pgserve 2.1.2 → 2.2.0

package/tests/tenancy.test.js

@@ -1,403 +0,0 @@
-/**
- * Group 4 — database-per-fingerprint + enforcement + kill switch.
- *
- * Boots a real pgserve daemon with isolated control socket + audit log,
- * stubs SO_PEERCRED to return synthetic creds, and overrides the
- * fingerprint-derivation cwd per-accept so a single test process can
- * masquerade as several different "projects" connecting to the daemon.
- *
- * Coverage (mirrors WISH §Group 4 acceptance bullets):
- *   1. Two peers with different fingerprints get different DBs
- *   2. Same peer reconnecting reaches its existing DB
- *   3. Cross-fingerprint connection denied with SQLSTATE 28P01
- *   4. Kill-switch env: cross-fingerprint succeeds + audit event emitted
- *   5. Sanitizer: name "@scope/foo bar" → "_scope_foo_bar"
- *
- * Plus unit tests on `sanitizeName` and `resolveTenantDatabaseName` and a
- * boot-time deprecation warning check.
- */
-
-import {
-  describe,
-  test,
-  expect,
-  beforeAll,
-  afterAll,
-  beforeEach,
-  afterEach,
-} from 'bun:test';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import pg from 'pg';
-
-import {
-  PgserveDaemon,
-  resolveControlSocketPath,
-  resolvePidLockPath,
-  resolveLibpqCompatPath,
-} from '../src/daemon.js';
-import { _setPeerCredImpl, initFingerprintFfi } from '../src/fingerprint.js';
-import { configureAudit, AUDIT_EVENTS } from '../src/audit.js';
-import {
-  sanitizeName,
-  resolveTenantDatabaseName,
-  KILL_SWITCH_ENV,
-} from '../src/tenancy.js';
-import { createLogger } from '../src/logger.js';
-
-const { Client } = pg;
-
-// ---------------------------------------------------------------------------
-// Pure-function unit tests
-// ---------------------------------------------------------------------------
-
-describe('sanitizeName', () => {
-  test('collapses non-[a-z0-9] runs to a single underscore', () => {
-    expect(sanitizeName('hello-world')).toBe('hello_world');
-    expect(sanitizeName('hello---world')).toBe('hello_world');
-    expect(sanitizeName('a..b..c')).toBe('a_b_c');
-  });
-
-  test('lowercases', () => {
-    expect(sanitizeName('UPPER-CASE')).toBe('upper_case');
-    expect(sanitizeName('MixedCase')).toBe('mixedcase');
-  });
-
-  test('preserves alphanumerics', () => {
-    expect(sanitizeName('foo123')).toBe('foo123');
-    expect(sanitizeName('1to1')).toBe('1to1');
-  });
-
-  test('truncates to 30 chars', () => {
-    const long = 'a'.repeat(50);
-    expect(sanitizeName(long).length).toBe(30);
-  });
-
-  test('handles the wish-spec example', () => {
-    expect(sanitizeName('@scope/foo bar')).toBe('_scope_foo_bar');
-  });
-
-  test('falls back to "anon" for empty or pure-non-alphanumeric input', () => {
-    expect(sanitizeName('')).toBe('anon');
-    expect(sanitizeName(null)).toBe('anon');
-    expect(sanitizeName(undefined)).toBe('anon');
-    expect(sanitizeName('@@@')).toBe('anon');
-  });
-});
-
-describe('resolveTenantDatabaseName', () => {
-  test('builds canonical app_<sanitized>_<fingerprint>', () => {
-    expect(resolveTenantDatabaseName({ name: 'demo', fingerprint: 'abcdef012345' }))
-      .toBe('app_demo_abcdef012345');
-  });
-
-  test('applies sanitization', () => {
-    expect(resolveTenantDatabaseName({ name: '@scope/foo bar', fingerprint: 'abcdef012345' }))
-      .toBe('app__scope_foo_bar_abcdef012345');
-  });
-
-  test('rejects malformed fingerprints', () => {
-    expect(() => resolveTenantDatabaseName({ name: 'x', fingerprint: 'TOO-SHORT' }))
-      .toThrow(/12 hex chars/);
-    expect(() => resolveTenantDatabaseName({ name: 'x', fingerprint: 'GHIJKL012345' }))
-      .toThrow(/12 hex chars/);
-  });
-
-  test('result fits in PG identifier limit (≤63 chars)', () => {
-    const longName = 'a'.repeat(80);
-    const ident = resolveTenantDatabaseName({ name: longName, fingerprint: 'abcdef012345' });
-    expect(ident.length).toBeLessThanOrEqual(63);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Daemon integration tests
-//
-// One daemon shared across the integration suite — PG startup is slow and
-// the tests are independent at the pgserve_meta level (each clears its
-// state). Per-accept fingerprint behaviour is driven by an override queue
-// the test pushes into before each connect.
