@quickservicets/core 0.1.0 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quickservicets/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The QuickService.ts runtime: build typed, validated and documented REST APIs on Bun from TypeScript entity types.",
   "keywords": [
     "quickservicets",

package/src/adapters/mongodb.ts

@@ -97,8 +97,10 @@ export function toFilter(conditions: Condition[], entity?: EntityModel): Filter<
     entity?.fields.some((field) => field.name === condition.field && field.type === "refArray") ?? false;
   const one = (condition: Condition): Document => {
     if (isConditionGroup(condition)) {
-      // An empty AND matches everything; an empty OR matches nothing.
-      if (condition.conditions.length === 0) return condition.group === "or" ? { _id: { $in: [] } } : {};
+      // An empty AND matches everything, so its negation matches nothing; an empty OR matches nothing.
+      if (condition.conditions.length === 0) return condition.group === "and" ? {} : { _id: { $in: [] } };
+      // $nor also matches documents where a compared field is null or missing.
+      if (condition.group === "not") return { $nor: [condition.conditions.length === 1 ? one(condition.conditions[0]!) : { $and: condition.conditions.map(one) }] };
       return { [condition.group === "or" ? "$or" : "$and"]: condition.conditions.map(one) };
     }
     return isRelation(condition) ? translateArray(condition) : translate(condition);

package/src/adapters/postgres-conditions.ts

@@ -140,6 +140,16 @@ function translateField(out: Translation, condition: FieldCondition): void {
 }
 
 function translate(out: Translation, condition: Condition): void {
+  if (isConditionGroup(condition) && condition.group === "not") {
+    out.key += "not(";
+    // IS NOT TRUE also matches when the inner condition is NULL, as it is for comparisons with a NULL column.
+    out.emit("(");
+    if (condition.conditions.length === 0) out.emit("(1 = 1)");
+    else translateAll(out, condition.conditions, " and ");
+    out.emit(" is not true)");
+    out.key += ")";
+    return;
+  }
   if (isConditionGroup(condition)) {
     const or = condition.group === "or";
     out.key += or ? "or(" : "and(";

package/src/app.ts

@@ -202,7 +202,7 @@ export function createApp({ models, crudRoutes, endpoints: allEndpoints, hooks,
     populateMaxDepth: config.populate?.maxDepth,
     fileAccess,
     fileCleanup,
-    findAllMax: config.repositories?.findAllMax,
+    toArrayMax: config.repositories?.toArrayMax,
   });
   const hooksByRoute = new Map(crudRoutes.map((entry) => [`${entry.method} ${entry.path}`, entry.hooks]));
   const uploads = { storage: config.storage, files: config.files };

package/src/config.ts

@@ -70,8 +70,8 @@ export interface ServiceConfig extends NativeFeatures {
   };
   /** Repository settings. */
   repositories?: {
-    /** Most records a fluent query's `all()` may return (default 10000). */
-    findAllMax?: number;
+    /** Most records a fluent query's `toArray()` may return (default 10000). */
+    toArrayMax?: number;
   };
   /** Populate settings. */
   populate?: {
@@ -321,6 +321,9 @@ function resolveLifecycle(config: ServiceConfig): ResolvedConfig["lifecycle"] {
   return resolved;
 }
 
+/** The error for the config key the fluent query's `toArray()` replaced. */
+export const FIND_ALL_MAX_RENAMED = "repositories.findAllMax was renamed to repositories.toArrayMax";
+
 export function resolveConfig(
   config: ServiceConfig,
   env: Record<string, string | undefined> = process.env,
@@ -331,6 +334,7 @@ export function resolveConfig(
   if (!config || typeof config !== "object" || !config.database) {
     throw new ConfigError("Invalid config: database is required");
   }
+  if (Object.hasOwn(config.repositories ?? {}, "findAllMax")) throw new ConfigError(FIND_ALL_MAX_RENAMED);
   // Variables win over aliases, which win over the config's values; the environment is read only here.
   const environment = applyEnvironment(config as unknown as Record<string, unknown>, env, activeFeatureDefinitions());
   config = environment.config as unknown as ServiceConfig;

