mutineer 1.7.0 → 1.8.0

data/lib/mutineer/rails_worker_db.rb

@@ -2,6 +2,7 @@
 
 require "digest"
 require "uri"
+require_relative "redaction"
 
 module Mutineer
   # Per-worker database isolation for the daemon path.
@@ -352,20 +353,35 @@ module Mutineer
       ActiveRecord::Base.establish_connection(worker_db_config(slot))
     end
 
-    # How many database configs the test environment declares. One is normal.
-    # More than one means the run must use a single worker.
+    # The database config names the test environment declares, and the one
+    # each worker copies (the config `ActiveRecord::Base` uses). The tool
+    # counts the names that `shared_databases` does not list: more than one
+    # means the run must use a single worker.
     #
-    # @return [Integer]
-    def self.database_count
-      return 1 unless available?
+    # A config with `database_tasks: false` counts: workers would share it like
+    # any other. A replica does not, as before: it reads another config's database.
+    # No rescue: a failure must reach the tool, which then keeps one worker.
+    #
+    # @return [Hash{String => Object}] "names" (Array<String>) and "primary" (String).
+    def self.database_names
+      names = test_configs.reject(&:replica?).map(&:name)
+      { "names" => names, "primary" => primary_database_name }
+    end
 
+    # The config name each worker copies: the one `ActiveRecord::Base` uses.
+    #
+    # @return [String]
+    def self.primary_database_name
+      ActiveRecord::Base.connection_db_config.name
+    end
+
+    # The test environment's database configs, hidden ones and replicas included.
+    #
+    # @return [Array<ActiveRecord::DatabaseConfigurations::DatabaseConfig>]
+    def self.test_configs
       env = ENV["RAILS_ENV"].to_s
       env = "test" if env.empty?
-      list = ActiveRecord::Base.configurations.configs_for(env_name: env)
-      count = list.size
-      count < 1 ? 1 : count
-    rescue StandardError
-      1
+      ActiveRecord::Base.configurations.configs_for(env_name: env, include_hidden: true)
     end
 
     # Child-side (after fork): route this process's ActiveRecord at the worker's
@@ -378,7 +394,7 @@ module Mutineer
     # `schema.rb` again would drop those rows.
     #
     # @param worker [Integer] the worker slot index.
-    # @param schema_path [String, nil] absolute path to `db/schema.rb`, or nil to skip.
+    # @param schema_path [String, nil] the app's Ruby schema file ({ruby_schema_path}), or nil to skip.
     # @param seed [Boolean] copy the base SQLite file into the worker file first.
     # @return [void]
     def self.after_fork(worker, schema_path = nil, seed: false)
@@ -433,10 +449,10 @@ module Mutineer
     # file, which catches an edited schema with the same version. No stored
     # checksum counts as out of date, as in Rails' own `schema_up_to_date?`.
     #
-    # @param schema_path [String] absolute path to `db/schema.rb`.
+    # @param schema_path [String] absolute path to the app's Ruby schema file.
     # @return [Boolean]
     def self.schema_current?(schema_path)
-      text    = File.read(schema_path)
+      text    = File.read(schema_path, encoding: "UTF-8")
       version = schema_file_version(text)
       conn = ActiveRecord::Base.connection
       base       = ActiveRecord::Base
@@ -459,10 +475,91 @@ module Mutineer
       text[/define\(version:\s*([\d_]+)/, 1]&.delete("_")&.to_i
     end
 
