|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach, vi } from 'vitest'; |
| 4 | +import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; |
| 5 | +import { tmpdir } from 'node:os'; |
| 6 | +import { dirname, join, resolve } from 'node:path'; |
| 7 | +import { fileURLToPath } from 'node:url'; |
| 8 | +import Database from 'better-sqlite3'; |
| 9 | +import { resolveAuthSecret } from '@objectstack/core'; |
| 10 | +import { isExitSignal } from '../../utils/format.js'; |
| 11 | +import MigratePlan from './plan.js'; |
| 12 | +import MigrateApply from './apply.js'; |
| 13 | +import MigrateSecurityCatalogOverlays from './security-catalog-overlays.js'; |
| 14 | + |
| 15 | +// [#10126] Pay the first transform of the dist-resolved workspace deps the |
| 16 | +// commands reach through dynamic `import()`s at MODULE LOAD, not inside a case. |
| 17 | +import '@objectstack/runtime'; |
| 18 | +import '@objectstack/objectql'; |
| 19 | +import '@objectstack/plugin-auth'; |
| 20 | +import '@objectstack/plugin-security'; |
| 21 | + |
| 22 | +/** |
| 23 | + * [#22581] `os migrate` reads the `.env*` files `os serve` / `start` / `dev` |
| 24 | + * read, with the process environment keeping its precedence, and says which |
| 25 | + * database it opened and who named it. |
| 26 | + * |
| 27 | + * Measured on `main` before the fix: a project whose `.env` set |
| 28 | + * `OS_DATABASE_URL` served that database and planned |
| 29 | + * `.objectstack/data/objectstack.db`; an `OS_AUTH_SECRET` kept in `.env` left |
| 30 | + * the auth family out of the plan. |
| 31 | + * |
| 32 | + * `--dev` (`os migrate security-catalog-overlays`, which composes as `os serve |
| 33 | + * --dev`) reads the development files, as `serve --dev` does. |
| 34 | + * |
| 35 | + * Driven in-process through each command's own `run()`, from inside the |
| 36 | + * fixture (`chdir`), with `NODE_ENV=production`: `bin/run-dev.js` pins |
| 37 | + * `NODE_ENV=development`, which is a development boot, and a development boot |
| 38 | + * composes the auth family on its fallback secret with or without `.env`. |
| 39 | + * |
| 40 | + * The load writes `.env` values into `process.env`, as it does in a real run; |
| 41 | + * `afterEach` puts every variable a fixture can set back, so no case reads the |
| 42 | + * one before it. |
| 43 | + */ |
| 44 | + |
| 45 | +const HERE = dirname(fileURLToPath(import.meta.url)); |
| 46 | +const CLI_ROOT = resolve(HERE, '..', '..', '..'); |
| 47 | +const CASE_TIMEOUT_MS = 240_000; |
| 48 | +const SECRET = 'os22581-fixture-secret-at-least-32-characters-long'; |
| 49 | + |
| 50 | +/** Every variable that would point a boot elsewhere, or that a fixture's `.env` sets. */ |
| 51 | +const ENV_KEYS = [ |
| 52 | + 'OS_DATABASE_URL', 'DATABASE_URL', 'TURSO_DATABASE_URL', 'OS_DATABASE_DRIVER', 'OS_HOME', |
| 53 | + 'OS_TELEMETRY_DB', 'OS_AUTH_SECRET', 'AUTH_SECRET', 'BETTER_AUTH_SECRET', 'OS_ARTIFACT_PATH', 'NODE_ENV', |
| 54 | +] as const; |
| 55 | + |
| 56 | +type Invoke = (argv: string[]) => Promise<unknown>; |
| 57 | +const invoke = (command: { run: (argv: string[], opts: { root: string }) => Promise<unknown> }): Invoke => |
| 58 | + (argv) => command.run(argv, { root: CLI_ROOT }); |
| 59 | + |
