@stigmer/server 3.37.1 → 3.38.1

package/src/pipeline/__tests__/support.ts

@@ -1,16 +1,31 @@
 /**
- * Shared test identity for RequestContext construction (O2, ruling Q3):
- * the identity parameter is required, so every test constructs one
- * explicitly — never a hidden default that could mask a missed threading
- * site in production code. Overrides let adversarial tests pin specific
- * caller classes.
+ * Shared test fixtures for the pipeline and the domains.
+ *
+ * The caller identity for RequestContext construction: the identity
+ * parameter is required, so every test constructs one explicitly — never a
+ * hidden default that could mask a missed threading site in production
+ * code. Overrides let adversarial tests pin specific caller classes.
+ *
+ * The run-gate authorizer, which isolates the AuthorizeRunTarget splice from
+ * every other authorization site on a chain.
+ *
+ * The store-fault helpers the per-domain `store-faults` tests share: a store
+ * whose reads fail with a chosen error, a dependency that must never be
+ * reached once a load has failed, and the ConnectError a failing call
+ * rejects with. Together they pin the error contract's store-fault rule
+ * (`src/pipeline/errors.ts`): a typed not-found answers NotFound, any other
+ * store failure a sanitized Internal.
  */
+import { ConnectError } from "@connectrpc/connect";
+import { expect } from "vitest";
+
 import type {
   Authorizer,
   AuthzCheck,
   AuthzDecision,
 } from "../../extensions/authorizer.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import type { Store } from "../../store/interface.js";
 import { isRunGateCheck } from "../steps/authorize-run-target.js";
 
 export function testCallerIdentity(
@@ -52,3 +67,31 @@ export function runGateOnlyAuthorizer(decide: () => AuthzDecision): {
     },
   };
 }
+
+/** A dependency the call must never reach once its load has failed. */
+export function untouchable<T extends object>(name: string): T {
+  return new Proxy({} as T, {
+    get(_target, prop) {
+      throw new Error(`${name}.${String(prop)} reached after a failed load`);
+    },
+  });
+}
+
+/** A store whose every read fails with the given error. */
+export function failingStore(error: Error): Store {
+  return {
+    getResource: () => Promise.reject(error),
+  } as unknown as Store;
+}
+
+/** The ConnectError `call` rejects with; fails the test if it resolves. */
+export async function errorOf(
+  call: () => Promise<unknown>,
+): Promise<ConnectError> {
+  const error = await call().then(
+    () => undefined,
+    (e: unknown) => e,
+  );
+  expect(error, "the call must fail").toBeInstanceOf(ConnectError);
+  return error as ConnectError;
+}

package/src/pipeline/steps/authorization-tuples.ts

@@ -330,8 +330,12 @@ export function newCreateAuthorizationTuplesStep<Desc extends DescMessage>(
 /**
  * CleanupIamPolicies — after the store delete in every delete chain.
  * Best-effort by contract: a driver failure is logged and the delete
- * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
- * the cloud side owns convergence for orphaned grants).
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all),
+ * because a deleted resource's rows grant nothing once it is gone. The
+ * organization is the one kind whose id another caller can take next, so
+ * its chain revokes the organization's rows before the row, failing
+ * closed (RevokeOrganizationPolicies, domain/organization/steps.ts), and
+ * this step is only its backstop there.
  */
 export function newCleanupIamPoliciesStep<Desc extends DescMessage>(
   lifecycle: ResourceAuthorizationLifecycle | undefined,