@palbase/backend 23.0.0 → 23.1.0

package/dist/test/index.js

@@ -1,5 +1,111 @@
 import "../chunk-7D4SUZUM.js";
 
+// ../core/dist/index.js
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var POW_CHALLENGE_ID_HEADER = "X-PoW-Challenge-ID";
+var POW_NONCE_HEADER = "X-PoW-Nonce";
+function asPowChallenge(details) {
+  if (typeof details !== "object" || details === null) return null;
+  const env = details;
+  if (env.error !== "pow_required") return null;
+  const c = env.challenge;
+  if (typeof c !== "object" || c === null) return null;
+  const { id, prefix, difficulty } = c;
+  if (typeof id !== "string" || typeof prefix !== "string") return null;
+  if (typeof difficulty !== "number" || !Number.isInteger(difficulty) || difficulty < 0) return null;
+  return { id, prefix, difficulty };
+}
+var encoder = new TextEncoder();
+var hasher = null;
+async function digester() {
+  if (hasher) return hasher;
+  const runtime = globalThis;
+  const nodeish = runtime.process?.versions?.node !== void 0 || runtime.process?.versions?.bun !== void 0;
+  if (nodeish) {
+    try {
+      const mod = await import(
+        /* @vite-ignore */
+        `${"node:"}crypto`
+      );
+      if (typeof mod.createHash === "function") {
+        const createHash = mod.createHash;
+        hasher = (input) => new Uint8Array(createHash("sha256").update(input).digest());
+        return hasher;
+      }
+    } catch {
+    }
+  }
+  hasher = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(input)));
+  return hasher;
+}
+var now = () => typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+function leadingZeroBits(hash) {
+  let bits = 0;
+  for (const byte of hash) {
+    if (byte === 0) {
+      bits += 8;
+      continue;
+    }
+    return bits + Math.clz32(byte) - 24;
+  }
+  return bits;
+}
+var MAX_POW_DIFFICULTY = 24;
+function powBudget(difficulty) {
+  return 8 * 2 ** difficulty;
+}
+var POW_TIME_BUDGET_MS = 12e4;
+var CALIBRATION_WARMUP = 1024;
+var CALIBRATION_END = 9216;
+async function solvePowChallenge(challenge, maxIterations = powBudget(challenge.difficulty), signal) {
+  if (challenge.difficulty > MAX_POW_DIFFICULTY) {
+    throw new Error(
+      `proof-of-work: refusing difficulty ${challenge.difficulty}; this client attempts at most ${MAX_POW_DIFFICULTY}, which is the highest a Palbase stack issues`
+    );
+  }
+  const digest = await digester();
+  let warmedAt = 0;
+  let calibrated = false;
+  let deadline = Number.POSITIVE_INFINITY;
+  for (let nonce = 0; nonce < maxIterations; nonce++) {
+    if ((nonce & 1023) === 0) {
+      if (signal?.aborted) {
+        throw new DOMException("proof-of-work solve aborted", "AbortError");
+      }
+      if (now() > deadline) {
+        throw new Error(
+          `proof-of-work: gave up on difficulty ${challenge.difficulty} after ${POW_TIME_BUDGET_MS / 1e3}s and ${nonce.toLocaleString()} attempts \u2014 the tail this run drew is longer than the allowance`
+        );
+      }
+    }
+    if (nonce === CALIBRATION_WARMUP) {
+      warmedAt = now();
+    }
+    if (!calibrated && nonce === CALIBRATION_END) {
+      calibrated = true;
+      const elapsed = Math.max(now() - warmedAt, 1e-3);
+      const rate = (CALIBRATION_END - CALIBRATION_WARMUP) / (elapsed / 1e3);
+      const expectedMs = 2 ** challenge.difficulty / rate * 1e3;
+      if (expectedMs > POW_TIME_BUDGET_MS) {
+        throw new Error(
+          `proof-of-work: difficulty ${challenge.difficulty} needs about ${Math.round(expectedMs / 1e3)}s here (${Math.round(rate).toLocaleString()} digests/s) and this client allows ${POW_TIME_BUDGET_MS / 1e3}s; refusing before spending the time rather than after`
+        );
+      }