-// ---------------------------------------------------------------------------
-
-describe('daemon tenancy enforcement', () => {
-  let daemon;
-  let scratch;
-  let controlSocketDir;
-  let auditFile;
-  let overridesQueue;
-  let savedAuditDefaults;
-
-  beforeAll(async () => {
-    await initFingerprintFfi();
-    // Stub peer creds: every accept on the test daemon's control socket
-    // appears to come from this process. The real creds matter only for
-    // uid (used in fingerprint hashing); pid is ignored once we override
-    // cwd via `_fingerprintAcceptOpts`.
-    _setPeerCredImpl(() => ({
-      pid: process.pid,
-      uid: process.getuid(),
-      gid: process.getgid(),
-    }));
-
-    scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-tenancy-test-'));
-    controlSocketDir = path.join(scratch, 'sock');
-    fs.mkdirSync(controlSocketDir, { recursive: true });
-    auditFile = path.join(scratch, 'audit.log');
-
-    // Save the audit module's mutable globals so we can restore them after
-    // the suite (other tests rely on the defaults).
-    savedAuditDefaults = {
-      logFile: path.join(os.homedir(), '.pgserve', 'audit.log'),
-      target: process.env.PGSERVE_AUDIT_TARGET || 'file',
-    };
-
-    overridesQueue = [];
-
-    daemon = new PgserveDaemon({
-      controlSocketDir,
-      controlSocketPath: resolveControlSocketPath(controlSocketDir),
-      pidLockPath: resolvePidLockPath(controlSocketDir),
-      libpqCompatPath: resolveLibpqCompatPath(controlSocketDir, 5432),
-      auditLogFile: auditFile,
-      auditTarget: 'file',
-      pgPort: 16700,
-      logger: createLogger({ level: process.env.LOG_LEVEL || 'warn' }),
-      _fingerprintAcceptOpts: () => overridesQueue.shift() || {},
-    });
-    await daemon.start();
-  });
-
-  afterAll(async () => {
-    try { await daemon.stop(); } catch { /* swallow */ }
-    _setPeerCredImpl(null);
-    if (savedAuditDefaults) configureAudit(savedAuditDefaults);
-    try { fs.rmSync(scratch, { recursive: true, force: true }); } catch { /* swallow */ }
-  });
-
-  beforeEach(async () => {
-    overridesQueue.length = 0;
-    // Clear pgserve_meta and drop any user DBs from prior tests so each
-    // test starts from a clean slate.
-    if (daemon._adminClient) {
-      try { await daemon._adminClient.query('TRUNCATE pgserve_meta'); } catch { /* schema not yet created in odd cases */ }
-      const r = await daemon._adminClient.query(`
-        SELECT datname FROM pg_database
-        WHERE datname LIKE 'app_%' AND datistemplate = false
-      `);
-      for (const row of r.rows) {
-        try { await daemon._adminClient.query(`DROP DATABASE "${row.datname}"`); } catch { /* swallow */ }
-      }
-    }
-    // Reset audit log so each test reads only its own events.
