@elytracms/studio 0.0.93 → 0.0.95

package/convex/redirect-migration.test.ts

@@ -0,0 +1,205 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import schema from './schema'
+
+// convex-test fires `runAfter(0)` on a REAL timer; fake timers keep any scheduled
+// revalidation queued (rows written, the `webhooks:deliver` fetch never fired).
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-616 — the redirect move from the `redirects` table into `records` (kind `redirect`)
+ * is a STORED-DATA move (Konditorei and Naturkinder hold real redirects), done the EC-587
+ * way: writes to the new home, a marked tolerant read of the old one, an idempotent
+ * per-deployment migration. These run the REAL functions on convex-test over legacy rows
+ * inserted as a pre-EC-616 deployment holds them, and pin "no gap": a deployment with the
+ * new functions pushed and the migration NOT yet run serves exactly what it served before.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+const listRedirects = makeFunctionReference<'query'>('redirects:list')
+const getRedirect = makeFunctionReference<'query'>('redirects:get')
+const saveRedirect = makeFunctionReference<'mutation'>('redirects:save')
+const removeRedirect = makeFunctionReference<'mutation'>('redirects:remove')
+const migrateLegacy = makeFunctionReference<'mutation'>('redirects:migrateLegacy')
+const snapshot = makeFunctionReference<'query'>('delivery:snapshot')
+
+const STAMP = '2026-08-01T00:00:00.000Z'
+const LATER = '2026-10-26T00:00:00.000Z'
+
+/** Rows as a pre-EC-616 deployment stores them in the legacy `redirects` table. */
+const LEGACY = [
+  { redirectId: 'r_spring', from: '/spring', to: '/offers', permanent: true, enabled: true },
+  { redirectId: 'r_paused', from: '/paused', to: '/x', permanent: false, enabled: false, meta: { note: 'later' } },
+  { redirectId: 'r_blog', from: '/blog-old', to: '/blog', permanent: true, enabled: true },
+  // Stored before EC-577 refused it: a meta key naming a column. The current schema
+  // refuses this row as a create, so the migration must REPORT it, never drop it.
+  { redirectId: 'r_shadow', from: '/shadow', to: '/real', permanent: true, enabled: true, meta: { to: '/fake' } },
+] as const
+
+async function legacyDeployment(configuredRevalidation = false) {
+  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+  if (configuredRevalidation) {
+    env['CANVAS_REVALIDATE_ENDPOINT'] = 'https://host.invalid/api/revalidate'
+    env['CANVAS_REVALIDATE_SECRET'] = 'ec616-secret'
+  }
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: 'editor', role: 'editor', createdAt: STAMP, updatedAt: STAMP })
+    for (const row of LEGACY) await ctx.db.insert('redirects', { ...row, createdAt: STAMP, updatedAt: STAMP })
+  })
+  const asEditor = t.withIdentity({ subject: 'editor', issuer: 'https://convex.test' })
+  return { t, asEditor }
+}
+
+afterEach(() => {
+  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+  delete env['CANVAS_REVALIDATE_ENDPOINT']
+  delete env['CANVAS_REVALIDATE_SECRET']
+})
+
+/** What the pre-EC-616 functions returned for the legacy rows: each row flat, ordered by `from`. */
+const SERVED_BEFORE = [...LEGACY]
+  .sort((a, b) => (a.from < b.from ? -1 : 1))
+  .map((row) => ({ ...row, createdAt: STAMP, updatedAt: STAMP }))
+
+/** What the pre-EC-616 snapshot served: the enabled rows as routing records. */
+const LIVE_BEFORE = LEGACY.filter((row) => row.enabled).map((row) => ({
+  id: row.redirectId,
+  from: row.from,
+  to: row.to,
+  permanent: row.permanent,
+}))
+
+const byId = (a: { id: string }, b: { id: string }) => (a.id < b.id ? -1 : 1)
+
+async function counts(t: Awaited<ReturnType<typeof legacyDeployment>>['t']) {
+  return t.run(async (ctx) => ({
+    legacy: (await ctx.db.query('redirects').collect()).length,
+    records: (await ctx.db.query('records').collect()).filter((row) => row.kind === 'redirect').length,
+  }))
+}
+
+describe('the redirect move: no gap before the migration runs (EC-616)', () => {
+  it('list, get and the delivery snapshot serve the legacy rows exactly as before', async () => {
+    const { asEditor } = await legacyDeployment()
+    expect(await asEditor.query(listRedirects, {})).toEqual(SERVED_BEFORE)
+    expect(await asEditor.query(getRedirect, { redirectId: 'r_paused' })).toEqual(
+      SERVED_BEFORE.find((row) => row.redirectId === 'r_paused'),
+    )
+    const served = (await asEditor.query(snapshot, { projectId: 'demo' })) as { redirects: { id: string }[] }
+    expect([...served.redirects].sort(byId)).toEqual([...LIVE_BEFORE].sort(byId))
+  })
+
