`test/vienna-executor.test.mjs`

152 lines
import test from 'node:test';
import assert from 'node:assert/strict';
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';
import {spawnSync,spawn} from 'node:child_process';
import {fileURLToPath} from 'node:url';
import {hash,DOMAIN,key} from '../vienna-executor.mjs';
const root=fileURLToPath(new URL('..',import.meta.url));
const evidence=process.env.VIENNA_EVIDENCE_DIR||os.tmpdir();
const guard=path.join(root,'test/vienna-boundaries.cjs');
const sourceFiles=['apply-fix.mjs','cli-args.mjs','vienna-executor.mjs','vienna-offline-adapter.mjs'].map(f=>path.join(root,f));
const store={domain:DOMAIN,id:'gid://shopify/Shop/900000000001'}; // SYNTHETIC; never a live identity.
function fixture(){
  const dir=fs.mkdtempSync(path.join(evidence,'vienna-fixture-'));
  const bytes=fs.readFileSync(path.join(root,'test/fixtures/vienna-manifest.json'));
  assert.equal(hash(bytes),fs.readFileSync(path.join(root,'test/fixtures/vienna-manifest.sha256'),'utf8').trim());
  const manifest=JSON.parse(bytes),records=manifest.records;
  const f={dir,manifest,path:path.join(dir,'manifest.json'),state:path.join(dir,'state.json'),journal:path.join(dir,'journal.jsonl')};
  fs.writeFileSync(f.path,JSON.stringify(manifest,null,2)+'\n');
  fs.writeFileSync(f.state,JSON.stringify({fixture:true,version:1,store,records:structuredClone(records),calls:[],faults:{}},null,2)+'\n');
  f.sha=hash(fs.readFileSync(f.path));return f;
}
function state(f){return JSON.parse(fs.readFileSync(f.state,'utf8'));}
function updateState(f,fn){const s=state(f);fn(s);fs.writeFileSync(f.state,JSON.stringify(s,null,2)+'\n');}
function journal(f){return fs.readFileSync(f.journal,'utf8').trimEnd().split('\n').map(x=>JSON.parse(x));}
function invoke(f,mode='--all',extra=[],opts={}){
  const args=[mode,'--manifest',f.path,'--expected-sha256',f.sha,'--expected-store-id',store.id];
  if(!['--plan','--enumerate'].includes(mode))args.push('--offline-state',f.state,'--journal',f.journal);
  if(opts.resume)args.push('--journal-sha256',hash(fs.readFileSync(f.journal)));
  const result=spawnSync(process.execPath,['--require',guard,path.join(root,'apply-fix.mjs'),...args,...extra],{
    encoding:'utf8',timeout:5000,env:{VIENNA_EXTERNAL_DRIFT:opts.externalDrift?f.state:'',VIENNA_DRIFT_STORE:opts.driftStore?'1':'',VIENNA_FAIL_SUCCESS_APPEND:opts.failSuccessAppend?'1':'',VIENNA_ALLOWED_READS:JSON.stringify([...sourceFiles,f.path,f.journal,...(!opts.noWrites||opts.allowAdapterRead?[f.state]:[])]),VIENNA_ALLOWED_WRITES:JSON.stringify(opts.noWrites?[]:[f.state,f.journal]),VIENNA_ALLOWED_DIRS:JSON.stringify(opts.noWrites?[]:[f.dir,f.journal+'.lock',f.state+'.lock'])}
  });
  assert.ifError(result.error); assert.equal(result.signal,null,result.stderr);
  fs.writeFileSync(path.join(f.dir,`result-${fs.readdirSync(f.dir).length}.json`),JSON.stringify({args,...result},null,2));
  assert.doesNotMatch(result.stderr,/BOUNDARY_DENIED:/,result.stderr);
  return result;
}
function fail(r,re){assert.equal(r.status,2,r.stdout+r.stderr);assert.match(r.stderr,re);}
function unchanged(f,before){assert.equal(hash(fs.readFileSync(f.state)),before);assert.equal(fs.existsSync(f.journal),false);}
for(const [name,change,re] of [
  ['foreign vendor',m=>m.records[0].vendor='Fentucci Naturals',/scope/],
  ['foreign line',m=>m.records[0].title='Other Line',/scope/],
  ['malformed ID',m=>m.records[0].productId='gid://shopify/Product/*',/identity/],
  ['sample injection',m=>m.records[0].variantTitle='Sample',/scope/],
  ['duplicate item',m=>m.records.push(m.records[0]),/Duplicate/],
  ['variant collision',m=>m.records[2].variantId=m.records[0].variantId,/collision/],
  ['stale',m=>m.expiresAt='2026-09-08T11:59:59.000Z',/Stale/],
  ['future',m=>m.createdAt='2026-09-08T12:01:00.000Z',/Stale/],
