|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#21910] The referential cascade does not treat a federated object's |
| 5 | + * platform-INJECTED `organization_id` as a reference to `sys_organization`, |
| 6 | + * and treats nothing else that way. |
| 7 | + * |
| 8 | + * The registry injects the tenant anchor (`organization_id`, a lookup to |
| 9 | + * `sys_organization`) into every object it registers, ADR-0015 `external` ones |
| 10 | + * included, and the platform provisions no storage for a federated object. On |
| 11 | + * the showcase, deleting an organization ran the cascade scan's dependents |
| 12 | + * probe against the remote `customers` table on that column. The SQL driver |
| 13 | + * refused it (`INVALID_FILTER`, no such column), the probe's #8895 catch |
| 14 | + * propagated the refusal, and the organization delete answered 500. |
| 15 | + * |
| 16 | + * What this file pins, all through `engine.delete` on a two-driver engine (the |
| 17 | + * default one, and the remote a federated object is bound to by `datasource`): |
| 18 | + * |
| 19 | + * 1. the scan never reads a federated object on its injected anchor, so an |
| 20 | + * organization delete lands while that read would be refused. A local |
| 21 | + * object's injected anchor IS read on the same delete, which proves the |
| 22 | + * scan ran; |
| 23 | + * 2. an `organization_id` the AUTHOR declared on a federated object is still |
| 24 | + * probed, and a probe failure still propagates (#8895); |
| 25 | + * 3. any other lookup the author declares on a federated object is still |
| 26 | + * probed, and a probe failure still propagates (#8895); |
| 27 | + * 4. the cascade's atomicity plan agrees with the scan: an organization delete |
| 28 | + * whose only cross-datasource "participant" was the injected anchor runs |
| 29 | + * as one transaction, while an author-declared federated lookup still |
| 30 | + * makes the plan cross-datasource. |
| 31 | + * |
| 32 | + * The seed rows are written straight into the stub's store, so no write path |
| 33 | + * other than the delete under test runs. The door pin is |
| 34 | + * `packages/qa/dogfood/test/organization-delete-federated-fixture.dogfood.test.ts`. |
| 35 | + */ |
| 36 | + |
| 37 | +import { describe, it, expect } from 'vitest'; |
| 38 | +import { resolveInjectedColumnProvenance } from '@objectstack/spec/data'; |
| 39 | +import { ObjectQL } from './engine.js'; |
| 40 | + |
| 41 | +/** The remote datasource every federated fixture below is bound to. */ |
| 42 | +const REMOTE = 'remote_ds'; |
| 43 | +const PACKAGE_ID = 'test-21910'; |
| 44 | + |
| 45 | +type Row = Record<string, unknown>; |
| 46 | + |
| 47 | +/** |
| 48 | + * A stub driver that records every read into a shared log and can be told to |
| 49 | + * refuse reads of one object with an exact error object. Its `find` applies |
| 50 | + * the caller's `limit` after the filter, by presence. |
| 51 | + */ |
| 52 | +function makeDriver(name: string, log: { reads: string[]; begun: number }) { |
| 53 | + const tables: Record<string, Row[]> = {}; |
| 54 | + const failReads = new Map<string, unknown>(); |
| 55 | + const rowsOf = (o: string): Row[] => (tables[o] ??= []); |
| 56 | + const matches = (row: Row, where: any): boolean => { |
| 57 | + if (!where || typeof where !== 'object') return true; |
| 58 | + for (const [k, v] of Object.entries(where)) { |
| 59 | + if (k.startsWith('$')) continue; |
| 60 | + const exp = v && typeof v === 'object' && '$eq' in (v as any) ? (v as any).$eq : v; |
