@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/state_store_boundary_evidence.rs

@@ -1,299 +0,0 @@
-//! Evidence for the StateStore boundary audit
-//! (`docs/audits/STATESTORE-BOUNDARY-AUDIT.md`).
-//!
-//! These tests add **no capability and no product surface**. They answer one
-//! adversarial question with runs rather than readings:
-//!
-//! > Can FeltDB expose immutable state history through the existing server
-//! > authority with fewer primitives than a conventional database or branch
-//! > system requires?
-//!
-//! The answer is yes, and the margin is large. `MinimalStore` below is written
-//! in this test file deliberately: demonstrating that a shape is sufficient is
-//! not the same as committing the product to it, and this PR adds no API.
-
-use feltdb::state_model::{
-    apply_reconciliation_plan, ConflictClass, ConflictClassification, ReconciliationPlan, StateId,
-    StateRevision, StateStore,
-};
-use feltdb::FeltDb;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tempfile::TempDir;
-
-fn revision(content: &str) -> StateRevision {
-    StateRevision {
-        id: StateId::compute(content),
-        resource: "docs:1".into(),
-        content: content.to_string(),
-        content_id: StateId::compute(content),
-        sequence: 0,
-        parent_id: None,
-        authority: "test".into(),
-        timestamp_ms: 0,
-        metadata: Default::default(),
-    }
-}
-
-// ---------------------------------------------------------------------------
-// A store built from two operations
-// ---------------------------------------------------------------------------
-
-/// A read-through revision store built from nothing but `FeltDb::insert` and
-/// `FeltDb::get`.
-///
-/// No in-memory index, no `current` pointer, no branches, and — because every
-/// record is keyed by the hash of its own content — no recovery path.
-struct MinimalStore {
-    db: Arc<FeltDb>,
-}
-
-impl MinimalStore {
-    fn key(id: &StateId) -> String {
-        format!("state:revision:{}", id.as_hex())
-    }
-
-    fn put(&self, revision: &StateRevision) -> Result<(), String> {
-        if !revision.verify_integrity() {
-            return Err("integrity check failed".into());
-        }
-        self.db
-            .insert(&Self::key(&revision.id), revision.clone())
-            .map_err(|error| error.to_string())
-    }
-
-    fn get(&self, id: &StateId) -> Option<StateRevision> {
-        self.db.get::<StateRevision>(&Self::key(id)).ok().flatten()
-    }
-
-    /// Ancestry is not a third operation. It is `get` and `parent_id`.
-    fn ancestors(&self, id: &StateId) -> Vec<StateId> {
-        let mut out = vec![];
-        let mut cursor = self.get(id).and_then(|revision| revision.parent_id);
-        while let Some(parent) = cursor {
-            out.push(parent.clone());
-            cursor = self.get(&parent).and_then(|revision| revision.parent_id);
-        }
-        out
-    }
-}
-
-/// Two operations carry the whole chain, across a real restart, with no
-/// recovery step and no mutable pointer.
-///
-/// This is the audit's central result. The store is opened, written, dropped,
-/// and reopened over the same log by a *different* `FeltDb` instance; nothing
-/// reconstructs an index, and the three revisions reconciliation needs are read
-/// back by identity alone.
-#[test]
-fn two_operations_carry_the_whole_chain_across_a_restart() {
-    let directory = TempDir::new().unwrap();
-    let path = directory.path().join("minimal.log");
-
-    let (base_id, left_id, right_id) = {
-        let store = MinimalStore {
-            db: Arc::new(FeltDb::open(&path).unwrap()),
-        };
-        let base = StateRevision::initial(
-            "docs:1".to_string(),
-            r#"{"shared":1,"only_left":1}"#.into(),
-            "a".into(),
-        );
-        let left = StateRevision::child(
-            r#"{"shared":10,"only_left":2}"#.into(),
-            &base,
-            "alice".into(),
-        );
-        let right =
-            StateRevision::child(r#"{"shared":20,"only_left":1}"#.into(), &base, "bob".into());
-
-        store.put(&base).unwrap();
-        store.put(&left).unwrap();
-        store.put(&right).unwrap();
-        (base.id.clone(), left.id.clone(), right.id.clone())
-    };
-
-    // A different FeltDb instance over the same log. No recovery is run.
