|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * [#21597] `loadGovernance`'s tenant scan asks the REGISTRY whether |
| 5 | + * `sys_organization` is registered before it reads it. |
| 6 | + * |
| 7 | + * Since commit eb9ef791bd an in-process engine verb refuses an object name the |
| 8 | + * registry does not resolve, with `OBJECT_NOT_FOUND` (404), before any driver |
| 9 | + * is asked. A composition that registers no `sys_organization` therefore no |
| 10 | + * longer reaches a driver with the tenant scan's read: it gets the engine's |
| 11 | + * refusal. That is not a missing table, so the scan's catch rethrew it, and |
| 12 | + * every sweep aborted before applying a single policy. |
| 13 | + * |
| 14 | + * Unregistered is the single-tenant answer. With no organization object there |
| 15 | + * is no tenant to hold an override, and that is the same answer |
| 16 | + * `ObjectQL.probeInstallOrganizations` gives to the same question. What does |
| 17 | + * NOT change is the catch: a missing table on a REGISTERED `sys_organization` |
| 18 | + * is still the one benign driver cause, and every other failure still aborts |
| 19 | + * the sweep (#12853). In particular an `OBJECT_NOT_FOUND` is not read as |
| 20 | + * absence wholesale: the registry already said the object is registered, so a |
| 21 | + * refusal arriving from the read is about something else. |
| 22 | + * |
| 23 | + * Every case runs on a REAL `ObjectQL` engine over a stub driver, so the |
| 24 | + * refusal the guard avoids is the engine's own and not a double's guess at it. |
| 25 | + * `engine.find` is spied with call-through: the spy records what the sweep |
| 26 | + * asked the engine, and the engine still answers. |
| 27 | + */ |
| 28 | + |
| 29 | +import { describe, it, expect, vi } from 'vitest'; |
| 30 | +import { ObjectQL } from '../engine.js'; |
| 31 | +import { LifecycleService } from './lifecycle-service.js'; |
| 32 | +import { parseLifecycleDuration } from './duration.js'; |
| 33 | + |
| 34 | +const FIXED_NOW = 1_700_000_000_000; |
| 35 | +const PACKAGE_ID = 'lifecycle-organization-registry'; |
| 36 | + |
| 37 | +/** The lifecycle-declared object every sweep below reaps. */ |
| 38 | +const TELEMETRY_OBJ = { |
| 39 | + name: 'sys_job_run', |
| 40 | + fields: { status: { type: 'text' } }, |
| 41 | + lifecycle: { class: 'telemetry', retention: { maxAge: '30d' } }, |
| 42 | +} as any; |
| 43 | + |
| 44 | +const ORG_OBJECT = { name: 'sys_organization', fields: { name: { type: 'text' } } } as any; |
| 45 | + |
| 46 | +const isoCutoff = (literal: string) => new Date(FIXED_NOW - parseLifecycleDuration(literal)).toISOString(); |
| 47 | + |
| 48 | +/** The regulated tenant keeps its rows three times longer than the global window. */ |
| 49 | +const TENANT_OVERRIDES = { org_reg: { retention_overrides: { sys_job_run: { maxAge: '90d' } } } }; |
| 50 | + |
| 51 | +/** Settings service whose only values are tenant-scoped ones. */ |
| 52 | +function fakeSettings(tenantValues: Record<string, Record<string, unknown>>) { |
| 53 | + return { |
| 54 | + async get(_ns: string, key: string, ctx?: Record<string, unknown>) { |
| 55 | + const tenantId = ctx?.tenantId as string | undefined; |
| 56 | + if (tenantId && tenantValues[tenantId] && key in tenantValues[tenantId]) { |
| 57 | + return { value: tenantValues[tenantId][key], source: 'tenant' }; |
| 58 | + } |
| 59 | + return { value: undefined, source: 'default' }; |
| 60 | + }, |
| 61 | + }; |
| 62 | +} |
| 63 | + |
| 64 | +/** A transient database outage, the shape `isMissingTableError` answers `false` for. */ |
| 65 | +const outage = () => |
