@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/50-integration.js

@@ -0,0 +1,486 @@
+"use strict";
+/**
+ * Layer 5 — operator-facing integration / cross-module flows.
+ *
+ * (Layer 5: operator-facing
+ * integration). Cluster gates verify that write-side framework calls
+ * fail with NotLeaderError when the local node is a follower.
+ *
+ *   cluster-gates: audit + consent / session / subject / queue /
+ *                  object-store-local
+ *
+ * All previous layers must run first. Each test relies on
+ * _setupClusterGateFixture() which initializes cluster + immediately
+ * shuts it down so the node becomes a follower.
+ *
+ * Usage from smoke.js:
+ *   var integrationLayer = require("./50-integration");
+ *   await integrationLayer.run();
+ */
+
+var helpers = require("./_helpers");
+var b      = helpers.b;
+var fs     = helpers.fs;
+var os     = helpers.os;
+var path   = helpers.path;
+var check  = helpers.check;
+var _setupClusterGateFixture  = helpers._setupClusterGateFixture;
+var _expectNotLeaderError     = helpers._expectNotLeaderError;
+
+async function testClusterGatesAuditAndConsent() {
+  var fx = await _setupClusterGateFixture();
+  try {
+    _expectNotLeaderError("audit.record on follower", async function () {
+      await b.audit.record({
+        actor: { kind: "user", id: "u1" },
+        action: "auth.login",
+        outcome: "success",
+      });
+    });
+    _expectNotLeaderError("audit.checkpoint on follower", async function () {
+      await b.audit.checkpoint();
+    });
+    _expectNotLeaderError("consent.grant on follower", async function () {
+      await b.consent.grant({
+        subjectId:   "subj-1",
+        purpose:     "marketing",
+        lawfulBasis: "consent",
+        channel:     "web-form",
+      });
+    });
+    _expectNotLeaderError("consent.withdraw on follower", async function () {
+      await b.consent.withdraw({ subjectId: "subj-1", purpose: "marketing" });
+    });
+  } finally {
+    await fx.teardown();
+  }
+}
+
+async function testClusterGatesSession() {
+  var fx = await _setupClusterGateFixture();
+  try {
+    // session.* are async since the cluster-storage migration (cluster-storage dispatch).
+    // _expectNotLeaderError awaits the returned promise when fn returns
+    // one — but the call-site await is what makes the assertion sequence
+    // before the next statement runs.
+    await _expectNotLeaderError("session.create on follower", function () {
+      return b.session.create({ userId: "u1" });
+    });
+    await _expectNotLeaderError("session.destroy on follower", function () {
+      return b.session.destroy("any-token");
+    });
+    await _expectNotLeaderError("session.purgeExpired on follower", function () {
+      return b.session.purgeExpired();
+    });
+  } finally {
+    await fx.teardown();
+  }
+}
+
+async function testClusterGatesSubject() {
+  var fx = await _setupClusterGateFixture();
+  try {
+    _expectNotLeaderError("subject.rectify on follower", function () {
+      b.subject.rectify("subj-1", {
+        table: "users", id: "u1", changes: { email: "a@b.c" }, reason: "test",
+      });
+    });
+    _expectNotLeaderError("subject.erase on follower", function () {
+      b.subject.erase("subj-1", {
+        reason: "test",
+        acknowledgements: ["no-litigation-hold", "no-statutory-retention-required"],
+      });
+    });
+    _expectNotLeaderError("subject.restrict on follower", function () {
+      b.subject.restrict("subj-1", { on: true, reason: "test" });
+    });
+    _expectNotLeaderError("subject.recordObjection on follower", function () {
+      b.subject.recordObjection("subj-1", { purpose: "marketing", reason: "test" });
+    });
+  } finally {
+    await fx.teardown();
+  }
+}
+
+async function testClusterGatesQueue() {
+  var fx = await _setupClusterGateFixture();
+  try {
+    b.queue.init({ backends: { "default": { protocol: "local" } } });
+    var threwEnqueue = null;
+    try { await b.queue.enqueue("test-q", { x: 1 }); }
+    catch (e) { threwEnqueue = e; }
+    check("queue.enqueue on follower throws NotLeaderError",
+          threwEnqueue && threwEnqueue.code === "NOT_LEADER");
+
+    var threwPurge = null;
+    try { await b.queue.purge("test-q"); }
+    catch (e) { threwPurge = e; }
+    check("queue.purge on follower throws NotLeaderError",
+          threwPurge && threwPurge.code === "NOT_LEADER");
+    try { await b.queue.shutdown(); } catch (_e) {}
+  } finally {
+    await fx.teardown();
+  }
+}
+
+async function testClusterGatesObjectStoreLocal() {
+  var fx = await _setupClusterGateFixture();
+  try {
+    var localProto = require(path.join(__dirname, "..", "lib", "object-store/local"));
+    var rootDir = path.join(fx.tmpDir, "obj");
+    var backend = localProto.create({ rootDir: rootDir });
+
+    var threwPut = null;
+    try { await backend.put("foo/bar", Buffer.from("hi")); }
+    catch (e) { threwPut = e; }
+    check("object-store-local.put on follower throws",
+          threwPut && threwPut.code === "NOT_LEADER");
+
+    var threwDelete = null;
+    try { await backend.delete("foo/bar"); }
+    catch (e) { threwDelete = e; }
+    check("object-store-local.delete on follower throws",
+          threwDelete && threwDelete.code === "NOT_LEADER");
+
+    // Reads remain anywhere — no gate. Set up a non-existent key for
+    // a clean error type comparison (NOT_FOUND, not NOT_LEADER).
