@malloy-publisher/server 0.0.235 → 0.0.236

package/src/errors.spec.ts

@@ -1,119 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import {
-   AccessDeniedError,
-   BadRequestError,
-   ConnectionAuthError,
-   ConnectionError,
-   internalErrorToHttpError,
-   ModelCompilationError,
-   NotQueryableError,
-   PayloadTooLargeError,
-   QueryTimeoutError,
-   ServiceUnavailableError,
-} from "./errors";
-
-describe("internalErrorToHttpError", () => {
-   it("maps ConnectionAuthError to 422", () => {
-      const { status, json } = internalErrorToHttpError(
-         new ConnectionAuthError("creds rejected for db_x"),
-      );
-      expect(status).toBe(422);
-      expect(json).toEqual({
-         code: 422,
-         message: "creds rejected for db_x",
-      });
-   });
-
-   it("maps BadRequestError to 400", () => {
-      const { status, json } = internalErrorToHttpError(
-         new BadRequestError("bad input"),
-      );
-      expect(status).toBe(400);
-      expect(json).toEqual({ code: 400, message: "bad input" });
-   });
-
-   it("maps AccessDeniedError to 403 (authorize gate)", () => {
-      const { status, json } = internalErrorToHttpError(
-         new AccessDeniedError('Access denied for source "gated".'),
-      );
-      expect(status).toBe(403);
-      expect(json).toEqual({
-         code: 403,
-         message: 'Access denied for source "gated".',
-      });
-   });
-
-   it("maps NotQueryableError to 404 (explore boundary)", () => {
-      const { status, json } = internalErrorToHttpError(
-         new NotQueryableError('No queryable source "hidden".'),
-      );
-      expect(status).toBe(404);
-      expect(json).toEqual({
-         code: 404,
-         message: 'No queryable source "hidden".',
-      });
-   });
-
-   it("maps ModelCompilationError to 424", () => {
-      const { status, json } = internalErrorToHttpError(
-         new ModelCompilationError({ message: "compile failed" }),
-      );
-      expect(status).toBe(424);
-      expect(json).toEqual({ code: 424, message: "compile failed" });
-   });
-
-   it("maps ConnectionError to 502 (distinct from auth, still retryable)", () => {
-      const { status, json } = internalErrorToHttpError(
-         new ConnectionError("upstream broken"),
-      );
-      expect(status).toBe(502);
-      expect(json).toEqual({ code: 502, message: "upstream broken" });
-   });
-
-   it("falls through to 500 for unrecognized errors", () => {
-      const { status, json } = internalErrorToHttpError(new Error("boom"));
-      expect(status).toBe(500);
-      expect(json.message).toBe("boom");
-   });
-
-   it("maps PayloadTooLargeError to 413", () => {
-      const { status, json } = internalErrorToHttpError(
-         new PayloadTooLargeError(
-            "Query returned more than 100000 rows; refine the query or raise PUBLISHER_MAX_QUERY_ROWS.",
-         ),
-      );
-      expect(status).toBe(413);
-      expect(json).toEqual({
-         code: 413,
-         message:
-            "Query returned more than 100000 rows; refine the query or raise PUBLISHER_MAX_QUERY_ROWS.",
-      });
-   });
-
-   it("maps ServiceUnavailableError to 503 (load shedding / back-pressure)", () => {
-      const { status, json } = internalErrorToHttpError(
-         new ServiceUnavailableError(
-            "Pod at max concurrent queries (32); retry later.",
-         ),
-      );
-      expect(status).toBe(503);
-      expect(json).toEqual({
-         code: 503,
-         message: "Pod at max concurrent queries (32); retry later.",
-      });
-   });
-
-   it("maps QueryTimeoutError to 504 (gateway timeout, distinct from 503 back-pressure)", () => {
-      const { status, json } = internalErrorToHttpError(
-         new QueryTimeoutError(
-            "Query exceeded PUBLISHER_QUERY_TIMEOUT_MS (300000ms) and was aborted.",
-         ),
-      );
-      expect(status).toBe(504);
-      expect(json).toEqual({
-         code: 504,
-         message:
-            "Query exceeded PUBLISHER_QUERY_TIMEOUT_MS (300000ms) and was aborted.",
-      });
-   });
-});

