@voxgig/sdkgen 4.34.0 → 4.34.1

package/project/.sdk/src/cmp/php/TestClean_php.ts

@@ -373,8 +373,28 @@ class CleanTest extends TestCase
         };
     }
 
+    // Offline, as every generated suite is: the test OPTION resolves a
+    // required server variable to test-<name>, and installs no transport.
+    private static function offline(array $opts): array
+    {
+        return array_merge($opts, ['test' => ['active' => true]]);
+    }
+
+    // A client the sweep cannot build leaves nothing swept: a harness error,
+    // not a leak.
+    private static function construct(array $opts): ${Name}SDK
+    {
+        try {
+            return new ${Name}SDK(self::offline($opts));
+        } catch (\\Throwable $e) {
+            throw new \\RuntimeException('clean harness: the client could not be constructed, ' .
+                'so nothing was swept: ' . $e->getMessage(), 0, $e);
+        }
+    }
+
     private static function make_sdk(
-        callable $respond, \\ArrayObject $sinks, ?array $cleanopts = null, array $extra = []
+        callable $respond, \\ArrayObject $sinks, ?array $cleanopts = null, array $extra = [],
+        ?array $auth = null
     ): array
     {
         $capture = function (string $name) use ($sinks): callable {
@@ -425,8 +445,11 @@ class CleanTest extends TestCase
         if (0 < count($feature)) {
             $opts['feature'] = $feature;
         }
+        if (null !== $auth) {
+            $opts['auth'] = $auth;
+        }
 
-        return [new ${Name}SDK($opts), $watcher];
+        return [self::construct($opts), $watcher];
     }
 
     // The first operation that completes against a plain 200: with no
@@ -435,7 +458,7 @@ class CleanTest extends TestCase
     // answers get_name(), as the feature corpus runner finds them.
     private static function usable_op(): ?array
     {
-        $plain = new ${Name}SDK([
+        $plain = self::construct([
             'apikey' => self::CANARY['apikey'],
             'utility' => [
                 'fetcher' => function (${Name}Context $_ctx, string $_url, array $_fetchdef): array {
@@ -465,7 +488,7 @@ class CleanTest extends TestCase
         $entities = ${Name}Config::shared_config()['entity'] ?? [];
         foreach ($found as $entname => $accessor) {
             $ent = $plain->$accessor();
-            $ops = array_values(array_filter(['list', 'load', 'create', 'update', 'remove'],
+            $ops = array_values(array_filter(['list', 'load', 'create', 'update', 'patch', 'remove'],
                 function (string $op) use ($ent): bool {
                     return method_exists($ent, $op);
                 }));
@@ -499,12 +522,13 @@ class CleanTest extends TestCase
         // What the caller passed and keeps; an array, so the call cannot
         // change it, but it is searched like the record the watcher reads.
         $held = $ctrl['explain'] ?? null;
+        $accessor = $target['accessor'];
+        $op = $target['op'];
+        $entity = $sdk->$accessor();
         $out = null;
         $err = null;
         try {
-            $accessor = $target['accessor'];
-            $op = $target['op'];
-            $out = $sdk->$accessor()->$op($target['match'], $ctrl);
+            $out = $entity->$op($target['match'], $ctrl);
         } catch (\\Throwable $e) {
             $err = $e;
         }
@@ -519,6 +543,10 @@ class CleanTest extends TestCase
                 $sinks[] = $s;
             }
         }
+        // Raw, as a caller copying the match into another query reads it.
+        foreach (self::surfaces('match', $entity->match_get()) as $s) {
+            $sinks[] = $s;
+        }
 
         $explain = null;
         $last = $watcher->last;
@@ -539,6 +567,11 @@ class CleanTest extends TestCase
 
     public function test_no_credential_leaves_the_sdk_in_any_form(): void
     {
+        // PHP records a frame's arguments unless the ini says otherwise, and
+        // they hold every context the failing frames were handed: clean strips
+        // them, which the sweep sees only with them recorded. A production ini
+        // switches them off, so the sweep switches them on.
+        $args = ini_set('zend.exception_ignore_args', '0');
         // Frameworks turn every notice into an exception (PHPUnit 8 did too);
         // one thrown mid-pipeline must still leave clean.
         set_error_handler(static function (int $no, string $str, string $file, int $line): bool {
@@ -548,6 +581,9 @@ class CleanTest extends TestCase
             $this->sweep();
         } finally {
             restore_error_handler();
+            if (false !== $args) {
+                ini_set('zend.exception_ignore_args', $args);
+            }
         }
     }
 
