@feltdb/core 0.8.4 → 0.8.6

package/dist/create/server-source/crates/feltdb/tests/resource_scoped_revisions.rs

@@ -0,0 +1,338 @@
+//! Production-facing evidence for the resource-scoped revision model.
+//!
+//! The [contract](../../../docs/architecture/revision-identity-and-ancestry.md)
+//! proves the 21 clauses; this file proves the scenarios a database has to
+//! survive rather than the clauses a model has to satisfy.
+//!
+//! Three groups: identity, ancestry, and bounded history.
+
+use feltdb::state_model::{
+    ParentLookup, RetentionPolicy, RevisionError, StateRevision, StateStore,
+};
+use feltdb::{FeltDb, JsonCasResult};
+use serde_json::json;
+use std::sync::Arc;
+use tempfile::TempDir;
+
+fn durable(name: &str) -> (TempDir, Arc<FeltDb>, StateStore) {
+    let directory = TempDir::new().unwrap();
+    let db = Arc::new(FeltDb::open(directory.path().join(name)).unwrap());
+    let store = StateStore::with_feltdb(db.clone()).unwrap();
+    (directory, db, store)
+}
+
+fn revision_lines(log: &str) -> usize {
+    log.lines()
+        .filter(|line| line.contains("state:revision:") && !line.contains(r#""deleted":true"#))
+        .count()
+}
+
+// ---------------------------------------------------------------------------
+// Identity
+// ---------------------------------------------------------------------------
+
+/// Writing the same state twice to one resource records two revisions.
+#[test]
+fn same_content_twice_is_distinct() {
+    let (_directory, db, store) = durable("same-twice.log");
+
+    db.insert("tasks:1", json!({"title": "A"})).unwrap();
+    db.update("tasks:1", json!({"title": "A"})).unwrap();
+
+    let history = store.history_of("tasks:1");
+    assert_eq!(history.len(), 2, "two writes, two revisions");
+    assert_ne!(history[0].id, history[1].id);
+    assert_eq!(
+        history[0].content_id, history[1].content_id,
+        "and it was the same state both times"
+    );
+}
+
+/// A revert is a new historical node, not a return to an old one.
+#[test]
+fn revert_creates_new_revision() {
+    let (_directory, db, store) = durable("revert.log");
+
+    db.insert("tasks:1", json!({"title": "A"})).unwrap();
+    db.update("tasks:1", json!({"title": "B"})).unwrap();
+    db.update("tasks:1", json!({"title": "A"})).unwrap();
+
+    let history = store.history_of("tasks:1");
+    assert_eq!(history.len(), 3);
+    assert_ne!(
+        history[0].id, history[2].id,
+        "the revert did not resurrect an identity"
+    );
+    assert_eq!(history[2].parent_id.as_ref(), Some(&history[1].id));
+    assert_eq!(history[1].parent_id.as_ref(), Some(&history[0].id));
+    assert_eq!(history[0].parent_id, None);
+}
+
+/// Identical content on two resources is two histories, never one object.
+#[test]
+fn same_content_across_resources_is_distinct() {
+    let (_directory, db, store) = durable("two-resources.log");
+
+    db.insert("tasks:1", json!({"title": "A"})).unwrap();
+    db.insert("tasks:2", json!({"title": "A"})).unwrap();
+
+    let one = store.head_of("tasks:1").unwrap();
+    let two = store.head_of("tasks:2").unwrap();
+
+    assert_ne!(one.id, two.id);
+    assert_eq!(one.content_id, two.content_id);
+    assert_eq!(one.resource, "tasks:1");
+    assert_eq!(two.resource, "tasks:2");
+    assert_eq!(store.history_of("tasks:1").len(), 1);
+    assert_eq!(store.history_of("tasks:2").len(), 1);
+}
+
+// ---------------------------------------------------------------------------
+// Ancestry
+// ---------------------------------------------------------------------------
+
+/// **T6, closed.** No later mint rewrites an existing revision's ancestry.
+#[test]
+fn committed_parent_is_immutable() {
+    let (_directory, db, store) = durable("immutable.log");
+
+    db.insert("tasks:1", json!({"title": "A"})).unwrap();
+    db.update("tasks:1", json!({"title": "B"})).unwrap();
+    let second = store.head_of("tasks:1").unwrap();
+    let recorded_parent = second.parent_id.clone();
+    assert!(recorded_parent.is_some());
+
+    // Everything that rewrote it before: the same content again, the same
+    // content as a root, and the same content on another resource.