package/src/errors.ts

@@ -1,237 +0,0 @@
-import { MalloyError } from "@malloydata/malloy";
-import { PUBLISHER_CONFIG_NAME } from "./constants";
-
-export function internalErrorToHttpError(error: Error) {
-   if (error instanceof BadRequestError) {
-      return httpError(400, error.message);
-   } else if (error instanceof FrozenConfigError) {
-      return httpError(403, error.message);
-   } else if (error instanceof AccessDeniedError) {
-      return httpError(403, error.message);
-   } else if (error instanceof EnvironmentNotFoundError) {
-      return httpError(404, error.message);
-   } else if (error instanceof PackageNotFoundError) {
-      return httpError(404, error.message);
-   } else if (error instanceof ModelNotFoundError) {
-      return httpError(404, error.message);
-   } else if (error instanceof NotQueryableError) {
-      return httpError(404, error.message);
-   } else if (error instanceof MalloyError) {
-      return httpError(400, error.message);
-   } else if (error instanceof ConnectionNotFoundError) {
-      return httpError(404, error.message);
-   } else if (error instanceof ConnectionAuthError) {
-      return httpError(422, error.message);
-   } else if (error instanceof UnsupportedCatalogFormatError) {
-      return httpError(422, error.message);
-   } else if (error instanceof MaterializationEligibilityError) {
-      return httpError(422, error.message);
-   } else if (error instanceof ModelCompilationError) {
-      return httpError(424, error.message);
-   } else if (error instanceof ConnectionError) {
-      return httpError(502, error.message);
-   } else if (error instanceof MaterializationNotFoundError) {
-      return httpError(404, error.message);
-   } else if (error instanceof MaterializationConflictError) {
-      return httpError(409, error.message);
-   } else if (error instanceof InvalidStateTransitionError) {
-      return httpError(409, error.message);
-   } else if (error instanceof ServiceUnavailableError) {
-      return httpError(503, error.message);
-   } else if (error instanceof PayloadTooLargeError) {
-      return httpError(413, error.message);
-   } else if (error instanceof QueryTimeoutError) {
-      return httpError(504, error.message);
-   } else {
-      return httpError(500, error.message);
-   }
-}
-
-function httpError(code: number, message: string) {
-   return {
-      status: code,
-      json: {
-         code,
-         message: message,
-      },
-   };
-}
-
-export class NotImplementedError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class BadRequestError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class EnvironmentNotFoundError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class PackageNotFoundError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class ModelNotFoundError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class ConnectionNotFoundError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class ConnectionError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class ConnectionAuthError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-// A catalog was reached and authenticated fine, but its on-disk format is
-// outside the range the pinned engine's extension can attach (see
-// ducklake_version.ts). Distinct from ConnectionAuthError so the 422 doesn't
-// read as a credentials problem. Maps to HTTP 422.
-export class UnsupportedCatalogFormatError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class ModelCompilationError extends Error {
-   // Accepts a MalloyError or any message-bearing object, so callers that add
-   // context around a compile failure (e.g. naming the source whose authorize
-   // annotation failed) can reuse this 424 mapping without a separate class.
-   constructor(error: { message: string }) {
-      super(error.message);
-   }
-}
-
-/**
- * A persist source was asked to materialize into a `storage=` destination (the
- * DuckDB/DuckLake tier) but is ineligible: it has an unbound free parameter, it
- * references a given (an RLAC/tenant-isolation refusal), or its served shape
- * does not compile in DuckDB. Mapped to HTTP **422** (the request is
- * well-formed, but the source cannot be processed into a materialized artifact)
- * — a hard refuse, never a silent fallback. Kept a distinct class so the
- * givens/RLAC refusal is greppable for security review. Accepts a
- * message-bearing object to match {@link ModelCompilationError}'s ergonomics.
- */
-export class MaterializationEligibilityError extends Error {
-   constructor(error: { message: string }) {
-      super(error.message);
-      this.name = "MaterializationEligibilityError";
-   }
-}
-
-export class FrozenConfigError extends Error {
-   constructor(
-      message = `Publisher config can't be updated when ${PUBLISHER_CONFIG_NAME} has { "frozenConfig": true }`,
-   ) {
-      super(message);
-   }
-}
-
-/**
- * A request was denied by a source's `#(authorize)` gate (HTTP 403). Thrown by
- * the runtime authorize check when no in-scope expression evaluates true for
- * the supplied givens (including when a referenced given has no value).
- */
-export class AccessDeniedError extends Error {
-   constructor(message: string) {
-      super(message);
-      this.name = "AccessDeniedError";
-   }
-}
-
-/**
- * A query targeted a source/model that is not part of the package's queryable
- * surface under `queryableSources: "declared"` (a non-`explores` model file, or
- * a source not in a model's `export {}` closure). Mapped to HTTP **404**, not
- * 403, and with a deliberately generic message: unlike `#(authorize)` (which is
- * identity-scoped and answers "who"), the explore boundary is identity-free and
- * answers "what is queryable" — so a hidden target should be indistinguishable
- * from a non-existent one (no enumeration / existence oracle).
- */
-export class NotQueryableError extends Error {
-   constructor(message: string) {
-      super(message);
-      this.name = "NotQueryableError";
-   }
-}
-
-export class MaterializationNotFoundError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class MaterializationConflictError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-export class InvalidStateTransitionError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-/**
- * Thrown when the publisher is temporarily refusing a request to keep
- * RSS under the configured `PUBLISHER_MAX_MEMORY_BYTES` cap. Mapped to
- * HTTP 503 so an upstream proxy / client can retry with back-off.
- */
-export class ServiceUnavailableError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-/**
- * Thrown when a response would exceed a server-side size cap (e.g. an
- * ad-hoc connection SQL query that returned more than
- * `PUBLISHER_MAX_QUERY_ROWS` rows). Mapped to HTTP 413 so callers know
- * the request was well-formed but the result is too large for the
- * publisher to materialize; the remediation is "refine the query" or
- * "raise the cap", not "retry".
- */
-export class PayloadTooLargeError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}
-
-/**
- * Thrown when a query exceeded the configured wall-clock budget
- * (`PUBLISHER_QUERY_TIMEOUT_MS`) and the publisher aborted it
- * mid-execution. Mapped to HTTP 504 (`Gateway Timeout`) because the
- * publisher acts as a gateway to the underlying database — the
- * upstream caller did nothing wrong, but the downstream query took
- * too long. Distinct from {@link ServiceUnavailableError} so clients
- * can distinguish "back off, the pod is loaded" (503, retryable)
- * from "this specific query is too expensive" (504, refine it).
- */
-export class QueryTimeoutError extends Error {
-   constructor(message: string) {
-      super(message);
-   }
-}