  ['missing identity',m=>delete m.records[0].locationId,/Malformed/],
  ['unknown field',m=>m.all=true,/Malformed/],
  ['scope broadening',m=>m.scope.vendor='all',/scope/],
  ['store mismatch',m=>m.store.id='gid://shopify/Shop/99',/Store/],
  ['domain mismatch',m=>m.store.domain='other.myshopify.com',/Store/],
  ['canary injection',m=>m.canary.push('foreign'),/Canary/],
  ['split canary locations',m=>m.canary=[key(m.records[0])],/every frozen location/],
  ['quantity injection',m=>m.records[0].onHand=-10,/scope/]
])test('before adapter: '+name,()=>{const f=fixture();change(f.manifest);fs.writeFileSync(f.path,JSON.stringify(f.manifest));f.sha=hash(fs.readFileSync(f.path));const before=hash(fs.readFileSync(f.state));fail(invoke(f,'--all',[],{noWrites:true}),re);unchanged(f,before);});
test('external hash rejects valid-looking foreign ID injection',()=>{const f=fixture(),before=hash(fs.readFileSync(f.state));f.manifest.records[0].productId='gid://shopify/Product/777';fs.writeFileSync(f.path,JSON.stringify(f.manifest));fail(invoke(f,'--all',[],{noWrites:true}),/SHA256/);unchanged(f,before);});
test('malformed JSON and missing manifest fail before adapter',()=>{const f=fixture(),before=hash(fs.readFileSync(f.state));fs.writeFileSync(f.path,'{');f.sha=hash(fs.readFileSync(f.path));fail(invoke(f,'--all',[],{noWrites:true}),/JSON|property/);unchanged(f,before);f.path=path.join(f.dir,'missing.json');fail(invoke(f,'--all',[],{noWrites:true}),/ENOENT/);unchanged(f,before);});
test('plan and enumerate have no adapter, journal or write effects',()=>{for(const mode of ['--plan','--enumerate']){const f=fixture(),before=hash(fs.readFileSync(f.state));const r=invoke(f,mode,[],{noWrites:true});assert.equal(r.status,0,r.stderr);assert.equal(JSON.parse(r.stdout).mutations,0);unchanged(f,before);}});
test('adapter actual shop mismatch rejects before state or journal changes',()=>{const f=fixture();updateState(f,s=>s.store={...store,id:'gid://shopify/Shop/99'});const before=hash(fs.readFileSync(f.state));fail(invoke(f,'--all',[],{noWrites:true,allowAdapterRead:true}),/Adapter store/);unchanged(f,before);});
test('happy all path exact multi-location postread; retry performs zero duplicate writes',()=>{const f=fixture();let r=invoke(f);assert.equal(r.status,0,r.stderr);assert.equal(JSON.parse(r.stdout).writes,4);assert.deepEqual(state(f).records.map(r=>r.onHand),[0,0,0,0]);assert.equal(journal(f).filter(e=>e.type==='verified').length,4);const sets=state(f).calls.filter(c=>c.method==='set').length;r=invoke(f,'--all',[],{resume:true});assert.equal(r.status,0,r.stderr);assert.equal(JSON.parse(r.stdout).writes,0);assert.equal(state(f).calls.filter(c=>c.method==='set').length,sets);});
test('frozen canary uses explicit membership and cannot broaden on resume',()=>{const f=fixture();const r=invoke(f,'--canary');assert.equal(r.status,0,r.stderr);assert.deepEqual(state(f).records.map(r=>r.onHand),[2026,2026,0,2026]);assert.deepEqual(state(f).calls.filter(c=>c.method==='set').map(c=>c.key),f.manifest.canary);const before=hash(fs.readFileSync(f.state));fail(invoke(f,'--all',[],{resume:true,noWrites:true}),/broaden/);assert.equal(hash(fs.readFileSync(f.state)),before);});
test('all locations of selected canary product execute',()=>{const f=fixture();f.manifest.canary=f.manifest.records.slice(0,2).map(key);fs.writeFileSync(f.path,JSON.stringify(f.manifest));f.sha=hash(fs.readFileSync(f.path));assert.equal(invoke(f,'--canary').status,0);assert.deepEqual(state(f).records.map(r=>r.onHand),[0,0,2026,2026]);});
test('quantity and exact foreign identity drift prevent write',()=>{for(const change of [s=>s.records[0].onHand=9,s=>s.records[0].productId='gid://shopify/Product/888']){const f=fixture();updateState(f,change);fail(invoke(f),/precondition drift/);assert.equal(state(f).calls.filter(c=>c.method==='set').length,0);assert.equal(journal(f).length,1);}});
