also looking at this
test: control purge history preparation clock
#55
37 files
+1804
-168
Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.
| @@ -1,6 +1,7 @@ | ||
| 1 | 1 | import assert from 'node:assert/strict' |
| 2 | import { setSystemTime } from 'bun:test' | |
| 2 | 3 | import { randomUUID } from 'node:crypto' |
| 3 | import { actor, as, seed, database, records, managed } from './managed-context' | |
| 4 | import { actor, as, seed, database, records, managed, status } from './managed-context' | |
| 4 | 5 | const purge = await import('../../../resources/functions/drone/public-safety/purge/service') |
| 5 | 6 | const { purgeAbilities, purgePolicy, purgeCoverage, purgeExclusions } = await import('../../../resources/functions/drone/public-safety/purge/types') |
| 6 | 7 | const { publicSafetyPurgeGate } = await import('../../../resources/functions/drone/public-safety/purge/policy') |
| @@ -11,17 +12,52 @@ const coordinator = await actor('purge-history-coordinator') | ||
| 11 | 12 | try { |
| 12 | 13 | process.env.PUBLIC_SAFETY_PURGE_ENABLED = 'true' |
| 13 | 14 | await as(coordinator.token.plainTextToken, async () => { |
| 14 | const key = 'purge-history', fixture = await seed(key, 60000) | |
| 15 | const capture = fixture.run.survey.captures[0]!, support = fixture.run.captures[0]!.support.findIndex(value => value === 1) | |
| 16 | const observation = await records.appendPublicSafetyObservation(key, { expectedVersion: 3, sourceDigest: fixture.source.digest, captureId: capture.id, modality: 'visible', pixel: { x: support % capture.width, y: Math.floor(support / capture.width) }, note: 'private-history-observation-fragment', uncertaintyNote: 'private-history-uncertainty-fragment' }) | |
| 17 | let version = 4, previousReviewId: number | null = null | |
| 18 | for (let count = 0; count < 137; count++) { | |
| 19 | const appended = await records.appendPublicSafetyReview(key, observation.observation.id, { expectedVersion: version, sourceDigest: fixture.source.digest, previousReviewId, disposition: 'unresolved', note: `private-history-review-fragment-${count}` }) | |
| 20 | version = appended.incident.version; previousReviewId = appended.review.id | |
| 21 | } | |
| 22 | await managed.createPublicSafetyManagedDataset(key, { ...fixture.body, expectedVersion: version }) | |
| 15 | const key = 'purge-history' | |
| 16 | // Controlled preparation removes an unrelated host-throughput precondition. | |
| 17 | // The installed Stacks testing root registers afterEach, so this standalone | |
| 18 | // child uses its underlying Bun clock API. Real timers remain unchanged. | |
| 19 | const fixture = await (async () => { | |
| 20 | const preparationAt = Date.now() | |
| 21 | const realNow = () => { | |
| 22 | setSystemTime() | |
| 23 | try { return Date.now() } | |
| 24 | finally { setSystemTime(preparationAt) } | |
| 25 | } | |
| 26 | setSystemTime(preparationAt) | |
| 27 | try { | |
| 28 | const prepared = await seed(key, 60000) | |
| 29 | const capture = prepared.run.survey.captures[0]!, support = prepared.run.captures[0]!.support.findIndex(value => value === 1) | |
| 30 | const observation = await records.appendPublicSafetyObservation(key, { expectedVersion: 3, sourceDigest: prepared.source.digest, captureId: capture.id, modality: 'visible', pixel: { x: support % capture.width, y: Math.floor(support / capture.width) }, note: 'private-history-observation-fragment', uncertaintyNote: 'private-history-uncertainty-fragment' }) | |
| 31 | let version = 4, previousReviewId: number | null = null | |
| 32 | for (let count = 0; count < 137; count++) { | |
| 33 | if (count === 136) { | |
| 34 | // Exercise the reproduced precondition even on a fast host. This | |
| 35 | // spends the existing expiry wait before the last setup write. | |
