@bongos/core 1.21.117 → 1.21.119

package/tests/db_ownership_handover.mjs

@@ -0,0 +1,156 @@
+// tests/db_ownership_handover.mjs — the ownership handover against a REAL Postgres
+// (task 1004735).
+//
+// A project with its own database account had its tables made by postgres at provisioning
+// and only GRANTed to the account. Later core moves migrate AS that account, and GRANT ALL
+// does not carry the right to ALTER TABLE or CREATE OR REPLACE FUNCTION — only ownership
+// does — so toast's first ALTERing move failed "must be owner of table tasks" and rolled
+// back. dbOwnershipSql (scripts/gds/provision-repo.js) hands everything over. It is one long
+// DO block of catalog queries, which a string test cannot prove: whether it actually runs,
+// which objects it reaches, and that it leaves extension-owned objects alone are questions
+// only a real engine answers.
+//
+// Hermetic within the database: a throwaway schema and role, both dropped at the end, so the
+// shared fixture database's public schema is never touched. Needs a superuser (CREATE ROLE,
+// giving away postgres-owned objects) — the integration lane's postgres is one.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION set
+// so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/db_ownership_handover.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const { dbOwnershipSql } = require('../scripts/gds/provision-repo.js');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+let client;
+try {
+  client = await pool.connect();
+} catch (e) {
+  console.log(`db_ownership_handover.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+const { rows: [me] } = await client.query('SELECT rolsuper FROM pg_roles WHERE rolname = current_user');
+if (!me || !me.rolsuper) {
+  console.log('db_ownership_handover.mjs SKIPPED — the connecting role is not a superuser, so it cannot stand in for postgres here.');
+  client.release();
+  await pool.end();
+  process.exit(0);
+}
+
+const SCHEMA = `own_t_${process.pid}`;
+const ROLE = `own-t-role-${process.pid}`; // a hyphen, like the real bongos-<slug> roles
+const q = (sql) => client.query(sql);
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// Every object in the schema that the handover is meant to reach, with its owner. Excludes
+// what follows something else: table row types, auto-made array types, column-owned sequences.
+const OWNERS = `
+  SELECT c.relname AS name, pg_get_userbyid(c.relowner) AS owner FROM pg_class c
+   WHERE c.relnamespace = '${SCHEMA}'::regnamespace AND c.relkind IN ('r','p','v','m','f','S')
+  UNION ALL
+  SELECT p.proname, pg_get_userbyid(p.proowner) FROM pg_proc p WHERE p.pronamespace = '${SCHEMA}'::regnamespace
+  UNION ALL
+  SELECT y.typname, pg_get_userbyid(y.typowner) FROM pg_type y
+   WHERE y.typnamespace = '${SCHEMA}'::regnamespace AND y.typtype IN ('e','d','r')`;
+
+let extension = null;
+try {
+  await q(`CREATE ROLE "${ROLE}" LOGIN`);
+  // The schema is the role's, as public is the database owner's on a real project (PG15+:
+  // pg_database_owner) — the objects INSIDE it are still postgres's, which is the bug.
+  await q(`CREATE SCHEMA ${SCHEMA} AUTHORIZATION "${ROLE}"`);
+  await q(`SET search_path = ${SCHEMA}`);
+  await q(`CREATE TABLE tasks (id serial PRIMARY KEY, n int GENERATED BY DEFAULT AS IDENTITY, title text)`);
+  await q(`CREATE TABLE events (id bigint, at date) PARTITION BY RANGE (at)`);
+  await q(`CREATE TABLE events_2026 PARTITION OF events FOR VALUES FROM ('2026-01-01') TO ('2027-01-01')`);
+  await q(`CREATE VIEW open_tasks AS SELECT * FROM tasks`);
+  await q(`CREATE MATERIALIZED VIEW task_count AS SELECT count(*) FROM tasks`);
+  await q(`CREATE SEQUENCE free_seq`);
+  await q(`CREATE FUNCTION promote_dependents_on_ship() RETURNS int LANGUAGE sql AS 'SELECT 1'`);
+  await q(`CREATE PROCEDURE tidy() LANGUAGE sql AS 'SELECT 1'`);
+  await q(`CREATE AGGREGATE total(int) (SFUNC = int4pl, STYPE = int)`);
+  await q(`CREATE TYPE mood AS ENUM ('ok', 'not')`);
+  await q(`CREATE DOMAIN positive AS int CHECK (VALUE > 0)`);
+  await q(`CREATE TYPE pair AS (a int, b int)`);