package/src/environment.ts

@@ -53,7 +53,7 @@ export const CONFIG_OVERRIDES: readonly ConfigOverride[] = [
   { path: "files.deleteOnRemove", schema: boolean() },
   { path: "files.deleteReplaced", schema: boolean() },
   { path: "files.deleteWithOwner", schema: boolean() },
-  { path: "repositories.findAllMax", schema: integer().min(1) },
+  { path: "repositories.toArrayMax", schema: integer().min(1) },
   { path: "populate.maxDepth", schema: integer().min(1) },
   { path: "migrations.autoInDev", schema: boolean() },
   { path: "jobs.enabled", schema: boolean(), alias: { name: "JOBS_ENABLED" } },

package/src/fluent-query.ts

@@ -19,6 +19,14 @@ export class QueryCondition {
     return new QueryCondition([{ group: "or", conditions: [this.single(), other.single()] }]);
   }
 
+  /**
+   * Every record for which this condition is not true, including records where a compared field is null or missing:
+   * `a.and(b).not()` is `NOT (a AND b)`.
+   */
+  not(): QueryCondition {
+    return new QueryCondition([{ group: "not", conditions: [this.single()] }]);
+  }
+
   /** The conditions as one: itself when there is one, an AND group otherwise. */
   private single(): Condition {
     return this.conditions.length === 1 ? this.conditions[0]! : { group: "and", conditions: [...this.conditions] };
@@ -287,24 +295,37 @@ export interface Query<T, R = Record<never, never>, M = never> {
   thenBy(lambda: SortLambda<T>): Query<T, R, M>;
   /** Adds a further sort field in descending order. */
   thenByDescending(lambda: SortLambda<T>): Query<T, R, M>;
-  /** Leaves out the first `count` results (not applied to `count()` and `any()`). */
+  /** Leaves out the first `count` results (not applied to `count()`, `any()`, `all()` and `none()`). */
   skip(count: number): Query<T, R, M>;
-  /** Returns at most `count` results (not applied to `count()` and `any()`). */
+  /** Returns at most `count` results (not applied to `count()`, `any()`, `all()` and `none()`). */
   take(count: number): Query<T, R, M>;
   /** Returns only these fields plus `id`. */
   select<K extends keyof T & string>(...fields: K[]): Query<Pick<T, K | ("id" & keyof T)>, R, M>;
   /** Replaces reference paths with the referenced records, e.g. `include("profiles.permissions.module")`. */
   include<const P extends readonly PopulatePath<R>[]>(...paths: P): Query<Populated<T, R, P[number]>, Record<never, never>, M>;
-  /** Every match; throws when there are more than `repositories.findAllMax`. */
-  all(): Promise<T[]>;
+  /** Every match; throws when there are more than `repositories.toArrayMax`. */
+  toArray(): Promise<T[]>;
   /** The first match, or 404 `<Entity> not found`. */
   first(): Promise<T>;
   /** The first match, or null. */
   firstOrDefault(): Promise<T | null>;
   /** The number of matches, without loading records. */
   count(): Promise<number>;
-  /** Whether at least one record matches, without loading records. */
-  any(): Promise<boolean>;
+  /**
+   * Whether at least one match exists, or with a condition, whether at least one match satisfies it, without loading
+   * records.
+   */
+  any(lambda?: QueryLambda<T>): Promise<boolean>;
+  /**
+   * Whether every match satisfies the condition (true when nothing matches), answered by the database in one round trip
+   * without loading records.
+   */
+  all(lambda: QueryLambda<T>): Promise<boolean>;
+  /**
+   * Whether no match exists, or with a condition, whether no match satisfies it (`!(await any(lambda))`), without
+   * loading records.
+   */
+  none(lambda?: QueryLambda<T>): Promise<boolean>;
   /** `{ data, total, limit, offset }` like the generated list routes. */
   page(options?: PageOptions): Promise<{ data: T[]; total: number; limit: number; offset: number }>;
   /**
@@ -318,7 +339,7 @@ export interface Query<T, R = Record<never, never>, M = never> {
 /** What a query needs from its repository. */
 export interface QueryBackend {
   model: EntityModel;
-  findAllMax: number;
+  toArrayMax: number;
   /** A page of matches; `withTotal` false skips counting them (`total` is then the page size). */
   list(query: ListQuery, populate: string[], withTotal: boolean): Promise<{ data: Record<string, unknown>[]; total: number }>;
   count(where: Condition[]): Promise<number>;
@@ -372,7 +393,7 @@ function nonNegative(method: string, count: number): number {
 
