@sun-asterisk/sungen 3.0.1 → 3.1.1

package/src/orchestrator/templates/specs-db.ts

@@ -0,0 +1,169 @@
+/* eslint-disable */
+/**
+ * Sungen Data Driver — runtime DB-verification helper (auto-generated into specs/db.ts).
+ *
+ * Read-only by construction: it only ever issues a single parameterized SELECT, and
+ * table/column identifiers are validated against a strict allowlist pattern (identifiers
+ * can't be bound as parameters). Secrets come from .env.qa / process.env, never inline.
+ *
+ * Engines: PostgreSQL (`pg`) and SQLite (`better-sqlite3`), lazy-loaded on first use.
+ * Config: a `datasources.yaml` at the project root (or qa/), with ${VAR} resolved from env.
+ *
+ * DO NOT EDIT — regenerated by `sungen generate`.
+ */
+import { expect } from '@playwright/test';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ident = (s: string): string => {
+  if (!IDENT.test(s)) throw new Error(`Unsafe identifier: ${JSON.stringify(s)} (allowed: [A-Za-z_][A-Za-z0-9_]*)`);
+  return s;
+};
+
+interface DataSourceConfig {
+  engine: 'postgres' | 'mysql' | 'sqlite';
+  url: string;
+  readonly?: boolean;
+  statement_timeout_ms?: number;
+  max_rows?: number;
+}
+
+function loadEnvQa(): void {
+  for (const name of ['.env.qa', `.env.qa.${process.env.SUNGEN_ENV || ''}`]) {
+    const p = path.join(process.cwd(), name);
+    if (!name.endsWith('.') && fs.existsSync(p)) {
+      for (const line of fs.readFileSync(p, 'utf8').split('\n')) {
+        const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+        if (m && process.env[m[1]] === undefined) {
+          process.env[m[1]] = m[2].replace(/^["']|["']$/g, '');
+        }
+      }
+    }
+  }
+}
+
+function loadConfig(): Record<string, DataSourceConfig> {
+  loadEnvQa();
+  const file = [
+    path.join(process.cwd(), 'datasources.yaml'),
+    path.join(process.cwd(), 'qa', 'datasources.yaml'),
+  ].find((f) => fs.existsSync(f));
+  if (!file) throw new Error('Data Driver: no datasources.yaml found (project root or qa/).');
+  let raw = fs.readFileSync(file, 'utf8').replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, k) => process.env[k] ?? '');
+  const { parse } = require('yaml');
+  const doc = parse(raw) || {};
+  if (!doc.datasources || typeof doc.datasources !== 'object') {
+    throw new Error('Data Driver: datasources.yaml must define a top-level `datasources:` map.');
+  }
+  return doc.datasources;
+}
+
+type Engine = { query(sql: string, params: any[]): Promise<any[]>; };
+
+class DataSource {
+  private configs: Record<string, DataSourceConfig> | null = null;
+  private engines = new Map<string, Engine>();
+
+  private cfg(name?: string): { key: string; conf: DataSourceConfig } {
+    if (!this.configs) this.configs = loadConfig();
+    const key = name || Object.keys(this.configs)[0];
+    const conf = this.configs[key];
+    if (!conf) throw new Error(`Data Driver: datasource "${key}" not found in datasources.yaml`);
+    return { key, conf };
+  }
+
+  private async engine(name?: string): Promise<{ engine: Engine; conf: DataSourceConfig }> {
+    const { key, conf } = this.cfg(name);
+    if (this.engines.has(key)) return { engine: this.engines.get(key)!, conf };
+    if (!conf.url) throw new Error(`Data Driver: datasource "${key}" has no url (set it in .env.qa).`);
+    let engine: Engine;
+    if (conf.engine === 'postgres') {
+      const { Pool } = require('pg');
+      const pool = new Pool({ connectionString: conf.url, max: 2, statement_timeout: conf.statement_timeout_ms ?? 4000 });
+      engine = { query: async (sql, params) => (await pool.query(sql, params)).rows };
+    } else if (conf.engine === 'sqlite') {
+      const Database = require('better-sqlite3');
+      const db = new Database(conf.url.replace(/^sqlite:/, ''), { readonly: conf.readonly !== false });
+      engine = { query: async (sql, params) => db.prepare(sql).all(...params) };
+    } else {
+      throw new Error(`Data Driver: engine "${conf.engine}" not supported yet (postgres | sqlite).`);
+    }
+    this.engines.set(key, engine);
+    return { engine, conf };
+  }
+
