@decohere/data-typeorm 0.0.1-dev.126 → 0.0.1-dev.5

package/src/unit-of-work.ts

@@ -0,0 +1,52 @@
+import type { IUnitOfWork } from "@decohere/data";
+import type { Constructable } from "@decohere/core/reflection";
+import type { DataSource, QueryRunner, Repository } from "typeorm";
+
+export class TypeOrmUnitOfWork implements IUnitOfWork {
+	private readonly dataSource: DataSource;
+	public readonly queryRunner: QueryRunner;
+
+	public constructor(dataSource: DataSource) {
+		this.dataSource = dataSource;
+		this.queryRunner = this.dataSource.createQueryRunner();
+	}
+
+	public get entityManager() {
+		return this.queryRunner.manager;
+	}
+
+	public getRepository<T>(entity: Constructable): Repository<T> {
+		return this.entityManager.getRepository<T>(entity);
+	}
+
+	public async beginTransaction(): Promise<void> {
+		return this.queryRunner.startTransaction();
+	}
+
+	public async commit() {
+		return this.queryRunner.commitTransaction();
+	}
+
+	/**
+	 * Hand the connection back to the pool, rolling back first if a transaction is still open
+	 * (e.g. the request failed before commit). Otherwise the next user of that pooled
+	 * connection would inherit the half-finished transaction (#502).
+	 */
+	public async [Symbol.asyncDispose]() {
+		if (this.queryRunner.isReleased) {
+			return;
+		}
+		try {
+			if (this.queryRunner.isTransactionActive) {
+				await this.queryRunner.rollbackTransaction();
+			}
+		} finally {
+			await this.queryRunner.release();
+		}
+	}
+
+	/** Prefer `await using` / async disposal; this starts the same cleanup without waiting. */
+	public [Symbol.dispose]() {
+		void this[Symbol.asyncDispose]();
+	}
+}

package/tests/bootstrap-schemas.docker.spec.ts

@@ -0,0 +1,145 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { Pool } from "pg";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { bootstrapDataSources } from "../src/bootstrap.js";
+import { type PostgresContainer, startPostgres } from "./postgres-container.js";
+
+/**
+ * Ledger's shape (#656): one trusted dev server, one database, a schema per module, and a
+ * migrate role that ends up owning the database. Needs Docker: runs under `pnpm test:docker`.
+ */
+
+const BOOTSTRAP_USER = "decohere_bootstrap";
+const APP_USER = "ledger_app";
+const MIGRATE_USER = "ledger_migrate";
+const DATABASE = "ledger_dev";
+const SCHEMAS = ["accounts", "liquidity"] as const;
+
+describe("bootstrapDataSources against a trusted Postgres (#656)", () => {
+	let postgres: PostgresContainer;
+
+	beforeAll(async () => {
+		postgres = await startPostgres({ trust: true });
+		await postgres.superuser.query(
+			`CREATE ROLE ${BOOTSTRAP_USER} LOGIN CREATEDB CREATEROLE NOSUPERUSER NOBYPASSRLS`,
+		);
+	}, 120_000);
+
+	afterAll(async () => {
+		await postgres?.stop();
+	});
+
+	function dataSource(schema: string): ConnectionInfo {
+		return {
+			name: schema,
+			provider: "postgres",
+			host: postgres.host,
+			port: postgres.port,
+			database: DATABASE,
+			username: APP_USER,
+			auth: "trust",
+			schema,
+			synchronize: true,
+			seed: false,
+			bootstrap: true,
+			adminUser: BOOTSTRAP_USER,
+			migrateUsername: MIGRATE_USER,
+		};
+	}
+
+	function bootstrap() {
