Spaces:
Running
Running
| import { UserContext } from '../src/core/context'; | |
| import { AbstractSQLTeaQLClient, EntitySchema, SQLExecutionEvidenceStore, SQLExecutionMetadata } from '../src/sql/core'; | |
| import { SQLiteDriver } from '../src/sql/sqlite'; | |
| import { PLAINTEXT_LOG_ACK, PLAINTEXT_LOG_ENV, projectSQLLog } from '../src/core/log-privacy'; | |
| const schemas: Record<string, EntitySchema> = { Customer: { | |
| table: 'readback_customer', auditMaskFields: ['name'], columns: { | |
| id: { columnName: 'id', logicalType: 'integer', decode: 'string', logPolicy: 'plain' }, | |
| version: { columnName: 'version', logicalType: 'integer', decode: 'number', logPolicy: 'plain' }, | |
| name: { columnName: 'name', logicalType: 'text', decode: 'string', logPolicy: 'plain' }, | |
| passwordHash: { columnName: 'password_hash', logicalType: 'text', decode: 'string', logPolicy: 'plain' }, | |
| }, | |
| } }; | |
| class Client extends AbstractSQLTeaQLClient { | |
| constructor(driver: SQLiteDriver) { super(driver, schemas); } | |
| } | |
| it.each(['Create', 'Update', 'Delete'].flatMap(action => [0, 1, 2, 3].map(mode => ({ action, mode }))))( | |
| 'retains actual successful write/SELECT facts for $action with logging mode $mode', async ({ action, mode }) => { | |
| const driver = new SQLiteDriver(':memory:'); | |
| const client = new Client(driver).setDiagnosticSQLLogSink(undefined); | |
| try { | |
| await new UserContext().insertResource('dataService', client).ensureSchema(); | |
| if (action !== 'Create') await client.executeMutation({ entity: 'Customer', action: 'Create', | |
| id: '17', payload: { name: 'PRIVATE-CUSTOMER' }, comment: 'seed readback fixture' }); | |
| const evidence = new SQLExecutionEvidenceStore(), logs: SQLExecutionMetadata[] = []; | |
| client.setRuntimeTelemetrySink(evidence).setDiagnosticSQLLogSink({ write(entry) { logs.push(entry); } }) | |
| .setMutationLoggingEnabled(Boolean(mode & 1)).setQueryLoggingEnabled(Boolean(mode & 2)); | |
| const comment = action === 'Delete' ? 'delete fixture' : 'persist PRIVATE-CUSTOMER'; | |
| const result = await client.executeMutation({ entity: 'Customer', action, id: '17', version: 1, | |
| payload: action === 'Delete' ? {} : { name: 'PRIVATE-CUSTOMER' }, comment }); | |
| const operation = action === 'Create' ? 'insert' : action.toLowerCase(); | |
| expect(result.persistedRecord?.name).toBe('PRIVATE-CUSTOMER'); | |
| expect(result).toMatchObject({ metadata: { operation, affectedRows: 1, statements: [ | |
| { operation, affectedRows: 1, executionOutcome: 'success' }, | |
| { operation: 'select', resultCount: 1, comment, executionOutcome: 'success', parameters: ['17'] }, | |
| ] } }); | |
| expect(Object.isFrozen(result.metadata?.statements)).toBe(true); | |
| if (action !== 'Delete') expect(result.metadata?.statements?.[0].parameters).toContain('PRIVATE-CUSTOMER'); | |
| const entries = evidence.snapshot(); | |
| expect(entries.map(entry => entry.operation)).toEqual([operation, 'select']); | |
| expect(entries[1]?.tracePath.map(node => node.kind)).toEqual(['operation', 'request', 'provider', 'sql']); | |
| expect(entries[1]?.tracePath[0].name).toBe('Customer'); | |
| expect(entries[1]?.mutationLineage).toEqual(entries[0]?.mutationLineage); | |
