@bongos/core 1.19.812 → 1.19.814

package/tests/criterion_goal_attach.mjs

@@ -36,21 +36,54 @@ const api = require('../src/module-api.js');
 // db.updateCriterionGoal instead would leave its SQL with no coverage at all —
 // a mutation that made the UPDATE write nothing stayed green until this landed.
 const sqlLog = [];
+
+// One statement handler, shared by the pool and by the transaction client it
+// hands out, so a statement is recorded identically wherever it runs — otherwise
+// "the UPDATE reached the pool" would quietly stop being true the moment the
+// route started using a transaction, and the assertions would pass over nothing.
+const runSql = async (sql, params, via = 'pool') => {
+  sqlLog.push({ sql, params, via });
+  if (/UPDATE done_when_criteria/.test(sql)) {
+    const [goalId, id] = params;
+    criterion = { ...criterion, id: Number(id), goal_id: goalId };
+    return { rows: [{ ...criterion }] };
+  }
+  if (/COALESCE\(MAX\(sort_order\)/.test(sql)) return { rows: [{ next: 7 }] };
+  if (/INSERT INTO done_when_criteria/.test(sql)) {
+    const [versionId, criterionId, criterionMd, goalId, sortOrder] = params;
+    return { rows: [{ id: 99, version_id: versionId, criterion_id: criterionId, criterion_md: criterionMd, goal_id: goalId, sort_order: sortOrder, satisfied: false }] };
+  }
+  if (/^\s*(BEGIN|COMMIT|ROLLBACK)\s*$/i.test(sql)) return { rows: [] };
+  throw new Error(`unexpected SQL reached the pool: ${sql}`);
+};
+
+// connect() makes withTx work against the fake (task 1003840). Every client it
+// returns is recorded, so a test can assert the transaction BOUNDARY — that a
+// write happened between BEGIN and COMMIT — not merely that the write happened.
+const clients = [];
 Object.defineProperty(api, 'pool', {
   configurable: true,
   value: {
-    query: async (sql, params) => {
-      sqlLog.push({ sql, params });
-      if (/UPDATE done_when_criteria/.test(sql)) {
-        const [goalId, id] = params;
-        criterion = { ...criterion, id: Number(id), goal_id: goalId };
-        return { rows: [{ ...criterion }] };
-      }
-      throw new Error(`unexpected SQL reached the pool: ${sql}`);
+    query: (sql, params) => runSql(sql, params, 'pool'),
+    connect: async () => {
+      const client = {
+        query: (sql, params) => runSql(sql, params, 'client'),
+        release: () => { client.released = true; },
+        released: false,
+      };
+      clients.push(client);
+      return client;
     },
   },
 });
 
+// The statements of the LAST transaction, in order — BEGIN … COMMIT included.
+function txStatements() {
+  const begin = sqlLog.findIndex((q) => /^\s*BEGIN\s*$/i.test(q.sql));
+  if (begin === -1) return [];
+  return sqlLog.slice(begin).map((q) => q.sql.trim().split(/\s+/).slice(0, 3).join(' '));
+}
+
 const db = require('../modules/lifecycle/db.js');
 const doneWhen = require('../modules/lifecycle/done-when.js');
 const goalEdits = require('../modules/lifecycle/goal-edits.js');
@@ -71,6 +104,7 @@ function resetWorld() {
   actor = METIC;
   completable = new Set([3]);
   sqlLog.length = 0;
+  clients.length = 0;
   calls = { achieve: [], auditMove: [], prose: [] };
   // Derived from the SQL the real updateCriterionGoal actually sent, as
   // [criterionId, goalId] — so "nothing was written" means no UPDATE reached the
@@ -140,6 +174,15 @@ async function patch(body) {
   return { status: res.status, body: await res.json().catch(() => ({})) };
 }
 
+async function post(versionId, body) {
+  const res = await fetch(`${base}/versions/${versionId}/done-when`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+
 let passed = 0, failed = 0;
 async function test(name, fn) {
   resetWorld();
@@ -342,6 +385,188 @@ await test('the UPDATE sets goal_id from the parameter, keyed by criterion id',
   assert.deepEqual(update.params, [3, 55]);
 });
 
