@cedarjs/testing 7.0.0-canary.3181 → 7.0.0-canary.3188

package/dist/api/checkTestDatabase.d.ts

@@ -20,4 +20,31 @@ export declare function redactDatabaseUrl(url: string): string;
  * yet), this is a no-op — Prisma itself will surface the problem.
  */
 export declare function checkTestDatabaseUrlMatchesProvider(databaseUrl: string, usedFallback: boolean): Promise<void>;
+/**
+ * Guards `cedar test api`'s destructive database reset by *identity*, not
+ * just provider: refuses to run when the resolved test database is the same
+ * database as `DATABASE_URL` — same host, port, and database name, or the
+ * same sqlite file.
+ *
+ * This is deliberately the only check, rather than also requiring the
+ * database's *name* to look test-like (e.g. containing "test" or "e2e"). A
+ * naming convention doesn't hold for managed Postgres providers with a
+ * fixed default database name shared by every project — every Supabase
+ * project's database is named `postgres`, for instance — so it can't tell a
+ * real project's database apart from a dedicated test one by name alone.
+ * Whether the two connection strings resolve to the same database is the
+ * one fact that holds across every provider.
+ *
+ * When there's no `DATABASE_URL` at all to compare against, this fails
+ * closed rather than skipping the check: an explicit `TEST_DATABASE_URL`
+ * with nothing to confirm it's not the app's real database is refused,
+ * since there'd be no way to tell it apart from one that is. Cedar's own
+ * generated sqlite fallback (`usedFallback`) is exempt from that fail-closed
+ * refusal — it's a path only Cedar controls, so there's no need to force a
+ * `DATABASE_URL` to exist just to permit it — but it still runs through the
+ * same-database comparison below whenever a `DATABASE_URL` is present, so a
+ * project whose real database happens to live at that same generated path
+ * is still caught.
+ */
+export declare function checkTestDatabaseIdentity(testDatabaseUrl: string, mainDatabaseUrl: string | undefined, usedFallback: boolean): void;
 //# sourceMappingURL=checkTestDatabase.d.ts.map

package/dist/api/checkTestDatabase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkTestDatabase.d.ts","sourceRoot":"","sources":["../../src/api/checkTestDatabase.ts"],"names":[],"mappings":"AAkBA;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,iBAmCtB"}
+{"version":3,"file":"checkTestDatabase.d.ts","sourceRoot":"","sources":["../../src/api/checkTestDatabase.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,iBAmCtB;AAuHD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,YAAY,EAAE,OAAO,QAkCtB"}