-    let store = MinimalStore {
-        db: Arc::new(FeltDb::open(&path).unwrap()),
-    };
-    let base = store.get(&base_id).expect("base survives");
-    let left = store.get(&left_id).expect("left survives");
-    let right = store.get(&right_id).expect("right survives");
-    assert!(base.verify_integrity() && left.verify_integrity() && right.verify_integrity());
-
-    // The full chain runs against what was read back.
-    let classification = ConflictClassification::classify(&base, &left, &right);
-    assert_eq!(classification.overall, ConflictClass::Conflict);
-
-    let plan = ReconciliationPlan::new(left.id.clone(), right.id.clone(), base.id.clone(), true);
-    let content = apply_reconciliation_plan(&base, &left, &right, &plan).expect("applies");
-    assert_eq!(content, r#"{"only_left":2,"shared":10}"#);
-
-    let result = StateRevision::child(content, &left, "reconciler".into());
-    store.put(&result).expect("the result persists");
-    assert_eq!(
-        store.ancestors(&result.id),
-        vec![left_id, base_id],
-        "ancestry needs no primitive beyond get and parent_id"
-    );
-
-    // And no shared mutable record was ever written.
-    let current = store
-        .db
-        .get::<(String, HashMap<String, String>)>("state:current")
-        .unwrap();
-    assert!(
-        current.is_none(),
-        "a content-addressed history needs no current pointer"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// What the chain actually requires
-// ---------------------------------------------------------------------------
-
-/// Application reads exactly one content, and three identities.
-///
-/// The base and the branch that was *not* selected contribute nothing but their
-/// ids — both may be unparseable and application still succeeds. This bounds
-/// what a store must be able to serve at the moment a plan is applied: one full
-/// state, not three.
-///
-/// Classification is the step that reads all three, so the chain as a whole
-/// still needs all three. The distinction matters for a durable design, because
-/// the two steps could be served differently.
-#[test]
-fn application_reads_one_content_and_three_identities() {
-    let base = revision("this is not json at all");
-    let left = revision(r#"{"a":1}"#);
-    let right = revision("also not json");
-
-    let plan = ReconciliationPlan::new(left.id.clone(), right.id.clone(), base.id.clone(), true);
-    assert_eq!(
-        apply_reconciliation_plan(&base, &left, &right, &plan).expect("applies"),
-        r#"{"a":1}"#,
-        "only the selected parent's content is read"
-    );
-}
-
-/// The chain from three revisions to a reconciled one names no branch.
-#[test]
-fn the_chain_needs_no_branch() {
-    let store = StateStore::new_volatile();
-    let base = store
-        .create("docs:1", r#"{"v":1}"#.into(), "a".into())
-        .unwrap();
-    let left = store
-        .commit(r#"{"v":2}"#.into(), &base, "alice".into())
-        .unwrap();
-    let right = store
-        .commit(r#"{"v":3}"#.into(), &base, "bob".into())
-        .unwrap();
-
-    let plan = ReconciliationPlan::new(left.id.clone(), right.id.clone(), base.id.clone(), true);
-    assert!(apply_reconciliation_plan(&base, &left, &right, &plan).is_ok());
-    assert!(
-        store.get(&base.id).is_some() && store.get(&left.id).is_some(),
-        "the chain named no branch, and every revision stayed addressable"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// What the existing store costs
-// ---------------------------------------------------------------------------
-
-/// No commit writes a shared mutable record. **Regression.**
-///
-/// This test previously asserted the opposite, as a finding: `state:current`
-/// carried the global current pointer *and* the whole branch map in one
-/// replicated record — the record behind both defects the branching audit
-/// reported — and `commit_revision` wrote it unconditionally, so a caller that
-/// never created a branch did not avoid it.