+      deadline = now() + (POW_TIME_BUDGET_MS - (now() - warmedAt));
+    }
+    const hash = await digest(challenge.prefix + nonce);
+    if (leadingZeroBits(hash) >= challenge.difficulty) {
+      return {
+        [POW_CHALLENGE_ID_HEADER]: challenge.id,
+        [POW_NONCE_HEADER]: String(nonce)
+      };
+    }
+  }
+  throw new Error(
+    `proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`
+  );
+}
+
 // src/test/api.ts
 var TestApiError = class extends Error {
   status;
@@ -27,24 +133,45 @@ function required(value, envName) {
   }
   return value;
 }
+function isLocalTarget(baseUrl) {
+  try {
+    const { hostname } = new URL(baseUrl);
+    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]" || hostname === "::1";
+  } catch {
+    return false;
+  }
+}
+function secondsUntilExpiry(token) {
+  const body = token.split(".")[1];
+  if (!body) return null;
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return typeof claims.exp === "number" ? claims.exp - Math.floor(Date.now() / 1e3) : null;
+  } catch {
+    return null;
+  }
+}
 function createTestApi(config) {
   const baseUrl = required(config.baseUrl, "PALBASE_TEST_BASE_URL").replace(/\/$/, "");
   const apiKey = required(config.apiKey, "PALBASE_TEST_API_KEY");
-  const candidateToken = required(config.candidateToken, "PALBASE_TEST_CANDIDATE");
+  const local = isLocalTarget(baseUrl);
+  const candidateToken = local ? config.candidateToken ?? "" : required(config.candidateToken ?? "", "PALBASE_TEST_CANDIDATE");
+  const doFetch = config.fetch ?? fetch;
   const requests = [];
   let bearer = null;
   async function call(method, path, body, opts = {}) {
     const headers = {
       apikey: apiKey,
       // Selects the release under test. Omit it and the gateway serves the LIVE
-      // one, which would make the whole suite grade the wrong code.
-      "x-palbase-candidate": candidateToken,
+      // one, which would make the whole suite grade the wrong code. Absent only
+      // against a local stack, which has a single version.
+      ...candidateToken ? { "x-palbase-candidate": candidateToken } : {},
       ...opts.headers
     };
     if (bearer) headers.authorization = `Bearer ${bearer}`;
     if (body !== void 0) headers["content-type"] = "application/json";
     const startedAt = Date.now();
-    const res = await fetch(`${baseUrl}${path}`, {
+    const res = await doFetch(`${baseUrl}${path}`, {
       method,
       headers,
       body: body === void 0 ? void 0 : JSON.stringify(body)
@@ -52,7 +179,18 @@ function createTestApi(config) {
     const text = await res.text();
     const parsed = text ? safeParse(text) : void 0;
     requests.push({ method, path, status: res.status, ms: Date.now() - startedAt });
-    if (!res.ok) throw new TestApiError(method, path, res.status, parsed);
+    if (!res.ok) {
+      if (res.status === 401 && bearer) {
+        const left = secondsUntilExpiry(bearer);
+        if (left !== null && left <= 0) {
+          throw new TestApiError(method, path, res.status, {
+            error: "access_token_expired",
+            error_description: `this run's access token EXPIRED ${Math.abs(left)}s ago \u2014 a test identity is minted for the length of ONE deploy, so a saved token does not survive to the next run. Re-mint it (\`palbase test-user create --json\`, or let \`palbase test\` do it) and run again.`
+          });
+        }
+      }
+      throw new TestApiError(method, path, res.status, parsed);
+    }
     return parsed;
   }
   return {
@@ -84,11 +222,21 @@ function createTestApi(config) {
       return this.signIn(identity);
     },
     async signIn(credentials) {
-      const result = await call(