 /** A query over the backend's records with the given state; every method returns a new query. */
 export function createQuery<T, R = Record<never, never>, M = never>(backend: QueryBackend, state: QueryState): Query<T, R, M> {
-  const { model, findAllMax } = backend;
+  const { model, toArrayMax } = backend;
   const next = (changes: Partial<QueryState>) => createQuery<T, R, M>(backend, { ...state, ...changes });
   const keyOf = (lambda: SortLambda<T>) => {
     const key = lambda(sortKeys(model) as unknown as SortFields<T>);
@@ -391,6 +412,8 @@ export function createQuery<T, R = Record<never, never>, M = never>(backend: Que
     return { ...result, data: shape(result.data) };
   };
   const count = () => backend.count(state.where);
+  const any = async (lambda?: QueryLambda<T>) =>
+    (await (lambda === undefined ? count() : backend.count([...state.where, ...conditionsOf(model, lambda)]))) > 0;
   return {
     where: (lambda) => next({ where: [...state.where, ...conditionsOf(model, lambda)] }),
     orderBy: (lambda) => next({ sort: [{ field: keyOf(lambda), direction: "asc" }] }),
@@ -401,13 +424,13 @@ export function createQuery<T, R = Record<never, never>, M = never>(backend: Que
     take: (value) => next({ take: nonNegative("take", value) }),
     select: (...fields) => createQuery(backend, { ...state, select: fields }) as never,
     include: (...paths) => createQuery(backend, { ...state, include: [...new Set([...(state.include ?? []), ...paths])] }) as never,
-    async all() {
+    async toArray() {
       // One record past the cap shows there are too many, without counting the matches.
-      const limit = Math.min(state.take ?? Number.POSITIVE_INFINITY, findAllMax + 1);
+      const limit = Math.min(state.take ?? Number.POSITIVE_INFINITY, toArrayMax + 1);
       if (limit === 0) return [];
       const { data } = await read(limit, state.skip);
-      if (data.length > findAllMax) {
-        throw new Error(`Query on ${model.entityName} matched more than repositories.findAllMax (${findAllMax}) records`);
+      if (data.length > toArrayMax) {
+        throw new Error(`Query on ${model.entityName} matched more than repositories.toArrayMax (${toArrayMax}) records`);
       }
       return data;
     },
@@ -420,8 +443,15 @@ export function createQuery<T, R = Record<never, never>, M = never>(backend: Que
       return state.take === 0 ? null : ((await read(1, state.skip)).data[0] ?? null);
     },
     count,
-    async any() {
-      return (await count()) > 0;
+    any,
+    async none(lambda) {
+      return !(await any(lambda));
+    },
+    async all(lambda) {
+      if (typeof lambda !== "function") throw new Error("all() needs a condition; use toArray() to read the records");
+      // The matches and those satisfying the condition, counted together in one query.
+      const counts = await backend.aggregate(state.where, { matched: { fn: "count" }, satisfied: { fn: "count", where: conditionsOf(model, lambda) } });
+      return counts === null || counts.matched === counts.satisfied;
     },
     async page({ limit = 20, offset = 0 }: PageOptions = {}) {
       const details: FieldErrorDetail[] = [];