| 61 | + if ((row[k] ?? null) !== (exp ?? null)) return false; |
| 62 | + } |
| 63 | + return true; |
| 64 | + }; |
| 65 | + const driver: any = { |
| 66 | + name, version: '0.0.0', supports: {}, |
| 67 | + async connect() {}, async disconnect() {}, async checkHealth() { return true; }, async execute() { return null; }, |
| 68 | + async syncSchema() {}, |
| 69 | + registerExternalObject() {}, |
| 70 | + async find(o: string, ast: any) { |
| 71 | + log.reads.push(o); |
| 72 | + const failure = failReads.get(o); |
| 73 | + if (failure !== undefined) throw failure; |
| 74 | + const hit = (tables[o] ?? []).filter((r) => matches(r, ast?.where)); |
| 75 | + return typeof ast?.limit === 'number' ? hit.slice(0, ast.limit) : hit; |
| 76 | + }, |
| 77 | + async findOne(o: string, ast: any) { |
| 78 | + const [first] = await this.find(o, { ...ast, limit: 1 }); |
| 79 | + return first ?? null; |
| 80 | + }, |
| 81 | + async count(o: string, ast: any) { |
| 82 | + return (await this.find(o, { where: ast?.where })).length; |
| 83 | + }, |
| 84 | + async create(o: string, data: Row) { |
| 85 | + const row = { ...data, id: String(data.id) }; |
| 86 | + rowsOf(o).push(row); |
| 87 | + return row; |
| 88 | + }, |
| 89 | + async update(o: string, id: string, data: Row) { |
| 90 | + const rows = rowsOf(o); |
| 91 | + const at = rows.findIndex((r) => r.id === String(id)); |
| 92 | + if (at < 0) throw new Error(`not found ${o}/${id}`); |
| 93 | + rows[at] = { ...rows[at], ...data, id: String(id) }; |
| 94 | + return rows[at]; |
| 95 | + }, |
| 96 | + async upsert(o: string, data: Row) { return this.create(o, data); }, |
| 97 | + async delete(o: string, id: string) { |
| 98 | + const rows = rowsOf(o); |
| 99 | + const at = rows.findIndex((r) => r.id === String(id)); |
| 100 | + if (at < 0) return false; |
| 101 | + rows.splice(at, 1); |
| 102 | + return true; |
| 103 | + }, |
| 104 | + async bulkCreate() { return []; }, async bulkUpdate() { return []; }, async bulkDelete() {}, |
| 105 | + async beginTransaction() { log.begun += 1; return { id: `trx_${log.begun}` }; }, |
| 106 | + async commit() {}, async rollback() {}, |
| 107 | + }; |
| 108 | + return { |
| 109 | + driver, |
| 110 | + failReads, |
| 111 | + has: (o: string, id: string) => rowsOf(o).some((r) => r.id === id), |
| 112 | + seed: (o: string, row: Row) => void rowsOf(o).push(row), |
| 113 | + }; |
| 114 | +} |
| 115 | + |
| 116 | +/** The deleted object. Its own injected anchor makes it self-referencing, harmlessly. */ |
| 117 | +const ORGANIZATION = { |
| 118 | + name: 'sys_organization', |
| 119 | + label: 'Organization', |
| 120 | + fields: { name: { name: 'name', label: 'Name', type: 'text' as const } }, |
| 121 | +}; |
| 122 | + |
| 123 | +/** A LOCAL object: the registry injects `organization_id`, and storage backs it. */ |
| 124 | +const LOCAL = { |
| 125 | + name: 'acct', |
| 126 | + label: 'Account', |
| 127 | + fields: { name: { name: 'name', label: 'Name', type: 'text' as const } }, |
| 128 | +}; |
| 129 | + |
| 130 | +/** Federated, as the showcase declares it: no `organization_id` of its own. */ |
| 131 | +const FEDERATED = { |
| 132 | + name: 'ext_customer', |
| 133 | + label: 'External Customer', |
| 134 | + datasource: REMOTE, |
| 135 | + external: { remoteName: 'customers' }, |
| 136 | + fields: { name: { name: 'name', label: 'Name', type: 'text' as const } }, |
| 137 | +}; |
| 138 | + |
| 139 | +/** Federated, with an `organization_id` the AUTHOR declared: it maps a real remote column. */ |
