@substrat-run/contract-tests 0.122.1 → 0.124.0

package/dist/scope-host-suite.js

@@ -1166,7 +1166,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
         it('facets the outbox, and keeps an ERASED payload out of the null bucket (#1239)', async () => {
             const stub = await host.getScope(alice, t1, s1);
             const subject = ulid();
-            // Three events: two whose payload carries `secret`, one that never had it.
+            // Three events: two whose payload carries `secret` — both classed pseudonymous,
+            // since they name a subject — and one that never had it.
             await stub.invoke('test/emit-event', { subject, secret: 'kept' });
             await stub.invoke('test/emit-event', { subject: ulid(), secret: 'kept' });
             await stub.invoke('test/emit-event');
@@ -1180,7 +1181,10 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 type: 'test.happened',
             });
             expect(before.erased).toBe(0);
-            expect(before.buckets.find((b) => b.value === 'kept').count).toBe(2);
+            // #1762: a classified event is withheld from a payload grouping, so the two
+            // `kept` events are counted apart rather than bucketed.
+            expect(before.buckets.find((b) => b.value === 'kept')).toBeUndefined();
+            expect(before.withheldPersonal).toBeGreaterThanOrEqual(2);
             // The event that never carried the field is a genuine null bucket — an
             // absence in the data, which is a different fact from an erasure.
             expect(before.buckets.find((b) => b.value === null).count).toBeGreaterThanOrEqual(1);
@@ -1192,12 +1196,69 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             });
             // THE RULE: the erased event is counted apart, and did NOT join the null
             // bucket. Folding it in would show a reader a clean distribution with no
-            // hint that part of the history was redacted.
+            // hint that part of the history was redacted. It moves from withheld to
+            // erased — counted once, in the one place that says what happened to it.
             expect(after.erased).toBe(1);
-            expect(after.buckets.find((b) => b.value === 'kept').count).toBe(1);
+            expect(after.withheldPersonal).toBe(before.withheldPersonal - 1);
             expect(after.buckets.find((b) => b.value === null)?.count ?? 0).toBe(before.buckets.find((b) => b.value === null).count);
             // And the denominator still counts it: the event happened, whatever it said.
             expect(after.total).toBe(before.total);
+            expect(after.truncated).toBe(false);
+            expect(after.buckets.reduce((n, b) => n + b.count, 0) + after.erased + after.withheldPersonal).toBe(after.total);
+        });
+        it('withholds personal-data events from a payload grouping, and only there (#1762)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const shredded = ulid();
+            // One payload field under every class. Grouped by it, only the `none` events may
+            // produce buckets: a bucket per address is a search for a person.
+            await stub.invoke('test/emit-classified', { pii: 'none', email: 'ops@acme.test' });
+            await stub.invoke('test/emit-classified', { pii: 'none', email: 'ops@acme.test' });
+            await stub.invoke('test/emit-classified', { pii: 'pseudonymous', email: 'anna@acme.test' });
+            await stub.invoke('test/emit-classified', { pii: 'pseudonymous', email: 'anna@acme.test' });
+            await stub.invoke('test/emit-classified', { pii: 'direct', email: 'bo@acme.test' });
+            await stub.invoke('test/emit-classified', { pii: 'direct', email: 'cy@acme.test', subject: shredded });
+            await host.admin.shredSubject(staff, t1, s1, dataSubjectId.parse(shredded));
+            const byEmail = await host.admin.facetEvents(staff, t1, s1, {
+                groupBy: { kind: 'payload', field: 'email' },
+                type: 'test.classified',
+            });
+            expect(byEmail.buckets.map((b) => [b.value, b.count])).toEqual([['ops@acme.test', 2]]);
+            // Three classified events still carry their payload; the fourth was shredded and
+            // is counted as erased, not twice.
+            expect(byEmail.withheldPersonal).toBe(3);
+            expect(byEmail.erased).toBe(1);
+            expect(byEmail.total).toBe(6);
+            expect(byEmail.buckets.reduce((n, b) => n + b.count, 0) + byEmail.erased + byEmail.withheldPersonal).toBe(byEmail.total);
+            // The access row says what the read held back, on this co-located branch as on the
+            // delegated one — `delegatedReadParams.facetEvents` is the one projection.
+            const rows = (await host.admin.accessLog(staff, { method: 'facetEvents' }))
+                .filter((e) => e.scopeId === s1)
+                .map((e) => (typeof e.params === 'string' ? JSON.parse(e.params) : e.params))
+                .filter((p) => p.groupBy?.field === 'email');
+            expect(rows.at(-1)).toMatchObject({ withheldPersonal: 3 });
+            expect(rows.at(-1)).not.toHaveProperty('withheldReason');
+            // The row's params are cut at 500 chars, and `type` is unbounded: what was withheld
+            // must survive a request long enough to be cut.