+    db.update("tasks:1", json!({"title": "B"})).unwrap();
+    db.insert("tasks:2", json!({"title": "B"})).unwrap();
+    assert!(store
+        .create("tasks:1", r#"{"title":"B"}"#.into(), "x".into())
+        .is_err());
+
+    assert_eq!(
+        store.get(&second.id).unwrap().parent_id,
+        recorded_parent,
+        "the committed revision kept the parent it was committed with"
+    );
+}
+
+/// **T5, closed.** A parent must be an authoritative stored revision.
+#[test]
+fn foreign_parent_is_rejected() {
+    let (_directory, _db, store) = durable("foreign.log");
+
+    let real = store
+        .create("tasks:1", r#"{"title":"A"}"#.into(), "x".into())
+        .unwrap();
+
+    // A revision the caller built but never committed.
+    let fabricated = StateRevision::at(
+        "tasks:1".into(),
+        r#"{"never":"stored"}"#.into(),
+        None,
+        0,
+        "x".into(),
+    );
+    assert!(matches!(
+        store.commit(r#"{"title":"B"}"#.into(), &fabricated, "x".into()),
+        Err(RevisionError::UnknownParent(_))
+    ));
+
+    // And a real revision, but of another resource.
+    assert!(matches!(
+        store.mint(
+            "tasks:2",
+            r#"{"title":"B"}"#.into(),
+            Some(&real),
+            "x".into()
+        ),
+        Err(RevisionError::ForeignParent { .. })
+    ));
+}
+
+/// The fenced path mints from the revision the fence itself committed against,
+/// so no caller-supplied historical object can choose the ancestry.
+#[test]
+fn the_fenced_path_mints_from_the_current_revision() {
+    let (_directory, db, store) = durable("fenced.log");
+
+    db.insert("tasks:1", json!({"title": "A", "__version": 1}))
+        .unwrap();
+    let before = store.head_of("tasks:1").unwrap();
+
+    // A refused write mints nothing.
+    let refused = db
+        .compare_and_set_json("tasks:1", 99, None, None, false, json!({"title": "Z"}))
+        .unwrap();
+    assert!(matches!(refused, JsonCasResult::VersionConflict { .. }));
+    assert_eq!(store.history_of("tasks:1").len(), 1, "no revision minted");
+
+    // An accepted one descends from what was current.
+    db.compare_and_set_json("tasks:1", 1, None, None, false, json!({"title": "B"}))
+        .unwrap();
+    let after = store.head_of("tasks:1").unwrap();
+    assert_eq!(after.parent_id.as_ref(), Some(&before.id));
+    assert_eq!(after.sequence, before.sequence + 1);
+}
+
+// ---------------------------------------------------------------------------
+// Bounded history
+// ---------------------------------------------------------------------------
+
+/// The whole point of the policy: writing forever does not store forever.
+#[test]
+fn repeated_mutation_has_bounded_history() {
+    let (_directory, db, store) = durable("bounded.log");
+    store
+        .set_retention_policy("tasks:1", RetentionPolicy::keep_last(5))
+        .unwrap();
+
+    db.insert("tasks:1", json!({"n": 0})).unwrap();
+    for n in 1..200 {
+        db.update("tasks:1", json!({ "n": n })).unwrap();
+    }
+
+    assert_eq!(
+        store.history_of("tasks:1").len(),
+        5,
+        "two hundred writes, five retained revisions"
+    );
+}
+
+/// Retention never takes the state the application is using.
+#[test]
+fn current_revision_survives_retention() {
+    let (_directory, db, store) = durable("current.log");
+    // Even asked for zero, the current revision survives.
+    store
+        .set_retention_policy("tasks:1", RetentionPolicy::keep_last(0))
+        .unwrap();
+
+    db.insert("tasks:1", json!({"n": 0})).unwrap();
+    for n in 1..20 {
+        db.update("tasks:1", json!({ "n": n })).unwrap();
+    }
+
+    let history = store.history_of("tasks:1");
+    assert_eq!(history.len(), 1, "keep_last is clamped to at least one");
+    assert!(history[0].content.contains(r#""n":19"#));
+
+    let current: serde_json::Value = db.get("tasks:1").unwrap().unwrap();
+    assert_eq!(current["n"], json!(19), "and the row itself is untouched");
+}
+
+/// A retained revision's ancestry stays valid, and the cut is legible.