package/src/matching.ts

@@ -20,7 +20,9 @@ export function compareValues(left: unknown, right: unknown): number {
 export function matches(record: StoredRecord, condition: Condition, entity: EntityModel): boolean {
   if (isConditionGroup(condition)) {
     const test = (inner: Condition) => matches(record, inner, entity);
-    return condition.group === "or" ? condition.conditions.some(test) : condition.conditions.every(test);
+    if (condition.group === "or") return condition.conditions.some(test);
+    // Comparisons with a missing value are false, so their negation matches it.
+    return condition.group === "not" ? !condition.conditions.every(test) : condition.conditions.every(test);
   }
   const actual = record[condition.field];
   const { op, value } = condition;

package/src/query.ts

@@ -41,9 +41,12 @@ export interface FieldCondition {
   literal?: true;
 }
 
-/** Conditions joined by AND or OR, nested to any depth. */
+/**
+ * Conditions joined by AND or OR, nested to any depth. A `not` group matches every record for which its conditions
+ * (joined by AND) are not true, including records where a compared field is null or missing.
+ */
 export interface ConditionGroup {
-  group: "and" | "or";
+  group: "and" | "or" | "not";
   conditions: Condition[];
 }
 

package/src/repository.ts

@@ -68,11 +68,11 @@ export interface RepositoryOptions {
   fileAccess?: FileAccessSettings;
   /** When set, objects and file records that are no longer used are deleted. */
   fileCleanup?: FileCleanupSettings;
-  /** Most records a fluent query's `all()` may return (default 10000). */
-  findAllMax?: number;
+  /** Most records a fluent query's `toArray()` may return (default 10000). */
+  toArrayMax?: number;
 }
 
-export const DEFAULT_FIND_ALL_MAX = 10000;
+export const DEFAULT_TO_ARRAY_MAX = 10000;
 const FIND_BY_IDS_BATCH = 100;
 
 export interface ListResult<T> {
@@ -176,6 +176,14 @@ export interface Repository<T extends EntityRecord = EntityRecord, R = Record<ne
   where(lambda: QueryLambda<T>): Query<T, R>;
   /** A fluent query over every record. */
   query(): Query<T, R>;
+  /** Whether any record exists, or with a condition, whether any record satisfies it; `query().any(lambda)`. */
+  any(lambda?: QueryLambda<T>): Promise<boolean>;
+  /** Whether every record satisfies the condition (true when there are none); `query().all(lambda)`. */
+  all(lambda: QueryLambda<T>): Promise<boolean>;
+  /** Whether no record exists, or with a condition, whether no record satisfies it; `query().none(lambda)`. */
+  none(lambda?: QueryLambda<T>): Promise<boolean>;
+  /** The number of records, or with a condition, of records satisfying it; `where(lambda).count()`. */
+  count(lambda?: QueryLambda<T>): Promise<number>;
   /**
    * A fluent query over the records the reference array `field` of record `id` lists, e.g.
    * `related(orgId, "members")`. It has no records when that record does not exist, and its `aggregate` then resolves
@@ -185,9 +193,9 @@ export interface Repository<T extends EntityRecord = EntityRecord, R = Record<ne
 }
 
 /** The read methods of a repository, the only ones offered for records the framework writes (e.g. job runs). */
-export const READ_METHODS = ["findById", "findOne", "list", "where", "query"] as const;
+export const READ_METHODS = ["findById", "findOne", "list", "where", "query", "any", "all", "none", "count"] as const;
 
-/** A repository that only reads: `findById`, `findOne`, `list`, `where` and `query`. */
+/** A repository that only reads: `findById`, `findOne`, `list`, `where`, `query`, `any`, `all`, `none` and `count`. */
 export type ReadRepository<T extends EntityRecord = EntityRecord, R = Record<never, never>> = Pick<Repository<T, R>, (typeof READ_METHODS)[number]>;
 
