From 70fd6396f45eddcffb3285c04e19ab9e72df2576 Mon Sep 17 00:00:00 2001 From: Heimdall Date: Thu, 5 Nov 2026 23:30:23 +0000 Subject: [PATCH 1/2] Exercise the pending-link and findAuthCompletion store methods in the live-Postgres privilege tests The live suite asserts that exerciseStore calls every PostgresStore method and that dropping any one table privilege makes it fail with 42501. createPendingLink, consumePendingLink and findAuthCompletion landed without a call there, so the coverage assertion failed, and with no operation touching pending_links the privilege test saw no error when SELECT on it was revoked. Both failures were invisible because the live files skip without HEIMDALL_TEST_PG_ADMIN_URL. Co-Authored-By: Claude Sonnet 5.5 --- tests/store.test.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/tests/store.test.ts b/tests/store.test.ts index 11614c4..f17a834 100644 --- a/tests/store.test.ts +++ b/tests/store.test.ts @@ -398,6 +398,19 @@ async function exerciseStore(store: PostgresStore): Promise> { await s.consumeAuthCompletion("ghostlight", byCode.code, now); await s.createAuthCompletion({ ...completion, attemptId: attempt.handle }); await s.consumeAuthCompletionByAttempt("ghostlight", attempt.handle, now); + const found = await s.createAuthCompletion(completion); + await s.findAuthCompletion("ghostlight", found.code); + const pending = await s.createPendingLink({ + appSlug: "ghostlight", + accountId: account.id, + provider: "discord", + providerUserId: "u2", + identity: { ...identity, providerUserId: "u2" }, + returnTo: "https://x.test/", + createdAt: now, + expiresAt: later, + }); + await s.consumePendingLink("ghostlight", pending.id, account.id, now); const snapshot = { accountId: account.id, provider: "discord" as const, scope: "ghostlight:probe", evaluatedAt: now, isAllowed: true, reasonCode: "ok", rawSummaryJson: {} }; await s.upsertEntitlementSnapshot(snapshot); await s.upsertEntitlementSnapshot({ ...snapshot, isAllowed: false }); -- 2.47.3 From 575be9cf49d992dc23e6fc6111c3acc314f50acb Mon Sep 17 00:00:00 2001 From: Heimdall Date: Thu, 5 Nov 2026 23:30:57 +0000 Subject: [PATCH 2/2] Add scripts/test-live-pg.sh: run the suite against a throwaway Postgres Co-Authored-By: Claude Sonnet 5.5 --- scripts/test-live-pg.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100755 scripts/test-live-pg.sh diff --git a/scripts/test-live-pg.sh b/scripts/test-live-pg.sh new file mode 100755 index 0000000..a25c3e9 --- /dev/null +++ b/scripts/test-live-pg.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +# Runs the whole vitest suite with the live-Postgres files enabled, against a +# throwaway local cluster that this script starts and removes. Needs the +# Postgres server binaries (initdb, pg_ctl) on PATH or in PG_BIN. +# SOUL_PG_URL's test drops and recreates schema public, so it only ever sees +# this disposable cluster. +set -euo pipefail +export PATH="${PG_BIN:-/usr/lib/postgresql/16/bin}:$PATH" +dir="$(mktemp -d)" +port="${PG_PORT:-54329}" +trap 'pg_ctl -D "$dir" -m immediate stop >/dev/null 2>&1 || true; rm -rf "$dir"' EXIT +initdb -D "$dir" -U pgadmin --auth=trust >/dev/null +pg_ctl -D "$dir" -o "-p $port -k $dir -c listen_addresses=127.0.0.1" -l "$dir/log" -w start >/dev/null +url="postgres://pgadmin@127.0.0.1:$port/postgres" +HEIMDALL_TEST_PG_ADMIN_URL="$url" SOUL_PG_URL="$url" npx vitest run --config vitest.config.ts "$@" -- 2.47.3