|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * `composeStacks` step 3 (the `concat` pass) refuses a stack whose value for a |
| 5 | + * concatenated collection key is not an array (#19784 — ruling C, the |
| 6 | + * follow-up the #18239 ruling routed here). |
| 7 | + * |
| 8 | + * ## What was wrong |
| 9 | + * |
| 10 | + * Step 3 kept only the array values it found for each `concat` key and |
| 11 | + * announced the rest with a one-time `console.warn`. So a stack reaching |
| 12 | + * composition with `permissions: { … }` or `data: 42` (a hand-built stack |
| 13 | + * object, or `defineStack(config, { strict: false })`) composed "successfully" |
| 14 | + * into an artifact that simply lacked that stack's grants or seed rows — and |
| 15 | + * the same for every other concatenated key. Under `manifest: 'preserve'` the |
| 16 | + * dropped value survived only inside that stack's package body, so the |
| 17 | + * artifact's top level and its package list disagreed. |
| 18 | + * |
| 19 | + * ## What is pinned |
| 20 | + * |
| 21 | + * The ruling: 「A composed artifact is complete or it is refused」. Every key the |
| 22 | + * composer concatenates (derived from `COMPOSE_KEY_DISPOSITIONS`, never |
| 23 | + * transcribed — a key added to the table is covered the day it lands) refuses a |
| 24 | + * non-array value with step 2's envelope for the same defect on `objects`: |
| 25 | + * `STACK_SCHEMA_INVALID`, `status: 422`, one zod issue rooted at the key. |
| 26 | + * |
| 27 | + * Every refusal has its CONTROL: the same composition with the key authored as |
| 28 | + * an array is accepted with both stacks' content, so no refusal can satisfy |
| 29 | + * the assertions for the wrong reason. |
| 30 | + */ |
| 31 | +import { describe, it, expect, vi, afterEach } from 'vitest'; |
| 32 | +import { composeStacks, defineStack, COMPOSE_KEY_DISPOSITIONS, type ObjectStackDefinition } from './stack.zod'; |
| 33 | + |
| 34 | +type Envelope = Error & { |
| 35 | + code?: string; |
| 36 | + status?: number; |
| 37 | + issues?: ReadonlyArray<{ code?: string; path?: readonly PropertyKey[]; expected?: string }>; |
| 38 | +}; |
| 39 | + |
| 40 | +/** The thrown value, or `null` when the composition is accepted. */ |
| 41 | +function refusal(fn: () => unknown): Envelope | null { |
| 42 | + try { |
| 43 | + fn(); |
| 44 | + return null; |
| 45 | + } catch (e) { |
| 46 | + return e as Envelope; |
| 47 | + } |
| 48 | +} |
| 49 | + |
| 50 | +const mf = (id: string) => ({ id, name: id.split('.').pop()!, version: '1.0.0', type: 'app' as const }); |
| 51 | + |
| 52 | +/** A stack object nobody parsed. */ |
| 53 | +const handBuilt = (overrides: Record<string, unknown>) => overrides as unknown as ObjectStackDefinition; |
| 54 | + |
| 55 | +/** A stack through `defineStack`'s `strict: false` door, which skips the parse. */ |
| 56 | +const unparsed = (overrides: Record<string, unknown>) => defineStack(overrides as never, { strict: false }); |
| 57 | + |
| 58 | +const CONCAT_KEYS = Object.entries(COMPOSE_KEY_DISPOSITIONS) |
| 59 | + .filter(([, rule]) => rule === 'concat') |
| 60 | + .map(([key]) => key); |
| 61 | + |
| 62 | +const B1 = "'com.example.b' (stack #1)"; |
| 63 | + |
| 64 | +afterEach(() => { |
| 65 | + vi.restoreAllMocks(); |
| 66 | +}); |
| 67 | + |
| 68 | +describe('#19784 — composeStacks refuses a non-array concatenated collection', () => { |
| 69 | + it('covers every concat key the composer declares (the table is the census, not a transcription)', () => { |
| 70 | + expect(CONCAT_KEYS).toContain('permissions'); |
| 71 | + expect(CONCAT_KEYS).toContain('data'); |
| 72 | + expect(CONCAT_KEYS.length).toBeGreaterThanOrEqual(30); |
| 73 | + }); |
| 74 | + |
| 75 | + for (const key of CONCAT_KEYS) { |
| 76 | + describe(`'${key}'`, () => { |
| 77 | + const a = () => handBuilt({ manifest: mf('com.example.a'), [key]: [{ name: 'a_item' }] }); |
| 78 | + const b = (value: unknown) => handBuilt({ manifest: mf('com.example.b'), [key]: value }); |
| 79 | + |
| 80 | + it('a map-shaped value is refused with STACK_SCHEMA_INVALID / 422 — never skipped', () => { |
| 81 | + const refused = refusal(() => composeStacks([a(), b({ b_item: { name: 'b_item' } })])); |
| 82 | + expect(refused).toBeInstanceOf(Error); |
| 83 | + expect(refused?.code).toBe('STACK_SCHEMA_INVALID'); |
| 84 | + expect(refused?.status).toBe(422); |