package/dist/api/checkTestDatabase.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { getPrismaDatasourceProvider } from "@cedarjs/project-config";
 const PROVIDER_URL_SCHEMES = {
   sqlite: ["file:"],
@@ -38,7 +39,108 @@ async function checkTestDatabaseUrlMatchesProvider(databaseUrl, usedFallback) {
 ${reason}`
   );
 }
+const DEFAULT_PORTS = {
+  "postgresql:": "5432",
+  "mysql:": "3306",
+  "sqlserver:": "1433",
+  "mongodb:": "27017"
+};
+function normalizeScheme(scheme) {
+  return scheme === "postgres:" ? "postgresql:" : scheme;
+}
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/, "");
+}
+function parseSqlServerIdentity(url) {
+  const [authority, ...params] = url.split(";");
+  const match = authority.match(
+    /^([a-z][a-z0-9+.-]*:)\/\/([^:/?#]+)(?::(\d+))?/i
+  );
+  if (!match) {
+    return void 0;
+  }
+  const [, scheme, host, port] = match;
+  const databaseParam = params.find(
+    (param) => /^\s*(?:database|initial\s+catalog)\s*=/i.test(param)
+  );
+  const database = databaseParam?.slice(databaseParam.indexOf("=") + 1).trim();
+  return {
+    scheme: scheme.toLowerCase(),
+    host: normalizeHost(host),
+    port,
+    database
+  };
+}
+function parseUriIdentity(url) {
+  try {
+    const parsed = new URL(url);
+    const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")).split("/")[0] || void 0;
+    return {
+      scheme: parsed.protocol.toLowerCase(),
+      host: parsed.hostname ? normalizeHost(parsed.hostname) : void 0,
+      port: parsed.port || void 0,
+      database
+    };
+  } catch {
+    return void 0;
+  }
+}
+function parseDatabaseIdentity(url) {
+  const scheme = getUrlScheme(url);
+  if (!scheme) {
+    return void 0;
+  }
+  if (scheme === "file:") {
+    return { scheme, database: path.resolve(url.slice("file:".length)) };
+  }
+  if (scheme === "sqlserver:") {
+    return parseSqlServerIdentity(url);
+  }
+  return parseUriIdentity(url);
+}
+function identitiesMatch(a, b) {
+  const schemeA = normalizeScheme(a.scheme);
+  const schemeB = normalizeScheme(b.scheme);
+  if (schemeA !== schemeB) {
+    return false;
+  }
+  if (schemeA === "file:") {
+    return !!a.database && a.database === b.database;
+  }
+  if (!a.database || !b.database || a.database !== b.database) {
+    return false;
+  }
+  const portA = a.port || DEFAULT_PORTS[schemeA] || "";
+  const portB = b.port || DEFAULT_PORTS[schemeA] || "";
+  return (a.host ?? "") === (b.host ?? "") && portA === portB;
+}
+function checkTestDatabaseIdentity(testDatabaseUrl, mainDatabaseUrl, usedFallback) {
+  if (!mainDatabaseUrl) {
+    if (usedFallback) {
+      return;
+    }
+    const redactedTestUrl = redactDatabaseUrl(testDatabaseUrl);
+    throw new Error(
+      `TEST_DATABASE_URL (${redactedTestUrl}) is set, but there's no DATABASE_URL to confirm it isn't the same database your app actually uses. Refusing to run a destructive reset without that confirmation.
+
+Set DATABASE_URL (even to a placeholder) so Cedar can verify TEST_DATABASE_URL points somewhere different.`
+    );
+  }
+  const sameRawUrl = mainDatabaseUrl === testDatabaseUrl;
+  const testIdentity = parseDatabaseIdentity(testDatabaseUrl);
+  const mainIdentity = parseDatabaseIdentity(mainDatabaseUrl);
+  const sameParsedIdentity = !!testIdentity && !!mainIdentity && identitiesMatch(testIdentity, mainIdentity);
+  if (sameRawUrl || sameParsedIdentity) {
+    const redactedTestUrl = redactDatabaseUrl(testDatabaseUrl);
+    throw new Error(
+      `TEST_DATABASE_URL (${redactedTestUrl}) points at the same database as DATABASE_URL. Refusing to run a destructive reset against your app's main database.
+
+Set TEST_DATABASE_URL to a dedicated test database.`
+    );
+  }
+}
 export {
+  checkTestDatabaseIdentity,
   checkTestDatabaseUrlMatchesProvider,
   redactDatabaseUrl
 };

package/dist/api/vitest/CedarApiVitestEnv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CedarApiVitestEnv.d.ts","sourceRoot":"","sources":["../../../src/api/vitest/CedarApiVitestEnv.ts"],"names":[],"mappings":"AAEA,OAAO,2BAA2B,CAAA;AAElC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAUtD,QAAA,MAAM,yBAAyB,EAAE,WAgDhC,CAAA;AAED,eAAe,yBAAyB,CAAA"}
+{"version":3,"file":"CedarApiVitestEnv.d.ts","sourceRoot":"","sources":["../../../src/api/vitest/CedarApiVitestEnv.ts"],"names":[],"mappings":"AAEA,OAAO,2BAA2B,CAAA;AAElC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAWtD,QAAA,MAAM,yBAAyB,EAAE,WAwFhC,CAAA;AAED,eAAe,yBAAyB,CAAA"}