test('partial multi-location rejection; rollback restores successes only and is idempotent',()=>{const f=fixture();updateState(f,s=>s.faults[key(s.records[1])]='reject');fail(invoke(f),/Confirmed mutation rejection/);assert.deepEqual(state(f).records.map(r=>r.onHand),[0,2026,2026,2026]);assert.equal(journal(f).filter(e=>e.type==='success').length,1);let r=invoke(f,'--rollback',[],{resume:true});assert.equal(r.status,0,r.stderr);assert.equal(JSON.parse(r.stdout).writes,1);assert.deepEqual(state(f).records.map(r=>r.onHand),[2026,2026,2026,2026]);const sets=state(f).calls.filter(c=>c.method==='set').length;r=invoke(f,'--rollback',[],{resume:true});assert.equal(r.status,0,r.stderr);assert.equal(state(f).calls.filter(c=>c.method==='set').length,sets);});
test('confirmed rejection retry skips successes and compares untouched frozen rows',()=>{const f=fixture();updateState(f,s=>s.faults[key(s.records[1])]='reject');fail(invoke(f),/Confirmed/);updateState(f,s=>s.faults={});const r=invoke(f,'--all',[],{resume:true});assert.equal(r.status,0,r.stderr);assert.equal(state(f).calls.filter(c=>c.method==='set'&&c.key===key(f.manifest.records[0])).length,1);assert.deepEqual(state(f).records.map(r=>r.onHand),[0,0,0,0]);});
for(const fault of ['throw-before','throw-after'])test('ambiguous '+fault+' blocks retry AND rollback before adapter',()=>{const f=fixture();updateState(f,s=>s.faults[key(s.records[0])]=fault);fail(invoke(f),/Simulated/);assert.equal(journal(f).at(-1).type,'intent');assert.equal(state(f).records[0].onHand,fault==='throw-after'?0:2026);for(const mode of ['--all','--rollback']){const before=hash(fs.readFileSync(f.state));fail(invoke(f,mode,[],{resume:true,noWrites:true}),/Unresolved mutation intent/);assert.equal(hash(fs.readFileSync(f.state)),before);}});
test('rollback response ambiguity leaves unresolved intent and blocks further recovery',()=>{const f=fixture();assert.equal(invoke(f,'--canary').status,0);updateState(f,s=>s.faults[key(s.records[2])]='throw-after');fail(invoke(f,'--rollback',[],{resume:true}),/Simulated/);assert.equal(state(f).records[2].onHand,2026);assert.equal(journal(f).at(-1).direction,'rollback');fail(invoke(f,'--rollback',[],{resume:true,noWrites:true}),/Unresolved/);});
test('postread failure retains confirmed success and blocks rollback on identity drift',()=>{const f=fixture();updateState(f,s=>s.faults[key(s.records[0])]='bad-postread');fail(invoke(f),/precondition drift/);assert.equal(journal(f).at(-1).type,'success');const sets=state(f).calls.filter(c=>c.method==='set').length;fail(invoke(f,'--rollback',[],{resume:true}),/precondition drift/);assert.equal(state(f).calls.filter(c=>c.method==='set').length,sets);});
test('success before verification crash recovers by exact read without duplicate write',()=>{const f=fixture();updateState(f,s=>s.faults[key(s.records[0])]='bad-postread');fail(invoke(f),/precondition drift/);updateState(f,s=>{s.records[0].variantId=f.manifest.records[0].variantId;s.faults={};});const r=invoke(f,'--all',[],{resume:true});assert.equal(r.status,0,r.stderr);assert.equal(state(f).calls.filter(c=>c.method==='set'&&c.key===key(f.manifest.records[0])).length,1);});
function forge(events){let prev='0'.repeat(64);return events.map((e,i)=>{const {hash:_,...body}=e;body.seq=i;body.prev=prev;prev=hash(JSON.stringify(body));return JSON.stringify({...body,hash:prev})+'\n';}).join('');}
for(const [name,change] of [
 ['foreign key',es=>es[1].key='gid://shopify/InventoryItem/999@gid://shopify/Location/1'],
 ['quantity',es=>es[1].before=999],['missing intent',es=>es.splice(1,1)],
 ['duplicate success',es=>es.splice(3,0,es[2])],['rollback without applied success',es=>{es[1].direction='rollback';es[1].before=0;es[1].after=2026;}],
