@fuzdev/fuz_app 0.142.0 → 0.144.0

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -15,17 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * Three further daemon-token actions live here but are **not** bundled by
+ * Two further daemon-token actions live here but are **not** bundled by
  * `create_testing_actions`, and are appended at the full-mount layer
  * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
  * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
  * it must enumerate *every* mounted method, so it goes where the complete list
- * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
- * and request check for the cross-impl origin conformance table), and
- * **`_testing_shorten_credential_expiry`** (pull an account's credential
- * expiries in to seconds from now, shorten-only, for the credential-deadline
- * cases) — the last two kept out of the bundle so a consumer whose Rust binary
- * doesn't mount their mirrors keeps a green manifest gate.
+ * exists) and **`_testing_shorten_credential_expiry`** (pull an account's
+ * credential expiries in to seconds from now, shorten-only, for the
+ * credential-deadline cases) — the latter kept out of the bundle so a consumer
+ * whose Rust binary doesn't mount its mirror keeps a green manifest gate.
+ * `_testing_origin_check`, mounted the same way, lives in the hono-free
+ * `testing_origin_check.ts`.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -83,27 +83,14 @@ import { jsonrpc_errors } from '../../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../../http/pending_effects.js';
 import { protocol_action_specs } from '../../actions/protocol.js';
 import { query_put_fact } from '../../db/fact_queries.js';
+import { query_put_fact_holder } from '../../db/fact_holder_queries.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from '../../auth/role_schema.js';
 import { query_schema_snapshot, SchemaSnapshot, query_migration_tracker, MigrationTracker } from '../schema_introspect.js';
 import { ActionManifest, build_action_manifest } from './action_manifest.js';
 import { query_create_actor } from '../../auth/account_queries.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
-import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
-/**
- * Shared `auth` axis for every `_testing_*` action: keeper-only via the
- * daemon-token credential, no acting actor. This is the entire structural
- * fence on the backdoor surface (these actions run direct DB writes the
- * production wire never exposes), so every `_testing_*` spec references this
- * one const rather than re-declaring it — a single source of truth the gate test
- * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
- * / shared `AuthSpec` in `fuz_testing`.
- */
-const TESTING_ACTION_AUTH = {
-    account: 'required',
-    actor: 'none',
-    credential_types: ['daemon_token']
-};
+import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
 /** Output shape for an individual seeded account (keeper or extra). */
 const SeededAccountShape = z.strictObject({
     account: z.strictObject({ id: Uuid, username: z.string() }),
@@ -276,8 +263,11 @@ export const create_testing_drain_effects_action = (audit) => rpc_action(testing
  * cross-process fact-serving suite, which drives over real HTTP and has no
  * `PgFactStore` to call. Hashes the UTF-8 `content` (blake3, via
  * `fact_hash_bytes` — the same hash the Rust `_testing_put_fact` computes),
- * inserts the row idempotently, and returns `{hash}`. The referencing cell is
- * seeded separately via the `cell_create` RPC. Embedded-only is enough for the
+ * inserts the row idempotently, and returns `{hash}`. `holder` names the actor
+ * the put is on behalf of — recorded in `fact_holder` (deduplicated puts
+ * included), as a real upload records its uploader, so the suites can drive
+ * cell ref admission; absent, the put is a system put with no holder. The
+ * referencing cell is seeded separately via the `cell_create` RPC. Embedded-only is enough for the
  * authz assertions (cell-scoped admit, cross-owner-no-leak, 404-mask, bare-hash
  * admin-only); external / X-Accel parity stays covered by the forge's own gate.
  *
@@ -293,7 +283,8 @@ export const testing_put_fact_action_spec = {
     side_effects: true,
     input: z.strictObject({
         content: z.string(),
-        content_type: z.string().optional()
+        content_type: z.string().optional(),
+        holder: Uuid.optional()
     }),
     output: z.strictObject({ hash: FactHashSchema }),
     async: true,
@@ -459,76 +450,6 @@ export const testing_migration_tracker_action_spec = {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export const create_testing_migration_tracker_action = () => rpc_action(testing_migration_tracker_action_spec, async (_input, ctx) => query_migration_tracker(ctx.db));
-/** Input of `_testing_origin_check`. */
-export const TestingOriginCheckInput = z.strictObject({
-    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
-    patterns: z.string(),
-    /** One `Origin` header's value, or `null` for a request without one. */
-    origin: z.string().nullable()
-});
-/**
- * Output of `_testing_origin_check`: the request-level answer when the list
- * parses, else every refusal — `index` the 1-based entry position, absent for
- * a list-level refusal.
- */
-export const TestingOriginCheckOutput = z.union([
-    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
-    z.strictObject({
-        ok: z.literal(false),
-        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
-    })
-]);
-/**
- * Answer one `_testing_origin_check` input: parse `patterns` with
- * `parse_allowed_origins`, then run the request-level check for one `Origin`
- * carrying `origin` (`null` — no `Origin` — passes). The action handler and
- * the conformance table's unit test both call this, so the table checks the
- * same function the wire serves.
- *
- * @param input - the allowlist value and the `Origin` value
- * @returns the answer the Rust twin returns for the same input
- */
-export const run_testing_origin_check = (input) => {
-    const parsed = parse_allowed_origins(input.patterns);
-    if (!parsed.ok) {
-        return {
-            ok: false,
-            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
-        };
-    }
-    return {
-        ok: true,
-        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
-    };
-};
-/**
- * `_testing_origin_check` — run the origin allowlist's parse and request
- * check for one `{patterns, origin}` pair, so the shared conformance table
- * (`origin_conformance.json`) checks each backend's grammar and matcher over
- * the wire, row by row. Pure: no database, no state. The Rust mirror is
- * `fuz_testing::create_testing_origin_check_action_spec`.
- *
- * Like `_testing_action_manifest`, it is **not** bundled by
- * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
- * mirror would fail its action-manifest parity gate. The spine test binary
- * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
- *
- * `auth` gates on the daemon-token credential, matching `_testing_reset`.
- */
-export const testing_origin_check_action_spec = {
-    method: '_testing_origin_check',
-    kind: 'request_response',
-    initiator: 'frontend',
-    auth: TESTING_ACTION_AUTH,
-    side_effects: false,
-    input: TestingOriginCheckInput,
-    output: TestingOriginCheckOutput,
-    async: true,
-    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
-        '{patterns, origin} pair, for the cross-impl origin conformance table.'
-};
-/** Build the standalone `_testing_origin_check` action (see the spec doc). */
-export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));
 /** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
 export const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
 /**
@@ -803,6 +724,11 @@ export const create_testing_actions = (deps, options) => {
                 content_type: input.content_type ?? null,
                 size: bytes.length
             });
+            // the holder row, on a dedup hit too (`PgFactStore`'s put records it the
+            // same way); an unknown actor fails the FK
+            if (input.holder !== undefined) {
+                await query_put_fact_holder({ db: ctx.db }, input.holder, hash);
+            }
             return { hash };
         }),
         create_testing_drain_effects_action(deps.audit),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.142.0",
+  "version": "0.144.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",