Files
gongxue-base/scripts/tenant-foreign-key-audit-test.js
2026-07-12 19:26:57 +08:00

81 lines
3.0 KiB
JavaScript

import assert from 'node:assert/strict';
import fs from 'node:fs';
import {
EXPECTED_TENANT_FOREIGN_KEY_RELATION_COUNT,
EXPECTED_TENANT_FOREIGN_KEY_SCHEMA_SHA256,
buildTenantForeignKeyViolationQuery,
tenantForeignKeyExceptions,
tenantForeignKeySchemaSha256,
} from './lib/tenant-foreign-key-audit.js';
import {
assertTenantForeignKeyAuditTarget,
parseTenantForeignKeyAuditOptions,
} from './tenant-foreign-key-audit.js';
const relation = overrides => ({
childTable: 'child_rows',
constraintName: 'child_rows_parent_id_fkey',
childColumns: ['parent_id'],
parentTable: 'parent_rows',
parentColumns: ['id'],
validated: true,
updateAction: 'a',
deleteAction: 'a',
...overrides,
});
assert.equal(EXPECTED_TENANT_FOREIGN_KEY_RELATION_COUNT, 189);
assert.match(EXPECTED_TENANT_FOREIGN_KEY_SCHEMA_SHA256, /^[0-9a-f]{64}$/);
assert.equal(tenantForeignKeyExceptions().length, 3);
const digestA = tenantForeignKeySchemaSha256([relation({ childTable: 'b' }), relation({ childTable: 'a' })]);
const digestB = tenantForeignKeySchemaSha256([relation({ childTable: 'a' }), relation({ childTable: 'b' })]);
assert.equal(digestA, digestB, 'schema fingerprint must not depend on catalog row ordering');
const defaultQuery = buildTenantForeignKeyViolationQuery([relation({})]);
assert.match(defaultQuery, /child\.tenant_id is distinct from parent\.tenant_id/i);
const globalRuleQuery = buildTenantForeignKeyViolationQuery([
relation({
childTable: 'platform_audit_alerts',
constraintName: 'platform_audit_alerts_rule_id_fkey',
childColumns: ['rule_id'],
parentTable: 'platform_audit_alert_rules',
}),
]);
assert.match(globalRuleQuery, /parent\.tenant_id is not null and child\.tenant_id is distinct from parent\.tenant_id/i);
const platformBankQuery = buildTenantForeignKeyViolationQuery([
relation({
childTable: 'tenant_question_bank_adoptions',
constraintName: 'tenant_question_bank_adoptions_source_question_bank_id_fkey',
childColumns: ['source_question_bank_id'],
parentTable: 'question_banks',
}),
]);
assert.match(platformBankQuery, /parent\.source_scope is distinct from 'platform'/i);
assert.throws(
() => parseTenantForeignKeyAuditOptions([], {}),
/DATABASE_URL is required/,
);
assert.throws(
() => assertTenantForeignKeyAuditTarget('postgresql://postgres:postgres@127.0.0.1:5432/postgres'),
/reserved for tikupro-pg/,
);
assert.throws(
() => assertTenantForeignKeyAuditTarget('postgresql://postgres:postgres@tikupro-pg:55432/postgres'),
/tikupro-pg targets are forbidden/,
);
assert.deepEqual(
assertTenantForeignKeyAuditTarget('postgresql://postgres:secret@127.0.0.1:55432/postgres'),
{ host: '127.0.0.1', port: '55432', database: 'postgres', user: 'postgres' },
);
const readiness = fs.readFileSync('scripts/production-readiness-check.js', 'utf8');
assert.match(readiness, /db\.tenant_foreign_keys\.schema/);
const launchGate = fs.readFileSync('scripts/production-launch-gate.js', 'utf8');
assert.match(launchGate, /db\.tenant-foreign-key-audit/);
console.log('[PASS] tenant foreign key audit contract');