okengine 0.14.1 → 0.16.0

package/src/console/ui-next/ui-next-seed-store.ts

@@ -41,6 +41,20 @@ const SEED_SPACES = [
 ] as const;
 
 const SEED_MEMBERS = [
+  {
+    id: "mem_demo",
+    space_id: "space_eng",
+    name: "Demo User",
+    email: "demo@example.com",
+    role: "owner",
+  },
+  {
+    id: "mem_admin",
+    space_id: "space_eng",
+    name: "Avery Cole",
+    email: "admin@keel.dev",
+    role: "admin",
+  },
   {
     id: "mem_aria",
     space_id: "space_eng",
@@ -48,6 +62,13 @@ const SEED_MEMBERS = [
     email: "aria@keel.dev",
     role: "project_manager",
   },
+  {
+    id: "mem_lead",
+    space_id: "space_eng",
+    name: "Jules Hart",
+    email: "jules@keel.dev",
+    role: "lead",
+  },
   {
     id: "mem_ben",
     space_id: "space_eng",
@@ -55,6 +76,13 @@ const SEED_MEMBERS = [
     email: "ben@keel.dev",
     role: "developer",
   },
+  {
+    id: "mem_eli",
+    space_id: "space_eng",
+    name: "Eli Park",
+    email: "eli@keel.dev",
+    role: "contributor",
+  },
   {
     id: "mem_cai",
     space_id: "space_des",
@@ -62,6 +90,20 @@ const SEED_MEMBERS = [
     email: "cai@keel.dev",
     role: "member",
   },
+  {
+    id: "mem_member",
+    space_id: "space_des",
+    name: "Member",
+    email: "member@example.com",
+    role: "member",
+  },
+  {
+    id: "mem_commenter",
+    space_id: "space_gtm",
+    name: "Kit Rowe",
+    email: "kit@keel.dev",
+    role: "commenter",
+  },
   {
     id: "mem_dia",
     space_id: "space_gtm",
@@ -69,13 +111,6 @@ const SEED_MEMBERS = [
     email: "dia@keel.dev",
     role: "guest",
   },
-  {
-    id: "mem_eli",
-    space_id: "space_eng",
-    name: "Eli Park",
-    email: "eli@keel.dev",
-    role: "developer",
-  },
 ] as const;
 
 const SEED_GOALS = [
@@ -640,14 +675,7 @@ function generateKeelVolume(): {
     email: `${p.id}@keel.dev`,
     role: "member",
   }));
-  const emails = [
-    "aria@keel.dev",
-    "ben@keel.dev",
-    "cai@keel.dev",
-    "dia@keel.dev",
-    "eli@keel.dev",
-    ...members.map((m) => m.email),
-  ];
+  const emails = [...SEED_MEMBERS.map((m) => m.email), ...members.map((m) => m.email)];
 
   const projects = Array.from({ length: GENERATED.projects }, (_, i) => ({
     id: `proj_g_${String(i + 1).padStart(2, "0")}`,

package/src/console/xss.gate.test.ts

@@ -21,6 +21,7 @@ const FEATURES_ROOT = `${UI_ROOT}/features`;
  * already covers it; the list makes coverage explicit in CI output.
  */
 export const CONSOLE_UI_FEATURE_DIRS = [
+  "access",
   "auth",
   "flows",
   "not-found",

package/src/docker/compose-health.test.ts

@@ -16,6 +16,12 @@ describe("compose-health", () => {
     expect(composeRowToStatus({ State: "stopped" })).toBe("error");
     expect(composeRowToStatus({ Status: "Exited (0) 3 seconds ago" })).toBe("error");
     expect(composeRowToStatus({ State: "running" })).toBe("ready");
+    expect(composeRowToStatus({ State: "restarting" })).toBe("pending");
+    expect(composeRowToStatus({ State: "running", Status: "Up Less than a second" })).toBe(
+      "pending",
+    );
+    expect(composeRowToStatus({ State: "running", Status: "Up 2 seconds" })).toBe("pending");
+    expect(composeRowToStatus({ State: "running", Status: "Up 2 minutes" })).toBe("ready");
     expect(composeRowToStatus({ Status: "Up 2 seconds (health: starting)" })).toBe("pending");
   });
 
@@ -60,6 +66,27 @@ describe("compose-health", () => {
     expect(updates).toEqual(["store-sql:pending", "store-sql:ready"]);
   });
 