@@ -585,14 +621,19 @@ class CleanTest extends TestCase
             }
         }
 
+        // A name given at run time replaces the declared one: the match leaves
+        // out whichever name prepare_auth placed.
+        [$sdk, $watcher] = self::make_sdk(self::scenarios()['ok'], $sinks, null, [], ['name' => 'zzcred']);
+        self::drive($sdk, $watcher, $target, [], $sinks);
+
         // A credential mistyped as a map is rejected by validation, whose
         // message quotes the value it rejected.
         $rejected = null;
         try {
-            new ${Name}SDK([
+            new ${Name}SDK(self::offline([
                 'apikey' => ['value' => self::CANARY['apikey']],
                 'clean' => ['values' => self::CANARY['value']],
-            ]);
+            ]));
         } catch (\\Throwable $e) {
             $rejected = $e;
         }
@@ -675,7 +716,7 @@ class CleanTest extends TestCase
         // With no clean option at all, the schema defaults still apply.
         $respond404 = self::scenarios()['notfound'];
         $bwatcher = self::capture_feature($sinks);
-        $bare = new ${Name}SDK([
+        $bare = self::construct([
             'apikey' => self::CANARY['apikey'],
             'secret' => self::CANARY['secret'],
             'headers' => ['X-Custom-Token' => self::CANARY['header']],
@@ -691,12 +732,14 @@ class CleanTest extends TestCase
 
         // A feature's name is not a field name: only the sensitive names
         // inside its settings register. An entity block, of per-entity
-        // settings or seeded records keyed by entity name and id, is not read.
-        $featured = new ${Name}SDK([
+        // settings or seeded records keyed by entity name and id, is not read,
+        // and nor are rbac's rules, keyed by entity and operation names.
+        $featured = self::construct([
             'apikey' => self::CANARY['apikey'],
             'feature' => [
                 'zzsecrets' => ['active' => false, 'kind' => 'PLAINSETTING-q8w2e4r6'],
                 'zzfeat' => ['active' => false, 'apitoken' => 'FEATTOKEN-z9y8x7w6'],
+                'rbac' => ['active' => false, 'rules' => ['zztoken.load' => 'PLAINRULE-k7j5h3g1']],
                 'test' => ['active' => false, 'entity' => [
                     'zztoken' => ['ZZTOKEN01' => ['note' => 'PLAINRECORD-t5r3e1w9']]]],
             ],
@@ -707,6 +750,7 @@ class CleanTest extends TestCase
         $ftoken = $fclean($featured->get_root_ctx(), 'token FEATTOKEN-z9y8x7w6');
         $frecord = $fclean($featured->get_root_ctx(), 'record PLAINRECORD-t5r3e1w9');
         $falias = $fclean($featured->get_root_ctx(), 'alias PLAINALIAS-m2n4b6v8');
+        $frule = $fclean($featured->get_root_ctx(), 'rule PLAINRULE-k7j5h3g1');
 
         $leaked = [];
         $excerpt = '';
@@ -758,6 +802,7 @@ class CleanTest extends TestCase
         $this->assertSame('token ' . self::MASK, $ftoken);
         $this->assertSame('record PLAINRECORD-t5r3e1w9', $frecord);
         $this->assertSame('alias PLAINALIAS-m2n4b6v8', $falias);
+        $this->assertSame('rule PLAINRULE-k7j5h3g1', $frule);
 
         $explained = $explains['ok/explain'] ?? [];
         $this->assertNotNull($explained['result'] ?? null, 'the explain record should carry the result');
@@ -766,6 +811,22 @@ class CleanTest extends TestCase
     }
 
     public function test_the_sweep_can_see_a_leak_clean_switched_off_shows_the_credential(): void
+    {
+        // With clean off nothing strips the trace arguments, and var_export
+        // renders the whole context through them: 43 MB of text on a
+        // 31-operation API (#292). The control proves the sweep sees a raw
+        // value, which the arguments are not needed for.
+        $args = ini_set('zend.exception_ignore_args', '1');
+        try {
+            $this->leak_control();
+        } finally {
+            if (false !== $args) {
+                ini_set('zend.exception_ignore_args', $args);
+            }
+        }
+    }
+
+    private function leak_control(): void
     {
         $target = self::usable_op();
         if (null === $target) {

package/project/.sdk/src/cmp/php/TestDirect_php.ts

@@ -15,11 +15,26 @@ import {
   serverVarEnv,
   serverVariables,
   pointParts,
+  liveStrict,
+  liveStrictNote,
 } from '@voxgig/sdkgen'
 
 import { formatPhpValue } from './utility_php'
 
