stack/packages/bus/tests/grant-migration.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { pathToFileURL } from 'node:url';
import { createHash } from 'node:crypto';
import { DatabaseSync } from 'node:sqlite';
import { Store, schemaDigest } from '../src/store.mjs';
import { Broker } from '../src/broker.mjs';
// Row 234 (#1740, #436a row a): the 3i→3j step adds the hosts and host_grants tables and the grant
// event guard (#436b section 7 at fa5658941). It runs on a 3i store built here from the pinned 3i
// schema (8fede5fc6's schema.sql) and fixture rows. No live store is read or copied.
const AT = '2026-10-21T00:00:00.000Z';
const TAG = 'mosaic-' + 'a'.repeat(32);
const ddl3i = readFileSync(new URL('./fixtures/schema-3i.sql', import.meta.url), 'utf8');
const here = (p) => new URL(p, import.meta.url);
const NEW = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hosts_1', 'sqlite_autoindex_host_grants_1'];
// Row 236 (#1742): 3j→3k's objects, after this step. Their test is gitea-migration.test.mjs.
const LATER = ['gitea_users', 'gitea_grants', 'sqlite_autoindex_gitea_users_1', 'sqlite_autoindex_gitea_grants_1'];
// Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
// Row 271 (#1776): and the 3m→3n step's session_ops and message_cancels. session-clear.test.mjs tests them.
const later3l = (r) => [...SESSIONS_3L, 'thread_shares', 'session_ops', 'message_cancels', 'project_archives', 'project_system_types', 'store_tasks', 'request_events', 'request_effects', 'request_snapshots', 'request_snapshot_events', 'request_project_events'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
function source3i(t) {
  const root = mkdtempSync(join(tmpdir(), 'grant-migrate-'));
  t.after(() => rmSync(root, { recursive: true, force: true }));
  mkdirSync(join(root, 'bus'), { mode: 0o700 });
  const path = join(root, 'bus/bus.sqlite'), db = new DatabaseSync(path);
  assert.equal(createHash('sha256').update(ddl3i).digest('hex'), '6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737');
  db.exec(ddl3i);
  const run = (sql, ...args) => db.prepare(sql).run(...args);
  run('INSERT INTO meta VALUES (?,?)', 'schema_version', '3i');
  run('INSERT INTO meta VALUES (?,?)', 'schema_digest', schemaDigest(db));
  run('INSERT INTO meta VALUES (?,?)', 'comment_cursor_epoch', AT);
  run('INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)', 'e1', AT, 'demo', 'action.allowed', 'coder', 'run1', '{"action":"host.sudo"}');
  run('INSERT INTO events(id,at,business,kind,body) VALUES(?,?,?,?,?)', 'e2', AT, 'demo', 'action.allowed', '{}');
  db.close(); chmodSync(path, 0o600);
  return { root, path };
}
function rows(path) {
  const db = new DatabaseSync(path, { readOnly: true });
  try {
    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults','thread_shares','session_ops','message_cancels','request_events','request_effects','request_snapshots','request_snapshot_events','request_project_events','project_archives','project_system_types','store_tasks')").all()
      .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
        .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
  } finally { db.close(); }
}
// Row 264a: the 3k→3l step fills sessions and session_defaults with INSERT ... SELECT, which gives
// each a sqlite_sequence row even when it copies none (3k-3l.sql:50-52). The compare after the step
// leaves out the rows SESSIONS_3L names and checks they are exactly those two at seq 0, so any other
// new row still fails.
function migrated3l(now) {
  const left = now.sqlite_sequence.filter(r => SESSIONS_3L.includes(r.name));
  assert.deepEqual(left, [{ name: 'sessions', seq: 0 }, { name: 'session_defaults', seq: 0 }]);
  return { ...now, sqlite_sequence: now.sqlite_sequence.filter(r => !SESSIONS_3L.includes(r.name)) };
}
function master(path) {
  const db = new DatabaseSync(path, { readOnly: true });
  try {
    return db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_master ORDER BY type,name').all().map(r => ({ ...r }));
  } finally { db.close(); }
}
const version = (path) => {
  const db = new DatabaseSync(path, { readOnly: true });
  try { return db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value; } finally { db.close(); }
};
// A copy of the bus module whose store.mjs, schema.sql and 3i→3j step the caller edits.
async function engine(root, name, { store, schema, step = (s) => s }) {
  const moduleRoot = join(root, name);
  mkdirSync(join(moduleRoot, 'src/migrations'), { recursive: true });
  const source = readFileSync(here('../src/store.mjs'), 'utf8'), edited = store ? store(source) : source;
  if (store) assert.notEqual(edited, source);
  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
  writeFileSync(join(moduleRoot, 'schema.sql'), schema ?? readFileSync(here('../schema.sql'), 'utf8'));
  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql'])
    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
  writeFileSync(join(moduleRoot, 'src/migrations/3i-3j.sql'), step(readFileSync(here('../src/migrations/3i-3j.sql'), 'utf8')));
  copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
  copyFileSync(here('../src/migrations/3m-3n.sql'), join(moduleRoot, 'src/migrations/3m-3n.sql'));
  copyFileSync(here('../src/migrations/3n-3o.sql'), join(moduleRoot, 'src/migrations/3n-3o.sql'));
  copyFileSync(here('../src/migrations/3o-3p.sql'), join(moduleRoot, 'src/migrations/3o-3p.sql'));
  copyFileSync(here('../src/migrations/3p-3q.sql'), join(moduleRoot, 'src/migrations/3p-3q.sql'));
  copyFileSync(here('../src/migrations/3q-3r.sql'), join(moduleRoot, 'src/migrations/3q-3r.sql'));
  copyFileSync(here('../src/migrations/3r-3s.sql'), join(moduleRoot, 'src/migrations/3r-3s.sql'));
  copyFileSync(here('../src/migrations/3s-3t.sql'), join(moduleRoot, 'src/migrations/3s-3t.sql'));
  copyFileSync(here('../src/migrations/3t-3u.sql'), join(moduleRoot, 'src/migrations/3t-3u.sql'));
  copyFileSync(here('../src/migrations/3u-3v.sql'), join(moduleRoot, 'src/migrations/3u-3v.sql'));
  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
}
function fresh(t) {
  const root = mkdtempSync(join(tmpdir(), 'grant-store-'));
  const store = new Store(root);
  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
  store.run(`INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking)
    VALUES('d1',?,'demo','chief','run1','gated','credential.mint','human','q','["yes","no"]','yes',0)`, AT);
  return store;
}
const event = (store, actor, body, kind = 'action.allowed') => store.run(
  'INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)',
  'e' + Math.random().toString(16).slice(2), AT, 'demo', kind, actor[0], actor[1], JSON.stringify(body));
const host = (store, values = {}) => store.run(
  `INSERT INTO hosts(business,host,address,port,user,sudo,host_keys,installer_fingerprint,state,decision,checked_at)
    VALUES(:business,:host,:address,:port,:user,:sudo,:host_keys,:fp,:state,:decision,:checked)`,
  { business: 'demo', host: 'web1', address: '192.0.2.10', port: 22, user: 'deploy', sudo: 0,
    host_keys: '["ssh-ed25519 AAAA"]', fp: null, state: 'pending-install', decision: 'd1', checked: null, ...values });

