@bongos/core 1.19.923 → 1.19.924

package/tests/core_upgrade_door.mjs

@@ -15,7 +15,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -52,10 +52,24 @@ await t('the shape and the action both reach the DB constraints', () => {
   // The JS list and the CHECK are two spellings of one vocabulary; a widening that
   // lands in only one of them fails at insert time, in production, on the first
   // real use. (The bug class task 1003913 shipped a fix for, in another file.)
-  const mig = read('modules', 'provisioning', 'migrations', 'provisioning_018_core_upgrade_intent.sql')
+  // Read the NEWEST migration that widens the action CHECK, not a fixed filename: the
+  // vocabulary grows, and a test pinned to one file passes forever while the constraint
+  // it is meant to guard falls behind (task 1004121 added an action 018 does not carry).
+  const migDir = join(__dirname, '..', 'modules', 'provisioning', 'migrations');
+  const widenings = readdirSync(migDir).filter((f) => f.endsWith('.sql'))
+    .filter((f) => /ADD CONSTRAINT provisioning_intents_action_check/.test(readFileSync(join(migDir, f), 'utf8')))
+    .sort();
+  assert.ok(widenings.length, 'some migration defines the action CHECK');
+  const mig = readFileSync(join(migDir, widenings[widenings.length - 1]), 'utf8')
+    .replace(/^\s*--.*$/gm, ' ').replace(/\s+/g, ' ');
+  const shapes = read('modules', 'provisioning', 'migrations', 'provisioning_018_core_upgrade_intent.sql')
     .replace(/^\s*--.*$/gm, ' ').replace(/\s+/g, ' ');
-  assert.match(mig, /CHECK \(action IN \([^)]*'core-upgrade'\)\)/, 'the intents CHECK admits the new action');
-  assert.match(mig, /CHECK \(hosting_shape IN \([^)]*'control-plane'\)\)/, 'the instances CHECK admits the new shape');
+  // Membership, not POSITION. The old spelling required 'core-upgrade' to be the last
+  // item before the closing paren, so the next action appended after it failed a test
+  // that had nothing to say about the next action.
+  assert.match(mig, /CHECK \(action IN \(/, 'the intents CHECK is an action allow-list');
+  assert.ok(mig.includes("'core-upgrade'"), 'and it still admits the move itself');
+  assert.match(shapes, /CHECK \(hosting_shape IN \([^)]*'control-plane'\)\)/, 'the instances CHECK admits the new shape');
   for (const a of P.INTENT_ACTIONS) {
     assert.ok(mig.includes(`'${a}'`), `the widened CHECK must still carry '${a}' — a rewrite drops what it forgets`);
   }
@@ -404,5 +418,43 @@ await t('THE DEPLOY PAGE NEVER COMPUTES A VERSION COMPARISON — every number on
   assert.match(js, /p\.behind/, 'and asks the server whether there is anything to do');
 });
 
+console.log('\nthe pre-flight verdict, and when it may be shown (task 1004121):');
+
+const snapOf = (over = {}) => ({
+  served_version: '1.19.917', available: ['1.19.917', '1.19.921'], recommended: '1.19.921',
+  observed_at: new Date().toISOString(), preflight_at: new Date().toISOString(), ...over,
+});
+const box = { id: '1', slug: 'cloudbongos', hosting_shape: 'control-plane' };
+
+await t('a verdict taken against the version ON OFFER is shown', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.921', ok: true, lines: ['database reachable'], error: null } }), null);
+  assert.ok(p.preflight, 'it reaches the control');
+  assert.equal(p.preflight.target, '1.19.921');
+  assert.ok(p.preflight_at, 'with its own age, not the probe’s');
+});
+
+await t('a verdict taken against a SUPERSEDED version is withheld, not shown as a pass', () => {
+  // The whole point of storing `target` with the verdict. A pass checked against
+  // 1.19.920 says nothing true about a button labelled 1.19.921 — and a stale pass is
+  // worse than no answer, because it reads as a guarantee.
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.920', ok: true, lines: ['database reachable'], error: null } }), null);
+  assert.equal(p.preflight, null, 'withheld');
+  assert.equal(p.preflight_at, null, 'and so is its timestamp — no age for an answer not given');
+});
+
+await t('a stale REFUSAL is withheld too — it must not veto a move it never checked', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.900', ok: false, lines: [], error: 'working tree not clean' } }), null);
+  assert.equal(p.preflight, null, 'the guard is symmetric: it withholds fails as well as passes');
+});
+
+await t('no verdict at all is null — never an implied pass', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({ preflight: null, preflight_at: null }), null);
+  assert.equal(p.preflight, null);
+  assert.equal(p.behind, true, 'and the rest of the reading is unaffected');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_upgrade_runner.mjs

@@ -471,5 +471,87 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
 });
 