 
+// Blocked without the ids its request needs, rather than sent with null.
+function liveKeysBlock(keys: string[], entidEnvVar: string): string {
+  return 0 === keys.length ? '' : `        if ($setup["live"]) {
+            foreach ([${keys.map((k) => JSON.stringify(k)).join(', ')}] as $_liveKey) {
+                if (null === ($setup["idmap"][$_liveKey] ?? null)) {
+                    Runner::live_miss(self::LIVE_STRICT, "Live test blocked: needs " . $_liveKey . " via ${entidEnvVar}");
+                }
+            }
+        }
+`
+}
+
+
 function normalizePathParams(
   parts: string[],
   params: any[],
@@ -145,6 +160,10 @@ const TestDirect = cmp(function TestDirect(props: any) {
 
   const entidEnvVar = `${PROJECTNAME}_TEST_${envToken(entity.name)}_ENTID`
 
+  // The *_ENTID key a live test reads a parameter's value from.
+  const liveKey = (param: any): string =>
+    ('id' === param.n ? entity.name : param.n.replace(/_id$/, '')) + '01'
+
   File({ name: entity.Name + 'DirectTest.' + target.ext }, () => {
 
     Content(`<?php
@@ -159,25 +178,18 @@ use PHPUnit\\Framework\\TestCase;
 
 class ${entity.Name}DirectTest extends TestCase
 {
+${liveStrictNote(liveStrict(model, target.name), '//', '    ')}
+    private const LIVE_STRICT = ${liveStrict(model, target.name)};
+
+    private static function liveOk(array $result): bool
+    {
+        $status = Helpers::to_int($result["status"] ?? 0);
+        return empty($result["err"]) && !empty($result["ok"]) && $status >= 200 && $status < 300;
+    }
+
 `)
 
     if (hasList && listPoint) {
-      const listLiveIdKeys: string[] = listParams.map((lp: any) => {
-        return lp.n === 'id'
-          ? entity.name + '01'
-          : lp.n.replace(/_id$/, '') + '01'
-      })
-      const listSkipBlock = listLiveIdKeys.length > 0
-        ? `        if ($setup["live"]) {
-            foreach ([${listLiveIdKeys.map(k => `"${k}"`).join(', ')}] as $_liveKey) {
-                if (!isset($setup["idmap"][$_liveKey]) || $setup["idmap"][$_liveKey] === null) {
-                    $this->markTestSkipped("live test needs $_liveKey via *_ENTID env var (synthetic IDs only)");
-                    return;
-                }
-            }
-        }
-`
-        : ''
       Content(`    public function test_direct_list_${entity.name}(): void
     {
         $setup = ${entity.name}_direct_setup([
@@ -189,58 +201,28 @@ class ${entity.Name}DirectTest extends TestCase
             $this->markTestSkipped($_reason ?? "skipped via sdk-test-control.json");
             return;
         }
-${listSkipBlock}        $client = $setup["client"];
+${liveKeysBlock(listParams.map(liveKey), entidEnvVar)}        $client = $setup["client"];
 
