@cerbos/orm-prisma 4.0.0 → 5.0.0

package/src/adversarial.test.ts

@@ -1,28 +1,48 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import { GRPC as Cerbos } from "@cerbos/grpc";
-import type { Principal, Resource, Value } from "@cerbos/core";
-
-import { queryPlanToPrisma, PlanKind, MapperConfig } from ".";
+import { afterAll, beforeAll, describe, expect, test } from "@jest/globals";
+import {
+  PlanExpression,
+  PlanExpressionValue,
+  PlanExpressionVariable,
+} from "@cerbos/core";
+import type { PlanExpressionOperand, PlanResourcesResponse } from "@cerbos/core";
+
+import { queryPlanToPrisma, PlanKind, UnsupportedQueryPlanError } from ".";
+import type { PrismaFilter } from ".";
+import {
+  assertFuzzVerdict,
+  FUZZ_DIR,
+  fuzzThrown,
+  fuzzVerdict,
+  MAPPER,
+  MODEL,
+  pdpTags,
+  planOf,
+  readCorpusJson,
+  readGolden,
+  readGoldens,
+  writeFuzzResults,
+} from "./corpus";
+import type { FuzzVerdict, Golden } from "./corpus";
 import { prisma } from "./test-setup.adversarial";
 
 /**
- * Adversarial differential suite: every action in the shared `../conformance/` corpus is planned
- * against a REAL Cerbos PDP (the sidecar started by `npm run test:adversarial`, loaded with
- * `conformance/policies/adversarial.yaml`), translated by this adapter, and executed against
- * seeded rows — then the filtered id set is compared against an oracle computed by calling the
- * check API for each row with attributes mirroring that row exactly.
+ * The conformance harness (conformance/README.md, "The harness contract"). It loads the corpus
+ * dataset into a real store, translates every recorded golden plan for both pinned PDPs, runs the
+ * query through a generated Prisma client, and compares the returned ids with the `allowed` ids the
+ * PDP's check() recorded. No PDP runs here. Exceptions live in `conformance-ledger.json`.
  *
- * No hand-computed expectations: if this adapter's filter semantics diverge from Cerbos's own
- * evaluation for any row, the mismatch surfaces mechanically. See `conformance/README.md` for the
- * oracle recipe (NULL-as-missing-attribute, the degeneracy guard) — this file only owns the
- * Prisma-specific translation (seeding, field mapping, executing the query).
+ * The store is chosen with `ADAPTER_TEST_DB` (`sqlite` by default, `postgres` and `mysql` via
+ * testcontainers started in `jest.globalSetup.adversarial.js`), and the Prisma major with
+ * `PRISMA_VERSION`. The two are independent dimensions: v6/v7 is an ENGINE matrix, and an engine
+ * matrix says nothing about how a provider coerces a fractional threshold against an `Int` column,
+ * escapes a LIKE metacharacter, compares a real `timestamp` (cerbos/query-plan-adapters#320), or
+ * decides with its COLLATION whether `=` is case-sensitive at all (#340).
  */
 
-const cerbos = new Cerbos("127.0.0.1:3593", { tls: false });
-
-const CONFORMANCE_DIR = path.join(__dirname, "..", "..", "conformance");
+// -- the dataset: conformance/seeds.json + derived-fields.json ----------------------------------
 
 interface Tag {
   id: string;
@@ -31,556 +51,536 @@ interface Tag {
 
 interface Seed {
   id: string;
-  aBool: boolean;
-  aString: string;
-  aNumber: number;
+  aBool: boolean | null;
+  aString: string | null;
+  aNumber: number | null;
   aOptionalString: string | null;
+  aNumberList: (number | null)[];
+  aBoolList: (boolean | null)[];
   tags: Tag[];
   subCategoryNames: string[];
+  /** The seed whose scalars this row's to-one `parent` carries; null for no parent. */
+  parentSeedId: string | null;
+  /** The store capabilities the row needs (conformance/README.md, "The harness contract"). */
+  requires?: string[];
 }
 
-interface SeedsFile {
-  principal: Principal;
-  resourceKind: string;
-  seeds: Seed[];
-}
-
-interface UnsupportedShape {
-  action: string;
-  shape: string;
-  springDataMessage: string;
-}
-
-interface AdapterUnsupportedEntry {
-  action: string;
-  reason: string;
+interface DerivedEntry {
+  createdBy: string;
+  aDouble: number | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+  scope: string | null;
+  labels: (string | null)[];
 }
 
-interface KnownDivergence {
-  action: string;
-  adapters: string[];
-}
+const STORE_NAMES = ["sqlite", "postgres", "mysql"] as const;
 
-interface ActionsFile {
-  conformance: string[];
-  adapterUnsupported?: Record<string, AdapterUnsupportedEntry[]>;
-  adapterSupportedExpected?: Record<string, AdapterUnsupportedEntry[]>;
-  expectedUnsupported: UnsupportedShape[];
-  knownDivergences?: KnownDivergence[];
-}
+type StoreName = (typeof STORE_NAMES)[number];
 
-type ThrowingAction = readonly [action: string, reason: string];
+function selectedStoreName(): StoreName {
+  const requested = process.env["ADAPTER_TEST_DB"] ?? "sqlite";
 
