@dooer/dooer-test-env 1.6.0 → 1.8.0

package/lib/cli.js

@@ -17,6 +17,7 @@ module.exports = async function cli() {
     .command(require('./command/customer')) // customer copy|purge
     .command(require('./command/shred')) // shred (localhost only)
     .command(require('./command/bankid')) // bankid pull|status|clear (staging certs → keychain)
+    .command(require('./command/validation')) // validation on|off|status (output-schema checks)
     .command(require('./command/logs')) // search logs across all local services (transactionId, errors, …)
     .command(require('./command/measure')) // resource-usage report for the running env
     .demandCommand(1, 'Pick a command group. Try --help.')

package/lib/command/env.js

@@ -14,7 +14,11 @@ const discovery = require('../discovery/client')
 function ensureCompose() {
   rt.ensureRunDir()
   if (!fs.existsSync(rt.COMPOSE_FILE)) {
-    const r = generateCompose({ servicesDir: rt.SERVICES_DIR, out: rt.COMPOSE_FILE })
+    const r = generateCompose({
+      servicesDir: rt.SERVICES_DIR,
+      out: rt.COMPOSE_FILE,
+      outputValidation: !!rt.readState().outputValidation,
+    })
     console.log(chalk.gray(`generated ${rt.COMPOSE_FILE} (${(r && r.serviceCount) || 'n'} services)`))
   }
   return rt.COMPOSE_FILE

package/lib/command/setup.js

@@ -62,7 +62,11 @@ module.exports = {
 
     // generate the compose file
     rt.ensureRunDir()
-    const r = generateCompose({ servicesDir: rt.SERVICES_DIR, out: rt.COMPOSE_FILE })
+    const r = generateCompose({
+      servicesDir: rt.SERVICES_DIR,
+      out: rt.COMPOSE_FILE,
+      outputValidation: !!rt.readState().outputValidation,
+    })
     console.log(`\n${ok(true)} generated ${rt.COMPOSE_FILE} (${(r && r.serviceCount) || '?'} services)`)
 
     // BankID certs → keychain, so local login matches staging (production BankID). Idempotent; only pulls

package/lib/command/validation.js

@@ -0,0 +1,74 @@
+const chalk = require('chalk')
+const rt = require('../runtime')
+const { generateCompose, VALIDATION_ENV } = require('../compose/generate')
+
+// Turn OUTPUT-schema validation on/off for the whole local stack.
+//
+// Both @dooer/microservice (a service validating its OWN response, define-route.js:515) and
+// @dooer/json-http-client (a client validating a response it RECEIVED, route-validators.js:46) run that
+// check only when NODE_ENV !== 'production'. Inbound INPUT validation is a separate path
+// (define-route.js:436) and always runs — this switch does not weaken it.
+//
+// Default OFF, so the local env behaves like staging/live where these checks are silent. Turn it ON to hunt
+// stale service definitions (a consumer whose bundled definition predates a producer's added fields 500s on
+// perfectly good data). See lib/compose/generate.js VALIDATION_ENV.
+
+function apply(enabled, { profile }) {
+  const state = rt.readState()
+  state.outputValidation = !!enabled
+  rt.writeState(state)
+  const r = generateCompose({ servicesDir: rt.SERVICES_DIR, out: rt.COMPOSE_FILE, outputValidation: !!enabled })
+  console.log(chalk.gray(`regenerated ${rt.COMPOSE_FILE} (${r.dooerServiceCount} services)`))
+  const code = rt.dc(['up', '-d'], { profile })
+  console.log(
+    code === 0
+      ? chalk.green(`output validation ${enabled ? 'ON' : 'OFF'} — services recreated.`)
+      : chalk.yellow('compose reported an error while recreating services')
+  )
+  process.exitCode = code
+}
+
+const profileOption = (y) =>
+  y.option('profile', { type: 'string', default: 'full', describe: 'compose profile to recreate' })
+
+module.exports = {
+  command: 'validation <command>',
+  describe: 'output-schema validation for the local stack (default: off, like staging/live)',
+  builder: (y) =>
+    y
+      .command({
+        command: 'on',
+        describe: 'ENABLE output-schema validation (surfaces stale service definitions; recreates services)',
+        builder: profileOption,
+        handler: (argv) => apply(true, { profile: argv.profile }),
+      })
+      .command({
+        command: 'off',
+        describe: 'DISABLE output-schema validation (default; behaves like staging/live)',
+        builder: profileOption,
+        handler: (argv) => apply(false, { profile: argv.profile }),
+      })
+      .command({
+        command: 'status',
+        describe: 'show whether output-schema validation is on or off',
+        handler: () => {
+          const on = !!rt.readState().outputValidation
+          console.log(`output validation: ${on ? chalk.green('ON') : chalk.gray('OFF')}`)
+          console.log(
+            `  ${Object.entries(VALIDATION_ENV[on ? 'on' : 'off'])
+              .map(([k, v]) => `${k}=${v}`)
+              .join('  ')}`
+          )
+          console.log(
+            chalk.gray(
+              on
+                ? '  a consumer with a stale service definition will 500 on valid data — that is the point'
+                : '  matches staging/live, where these checks are silent. `validation on` to hunt drift'
+            )
+          )
+        },
+      })
+      .demandCommand(1, 'Use: validation on | validation off | validation status')
+      .strict(),
+  handler: () => {},
+}