| 36 | const expires = Date.parse(prepared.config.retention.expiresAt) | |
| 37 | const remaining = expires - realNow() + 20 | |
| 38 | if (remaining > 0) await Bun.sleep(remaining) | |
| 39 | assert(realNow() >= expires, 'The final controlled setup review must cross real retention expiry') | |
| 40 | } | |
| 41 | const appended = await records.appendPublicSafetyReview(key, observation.observation.id, { expectedVersion: version, sourceDigest: prepared.source.digest, previousReviewId, disposition: 'unresolved', note: `private-history-review-fragment-${count}` }) | |
| 42 | version = appended.incident.version; previousReviewId = appended.review.id | |
| 43 | } | |
| 44 | await managed.createPublicSafetyManagedDataset(key, { ...prepared.body, expectedVersion: version }) | |
| 45 | const beforeReviews = await database.db.primary.selectFrom('public_safety_reviews').select('id').execute() | |
| 46 | const beforeAudits = await database.db.primary.selectFrom('public_safety_audits').select('id').execute() | |
| 47 | const incident = (await database.db.primary.selectFrom('public_safety_incidents').select('version').where('incident_key', '=', key).executeTakeFirst())! | |
| 48 | assert.equal(beforeReviews.length, 137) | |
| 49 | setSystemTime(Date.parse(prepared.config.retention.expiresAt)) | |
| 50 | await assert.rejects(() => records.appendPublicSafetyReview(key, observation.observation.id, { expectedVersion: incident.version, sourceDigest: prepared.source.digest, previousReviewId, disposition: 'unresolved', note: 'refused-at-exact-retention-boundary' }), status(404)) | |
| 51 | assert.deepEqual(await database.db.primary.selectFrom('public_safety_reviews').select('id').execute(), beforeReviews) | |
| 52 | assert.deepEqual(await database.db.primary.selectFrom('public_safety_audits').select('id').execute(), beforeAudits) | |
| 53 | return prepared | |
| 54 | } | |
| 55 | finally { setSystemTime() } | |
| 56 | })() | |
| 23 | 57 | const wait = Date.parse(fixture.config.retention.expiresAt) - Date.now() + 20 |
| 24 | 58 | if (wait > 0) await new Promise(resolve => setTimeout(resolve, wait)) |
| 59 | assert(Date.now() > Date.parse(fixture.config.retention.expiresAt), 'Purge acceptance must use genuinely elapsed wall time after restoring the clock') | |
| 60 | console.log('PASS controlled setup crosses real60000ms expiry before its last review and refuses exact-expiry review before genuinely due purge') | |
| 25 | 61 | const preview = await purge.previewPublicSafetyPurge(key) |
| 26 | 62 | assert.equal(preview.counts.reviews, 137); assert(preview.counts.audits > 100) |
| 27 | 63 | const accepted = await purge.acceptPublicSafetyPurge(key, { expectedVersion: preview.incidentVersion, expectedRetentionVersion: preview.retentionVersion, policyVersion: purgePolicy, coverage: purgeCoverage, inventoryDigest: preview.inventoryDigest, exclusions: purgeExclusions, receiptRetentionDays: 2, requestId: randomUUID() }) |
| @@ -71,6 +71,7 @@ test('accepted purge removes more than one hundred review leaves and audits in b | ||
| 71 | 71 | try { [code, stdout, stderr] = await Promise.all([running.exited, new Response(running.stdout).text(), new Response(running.stderr).text()]) } |
| 72 | 72 | finally { clearTimeout(timer) } |
| 73 | 73 | expect(code, `${stdout}\n${stderr}`).toBe(0); expect(stdout).toContain('PASS actual137review FK leaves') |
| 74 | expect(stdout).toContain('PASS controlled setup crosses real60000ms expiry before its last review and refuses exact-expiry review before genuinely due purge') | |
| 74 | 75 | } |
| 75 | 76 | finally { if (child && child.exitCode === null) { child.kill('SIGKILL'); await child.exited }; await rm(root, { recursive: true, force: true }) } |
| 76 | 77 | }, 180000) |