+console.log('\nthe dry run behind "see what would change" (task 1004121):');
+
+await t('a passing dry run is parsed into its pre-flight lines, with no error', () => {
+  const { checks, error } = R.parsePreflight([
+    'bongos upgrade — @bongos/core: 1.19.917 → 1.19.921',
+    '  ✓ pre-flight: no modules/ — nothing to pre-check',
+    '  ✓ pre-flight: database "cloudbongos" reachable as the current user',
+  ].join('\n'));
+  assert.equal(error, null);
+  assert.equal(checks.length, 2);
+});
+
+await t('a REFUSAL is carried verbatim — its wording is the instruction', () => {
+  const { error } = R.parsePreflight(
+    '  ✖ cannot determine which database to migrate.\n    Set PGDATABASE, or give this instance a db.database in config/branding.json.');
+  assert.match(error, /Set PGDATABASE/, 'the remedy rides along, not just the complaint');
+});
+
+await t('ONE builder serves both legs — the preview and the move cannot drift apart', () => {
+  // Two hand-copied builders are how "what you were shown" stops matching "what runs".
+  // Everything deciding whether the upgrade is ALLOWED must be identical; only the tail
+  // that describes what happens AFTER the pin moves may differ, because a dry run stops
+  // before it.
+  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone', db_name: 'test4' };
+  const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
+  const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
+  for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
+    assert.ok(move.cmd.includes(shared), `move carries ${shared}`);
+    assert.ok(peek.cmd.includes(shared), `preview carries the same ${shared}`);
+  }
+  assert.equal(move.instanceDir, peek.instanceDir, 'same target directory');
+  assert.equal(move.runAs, peek.runAs, 'same account');
+  // And the tail genuinely differs — asserted rather than assumed, so this test cannot
+  // quietly pass a preview that would restart the box.
+  assert.match(peek.cmd, /--dry-run/);
+  for (const post of ['--service', '--health-url', '--version-url', '--commit-pin', '--requested-by']) {
+    assert.ok(move.cmd.includes(post), `the move carries ${post}`);
+    assert.ok(!peek.cmd.includes(post), `the preview must NOT carry ${post} — it never gets that far`);
+  }
+});
+
+await t('an invalid slug is refused at the BUILDER, not left to a helper to throw', () => {
+  // The slug reaches a shell through instanceUser()/dbName(). Depending on another
+  // function's internals for that is one refactor away from an injection path.
+  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'standalone' }, '1.19.921', {}),
+    /invalid slug/);
+});
+
+await t('a dry run that fails WITHOUT a recognisable marker is still a refusal, never a pass', () => {
+  const deps = { privileged: false, exec: () => ({ ok: false, stdout: 'something went sideways' }) };
+  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone' }, '1.19.921', deps);
+  assert.equal(r.ok, false, 'a non-zero exit is a refusal whatever it printed');
+  assert.ok(r.error);
+});
+
+await t('the TICK never dry-runs — the verdict is asked for, not produced on a schedule', async () => {
+  // Re-running a check every tick for a box behind for hours spends a subprocess to
+  // re-learn the same answer, and is still missing in the window that matters.
+  const d = makeDeps({ served: '1.19.762' });
+  let spawned = 0;
+  d.preflightUpgrade = () => { spawned++; return { ok: true }; };
+  await R.snapshotCoreVersions(inst(), d);
+  assert.equal(spawned, 0, 'the version probe is per-tick; the dry run is not');
+});
+
+await t('the on-demand leg caches the verdict, and a REFUSAL is still a successful preview', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  d.preflightUpgrade = () => ({ target: '1.19.921', ok: false, lines: [], error: 'working tree not clean' });
+  const r = await R.preflightCoreUpgrade(inst(), d, intent({ target_version: '1.19.921' }));
+  assert.equal(r.ok, true, 'the CHECK ran — a refusal is what it was for, not a failure of it');
+  const write = d.queries.find((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql));
+  assert.ok(write, 'the verdict is cached');
+  assert.match(String(write.params[1]), /working tree not clean/);
+});
+
+await t('a preview of nothing is refused rather than cached as a pass', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.preflightCoreUpgrade(inst(), d, intent({ target_version: null }));
+  assert.equal(r.ok, false);
+  assert.equal(d.queries.filter((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql)).length, 0);
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -75,12 +75,18 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
     OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast() {} },
     location: { assign() {} },
   };
+  // The page's poll interval, driven rather than slept through. Injecting the REAL
+  // setTimeout made every case whose preview never converges sit out the page's full
+  // ~30s wait in wall-clock, still repainting after the test had finished — slow, and
+  // flaky against a torn-down sandbox.
+  windowObj.__deployPollMs = 0;
+  windowObj.__deployPollTries = 3;
   const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
   documentObj._ready();
-  const settle = async () => { for (let i = 0; i < 12; i++) await new Promise((r) => setTimeout(r, 0)); };
+  const settle = async () => { for (let i = 0; i < 40; i++) await new Promise((r) => setTimeout(r, 0)); };
   return { els, posts, gets, settle, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
@@ -126,13 +132,20 @@ test('confirming sends THAT project’s id and the version it was shown', async
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
   await b.settle();
-  assert.equal(b.posts.length, 1);
-  assert.equal(b.posts[0].path, '/provisioning/instances/32/core-upgrade');
+  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
+  // not one — separated by its payload rather than by its position, because "the second
+  // post" would silently start asserting about the wrong request the next time the order
+  // changes.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, 'exactly one move is sent');
+  assert.equal(moves[0].path, '/provisioning/instances/32/core-upgrade');
   // Field-wise, not deepEqual: the body is built inside the vm realm, so its
   // prototype is not this realm's Object and deepStrictEqual rejects it on identity
   // alone — a harness artifact that says nothing about the payload.
-  assert.equal(b.posts[0].body.to, '1.19.871');
-  assert.deepEqual(Object.keys(b.posts[0].body), ['to'], 'and nothing else is sent');
+  assert.equal(moves[0].body.to, '1.19.871');
+  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
+  // And the move must never carry the flag that would turn it into a no-op.
+  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
 });
 
