@substrat-run/contract-tests 0.82.0 → 0.84.0

package/dist/scope-host-suite.js

@@ -144,6 +144,29 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(new Date(row.occurred_at).getTime()).not.toBeNaN();
             expect(row.pii_class).toBe('none');
         });
+        it('ctx.now() is one instant for the whole operation, and the envelope agrees (#812)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const { first, second } = await stub.invoke('test/now');
+            // A valid instant, and the SAME one on both reads. Two rows written in one
+            // transaction cannot disagree about when they were written — that is the
+            // promise a frozen clock rests on, not an implementation detail.
+            expect(instant.safeParse(first).success).toBe(true);
+            expect(second).toBe(first);
+            // And the event announcing the work carries the same instant as the work.
+            const rows = await stub.invoke('test/read-outbox');
+            const row = rows[rows.length - 1];
+            expect(row.occurred_at).toBe(first);
+        });
+        it('ctx.now() advances between operations — stable is not frozen (#812)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const a = await stub.invoke('test/now');
+            await new Promise((r) => setTimeout(r, 5));
+            const b = await stub.invoke('test/now');
+            // Held within an operation, re-read for the next one. A host that stamped
+            // once per process would pass every assertion above and be useless.
+            expect(Date.parse(b.first)).toBeGreaterThanOrEqual(Date.parse(a.first));
+            expect(b.first).not.toBe(a.first);
+        });
         it('rejects PII-classed events without a subjectId (§6.1)', async () => {
             const stub = await host.getScope(alice, t1, s1);
             await expect(stub.invoke('test/emit-unclassified-pii')).rejects.toThrow(/subjectId/);
@@ -246,6 +269,44 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect((await host.listPlatformRequestHistory(t1, s1, { status: 'failed' })).every((r) => r.status === 'failed')).toBe(true);
             expect((await host.listPlatformRequestHistory(t1, s1, { limit: 1 })).length).toBe(1);
         });
+        /**
+         * #841. `lastError` says WHAT happened; this says WHO refused — and until it existed the
+         * dashboard assumed the provider every time, so a `permission denied: protocol:read`
+         * raised by our own check, before a byte left the platform, was rendered as the provider's
+         * own words. Pinned in the shared suite because both adapters store it in their own spine
+         * table, and a read-back that disagreed between them would be worse than no read at all.
+         */
+        it('journals WHO refused beside what was refused, and survives the round trip (#841)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const id = await stub.invoke('platform/request', { kind: 'connector:test', payload: { doc: 9 } });
+            const row = (await host.listPlatformRequests(t1, s1)).find((r) => r.id === id);
+            await host.settlePlatformRequest(t1, s1, row.id, {
+                status: 'failed',
+                lastError: 'permission denied: protocol:read',
+                failure: { origin: 'platform', code: 'permission_denied', permission: 'protocol:read' },
+            });
+            const settled = (await host.listPlatformRequestHistory(t1, s1, { kind: 'connector:test' })).find((r) => r.id === id);
+            expect(settled.failure).toEqual({
+                origin: 'platform',
+                code: 'permission_denied',
+                permission: 'protocol:read',
+            });
+        });
+        /**
+         * A caller that does not attribute leaves the column NULL, and NULL must read back as
+         * "nobody classified this" rather than as an origin nobody decided. This is the shape a
+         * control plane older than the field produces, and the drawer renders it by saying
+         * nothing about origin at all.
+         */
+        it('leaves attribution null when the settling caller did not attribute (#841)', async () => {
+            const stub = await host.getScope(alice, t1, s1);
+            const id = await stub.invoke('platform/request', { kind: 'connector:test', payload: { doc: 10 } });
+            const row = (await host.listPlatformRequests(t1, s1)).find((r) => r.id === id);
+            await host.settlePlatformRequest(t1, s1, row.id, { status: 'failed', lastError: 'something broke' });
+            const settled = (await host.listPlatformRequestHistory(t1, s1, { kind: 'connector:test' })).find((r) => r.id === id);
+            expect(settled.lastError).toBe('something broke');
+            expect(settled.failure).toBeNull();
+        });
         it('newest first, so a limit is a recency window rather than an arbitrary page (#618)', async () => {
             const stub = await host.getScope(alice, t1, s1);
             const first = await stub.invoke('platform/request', { kind: 'order-check', payload: { n: 1 } });
@@ -1583,6 +1644,93 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(await host.admin.listConnectionGrants(staff, gt)).toEqual([]);
             });
         });
+        // -- the read-back: what the SCOPE says a connection may do (#726 gap 1) ----
+        //
+        // The grants above are the DIRECTORY's record. This is the other half, and the
+        // one a deployment can reach: the delivered tuples, read from where they are
+        // enforced. #716 found `protocol:attach` missing from a live connection after
+        // months of silent failure precisely because nothing outside the control plane
+        // could answer this question.
