fix: harden release gate and page delivery

2026-07-26 14:32:01 +08:00
parent d3141a3e91
commit b1577a16e9
61 changed files with 6017 additions and 89 deletions
@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  buildContainerPgConnectionString,
+  buildPgConnectionString,
+  makeIsolatedDatabaseName,
+} from './local-stack.mjs';
+
+test('isolated database names are bounded and identifier-safe', () => {
+  const name = makeIsolatedDatabaseName('Gate 2026-07-26 / ABC', 'memind_gate');
+  assert.equal(name, 'memind_gate_gate_2026_07_26_abc');
+  assert.match(name, /^[a-z][a-z0-9_]+$/);
+  assert.ok(name.length <= 63);
+});
+
+test('PostgreSQL Unix socket DSN is preserved while database is isolated', () => {
+  const dsn = buildPgConnectionString(
+    'postgresql://gate:secret@localhost/base?host=%2Ftmp&port=5433',
+    'mindspace_gate_abc',
+  );
+  const parsed = new URL(dsn);
+  assert.equal(parsed.pathname, '/mindspace_gate_abc');
+  assert.equal(parsed.searchParams.get('host'), '/tmp');
+  assert.equal(parsed.searchParams.get('port'), '5433');
+});
+
+test('container PostgreSQL DSN keeps credentials and host while isolating database', () => {
+  const dsn = buildContainerPgConnectionString(
+    'postgresql://john:secret@host.docker.internal:5433/mindspace_userdata_dev',
+    'mindspace_gate_abc',
+  );
+  const parsed = new URL(dsn);
+  assert.equal(parsed.hostname, 'host.docker.internal');
+  assert.equal(parsed.port, '5433');
+  assert.equal(parsed.username, 'john');
+  assert.equal(parsed.password, 'secret');
+  assert.equal(parsed.pathname, '/mindspace_gate_abc');
+});
+
+test('isolated database names reject empty or unsafe prefixes', () => {
+  assert.throws(() => makeIsolatedDatabaseName('abc', '../bad'), /Unsafe/);
+});