postgresai 0.16.0-rc.2 → 0.16.0-rc.4

package/test/checkup.test.ts

@@ -1539,12 +1539,13 @@ describe("CLI tests", () => {
     const r = runCli(["checkup", "--help"]);
     expect(r.status).toBe(0);
     expect(r.stdout).toMatch(/--markdown/);
-    expect(r.stdout).toMatch(/output markdown to stdout/i);
+    expect(r.stdout).toMatch(/PostgresAI API/i);
+    expect(r.stdout).toMatch(/transmits the full\s+report JSON/i);
   });
 
   test("checkup --markdown is recognized as valid option", () => {
     // Should not produce "unknown option" error for --markdown
-    const r = runCli(["checkup", "postgresql://test:test@localhost:5432/test", "--markdown", "--no-upload"]);
+    const r = runCli(["checkup", "postgresql://test:test@localhost:5432/test", "--markdown"]);
     // Connection will fail, but option parsing should succeed
     expect(r.stderr).not.toMatch(/unknown option/i);
     expect(r.stderr).not.toMatch(/did you mean/i);
@@ -1554,11 +1555,13 @@ describe("CLI tests", () => {
     // Use empty config dir to ensure no API key is configured
     const env = { XDG_CONFIG_HOME: "/tmp/postgresai-test-empty-config" };
     // --markdown should work even without API key
-    const r = runCli(["checkup", "postgresql://test:test@localhost:5432/test", "--markdown", "--no-upload"], env);
+    const r = runCli(["checkup", "postgresql://test:test@localhost:5432/test", "--markdown"], env);
     // Connection will fail, but --markdown flag should be recognized
     expect(r.status).not.toBe(0);
     expect(r.stderr).not.toMatch(/unknown option/i);
     expect(r.stderr).not.toMatch(/API key is required/i);
+    expect(r.stderr).toMatch(/full report JSON will still be sent/i);
+    expect(r.stderr).toMatch(/markdown conversion/i);
   });
 
   test("checkup with --no-upload and no output flags shows summary", () => {
@@ -1663,6 +1666,21 @@ describe("checkup auth pre-flight (CLI)", () => {
   // failure mentions this address.
   const DEAD_DB = "postgresql://test:test@127.0.0.1:2/test";
 
+  test("--no-upload rejects --markdown before database or API work", () => {
+    const env = {
+      XDG_CONFIG_HOME: `/tmp/postgresai-test-no-upload-markdown-${process.pid}`,
+      PGAI_API_KEY: "configured-token",
+      PGAI_API_BASE_URL: "http://127.0.0.1:1",
+    };
+    const r = runCli(["checkup", DEAD_DB, "--no-upload", "--markdown"], env);
+
+    expect(r.status).not.toBe(0);
+    expect(r.stderr).toMatch(/--no-upload and --markdown are mutually exclusive/i);
+    expect(r.stderr).toMatch(/markdown conversion is performed by the PostgresAI API/i);
+    expect(r.stderr).toMatch(/use --json or --output/i);
+    expect(r.stderr).not.toMatch(/127\.0\.0\.1:2|ECONNREFUSED/);
+  });
+
   test("no API key: prominent notice, run continues locally", () => {
     const env = {
       XDG_CONFIG_HOME: `/tmp/postgresai-test-preflight-nokey-${process.pid}`,
@@ -2173,6 +2191,31 @@ describe("checkup-summary", () => {
     );
   });
 
+  for (const checkId of ["F004", "F005"]) {
+    test(`generateCheckSummary for degraded ${checkId} is never ok`, () => {
+      const report = {
+        results: {
+          node1: {
+            data: {
+              db1: {
+                status: {
+                  ok: false,
+                  reason: "missing_schema",
+                  error: 'schema "postgres_ai" does not exist',
+                },
+                total_count: 0,
+              },
+            },
+          },
+        },
+      };
+
+      const result = summary.generateCheckSummary(checkId, report);
+      expect(result.status).toBe("warning");
+      expect(result.message).toMatch(/degraded.*missing schema/i);
+    });
+  }
+
   test("generateCheckSummary for H001 with no issues", () => {
     const report = {
       results: {
@@ -3371,6 +3414,7 @@ describe("Postgres version compatibility (PG13-PG18)", () => {
           autovacuum_vacuum_scale_factor: expectedAutovacuumSetting,
         });
         expect(reports.F004.results["test-node"].data.testdb).toEqual({
+          status: { ok: true, reason: null, error: null },
           bloated_tables: [],
           total_count: 0,
           total_bloat_size_bytes: 0,
@@ -3379,6 +3423,7 @@ describe("Postgres version compatibility (PG13-PG18)", () => {
           database_size_pretty: "1.00 GiB",
         });
         expect(reports.F005.results["test-node"].data.testdb).toEqual({
+          status: { ok: true, reason: null, error: null },
           bloated_indexes: [],
           total_count: 0,
           total_bloat_size_bytes: 0,

package/test/init.integration.test.ts

@@ -407,12 +407,14 @@ describe.skipIf(skipTests)("integration: prepare-db", () => {
     }
   }, { timeout: TEST_TIMEOUT });
 