+    var threwGet = null;
+    try { await backend.get("nope"); }
+    catch (e) { threwGet = e; }
+    check("object-store-local.get not gated by cluster",
+          threwGet && threwGet.code === "NOT_FOUND");
+  } finally {
+    await fx.teardown();
+  }
+}
+
+// ---- createApp ----
+
+async function _appGet(port, urlPath) {
+  return await b.httpClient.request({
+    url: "http://127.0.0.1:" + port + urlPath,
+    allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+    allowInternal:    true,
+  });
+}
+
+async function testCreateAppMinimalBoot() {
+  // Verification gate from blamejs-roadmap.md: "createApp() with a
+  // minimal config boots in under 1s and serves a 200 OK response."
+  // Time the full boot + listen + first 200 response.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-"));
+  var t0 = Date.now();
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },     // bot-guard refuses non-browser-y test clients
+    routes:  function (r) {
+      r.get("/", function (req, res) { b.render.text(res, "OK"); });
+    },
+  });
+  var bootMs = Date.now() - t0;
+  // Windows GitHub Actions runners (slow disk + cold-start) regularly
+  // exceed the original 1s budget; the assertion is a perf tripwire,
+  // not a correctness check. 5s catches pathological regressions
+  // (e.g. accidental sync-fs walk on boot) while giving Windows CI
+  // realistic headroom.
+  check("createApp boot time under 5s",                bootMs < 5000);                              // allow:raw-byte-literal — perf tripwire budget
+
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    check("listen returns port",                       typeof addr.port === "number" && addr.port > 0);
+    check("listen returns server reference",           addr.server && typeof addr.server === "object");
+    check("address() reflects bound port",             app.address().port === addr.port);
+
+    var resp = await _appGet(addr.port, "/");
+    check("minimal createApp serves 200",              resp.statusCode === 200);
+    check("response body matches handler",             resp.body.toString("utf8") === "OK");
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppDefaultMiddleware() {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    routes:  function (r) {
+      r.get("/healthz", function (req, res) { b.render.json(res, { ok: true }); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    // Default middleware stack includes botGuard, which rejects requests
+    // without browser-y fingerprints (no Accept-Language, no
+    // Sec-Fetch-Mode). Send those headers so the request reaches the
+    // route handler — the test verifies upstream middleware (requestId,
+    // securityHeaders) ran, not that bot-guard's defaults pass for
+    // arbitrary clients.
