Allow leaving corrupted indexes as readable after header repair

fdb-record-layer-core/src/main/java/com/apple/foundationdb/record/provider/foundationdb/FDBRecordStore.java

@@ -255,6 +255,11 @@ public class FDBRecordStore extends FDBStoreBase implements FDBRecordStoreBase<M
     protected static final Object RECORD_VERSION_KEY = FDBRecordStoreKeyspace.RECORD_VERSION_SPACE.key();
     protected static final Object INDEX_BUILD_SPACE_KEY = FDBRecordStoreKeyspace.INDEX_BUILD_SPACE.key();
 
+    /**
+     * Name for the commit check that prevents commits when potentially corrupted indexes are left readable.
+     */
+    public static final String POTENTIALLY_CORRUPTED_INDEXES_COMMIT_CHECK = "PotentiallyCorruptedIndexes";
+
     @SuppressWarnings("squid:S2386")
     @SpotBugsSuppressWarnings("MS_MUTABLE_ARRAY")
     public static final byte[] LITTLE_ENDIAN_INT64_ONE = { 1, 0, 0, 0, 0, 0, 0, 0 };
@@ -5682,6 +5687,25 @@ private CompletableFuture<Void> preloadMetaData() {
             }
         }
 
+        /**
+         * In the event that a store has been corrupted, and the header has been lost, this method can be used to open
+         * the store, and fill in the missing header; replaced by {@link #repairMissingHeader(int, FormatVersion, boolean)}.
+         *
+         * @param userVersion the user version to set in the store header
+         * @param minimumPossibleFormatVersion the minimum {@link FormatVersion} that this store could have possibly
+         * had. Notably, upgrading to {@link FormatVersion#SAVE_VERSION_WITH_RECORD} requires moving data, and upgrading
+         * to {@link FormatVersion#SAVE_UNSPLIT_WITH_SUFFIX} requires storing whether the store should have the unsplit
+         * suffix or not. It is probably possible for {@code repairMissingHeader} to determine what to do based on the
+         * rest of the data in the store, but to keep this simple, upgrading across those versions is not supported.
+         *
+         * @return a boolean indicating whether a repair needed to be done ({@code true}) or not ({@code false}) and
+         * the opened store.
+         */
+        @API(API.Status.DEPRECATED)
+        public CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHeader(final int userVersion, FormatVersion minimumPossibleFormatVersion) {
+            return repairMissingHeader(userVersion, minimumPossibleFormatVersion, false);
+        }
+
         /**
          * In the event that a store has been corrupted, and the header has been lost, this method can be used to open
          * the store, and fill in the missing header.
@@ -5697,6 +5721,9 @@ private CompletableFuture<Void> preloadMetaData() {
          *             Disable all indexes, since we cannot universally determine whether they have been added or
          *             changed since the store was last opened. In theory there are some situations where we could
          *             determine that the index can be marked readable for free, but this is not supported.
+         *             If {@code leavePotentiallyCorruptIndexesReadable} is {@code true} they will not be disabled.
+         *             This can be useful if you want to use the potentially corrupt indexes to discern information
+         *             about the corrupted records.
          *         </li>
          *         <li>
          *             Disable the {@link RecordMetaData#getRecordCountKey()} if there is one on the metadata, because
@@ -5727,12 +5754,16 @@ private CompletableFuture<Void> preloadMetaData() {
          * to {@link FormatVersion#SAVE_UNSPLIT_WITH_SUFFIX} requires storing whether the store should have the unsplit
          * suffix or not. It is probably possible for {@code repairMissingHeader} to determine what to do based on the
          * rest of the data in the store, but to keep this simple, upgrading across those versions is not supported.
+         * @param leavePotentiallyCorruptIndexesReadable if {@code true}, indexes will not be marked as disabled during
+         * repair, even though they could be corrupt.
          *
          * @return a boolean indicating whether a repair needed to be done ({@code true}) or not ({@code false}) and
          * the opened store.
          */
         @API(API.Status.INTERNAL)
-        public CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHeader(final int userVersion, FormatVersion minimumPossibleFormatVersion) {
+        public CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHeader(
+                final int userVersion, @Nonnull final FormatVersion minimumPossibleFormatVersion,
+                final boolean leavePotentiallyCorruptIndexesReadable) {
             if (!formatVersion.isAtLeast(minimumPossibleFormatVersion)) {
                 throw new RecordCoreArgumentException("minimumPossibleFormatVersion is greater than the target formatVerson")
                         .addLogInfo(LogMessageKeys.FORMAT_VERSION, minimumPossibleFormatVersion)
@@ -5748,12 +5779,13 @@ public CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHead
                             store.getStoreStateCache().get(store, StoreExistenceCheck.NONE)
                                     .thenCompose(storeStateCacheEntry ->
                                             repairMissingHeader(userVersion, store,
-                                                    storeStateCacheEntry.getRecordStoreState().getStoreHeader())));
+                                                    storeStateCacheEntry.getRecordStoreState().getStoreHeader(), leavePotentiallyCorruptIndexesReadable)));
         }
 