+    # Record each pool that runs SQL in this fork from now on. Run in the fork
+    # before its tests, so {touched_shared_databases} also sees a pool that a
+    # test disconnects or removes before it ends.
+    #
+    # @return [void]
+    def self.watch_sql
+      @sql_pools = {} # used as a set: one entry per pool, not per query
+      ActiveSupport::Notifications.subscribe("sql.active_record") do |*, payload|
+        connection = payload[:connection]
+        @sql_pools[connection.pool] = true if connection.respond_to?(:pool)
+      end
+    end
+
+    # Names from `shared` whose database this fork used. Run in a fork after
+    # its tests: a name here means a test used a database that parallel
+    # workers share, so the verdict cannot be trusted. A pool counts when it
+    # is still connected, or when it ran SQL since {watch_sql}. It names a
+    # shared database when its config has a shared name, when its class also
+    # holds a shared writer pool (a replica in the same `connects_to`), or when
+    # its config names the same database as a shared config. Transactional
+    # tests connect every registered writing pool, so a pool registered for a
+    # shared database shows up here after any test.
+    #
+    # Only names in {database_names} count: the tool warned about any other
+    # name, and no worker shares a database that does not exist.
+    #
+    # No rescue: a failed check must raise (scored `error`), never read as clean.
+    # shortcut: a connection made outside Active Record (a raw driver) is not
+    # seen; upgrade when such an app needs `shared_databases`.
+    #
+    # @param shared [Array<String>] database config names in `shared_databases`.
+    # @return [Array<String>]
+    def self.touched_shared_databases(shared)
+      return [] if shared.empty? || !available?
+
+      shared &= database_names["names"]
+      return [] if shared.empty?
+      # Rails 7.0 reads `:all` below as a role name and lists no pool, so the
+      # check would always pass. Fail every mutant instead of trusting it.
+      raise "shared_databases needs Rails 7.1 or later" if ActiveRecord.version < Gem::Version.new("7.1")
+
+      pools = ActiveRecord::Base.connection_handler.connection_pool_list(:all)
+      owners = pools.filter_map { |p| [pool_owner(p), p.db_config.name] if shared.include?(p.db_config.name) }.to_h
+      by_database = test_configs.filter_map { |c| [c.database, c.name] if shared.include?(c.name) && c.database }.to_h
+      used = pools.select(&:connected?) | (@sql_pools&.keys || [])
+      used.filter_map do |pool|
+        config = pool.db_config
+        shared.include?(config.name) ? config.name : owners[pool_owner(pool)] || by_database[config.database]
+      end.uniq
+    end
+
+    # The class a pool belongs to, by name. `connects_to` registers a class's
+    # writer and replica pools under it. Rails 8 keeps it in a descriptor.
+    #
+    # @param pool [ActiveRecord::ConnectionAdapters::ConnectionPool]
+    # @return [String]
+    def self.pool_owner(pool)
+      config = pool.pool_config
+      config.respond_to?(:connection_descriptor) ? config.connection_descriptor.name : config.connection_name
+    end
+
+    # The Ruby schema file a SQLite worker loads over an out-of-date copy, as
+    # the booted app's config names it. Rails resolves the name: `db/schema.rb`
+    # by default, the `schema_dump:` file of the database config (a bare name
+    # such as `schema_sqlite.rb` lives in `db/`), or the `SCHEMA` variable.
+    # nil when the file does not exist, when the config sets `schema_dump: false`,
+    # or when the app uses `structure.sql` (a worker cannot `load` SQL). With nil
+    # the worker keeps its copy of the test database as it is.
+    #
+    # @return [String, nil] absolute path of an existing file, or nil.
+    def self.ruby_schema_path
+      db_config = ActiveRecord::Base.connection_db_config
+      format = schema_format_for(db_config)
+      return unless format == :ruby
+
+      path = ActiveRecord::Tasks::DatabaseTasks.schema_dump_path(db_config, format)
+      # Expanded so `load` never searches $LOAD_PATH for a relative SCHEMA value.
+      path &&= File.expand_path(path)
+      path if path && File.exist?(path)
+    end
+
     # Load a Rails `schema.rb` into the current connection with output silenced
     # (fork child stdout is already File::NULL; this is belt-and-braces).
     #
-    # @param schema_path [String] absolute path to `db/schema.rb`.
+    # @param schema_path [String] absolute path to the app's Ruby schema file.
     # @return [void]
     def self.load_schema(schema_path)
       ActiveRecord::Migration.verbose = false if defined?(ActiveRecord::Migration)
@@ -518,6 +615,27 @@ module Mutineer
       adapter == "mysql2" || adapter == "trilogy"
     end
 
