@decohere/data-typeorm 0.0.1-dev.125 → 0.0.1-dev.5

package/tests/prepare-database.docker.spec.ts

@@ -0,0 +1,96 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { Pool } from "pg";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { PostgresServerManager } from "../src/server-manager.js";
+import { type PostgresContainer, startPostgres } from "./postgres-container.js";
+
+/**
+ * Real-Postgres gate for scaffold-shaped bootstrap (CU-869eja1c8).
+ * Catches bugs that SQL-shape / mocked-Pool tests miss (PASSWORD $1, missing maintenance DB).
+ * Needs Docker: runs under `pnpm test:docker`, not `pnpm test`.
+ */
+
+const BOOTSTRAP_USER = "decohere_bootstrap";
+const BOOTSTRAP_PASSWORD = "boot'strap-secret!";
+const APP_USER = "crypto_api_app";
+const APP_PASSWORD = "app'secret!";
+const MIGRATE_USER = "crypto_api_migrate";
+const MIGRATE_PASSWORD = "mig'secret!";
+const APP_DATABASE = "crypto_api_dev";
+
+describe("prepareDatabase against real Postgres CU-869eja1c8", () => {
+	let postgres: PostgresContainer;
+
+	beforeAll(async () => {
+		postgres = await startPostgres();
+		await postgres.superuser.query(
+			`CREATE ROLE ${BOOTSTRAP_USER} LOGIN PASSWORD '${BOOTSTRAP_PASSWORD.replaceAll("'", "''")}' CREATEDB CREATEROLE NOSUPERUSER NOBYPASSRLS`,
+		);
+		await postgres.superuser.query(`GRANT CONNECT ON DATABASE postgres TO ${BOOTSTRAP_USER}`);
+	}, 120_000);
+
+	afterAll(async () => {
+		await postgres?.stop();
+	});
+
+	function connectionInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+		return {
+			name: "api",
+			provider: "postgres",
+			host: postgres.host,
+			port: postgres.port,
+			database: APP_DATABASE,
+			synchronize: true,
+			seed: false,
+			username: APP_USER,
+			password: APP_PASSWORD,
+			bootstrap: true,
+			adminUser: BOOTSTRAP_USER,
+			adminPassword: BOOTSTRAP_PASSWORD,
+			migrateUsername: MIGRATE_USER,
+			migratePassword: MIGRATE_PASSWORD,
+			...overrides,
+		};
+	}
+
+	it("connects as decohere_bootstrap, creates the app DB, and provisions app/migrate roles", async () => {
+		await using manager = new PostgresServerManager("crypto-it", connectionInfo());
+		await manager.connect();
+		await manager.initializeDatabase(APP_DATABASE);
+		await manager.provisionRoles({
+			database: APP_DATABASE,
+			appUsername: APP_USER,
+			appPassword: APP_PASSWORD,
+			migrateUsername: MIGRATE_USER,
+			migratePassword: MIGRATE_PASSWORD,
+			allowAppDdl: true,
+		});
+
+		const app = new Pool({
+			host: postgres.host,
+			port: postgres.port,
+			user: APP_USER,
+			password: APP_PASSWORD,
+			database: APP_DATABASE,
+		});
+		try {
+			const result = await app.query("SELECT 1 AS ok");
+			expect(result.rows[0]?.ok).toBe(1);
+		} finally {
+			await app.end();
+		}
+
+		const migrate = new Pool({
+			host: postgres.host,
+			port: postgres.port,
+			user: MIGRATE_USER,
+			password: MIGRATE_PASSWORD,
+			database: APP_DATABASE,
+		});
+		try {
+			await migrate.query("CREATE TABLE IF NOT EXISTS it_probe (id int)");
+		} finally {
+			await migrate.end();
+		}
+	});
+});