-///
-/// That record no longer exists. The store's entire durable schema is
-/// `state:revision:{hex}`, one record per revision, and nothing else is
-/// written. The two defects were removed with it rather than repaired.
-#[test]
-fn no_commit_writes_a_shared_mutable_record() {
-    let directory = TempDir::new().unwrap();
-    let db = Arc::new(FeltDb::open(directory.path().join("shared.log")).unwrap());
-    let store = StateStore::with_feltdb(db.clone()).unwrap();
-
-    let base = store
-        .create("docs:1", r#"{"v":1}"#.into(), "a".into())
-        .unwrap();
-    let child = store
-        .commit(r#"{"v":2}"#.into(), &base, "a".into())
-        .unwrap();
-
-    assert!(
-        db.get::<(String, HashMap<String, String>)>("state:current")
-            .unwrap()
-            .is_none(),
-        "the record that carried the global pointer and the branch map is gone"
-    );
-
-    // What *is* written is one record per revision, and nothing else.
-    for revision in [&base, &child] {
-        assert_eq!(
-            store
-                .get(&revision.id)
-                .expect("revision is durable")
-                .content,
-            revision.content
-        );
-    }
-}
-
-/// One damaged record no longer refuses the whole store. **Regression.**
-///
-/// This test previously asserted the opposite, as a finding: `with_feltdb`
-/// eagerly loaded every revision, re-verified every content hash, and validated
-/// every parent reference before returning, so a single orphaned record that no
-/// caller would ever request refused the entire store.
-///
-/// There is no recovery step now. Reads are keyed and independent, so a damaged
-/// or unrelated record is simply a record nobody asked for. This is the
-/// operational difference between an index that must be rebuilt and records
-/// addressed by content.
-#[test]
-fn one_damaged_record_does_not_refuse_the_whole_store() {
-    let directory = TempDir::new().unwrap();
-    let path = directory.path().join("domain.log");
-
-    let good_id = {
-        let db = Arc::new(FeltDb::open(&path).unwrap());
-        let store = StateStore::with_feltdb(db.clone()).unwrap();
-        let good = store
-            .create("docs:1", r#"{"v":1}"#.into(), "a".into())
-            .unwrap();
-
-        // An unrelated revision whose parent was never stored. Nothing the
-        // caller will ever ask for.
-        let orphan = StateRevision {
-            id: StateId::compute(r#"{"orphan":true}"#),
-            resource: "docs:1".into(),
-            content: r#"{"orphan":true}"#.into(),
-            content_id: StateId::compute(r#"{"orphan":true}"#),
-            sequence: 0,
-            parent_id: Some(StateId::compute("a parent that was never stored")),
-            authority: "x".into(),
-            timestamp_ms: 0,
-            metadata: Default::default(),
-        };
-        db.insert(&format!("state:revision:{}", orphan.id.as_hex()), orphan)
-            .unwrap();
-        good.id
-    };
-
-    let db = Arc::new(FeltDb::open(&path).unwrap());
-    let store = StateStore::with_feltdb(db).expect("the store opens despite the orphan");
-
-    // The intact revision is readable by identity, unaffected by its neighbour.
