@proteinjs/db 1.35.1 → 1.36.0

package/test/EncryptedColumnsSchema.test.ts

@@ -0,0 +1,172 @@
+import { Table } from '../src/Table';
+import { EncryptionDerivedTableRegistry } from '../src/encryption/EncryptionDerivedTableRegistry';
+import { withRecordColumns, Record } from '../src/Record';
+import { ObjectColumn, ReferenceColumn, StringColumn, UuidColumn } from '../src/Columns';
+import { EncryptedColumns } from '../src/encryption/EncryptedColumns';
+import { EncryptedColumnConfigError } from '../src/encryption/DbEncryptionConfig';
+
+interface Note extends Record {
+  title?: string;
+  body?: string;
+  label?: string;
+  attachments?: string;
+  plain?: string;
+}
+
+const noteTable = (columns: any): Table<Note> =>
+  new (class extends Table<Note> {
+    name = `enc_schema_test_${schemaTestTableCounter++}`;
+    columns = columns;
+  })();
+
+let schemaTestTableCounter = 0;
+
+/**
+ * The schema side of `ColumnOptions.encrypted`: declaration validation (invalid states
+ * rejected loudly), derived companion columns / token table, ciphertext widening, and the
+ * mandatory-declaration gate.
+ */
+describe('EncryptedColumns schema derivation', () => {
+  const encryptedColumns = new EncryptedColumns();
+
+  test('derives companions automatically: MAX widening, equality fingerprint column + index, sort prefix column, token table', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title', { encrypted: { searchable: 'contains' } }),
+        label: new StringColumn('label', { encrypted: { searchable: 'equality', sortKey: { revealPrefix: 3 } } }),
+        body: new ObjectColumn('body', { encrypted: {} }),
+        plain: new StringColumn('plain', { encrypted: false }),
+      })
+    );
+    encryptedColumns.ensureSchema(table);
+
+    // ciphertext outgrows declared widths
+    expect((table.columns.title as StringColumn).maxLength).toBe('MAX');
+    expect((table.columns.label as StringColumn).maxLength).toBe('MAX');
+    // plaintext column untouched
+    expect((table.columns.plain as StringColumn).maxLength).toBe(255);
+
+    // equality fingerprint companion, indexed
+    const eqCompanion = (table.columns as any)[encryptedColumns.eqCompanionProp(table, 'label')];
+    expect(eqCompanion).toBeTruthy();
+    expect(eqCompanion.name).toBe('label_enc_eq');
+    expect(table.indexes.some((index) => index.name === `${table.name}_label_enc_eq_idx`)).toBe(true);
+
+    // sort prefix companion bounded to the declared reveal
+    const sortCompanion = (table.columns as any)[encryptedColumns.sortCompanionProp(table, 'label')];
+    expect(sortCompanion.name).toBe('label_enc_srt');
+    expect(sortCompanion.maxLength).toBe(3);
+
+    // token table registered in the derived registry (tableByName's fallback — the
+    // full tableByName resolution is covered by the driver integration tests, which run
+    // with a real reflection graph)
+    const tokenTable = encryptedColumns.tokenTableFor(table)!;
+    expect(tokenTable.name).toBe(`${table.name}_enc_tok`);
+    expect(EncryptionDerivedTableRegistry.get(tokenTable.name)).toBe(tokenTable);
+
+    // idempotent: a second pass adds nothing
+    const columnCount = Object.keys(table.columns).length;
+    const indexCount = table.indexes.length;
+    encryptedColumns.ensureSchema(table);
+    expect(Object.keys(table.columns).length).toBe(columnCount);
+    expect(table.indexes.length).toBe(indexCount);
+  });
+
+  test('a unique declaration moves onto the equality fingerprint (per-owner value uniqueness)', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        label: new StringColumn('label', {
+          unique: { unique: true },
+          encrypted: { searchable: 'equality' },
+        }),
+      })
+    );
+    encryptedColumns.ensureSchema(table);
+    expect((table.columns.label as StringColumn).options?.unique).toBeUndefined();
+    const eqCompanion = (table.columns as any)[encryptedColumns.eqCompanionProp(table, 'label')];
+    expect(eqCompanion.options.unique.unique).toBe(true);
+  });
+
+  test('rejects: unique without equality declaration (a unique index on ciphertext cannot bite)', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        label: new StringColumn('label', { unique: { unique: true }, encrypted: {} }),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(EncryptedColumnConfigError);
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(/searchable: 'equality'/);
+  });
+
+  test('rejects: encrypted on reference/id columns (metadata by construction)', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        attachments: new ReferenceColumn('attachment', 'other_table', false, { encrypted: {} } as any),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(EncryptedColumnConfigError);
+  });
+
+  test('rejects: searchable/sortKey on serialized-object columns (derivatives cover text, not serialization)', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        body: new ObjectColumn('body', { encrypted: { searchable: 'contains' } }),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(EncryptedColumnConfigError);
+  });
+
+  test('rejects: malformed nested config values', () => {
+    const badSearchable = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title', { encrypted: { searchable: 'fuzzy' } as any }),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(badSearchable)).toThrow(EncryptedColumnConfigError);
+
+    const badReveal = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title', { encrypted: { sortKey: { revealPrefix: 0 } } }),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(badReveal)).toThrow(EncryptedColumnConfigError);
+  });
+
+  test('a rejected declaration stays rejected on every use (no half-applied schema)', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title', { encrypted: { searchable: 'fuzzy' } as any }),
+      })
+    );
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(EncryptedColumnConfigError);
+    expect(() => encryptedColumns.ensureSchema(table)).toThrow(EncryptedColumnConfigError);
+  });
+});
+
+describe('EncryptedColumns mandatory declarations (the sweep-wave gate)', () => {
+  const encryptedColumns = new EncryptedColumns();
+
+  test('a text column without an encrypted declaration fails validation, naming the column', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title'),
+        plain: new StringColumn('plain', { encrypted: false }),
+      })
+    );
+    encryptedColumns.ensureSchema(table);
+    expect(() => encryptedColumns.validateDeclarations(table)).toThrow(EncryptedColumnConfigError);
+    expect(() => encryptedColumns.validateDeclarations(table)).toThrow(/title/);
+  });
+
+  test('declared columns (false or config), id/reference columns, and derived companions pass', () => {
+    const table = noteTable(
+      withRecordColumns<any>({
+        title: new StringColumn('title', { encrypted: { searchable: 'equality' } }),
+        plain: new StringColumn('plain', { encrypted: false }),
+        attachments: new ReferenceColumn('attachment', 'other_table', false),
+        label: new UuidColumn('label'),
+      })
+    );
+    encryptedColumns.ensureSchema(table);
+    expect(() => encryptedColumns.validateDeclarations(table)).not.toThrow();
+  });
+});