| expect(logs.map(entry => entry.operation)).toEqual([ | |
| ...(mode & 1 ? [operation] : []), ...(mode & 2 ? ['select'] : []), | |
| ]); | |
| expect(JSON.stringify([logs, entries])).not.toContain('PRIVATE-CUSTOMER'); | |
| expect(client.auditTrace.filter(event => event.reason !== 'seed readback fixture')).toHaveLength(1); | |
| } finally { await client.close(); } | |
| }); | |
| it('retains result facts without sinks and safely reprojects nested readbacks after debug revocation', async () => { | |
| const previous = process.env[PLAINTEXT_LOG_ENV]; | |
| const driver = new SQLiteDriver(':memory:'); | |
| const client = new Client(driver).setDiagnosticSQLLogSink(undefined); | |
| try { | |
| delete process.env[PLAINTEXT_LOG_ENV]; | |
| await new UserContext().insertResource('dataService', client).ensureSchema(); | |
| const result = await client.executeMutation({ entity: 'Customer', action: 'Create', id: '23', | |
| payload: { name: 'PRIVATE-CUSTOMER', passwordHash: 'PASSWORD-CANARY' }, | |
| comment: 'persist PRIVATE-CUSTOMER PASSWORD-CANARY' }); | |
| expect(result.metadata?.statements?.map(entry => entry.operation)).toEqual(['insert', 'select']); | |
| const safe = projectSQLLog(result.metadata!); | |
| expect(JSON.stringify(safe)).not.toContain('PRIVATE-CUSTOMER'); | |
| expect(safe.statements?.[1].comment).toBe('persist [REDACTED] [REDACTED]'); | |
| expect(JSON.stringify(safe)).not.toContain('PASSWORD-CANARY'); | |
| process.env[PLAINTEXT_LOG_ENV] = PLAINTEXT_LOG_ACK; | |
| const debug = projectSQLLog(result.metadata!); | |
| expect(debug.statements?.[1].comment).toBe('persist PRIVATE-CUSTOMER [REDACTED]'); | |
| expect(JSON.stringify(debug)).not.toContain('PASSWORD-CANARY'); | |
| delete process.env[PLAINTEXT_LOG_ENV]; | |
| expect(JSON.stringify(projectSQLLog(debug))).not.toContain('PRIVATE-CUSTOMER'); | |
| expect(result.persistedRecord?.name).toBe('PRIVATE-CUSTOMER'); | |
| expect(result.metadata?.comment).toBeUndefined(); | |
| expect(result.metadata?.auditReason).toBe('persist PRIVATE-CUSTOMER PASSWORD-CANARY'); | |
| } finally { | |
| if (previous === undefined) delete process.env[PLAINTEXT_LOG_ENV]; | |
| else process.env[PLAINTEXT_LOG_ENV] = previous; | |
| await client.close(); | |
| } | |
| }); | |
| it.each(['Update', 'Delete'])('does not invent a readback or committed audit for unmatched %s', async action => { | |
| const driver = new SQLiteDriver(':memory:'); | |
| const evidence = new SQLExecutionEvidenceStore(); | |
| const client = new Client(driver).setDiagnosticSQLLogSink(undefined).setRuntimeTelemetrySink(evidence); | |
| try { | |
| await new UserContext().insertResource('dataService', client).ensureSchema(); | |
| await expect(client.executeMutation({ entity: 'Customer', action, id: '99', version: 1, | |
| payload: action === 'Delete' ? {} : { name: 'missing' }, comment: 'update absent fixture' })) | |
| .rejects.toThrow('Optimistic lock failed'); | |
| expect(evidence.snapshot()).toHaveLength(1); | |
| expect(evidence.snapshot()[0]).toMatchObject({ operation: action.toLowerCase(), executionOutcome: 'success', affectedRows: 0 }); | |
| expect(client.auditTrace).toHaveLength(0); | |
| } finally { await client.close(); } | |
| }); | |