+    var resp = await b.httpClient.request({
+      url: "http://127.0.0.1:" + addr.port + "/healthz",
+      headers: {
+        "Accept-Language": "en-US",
+        "Sec-Fetch-Mode":  "navigate",
+        "User-Agent":      "Mozilla/5.0 blamejs-test",
+      },
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+      allowInternal:    true,
+    });
+    // requestId middleware sets X-Request-Id by default
+    check("default middleware: X-Request-Id set",
+          typeof resp.headers["x-request-id"] === "string" &&
+          resp.headers["x-request-id"].length > 0);
+    // securityHeaders sets a CSP / HSTS-equivalent
+    check("default middleware: security headers present",
+          typeof resp.headers["x-content-type-options"] === "string");
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppMiddlewareDisableable() {
+  // Operator opts out of requestId — no X-Request-Id on the response.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { requestId: false, securityHeaders: false, botGuard: false },
+    routes:  function (r) {
+      r.get("/x", function (req, res) { b.render.text(res, "x"); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var resp = await _appGet(addr.port, "/x");
+    check("middleware: requestId opted out → no X-Request-Id",
+          resp.headers["x-request-id"] === undefined);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppRoutesCallback() {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },
+    routes:  function (r) {
+      r.get("/users/:id", function (req, res) {
+        b.render.json(res, { id: req.params.id });
+      });
+      r.post("/echo", function (req, res) {
+        b.render.json(res, { method: req.method });
+      });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var got = await _appGet(addr.port, "/users/42");
+    check("routes callback: GET param parsed",
+          JSON.parse(got.body.toString("utf8")).id === "42");
+
+    var posted = await b.httpClient.request({
+      method: "POST",
+      url: "http://127.0.0.1:" + addr.port + "/echo",
+      body:  Buffer.from(""),
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+      allowInternal:    true,
+    });
+    check("routes callback: POST handler runs",
+          JSON.parse(posted.body.toString("utf8")).method === "POST");
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppWithJobs() {
+  // createApp's opts.jobs callback wires the jobs registry. Verifies
+  // that handlers defined inside the callback actually consume
+  // post-listen, and that shutdown drains in-flight jobs cleanly.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-jobs-"));
+  var processed = [];
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },
+    jobs: function (j) {
+      j.define("send-welcome", async function (job) {
+        processed.push(job.payload.userId);
+      });
+    },
+    jobsOptions: {
+      consumerDefaults: { pollIntervalMs: 30, fastPollMs: 10 },
+    },
+    routes: function (r) {
+      r.post("/users", async function (req, res) {
+        var enq = await app.jobs.enqueue("send-welcome", { userId: "u-from-route" });
+        b.render.json(res, { jobId: enq.jobId });
+      });
+    },
+  });
+  check("createApp: jobs instance exposed",            app.jobs && typeof app.jobs.enqueue === "function");
+  check("createApp: jobs registry knows the handler",  app.jobs.stats().defined.indexOf("send-welcome") !== -1);
+  check("createApp: jobs already started after createApp",  app.jobs.stats().started === true);
+
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var posted = await b.httpClient.request({
+      method: "POST",
+      url: "http://127.0.0.1:" + addr.port + "/users",
+      body: Buffer.from(""),
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+      allowInternal:    true,
+    });
+    check("route enqueues + responds",                 posted.statusCode === 200);
+
+    var t0 = Date.now();
+    while (processed.length === 0 && Date.now() - t0 < 5000) {
+      await new Promise(function (r) { setTimeout(r, 50); });
+    }
+    check("createApp+jobs: handler fired for the route-enqueued job",
+          processed.length === 1 && processed[0] === "u-from-route");
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppShutdown() {
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },
+    routes:  function (r) { r.get("/", function (req, res) { b.render.text(res, "OK"); }); },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+
+  // Confirm reachable
+  var beforeResp = await _appGet(addr.port, "/");
+  check("shutdown: reachable before",                  beforeResp.statusCode === 200);
+
+  await app.shutdown();
+  check("shutdown: address() returns null after",      app.address() === null);
+
+  // Connection should be refused now (server closed)
+  var connectionRefused = false;
+  try { await _appGet(addr.port, "/"); }
+  catch (_e) { connectionRefused = true; }
+  check("shutdown: connection refused after close",     connectionRefused);
+
+  // Idempotent — calling shutdown twice is safe
+  await app.shutdown();
+  check("shutdown: idempotent (second call is a no-op)", true);
+
+  fs.rmSync(dataDir, { recursive: true, force: true });
+}
+
+async function testCreateAppValidation() {
+  var threw = null;
+  try { await b.createApp(); }
+  catch (e) { threw = e; }
+  check("createApp(): no opts → throws",               threw && /opts object is required/.test(threw.message));
+
+  threw = null;
+  try { await b.createApp({}); }
+  catch (e) { threw = e; }
+  check("createApp({}): missing dataDir → throws",     threw && /dataDir is required/.test(threw.message));
+}
+
+function testCreateAppSurface() {
+  check("b.createApp is a function",                   typeof b.createApp === "function");
+}
+
+// ---- run() ----
+
+async function run() {
+  // Cluster gates — write-side gates across framework subsystems
+  await testClusterGatesAuditAndConsent();
+  await testClusterGatesSession();
+  await testClusterGatesSubject();
+  await testClusterGatesQueue();
+  await testClusterGatesObjectStoreLocal();
+
+  // createApp — orchestrates vault → externalDb → cluster →
+  // frameworkSchema → db → router → middleware → routes.