| 66 | + Object.assign(new Error('connect ECONNREFUSED 127.0.0.1:5432'), { code: 'ECONNREFUSED' }); |
| 67 | + |
| 68 | +/** The benign unprovisioned table, in the SQLite-family spelling. */ |
| 69 | +const missingTable = () => new Error('no such table: sys_organization'); |
| 70 | + |
| 71 | +const abortedError = (message: string) => |
| 72 | + `governance snapshot could not be loaded (${message}) — sweep aborted before any policy ` + |
| 73 | + 'was applied, so no rows were reaped for this object'; |
| 74 | + |
| 75 | +/** |
| 76 | + * A real engine with `sys_job_run` registered, and `sys_organization` |
| 77 | + * registered only when asked. The stub driver answers the organization read |
| 78 | + * with `organizationRead` and every candidate page with no rows. |
| 79 | + */ |
| 80 | +async function lifecycleEngine(opts: { |
| 81 | + registerOrganization: boolean; |
| 82 | + organizationRead?: () => Array<Record<string, unknown>>; |
| 83 | +}) { |
| 84 | + const driverReads: string[] = []; |
| 85 | + const driverDeletes: string[] = []; |
| 86 | + const organizationRead = opts.organizationRead ?? (() => [{ id: 'org_reg' }]); |
| 87 | + const driver = { |
| 88 | + name: 'memory', |
| 89 | + version: '0.0.0', |
| 90 | + supports: {}, |
| 91 | + async connect() {}, async disconnect() {}, async checkHealth() { return true; }, |
| 92 | + async execute() { return null; }, |
| 93 | + async find(object: string) { |
| 94 | + driverReads.push(object); |
| 95 | + return object === 'sys_organization' ? organizationRead() : []; |
| 96 | + }, |
| 97 | + async findOne() { return null; }, |
| 98 | + async count() { return 0; }, |
| 99 | + async create(_object: string, data: any) { return { id: 'r_1', ...data }; }, |
| 100 | + async update(_object: string, id: string, data: any) { return { id, ...data }; }, |
| 101 | + async delete(object: string) { driverDeletes.push(object); return true; }, |
| 102 | + async bulkCreate(_object: string, rows: any[]) { return rows; }, |
| 103 | + async bulkUpdate() { return []; }, |
| 104 | + async bulkDelete(object: string) { driverDeletes.push(object); }, |
| 105 | + async syncSchema() {}, |
| 106 | + } as any; |
| 107 | + |
| 108 | + const engine = new ObjectQL(); |
| 109 | + engine.registerDriver(driver, true); |
| 110 | + await engine.init(); |
| 111 | + engine.registry.registerObject(TELEMETRY_OBJ, PACKAGE_ID); |
| 112 | + if (opts.registerOrganization) engine.registry.registerObject(ORG_OBJECT, PACKAGE_ID); |
| 113 | + |
| 114 | + const find = vi.spyOn(engine, 'find'); |
| 115 | + const callsOn = (object: string) => |
| 116 | + find.mock.calls.map((call, i) => ({ call, i })).filter(({ call }) => call[0] === object); |
| 117 | + |
| 118 | + return { |
| 119 | + engine, |
| 120 | + driverReads, |
| 121 | + driverDeletes, |
| 122 | + /** The `where` of every candidate read the reaper issued through the engine. */ |
| 123 | + reapReads: () => callsOn('sys_job_run').map(({ call }) => (call[1] as any)?.where), |
| 124 | + /** How many times the tenant scan asked the engine for `sys_organization`. */ |
| 125 | + orgReads: () => callsOn('sys_organization').length, |
| 126 | + /** What the engine rejected the tenant scan's read with. */ |
| 127 | + orgReadRejection: async () => { |
| 128 | + const [first] = callsOn('sys_organization'); |
| 129 | + return (find.mock.results[first.i].value as Promise<unknown>).then( |
| 130 | + () => { throw new Error('the tenant scan read resolved; expected a rejection'); }, |
| 131 | + (error: unknown) => error as Error & { code?: unknown; status?: unknown; object?: unknown }, |
| 132 | + ); |
| 133 | + }, |