| 60 | +/** Run a command with stdout captured, its exits trapped, and its JSON document parsed. */ |
| 61 | +async function runJson(command: Invoke, argv: string[]): Promise<{ payload: any; exitCode: number }> { |
| 62 | + const savedExit = process.exitCode; |
| 63 | + const swallow = ((_chunk: unknown, ...rest: unknown[]) => { |
| 64 | + const cb = rest.find((a) => typeof a === 'function') as (() => void) | undefined; |
| 65 | + if (cb) cb(); |
| 66 | + return true; |
| 67 | + }) as typeof process.stdout.write; |
| 68 | + const stdout = vi.spyOn(process.stdout, 'write').mockImplementation(swallow); |
| 69 | + vi.spyOn(process.stderr, 'write').mockImplementation(swallow); |
| 70 | + vi.spyOn(console, 'log').mockImplementation(() => {}); |
| 71 | + vi.spyOn(console, 'warn').mockImplementation(() => {}); |
| 72 | + vi.spyOn(console, 'error').mockImplementation(() => {}); |
| 73 | + let processExit: number | undefined; |
| 74 | + vi.spyOn(process, 'exit').mockImplementation(((code?: number) => { |
| 75 | + processExit = code ?? 0; |
| 76 | + throw new Error(`__PROCESS_EXIT__:${processExit}`); |
| 77 | + }) as never); |
| 78 | + let thrownExit: number | undefined; |
| 79 | + try { |
| 80 | + try { |
| 81 | + await command(argv); |
| 82 | + } catch (error) { |
| 83 | + const trapped = error instanceof Error && error.message.startsWith('__PROCESS_EXIT__'); |
| 84 | + if (!trapped && !isExitSignal(error)) throw error; |
| 85 | + if (!trapped) thrownExit = (error as { oclif?: { exit?: number } }).oclif?.exit; |
| 86 | + } |
| 87 | + const out = stdout.mock.calls.map((c) => String(c[0])).join('').trim(); |
| 88 | + let payload: any; |
| 89 | + try { |
| 90 | + payload = JSON.parse(out); |
| 91 | + } catch { |
| 92 | + payload = { unparsed: out.slice(-400) }; |
| 93 | + } |
| 94 | + return { payload, exitCode: processExit ?? thrownExit ?? (process.exitCode as number | undefined) ?? 0 }; |
| 95 | + } finally { |
| 96 | + process.exitCode = savedExit; |
| 97 | + vi.restoreAllMocks(); |
| 98 | + } |
| 99 | +} |
| 100 | + |
| 101 | +const dirs: string[] = []; |
| 102 | +const savedEnv: Record<string, string | undefined> = {}; |
| 103 | +let savedCwd: string; |
| 104 | + |
| 105 | +/** A config-only project with the given `.env` lines. */ |
| 106 | +function project(dotenv: string[], requires: string[] = []): string { |
| 107 | + const dir = mkdtempSync(join(tmpdir(), 'os-22581-env-')); |
| 108 | + dirs.push(dir); |
| 109 | + mkdirSync(join(dir, 'dist'), { recursive: true }); |
| 110 | + writeFileSync( |
| 111 | + join(dir, 'objectstack.config.ts'), |
| 112 | + [ |
| 113 | + 'export default {', |
| 114 | + " manifest: { id: 'com.example.os22581env', name: 'env', version: '0.0.0', type: 'app' },", |
| 115 | + ` requires: ${JSON.stringify(requires)},`, |
| 116 | + " objects: [{ name: 'os22581_env_thing', fields: { title: { type: 'text' } } }],", |
| 117 | + '};', |
| 118 | + '', |
| 119 | + ].join('\n'), |
| 120 | + ); |
| 121 | + writeFileSync(join(dir, '.env'), `${dotenv.join('\n')}\n`); |
| 122 | + return dir; |
| 123 | +} |
| 124 | + |
| 125 | +/** Enter the fixture as the operator's shell would: this environment, that cwd. */ |
| 126 | +function enter(dir: string, exported: Record<string, string> = {}): void { |