-    try { fs.writeFileSync(auditFile, '', { mode: 0o600 }); } catch { /* swallow */ }
-    daemon.enforcementDisabled = false;
-  });
-
-  function makeProject(name, dirName = name) {
-    const dir = path.join(scratch, dirName);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name }));
-    return dir;
-  }
-
-  function pushOverride(projDir, scriptArgv1 = 'index.js') {
-    overridesQueue.push({
-      cwdOverride: projDir,
-      cmdlineOverride: ['bun', scriptArgv1],
-    });
-  }
-
-  async function makeClient({ database, expectError = false } = {}) {
-    const client = new Client({
-      host: controlSocketDir,
-      port: 5432,
-      database: database || 'postgres',
-      user: 'postgres',
-      password: 'postgres',
-    });
-    // pg.Client's end() can hang after a FATAL connect failure (it tries
-    // to send a Terminate message on a closed socket), so on the deny path
-    // we swallow connect's rejection and return immediately. The TCP
-    // socket is already FIN'd by the daemon.
-    if (expectError) {
-      // Suppress unhandled-error events on the underlying socket.
-      client.on('error', () => { /* swallow */ });
-      let err;
-      try { await client.connect(); } catch (e) { err = e; }
-      return { error: err };
-    }
-    await client.connect();
-    return { client };
-  }
-
-  function readAudit() {
-    if (!fs.existsSync(auditFile)) return [];
-    return fs.readFileSync(auditFile, 'utf8')
-      .split('\n')
-      .filter(Boolean)
-      .map((l) => JSON.parse(l));
-  }
-
-  test('two peers with different fingerprints get different DBs', async () => {
-    const projA = makeProject('proj-a');
-    const projB = makeProject('proj-b');
-
-    pushOverride(projA);
-    const { client: ca } = await makeClient();
-    const ra = await ca.query('SELECT current_database() AS db');
-    await ca.end();
-
-    pushOverride(projB);
-    const { client: cb } = await makeClient();
-    const rb = await cb.query('SELECT current_database() AS db');
-    await cb.end();
-
-    expect(ra.rows[0].db).toMatch(/^app_proj_a_[0-9a-f]{12}$/);
-    expect(rb.rows[0].db).toMatch(/^app_proj_b_[0-9a-f]{12}$/);
-    expect(ra.rows[0].db).not.toBe(rb.rows[0].db);
-
-    const events = readAudit();
-    const created = events.filter((e) => e.event === AUDIT_EVENTS.DB_CREATED);
-    expect(created.length).toBe(2);
-    expect(created.map((e) => e.database).sort()).toEqual(
-      [ra.rows[0].db, rb.rows[0].db].sort(),
-    );
-  });
-
-  test('same peer reconnecting reaches its existing DB (no second db_created)', async () => {
-    const projA = makeProject('reconnect-app');
-
-    pushOverride(projA);
-    const { client: c1 } = await makeClient();
-    const r1 = await c1.query('SELECT current_database() AS db');
-    await c1.end();
-
-    pushOverride(projA);
-    const { client: c2 } = await makeClient();
-    const r2 = await c2.query('SELECT current_database() AS db');
-    await c2.end();
-
-    expect(r2.rows[0].db).toBe(r1.rows[0].db);
-
-    const created = readAudit().filter((e) => e.event === AUDIT_EVENTS.DB_CREATED);
-    expect(created.length).toBe(1);
-  });
-
-  test('cross-fingerprint connection denied with SQLSTATE 28P01', async () => {
-    const projA = makeProject('tenant-a');
-    const projB = makeProject('tenant-b');
-
-    // Provision tenant A's DB first.
-    pushOverride(projA);
-    const { client: ca } = await makeClient();
-    const ra = await ca.query('SELECT current_database() AS db');
-    await ca.end();
-    const tenantADb = ra.rows[0].db;
-
-    // Now have tenant B try to connect explicitly into tenant A's DB.
-    pushOverride(projB);
-    const { error } = await makeClient({ database: tenantADb, expectError: true });
-
-    expect(error).toBeDefined();
-    expect(error.code).toBe('28P01');
-
-    const denied = readAudit().filter(
-      (e) => e.event === AUDIT_EVENTS.CONNECTION_DENIED_FINGERPRINT_MISMATCH,
-    );
-    expect(denied.length).toBe(1);
-    expect(denied[0].requested_database).toBe(tenantADb);
-    expect(denied[0].owned_database).toMatch(/^app_tenant_b_[0-9a-f]{12}$/);
-  });
-
-  test('kill-switch env: cross-fingerprint succeeds and emits audit event', async () => {
-    const projA = makeProject('killswitch-a');
-    const projB = makeProject('killswitch-b');
-
-    // Provision tenant A.
