Tests: internal/migrate

internal/migrate · 64 tests

Each test is named for the property it holds, and runs against a real deployment: there is no mock of the database and no arm that skips when it is absent. The sentence is the test's name read back; the name is what go test -run takes.

access_test.go

• Fresh registry enforces credential access modes — TestFreshRegistryEnforcesCredentialAccessModes

anchoridentity_test.go

• Canonical anchor upgrade refuses distinct normalized aliases — TestCanonicalAnchorUpgradeRefusesDistinctNormalizedAliases
• Canonical anchor upgrade preserves raw spelling variants — TestCanonicalAnchorUpgradePreservesRawSpellingVariants

chunkidentity_test.go

• Message chunk identity upgrade preserves i ds and refuses ambiguity — TestMessageChunkIdentityUpgradePreservesIDsAndRefusesAmbiguity

connectionbound_test.go

• A pool the server cannot satisfy is refused at startup with both numbers — TestAPoolTheServerCannotSatisfyIsRefusedAtStartupWithBothNumbers. ── #197 ────────────────────────────────────────────────────────────────────────────────────── The failure this holds against was measured, not imagined: twenty-eight workers and an API against max_connections=80 lost ten of 1,397 documents and logged 357 worker drain failures in thirty minutes, every one of them the server refusing a session.
• An oversubscribed server reports no headroom rather than a negative one — TestAnOversubscribedServerReportsNoHeadroomRatherThanANegativeOne. A budget that has been oversubscribed by other processes reports no headroom rather than a negative one: below zero would read as a different kind of fault than full.

ingestion_test.go

• Backlog migration preserves previously accepted work above its new limit — TestBacklogMigrationPreservesPreviouslyAcceptedWorkAboveItsNewLimit

instance_test.go

• An existing memory namespace upgrades without moving its observations — TestAnExistingMemoryNamespaceUpgradesWithoutMovingItsObservations
• An existing login that gained elevated attributes is refused not repaired — TestAnExistingLoginThatGainedElevatedAttributesIsRefusedNotRepaired. A plane login that gained a privilege this system never grants is refused, and left as it was.

integrity_test.go

• Runtime relationships cannot cross projects or leave dangling targets — TestRuntimeRelationshipsCannotCrossProjectsOrLeaveDanglingTargets
• Relationship migration validates history before invalidating reports — TestRelationshipMigrationValidatesHistoryBeforeInvalidatingReports

migrate_test.go

• The migration applies — TestTheMigrationApplies
• Applying twice changes nothing — TestApplyingTwiceChangesNothing. Applying twice must be a no-op, because a migrator runs on every deploy and a second run is the normal case rather than the exception.
• Provisioning twice is a no op — TestProvisioningTwiceIsANoOp
• A scope that is not an identifier is refused — TestAScopeThatIsNotAnIdentifierIsRefused. The partition name is built by string interpolation because DDL cannot take a bind value, so the allowlist is the only thing between a scope and an injection.
• An unprovisioned scope still accepts writes — TestAnUnprovisionedScopeStillAcceptsWrites. A write for an unprovisioned scope must land somewhere visible rather than fail: losing a customer's memory because provisioning missed a step is the worse failure.
• One tenant cannot address another — TestOneTenantCannotAddressAnother. THE HARD BOUNDARY.
• Projects are a soft boundary within a tenant — TestProjectsAreASoftBoundaryWithinATenant. The soft boundary.
• A schema name that would collide is refused — TestASchemaNameThatWouldCollideIsRefused. A truncated schema name would put two tenants in one schema, which is the worst failure this type can prevent, so the length check is asserted rather than assumed.
• Provisioning a tenant is repeatable and refuses a bad name — TestProvisioningATenantIsRepeatableAndRefusesABadName. Provisioning a tenant twice is a no-op, and a schema name that cannot be an identifier is refused before it reaches a statement.
• Salience is gone and confidence is not — TestSalienceIsGoneAndConfidenceIsNot. A column that existed because it was expected rather than because something read it is gone.

namespacelock_test.go

• Starters provisioning one namespace together all succeed — TestStartersProvisioningOneNamespaceTogetherAllSucceed. Starters that provision one fresh namespace together all succeed, and each migration is recorded once: the lock makes them take turns rather than fail on what another just created.
• A migration waits for the namespace lock — TestAMigrationWaitsForTheNamespaceLock. A migration waits while another session holds the namespace's lock, and proceeds when it is released: the lock is the one Apply takes, not a lock that merely exists.

ontology_test.go

• A relation outside the vocabulary cannot be stored — TestARelationOutsideTheVocabularyCannotBeStored. ── #5's claim: the vocabulary is closed, and closed by the database ─────────────────────────── The refusal is asserted through a direct INSERT rather than through the write path, because the point is that NO path can store an unknown relation — including one written by hand during an incident, which is exactly when a convention enforced in application code is bypassed.
• Retiring a predicate in use is refused — TestRetiringAPredicateInUseIsRefused. A predicate cannot be retired while facts still use it.
• Every semantic type has a predicate in it — TestEverySemanticTypeHasAPredicateInIt. The declared semantic types and the seeded rows cannot drift apart.
• The vocabulary stays within its declared bounds — TestTheVocabularyStaysWithinItsDeclaredBounds. The size of the vocabulary is itself the decision.
• The unresolvable terms are a closed set in the schema — TestTheUnresolvableTermsAreAClosedSetInTheSchema. The set is in the database, for the reason the predicate vocabulary is: a closed set belongs where it is enforced, not where it is remembered.
• Every unresolvable term is stored normalised — TestEveryUnresolvableTermIsStoredNormalised. Every term is stored in the form the resolver would compare against.