| 140 | +const FEDERATED_DECLARED_ANCHOR = { |
| 141 | + name: 'ext_tenant_customer', |
| 142 | + label: 'External Tenant Customer', |
| 143 | + datasource: REMOTE, |
| 144 | + external: { remoteName: 'tenant_customers' }, |
| 145 | + fields: { |
| 146 | + name: { name: 'name', label: 'Name', type: 'text' as const }, |
| 147 | + organization_id: { |
| 148 | + name: 'organization_id', |
| 149 | + label: 'Remote Organization', |
| 150 | + type: 'lookup' as const, |
| 151 | + reference: 'sys_organization', |
| 152 | + }, |
| 153 | + }, |
| 154 | +}; |
| 155 | + |
| 156 | +/** Federated, with another lookup the author declared against the organization. */ |
| 157 | +const FEDERATED_AUTHOR_LOOKUP = { |
| 158 | + name: 'ext_order', |
| 159 | + label: 'External Order', |
| 160 | + datasource: REMOTE, |
| 161 | + external: { remoteName: 'orders' }, |
| 162 | + fields: { |
| 163 | + amount: { name: 'amount', label: 'Amount', type: 'number' as const }, |
| 164 | + org_ref: { name: 'org_ref', label: 'Organization', type: 'lookup' as const, reference: 'sys_organization' }, |
| 165 | + }, |
| 166 | +}; |
| 167 | + |
| 168 | +const ORG_ID = 'org_21910'; |
| 169 | + |
| 170 | +/** The refusal the SQL driver answers for a filter on a column the remote does not have. */ |
| 171 | +function unknownColumnRefusal(object: string, column: string) { |
| 172 | + return Object.assign( |
| 173 | + new Error(`A filter on object '${object}' names a column the database could not resolve (${column}).`), |
| 174 | + { code: 'INVALID_FILTER', status: 400 }, |
| 175 | + ); |
| 176 | +} |
| 177 | + |
| 178 | +async function makeEngine(objects: any[]) { |
| 179 | + const log = { reads: [] as string[], begun: 0 }; |
| 180 | + const warnings: string[] = []; |
| 181 | + const logger = { |
| 182 | + debug() {}, info() {}, error() {}, |
| 183 | + warn: (message: unknown) => void warnings.push(String(message)), |
| 184 | + }; |
| 185 | + const engine = new ObjectQL({ logger } as any); |
| 186 | + const local = makeDriver('memory', log); |
| 187 | + const remote = makeDriver(REMOTE, log); |
| 188 | + engine.registerDriver(local.driver, true); |
| 189 | + engine.registerDriver(remote.driver); |
| 190 | + await engine.init(); |
| 191 | + for (const o of objects) engine.registry.registerObject(o, PACKAGE_ID); |
| 192 | + local.seed('sys_organization', { id: ORG_ID, name: 'Doomed Org' }); |
| 193 | + return { engine, local, remote, log, warnings }; |
| 194 | +} |
| 195 | + |
| 196 | +const NOT_ATOMIC = 'cannot run as one unit of work'; |
| 197 | + |
| 198 | +describe('[#21910] the cascade scan skips a federated object\'s injected tenant anchor, and nothing else', () => { |
| 199 | + it('never probes a federated object on its injected organization_id, so the organization delete lands', async () => { |
| 200 | + const { engine, local, remote, log } = await makeEngine([ORGANIZATION, LOCAL, FEDERATED]); |
| 201 | + // PREMISE: the registered schema carries the platform's injected anchor. |
| 202 | + expect(resolveInjectedColumnProvenance(engine.getSchema('ext_customer'), 'organization_id')) |
| 203 | + .toBe('injected-unprovisioned'); |
| 204 | + // Any read of the remote table on that column is refused, as the showcase measured. |
| 205 | + remote.failReads.set('ext_customer', unknownColumnRefusal('ext_customer', 'organization_id')); |
| 206 | + |
| 207 | + log.reads.length = 0; |
| 208 | + await engine.delete('sys_organization', { where: { id: ORG_ID } } as any); |
| 209 | + |
