +640,10 @@ fn backup(path: &std::path::Path) -> std::io::Result<()> {
     // written through.
     #[cfg(unix)]
     let permissions = {
-        use std::os::unix::fs::PermissionsExt;
-        let mut mode = src.metadata()?.permissions().mode() & 0o777;
-        if let Ok(m) = std::fs::symlink_metadata(&bak)
-            && m.is_file()
-        {
-            mode &= m.permissions().mode();
-        }
-        Some(std::fs::Permissions::from_mode(mode))
+        use std::os::unix::fs::{MetadataExt, PermissionsExt};
+        let sm = src.metadata()?;
+        let old = std::fs::symlink_metadata(&bak).ok().filter(|m| m.is_file());
+        Some(std::fs::Permissions::from_mode(backup_mode(sm.mode(), sm.gid(), old.map(|m| (m.mode(), m.gid())))))
     };
     #[cfg(not(unix))]
     let permissions = None;
@@ -993,6 +1004,19 @@ mod tests {
     use crate::Session;
     use crate::temp_dir::TempDir;
 
+    /// A backup is never more open than the drawing or the old `.bak`, and loses the group bits when
+    /// it would keep the old `.bak`'s group while the drawing is in another.
+    #[cfg(unix)]
+    #[test]
+    fn backup_mode_drops_group_bits_for_a_different_group() {
+        use super::backup_mode;
+        assert_eq!(backup_mode(0o640, 10, None), 0o640);
+        assert_eq!(backup_mode(0o640, 10, Some((0o664, 10))), 0o640);
+        assert_eq!(backup_mode(0o640, 10, Some((0o664, 20))), 0o600);
+        assert_eq!(backup_mode(0o644, 10, Some((0o644, 20))), 0o604);
+        assert_eq!(backup_mode(0o600, 10, Some((0o664, 10))), 0o600);
+    }
+
     fn active_title(s: &Session) -> String {
         s.state().unwrap().title.clone()
     }

crates/engine/src/cmd/file/compare.rs

@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
 
-use cadcraft_doc::{BlockBoundsCache, Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds_cached};
+use cadcraft_doc::{Drawing, Entity, EntityKind, Handle, MAX_BLOCK_DEPTH, Space, entity_bounds};
 use cadcraft_geom::{Bounds2, Vec2};
 use serde_json::{Value, json};
 
@@ -375,20 +375,16 @@ fn run_compare(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let Diff { added, removed, changed, common, truncated } = diff(&cur, &other, &space);
     let mut boxes = Vec::new();
-    // One block-bounds cache for each drawing, so a block many differing entities refer to is
-    // measured once, not once per entity.
-    let (mut cur_cache, mut other_cache) = (BlockBoundsCache::default(), BlockBoundsCache::default());
-    fn bound<'a>(boxes: &mut Vec<Bounds2>, d: &'a Drawing, h: Handle, cache: &mut BlockBoundsCache<'a>) {
-        if let Some(b) = d.entity(h).map(|e| entity_bounds_cached(d, e, 0, cache)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite())
-        {
+    let mut bound = |d: &Drawing, h: Handle| {
+        if let Some(b) = d.entity(h).map(|e| entity_bounds(d, e, 0)).filter(|b| !b.is_empty() && b.min.is_finite() && b.max.is_finite()) {
             boxes.push(b);
         }
-    }
-    added.iter().for_each(|h| bound(&mut boxes, &cur, *h, &mut cur_cache));
-    removed.iter().for_each(|h| bound(&mut boxes, &other, *h, &mut other_cache));
+    };
+    added.iter().for_each(|h| bound(&cur, *h));
+    removed.iter().for_each(|h| bound(&other, *h));
     for (a, b, _, _) in &changed {
-        bound(&mut boxes, &cur, *a, &mut cur_cache);
-        bound(&mut boxes, &other, *b, &mut other_cache);
+        bound(&cur, *a);
+        bound(&other, *b);
     }
     let regions = regions(&boxes);
     let ch: Vec<Value> = changed

