`verification/fleet-classification/verify-patches.cjs`

46 lines
const fs = require('node:fs'), path = require('node:path'), vm = require('node:vm');
const {createRequire} = require('node:module');
const assert = require('node:assert/strict');
const base = __dirname;
const discovery = JSON.parse(fs.readFileSync(path.join(base,'shared-modules.json')));
const tests=[],missingDrivers=[];
for(const item of discovery.modules){
  const source=fs.readFileSync(item.path,'utf8').replace(discovery.proposed_old,discovery.proposed_new);
  const body=source.match(/let pool = null;\s*function db\(\) \{[\s\S]*?\n\}/);
  assert(body, item.path);
  let pg;try{pg=createRequire(item.path)('pg');}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e;missingDrivers.push(item.path);}
  for(const [platform,PGHOST,expected] of [['darwin',undefined,'/tmp'],['linux',undefined,'127.0.0.1'],['darwin','/custom/socket','/custom/socket'],['linux','db.example','db.example'],['darwin','','/tmp']]){
    let captured;
    const ctx={process:{platform,env:PGHOST===undefined?{}:{PGHOST}},PGPASS:'test-only-not-a-secret',Pool:class{constructor(options){captured=options;}}};
    vm.runInNewContext(body[0]+';db();',ctx,{timeout:1000});
    assert.equal(captured.host,expected);
    for(const [k,v] of Object.entries({port:5432,user:'dw_admin',database:'dw_unified',password:'test-only-not-a-secret',max:3})) assert.equal(captured[k],v);
    if(pg){const client=new pg.Client(captured);
      assert.equal(client.connectionParameters.host,expected);
      assert.equal(client.connectionParameters.isDomainSocket,expected.startsWith('/'));}
    tests.push({project:path.basename(path.dirname(path.dirname(item.path))),platform,override:PGHOST??null,host:expected,status:'PASS',installed_driver:pg?'PASS':'unavailable: dependency not installed; runtime prerequisite unresolved'});
  }
}
async function main(){
 const pg=createRequire('/Users/macstudio3/Projects/gracie-internal/package.json')('pg');
 const secrets=fs.readFileSync('/Users/macstudio3/Projects/secrets-manager/.env','utf8');
 const m=secrets.match(/^DW_ADMIN_DB_PASSWORD=(.+)$/m);
 const password=process.env.DW_ADMIN_DB_PASSWORD || (m?m[1].replace(/^["']|["']$/g,'').trim():'');
 const identities=[];
 for(const host of ['127.0.0.1','/tmp']){
   const c=new pg.Client({host,port:5432,user:'dw_admin',database:'dw_unified',password,connectionTimeoutMillis:5000,options:'-c default_transaction_read_only=on -c statement_timeout=5000'});
   try{await c.connect();const r=(await c.query("SELECT current_user AS role,current_database() AS database, (SELECT oid FROM pg_database WHERE datname=current_database()) AS database_oid,pg_postmaster_start_time() AS server_started,inet_client_addr() IS NULL AS socket,current_setting('transaction_read_only') AS read_only,to_regclass('public.vendor_requests')::text AS request_table")).rows[0];
     assert.equal(r.socket,host==='/tmp');assert.equal(r.read_only,'on');assert.equal(r.role,'dw_admin');assert.equal(r.database,'dw_unified');identities.push({host,...r});
   }finally{await c.end();}
 }
 assert.equal(identities[0].database_oid,identities[1].database_oid);
 assert.equal(String(identities[0].server_started),String(identities[1].server_started));
 const missing=new pg.Client({host:'/tmp/tk11438-deliberately-missing-socket',port:5432,user:'dw_admin',database:'dw_unified',connectionTimeoutMillis:3000});
 let failure;try{await missing.connect();}catch(e){failure=e.code;}finally{await missing.end();}
 assert.equal(failure,'ENOENT');
 const proof={verdict:'PASS available preparation checks; missing drivers explicit; services not rolled out',tests,missingDrivers,expression_checks:tests.length,installed_driver_config_checks:tests.filter(t=>t.installed_driver==='PASS').length,gracie_read_only_identities:identities,missing_socket_error:failure,application_imports:0,email_sends:0,database_writes:0};
 fs.writeFileSync(path.join(base,'driver-proof.json'),JSON.stringify(proof,null,2)+'\n');
 console.log(JSON.stringify({status:proof.verdict,driver_checks:proof.installed_driver_config_checks,missingDrivers:missingDrivers.length,identity:'same database OID/role/server start',missing_socket:failure}));
}
main().catch(e=>{console.error(e.code||e.name, 'verification failed');process.exitCode=1;});