+  test("watchComposeHealth waits through compose restarting", async () => {
+    let calls = 0;
+    const map = await watchComposeHealth({
+      files: ["compose.yml"],
+      cwd: "/tmp",
+      env: {},
+      intervalMs: 1,
+      timeoutMs: 5_000,
+      sleep: async () => {},
+      run: async () => {
+        calls += 1;
+        if (calls === 1) {
+          return JSON.stringify([{ Service: "store-sql", State: "restarting" }]);
+        }
+        return JSON.stringify([{ Service: "store-sql", Health: "healthy", State: "running" }]);
+      },
+    });
+    expect(calls).toBe(2);
+    expect(map.get("store-sql")).toBe("ready");
+  });
+
   test("readComposeHealth / watch use ps -a", async () => {
     let seen: readonly string[] = [];
     await watchComposeHealth({

package/src/docker/compose-health.ts

@@ -20,22 +20,27 @@ export type ComposePsRow = {
 export function composeRowToStatus(row: ComposePsRow): DevStatus {
   const health = (row.Health ?? "").trim().toLowerCase();
   const state = (row.State ?? "").trim().toLowerCase();
+  const statusText = (row.Status ?? "").toLowerCase();
   if (health === "healthy") return "ready";
   if (health === "unhealthy") return "error";
   if (health === "starting") return "pending";
-  if (state === "running" || state === "up") return "ready";
+  if (state === "restarting") return "pending";
+  if (state === "running" || state === "up") {
+    // Right after `compose restart`, State is "running" before Health is
+    // "starting". Treat a fresh Up without (healthy) as still coming up.
+    if (isFreshComposeUp(statusText) && !statusText.includes("(healthy)")) return "pending";
+    return "ready";
+  }
   if (
     state === "exited" ||
     state === "dead" ||
     state === "stopped" ||
-    state === "restarting" ||
     state === "removing" ||
     state === "oomkilled"
   ) {
     return "error";
   }
   // Status text for stopped containers (`Exited (0) 2 seconds ago`).
-  const statusText = (row.Status ?? "").toLowerCase();
   if (statusText.startsWith("exited") || statusText.startsWith("dead")) return "error";
   if (state === "created" || state === "paused" || state.length === 0) return "pending";
   // Status text like "Up 3 seconds (healthy)"
@@ -48,6 +53,17 @@ export function composeRowToStatus(row: ComposePsRow): DevStatus {
   return "pending";
 }
 
+/**
+ * True when compose `Status` is a just-started container (health not reported yet).
+ *
+ * @param statusText - Lowercased `Status` from `docker compose ps`
+ */
+function isFreshComposeUp(statusText: string): boolean {
+  if (statusText.includes("less than a second")) return true;
+  const seconds = /up\s+(\d+)\s+seconds?/i.exec(statusText);
+  return seconds !== null && Number(seconds[1]) < 8;
+}
+
 /**
  * Parse NDJSON or a JSON array from `docker compose ps --format json`.
  *

package/src/docker/docker.test.ts

@@ -392,11 +392,13 @@ describe("image recipes", () => {
     expect(pgdogToml).toContain('host = "0.0.0.0"');
     expect(pgdogToml).toContain("port = 6432");
     expect(pgdogToml).toContain('pooler_mode = "transaction"');
+    expect(pgdogToml).toContain("default_pool_size = 20");
     expect(pgdogToml).toContain("[[databases]]");
     expect(pgdogToml).toContain('name = "oke"');
     expect(pgdogToml).toContain('host = "store-sql"');
     expect(pgdogToml).toContain("port = 5432");
     expect(pgdogToml).toContain('database_name = "oke"');
+    expect(pgdogToml).toContain("pool_size = 20");
 
     const usersToml = buildPgDogUsersToml({
       user: "oke",
@@ -936,6 +938,7 @@ describe("deriveInfrastructure", () => {
 
     const pgdogToml = result.files.find((f) => f.path === "pgdog/pgdog.toml")!.content;
     expect(pgdogToml).toContain('pooler_mode = "transaction"');
+    expect(pgdogToml).toContain("pool_size = 20");
     expect(pgdogToml).toContain('host = "store-sql"');
     expect(pgdogToml).not.toContain(fixedCreds["store.sql"].password);
 

package/src/docker/recipes/pgdog.ts

@@ -35,12 +35,14 @@ export function buildPgDogToml(opts: {
     'host = "0.0.0.0"',
     "port = 6432",
     'pooler_mode = "transaction"',
+    "default_pool_size = 20",
     "",
     "[[databases]]",
     `name = ${tomlString(db)}`,
     `host = ${tomlString(host)}`,
     `port = ${port}`,
     `database_name = ${tomlString(db)}`,
+    "pool_size = 20",
     "",
   ].join("\n");
 }

package/src/drivers/clock-postgres.ts

@@ -7,7 +7,13 @@
  */
 
 import type { CronRow, CronStatus, CronStore } from "../elements/clock/reconcile.ts";
-import { toPostgresParams } from "./postgres.ts";
+import {
+  resolvePostgresUrl,
+  sharedPostgresClient,
+  toPostgresParams,
+  withPinnedPostgres,
+  type PostgresClientLike,
+} from "./postgres.ts";
 