package/tests/server-manager.bootstrap.spec.ts

@@ -0,0 +1,72 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { PoolMock, connectMock } = vi.hoisted(() => {
+	const connectMock = vi.fn();
+	const PoolMock = vi.fn(function Pool(
+		this: { connect: typeof connectMock },
+		_options: unknown,
+	) {
+		this.connect = connectMock;
+		return this;
+	});
+	return { PoolMock, connectMock };
+});
+
+vi.mock("pg", () => ({ Pool: PoolMock }));
+
+import { PostgresServerManager } from "../src/server-manager.js";
+
+function adminInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "api",
+		provider: "postgres",
+		host: "postgres",
+		port: 5432,
+		database: "crypto_api_dev",
+		synchronize: true,
+		seed: true,
+		username: "crypto_api_app",
+		password: "app-secret",
+		bootstrap: true,
+		adminUser: "decohere_bootstrap",
+		adminPassword: "bootstrap-secret",
+		...overrides,
+	};
+}
+
+describe("PostgresServerManager.connect CU-869ej9yq1", () => {
+	beforeEach(() => {
+		PoolMock.mockClear();
+		connectMock.mockReset();
+		connectMock.mockResolvedValue({ release: vi.fn() });
+	});
+
+	it("connects the bootstrap role to the postgres maintenance database", async () => {
+		const manager = new PostgresServerManager("crypto", adminInfo());
+		await manager.connect();
+
+		expect(PoolMock).toHaveBeenCalledWith(
+			expect.objectContaining({
+				user: "decohere_bootstrap",
+				password: "bootstrap-secret",
+				host: "postgres",
+				port: 5432,
+				database: "postgres",
+				application_name: "crypto",
+			}),
+		);
+		expect(PoolMock.mock.calls[0]?.[0]).not.toEqual(
+			expect.objectContaining({ database: "decohere_bootstrap" }),
+		);
+	});
+
+	it("wraps connection failures with host/port context", async () => {
+		connectMock.mockRejectedValue(new Error('database "decohere_bootstrap" does not exist'));
+		const manager = new PostgresServerManager("crypto", adminInfo());
+
+		await expect(manager.connect()).rejects.toThrow(
+			/Cannot connect to PostgreSQL at postgres:5432/,
+		);
+	});
+});