+  it('a save of a legacy-only redirect lifts it: an edit, not a create; the legacy row goes', async () => {
+    const { t, asEditor } = await legacyDeployment()
+    // An edit that leaves `enabled`/`permanent` absent keeps the STORED (legacy) values.
+    const saved = await asEditor.mutation(saveRedirect, {
+      redirectId: 'r_paused',
+      to: '/y',
+      createdAt: LATER,
+      updatedAt: LATER,
+    })
+    expect(saved).toEqual({
+      redirectId: 'r_paused',
+      from: '/paused',
+      to: '/y',
+      permanent: false,
+      enabled: false,
+      meta: { note: 'later' },
+      createdAt: STAMP,
+      updatedAt: LATER,
+    })
+    expect(await counts(t)).toEqual({ legacy: 3, records: 1 })
+    expect((await asEditor.query(listRedirects, {})) as unknown[]).toHaveLength(4)
+  })
+
+  it('a remove of a legacy-only redirect deletes it (it never resurfaces)', async () => {
+    const { t, asEditor } = await legacyDeployment()
+    await asEditor.mutation(removeRedirect, { redirectId: 'r_blog' })
+    expect(await asEditor.query(getRedirect, { redirectId: 'r_blog' })).toBeNull()
+    expect(await counts(t)).toEqual({ legacy: 3, records: 0 })
+  })
+})
+
+describe('redirects:migrateLegacy (EC-616)', () => {
+  it('moves every valid legacy row, reports the refused one, and serves the same set after', async () => {
+    const { t, asEditor } = await legacyDeployment()
+    const first = await t.mutation(migrateLegacy, {})
+    expect(first).toEqual({
+      scanned: 4,
+      moved: 3,
+      shadowed: 0,
+      refused: [{ redirectId: 'r_shadow', message: expect.stringMatching(/meta may not use a column name/) }],
+      movedIds: ['r_blog', 'r_paused', 'r_spring'],
+    })
+    expect(await counts(t)).toEqual({ legacy: 1, records: 3 })
+    // The served set is unchanged by the move — the refused row still serves (tolerant read).
+    expect(await asEditor.query(listRedirects, {})).toEqual(SERVED_BEFORE)
+    const served = (await asEditor.query(snapshot, { projectId: 'demo' })) as { redirects: { id: string }[] }
+    expect([...served.redirects].sort(byId)).toEqual([...LIVE_BEFORE].sort(byId))
+  })
+
+  it('is idempotent: a second run moves nothing', async () => {
+    const { t } = await legacyDeployment()
+    await t.mutation(migrateLegacy, {})
+    expect(await t.mutation(migrateLegacy, {})).toMatchObject({ scanned: 1, moved: 0, shadowed: 0 })
+    expect(await counts(t)).toEqual({ legacy: 1, records: 3 })
+  })
+
+  it('drops a legacy row a record already shadows (a save lifted it meanwhile)', async () => {
+    const { t, asEditor } = await legacyDeployment()
+    // Simulate the race the transaction cannot have: a record and its legacy row both present.
+    await t.run(async (ctx) => {
+      await ctx.db.insert('redirects', {
+        redirectId: 'r_twice',
+        from: '/twice',
+        to: '/a',
+        permanent: true,
+        enabled: true,
+        createdAt: STAMP,
+        updatedAt: STAMP,
+      })
+    })
+    await asEditor.mutation(saveRedirect, { redirectId: 'r_twice', from: '/twice', to: '/b', createdAt: LATER, updatedAt: LATER })
+    await t.run(async (ctx) => {
+      await ctx.db.insert('redirects', {
+        redirectId: 'r_twice',
+        from: '/twice',
+        to: '/a',
+        permanent: true,
+        enabled: true,
+        createdAt: STAMP,
+        updatedAt: STAMP,
+      })
+    })
+    // The record wins every read while both exist…
+    expect(await asEditor.query(getRedirect, { redirectId: 'r_twice' })).toMatchObject({ to: '/b' })
+    // …and the migration drops the shadowed legacy row instead of overwriting the record.
+    expect(await t.mutation(migrateLegacy, {})).toMatchObject({ shadowed: 1 })
+    expect(await asEditor.query(getRedirect, { redirectId: 'r_twice' })).toMatchObject({ to: '/b' })
+  })
+
+  it('schedules no revalidation: the served set is identical before and after', async () => {
+    const { t } = await legacyDeployment(true)
+    await t.mutation(migrateLegacy, {})
+    const scheduled = await t.run(async (ctx) => ctx.db.system.query('_scheduled_functions').collect())
+    expect(scheduled).toEqual([])
+  })
+
+  it('control: a redirect SAVE on the same configured deployment does schedule one', async () => {
+    const { t, asEditor } = await legacyDeployment(true)
+    await asEditor.mutation(saveRedirect, { redirectId: 'r_new', from: '/n', to: '/m', createdAt: LATER, updatedAt: LATER })
+    const scheduled = await t.run(async (ctx) => ctx.db.system.query('_scheduled_functions').collect())
+    expect(scheduled.map((row) => (row.args as [{ event: unknown }])[0].event)).toEqual([{ kind: 'redirects' }])
+  })
+})