+  // An extension's objects in the same schema must be left alone (and must not make the
+  // handover error). Use whichever stock extension this server has and has not installed.
+  const { rows: ext } = await q(`SELECT name FROM pg_available_extensions
+    WHERE name IN ('pg_trgm','citext','hstore','tablefunc','fuzzystrmatch') AND installed_version IS NULL ORDER BY name LIMIT 1`);
+  if (ext.length) {
+    extension = ext[0].name;
+    await q(`CREATE EXTENSION ${extension} SCHEMA ${SCHEMA}`);
+  }
+  await q(`RESET search_path`);
+
+  console.log('\nthe ownership handover against a real Postgres:');
+
+  await t('before: the account can USE the tables but cannot ALTER one — the bug, reproduced', async () => {
+    await q(`GRANT ALL ON ALL TABLES IN SCHEMA ${SCHEMA} TO "${ROLE}"`);
+    await q(`SET ROLE "${ROLE}"`);
+    try {
+      await assert.rejects(q(`ALTER TABLE ${SCHEMA}.tasks ADD COLUMN parked boolean`), /must be owner of table tasks/);
+    } finally { await q('RESET ROLE'); }
+  });
+
+  await t('the handover runs, and every table, view, sequence, function and type is the account\'s', async () => {
+    await q(dbOwnershipSql(ROLE, SCHEMA));
+    const { rows } = await q(OWNERS);
+    const extOwned = extension
+      ? new Set((await q(`SELECT p.proname AS name FROM pg_proc p JOIN pg_depend d ON d.objid = p.oid AND d.deptype = 'e'
+          WHERE p.pronamespace = '${SCHEMA}'::regnamespace
+          UNION SELECT y.typname FROM pg_type y JOIN pg_depend d ON d.objid = y.oid AND d.deptype = 'e'
+          WHERE y.typnamespace = '${SCHEMA}'::regnamespace`)).rows.map((r) => r.name))
+      : new Set();
+    const mine = rows.filter((r) => !extOwned.has(r.name));
+    for (const name of ['tasks', 'tasks_id_seq', 'tasks_n_seq', 'events', 'events_2026', 'open_tasks', 'task_count', 'free_seq',
+      'promote_dependents_on_ship', 'tidy', 'total', 'mood', 'positive']) {
+      const row = mine.find((r) => r.name === name);
+      assert.ok(row, `${name} exists`);
+      assert.equal(row.owner, ROLE, `${name} is owned by the account`);
+    }
+    const { rows: [pair] } = await q(`SELECT pg_get_userbyid(typowner) AS owner FROM pg_type WHERE typname = 'pair' AND typnamespace = '${SCHEMA}'::regnamespace`);
+    assert.equal(pair.owner, ROLE, 'a CREATE TYPE composite too');
+    const left = mine.filter((r) => r.owner !== ROLE);
+    assert.deepEqual(left, [], 'nothing of the project\'s is left with postgres');
+  });
+
+  await t('extension objects stay with the extension\'s owner — never handed over', async () => {
+    if (!extension) { console.log('        (no spare stock extension on this server — sub-case not exercised)'); return; }
+    const { rows } = await q(`SELECT pg_get_userbyid(p.proowner) AS owner FROM pg_proc p JOIN pg_depend d ON d.objid = p.oid AND d.deptype = 'e'
+      WHERE p.pronamespace = '${SCHEMA}'::regnamespace`);
+    assert.ok(rows.length > 0, `precondition: ${extension} put functions in the schema`);
+    assert.ok(rows.every((r) => r.owner !== ROLE), `${extension}'s functions are untouched`);
+  });
+
+  await t('after: the account can ALTER a table and CREATE OR REPLACE a function — what core_274 needed', async () => {
+    await q(`SET ROLE "${ROLE}"`);
+    try {
+      await q(`ALTER TABLE ${SCHEMA}.tasks ADD COLUMN parked boolean`);
+      await q(`CREATE OR REPLACE FUNCTION ${SCHEMA}.promote_dependents_on_ship() RETURNS int LANGUAGE sql AS 'SELECT 2'`);
+    } finally { await q('RESET ROLE'); }
+  });
+
+  await t('a second run is a clean no-op (provisioning re-runs it; the remedy may meet a healed project)', async () => {
+    await q(dbOwnershipSql(ROLE, SCHEMA));
+  });
+} finally {
+  await q('RESET ROLE').catch(() => {});
+  await q(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch((e) => console.log(`  cleanup: ${e.message}`));
+  await q(`DROP ROLE IF EXISTS "${ROLE}"`).catch((e) => console.log(`  cleanup: ${e.message}`));
+  client.release();
+  await pool.end();
+}
+
+console.log(`\ndb_ownership_handover: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/hub_profile_leak.mjs