package/tests/trusted-dev-postgres.spec.ts

@@ -0,0 +1,212 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { PoolMock, connectMock, queryMock } = vi.hoisted(() => {
+	const connectMock = vi.fn();
+	const queryMock = vi.fn();
+	const PoolMock = vi.fn(function Pool(
+		this: { connect: typeof connectMock; query: typeof queryMock; end: () => Promise<void> },
+		_options: unknown,
+	) {
+		this.connect = connectMock;
+		this.query = queryMock;
+		this.end = async () => {};
+		return this;
+	});
+	return { PoolMock, connectMock, queryMock };
+});
+
+vi.mock("pg", () => ({ Pool: PoolMock }));
+
+import {
+	assertBootstrapCredentials,
+	assertDataSourceAuth,
+	shouldBootstrapDatabase,
+} from "../src/bootstrap-policy.js";
+import { createUserQuery } from "../src/scripts/user.js";
+import { PostgresServerManager } from "../src/server-manager.js";
+
+// A local dev Postgres that trusts every connection has no passwords at all (#578), and says so
+// with auth: trust (#656).
+function trustedInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "api",
+		provider: "postgres",
+		host: "postgres",
+		port: 5432,
+		database: "crypto_api_dev",
+		synchronize: true,
+		seed: true,
+		username: "crypto_api_app",
+		auth: "trust",
+		migrateUsername: "crypto_api_migrate",
+		adminUser: "decohere_bootstrap",
+		...overrides,
+	};
+}
+
+function sqlSent(): string[] {
+	return queryMock.mock.calls.map((call) => String(call[0]));
+}
+
+describe("trust auth is declared, never guessed (#656)", () => {
+	beforeEach(() => {
+		PoolMock.mockClear();
+		connectMock.mockReset();
+		connectMock.mockResolvedValue({ release: vi.fn() });
+		queryMock.mockReset();
+		queryMock.mockImplementation(async (sql: string) =>
+			sql.includes("datdba")
+				? { rowCount: 1, rows: [{ owner: "decohere_bootstrap" }] }
+				: { rowCount: 0, rows: [] },
+		);
+	});
+
+	describe("checking a data source's auth", () => {
+		it("accepts auth: trust with no passwords in development", () => {
+			expect(() => assertDataSourceAuth(trustedInfo(), "development")).not.toThrow();
+		});
+
+		it("refuses auth: trust outside development", () => {
+			expect(() => assertDataSourceAuth(trustedInfo(), "production")).toThrow(
+				/Data source "api" sets auth: trust, which is allowed only in development/,
+			);
+		});
+
+		it("refuses a missing password without auth: trust, in development too", () => {
+			for (const env of ["development", "production"]) {
+				expect(() => assertDataSourceAuth(trustedInfo({ auth: undefined }), env)).toThrow(
+					/Data source "api" has no password\. Set password, or auth: trust/,
+				);
+			}
+		});
+
+		it("treats an empty password as missing", () => {
+			expect(() =>
+				assertDataSourceAuth(trustedInfo({ auth: "password", password: "" }), "development"),
+			).toThrow(/has no password/);
+		});
+
+		it("accepts a password without auth, in any environment", () => {
+			expect(() =>
+				assertDataSourceAuth(
+					trustedInfo({ auth: undefined, password: "s3cret" }),
+					"production",
+				),
+			).not.toThrow();
+		});
+
+		it("refuses an auth it does not know", () => {
+			expect(() =>
+				assertDataSourceAuth(
+					trustedInfo({ auth: "md5" as ConnectionInfo["auth"] }),
+					"development",
+				),
+			).toThrow(/auth must be "password" or "trust" \(got "md5"\)/);
+		});
+
+		it("refuses a migrate role with no password when bootstrapping without auth: trust", () => {
+			expect(() =>
+				assertBootstrapCredentials(trustedInfo({ auth: undefined, password: "s3cret" })),
+			).toThrow(/Data source "api" has migrateUsername but no migratePassword/);
+			expect(() => assertBootstrapCredentials(trustedInfo())).not.toThrow();
+		});
+	});
+
+	describe("creating a role", () => {
+		it("leaves PASSWORD out when no password is given", () => {
+			const { text } = createUserQuery("crypto_api_app");
+			expect(text).toBe(
+				'CREATE USER "crypto_api_app" WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE',
+			);
+		});
+
+		it("still refuses an empty password, which is a typo and not a choice", () => {
+			expect(() => createUserQuery("crypto_api_app", "")).toThrow(/Invalid password/);
+		});
+	});
+
+	describe("deciding to bootstrap", () => {
+		it("bootstraps in development with auth: trust and no admin password", () => {
+			expect(shouldBootstrapDatabase(trustedInfo(), "development")).toBe(true);
+		});
+
+		it("no longer lets development alone stand in for an admin password", () => {
+			expect(shouldBootstrapDatabase(trustedInfo({ auth: undefined }), "development")).toBe(
+				false,
+			);
+			expect(() =>
+				shouldBootstrapDatabase(
+					trustedInfo({ auth: undefined, bootstrap: true }),
+					"development",
+				),
+			).toThrow(/adminPassword may be left out only with auth: trust/);
+		});
+
+		it("still needs an admin user", () => {
+			expect(
+				shouldBootstrapDatabase(trustedInfo({ adminUser: undefined }), "development"),
+			).toBe(false);
+		});
+	});
+
+	describe("connecting as the bootstrap role", () => {
+		it("connects with no password when the server is trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.connect();
+
+			const options = PoolMock.mock.calls[0]?.[0] as { user: string; password?: string };
+			expect(options.user).toBe("decohere_bootstrap");
+			expect(options.password).toBeUndefined();
+		});
+
+		it("asks for the admin password when the server is not trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo({ auth: undefined }));
+			await expect(manager.connect()).rejects.toThrow(/adminUser and adminPassword/);
+			expect(PoolMock).not.toHaveBeenCalled();
+		});
+	});
+
+	describe("provisioning the app and migrate roles", () => {
+		it("creates both without a PASSWORD clause when the server is trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.provisionRoles({
+				database: "crypto_api_dev",
+				appUsername: "crypto_api_app",
+				migrateUsername: "crypto_api_migrate",
+				allowAppDdl: false,
+			});
+
+			const creates = sqlSent().filter((sql) => sql.startsWith("CREATE USER"));
+			expect(creates).toHaveLength(2);
+			for (const sql of creates) {
+				expect(sql).not.toContain("PASSWORD");
+			}
+		});
+
+		it("still sets a password on a role that was given one", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo());
+			await manager.provisionRoles({
+				database: "crypto_api_dev",
+				appUsername: "crypto_api_app",
+				appPassword: "app-secret",
+				allowAppDdl: false,
+			});
+
+			const create = sqlSent().find((sql) => sql.startsWith("CREATE USER"));
+			expect(create).toContain("PASSWORD 'app-secret'");
+		});
+
+		it("refuses a role with no password when the server is not trusted", async () => {
+			const manager = new PostgresServerManager("crypto", trustedInfo({ auth: undefined }));
+			await expect(
+				manager.provisionRoles({
+					database: "crypto_api_prod",
+					appUsername: "crypto_api_app",
+					allowAppDdl: false,
+				}),
+			).rejects.toThrow(/password is required for database role "crypto_api_app"/i);
+			expect(sqlSent().some((sql) => sql.startsWith("CREATE USER"))).toBe(false);
+		});
+	});
+});