| 127 | + process.env.NODE_ENV = 'production'; |
| 128 | + process.env.OS_TELEMETRY_DB = '0'; |
| 129 | + process.env.OS_ARTIFACT_PATH = join(dir, 'dist', 'objectstack.json'); |
| 130 | + Object.assign(process.env, exported); |
| 131 | + process.chdir(dir); |
| 132 | +} |
| 133 | + |
| 134 | +beforeAll(() => { |
| 135 | + savedCwd = process.cwd(); |
| 136 | + for (const key of ENV_KEYS) savedEnv[key] = process.env[key]; |
| 137 | +}); |
| 138 | + |
| 139 | +beforeEach(() => { |
| 140 | + for (const key of ENV_KEYS) delete process.env[key]; |
| 141 | +}); |
| 142 | + |
| 143 | +afterEach(() => { |
| 144 | + process.chdir(savedCwd); |
| 145 | + for (const key of ENV_KEYS) { |
| 146 | + const value = savedEnv[key]; |
| 147 | + if (value === undefined) delete process.env[key]; |
| 148 | + else process.env[key] = value; |
| 149 | + } |
| 150 | +}); |
| 151 | + |
| 152 | +afterAll(() => { |
| 153 | + for (const d of dirs) { |
| 154 | + try { rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } |
| 155 | + } |
| 156 | +}); |
| 157 | + |
| 158 | +describe('os migrate reads the .env files the serving commands read (#22581)', () => { |
| 159 | + it('a .env naming a database: plan and apply report that database, and that .env named it', async () => { |
| 160 | + const dir = project(['OS_DATABASE_URL=file:from-dotenv.db']); |
| 161 | + enter(dir); |
| 162 | + const expectedSource = { kind: 'env-file', variable: 'OS_DATABASE_URL', file: '.env' }; |
| 163 | + |
| 164 | + const plan = await runJson(invoke(MigratePlan), ['--json']); |
| 165 | + expect(plan.exitCode, JSON.stringify(plan.payload).slice(0, 400)).toBe(0); |
| 166 | + expect(plan.payload.database).toBe('from-dotenv.db'); |
| 167 | + expect(plan.payload.databaseSource).toEqual(expectedSource); |
| 168 | + |
| 169 | + // No --yes: apply stops at its confirmation gate, after naming its target. |
| 170 | + const apply = await runJson(invoke(MigrateApply), ['--json']); |
| 171 | + expect(apply.payload.message, JSON.stringify(apply.payload).slice(0, 400)).toBe('confirmation_required'); |
| 172 | + expect(apply.payload.database).toBe('from-dotenv.db'); |
| 173 | + expect(apply.payload.databaseSource).toEqual(expectedSource); |
| 174 | + // …and neither boot opened the default database the serving boot never would. |
| 175 | + expect(existsSync(join(dir, '.objectstack', 'data', 'objectstack.db'))).toBe(false); |
| 176 | + }, CASE_TIMEOUT_MS); |
| 177 | + |
| 178 | + it('an OS_AUTH_SECRET kept in .env keeps the auth family in the plan', async () => { |
| 179 | + const dir = project([`OS_AUTH_SECRET=${SECRET}`], ['auth']); |
| 180 | + enter(dir); |
| 181 | + |
| 182 | + const plan = await runJson(invoke(MigratePlan), ['--json']); |
| 183 | + expect(plan.exitCode, JSON.stringify(plan.payload).slice(0, 400)).toBe(0); |
| 184 | + expect((plan.payload.composition?.notes ?? []).join(' ')).toContain('Composed the auth family'); |
| 185 | + expect((plan.payload.pending ?? []).map((p: any) => p.table)).toContain('sys_account'); |
| 186 | + expect(plan.payload.databaseSource).toEqual({ kind: 'default' }); |
| 187 | + }, CASE_TIMEOUT_MS); |
| 188 | + |
| 189 | + it('control: an exported OS_DATABASE_URL wins over .env, and is named as exported', async () => { |