@@ -68,7 +68,8 @@ const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
 const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
 const SECRET_PREV = 'p05-prev-sentinel';
 const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
-const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+// crafts: each craft's own summed numbers (task 1004440), named or not like the totals.
+const CP_KEYS = ['totals', 'disciplines', 'crafts', 'last_active', 'projects', 'more_projects'];
 const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since', 'bio', 'links'];
 
 const q = (sql, params) => pool.query(sql, params);
@@ -128,6 +129,16 @@ try {
   // 42703 "column does not exist" instead of a 404-vs-200 assertion.
   await q(migrationSql('platform_identity_012_account_privacy.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
+  // getRollupForBuilder reads four more (task 1004664 — this file failed 3 of 7 on a FRESH
+  // database: every check that reaches the rollup answered 42703, while an old shared
+  // database that already had the columns hid it). It names a project only when it is ON
+  // THE MAP (projects-feed.js onMapSql: status, the publish gate's description, a known
+  // door) AND its door is public — 011 + 020 — and serializes a.recent_ships (012) and
+  // a.crafts (029).
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_020_visibility_pull.sql'));
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // The active account carries the P02 fields + a user-set name source, so the
@@ -150,9 +161,13 @@ try {
      VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
     [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
   );
+  // Both projects are on the map — active, described, door known — so the ONLY thing that
+  // keeps the second one unnamed is its private door. A fixture that left out the
+  // description would pass the "never named" check for the wrong reason (unpublishable).
   await q(
-    `INSERT INTO platform_identity_projects (origin, name, featured, status)
-     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    `INSERT INTO platform_identity_projects (origin, name, featured, status, description, visibility, visibility_source)
+     VALUES ($1, 'P05 Pub Proj', true, 'active', 'A public P05 project.', 'public', 'control-plane'),
+            ($2, $3, false, 'active', 'A private P05 project.', 'private', 'control-plane')`,
     [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
   );
   await q(
@@ -180,7 +195,7 @@ try {
     assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
     assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
     assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
-    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held', 'recent_ships'].sort());
     assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
     assert.equal(r.json.account.bio, 'Builds things.', 'bio serializes (P02)');
     assert.deepEqual(r.json.account.links, { website: 'https://p05.example/' }, 'links serialize (P02)');

package/tests/provision.mjs

@@ -18,6 +18,7 @@ import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
+const PR = require('../scripts/gds/provision-repo.js'); // task 1004735: dbOwnershipSql/Cmd are not re-exported through provision.js
 const AP = require('../scripts/gds/instance-apex.js');
 const RP = require('../scripts/gds/provision-repo.js');
 
@@ -3370,6 +3371,39 @@ t('dbRoleGrantsCmd: runs on the INSTANCE db and grants forward too — the migra
   assert.match(c, /GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO %I/);
 });
 
