@decohere/data-postgres 0.0.0-stage → 0.0.1-dev.5

package/tests/prepare-database.docker.spec.ts

@@ -0,0 +1,96 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { Pool } from "pg";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { PostgresServerManager } from "../src/server-manager.js";
+import { type PostgresContainer, startPostgres } from "./postgres-container.js";
+
+/**
+ * Real-Postgres gate for scaffold-shaped bootstrap.
+ * Catches bugs that SQL-shape / mocked-Pool tests miss (PASSWORD $1, missing maintenance DB).
+ * Needs Docker: runs under `pnpm test:docker`, not `pnpm test`.
+ */
+
+const BOOTSTRAP_USER = "decohere_bootstrap";
+const BOOTSTRAP_PASSWORD = "boot'strap-secret!";
+const APP_USER = "crypto_api_app";
+const APP_PASSWORD = "app'secret!";
+const MIGRATE_USER = "crypto_api_migrate";
+const MIGRATE_PASSWORD = "mig'secret!";
+const APP_DATABASE = "crypto_api_dev";
+
+describe("prepareDatabase against real Postgres", () => {
+	let postgres: PostgresContainer;
+
+	beforeAll(async () => {
+		postgres = await startPostgres();
+		await postgres.superuser.query(
+			`CREATE ROLE ${BOOTSTRAP_USER} LOGIN PASSWORD '${BOOTSTRAP_PASSWORD.replaceAll("'", "''")}' CREATEDB CREATEROLE NOSUPERUSER NOBYPASSRLS`,
+		);
+		await postgres.superuser.query(`GRANT CONNECT ON DATABASE postgres TO ${BOOTSTRAP_USER}`);
+	}, 120_000);
+
+	afterAll(async () => {
+		await postgres?.stop();
+	});
+
+	function connectionInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+		return {
+			name: "api",
+			provider: "postgres",
+			host: postgres.host,
+			port: postgres.port,
+			database: APP_DATABASE,
+			synchronize: true,
+			seed: false,
+			username: APP_USER,
+			password: APP_PASSWORD,
+			bootstrap: true,
+			adminUser: BOOTSTRAP_USER,
+			adminPassword: BOOTSTRAP_PASSWORD,
+			migrateUsername: MIGRATE_USER,
+			migratePassword: MIGRATE_PASSWORD,
+			...overrides,
+		};
+	}
+
+	it("connects as decohere_bootstrap, creates the app DB, and provisions app/migrate roles", async () => {
+		await using manager = new PostgresServerManager("crypto-it", connectionInfo());
+		await manager.connect();
+		await manager.initializeDatabase(APP_DATABASE);
+		await manager.provisionRoles({
+			database: APP_DATABASE,
+			appUsername: APP_USER,
+			appPassword: APP_PASSWORD,
+			migrateUsername: MIGRATE_USER,
+			migratePassword: MIGRATE_PASSWORD,
+			allowAppDdl: true,
+		});
+
+		const app = new Pool({
+			host: postgres.host,
+			port: postgres.port,
+			user: APP_USER,
+			password: APP_PASSWORD,
+			database: APP_DATABASE,
+		});
+		try {
+			const result = await app.query("SELECT 1 AS ok");
+			expect(result.rows[0]?.ok).toBe(1);
+		} finally {
+			await app.end();
+		}
+
+		const migrate = new Pool({
+			host: postgres.host,
+			port: postgres.port,
+			user: MIGRATE_USER,
+			password: MIGRATE_PASSWORD,
+			database: APP_DATABASE,
+		});
+		try {
+			await migrate.query("CREATE TABLE IF NOT EXISTS it_probe (id int)");
+		} finally {
+			await migrate.end();
+		}
+	});
+});

