graphql-server-test 3.33.2 → 3.33.4

package/README.md

@@ -181,7 +181,6 @@ The `server.api` option provides full control over the GraphQL server configurat
 
 | Property | Type | Default | Description |
 |----------|------|---------|-------------|
-| `routingSchema` | `string` | `routing_public` | Schema that owns `resolve_route()` and the routing tables |
 | `exposedSchemas` | `string[]` | from `schemas` | Database schemas to expose (overridden by `schemas`) |
 | `anonRole` | `string` | from `authRole` | Anonymous role name (overridden by `authRole`) |
 | `roleName` | `string` | from `authRole` | Default role name (overridden by `authRole`) |

package/esm/get-connections.js

@@ -1,7 +1,41 @@
 import { getEnvOptions } from '@constructive-io/graphql-env';
+import { randomBytes } from 'crypto';
+import { pgCache } from 'pg-cache';
 import { getConnections as getPgConnections } from 'pgsql-test';
 import { createDevTestServer, createTestServer } from './server';
 import { createQueryFn, createSuperTestAgent } from './supertest';
+/**
+ * The server connects as its own login, as in production: NOBYPASSRLS, a
+ * member of the request roles only, never of administrator. It holds the
+ * table/function privileges the seeded schemas grant it, so whatever RLS hides
+ * from it stays hidden and a read that silently relied on BYPASSRLS fails here.
+ */
+const createServerLogin = async (pg) => {
+    const user = `server_test_${randomBytes(6).toString('hex')}`;
+    const password = randomBytes(18).toString('hex');
+    await pg.query(`
+    CREATE ROLE "${user}" LOGIN NOSUPERUSER NOBYPASSRLS PASSWORD '${password}' IN ROLE anonymous, authenticated;
+    GRANT CONNECT ON DATABASE "${pg.config.database}" TO "${user}";
+    DO $grant$
+    DECLARE s text;
+    BEGIN
+      FOR s IN
+        SELECT nspname FROM pg_namespace
+        WHERE nspname NOT LIKE 'pg\\_%' AND nspname <> 'information_schema'
+      LOOP
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', s, '${user}');
+        EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', s, '${user}');
+        EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA %I TO %I', s, '${user}');
+      END LOOP;
+    END
+    $grant$;
+  `);
+    // The seed's pg-cache entry must not hand the server the seeding connection.
+    pgCache.delete(pg.config.database);
+    await pgCache.waitForDisposals();
+    return { user, password };
+};
+const liveSuites = new Set();
 /**
  * Creates connections with an HTTP server for SuperTest testing
  *
@@ -35,10 +69,11 @@ export const getConnections = async (input, seedAdapters) => {
     // Get database connections using pgsql-test
     const conn = await getPgConnections(input, seedAdapters);
     const { pg, db, teardown: dbTeardown } = conn;
+    const login = await createServerLogin(pg);
     // Build options for the HTTP server
     // Merge user-provided server.api options with convenience properties (schemas, authRole)
     const serverOpts = getEnvOptions({
-        pg: pg.config,
+        pg: { ...pg.config, user: login.user, password: login.password },
         api: {
             // Start with user-provided api options from server.api
             ...input.server?.api,
@@ -57,9 +92,16 @@ export const getConnections = async (input, seedAdapters) => {
         : await createDevTestServer(serverOpts, input.server);
     // Create SuperTest agent
     const request = createSuperTestAgent(server);
-    // Combined teardown function
+    const suite = { server, pg, user: login.user };
+    liveSuites.add(suite);
+    // pgsql-test's teardown closes every database this process opened, so the
+    // first teardown also releases every other live suite's server and login.
     const teardown = async () => {
-        await server.stop();
+        for (const live of [...liveSuites]) {
+            liveSuites.delete(live);
+            await live.server.stop();
+            await live.pg.query(`DROP OWNED BY "${live.user}"; DROP ROLE "${live.user}"`);
+        }
         await dbTeardown();
     };
     return {