 test('a box with nothing newer offers no button', async () => {
@@ -191,3 +204,89 @@ test('a move on the platform row re-reads the control plane, not a tenant previe
   assert.ok(b.gets.includes('/provisioning/control-plane'), 'the self row is read from its own endpoint');
   assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is re-probed');
 });
+
+// ---- the pre-flight verdict on step two (task 1004121) ---------------------------
+// The defect: step one was called "see what would change" and changed nothing but a
+// local flag. These read what step two actually PAINTS, because the bug was invisible
+// to every assertion about what the page fetched — it fetched nothing.
+
+test('step two shows what the dry run found, not just a restatement of the action', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database "cloudbongos" reachable as the current user'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /nothing blocks this move/i, 'it states a verdict');
+  assert.match(html, /database &quot;cloudbongos&quot; reachable|database "cloudbongos" reachable/, 'and shows what was checked');
+});
+
+test('a BLOCKED move says so, in the upgrade’s own words, and still offers the button', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: false, lines: [], error: 'working tree not clean — commit/stash first, or pass --force.' },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /This would fail/, 'the owner is told before pressing');
+  assert.match(html, /working tree not clean/, 'verbatim — the wording names the fix');
+  // Deliberate: the runner refuses on its own, and this reading can be minutes old.
+  assert.match(html, /id="dp-confirm-1"/, 'the button is still there — a stale ✖ must not lock the owner out');
+});
+
+test('with no verdict yet, arming ASKS for one and says so — never an implied pass', async () => {
+  // The whole failure mode in one test: silence where a check should be must not look
+  // like a clean bill of health, and the page must actually go and get the answer rather
+  // than wait for a background tick that may be minutes away.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  // While it is in flight the row says so — asserted BEFORE settling, because the whole
+  // point is what the owner sees during the wait.
+  assert.match(b.panel(), /Checking what this would do/, 'it states that a check is under way');
+  await b.settle();
+  const asks = b.posts.filter((x) => x.body && x.body.dry_run === true);
+  assert.equal(asks.length, 1, 'exactly one check is requested');
+  assert.equal(asks[0].body.to, '1.19.871', 'against the version on offer');
+  // And when the answer never arrives (this harness never converges), it falls back to
+  // the honest state rather than to a pass — which is the failure mode being guarded.
+  const settled = b.panel();
+  assert.match(settled, /Not checked yet/, 'an answer that never came is stated as such');
+  assert.doesNotMatch(settled, /nothing blocks this move/i, 'and never dressed up as a pass');
+});
+
+test('the poll does not close the panel the owner is reading', async () => {
+  // refreshOne() returns a row to step one — right after a MOVE, wrong during the wait.
+  // Polling with it un-armed the row under the owner every interval, so the confirm
+  // button vanished mid-check.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  await b.settle();
+  assert.match(b.panel(), /id="dp-confirm-1"/, 'still armed after the poll has run and given up');
+});
+
+test('a poll whose row is closed stops instead of repainting a step nobody is on', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  b.els.get('dp-cancel-1')._on.click();
+  await b.settle();
+  assert.match(b.panel(), /id="dp-preview-1"/, 'back at step one');
+  assert.doesNotMatch(b.panel(), /Checking what this would do/, 'and not still claiming to be checking');
+});
+
+test('a verdict already in hand is NOT re-requested', async () => {
+  // Re-asking would spend a subprocess on the box to reprint an answer already shown.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database reachable'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  await b.settle();
+  assert.equal(b.posts.filter((x) => x.body && x.body.dry_run).length, 0, 'no check requested');
+  assert.match(b.panel(), /nothing blocks this move/i, 'the held verdict is shown');
+});