| 85 | + expect(refused?.issues).toHaveLength(1); |
| 86 | + expect(refused?.issues?.[0]?.path).toEqual([key]); |
| 87 | + expect(refused?.issues?.[0]?.code).toBe('invalid_type'); |
| 88 | + expect(refused?.issues?.[0]?.expected).toBe('array'); |
| 89 | + expect(refused?.message.startsWith(`composeStacks validation failed: ${B1} declares '${key}'`)).toBe(true); |
| 90 | + }); |
| 91 | + |
| 92 | + it("is refused under `manifest: 'preserve'` too", () => { |
| 93 | + const refused = refusal(() => |
| 94 | + composeStacks([a(), b({ b_item: { name: 'b_item' } })], { manifest: 'preserve' }), |
| 95 | + ); |
| 96 | + expect(refused?.code).toBe('STACK_SCHEMA_INVALID'); |
| 97 | + expect(refused?.status).toBe(422); |
| 98 | + }); |
| 99 | + |
| 100 | + it('the control — the same key authored as an array composes the entries of BOTH stacks', () => { |
| 101 | + const composed = composeStacks([a(), b([{ name: 'b_item' }])]) as Record<string, unknown>; |
| 102 | + expect(composed[key]).toEqual([{ name: 'a_item' }, { name: 'b_item' }]); |
| 103 | + }); |
| 104 | + }); |
| 105 | + } |
| 106 | + |
| 107 | + /** The value shapes, on the two keys the ruling's measurement named. */ |
| 108 | + // A Set rides a hand-built stack only: `defineStack`'s map-form normalizer |
| 109 | + // reads any object through `Object.entries`, so a Set entering through the |
| 110 | + // `strict: false` door arrives here already flattened to `[]` — upstream of |
| 111 | + // composition, and not this pass's finding. |
| 112 | + const shapes: Array<{ label: string; value: () => unknown; door: typeof handBuilt }> = [ |
| 113 | + { label: 'a number, through `strict: false`', value: () => 42, door: unparsed }, |
| 114 | + { label: 'a string, through `strict: false`', value: () => 'not-an-array', door: unparsed }, |
| 115 | + { label: 'null, through `strict: false`', value: () => null, door: unparsed }, |
| 116 | + { label: 'false, through `strict: false`', value: () => false, door: unparsed }, |
| 117 | + { label: 'a Set of entries, on a hand-built stack', value: () => new Set([{ name: 'b_item' }]), door: handBuilt }, |
| 118 | + ]; |
| 119 | + for (const key of ['permissions', 'data']) { |
| 120 | + for (const shape of shapes) { |
| 121 | + it(`'${key}' as ${shape.label} is refused, whichever position it holds`, () => { |
| 122 | + const good = () => handBuilt({ manifest: mf('com.example.a'), [key]: [{ name: 'a_item' }] }); |
| 123 | + const bad = () => shape.door({ manifest: mf('com.example.b'), [key]: shape.value() }); |
| 124 | + for (const run of [() => composeStacks([good(), bad()]), () => composeStacks([bad(), good()])]) { |
| 125 | + const refused = refusal(run); |
| 126 | + expect(refused?.code).toBe('STACK_SCHEMA_INVALID'); |
| 127 | + expect(refused?.status).toBe(422); |
| 128 | + expect(refused?.issues?.[0]?.path).toEqual([key]); |
| 129 | + } |
| 130 | + }); |
| 131 | + } |
| 132 | + } |
| 133 | + |
| 134 | + it('an ABSENT key is not a malformed one — composed from the stacks that declare it, silently', () => { |
| 135 | + const warn = vi.spyOn(console, 'warn').mockImplementation(() => {}); |
| 136 | + const composed = composeStacks([ |
| 137 | + handBuilt({ manifest: mf('com.example.a'), permissions: [{ name: 'a_item' }] }), |
| 138 | + handBuilt({ manifest: mf('com.example.b'), permissions: undefined }), |
| 139 | + ]); |
| 140 | + expect(composed.permissions).toEqual([{ name: 'a_item' }]); |
| 141 | + expect(warn).not.toHaveBeenCalled(); |
| 142 | + }); |
| 143 | + |
| 144 | + it('a non-object ENTRY inside an array is carried as-is — the composed content is unchanged', () => { |
| 145 | + const composed = composeStacks([ |
| 146 | + handBuilt({ manifest: mf('com.example.a'), permissions: [{ name: 'a_item' }] }), |
| 147 | + handBuilt({ manifest: mf('com.example.b'), permissions: [null, { name: 'b_item' }] }), |
| 148 | + ]); |
| 149 | + expect(composed.permissions).toEqual([{ name: 'a_item' }, null, { name: 'b_item' }]); |
| 150 | + }); |
| 151 | + |
| 152 | + it('the strict door raises the SAME code for the same defect — one dialect for one authored mistake', () => { |
| 153 | + const refused = refusal(() => defineStack({ manifest: mf('com.example.b'), permissions: 42 } as never)); |
| 154 | + expect(refused?.code).toBe('STACK_SCHEMA_INVALID'); |
| 155 | + expect(refused?.status).toBe(422); |
| 156 | + }); |
| 157 | +}); |
0 commit comments