+t('dbOwnershipCmd: hands OWNERSHIP of every object to the instance role, as postgres, in its own db (task 1004735)', () => {
+  // GRANT ALL is not ownership: a later migrate run AS the instance role (--migrate-as,
+  // task 1004512) cannot ALTER TABLE or CREATE OR REPLACE FUNCTION on an object postgres
+  // owns ("must be owner of"), so toast's first ALTERing core move failed and rolled back.
+  const c = PR.dbOwnershipCmd(coTenant, { privileged: true });
+  assert.ok(c.startsWith('sudo -u postgres psql -v ON_ERROR_STOP=1 -d mercury -c '), c.slice(0, 80));
+  for (const kind of ['TABLE', 'SEQUENCE', 'FUNCTION', 'PROCEDURE', 'AGGREGATE', 'TYPE', 'DOMAIN', 'VIEW']) assert.ok(c.includes(`$t$${kind}$t$`) || c.includes(`ALTER ${kind} `), `hands over ${kind}s`);
+  assert.match(c, /OWNER TO %I/);
+  assert.match(c, /\$r\$bongos-mercury\$r\$/, 'to the instance\'s own role');
+  assert.match(c, /deptype IN \(\$e\$e\$e\$\)/, 'skips objects an EXTENSION owns — altering those errors, and they are not the project\'s');
+  assert.match(c, /\$s\$public\$s\$::regnamespace/, 'only the public schema');
+  assert.doesNotMatch(c, /REASSIGN OWNED/, 'REASSIGN OWNED BY postgres would also hand over every SIBLING database postgres owns');
+});
+
+await ta('provisionInstance: hands ownership over right after the grants, and a failure there does not fail the provision (task 1004735)', async () => {
+  const { deps } = recorder();
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+  const grants = seen.findIndex((c) => c.cmd.includes('GRANT ALL ON SCHEMA public'));
+  const own = seen.findIndex((c) => c.cmd.includes('OWNER TO %I') && c.cmd.includes('regnamespace'));
+  assert.ok(grants >= 0 && own === grants + 1, `the handover follows the grants (grants at ${grants}, handover at ${own})`);
+  assert.equal(seen[own].opts.allowFail, true, 'non-fatal: the migrate_not_owner remedy is the backstop');
+});
+
+t('dbOwnershipSql: the SQL body carries no quote of either kind, so it survives psql -c and bash -s', () => {
+  const sql = PR.dbOwnershipSql('bongos-mercury');
+  assert.ok(!sql.includes("'"), sql);
+  assert.ok(!sql.includes(String.fromCharCode(34)), sql);
+  assert.ok(!sql.includes('$p$'), 'never the password marker the runner log redaction keys on');
+  assert.throws(() => PR.dbOwnershipSql('x; drop'), /role/, 'a role name that is not a plain identifier is refused, never quoted');
+});
+
 t('the role + seed commands render with NO double quote — they must survive `bash -s` over SSH unchanged', () => {
   const dq = String.fromCharCode(34);
   for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant), P.seedFirstVersionCmd(coTenant)]) {

package/tests/upgrade_migrate.mjs

@@ -254,6 +254,16 @@ test('a full upgrade whose migrate fails reports the migration, the error, and a
   assert.equal(outcome.classifyFailure('migrate_check_violation').class, 'unknown', 'existing rows break the new rule: a person decides, never an unattended retry');
 });
 
+test('"must be owner of" in a failed migrate is the known not-owner snag, not an unknown failure (task 1004735)', () => {
+  const outcome = require('../scripts/gds/upgrade-outcome.js');
+  const res = { ok: false, rolledBack: true, rollback: {}, error: 'migrate failed (exit 3) at core_274_parked_backlog_stays_parked: ERROR:  must be owner of table tasks' };
+  assert.equal(outcome.upgradeReason(res), 'migrate_not_owner');
+  assert.deepEqual(outcome.classifyFailure('migrate_not_owner'), { class: 'known_wedge', reason: 'migrate_not_owner' });
+  const fn = { ...res, error: 'migrate failed (exit 3) at core_274_x: ERROR:  must be owner of function promote_dependents_on_ship' };
+  assert.equal(outcome.upgradeReason(fn), 'migrate_not_owner', 'functions too — CREATE OR REPLACE on a postgres-owned function');
+  assert.equal(outcome.upgradeReason({ ...res, error: 'migrate failed (exit 3) at core_5: ERROR:  boom' }), 'migrate', 'any other migrate failure is unchanged');
+});
+
 test('teeSpawn streams the child\'s output live AND keeps it for the failure report', async () => {
   const pipe = () => Object.assign(new EventEmitter(), { setEncoding() {} });
   let child;