package/convex/redirect-revalidate.test.ts

@@ -135,8 +135,12 @@ describe('EC-510 — the write chokepoint revalidates on every redirect write',
       // is the gate working rather than the instrument being blind.
       expect(await scheduledRevalidations(t)).toEqual([])
       // The write itself still happened — silence is at the webhook, not the save.
+      // EC-616: a redirect is stored as a `records` row of kind `redirect` now.
       expect(
-        await t.run(async (ctx) => (await ctx.db.query('redirects').collect()).length),
+        await t.run(
+          async (ctx) =>
+            (await ctx.db.query('records').collect()).filter((row) => row.kind === 'redirect').length,
+        ),
       ).toBe(1)
     })
   })

package/convex/redirects.ts

@@ -1,92 +1,133 @@
-import { ConvexError, v } from 'convex/values'
-import type { DocumentByName, WithoutSystemFields } from 'convex/server'
-import { redirectRowSchema, rejectedWriteMessage, resolveRecordWrite } from '@elytracms/core/persistence'
-import type { DataModel } from './functions'
-import { mutation, query } from './functions'
-import { requireCapability } from './guard'
-
-type RedirectDoc = DocumentByName<DataModel, 'redirects'>
+import { internalMutationGeneric } from 'convex/server'
+import type { MutationBuilder } from 'convex/server'
+import {
+  PersistenceValidationError,
+  recordColumnsOf,
+  recordSlots,
+  redirectRecordKind,
+  resolveRecordQuery,
+  resolveRecordSave,
+} from '@elytracms/core/persistence'
+import type { RedirectEntry } from '@elytracms/core/persistence'
+import type { DataModel, MutationCtx, QueryCtx } from './functions'
+import { defineRecordFunctions, findRecordDoc, listRecordWire } from './record-functions'
+import type { LegacyRecord, LegacyRecordSource } from './record-functions'
+import { recordEntryFromWire } from '@elytracms/core/persistence'
 