+        //
+        // The invariant that matters is agreement with the checker: whatever this
+        // returns must be exactly what `check` would allow for that connection in that
+        // scope. A read-back that disagreed would be worse than none, because it is the
+        // read an operator would believe. That agreement is asserted against real
+        // evaluation in `permission-suite` (which has the probe operation); what is
+        // pinned here is the shape — liveness, inheritance, and per-connection narrowing.
+        describe('connection grants, read back from the scope (#726)', () => {
+            const rt = tenantId.parse(ulid());
+            const rs = scopeId.parse(ulid());
+            const rconn = connectionId.parse(ulid());
+            const SCOPED = permissionKey.parse('protocol:record-signature');
+            const INHERITED = permissionKey.parse('protocol:attach');
+            const EXPIRED = permissionKey.parse('protocol:read');
+            beforeAll(async () => {
+                await host.admin.createTenant(staff, { id: rt, slug: 'tenant-readback', name: 'Readback' });
+                await host.provisionScope(staff, { tenantId: rt, scopeId: rs, vertical: 'signing' });
+                await host.admin.activateScope(staff, rt, rs);
+                await host.admin.createConnection(staff, {
+                    id: rconn,
+                    tenantId: rt,
+                    vertical: 'signing',
+                    provider: 'signer',
+                    label: 'Signer',
+                    secret: { accessToken: 'tok-readback' },
+                });
+                // Scope-targeted, tenant-wide, and one already past its expiry.
+                await host.admin.grantToConnection(staff, {
+                    connectionId: rconn,
+                    permission: SCOPED,
+                    node: { tenantId: rt, scopeId: rs },
+                    grantedBy: staff,
+                });
+                await host.admin.grantToConnection(staff, {
+                    connectionId: rconn,
+                    permission: INHERITED,
+                    node: { tenantId: rt, scopeId: null },
+                    grantedBy: staff,
+                });
+                await host.admin.grantToConnection(staff, {
+                    connectionId: rconn,
+                    permission: EXPIRED,
+                    node: { tenantId: rt, scopeId: rs },
+                    expiresAt: instant.parse('2020-01-01T00:00:00.000Z'),
+                    grantedBy: staff,
+                });
+            });
+            it('answers with the live grants, tenant-wide ones included', async () => {
+                const grants = await host.connectionGrantsInScope(rt, rs);
+                expect(grants.map((g) => g.permission).sort()).toEqual([INHERITED, SCOPED].sort());
+                expect(grants.every((g) => g.connectionId === rconn)).toBe(true);
+            });
+            it('omits an expired grant — it would not be enforced either', async () => {
+                const grants = await host.connectionGrantsInScope(rt, rs);
+                expect(grants.map((g) => g.permission)).not.toContain(EXPIRED);
+            });
+            it('is scoped to the connection — another connection in the tenant is not reported', async () => {
+                const other = connectionId.parse(ulid());
+                await host.admin.createConnection(staff, {
+                    id: other,
+                    tenantId: rt,
+                    vertical: 'signing',
+                    provider: 'other-signer',
+                    label: 'Other',
+                    secret: { accessToken: 'tok-other' },
+                });
+                await host.admin.grantToConnection(staff, {
+                    connectionId: other,
+                    permission: EXPIRED,
+                    node: { tenantId: rt, scopeId: rs },
+                    grantedBy: staff,
+                });
+                const byConnection = new Map();
+                for (const g of await host.connectionGrantsInScope(rt, rs)) {
+                    byConnection.set(g.connectionId, [...(byConnection.get(g.connectionId) ?? []), g.permission]);
+                }
+                expect(byConnection.get(other)).toEqual([EXPIRED]);
+                expect(byConnection.get(rconn)?.sort()).toEqual([INHERITED, SCOPED].sort());
+            });
+        });
         // -- connector state: a connector's own durable bookkeeping (#101 gap 3) ---
         describe('connector state', () => {
             it('round-trips arbitrary JSON keyed by (connection, key)', async () => {