@reventlessdev/reventless-seed-aws 1.0.0-alpha.3 → 1.0.0-alpha.30

package/lib/ocaml/ObjectStoreReconcileTest.res

@@ -0,0 +1,83 @@
+// The half of reconciliation that decides whether an object is referenced.
+//
+// Everything else in the report is counting; `collectRefs` is the judgement, and
+// it is judgement in one direction only. A ref it misses turns a live object
+// into an "unreferenced, tagged pending" row — which is the row an operator
+// reads as permission to enable an expiry rule. A ref it collects too eagerly
+// only ever leaves an object alive.
+//
+// So these tests are about reach: nesting, arrays, records, and the prefix
+// boundary that separates one store from another.
+
+open JestGlobals
+
+module Reconcile = ReventlessSeedAws_Reconcile
+
+let prefix = "Catalog/productImages"
+let refIn = "/Catalog/productImages/user-1/uuid/photo.png"
+let refOther = "/Ordering/receipts/user-1/uuid/r.pdf"
+
+let collect = (json: JSON.t): array<string> => {
+  let out = Set.make()
+  Reconcile.collectRefs(~prefix, json, out)
+  out->Set.toArray
+}
+
+let obj = (fields: array<(string, JSON.t)>) => fields->Dict.fromArray->JSON.Encode.object
+
+describe("ReventlessSeedAws_Reconcile.collectRefs", () => {
+  testSync("finds a ref on a top-level field", () =>
+    expect(collect(obj([("imageUrl", JSON.Encode.string(refIn))])))->toEqual([refIn])
+  )
+
+  // Deliberately not declaration-driven: the claim component reads `@storageRef`
+  // annotations, so a report reading the same list would inherit the same blind
+  // spot and agree precisely where both are wrong. An unannotated field holding a
+  // ref has to show up here, as the thing to fix before expiry goes on.
+  testSync("finds a ref on a field no annotation would have named", () =>
+    expect(collect(obj([("someUndeclaredField", JSON.Encode.string(refIn))])))->toEqual([refIn])
+  )
+
+  testSync("finds refs inside an array", () =>
+    expect(collect(obj([("images", JSON.Encode.array([JSON.Encode.string(refIn)]))])))->toEqual([
+      refIn,
+    ])
+  )
+
+  testSync("finds a ref nested inside a record", () =>
+    expect(collect(obj([("variant", obj([("photo", JSON.Encode.string(refIn))]))])))->toEqual([
+      refIn,
+    ])
+  )
+
+  // Store isolation: one bucket holds several stores under distinct prefixes, so
+  // a reconciliation scoped to one store must not count another's refs — that
+  // would mark a genuinely abandoned object as referenced and hide it forever.
+  testSync("ignores a ref belonging to another store", () =>
+    expect(collect(obj([("receipt", JSON.Encode.string(refOther))])))->toEqual([])
+  )
+
+  // The prefix boundary is a path segment, not a string prefix.
+  testSync("ignores a store whose name merely starts the same way", () =>
+    expect(
+      collect(obj([("x", JSON.Encode.string("/Catalog/productImagesArchive/u/i/p.png"))])),
+    )->toEqual([])
+  )
+
+  testSync("ignores strings that are not refs at all", () =>
+    expect(
+      collect(
+        obj([
+          ("name", JSON.Encode.string("A product")),
+          ("external", JSON.Encode.string("https://example.com/Catalog/productImages/p.png")),
+          ("count", JSON.Encode.int(3)),
+        ]),
+      ),
+    )->toEqual([])
+  )
+
+  testSync("collects each distinct ref once", () => {
+    let json = obj([("a", JSON.Encode.string(refIn)), ("b", JSON.Encode.string(refIn))])
+    expect(collect(json)->Array.length)->toBe(1)
+  })
+})

package/lib/ocaml/ObjectStoreResetTest.res

@@ -0,0 +1,191 @@
+// How the reset learns which uploaded objects belong to which plugin, and what
+// it refuses.
+//
+// A declared store's bucket is built by the PLATFORM deploy, so its tags say
+// which project built it, not whose data is in it. Ownership therefore comes
+// from the platform's `objectStores` stack output, and these pin the pure half
+// of that: parsing the output, and refusing any store set a prefix-scoped wipe
+// could not separate. The impure half is a `pulumi stack output` subprocess and
+// the S3 calls, and the decisions under test are in neither.