-  // 60s timeout for PostgreSQL startup + multiple SQL queries in slow CI
-  test("explain_generic validates input and prevents SQL injection", async () => {
+  // Security regression for #387: explain_generic was a SECURITY DEFINER helper that
+  // ran caller-supplied SQL through EXPLAIN. The planner folds IMMUTABLE/STABLE functions
+  // at plan time in the definer's (superuser) context, making it an RCE/data-exfil vector.
+  // It has been removed; prepare-db must NOT create it.
+  test("explain_generic is not created by prepare-db (RCE helper removed, #387)", async () => {
     pg = await createTempPostgres();
 
     try {
-      // Run init first
       {
         const r = runCliInit([pg.adminUri, "--password", "pw1", "--skip-optional-permissions"]);
         expect(r.status).toBe(0);
@@ -422,82 +424,10 @@ describe.skipIf(skipTests)("integration: prepare-db", () => {
       await c.connect();
 
       try {
-        // Check PostgreSQL version - generic_plan requires 16+
-        const versionRes = await c.query("show server_version_num");
-        const version = parseInt(versionRes.rows[0].server_version_num, 10);
-
-        if (version < 160000) {
-          // Skip this test on older PostgreSQL versions
-          console.log("Skipping explain_generic tests: requires PostgreSQL 16+");
-          return;
-        }
-
-        // Test 1: Empty query should be rejected
-        await expect(
-          c.query("select postgres_ai.explain_generic('')")
-        ).rejects.toThrow(/query cannot be empty/);
-
-        // Test 2: Null query should be rejected
-        await expect(
-          c.query("select postgres_ai.explain_generic(null)")
-        ).rejects.toThrow(/query cannot be empty/);
-
-        // Test 3: Multiple statements (semicolon in middle) should be rejected
-        await expect(
-          c.query("select postgres_ai.explain_generic('select 1; select 2')")
-        ).rejects.toThrow(/semicolon|multiple statements/i);
-
-        // Test 4: Trailing semicolon should be stripped and work
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select 1;') as result");
-          expect(res.rows[0].result).toBeTruthy();
-          expect(res.rows[0].result).toMatch(/Result/i);
-        }
-
-        // Test 5: Valid query should work
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select $1::int', 'text') as result");
-          expect(res.rows[0].result).toBeTruthy();
-        }
-
-        // Test 6: JSON format should work
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select 1', 'json') as result");
-          const plan = JSON.parse(res.rows[0].result);
-          expect(Array.isArray(plan)).toBe(true);
-          expect(plan[0].Plan).toBeTruthy();
-        }
-
-        // Test 7: Whitespace-only query should be rejected
-        await expect(
-          c.query("select postgres_ai.explain_generic('   ')")
-        ).rejects.toThrow(/query cannot be empty/);
-
-        // Test 8: Semicolon in string literal is rejected (documented limitation)
-        // Note: This is a known limitation - the simple heuristic cannot parse SQL strings
-        await expect(
-          c.query("select postgres_ai.explain_generic('select ''hello;world''')")
-        ).rejects.toThrow(/semicolon/i);
-
-        // Test 9: SQL comments should work (no semicolons)
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select 1 -- comment') as result");
-          expect(res.rows[0].result).toBeTruthy();
-        }
-
-        // Test 10: Escaped quotes should work (no semicolons)
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select ''test''''s value''') as result");
-          expect(res.rows[0].result).toBeTruthy();
-        }
-
-        // Test 11: Case-insensitive format parameter
-        {
-          const res = await c.query("select postgres_ai.explain_generic('select 1', 'JSON') as result");
-          const plan = JSON.parse(res.rows[0].result);
-          expect(Array.isArray(plan)).toBe(true);
-        }
-
+        const res = await c.query(
+          "select count(*)::int as n from pg_proc where proname = 'explain_generic' and pronamespace = (select oid from pg_namespace where nspname = 'postgres_ai')"
+        );
+        expect(res.rows[0].n).toBe(0);
       } finally {
         await c.end();
       }

package/test/init.test.ts

@@ -1489,6 +1489,24 @@ describe("checkCurrentUserPermissions", () => {
     ).rejects.toThrow("permission denied for relation pg_roles");
   });
 