package/test/EncryptionEnvelope.test.ts

@@ -0,0 +1,66 @@
+import { randomBytes } from 'crypto';
+import { EncryptionEnvelope } from '../src/encryption/EncryptionEnvelope';
+import { DataKeyMaterial } from '../src/encryption/DataKeyStore';
+import { InMemoryMasterKeyProvider } from '../src/encryption/InMemoryMasterKeyProvider';
+
+const keyFor = (owner: string, version = 1): DataKeyMaterial => ({
+  owner,
+  version,
+  cipherKey: randomBytes(32),
+  indexKey: randomBytes(32),
+});
+
+describe('EncryptionEnvelope', () => {
+  const envelope = new EncryptionEnvelope();
+
+  test('round trip: encrypt -> parse -> decrypt restores the exact plaintext', () => {
+    const key = keyFor('11111111-2222-3333-4444-555555555555', 3);
+    const plaintext = 'Therapy notes — divorce; emoji 🙂 and unicode ünïcode';
+    const stored = envelope.encrypt(plaintext, key);
+    expect(stored.startsWith(EncryptionEnvelope.PREFIX)).toBe(true);
+    expect(stored).not.toContain('Therapy');
+
+    const parsed = envelope.parse(stored)!;
+    expect(parsed.owner).toBe(key.owner);
+    expect(parsed.version).toBe(3);
+    expect(envelope.decrypt(stored, key)).toBe(plaintext);
+  });
+
+  test('self-describing: the envelope names key owner and version (rotation is a rewrite, not a redesign)', () => {
+    const key = keyFor('owner-a', 7);
+    const parsed = envelope.parse(envelope.encrypt('x', key))!;
+    expect(parsed).toMatchObject({ owner: 'owner-a', version: 7 });
+  });
+
+  test('plaintext and non-envelope strings do not parse as envelopes', () => {
+    expect(envelope.parse('an ordinary title')).toBeUndefined();
+    expect(envelope.parse('pjenc:1:not-an-envelope')).toBeUndefined();
+    expect(envelope.parse(null)).toBeUndefined();
+    expect(envelope.parse(42)).toBeUndefined();
+  });
+
+  test('tampered ciphertext fails loudly (GCM auth)', () => {
+    const key = keyFor('owner-a');
+    const stored = envelope.encrypt('sensitive', key);
+    const flipped = stored.slice(0, -2) + (stored.endsWith('AA') ? 'BB' : 'AA');
+    expect(() => envelope.decrypt(flipped, key)).toThrow();
+  });
+
+  test('wrong key fails loudly, never returns garbage', () => {
+    const stored = envelope.encrypt('sensitive', keyFor('owner-a'));
+    expect(() => envelope.decrypt(stored, keyFor('owner-a'))).toThrow();
+  });
+});
+
+describe('InMemoryMasterKeyProvider', () => {
+  test('wrap/unwrap round trip; same secret unwraps across instances; wrong secret fails', async () => {
+    const material = randomBytes(64);
+    const wrapped = await new InMemoryMasterKeyProvider('test-secret').wrapDataKey(material);
+    expect(wrapped).not.toContain(material.toString('base64'));
+
+    const unwrapped = await new InMemoryMasterKeyProvider('test-secret').unwrapDataKey(wrapped);
+    expect(unwrapped.equals(material)).toBe(true);
+
+    await expect(new InMemoryMasterKeyProvider('other-secret').unwrapDataKey(wrapped)).rejects.toThrow();
+  });
+});