package/tests/type-orm.module.spec.ts

@@ -0,0 +1,123 @@
+import "reflect-metadata";
+import { type ConnectionInfo, DatabaseConfig, DEFAULT_DATA_SOURCE } from "@decohere/data";
+import { ServiceContainerBuilder, ResolveError } from "@decohere/di";
+import { injectable } from "@decohere/di/decorators";
+import type { DataSource } from "typeorm";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { DataSourceFactory } from "../src/data-source.factory.js";
+import {
+	injectDataSource,
+	TypeOrmDataSourceToken,
+	typeOrmDataSourceToken,
+} from "../src/inject-data-source.js";
+import { TypeOrmModule } from "../src/type-orm.module.js";
+import { TypeOrmUnitOfWork } from "../src/unit-of-work.js";
+
+class PositionEntity {}
+
+function pgInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "default",
+		provider: "postgres",
+		host: "localhost",
+		port: 5432,
+		database: "app",
+		synchronize: false,
+		seed: false,
+		username: "app",
+		password: "secret",
+		bootstrap: false,
+		...overrides,
+	};
+}
+
+function fakeDataSource() {
+	const repository = { find: vi.fn().mockResolvedValue([]) };
+	return {
+		initialize: vi.fn().mockResolvedValue(undefined),
+		getRepository: vi.fn(() => repository),
+		query: vi.fn().mockResolvedValue([{ "?column?": 1 }]),
+		createQueryRunner: vi.fn(() => ({
+			manager: {},
+			isReleased: false,
+			release() {},
+		})),
+		repository,
+	};
+}
+
+describe("TypeOrmModule DataSource singleton CU-869ekhrex", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("lets a singleton adapter inject DataSource and call getRepository", async () => {
+		const ds = fakeDataSource();
+		vi.spyOn(DataSourceFactory, "create").mockReturnValue(ds as unknown as DataSource);
+
+		@injectable()
+		class TypeOrmPositionBook {
+			public constructor(@injectDataSource() private readonly dataSource: DataSource) {}
+			public list() {
+				return this.dataSource.getRepository(PositionEntity).find();
+			}
+		}
+
+		const containerBuilder = new ServiceContainerBuilder();
+		containerBuilder.registerSingleton(TypeOrmPositionBook);
+
+		const databaseConfig = new DatabaseConfig();
+		databaseConfig.dataSources = [pgInfo()];
+		await new TypeOrmModule().configure({
+			applicationName: "funding-fee.api",
+			databaseConfig,
+			moduleConfigurations: [{ entities: [PositionEntity] }],
+			containerBuilder,
+		});
+
+		const container = containerBuilder.build();
+		const book = container.resolve(TypeOrmPositionBook);
+		await book.list();
+
+		expect(ds.getRepository).toHaveBeenCalledWith(PositionEntity);
+		expect(ds.repository.find).toHaveBeenCalled();
+		expect(container.resolve(TypeOrmDataSourceToken)).toBe(ds);
+		expect(container.resolve(TypeOrmDataSourceToken)).toBe(
+			container.resolve(TypeOrmDataSourceToken),
+		);
+	});
+
+	it("registers a named DataSource without replacing request-scoped UoW", async () => {
+		const ds = fakeDataSource();
+		vi.spyOn(DataSourceFactory, "create").mockReturnValue(ds as unknown as DataSource);
+
+		@injectable()
+		class TypeOrmPositionBook {
+			public constructor(@injectDataSource("api") private readonly dataSource: DataSource) {}
+			public source() {
+				return this.dataSource;
+			}
+		}
+
+		const containerBuilder = new ServiceContainerBuilder();
+		containerBuilder.registerSingleton(TypeOrmPositionBook);
+
+		const databaseConfig = new DatabaseConfig();
+		databaseConfig.dataSources = [pgInfo({ name: "api" })];
+		await new TypeOrmModule().configure({
+			applicationName: "funding-fee.api",
+			databaseConfig,
+			moduleConfigurations: [{ name: "api", entities: [PositionEntity] }],
+			containerBuilder,
+		});
+
+		const container = containerBuilder.build();
+		expect(container.resolve(TypeOrmPositionBook).source()).toBe(ds);
+		expect(container.resolve(typeOrmDataSourceToken("api"))).toBe(ds);
+		expect(() => container.resolve(TypeOrmDataSourceToken)).toThrow(ResolveError);
+
+		using scope = container.beginScope("req");
+		expect(scope.resolve("api")).toBeInstanceOf(TypeOrmUnitOfWork);
+		expect(() => scope.resolve(DEFAULT_DATA_SOURCE)).toThrow(ResolveError);
+	});
+});