package/tests/server-manager.bootstrap.spec.ts

@@ -0,0 +1,72 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { PoolMock, connectMock } = vi.hoisted(() => {
+	const connectMock = vi.fn();
+	const PoolMock = vi.fn(function Pool(
+		this: { connect: typeof connectMock },
+		_options: unknown,
+	) {
+		this.connect = connectMock;
+		return this;
+	});
+	return { PoolMock, connectMock };
+});
+
+vi.mock("pg", () => ({ Pool: PoolMock }));
+
+import { PostgresServerManager } from "../src/server-manager.js";
+
+function adminInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "api",
+		provider: "postgres",
+		host: "postgres",
+		port: 5432,
+		database: "crypto_api_dev",
+		synchronize: true,
+		seed: true,
+		username: "crypto_api_app",
+		password: "app-secret",
+		bootstrap: true,
+		adminUser: "decohere_bootstrap",
+		adminPassword: "bootstrap-secret",
+		...overrides,
+	};
+}
+
+describe("PostgresServerManager.connect", () => {
+	beforeEach(() => {
+		PoolMock.mockClear();
+		connectMock.mockReset();
+		connectMock.mockResolvedValue({ release: vi.fn() });
+	});
+
+	it("connects the bootstrap role to the postgres maintenance database", async () => {
+		const manager = new PostgresServerManager("crypto", adminInfo());
+		await manager.connect();
+
+		expect(PoolMock).toHaveBeenCalledWith(
+			expect.objectContaining({
+				user: "decohere_bootstrap",
+				password: "bootstrap-secret",
+				host: "postgres",
+				port: 5432,
+				database: "postgres",
+				application_name: "crypto",
+			}),
+		);
+		expect(PoolMock.mock.calls[0]?.[0]).not.toEqual(
+			expect.objectContaining({ database: "decohere_bootstrap" }),
+		);
+	});
+
+	it("wraps connection failures with host/port context", async () => {
+		connectMock.mockRejectedValue(new Error('database "decohere_bootstrap" does not exist'));
+		const manager = new PostgresServerManager("crypto", adminInfo());
+
+		await expect(manager.connect()).rejects.toThrow(
+			/Cannot connect to PostgreSQL at postgres:5432/,
+		);
+	});
+});