package/test/EncryptionQueryContract.test.ts

@@ -0,0 +1,195 @@
+import { QueryBuilder } from '@proteinjs/db-query';
+import { ColumnQueryRuntime, Table } from '../src/Table';
+import { withRecordColumns, Record } from '../src/Record';
+import { StringColumn } from '../src/Columns';
+import { TableQueryTransformProvider } from '../src/TableQueryTransformProvider';
+import { EncryptedColumnQueryError } from '../src/encryption/EncryptedColumnQueryError';
+import { EncryptedColumns } from '../src/encryption/EncryptedColumns';
+
+interface Doc extends Record {
+  title?: string; // encrypted + contains
+  label?: string; // encrypted + equality
+  body?: string; // encrypted, no search
+  sorted?: string; // encrypted + sortKey
+  status?: string; // plaintext
+}
+
+let contractTableCounter = 0;
+const docTable = (): Table<Doc> =>
+  new (class extends Table<Doc> {
+    name = `enc_contract_test_${contractTableCounter++}`;
+    columns = withRecordColumns<Doc>({
+      title: new StringColumn('title', { encrypted: { searchable: 'contains' } }),
+      label: new StringColumn('label', { encrypted: { searchable: 'equality' } }),
+      body: new StringColumn('body', { encrypted: {} }),
+      sorted: new StringColumn('sorted', { encrypted: { sortKey: { revealPrefix: 3 } } }),
+      status: new StringColumn('status', { encrypted: false }),
+    });
+  })();
+
+const runtime: ColumnQueryRuntime = {
+  runAsSystem: false,
+  query: async () => {
+    throw new Error('query runner should not be reached by rejection paths');
+  },
+  systemQuery: async () => {
+    throw new Error('systemQuery runner should not be reached by rejection paths');
+  },
+};
+
+/**
+ * The framework path under test: the column's own query contract
+ * (`Column.queryTransform`, derived by EncryptedColumns.ensureSchema) applied through
+ * db-query's `QueryBuilder.applyColumnTransforms` — exactly as `Db.addColumnQueries`
+ * invokes it.
+ */
+const translate = (table: Table<Doc>, qb: QueryBuilder<Doc>) => {
+  new EncryptedColumns().ensureSchema(table);
+  return qb.applyColumnTransforms(
+    new TableQueryTransformProvider((name) => {
+      if (name !== table.name) {
+        throw new Error(`Unable to find table: ${name}`);
+      }
+      return table;
+    }, runtime)
+  );
+};
+
+/**
+ * THE COMPATIBILITY CONTRACT's rejected set — every out-of-contract shape on an encrypted
+ * column throws at query-build time with an error naming the limitation and the sanctioned
+ * paths ("a limitation a developer cannot hit silently is a contract").
+ */
+describe('Encrypted-column query contract: loud rejections', () => {
+  test('DB-side ORDER BY without a declared sortKey — the spec error, naming the three options', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).sort([{ field: 'title' }]);
+    await expect(translate(table, qb)).rejects.toThrow(EncryptedColumnQueryError);
+
+    const qb2 = new QueryBuilder<Doc>(table.name).sort([{ field: 'title' }]);
+    await expect(translate(table, qb2)).rejects.toThrow(
+      /Cannot ORDER BY encrypted column.*no sortKey declared.*sort by a metadata column.*sort the fetched rows.*revealPrefix/s
+    );
+  });
+
+  test('ORDER BY with a declared sortKey translates onto the reveal-prefix companion', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).sort([{ field: 'sorted', desc: true }]);
+    await translate(table, qb);
+    expect(qb.getSortCriteria()[0].field).toBe(new EncryptedColumns().sortCompanionProp(table, 'sorted'));
+  });
+
+  test('range conditions are rejected', async () => {
+    const table = docTable();
+    for (const operator of ['<', '>', '<=', '>='] as const) {
+      const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'title', operator, value: 'm' });
+      await expect(translate(table, qb)).rejects.toThrow(/range condition/);
+    }
+    const between = new QueryBuilder<Doc>(table.name).condition({
+      field: 'title',
+      operator: 'BETWEEN',
+      value: ['a', 'z'] as any,
+    });
+    await expect(translate(table, between)).rejects.toThrow(EncryptedColumnQueryError);
+  });
+
+  test('LIKE shapes beyond contains/prefix/suffix/exact are rejected', async () => {
+    for (const pattern of ['a%b', '%a%b%', 'a_b', 'a\\%b']) {
+      const table = docTable();