package/lib/compose/generate.js

@@ -82,8 +82,7 @@ const GLOBAL_OVERRIDES = {
   // NOTE: never set DOOER_MICROSERVICE_PORT — no staging manifest sets it, so every image defaults to 3000
   // on its own. service-ai (python) reads it as a raw string and does `bind(('', port))`, which throws
   // "an integer is required (got type str)" the moment we inject it. Let the images default.
-  NODE_ENV: 'development',
-  DOOER_ENVIRONMENT_NAME: 'local',
+  // NODE_ENV / DOOER_ENVIRONMENT_NAME are set per validation mode — see VALIDATION_ENV below.
   DOOER_LOG_LEVEL: 'informational',
   // Auth: force the shared @dooer LOCAL dev PUBLIC key on every verifier. The manifests carry the STAGING
   // public key as a plain value (which would win over config's `local` default), but the only signer —
@@ -149,8 +148,26 @@ function secretDefault(name) {
   return OMIT
 }
 
+// OUTPUT-schema validation mode. Both @dooer/microservice (a service validating its OWN response,
+// define-route.js:515) and @dooer/json-http-client (a client validating a response it RECEIVED,
+// route-validators.js:46) run that check only when NODE_ENV !== 'production'. Inbound INPUT validation is
+// a different path (define-route.js:436) and always runs — turning this off does not weaken it.
+//
+// OFF is the default so the local env behaves like staging/live, where these checks are silent: otherwise
+// any consumer carrying a stale service definition 500s on perfectly good data (seen with service-ledger →
+// service-business-entities and service-document-processing → service-core-objects). Turn it ON deliberately
+// to hunt that drift. (Jimmy 2026-09-03.)
+//
+// With NODE_ENV=production, @dooer/config's isDevOrTest() would go false and drop every `local:` value and
+// `localOptional` (crash-looping services) — DOOER_ENVIRONMENT_NAME='environment-local' keeps it true via
+// its second clause. DOOER_DISPLAY_ERRORS keeps error detail, which production mode otherwise hides.
+const VALIDATION_ENV = {
+  on: { NODE_ENV: 'development', DOOER_ENVIRONMENT_NAME: 'local', DOOER_DISPLAY_ERRORS: 'true' },
+  off: { NODE_ENV: 'production', DOOER_ENVIRONMENT_NAME: 'environment-local', DOOER_DISPLAY_ERRORS: 'true' },
+}
+
 // Build the final env map for one dooer service.
-function buildServiceEnv(svc) {
+function buildServiceEnv(svc, { outputValidation = false } = {}) {
   const env = {}
   // 1. plain manifest values (verbatim).
   Object.assign(env, svc.env)
@@ -160,8 +177,8 @@ function buildServiceEnv(svc) {
     if (v === OMIT) return
     env[name] = v
   })
-  // 3. global local overrides win.
-  Object.assign(env, GLOBAL_OVERRIDES)
+  // 3. global local overrides win, plus the validation-mode env (NODE_ENV / environment name).
+  Object.assign(env, GLOBAL_OVERRIDES, VALIDATION_ENV[outputValidation ? 'on' : 'off'])
   // 3b. stateless services (service-graphql, service-pdf, …) declare no application user; keep the shared
   // dooer superuser for them so they still connect. Services WITH a manifest user keep it (see GLOBAL_OVERRIDES).
   if (!env.DOOER_SQL_APPLICATION_USER) env.DOOER_SQL_APPLICATION_USER = DEV.sqlUser
@@ -362,7 +379,7 @@ const SERVICE_ALIASES = {
 }
 
 // Turn the parsed manifests into the compose object.
-function buildCompose(services, frontends, { profile } = {}) {
+function buildCompose(services, frontends, { profile, outputValidation = false } = {}) {
   const wantedSvc = profile ? services.filter((s) => profilesFor(s.name).includes(profile)) : services
   const portMap = frontendPortMap(frontends)
 
