test: add real-Postgres smoke gate (pg-real) (#357)

* test: add real-Postgres smoke gate (pg-real) Mocked Supabase tests cannot exercise triggers, RPCs, or RLS policies — a migration that drops enforce_period_lock, mangles user_company_ids(), or weakens an RLS policy ships green today. Closes that gap with a small Vitest project `pg-real` running 5 smoke tests against a real supabase/postgres:15 container in CI. Covers: closed-period INSERT rejection, commit_journal_entry voucher atomicity under concurrency, posted-entry immutability, RLS tenant isolation on journal_entries, and audit_log UPDATE/DELETE rejection. Also lands the bankid anonymization migration that was sitting untracked from a prior task. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pg-real): fix storage schema bootstrap + de-scope + PR review fixes - Drop bankid anonymization migration from this PR. That change is separate scope (and has open compliance questions flagged by the Swedish review bot on #357); it will land in its own PR. - Add tests/pg/bootstrap.sql to align storage.buckets/objects/foldername with what migrations expect before the replay loop. The supabase/postgres image ships only a partial storage schema; the rest comes from the storage-api service at runtime, which CI does not run. First pg-real run failed at migration 24 on "column public of relation buckets does not exist". - Add concurrency group to the workflow so stacked PR commits cancel in-progress runs instead of queueing. - Gate the pg-real vitest project on DATABASE_URL so a bare `vitest run` with no DB configured runs only the unit project. npm run test:pg is the opt-in entry point. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(pg-real): widen JWT claim setup so auth.uid() resolves under RLS The rls.pg test came back with 0 rows instead of 1 — user_company_ids() returned empty because auth.uid() didn't resolve to the seeded user. Two fixes: - Set both request.jwt.claims (whole object) and request.jwt.claim.sub (individual claim). Different Supabase auth.uid() versions read one or the other. - Assert auth.uid() = expected userId immediately after the context switch, so the next failure points at the right layer instead of an unrelated empty-result assertion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-24 11:24:45 +02:00
parent 0222e084bb
commit ab63da8324
11 changed files with 737 additions and 6 deletions
@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest'
+import { getPool } from '@/tests/pg/setup'
+import {
+  insertBalancedLines,
+  insertDraftJournalEntry,
+  seedCompany,
+} from '@/tests/pg/fixtures'
+
+describe('engine.pg — triggers & RPCs that mocks cannot catch', () => {
+  it('rejects INSERT into journal_entries when the fiscal period is closed', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany({ isClosed: true })
+
+    await expect(
+      insertDraftJournalEntry({ userId, companyId, fiscalPeriodId }),
+    ).rejects.toThrow(/locked\/closed fiscal period/i)
+  })
+
+  it('commit_journal_entry assigns sequential voucher numbers under concurrency', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+
+    const entryA = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+    const entryB = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+    await insertBalancedLines(entryA)
+    await insertBalancedLines(entryB)
+
+    // Two dedicated clients so the row-level lock on voucher_sequences is
+    // actually exercised — not just a single connection serialising calls.
+    const clientA = await getPool().connect()
+    const clientB = await getPool().connect()
+    try {
+      const [resA, resB] = await Promise.all([
+        clientA.query<{ voucher_number: number }>(
+          `SELECT voucher_number FROM public.commit_journal_entry($1::uuid, $2::uuid)`,
+          [companyId, entryA],
+        ),
+        clientB.query<{ voucher_number: number }>(
+          `SELECT voucher_number FROM public.commit_journal_entry($1::uuid, $2::uuid)`,
+          [companyId, entryB],
+        ),
+      ])
+      const numbers = [resA.rows[0]!.voucher_number, resB.rows[0]!.voucher_number].sort(
+        (a, b) => a - b,
+      )
+      expect(numbers).toEqual([1, 2])
+    } finally {
+      clientA.release()
+      clientB.release()
+    }
+  })
+
+  it('rejects UPDATE to a posted journal entry (committed immutability)', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+
+    // Bypass commit_journal_entry by inserting directly as 'posted'. The
+    // immutability trigger fires on UPDATE, not INSERT, so this is legal
+    // setup on the superuser connection.
+    const entryId = await insertDraftJournalEntry({
+      userId,
+      companyId,
+      fiscalPeriodId,
+      status: 'posted',
+      voucherNumber: 1,
+    })
+
+    await expect(
+      getPool().query(
+        `UPDATE public.journal_entries SET description = 'tampered' WHERE id = $1`,
+        [entryId],
+      ),
+    ).rejects.toThrow(/Cannot modify a posted journal entry/i)
+  })
+})
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest'
+import { insertDraftJournalEntry, seedCompany } from '@/tests/pg/fixtures'
+import { withUserContext } from '@/tests/pg/setup'
+
+describe('rls.pg — tenant isolation on journal_entries', () => {
+  it('returns only the authenticated user\'s company rows', async () => {
+    const a = await seedCompany()
+    const b = await seedCompany()
+
+    // One entry in each tenant.
+    const entryA = await insertDraftJournalEntry({
+      userId: a.userId,
+      companyId: a.companyId,
+      fiscalPeriodId: a.fiscalPeriodId,
+    })
+    await insertDraftJournalEntry({
+      userId: b.userId,
+      companyId: b.companyId,
+      fiscalPeriodId: b.fiscalPeriodId,
+    })
+
+    // user A should see exactly entryA and nothing from tenant B.
+    const rows = await withUserContext(a.userId, async (client) => {
+      const res = await client.query<{ id: string; company_id: string }>(
+        `SELECT id, company_id FROM public.journal_entries`,
+      )
+      return res.rows
+    })
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0]!.id).toBe(entryA)
+    expect(rows[0]!.company_id).toBe(a.companyId)
+  })
+})