test: classify durable runtime auth blocker

2026-05-23 06:53:00 +00:00
parent 322e3155b4
commit 6a14989c03
1 changed files with 35 additions and 0 deletions
@@ -106,6 +106,41 @@ test("live dry-run separates SSL negotiation blocker from auth and schema", asyn
  assert.equal(JSON.stringify(report).includes("The server does not support SSL connections"), false);
 });

+test("live dry-run classifies fixture 28P01 as auth before schema or migration", async () => {
+  const report = await buildDevRuntimeMigrationReport(
+    parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),
+    {
+      env: {
+        HWLAB_CLOUD_DB_SSL_MODE: "disable"
+      },
+      queryClient: {
+        async query(sql) {
+          assert.match(sql, /information_schema\.columns/u);
+          const error = new Error("fixture auth failure");
+          error.code = "28P01";
+          throw error;
+        }
+      },
+      now: () => "2026-05-23T00:00:00.000Z"
+    }
+  );
+
+  assert.equal(report.conclusion.status, "blocked");
+  assert.equal(report.actions.liveDbReadAttempted, true);
+  assert.equal(report.actions.liveDbWriteAttempted, false);
+  assert.equal(report.gates.auth.status, "blocked");
+  assert.equal(report.gates.schema.status, "not_checked");
+  assert.equal(report.gates.migration.status, "not_checked");
+  assert.equal(report.gates.readiness.status, "not_checked");
+  assert.equal(report.blockers[0].scope, "runtime-migration-auth");
+  assert.equal(report.blockers[0].evidence.blocker, "runtime_durable_adapter_auth_blocked");
+  assert.equal(report.runtime.blocker, "runtime_durable_adapter_auth_blocked");
+  assert.equal(report.runtime.connection.queryResult, "auth_blocked");
+  assert.equal(report.runtime.connection.errorCode, "28P01");
+  assert.equal(report.safety.fixtureEvidenceAllowed, false);
+  assert.equal(JSON.stringify(report).includes("fixture auth failure"), false);
+});
+
 test("live dry-run classifies pg_hba no-encryption rejection as SSL with ssl disabled", async () => {
  const report = await buildDevRuntimeMigrationReport(
    parseArgs(["--dry-run", "--allow-live-db-read", "--confirm-dev"]),