-    pushOverride(projA);
-    const { client: ca } = await makeClient();
-    const ra = await ca.query('SELECT current_database() AS db');
-    await ca.end();
-    const tenantADb = ra.rows[0].db;
-
-    // Flip the live kill-switch flag on the daemon (the env var is read
-    // once at construction; this is the test seam for the same effect).
-    daemon.enforcementDisabled = true;
-
-    pushOverride(projB);
-    const { client: cb } = await makeClient({ database: tenantADb });
-    const rb = await cb.query('SELECT current_database() AS db');
-    await cb.end();
-
-    // Bypass succeeded: tenant B's session reached tenant A's DB.
-    expect(rb.rows[0].db).toBe(tenantADb);
-
-    const events = readAudit();
-    const bypass = events.filter(
-      (e) => e.event === AUDIT_EVENTS.ENFORCEMENT_KILL_SWITCH_USED,
-    );
-    expect(bypass.length).toBe(1);
-    expect(bypass[0].owned_database).toMatch(/^app_killswitch_b_[0-9a-f]{12}$/);
-    expect(bypass[0].requested_database).toBe(tenantADb);
-
-    // No deny event should fire while the kill switch is active.
-    const denied = events.filter(
-      (e) => e.event === AUDIT_EVENTS.CONNECTION_DENIED_FINGERPRINT_MISMATCH,
-    );
-    expect(denied.length).toBe(0);
-  });
-
-  test('sanitizer: name "@scope/foo bar" produces app__scope_foo_bar_<hex>', async () => {
-    const projScoped = makeProject('@scope/foo bar', 'scoped-pkg');
-
-    pushOverride(projScoped);
-    const { client } = await makeClient();
-    const r = await client.query('SELECT current_database() AS db');
-    await client.end();
-
-    expect(r.rows[0].db).toMatch(/^app__scope_foo_bar_[0-9a-f]{12}$/);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Boot-time deprecation warning
-// ---------------------------------------------------------------------------
-
-describe('boot deprecation warning when kill switch is set', () => {
-  test('writes a deprecation message to stderr at start()', async () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-killswitch-boot-'));
-    const controlDir = path.join(dir, 'sock');
-    fs.mkdirSync(controlDir, { recursive: true });
-
-    const captured = [];
-    const origWrite = process.stderr.write.bind(process.stderr);
-    process.stderr.write = (chunk, ...rest) => {
-      captured.push(typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8'));
-      return origWrite(chunk, ...rest);
-    };
-
-    let d;
-    try {
-      d = new PgserveDaemon({
-        controlSocketDir: controlDir,
-        controlSocketPath: resolveControlSocketPath(controlDir),
-        pidLockPath: resolvePidLockPath(controlDir),
-        libpqCompatPath: resolveLibpqCompatPath(controlDir, 5432),
-        pgPort: 16780,
-        enforcementDisabled: true,
-        logger: createLogger({ level: 'warn' }),
-      });
-      await d.start();
-
-      const merged = captured.join('');
-      expect(merged).toContain(KILL_SWITCH_ENV);
-      expect(merged).toContain('DISABLED');
-      expect(merged).toContain('deprecated');
-    } finally {
-      process.stderr.write = origWrite;
-      try { if (d) await d.stop(); } catch { /* swallow */ }
-      try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* swallow */ }
-    }
-  });
-});

package/tests/wrapper-supervision.test.js

@@ -1,107 +0,0 @@
-/**
- * Wrapper supervision: postgres backend death surfaces to the wrapper
- *
- * Verifies that:
- *  1. PostgresManager extends EventEmitter and emits `backendExited` when
- *     the postgres child exits.
- *  2. `expected: true` is reported when the exit was initiated by stop().
- *  3. `expected: false` is reported when the child was killed externally
- *     (the case the wrapper needs to react to per pgserve#45).
- *  4. PgserveDaemon re-emits `backendDiedUnexpectedly` only for unexpected
- *     exits, not for clean stop().