+  test("guards optional postgres_ai privilege probes when the schema is absent", async () => {
+    let capturedSql = "";
+    const client = {
+      query: async (sql: string) => {
+        capturedSql = sql;
+        return { rows: [] };
+      },
+    };
+
+    await init.checkCurrentUserPermissions(client as any);
+
+    expect(capturedSql).toContain("to_regnamespace('postgres_ai') is null");
+    expect(capturedSql).toContain("'postgres_ai schema exists' as permission_name");
+    expect(capturedSql).toMatch(
+      /when to_regnamespace\('postgres_ai'\) is null then null\s+when not has_schema_privilege/
+    );
+  });
+
   test("returns all rows for inspection", async () => {
     const rows: init.PermissionCheckRow[] = [
       { permission_name: "connect on database postgres", status: "required", granted: true, fix_command: null },
@@ -1545,6 +1563,23 @@ describe("formatPermissionCheckMessages", () => {
     expect(messages.errors).toHaveLength(0);
   });
 
+  test("explains that a missing postgres_ai schema only degrades F004/F005", () => {
+    const result: init.PreflightPermissionResult = {
+      ok: true,
+      rows: [],
+      missingRequired: [],
+      missingOptional: [
+        { permission_name: "postgres_ai schema exists", status: "optional", granted: false, fix_command: null },
+      ],
+    };
+
+    const messages = init.formatPermissionCheckMessages(result);
+    expect(messages.failed).toBe(false);
+    expect(messages.warnings).toEqual([
+      "Warning: optional: postgres_ai schema not found — F004/F005 (bloat estimates) will be skipped; run prepare-db or create the view manually to enable them.",
+    ]);
+  });
+
   test("returns errors with fix commands for missing required permissions", () => {
     const result: init.PreflightPermissionResult = {
       ok: false,

package/test/schema-validation.test.ts

@@ -99,6 +99,46 @@ describe("Schema validation", () => {
     validateAgainstSchema(report, "F003");
   });
 
+  for (const checkId of ["F004", "F005"]) {
+    test(`${checkId} distinguishes a healthy empty result from missing schema`, async () => {
+      const healthyClient = createMockClient();
+      const healthy = await checkup.REPORT_GENERATORS[checkId](healthyClient as any, "node-01");
+      const healthyDb = healthy.results["node-01"].data.testdb;
+      expect(healthyDb.status).toEqual({ ok: true, reason: null, error: null });
+      validateAgainstSchema(healthy, checkId);
+
+      const missingSchemaClient = createMockClient({
+        bloatCapabilityRows: [
+          { schema_exists: false, schema_usage: false, view_exists: false, view_select: false },
+        ],
+      });
+      const degraded = await checkup.REPORT_GENERATORS[checkId](missingSchemaClient as any, "node-01");
+      const degradedDb = degraded.results["node-01"].data.testdb;
+      expect(degradedDb.status).toEqual({
+        ok: false,
+        reason: "missing_schema",
+        error: 'schema "postgres_ai" does not exist',
+      });
+      validateAgainstSchema(degraded, checkId);
+    });
+
+    test(`${checkId} exposes missing-grant degradation`, async () => {
+      const client = createMockClient({
+        bloatCapabilityRows: [
+          { schema_exists: true, schema_usage: true, view_exists: true, view_select: false },
+        ],
+      });
+      const report = await checkup.REPORT_GENERATORS[checkId](client as any, "node-01");
+      const dbEntry = report.results["node-01"].data.testdb;
+      expect(dbEntry.status).toEqual({
+        ok: false,
+        reason: "missing_grant",
+        error: "permission denied for relation postgres_ai.pg_statistic",
+      });
+      validateAgainstSchema(report, checkId);
+    });
+  }
+
   // Settings reports (D004, F001, G001) - single test each
   for (const checkId of ["D004", "F001", "G001"]) {
     test(`${checkId} validates against schema`, async () => {

package/test/test-utils.ts

@@ -19,6 +19,7 @@ export interface MockClientOptions {
   indexBloatRows?: any[];
   deadTuplesRows?: any[];
   vacuumStatsRows?: any[];
+  bloatCapabilityRows?: any[];
   deadlockStatsRows?: any[];
   pgStatStatementsExtensionRows?: any[];
   pgStatStatementsStatsRows?: any[];
@@ -61,6 +62,7 @@ export function createMockClient(options: MockClientOptions = {}) {
     indexBloatRows = [],
     deadTuplesRows = [],
     vacuumStatsRows = [],
+    bloatCapabilityRows = [{ schema_exists: true, schema_usage: true, view_exists: true, view_select: true }],
     deadlockStatsRows = [{ deadlocks: "0", conflicts: "0", stats_reset: null }],
     pgStatStatementsExtensionRows = [],
     pgStatStatementsStatsRows = [],
@@ -128,6 +130,9 @@ export function createMockClient(options: MockClientOptions = {}) {
         return { rows: deadTuplesRows };
       }
       // F004/F005: bloat metrics from metrics.yml
+      if (sql.includes("to_regnamespace('postgres_ai')") && sql.includes("view_select")) {
+        return { rows: bloatCapabilityRows };
+      }
       if (sql.includes("tag_idxname") && sql.includes("bloat_size")) {
         return { rows: indexBloatRows };
       }