 /** Row shape in `oke_crons` (lease columns mirror `oke_signal_messages`). */
 interface CronDbRow {
@@ -69,16 +75,16 @@ export interface BunCronClient {
   close?(options?: { timeout?: number }): Promise<void>;
 }
 
-function wrapBunClient(client: BunCronClient): PostgresCronSql {
+function wrapBunClient(client: PostgresClientLike): PostgresCronSql {
   const api: PostgresCronSql = {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -92,7 +98,7 @@ function wrapBunClient(client: BunCronClient): PostgresCronSql {
       return { changes: 0 };
     },
     async begin(fn) {
-      return client.begin(async (tx) => fn(wrapBunClient(tx)));
+      return withPinnedPostgres(client, (tx) => fn(wrapBunClient(tx)));
     },
     async close() {
       await client.close?.();
@@ -365,10 +371,8 @@ export async function createPostgresCronStore(
   const sql =
     options.sql ??
     wrapBunClient(
-      options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunCronClient),
+      (options.client ??
+        sharedPostgresClient(resolvePostgresUrl(options.url))) as PostgresClientLike,
     );
 
   await ensureSchema(sql);

package/src/drivers/instances-postgres.ts

@@ -7,7 +7,7 @@
 
 import type { ConfigEnv } from "../config/index.ts";
 import type { InstanceRow, InstanceStore } from "../kernel/instances.ts";
-import { toPostgresParams } from "./postgres.ts";
+import { resolvePostgresUrl, sharedPostgresClient, toPostgresParams } from "./postgres.ts";
 
 /** Minimal SQL surface for the postgres instance store. */
 export interface PostgresInstanceSql {
@@ -40,13 +40,13 @@ const UPSERT_SQL = `INSERT INTO oke_instances (id, started_at, heartbeat_at, lea
 function wrapBunClient(client: BunInstanceClient): PostgresInstanceSql {
   return {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -109,9 +109,7 @@ export async function createPostgresInstanceStore(
     options.sql ??
     wrapBunClient(
       options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunInstanceClient),
+        (sharedPostgresClient(resolvePostgresUrl(options.url)) as unknown as BunInstanceClient),
     );
 
   await ensureSchema(sql);

package/src/drivers/journal-postgres.ts

@@ -14,7 +14,13 @@ import {
   type JournalRun,
   type JournalStore,
 } from "../kernel/journal.ts";
-import { toPostgresParams } from "./postgres.ts";
+import {
+  resolvePostgresUrl,
+  sharedPostgresClient,
+  toPostgresParams,
+  withPinnedPostgres,
+  type PostgresClientLike,
+} from "./postgres.ts";
 
 /** Row shape in `oke_journal_runs` (lease columns mirror `oke_crons`). */
 interface JournalDbRow {
@@ -87,16 +93,16 @@ export interface BunJournalClient {
   close?(options?: { timeout?: number }): Promise<void>;
 }
 
-function wrapBunClient(client: BunJournalClient): PostgresJournalSql {
+function wrapBunClient(client: PostgresClientLike): PostgresJournalSql {
   const api: PostgresJournalSql = {
     async query(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (Array.isArray(result)) return result as Record<string, unknown>[];
       return Array.from(result as ArrayLike<Record<string, unknown>>);
     },
     async exec(sql, params = []) {
-      const pg = toPostgresParams(sql);
+      const pg = toPostgresParams(sql, params);
       const result = await client.unsafe(pg, [...params]);
       if (
         result &&
@@ -110,7 +116,7 @@ function wrapBunClient(client: BunJournalClient): PostgresJournalSql {
       return { changes: 0 };
     },
     async begin(fn) {
-      return client.begin(async (tx) => fn(wrapBunClient(tx)));
+      return withPinnedPostgres(client, (tx) => fn(wrapBunClient(tx)));
     },
     async close() {
       await client.close?.();
@@ -437,10 +443,8 @@ export async function createPostgresJournalStore(
   const sql =
     options.sql ??
     wrapBunClient(
-      options.client ??
-        (new Bun.SQL(
-          options.url ?? process.env.DATABASE_URL ?? "postgres://localhost:5432/oke",
-        ) as unknown as BunJournalClient),
+      (options.client ??
+        sharedPostgresClient(resolvePostgresUrl(options.url))) as PostgresClientLike,
     );
 