package/src/filter_deprecation.spec.ts

@@ -1,64 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { setFilterDeprecationHeaders } from "./filter_deprecation";
-
-const makeRes = () => {
-   const headers: Record<string, string> = {};
-   const res = {
-      headers,
-      setHeader(name: string, value: string) {
-         headers[name] = value;
-         return res;
-      },
-   };
-   return res;
-};
-
-const DEPRECATION_LINK =
-   '<https://github.com/malloydata/publisher/blob/main/docs/givens.md>; rel="deprecation"; type="text/markdown"';
-
-describe("setFilterDeprecationHeaders", () => {
-   it("does not set headers when neither filterParams nor bypassFilters is supplied", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, {});
-      expect(res.headers.Deprecation).toBeUndefined();
-      expect(res.headers.Link).toBeUndefined();
-   });
-
-   it("does not set headers for an explicit empty filterParams object (no-op opt-out)", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, { filterParams: {} });
-      expect(res.headers.Deprecation).toBeUndefined();
-      expect(res.headers.Link).toBeUndefined();
-   });
-
-   it("sets RFC 8594 headers when filterParams carries values", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, {
-         filterParams: { region: ["US"] },
-      });
-      expect(res.headers.Deprecation).toBe("true");
-      expect(res.headers.Link).toBe(DEPRECATION_LINK);
-   });
-
-   it("sets RFC 8594 headers when bypassFilters is true", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, { bypassFilters: true });
-      expect(res.headers.Deprecation).toBe("true");
-      expect(res.headers.Link).toBe(DEPRECATION_LINK);
-   });
-
-   it("does not set headers when bypassFilters is undefined and filterParams is undefined", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, {
-         filterParams: undefined,
-         bypassFilters: undefined,
-      });
-      expect(res.headers.Deprecation).toBeUndefined();
-   });
-
-   it("does not set headers when filterParams is null", () => {
-      const res = makeRes();
-      setFilterDeprecationHeaders(res, { filterParams: null });
-      expect(res.headers.Deprecation).toBeUndefined();
-   });
-});