 /** The read methods of a repository, without its write methods. */
@@ -491,10 +499,10 @@ export function createRepository(
     return resolved;
   };
 
-  const findAllMax = repositoryOptions.findAllMax ?? DEFAULT_FIND_ALL_MAX;
+  const toArrayMax = repositoryOptions.toArrayMax ?? DEFAULT_TO_ARRAY_MAX;
   const backend: QueryBackend = {
     model,
-    findAllMax,
+    toArrayMax,
     list: (query, populate, withTotal) => listRecords(query, { populate }, withTotal),
     count: async (where) => adapter.count(model, await resolve(where)),
     aggregate: async (where, aggregates) => {
@@ -528,7 +536,7 @@ export function createRepository(
     };
     return {
       model,
-      findAllMax,
+      toArrayMax,
       list: (query, populate, withTotal) => listRecords(query, { populate }, withTotal, (where) => findRelated(query, where, withTotal)),
       count: async (where) => {
         const resolved = await resolve(where);
@@ -584,6 +592,11 @@ export function createRepository(
       return createQuery(backend, { where: [], sort: [], skip: 0 });
     },
 
+    any: (lambda) => repository.query().any(lambda),
+    all: (lambda) => repository.query().all(lambda),
+    none: (lambda) => repository.query().none(lambda),
+    count: (lambda) => (lambda === undefined ? repository.query() : repository.where(lambda)).count(),
+
     related(id, field) {
       const definition = model.fields.find((candidate) => candidate.name === field);
       if (!definition || definition.type !== "refArray" || definition.storage !== "relation") {

package/src/sql/conditions.ts

@@ -58,9 +58,11 @@ function translateRelation(table: Columns, condition: FieldCondition, context: R
 
 function translate(table: Columns, condition: Condition, dialect: SqlDialect, context?: RelationContext): SQL {
   if (isConditionGroup(condition)) {
-    // An empty AND matches everything; an empty OR matches nothing.
-    if (condition.conditions.length === 0) return condition.group === "or" ? sql`1 = 0` : sql`1 = 1`;
+    // An empty AND matches everything, so its negation matches nothing; an empty OR matches nothing.
+    if (condition.conditions.length === 0) return condition.group === "and" ? sql`1 = 1` : sql`1 = 0`;
     const parts = condition.conditions.map((inner) => translate(table, inner, dialect, context));
+    // IS NOT TRUE also matches when the inner condition is NULL, as it is for comparisons with a NULL column.
+    if (condition.group === "not") return sql`((${and(...parts)}) is not true)`;
     return (condition.group === "or" ? or(...parts) : and(...parts))!;
   }
   const relation = context?.entity.fields.find((field) => field.name === condition.field && field.type === "refArray");

package/src/testing/adapter-contract.ts

@@ -468,9 +468,9 @@ export function runAdapterContract(name: string, factory: AdapterFactory): void
       test("scope every terminal to the records of the array, in the usual default order", async () => {
         const { items, a, linked } = await setupRelated();
         const partners = items.related(linked.id, "partners");
-        expect(names(await partners.all())).toEqual(["c", "b", "a"]);
+        expect(names(await partners.toArray())).toEqual(["c", "b", "a"]);
         const bigOrC = partners.where((o) => o.size.gte(15).or(o.name.eq("c")));
-        expect(names(await bigOrC.orderBy((o) => o.name).all())).toEqual(["b", "c"]);
+        expect(names(await bigOrC.orderBy((o) => o.name).toArray())).toEqual(["b", "c"]);
         expect(await partners.count()).toBe(3);
         expect(await bigOrC.count()).toBe(2);
         expect(await partners.any()).toBe(true);
@@ -508,7 +508,7 @@ export function runAdapterContract(name: string, factory: AdapterFactory): void
         expect(await items.related(empty.id, "partners").aggregate(() => ({}))).toEqual({});
         for (const id of [newId(), empty.id]) {
           const partners = items.related(id, "partners");
-          expect(await partners.all()).toEqual([]);
+          expect(await partners.toArray()).toEqual([]);
           expect(await partners.count()).toBe(0);
           expect(await partners.any()).toBe(false);
           expect(await partners.firstOrDefault()).toBeNull();