+		return bootstrapDataSources(SCHEMAS.map(dataSource), {
+			applicationName: "ledger.it",
+			nodeEnv: "development",
+		});
+	}
+
+	async function as<T>(user: string, work: (pool: Pool) => Promise<T>): Promise<T> {
+		const pool = new Pool({
+			host: postgres.host,
+			port: postgres.port,
+			user,
+			database: DATABASE,
+		});
+		try {
+			return await work(pool);
+		} finally {
+			await pool.end();
+		}
+	}
+
+	/** Everything the bootstrap may touch, as text, so two runs can be compared. */
+	async function catalogState() {
+		return as(MIGRATE_USER, async (pool) => {
+			const { rows } = await pool.query(`
+				SELECT 'schema ' || nspname || ' owner=' || pg_get_userbyid(nspowner) || ' acl=' || coalesce(nspacl::text, '') AS line
+				  FROM pg_namespace WHERE nspname IN ('public', 'accounts', 'liquidity')
+				UNION ALL
+				SELECT 'database owner=' || pg_get_userbyid(datdba) || ' acl=' || coalesce(datacl::text, '')
+				  FROM pg_database WHERE datname = current_database()
+				UNION ALL
+				SELECT 'default ' || pg_get_userbyid(defaclrole) || ' ' || defaclnamespace::regnamespace::text
+				       || ' ' || defaclobjtype::text || ' ' || defaclacl::text
+				  FROM pg_default_acl
+				UNION ALL
+				SELECT 'member ' || pg_get_userbyid(member) || ' of ' || pg_get_userbyid(roleid)
+				       || ' admin=' || admin_option || ' inherit=' || inherit_option || ' set=' || set_option
+				  FROM pg_auth_members
+				 WHERE pg_get_userbyid(member) IN ('${BOOTSTRAP_USER}', '${APP_USER}', '${MIGRATE_USER}')
+				ORDER BY 1`);
+			return rows.map((row: { line: string }) => row.line);
+		});
+	}
+
+	it("creates the database, the roles and each schema, and lets the app role work in them", async () => {
+		await bootstrap();
+
+		const owners = await as(APP_USER, async (pool) => {
+			const { rows } = await pool.query(
+				`SELECT nspname, pg_get_userbyid(nspowner) AS owner FROM pg_namespace
+				  WHERE nspname = ANY($1) ORDER BY nspname`,
+				[SCHEMAS],
+			);
+			return rows;
+		});
+		expect(owners).toEqual([
+			{ nspname: "accounts", owner: MIGRATE_USER },
+			{ nspname: "liquidity", owner: MIGRATE_USER },
+		]);
+
+		// synchronize: the app role creates its own tables in each schema.
+		for (const schema of SCHEMAS) {
+			await as(APP_USER, (pool) =>
+				pool.query(
+					`CREATE TABLE ${schema}.synced (id int); INSERT INTO ${schema}.synced VALUES (1)`,
+				),
+			);
+		}
+
+		// Default privileges apply in the named schemas: tables the migrate role creates there
+		// are readable and writable by the app role.
+		for (const schema of SCHEMAS) {
+			await as(MIGRATE_USER, (pool) => pool.query(`CREATE TABLE ${schema}.migrated (id int)`));
+			await as(APP_USER, (pool) =>
+				pool.query(
+					`INSERT INTO ${schema}.migrated VALUES (1); SELECT * FROM ${schema}.migrated`,
+				),
+			);
+		}
+	});
+
+	it("changes nothing when run again, now that the migrate role owns the database", async () => {
+		const before = await catalogState();
+		expect(before.find((line) => line.startsWith("database "))).toMatch(
+			new RegExp(`^database owner=${MIGRATE_USER} `),
+		);
+		// The admin gives back the roles it borrowed: it keeps no membership that lends it their rights.