+
+// ---- the TOCTOU window (task 1003840) --------------------------------------
+//
+// The route used to resolve its facts on the pool, decide, and then write on
+// another connection. Between the decision and the write the goal could be
+// transferred or closed and the membership revoked, and the write would land on
+// authority that no longer held. These pin the three properties that close it:
+// one transaction, the authority read LOCKED inside it, and nothing written (or
+// announced) when the decision refuses.
+
+// Record what the route ASKS FOR, since getGoal is stubbed here and its SQL never
+// reaches the recording pool.
+const goalReads = [];
+const versionReads = [];
+const realGetGoal = db.getGoal;
+const realGetVersion = db.getVersion;
+db.getGoal = async (id, deps = {}) => { goalReads.push({ id: Number(id), deps }); return realGetGoal(id, deps); };
+db.getVersion = async (id, deps = {}) => { versionReads.push({ id, deps }); return realGetVersion(id, deps); };
+
+await test('the authority read is LOCKED and inside the transaction (task 1003840)', async () => {
+  actor = ARCHON;
+  goalReads.length = 0;
+  await patch({ goal_id: 3 });
+  assert.ok(goalReads.length > 0, 'the route read a goal at all');
+  for (const r of goalReads) {
+    assert.ok(r.deps && r.deps.client, `goal ${r.id} was read OUTSIDE the transaction`);
+    assert.equal(r.deps.forUpdate, true, `goal ${r.id} was read without FOR UPDATE — a re-read that is not locked still races`);
+  }
+});
+
+await test('the write lands BETWEEN begin and commit (task 1003840)', async () => {
+  actor = ARCHON;
+  await patch({ goal_id: 3 });
+  const seq = sqlLog.map((q) => q.sql.trim().split(/\s+/).slice(0, 2).join(' ').toUpperCase());
+  const begin = seq.findIndex((x) => x.startsWith('BEGIN'));
+  const update = seq.findIndex((x) => x.startsWith('UPDATE DONE_WHEN_CRITERIA'));
+  const commit = seq.findIndex((x) => x.startsWith('COMMIT'));
+  assert.ok(begin !== -1, 'a transaction was opened');
+  assert.ok(update !== -1, 'the move was written');
+  assert.ok(commit !== -1, 'the transaction was committed');
+  assert.ok(begin < update && update < commit,
+    `expected BEGIN < UPDATE < COMMIT, got ${begin} / ${update} / ${commit}`);
+  // ORDER IS NOT ENOUGH. A write sent to the POOL while a transaction happens to
+  // be open still lands between BEGIN and COMMIT in this log, and is exactly the
+  // bug — it is outside the transaction and rolls back with nothing. Caught by
+  // probing: dropping the client from updateCriterionGoal left the ordering
+  // assertion green. So the connection is asserted, not just the sequence.
+  const writes = sqlLog.filter((q) => /UPDATE done_when_criteria/.test(q.sql));
+  assert.ok(writes.length > 0, 'the move was written');
+  for (const w of writes) {
+    assert.equal(w.via, 'client', 'the write must run ON the transaction client, not the pool');
+  }
+});
+
+await test('the transaction client is always released (task 1003840)', async () => {
+  // A leaked client is a pool slot that never comes back; under load that is an
+  // outage, and it would not show up in any assertion about the response.
+  actor = ARCHON;
+  await patch({ goal_id: 3 });
+  assert.ok(clients.length > 0, 'a client was checked out');
+  for (const c of clients) assert.equal(c.released, true, 'every checked-out client is released');
+});
+
+await test('a REFUSED move writes nothing and announces nothing (task 1003840)', async () => {
+  // The rollback path. A refusal must leave no row written and no audit entry:
+  // recording a move that did not happen would put an edit in the ledger that
+  // never landed.
+  actor = METIC;                       // not the owner of goal 3
+  goals.set(3, { id: 3, version_id: V1, owner_builder_id: 999, status: 'open' });
+  const res = await patch({ goal_id: 3 });
+  assert.ok(res.status >= 400, `expected a refusal, got ${res.status}`);
+  assert.deepEqual(calls.updateGoal, [], 'no UPDATE reached the pool');
+  assert.deepEqual(calls.auditMove, [], 'no move was announced for a write that never landed');
+  assert.equal(clients.every((c) => c.released), true, 'the client is released on the refusal path too');
+});
+
+await test('FOR UPDATE outside a transaction is refused, not silently downgraded (task 1003840)', async () => {
+  // The lock is the whole fix, so asking for one where it cannot be held must be
+  // an error rather than a quiet plain read — otherwise a future caller drops the
+  // client, keeps the flag, and believes it is safe.
+  // The REAL implementation, not this file's stub of it: db.getGoal is replaced
+  // above, so asserting against that would only prove the stub ignores the flag.
+  // It throws before touching a pool, so this needs no database.
+  const realGoals = require('../modules/lifecycle/db-goals.js');
+  await assert.rejects(
+    () => realGoals.getGoal(3, { forUpdate: true }),
+    /requires deps\.client/,
+    'forUpdate without a client must throw',
+  );
+});
+
+
