@everystack/cli 0.4.93 → 0.4.95

package/src/cli/exec-run.ts

@@ -46,6 +46,74 @@ export class SchemaChangedError extends Error {
   }
 }
 
+/**
+ * The ledger violation: the file wrote to the `everystack` schema. Those tables are what every
+ * safety decision reads — schema_log is the descent anchor and a restore's witness, derived_provenance
+ * decides what the reconciler trusts, exec_log is this lane's own audit. A DML lane that can write
+ * them can forge any of it, so the whole transaction was rolled back.
+ */
+export class LedgerWriteError extends Error {
+  constructor(detail: string) {
+    super(
+      `db:exec cannot write the everystack schema (${detail}) — its tables are the ledgers every safety check reads, ` +
+        'and a write here could forge one. The whole transaction was rolled back; nothing was applied.',
+    );
+    this.name = 'LedgerWriteError';
+  }
+}
+
+/**
+ * Rows written to everystack.* by THIS transaction (pg_stat_xact_* counts the open transaction), and
+ * each table's relfilenode — TRUNCATE touches no row counter but always gives the table a new file.
+ * Semantic, like the catalog digest: it reads what happened, not what the SQL text looks like.
+ */
+export const LEDGER_GUARD_SQL = `
+SELECT coalesce(sum(s.n_tup_ins + s.n_tup_upd + s.n_tup_del), 0)::bigint AS writes,
+       coalesce(string_agg(c.relname || ':' || c.relfilenode::text, ',' ORDER BY c.relname), '') AS files,
+       -- A table that INHERITS from a ledger table (a temp one is enough) makes its rows read as
+       -- ledger rows, and its writes count against the child. Ledger tables never have children.
+       (SELECT count(*) FROM pg_catalog.pg_inherits i JOIN pg_catalog.pg_class p ON p.oid = i.inhparent
+          JOIN pg_catalog.pg_namespace pn ON pn.oid = p.relnamespace WHERE pn.nspname = 'everystack')::int AS children,
+       pg_catalog.current_setting('track_counts') AS track_counts
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+LEFT JOIN pg_catalog.pg_stat_xact_user_tables s ON s.relid = c.oid
+WHERE n.nspname = 'everystack' AND c.relkind IN ('r', 'p')`.trim();
+
+/**
+ * Fire every DEFERRED constraint trigger NOW. A deferred trigger runs at COMMIT — after both
+ * checks — so a file could hide DDL or a ledger write inside one (closing-gate review round 2).
+ * Made immediate here, it fires inside the window the checks read.
+ */
+export const FIRE_DEFERRED_SQL = 'SET CONSTRAINTS ALL IMMEDIATE';
+
+/**
+ * The digest reads `pg_get_*def` / `pg_get_expr` text, which qualifies names relative to the
+ * search_path: a file that sets its own path would move the digest with no schema change (a
+ * serial default prints `nextval('t_id_seq')` or `nextval('public.t_id_seq')`). Pin the path for
+ * the read, then give the file its own back.
+ */
+// pg_temp named LAST: unnamed, PostgreSQL searches it FIRST for relations, and a file's temp view
+// called pg_class would answer the check (closing-gate review round 3). Every catalog the checks
+// read is also written pg_catalog.x; this pin is the second lock.
+const PATH_SAVE_SQL = `SELECT pg_catalog.current_setting('search_path') AS path`;
+const PATH_PIN_SQL = `SELECT pg_catalog.set_config('search_path', 'pg_catalog, pg_temp', true)`;
+const pathRestoreSql = (path: string): string => `SELECT pg_catalog.set_config('search_path', '${path.replace(/'/g, "''")}', true)`;
+
+/** Run a check query under the pinned path, then give the file its own path back. */
+async function pinned(run: TxRunner, query: string): Promise<ExecStmtResult> {
+  const saved = (await run(PATH_SAVE_SQL)).rows?.[0]?.path;
+  await run(PATH_PIN_SQL);
+  const res = await run(query); // a failure aborts the transaction: nothing to restore, keep its error
+  if (typeof saved === 'string') await run(pathRestoreSql(saved));
+  return res;
+}
+
+const pinnedDigest = async (run: TxRunner, digestQuery: string): Promise<string> => readDigest(await pinned(run, digestQuery));
+
+/** A WITH HOLD cursor finishes its query at COMMIT — after the checks. Close them all first. */
+export const CLOSE_CURSORS_SQL = 'CLOSE ALL';
+
 /** Transaction rails — a file can't hang the plane or block behind a lock forever. */
 export interface ExecRails {
   statementTimeoutMs?: number;
@@ -87,7 +155,8 @@ export async function runExecInTx(
   for (const rail of railStatements(opts.rails)) await run(rail);
 
   const digestQuery = catalogDigestQuery(opts.schemas);
-  const before = readDigest(await run(digestQuery));
+  const before = await pinnedDigest(run, digestQuery);
+  const ledgerBefore = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
 
   const rowsAffected: number[] = [];
   for (const stmt of splitSqlStatements(fileSql)) {
@@ -95,8 +164,18 @@ export async function runExecInTx(
     rowsAffected.push(res.count);
   }
 
-  const after = readDigest(await run(digestQuery));
+  await run(FIRE_DEFERRED_SQL);
+  await run(CLOSE_CURSORS_SQL);
+  const after = await pinnedDigest(run, digestQuery);
   if (before !== after) throw new SchemaChangedError(before, after);
+  const ledgerAfter = (await pinned(run, LEDGER_GUARD_SQL)).rows?.[0] ?? {};
+  if (String(ledgerAfter.track_counts ?? 'on') === 'off') {
+    throw new LedgerWriteError('track_counts was turned off, so ledger writes could not be counted');
+  }
+  if (Number(ledgerAfter.children ?? 0) > 0) throw new LedgerWriteError('a table inherits from a ledger table');
+  const wrote = Number(ledgerAfter.writes ?? 0) - Number(ledgerBefore.writes ?? 0);
+  if (wrote > 0) throw new LedgerWriteError(`${wrote} row(s) written`);
+  if (String(ledgerAfter.files ?? '') !== String(ledgerBefore.files ?? '')) throw new LedgerWriteError('a table was truncated or rewritten');
   return rowsAffected;
 }