+		expect(before.filter((line) => line.startsWith(`member ${BOOTSTRAP_USER} `))).not.toEqual(
+			expect.arrayContaining([expect.stringContaining("inherit=true")]),
+		);
+
+		await bootstrap();
+
+		expect(await catalogState()).toEqual(before);
+	});
+});

package/tests/bootstrap.spec.ts

@@ -0,0 +1,156 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { PoolMock, queryMock } = vi.hoisted(() => {
+	const queryMock = vi.fn();
+	const PoolMock = vi.fn(function Pool(
+		this: {
+			connect: () => Promise<{ release: () => void }>;
+			query: typeof queryMock;
+			end: () => Promise<void>;
+		},
+		_options: unknown,
+	) {
+		this.connect = async () => ({ release() {} });
+		this.query = queryMock;
+		this.end = async () => {};
+		return this;
+	});
+	return { PoolMock, queryMock };
+});
+
+vi.mock("pg", () => ({ Pool: PoolMock }));
+
+import { bootstrapDataSources } from "../src/bootstrap.js";
+
+/** Edges the real-Postgres suite (bootstrap-schemas.docker.spec.ts) does not see. */
+
+function dataSource(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "accounts",
+		provider: "postgres",
+		host: "postgres",
+		port: 5432,
+		database: "ledger_dev",
+		username: "ledger_app",
+		auth: "trust",
+		schema: "accounts",
+		synchronize: true,
+		seed: false,
+		bootstrap: true,
+		adminUser: "decohere_bootstrap",
+		...overrides,
+	};
+}
+
+/** Pools opened on the maintenance database: one per server and database bootstrapped. */
+function serverConnections(): number {
+	return PoolMock.mock.calls.filter(
+		(call) => (call[0] as { database: string }).database === "postgres",
+	).length;
+}
+
+function sqlSent(): string[] {
+	return queryMock.mock.calls.map((call) => String(call[0]));
+}
+
+let privilegesHeld = false;
+
+describe("bootstrapDataSources (#656)", () => {
+	beforeEach(() => {
+		PoolMock.mockClear();
+		queryMock.mockReset();
+		privilegesHeld = false;
+		queryMock.mockImplementation(async (sql: string) => {
+			if (sql.includes("datdba"))
+				return { rowCount: 1, rows: [{ owner: "decohere_bootstrap" }] };
+			if (sql.includes("AS granted"))
+				return { rowCount: 1, rows: [{ granted: privilegesHeld }] };
+			return { rowCount: 0, rows: [] };
+		});
+	});
+
+	const options = { applicationName: "ledger", nodeEnv: "development" };
+
+	it("bootstraps data sources that share a server and database once", async () => {
+		await bootstrapDataSources(
+			[
+				dataSource(),
+				dataSource({ name: "liquidity", schema: "liquidity" }),
+				dataSource({ name: "other", database: "other_dev", schema: undefined }),
+			],
+			options,
+		);
+
+		expect(serverConnections()).toBe(2);
+		expect(sqlSent().filter((sql) => sql.startsWith("CREATE SCHEMA"))).toEqual([
+			'CREATE SCHEMA IF NOT EXISTS "accounts" AUTHORIZATION "decohere_bootstrap"',
+			'CREATE SCHEMA IF NOT EXISTS "liquidity" AUTHORIZATION "decohere_bootstrap"',
+			'CREATE SCHEMA IF NOT EXISTS "public" AUTHORIZATION "decohere_bootstrap"',
+		]);
+	});
+
+	it("grants on the data source's schema, not on public", async () => {
+		await bootstrapDataSources([dataSource()], options);
+
+		const grants = sqlSent().filter((sql) => sql.startsWith("GRANT"));
+		expect(grants).toEqual([
+			'GRANT CONNECT ON DATABASE "ledger_dev" TO "ledger_app"',