planes_test.go

• The memory service cannot read the registry — TestTheMemoryServiceCannotReadTheRegistry. ── #50's claim ─────────────────────────────────────────────────────────────────────────────── The memory service cannot read the registry.
• The memory service can serve the tenant it is granted — TestTheMemoryServiceCanServeTheTenantItIsGranted. The other half: it can serve the tenant it exists to serve.
• The memory service cannot change the schema or make a new one — TestTheMemoryServiceCannotChangeTheSchemaOrMakeANewOne. It cannot change the shape of what it serves, and it cannot make itself a new place to work in.
• The memory service can still see that other tenants exist — TestTheMemoryServiceCanStillSeeThatOtherTenantsExist. ── The limit of this boundary, asserted so nobody claims more than it gives ────────────────── System catalogs expose namespace names.
• Establishing the planes twice is a no op — TestEstablishingThePlanesTwiceIsANoOp. Establishing the planes twice changes nothing, because it is the kind of step an operator repeats when unsure whether it ran.
• A plane identity without a password is refused — TestAPlaneIdentityWithoutAPasswordIsRefused. A login role with no password is one anything on the network can assume, which would make every grant above decorative.
• Establishing the planes concurrently is safe — TestEstablishingThePlanesConcurrentlyIsSafe. Several processes establishing the planes at once all succeed.
• A provisioned project exists before anything is written to it — TestAProvisionedProjectExistsBeforeAnythingIsWrittenToIt. Provisioning records the project, so a project that exists but has never been written to is still a project.
• A memory surface can be added and never removed — TestAMemorySurfaceCanBeAddedAndNeverRemoved. A memory surface can be turned on and never off.
• A retention that would delete on write is refused — TestARetentionThatWouldDeleteOnWriteIsRefused. A retention that would delete on write is refused.
• The audit ledger cannot be rewritten or deleted — TestTheAuditLedgerCannotBeRewrittenOrDeleted. Append-only, enforced by the database rather than intended by the application.
• The ledger refuses an operation it does not know — TestTheLedgerRefusesAnOperationItDoesNotKnow. The ledger records no operation it does not know about, so a count of what happened is a count of everything that happened.
• Altering a sealed entry is detected — TestAlteringASealedEntryIsDetected. Altering a sealed entry breaks its seal, and the verifier says which one and how.
• Removing a seal breaks the chain — TestRemovingASealBreaksTheChain. Removing a seal to hide a range breaks the chain, and the verifier distinguishes that from an altered entry — they are different accusations.
• A verification reports what it does not cover — TestAVerificationReportsWhatItDoesNotCover. A verification says what it does NOT cover.
• Sealing with nothing to seal does nothing — TestSealingWithNothingToSealDoesNothing. Sealing twice with nothing in between does nothing rather than writing an empty seal.
• Two sealers cannot overlap — TestTwoSealersCannotOverlap. Sealing is serialised, so two sealers cannot both claim the same entries.
• Bootstrap repeats under an administrator who is not a superuser — TestBootstrapRepeatsUnderAnAdministratorWhoIsNotASuperuser
• Bootstrap does not adopt a role that carries a privilege it never grants — TestBootstrapDoesNotAdoptARoleThatCarriesAPrivilegeItNeverGrants. A role that gained a privilege this system never grants was not made here, and bootstrap must not hand it the registry password — under any identity, since the superuser could.
• The memory service writes only the tables it is listed for — TestTheMemoryServiceWritesOnlyTheTablesItIsListedFor. ── #242: the memory role writes only what it is listed for ───────────────────────────────────── A table a migration adds is readable by the memory service and not writable until somebody lists it.

privileges_test.go

• Runtime pool refuses privilege drift and accepts remediation — TestRuntimePoolRefusesPrivilegeDriftAndAcceptsRemediation
• Set role cannot hide a privileged login from runtime validation — TestSetRoleCannotHideAPrivilegedLoginFromRuntimeValidation
• Privilege inspection refuses missing configuration and cancelled queries — TestPrivilegeInspectionRefusesMissingConfigurationAndCancelledQueries

provision_test.go

• Project name refusal never creates storage — TestProjectNameRefusalNeverCreatesStorage
• Long project names with the same prefix have distinct storage and prune — TestLongProjectNamesWithTheSamePrefixHaveDistinctStorageAndPrune
• Project row failure rolls back its partition and index — TestProjectRowFailureRollsBackItsPartitionAndIndex
• Conflicting project relations are not treated as successful provisioning — TestConflictingProjectRelationsAreNotTreatedAsSuccessfulProvisioning
• Valid legacy partition and index names are reused — TestValidLegacyPartitionAndIndexNamesAreReused
• Project name migration validates existing rows atomically — TestProjectNameMigrationValidatesExistingRowsAtomically
• Project table names cannot collide with another projects index — TestProjectTableNamesCannotCollideWithAnotherProjectsIndex
• Existing default partition data is preserved when attachment is refused — TestExistingDefaultPartitionDataIsPreservedWhenAttachmentIsRefused
• A cancelled provisioner leaves no project or storage — TestACancelledProvisionerLeavesNoProjectOrStorage
• A legacy partition with no ANN index is completed without renaming it — TestALegacyPartitionWithNoANNIndexIsCompletedWithoutRenamingIt

runtimeconnection_test.go

• A runtime connection carries keepalives and a client check — TestARuntimeConnectionCarriesKeepalivesAndAClientCheck. A runtime connection reaches the server with keepalives that end a vanished client's session, and its locks, in about a minute, and with a check that cancels a query whose client has gone .

speaker_test.go

• Speaker migration preserves named identity and refuses ambiguous history — TestSpeakerMigrationPreservesNamedIdentityAndRefusesAmbiguousHistory. Reproduce a real version-21 database, rather than bypassing the new constraints after upgrading.