package/tests/typeorm.lifecycle.spec.ts

@@ -0,0 +1,97 @@
+import "reflect-metadata";
+import { type ConnectionInfo, DatabaseConfig } from "@decohere/data";
+import { Builder, type HostedService } from "@decohere/http";
+import { injectable } from "@decohere/di/decorators";
+import {
+	ConfigurationServiceToken,
+	type IConfigurationService,
+} from "@decohere/core/configuration";
+import type { Constructable } from "@decohere/core/reflection";
+import { DataSource } from "typeorm";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import "../src/typeorm.extensions.js";
+
+const connection: ConnectionInfo = {
+	name: "default",
+	provider: "postgres",
+	host: "localhost",
+	port: 5432,
+	database: "app",
+	synchronize: false,
+	seed: false,
+	username: "app",
+	password: "secret",
+	bootstrap: false,
+};
+
+class StaticConfig implements IConfigurationService {
+	public readonly dataSources = [];
+	public async get<T extends object>(type: Constructable<T> | string): Promise<T> {
+		if (type === DatabaseConfig) {
+			const config = new DatabaseConfig();
+			config.dataSources = [connection];
+			return config as unknown as T;
+		}
+		return {} as T;
+	}
+}
+
+let events: string[] = [];
+
+@injectable()
+class UsesTheDatabase implements HostedService {
+	public start() {}
+	public stop() {
+		events.push("hosted service stopped");
+	}
+}
+
+/** The real DataSource class, with connecting and disconnecting stubbed: no database needed. */
+function stubConnections() {
+	vi.spyOn(DataSource.prototype, "initialize").mockImplementation(async function (
+		this: DataSource,
+	) {
+		Object.assign(this, { isInitialized: true });
+		return this;
+	});
+	return vi.spyOn(DataSource.prototype, "destroy").mockImplementation(async function (
+		this: DataSource,
+	) {
+		events.push("data source destroyed");
+		Object.assign(this, { isInitialized: false });
+	});
+}
+
+describe("withTypeOrm lifecycle (#541)", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+		events = [];
+	});
+
+	it("destroys the DataSource when the app stops, after hosted services have stopped", async () => {
+		const destroy = stubConnections();
+		const app = await Builder.create()
+			.withServices((c) => c.registerSingleton(ConfigurationServiceToken, new StaticConfig()))
+			.withTypeOrm({ entities: [] })
+			.withHostedService(UsesTheDatabase)
+			.build();
+		await app.start({ port: 0, shutdownSignals: false });
+
+		await app.dispose();
+
+		expect(destroy).toHaveBeenCalledTimes(1);
+		expect(events).toEqual(["hosted service stopped", "data source destroyed"]);
+	});
+
+	it("destroys a DataSource nothing resolved (no request ever used it)", async () => {
+		const destroy = stubConnections();
+		const app = await Builder.create()
+			.withServices((c) => c.registerSingleton(ConfigurationServiceToken, new StaticConfig()))
+			.withTypeOrm({ entities: [] })
+			.build();
+
+		await app.dispose();
+
+		expect(destroy).toHaveBeenCalledTimes(1);
+	});
+});