| 134 | + }; |
| 135 | +} |
| 136 | + |
| 137 | +function sweepOnce(engine: ObjectQL, warn: (msg: string) => void = () => {}) { |
| 138 | + return new LifecycleService({ |
| 139 | + getEngine: () => engine, |
| 140 | + logger: { info: () => {}, warn, debug: () => {} }, |
| 141 | + now: () => FIXED_NOW, |
| 142 | + initialDelayMs: 1, |
| 143 | + sweepIntervalMs: 10, |
| 144 | + getSettings: () => fakeSettings(TENANT_OVERRIDES), |
| 145 | + referenceAudit: { enabled: false }, |
| 146 | + }).sweep(); |
| 147 | +} |
| 148 | + |
| 149 | +describe('LifecycleService.sweep — the tenant scan asks the registry first (#21597)', () => { |
| 150 | + // ── POSITIVE CONTROL ────────────────────────────────────────────────────── |
| 151 | + |
| 152 | + it('control: a REGISTERED, provisioned sys_organization is read, and its tenant gets its own window', async () => { |
| 153 | + const box = await lifecycleEngine({ registerOrganization: true }); |
| 154 | + |
| 155 | + const report = await sweepOnce(box.engine); |
| 156 | + |
| 157 | + // The guard does not skip the scan for a registered object: the read |
| 158 | + // reached the driver, and the tenant pass ran before the global one. |
| 159 | + expect(box.orgReads()).toBe(1); |
| 160 | + expect(box.driverReads.filter((o) => o === 'sys_organization')).toHaveLength(1); |
| 161 | + expect(box.reapReads()).toEqual([ |
| 162 | + { created_at: { $lt: isoCutoff('90d') }, organization_id: 'org_reg' }, |
| 163 | + { |
| 164 | + created_at: { $lt: isoCutoff('30d') }, |
| 165 | + $or: [{ organization_id: { $nin: ['org_reg'] } }, { organization_id: null }], |
| 166 | + }, |
| 167 | + ]); |
| 168 | + expect(report.errors).toEqual([]); |
| 169 | + }); |
| 170 | + |
| 171 | + // ── THE DEFECT ──────────────────────────────────────────────────────────── |
| 172 | + |
| 173 | + it('premise: with no sys_organization registered, the engine refuses the read itself', async () => { |
| 174 | + const box = await lifecycleEngine({ registerOrganization: false }); |
| 175 | + |
| 176 | + const refusal = await box.engine |
| 177 | + .find('sys_organization', { limit: 1, context: { isSystem: true } } as any) |
| 178 | + .then(() => undefined, (error: unknown) => error as Error & { code?: unknown; status?: unknown; object?: unknown }); |
| 179 | + |
| 180 | + expect(refusal?.code).toBe('OBJECT_NOT_FOUND'); |
| 181 | + expect(refusal?.status).toBe(404); |
| 182 | + expect(refusal?.object).toBe('sys_organization'); |
| 183 | + // Refused before any driver was asked: this is not a missing table. |
| 184 | + expect(box.driverReads).toEqual([]); |
| 185 | + }); |
| 186 | + |
| 187 | + it('an UNREGISTERED sys_organization is the single-tenant answer: the sweep runs on the global window', async () => { |
| 188 | + const warn = vi.fn(); |
| 189 | + const box = await lifecycleEngine({ registerOrganization: false }); |
| 190 | + |
| 191 | + const report = await sweepOnce(box.engine, warn); |
| 192 | + |
| 193 | + // The sweep was not aborted. Asserted first so that a regression shows the |
| 194 | + // abort it reported, not a call count. |
| 195 | + expect(report.errors).toEqual([]); |
| 196 | + // The registry answered, so the scan never read: no engine refusal to |
| 197 | + // abort on, and nothing reached the driver for `sys_organization`. |
| 198 | + expect(box.orgReads()).toBe(0); |
| 199 | + expect(box.driverReads.filter((o) => o === 'sys_organization')).toEqual([]); |
| 200 | + // The sweep RAN: one global pass, no tenant pass. |
| 201 | + expect(box.reapReads()).toEqual([{ created_at: { $lt: isoCutoff('30d') } }]); |
| 202 | + expect(report.swept).toEqual([ |
