@bongos/core 1.19.91 → 1.19.93

package/scripts/migrate.sh

@@ -32,7 +32,13 @@ INVOKE_CWD="${INIT_CWD:-$PWD}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 DEFAULT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 CORE_ROOT="$(cd "$DEFAULT_ROOT" && node -e "process.stdout.write(require('./src/instance-config').resolveCoreRoot())" 2>/dev/null || echo "$DEFAULT_ROOT")"
-INSTANCE_ROOT="$(cd "$INVOKE_CWD" && node -e "process.stdout.write(require('$DEFAULT_ROOT/src/instance-config').resolveInstanceRootExplicit() || '')" 2>/dev/null || true)"
+# The module path rides in as argv rather than being interpolated into the JS source: a
+# Windows-shaped DEFAULT_ROOT contains backslashes, which are ESCAPE SEQUENCES inside a JS
+# string literal ("\U", "\r", "\D"), so interpolating corrupts the path, the require throws,
+# and this silently falls back to DEFAULT_ROOT — precisely the F6 shape described above, just
+# triggered by the path separator instead of the cwd. Fixed alongside task 1002755, which hit
+# the identical bug one resolution further down.
+INSTANCE_ROOT="$(cd "$INVOKE_CWD" && node -e "process.stdout.write(require(process.argv[1]).resolveInstanceRootExplicit() || '')" "$DEFAULT_ROOT/src/instance-config" 2>/dev/null || true)"
 INSTANCE_ROOT="${INSTANCE_ROOT:-$DEFAULT_ROOT}"
 # Run from the instance root so instance-relative paths resolve (the post-deploy art check below)
 # AND so the enabledModules() read finds the instance's config/modules.json (resolveInstanceRoot
@@ -49,17 +55,68 @@ if [ "${1:-}" = "--print-roots" ]; then
   exit 0
 fi
 
-DB="${PGDATABASE:-amazonprimea}"
-
 # Test/ops seam (added with the 1.18.19 space-in-path fix): --print-migrations walks the REAL core-migration loop but reports
 # each path instead of applying it, and touches NO DB. tests/migrate_root_resolution.mjs uses it to
 # assert that a checkout whose path contains a space still yields whole, readable paths. Reporting
 # through the real loop (rather than a copy of it in the test) is the point: if the loop ever reverts
 # to an unquoted `for f in $MIGRATIONS`, this seam fragments the paths and the test fails. Also handy
 # in the field — `npm run migrate -- --print-migrations` shows exactly what migrate would apply.
+#
+# Resolved BEFORE the database name below, because a dry run touches no DB (every psql call is
+# guarded by DRY_RUN) and so must not require one.
 DRY_RUN=0
 if [ "${1:-}" = "--print-migrations" ]; then DRY_RUN=1; fi
 