+
+open JestGlobals
+
+module Reset = ReventlessSeedAws_Reset
+
+let obj = entries => JSON.Encode.object(entries->Dict.fromArray)
+let str = JSON.Encode.string
+
+let storeEntry = (~bucket, ~prefix) =>
+  obj([("bucketName", str(bucket)), ("keyPrefix", str(prefix))])
+
+let output = entries => Some(obj(entries))
+
+let store = (~qualified, ~bucket, ~prefix): Reset.objectStore => {
+  let (plugin, name) = Reset.splitQualified(qualified)->Option.getOr(("", qualified))
+  {qualified, plugin, store: name, bucketName: bucket, keyPrefix: prefix}
+}
+
+describe("parseObjectStores", () => {
+  testSync("splits the qualified key into plugin and store", () =>
+    switch Reset.parseObjectStores(
+      output([
+        ("Catalog.productImages", storeEntry(~bucket="alpha-stores", ~prefix="productImages")),
+      ]),
+    ) {
+    | Ok([s]) =>
+      expect((s.plugin, s.store, s.bucketName, s.keyPrefix))->toEqual((
+        "Catalog",
+        "productImages",
+        "alpha-stores",
+        "productImages",
+      ))
+    | other => fail(`expected one parsed store, got ${other->JSON.stringifyAny->Option.getOr("?")}`)
+    }
+  )
+
+  // A store name may contain a dot; a registered plugin name may not — so the
+  // split is at the first one, matching how the key is composed.
+  testSync("splits at the first dot only", () =>
+    switch Reset.splitQualified("Catalog.product.images") {
+    | Some((plugin, name)) => expect((plugin, name))->toEqual(("Catalog", "product.images"))
+    | None => fail("expected a split")
+    }
+  )
+
+  // A platform that declares no stores is ordinary, not an error.
+  testSync("absent output yields no stores", () =>
+    switch Reset.parseObjectStores(None) {
+    | Ok(stores) => expect(stores->Array.length)->toBe(0)
+    | Error(message) => fail(message)
+    }
+  )
+
+  // A store the reset cannot read is a store it would silently leave behind, so
+  // a malformed entry fails the run rather than being skipped.
+  testSync("a malformed entry is an error, not a skip", () =>
+    switch Reset.parseObjectStores(
+      output([("Catalog.productImages", obj([("keyPrefix", str("x"))]))]),
+    ) {
+    | Ok(_) => fail("expected a malformed entry to be refused")
+    | Error(message) => expect(message->String.includes("Catalog.productImages"))->toBe(true)
+    }
+  )
+
+  testSync("an unqualified key is an error", () =>
+    switch Reset.parseObjectStores(
+      output([("productImages", storeEntry(~bucket="alpha-stores", ~prefix="productImages"))]),
+    ) {
+    | Ok(_) => fail("expected an unqualified key to be refused")
+    | Error(message) => expect(message->String.includes("productImages"))->toBe(true)
+    }
+  )
+})
+
+describe("validateStores", () => {
+  testSync("distinct prefixes in one bucket are fine", () =>
+    expect(
+      Reset.validateStores([
+        store(~qualified="Catalog.productImages", ~bucket="alpha-stores", ~prefix="productImages"),
+        store(~qualified="Ordering.labels", ~bucket="alpha-stores", ~prefix="labels"),
+      ]),
+    )->toEqual(Ok())
+  )
+
+  // The cross-plugin collision: one prefix, two owners, nothing to tell their
+  // objects apart.
+  testSync("two plugins on one prefix are refused", () =>
+    switch Reset.validateStores([
+      store(~qualified="Catalog.productImages", ~bucket="alpha-stores", ~prefix="productImages"),
+      store(~qualified="Ordering.productImages", ~bucket="alpha-stores", ~prefix="productImages"),
+    ]) {
+    | Ok() => fail("expected a collision to be refused")
+    | Error(message) =>
+      expect(
+        message->String.includes("Catalog.productImages") &&
+          message->String.includes("Ordering.productImages"),
+      )->toBe(true)
+    }
+  )
+
+  // The same shape one level up: `Catalog` encloses `Catalog/productImages`, so
+  // wiping the first would delete the second's objects.
+  testSync("an enclosing prefix is refused", () =>
+    switch Reset.validateStores([
+      store(~qualified="Legacy.catalog", ~bucket="alpha-stores", ~prefix="Catalog"),
+      store(
+        ~qualified="Catalog.productImages",
+        ~bucket="alpha-stores",
+        ~prefix="Catalog/productImages",
+      ),
+    ]) {
+    | Ok() => fail("expected an enclosing prefix to be refused")
+    | Error(message) => expect(message->String.includes("encloses"))->toBe(true)
+    }
+  )
+
+  // Different buckets cannot reach each other, so an equal prefix there is not a
+  // collision — which is what the per-store layout produces in production.
+  testSync("one prefix in two different buckets is fine", () =>
+    expect(
+      Reset.validateStores([
+        store(
+          ~qualified="Catalog.productImages",
+          ~bucket="catalog-productImages",
+          ~prefix="productImages",
+        ),
+        store(
+          ~qualified="Ordering.productImages",
+          ~bucket="ordering-productImages",
+          ~prefix="productImages",
+        ),
+      ]),
+    )->toEqual(Ok())
+  )
+
+  // A shared prefix that merely starts with another's characters is not nesting:
+  // the delete prefix carries a trailing slash, so `images` cannot reach
+  // `images-archive`.