- *
- * Tests use the real Bun.spawn'd postgres binary via PostgresManager because
- * the supervision contract is end-to-end — a unit test with a mocked process
- * would prove only that the JS plumbing fires.
- */
-
-import { PostgresManager } from '../src/postgres.js';
-import { PgserveDaemon } from '../src/daemon.js';
-import { EventEmitter } from 'events';
-import { test, expect } from 'bun:test';
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-
-function quietLogger() {
-  return {
-    info: () => {}, warn: () => {}, error: () => {}, debug: () => {},
-    child: () => quietLogger(),
-  };
-}
-
-test('PostgresManager extends EventEmitter', () => {
-  const mgr = new PostgresManager({});
-  expect(mgr).toBeInstanceOf(EventEmitter);
-});
-
-test('PostgresManager emits backendExited with expected=true after stop()', async () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-supv-stop-'));
-  const mgr = new PostgresManager({ dataDir: dir, logger: quietLogger() });
-  let event = null;
-  mgr.on('backendExited', (info) => { event = info; });
-  await mgr.start();
-  await mgr.stop();
-  // Give event loop a tick to flush exited.then handler if not already drained
-  await new Promise((r) => setTimeout(r, 50));
-  expect(event).not.toBeNull();
-  expect(event.expected).toBe(true);
-  fs.rmSync(dir, { recursive: true, force: true });
-}, 60000);
-
-// External-SIGKILL integration coverage runs on Linux only. On macOS,
-// Bun.spawn'd postgres reliably refuses to surface its `exited` promise
-// within the test deadline when killed by SIGKILL — Bun's posix_spawn
-// path on darwin holds parent reaping until grandchildren reap, which
-// postgres never does fast enough for a deterministic test. The
-// `expected=false` branch is still covered cross-platform by the
-// daemon-level re-emit test below, which feeds a synthetic
-// `backendExited` payload through a fake EventEmitter and bypasses the
-// OS signal-handling variability entirely.
-const linuxOnly = process.platform === 'linux' ? test : test.skip;
-linuxOnly('PostgresManager emits backendExited with expected=false on external SIGKILL (linux)', async () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-supv-kill-'));
-  const mgr = new PostgresManager({ dataDir: dir, logger: quietLogger() });
-  let event = null;
-  mgr.on('backendExited', (info) => { event = info; });
-  await mgr.start();
-  const childPid = mgr.process?.pid;
-  expect(childPid).toBeGreaterThan(0);
-  // External kill — _stopping stays false, so the handler must mark unexpected
-  process.kill(childPid, 'SIGKILL');
-  // Wait for the exit handler to fire (max 3s)
-  for (let i = 0; i < 60 && event === null; i++) {
-    await new Promise((r) => setTimeout(r, 50));
-  }
-  expect(event).not.toBeNull();
-  expect(event.expected).toBe(false);
-  // Cleanup: paths were nulled by the unexpected-exit branch, so stop() is a no-op
-  await mgr.stop().catch(() => {});
-  fs.rmSync(dir, { recursive: true, force: true });
-}, 60000);
-
-test('PgserveDaemon re-emits backendDiedUnexpectedly only on unexpected exit', () => {
-  // Pure plumbing test — synthesize PgserveDaemon and a fake pgManager that
-  // is just an EventEmitter; verify the wiring.
-  const fakePgManager = new EventEmitter();
-  // PgserveDaemon constructor needs a baseDir; passing a tmp dir avoids
-  // touching real config.
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgserve-supv-daemon-'));
-  const daemon = new PgserveDaemon({
-    baseDir: dir,
-    logger: quietLogger(),
-    pgManager: fakePgManager,
-    enforcementDisabled: true,
-  });
-  const events = [];
-  daemon.on('backendDiedUnexpectedly', (info) => events.push(info));
-
-  fakePgManager.emit('backendExited', { code: 0, expected: true });
-  expect(events).toHaveLength(0); // clean stop — no re-emit
-
-  fakePgManager.emit('backendExited', { code: 137, expected: false });
-  expect(events).toHaveLength(1);
-  expect(events[0]).toEqual({ code: 137, expected: false });
-
-  fs.rmSync(dir, { recursive: true, force: true });
-});