package/src/testing/attack-suite.ts

@@ -1,8 +1,13 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { DatabaseAdapter, StoredRecord } from "../adapter.ts";
-import { createApp } from "../app.ts";
-import { resolveConfig } from "../config.ts";
+import type { App } from "../app.ts";
+import type { ServiceConfig } from "../config.ts";
+import { pathAndQueryLength } from "../features/security/limits.ts";
+import { parseSize } from "../files/limits.ts";
 import { builtInFileEntity } from "../files.ts";
+import type { Repositories } from "../hooks.ts";
+// The package entry registers the natives, so the suite resolves them as a service does.
+import { createApp, createFeatureLifecycle, resolveConfig, type FeatureLifecycle } from "../index.ts";
 import type { LogEntry } from "../logger.ts";
 import type { EntityModel } from "../model.ts";
 import { contractItem, contractOrganization, contractRecord } from "./adapter-contract.ts";
@@ -12,6 +17,11 @@ export interface AttackSuiteOptions {
   name: string;
   /** Returns a fresh, empty adapter whose `connect` creates the tables of the models it receives. */
   adapter: () => DatabaseAdapter | Promise<DatabaseAdapter>;
+  /**
+   * Merged into the config the suite resolves, like `{ security: false }` or `{ security: { limits: { url: "64KB" } } }`;
+   * the adapter and a quiet logger are always applied. The natives enabled by default run unless it turns them off.
+   */
+  config?: Partial<Omit<ServiceConfig, "database" | "logger">>;
 }
 
 const fileEntity = builtInFileEntity("file");
@@ -34,44 +44,117 @@ export const SQL_PAYLOADS: Payload[] = [
   { label: "a 10 KB string", value: "'; --".repeat(2048) },
 ];
 
-interface Harness {
+/** A running app of the attack models, with the natives the config enables, called without opening a port. */
+export interface AttackHarness {
   adapter: DatabaseAdapter;
   fetch(method: string, path: string, body?: string): Promise<Response>;
   /** Every stored item and file, sorted by id, to compare before and after an attack. */
   snapshot(): Promise<StoredRecord[]>;
+  /** Whether the security limits refuse `path` for its length: security and its `limits` item on, and the path and query over `limits.url`. */
+  urlTooLong(path: string): boolean;
+  /** Runs the shutdown sequence and disconnects the adapter. */
+  stop(): Promise<void>;
 }
 