package/src/filter_deprecation.ts

@@ -1,42 +0,0 @@
-/**
- * Minimal structural type the helper needs from an HTTP response. Kept
- * narrower than `express.Response` so tests can pass a tiny stub instead
- * of constructing a full Express response.
- */
-export interface HeaderSetter {
-   setHeader(name: string, value: string): unknown;
-}
-
-/**
- * Attach RFC 8594 deprecation headers when the request carries any of the
- * legacy `#(filter)` API surface (`filterParams` / `bypassFilters` on POST,
- * `filter_params` / `bypass_filters` on the notebook-cell GET). The
- * complementary operator-facing notice for legacy *models* (independent of
- * whether the caller used the deprecated request fields) ships as a
- * one-time warn log in `Model`'s constructor — see service/model.ts.
- *
- * `filterParams` here is the *parsed* value (after JSON.parse for the GET
- * notebook-cell path), so an empty `{}` is treated as a no-op opt-out — the
- * header only fires when the caller actually supplied filter values.
- */
-export const setFilterDeprecationHeaders = (
-   res: HeaderSetter,
-   options: { filterParams?: unknown; bypassFilters?: unknown },
-): void => {
-   const hasFilterParams =
-      options.filterParams !== undefined &&
-      options.filterParams !== null &&
-      !(
-         typeof options.filterParams === "object" &&
-         !Array.isArray(options.filterParams) &&
-         Object.keys(options.filterParams as Record<string, unknown>).length ===
-            0
-      );
-   if (hasFilterParams || options.bypassFilters !== undefined) {
-      res.setHeader("Deprecation", "true");
-      res.setHeader(
-         "Link",
-         '<https://github.com/malloydata/publisher/blob/main/docs/givens.md>; rel="deprecation"; type="text/markdown"',
-      );
-   }
-};