-interface ActionClassification {
-  oracleActions: string[];
-  throwingActions: ThrowingAction[];
-  supportedExpected: Set<string>;
-}
+  // A typo must fail rather than silently fall back to SQLite (jest.adversarial.config.js rejects
+  // it first; the repeat keeps this file reading against a value it trusts).
+  const store = STORE_NAMES.find((name) => name === requested);
 
-function classifyActionsForAdapter(
-  manifest: ActionsFile,
-  adapter: string
-): ActionClassification {
-  const unsupported = manifest.adapterUnsupported?.[adapter] ?? [];
-  const unsupportedActions = new Set(unsupported.map((entry) => entry.action));
-  const supportedExpected = new Set(
-    (manifest.adapterSupportedExpected?.[adapter] ?? []).map(
-      (entry) => entry.action
-    )
-  );
-  const oracleActions = [
-    ...manifest.conformance.filter(
-      (action) => !unsupportedActions.has(action)
-    ),
-    ...supportedExpected,
-  ];
-  const throwingActions: ThrowingAction[] = [
-    ...unsupported.map(
-      (entry): ThrowingAction => [entry.action, entry.reason]
-    ),
-    ...manifest.expectedUnsupported
-      .filter((entry) => !supportedExpected.has(entry.action))
-      .map((entry): ThrowingAction => [entry.action, entry.shape]),
-  ];
+  if (store === undefined) {
+    throw new Error(
+      `Unknown ADAPTER_TEST_DB "${requested}": expected one of ${STORE_NAMES.join(", ")}`
+    );
+  }
 
-  return {
-    oracleActions: [...new Set(oracleActions)].sort(),
-    throwingActions: throwingActions.sort(([left], [right]) =>
-      left.localeCompare(right)
-    ),
-    supportedExpected,
-  };
+  return store;
 }
 
-const seedsFile: SeedsFile = JSON.parse(
-  fs.readFileSync(path.join(CONFORMANCE_DIR, "seeds.json"), "utf8")
+const STORE_NAME = selectedStoreName();
+
+// A seed requiring a capability the ledger's `lacks` names for this store is a resource it cannot
+// hold: it is not loaded, and its id is struck from every allowed set.
+const LACKS = Object.entries(
+  (
+    // SAFETY: validate-corpus.sh checks every conformance-ledger.json against its schema.
+    JSON.parse(
+      fs.readFileSync(path.join(__dirname, "..", "conformance-ledger.json"), "utf8")
+    ) as { lacks?: Record<string, { reason: string; stores?: string[] }> }
+  ).lacks ?? {}
+)
+  .filter(([, entry]) => entry.stores?.includes(STORE_NAME) ?? true)
+  .map(([capability]) => capability);
+
+const UNHELD = new Set(
+  (readCorpusJson<{ seeds: Seed[] }>("seeds.json")).seeds
+    .filter((seed) => seed.requires?.some((capability) => LACKS.includes(capability)))
+    .map((seed) => seed.id)
 );
-const actionsFile: ActionsFile = JSON.parse(
-  fs.readFileSync(path.join(CONFORMANCE_DIR, "actions.json"), "utf8")
-);
-const SEEDS = seedsFile.seeds;
-
-const {
-  oracleActions: ORACLE_ACTIONS,
-  throwingActions: THROWING_ACTIONS,
-  supportedExpected: PRISMA_SUPPORTED_EXPECTED,
-} = classifyActionsForAdapter(actionsFile, "prisma");
-const PRISMA_KNOWN_DIVERGENCES = new Set(
-  (actionsFile.knownDivergences ?? [])
-    .filter((entry) => entry.adapters.includes("prisma"))
-    .map((entry) => entry.action)
-);
-const EXPECTED_UNSUPPORTED_ACTIONS = new Set(
-  actionsFile.expectedUnsupported.map((entry) => entry.action)
+
+const SEEDS = (readCorpusJson<{ seeds: Seed[] }>("seeds.json")).seeds.filter(
+  (seed) => !UNHELD.has(seed.id)
 );
-const MANIFEST_ACTIONS = new Set([
-  ...actionsFile.conformance,
-  ...EXPECTED_UNSUPPORTED_ACTIONS,
-  ...PRISMA_KNOWN_DIVERGENCES,
-]);
-
-function doubleFor(seed: Seed): number | null {
-  switch (seed.id) {
-    case "a1":
-      return -0.6;
-    case "a2":
-      return 0.25;
-    case "a3":
-      return null;
-    default:
-      return seed.aNumber + 0.3;
-  }
+
+function held(allowed: string[]): string[] {
+  return allowed.filter((id) => !UNHELD.has(id));
 }
 
-function labelsFor(seed: Seed): (string | null)[] {
-  switch (seed.id) {
-    case "a1":
-      return ["gold", "silver"];
-    case "a6":
-      return [null, "silver"];
-    case "a8":
-      return ["silver"];
-    case "c1":
-      return ["Gold"];
-    default:
-      return [];
+const DERIVED = (
+  readCorpusJson<{ derived: Record<string, DerivedEntry> }>("derived-fields.json")
+).derived;
+
+function derivedFor(seed: Seed): DerivedEntry {
+  const entry = DERIVED[seed.id];
+
+  if (entry === undefined) {
+    throw new Error(`derived-fields.json has no entry for seed "${seed.id}"`);
   }
-}
 
-/** Deterministic ISO instant per seed for the timestamp probe: split around 2025-01-01. */
-function isoFor(seed: Seed): string {
-  return seed.aNumber >= 2 ? "2024-06-01T00:00:00Z" : "2026-06-01T00:00:00Z";
+  return entry;
 }
 