 ['foreign header',es=>es[0].manifestHash='a'.repeat(64)],['unknown event',es=>es[1].type='reconciled'],
])test('forged history rejected even with recomputed checkpoint: '+name,()=>{const f=fixture();assert.equal(invoke(f,'--canary').status,0);const es=journal(f);change(es);fs.writeFileSync(f.journal,forge(es));const before=hash(fs.readFileSync(f.state));fail(invoke(f,'--rollback',[],{resume:true,noWrites:true}),/journal|Journal|Unbound|Foreign|Unknown|Invalid/);assert.equal(hash(fs.readFileSync(f.state)),before);});
test('corrupt, truncated and wrong external journal hash refuse before adapter',()=>{for(const mutation of [s=>s.slice(0,-1),s=>s.replace('header','bogus')]){const f=fixture();assert.equal(invoke(f,'--canary').status,0);fs.writeFileSync(f.journal,mutation(fs.readFileSync(f.journal,'utf8')));fail(invoke(f,'--rollback',[],{resume:true,noWrites:true}),/Truncated|Corrupt/);}const f=fixture();assert.equal(invoke(f,'--canary').status,0);fail(invoke(f,'--canary',['--journal-sha256','a'.repeat(64)],{noWrites:true}),/Journal SHA256/);fail(invoke(f,'--canary',[],{noWrites:true}),/Existing journal requires/);});
test('existing concurrent journal lock refuses without writes',()=>{const f=fixture();assert.equal(invoke(f,'--canary').status,0);fs.mkdirSync(f.journal+'.lock');const before=hash(fs.readFileSync(f.state));fail(invoke(f,'--canary',[],{resume:true}),/EEXIST/);assert.equal(hash(fs.readFileSync(f.state)),before);});
for(const [code,label] of [["require('node:fs').readFileSync('/Users/macstudio3/Projects/secrets-manager/.env')",'fs.readFileSync'],["fetch('https://example.invalid')",'fetch'],["require('node:https').get('https://example.invalid')",'node:https.get'],["require('node:child_process').spawn('never-launch')",'node:child_process.spawn']])test('denied real boundary calibration '+label,()=>{const r=spawnSync(process.execPath,['--require',guard,'--eval',code],{encoding:'utf8',env:{}});assert.notEqual(r.status,0);assert.match(r.stderr,new RegExp('BOUNDARY_DENIED:'+label.replaceAll('.','\\.')));});
test('confirmed adapter success then failed success append leaves only intent and blocks both recoveries',()=>{
  for(const mode of ['--canary','--rollback']) {
    const f=fixture();if(mode==='--rollback')assert.equal(invoke(f,'--canary').status,0);
    fail(invoke(f,mode,[],{resume:mode==='--rollback',failSuccessAppend:true}),/after confirmed mutation before success append/);
    assert.equal(journal(f).at(-1).type,'intent');
    assert.equal(state(f).records[2].onHand,mode==='--canary'?0:2026);
    for(const recovery of ['--canary','--rollback'])fail(invoke(f,recovery,[],{resume:true,noWrites:true}),/Unresolved mutation intent/);
  }
});
test('rollback postread failure retains success; verified retry performs no duplicate restore',()=>{
  const f=fixture();assert.equal(invoke(f,'--canary').status,0);
  updateState(f,s=>s.faults[key(s.records[2])]='bad-postread');
  fail(invoke(f,'--rollback',[],{resume:true}),/precondition drift/);
  assert.equal(journal(f).at(-1).type,'success');assert.equal(journal(f).at(-1).direction,'rollback');
  const sets=state(f).calls.filter(c=>c.method==='set').length;
  fail(invoke(f,'--rollback',[],{resume:true}),/precondition drift/);
  updateState(f,s=>{s.records[2].variantId=f.manifest.records[2].variantId;s.faults={};});
  assert.equal(invoke(f,'--rollback',[],{resume:true}).status,0);
  assert.equal(state(f).calls.filter(c=>c.method==='set').length,sets);
  assert.equal(journal(f).at(-1).type,'verified');
});
test('durable helper rejects symlink and hardlink targets without altering victims',async()=>{
  const {durableWrite}=await import('../vienna-executor.mjs');
  for(const kind of ['symlink','hardlink']) {
    const f=fixture(),victim=path.join(f.dir,'victim.json'),alias=path.join(f.dir,'alias.json');