test('3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard', t => {
  const { root, path } = source3i(t), before = rows(path), was = master(path);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
  assert.equal(version(path), '3v');
  assert.deepEqual(migrated3l(rows(path)), before);
  const now = master(path).filter(r => !LATER.includes(r.name));
  assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
  assert.deepEqual(now.filter(r => NEW.includes(r.name)).map(r => r.name).sort(), [...NEW].sort());
  const store = new Store(root);
  try {
    assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
    assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
    assert.equal(store.get('SELECT count(*) AS n FROM hosts').n, 0);
    // An event row 210 wrote before the step stays, and a session can still write host.sudo.
    event(store, ['coder', 'run2'], { action: 'host.sudo', phase: 'requested' });
  } finally { store.close(); }
});

test('a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact', async t => {
  const { root, path } = source3i(t), before = rows(path), was = master(path);
  // The real step plus a statement that fails only when events has a row, so the empty replay at
  // import passes and the store's run fails after both tables and the trigger exist.
  const Failing = await engine(root, 'engine-failing', { step: (sql) => sql + 'INSERT INTO events SELECT * FROM events LIMIT 1;\n' });
  assert.throws(() => new Failing(root, { migrateSchema: true }), /events is append-only/);
  assert.equal(version(path), '3i');
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), before);
  new Store(root, { migrateSchema: true }).close();
  assert.equal(version(path), '3v');
});

test('the 3i engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
  const { root, path } = source3i(t);
  new Store(root, { migrateSchema: true }).close();
  const after = rows(path), was = master(path);
  const Store3i = await engine(root, 'engine-3i', {
    schema: ddl3i,
    store: (source) => source
      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3i).digest('hex')}';`)
      .replace("export const SCHEMA_VERSION = '3v';", "export const SCHEMA_VERSION = '3i';")
      .replace(/\}, \{\n {2}\/\/ Row 234 \(#1740\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
  });
  const pinned = readFileSync(join(root, 'engine-3i/src/store.mjs'), 'utf8');
  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3i';") && !pinned.includes('3i-3j'), 'the 3i engine has no 3i→3j step');
  assert.throws(() => new Store3i(root), /schema-mismatch/);
  assert.throws(() => new Store3i(root, { migrateSchema: true }), /schema-mismatch/);
  assert.equal(version(path), '3v');
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), after);
});

