@ultimat3/testing 30.5.0 → 30.7.0

package/src/seed-graph.ts

@@ -63,6 +63,33 @@ function ownedByTenant(
   return owned;
 }
 
+/**
+ * Every untenanted entity (`shared`, or of no tenant) a tenant-owned table points at through a key
+ * unique across the TABLE — a unique set holding the reference and not the tenant column. Each
+ * tenant's children then take parent rows no other tenant may reuse, so the parent seeds
+ * `perTable` rows per tenant: `perTable` alone ran out before tenant 2 (`X_SEED_GRAPH_UNSATISFIED`).
+ */
+function fannedOut(
+  shapes: ReadonlyMap<string, EntityShape>,
+  scoped: (name: string) => boolean,
+): ReadonlySet<string> {
+  const out = new Set<string>();
+  for (const shape of shapes.values()) {
+    if (!scoped(shape.name)) continue;
+    const tenantColumn = shape.entity.$tenantColumn;
+    const tableWide = [...shape.uniques, ...shape.partialUniques].filter(
+      (set) => tenantColumn === null || !set.includes(tenantColumn),
+    );
+    for (const reference of shape.references.values()) {
+      if (scoped(reference.targetEntity) || reference.targetEntity === shape.name) continue;
+      if (tableWide.some((set) => set.includes(reference.property))) {
+        out.add(reference.targetEntity);
+      }
+    }
+  }
+  return out;
+}
+
 export function seedGraph(
   entities: Readonly<Record<string, SeedEntity>>,
   options: SeedGraphOptions = {},
@@ -108,6 +135,7 @@ export function seedGraph(
   }
   const owned = ownedByTenant(shapes, roots);
   const scoped = (name: string): boolean => owned.has(name);
+  const fanned = fannedOut(shapes, scoped);
   for (const factory of Object.values(options.factories ?? {})) factory.reset();
 
   const placed = new Map<string, Placed[]>();
@@ -170,7 +198,8 @@ export function seedGraph(
     const buckets: readonly (string | null)[] = scoped(name) ? tenants : [null];
     let ordinal = 0;
     for (const [bucket, tenant] of buckets.entries()) {
-      const size = rootProperty === undefined ? perTable : 1;
+      const size =
+        rootProperty !== undefined ? 1 : fanned.has(name) ? perTable * tenantCount : perTable;
       for (let index = 0; index < size; index += 1) {
         ordinal += 1;
         const canary = stream().replace(/-/g, '').slice(0, 10);

package/src/tenant-proof-report.ts

@@ -34,10 +34,19 @@ export function tenantFindingLines(records: readonly ExerciseRecord[]): readonly
   );
 }
 
+/**
+ * B sends A's own first input, A's ids bound in only where it takes any: `{ occurrenceMs }` carries
+ * none, and B still crosses when a statement it ran names no tenant. Both readings, always.
+ */
 const causeOf = (record: ExerciseRecord, finding: TenantFinding): string =>
   finding.code === 'X_TENANT_LEAK'
-    ? `${record.kind} ${record.name}, called by tenant B with tenant A's ids ${LEG[finding.leg]}, handed back A's seeded data at ${where(finding)}: a read reached A's row by an id the caller chose, past the tenant guard`
-    : `${record.kind} ${record.name}, called by tenant B with tenant A's ids ${LEG[finding.leg]}, changed A's ${where(finding)}: a write reached A's row by an id the caller chose, past the tenant guard`;
+    ? `${record.kind} ${record.name}, called by tenant B with A's own input ${LEG[finding.leg]}, handed back A's seeded data at ${where(finding)}: a read reached A's row past the tenant guard — by an id the caller chose, or by a statement no tenant predicate scopes`
+    : `${record.kind} ${record.name}, called by tenant B with A's own input ${LEG[finding.leg]}, changed A's ${where(finding)}: a write reached A's row past the tenant guard — by an id the caller chose, or by a statement no tenant predicate scopes`;
+
+const fixOf = (name: string, finding: TenantFinding): string =>
+  finding.code === 'X_TENANT_LEAK'
+    ? `x exercise ${name} --json — then read the row behind ${where(finding)} through the repository scoped to ctx.actor, never by the input id alone, nor by an unscoped statement`
+    : `x exercise ${name} --json — then write ${where(finding)} through the repository scoped to ctx.actor, never by the input id alone, nor by an unscoped statement`;
 