-    let good = store
-        .get(&good_id)
-        .expect("the intact revision is readable");
-    assert!(good.verify_integrity());
-    assert_eq!(good.content, r#"{"v":1}"#);
-}

package/dist/create/server-source/crates/feltdb/tests/storage_independent_versioned_object_substrate.rs

@@ -1,328 +0,0 @@
-use feltdb::{
-    ConflictClass, DurableObjectStore, LocalObjectStore, MaterializationProjection, PathComponent,
-    Reachability, S3CompatibleBucket, S3CompatibleObjectStore, StateId, StateTopology,
-    SubstrateError, VersionedObjectSubstrate,
-};
-use serde_json::json;
-use std::sync::{Arc, Barrier};
-use std::thread;
-use tempfile::TempDir;
-
-#[derive(Debug, PartialEq, Eq)]
-struct Snapshot {
-    revisions: Vec<(String, Option<String>, String)>,
-    refs: Vec<(String, String, String, u64)>,
-    relationship: String,
-    has_common_ancestor: bool,
-    diff_len: usize,
-    conflict: ConflictClass,
-    materialized: String,
-    reachability_revisions: Vec<String>,
-    reachability_objects: Vec<String>,
-}
-
-fn workload<S: DurableObjectStore>(substrate: &VersionedObjectSubstrate<S>) -> Snapshot {
-    let a = substrate
-        .create_revision("graph:item", json!({"n":"A"}).to_string(), None, "auth".into())
-        .unwrap();
-    let b = substrate
-        .create_revision(
-            "graph:item",
-            json!({"n":"B"}).to_string(),
-            Some(a.id.clone()),
-            "auth".into(),
-        )
-        .unwrap();
-    let c = substrate
-        .create_revision(
-            "graph:item",
-            json!({"n":"C","shared":true}).to_string(),
-            Some(b.id.clone()),
-            "auth".into(),
-        )
-        .unwrap();
-    let d = substrate
-        .create_revision(
-            "graph:item",
-            json!({"n":"D","shared":true}).to_string(),
-            Some(b.id.clone()),
-            "auth".into(),
-        )
-        .unwrap();
-
-    substrate
-        .create_ref("heads", "main", c.id.clone(), "auth".into())
-        .unwrap();
-    substrate
-        .create_ref("heads", "feature", d.id.clone(), "auth".into())
-        .unwrap();
-
-    let revisions = substrate.list_revisions().unwrap();
-    let mut topology = StateTopology::new();
-    for revision in &revisions {
-        topology.add_revision(revision.clone());
-    }
-
-    let conflict = substrate
-        .conflict_classification(&b.id, &c.id, &d.id)
-        .unwrap()
-        .overall;
-    let reconciled = substrate.reconcile(&b.id, &c.id, &d.id, "reconciler").unwrap();
-    let materialized = substrate
-        .materialize(
-            &reconciled.id,
-            &MaterializationProjection::select(vec![vec![PathComponent::Key("n".into())]]),
-        )
-        .unwrap()
-        .to_string();
-
-    let reachability = substrate.reachability().unwrap();
-
-    let mut revisions_snapshot = substrate
-        .list_revisions()
-        .unwrap()
-        .into_iter()
-        .map(|r| {
-            (
-                r.id.as_hex().to_string(),
-                r.parent_id.map(|p| p.as_hex().to_string()),
-                r.content_id.as_hex().to_string(),
-            )
-        })
-        .collect::<Vec<_>>();
-    revisions_snapshot.sort();
-
-    let refs_snapshot = substrate
-        .list_refs(None)
-        .unwrap()
-        .into_iter()
-        .map(|r| {
-            (
-                r.namespace,
-                r.name,
-                r.target.as_hex().to_string(),
-                r.version,
-            )
-        })
-        .collect::<Vec<_>>();
-
-    let relationship = format!("{:?}", topology.relationship(&c.id, &d.id));
-    let has_common_ancestor = topology.common_ancestor(&c.id, &d.id).is_some();
-    let diff_len = feltdb::SemanticDiff::compute(
-        &serde_json::from_str::<serde_json::Value>(&c.content).unwrap(),