+# --- Which database? (task 1002755) ---------------------------------------
+# SAME precedence as src/bongos/pool.js: an explicit PGDATABASE wins, else the instance's own
+# branding pack names it (config/branding.json db.database, else the neutral starter). Resolved by
+# CALLING pool.instanceDbName() rather than re-reading the config here, so the migrator and the
+# running server can never disagree about which database this instance is.
+#
+# There is deliberately NO literal fallback. This script ships inside the core to EVERY instance,
+# so a baked-in default is one host's database name pointed at everyone else's box: on a co-hosted
+# machine it silently targets a stranger's data, and everywhere else it dies with a confusing
+# "database ... does not exist" long after the caller has moved its version pin. pool.js already
+# made exactly this call for the server ("NOT hard-defaulting to a host's DB name", pool.js:10-16);
+# this is the migrator catching up, not a new policy.
+# The module path rides in as argv, NOT interpolated into the JS source: a Windows-shaped
+# CORE_ROOT contains backslashes, and inside a JS string literal those are escape sequences
+# ("\U", "\r"), so interpolating silently corrupts the path and this resolution degrades to
+# empty. argv values are never parsed as JS.
+DB="${PGDATABASE:-}"
+DB_RESOLVER_ERR=""
+if [ -z "$DB" ]; then
+  # stderr is CAPTURED, not discarded: "the pack names no database" and "the resolver could not
+  # run at all" are different problems with different fixes, and collapsing both into an empty
+  # string sends the operator to edit a config file when the real answer is `npm install`.
+  # (pool.js requires pg, so an instance with no node_modules fails here rather than resolving.)
+  if DB_RESOLVED="$(node -e "process.stdout.write(require(process.argv[1]).instanceDbName() || '')" "$CORE_ROOT/src/bongos/pool" 2>&1)"; then
+    DB="$DB_RESOLVED"
+  else
+    DB_RESOLVER_ERR="$DB_RESOLVED"
+  fi
+fi
+if [ -z "$DB" ] && [ "$DRY_RUN" = 0 ]; then
+  echo "migrate: cannot determine which database to migrate." >&2
+  if [ -n "$DB_RESOLVER_ERR" ]; then
+    echo "  the db-name resolver did not run: $(printf '%s' "$DB_RESOLVER_ERR" | head -n 1)" >&2
+    echo "  if the core's dependencies are not installed yet, run: npm install" >&2
+  else
+    echo "  Set PGDATABASE, or give this instance a db.database in config/branding.json." >&2
+  fi
+  echo "  Refusing to guess: a baked-in default would target another instance's database." >&2
+  exit 2
+fi
+
+# Test/ops seam: --print-db reports the database this run WOULD migrate, and exits before any DB
+# work. `bongos upgrade` calls it to learn the name up front, so its pre-flight can prove the DB is
+# reachable BEFORE the version pin moves — otherwise an unresolvable name is only discovered at
+# migrate time, and the pin has to be unwound (task 1002755).
+if [ "${1:-}" = "--print-db" ]; then
+  printf '%s\n' "$DB"
+  exit 0
+fi
+
 # --- Instance-seed policy (task 1704 / ADR 0105) --------------------------
 # OTB/product scope-truth (versions, goals, done_when_criteria) lives in seed
 # migrations under migrations/instance/ (plus a few guarded blocks embedded in the

package/src/module-api.js

@@ -609,8 +609,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.89 with no explicit bump. run 31717551308. (task 1002620)
 //   1.19.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.90 with no explicit bump. run 31722841411. (task 1002620)
+//   1.19.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.91 with no explicit bump. run 31727411036. (task 1002620)
+//   1.19.93 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.92 with no explicit bump. run 31735192921. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.91'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.93'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migrate_root_resolution.mjs

@@ -18,7 +18,7 @@
 import { strict as assert } from 'node:assert';
 import { execFileSync } from 'node:child_process';
 import {
-  mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, symlinkSync, realpathSync,
+  mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, symlinkSync, copyFileSync, realpathSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -116,7 +116,15 @@ function makeCore({ spaced, files = ['001_a.sql', '002_b.sql', '006_pms_v2.sql',
   mkdirSync(path.join(dir, 'scripts'));
   mkdirSync(path.join(dir, 'migrations'));
   mkdirSync(path.join(dir, 'src'));
-  symlinkSync(MIGRATE, path.join(dir, 'scripts', 'migrate.sh'));
+  // Symlink so the fixture can never drift from the real script. Windows refuses symlinks without
+  // elevation (EPERM), so fall back to a COPY taken fresh from MIGRATE on each run — equally
+  // drift-proof, and it is what lets these cases run on a Windows checkout at all.
+  try {
+    symlinkSync(MIGRATE, path.join(dir, 'scripts', 'migrate.sh'));
+  } catch (e) {
+    if (e.code !== 'EPERM' && e.code !== 'EACCES') throw e;
+    copyFileSync(MIGRATE, path.join(dir, 'scripts', 'migrate.sh'));
+  }
   // Pin both roots to the fixture explicitly, so the test does not lean on migrate.sh's
   // node-unavailable fallback to decide what CORE_ROOT is.
   writeFileSync(path.join(dir, 'src', 'instance-config.js'), [
@@ -216,5 +224,95 @@ t('the pre-fix unquoted loop now fails loudly instead of silently skipping', ()
   assert.equal(r.applied.length, 0, 'the unquoted loop applies nothing (that was the bug)');
 });
 