package/tests/trusted-dev-postgres.spec.ts

@@ -0,0 +1,217 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { PoolMock, connectMock, queryMock } = vi.hoisted(() => {
+	const connectMock = vi.fn();
+	const queryMock = vi.fn();
+	const PoolMock = vi.fn(function Pool(
+		this: { connect: typeof connectMock; query: typeof queryMock; end: () => Promise<void> },
+		_options: unknown,
+	) {
+		this.connect = connectMock;
+		this.query = queryMock;
+		this.end = async () => {};
+		return this;
+	});
+	return { PoolMock, connectMock, queryMock };
+});
+
+vi.mock("pg", () => ({ Pool: PoolMock }));
+
+import {
+	assertBootstrapCredentials,
+	assertDataSourceAuth,
+	shouldBootstrapDatabase,
+} from "@decohere/data";
+import { createUserQuery } from "../src/user-scripts.js";
+import { PostgresServerManager } from "../src/server-manager.js";
+
+// A local dev Postgres that trusts every connection has no passwords at all, and says so
+// with auth: trust.
+function trustedInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "api",
+		provider: "postgres",
+		host: "postgres",
+		port: 5432,
+		database: "crypto_api_dev",
+		synchronize: true,
+		seed: true,
+		username: "crypto_api_app",
+		auth: "trust",
+		migrateUsername: "crypto_api_migrate",
+		adminUser: "decohere_bootstrap",
+		...overrides,
+	};
+}
+
+function sqlSent(): string[] {
+	return queryMock.mock.calls.map((call) => String(call[0]));
+}
+
+describe("trust auth is declared, never guessed", () => {
+	beforeEach(() => {
+		PoolMock.mockClear();
+		connectMock.mockReset();
+		connectMock.mockResolvedValue({ release: vi.fn() });
+		queryMock.mockReset();
+		queryMock.mockImplementation(async (sql: string) =>
+			sql.includes("datdba")
+				? { rowCount: 1, rows: [{ owner: "decohere_bootstrap" }] }
+				: { rowCount: 0, rows: [] },
+		);
+	});
+
+	describe("checking a data source's auth", () => {
+		it("accepts auth: trust with no passwords in development", () => {
+			expect(() => assertDataSourceAuth(trustedInfo(), "development")).not.toThrow();
+		});
+
+		it("refuses auth: trust outside development", () => {
+			expect(() => assertDataSourceAuth(trustedInfo(), "production")).toThrow(
+				/Data source "api" sets auth: trust, which is allowed only in development/,
+			);
+		});
+
+		it("refuses a missing password without auth: trust, in development too", () => {
+			for (const env of ["development", "production"]) {
+				expect(() => assertDataSourceAuth(trustedInfo({ auth: undefined }), env)).toThrow(
+					/Data source "api" has no password\. Set password, or auth: trust/,
+				);
+			}
+		});
+
+		it("treats an empty password as missing", () => {
+			expect(() =>
+				assertDataSourceAuth(trustedInfo({ auth: "password", password: "" }), "development"),
+			).toThrow(/has no password/);
+		});
+
+		it("accepts a password without auth, in any environment", () => {
+			expect(() =>
+				assertDataSourceAuth(
+					trustedInfo({ auth: undefined, password: "s3cret" }),
+					"production",
+				),
+			).not.toThrow();
+		});
+
+		it("refuses an auth it does not know", () => {
+			expect(() =>
+				assertDataSourceAuth(
+					trustedInfo({ auth: "md5" as ConnectionInfo["auth"] }),
+					"development",
+				),
+			).toThrow(/auth must be "password" or "trust" \(got "md5"\)/);
+		});
+
+		it("refuses a migrate role with no password when bootstrapping without auth: trust", () => {
+			expect(() =>
+				assertBootstrapCredentials(trustedInfo({ auth: undefined, password: "s3cret" })),
+			).toThrow(/Data source "api" has migrateUsername but no migratePassword/);
+			expect(() => assertBootstrapCredentials(trustedInfo())).not.toThrow();
+		});
+	});
+
+	describe("creating a role", () => {
+		it("leaves PASSWORD out when no password is given", () => {
+			const { text } = createUserQuery("crypto_api_app");
+			expect(text).toBe(
+				'CREATE USER "crypto_api_app" WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE',
+			);
+		});
+
+		it("treats a password a config file set to null as no password", () => {
+			const { text } = createUserQuery("crypto_api_app", null);
+			expect(text).not.toContain("PASSWORD");
+		});
+
+		it("still refuses an empty password, which is a typo and not a choice", () => {
+			expect(() => createUserQuery("crypto_api_app", "")).toThrow(/Invalid password/);
+		});
+	});
+
+	describe("deciding to bootstrap", () => {
+		it("bootstraps in development with auth: trust and no admin password", () => {
+			expect(shouldBootstrapDatabase(trustedInfo(), "development")).toBe(true);
+		});
+
+		it("no longer lets development alone stand in for an admin password", () => {
+			expect(shouldBootstrapDatabase(trustedInfo({ auth: undefined }), "development")).toBe(
+				false,
+			);
+			expect(() =>
+				shouldBootstrapDatabase(
+					trustedInfo({ auth: undefined, bootstrap: true }),
+					"development",
+				),
+			).toThrow(/adminPassword may be left out only with auth: trust/);
+		});
+
+		it("still needs an admin user", () => {
+			expect(
+				shouldBootstrapDatabase(trustedInfo({ adminUser: undefined }), "development"),
+			).toBe(false);
+		});
+	});
+
+	describe("connecting as the bootstrap role", () => {
+		it("connects with no password when the server is trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.connect();
+
+			const options = PoolMock.mock.calls[0]?.[0] as { user: string; password?: string };
+			expect(options.user).toBe("decohere_bootstrap");
+			expect(options.password).toBeUndefined();
+		});
+
+		it("asks for the admin password when the server is not trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo({ auth: undefined }));
+			await expect(manager.connect()).rejects.toThrow(/adminUser and adminPassword/);
+			expect(PoolMock).not.toHaveBeenCalled();
+		});
+	});
+
+	describe("provisioning the app and migrate roles", () => {
+		it("creates both without a PASSWORD clause when the server is trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.provisionRoles({
+				database: "crypto_api_dev",
+				appUsername: "crypto_api_app",
+				migrateUsername: "crypto_api_migrate",
+				allowAppDdl: false,
+			});
+
+			const creates = sqlSent().filter((sql) => sql.startsWith("CREATE USER"));
+			expect(creates).toHaveLength(2);
+			for (const sql of creates) {
+				expect(sql).not.toContain("PASSWORD");
+			}
+		});
+
+		it("still sets a password on a role that was given one", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.provisionRoles({
+				database: "crypto_api_dev",
+				appUsername: "crypto_api_app",
+				appPassword: "app-secret",
+				allowAppDdl: false,
+			});
+
+			const create = sqlSent().find((sql) => sql.startsWith("CREATE USER"));
+			expect(create).toContain("PASSWORD 'app-secret'");
+		});
+
+		it("refuses a role with no password when the server is not trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo({ auth: undefined }));
+			await expect(
+				manager.provisionRoles({
+					database: "crypto_api_prod",
+					appUsername: "crypto_api_app",
+					allowAppDdl: false,
+				}),
+			).rejects.toThrow(/password is required for database role "crypto_api_app"/i);
+			expect(sqlSent().some((sql) => sql.startsWith("CREATE USER"))).toBe(false);
+		});
+	});
+});

