@substrat-run/contract-tests 0.138.0 → 0.140.0

package/dist/scope-host-suite.js

@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
-import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, } from '@substrat-run/contracts';
+import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, EMAIL_SENT, PLATFORM_REQUEST_ENTITY_TYPE, SEND_EMAIL_KIND, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, } from '@substrat-run/contracts';
 import { INERT_SCOPE_REASON, isSearchIndexTable, platformIntentFailureMessage, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, createUlid, ulid, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, TEST_LIFECYCLE, testModManifest, victimModManifest, } from './modules.js';
 /**
@@ -273,6 +273,45 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(settled.status).toBe('done');
             expect(JSON.parse(settled.result)).toEqual({ scopeId: 'NEWSITE' });
         });
+        it('a settle carrying an outcome event writes it once, as the kernel, with the settle (#2102)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const mail = { to: 'ada@example.com', subject: 'Hej', html: '<p>Hej</p>', text: 'Hej' };
+            const id = await stub.invoke('platform/request', { kind: SEND_EMAIL_KIND, payload: mail });
+            const mine = () => stub
+                .invoke('platform/outcome-events')
+                .then((rows) => rows.filter((r) => JSON.parse(r.payload).request === id));
+            const event = (request) => ({
+                type: EMAIL_SENT,
+                entity: { entityType: PLATFORM_REQUEST_ENTITY_TYPE, entityId: id },
+                payload: {
+                    request: platformRequestId.parse(request),
+                    about: null,
+                    sender: 'platform',
+                    messageId: 'msg-1',
+                    attempts: 1,
+                    code: null,
+                    status: null,
+                },
+            });
+            // Refused before anything is written: an event on a `pending` settle, or one naming
+            // another request. The row stays exactly as it was.
+            await expect(host.settlePlatformRequest(t1, s1, platformRequestId.parse(id), { status: 'pending', event: event(id) })).rejects.toThrow();
+            await expect(host.settlePlatformRequest(t1, s1, platformRequestId.parse(id), { status: 'done', event: event(ulid()) })).rejects.toThrow();
+            expect((await host.listPlatformRequests(t1, s1)).find((r) => r.id === id)?.attempts).toBe(0);
+            expect(await mine()).toEqual([]);
+            await host.settlePlatformRequest(t1, s1, platformRequestId.parse(id), { status: 'done', event: event(id) });
+            const written = await mine();
+            expect(written).toHaveLength(1);
+            expect(written[0].type).toBe(EMAIL_SENT);
+            expect(JSON.parse(written[0].actor)).toEqual({ system: '@substrat-run/kernel' });
+            expect([written[0].entity_type, written[0].entity_id]).toEqual([PLATFORM_REQUEST_ENTITY_TYPE, id]);
+            expect(JSON.parse(written[0].payload)).toMatchObject({ request: id, messageId: 'msg-1', sender: 'platform' });
+            // A repeated settle finds the row terminal: it moves nothing, so it writes nothing.
+            await host.settlePlatformRequest(t1, s1, platformRequestId.parse(id), { status: 'failed', event: event(id) });
+            expect(await mine()).toHaveLength(1);
+            const row = (await stub.invoke('platform/read-requests')).find((r) => r.id === id);
+            expect(row.status).toBe('done');
+        });
         it('a transient failure keeps the intent pending and preserves a two-phase result (retry)', async () => {
             const stub = await host.getScope(alice, t1, s1);
             const id = await stub.invoke('platform/request', { kind: 'provision-sibling', payload: {} });
@@ -4400,6 +4439,20 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(rotated?.after).toMatchObject({ id: row.id, rotatedBy: officeAdmin });
                 expect(JSON.stringify(log)).not.toContain('tok-relay-rotated');
             });
+            it('a rotation sets the expiry, keeps it when omitted, and clears it with null (#2100)', async () => {
+                const [row] = await host.admin.listConnections(staff, { tenantId: t1, vertical: 'callout' });
+                const expiry = async () => (await host.admin.listConnections(staff, { tenantId: t1, vertical: 'callout' })).find((c) => c.id === row.id)
+                    .expiresAt;
+                const at = '2027-10-07T12:00:00.000Z';
+                await host.admin.updateConnectionSecret(staff, row.id, { accessToken: 'tok-dated' }, at);
+                expect(await expiry()).toBe(at);
+                await host.admin.updateConnectionSecret(staff, row.id, { accessToken: 'tok-kept' });
+                expect(await expiry()).toBe(at);
+                // The credential that had an end was replaced by one that has none (a certificate → a
+                // client secret): the old end must not stay on the connection, reading as this one's.