package/dist/api/vitest/CedarApiVitestEnv.js

@@ -1,9 +1,10 @@
 import path from "node:path";
 import "dotenv-defaults/config.js";
 import execa from "execa";
-import { getPaths } from "@cedarjs/project-config";
+import { getConfig, getPaths } from "@cedarjs/project-config";
 import { getPackageManager } from "@cedarjs/project-config/packageManager";
 import {
+  checkTestDatabaseIdentity,
   checkTestDatabaseUrlMatchesProvider,
   redactDatabaseUrl
 } from "../checkTestDatabase.js";
@@ -18,6 +19,7 @@ const CedarApiVitestEnvironment = {
       };
     }
     const cedarPaths = getPaths();
+    const mainDatabaseUrl = "CEDAR_APP_DATABASE_URL" in process.env ? process.env.CEDAR_APP_DATABASE_URL : process.env.DATABASE_URL;
     const defaultDb = `file:${path.join(cedarPaths.generated.base, "test.db")}`;
     const usedFallback = !process.env.TEST_DATABASE_URL;
     process.env.DATABASE_URL = process.env.TEST_DATABASE_URL || defaultDb;
@@ -25,16 +27,26 @@ const CedarApiVitestEnvironment = {
       process.env.DATABASE_URL,
       usedFallback
     );
+    const testConfig = getConfig().test;
+    checkTestDatabaseIdentity(
+      process.env.DATABASE_URL,
+      mainDatabaseUrl,
+      usedFallback
+    );
     console.log(
       `Setting up test database: ${redactDatabaseUrl(process.env.DATABASE_URL)}`
     );
     const command = process.env.TEST_DATABASE_STRATEGY === "reset" ? ["prisma", "migrate", "reset", "--force"] : ["prisma", "db", "push", "--force-reset", "--accept-data-loss"];
     const pm = getPackageManager();
     const pmExec = pm === "pnpm" ? pm : "npx";
+    const env = { ...process.env };
+    if (testConfig.autoConsentToDbReset && !("PRISMA_USER_CONSENT_FOR_DANGEROUS_AI_ACTION" in env)) {
+      env.PRISMA_USER_CONSENT_FOR_DANGEROUS_AI_ACTION = "Cedar auto-consent: cedar.toml's [test] autoConsentToDbReset is true, and the reset target passed Cedar's test-database identity guard.";
+    }
     execa.sync(pmExec, ["cedar", ...command], {
       cwd: cedarPaths.api.base,
       stdio: "inherit",
-      env: process.env
+      env
     });
     return {
       teardown() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/testing",
-  "version": "7.0.0-canary.3181",
+  "version": "7.0.0-canary.3188",
   "description": "Tools, wrappers and configuration for testing a Cedar project.",
   "repository": {
     "type": "git",
@@ -54,9 +54,9 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/context": "7.0.0-canary.3181",
-    "@cedarjs/graphql-server": "7.0.0-canary.3181",
-    "@cedarjs/project-config": "7.0.0-canary.3181",
+    "@cedarjs/context": "7.0.0-canary.3188",
+    "@cedarjs/graphql-server": "7.0.0-canary.3188",
+    "@cedarjs/project-config": "7.0.0-canary.3188",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.3",
@@ -73,19 +73,19 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "7.0.0-canary.3181",
-    "@cedarjs/framework-tools": "7.0.0-canary.3181",
-    "@cedarjs/router": "7.0.0-canary.3181",
-    "@cedarjs/web": "7.0.0-canary.3181",
+    "@cedarjs/auth": "7.0.0-canary.3188",
+    "@cedarjs/framework-tools": "7.0.0-canary.3188",
+    "@cedarjs/router": "7.0.0-canary.3188",
+    "@cedarjs/web": "7.0.0-canary.3188",
     "concurrently": "9.2.4",
     "publint": "0.3.24",
     "typescript": "5.9.3",
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "7.0.0-canary.3181",
-    "@cedarjs/router": "7.0.0-canary.3181",
-    "@cedarjs/web": "7.0.0-canary.3181",
+    "@cedarjs/auth": "7.0.0-canary.3188",
+    "@cedarjs/router": "7.0.0-canary.3188",
+    "@cedarjs/web": "7.0.0-canary.3188",
     "vitest": "4.1.11"
   },
   "peerDependenciesMeta": {