+        $params = [];
 `)
-
-      if (listParams.length > 0) {
-        Content(`        $params = [];
+      listParams.forEach((lp: any, i: number) => {
+        Content(`        $params["${lp.n}"] = $setup["live"] ? ($setup["idmap"]["${liveKey(lp)}"] ?? null) : "direct0${i + 1}";
 `)
-        for (const lp of listParams) {
-          const key = lp.n === 'id'
-            ? entity.name + '01'
-            : lp.n.replace(/_id$/, '') + '01'
-          Content(`        if ($setup["live"]) {
-            $params["${lp.n}"] = $setup["idmap"]["${key}"];
-        } else {
-            $params["${lp.n}"] = "direct01";
-        }
-`)
-        }
-        Content(`
+      })
+      Content(`
         $result = $client->direct([
             "path" => "${listPath}",
             "method" => "GET",
             "params" => $params,
         ]);
-`)
-      } else {
-        Content(`
-        $result = $client->direct([
-            "path" => "${listPath}",
-            "method" => "GET",
-            "params" => [],
-        ]);
-`)
-      }
-
-      Content(`        if ($setup["live"]) {
-            // Live mode is lenient: synthetic IDs frequently 4xx and the
-            // list-response shape varies wildly across public APIs. Skip
-            // rather than fail when the call doesn't return a usable list.
-            if (!empty($result["err"])) {
-                $this->markTestSkipped("list call failed (likely synthetic IDs against live API): " . (string)$result["err"]);
-                return;
-            }
-            if (empty($result["ok"])) {
-                $this->markTestSkipped("list call not ok (likely synthetic IDs against live API)");
-                return;
+        if ($setup["live"]) {
+            if (!self::liveOk($result)) {
+                Runner::live_miss(self::LIVE_STRICT, "Live list failed: " . Runner::live_describe($result));
             }
-            $status = Helpers::to_int($result["status"]);
-            if ($status < 200 || $status >= 300) {
-                $this->markTestSkipped("expected 2xx status, got " . $status);
-                return;
+            if (null === Runner::live_list($result["data"] ?? null)) {
+                Runner::live_miss(self::LIVE_STRICT, "Live list returned no list: " . Runner::live_describe($result));
             }
+            $this->assertIsArray(Runner::live_list($result["data"]));
         } else {
             $this->assertArrayNotHasKey("err", $result);
             $this->assertTrue($result["ok"]);
@@ -255,15 +237,11 @@ ${listSkipBlock}        $client = $setup["client"];
     }
 
     if (hasLoad && loadPoint) {
-      // Skip live direct-load only when there's no way to fill path params:
-      // no spec examples and no list-bootstrap. Spec examples win first.
-      const loadSkipBlock = (loadParams.length > 0 && !loadAllHaveExamples)
-        ? `        if ($setup["live"]) {
-            $this->markTestSkipped("live direct-load needs real ID — set *_ENTID env var with real IDs to run");
-            return;
-        }
-`
-        : ''
+      const discover = !loadAllHaveExamples && hasList && 0 < loadParams.length
+      const idParam = loadParams.find((p: any) => 'id' === p.n)?.n ?? loadParams[0]?.n ?? 'id'
+      const loadLiveIdKeys: string[] = loadAllHaveExamples ? [] :
+        discover ? listParams.map(liveKey).concat(loadParams.filter((p: any) => idParam !== p.n).map(liveKey)) :
+          loadParams.map(liveKey)
       Content(`    public function test_direct_load_${entity.name}(): void
     {
         $setup = ${entity.name}_direct_setup(["id" => "direct01"]);
@@ -272,82 +250,71 @@ ${listSkipBlock}        $client = $setup["client"];
             $this->markTestSkipped($_reason ?? "skipped via sdk-test-control.json");
             return;
         }
-${loadSkipBlock}        $client = $setup["client"];
-
-`)
+${liveKeysBlock([...new Set(loadLiveIdKeys)], entidEnvVar)}        $client = $setup["client"];
 