-function timestampFor(seed: Seed): string | null {
-  switch (seed.id) {
-    case "a1":
-      return "2020-03-15T10:30:00Z";
-    case "a2":
-      return "2037-01-01T00:00:00Z";
-    case "a3":
-      return null;
-    case "a4":
-      return "2024-06-01T00:00:00Z";
-    case "a5":
-      return "2020-03-15T10:30:00.123456Z";
-    default:
-      return seed.aNumber >= 2
-        ? "2036-06-06T06:06:06Z"
-        : "2021-05-05T05:05:05Z";
+// The real to-one relation (conformance/README.md, "The dataset"): every resource owns a FRESH
+// parent (and inner) row carrying the named seed's scalars, so no two resources share one.
+const SEEDS_BY_ID = new Map(SEEDS.map((seed) => [seed.id, seed]));
+
+function parentSeedOf(seed: Seed | undefined): Seed | undefined {
+  const id = seed?.parentSeedId;
+
+  if (id === undefined || id === null) {
+    return undefined;
   }
-}
 
-function scopeFor(seed: Seed): string | null {
-  switch (seed.id) {
-    case "a1":
-      return "dept";
-    case "a2":
-      return "dept.eng";
-    case "a3":
-      return "dept.eng.platform";
-    case "a4":
-      return "dept.eng.platform.obs";
-    case "a5":
-      return "dept.engineering";
-    case "a6":
-      return "dept.sales";
-    case "a8":
-      return "";
-    case "a9":
-      return "50%";
-    case "b1":
-      return "50%:a_b:x";
-    case "b2":
-      return "50x:a_b:y";
-    case "b3":
-      return "50%:aXb:y";
-    case "b4":
-      return "50%:a_b";
-    case "b5":
-      return "dept.eng.platform2";
-    case "b6":
-      return "50%.a_b";
-    case "c1":
-      return "Dept.Eng";
-    case "c2":
-      return "dept.eng.";
-    case "d1":
-      return "[env]:prod:eu";
-    case "d2":
-      return "e:prod:eu";
-    default:
-      return null;
+  const parent = SEEDS_BY_ID.get(id);
+
+  if (parent === undefined) {
+    throw new Error(`seeds.json: "${seed?.id}" names parent "${id}", which is not a seed id`);
   }
+
+  return parent;
 }
 
-const MAPPER: Record<string, MapperConfig> = {
-  "request.resource.attr.aBool": { field: "aBool" },
-  "request.resource.attr.aString": { field: "aString" },
-  "request.resource.attr.aNumber": { field: "aNumber" },
-  "request.resource.attr.aDouble": { field: "aDouble" },
-  "request.resource.attr.aOptionalString": { field: "aOptionalString" },
-  "request.resource.attr.createdBy": { field: "createdBy" },
-  "request.resource.attr.scope": { field: "scope" },
-  "request.resource.attr.createdAt": {
-    field: "createdAt",
-    valueType: "dateTime",
-  },
-  "request.resource.attr.owner": {
-    field: "aOptionalString",
-    nullable: true,
-  },
-  // obj.inner is not a real nested column — mirrors aString, same trick the spring-data
-  // reference harness uses for the p-struct probe.
-  "request.resource.attr.obj.inner": { field: "aString" },
-  "request.resource.attr.tags": {
-    relation: {
-      name: "tags",
-      type: "many",
-      // Model name enables field-to-field comparisons between tag columns; the nullable
-      // flag on `name` enables the adapter's three-valued-logic guards for collection
-      // macros over elements whose name column is NULL (a missing attribute — a CEL
-      // error, hence deny — on the check side).
-      model: "AdversarialTag",
-      fields: {
-        id: { field: "tagId" },
-        name: { field: "name", nullable: true },
-      },
-    },
-  },
-  "request.resource.attr.tagNames": {
-    relation: {
-      name: "tags",
-      type: "many",
-      field: "name",
-      fields: { name: { field: "name", nullable: true } },
-    },
-  },
-  "request.resource.attr.categories": {
-    relation: {
-      name: "categories",
-      type: "many",
-      fields: {
-        name: { field: "name" },
-        subCategories: {
-          relation: {
-            name: "subCategories",
-            type: "many",
-            fields: {
-              name: { field: "name" },
-              labels: {
-                relation: {
-                  name: "labels",
-                  type: "many",
-                  fields: {
-                    name: { field: "name", nullable: true },
-                  },
-                },
-              },
-            },
-          },
-        },
-      },
-    },
-  },
-  // Multi-hop chain probe (W1): mainCategory mirrors the SAME categories/subCategories relation
-  // as a single-object dotted chain on the check side (every seed holds at most one category),
-  // pinning that the adapter joins through every intermediate hop, never off the root.
-  "request.resource.attr.mainCategory": {
-    relation: {
-      name: "categories",
-      type: "many",
-      fields: {
-        name: { field: "name" },
-        subCategories: {
-          relation: {
-            name: "subCategories",
-            type: "many",
-            fields: { name: { field: "name" } },
-          },
-        },
-        // subNames: the same 2-hop chain but with a bare `field`, so plain `in` membership
-        // compares the flattened tail's name column directly.
-        subNames: {
-          relation: {
-            name: "subCategories",
-            type: "many",
-            field: "name",
-          },
-        },
-      },
-    },
-  },
-};
+/** The four scalars one level of the chain stores, as columns. */
+function relationColumns(seed: Seed) {
+  return {
+    aBool: seed.aBool,
+    aString: seed.aString,
+    aNumber: seed.aNumber,
+    aOptionalString: seed.aOptionalString,
+  };
+}
 