| 203 | + { object: 'sys_job_run', class: 'telemetry', policy: 'retention', cutoff: isoCutoff('30d'), deleted: 0 }, |
| 204 | + ]); |
| 205 | + expect(warn).not.toHaveBeenCalled(); |
| 206 | + }); |
| 207 | + |
| 208 | + // ── THE BENIGN DRIVER CAUSE IS UNCHANGED ────────────────────────────────── |
| 209 | + |
| 210 | + it('a REGISTERED but unprovisioned sys_organization keeps the missing-table answer', async () => { |
| 211 | + const box = await lifecycleEngine({ |
| 212 | + registerOrganization: true, |
| 213 | + organizationRead: () => { throw missingTable(); }, |
| 214 | + }); |
| 215 | + |
| 216 | + const report = await sweepOnce(box.engine); |
| 217 | + |
| 218 | + // Proof the benign branch was exercised: the scan read, the driver threw. |
| 219 | + expect(box.orgReads()).toBe(1); |
| 220 | + expect(box.driverReads.filter((o) => o === 'sys_organization')).toHaveLength(1); |
| 221 | + expect(box.reapReads()).toEqual([{ created_at: { $lt: isoCutoff('30d') } }]); |
| 222 | + expect(report.errors).toEqual([]); |
| 223 | + expect(report.swept).toHaveLength(1); |
| 224 | + }); |
| 225 | + |
| 226 | + // ── EVERYTHING ELSE STILL ABORTS ────────────────────────────────────────── |
| 227 | + |
| 228 | + it('a real driver fault on a registered sys_organization still aborts the sweep, with the fault itself', async () => { |
| 229 | + const warn = vi.fn(); |
| 230 | + const box = await lifecycleEngine({ |
| 231 | + registerOrganization: true, |
| 232 | + organizationRead: () => { throw outage(); }, |
| 233 | + }); |
| 234 | + |
| 235 | + const report = await sweepOnce(box.engine, warn); |
| 236 | + const fault = await box.orgReadRejection(); |
| 237 | + |
| 238 | + // The read the sweep aborted on rejected with the driver's own fault. |
| 239 | + expect(fault.code).toBe('ECONNREFUSED'); |
| 240 | + expect(fault.message).toContain('ECONNREFUSED'); |
| 241 | + // …and that fault, not a swallowed outcome, is what the sweep reports. |
| 242 | + expect(box.reapReads()).toEqual([]); |
| 243 | + expect(box.driverDeletes).toEqual([]); |
| 244 | + expect(report.swept).toEqual([]); |
| 245 | + expect(report.errors).toEqual([{ object: 'sys_job_run', error: abortedError(fault.message) }]); |
| 246 | + expect(warn).toHaveBeenCalledTimes(1); |
| 247 | + expect(warn.mock.calls[0][0]).toContain(`(${fault.message})`); |
| 248 | + }); |
| 249 | + |
| 250 | + it('an OBJECT_NOT_FOUND attributed to ANOTHER object is not read as absence: the sweep aborts', async () => { |
| 251 | + const box = await lifecycleEngine({ registerOrganization: true }); |
| 252 | + // A hook on the organization read that itself reads an object this |
| 253 | + // composition never registered — the engine refuses THAT read, and the |
| 254 | + // refusal surfaces from the `sys_organization` scan. |
| 255 | + box.engine.registerHook( |
| 256 | + 'beforeFind', |
| 257 | + async () => { |
| 258 | + await box.engine.find('sys_org_unit', { limit: 1, context: { isSystem: true } } as any); |
| 259 | + }, |
| 260 | + { object: 'sys_organization' }, |
| 261 | + ); |
| 262 | + |
| 263 | + const report = await sweepOnce(box.engine); |
| 264 | + const refusal = await box.orgReadRejection(); |
| 265 | + |
| 266 | + expect(refusal.code).toBe('OBJECT_NOT_FOUND'); |
| 267 | + expect(refusal.status).toBe(404); |
| 268 | + expect(refusal.object).toBe('sys_org_unit'); |
| 269 | + expect(box.reapReads()).toEqual([]); |
| 270 | + expect(report.swept).toEqual([]); |
| 271 | + expect(report.errors).toEqual([{ object: 'sys_job_run', error: abortedError(refusal.message) }]); |
| 272 | + }); |
| 273 | +}); |
0 commit comments