+      const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'title', operator: 'LIKE', value: pattern });
+      await expect(translate(table, qb)).rejects.toThrow(/Supported: contains/);
+    }
+  });
+
+  test('NOT LIKE / negated equality are rejected', async () => {
+    for (const operator of ['NOT LIKE', '<>', '!=', 'NOT IN'] as const) {
+      const table = docTable();
+      const qb = new QueryBuilder<Doc>(table.name).condition({
+        field: 'title',
+        operator,
+        value: operator === 'NOT IN' ? (['x'] as any) : 'x',
+      });
+      await expect(translate(table, qb)).rejects.toThrow(EncryptedColumnQueryError);
+    }
+  });
+
+  test('aggregation over the value (MIN/MAX/SUM/AVG) is rejected; COUNT is native', async () => {
+    for (const fn of ['MIN', 'MAX', 'SUM', 'AVG'] as const) {
+      const table = docTable();
+      const qb = new QueryBuilder<Doc>(table.name).aggregate({ function: fn, field: 'title' });
+      await expect(translate(table, qb)).rejects.toThrow(/Aggregation over/);
+    }
+
+    const countTable = docTable();
+    const countQb = new QueryBuilder<Doc>(countTable.name).aggregate({ function: 'COUNT', resultProp: 'count' });
+    await expect(translate(countTable, countQb)).resolves.toBeUndefined();
+  });
+
+  test('GROUP BY the value is rejected', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).groupBy(['title']);
+    await expect(translate(table, qb)).rejects.toThrow(/GROUP BY/);
+  });
+
+  test('equality without a searchable: equality declaration is rejected, naming the declaration', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'body', operator: '=', value: 'x' });
+    await expect(translate(table, qb)).rejects.toThrow(/searchable: 'equality'/);
+  });
+
+  test('LIKE without a searchable: contains declaration is rejected, naming the declaration', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'body', operator: 'LIKE', value: '%x%' });
+    await expect(translate(table, qb)).rejects.toThrow(/searchable: 'contains'/);
+  });
+
+  test('case-insensitive equality is rejected (fingerprints cover the exact value)', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name);
+    qb.condition({ field: 'label', operator: '=', value: 'x' }, undefined, false);
+    await expect(translate(table, qb)).rejects.toThrow(/case-insensitively/);
+  });
+
+  test('subquery comparison against an encrypted column is rejected', async () => {
+    const table = docTable();
+    const sub = new QueryBuilder<any>('other_table').select({ fields: ['id'] });
+    const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'label', operator: 'IN', value: sub as any });
+    await expect(translate(table, qb)).rejects.toThrow(/subquery/);
+  });
+
+  test('value-CASE ordering (byValues) on an encrypted column is rejected', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).sort([{ field: 'sorted', byValues: ['a', 'b'] }]);
+    await expect(translate(table, qb)).rejects.toThrow(/ORDER BY specific values/);
+  });
+
+  test('null-checks stay native: IS NULL / IS NOT NULL / = null pass through untouched', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name)
+      .condition({ field: 'title', operator: 'IS NULL' })
+      .condition({ field: 'body', operator: 'IS NOT NULL' })
+      .condition({ field: 'label', operator: '=', value: null });
+    await expect(translate(table, qb)).resolves.toBeUndefined();
+  });
+
+  test('everything on OTHER columns is untouched', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name)
+      .condition({ field: 'status', operator: 'LIKE', value: '%anything%' })
+      .sort([{ field: 'status' }])
+      .groupBy(['status'])
+      .aggregate({ function: 'MAX', field: 'status' });
+    await expect(translate(table, qb)).resolves.toBeUndefined();
+  });
+
+  test('LIKE %% (match-any) rewrites to a native IS NOT NULL', async () => {
+    const table = docTable();
+    const qb = new QueryBuilder<Doc>(table.name).condition({ field: 'title', operator: 'LIKE', value: '%%' });
+    await translate(table, qb);
+    const conditionNode: any = qb.graph
+      .nodes()
+      .map((id: string) => qb.graph.node(id))
+      .find((node: any) => node?.type === 'CONDITION');
+    expect(conditionNode.operator).toBe('IS NOT NULL');
+  });
+});

