biz-a-cli 2.3.80-15365 → 2.3.80-15367

package/engine/ext/live.js

@@ -29,12 +29,32 @@ import {
 } from "./publicTheme.js";
 import { createAllTenantScope } from "../orm/tenantScope.js";
 import { execPostgres, isPostgresIndex } from "../domain/dialect.js";
+import { nextGeneratorValue } from "../orm/dialect.js";
 
 const DEFAULT_FINA_URL = "http://127.0.0.1:212";
 
 // Next value from a Firebird generator (for SYS$EXT_USER ids). Mirrors datalib.genId's
 // endpoint without importing datalib (which pulls the worker pool + watcher).
+//
+// ⚠️ ON POSTGRESQL THERE IS NO GENERATOR AND NO FINA TO ASK. The migrations translate
+// `<TABLE>_GEN` + BI trigger into an IDENTITY column, so this call could only ever fail — the same
+// defect the admin client's `genId` hit live ("add user group" -> ECONNREFUSED 127.0.0.1:212), in a
+// second hand-rolled copy. Shared with apiRoute.js through `nextGeneratorValue` so the two cannot
+// drift; the Firebird branch below is untouched.
 async function genId(cfg, genName) {
+	if (isPostgresIndex(cfg.dbindex)) {
+		const { sequence, value } = await nextGeneratorValue({
+			exec: execPostgres,
+			dbIndex: cfg.dbindex,
+			generator: genName,
+		});
+		if (sequence === null) {
+			throw new Error(
+				`no sequence backs generator ${genName} on database ${cfg.dbindex}`,
+			);
+		}
+		return value;
+	}
 	const url = `${cfg.url}/fina/rest/TOrmMethod/genId/${genName}/${cfg.dbindex}`;
 	const res = await axios.get(url, {
 		headers: { "content-type": "text/plain" },

package/engine/orm/apiRoute.js

@@ -20,6 +20,7 @@
  *   failure           -> {"error":"..."} , which db/ds.js's dsReq already looks for.
  */
 import { json2List, addTableNameToArray, lookupToSql, lookupTotalToSql, resolveDbIndex, buildWriteSql } from "./index.js";
+import { nextGeneratorValue } from "./dialect.js";
 import { createReaders } from "./changeInference.js";
 import { CONFLICT_CODE, ROW_VERSION_KEY, refreshRowVersion } from "./concurrency.js";
 import {
@@ -135,6 +136,27 @@ export const parseExecuteSqlRequest = (path, body) => {
 	}
 };
 
+/*
+ * `genId` carries EVERYTHING IN THE PATH and posts a null body:
+ * `/fina/rest/TOrmMethod/%22genId%22/SYS$USERGROUP_GEN/3` (data.service.ts genId).
+ *
+ * ⚠️ Which is why `parseDataSnapRequest` never recognised it — that one needs `_parameters[0]` and
+ * quietly declines a body it cannot read. The call fell through to FINA, and on a tenant with no
+ * FINA the admin screen answered `502 ECONNREFUSED 127.0.0.1:212`.
+ *
+ * Returns { generator, dbIndex } or null.
+ */
+const GENID_PATH = /\/fina\/rest\/\w+\/(?:%22|")genId(?:%22|")\/([^/?#]+)\/(\d+)/i;
+
+export const parseGenIdRequest = (path) => {
+	const match = GENID_PATH.exec(String(path ?? ""));
+	if (!match) return null;
+	const generator = decodeURIComponent(match[1]).trim();
+	if (!generator) return null;
+	const dbIndex = Number(match[2]);
+	return { generator, dbIndex: Number.isFinite(dbIndex) ? dbIndex : null };
+};
+
 export const parseDataSnapRequest = (path, body) => {
 	const match = DATASNAP_PATH.exec(String(path ?? ""));
 	if (!match) return null;
@@ -580,6 +602,53 @@ export const routeApiRequest = async (
 		}
 	}
 
+	/*
+	 * ⚠️⚠️ `genId` — a Firebird GENERATOR, answered from PostgreSQL's own counter.
+	 *
+	 * This used to fall through to FINA with the rest of the non-ORM surface, which was honest while
+	 * the generator was merely SOMEWHERE ELSE. It is not: the PostgreSQL migrations translate
+	 * `<TABLE>_GEN` + BI trigger into `GENERATED BY DEFAULT AS IDENTITY`, so on a PostgreSQL tenant
+	 * the generator does not exist at all and the forward could only ever reach a Firebird counter
+	 * for a different database — or, on a tenant with no FINA, `ECONNREFUSED`.
+	 *
+	 * ⚠️ Answering it from FINA was the WORSE outcome of the two. `buildUpsert` honours a supplied
+	 * key, so a value drawn from one database and inserted into another collides with the identity
+	 * column's own sequence as soon as the two counters cross. Resolving to the table's OWN sequence
+	 * is what makes the pre-allocated key and the column default one counter again.
+	 *
+	 * ⚠️ A Firebird index still has a real generator, so it still forwards — the mixed tenant
+	 * `finaEndpoint.js` protects keeps working untouched.
+	 */
+	const genIdRequest = parseGenIdRequest(path);
+	if (genIdRequest) {
+		if (!isPostgresIndex(genIdRequest.dbIndex)) return null;
+		try {
+			const { sequence, value } = await nextGeneratorValue({
+				exec,
+				dbIndex: genIdRequest.dbIndex,
+				generator: genIdRequest.generator,
+			});
+			/* ⚠️ A caller can act on "no sequence backs SYS$NOPE_GEN". It cannot act on a connection
+			   error, and telling the two apart is most of what made this bug hard to place. */
+			if (sequence === null) {
+				return {
+					status: 400,
+					body: {
+						error:
+							`no sequence backs generator ${genIdRequest.generator} on database ` +
+							`${genIdRequest.dbIndex} — no sequence of that name, and no identity column on ` +
+							`${genIdRequest.generator.replace(/_GEN$/i, "")}`,
+					},
+				};
+			}
+			/* ⚠️ A BARE NUMBER, captured from the live FINA rather than guessed: it answers `2`, not
+			   `{data:…}` and not a string. data.service.ts hands the body straight to the caller. */
+			return { status: 200, body: value };
+		} catch (error) {
+			return { status: 500, body: { error: error?.message ?? String(error) } };
+		}
+	}
+
 	const parsed = parseDataSnapRequest(path, body);
 	if (!parsed) return null;
 