 /**
  * One coded finding per tenant finding. The fix reruns the one primitive: what it reads or writes
@@ -54,7 +63,7 @@ export function tenantProofFindings(
       (finding): TenantProofFinding => ({
         code: finding.code,
         cause: causeOf(record, finding),
-        fix: `x exercise ${name} --json — then read ${finding.code === 'X_TENANT_LEAK' ? 'the row behind ' : ''}${where(finding)} through the repository scoped to ctx.actor, never by the input id alone`,
+        fix: fixOf(name, finding),
         at: `${record.kind} ${record.name}`,
       }),
     );

package/src/tenant-proof.ts

@@ -79,6 +79,12 @@ export interface TenantAttack {
    * half is skipped. An action or a query answers B directly, so a declared scope excuses nothing.
    */
   readonly sweep: boolean;
+  /**
+   * A job declaring `tenant: 'none'` (`bindJobTenant`'s `none`): no org reaches its run. Handed
+   * nothing of A's, B's run is A's run — what it writes to A's rows it writes for every enqueuer,
+   * so the write half's premise, B choosing A's row, cannot hold: skipped (`tenantlessReason`).
+   */
+  readonly tenantless: boolean;
   attack(leg: TenantLeg): Promise<LegAnswer>;
   /** A's positive control: today's exercise of the primitive, and what A's last answer was. */
   control(): Promise<{ readonly record: ExerciseRecord; readonly output: unknown }>;
@@ -129,11 +135,25 @@ export function sweepReason(
   return `crossTenant(${JSON.stringify(reason)}) declares this job reads across tenants, and B's input named nothing of A's: read half skipped, write half kept`;
 }
 
+/**
+ * The reason the write half is skipped, or `undefined`: a `tenant: 'none'` job whose input carries
+ * none of A's marks — no org and no id of B's choosing reaches the run. Handed one of A's ids, B
+ * chose A's row and the write half stands. An action or a query runs as B's actor, so B's org
+ * reaches it: a write to A's row with no id handed is an unscoped statement, crossed as ever.
+ */
+export function tenantlessReason(
+  plan: Pick<TenantAttack, 'tenantless' | 'taint'>,
+  hunted: readonly string[],
+): string | undefined {
+  if (!plan.tenantless || hunted.length !== plan.taint.marks.length) return undefined;
+  return "tenant: 'none' runs this job under no org, and B's input named nothing of A's: B's run is A's run, so what it writes it writes for every enqueuer — write half skipped, read half kept";
+}
+
 const verdictOf = (
   plan: TenantAttack,
   control: { readonly record: ExerciseRecord; readonly output: unknown },
   findings: readonly TenantFinding[],
-  swept: string | undefined,
+  skipped: readonly string[],
 ): TenantProof => {
   const { record } = control;
   if (findings.length > 0) return { verdict: 'crossed', findings };
@@ -144,7 +164,7 @@ const verdictOf = (
     };
   }
   if (plan.public !== undefined) return { verdict: 'public', reason: plan.public };
-  if (swept !== undefined) return { verdict: 'public', reason: swept };
+  if (skipped.length > 0) return { verdict: 'public', reason: skipped.join('; ') };
   // Every mark of A's, handed ones included: A was handed its own ids, and reading them is the point.
   if (plan.read && findTaint(control.output, 'output', plan.taint.marks).length === 0) {
     return {
@@ -159,12 +179,19 @@ const verdictOf = (
 export async function proveTenant(plan: TenantAttack): Promise<ExerciseRecord> {
   const marks = huntedMarks(plan.taint, plan.input);
   const findings: TenantFinding[] = [];
+  const unwritten = tenantlessReason(plan, marks);
   let swept: string | undefined;
-  const leg = async (name: TenantLeg): Promise<void> => {
+  /** B's call, between two snapshots unless the write half is skipped: then none is read. */
+  const watched = async (name: TenantLeg): Promise<LegAnswer> => {
+    if (unwritten !== undefined) return plan.attack(name);
     const before = await plan.snapshot(plan.taint.rows);
     const answer = await plan.attack(name);
     const after = await plan.snapshot(plan.taint.rows);
     findings.push(...crossedWrites(name, plan.taint, before, after));
+    return answer;
+  };
+  const leg = async (name: TenantLeg): Promise<void> => {
+    const answer = await watched(name);
     if (plan.public !== undefined) return;
     const sweep = sweepReason(plan, answer, marks);
     if (sweep === undefined) findings.push(...leaksIn(name, answer, marks));
@@ -173,5 +200,6 @@ export async function proveTenant(plan: TenantAttack): Promise<ExerciseRecord> {
   await leg('before');
   const control = await plan.control();
   await leg('after');
-  return { ...control.record, tenant: verdictOf(plan, control, findings, swept) };
+  const skipped = [swept, unwritten].filter((reason) => reason !== undefined);
+  return { ...control.record, tenant: verdictOf(plan, control, findings, skipped) };
 }