+			'GRANT USAGE ON SCHEMA "accounts" TO "ledger_app"',
+			'GRANT CREATE ON SCHEMA "accounts" TO "ledger_app"',
+		]);
+	});
+
+	it("grants nothing the roles already hold", async () => {
+		privilegesHeld = true;
+		await bootstrapDataSources([dataSource({ migrateUsername: "ledger_migrate" })], options);
+
+		expect(sqlSent().filter((sql) => /^(GRANT|REVOKE)/.test(sql))).toEqual([]);
+	});
+
+	it("refuses data sources on one database that disagree on how to bootstrap it", async () => {
+		await expect(
+			bootstrapDataSources(
+				[dataSource(), dataSource({ name: "liquidity", migrateUsername: "ledger_migrate" })],
+				options,
+			),
+		).rejects.toThrow(
+			/Data sources "accounts" and "liquidity" share database postgres:5432\/ledger_dev but set different migrateUsername/,
+		);
+		expect(PoolMock).not.toHaveBeenCalled();
+	});
+
+	it("checks the auth of every data source, including those it does not bootstrap", async () => {
+		await expect(
+			bootstrapDataSources(
+				[dataSource({ name: "readonly", bootstrap: false, auth: undefined })],
+				options,
+			),
+		).rejects.toThrow(/Data source "readonly" has no password/);
+		expect(PoolMock).not.toHaveBeenCalled();
+	});
+
+	it("refuses auth: trust outside development before connecting", async () => {
+		await expect(
+			bootstrapDataSources([dataSource()], {
+				applicationName: "ledger",
+				nodeEnv: "production",
+			}),
+		).rejects.toThrow(/sets auth: trust, which is allowed only in development/);
+		expect(PoolMock).not.toHaveBeenCalled();
+	});
+
+	it("explains when the admin cannot act as the database owner", async () => {
+		queryMock.mockImplementation(async (sql: string) => {
+			if (sql.includes("datdba")) return { rowCount: 1, rows: [{ owner: "postgres" }] };
+			if (sql.includes("AS granted")) return { rowCount: 1, rows: [{ granted: false }] };
+			if (sql.startsWith('GRANT "postgres"'))
+				throw new Error('permission denied to grant role "postgres"');
+			return { rowCount: 0, rows: [] };
+		});
+
+		await expect(bootstrapDataSources([dataSource()], options)).rejects.toThrow(
+			/Bootstrap role "decohere_bootstrap" cannot act as "postgres"/,
+		);
+	});
+});

package/tests/db-least-privilege.pentest.spec.ts

@@ -0,0 +1,125 @@
+import type { ConnectionInfo } from "@decohere/data";
+import { describe, expect, it } from "vitest";
+import { shouldBootstrapDatabase } from "../src/bootstrap-policy.js";
+import {
+	createSchemaQuery,
+	createUserQuery,
+	defaultPrivilegesForAppQueries,
+	grantConnectQuery,
+	grantSchemaCreateQuery,
+	grantSchemaUsageQuery,
+	userScripts,
+} from "../src/scripts/user.js";
+
+function baseInfo(overrides: Partial<ConnectionInfo> = {}): ConnectionInfo {
+	return {
+		name: "default",
+		provider: "postgres",
+		host: "localhost",
+		port: 5432,
+		database: "webapi_dev",
+		synchronize: false,
+		seed: false,
+		username: "webapi_app",
+		password: "app-secret",
+		...overrides,
+	};
+}
+
+describe("pen-test — least-privilege DB roles CU-869eh3065", () => {
+	it("runtime createOwnerUser helper grants CONNECT+USAGE, not ALL PRIVILEGES", () => {
+		const { text } = userScripts.createOwnerUser("webapi_app", "s3cret!", "webapi_dev");
+		expect(text).toMatch(/GRANT CONNECT ON DATABASE/);
+		expect(text).toMatch(/GRANT USAGE ON SCHEMA "public"/);