package/engine/orm/dialect.js

@@ -25,6 +25,71 @@ export const buildPagingClause = (start, length) => {
 export const buildSequenceNextValue = (sequenceName) =>
 	`SELECT nextval('${String(sequenceName).replace(/'/g, "''")}')`;
 
+/*
+ * Doc 3 §5 item 11 — which PostgreSQL sequence stands in for a Firebird GENERATOR.
+ *
+ * ⚠️⚠️ THE SECOND BRANCH IS THE WHOLE POINT. On Firebird a table's key comes from `<TABLE>_GEN`
+ * plus a BEFORE INSERT trigger; the PostgreSQL migrations translate that pair into
+ * `GENERATED BY DEFAULT AS IDENTITY`, so the generator does not exist here and cannot. Measured on
+ * both live PostgreSQL databases: not one `%_GEN` sequence.
+ *
+ * So `SYS$USERGROUP_GEN` resolves to the sequence `SYS$USERGROUP`'s identity column ALREADY OWNS.
+ * That is not a convenience — it is the correctness condition. A caller that pre-allocates a key
+ * and then inserts it explicitly (`admin/userGroup.component.ts`, because SYS$UGPRIV is written as
+ * an independent row carrying `usergroup_id`) must draw from the SAME counter the column's DEFAULT
+ * would use, or the two drift apart and collide on the primary key. That is exactly what was
+ * happening while `genId` was forwarded to a FINA whose own generator was a different number in a
+ * different database.
+ *
+ * ⚠️ The exact-name branch comes FIRST so an application that genuinely created `FOO_GEN` keeps
+ * working, and so a Firebird-shaped schema restored onto PostgreSQL is still answered correctly.
+ *
+ * ⚠️ The column is not assumed to be `id`: the lookup asks which of the table's columns owns a
+ * sequence. A table whose key is named otherwise resolves just the same.
+ *
+ * ⚠️ `pg_table_is_visible` keeps both branches inside the caller's search path — without it a
+ * same-named sequence in another schema could answer for a table this connection cannot even see.
+ *
+ * ⚠️ Both names are rendered as LITERALS, compared with `lower(...)`, never as identifiers. Nothing
+ * from the request reaches an identifier position: the `nextval` that follows uses the name the
+ * DATABASE returned, not the one the caller sent.
+ */
+export const buildGeneratorSequenceSql = (generator) => {
+	const name = String(generator ?? "");
+	const table = name.replace(/_GEN$/i, "");
+	return (
+		"SELECT COALESCE(" +
+		"(SELECT c.oid::regclass::text FROM pg_class c " +
+		`WHERE c.relkind = 'S' AND pg_table_is_visible(c.oid) AND lower(c.relname) = lower(${quoteLiteral(name)}) ` +
+		"LIMIT 1), " +
+		"(SELECT pg_get_serial_sequence(t.oid::regclass::text, a.attname) FROM pg_class t " +
+		"JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum > 0 AND NOT a.attisdropped " +
+		`WHERE t.relkind = 'r' AND pg_table_is_visible(t.oid) AND lower(t.relname) = lower(${quoteLiteral(table)}) ` +
+		"AND pg_get_serial_sequence(t.oid::regclass::text, a.attname) IS NOT NULL " +
+		"LIMIT 1)" +
+		") AS sequence_name"
+	);
+};
+
+/*
+ * The next value of a Firebird-named generator, from PostgreSQL.
+ *
+ * ⚠️ ONE COPY, because there are two callers and they must not drift: `apiRoute.js` answers the
+ * admin client's `genId`, and `engine/ext/live.js` pre-generates SYS$EXT_USER ids. The second was
+ * a hand-rolled axios call to FINA and carried the identical latent failure — a PostgreSQL tenant
+ * has no FINA to ask and no generator to ask for.
+ *
+ * Resolves to `{ sequence, value }`, or `{ sequence: null, value: null }` when nothing backs the
+ * name. The caller decides what an unresolvable generator means; here it is simply a fact.
+ */
+export const nextGeneratorValue = async ({ exec, dbIndex, generator }) => {
+	const resolved = (await exec(buildGeneratorSequenceSql(generator), dbIndex)) ?? [];
+	const sequence = resolved[0]?.sequence_name ?? resolved[0]?.SEQUENCE_NAME ?? null;
+	if (!sequence) return { sequence: null, value: null };
+	const next = (await exec(buildSequenceNextValue(sequence), dbIndex)) ?? [];
+	return { sequence, value: Number(next[0]?.nextval ?? next[0]?.NEXTVAL) };
+};
+
 export const quoteLiteral = (value) => `'${String(value).replace(/'/g, "''")}'`;
 
 /* A JS Date as a SQL literal. `String(date)` gives

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "biz-a-cli",
-	"version": "2.3.80-15365",
+	"version": "2.3.80-15367",
 	"description": "",
 	"main": "bin/index.js",
 	"type": "module",