crates/engine/src/cmd/modify2/mocoro.rs

@@ -108,12 +108,6 @@ pub(super) fn run_mocoro(s: &mut Session, p: &Value) -> Result<Value> {
     }
     // Every option is checked before the drawing changes.
     let ops = list.iter().enumerate().map(|(i, v)| parse_op(i, v)).collect::<Result<Vec<_>>>()?;
-    // Each Copy clones every selected object: the copies together stay within MAXARRAY, as an array's do.
-    // Erased handles are skipped by `apply`, so only live objects count (none: nothing is copied).
-    let live = counts(s, &objs)?.0;
-    if live > 0 {
-        crate::cmd::array::check_size(s, ops.iter().filter(|o| matches!(o, Op::Copy(_))).count() as u64, live)?;
-    }
     let mut copies = Vec::new();
     for op in ops {
         copies.extend(apply(s, &objs, &mut base, op)?);

crates/engine/tests/it/mocoro.rs

@@ -233,17 +233,3 @@ fn options_on_objects_that_are_gone_record_nothing() {
     assert!(lines(&s).is_empty());
     assert_eq!(undo_len(&s), undo, "no empty undo step");
 }
-
-#[test]
-fn json_form_copies_stay_within_maxarray() {
-    let mut s = Session::new();
-    let l = line(&mut s, [0.0, 0.0], [10.0, 0.0]);
-    // 5,000 Copy options of 30 objects would be 150,000 copies, over the default MAXARRAY of 100,000.
-    let others: Vec<String> = (0..29).map(|i| line(&mut s, [0.0, f64::from(i + 1)], [10.0, f64::from(i + 1)])).collect();
-    let mut hs = vec![l];
-    hs.extend(others);
-    let ops: Vec<Value> = (0..5_000).map(|i| json!({"copy": [0, i]})).collect();
-    let e = s.execute("mocoro", &json!({"handles": hs, "base": [0, 0], "ops": ops})).unwrap_err();
-    assert!(e.to_string().contains("MAXARRAY"), "{e}");
-    assert_eq!(lines(&s).len(), 30, "nothing was copied");
-}

crates/io/src/pdf.rs

@@ -50,8 +50,6 @@ const MAX_LAYER_NAME: usize = 1000;
 /// Most link annotations in one file, and the longest link target (bytes).
 const MAX_LINKS: usize = 10_000;
 const MAX_URL: usize = 2048;
-/// The most link annotations in one PDF, over all pages (a page holds at most [`MAX_LINKS`]).
-const MAX_FILE_ANNOTATIONS: usize = 100_000;
 /// Longest title and page label written (characters).
 const MAX_TEXT: usize = 1000;
 
@@ -359,10 +357,7 @@ fn sheet_name(space: &Space) -> String {
 /// Write a vector PDF with one page per space (at most [`MAX_PAGES`]), each labelled with its
 /// layout name. The options apply to every sheet; layouts use their own page setups.
 pub fn pdf_sheets(d: &Drawing, spaces: &[Space], o: &PdfOptions) -> Result<Vec<u8>> {
-    // Links are file-wide (`pdf_items` reads them from `o`), so a sheet's own options carry none:
-    // a copy of the list per sheet multiplied it by the sheet count.
-    let sheet = PdfOptions { links: Vec::new(), ..o.clone() };
-    let items: Vec<(Space, PdfOptions)> = spaces.iter().take(MAX_PAGES + 1).map(|s| (s.clone(), sheet.clone())).collect();
+    let items: Vec<(Space, PdfOptions)> = spaces.iter().take(MAX_PAGES + 1).map(|s| (s.clone(), o.clone())).collect();
     pdf_items(d, &items, o)
 }
 