-        &serde_json::from_str::<serde_json::Value>(&d.content).unwrap(),
-    )
-    .changes
-    .len();
-
-    Snapshot {
-        revisions: revisions_snapshot,
-        refs: refs_snapshot,
-        relationship,
-        has_common_ancestor,
-        diff_len,
-        conflict,
-        materialized,
-        reachability_revisions: reachability
-            .revisions
-            .iter()
-            .map(|id| id.as_hex().to_string())
-            .collect(),
-        reachability_objects: reachability
-            .objects
-            .iter()
-            .map(|id| id.as_hex().to_string())
-            .collect(),
-    }
-}
-
-#[test]
-fn local_and_s3_compatible_backends_produce_identical_version_semantics() {
-    let local_dir = TempDir::new().unwrap();
-    let local = VersionedObjectSubstrate::new(LocalObjectStore::new(local_dir.path()).unwrap());
-
-    let bucket = S3CompatibleBucket::default();
-    let s3 = VersionedObjectSubstrate::new(S3CompatibleObjectStore::new(bucket));
-
-    let local_snapshot = workload(&local);
-    let s3_snapshot = workload(&s3);
-    assert_eq!(local_snapshot, s3_snapshot);
-}
-
-#[test]
-fn durable_survives_cache_loss_but_cache_never_becomes_authority() {
-    let local_dir = TempDir::new().unwrap();
-    let backend = LocalObjectStore::new(local_dir.path()).unwrap();
-
-    let service = VersionedObjectSubstrate::new(backend.clone());
-    let a = service
-        .create_revision("docs:1", json!({"v":1}).to_string(), None, "auth".into())
-        .unwrap();
-    let b = service
-        .create_revision(
-            "docs:1",
-            json!({"v":2}).to_string(),
-            Some(a.id.clone()),
-            "auth".into(),
-        )
-        .unwrap();
-    service
-        .create_ref("heads", "main", b.id.clone(), "auth".into())
-        .unwrap();
-
-    let restart = VersionedObjectSubstrate::new(backend.clone());
-    let restored = restart.get_revision(&b.id).unwrap();
-    assert_eq!(restored.id, b.id);
-
-    // Populate cache then remove durable object; reads must fail closed.
-    let _ = restart.get_object(&b.content_id).unwrap();
-    backend.delete(&format!("object:{}", b.content_id.as_hex())).unwrap();
-    let failed = restart.get_revision(&b.id);
-    assert!(matches!(failed, Err(SubstrateError::NotFound(_))));
-}
-
-#[test]
-fn shared_history_gc_parity_across_backends_and_restart() {
-    fn scenario<S: DurableObjectStore>(backend: S) -> (Reachability, Reachability) {
-        let substrate = VersionedObjectSubstrate::new(backend.clone());
-        let a = substrate
-            .create_revision("graph:item", json!({"n":"A"}).to_string(), None, "auth".into())
-            .unwrap();
-        let b = substrate
-            .create_revision(
-                "graph:item",
-                json!({"n":"B"}).to_string(),
-                Some(a.id.clone()),
-                "auth".into(),
-            )
-            .unwrap();
-        let c = substrate
-            .create_revision(
-                "graph:item",
-                json!({"n":"C"}).to_string(),
-                Some(b.id.clone()),
-                "auth".into(),
-            )
-            .unwrap();
-        let d = substrate
-            .create_revision(
-                "graph:item",
-                json!({"n":"D"}).to_string(),
-                Some(b.id.clone()),
-                "auth".into(),
-            )
-            .unwrap();
-        substrate
-            .create_ref("heads", "main", c.id.clone(), "auth".into())
-            .unwrap();
-        substrate
-            .create_ref("heads", "feature", d.id.clone(), "auth".into())
-            .unwrap();
-
-        substrate.delete_ref("heads", "feature", Some(1)).unwrap();
-        let after_gc = substrate.collect_unreachable().unwrap();
-        assert!(after_gc.revisions.iter().any(|id| id == &b.id));