+    # Classify a MySQL `SELECT VERSION()` text against the support matrix.
+    # MariaDB is matched by name first: it reports 10.x or 11.x, and some
+    # builds prefix `5.5.5-`, so a numeric check alone would misread it.
+    #
+    # @param version [String, nil]
+    # @return [Symbol] `:supported` (MySQL 8), `:not_supported` (before 8),
+    #   `:not_tested` (MariaDB, MySQL 9 or later), or `:unreadable`.
+    def self.mysql_version_support(version)
+      text = version.to_s
+      return :not_tested if text.match?(/mariadb/i)
+
+      major = text[/\A(\d+)\.\d+/, 1]
+      return :unreadable unless major
+
+      major = major.to_i
+      return :not_supported if major < 8
+      return :not_tested if major > 8
+
+      :supported
+    end
+
     # Drop and recreate slots `0...count` from the booted test database.
     # Holds the exclusive advisory lock only for the copy, then a shared lock
     # for the rest of this process so a second run cannot drop those databases.
@@ -819,7 +937,8 @@ module Mutineer
     #
     # @param count [Integer]
     # @return [void]
-    # @raise [RuntimeError] when `count` exceeds {MYSQL_LOCK_SLOTS}, or another run holds the lock.
+    # @raise [RuntimeError] when `count` exceeds {MYSQL_LOCK_SLOTS}, the server is
+    #   MySQL older than 8.0, or another run holds the lock.
     def self.provision_mysql(count)
       if count > MYSQL_LOCK_SLOTS
         raise "MySQL worker databases support at most #{MYSQL_LOCK_SLOTS} workers"
@@ -829,6 +948,10 @@ module Mutineer
       remember_mysql_base_config(hash)
       base = hash[:database].to_s
       conn = open_mysql_connection(hash, base)
+      if (refusal = check_mysql_server(conn, password: hash[:password]))
+        conn.close
+        raise "could not provision #{base}: #{refusal}"
+      end
       unless try_mysql_lock(conn, base, shared: false)
         conn.close
         raise "another Mutineer run is using #{base}"
@@ -861,6 +984,56 @@ module Mutineer
       warn "[mutineer] provisioned #{count} mysql worker database(s) from #{base}"
     end
 
+    # Read the server version and print a warning when the matrix does not
+    # test it. Does not close `conn` or raise: the caller does both. A failed
+    # version query only warns, with its cause shown. URL passwords, the
+    # DATABASE_URL password and the configured `password` are hidden in the
+    # cause and in the version text.
+    #
+    # @param conn [Mysql2::Client, Trilogy]
+    # @param password [String, nil] the configured password, hidden when it appears.
+    # @return [String, nil] the refusal text for MySQL older than 8.0, else nil.
+    def self.check_mysql_server(conn, password: nil)
+      secret = password.to_s
+      hide = lambda do |text|
+        out = Redaction.text(text)
+        next out if secret.empty?
+        # A short password would match inside ordinary words, so hide it only as a whole word.
+        pattern = secret.length >= 4 ? secret : /(?<![[:alnum:]])#{Regexp.escape(secret)}(?![[:alnum:]])/
+        out.gsub(pattern, Redaction::REDACTED)
+      end
+      failure = nil
+      raw = begin
+        mysql_rows(conn, "SELECT VERSION() AS version").first&.fetch("version", nil)
+      rescue StandardError => e
+        failure = hide.call("#{e.class}: #{e.message.lines.first.to_s.strip}")
+        nil
+      end
+      support = mysql_version_support(raw)
+      version = raw.nil? ? nil : hide.call(raw)
+
+      case support
+      when :not_supported
+        "MySQL #{version} is not supported. --daemon needs MySQL 8.0 or later. " \
+          "Pass --no-daemon (or daemon: false) to stay serial."
+      when :not_tested
+        warn "[mutineer] server version #{version} is not tested with --daemon. " \
+             "The run continues. If a result looks wrong, pass --no-daemon."
+        nil
+      when :unreadable
+        shown = if failure
+                  "an error: #{failure}"
+                elsif version.to_s.empty?
+                  "nothing"
+                else
+                  "\"#{version}\""
+                end
+        warn "[mutineer] could not read the MySQL server version (got #{shown}). " \
+             "The run continues. --daemon is tested on MySQL 8."
+        nil
+      end
+    end
+
     # Take one shared GET_LOCK name and drop this process's app connection.
     #
     # @return [void]
@@ -1111,7 +1284,7 @@ module Mutineer
         ActiveRecord::Base.establish_connection(slot_hash)
         switched = true
         db_config = mysql_db_config(slot_hash)
-        format = current_schema_format
+        format = schema_format_for(db_config)
         file = mysql_schema_file(db_config, format)
         ActiveRecord::Tasks::DatabaseTasks.load_schema(db_config, format, file) if file
       rescue StandardError => e
@@ -1142,6 +1315,17 @@ module Mutineer
       ActiveRecord::DatabaseConfigurations::HashConfig.new(env, "primary", slot_hash)
     end
 
