fix: port CSS lock/sweep hardening

config/dev-http-subdomain.json

@@ -36,7 +36,8 @@
     "css:config/util/representation-conversion/default.json",
     "css:config/util/resource-locker/file.json",
     "css:config/util/variables/default.json",
-    "pivot:config/pivot-overrides.json"
+    "pivot:config/pivot-overrides.json",
+    "pivot:config/pivot-file-locker-overrides.json"
     ],
   "@graph": [
     {

config/dev-http-suffix.json

@@ -36,7 +36,8 @@
     "css:config/util/representation-conversion/default.json",
     "css:config/util/resource-locker/file.json",
     "css:config/util/variables/default.json",
-    "pivot:config/pivot-overrides.json"
+    "pivot:config/pivot-overrides.json",
+    "pivot:config/pivot-file-locker-overrides.json"
     ],
   "@graph": [
     {

config/pivot-file-locker-overrides.json

@@ -0,0 +1,20 @@
+{
+  "comment": "Overrides specific to configs that use the file-system resource locker. Imported only by prod/dev configs, NOT by test.json (which uses the memory locker).",
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/pivot/^1.0.0/components/context.jsonld"
+  ],
+  "@graph": [
+    {
+      "comment": "Bound the lock acquisition retries so a contended lock fails fast instead of spinning the event loop and filesystem threadpool forever (~30s max wait).",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:FileSystemResourceLocker" },
+      "overrideParameters": {
+        "@type": "FileSystemResourceLocker",
+        "attemptSettings_retryCount": 600,
+        "attemptSettings_retryDelay": 50,
+        "attemptSettings_retryJitter": 30
+      }
+    }
+  ]
+}

config/pivot-overrides.json

@@ -61,6 +61,82 @@
         "templateEngine": { "@id": "urn:solid-server:default:TemplateEngine" },
         "template": "./templates/main.html.ejs"
       }
+    },
+    {
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:AccountStorage" },
+      "overrideParameters": {
+        "@type": "SafeBaseLoginAccountStorage",
+        "storage": { "@id": "urn:solid-server:default:IndexedStorage" }
+      }
+    },
+    {
+      "comment": "Scope the cookie sweep to its own container so entries()/sweeps do not walk the entire /.internal/ tree (sustained high CPU with many accounts).",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:CookieStorage" },
+      "overrideParameters": {
+        "@type": "WrappedExpiringStorage",
+        "source": {
+          "@type": "MaxKeyLengthStorage",
+          "source": {
+            "@type": "JsonResourceStorage",
+            "source": { "@id": "urn:solid-server:default:ResourceStore_Backend" },
+            "baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
+            "container": "/.internal/accounts/cookies/"
+          }
+        }
+      }
+    },
+    {
+      "comment": "Scope the forgot-password sweep to its own container.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ForgotPasswordStorage" },
+      "overrideParameters": {
+        "@type": "WrappedExpiringStorage",
+        "source": {
+          "@type": "MaxKeyLengthStorage",
+          "source": {
+            "@type": "JsonResourceStorage",
+            "source": { "@id": "urn:solid-server:default:ResourceStore_Backend" },
+            "baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
+            "container": "/.internal/accounts/forgot-password/"
+          }
+        }
+      }
+    },
+    {
+      "comment": "Scope the token sweep to its own container.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ExpiringTokenStorage" },
+      "overrideParameters": {
+        "@type": "WrappedExpiringStorage",
+        "source": {
+          "@type": "MaxKeyLengthStorage",
+          "source": {
+            "@type": "JsonResourceStorage",
+            "source": { "@id": "urn:solid-server:default:ResourceStore_Backend" },
+            "baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
+            "container": "/.internal/idp/tokens/"
+          }
+        }
+      }
+    },
+    {
+      "comment": "Scope the adapter sweep to its own container. Requires the @id added to the installed CSS adapter-factory.json by the patch-package override.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ExpiringAdapterStorage" },
+      "overrideParameters": {
+        "@type": "WrappedExpiringStorage",
+        "source": {
+          "@type": "MaxKeyLengthStorage",
+          "source": {
+            "@type": "JsonResourceStorage",
+            "source": { "@id": "urn:solid-server:default:ResourceStore_Backend" },
+            "baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
+            "container": "/.internal/idp/adapter/"
+          }
+        }
+      }
     }
   ]
 }

config/prod.json

@@ -35,7 +35,8 @@
     "css:config/util/representation-conversion/default.json",
     "css:config/util/resource-locker/file.json",
     "css:config/util/variables/default.json",
-    "pivot:config/pivot-overrides.json"
+    "pivot:config/pivot-overrides.json",
+    "pivot:config/pivot-file-locker-overrides.json"
   ],
   "@graph": [
    {

config/suffix.json

@@ -35,7 +35,8 @@
     "css:config/util/representation-conversion/default.json",
     "css:config/util/resource-locker/file.json",
     "css:config/util/variables/default.json",
-    "pivot:config/pivot-overrides.json"
+    "pivot:config/pivot-overrides.json",
+    "pivot:config/pivot-file-locker-overrides.json"
   ],
   "@graph": [
    {

package.json

@@ -27,6 +27,7 @@
     "build:components": "componentsjs-generator -s src -c dist/components -i .componentsignore -r pivot",
     "build:ts": "tsc",
     "prepare": "npm run build",
+    "postinstall": "patch-package",
     "test": "jest"
   },
   "files": [

patches/@solid+community-server+7.2.0.patch

@@ -0,0 +1,12 @@
+diff --git a/node_modules/@solid/community-server/config/identity/handler/base/adapter-factory.json b/node_modules/@solid/community-server/config/identity/handler/base/adapter-factory.json
+index c2b9890..c406ba6
+--- a/node_modules/@solid/community-server/config/identity/handler/base/adapter-factory.json
++++ b/node_modules/@solid/community-server/config/identity/handler/base/adapter-factory.json
+@@ -13,6 +13,7 @@
+         "source": {
+           "@type": "ExpiringAdapterFactory",
+           "storage": {
++            "@id": "urn:solid-server:default:ExpiringAdapterStorage",
+             "@type": "WrappedExpiringStorage",
+             "source": {
+               "@type": "ContainerPathStorage",

patches/proper-lockfile+4.1.2.patch

@@ -0,0 +1,18 @@
+diff --git a/node_modules/proper-lockfile/lib/lockfile.js b/node_modules/proper-lockfile/lib/lockfile.js
+index 97b6637..25bd0a2 100644
+--- a/node_modules/proper-lockfile/lib/lockfile.js
++++ b/node_modules/proper-lockfile/lib/lockfile.js
+@@ -99,6 +99,13 @@ function removeLock(file, options, callback) {
+ function updateLock(file, options) {
+     const lock = locks[file];
+
++    // Guard against a renewal timer racing with lock release:
++    // `locks[file]` may already be deleted when an in-flight fs callback recurses.
++    /* istanbul ignore if */
++    if (!lock) {
++        return;
++    }
++
+     // Just for safety, should never happen
+     /* istanbul ignore if */
+     if (lock.updateTimeout) {