-        assert!(after_gc.revisions.iter().any(|id| id == &c.id));
-        assert!(!after_gc.revisions.iter().any(|id| id == &d.id));
-
-        let restarted = VersionedObjectSubstrate::new(backend);
-        let after_restart = restarted.reachability().unwrap();
-        (after_gc, after_restart)
-    }
-
-    let local_dir = TempDir::new().unwrap();
-    let (local_gc, local_restart) = scenario(LocalObjectStore::new(local_dir.path()).unwrap());
-    assert_eq!(local_gc, local_restart);
-
-    let bucket = S3CompatibleBucket::default();
-    let (s3_gc, s3_restart) = scenario(S3CompatibleObjectStore::new(bucket));
-    assert_eq!(s3_gc, s3_restart);
-    assert_eq!(local_gc, s3_gc);
-}
-
-#[test]
-fn concurrent_ref_cas_allows_only_one_winner_across_backends() {
-    fn run<S: DurableObjectStore>(backend: S) {
-        let substrate = Arc::new(VersionedObjectSubstrate::new(backend));
-        let a = substrate
-            .create_revision("docs:1", json!({"v":1}).to_string(), None, "auth".into())
-            .unwrap();
-        let b = substrate
-            .create_revision(
-                "docs:1",
-                json!({"v":2}).to_string(),
-                Some(a.id.clone()),
-                "auth".into(),
-            )
-            .unwrap();
-        let c = substrate
-            .create_revision(
-                "docs:1",
-                json!({"v":3}).to_string(),
-                Some(b.id.clone()),
-                "auth".into(),
-            )
-            .unwrap();
-        substrate
-            .create_ref("heads", "main", b.id.clone(), "auth".into())
-            .unwrap();
-
-        let barrier = Arc::new(Barrier::new(2));
-        let left = {
-            let substrate = Arc::clone(&substrate);
-            let barrier = Arc::clone(&barrier);
-            let c = c.id.clone();
-            thread::spawn(move || {
-                barrier.wait();
-                substrate.cas_move_ref("heads", "main", 1, c, "left".into())
-            })
-        };
-        let right = {
-            let substrate = Arc::clone(&substrate);
-            let barrier = Arc::clone(&barrier);
-            let a = a.id.clone();
-            thread::spawn(move || {
-                barrier.wait();
-                substrate.cas_move_ref("heads", "main", 1, a, "right".into())
-            })
-        };
-
-        let one = left.join().unwrap();
-        let two = right.join().unwrap();
-        let wins = usize::from(one.is_ok()) + usize::from(two.is_ok());
-        assert_eq!(wins, 1);
-    }
-
-    let local_dir = TempDir::new().unwrap();
-    run(LocalObjectStore::new(local_dir.path()).unwrap());
-    run(S3CompatibleObjectStore::new(S3CompatibleBucket::default()));
-}
-
-#[test]
-fn duplicate_object_writes_and_restart_are_stable() {
-    fn run<S: DurableObjectStore>(backend: S) {
-        let substrate = VersionedObjectSubstrate::new(backend.clone());
-        let one = substrate.store_object(r#"{"same":true}"#).unwrap();
-        let two = substrate.store_object(r#"{"same":true}"#).unwrap();
-        assert_eq!(one, two);
-
-        let restarted = VersionedObjectSubstrate::new(backend);
-        let value = restarted.get_object(&one).unwrap();
-        assert_eq!(value, r#"{"same":true}"#);
-    }
-
-    let local_dir = TempDir::new().unwrap();
-    run(LocalObjectStore::new(local_dir.path()).unwrap());
-    run(S3CompatibleObjectStore::new(S3CompatibleBucket::default()));
-}
-
-#[test]
-fn ref_is_not_published_when_target_is_not_durable() {
-    let local_dir = TempDir::new().unwrap();
-    let backend = LocalObjectStore::new(local_dir.path()).unwrap();
-    let substrate = VersionedObjectSubstrate::new(backend.clone());
-
-    let fake = StateId::from_hex("a".repeat(64));
-    let create = substrate.create_ref("heads", "broken", fake, "auth".into());
-    assert!(matches!(create, Err(SubstrateError::NotFound(_))));
-}