package/src/seed-pattern-sample.ts

@@ -1,216 +0,0 @@
-// Strings a declared `matches(/…/)` pattern accepts, built by walking the pattern rather than
-// guessing shapes. The common subset only — literals, classes, `.`, groups, alternation,
-// quantifiers, anchors — and an honest `[]` for anything past it (lookaround, backreference, `\b`,
-// `\p{…}`): a pattern this cannot read leaves the column's other candidates to the solver.
-
-import { fnv1a } from '@ultimat3/core';
-import { seededRandom } from './determinism';
-
-type Node =
-  | { readonly kind: 'chars'; readonly chars: readonly string[] }
-  | { readonly kind: 'alt'; readonly branches: readonly (readonly Piece[])[] }
-  | { readonly kind: 'empty' };
-
-interface Piece {
-  readonly node: Node;
-  readonly min: number;
-  readonly max: number;
-}
-
-/** How far past its floor an unbounded quantifier draws: enough to vary, short enough to store. */
-const UNBOUNDED_SPAN = 6;
-
-/** The universe a class or `.` picks from: printable ASCII, so every sample is plain text. */
-const PRINTABLE = Array.from({ length: 95 }, (_, i) => String.fromCharCode(32 + i));
-const DIGITS = PRINTABLE.filter((c) => c >= '0' && c <= '9');
-const WORD = PRINTABLE.filter((c) => /\w/.test(c));
-const SPACE = [' ', '\t'];
-
-const SHORTHAND: Readonly<Record<string, readonly string[]>> = {
-  d: DIGITS,
-  D: PRINTABLE.filter((c) => !DIGITS.includes(c)),
-  w: WORD,
-  W: PRINTABLE.filter((c) => !WORD.includes(c)),
-  s: SPACE,
-  S: PRINTABLE.filter((c) => c !== ' '),
-};
-
-const CONTROL: Readonly<Record<string, string>> = { t: '\t', n: '\n', r: '\r', f: '\f', v: '\v' };
-
-class Parser {
-  private at = 0;
-  /** The first construct past the subset; set once, and it ends the walk. */
-  private refused: string | undefined;
-  constructor(private readonly source: string) {}
-
-  /** The tree, or `undefined` when any part of the pattern is past the subset. */
-  parse(): Node | undefined {
-    const node = this.alternation();
-    if (this.refused === undefined && this.at < this.source.length) this.refuse('a stray ")"');
-    return this.refused === undefined ? node : undefined;
-  }
-
-  /** Records the refusal and moves to the end, so every loop above stops on its next look. */
-  private refuse(construct: string): readonly string[] {
-    this.refused ??= construct;
-    this.at = this.source.length;
-    return [];
-  }
-
-  private peek(): string | undefined {
-    return this.source[this.at];
-  }
-
-  private alternation(): Node {
-    const branches: Piece[][] = [this.sequence()];
-    while (this.peek() === '|') {
-      this.at += 1;
-      branches.push(this.sequence());
-    }
-    return { kind: 'alt', branches };
-  }
-
-  private sequence(): Piece[] {
-    const pieces: Piece[] = [];
-    for (let c = this.peek(); c !== undefined && c !== '|' && c !== ')'; c = this.peek()) {
-      const node = this.atom();
-      const [min, max] = this.quantifier();
-      pieces.push({ node, min, max });
-    }
-    return pieces;
-  }
-