| 210 | + expect(local.has('sys_organization', ORG_ID)).toBe(false); |
| 211 | + expect(log.reads).not.toContain('ext_customer'); |
| 212 | + // CONTROL: the scan ran for this delete, and probed the local object's injected anchor. |
| 213 | + expect(log.reads).toContain('acct'); |
| 214 | + }); |
| 215 | + |
| 216 | + it('still probes an organization_id the AUTHOR declared on a federated object, and its failure propagates (#8895)', async () => { |
| 217 | + const { engine, local, remote, log } = await makeEngine([ORGANIZATION, FEDERATED_DECLARED_ANCHOR]); |
| 218 | + expect(resolveInjectedColumnProvenance(engine.getSchema('ext_tenant_customer'), 'organization_id')) |
| 219 | + .toBe('author'); |
| 220 | + const injected = unknownColumnRefusal('ext_tenant_customer', 'organization_id'); |
| 221 | + remote.failReads.set('ext_tenant_customer', injected); |
| 222 | + |
| 223 | + log.reads.length = 0; |
| 224 | + const err: any = await engine.delete('sys_organization', { where: { id: ORG_ID } } as any).catch((e) => e); |
| 225 | + |
| 226 | + expect(err).toBe(injected); |
| 227 | + expect(err.code).toBe('INVALID_FILTER'); |
| 228 | + expect(err.status).toBe(400); |
| 229 | + expect(log.reads).toContain('ext_tenant_customer'); |
| 230 | + expect(local.has('sys_organization', ORG_ID)).toBe(true); |
| 231 | + }); |
| 232 | + |
| 233 | + it('still probes any other lookup the author declared on a federated object, and its failure propagates (#8895)', async () => { |
| 234 | + const { engine, local, remote, log } = await makeEngine([ORGANIZATION, FEDERATED_AUTHOR_LOOKUP]); |
| 235 | + const injected = unknownColumnRefusal('ext_order', 'org_ref'); |
| 236 | + remote.failReads.set('ext_order', injected); |
| 237 | + |
| 238 | + log.reads.length = 0; |
| 239 | + const err: any = await engine.delete('sys_organization', { where: { id: ORG_ID } } as any).catch((e) => e); |
| 240 | + |
| 241 | + expect(err).toBe(injected); |
| 242 | + expect(err.code).toBe('INVALID_FILTER'); |
| 243 | + expect(err.status).toBe(400); |
| 244 | + expect(log.reads).toContain('ext_order'); |
| 245 | + expect(local.has('sys_organization', ORG_ID)).toBe(true); |
| 246 | + }); |
| 247 | +}); |
| 248 | + |
| 249 | +describe('[#21910] the cascade atomicity plan agrees with the scan about who takes part', () => { |
| 250 | + it('runs the organization delete as one transaction when the injected anchor was its only cross-datasource reference', async () => { |
| 251 | + const { engine, local, log, warnings } = await makeEngine([ORGANIZATION, LOCAL, FEDERATED]); |
| 252 | + |
| 253 | + await engine.delete('sys_organization', { where: { id: ORG_ID } } as any); |
| 254 | + |
| 255 | + expect(local.has('sys_organization', ORG_ID)).toBe(false); |
| 256 | + expect(log.begun).toBe(1); |
| 257 | + expect(warnings.filter((w) => w.includes(NOT_ATOMIC))).toEqual([]); |
| 258 | + }); |
| 259 | + |
| 260 | + it('CONTROL: an author-declared lookup on a federated object still makes the plan cross-datasource', async () => { |
| 261 | + const { engine, local, log, warnings } = await makeEngine([ORGANIZATION, LOCAL, FEDERATED_AUTHOR_LOOKUP]); |
| 262 | + |
| 263 | + await engine.delete('sys_organization', { where: { id: ORG_ID } } as any); |
| 264 | + |
| 265 | + expect(local.has('sys_organization', ORG_ID)).toBe(false); |
| 266 | + expect(log.reads).toContain('ext_order'); |
| 267 | + expect(log.begun).toBe(0); |
| 268 | + expect(warnings.filter((w) => w.includes(NOT_ATOMIC))).toHaveLength(1); |
| 269 | + }); |
| 270 | +}); |
0 commit comments