+  private build(table: string, filter: Record<string, any>): { sql: string; params: any[] } {
+    const cols = Object.keys(filter);
+    const where = cols.map((c, i) => `${ident(c)} = $${i + 1}`).join(' AND ');
+    const sql = `SELECT * FROM ${ident(table)}${where ? ' WHERE ' + where : ''} LIMIT 50`;
+    return { sql, params: cols.map((c) => filter[c]) };
+  }
+
+  /** A row matching `filter` must exist; if `expected` given, assert those columns on the first match. */
+  async assertRow(table: string, filter: Record<string, any>, expected?: Record<string, any>, datasource?: string): Promise<void> {
+    const { engine, conf } = await this.engine(datasource);
+    const { sql, params } = this.build(table, filter);
+    const rows = await engine.query(this.sqlFor(conf, sql), params);
+    expect(rows.length, `Expected a row in "${table}" where ${desc(filter)} — found ${rows.length}`).toBeGreaterThanOrEqual(1);
+    if (expected) {
+      const row = rows[0];
+      for (const [col, val] of Object.entries(expected)) {
+        ident(col);
+        expect(String(row[col]), `Column "${col}" of "${table}" where ${desc(filter)}`).toBe(String(val));
+      }
+    }
+  }
+
+  /** No row matching `filter` may exist. */
+  async assertNoRow(table: string, filter: Record<string, any>, datasource?: string): Promise<void> {
+    const { engine, conf } = await this.engine(datasource);
+    const { sql, params } = this.build(table, filter);
+    const rows = await engine.query(this.sqlFor(conf, sql), params);
+    expect(rows.length, `Expected NO row in "${table}" where ${desc(filter)} — found ${rows.length}`).toBe(0);
+  }
+
+  /** Exactly `count` rows must match `filter`. */
+  async assertCount(table: string, filter: Record<string, any>, count: number, datasource?: string): Promise<void> {
+    const { engine, conf } = await this.engine(datasource);
+    const cols = Object.keys(filter);
+    const where = cols.map((c, i) => `${ident(c)} = $${i + 1}`).join(' AND ');
+    const sql = `SELECT count(*) AS n FROM ${ident(table)}${where ? ' WHERE ' + where : ''}`;
+    const rows = await engine.query(this.sqlFor(conf, sql), cols.map((c) => filter[c]));
+    const n = Number(rows[0]?.n ?? rows[0]?.['count(*)'] ?? 0);
+    expect(n, `Expected ${count} row(s) in "${table}"${cols.length ? ' where ' + desc(filter) : ''} — found ${n}`).toBe(Number(count));
+  }
+
+  /** Rewrites $1/$2 placeholders to `?` for SQLite. */
+  private sqlFor(conf: DataSourceConfig, sql: string): string {
+    return conf.engine === 'sqlite' ? sql.replace(/\$\d+/g, '?') : sql;
+  }
+
+  // --- Named queries (catalog-backed; SQL is resolved + embedded at compile time) -----------
+  /** Read-only guard (second layer): a named query must be a single SELECT/WITH statement. */
+  private assertSelectOnly(label: string, sql: string): void {
+    const s = sql.trim().replace(/;\s*$/, '');
+    if (!/^(SELECT|WITH)\b/i.test(s)) throw new Error(`Data Driver: ${label} is not a read-only SELECT — refused.`);
+    if (s.includes(';')) throw new Error(`Data Driver: ${label} contains multiple statements — refused.`);
+    if (/\b(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|GRANT|REVOKE|MERGE|REPLACE|CALL|EXEC|EXECUTE|ATTACH|PRAGMA|VACUUM)\b/i.test(s)) {
+      throw new Error(`Data Driver: ${label} contains a write/DDL keyword — refused.`);
+    }
+  }
+
+  /**
+   * Run a catalog query (read-only) and return its rows. The result is bound to a `{{name}}`
+   * variable via `testData.bind(...)`, so the scenario asserts on it with `expect …` steps and
+   * path access (`{{name.count}}`, `{{name.first.col}}`, `{{name[2].col}}`).
+   */
+  async fetchQuery(label: string, sql: string, params: any[], datasource?: string): Promise<any[]> {
+    this.assertSelectOnly(label, sql);
+    const { engine, conf } = await this.engine(datasource);
+    return engine.query(this.sqlFor(conf, sql), params);
+  }
+}
+
+function desc(filter: Record<string, any>): string {
+  return Object.entries(filter).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(', ');
+}
+
+export const db = new DataSource();

