@object-ui/data-objectstack 17.2.0 → 17.5.0

package/src/filter-operator-ast-parity.test.ts

@@ -7,7 +7,7 @@
  */
 
 /**
- * Adapter operator table → filter-AST parity (#2901, objectstack#3948).
+ * Adapter operator table → filter-AST parity (#2901, objectstack#3948, #3641).
  *
  * `FILTER_OPERATOR_ALIASES` is the last translation a filter passes through
  * before it goes on the wire, and `normalizeFilterOperator` ends in `?? op` —
@@ -20,7 +20,31 @@
  * `VIEW_FILTER_OPERATORS` — were missing, which is exactly how a stored
  * "close_date before X" view came back unfiltered.
  *
- * These tests pin the table against the spec vocabularies in both directions.
+ * That failure description is historical, and one part of it has moved (measured
+ * for #3641, not assumed): on the published `@objectstack/driver-sql@17.0.0-rc.5`
+ * the array form is lowered by `parseFilterAST()` at the engine and protocol
+ * doors, and an array reaching the driver anyway is refused with a 400
+ * (`unsupportedFilterError`, objectstack#5158) rather than skipped. What the
+ * protocol door does with an array the AST gate REJECTS is not measurable from
+ * this repo, so whether a missing row costs an unfiltered read or a hard 400
+ * today is deliberately left open. Both are a broken query.
+ *
+ * ## What the coverage guarantee rests on (#3641)
+ *
+ * The coverage sweep below used to mirror production's `?? op` tail: resolve the
+ * operator through the table, fall back to the raw view spelling, then ask
+ * whether the result was a member of `VALID_AST_OPERATORS`. That reads as a
+ * coverage assertion and is not one. `VALID_AST_OPERATORS` is derived upstream
+ * from `AST_OPERATOR_MAP`, it grew until it spelled the canonical view operators
+ * verbatim — `before` and `after` included — and from that moment the fallback
+ * arm was always AST-valid. Emptying this entire table left the sweep green, so
+ * the one thing it existed to catch, a missing row, had become invisible to it.
+ *
+ * The sweep therefore asserts the row EXISTS, with no fallback: the header above
+ * says a missing row is an unfiltered query rather than a validation failure, so
+ * a missing row is what is asserted, directly. What the rows resolve TO is a
+ * separate question, kept as its own assertion below — and the pair that
+ * actually regressed is pinned by spelling, not by membership.
  */
 import { describe, it, expect } from 'vitest';
 import { VALID_AST_OPERATORS } from '@objectstack/spec/data';
@@ -30,6 +54,10 @@ import { FILTER_OPERATOR_ALIASES } from './index';
 /**
  * View operators this adapter is not the bridge for — the value-shape ones the
  * view layer resolves to a null comparison before an operator is ever emitted.
+ *
+ * Every token here must still be a member of `VIEW_FILTER_OPERATORS` — the
+ * ratchet below enforces it. Subtracting a name the spec has retired excuses
+ * nothing and must be deleted rather than left as a dead subtraction (#3628).
  */
 const NOT_THIS_ADAPTERS_JOB = new Set(['is_empty', 'is_not_empty']);
 
@@ -39,6 +67,33 @@ describe('FILTER_OPERATOR_ALIASES lands inside the spec AST vocabulary', () => {
     expect(VALID_AST_OPERATORS.size).toBeGreaterThan(0);
   });
 