-function setUp(options: AttackSuiteOptions): () => Harness {
-  let harness: Harness | undefined;
-  let adapter: DatabaseAdapter;
-  beforeAll(async () => {
-    adapter = await options.adapter();
+const ORIGIN = "http://attack.test";
+
+interface SecuritySettings {
+  limits?: { enabled?: boolean; url?: string | number };
+  headers?: { enabled?: boolean; contentTypeOptions?: boolean };
+}
+
+const securityOf = (features: readonly { key: string; options: unknown }[]) =>
+  features.find((feature) => feature.key === "security")?.options as SecuritySettings | undefined;
+
+/** The `limits.url` of the resolved security native, in bytes; undefined when security or its `limits` item is off. */
+function urlLimit(security: SecuritySettings | undefined): number | undefined {
+  if (!security?.limits?.enabled || security.limits.url === undefined) return undefined;
+  return parseSize(security.limits.url);
+}
+
+/**
+ * Starts the attack models on a fresh adapter as `startService` does, without listening: the enabled features' setups,
+ * the connection, the app with the features' routes, middleware and server settings, then the `onStart` callbacks.
+ */
+export async function startAttackHarness(options: AttackSuiteOptions): Promise<AttackHarness> {
+  const adapter = await options.adapter();
+  const quiet = (_entry: LogEntry) => {};
+  const config = resolveConfig({ ...options.config, database: adapter, logger: { info: quiet, warn: quiet, error: quiet } }, {});
+  const lifecycle: FeatureLifecycle = createFeatureLifecycle({
+    features: config.features,
+    config,
+    models: attackModels,
+    worker: { index: 0, count: 1, runsScheduledWork: true },
+    endpoints: [],
+    crudRoutes: [],
+  });
+  let connected = false;
+  let app: App | undefined;
+  try {
+    await lifecycle.setup();
     await adapter.connect(attackModels);
-    const quiet = (_entry: LogEntry) => {};
-    const config = resolveConfig({ database: adapter, logger: { info: quiet, warn: quiet, error: quiet } }, {});
-    const app = createApp({ models: attackModels, crudRoutes: [], endpoints: [], hooks: new Map(), config });
-    const all = async (model: EntityModel) =>
-      (await adapter.findMany(model, { where: [], sort: [{ field: "id", direction: "asc" }], limit: 10_000, offset: 0 })).data;
-    harness = {
-      adapter,
-      fetch: (method, path, body) =>
-        app.server.fetch(
-          new Request(`http://attack.test${path}`, {
-            method,
-            ...(body === undefined ? {} : { body, headers: { "content-type": "application/json" } }),
-          }),
-        ),
-      snapshot: async () => [...(await all(contractItem)), ...(await all(fileEntity))],
-    };
+    connected = true;
+    app = createApp({
+      models: attackModels,
+      crudRoutes: [],
+      endpoints: [],
+      hooks: new Map(),
+      config,
+      runtimeRoutes: lifecycle.routes,
+      middleware: lifecycle.middleware,
+      server: lifecycle.server,
+    });
+    await lifecycle.start({ repos: app.repos as unknown as Repositories, server: app.server });
+  } catch (error) {
+    await app?.shutdown();
+    await lifecycle.stop();
+    if (connected) await adapter.disconnect();
+    throw error;
+  }
+  const running = app;
+  const security = securityOf(config.features);
+  const maxUrl = urlLimit(security);
+  // With the security headers on, every response the suite receives must carry them, refusals included.
+  const nosniff = security?.headers?.enabled === true && security.headers.contentTypeOptions === true;
+  const all = async (model: EntityModel) =>
+    (await adapter.findMany(model, { where: [], sort: [{ field: "id", direction: "asc" }], limit: 10_000, offset: 0 })).data;
+  return {
+    adapter,
+    fetch: async (method, path, body) => {
+      const response = await running.server.fetch(
+        new Request(`${ORIGIN}${path}`, {
+          method,
+          ...(body === undefined ? {} : { body, headers: { "content-type": "application/json" } }),
+        }),
+      );
+      if (nosniff) expect(response.headers.get("x-content-type-options"), `${method} ${path.slice(0, 80)}`).toBe("nosniff");
+      return response;
+    },
+    snapshot: async () => [...(await all(contractItem)), ...(await all(fileEntity))],
+    urlTooLong: (path) => maxUrl !== undefined && pathAndQueryLength(new URL(path, ORIGIN).href) > maxUrl,
+    async stop() {
+      await lifecycle.shutdown();
+      await running.shutdown();
+      await lifecycle.stop();
+      await adapter.disconnect();
+    },
+  };
+}
+
+/** Starts a harness before the first test of the enclosing group and stops it after the last. */
+function setUp(options: AttackSuiteOptions): () => AttackHarness {
+  let harness: AttackHarness | undefined;
+  beforeAll(async () => {
+    harness = await startAttackHarness(options);
   });
   afterAll(async () => {
-    await adapter?.disconnect();
+    await harness?.stop();
   });
   return () => harness!;
 }
 