         private CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHeader(final int userVersion,
-                                                                                     @Nonnull final FDBRecordStore store,
-                                                                                     @Nonnull final RecordMetaDataProto.DataStoreInfo existing) {
+                                                                                            @Nonnull final FDBRecordStore store,
+                                                                                            @Nonnull final RecordMetaDataProto.DataStoreInfo existing,
+                                                                                            boolean leavePotentiallyCorruptIndexesReadable) {
             if (!existing.equals(RecordMetaDataProto.DataStoreInfo.getDefaultInstance())) {
                 return store.checkVersion(userVersionChecker, StoreExistenceCheck.ERROR_IF_NOT_EXISTS)
                         .thenApply(checkVersionDidSomething -> NonnullPair.of(false, store));
@@ -5827,12 +5859,24 @@ private CompletableFuture<NonnullPair<Boolean, FDBRecordStore>> repairMissingHea
             //    or that the store was on a metadata version that didn't have the index, or
             //    had an older version of the index. If it wasn't readable on the current version, then
             //    leaving the index would leave it in a corrupted state.
-            return bumpMetaDataVersionStamp.thenCompose(vignore -> AsyncUtil.whenAll(
+            return bumpMetaDataVersionStamp.thenCompose(vignore -> {
+                if (leavePotentiallyCorruptIndexesReadable) {
+                    // Add a commit check that will fail if the user tries to commit with potentially corrupted indexes
+                    store.getRecordContext().addCommitCheck(POTENTIALLY_CORRUPTED_INDEXES_COMMIT_CHECK,
+                            new PreventCommitCheck(() -> new RecordCoreException(
+                                    "Commit failed because potentially corrupted indexes were left readable after header repair. " +
+                                            "The indexes should be rebuilt or verified before allowing commits.")));
+                    // Leave indexes as-is per user request
+                    return AsyncUtil.DONE;
+                } else {
+                    return AsyncUtil.whenAll(
                             recordMetaData.getAllIndexes().stream()
                                     .map(store::markIndexDisabled)
-                                    .collect(Collectors.toList()))
-                    .thenApply(ignored -> NonnullPair.of(true, store)));
+                                    .collect(Collectors.toList()));
+                }
+            }).thenApply(ignored -> NonnullPair.of(true, store));
         }
+
     }
 
 }

fdb-record-layer-core/src/main/java/com/apple/foundationdb/record/provider/foundationdb/PreventCommitCheck.java

@@ -0,0 +1,52 @@
+/*
+ * PreventCommitCheck.java
+ *
+ * This source file is part of the FoundationDB open source project
+ *
+ * Copyright 2015-2025 Apple Inc. and the FoundationDB project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.apple.foundationdb.record.provider.foundationdb;
+
+import com.apple.foundationdb.annotation.API;
+import com.apple.foundationdb.record.RecordCoreException;
+
+import javax.annotation.Nonnull;
+import java.util.concurrent.CompletableFuture;
+import java.util.function.Supplier;
+
+/**
+ * Commit check that always fails, effectively preventing this transaction from committing at all.
+ */
+@API(API.Status.INTERNAL)
+class PreventCommitCheck implements FDBRecordContext.CommitCheckAsync {
+
+    final Supplier<RecordCoreException> exceptionSupplier;
+
+    PreventCommitCheck(Supplier<RecordCoreException> exceptionSupplier) {
+        this.exceptionSupplier = exceptionSupplier;
+    }
+
+    @Override
+    public boolean isReady() {
+        return true;
+    }
+
+    @Override
+    @Nonnull
+    public CompletableFuture<Void> checkAsync() {
+        return CompletableFuture.failedFuture(exceptionSupplier.get());
+    }
+}