+      const attempt = async (extra) => call(
         "POST",
         "/auth/login",
-        credentials
+        credentials,
+        extra ? { headers: extra } : {}
       );
+      let result;
+      try {
+        result = await attempt();
+      } catch (e) {
+        const refusal = e;
+        const challenge = refusal.status === 403 ? asPowChallenge(refusal.body) : null;
+        if (!challenge) throw e;
+        result = await attempt(await solvePowChallenge(challenge));
+      }
       bearer = result.access_token;
       return result.user ?? { id: "" };
     },
@@ -128,9 +276,333 @@ var api = new Proxy({}, {
     return Reflect.get(configured, prop, configured);
   }
 });
+
+// src/__tests__/helpers/mock-db.ts
+function createMockDB() {
+  const store = /* @__PURE__ */ new Map();
+  const tracked = {
+    inserted: /* @__PURE__ */ new Map(),
+    updated: /* @__PURE__ */ new Map(),
+    deleted: /* @__PURE__ */ new Map()
+  };
+  function rowsOf(table) {
+    let rows = store.get(table);
+    if (!rows) {
+      rows = [];
+      store.set(table, rows);
+    }
+    return rows;
+  }
+  function track(map, table, row) {
+    const list = map.get(table);
+    if (list) list.push(row);
+    else map.set(table, [row]);
+  }
+  const ops = {
+    async search(_table, _params) {
+      return [];
+    },
+    async similar() {
+      return [];
+    },
+    async recommend() {
+      return [];
+    },
+    async supersede(_table, _id, row) {
+      return { id: crypto.randomUUID(), ...row };
+    },
+    async query(_sql, _params) {
+      return [];
+    },
+    async insert(table, data) {
+      const record = { id: crypto.randomUUID(), ...data };
+      rowsOf(table).push(record);
+      track(tracked.inserted, table, record);
+      return record;
+    },
+    // Same semantics the engine's SQL has: match on the conflict columns, update
+    // everything else, and return the resulting row either way.
+    async upsert(table, data, opts) {
+      if (opts.onConflict.length === 0) {
+        throw new Error(`upsert into ${table}: onConflict en az bir kolon ad\u0131 ister`);
+      }
+      const rows = rowsOf(table);
+      const existing = rows.find((r) => opts.onConflict.every((c) => r[c] === data[c]));
+      if (existing) {
+        for (const [k, v] of Object.entries(data)) {
+          if (!opts.onConflict.includes(k)) existing[k] = v;
+        }
+        return existing;
+      }
+      const record = { id: crypto.randomUUID(), ...data };
+      rows.push(record);
+      track(tracked.inserted, table, record);
+      return record;
+    },
+    async update(table, id, data) {
+      const rows = store.get(table) ?? [];
+      const idx = rows.findIndex((r) => r["id"] === id);
+      const updated = idx >= 0 ? { ...rows[idx], ...data } : { id, ...data };
+      if (idx >= 0) {
+        rows[idx] = updated;
+      }
+      track(tracked.updated, table, updated);
+      return updated;
+    },
+    async delete(table, id) {
+      const rows = store.get(table) ?? [];
+      const idx = rows.findIndex((r) => r["id"] === id);
+      if (idx >= 0) rows.splice(idx, 1);
+      const list = tracked.deleted.get(table);
+      if (list) list.push(id);
+      else tracked.deleted.set(table, [id]);
+    },
+    async findById(table, id) {
+      const rows = store.get(table) ?? [];
+      return rows.find((r) => r["id"] === id) ?? null;
+    },
+    // The SAME filter language the engine compiles to SQL: a plain value is
+    // equality, an object is an operator set. A fake that understood less would
+    // pass a service test that the live database then fails — which is the one
+    // thing a stand-in must never do.