 /** Creates items through the generated route, as a client would. */
-async function seedItems(harness: Harness, titles: string[]): Promise<StoredRecord[]> {
+async function seedItems(harness: AttackHarness, titles: string[]): Promise<StoredRecord[]> {
   const stored: StoredRecord[] = [];
   for (const title of titles) {
     const response = await harness.fetch("POST", "/items", JSON.stringify({ title }));
@@ -99,7 +182,7 @@ async function expectValidationError(response: Response, message?: string): Prom
 }
 
 /** Runs a read attack and asserts that it neither failed with a 500 nor changed any stored record. */
-async function readAttack(harness: Harness, path: string, method = "GET"): Promise<Response> {
+async function readAttack(harness: AttackHarness, path: string, method = "GET"): Promise<Response> {
   const before = await harness.snapshot();
   const response = await harness.fetch(method, path);
   const clone = response.clone() as Response;
@@ -108,6 +191,24 @@ async function readAttack(harness: Harness, path: string, method = "GET"): Promi
   return clone;
 }
 
+/**
+ * Sends a payload in the URL: over the security `limits.url` it expects 414 `URL is too long` and an unchanged
+ * snapshot; otherwise it hands the response to `expectations`. Never a 500, never a changed record.
+ */
+export async function urlAttack(harness: AttackHarness, method: string, path: string, expectations: (response: Response) => Promise<void> | void, body?: string): Promise<void> {
+  const before = await harness.snapshot();
+  const response = await harness.fetch(method, path, body);
+  const clone = response.clone() as Response;
+  const parsed = (await expectNot500(response)) as { error?: { message?: string } } | undefined;
+  expect(await harness.snapshot()).toEqual(before);
+  if (harness.urlTooLong(path)) {
+    expect(clone.status).toBe(414);
+    expect(parsed?.error?.message).toBe("URL is too long");
+    return;
+  }
+  await expectations(clone);
+}
+
 async function listedIds(response: Response): Promise<string[]> {
   expect(response.status).toBe(200);
   const body = (await response.json()) as { data: { id: string }[] };
@@ -143,23 +244,18 @@ export function runAttackSuite(options: AttackSuiteOptions): void {
         ];
         for (const [op, raw, matches] of filters) {
           test(`sql: ${op} with ${label}`, async () => {
-            const response = await readAttack(harness(), `/items${query({ [`where[title][${op}]`]: raw })}`);
-            if (refused) await expectValidationError(response);
-            else expect(await listedIds(response)).toEqual(idsOf(seeded, matches));
+            await urlAttack(harness(), "GET", `/items${query({ [`where[title][${op}]`]: raw })}`, async (response) => {
+              if (refused) await expectValidationError(response);
+              else expect(await listedIds(response)).toEqual(idsOf(seeded, matches));
+            });
           });
         }
 
         test(`sql: id with ${label}`, async () => {
           const path = `/items/${encodeURIComponent(value)}`;
-          for (const method of ["GET", "DELETE"]) {
-            const response = await readAttack(harness(), path, method);
-            expect([400, 404]).toContain(response.status);
-          }
-          const before = await harness().snapshot();
-          const patched = await harness().fetch("PATCH", path, JSON.stringify({ title: "changed" }));
-          await expectNot500(patched);
-          expect([400, 404]).toContain(patched.status);
-          expect(await harness().snapshot()).toEqual(before);
+          const missing = (response: Response) => void expect([400, 404]).toContain(response.status);
+          for (const method of ["GET", "DELETE"]) await urlAttack(harness(), method, path, missing);
+          await urlAttack(harness(), "PATCH", path, missing, JSON.stringify({ title: "changed" }));
         });
 
         test(`sql: body with ${label}`, async () => {