 /**
- * Editorial redirects persistence (EC-303). Redirects are data an editor owns —
- * saved+enabled entries go live dynamically (no deploy) via the delivery
- * snapshot. Reachable only through the app's `ConvexRedirectRepository` adapter.
- * Content-gated (a viewer reads, an editor writes), NOT admin-only — redirects
- * are content, not administration.
+ * Editorial redirects persistence (EC-303) — since EC-616 the redirect RECORD KIND over
+ * the generic record store (`redirectRecordKind`, one `records` row per redirect). The
+ * functions keep their names and wire (`redirects:save/get/list/remove`, `redirectId` +
+ * the columns flat), so the studio's adapter and every consumer's
+ * `export * from '@elytracms/studio/convex/redirects'` line are unchanged. Content-gated
+ * (a viewer reads, an editor writes), NOT admin-only — redirects are content.
+ *
+ * ## The move from the `redirects` table (stored data — KON and NK hold real redirects)
+ *
+ * The EC-587 precedent, with no gap:
+ *
+ * - **writes go to `records`** (kind `redirect`); nothing writes the legacy table again;
+ * - **reads union the legacy rows no record shadows** — the TOLERANT READ below, marked:
+ *   a deployment with these functions pushed and the migration NOT yet run serves the
+ *   same redirects it served before (`list`, `get`, the delivery snapshot);
+ * - a save of a legacy-only redirect lifts it (record from its columns, legacy row
+ *   deleted, one transaction); a remove deletes both;
+ * - **`redirects:migrateLegacy`** moves every legacy row in one idempotent internal
+ *   mutation and reports counts — run per deployment (both consumers + the prod harness:
+ *   owner-run); the legacy table and this tolerant read are dropped together once it is
+ *   reported run everywhere (a gated item, like EC-587's alt column).
  */
 
-/**
- * Create or modify a redirect (EC-577). The ONE write rule (`resolveRecordWrite`,
- * shared with the in-memory adapter) runs here, inside the transaction: a column
- * absent from the args keeps its stored value — `permanent`/`enabled` included,
- * whose defaults (the record schema's `.default(true)`) apply only when this save
- * creates the redirect — `null` clears the optional `meta` bag, a value sets. ONE
- * `db.patch` or ONE `db.insert`, so the EC-510 revalidation trigger fires once.
- */
-export const save = mutation({
-  args: {
-    redirectId: v.string(),
-    from: v.optional(v.string()),
-    to: v.optional(v.string()),
-    permanent: v.optional(v.boolean()),
-    enabled: v.optional(v.boolean()),
-    // Schema-driven additive-field bag (EC-311 Tier 2): present replaces the bag,
-    // `null` clears it, absent keeps it.
-    meta: v.optional(v.any()),
-    createdAt: v.string(),
-    updatedAt: v.string(),
-  },
-  handler: async (ctx, { redirectId, createdAt, updatedAt, ...write }) => {
-    await requireCapability(ctx, 'content.write')
-    const existing = await ctx.db
-      .query('redirects')
-      .withIndex('by_redirect', (q) => q.eq('redirectId', redirectId))
-      .first()
-    const resolved = resolveRecordWrite(redirectRowSchema, existing ?? undefined, write)
-    if (!resolved.ok) {
-      throw new ConvexError({
-        code: 'validation',
-        message: rejectedWriteMessage('redirect', redirectId, resolved.issues),
-        issues: resolved.issues,
-      })
-    }
-    if (existing) {
-      await ctx.db.patch(existing._id, { ...(resolved.patch as Partial<RedirectDoc>), updatedAt })
-      return ctx.db.get(existing._id)
-    }
-    const row: WithoutSystemFields<RedirectDoc> = { ...resolved.row, redirectId, createdAt, updatedAt }
-    const id = await ctx.db.insert('redirects', row)
-    return ctx.db.get(id)
-  },
-})
+type LegacyRedirectDoc = DataModel['redirects']['document']
 
-export const get = query({
-  args: { redirectId: v.string() },
-  handler: async (ctx, args) => {
-    await requireCapability(ctx, 'content.read')
-    return ctx.db
+/** TOLERANT READ (marked) — the legacy `redirects` table as the kind's legacy source. */
+const legacyRedirects: LegacyRecordSource = {
+  find: async (ctx, recordId) => {
+    const row = await ctx.db
       .query('redirects')
-      .withIndex('by_redirect', (q) => q.eq('redirectId', args.redirectId))
+      .withIndex('by_redirect', (q) => q.eq('redirectId', recordId))
       .first()
+    return row ? legacyRecord(row) : null
   },
-})
+  list: async (ctx) => (await ctx.db.query('redirects').withIndex('by_redirect').collect()).map(legacyRecord),
+  remove: async (ctx, record) => {
+    await ctx.db.delete(record.handle as LegacyRedirectDoc['_id'])
+  },
+}
+
+function legacyRecord(row: LegacyRedirectDoc): LegacyRecord {
+  return {
+    recordId: row.redirectId,
+    columns: recordColumnsOf(redirectRecordKind, row),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+    handle: row._id,
+  }
+}
 