package/get-connections.js

@@ -2,9 +2,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConnections = void 0;
 const graphql_env_1 = require("@constructive-io/graphql-env");
+const crypto_1 = require("crypto");
+const pg_cache_1 = require("pg-cache");
 const pgsql_test_1 = require("pgsql-test");
 const server_1 = require("./server");
 const supertest_1 = require("./supertest");
+/**
+ * The server connects as its own login, as in production: NOBYPASSRLS, a
+ * member of the request roles only, never of administrator. It holds the
+ * table/function privileges the seeded schemas grant it, so whatever RLS hides
+ * from it stays hidden and a read that silently relied on BYPASSRLS fails here.
+ */
+const createServerLogin = async (pg) => {
+    const user = `server_test_${(0, crypto_1.randomBytes)(6).toString('hex')}`;
+    const password = (0, crypto_1.randomBytes)(18).toString('hex');
+    await pg.query(`
+    CREATE ROLE "${user}" LOGIN NOSUPERUSER NOBYPASSRLS PASSWORD '${password}' IN ROLE anonymous, authenticated;
+    GRANT CONNECT ON DATABASE "${pg.config.database}" TO "${user}";
+    DO $grant$
+    DECLARE s text;
+    BEGIN
+      FOR s IN
+        SELECT nspname FROM pg_namespace
+        WHERE nspname NOT LIKE 'pg\\_%' AND nspname <> 'information_schema'
+      LOOP
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', s, '${user}');
+        EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', s, '${user}');
+        EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA %I TO %I', s, '${user}');
+      END LOOP;
+    END
+    $grant$;
+  `);
+    // The seed's pg-cache entry must not hand the server the seeding connection.
+    pg_cache_1.pgCache.delete(pg.config.database);
+    await pg_cache_1.pgCache.waitForDisposals();
+    return { user, password };
+};
+const liveSuites = new Set();
 /**
  * Creates connections with an HTTP server for SuperTest testing
  *
@@ -38,10 +72,11 @@ const getConnections = async (input, seedAdapters) => {
     // Get database connections using pgsql-test
     const conn = await (0, pgsql_test_1.getConnections)(input, seedAdapters);
     const { pg, db, teardown: dbTeardown } = conn;
+    const login = await createServerLogin(pg);
     // Build options for the HTTP server
     // Merge user-provided server.api options with convenience properties (schemas, authRole)
     const serverOpts = (0, graphql_env_1.getEnvOptions)({
-        pg: pg.config,
+        pg: { ...pg.config, user: login.user, password: login.password },
         api: {
             // Start with user-provided api options from server.api
             ...input.server?.api,
@@ -60,9 +95,16 @@ const getConnections = async (input, seedAdapters) => {
         : await (0, server_1.createDevTestServer)(serverOpts, input.server);
     // Create SuperTest agent
     const request = (0, supertest_1.createSuperTestAgent)(server);
-    // Combined teardown function
+    const suite = { server, pg, user: login.user };
+    liveSuites.add(suite);
+    // pgsql-test's teardown closes every database this process opened, so the
+    // first teardown also releases every other live suite's server and login.
     const teardown = async () => {
-        await server.stop();
+        for (const live of [...liveSuites]) {
+            liveSuites.delete(live);
+            await live.server.stop();
+            await live.pg.query(`DROP OWNED BY "${live.user}"; DROP ROLE "${live.user}"`);
+        }
         await dbTeardown();
     };
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-server-test",
-  "version": "3.33.2",
+  "version": "3.33.4",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server Testing with SuperTest HTTP requests",
   "main": "index.js",
@@ -31,8 +31,8 @@
   "devDependencies": {
     "@0no-co/graphql.web": "^1.3.3",
     "@agentic-kit/ollama": "2.16.0",
-    "@constructive-io/graphql-codegen": "^5.24.2",
-    "@constructive-io/graphql-query": "^4.21.2",
+    "@constructive-io/graphql-codegen": "^5.24.4",
+    "@constructive-io/graphql-query": "^4.21.4",
     "@constructive-io/s3-utils": "^2.35.0",
     "@pgpmjs/core": "^7.34.0",
     "@simplewebauthn/server": "13.3.2",
@@ -47,18 +47,19 @@
     "nested-obj": "^0.2.3"
   },
   "dependencies": {
-    "@constructive-io/graphql-dev-server": "^3.21.2",
-    "@constructive-io/graphql-env": "^3.37.1",
-    "@constructive-io/graphql-server": "^5.32.2",
-    "@constructive-io/graphql-types": "^3.36.0",
+    "@constructive-io/express-context": "^0.35.1",
+    "@constructive-io/graphql-dev-server": "^3.21.4",
+    "@constructive-io/graphql-env": "^3.37.2",
+    "@constructive-io/graphql-server": "^5.32.4",
+    "@constructive-io/graphql-types": "^3.36.1",
     "@constructive-io/upload-client": "0.29.0",
     "@pgpmjs/types": "^2.58.0",
     "express": "^5.2.1",
-    "graphile-schema": "^2.20.2",
+    "graphile-schema": "^2.20.4",
     "graphql": "16.13.0",
     "pg": "^8.21.0",
     "pg-cache": "^3.30.0",
-    "pgsql-test": "^5.18.0",
+    "pgsql-test": "^5.18.1",
     "supertest": "^7.0.0"
   },
   "keywords": [
@@ -72,5 +73,5 @@
     "e2e",
     "server"
   ],
-  "gitHead": "91e18cc80da92331fb3aadd5baa43251c8934bc8"
+  "gitHead": "b6c80da2ba0532a4aaf0d0154901efa7911974d8"
 }