   await ensureSchema(sql);

package/src/drivers/pg-rls.test.ts

@@ -2,7 +2,13 @@ import { describe, expect, test } from "bun:test";
 import {
   buildAlterPolicySql,
   buildCreatePolicySql,
+  buildRlsIdentityPreludeSql,
+  emitPgPolicySource,
+  formatPolicyRole,
+  OKE_RLS_HELPER_STATEMENTS,
+  OKE_RLS_ROLE,
   parseSqlPolicySpec,
+  rlsScopesJson,
   sqlPolicyRowId,
 } from "./pg-rls.ts";
 
@@ -36,6 +42,22 @@ describe("parseSqlPolicySpec", () => {
     expect(spec.withCheck).toBe("true");
   });
 
+  test("accepts Drizzle as/to/for aliases", () => {
+    const spec = parseSqlPolicySpec({
+      name: "gate_read",
+      table: "bookings",
+      for: "select",
+      as: "permissive",
+      to: "current_user",
+      using: "oke.gate() = 'member'",
+    });
+    expect(spec.command).toBe("SELECT");
+    expect(spec.behavior).toBe("PERMISSIVE");
+    expect(spec.roles).toEqual(["current_user"]);
+    expect(buildCreatePolicySql(spec)).toContain("TO current_user");
+    expect(buildCreatePolicySql(spec)).not.toContain('"current_user"');
+  });
+
   test("rejects stacked statements in USING", () => {
     expect(() =>
       parseSqlPolicySpec({
@@ -69,3 +91,68 @@ describe("buildAlterPolicySql", () => {
     ).toThrow("invalid USING");
   });
 });
+
+describe("formatPolicyRole", () => {
+  test("leaves Drizzle special roles unquoted", () => {
+    expect(formatPolicyRole("public")).toBe("public");
+    expect(formatPolicyRole("current_user")).toBe("current_user");
+    expect(formatPolicyRole("member")).toBe('"member"');
+  });
+});
+
+describe("emitPgPolicySource", () => {
+  test("emits drizzle pgPolicy with oke helpers", () => {
+    const spec = parseSqlPolicySpec({
+      name: "gate_member_select",
+      table: "bookings",
+      command: "SELECT",
+      using: "oke.gate() = 'member'",
+    });
+    expect(emitPgPolicySource(spec)).toContain('pgPolicy("gate_member_select"');
+    expect(emitPgPolicySource(spec)).toContain('for: "select"');
+    expect(emitPgPolicySource(spec)).toContain("oke.gate() = 'member'");
+  });
+});
+
+describe("rlsScopesJson", () => {
+  test("sorts unique scopes", () => {
+    expect(rlsScopesJson(["booking:create", "member", "member"])).toBe(
+      '["booking:create","member"]',
+    );
+  });
+});
+
+describe("buildRlsIdentityPreludeSql", () => {
+  test("emits one statement per exec — never a multi-command batch", () => {
+    const stmts = buildRlsIdentityPreludeSql({
+      gate: "member",
+      userId: "alice",
+      scopes: ["member"],
+    });
+    expect(stmts.map((s) => s.sql)).toEqual([
+      `SET LOCAL ROLE ${OKE_RLS_ROLE}`,
+      "SET LOCAL row_security = on",
+      "SELECT set_config('oke.gate', ?, true), set_config('oke.user', ?, true), set_config('oke.scopes', ?, true)",
+    ]);
+    for (const stmt of stmts) {
+      expect(stmt.sql.includes(";")).toBe(false);
+    }
+    expect(stmts[2]?.params).toEqual(["member", "alice", '["member"]']);
+  });
+});
+
+describe("OKE_RLS_HELPER_STATEMENTS", () => {
+  test("has_scope uses jsonb_exists so ? is not a placeholder", () => {
+    const hasScope = OKE_RLS_HELPER_STATEMENTS.find((s) => s.includes("oke.has_scope"));
+    expect(hasScope).toBeDefined();
+    expect(hasScope).toContain("jsonb_exists(");
+    expect(hasScope).not.toMatch(/jsonb\s+\?/);
+  });
+
+  test("pins search_path to public so schema oke is not the table home", () => {
+    expect(OKE_RLS_HELPER_STATEMENTS).toContain("SET search_path TO public, oke");
+    expect(
+      OKE_RLS_HELPER_STATEMENTS.some((s) => s.includes("ALTER TABLE oke.%I SET SCHEMA public")),
+    ).toBe(true);
+  });
+});