| 190 | + const dir = project(['OS_DATABASE_URL=file:from-dotenv.db']); |
| 191 | + enter(dir, { OS_DATABASE_URL: 'file:from-shell.db' }); |
| 192 | + |
| 193 | + const plan = await runJson(invoke(MigratePlan), ['--json']); |
| 194 | + expect(plan.exitCode, JSON.stringify(plan.payload).slice(0, 400)).toBe(0); |
| 195 | + expect(plan.payload.database).toBe('from-shell.db'); |
| 196 | + expect(plan.payload.databaseSource).toEqual({ kind: 'process-env', variable: 'OS_DATABASE_URL' }); |
| 197 | + }, CASE_TIMEOUT_MS); |
| 198 | + |
| 199 | + it('apply\'s occupancy gate probes the database .env names, not the default', async () => { |
| 200 | + const dir = project(['OS_DATABASE_URL=file:from-dotenv.db']); |
| 201 | + const file = join(dir, 'from-dotenv.db'); |
| 202 | + const seed = new Database(file); |
| 203 | + seed.pragma('journal_mode = wal'); |
| 204 | + seed.exec('CREATE TABLE t (id INTEGER PRIMARY KEY)'); |
| 205 | + seed.close(); |
| 206 | + // A server between requests: attached, idle — what `os serve` leaves open. |
| 207 | + const held = new Database(file); |
| 208 | + held.prepare('SELECT * FROM t').all(); |
| 209 | + try { |
| 210 | + enter(dir); |
| 211 | + const apply = await runJson(invoke(MigrateApply), ['--json']); |
| 212 | + expect(apply.payload.error, JSON.stringify(apply.payload).slice(0, 400)).toBe('database_busy'); |
| 213 | + expect(apply.payload.database).toBe('from-dotenv.db'); |
| 214 | + expect(apply.exitCode).toBe(1); |
| 215 | + } finally { |
| 216 | + held.close(); |
| 217 | + } |
| 218 | + }, CASE_TIMEOUT_MS); |
| 219 | + |
| 220 | + it('--dev reads the development .env files, as os serve --dev does: a secret only in .env.development is seen', async () => { |
| 221 | + const dir = project([]); |
| 222 | + writeFileSync(join(dir, '.env.development'), [`OS_AUTH_SECRET=${SECRET}`, 'OS_DATABASE_URL=file:from-dev-env.db', ''].join('\n')); |
| 223 | + enter(dir); |
| 224 | + |
| 225 | + const run = await runJson(invoke(MigrateSecurityCatalogOverlays), ['--json', '--dev']); |
| 226 | + expect(run.payload.error, JSON.stringify(run.payload).slice(0, 400)).toBeUndefined(); |
| 227 | + expect(run.payload.database).toBe('from-dev-env.db'); |
| 228 | + // The secret the auth gate reads on this development boot is the file's, |
| 229 | + // not the development fallback it would read with no secret at all. |
| 230 | + expect(resolveAuthSecret({ isDev: true })).toBe(SECRET); |
| 231 | + }, CASE_TIMEOUT_MS); |
| 232 | + |
| 233 | + it('control: without --dev, the development .env files are not read', async () => { |
| 234 | + const dir = project([]); |
| 235 | + writeFileSync(join(dir, '.env.development'), [`OS_AUTH_SECRET=${SECRET}`, 'OS_DATABASE_URL=file:from-dev-env.db', ''].join('\n')); |
| 236 | + enter(dir); |
| 237 | + |
| 238 | + const run = await runJson(invoke(MigrateSecurityCatalogOverlays), ['--json']); |
| 239 | + expect(run.payload.error, JSON.stringify(run.payload).slice(0, 400)).toBeUndefined(); |
| 240 | + expect(run.payload.database).toBe(join(dir, '.objectstack', 'data', 'objectstack.db')); |
| 241 | + expect(process.env.OS_AUTH_SECRET).toBeUndefined(); |
| 242 | + }, CASE_TIMEOUT_MS); |
| 243 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments