@superblocksteam/shared 0.9603.2 → 0.9604.0

package/src/database-lifecycle/index.test.ts

@@ -1,13 +1,16 @@
 import { describe, expect, test } from 'vitest';
 
+import { ApiTriggerType } from '../types/api/index.js';
 import {
+  DATABASE_LIFECYCLE_MANAGED_BY,
+  LIFECYCLE_OPERATIONS,
   computeBindingKey,
   computeDesiredSpecHash,
   computeNativeDbApplicationToken,
-  computeNativeDbBindingToken,
-  computeNativeDbDatabaseName,
+  computeNativeDbProfileToken,
   computeRequirementKey,
   containsCredentialMaterial,
+  isLifecycleManagedIntegrationAllowedForApiTrigger,
   isSecretKey,
   isTerminalLifecycleState,
   nativeDbIamSessionPolicy,
@@ -16,6 +19,21 @@ import {
 } from './index.js';
 
 describe('database lifecycle contracts', () => {
+  // Postgres `ALTER TYPE ... ADD VALUE` appends. TypeORM's entity-vs-schema
+  // check treats enum label order as part of the contract, so this array must
+  // match the live `lifecycle_operation_enum` order rather than alphabetical
+  // or semantic grouping.
+  test('lists lifecycle operations in Postgres enum order', () => {
+    expect(LIFECYCLE_OPERATIONS).toEqual(['ensure_database', 'migrate_schema', 'retire_database', 'ensure_physical_database_instance']);
+  });
+
+  test('allows lifecycle-managed integrations only in application APIs', () => {
+    expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.UI, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(true);
+    expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
+    expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.SCHEDULE, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
+    expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, null)).toBe(true);
+  });
+
   test('computes stable requirement, binding, and desired spec identifiers', async () => {
     const requirement = {
       logicalName: 'Orders DB',
@@ -32,27 +50,28 @@ describe('database lifecycle contracts', () => {
     expect(computeRequirementKey({ logicalName: 'orders/db', engine: 'postgres' })).toBe('orders-db~orders%2Fdb:postgres');
     expect(computeRequirementKey({ logicalName: 'orders-db', engine: 'postgres' })).toBe('orders-db~orders-db:postgres');
     // binding_key excludes the logical name on purpose: one database per
-    // (organization, application, environment, profile). Two different logical
-    // names under the same profile resolve to the same binding_key.
+    // (organization, application, profile). Two different logical names under
+    // the same profile resolve to the same binding_key.
     expect(
       computeBindingKey({
         organizationId: 'org-1',
         applicationId: 'app-1',
-        environment: 'edit',
         profile: 'Staging EU'
       })
-    ).toBe('org-1:app-1:edit:staging-eu~Staging%20EU');
+    ).toBe('org-1:app-1:staging-eu~Staging%20EU');
     expect(
       computeBindingKey({
         organizationId: 'org-1',
         applicationId: 'app-1',
-        environment: 'edit',
         profile: 'staging'
       })
-    ).toBe('org-1:app-1:edit:staging~staging');
+    ).toBe('org-1:app-1:staging~staging');
 
     await expect(computeDesiredSpecHash(requirement)).resolves.toBe(
-      await computeDesiredSpecHash({ ...requirement, extensions: ['uuid-ossp', 'pgcrypto'] })
+      await computeDesiredSpecHash({
+        ...requirement,
+        extensions: ['uuid-ossp', 'pgcrypto']
+      })
     );
     await expect(computeDesiredSpecHash(requirement)).resolves.toBe('QsCl6RVzJVEwf4Nuk0D27rRtycYe2vQZMxcXLt9WUkQ=');
   });
@@ -67,8 +86,14 @@ describe('database lifecycle contracts', () => {
     } as const;
 
     const withoutDirectory = await computeDesiredSpecHash(infrastructureSpec);
-    const withDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/migrations' });
-    const withOtherDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/other-migrations' });
+    const withDirectory = await computeDesiredSpecHash({
+      ...infrastructureSpec,
+      migrationDirectory: 'db/migrations'
+    });
+    const withOtherDirectory = await computeDesiredSpecHash({
+      ...infrastructureSpec,
+      migrationDirectory: 'db/other-migrations'
+    });
 