@@ -458,16 +453,8 @@ fn write_pdf(d: &Drawing, items: &[(Space, PdfOptions)], o: &PdfOptions, text_as
         let mut writer = Writer::new(settings, metadata);
         let mut fonts = fonts::Fonts::new(!text_as_geometry);
         let mut groups = Groups::default();
-        // Link annotations of the whole file: each page keeps its own copy of the targets, so the
-        // pages times the links must not multiply without a bound.
-        let mut annotations_left = MAX_FILE_ANNOTATIONS;
         for (s, po) in items {
-            // Once the budget is spent no link is built (scanned and cloned) for later pages.
-            let mut page = sheet(drawn, s, po, if annotations_left == 0 { &links[..0] } else { &links })?;
-            // Only targets `write_page` accepts count against the budget.
-            page.links.retain(|(_, url)| uri(url).is_some());
-            page.links.truncate(annotations_left);
-            annotations_left -= page.links.len();
+            let page = sheet(drawn, s, po, &links)?;
             let doc = writer.document_mut();
             // Groups are added to the document, so they must exist before the page starts.
             groups.add(doc, d, &page.layers);
@@ -638,8 +625,7 @@ pub(crate) fn placement(space: &Space, bounds: &Bounds2, fit: bool, sheet: &Shee
 /// The hyperlinks to plot: the options' own, then (with [`PdfOptions::hyperlinks`]) those the
 /// drawing file gave its entities as `PE_URL` extended data, at most [`MAX_LINKS`] in all.
 fn all_links(d: &Drawing, o: &PdfOptions) -> Vec<(Handle, String)> {
-    // A target past MAX_URL is refused at the annotation anyway; it is left out before it is copied.
-    let mut out: Vec<(Handle, String)> = o.links.iter().filter(|(_, u)| u.len() <= MAX_URL).take(MAX_LINKS).cloned().collect();
+    let mut out: Vec<(Handle, String)> = o.links.iter().take(MAX_LINKS).cloned().collect();
     if !o.hyperlinks {
         return out;
     }

crates/ui-egui/src/managers.rs

@@ -306,7 +306,7 @@ fn point_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Action
 enum Field {
     Num(&'static str, &'static str, f64),
     Bool(&'static str, &'static str, bool),
-    Choice(&'static str, &'static str, String, std::sync::Arc<[String]>),
+    Choice(&'static str, &'static str, String, Vec<String>),
 }
 
 struct Style {
@@ -371,8 +371,7 @@ fn mleader_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Acti
         no_drawing(ctx, "Multileader Style", open);
         return None;
     };
-    // One list shared by every row: a copy per style multiplied the two counts.
-    let text_styles: std::sync::Arc<[String]> = d.text_styles.iter().map(|s| s.name.clone()).collect();
+    let text_styles: Vec<String> = d.text_styles.iter().map(|s| s.name.clone()).collect();
     let mut styles: Vec<Style> = d
         .mleader_styles
         .iter()
@@ -383,7 +382,7 @@ fn mleader_style(app: &mut CadApp, ctx: &egui::Context, open: &mut bool) -> Acti
                 Field::Num("textHeight", "Text height", s.text_height),
                 Field::Num("landingGap", "Landing gap", s.landing_gap),
                 Field::Num("dogleg", "Landing length", s.dogleg),
-                Field::Choice("textStyle", "Text style", s.text_style.clone(), std::sync::Arc::clone(&text_styles)),
+                Field::Choice("textStyle", "Text style", s.text_style.clone(), text_styles.clone()),
             ],
         })
         .collect();
@@ -452,7 +451,7 @@ fn style_manager(ctx: &egui::Context, open: &mut bool, title: &str, cmd: &'stati
                             ui.label(*label);
                             let mut picked = None;
                             craft_ui::ComboBox::from_id_salt((cmd, *key)).selected_text(v.as_str()).show_ui(ui, |ui| {
-                                for c in choices.iter() {
+                                for c in choices {
                                     if ui.selectable_label(c == v, c).clicked() && c != v {
                                         picked = Some(c.clone());
                                     }