-beforeAll(async () => {
+async function seedStore(): Promise<void> {
+  await prisma.adversarialInner.deleteMany();
+  await prisma.adversarialParent.deleteMany();
   await prisma.adversarialLabel.deleteMany();
   await prisma.adversarialSubCategory.deleteMany();
   await prisma.adversarialCategory.deleteMany();
   await prisma.adversarialTag.deleteMany();
+  await prisma.adversarialNumberListElement.deleteMany();
+  await prisma.adversarialBoolListElement.deleteMany();
   await prisma.adversarialResource.deleteMany();
 
   // Distinct sub-category/category graphs per seed so no rows share relations by accident.
   for (const seed of SEEDS) {
+    const derived = derivedFor(seed);
+    const parentSeed = parentSeedOf(seed);
+    const innerSeed = parentSeedOf(parentSeed);
     await prisma.adversarialResource.create({
       data: {
         id: seed.id,
         aBool: seed.aBool,
         aString: seed.aString,
         aNumber: seed.aNumber,
-        aDouble: doubleFor(seed),
+        aDouble: derived.aDouble,
         aOptionalString: seed.aOptionalString,
-        createdBy: isoFor(seed),
-        scope: scopeFor(seed),
-        createdAt: timestampFor(seed),
-        tags: {
-          create: seed.tags.map((t) => ({ tagId: t.id, name: t.name })),
-        },
+        createdBy: derived.createdBy,
+        scope: derived.scope,
+        createdAt: derived.createdAt,
+        updatedAt: derived.updatedAt,
+        // One row per element, null elements included: membership is all a filter asks of
+        // either list, so the element's position is not stored.
+        numberList: { create: seed.aNumberList.map((value) => ({ value })) },
+        boolList: { create: seed.aBoolList.map((value) => ({ value })) },
+        tags: { create: seed.tags.map((t) => ({ tagId: t.id, name: t.name })) },
+        // The to-one chain, one owned row per level. A seed with no parent gets no row at all:
+        // Prisma reads an undefined relation as no write.
+        parent:
+          parentSeed === undefined
+            ? undefined
+            : {
+                create: {
+                  ...relationColumns(parentSeed),
+                  inner: innerSeed === undefined ? undefined : { create: relationColumns(innerSeed) },
+                },
+              },
+        // One category holding every subcategory name (conformance/README.md, "The dataset").
         categories: {
-          create: seed.subCategoryNames.map((subName) => ({
-            name: "business",
-            subCategories: {
-              create: [
-                {
-                  name: subName,
-                  labels: {
-                    create: labelsFor(seed).map((name) => ({ name })),
+          create:
+            seed.subCategoryNames.length === 0
+              ? []
+              : [
+                  {
+                    name: "business",
+                    subCategories: {
+                      create: seed.subCategoryNames.map((subName) => ({
+                        name: subName,
+                        labels: { create: derived.labels.map((name) => ({ name })) },
+                      })),
+                    },
                   },
-                },
-              ],
-            },
-          })),
+                ],
         },
       },
     });
   }
-});
+}
 
-afterAll(async () => {
-  await prisma.$disconnect();
-});
+// -- the store ------------------------------------------------------------------------------------
 
-function principal(): Principal {
-  return seedsFile.principal;
+/**
+ * How each leg asks its own connection which engine answered, and the first word of the answer.
+ * Each spelling is a syntax error on the other two engines, so the anti-vacuity test fails in every
+ * direction. MySQL's `version()` answers a bare `8.4.x`; `@@version_comment` names the engine.
+ */
+const STORE_BANNERS: Record<StoreName, { query: string; engine: string }> = {
+  sqlite: { query: "select 'SQLite ' || sqlite_version() as banner", engine: "SQLite" },
+  postgres: { query: "select version() as banner", engine: "PostgreSQL" },
+  mysql: { query: "select @@version_comment as banner", engine: "MySQL" },
+};
+
+/**
+ * The six adversarial schemas — (Prisma 6, Prisma 7) x (SQLite, PostgreSQL, MySQL) — must hold one
+ * data model between them: a column that drifts in one would seed a different row shape on that leg
+ * while every assertion here stayed identical.
+ */
+const ADVERSARIAL_SCHEMAS = [
+  "schema.adversarial.prisma",
+  "schema.adversarial.v6.prisma",
+  "schema.adversarial.pg.prisma",
+  "schema.adversarial.pg.v6.prisma",
+  "schema.adversarial.mysql.prisma",
+  "schema.adversarial.mysql.v6.prisma",
+] as const;
+
+/** A schema's `model` blocks, without comments, generator/datasource blocks or incidental space. */
+function modelBlocks(schema: string): string {
+  const withoutComments = schema
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("//"))
+    .join("\n");
+
+  const models = withoutComments.match(/^model\s[\s\S]*$/m) ?? [];
+
+  return models.join("\n").replace(/[ \t]+/g, " ").replace(/\n\s*\n/g, "\n").trim();
 }
 