+    # Schema format of one database config. Rails 8.1 lets each config set its
+    # own `schema_format:`; older Rails has only the app-wide setting. A string
+    # setting ("ruby") counts the same as the symbol.
+    #
+    # @param db_config [ActiveRecord::DatabaseConfigurations::DatabaseConfig]
+    # @return [Symbol]
+    def self.schema_format_for(db_config)
+      format = db_config.respond_to?(:schema_format) ? db_config.schema_format : current_schema_format
+      format.respond_to?(:to_sym) ? format.to_sym : format
+    end
+
     # Schema format the booted app is using.
     #
     # @return [Symbol]

data/lib/mutineer/redaction.rb

@@ -5,7 +5,10 @@ require "uri"
 module Mutineer
   # Hides database credentials in text bound for a terminal: an error reply,
   # a log line, a warning. Rails parses DATABASE_URL itself, so an error about
-  # a malformed one can quote the whole URL.
+  # a malformed one can quote the whole URL. Outside a URL a password of 3
+  # characters or fewer is hidden only as a whole token, so it cannot blank
+  # letters inside other words. A password that exactly equals the username is
+  # left visible outside a URL, so `role "postgres"` stays readable.
   #
   # Stdlib only: the app-side daemon loads this file without the rest of
   # mutineer.
@@ -16,27 +19,102 @@ module Mutineer
     URL_PASSWORD = %r{([a-z][a-z0-9+.\-]*://[^\s:/@"'\\]*):(?:\\.|[^"'\r\n\\])*@}i
     # What replaces a hidden password.
     REDACTED = "[REDACTED]"
+    # What {text} returns when it fails: never the input, which may hold the
+    # password.
+    FAILED = "[message hidden: redaction failed]"
+    # An ASCII word character, the edge a whole-token match must not touch.
+    WORD_CHAR = "[A-Za-z0-9_]"
+    # The longest password form hidden only as a whole token. A longer form is
+    # hidden wherever it appears, even glued to an escape such as `%40` or
+    # `\x41`: failing toward hiding too much is safer for a long secret.
+    SHORT_FORM = 3
 