package/tests/user-scripts.pentest.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import {
+	assertSafeSqlIdent,
+	createUserQuery,
+	quoteIdent,
+	quoteLiteral,
+	userScripts,
+} from "../src/user-scripts.js";
+
+describe("pen-test — data's Postgres bootstrap SQL injection", () => {
+	it("rejects username that would break out of SQL string literals", () => {
+		expect(() => userScripts.createOwnerUser("evil'; DROP ROLE x; --", "pw", "db")).toThrow(
+			/Invalid username/,
+		);
+	});
+
+	it("escapes password metacharacters in CREATE USER (Postgres forbids PASSWORD $1)", () => {
+		const create = createUserQuery("apiuser", "x'; DROP ROLE x; --");
+		expect(create.text).not.toMatch(/PASSWORD\s+\$\d/);
+		expect(create.values).toEqual([]);
+		expect(create.text).toContain(quoteLiteral("x'; DROP ROLE x; --"));
+		expect(create.text).toContain("''"); // doubled quote from escaping
+		// Breakout must stay inside the password literal, not become SQL.
+		expect(create.text).toMatch(/PASSWORD 'x''; DROP ROLE x; --'/);
+	});
+
+	it("rejects database name with SQL metacharacters", () => {
+		expect(() =>
+			userScripts.createOwnerUser("apiuser", "secret", "db'; DROP DATABASE x; --"),
+		).toThrow(/Invalid database/);
+	});
+
+	it("emits CREATE USER with an escaped password literal for a safe username", () => {
+		const { text, values } = userScripts.createOwnerUser("api_user", "s3cret!", "webapi_dev");
+		expect(text).toContain("PASSWORD 's3cret!'");
+		expect(text).not.toMatch(/PASSWORD\s+\$\d/);
+		expect(values).toEqual([]);
+		expect(quoteIdent("api_user")).toBe('"api_user"');
+		expect(quoteLiteral("a'b")).toBe("'a''b'");
+		expect(() => assertSafeSqlIdent('x"; DROP', "username")).toThrow(/Invalid username/);
+	});
+});