-/** A NULL tag name in the DB is a missing element attribute on the check side. */
-function asTagAttribute(tag: Tag): Record<string, Value> {
-  const attr: Record<string, Value> = { id: tag.id };
-  if (tag.name !== null) {
-    attr["name"] = tag.name;
-  }
-  return attr;
+async function selectIds(where: PrismaFilter): Promise<string[]> {
+  const rows = await prisma.adversarialResource.findMany({ where, select: { id: true } });
+
+  return rows.map((row) => row.id).sort();
 }
 
-/** Cerbos attributes mirroring exactly what the seeded DB row holds. */
-function asCheckResource(seed: Seed): Resource {
-  const attr: Record<string, Value> = {
-    aBool: seed.aBool,
-    aString: seed.aString,
-    aNumber: seed.aNumber,
-    createdBy: isoFor(seed),
-    owner: seed.aOptionalString,
-    tagNames: seed.tags.map((tag) => tag.name),
-    obj: { inner: seed.aString },
-    tags: seed.tags.map(asTagAttribute),
-    categories: seed.subCategoryNames.map((subName) => ({
-      name: "business",
-      subCategories: [
-        {
-          name: subName,
-          labels: labelsFor(seed).map((name): Record<string, Value> =>
-            name === null ? {} : { name }
-          ),
-        },
-      ],
-    })),
-  };
-  // A DB NULL is a missing attribute on the check side — conditions touching it must deny
-  // (CEL error), matching SQL three-valued logic excluding the row.
-  if (seed.aOptionalString !== null) {
-    attr["aOptionalString"] = seed.aOptionalString;
-  }
-  const aDouble = doubleFor(seed);
-  if (aDouble !== null) {
-    attr["aDouble"] = aDouble;
-  }
-  const scope = scopeFor(seed);
-  if (scope !== null) {
-    attr["scope"] = scope;
-  }
-  const createdAt = timestampFor(seed);
-  if (createdAt !== null) {
-    attr["createdAt"] = createdAt;
-  }
-  // mainCategory mirrors the row's single category as ONE nested object (the seeder creates
-  // at most one category per seed), so direct dotted-chain CEL expressions evaluate cleanly;
-  // rows without a category get NO attribute — a CEL missing-attr error (deny), matching the
-  // adapter's empty join chain excluding the row.
-  if (seed.subCategoryNames.length > 0) {
-    attr["mainCategory"] = {
-      name: "business",
-      subCategories: seed.subCategoryNames.map((name) => ({ name })),
-      subNames: seed.subCategoryNames,
-    };
-  }
-  return { kind: seedsFile.resourceKind, id: seed.id, attr };
+// Every attribute the dataset omits when NULL is declared `omitted` in MAPPER. The call-level
+// option covers what is left, the list and relation elements, which the dataset sends as values;
+// the adapter's own default is pinned in translator.test.ts.
+const translatePlan = (queryPlan: PlanResourcesResponse) =>
+  queryPlanToPrisma({
+    queryPlan,
+    mapper: MAPPER,
+    model: MODEL,
+    nullAttributeRepresentation: "explicit",
+  });
+
+async function selectAllowed(queryPlan: PlanResourcesResponse): Promise<string[]> {
+  const result = translatePlan(queryPlan);
+
+  if (result.kind === PlanKind.ALWAYS_DENIED) return [];
+
+  return selectIds(result.kind === PlanKind.CONDITIONAL ? result.filters : {});
 }
 
-// -- oracle: ask the PDP itself, row by row --
+// -- the ledger -----------------------------------------------------------------------------------
 
-async function oracleAllowedIds(action: string): Promise<string[]> {
-  const ids: string[] = [];
-  for (const seed of SEEDS) {
-    const result = await cerbos.checkResource({
-      principal: principal(),
-      resource: asCheckResource(seed),
-      actions: [action],
-    });
-    if (result.isAllowed(action)) {
-      ids.push(seed.id);
-    }
-  }
-  return ids.sort();
+interface LedgerEntry {
+  status: "unsupported" | "divergent";
+  reason: string;
+  issue?: string;
+  pdp?: string[];
 }
 
-// -- adapter execution through the public queryPlanToPrisma path --
+const LEDGER = (
+  // SAFETY: validate-corpus.sh checks every conformance-ledger.json against its schema.
+  JSON.parse(
+    fs.readFileSync(path.join(__dirname, "..", "conformance-ledger.json"), "utf8")
+  ) as { cases: Record<string, LedgerEntry> }
+).cases;
 
-async function adapterFilteredIds(action: string): Promise<string[]> {
-  const queryPlan = await cerbos.planResources({
-    principal: principal(),
-    resource: { kind: seedsFile.resourceKind },
-    action,
-  });
-  const result = queryPlanToPrisma({
-    queryPlan,
-    mapper: MAPPER,
-    model: "AdversarialResource",
-  });
-  if (result.kind === PlanKind.ALWAYS_DENIED) {
-    return [];
+function ledgerEntry(golden: Golden, tag: string): LedgerEntry | undefined {
+  const entry = LEDGER[golden.id];
+
+  return entry && (entry.pdp === undefined || entry.pdp.includes(tag)) ? entry : undefined;
+}
+
+// -- the replay -----------------------------------------------------------------------------------
+
+const TAGS = pdpTags();
+const GOLDENS = new Map(TAGS.map((tag) => [tag, readGoldens(tag)]));
+const passed: Record<string, Record<string, number>> = {};
+const totals: Record<string, Record<string, number>> = {};
+const fuzzResults: FuzzVerdict[] = [];
+
+/** A fuzz case judged on this store (conformance/README.md, "Fuzzing"). */
+async function fuzzReplay(golden: Golden): Promise<FuzzVerdict> {
+  try {
+    return fuzzVerdict(golden, held(golden.allowed).sort(), await selectAllowed(await planOf(golden)));
+  } catch (error) {
+    return fuzzThrown(golden, error, UnsupportedQueryPlanError);
   }
-  const where = result.kind === PlanKind.CONDITIONAL ? result.filters : {};
-  const rows = await prisma.adversarialResource.findMany({
-    where,
-    select: { id: true },
-  });
-  return rows.map((r) => r.id).sort();
 }
 