package/tests/unit-of-work.spec.ts

@@ -0,0 +1,54 @@
+import type { DataSource, QueryRunner } from "typeorm";
+import { describe, expect, it } from "vitest";
+import { TypeOrmUnitOfWork } from "../src/unit-of-work.js";
+
+/** A stand-in QueryRunner that records what happens to the connection. */
+function fakeRunner(transactionActive: boolean) {
+	const events: string[] = [];
+	const runner = {
+		isTransactionActive: transactionActive,
+		isReleased: false,
+		async rollbackTransaction() {
+			await new Promise((resolve) => setTimeout(resolve, 5));
+			events.push("rollback");
+			runner.isTransactionActive = false;
+		},
+		async release() {
+			await new Promise((resolve) => setTimeout(resolve, 5));
+			events.push("release");
+			runner.isReleased = true;
+		},
+	};
+	const dataSource = { createQueryRunner: () => runner as unknown as QueryRunner };
+	return { uow: new TypeOrmUnitOfWork(dataSource as unknown as DataSource), runner, events };
+}
+
+// #502: a request that failed mid-transaction used to hand its connection back to the pool
+// with the transaction still open, and without waiting for the release to finish.
+describe("TypeOrmUnitOfWork disposal", () => {
+	it("rolls back an unfinished transaction, then releases the connection, and waits for both", async () => {
+		const { uow, runner, events } = fakeRunner(true);
+
+		await uow[Symbol.asyncDispose]();
+
+		expect(events).toEqual(["rollback", "release"]);
+		expect(runner.isReleased).toBe(true);
+	});
+
+	it("only releases when no transaction is open", async () => {
+		const { uow, events } = fakeRunner(false);
+
+		await uow[Symbol.asyncDispose]();
+
+		expect(events).toEqual(["release"]);
+	});
+
+	it("does nothing when already released", async () => {
+		const { uow, runner, events } = fakeRunner(false);
+		runner.isReleased = true;
+
+		await uow[Symbol.asyncDispose]();
+
+		expect(events).toEqual([]);
+	});
+});

package/tests/user-scripts.pentest.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import {
+	assertSafeSqlIdent,
+	createUserQuery,
+	quoteIdent,
+	quoteLiteral,
+	userScripts,
+} from "../src/scripts/user.js";
+
+describe("pen-test — data-typeorm bootstrap SQL injection", () => {
+	it("rejects username that would break out of SQL string literals", () => {
+		expect(() => userScripts.createOwnerUser("evil'; DROP ROLE x; --", "pw", "db")).toThrow(
+			/Invalid username/,
+		);
+	});
+
+	it("escapes password metacharacters in CREATE USER (Postgres forbids PASSWORD $1)", () => {
+		const create = createUserQuery("apiuser", "x'; DROP ROLE x; --");
+		expect(create.text).not.toMatch(/PASSWORD\s+\$\d/);
+		expect(create.values).toEqual([]);
+		expect(create.text).toContain(quoteLiteral("x'; DROP ROLE x; --"));
+		expect(create.text).toContain("''"); // doubled quote from escaping
+		// Breakout must stay inside the password literal, not become SQL.
+		expect(create.text).toMatch(/PASSWORD 'x''; DROP ROLE x; --'/);
+	});
+
+	it("rejects database name with SQL metacharacters", () => {
+		expect(() =>
+			userScripts.createOwnerUser("apiuser", "secret", "db'; DROP DATABASE x; --"),
+		).toThrow(/Invalid database/);
+	});
+
+	it("emits CREATE USER with an escaped password literal for a safe username", () => {
+		const { text, values } = userScripts.createOwnerUser("api_user", "s3cret!", "webapi_dev");
+		expect(text).toContain("PASSWORD 's3cret!'");
+		expect(text).not.toMatch(/PASSWORD\s+\$\d/);
+		expect(values).toEqual([]);
+		expect(quoteIdent("api_user")).toBe('"api_user"');
+		expect(quoteLiteral("a'b")).toBe("'a''b'");
+		expect(() => assertSafeSqlIdent('x"; DROP', "username")).toThrow(/Invalid username/);
+	});
+});