     module_function
 
-    # Hide the password in any URL, and the DATABASE_URL password wherever it
-    # appears: whole, percent-decoded, `inspect` escaped, or cut short after
-    # its `scheme://user:` prefix.
+    # Hide the password in any URL, and the DATABASE_URL password (from its
+    # `user:password@` pair and from its `password=` query parameter) wherever
+    # it appears: whole, percent-decoded, `inspect` escaped, or cut short after
+    # its `scheme://user:` prefix. Outside a URL a form of {SHORT_FORM}
+    # characters or fewer is hidden only as a whole token. Never raises: text in
+    # any encoding comes back as UTF-8, and an internal error returns {FAILED}.
     #
     # @param text [#to_s]
     # @param env [Hash{String => String}] where DATABASE_URL is read.
     # @return [String]
     def text(text, env: ENV)
-      out = text.to_s
-      head, raw = database_url_parts(env["DATABASE_URL"].to_s)
-      secrets = raw ? password_forms(raw) : []
+      out = utf8(text.to_s)
+      url = utf8(env["DATABASE_URL"].to_s)
+      # Two readings of the userinfo: up to the last `@` (a malformed password
+      # may hold any character) and up to the last `@` before the path (a
+      # query value may hold an `@`). Both are hidden: hiding too much is safe.
+      parts = [database_url_parts(url), database_url_parts(authority(url))].compact.uniq
       # Prefixes first, on the caller's text, so no replacement made here can
       # be mistaken for part of a password.
-      [head, head&.inspect&.[](1...-1)].compact.uniq.each do |prefix|
-        out = secrets.reduce(out) { |acc, secret| redact_prefixes(acc, prefix, secret) }
+      parts.each do |head, raw|
+        forms = password_forms(raw)
+        [head, head.inspect[1...-1]].uniq.each do |prefix|
+          out = forms.reduce(out) { |acc, secret| redact_prefixes(acc, prefix, secret) }
+        end
       end
       out = out.gsub(URL_PASSWORD) { "#{Regexp.last_match(1)}:#{REDACTED}@" }
-      secrets.reduce(out) { |acc, secret| acc.gsub(secret, REDACTED) }
+      # A password that exactly equals the username is left visible outside a
+      # URL. The username is not a secret: mutineer prints it in every
+      # redacted URL, so the value is already shown, and blanking it would
+      # hide every role and database name in a `postgres:postgres` setup. The
+      # skip needs an exact raw match: a password that only shares a form or a
+      # prefix with the username is a separate secret and stays hidden. A
+      # `password=` query parameter, which Rails prefers, is always hidden.
+      raws = parts.reject { |head, raw| raw == head[(head.index("://") + 3)...-1] }.map(&:last)
+      raws.concat(query_passwords(url))
+      secrets = raws.compact.uniq.flat_map { |raw| password_forms(raw) }.uniq.sort_by { |form| -form.length }
+      secrets.reduce(out) do |acc, secret|
+        secret.length > SHORT_FORM ? acc.gsub(secret, REDACTED) : redact_word(acc, secret)
+      end
+    rescue StandardError
+      FAILED
+    end
+
+    # A UTF-8 copy of `str` that every pattern here can match. Valid UTF-8 and
+    # ASCII-only text is returned as is. Binary text, or ASCII-compatible text
+    # whose bytes are invalid in its own encoding, is read as UTF-8 with bad
+    # bytes replaced. Other text (including UTF-16 and UTF-32, valid or not)
+    # is converted, with bad bytes and characters UTF-8 lacks replaced:
+    # reading UTF-16 bytes as UTF-8 would hide the password behind NULs.
+    #
+    # @param str [String]
+    # @return [String]
+    def utf8(str)
+      return str if str.ascii_only? || (str.encoding == Encoding::UTF_8 && str.valid_encoding?)
+
+      reread = str.encoding == Encoding::BINARY || (!str.valid_encoding? && str.encoding.ascii_compatible?)
+      return String.new(str, encoding: Encoding::UTF_8).scrub if reread
+
+      str.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
+    end
+
+    # Replace `form` in `text` only where it is a whole token: no ASCII word
+    # character touches either edge, including a punctuation edge.
+    #
+    # @param text [String]
+    # @param form [String] one form of the password.
+    # @return [String]
+    def redact_word(text, form)
+      pattern = "(?<!#{WORD_CHAR})#{Regexp.escape(form)}(?!#{WORD_CHAR})"
+      text.gsub(Regexp.new(pattern), REDACTED)
+    end
+
+    # An exception as `Class: message`, redacted. Each part is redacted on its
+    # own, so the join cannot raise on mixed encodings (a non-ASCII class name
+    # next to, say, a Latin-1 message): a raise inside a rescue would make the
+    # raw error the cause of the new one. For the same reason an exception
+    # whose own `message` raises gives {FAILED}.
+    #
+    # @param error [Exception]
+    # @return [String]
+    def describe(error)
+      "#{text(error.class)}: #{text(error.message)}"
+    rescue StandardError
+      FAILED
     end
 
     # Split DATABASE_URL into its `scheme://user:` head and its raw password.
@@ -58,6 +136,28 @@ module Mutineer
       [url[0..colon], raw] unless raw.empty?
     end
 
+    # `url` cut before the first `/`, `?` or `#` after `scheme://`: the part
+    # that holds the userinfo of a well-formed URL.
+    #
+    # @param url [String]
+    # @return [String]
+    def authority(url)
+      start = url.index("://")
+      return url unless start
+
+      url[0...(url.index(%r{[/?#]}, start + 3) || url.length)]
+    end
+
+    # The raw value of each `password=` query parameter, which Rails and libpq
+    # both accept in place of a `user:password@` pair. Every one, because
+    # Rails keeps the last duplicate.
+    #
+    # @param url [String]
+    # @return [Array<String>]
+    def query_passwords(url)
+      url.scan(/[?&]password=([^&#]+)/).flatten
+    end
+
     # The password as it may appear in a message: raw, percent-decoded, and
     # each `inspect` escaped. Longest first, so a longer form is replaced
     # before a form it contains.
@@ -66,7 +166,8 @@ module Mutineer
     # @return [Array<String>]
     def password_forms(raw)
       decoded = begin
-        URI.decode_www_form_component(raw.gsub("+", "%2B"))
+        # Decoding can yield invalid UTF-8 (`%E4`); scrub it like the text.
+        utf8(URI.decode_www_form_component(raw.gsub("+", "%2B")))
       rescue ArgumentError
         raw
       end