-  private quantifier(): readonly [number, number] {
-    const c = this.peek();
-    const bounds = /^\{(\d+)(,(\d*))?\}/.exec(this.source.slice(this.at));
-    let range: readonly [number, number] | undefined;
-    if (c === '*') range = [0, UNBOUNDED_SPAN];
-    else if (c === '+') range = [1, 1 + UNBOUNDED_SPAN];
-    else if (c === '?') range = [0, 1];
-    else if (bounds !== null) {
-      const low = Number(bounds[1]);
-      const high =
-        bounds[2] === undefined ? low : bounds[3] === '' ? low + UNBOUNDED_SPAN : Number(bounds[3]);
-      range = [low, high];
-    }
-    if (range === undefined) return [1, 1];
-    this.at += bounds !== null && c === '{' ? bounds[0].length : 1;
-    // A lazy quantifier matches the same strings; only the engine's preference differs.
-    if (this.peek() === '?') this.at += 1;
-    return range;
-  }
-
-  private atom(): Node {
-    const c = this.peek() as string;
-    this.at += 1;
-    if (c === '^' || c === '$') return { kind: 'empty' };
-    if (c === '.') return { kind: 'chars', chars: PRINTABLE };
-    if (c === '[') return { kind: 'chars', chars: this.charClass() };
-    if (c === '(') return this.group();
-    if (c === '\\') return { kind: 'chars', chars: this.escape(false) };
-    if (c === '*' || c === '+' || c === '?' || c === '{')
-      return { kind: 'chars', chars: this.refuse(`a bare "${c}"`) };
-    return { kind: 'chars', chars: [c] };
-  }
-
-  private group(): Node {
-    if (this.peek() === '?') {
-      const head = this.source.slice(this.at, this.at + 3);
-      if (head.startsWith('?:')) this.at += 2;
-      else if (/^\?<[A-Za-z_$]/.test(head) && this.source.includes('>', this.at)) {
-        this.at = this.source.indexOf('>', this.at) + 1;
-      } else return { kind: 'chars', chars: this.refuse(`the lookaround "(${head}"`) };
-    }
-    const inner = this.alternation();
-    if (this.peek() !== ')') return { kind: 'chars', chars: this.refuse('an unclosed group') };
-    this.at += 1;
-    return inner;
-  }
-
-  private escape(inClass: boolean): readonly string[] {
-    const c = this.peek();
-    if (c === undefined) return this.refuse('a trailing backslash');
-    this.at += 1;
-    const shorthand = Object.hasOwn(SHORTHAND, c) ? SHORTHAND[c] : undefined;
-    if (shorthand !== undefined) return shorthand;
-    const control = Object.hasOwn(CONTROL, c) ? CONTROL[c] : undefined;
-    if (control !== undefined) return [control];
-    const hex = c === 'x' ? 2 : c === 'u' ? 4 : 0;
-    if (hex > 0) {
-      const digits = this.source.slice(this.at, this.at + hex);
-      if (!/^[0-9a-fA-F]+$/.test(digits) || digits.length !== hex) return this.refuse(`\\${c}`);
-      this.at += hex;
-      return [String.fromCharCode(Number.parseInt(digits, 16))];
-    }
-    // `\b`, `\B`, a backreference, `\p{…}`, `\k<…>`, `\0`: a position or a reference, not a char.
-    if (/[A-Za-z0-9]/.test(c)) return this.refuse(`\\${c}${inClass ? ' in a class' : ''}`);
-    return [c];
-  }
-