+  testSync("a sibling prefix sharing a character run is fine", () =>
+    expect(
+      Reset.validateStores([
+        store(~qualified="Catalog.images", ~bucket="alpha-stores", ~prefix="images"),
+        store(~qualified="Catalog.imagesArchive", ~bucket="alpha-stores", ~prefix="images-archive"),
+      ]),
+    )->toEqual(Ok())
+  )
+
+  testSync("an empty or slash-bearing store name is refused", () => {
+    switch Reset.validateStores([
+      store(~qualified="Catalog.productImages", ~bucket="alpha-stores", ~prefix=""),
+    ]) {
+    | Ok() => fail("expected an empty prefix to be refused")
+    | Error(_) => ()
+    }
+    switch Reset.validateStores([
+      store(~qualified="Catalog.a/b", ~bucket="alpha-stores", ~prefix="a/b"),
+    ]) {
+    | Ok() => fail("expected a store name containing a slash to be refused")
+    | Error(_) => ()
+    }
+  })
+})
+
+describe("pluginOf", () => {
+  // The `objectStores` keys carry the REGISTERED plugin name; the menu carries
+  // the operator-facing label. Attribution uses the declared name so the reset
+  // never has to guess the relation between the two.
+  testSync("prefers the declared plugin name over the label", () =>
+    expect(
+      Reset.pluginOf({
+        projectDir: "../catalog-aws",
+        label: "catalog",
+        group: Domain,
+        plugin: "Catalog",
+      }),
+    )->toBe("Catalog")
+  )
+
+  testSync("falls back to the label when no plugin name is declared", () =>
+    expect(Reset.pluginOf({projectDir: ".", label: "platform", group: Platform}))->toBe("platform")
+  )
+})

package/lib/ocaml/QuiesceResetTest.res

@@ -0,0 +1,169 @@
+// Holding a stack's runtimes still for the length of a wipe: what gets held, and
+// what the reset says when a store comes back anyway.
+//
+// A truncate is not durable while the runtimes that own the data are running — a
+// slice runtime keeps its TODO list in memory for the life of its execution
+// environment and re-saves every row it holds at the end of each invocation,
+// including the scheduled sweep that carries no events. So the reset now
+// discovers the stack's Lambda functions alongside its stores and holds them at
+// zero concurrency across the wipe.
+//
+// The pure half of that is what these pin: which ARNs resolve to a function to
+// hold, the bounded fan-out the control-plane calls go through, and the failure
+// message — which used to say "re-run to finish" for a condition re-running
+// could not clear. The impure half is the Lambda control-plane calls themselves.
+
+open JestGlobals
+
+module Reset = ReventlessSeedAws_Reset
+module Quiesce = ReventlessSeedAws_Quiesce
+
+describe("classify", () => {
+  testSync("reads the function name out of a Lambda ARN", () =>
+    expect(
+      Reset.classify("arn:aws:lambda:eu-west-1:123456789012:function:AllAutomationSlices-28b116c"),
+    )->toEqual(Reset.Function("AllAutomationSlices-28b116c"))
+  )
+
+  // The tagging API returns unqualified ARNs, but a qualified one must still
+  // yield the function name — every Lambda control-plane call the hold makes
+  // takes a name, and "Name:1" is not one.
+  testSync("drops a version or alias qualifier", () =>
+    expect(
+      Reset.classify("arn:aws:lambda:eu-west-1:123456789012:function:AllReadModels-0287438:42"),
+    )->toEqual(Reset.Function("AllReadModels-0287438"))
+  )
+
+  testSync("still classifies tables and buckets", () => {
+    expect(
+      Reset.classify("arn:aws:dynamodb:eu-west-1:123456789012:table/Products-0ba6849"),
+    )->toEqual(Reset.Table("Products-0ba6849"))
+    expect(Reset.classify("arn:aws:s3:::alpha-product-images"))->toEqual(
+      Reset.Bucket("alpha-product-images"),
+    )
+  })
+
+  testSync("ignores anything else the tag scope returns", () =>
+    expect(
+      Reset.classify("arn:aws:sqs:eu-west-1:123456789012:OrderingDcbCmdTopic-4b3658c"),
+    )->toEqual(Reset.Other)
+  )
+})
+
+describe("mapBounded", () => {
+  // Results must line up with their inputs regardless of which worker finished
+  // first: the hold pairs each result with the function it came from, and a
+  // shuffled array would restore the wrong concurrency to the wrong function.