-      const needsQuery = loadParams.length > 0 || loadLiveQueryLines !== ''
-      if (needsQuery) {
-        Content(`        $params = [];
+        $params = [];
         $query = [];
+        if ($setup["live"]) {
+${loadLiveQueryLines ? loadLiveQueryLines + '\n' : ''}`)
+      if (loadAllHaveExamples) {
+        Content(loadExampleLines + '\n')
+      }
+      else if (discover) {
+        Content(`            $list_result = $client->direct([
+                "path" => "${listPath}",
+                "method" => "GET",
+                "params" => [${listParams.map((p: any) => `"${p.n}" => $setup["idmap"]["${liveKey(p)}"] ?? null`).join(', ')}],
+            ]);
+            if (!self::liveOk($list_result)) {
+                Runner::live_miss(self::LIVE_STRICT, "Live list discovery failed: " . Runner::live_describe($list_result));
+            }
+            $records = Runner::live_list($list_result["data"] ?? null);
+            if (null === $records) {
+                Runner::live_miss(self::LIVE_STRICT, "Live list discovery returned no list: " . Runner::live_describe($list_result));
+            }
+            if (0 === count($records)) {
+                Runner::live_empty("The account has no ${entity.name} record to load");
+            }
+            $first = is_array($records[0]) ? $records[0] : [];
+            $found = $first["${idParam}"] ?? $first["id"] ?? null;
+            if (null === $found) {
+                Runner::live_miss(self::LIVE_STRICT, "Live load blocked: discovery returned no usable identity");
+            }
+            $params["${idParam}"] = $found;
 `)
-        if (loadAllHaveExamples) {
-          Content(`        if ($setup["live"]) {
-`)
-          if (loadLiveQueryLines) Content(loadLiveQueryLines + '\n')
-          Content(loadExampleLines + '\n')
-          Content(`        } else {
-`)
-          for (let i = 0; i < loadParams.length; i++) {
-            Content(`            $params["${loadParams[i].n}"] = "direct0${i + 1}";
-`)
-          }
-          Content(`        }
+        for (const p of loadParams.filter((p: any) => idParam !== p.n)) {
+          Content(`            $params["${p.n}"] = $setup["idmap"]["${liveKey(p)}"] ?? null;
 `)
-        } else if (loadParams.length > 0) {
-          if (loadLiveQueryLines) {
-            Content(`        if ($setup["live"]) {
-${loadLiveQueryLines}
         }
+      }
+      else {
+        for (const p of loadParams) {
+          Content(`            $params["${p.n}"] = $setup["idmap"]["${liveKey(p)}"] ?? null;
 `)
-          }
-          Content(`        if (!$setup["live"]) {
-`)
-          for (let i = 0; i < loadParams.length; i++) {
-            Content(`            $params["${loadParams[i].n}"] = "direct0${i + 1}";
-`)
-          }
-          Content(`        }
-`)
-        } else if (loadLiveQueryLines) {
-          Content(`        if ($setup["live"]) {
-${loadLiveQueryLines}
         }
+      }
+      Content(`        } else {
+`)
+      for (let i = 0; i < loadParams.length; i++) {
+        Content(`            $params["${loadParams[i].n}"] = "direct0${i + 1}";
 `)
-        }
       }
+      Content(`        }
 
-      Content(`
         $result = $client->direct([
             "path" => "${loadPath}",
             "method" => "GET",
-`)
-      if (needsQuery) {
-        Content(`            "params" => $params,
+            "params" => $params,
             "query" => $query,
-`)
-      } else {
-        Content(`            "params" => [],
-`)
-      }
-      Content(`        ]);
+        ]);
         if ($setup["live"]) {
-            // Live mode is lenient: synthetic IDs frequently 4xx. Skip
-            // rather than fail when the load endpoint isn't reachable
-            // with the IDs we can construct from setup.idmap.
-            if (!empty($result["err"])) {
-                $this->markTestSkipped("load call failed (likely synthetic IDs against live API): " . (string)$result["err"]);
-                return;
+            if (!self::liveOk($result)) {
+                Runner::live_miss(self::LIVE_STRICT, "Live load failed: " . Runner::live_describe($result));
             }
-            if (empty($result["ok"])) {
-                $this->markTestSkipped("load call not ok (likely synthetic IDs against live API)");
-                return;
-            }
-            $status = Helpers::to_int($result["status"]);
-            if ($status < 200 || $status >= 300) {
-                $this->markTestSkipped("expected 2xx status, got " . $status);
-                return;
+            if (null === ($result["data"] ?? null)) {
+                Runner::live_miss(self::LIVE_STRICT, "Live load returned no data: " . Runner::live_describe($result));
             }
+            $this->assertNotNull($result["data"]);
         } else {
             $this->assertArrayNotHasKey("err", $result);
             $this->assertTrue($result["ok"]);
@@ -385,11 +352,12 @@ function ${entity.name}_direct_setup($mockres)
         $merged_opts = array_merge(Runner::live_client_options(), [${apikeyLiveField}${serverLiveField}
         ]);
         $client = new ${model.const.Name}SDK($merged_opts);
+        $idmap = $env["${entidEnvVar}"] ?? [];
         return [
             "client" => $client,
             "calls" => $calls,
             "live" => true,
-            "idmap" => [],
+            "idmap" => is_array($idmap) ? $idmap : [],
         ];
     }