package/src/orchestrator/templates/specs-test-data.ts

@@ -5,6 +5,8 @@ import yaml from 'yaml';
 
 export class TestDataLoader {
   private data: Record<string, any>;
+  // Data-driven (@cases): when set (via withRow), get() prefers this row's columns.
+  private row?: Record<string, any>;
 
   private constructor(data: Record<string, any>) {
     this.data = data;
@@ -41,23 +43,56 @@ export class TestDataLoader {
   }
 
   get(key: string): string {
-    // Captured/runtime vars (set() below) are stored under their literal — possibly
-    // dotted — key (e.g. "cart.product_name"), so check the flat key first.
-    let current: any = this.data[key];
-    if (current === undefined || current === null) {
-      // Fall back to nested navigation for YAML-structured keys (e.g. "cart.qty_two").
-      current = this.data;
-      for (const part of key.split('.')) {
-        if (current == null || typeof current !== 'object') {
-          throw new Error(`Test data key not found: ${key} (failed at '${part}')`);
-        }
-        current = current[part];
-      }
-    }
-    if (current === undefined || current === null) {
+    const value = this.resolve(key);
+    if (value === undefined || value === null) {
       throw new Error(`Test data key not found: ${key}`);
     }
-    return String(current);
+    return String(value);
+  }
+
+  /**
+   * Resolve a `{{...}}` reference to its raw value. Supports:
+   *  - flat keys (incl. captured runtime vars stored under a literal dotted key);
+   *  - `@cases` row columns (the current row wins);
+   *  - structured paths over nested data AND `@query`-bound result arrays:
+   *      `q.count` / `q.length`  → number of rows
+   *      `q.first.col` / `q.last.col` / `q[2].col` → a specific row's column
+   *      `q.col`                → shorthand for the first row's column
+   */
+  private resolve(key: string): any {
+    // 1. Exact flat key — captured vars (set()) live under a literal, possibly dotted, key.
+    if (this.row && key in this.row && this.row[key] !== undefined && this.row[key] !== null) {
+      return this.row[key];
+    }
+    if (this.data[key] !== undefined && this.data[key] !== null) {
+      return this.data[key];
+    }
+    // 2. Structured path: head from the row (cases) or shared data, then walk segments.
+    const tokens = String(key).replace(/\[(\d+)\]/g, '.$1').split('.');
+    let cur: any = (this.row && tokens[0] in this.row) ? this.row[tokens[0]] : this.data[tokens[0]];
+    for (let i = 1; i < tokens.length && cur != null; i++) cur = TestDataLoader.step(cur, tokens[i]);
+    return cur;
+  }
+
+  /** One navigation step over an array (with count/first/last/index/field-shorthand) or object. */
+  private static step(cur: any, token: string): any {
+    if (Array.isArray(cur)) {
+      if (token === 'count' || token === 'length') return cur.length;
+      if (token === 'first') return cur[0];
+      if (token === 'last') return cur[cur.length - 1];
+      if (/^\d+$/.test(token)) return cur[Number(token)];
+      return cur[0] == null ? undefined : cur[0][token]; // shorthand: first row's field
+    }
+    if (cur && typeof cur === 'object') return cur[token];
+    return undefined;
+  }
+
+  /**
+   * Bind a raw value (e.g. an `@query` result array) under `key` so `{{key.…}}` paths resolve.
+   * Unlike set(), the value is stored as-is (array/object), not coerced to a string.
+   */
+  bind(key: string, value: any): void {
+    this.data[key] = value;
   }
 
   /**
@@ -68,6 +103,32 @@ export class TestDataLoader {
   set(key: string, value: string): void {
     this.data[key] = value;
   }
+
+  /**
+   * Data-driven (@cases): return the list of rows at `key` (after env-overlay merge),
+   * each stamped with `__label` for the test title / report. Throws if missing or not a list.
+   */
+  cases(key: string): Array<Record<string, any>> {
+    const list = this.data[key];
+    if (!Array.isArray(list)) {
+      throw new Error(`@cases dataset "${key}" not found or not a list in test-data (got ${typeof list}).`);
+    }
+    return list.map((row: any, i: number) => {
+      const r: Record<string, any> = (row && typeof row === 'object' && !Array.isArray(row)) ? { ...row } : { value: row };
+      r.__label = String(r.case ?? r.name ?? r.label ?? `row ${i + 1}`);
+      return r;
+    });
+  }
+
+  /**
+   * Data-driven (@cases): a view whose get() prefers the given row's columns and falls
+   * back to the shared data. Used inside the per-row test() loop.
+   */
+  withRow(row: Record<string, any>): TestDataLoader {
+    const view = new TestDataLoader({ ...this.data }); // clone → per-row set() stays isolated
+    view.row = row;
+    return view;
+  }
 }
 
 function loadYamlSync(filePath: string): Record<string, any> | null {