+// ---- CREATE route: the same machinery, the same proof (task 1003840, round 2) --
+//
+// The first cut shipped the CREATE route's transaction with no runtime coverage —
+// only a source-regex on the sentinel shape — while its PATCH sibling got four
+// behavioural tests. Identical machinery deserves identical proof: a regex cannot
+// tell whether the INSERT actually ran on the transaction client.
+
+await test('CREATE: the goal is locked, inside the transaction (task 1003840)', async () => {
+  actor = ARCHON;
+  goalReads.length = 0;
+  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.ok(goalReads.length > 0, 'the route read the goal');
+  for (const g of goalReads) {
+    assert.ok(g.deps && g.deps.client, 'the goal was read OUTSIDE the transaction');
+    assert.equal(g.deps.forUpdate, true, 'the goal was read without FOR UPDATE');
+  }
+});
+
+await test('CREATE: the INSERT runs ON the transaction client (task 1003840)', async () => {
+  actor = ARCHON;
+  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  const inserts = sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql));
+  assert.equal(inserts.length, 1, 'exactly one INSERT');
+  assert.equal(inserts[0].via, 'client', 'the INSERT must not leave the transaction');
+  // Its sort_order read is part of the SAME decision and must share the client,
+  // or two concurrent creates can read the same next order.
+  const maxRead = sqlLog.find((q) => /COALESCE\(MAX\(sort_order\)/.test(q.sql));
+  assert.ok(maxRead, 'the sort_order read happened');
+  assert.equal(maxRead.via, 'client', 'the read that decides sort_order shares the transaction');
+});
+
+await test('CREATE: a refusal writes nothing and releases the client (task 1003840)', async () => {
+  actor = METIC;
+  goals.set(3, { id: 3, version_id: V1, owner_builder_id: 999, status: 'open' });
+  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  assert.ok(r.status >= 400, `expected a refusal, got ${r.status}`);
+  assert.equal(sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql)).length, 0, 'nothing was inserted');
+  assert.ok(clients.length > 0 && clients.every((c) => c.released), 'the client is released on the refusal path');
+});
+
+await test('the VERSION is locked too, not only the goal (task 1003840)', async () => {
+  // The task names three facts; the first cut locked one. A plain read is never
+  // blocked by another session's row lock under READ COMMITTED, so an unlocked
+  // version could still be frozen between this read and this COMMIT.
+  actor = ARCHON;
+  versionReads.length = 0;
+  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  assert.ok(versionReads.length > 0, 'the route read the version');
+  for (const v of versionReads) {
+    assert.ok(v.deps && v.deps.client, 'the version was read outside the transaction');
+    assert.equal(v.deps.forUpdate, true, 'the version was read without FOR UPDATE');
+  }
+});
+
+await test('a move locks both goals in ASCENDING ID ORDER, not call order (task 1003840)', async () => {
+  // Call order is source-then-destination, so 10->5 and 5->10 running at once
+  // would take the two locks in opposite orders and deadlock. One agreed order
+  // makes them queue. Asserted for the descending move, where the two differ.
+  actor = ARCHON;
+  goals.set(10, { id: 10, version_id: V1, owner_builder_id: ARCHON.id, status: 'open' });
+  criterion.goal_id = 10;
+  goalReads.length = 0;
+  const r = await patch({ goal_id: 3 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  const lockOrder = goalReads.filter((g) => g.deps && g.deps.forUpdate).map((g) => g.id);
+  assert.deepEqual(lockOrder, [...lockOrder].sort((a, b) => a - b),
+    `goals were locked in ${lockOrder.join(',')} — not ascending id order`);
+  assert.deepEqual(lockOrder, [3, 10], 'both ends are locked, lowest id first');
+});
+
+await test('setGoalStatus writes on the transaction client (task 1003840)', async () => {
+  // The auto-achieve's actual writer. Missed in the first cut, where it kept its
+  // own copy of the pool rule — so the UPDATE ran on the pool while the route
+  // held that same row FOR UPDATE on its client: a self-deadlock against real
+  // Postgres, not merely an untransacted write.
+  const realGoals = require('../modules/lifecycle/db-goals.js');
+  const seen = [];
+  const fakeClient = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ id: 3, status: 'achieved' }] }; } };
+  await realGoals.setGoalStatus({ goalId: 3, status: 'achieved' }, { client: fakeClient });
+  assert.equal(seen.length, 1, 'the UPDATE reached the injected client');
+  assert.match(seen[0].sql, /UPDATE goals/);
+  assert.deepEqual(seen[0].params, [3, 'achieved']);
+});
+
+// The wrapper installed above is removed, so nothing after this file's own tests
+// inherits a patched module export.
+db.getGoal = realGetGoal;
+db.getVersion = realGetVersion;
+
 await new Promise((r) => server.close(r));
 console.log(`\ncriterion_goal_attach: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/government_ownership_scope.mjs