test('A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it', async t => {
  // The step adds the guard but leaves old rows. At 3i recordEvent had no reserved-event refusal, so a
  // session could write these, and after the step only GRANT_EVIDENCE's actor filter keeps them out.
  const { root, path } = source3i(t);
  const db = new DatabaseSync(path);
  const run = (sql, ...args) => db.prepare(sql).run(...args);
  run(`INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking)
    VALUES('d1',?,'demo','chief','run1','gated','credential.mint','human','q','["yes","no"]','yes',0)`, AT);
  const legacy = [{ action: 'grant.host.removed', host: 'web1', hostLineLeft: TAG }, { operation: 'grant.host-enroll', decision: 'd1' }];
  for (const [i, body] of legacy.entries())
    run('INSERT INTO events(id,at,business,kind,actor_role,actor_run,body) VALUES(?,?,?,?,?,?,?)', 'old' + i, AT, 'demo', 'action.allowed', 'chief', 'run1', JSON.stringify(body));
  db.close();
  new Store(root, { migrateSchema: true }).close();
  const store = new Store(root);
  t.after(() => store.close());
  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE id IN ('old0','old1')").n, 2);
  host(store);
  const business = {
    id: 'demo',
    human: 'jason',
    arbiters: { technical: 'pm', delivery: 'pm' },
    roles: {
      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
    },
    vars: {},
  };
  const unenrolled = [];
  const broker = new Broker({ store, businesses: { demo: business }, hostGrant: { unenroll: (b, h) => unenrolled.push([b, h]), installerTag: () => null } });
  // The enrollment look-alike is not a spent decision, so nothing ends interrupted.
  assert.deepEqual(broker.reconcileGrants(), []);
  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE actor_run='grant'").n, 0);
  // The hostLineLeft look-alike is not a line left on the host.
  const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
  assert.deepEqual(await broker.request(human, { verb: 'hosts.remove', args: { host: 'web1' } }), { host: 'web1', removed: true });
  assert.deepEqual(unenrolled, [['demo', 'web1']]);
});

test('the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor', t => {
  const store = fresh(t);
  const refused = /only the grant writer records grant events/;
  for (const body of [{ action: 'grant.step' }, { action: 'grant.host.enrolled' }, { operation: 'grant.host-enroll', decision: 'd1' }]) {
    assert.throws(() => event(store, ['chief', 'run1'], body), refused, JSON.stringify(body));
    assert.throws(() => event(store, ['tester', 'run1'], body), refused);
    assert.throws(() => event(store, [null, null], body), refused, 'the human and session-less pair is not the grant actor');
    assert.throws(() => event(store, [null, 'run1'], body), refused);
    assert.throws(() => event(store, ['grant', 'grant'], body), refused);
    event(store, [null, 'grant'], body);
  }
  // Row 210's host.sudo and host.run stay outside the namespace, and so does any other kind.
  event(store, ['coder', 'run1'], { action: 'host.sudo', phase: 'completed' });
  event(store, ['coder', 'run1'], { action: 'grant.step' }, 'action.refused');
  event(store, ['coder', 'run1'], { action: 'granted.step', operation: 'grantx' });
  assert.equal(store.get("SELECT count(*) AS n FROM events WHERE actor_run='grant'").n, 3);
});

test('hosts: one record per business and host, a ready host has its installer and check, grants need the host', t => {
  const store = fresh(t);
  host(store);
  assert.throws(() => host(store, { address: '192.0.2.11' }), /UNIQUE constraint failed: hosts\.business, hosts\.host/);
  host(store, { business: 'other' });
  assert.throws(() => host(store, { host: 'web2', state: 'ready' }), /CHECK constraint failed/);
  assert.throws(() => host(store, { host: 'web2', state: 'ready', fp: 'SHA256:x' }), /CHECK constraint failed/);
  host(store, { host: 'web2', state: 'ready', fp: 'SHA256:x', checked: AT });
  assert.throws(() => host(store, { host: 'web3', state: 'live' }), /CHECK constraint failed/);
  assert.throws(() => host(store, { host: 'web3', host_keys: '[]' }), /CHECK constraint failed/);
  assert.throws(() => host(store, { host: 'web3', decision: 'nope' }), /FOREIGN KEY constraint failed/);
  const grant = (values = {}) => store.run(
    'INSERT INTO host_grants(business,agent,host,commands,rotate_by,tag,decision) VALUES(:business,:agent,:host,:commands,:rotate,:tag,:decision)',
    { business: 'demo', agent: 'coder', host: 'web2', commands: '[["true"]]', rotate: '2026-12-01', tag: TAG, decision: 'd1', ...values });
  assert.throws(() => grant({ host: 'web9' }), /FOREIGN KEY constraint failed/);
  for (const tag of ['mosaic-' + 'A'.repeat(32), 'mosaic-' + 'a'.repeat(31), 'mosaix-' + 'a'.repeat(32), 'mosaic-' + 'a'.repeat(31) + 'g'])
    assert.throws(() => grant({ tag }), /CHECK constraint failed/, tag);
  assert.throws(() => grant({ commands: '[]' }), /CHECK constraint failed/);
  grant();
  assert.throws(() => grant({ tag: 'mosaic-' + 'b'.repeat(32) }), /UNIQUE constraint failed/);
  assert.throws(() => store.run("DELETE FROM hosts WHERE business='demo' AND host='web2'"), /FOREIGN KEY constraint failed/);
});