-describe("adversarial conformance corpus", () => {
-  test("adapter-supported expected shapes move from throwing to oracle", () => {
-    const promotedAction = "promoted-shape";
-    const classification = classifyActionsForAdapter(
-      {
-        conformance: [],
-        adapterSupportedExpected: {
-          prisma: [{ action: promotedAction, reason: "supported by Prisma" }],
-        },
-        expectedUnsupported: [
-          {
-            action: promotedAction,
-            shape: "synthetic globally unsupported shape",
-            springDataMessage: "unsupported",
-          },
-        ],
-      },
-      "prisma"
-    );
+beforeAll(async () => {
+  // CEL string matching is case-sensitive, and this adapter lowers contains/startsWith/endsWith to
+  // LIKE. On SQLite, LIKE is case-INSENSITIVE for ASCII whatever the column collation; only this
+  // pragma changes it (conformance/README.md, "Store configuration is part of conformance").
+  if (STORE_NAME === "sqlite") {
+    await prisma.$executeRawUnsafe("PRAGMA case_sensitive_like = ON");
+  }
 
-    expect(classification.oracleActions).toContain(promotedAction);
-    expect(
-      classification.throwingActions.map(([action]) => action)
-    ).not.toContain(promotedAction);
+  await seedStore();
+}, 120_000);
+
+afterAll(async () => {
+  await prisma.$disconnect();
+  writeFuzzResults("prisma", `${STORE_NAME}-v${process.env["PRISMA_VERSION"] ?? "7"}`, fuzzResults);
+
+  const lines = TAGS.map((tag) => {
+    const tiers = Object.keys(totals[tag] ?? {}).sort();
+    const skipped = GOLDENS.get(tag)!.filter((golden) => golden.plannerDivergence !== null);
+
+    return `${tag}: ${tiers.map((tier) => `${tier} ${passed[tag]?.[tier] ?? 0}/${totals[tag]?.[tier]}`).join(", ")} (planner divergences skipped: ${skipped.map((golden) => golden.id).join(", ") || "none"})`;
   });
 
-  test("manifest assigns all 118 policy actions exactly one Prisma outcome", () => {
-    const oracle = new Set(ORACLE_ACTIONS);
-    const throwing = new Set(THROWING_ACTIONS.map(([action]) => action));
-    const misclassified = [...MANIFEST_ACTIONS].filter((action) => {
-      const classificationCount = [
-        oracle.has(action),
-        throwing.has(action),
-        PRISMA_KNOWN_DIVERGENCES.has(action),
-      ].filter(Boolean).length;
-      return classificationCount !== 1;
-    });
+  console.log(`conformance (${STORE_NAME}) passed per tier\n${lines.join("\n")}`);
+});
 
-    expect(MANIFEST_ACTIONS.size).toBe(118);
-    expect(misclassified).toEqual([]);
-    expect(
-      [...PRISMA_SUPPORTED_EXPECTED].filter(
-        (action) => !EXPECTED_UNSUPPORTED_ACTIONS.has(action)
-      )
-    ).toEqual([]);
+describe(`conformance (${STORE_NAME})`, () => {
+  // Every assertion below is identical on every leg, so a PostgreSQL leg that silently fell back to
+  // SQLite would pass while proving nothing about PostgreSQL. Ask the connection which engine it is.
+  test("executes against the store ADAPTER_TEST_DB selects", async () => {
+    const rows = await prisma.$queryRawUnsafe<{ banner: string }[]>(
+      STORE_BANNERS[STORE_NAME].query
+    );
+
+    expect(rows[0]?.banner?.split(" ")[0]).toBe(STORE_BANNERS[STORE_NAME].engine);
   });
 
-  test.each(ORACLE_ACTIONS)(
-    "%s matches the check() oracle",
-    async (action) => {
-      const [oracle, filtered] = await Promise.all([
-        oracleAllowedIds(action),
-        adapterFilteredIds(action),
-      ]);
-      expect(filtered).toEqual(oracle);
+  // Store configuration is part of conformance. Prisma's MySQL migration engine hardcodes
+  // `utf8mb4_unicode_ci`, so the tables are converted after `db push`
+  // (jest.globalSetup.adversarial.js). Under that default these return the case variant, the
+  // accent variant and the wrong-case prefix; asserted by name so a failure reads as "the store is
+  // misconfigured" rather than as a translation bug.
+  (STORE_NAME === "mysql" ? test : test.skip)(
+    "the MySQL leg runs under a byte-exact NO PAD collation",
+    async () => {
+      expect({
+        caseVariant: await selectIds({ aString: "one" }),
+        accentFolded: await selectIds({ aString: "hello🚀" }),
+        wrongCasePrefix: await selectIds({ aString: { startsWith: "ON" } }),
+        trailingSpace: await selectIds({ aString: "one " }),
+      }).toEqual({ caseVariant: ["a1"], accentFolded: [], wrongCasePrefix: [], trailingSpace: [] });
     }
   );
 