+// ==========================================================================
+// WHICH DATABASE does migrate target? (task 1002755)
+//
+// scripts/migrate.sh:52 used to read `DB="${PGDATABASE:-amazonprimea}"` — one host instance's
+// database name, baked into a script the core ships to EVERY instance. With no PGDATABASE in the
+// environment, a co-hosted box silently aimed at a stranger's database and everywhere else died
+// with a confusing "database ... does not exist" — after the caller had already moved its version
+// pin. ADR 0149:17 had already named the divergence: the server pool resolves from the branding
+// pack while migrate.sh defaulted to a literal, and "they only agree if PGDATABASE is set for both."
+//
+// These drive the `--print-db` seam, which resolves the name and exits before any psql — the
+// --print-roots pattern. The fixture carries a REAL config/branding.json so the assertions
+// exercise the actual resolver (pool.instanceDbName) rather than a stub of it.
+
+// A core fixture that is ALSO an instance: adds the branding pack instanceDbName() reads.
+// db.database === null models the neutral starter — an instance that has not named its database.
+function makeInstance({ database } = {}) {
+  const dir = makeCore({ spaced: false });
+  mkdirSync(path.join(dir, 'config'), { recursive: true });
+  writeFileSync(
+    path.join(dir, 'config', 'branding.json'),
+    `${JSON.stringify({ db: { database: database ?? null } }, null, 2)}\n`,
+  );
+  // migrate.sh resolves the name through <CORE_ROOT>/src/bongos/pool. Re-export the REAL module
+  // so these cases exercise the actual resolver rather than a restatement of it — a stub here
+  // would pass happily while pool.js drifted. The real file resolves its own `pg` from the repo's
+  // node_modules (module resolution walks up from ITS path, not the fixture's), and its
+  // resolveInstanceRoot() falls back to cwd — which migrate.sh has already set to this fixture.
+  mkdirSync(path.join(dir, 'src', 'bongos'), { recursive: true });
+  writeFileSync(
+    path.join(dir, 'src', 'bongos', 'pool.js'),
+    `module.exports = require(${JSON.stringify(path.join(REPO_ROOT, 'src', 'bongos', 'pool.js'))});\n`,
+  );
+  return dir;
+}
+
+function printDb(coreDir, extraEnv = {}) {
+  const env = { ...process.env, ...extraEnv };
+  for (const k of Object.keys(env)) if (/_INSTANCE_ROOT$/.test(k)) delete env[k];
+  if (!('PGDATABASE' in extraEnv)) delete env.PGDATABASE;
+  try {
+    const stdout = execFileSync('bash', [path.join(coreDir, 'scripts', 'migrate.sh'), '--print-db'],
+      { cwd: coreDir, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: 0, stdout: stdout.trim(), stderr: '' };
+  } catch (e) {
+    return { status: e.status ?? 1, stdout: String(e.stdout || '').trim(), stderr: String(e.stderr || '') };
+  }
+}
+
+t('--print-db reports the database named by the instance\'s own branding pack', () => {
+  const r = printDb(makeInstance({ database: 'acme_instance_db' }));
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(r.stdout, 'acme_instance_db');
+});
+
+t('an explicit PGDATABASE wins over the pack — same precedence as pool.js', () => {
+  const r = printDb(makeInstance({ database: 'from_the_pack' }), { PGDATABASE: 'from_the_env' });
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(r.stdout, 'from_the_env');
+});
+
+t('an instance that names no database is REFUSED, never defaulted', () => {
+  const r = printDb(makeInstance({ database: null }));
+  assert.equal(r.status, 2, 'must exit 2 — the seam refuses rather than printing an empty name');
+  assert.doesNotMatch(r.stdout, /\S/, 'nothing is printed as the database name');
+  assert.match(r.stderr, /cannot determine which database/i);
+  assert.match(r.stderr, /Refusing to guess/i);
+  // the regression itself: it must not reach for another instance's database
+  assert.doesNotMatch(`${r.stdout}${r.stderr}`, /amazonprimea/i);
+});
+
+t('--print-migrations stays DB-free — a dry run must not require a database name', () => {
+  // the seam walks the real loop and touches no psql, so an instance with no db.database
+  // must still be able to list what would be applied
+  const core = makeInstance({ database: null });
+  const r = printMigrations(core);
+  assert.equal(r.status, 0, `a dry run must not need a database: ${r.stderr}`);
+  assert.equal(r.listed, 4);
+});
+
+t('migrate.sh hardcodes no instance database name', () => {
+  // the static lock on the original defect — a literal default reintroduced anywhere in the
+  // script points every other instance at a database that is not theirs
+  const src = readFileSync(MIGRATE, 'utf8');
+  const code = src.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join('\n');
+  assert.doesNotMatch(code, /PGDATABASE:-\s*[A-Za-z]/,
+    'PGDATABASE must have no literal fallback — resolve from the branding pack instead');
+  assert.doesNotMatch(code, /amazonprimea/i, 'no instance database name in executable lines');
+});
+
 console.log(`\nmigrate_root_resolution: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/upgrade.mjs