+            const long = `test.${'x'.repeat(600)}`;
+            await host.admin.facetEvents(staff, t1, s1, { groupBy: { kind: 'payload', field: 'email' }, type: long });
+            const cut = (await host.admin.accessLog(staff, { method: 'facetEvents' }))
+                .filter((e) => e.scopeId === s1)
+                .map((e) => (typeof e.params === 'string' ? e.params : JSON.stringify(e.params)))
+                .filter((text) => text.includes('x'.repeat(100)));
+            expect(cut).toHaveLength(1);
+            expect(cut[0].startsWith('{"withheldPersonal":0,')).toBe(true);
+            // An envelope grouping is not payload content: every class is counted, and the
+            // class itself stays available as a dimension.
+            const byClass = await host.admin.facetEvents(staff, t1, s1, {
+                groupBy: { kind: 'piiClass' },
+                type: 'test.classified',
+            });
+            expect(Object.fromEntries(byClass.buckets.map((b) => [b.value, b.count]))).toEqual({
+                none: 2,
+                pseudonymous: 2,
+                direct: 2,
+            });
+            expect([byClass.erased, byClass.withheldPersonal, byClass.total]).toEqual([0, 0, 6]);
         });
         it('carries WHEN each bucket last saw an event, not only how many (#1234)', async () => {
             const stub = await host.getScope(alice, t1, s1);
@@ -1244,6 +1305,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // as erased would tell a reader that history was withheld from them when it
             // was simply never written.
             expect(facet.erased).toBe(0);
+            expect(facet.withheldPersonal).toBe(0);
             expect(facet.buckets.find((b) => b.value === null).count).toBe(1);
             expect(facet.total).toBe(3);
         });
@@ -2321,6 +2383,43 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const log = await host.admin.auditLog(staff, { limit: 500 });
                 expect(log.some((e) => e.action === 'restoreDirectory')).toBe(true);
             });
+            // A directory dump is untrusted input exactly as a scope dump is (#1143), and
+            // both adapters refuse it with the same words. The DO path always judged it;
+            // the node path ran the DDL through `exec`, appended statements included.
+            it('refuses a dump whose DDL carries a second statement, and leaves the directory as it was (#1143)', async () => {
+                const backup = await host.admin.exportDirectory(staff);
+                const smuggling = {
+                    name: 'directory_probe',
+                    ddl: 'CREATE TABLE directory_probe (id TEXT); CREATE TABLE smuggled (id TEXT);',
+                    columns: ['id'],
+                    rows: [['1']],
+                };
+                await expect(host.admin.restoreDirectory(staff, { ...backup, tables: [...backup.tables, smuggling] })).rejects.toThrow(/more than one statement/);
+                const after = (await host.admin.exportDirectory(staff)).tables.map((t) => t.name);
+                expect(after).not.toContain('smuggled');
+                expect(after).not.toContain('directory_probe');
+                // Refused before anything was dropped: the platform still resolves and serves.
+                expect(await host.admin.getTenant(staff, t1)).toBeDefined();
+                const stub = await host.getScope(alice, t1, s1);
+                await stub.invoke('test/write-marker', { v: 'after-refused-directory-restore' });
+            });
+            // The positive twin: the check does not refuse every extra table, and a `;` inside
+            // a string literal is not read as a statement boundary.
+            it('still restores an honest extra table whose DDL contains a quoted semicolon', async () => {
+                const backup = await host.admin.exportDirectory(staff);
+                const honest = {
+                    name: 'directory_probe',
+                    ddl: "CREATE TABLE directory_probe (id TEXT, note TEXT DEFAULT 'a;b')",
+                    columns: ['id', 'note'],
+                    rows: [['1', 'ok']],
+                };
+                await host.admin.restoreDirectory(staff, { ...backup, tables: [...backup.tables, honest] });
+                const restored = (await host.admin.exportDirectory(staff)).tables.find((t) => t.name === 'directory_probe');
+                expect(restored?.rows).toEqual([['1', 'ok']]);
+                // Back to the copy, which does not carry the probe.
+                await host.admin.restoreDirectory(staff, backup);
+                expect((await host.admin.exportDirectory(staff)).tables.some((t) => t.name === 'directory_probe')).toBe(false);
+            });
         });
         // -- restore (§8's write half): load a dump into an EXISTING scope in place ---
         describe('scope restore — backup/backout (§8)', () => {