-  /** The members of `[…]`, drawn from printable ASCII; a negated class is its complement there. */
-  private charClass(): readonly string[] {
-    const negated = this.peek() === '^';
-    if (negated) this.at += 1;
-    const members = new Set<string>();
-    let first = true;
-    for (let c = this.peek(); c !== ']' || first; c = this.peek()) {
-      if (c === undefined) return this.refuse('an unclosed class');
-      first = false;
-      const low = this.classMember();
-      if (low.length === 1 && this.peek() === '-' && this.source[this.at + 1] !== ']') {
-        this.at += 1;
-        const high = this.classMember();
-        if (high.length !== 1) return this.refuse('a range ending in a shorthand');
-        const [from, to] = [(low[0] as string).charCodeAt(0), (high[0] as string).charCodeAt(0)];
-        // Past printable ASCII the range's own first member stands in, so `[À-ÿ]` still yields one.
-        const inside = PRINTABLE.filter((ch) => ch.charCodeAt(0) >= from && ch.charCodeAt(0) <= to);
-        for (const ch of inside.length > 0 ? inside : [String.fromCharCode(from)]) members.add(ch);
-      } else {
-        for (const ch of low) members.add(ch);
-      }
-    }
-    this.at += 1;
-    return negated ? PRINTABLE.filter((ch) => !members.has(ch)) : [...members];
-  }
-
-  private classMember(): readonly string[] {
-    const c = this.peek() as string;
-    this.at += 1;
-    return c === '\\' ? this.escape(true) : [c];
-  }
-}
-
-const draw = (node: Node, random: () => number): string => {
-  const pick = <T>(items: readonly T[]): T | undefined =>
-    items[Math.floor(random() * items.length)];
-  if (node.kind === 'empty') return '';
-  if (node.kind === 'chars') return pick(node.chars) ?? '';
-  const branch = pick(node.branches) ?? [];
-  return branch
-    .map((piece) => {
-      const count = piece.min + Math.floor(random() * (piece.max - piece.min + 1));
-      return Array.from({ length: count }, () => draw(piece.node, random)).join('');
-    })
-    .join('');
-};
-
-/** Tries per sample: a draw that crosses an anchor (`a^b`) or a flag is retried, never returned. */
-const ATTEMPTS = 8;
-
-/**
- * Up to `count` distinct strings `pattern.test` accepts, the same ones for the same `seed` on any
- * machine. Empty when the pattern is past the subset, or when no draw lands inside it.
- */
-export function patternSamples(pattern: RegExp, seed: string, count = 4): readonly string[] {
-  const tree = new Parser(pattern.source).parse();
-  if (tree === undefined) return [];
-  const random = seededRandom(fnv1a(`${pattern.source}/${pattern.flags}:${seed}`) || 1);
-  // `lastIndex` would make `test` stateful under `g`/`y`; a copy without them judges each draw.
-  const judge = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ''));
-  const out: string[] = [];
-  for (let attempt = 0; attempt < count * ATTEMPTS && out.length < count; attempt += 1) {
-    const sample = draw(tree, random);
-    if (judge.test(sample) && !out.includes(sample)) out.push(sample);
-  }
-  return out;
-}