+///
+/// This is the hazard the retention rule was designed around: expiring an
+/// ancestor must not silently leave a retained child pointing at nothing. The
+/// child's `parent_id` is never rewritten — that would break immutability — so
+/// the resource records a horizon, and the oldest survivor reports its parent
+/// as **expired** rather than missing.
+#[test]
+fn parent_survives_required_retention() {
+    let (_directory, db, store) = durable("ancestry.log");
+    store
+        .set_retention_policy("tasks:1", RetentionPolicy::keep_last(3))
+        .unwrap();
+
+    db.insert("tasks:1", json!({"n": 0})).unwrap();
+    for n in 1..10 {
+        db.update("tasks:1", json!({ "n": n })).unwrap();
+    }
+
+    let history = store.history_of("tasks:1");
+    assert_eq!(history.len(), 3);
+
+    // Every retained revision but the oldest resolves its parent.
+    for revision in &history[1..] {
+        assert!(
+            matches!(
+                store.parent_of(&revision.id),
+                Some(ParentLookup::Revision(_))
+            ),
+            "a retained child's parent is retained"
+        );
+    }
+
+    // The oldest names a parent that was expired on purpose, and says so.
+    assert!(matches!(
+        store.parent_of(&history[0].id),
+        Some(ParentLookup::Expired(_))
+    ));
+    assert_eq!(
+        store.retention_horizon("tasks:1"),
+        history[0].sequence,
+        "the horizon is exactly where history was cut"
+    );
+}
+
+/// Expired revisions are reclaimed, not merely hidden.
+///
+/// Retention removes them from state immediately. The bytes go when the log is
+/// compacted, which is the operation that reclaims space — and this is the one
+/// place the two mechanisms meet: **retention decides what history exists;
+/// compaction reclaims what retention removed.** Neither does the other's job.
+#[test]
+fn expired_history_is_reclaimable() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("reclaim.log");
+    let db = Arc::new(FeltDb::open(&path).unwrap());
+    let store = StateStore::with_feltdb(db.clone()).unwrap();
+
+    store
+        .set_retention_policy("tasks:1", RetentionPolicy::keep_last(2))
+        .unwrap();
+    db.insert("tasks:1", json!({"n": 0})).unwrap();
+    for n in 1..50 {
+        db.update("tasks:1", json!({ "n": n })).unwrap();
+    }
+
+    assert_eq!(store.history_of("tasks:1").len(), 2, "history is bounded");
+
+    let versions = db.operation_versions().unwrap();
+    db.acknowledge_peer_versions("peer-1".to_string(), versions)
+        .unwrap();
+    db.compact_operation_log(&["peer-1".to_string()]).unwrap();
+
+    let log = std::fs::read_to_string(&path).unwrap();
+    assert_eq!(
+        revision_lines(&log),
+        2,
+        "compaction wrote out only the revisions retention kept"
+    );
+
+    // And the bound holds across a restart.
+    drop(store);
+    drop(db);
+    let reopened = Arc::new(FeltDb::open(&path).unwrap());
+    let store = StateStore::with_feltdb(reopened.clone()).unwrap();
+    assert_eq!(store.history_of("tasks:1").len(), 2);
+    let current: serde_json::Value = reopened.get("tasks:1").unwrap().unwrap();
+    assert_eq!(current["n"], json!(49), "current state survived all of it");
+}
+
+/// Minting survives a restart: the head index is derived, not durable, and a
+/// reopened database continues the resource's history rather than restarting it.
+#[test]
+fn history_continues_across_a_restart() {
+    let directory = TempDir::new().unwrap();
+    let path = directory.path().join("restart.log");
+    let db = Arc::new(FeltDb::open(&path).unwrap());
+
+    db.insert("tasks:1", json!({"n": 0})).unwrap();
+    db.update("tasks:1", json!({"n": 1})).unwrap();
+    drop(db);
+
+    let reopened = Arc::new(FeltDb::open(&path).unwrap());
+    reopened.update("tasks:1", json!({"n": 2})).unwrap();
+    let store = StateStore::with_feltdb(reopened).unwrap();
+
+    let history = store.history_of("tasks:1");
+    assert_eq!(history.len(), 3, "the third write continued the history");
+    assert_eq!(
+        history[2].sequence, 2,
+        "sequence continued, did not restart"
+    );
+    assert_eq!(history[2].parent_id.as_ref(), Some(&history[1].id));
+}