+  testCreateAppSurface();
+  await testCreateAppValidation();
+  await testCreateAppMinimalBoot();
+  await testCreateAppDefaultMiddleware();
+  await testCreateAppMiddlewareDisableable();
+  await testCreateAppRoutesCallback();
+  await testCreateAppWithJobs();
+  await testCreateAppShutdown();
+}
+
+module.exports = {
+  name: "Layer 5 — integration (cluster-gates: audit/consent/session/subject/queue/object-store)",
+  run:  run,
+  testClusterGatesAuditAndConsent:    testClusterGatesAuditAndConsent,
+  testClusterGatesSession:            testClusterGatesSession,
+  testClusterGatesSubject:            testClusterGatesSubject,
+  testClusterGatesQueue:              testClusterGatesQueue,
+  testClusterGatesObjectStoreLocal:   testClusterGatesObjectStoreLocal,
+  testCreateAppSurface:               testCreateAppSurface,
+  testCreateAppValidation:            testCreateAppValidation,
+  testCreateAppMinimalBoot:           testCreateAppMinimalBoot,
+  testCreateAppDefaultMiddleware:     testCreateAppDefaultMiddleware,
+  testCreateAppMiddlewareDisableable: testCreateAppMiddlewareDisableable,
+  testCreateAppRoutesCallback:        testCreateAppRoutesCallback,
+  testCreateAppWithJobs:              testCreateAppWithJobs,
+  testCreateAppShutdown:              testCreateAppShutdown,
+};

package/lib/vendor/blamejs/test/_helpers.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * Backward-compat shim. The real helpers live under ./helpers/ — this
+ * module re-exports the same surface so legacy `require("./_helpers")`
+ * imports keep working during the per-file test layout migration.
+ *
+ * New test files should import from ./helpers/ directly:
+ *   var { check, b } = require("../helpers");
+ */
+module.exports = require("./helpers");

package/lib/vendor/blamejs/test/_smoke-worker.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Smoke test worker — forked child that runs ONE test file's run()
+ * in a fresh Node process. Module-state isolation is automatic
+ * because the worker has its own module cache.
+ *
+ * Invocation: node test/_smoke-worker.js <test-file-path>
+ *
+ * Output contract: the LAST line of stdout is a JSON result of shape
+ *   { ok: boolean, checks: number, error?: string }
+ *
+ * Other stdout/stderr lines are forwarded to the parent for display
+ * on failure (the parent only prints them when ok=false).
+ */
+
+var path = require("node:path");
+var modulePath = process.argv[2];
+if (!modulePath) {
+  process.stderr.write("usage: _smoke-worker.js <test-file-path>\n");
+  process.exit(2);
+}
+
+(async function () {
+  var helpers, mod;
+  try {
+    helpers = require("./helpers");
+    mod = require(path.resolve(modulePath));
+  } catch (e) {
+    process.stdout.write("\n" + JSON.stringify({
+      ok:    false,
+      checks: 0,
+      error: "module load failed: " + (e && e.message),
+    }));
+    process.exit(1);
+  }
+  try {
+    if (typeof mod.run === "function") await mod.run();
+    if (Array.isArray(mod.groups) && mod.groups.length > 0) {
+      for (var i = 0; i < mod.groups.length; i++) {
+        var group = mod.groups[i];
+        var ctx = null;
+        try {
+          if (typeof group.setup === "function") ctx = await group.setup();
+          for (var j = 0; j < group.tests.length; j++) {
+            await group.tests[j].run(ctx);
+          }
+        } finally {
+          if (typeof group.teardown === "function") {
+            try { await group.teardown(ctx); }
+            catch (_te) { /* teardown errors don't mask test failures */ }
+          }
+        }
+      }
+    }
+    process.stdout.write("\n" + JSON.stringify({
+      ok:     true,
+      checks: helpers.getChecks(),
+    }));
+    process.exit(0);
+  } catch (err) {
+    process.stdout.write("\n" + JSON.stringify({
+      ok:     false,
+      checks: helpers.getChecks(),
+      error:  (err && err.message) || String(err),
+      stack:  err && err.stack,
+    }));
+    process.exit(1);
+  }
+})();