@@ -376,7 +393,10 @@ function buildCompose(services, frontends, { profile } = {}) {
       // Fall back to ./CMD-OPF.sh when a manifest sets none, so we never hit the image default ./CMD.sh
       // (Consul path) which hangs on consul-template.
       command: svc.command || ['./CMD-OPF.sh'],
-      environment: rewriteBrowserUrls({ ...buildServiceEnv(svc), ...(SERVICE_ENV_OVERRIDES[svc.name] || {}) }, portMap),
+      environment: rewriteBrowserUrls(
+        { ...buildServiceEnv(svc, { outputValidation }), ...(SERVICE_ENV_OVERRIDES[svc.name] || {}) },
+        portMap
+      ),
       // publish the browser-facing facade (4000) and service-graphql (4001) on the host
       ...(svc.name === 'public-facade' ? { ports: [`${FACADE_HOST_PORT}:3000`] } : {}),
       ...(svc.name === 'service-graphql' ? { ports: [`${GRAPHQL_HOST_PORT}:3000`] } : {}),
@@ -394,7 +414,7 @@ function buildCompose(services, frontends, { profile } = {}) {
   // repointed to each frontend's own localhost port where we run it (others stay as-is).
   ;(frontends || []).forEach((fe) => {
     const hostPort = portMap[fe.name]
-    const env = buildServiceEnv(fe)
+    const env = buildServiceEnv(fe, { outputValidation })
     // dooer-frontend's config validation rejects an EMPTY sentryEndpoint for the `local` environment
     // ("No value specified for [sentryEndpoint] ... (ENV: 'DOOER_SENTRY_ENDPOINT')"), even though staging
     // ships it as "". We don't use Sentry (Jimmy 2026-09-01) — inject a well-formed but inert DSN so the
@@ -430,10 +450,10 @@ function buildCompose(services, frontends, { profile } = {}) {
 
 // Public entry point. Reads every `service-*.yaml` + `frontend-*.yaml` in `servicesDir`, builds the
 // compose object, writes it as YAML to `out`, and returns a small summary.
-function generateCompose({ profile, servicesDir, out } = {}) {
+function generateCompose({ profile, servicesDir, out, outputValidation = false } = {}) {
   const services = listServices(servicesDir)
   const frontends = listFrontends(servicesDir)
-  const compose = buildCompose(services, frontends, { profile })
+  const compose = buildCompose(services, frontends, { profile, outputValidation })
 
   const yamlText = yaml.safeDump(compose, {
     lineWidth: -1, // never wrap (long base64 public keys must stay one line)
@@ -459,6 +479,7 @@ function generateCompose({ profile, servicesDir, out } = {}) {
 
 module.exports = {
   BOOKING_PROFILE_SERVICES,
+  VALIDATION_ENV,
   GLOBAL_OVERRIDES,
   secretDefault,
   buildServiceEnv,

package/lib/engine/seed.js

@@ -133,7 +133,22 @@ Optional:
 function sh(file, args) {
   return execFileSync(file, args, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }).trim()
 }
+// The LOCAL test env is addressed as the pseudo-namespace `local`: the docker-compose Postgres published on
+// 55432, and MinIO standing in for Ceph. Lets `customer copy --target-namespace local` pull a real org out
+// of staging/production into the local stack. (Jimmy 2026-09-03.)
+const LOCAL_NAMESPACE = 'local'
+const isLocalNamespace = (namespace) => namespace === LOCAL_NAMESPACE
+
 function connInfo(namespace) {
+  if (isLocalNamespace(namespace)) {
+    return {
+      host: 'localhost',
+      port: Number(process.env.DOOER_TEST_ENV_PG_PORT || 55432),
+      user: 'dooer',
+      password: 'dooer',
+      database: 'dooer',
+    }
+  }
   const clusterIP = sh('kubectl', ['get', 'svc', 'dooer-database', '-n', namespace, '-o', 'jsonpath={.spec.clusterIP}'])
   const b64 = sh('kubectl', [
     'get',
@@ -236,6 +251,21 @@ async function withRetry(fn, { tries = 6, label = 'op' } = {}) {
 // from the SOURCE env bucket to the TARGET env bucket at its NEW key (= the copied fileData id), so the
 // copy owns its own files. Endpoint/bucket/credentials are read from the file-storage pod per namespace.
 function s3Config(namespace) {
+  if (isLocalNamespace(namespace)) {
+    // local MinIO — the bucket `minio-init` provisions (see lib/compose/generate.js S3_BUCKETS).
+    return {
+      primary: {
+        bucket: 'file-storage-bucket',
+        client: new S3Client({
+          endpoint: process.env.DOOER_TEST_ENV_S3 || 'http://localhost:9000',
+          region: 'us-east-1',
+          forcePathStyle: true,
+          credentials: { accessKeyId: 'minioadmin', secretAccessKey: 'minioadmin' },
+        }),
+      },
+      fallback: null,
+    }
+  }
   const pods = sh('kubectl', [
     'get',
     'pods',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",

package/readme.md

@@ -43,6 +43,7 @@ customer new "<name>" --owner <userId> --execute empty functional account: compa
 customer copy | customer purge                    copy / delete one org between environments (emails anonymized)
 shred                                             anonymize the LOCAL db (localhost only)
 bankid pull | status | clear                      BankID cert (staging → keychain), used by service-accounts
+validation on | off | status                      output-schema validation (default OFF, like staging/live)
 logs <pattern> [--since 5m] [--service x] [-i]    search logs across ALL services (e.g. a transactionId). alias: search
 measure                                           sample docker stats → resource-usage report
 service <start|stop|restart|deploy|local|unlocal|version> <name>   per-service control