+    async findMany(table, query, opts) {
+      const rows = store.get(table) ?? [];
+      const matches2 = (row, key, cond) => {
+        if (cond !== null && typeof cond === "object" && !Array.isArray(cond)) {
+          return Object.entries(cond).every(([op, v]) => {
+            const cell = row[key];
+            switch (op) {
+              case "in":
+                return Array.isArray(v) && v.includes(cell);
+              case "neq":
+                return cell !== v;
+              case "gt":
+                return cell > v;
+              case "gte":
+                return cell >= v;
+              case "lt":
+                return cell < v;
+              case "lte":
+                return cell <= v;
+              default:
+                throw new Error(`findMany(${table}): where.${key} bilinmeyen operat\xF6r "${op}"`);
+            }
+          });
+        }
+        return row[key] === cond;
+      };
+      let out = query ? rows.filter((row) => Object.entries(query).every(([k, c]) => matches2(row, k, c))) : [...rows];
+      const order = opts?.orderBy;
+      if (order) {
+        const dir = order.direction === "desc" ? -1 : 1;
+        out = [...out].sort((a, b) => {
+          const x = a[order.column];
+          const y = b[order.column];
+          return x === y ? 0 : (x < y ? -1 : 1) * dir;
+        });
+      }
+      return opts?.limit === void 0 ? out : out.slice(0, opts.limit);
+    }
+  };
+  async function txPlan(plan) {
+    const snapshot = /* @__PURE__ */ new Map();
+    for (const [table, rows] of store) snapshot.set(table, [...rows]);
+    const trackedSnapshot = {
+      inserted: cloneTracked(tracked.inserted),
+      updated: cloneTracked(tracked.updated),
+      deleted: new Map([...tracked.deleted].map(([k, v]) => [k, [...v]]))
+    };
+    const results = [];
+    try {
+      for (const op of plan.ops) {
+        const result = applyOp(op, results);
+        results.push(result);
+        const failure = guardFailure(op.guard, result.rows.length);
+        if (failure) throw failure;
+      }
+    } catch (err) {
+      store.clear();
+      for (const [table, rows] of snapshot) store.set(table, rows);
+      tracked.inserted = trackedSnapshot.inserted;
+      tracked.updated = trackedSnapshot.updated;
+      tracked.deleted = trackedSnapshot.deleted;
+      throw err;
+    }
+    return { results };
+  }
+  function applyOp(op, results) {
+    switch (op.op) {
+      case "upsert": {
+        const values = resolveMap(op.values ?? {}, results, null);
+        const conflict = op.onConflict ?? [];
+        const rows = rowsOf(op.table);
+        const hit = rows.find((r) => conflict.every((c) => r[c] === values[c]));
+        if (hit) {
+          for (const [key, value] of Object.entries(values)) {
+            if (!conflict.includes(key)) hit[key] = value;
+          }
+          return { rows: [hit], rows_affected: 1 };
+        }
+        const created = { id: crypto.randomUUID(), ...values };
+        rows.push(created);
+        track(tracked.inserted, op.table, created);
+        return { rows: [created], rows_affected: 1 };
+      }
+      case "insert": {
+        const record = { id: crypto.randomUUID(), ...resolveMap(op.values ?? {}, results, null) };
+        rowsOf(op.table).push(record);
+        track(tracked.inserted, op.table, record);
+        return { rows: [record], rows_affected: 1 };
+      }
+      case "insertMany": {
+        const written = (op.rows ?? []).map((row) => {
+          const record = { id: crypto.randomUUID(), ...resolveMap(row, results, null) };
+          rowsOf(op.table).push(record);
+          track(tracked.inserted, op.table, record);
+          return record;
+        });
+        return { rows: written, rows_affected: written.length };
+      }
+      case "update": {
+        const rows = rowsOf(op.table);
+        const where = resolveMap(op.where ?? {}, results, null);
+        const written = [];
+        for (let i = 0; i < rows.length; i++) {
+          const row = rows[i];
+          if (!row || !matches(row, where)) continue;
+          const next = { ...row, ...resolveMap(op.set ?? {}, results, row) };
+          rows[i] = next;
+          track(tracked.updated, op.table, next);
+          written.push(next);
+        }
+        return { rows: written, rows_affected: written.length };
+      }
+      case "delete": {
+        const rows = rowsOf(op.table);
+        const where = resolveMap(op.where ?? {}, results, null);
+        const removed = rows.filter((row) => matches(row, where));
+        for (const row of removed) {
+          rows.splice(rows.indexOf(row), 1);
+          const id = row["id"];
+          const list = tracked.deleted.get(op.table);
+          const key = typeof id === "string" ? id : String(id);
+          if (list) list.push(key);
+          else tracked.deleted.set(op.table, [key]);
+        }
+        return { rows: removed, rows_affected: removed.length };
+      }
+      case "select": {
+        const where = resolveMap(op.where ?? {}, results, null);
+        let found = rowsOf(op.table).filter((row) => matches(row, where));
+        if (op.limit !== void 0) found = found.slice(0, op.limit);
+        return { rows: found, rows_affected: found.length };
+      }
+    }
+  }
+  const client = {
+    ...ops,
+    // No real savepoint in memory: the fake runs the callback against the SAME
+    // store. An assertion about rollback here would be asserting the fake.