package/test/SearchTokenizer.test.ts

@@ -0,0 +1,67 @@
+import { randomBytes } from 'crypto';
+import { SearchTokenizer } from '../src/encryption/SearchTokenizer';
+
+/**
+ * The token/fingerprint contract behind encrypted contains-search (§ Firmed-up plan,
+ * TRUST_AND_COMPLIANCE): word + trigram + short-prefix tokens at write; per-word fragment
+ * covers at query; HMAC fingerprints computable only with the owner's index key.
+ */
+describe('SearchTokenizer', () => {
+  const tokenizer = new SearchTokenizer();
+
+  test('value tokens: words, trigrams, and 1-2 letter word prefixes', () => {
+    const tokens = tokenizer.tokensForValue('Groceries list');
+    expect(tokens).toContain('w:groceries');
+    expect(tokens).toContain('w:list');
+    // the doc's example trigrams
+    for (const trigram of ['gro', 'roc', 'oce', 'cer', 'eri', 'rie', 'ies']) {
+      expect(tokens).toContain(`t:${trigram}`);
+    }
+    expect(tokens).toContain('p:g');
+    expect(tokens).toContain('p:gr');
+    expect(tokens).toContain('p:l');
+    expect(tokens).toContain('p:li');
+  });
+
+  test('normalization: case folds, punctuation splits words, numbers are word characters', () => {
+    const tokens = tokenizer.tokensForValue('N3xa-Dev NOTES');
+    expect(tokens).toContain('w:n3xa');
+    expect(tokens).toContain('w:dev');
+    expect(tokens).toContain('w:notes');
+  });
+
+  test('query fragments: >=3 char words cover by trigrams; 1-2 char words by word-prefix', () => {
+    const fragments = tokenizer.fragmentsForQuery('cake ry');
+    expect(fragments).toContain('t:cak');
+    expect(fragments).toContain('t:ake');
+    expect(fragments).toContain('p:ry');
+    expect(fragments).not.toContain('t:ry');
+  });
+
+  test('a true substring match always covers: value tokens superset query fragments (>=3 char words)', () => {
+    // "cake factory" appears inside "pancake factory list" — every query fragment must be
+    // present in the value's token set, or the index would miss a true match.
+    const valueTokens = new Set(tokenizer.tokensForValue('Pancake factory list'));
+    for (const fragment of tokenizer.fragmentsForQuery('cake factory')) {
+      expect(valueTokens.has(fragment)).toBe(true);
+    }
+  });
+
+  test('fingerprints are keyed: same token, different keys, unrelated fingerprints', () => {
+    const keyA = randomBytes(32);
+    const keyB = randomBytes(32);
+    expect(tokenizer.fingerprint('w:divorce', keyA)).not.toBe(tokenizer.fingerprint('w:divorce', keyB));
+    expect(tokenizer.fingerprint('w:divorce', keyA)).toBe(tokenizer.fingerprint('w:divorce', keyA));
+  });
+
+  test('equality fingerprint covers the exact value (case-exact, distinct from token space)', () => {
+    const key = randomBytes(32);
+    expect(tokenizer.equalityFingerprint('Divorce', key)).not.toBe(tokenizer.equalityFingerprint('divorce', key));
+    expect(tokenizer.equalityFingerprint('divorce', key)).not.toBe(tokenizer.fingerprint('w:divorce', key));
+  });
+
+  test('sort prefix: normalized first N characters, nothing else', () => {
+    expect(tokenizer.sortPrefix('Therapy notes', 3)).toBe('the');
+    expect(tokenizer.sortPrefix('ab', 3)).toBe('ab');
+  });
+});