+  // The exclusion ratchet (#3628). The coverage sweep further down subtracts a
+  // hand-written set from a spec-derived vocabulary, and that subtraction only
+  // excuses something while the spec still lists the subtracted tokens. Once
+  // upstream retires or renames one, the sweep stays green (it is still total
+  // over what remains) but the row becomes dead weight, and its comment goes on
+  // telling the next reader that the view layer resolves this one to a null
+  // comparison — about an operator no author can declare any more. That is the
+  // shape that rotted 37 of 82 deny-list entries in #3601 with nothing to report
+  // it: a hand-written list beside a spec-derived vocabulary and no assertion
+  // that its members still exist in that vocabulary.
+  //
+  // Collected rather than asserted per entry on purpose (same call as PR #3623):
+  // vocabulary retirements land as whole families, and failing on the first entry
+  // would hide the rest.
+  it('every NOT_THIS_ADAPTERS_JOB token is still in the spec view vocabulary', () => {
+    const vocabulary = new Set<string>(VIEW_FILTER_OPERATORS);
+    const retired = [...NOT_THIS_ADAPTERS_JOB].filter((op) => !vocabulary.has(op));
+    expect(
+      retired,
+      `VIEW_FILTER_OPERATORS no longer lists these NOT_THIS_ADAPTERS_JOB tokens: `
+        + `${retired.join(', ')}. The spec has retired them, so subtracting them from `
+        + 'the coverage sweep below excuses nothing — delete each from the set (with '
+        + 'the comment claiming the view layer resolves it) rather than leaving a dead '
+        + 'subtraction',
+    ).toEqual([]);
+  });
+
   it('every alias target is an operator the AST gate accepts', () => {
     const bad = Object.entries(FILTER_OPERATOR_ALIASES)
       .filter(([, target]) => !VALID_AST_OPERATORS.has(String(target).toLowerCase()))
@@ -50,17 +105,26 @@ describe('FILTER_OPERATOR_ALIASES lands inside the spec AST vocabulary', () => {
     ).toEqual([]);
   });
 
-  it('covers every canonical view operator the spec defines', () => {
-    const uncovered = VIEW_FILTER_OPERATORS
+  it('has a mapping row for every canonical view operator the spec defines', () => {
+    // Resolution mirrors `normalizeFilterOperator` — lowercased spelling first,
+    // then the operator as written — but stops short of its `?? op` tail. That
+    // tail is production behaviour and must stay there; reproducing it HERE is
+    // what cancelled this assertion (#3641), because the value it falls back to
+    // is the raw view spelling and the AST vocabulary now accepts all of those.
+    const hasRow = (op: string) =>
+      Object.prototype.hasOwnProperty.call(FILTER_OPERATOR_ALIASES, op.toLowerCase())
+      || Object.prototype.hasOwnProperty.call(FILTER_OPERATOR_ALIASES, op);
+
+    const missing = VIEW_FILTER_OPERATORS
       .filter((op) => !NOT_THIS_ADAPTERS_JOB.has(op))
-      .filter((op) => {
-        const target = FILTER_OPERATOR_ALIASES[op] ?? op;
-        return !VALID_AST_OPERATORS.has(String(target).toLowerCase());
-      });
+      .filter((op) => !hasRow(op));
     expect(
-      uncovered,
-      'an author can declare these on a ViewFilterRule and the spec validates them, '
-        + 'but they reach the wire unmapped and the filter is silently dropped',
+      missing,
+      'FILTER_OPERATOR_ALIASES has no row for these. An author can declare them on a '
+        + 'ViewFilterRule and the spec validates them, so they reach the wire as the raw '
+        + 'view spelling. Do not settle for "the AST gate happens to accept that" — the '
+        + 'gate accepting a spelling is not the driver compiling it into a WHERE clause, '
+        + 'and an unmapped operator is how this adapter shipped an unfiltered query',
     ).toEqual([]);
   });
 