+    attempt: (fn) => fn(ops),
+    txPlan,
+    // In tests there is no real DB role; `asService()` returns the same
+    // in-memory client so RLS-bypass code paths still hit the same store and
+    // tracking maps. The omitted `asService` matches the contract (no
+    // double-bypass), so callers can't recurse.
+    asService() {
+      return client;
+    },
+    inserted(table) {
+      return tracked.inserted.get(table) ?? [];
+    },
+    updated(table) {
+      return tracked.updated.get(table) ?? [];
+    },
+    deleted(table) {
+      return tracked.deleted.get(table) ?? [];
+    },
+    seed(table, data) {
+      store.set(table, [...data]);
+    }
+  };
+  return client;
+}
+function cloneTracked(map) {
+  return new Map([...map].map(([k, v]) => [k, [...v]]));
+}
+function resolveValue(value, results, current, column) {
+  if (typeof value !== "object" || value === null) return value;
+  const tagged = value;
+  if (tagged.$ref) {
+    const row = results[tagged.$ref.op]?.rows[0];
+    if (!row) {
+      throw txRejection(409, "tx_ref_unresolved", {
+        message: `operation ${tagged.$ref.op} produced no row to reference`
+      });
+    }
+    return row[tagged.$ref.field];
+  }
+  if (tagged.$expr) {
+    const fn = tagged.$expr["fn"];
+    if (fn === "now") return (/* @__PURE__ */ new Date()).toISOString();
+    const by = Number(tagged.$expr["by"]);
+    const base = Number(current?.[column] ?? 0);
+    return fn === "dec" ? base - by : base + by;
+  }
+  return value;
+}
+function resolveMap(map, results, current) {
+  const out = {};
+  for (const [key, value] of Object.entries(map)) {
+    out[key] = resolveValue(value, results, current, key);
+  }
+  return out;
+}
+function matches(row, where) {
+  return Object.entries(where).every(
+    ([key, value]) => value === null ? row[key] === null || row[key] === void 0 : row[key] === value
+  );
+}
+function guardFailure(guard, count) {
+  if (!guard) return null;
+  const ok = guard.kind === "one" ? count === 1 : guard.kind === "none" ? count === 0 : guard.kind === "atLeast" ? count >= guard.n : count <= guard.n;
+  if (ok) return null;
+  return txRejection(409, "tx_guard_failed", {
+    slot: guard.slot,
+    message: `expected ${guard.kind} ${guard.n} row(s), got ${count}`
+  });
+}
+function txRejection(status, code, extra) {
+  const err = new Error(extra.message);
+  err.status = status;
+  err.error_code = code;
+  if (extra.slot !== void 0) err.slot = extra.slot;
+  return err;
+}
+
+// src/test/fake-db.ts
+function fakeDatabase() {
+  const mock = createMockDB();
+  const queries = [];
+  const db = Object.assign(Object.create(Object.getPrototypeOf(mock)), mock, {
+    query: async (sql, params = []) => {
+      queries.push({ sql, params });
+      return mock.query(sql, params);
+    }
+  });
+  return {
+    db,
+    queries,
+    seed: (table, rows) => mock.seed(table, rows),
+    inserted: (table) => mock.inserted(table),
+    updated: (table) => mock.updated(table),
+    deleted: (table) => mock.deleted(table)
+  };
+}
 export {
   TestApiError,
   api,
-  createTestApi
+  createTestApi,
+  fakeDatabase
 };
 //# sourceMappingURL=index.js.map