package/src/health.spec.ts

@@ -1,123 +0,0 @@
-import {
-   afterAll,
-   afterEach,
-   beforeEach,
-   describe,
-   expect,
-   it,
-   spyOn,
-} from "bun:test";
-import { Server } from "http";
-import { performGracefulShutdownAfterDrain } from "./health";
-import { logger } from "./logger";
-import { __setPackageLoadPoolForTests } from "./package_load/package_load_pool";
-
-// Regression test for the graceful-shutdown ordering bug that caused
-//   [winston] Attempt to write logs with no transports: {"message":"Waiting 50 seconds..."}
-// to appear in production logs. logger.close() must run after every
-// logger.* call, including the "Waiting ... seconds after server close
-// before exit..." message.
-//
-// Tests call performGracefulShutdownAfterDrain directly rather than
-// emitting SIGTERM, so module-level operationalState is not mutated
-// and the spec stays isolated from sibling tests in the same process.
-describe("performGracefulShutdownAfterDrain: shutdown ordering", () => {
-   const originalExit = process.exit;
-   let callOrder: string[];
-
-   afterAll(async () => {
-      // performGracefulShutdownAfterDrain drains the package-load worker pool
-      // via getPackageLoadPool().shutdown() — which lazily CREATES the global
-      // singleton and leaves it installed in its shut-down state. In prod the
-      // process exits right after, so that's fine; in this shared test process
-      // it poisons every later spec that touches the worker path
-      // (Package.create → "PackageLoadPool is shutting down"), with failures
-      // that come and go with bun's platform-dependent file order. Reset the
-      // singleton so the next user lazily creates a fresh pool.
-      await __setPackageLoadPoolForTests(null);
-   });
-
-   beforeEach(() => {
-      callOrder = [];
-
-      spyOn(logger, "info").mockImplementation(((msg: string) => {
-         callOrder.push(`info:${msg}`);
-         return logger;
-      }) as never);
-      spyOn(logger, "close").mockImplementation((() => {
-         callOrder.push("close");
-         return logger;
-      }) as never);
-      // Silence warn/error calls so spec output stays clean. They are
-      // not load-bearing for these assertions.
-      spyOn(logger, "warn").mockImplementation((() => logger) as never);
-      spyOn(logger, "error").mockImplementation((() => logger) as never);
-
-      process.exit = ((_code?: number) => {
-         callOrder.push("exit");
-      }) as never;
-   });
-
-   afterEach(() => {
-      process.exit = originalExit;
-   });
-
-   // performGracefulShutdownAfterDrain lazily creates and shuts down the
-   // module-level PackageLoadPool singleton. If we leave that shut-down
-   // pool installed, sibling specs that run later in the same Bun process
-   // (e.g. package.spec.ts, package_race.spec.ts) inherit a dead pool and
-   // fail with "PackageLoadPool is shutting down". Reset the singleton so
-   // the next getPackageLoadPool() spins up a fresh one. The leaked-pool
-   // ordering is filesystem-readdir dependent, which is why it only
-   // surfaced on Linux CI.
-   afterAll(async () => {
-      await __setPackageLoadPoolForTests(null);
-   });
-
-   const fakeServer = (): Server => ({ listening: false }) as unknown as Server;
-
-   it("logs the 'Waiting ...' message before closing the logger", async () => {
-      await performGracefulShutdownAfterDrain(fakeServer(), fakeServer(), 0.05);
-
-      const waitingIdx = callOrder.findIndex((entry) =>
-         entry.startsWith("info:Waiting"),
-      );
-      const closeIdx = callOrder.indexOf("close");
-      const exitIdx = callOrder.indexOf("exit");
-
-      expect(waitingIdx).toBeGreaterThanOrEqual(0);
-      expect(closeIdx).toBeGreaterThanOrEqual(0);
-      expect(exitIdx).toBeGreaterThanOrEqual(0);
-      expect(waitingIdx).toBeLessThan(closeIdx);
-      expect(closeIdx).toBeLessThan(exitIdx);
-   });
-
-   it("emits no logger.info calls after logger.close", async () => {
-      await performGracefulShutdownAfterDrain(fakeServer(), fakeServer(), 0.05);
-
-      const closeIdx = callOrder.indexOf("close");
-      const lateInfoIdx = callOrder.findIndex(
-         (entry, idx) => idx > closeIdx && entry.startsWith("info:"),
-      );
-      expect(closeIdx).toBeGreaterThanOrEqual(0);
-      expect(lateInfoIdx).toBe(-1);
-   });
-
-   it("closes the logger exactly once", async () => {
-      await performGracefulShutdownAfterDrain(fakeServer(), fakeServer(), 0.05);
-
-      const closes = callOrder.filter((entry) => entry === "close").length;
-      expect(closes).toBe(1);
-   });
-
-   it("skips the 'Waiting ...' message when gracefulCloseTimeoutSeconds is 0", async () => {
-      await performGracefulShutdownAfterDrain(fakeServer(), fakeServer(), 0);
-
-      const waitingCalls = callOrder.filter((entry) =>
-         entry.startsWith("info:Waiting"),
-      );
-      expect(waitingCalls.length).toBe(0);
-      expect(callOrder.indexOf("close")).toBeGreaterThanOrEqual(0);
-      expect(callOrder.indexOf("exit")).toBeGreaterThanOrEqual(0);
-   });
-});