@@ -100,18 +100,24 @@ test('A2: every ".own"-suffixed key DECLARES scope own — the namespace never o
 });
 
 test('A3: the modelled families are the ones the ownership sweep names', () => {
+  // `task` joined the modelled families in task 1002443 (ADR 0297) — the first
+  // family added because a ROUTE needed it rather than to complete the model.
   assert.deepEqual(Object.keys(RESOURCE_FAMILIES).sort(),
-    ['box', 'builder_prefs', 'claim', 'credential', 'goal', 'memory']);
+    ['box', 'builder_prefs', 'claim', 'credential', 'goal', 'memory', 'task']);
   assert.deepEqual([...ownershipScopedKeys()].sort(),
-    ['box.manage.own', 'credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.act.own']);
-  // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`.
+    ['box.manage.own', 'credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.abandon.own', 'task.act.own']);
+  // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`,
+  // and `task.abandon` carries no suffix at all — it predates the axis and was given
+  // scope/resource/verb in place rather than renamed, because it is seeded in live
+  // rank rows (governance_002) and a key rename is a migration, not a declaration.
   assert.deepEqual([...crossOwnerKeys()].sort(),
-    ['box.fleet.manage', 'claim.release.any', 'memory.read.any']);
+    ['box.fleet.manage', 'claim.release.any', 'memory.read.any', 'task.abandon']);
   // The escalation path is DECLARED per key, never derived from the resource
-  // family (task 1003195). box is the one REAL pair in the catalog today:
-  // `box.fleet.manage` is the same `manage` verb over every owner's box, so it
-  // genuinely subsumes managing your own.
+  // family (task 1003195). TWO real pairs now: `box.fleet.manage` is the same
+  // `manage` verb over every owner's box, and `task.abandon` the same `act` verb
+  // over every creator's task, so each genuinely subsumes doing it to your own.
   assert.deepEqual(crossOwnerKeysFor('box.manage.own'), ['box.fleet.manage']);
+  assert.deepEqual(crossOwnerKeysFor('task.abandon.own'), ['task.abandon']);
   // claim and memory each HAVE an `any` key in their family and still declare no
   // counterpart — the distinction the family-derived version could not make.
   // `claim.release.any` carries one third of `act` (release, not cost or notes);