+		expect(text).not.toMatch(/GRANT ALL PRIVILEGES ON DATABASE/);
+		expect(text).not.toMatch(/GRANT ALL ON SCHEMA/);
+		expect(text).toMatch(/NOSUPERUSER/);
+		expect(text).toMatch(/NOCREATEDB/);
+		expect(text).toMatch(/NOCREATEROLE/);
+	});
+
+	it("app grants stay DML-oriented", () => {
+		const connect = grantConnectQuery("webapi_app", "webapi_dev");
+		const usage = grantSchemaUsageQuery("webapi_app");
+		expect(connect.text).toContain("GRANT CONNECT");
+		expect(usage.text).toContain("GRANT USAGE");
+		expect(grantSchemaCreateQuery("webapi_app").text).toContain("GRANT CREATE");
+	});
+
+	it("rejects a schema name with SQL metacharacters", () => {
+		expect(() => grantSchemaUsageQuery("webapi_app", 'accounts"; DROP SCHEMA x; --')).toThrow(
+			/Invalid schema/,
+		);
+		expect(() => createSchemaQuery("accounts; DROP", "webapi_migrate")).toThrow(
+			/Invalid schema/,
+		);
+	});
+
+	it("default privileges grant DML (not ALL) from migrate role to app role", () => {
+		const qs = defaultPrivilegesForAppQueries("webapi_migrate", "webapi_app");
+		const joined = qs.map((q) => q.text).join("\n");
+		expect(joined).toMatch(/GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES/);
+		expect(joined).toMatch(/GRANT USAGE, SELECT ON SEQUENCES/);
+		expect(joined).not.toMatch(/GRANT ALL ON TABLES/);
+	});
+
+	it("CREATE USER escapes password literals (Postgres forbids PASSWORD $1)", () => {
+		const create = createUserQuery("webapi_app", "x'; DROP ROLE x; --");
+		expect(create.text).not.toMatch(/PASSWORD\s+\$\d/);
+		expect(create.values).toEqual([]);
+		// Escaped so the quote does not terminate the literal early.
+		expect(create.text).toContain("PASSWORD 'x''; DROP ROLE x; --'");
+	});
+});
+
+describe("bootstrap gate CU-869eh3065", () => {
+	it("does not bootstrap in production when bootstrap is omitted", () => {
+		expect(
+			shouldBootstrapDatabase(
+				baseInfo({ adminUser: "decohere_bootstrap", adminPassword: "x" }),
+				"production",
+			),
+		).toBe(false);
+	});
+
+	it("does not bootstrap when bootstrap: false even in development", () => {
+		expect(
+			shouldBootstrapDatabase(
+				baseInfo({
+					bootstrap: false,
+					adminUser: "decohere_bootstrap",
+					adminPassword: "x",
+				}),
+				"development",
+			),
+		).toBe(false);
+	});
+
+	it("bootstraps in development when admin creds are present", () => {
+		expect(
+			shouldBootstrapDatabase(
+				baseInfo({ adminUser: "decohere_bootstrap", adminPassword: "x" }),
+				"dev",
+			),
+		).toBe(true);
+	});
+
+	it("bootstraps when bootstrap: true and admin creds are set", () => {
+		expect(
+			shouldBootstrapDatabase(
+				baseInfo({
+					bootstrap: true,
+					adminUser: "decohere_bootstrap",
+					adminPassword: "x",
+				}),
+				"production",
+			),
+		).toBe(true);
+	});
+
+	it("refuses bootstrap: true without admin credentials", () => {
+		expect(() => shouldBootstrapDatabase(baseInfo({ bootstrap: true }), "production")).toThrow(
+			/adminUser and adminPassword/,
+		);
+	});
+});

package/tests/postgres-container.ts

@@ -0,0 +1,139 @@
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { createConnection } from "node:net";
+import { Pool } from "pg";
+import { vi } from "vitest";
+
+// test/fs.setup.ts swaps node:fs for memfs; /.dockerenv is on the real disk.