-export const list = query({
+export const { save, get, list, remove } = defineRecordFunctions(redirectRecordKind, { legacy: legacyRedirects })
+
+/**
+ * Every stored redirect of this deployment (records + the tolerant legacy read), ordered
+ * by `from` — the ONE server-side reader; the delivery snapshot projects it through
+ * `readLiveRedirects` (EC-590 / EC-627 / EC-628: the one live-redirect rule).
+ */
+export async function loadRedirectEntries(ctx: QueryCtx, projectId: string): Promise<RedirectEntry[]> {
+  const rows = await listRecordWire(ctx, redirectRecordKind, resolveRecordQuery(redirectRecordKind), legacyRedirects)
+  return rows.map((row) => recordEntryFromWire(redirectRecordKind, row, projectId))
+}
+
+/**
+ * EC-616 — move every legacy `redirects` row into `records` (kind `redirect`), the
+ * redirect move's migration. Per row: a record of the same id already exists (a save
+ * lifted it, or an earlier run) → the legacy row is dropped as shadowed; otherwise the
+ * row's columns are written as a record CREATE through the one rule (`resolveRecordSave`
+ * — a legacy row the current schema refuses is REPORTED and left where it is, still
+ * served by the tolerant read, never dropped silently) and the legacy row deleted.
+ * Idempotent: a second run scans nothing.
+ *
+ * Internal: an admin runs it from the CLI, once per deployment —
+ * `npx convex run redirects:migrateLegacy` (no args). Built on the RAW internal-mutation
+ * builder, deliberately outside the write-chokepoint triggers: the served redirect set is
+ * identical before and after by construction (the tolerant read), so the move needs no
+ * revalidation — through the triggers it would schedule two sweeps per row (an insert
+ * into `records`, a delete from `redirects`). One transaction: Convex bounds it at 8192
+ * written rows, far above any editorial redirect set (KON's import holds 192).
+ */
+export const migrateLegacy = (internalMutationGeneric as MutationBuilder<DataModel, 'internal'>)({
   args: {},
   handler: async (ctx) => {
-    await requireCapability(ctx, 'content.read')
-    return ctx.db.query('redirects').withIndex('by_redirect').collect()
-  },
-})
-
-export const remove = mutation({
-  args: { redirectId: v.string() },
-  handler: async (ctx, args) => {
-    await requireCapability(ctx, 'content.write')
-    const existing = await ctx.db
-      .query('redirects')
-      .withIndex('by_redirect', (q) => q.eq('redirectId', args.redirectId))
-      .first()
-    if (existing) await ctx.db.delete(existing._id)
+    const legacy = await ctx.db.query('redirects').withIndex('by_redirect').collect()
+    const moved: string[] = []
+    const shadowed: string[] = []
+    const refused: Array<{ redirectId: string; message: string }> = []
+    for (const row of legacy) {
+      const record = legacyRecord(row)
+      if (await findRecordDoc(ctx as unknown as MutationCtx, redirectRecordKind, record.recordId)) {
+        await ctx.db.delete(row._id)
+        shadowed.push(record.recordId)
+        continue
+      }
+      let columns: Record<string, unknown>
+      try {
+        columns = resolveRecordSave(redirectRecordKind, record.recordId, undefined, record.columns)
+      } catch (error) {
+        if (!(error instanceof PersistenceValidationError)) throw error
+        refused.push({ redirectId: record.recordId, message: error.message })
+        continue
+      }
+      const slots = recordSlots(redirectRecordKind, columns, record.createdAt)
+      await ctx.db.insert('records', {
+        kind: redirectRecordKind.kind,
+        recordId: record.recordId,
+        data: columns,
+        at: slots.at,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+      })
+      await ctx.db.delete(row._id)
+      moved.push(record.recordId)
+    }
+    return { scanned: legacy.length, moved: moved.length, shadowed: shadowed.length, refused, movedIds: moved }
   },
 })