+                await host.admin.updateConnectionSecret(staff, row.id, { accessToken: 'tok-undated' }, null);
+                expect(await expiry()).toBeNull();
+            });
             it('records health, and a success clears a prior error', async () => {
                 const [row] = await host.admin.listConnections(staff, {
                     tenantId: t1,
@@ -6335,6 +6388,43 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 ]);
                 expect(await relinked(item('rl6'))).toHaveLength(2);
             });
+            /**
+             * The documented way to DETACH one parent of a multi-parent child (#2044): relink it
+             * onto a parent it already has. ticket0 takes a conversation's public thread off a
+             * widget session this way, so it is contract, not an accident of `writeEdge`. The
+             * expiries are planted (only a restore can hold one) to pin what the verb does to
+             * them: `to` is left permanent, as every edge a verb leaves live is, and a bystander
+             * parent keeps its own.
+             */
+            it('relink onto a live parent detaches `from` only: `to` left live and permanent, others untouched', async () => {
+                const FUTURE = '2999-01-01T00:00:00.000Z';
+                await plant([
+                    { subject: 'item:rl-dt', object: 'box:rb1' }, // from
+                    { subject: 'item:rl-dt', object: 'box:rb2', expires_at: FUTURE }, // to, already live
+                    { subject: 'item:rl-dt', object: 'box:rb3', expires_at: FUTURE }, // a bystander
+                ]);
+                await move(item('rl-dt'), box('rb1'), box('rb2'));
+                const table = (await host.admin.exportScope(staff, t1, s1)).tables.find((t) => t.name === '_substrat_tuples');
+                const col = (name) => table.columns.indexOf(name);
+                const rows = table.rows
+                    .filter((r) => r[col('subject')] === 'item:rl-dt')
+                    .map((r) => ({
+                    object: r[col('object')],
+                    revoked: r[col('revoked_at')] !== null,
+                    expires: r[col('expires_at')],
+                }))
+                    .sort((x, y) => String(x.object).localeCompare(String(y.object)));
+                expect(rows).toEqual([
+                    { object: 'box:rb1', revoked: true, expires: null },
+                    { object: 'box:rb2', revoked: false, expires: null },
+                    { object: 'box:rb3', revoked: false, expires: FUTURE },
+                ]);
+                // One move, recorded as one; the live `to` was neither revived nor re-announced.
+                const events = await relinked(item('rl-dt'));
+                expect(events).toHaveLength(1);
+                expect(events[0]).toMatchObject({ payload: { child: item('rl-dt'), from: box('rb1'), to: box('rb2') } });
+                expect(await relinked(item('rl-dt'), 'entity.linked')).toEqual([]);
+            });
             it('link revives an edge relink moved away from — INSERT OR IGNORE would have kept it dead', async () => {
                 await link(item('rl7'), box('rb1'));
                 // The twin first: a first-time link records nothing, as it never has.
@@ -7070,6 +7160,15 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(await host.admin.listEntitlements(staff, t)).toHaveLength(1);
             expect((await host.admin.listOrgs(staff, t)).filter((o) => o.id === org)).toHaveLength(1);
             expect((await host.admin.resolveIdentity(t, `oidc:reap-${t.toLowerCase()}`, 'x1'))?.principal).toBe(person);
+            // #1748: a finding and a suppress rule are the tenant's too.
+            await host.admin.recordOpsFailure({ actor: staff, operation: 'reap.finding', tenantId: t, message: 'x' });
+            await host.admin.createFindingRule(staff, t, {
+                operation: 'reap.other',
+                expiresAt: instant.parse(new Date(Date.now() + 86_400_000).toISOString()),
+                reason: 'reap fixture',
+            });
+            expect(await host.admin.listFindings(staff, { tenantId: t })).toHaveLength(1);
+            expect(await host.admin.listFindingRules(staff, t)).toHaveLength(1);
             // Reap only follows the reversible delete state.
             await expectRefusal(host.admin.reapTenant(staff, t), 'conflict', /not deleting/);
             // The caller reaps the scope first (the sweep/route orchestrates this above the
@@ -7088,6 +7187,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(await host.admin.listEntitlements(staff, t)).toHaveLength(0);
             expect((await host.admin.listOrgs(staff, t)).filter((o) => o.id === org)).toHaveLength(0);
             expect(await host.admin.resolveIdentity(t, `oidc:reap-${t.toLowerCase()}`, 'x1')).toBeUndefined();
+            expect(await host.admin.listFindings(staff, { tenantId: t })).toHaveLength(0);
+            expect(await host.admin.listFindingRules(staff, t)).toHaveLength(0);
             // The admin log is KEPT WHOLE — the witness outlives the tenant — and records the reap.
             const log = await host.admin.auditLog(staff, { tenantId: t });
             expect(log.some((r) => r.action === 'createTenant')).toBe(true);