+const { existsSync } = await vi.importActual<typeof import("node:fs")>("node:fs");
+
+/** A throwaway postgres:16 container for `*.docker.spec.ts` suites. */
+export type PostgresContainer = {
+	host: string;
+	port: number;
+	superuser: Pool;
+	stop(): Promise<void>;
+};
+
+const SUPERUSER = "postgres";
+const SUPER_PASSWORD = "postgres";
+
+export type StartPostgresOptions = {
+	/** Start the server with every connection trusted (pg_hba `trust`), like a local dev server. */
+	trust?: boolean;
+};
+
+export async function startPostgres(
+	options: StartPostgresOptions = {},
+): Promise<PostgresContainer> {
+	try {
+		execFileSync("docker", ["info"], { stdio: "ignore" });
+	} catch (err) {
+		throw new Error("Docker is required for data-typeorm *.docker.spec.ts suites", {
+			cause: err,
+		});
+	}
+
+	const name = `decohere-data-typeorm-it-${randomBytes(4).toString("hex")}`;
+	const auth = options.trust
+		? ["-e", "POSTGRES_HOST_AUTH_METHOD=trust"]
+		: ["-e", `POSTGRES_PASSWORD=${SUPER_PASSWORD}`];
+	const containerId = execFileSync(
+		"docker",
+		["run", "-d", "--rm", "--name", name, ...auth, "-p", "127.0.0.1::5432", "postgres:16"],
+		{ encoding: "utf8" },
+	).trim();
+
+	const { host, port } = address(containerId);
+	await waitForTcp(host, port, 60_000);
+	const superuser = await waitForSuperuser(host, port, options.trust === true);
+
+	return {
+		host,
+		port,
+		superuser,
+		async stop() {
+			await superuser.end();
+			execFileSync("docker", ["stop", containerId], { stdio: "ignore" });
+		},
+	};
+}
+
+/**
+ * Inside a dev container that shares the host's Docker daemon, a port published on the host's
+ * 127.0.0.1 is out of reach, but the container's bridge address is not. Elsewhere (CI), use the
+ * published port.
+ */
+function address(containerId: string): { host: string; port: number } {
+	if (existsSync("/.dockerenv")) {
+		const ip = execFileSync(
+			"docker",
+			[
+				"inspect",
+				"-f",
+				"{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}",
+				containerId,
+			],
+			{ encoding: "utf8" },
+		).trim();
+		if (ip.length === 0) throw new Error(`Container ${containerId} has no bridge address`);
+		return { host: ip, port: 5432 };
+	}
+	const portMap = execFileSync("docker", ["port", containerId, "5432/tcp"], {
+		encoding: "utf8",
+	}).trim();
+	// e.g. 127.0.0.1:32768
+	const match = portMap.match(/:(\d+)\s*$/);
+	if (!match?.[1]) {
+		throw new Error(`Could not parse docker port mapping from: ${portMap}`);
+	}
+	return { host: "127.0.0.1", port: Number(match[1]) };
+}
+
+function waitForTcp(host: string, port: number, timeoutMs: number): Promise<void> {
+	const start = Date.now();
+	return new Promise((resolve, reject) => {
+		const attempt = () => {
+			const socket = createConnection({ host, port }, () => {
+				socket.end();
+				resolve();
+			});
+			socket.on("error", () => {
+				socket.destroy();
+				if (Date.now() - start > timeoutMs) {
+					reject(new Error(`Timed out waiting for Postgres at ${host}:${port}`));
+					return;
+				}
+				setTimeout(attempt, 200);
+			});
+		};
+		attempt();
+	});
+}
+
+/** The image restarts the server once after init, so the first logins can still fail. */
+async function waitForSuperuser(host: string, port: number, trust: boolean): Promise<Pool> {
+	const start = Date.now();
+	for (;;) {
+		const pool = new Pool({
+			host,
+			port,
+			user: SUPERUSER,
+			password: trust ? undefined : SUPER_PASSWORD,
+			database: "postgres",
+			connectionTimeoutMillis: 2000,
+		});
+		try {
+			await pool.query("SELECT 1");
+			return pool;
+		} catch (err) {
+			await pool.end();
+			if (Date.now() - start > 60_000) {
+				throw new Error("Timed out waiting for Postgres to accept superuser login", {
+					cause: err,
+				});
+			}
+			await new Promise((r) => setTimeout(r, 250));
+		}
+	}
+}