Janady13/missionmatch / cmd/migrate-all-tenants/dsn_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / cmd/migrate-all-tenants/dsn_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	cmd/migrate-all-tenants/dsn_test.go
Original SHA-256	9536429882c894ae0c9b79fc003cd1eddc1b10b0ea3471e087fc0b26df995a37
Git blob SHA	47712effaac9156dd42d288d993de0952624b55c
Reading-copy SHA-256	78a78659adaf04d1d87bd4a108df9850379b031cb7a012ce1e7316c175c421f7

Original source ↗

Recovered source transcript

Download complete source text ↓112 lines · 4.5 KB

Credential-bearing and unrelated personal details were removed from this reading copy. The source identity and original checksum remain recorded.

package main

import (
	"strings"
	"testing"

	"github.com/google/uuid"

	"github.com/missionworkforce/missionmatch/internal/platform/directory"
)

// The regression this file exists for, in one sentence: the tenant DSN used to keep the CONTROL PLANE's
// host, so a tenant on another machine was never migrated and the tool migrated the control plane twice
// while reporting APPLIED for both. In production that produced a twelve migration divergence that every
// run reported as healthy, until a deploy needed a column the control plane did not have.

const controlDSN = "postgres://mig:secret@control.example:5433/missionmatch?sslmode=disable"

func tenant(host string, port int, ref string) directory.TenantConn {
	return directory.TenantConn{
		OrganizationID: uuid.New(),
		DBName:         "missionmatch",
		Host:           host,
		Port:           port,
		SecretRef:      ref,
		Status:         directory.StatusActive,
	}
}

// THE BUG. A tenant on a different host must produce a DSN pointing at THAT host, not at the control
// plane's. Note the database NAME is deliberately identical to the control plane's here, because that is
// the exact shape that made the old behaviour invisible: it connected somewhere real and succeeded.
func TestTenantDSNUsesTheTenantHostNotTheControlPlaneHost(t *testing.T) {
	got, err := tenantDSN(controlDSN, tenant("100.94.8.94", 5432, "tenant_acme"))
	if err != nil {
		t.Fatalf("tenantDSN: %v", err)
	}
	if !strings.Contains(got, "host=100.94.8.94") {
		t.Fatalf("tenant DSN did not target the tenant's own host: %q", got)
	}
	if strings.Contains(got, "control.example") {
		t.Fatalf("tenant DSN kept the CONTROL PLANE host, which is the defect this test exists for: %q", got)
	}
	if !strings.Contains(got, "port=5432") {
		t.Fatalf("tenant DSN did not take the tenant's port: %q", got)
	}
	if !strings.Contains(got, "dbname=missionmatch") {
		t.Fatalf("tenant DSN lost the database name: %q", got)
	}
	// The control plane's migrator credential is reused, which is the common single cluster role case.
	if !strings.Contains(got, "user=mig") || !strings.Contains(got, "password=[credential removed]") {
		t.Fatalf("tenant DSN did not reuse the migrator credential: %q", got)
	}
}

// A directory row with no host is a row this tool cannot address. It must ERROR rather than guess, because
// guessing is what silently migrated the wrong database.
func TestTenantDSNRefusesToGuessWhenTheDirectoryRowIsIncomplete(t *testing.T) {
	for _, tc := range []struct {
		name string
		conn directory.TenantConn
	}{
		{"no host", tenant("", 5432, "tenant_acme")},
		{"no port", tenant("100.94.8.94", 0, "tenant_acme")},
		{"neither", tenant("", 0, "")},
	} {
		if _, err := tenantDSN(controlDSN, tc.conn); err == nil {
			t.Fatalf("%s: tenantDSN accepted an unaddressable directory row and would have guessed a target", tc.name)
		}
	}
}

// An explicit per tenant migrator DSN wins, so a tenant whose credential differs (a managed database on
// another cloud, a rotated password) can be reached without changing the tool.
func TestExplicitTenantMigratorDSNOverridesEverything(t *testing.T) {
	t.Setenv("MM_TENANT_MIGRATOR_DSN_TENANT_ACME", "postgres://other:pw@elsewhere.example:6000/tenantdb")
	got, err := tenantDSN(controlDSN, tenant("100.94.8.94", 5432, "tenant_acme"))
	if err != nil {
		t.Fatalf("tenantDSN: %v", err)
	}
	if got != "postgres://other:pw@elsewhere.example:6000/tenantdb" {
		t.Fatalf("the explicit override was not used verbatim: %q", got)
	}
}

// The override is consulted even when the directory row could not be addressed on its own, so a row missing
// a host is recoverable by configuration rather than being a hard stop.
func TestExplicitOverrideRescuesAnIncompleteDirectoryRow(t *testing.T) {
	t.Setenv("MM_TENANT_MIGRATOR_DSN_TENANT_ACME", "postgres://other:pw@elsewhere.example:6000/tenantdb")
	if _, err := tenantDSN(controlDSN, tenant("", 0, "tenant_acme")); err != nil {
		t.Fatalf("an explicit override should address a row the directory cannot: %v", err)
	}
}

// The environment key folding must match internal/platform/secrets exactly, or an operator sets one
// variable name and the tool reads another.
func TestEnvKeyFoldsLikeTheSecretsResolver(t *testing.T) {
	cases := map[string]string{
		"tenant_acme": "TENANT_ACME",
		"tenant-acme": "TENANT_ACME",
		"Tenant.Acme": "TENANT_ACME",
		"  tenant  ":  "TENANT",
		"acme2":       "ACME2",
		"a/b:c":       "A_B_C",
	}
	for in, want := range cases {
		if got := envKey(in); got != want {
			t.Fatalf("envKey(%q) = %q, want %q", in, got, want)
		}
	}
}