package/tests/wedge_remedy.mjs

@@ -52,7 +52,7 @@ function harness({ execFails = false, privileged = false } = {}) {
 console.log('\nthe fix for each known snag (planRemedy):');
 
 await t('every reason with a fix is a known_wedge in the classifier — and back', () => {
-  assert.deepEqual([...W.REMEDY_REASONS].sort(), ['dirty_tree', 'disk_full', 'schema_pending']);
+  assert.deepEqual([...W.REMEDY_REASONS].sort(), ['dirty_tree', 'disk_full', 'migrate_not_owner', 'schema_pending']);
   for (const r of W.REMEDY_REASONS) assert.equal(REASON_CLASS[r], 'known_wedge', r);
   for (const [r, c] of Object.entries(REASON_CLASS)) if (c === 'known_wedge') assert.ok(W.REMEDY_REASONS.includes(r), `${r} is known_wedge but has no fix — it would be retired with nothing done`);
   assert.equal(REASON_CLASS.remedy_did_not_hold, 'unknown', 'a fix that did not hold reaches a person');
@@ -92,6 +92,28 @@ await t('schema pending: migrates the project\'s OWN database, PGDATABASE always
   assert.ok(W.planRemedy(inst(), 'schema_pending', { selfRoot, privileged: true, runAs: null }).refused);
 });
 
+await t('migrate not owner: hands the project\'s tables to ITS OWN account, as postgres (task 1004735)', () => {
+  const p = W.planRemedy(inst(), 'migrate_not_owner', { selfRoot, privileged: true });
+  assert.match(p.cmd, /^sudo -u postgres psql -v ON_ERROR_STOP=1 -d charter -c '/, 'only postgres can give away what postgres owns, and only in THIS project\'s database');
+  assert.match(p.cmd, /OWNER TO %I/);
+  assert.match(p.cmd, /\$r\$bongos-charter\$r\$/, 'to the account the move migrates as');
+  assert.match(p.describe, /bongos-charter/);
+  const plain = W.planRemedy(inst(), 'migrate_not_owner', { selfRoot });
+  assert.match(plain.cmd, /^psql -v ON_ERROR_STOP=1 -d charter -c '/);
+  assert.ok(W.planRemedy(inst({ hosting_shape: 'control-plane' }), 'migrate_not_owner', { selfRoot }).refused, 'the control plane migrates as its own app user — there is no project account to hand anything to');
+});
+
+await t('migrate not owner: remedied once, then the move is tried again', async () => {
+  const h = harness({ privileged: true });
+  const r = await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge('migrate_not_owner'), deps: h.deps });
+  assert.deepEqual(r, { repended: true });
+  assert.equal(h.ran.length, 1);
+  assert.match(h.ran[0].cmd, /^sudo -u postgres psql /);
+  const again = await W.remedyAfterFailure({ intent: intent({ remedied_reason: 'migrate_not_owner' }), inst: inst(), result: wedge('migrate_not_owner'), deps: harness({ privileged: true }).deps });
+  assert.equal(again.repended, false, 'a handover that did not clear it reaches a person');
+  assert.equal(again.failure.reason, 'remedy_did_not_hold');
+});
+
 await t('no command is built from a name that is not shell-safe', () => {
   assert.ok(W.planRemedy(inst({ slug: 'a;rm -rf' }), 'dirty_tree', { selfRoot }).refused);
   assert.ok(W.planRemedy(inst({ db_name: 'x; drop' }), 'disk_full', { selfRoot }).refused);