     // migrationDirectory only says where the SQL files live, not what
     // infrastructure to provision, so changing it must not look like drift.
@@ -91,7 +116,7 @@ describe('database lifecycle contracts', () => {
     expect(first).toBe(second);
   });
 
-  test('redacts raw credential material while preserving credential refs', () => {
+  test('redacts raw credential material and generic credential refs while preserving physical masterCredentialRef', () => {
     const redacted = redactLifecycleSecrets({
       host: 'db.internal',
       password: 'raw-password',
@@ -108,6 +133,11 @@ describe('database lifecycle contracts', () => {
           ref: 'database/orders',
           field: 'password'
         }
+      },
+      masterCredentialRef: {
+        resolver: 'aws_secrets_manager',
+        ref: 'physical-instance/master',
+        field: 'password'
       }
     });
 
@@ -122,11 +152,12 @@ describe('database lifecycle contracts', () => {
         }
       },
       credential_refs: {
-        password: {
-          resolver: 'vault',
-          ref: 'database/orders',
-          field: 'password'
-        }
+        password: '[REDACTED]'
+      },
+      masterCredentialRef: {
+        resolver: 'aws_secrets_manager',
+        ref: 'physical-instance/master',
+        field: 'password'
       }
     });
   });
@@ -158,17 +189,17 @@ describe('database lifecycle contracts', () => {
   test('builds a canonical session policy from a valid managed Postgres IAM descriptor', () => {
     const descriptor = parseNativeDbIamDescriptor({
       application_id: 'application-id',
-      auth_descriptor_version: 1,
+      auth_descriptor_version: 3,
       auth_mode: 'aws_iam_role',
       aws_account_id: '123456789012',
       binding_id: 'binding-id',
       cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
       connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
       host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
       port: 5432,
       region: 'us-west-2',
-      username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+      username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
     });
 
     expect(descriptor).toBeDefined();
@@ -176,57 +207,57 @@ describe('database lifecycle contracts', () => {
       throw new Error('Expected a valid IAM descriptor');
     }
     expect(nativeDbIamSessionPolicy(descriptor)).toBe(
-      '{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime"}]}'
+      '{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef1234567890_0123456789abcdef01234567_runtime"}]}'
     );
   });
 
-  test('reads binding-scoped v2 managed Postgres IAM descriptors', () => {
+  test('reads managed Postgres IAM descriptors with auth_descriptor_version 3', () => {
     expect(
       parseNativeDbIamDescriptor({
         application_id: 'application-id',
-        auth_descriptor_version: 2,
+        auth_descriptor_version: 3,
         auth_mode: 'aws_iam_role',
         aws_account_id: '123456789012',
         binding_id: 'binding-id',
         cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
         connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
         host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
         port: 5432,
         region: 'us-west-2',
-        username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
+        username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
       })
     ).toEqual({
       application_id: 'application-id',
-      auth_descriptor_version: 2,
+      auth_descriptor_version: 3,
       auth_mode: 'aws_iam_role',
       aws_account_id: '123456789012',
       binding_id: 'binding-id',
       cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
       connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
       host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
       port: 5432,
       region: 'us-west-2',
-      username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
+      username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
     });
   });
 
-  test('rejects v2 descriptors when database and runtime username use different binding tokens', () => {
+  test('rejects descriptors when database and runtime username do not match', () => {
     expect(
       parseNativeDbIamDescriptor({
         application_id: 'application-id',
-        auth_descriptor_version: 2,
+        auth_descriptor_version: 3,
         auth_mode: 'aws_iam_role',
         aws_account_id: '123456789012',
         binding_id: 'binding-id',
         cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
         connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
         host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
         port: 5432,
         region: 'us-west-2',
-        username: 'sbndb_abcdef123456_fedcba9876543210fedcba98_runtime'
+        username: 'sbndb_abcdef1234567890_fedcba9876543210fedcba98_runtime'
       })
     ).toBeUndefined();
   });
@@ -234,56 +265,82 @@ describe('database lifecycle contracts', () => {
   test('rejects malformed or non-commercial managed Postgres IAM descriptors', () => {
     const descriptor = {
       application_id: 'application-id',
-      auth_descriptor_version: 1,
+      auth_descriptor_version: 3,
       auth_mode: 'aws_iam_role',
       aws_account_id: '123456789012',
       binding_id: 'binding-id',
       cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
       connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
       host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
       port: 5432,
       region: 'us-west-2',
-      username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+      username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
     };
 