    fs.writeFileSync(victim,'retained'); if(kind==='symlink')fs.symlinkSync(victim,alias);else fs.linkSync(victim,alias);
    assert.throws(()=>durableWrite(alias,'replaced'),/Unsafe write target/);assert.equal(fs.readFileSync(victim,'utf8'),'retained');
  }
});
test('actual CLI rejects linked manifest, state and journal without modifying targets',()=>{
  for(const file of ['path','state','journal']) {
    const f=fixture();if(file==='journal')assert.equal(invoke(f,'--canary').status,0);
    const original=f[file],alias=path.join(f.dir,'alias-'+file);fs.symlinkSync(original,alias);f[file]=alias;
    const before=hash(fs.readFileSync(original));
    fail(invoke(f,'--canary',[],{resume:file==='journal',noWrites:true,allowAdapterRead:file==='state'}),/ELOOP|symbolic/);
    assert.equal(hash(fs.readFileSync(original)),before);
  }
});
test('open adapter reloads external quantity drift and read never overwrites persisted truth',async()=>{
  const {openOfflineAdapter}=await import('../vienna-offline-adapter.mjs');const f=fixture();
  const adapter=openOfflineAdapter(f.state,store);updateState(f,s=>s.records[0].onHand=9);
  const before=hash(fs.readFileSync(f.state));assert.equal((await adapter.read(f.manifest.records[0])).onHand,9);
  assert.equal(hash(fs.readFileSync(f.state)),before);
  assert.deepEqual(await adapter.set(f.manifest.records[0],2026,0),{kind:'rejected',confirmedNoWrite:true});
  assert.equal(hash(fs.readFileSync(f.state)),before);
});
test('actual CLI rejects quantity drift injected after intent fsync before compare/write',()=>{
  const f=fixture();fail(invoke(f,'--all',[],{externalDrift:true}),/Confirmed mutation rejection/);
  assert.equal(state(f).records[0].onHand,9);assert.equal(journal(f).at(-1).type,'rejected');
  assert.equal(journal(f).filter(e=>e.type==='success').length,0);
  fail(invoke(f,'--all',[],{resume:true}),/precondition drift/);
});
test('actual CLI detects refreshed store drift after intent and leaves unresolved receipt',()=>{
  const f=fixture();fail(invoke(f,'--all',[],{externalDrift:true,driftStore:true}),/Adapter store mismatch/);
  assert.equal(state(f).records[0].onHand,2026);assert.equal(journal(f).at(-1).type,'intent');
  fail(invoke(f,'--all',[],{resume:true,noWrites:true}),/Unresolved/);
});
test('competing actual CLI writers with different journals share one state lock',async()=>{
  const f=fixture();const firstArgs=['--all','--manifest',f.path,'--expected-sha256',f.sha,'--expected-store-id',store.id,'--offline-state',f.state,'--journal',f.journal];
  const child=spawn(process.execPath,['--require',guard,path.join(root,'apply-fix.mjs'),...firstArgs],{env:{VIENNA_HOLD_LOCK:'1',VIENNA_ALLOWED_READS:JSON.stringify([...sourceFiles,f.path,f.state,f.journal]),VIENNA_ALLOWED_WRITES:JSON.stringify([f.state,f.journal]),VIENNA_ALLOWED_DIRS:JSON.stringify([f.dir,f.journal+'.lock',f.state+'.lock'])},stdio:['ignore','pipe','pipe']});
  let output='',errors='',contender;
  child.stdout.on('data',b=>{output+=b;if(!contender&&output.includes('TEST_LOCK_HELD')){const second={...f,journal:path.join(f.dir,'second.jsonl')};contender=invoke(second);assert.equal(fs.existsSync(second.journal),false);}});
  child.stderr.on('data',b=>errors+=b);
  const code=await new Promise((resolve,reject)=>{child.on('error',reject);child.on('close',resolve);});
  assert.equal(code,0,errors);assert.ok(contender,'First CLI exposed lock checkpoint');fail(contender,/EEXIST/);
  assert.equal(state(f).calls.filter(c=>c.method==='set').length,4);
  assert.equal(fs.existsSync(f.state+'.lock'),false);assert.equal(fs.existsSync(f.journal+'.lock'),false);
  fs.writeFileSync(path.join(f.dir,'competing-writer-proof.json'),JSON.stringify({firstArgs,code,output,errors,contender},null,2));
});