+  test("keeps results in input order under out-of-order completion", async () => {
+    let delays = [40, 0, 30, 10, 20, 5]
+    let out = await delays->Quiesce.mapBounded(
+      ~limit=3,
+      async ms => {
+        await ReventlessSeed.Seed.Client.sleep(ms)
+        ms
+      },
+    )
+    expect(out)->toEqual(delays)
+  })
+
+  test("never runs more than the limit at once", async () => {
+    let inFlight = ref(0)
+    let peak = ref(0)
+    let _ = await Array.make(~length=12, 0)->Quiesce.mapBounded(
+      ~limit=4,
+      async _ => {
+        inFlight := inFlight.contents + 1
+        peak := Math.Int.max(peak.contents, inFlight.contents)
+        await ReventlessSeed.Seed.Client.sleep(5)
+        inFlight := inFlight.contents - 1
+      },
+    )
+    expect(peak.contents)->toBe(4)
+  })
+
+  test("an empty list spawns no workers and returns nothing", async () => {
+    let out = await []->Quiesce.mapBounded(~limit=4, async x => x)
+    expect(out->Array.length)->toBe(0)
+  })
+})
+
+describe("refillMessage", () => {
+  // The whole point of the change: the operator has to be able to see WHICH
+  // store came back, not just a total.
+  testSync("names every store that came back, with its count", () => {
+    let message = Reset.refillMessage(
+      ~refilled=[("AutoShipOrderTodo-61f39a2", 12), ("GeocodeCustomerAddressTodo-50d9488", 1)],
+      ~heldCount=41,
+    )
+    expect(message->String.includes("AutoShipOrderTodo-61f39a2"))->toBe(true)
+    expect(message->String.includes("GeocodeCustomerAddressTodo-50d9488"))->toBe(true)
+    expect(message->String.startsWith("13 item(s)/object(s) came back"))->toBe(true)
+  })
+
+  // Under a hold nothing could START during the wipe, so the only writer left is
+  // an invocation already running when the hold landed — and that one really
+  // does go away. This is the only case where "re-run" is honest advice.
+  testSync("advises re-running only when the runtimes were held", () => {
+    let message = Reset.refillMessage(~refilled=[("AutoShipOrderTodo-61f39a2", 12)], ~heldCount=41)
+    expect(message->String.includes("already in flight"))->toBe(true)
+    expect(message->String.includes("Re-running clears it"))->toBe(true)
+  })
+
+  // Without a hold, the writer holds the rows in memory and restores them every
+  // invocation — the exact condition the old "re-run to finish" sent operators
+  // round in circles on. It must not appear here.
+  testSync("refuses to advise re-running when the stack was not held", () => {
+    let message = Reset.refillMessage(~refilled=[("AutoShipOrderTodo-61f39a2", 12)], ~heldCount=0)
+    expect(message->String.includes("re-running will not help"->String.toLowerCase))->toBe(true)
+    expect(message->String.includes("SEED_RESET_NO_QUIESCE"))->toBe(true)
+  })
+})
+
+describe("isThrottle", () => {
+  // A hold that fails because the control plane is busy and a hold that fails
+  // because the credentials are short a policy read identically at the call
+  // site, and the fixes point in opposite directions: wait, versus go and edit
+  // an IAM policy. Sending an operator to the policy for a throttle costs them
+  // the whole trip.
+  testSync("recognises the wordings a throttled hold actually comes back with", () =>
+    [
+      "Rate exceeded",
+      "TooManyRequestsException: Rate exceeded",
+      "Request throttled, please try again",
+    ]->Array.forEach(reason => expect(Quiesce.isThrottle(reason))->toBe(true))
+  )
+
+  testSync("leaves a permission failure to the IAM advice", () => {
+    expect(
+      Quiesce.isThrottle(
+        "AccessDeniedException: User is not authorized to perform: lambda:PutFunctionConcurrency",
+      ),
+    )->toBe(false)
+    expect(Quiesce.isThrottle("ResourceNotFoundException: Function not found"))->toBe(false)
+  })
+})
+
+describe("noQuiesce", () => {
+  let set = v => NodeProcess.env->Dict.set("SEED_RESET_NO_QUIESCE", v)
+
+  // Fail-closed: the hold is what makes the wipe durable, so anything other than
+  // a deliberate opt-out keeps it on.
+  testSync("defaults to holding the platform", () => {
+    set("")
+    expect(Reset.noQuiesce())->toBe(false)
+    set("0")
+    expect(Reset.noQuiesce())->toBe(false)
+    set("no")
+    expect(Reset.noQuiesce())->toBe(false)
+  })
+
+  testSync("accepts the spellings an operator would actually type", () => {
+    ["1", "true", "TRUE", " yes "]->Array.forEach(
+      v => {
+        set(v)
+        expect(Reset.noQuiesce())->toBe(true)
+      },
+    )
+    set("")
+  })
+})