ClintchizandClaude Opus 5
205f4e2d4c
C1/C2: grant() wrapped its delete+insert in db.tx on a shared,
unserialized sqlite connection, so a concurrent bare write from another
method (e.g. revokeRole) got swept into the open transaction and
discarded on rollback - a revoke could report success while the
privilege survived. Also broke concurrent grants on distinct keys
("cannot start a transaction within a transaction"). Replaced with
single-statement upserts (ON CONFLICT / ON DUPLICATE KEY UPDATE),
atomic without a transaction.
I1: assignRole's check-then-act SELECT lost 19/20 concurrent identical
calls to a UNIQUE violation; switched to ON CONFLICT DO NOTHING.
I2: an unrecognised `effect` value was dropped from both the grant and
deny buckets on read. Added a CHECK constraint and made anything not
literally "allow" count as a deny (fail closed).
I3: ensureAuthzTables defaulted to sqlite instead of the Db's own
dialect. I4: scopeKey now refuses an explicitly empty tenantId rather
than treating it as global (shared with the memory adapter). I5: added
migrations.test.ts asserting the generated DDL per dialect, including
MySQL's binary collation on identity columns. M1: DDL is now a
statement list instead of a blob split on a formatting-dependent
separator. M3: declared @wrnexus/db as a workspace dependency.
Extends the conformance suite with four concurrency/empty-scope tests
(23 total, up from 19) that all three adapters now pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
76 lines
3.2 KiB
TypeScript
76 lines
3.2 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import { authzMigrationSql } from "../src/migrations.ts";
|
|
|
|
/**
|
|
* The postgres/mysql DDL is generated but never exercised against a real
|
|
* server in this repo, so it has to be asserted statically: the id column
|
|
* type, the `effect` CHECK constraint (an unrecognised value must not vanish
|
|
* from both the grant and deny buckets), the MySQL binary collation (so
|
|
* tenant "T1" cannot match "t1" and role "admin" cannot collapse with
|
|
* "Admin"), and both UNIQUE constraints, per dialect.
|
|
*/
|
|
describe("authzMigrationSql", () => {
|
|
test("sqlite: autoincrement id, no collation, both constraints", () => {
|
|
const { up, down } = authzMigrationSql("sqlite");
|
|
expect(up).toHaveLength(2);
|
|
const [assignment, grant] = up;
|
|
|
|
expect(assignment).toContain("id INTEGER PRIMARY KEY AUTOINCREMENT");
|
|
expect(assignment).toContain(
|
|
"CONSTRAINT _wrn_authz_assignment_unique UNIQUE (subject_id, scope, role)",
|
|
);
|
|
expect(assignment).not.toContain("COLLATE");
|
|
|
|
expect(grant).toContain("id INTEGER PRIMARY KEY AUTOINCREMENT");
|
|
expect(grant).toContain("effect VARCHAR(16) NOT NULL CHECK (effect IN ('allow', 'deny'))");
|
|
expect(grant).toContain(
|
|
"CONSTRAINT _wrn_authz_grant_unique UNIQUE (subject_id, scope, permission)",
|
|
);
|
|
expect(grant).not.toContain("COLLATE");
|
|
|
|
expect(down).toEqual([
|
|
"DROP TABLE IF EXISTS _wrn_authz_grant",
|
|
"DROP TABLE IF EXISTS _wrn_authz_assignment",
|
|
]);
|
|
});
|
|
|
|
test("postgres: SERIAL id, no collation, both constraints", () => {
|
|
const { up } = authzMigrationSql("postgres");
|
|
const [assignment, grant] = up;
|
|
|
|
expect(assignment).toContain("id SERIAL PRIMARY KEY");
|
|
expect(assignment).toContain(
|
|
"CONSTRAINT _wrn_authz_assignment_unique UNIQUE (subject_id, scope, role)",
|
|
);
|
|
expect(assignment).not.toContain("COLLATE");
|
|
|
|
expect(grant).toContain("id SERIAL PRIMARY KEY");
|
|
expect(grant).toContain("effect VARCHAR(16) NOT NULL CHECK (effect IN ('allow', 'deny'))");
|
|
expect(grant).toContain(
|
|
"CONSTRAINT _wrn_authz_grant_unique UNIQUE (subject_id, scope, permission)",
|
|
);
|
|
expect(grant).not.toContain("COLLATE");
|
|
});
|
|
|
|
test("mysql: AUTO_INCREMENT id, binary collation on identity columns, both constraints", () => {
|
|
const { up } = authzMigrationSql("mysql");
|
|
const [assignment, grant] = up;
|
|
|
|
expect(assignment).toContain("id INT AUTO_INCREMENT PRIMARY KEY");
|
|
expect(assignment).toContain("subject_id VARCHAR(255) COLLATE utf8mb4_bin NOT NULL");
|
|
expect(assignment).toContain("scope VARCHAR(255) COLLATE utf8mb4_bin NOT NULL DEFAULT ''");
|
|
expect(assignment).toContain("role VARCHAR(255) COLLATE utf8mb4_bin NOT NULL");
|
|
expect(assignment).toContain(
|
|
"CONSTRAINT _wrn_authz_assignment_unique UNIQUE (subject_id, scope, role)",
|
|
);
|
|
|
|
expect(grant).toContain("id INT AUTO_INCREMENT PRIMARY KEY");
|
|
expect(grant).toContain("subject_id VARCHAR(255) COLLATE utf8mb4_bin NOT NULL");
|
|
expect(grant).toContain("permission VARCHAR(255) COLLATE utf8mb4_bin NOT NULL");
|
|
expect(grant).toContain("effect VARCHAR(16) NOT NULL CHECK (effect IN ('allow', 'deny'))");
|
|
expect(grant).toContain(
|
|
"CONSTRAINT _wrn_authz_grant_unique UNIQUE (subject_id, scope, permission)",
|
|
);
|
|
});
|
|
});
|