@bongos/core 1.21.116 → 1.21.118

package/tests/provision.mjs

@@ -18,6 +18,7 @@ import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
+const PR = require('../scripts/gds/provision-repo.js'); // task 1004735: dbOwnershipSql/Cmd are not re-exported through provision.js
 const AP = require('../scripts/gds/instance-apex.js');
 const RP = require('../scripts/gds/provision-repo.js');
 
@@ -3370,6 +3371,39 @@ t('dbRoleGrantsCmd: runs on the INSTANCE db and grants forward too — the migra
   assert.match(c, /GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO %I/);
 });
 
+t('dbOwnershipCmd: hands OWNERSHIP of every object to the instance role, as postgres, in its own db (task 1004735)', () => {
+  // GRANT ALL is not ownership: a later migrate run AS the instance role (--migrate-as,
+  // task 1004512) cannot ALTER TABLE or CREATE OR REPLACE FUNCTION on an object postgres
+  // owns ("must be owner of"), so toast's first ALTERing core move failed and rolled back.
+  const c = PR.dbOwnershipCmd(coTenant, { privileged: true });
+  assert.ok(c.startsWith('sudo -u postgres psql -v ON_ERROR_STOP=1 -d mercury -c '), c.slice(0, 80));
+  for (const kind of ['TABLE', 'SEQUENCE', 'FUNCTION', 'PROCEDURE', 'AGGREGATE', 'TYPE', 'DOMAIN', 'VIEW']) assert.ok(c.includes(`$t$${kind}$t$`) || c.includes(`ALTER ${kind} `), `hands over ${kind}s`);
+  assert.match(c, /OWNER TO %I/);
+  assert.match(c, /\$r\$bongos-mercury\$r\$/, 'to the instance\'s own role');
+  assert.match(c, /deptype IN \(\$e\$e\$e\$\)/, 'skips objects an EXTENSION owns — altering those errors, and they are not the project\'s');
+  assert.match(c, /\$s\$public\$s\$::regnamespace/, 'only the public schema');
+  assert.doesNotMatch(c, /REASSIGN OWNED/, 'REASSIGN OWNED BY postgres would also hand over every SIBLING database postgres owns');
+});
+
+await ta('provisionInstance: hands ownership over right after the grants, and a failure there does not fail the provision (task 1004735)', async () => {
+  const { deps } = recorder();
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+  const grants = seen.findIndex((c) => c.cmd.includes('GRANT ALL ON SCHEMA public'));
+  const own = seen.findIndex((c) => c.cmd.includes('OWNER TO %I') && c.cmd.includes('regnamespace'));
+  assert.ok(grants >= 0 && own === grants + 1, `the handover follows the grants (grants at ${grants}, handover at ${own})`);
+  assert.equal(seen[own].opts.allowFail, true, 'non-fatal: the migrate_not_owner remedy is the backstop');
+});
+
+t('dbOwnershipSql: the SQL body carries no quote of either kind, so it survives psql -c and bash -s', () => {
+  const sql = PR.dbOwnershipSql('bongos-mercury');
+  assert.ok(!sql.includes("'"), sql);
+  assert.ok(!sql.includes(String.fromCharCode(34)), sql);
+  assert.ok(!sql.includes('$p$'), 'never the password marker the runner log redaction keys on');
+  assert.throws(() => PR.dbOwnershipSql('x; drop'), /role/, 'a role name that is not a plain identifier is refused, never quoted');
+});
+
 t('the role + seed commands render with NO double quote — they must survive `bash -s` over SSH unchanged', () => {
   const dq = String.fromCharCode(34);
   for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant), P.seedFirstVersionCmd(coTenant)]) {

package/tests/upgrade_migrate.mjs

@@ -254,6 +254,16 @@ test('a full upgrade whose migrate fails reports the migration, the error, and a
   assert.equal(outcome.classifyFailure('migrate_check_violation').class, 'unknown', 'existing rows break the new rule: a person decides, never an unattended retry');
 });
 
+test('"must be owner of" in a failed migrate is the known not-owner snag, not an unknown failure (task 1004735)', () => {
+  const outcome = require('../scripts/gds/upgrade-outcome.js');
+  const res = { ok: false, rolledBack: true, rollback: {}, error: 'migrate failed (exit 3) at core_274_parked_backlog_stays_parked: ERROR:  must be owner of table tasks' };
+  assert.equal(outcome.upgradeReason(res), 'migrate_not_owner');
+  assert.deepEqual(outcome.classifyFailure('migrate_not_owner'), { class: 'known_wedge', reason: 'migrate_not_owner' });
+  const fn = { ...res, error: 'migrate failed (exit 3) at core_274_x: ERROR:  must be owner of function promote_dependents_on_ship' };
+  assert.equal(outcome.upgradeReason(fn), 'migrate_not_owner', 'functions too — CREATE OR REPLACE on a postgres-owned function');
+  assert.equal(outcome.upgradeReason({ ...res, error: 'migrate failed (exit 3) at core_5: ERROR:  boom' }), 'migrate', 'any other migrate failure is unchanged');
+});
+
 test('teeSpawn streams the child\'s output live AND keeps it for the failure report', async () => {
   const pipe = () => Object.assign(new EventEmitter(), { setEncoding() {} });
   let child;

package/tests/wedge_remedy.mjs

@@ -52,7 +52,7 @@ function harness({ execFails = false, privileged = false } = {}) {
 console.log('\nthe fix for each known snag (planRemedy):');
 
 await t('every reason with a fix is a known_wedge in the classifier — and back', () => {
-  assert.deepEqual([...W.REMEDY_REASONS].sort(), ['dirty_tree', 'disk_full', 'schema_pending']);
+  assert.deepEqual([...W.REMEDY_REASONS].sort(), ['dirty_tree', 'disk_full', 'migrate_not_owner', 'schema_pending']);
   for (const r of W.REMEDY_REASONS) assert.equal(REASON_CLASS[r], 'known_wedge', r);
   for (const [r, c] of Object.entries(REASON_CLASS)) if (c === 'known_wedge') assert.ok(W.REMEDY_REASONS.includes(r), `${r} is known_wedge but has no fix — it would be retired with nothing done`);
   assert.equal(REASON_CLASS.remedy_did_not_hold, 'unknown', 'a fix that did not hold reaches a person');
@@ -92,6 +92,28 @@ await t('schema pending: migrates the project\'s OWN database, PGDATABASE always
   assert.ok(W.planRemedy(inst(), 'schema_pending', { selfRoot, privileged: true, runAs: null }).refused);
 });
 
+await t('migrate not owner: hands the project\'s tables to ITS OWN account, as postgres (task 1004735)', () => {
+  const p = W.planRemedy(inst(), 'migrate_not_owner', { selfRoot, privileged: true });
+  assert.match(p.cmd, /^sudo -u postgres psql -v ON_ERROR_STOP=1 -d charter -c '/, 'only postgres can give away what postgres owns, and only in THIS project\'s database');
+  assert.match(p.cmd, /OWNER TO %I/);
+  assert.match(p.cmd, /\$r\$bongos-charter\$r\$/, 'to the account the move migrates as');
+  assert.match(p.describe, /bongos-charter/);
+  const plain = W.planRemedy(inst(), 'migrate_not_owner', { selfRoot });
+  assert.match(plain.cmd, /^psql -v ON_ERROR_STOP=1 -d charter -c '/);
+  assert.ok(W.planRemedy(inst({ hosting_shape: 'control-plane' }), 'migrate_not_owner', { selfRoot }).refused, 'the control plane migrates as its own app user — there is no project account to hand anything to');
+});
+
+await t('migrate not owner: remedied once, then the move is tried again', async () => {
+  const h = harness({ privileged: true });
+  const r = await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge('migrate_not_owner'), deps: h.deps });
+  assert.deepEqual(r, { repended: true });
+  assert.equal(h.ran.length, 1);
+  assert.match(h.ran[0].cmd, /^sudo -u postgres psql /);
+  const again = await W.remedyAfterFailure({ intent: intent({ remedied_reason: 'migrate_not_owner' }), inst: inst(), result: wedge('migrate_not_owner'), deps: harness({ privileged: true }).deps });
+  assert.equal(again.repended, false, 'a handover that did not clear it reaches a person');
+  assert.equal(again.failure.reason, 'remedy_did_not_hold');
+});
+
 await t('no command is built from a name that is not shell-safe', () => {
   assert.ok(W.planRemedy(inst({ slug: 'a;rm -rf' }), 'dirty_tree', { selfRoot }).refused);
   assert.ok(W.planRemedy(inst({ db_name: 'x; drop' }), 'disk_full', { selfRoot }).refused);