package/test/reusable/CascadeDeleteTests.ts

@@ -42,8 +42,8 @@ export const cascadeDeleteTests = (
     const db = new Db(driver, undefined, transactionContextFactory);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     /**
      * -------------------- Cascade Delete (holder → referenced) --------------------

package/test/reusable/ColumnTypesTests.ts

@@ -11,8 +11,8 @@ export const columnTypeTests = (
     const db = new Db(driver, undefined, transactionContextFactory);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     test('Insert record with all null values', async () => {
       const testRecord: Omit<TestRecord, keyof Record> = {

package/test/reusable/CrudTests.ts

@@ -12,8 +12,8 @@ export const crudTests = (
     const db = new Db(driver, undefined, transactionContextFactory);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     test('Insert', async () => {
       const testEmployee: Omit<Employee, keyof Record> = { name: 'Veronica' };

package/test/reusable/DynamicReferenceColumnTests.ts

@@ -14,8 +14,8 @@ export const dynamicReferenceColumnTests = (driver: DbDriver, dropTable: (table:
     const db = new Db(driver);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     test('should handle references to different types', async () => {
       // Create an engineer

package/test/reusable/PreloadReferencesTests.ts

@@ -27,8 +27,8 @@ export const preloadReferencesTests = (driver: DbDriver, dropTable: (table: Tabl
     const db = new Db(countingDriver);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     test('preload hydrates dynamic references with one query per referenced table', async () => {
       const engineerA = await db.insert(dynamicReferenceTestTables.Engineer, {

package/test/reusable/RecordIteratorTests.ts

@@ -33,8 +33,8 @@ export const recordIteratorTests = (
     const table = recordIteratorTestTables.IterationRow;
     const WINDOW = 3;
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     beforeEach(async () => {
       await db.delete(

package/test/reusable/TableManagerTests.ts

@@ -34,8 +34,8 @@ export const tableManagerTests = (
     const tableManager = driver.getTableManager();
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     afterEach(async () => {
       await dropTable(tableManagerTestTables.ColumnTypes);

package/test/reusable/TransactionTests.ts

@@ -16,8 +16,8 @@ export const transactionTests = (
     const db = new Db(driver, undefined, transactionContextFactory);
     const testEnv = new DbTestEnvironment(driver, dropTable);
 
-    beforeAll(async () => await testEnv.beforeAll(), 30000);
-    afterAll(async () => await testEnv.afterAll(), 30000);
+    beforeAll(async () => await testEnv.beforeAll(), 120000);
+    afterAll(async () => await testEnv.afterAll(), 120000);
 
     test('Transaction with successful operations', async () => {
       const testEmployee1: Omit<TransactionEmployee, keyof Record> = {