@@ -1033,6 +1033,64 @@ t('runUpgrade: a REFUSED bump still reports the non-blocking module findings', a
   assert.match(text, /author unreachable/);
 });
 
+// ── which database will migrate target? (task 1002755) ────────────────────
+// The pre-flight probe is only meaningful if it tests the SAME database migrate will use. It used
+// to be handed process.env.PGDATABASE — undefined on a normal box — so psql fell through to a
+// database named after the OS user, failed for an unrelated reason, and soft-skipped; migrate then
+// picked its own name and died on a database that did not exist, AFTER the pin had moved.
+// The three-way result is the point: "names no database" and "resolver could not run" are
+// different problems and only the first may block a bump.
+
+t('resolveInstanceDb: an explicit PGDATABASE wins without spawning anything', () => {
+  const prev = process.env.PGDATABASE;
+  process.env.PGDATABASE = 'from_the_env';
+  try {
+    let spawned = false;
+    const r = u.resolveInstanceDb({ instanceDir: '/x' }, () => { spawned = true; return { status: 0, stdout: 'other' }; });
+    assert.deepEqual(r, { db: 'from_the_env', ran: true });
+    assert.equal(spawned, false, 'the env answer needs no child process');
+  } finally {
+    if (prev === undefined) delete process.env.PGDATABASE; else process.env.PGDATABASE = prev;
+  }
+});
+
+t('resolveInstanceDb: reports the name the core resolver printed', () => {
+  const prev = process.env.PGDATABASE;
+  delete process.env.PGDATABASE;
+  try {
+    const r = u.resolveInstanceDb({ instanceDir: '/x' }, () => ({ status: 0, stdout: 'acme_db\n' }));
+    assert.deepEqual(r, { db: 'acme_db', ran: true });
+  } finally { if (prev !== undefined) process.env.PGDATABASE = prev; }
+});
+
+t('resolveInstanceDb: ran-but-empty is FATAL, unrunnable is not', () => {
+  const prev = process.env.PGDATABASE;
+  delete process.env.PGDATABASE;
+  try {
+    // the instance genuinely names no database — knowable, and a bump must stop
+    assert.deepEqual(u.resolveInstanceDb({ instanceDir: '/x' }, () => ({ status: 0, stdout: '' })),
+      { db: null, ran: true });
+    // the resolver could not run — a DIFFERENT problem; must not be reported as "no database"
+    assert.deepEqual(u.resolveInstanceDb({ instanceDir: '/x' }, () => ({ status: 1, stdout: '' })),
+      { db: null, ran: false });
+    assert.deepEqual(u.resolveInstanceDb({ instanceDir: '/x' }, () => ({ error: new Error('ENOENT') })),
+      { db: null, ran: false });
+  } finally { if (prev !== undefined) process.env.PGDATABASE = prev; }
+});
+
+t('runUpgrade: refuses BEFORE the pin moves when the instance names no database', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'nodb-'));
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '1.0.0' } }, null, 2));
+  const res = await u.runUpgrade({ to: '1.0.1', instance: dir, registry: true, force: true }, {
+    resolveInstanceDb: () => ({ db: null, ran: true }),
+    log: () => {},
+  });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /cannot determine which database/i);
+  // the pin must be untouched — that is the whole point of checking in pre-flight
+  assert.match(readFileSync(join(dir, 'package.json'), 'utf8'), /"@bongos\/core": "1\.0\.0"/);
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);