package/src/httpFailureLogging.test.ts

@@ -0,0 +1,109 @@
+/**
+ * objectui#4042 half 2 — a request failure must SAY which request failed.
+ *
+ * `@objectstack/client` reports every non-2xx as
+ * `logger.error("HTTP request failed", undefined, { method, url, status, error })`.
+ * The console's logger used to forward that verbatim, so the identifying
+ * fields lived only in the third argument: anything that flattens a console
+ * record to text rendered them `[object Object]` / `Object`, and a screenful of
+ * failures told you nothing about which URL or which status. These tests pin
+ * that the message string itself now carries method + url + status (+ code).
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { formatHttpFailureMessage, createQuietHttpLogger } from './index';
+
+const META_401 = {
+  method: 'GET',
+  url: '/api/v1/meta/object',
+  status: 401,
+  error: { code: 'UNAUTHORIZED', message: 'Unauthorized' },
+};
+
+describe('formatHttpFailureMessage', () => {
+  it('folds method, url and status into the message', () => {
+    expect(formatHttpFailureMessage('HTTP request failed', META_401)).toBe(
+      'HTTP request failed: GET /api/v1/meta/object -> 401 [UNAUTHORIZED]',
+    );
+  });
+
+  it('omits the code when the body carries none', () => {
+    expect(
+      formatHttpFailureMessage('HTTP request failed', {
+        method: 'POST',
+        url: '/api/v1/data/task',
+        status: 500,
+      }),
+    ).toBe('HTTP request failed: POST /api/v1/data/task -> 500');
+  });
+
+  it('reads the `statusCode` spelling too', () => {
+    expect(
+      formatHttpFailureMessage('HTTP request failed', { url: '/api/v1/meta/app', statusCode: 403 }),
+    ).toBe('HTTP request failed: GET /api/v1/meta/app -> 403');
+  });
+
+  it('returns null — not a husk — when meta identifies nothing', () => {
+    expect(formatHttpFailureMessage('HTTP request failed', undefined)).toBeNull();
+    expect(formatHttpFailureMessage('HTTP request failed', {})).toBeNull();
+    expect(formatHttpFailureMessage('HTTP request failed', { error: { message: 'boom' } })).toBeNull();
+  });
+
+  it('never yields the un-diagnosable string the card reported', () => {
+    const line = formatHttpFailureMessage('HTTP request failed', META_401)!;
+    expect(line).not.toContain('[object Object]');
+    expect(line).toContain('/api/v1/meta/object');
+    expect(line).toContain('401');
+  });
+});
+
+describe('createQuietHttpLogger', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('logs a 401 as an error whose FIRST argument identifies the request', () => {
+    const spy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    createQuietHttpLogger().error('HTTP request failed', undefined, META_401);
+
+    expect(spy).toHaveBeenCalledTimes(1);
+    const [message, , meta] = spy.mock.calls[0];
+    expect(message).toBe('HTTP request failed: GET /api/v1/meta/object -> 401 [UNAUTHORIZED]');
+    // The structured bag is still handed over for DevTools to expand — the
+    // string is added alongside it, not instead of it.
+    expect(meta).toEqual(META_401);
+  });
+
+  it('keeps demoting an expected 404, and identifies it in the demoted line too', () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const debugSpy = vi.spyOn(console, 'debug').mockImplementation(() => {});
+
+    createQuietHttpLogger().error('HTTP request failed', undefined, {
+      method: 'GET',
+      url: '/api/v1/data/sys_presence',
+      status: 404,
+      error: { code: 'OBJECT_NOT_FOUND' },
+    });
+
+    expect(errorSpy).not.toHaveBeenCalled();
+    expect(debugSpy).toHaveBeenCalledTimes(1);
+    expect(debugSpy.mock.calls[0][0]).toContain('/api/v1/data/sys_presence -> 404');
+  });
+
+  it('does NOT silence a 401 — only 404-on-an-optional-collection is demoted', () => {
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const debugSpy = vi.spyOn(console, 'debug').mockImplementation(() => {});
+
+    // Session expiry mid-use: the console gates doomed requests, it does not
+    // hide the ones that still fail.
+    createQuietHttpLogger().error('HTTP request failed', undefined, META_401);
+
+    expect(errorSpy).toHaveBeenCalledTimes(1);
+    expect(debugSpy).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the bare message when there is nothing to identify', () => {
+    const spy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    createQuietHttpLogger().error('Something broke', undefined, undefined);
+
+    expect(spy.mock.calls[0][0]).toBe('Something broke');
+  });
+});