-  // Shapes the adapter does not support (globally unsupported planner shapes plus Prisma's
-  // declared adapterUnsupported list): translation must fail loudly, never produce a
-  // silently-wrong filter.
-  test.each(THROWING_ACTIONS)(
-    "%s fails loudly instead of silently mistranslating (%s)",
-    async (action) => {
-      await expect(adapterFilteredIds(action)).rejects.toThrow();
+  // `PRAGMA case_sensitive_like` holds per CONNECTION, so it must reach every connection a query can
+  // land on. Prisma 6 pooled SQLite connections until its schema pinned `connection_limit=1`;
+  // concurrent queries are what spread onto the rest.
+  (STORE_NAME === "sqlite" ? test : test.skip)(
+    "the SQLite leg's LIKE is case-sensitive on every connection",
+    async () => {
+      const results = await Promise.all(
+        Array.from({ length: 32 }, () => selectIds({ aString: { contains: "one" } }))
+      );
+
+      expect(results[0]?.length).toBeGreaterThan(0);
+      expect(results.filter((ids) => ids.includes("c1"))).toEqual([]);
     }
   );
 
-  test("pins the upstream has() planner over-grant", async () => {
-    const action = "p-has";
-    expect(PRISMA_KNOWN_DIVERGENCES.has(action)).toBe(true);
-    const queryPlan = await cerbos.planResources({
-      principal: principal(),
-      resource: { kind: seedsFile.resourceKind },
-      action,
-    });
-    const oracle = await oracleAllowedIds(action);
-    const allIds = SEEDS.map((seed) => seed.id).sort();
-
-    expect(queryPlan.kind).toBe(PlanKind.ALWAYS_ALLOWED);
-    expect(oracle.length).toBeGreaterThan(0);
-    expect(oracle.length).toBeLessThan(allIds.length);
-    expect(oracle).toContain("a1");
-    expect(await adapterFilteredIds(action)).toEqual(allIds);
+  test("every adversarial schema declares the same data model", () => {
+    const [reference, ...rest] = ADVERSARIAL_SCHEMAS.map((name) => ({
+      name,
+      models: modelBlocks(
+        fs.readFileSync(path.join(__dirname, "..", "prisma", name), "utf8")
+      ),
+    }));
+
+    expect(reference?.models).toContain(`model ${MODEL}`);
+
+    for (const schema of rest) {
+      expect(schema).toEqual({ name: schema.name, models: reference?.models });
+    }
+  });
+
+  (FUZZ_DIR ? test.skip : test)("the ledger names no case without a golden file", () => {
+    const ids = new Set(TAGS.flatMap((tag) => GOLDENS.get(tag)!.map((golden) => golden.id)));
+    expect(Object.keys(LEDGER).filter((id) => !ids.has(id))).toEqual([]);
+  });
+
+  // A golden that does not say which PDP recorded it, or whether that PDP diverged, cannot be
+  // routed: fail on it rather than let the filter below read a missing field as "no divergence".
+  test("every golden file is recorded for its tag and declares plannerDivergence", () => {
+    const malformed = TAGS.flatMap((tag) =>
+      GOLDENS.get(tag)!
+        .filter((golden) => golden.pdp !== tag || golden.plannerDivergence === undefined)
+        .map((golden) => `${tag}/${golden.id}`)
+    );
+
+    expect(malformed).toEqual([]);
   });
 