-    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 3 })).toBeUndefined();
-    expect(parseNativeDbIamDescriptor({ ...descriptor, cluster_resource_id: 'not-an-rds-resource' })).toBeUndefined();
-    expect(parseNativeDbIamDescriptor({ ...descriptor, connector_role_arn: 'arn:aws:iam::210987654321:role/other' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 1 })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 2 })).toBeUndefined();
+    expect(
+      parseNativeDbIamDescriptor({
+        ...descriptor,
+        cluster_resource_id: 'not-an-rds-resource'
+      })
+    ).toBeUndefined();
+    expect(
+      parseNativeDbIamDescriptor({
+        ...descriptor,
+        connector_role_arn: 'arn:aws:iam::210987654321:role/other'
+      })
+    ).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, database: 'orders' })).toBeUndefined();
-    expect(parseNativeDbIamDescriptor({ ...descriptor, host: descriptor.host.toUpperCase() })).toBeUndefined();
-    expect(parseNativeDbIamDescriptor({ ...descriptor, host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com' })).toBeUndefined();
+    expect(
+      parseNativeDbIamDescriptor({
+        ...descriptor,
+        host: descriptor.host.toUpperCase()
+      })
+    ).toBeUndefined();
+    expect(
+      parseNativeDbIamDescriptor({
+        ...descriptor,
+        host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com'
+      })
+    ).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, port: 0 })).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'cn-north-1' })).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'us-gov-west-1' })).toBeUndefined();
-    expect(parseNativeDbIamDescriptor({ ...descriptor, username: 'sbndb_000000000000_7bfeae1170db923274f1943f_runtime' })).toBeUndefined();
+    expect(
+      parseNativeDbIamDescriptor({
+        ...descriptor,
+        username: 'sbndb_0000000000000000_7bfeae1170db923274f1943f_runtime'
+      })
+    ).toBeUndefined();
   });
 
   test('accepts standalone RDS IAM resource IDs', () => {
     expect(
       parseNativeDbIamDescriptor({
         application_id: 'application-id',
-        auth_descriptor_version: 1,
+        auth_descriptor_version: 3,
         auth_mode: 'aws_iam_role',
         aws_account_id: '123456789012',
         binding_id: 'binding-id',
         cluster_resource_id: 'db-ABCDEF0123456789-1',
         connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
         host: 'native-db.example.us-west-2.rds.amazonaws.com',
         port: 5432,
         region: 'us-west-2',
-        username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+        username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
       })
     ).toBeDefined();
   });
 
-  test('derives canonical IAM database and runtime-user identity tokens', async () => {
+  test('derives canonical IAM application token', async () => {
     await expect(computeNativeDbApplicationToken('application-id')).resolves.toBe('7bfeae1170db923274f1943f');
-    await expect(computeNativeDbDatabaseName('abcdef123456', 'database-id')).resolves.toBe('sbndb_abcdef123456_dad72612f7a80580b028178f');
   });
 
-  test('derives a stable binding identity token for v2 database and runtime-user names', async () => {
-    await expect(computeNativeDbBindingToken('binding-id')).resolves.toBe('927968fc37b7b41be7e14cf9');
+  test('derives canonical IAM profile token', async () => {
+    await expect(computeNativeDbProfileToken('production')).resolves.toHaveLength(16);
+    await expect(computeNativeDbProfileToken('Production')).resolves.toBe(await computeNativeDbProfileToken('production'));
   });
 });