-  test("oracle is not degenerate", async () => {
-    // Guard the guard: at least one action must produce a non-empty, non-total oracle set,
-    // otherwise the differential comparison could pass vacuously (e.g. PDP denying all).
-    for (const action of ["vf-le", "like-percent", "all-on-empty"]) {
-      const ids = await oracleAllowedIds(action);
-      expect(ids.length).toBeGreaterThan(0);
-      expect(ids.length).toBeLessThan(SEEDS.length);
+  for (const tag of TAGS) {
+    // A plannerDivergence is a PDP bug no adapter can pass. The generator writes it only into the
+    // golden files of the tags it applies to, so a non-null value is the whole skip condition.
+    const cases = GOLDENS.get(tag)!.filter((golden) => golden.plannerDivergence === null);
+
+    test.each(cases.map((golden) => [golden.id, golden] as const))(
+      `${tag} %s`,
+      async (_id, golden) => {
+        if (FUZZ_DIR) {
+          const verdict = await fuzzReplay(golden);
+          fuzzResults.push(verdict);
+          assertFuzzVerdict(verdict);
+
+          return;
+        }
+
+        const entry = ledgerEntry(golden, tag);
+        const queryPlan = await planOf(golden);
+
+        if (entry?.status === "unsupported") {
+          expect(() => translatePlan(queryPlan)).toThrow(UnsupportedQueryPlanError);
+
+          return;
+        }
+
+        // Both sides sorted the same way, so a divergent entry cannot pass on ordering alone.
+        const ids = await selectAllowed(queryPlan);
+        const allowed = held(golden.allowed).sort();
+
+        if (entry?.status === "divergent") {
+          expect(ids).not.toEqual(allowed);
+
+          return;
+        }
+
+        expect(ids).toEqual(allowed);
+        (passed[tag] ??= {})[golden.tier] = (passed[tag]?.[golden.tier] ?? 0) + 1;
+      }
+    );
+
+    // The denominator is every golden file in the tier, skipped planner divergences included.
+    for (const golden of GOLDENS.get(tag)!) {
+      (totals[tag] ??= {})[golden.tier] = (totals[tag]?.[golden.tier] ?? 0) + 1;
+    }
+  }
+});
+
+// -- shapes the corpus does not spell -------------------------------------------------------------
+//
+// Synthesised plans over the same seeded store, for guards that must be a property of the
+// `mainCategory` chain rather than of the few spellings the corpus pins. Every expectation is a
+// recorded check() decision from a golden file, never a hand-computed row list.
+
+describe(`the absent-parent guard over the chain (${STORE_NAME})`, () => {
+  const allowedFor = (id: string) => held(readGolden(TAGS[0]!, id).allowed);
+
+  async function synthetic(condition: PlanExpressionOperand): Promise<string[]> {
+    const queryPlan: PlanResourcesResponse = {
+      kind: PlanKind.CONDITIONAL,
+      condition,
+      cerbosCallId: "synthetic",
+      requestId: "synthetic",
+      validationErrors: [],
+      metadata: undefined,
+    };
+
+    return selectAllowed(queryPlan);
+  }
+
+  // Every count threshold, not only the two spellings the corpus pins (#316). Each is TRUE for a
+  // row with no mainCategory only if the guard leaks: an absent to-one parent is a CEL
+  // missing-path error, so the PDP denies it outright.
+  test("every count threshold inherits the guard", async () => {
+    const size = new PlanExpression("size", [
+      new PlanExpressionVariable("request.resource.attr.mainCategory.subCategories"),
+    ]);
+
+    const compare = (operator: string, threshold: number) =>
+      new PlanExpression(operator, [size, new PlanExpressionValue(threshold)]);
+
+    const negate = (condition: PlanExpressionOperand) => new PlanExpression("not", [condition]);
+
+    for (const [label, condition] of [
+      ["size(chain) == 0", compare("eq", 0)],
+      ["size(chain) <= 0", compare("le", 0)],
+      ["size(chain) < 1", compare("lt", 1)],
+      ["!(size(chain) >= 1)", negate(compare("ge", 1))],
+      ["!(size(chain) > 0)", negate(compare("gt", 0))],
+    ] as const) {
+      expect([label, await synthetic(condition)]).toEqual([label, []]);
     }
+
+    // The mirror image, so the loop above cannot pass by denying everything.
+    const withParent = allowedFor("relation/size/non-negative-to-one-chain");
+    expect(withParent.length).toBeGreaterThan(0);
+    expect(await synthetic(negate(compare("eq", 0)))).toEqual(withParent);
+    expect(await synthetic(negate(compare("lt", 1)))).toEqual(withParent);
+  });
+
+  // Every ternary condition position over the chain, not only the one the corpus pins (#334).
+  test("every ternary condition inherits the guard", async () => {
+    const chainIn = new PlanExpression("in", [
+      new PlanExpressionValue("finance"),
+      new PlanExpressionVariable("request.resource.attr.mainCategory.subNames"),
+    ]);
+
+    const TRUE = new PlanExpressionValue(true);
+    const FALSE = new PlanExpressionValue(false);
+
+    const ternary = (
+      condition: PlanExpressionOperand,
+      thenBranch: PlanExpressionOperand,
+      elseBranch: PlanExpressionOperand
+    ) => new PlanExpression("if", [condition, thenBranch, elseBranch]);
+
+    // A row with no mainCategory is neither: the condition errors and selects neither branch.
+    const conditionTrue = allowedFor("relation/in/to-one-chain");
+    const conditionFalse = allowedFor("relation/in/negated-to-one-chain");
+    expect(conditionTrue.length).toBeGreaterThan(0);
+    expect(conditionFalse.length).toBeGreaterThan(0);
+    expect(conditionTrue.length + conditionFalse.length).toBeLessThan(SEEDS.length);
+
+    expect(await synthetic(ternary(chainIn, FALSE, TRUE))).toEqual(conditionFalse);
+    expect(
+      await synthetic(ternary(new PlanExpression("not", [chainIn]), TRUE, FALSE))
+    ).toEqual(conditionFalse);
+    expect(
+      await synthetic(ternary(new PlanExpression("not", [chainIn]), FALSE, TRUE))
+    ).toEqual(conditionTrue);
+
+    // A conjunction condition needs De Morgan: CEL's `&&` absorbs an erroring operand when the
+    // other is FALSE, so a parentless row with aBool=false DOES select the else-branch.
+    const aBoolFalse = SEEDS.filter((seed) => seed.aBool === false).map((seed) => seed.id);
+    expect(aBoolFalse.length).toBeGreaterThan(0);
+    expect(
+      await synthetic(
+        ternary(
+          new PlanExpression("and", [
+            chainIn,
+            new PlanExpressionVariable("request.resource.attr.aBool"),
+          ]),
+          FALSE,
+          TRUE
+        )
+      )
+    ).toEqual([...new Set([...conditionFalse, ...aBoolFalse])].sort());
   });
 });