|
| 1 | +use codeguard_runtime::{ProcessOutcome, ProcessSpec, Termination, run_process}; |
| 2 | +use serde_json::Value; |
| 3 | +use sha2::{Digest, Sha256}; |
| 4 | +use std::{ |
| 5 | + collections::BTreeMap, |
| 6 | + ffi::OsString, |
| 7 | + path::PathBuf, |
| 8 | + sync::atomic::AtomicBool, |
| 9 | + time::{Duration, Instant, SystemTime, UNIX_EPOCH}, |
| 10 | +}; |
| 11 | + |
| 12 | +fn oracle() -> Value { |
| 13 | + serde_json::from_slice(include_bytes!( |
| 14 | + "../../../tests/acceptance/evidence/cfquery-postgres-oracle-2026-10-06.json" |
| 15 | + )) |
| 16 | + .unwrap() |
| 17 | +} |
| 18 | + |
| 19 | +#[test] |
| 20 | +fn native_sql_dialect_counterevidence_does_not_relabel_generic_pending_case() { |
| 21 | + let evidence = oracle(); |
| 22 | + assert_eq!(evidence["authority"], "development_only"); |
| 23 | + assert_eq!(evidence["grammar_qualified"], false); |
| 24 | + assert_eq!(evidence["delivery_decision"], "not_evaluated"); |
| 25 | + let cases = evidence["cases"].as_array().unwrap(); |
| 26 | + assert_eq!(cases.len(), 2); |
| 27 | + for case in cases { |
| 28 | + assert_eq!(case["dialect"], "postgresql"); |
| 29 | + assert_eq!(case["query_execution"], "not_executed_prepare_only"); |
| 30 | + assert_eq!( |
| 31 | + case["source_sha256"], |
| 32 | + format!( |
| 33 | + "{:x}", |
| 34 | + Sha256::digest(case["source"].as_str().unwrap().as_bytes()) |
| 35 | + ) |
| 36 | + ); |
| 37 | + } |
| 38 | + assert_eq!(cases[0]["native_valid"], true); |
| 39 | + assert_eq!(cases[1]["native_valid"], false); |
| 40 | + assert_eq!(cases[1]["sqlstate"], "42601"); |
| 41 | + let corpus: Value = serde_json::from_slice(include_bytes!( |
| 42 | + "../../../tests/fixtures/grammar_regression_v0_2.json" |
| 43 | + )) |
| 44 | + .unwrap(); |
| 45 | + let generic = corpus["cases"] |
| 46 | + .as_array() |
| 47 | + .unwrap() |
| 48 | + .iter() |
| 49 | + .find(|c| c["id"] == "cfquery-missing_select_list") |
| 50 | + .unwrap(); |
| 51 | + assert_eq!(generic["source_sha256"], cases[0]["source_sha256"]); |
| 52 | + assert_eq!(generic["label"], "pending"); |
| 53 | + assert_eq!(generic["cohort"], "provisional_syntax"); |
| 54 | +} |
| 55 | + |
| 56 | +/// 独占且无网络的原生SQL语法夹具；来源：OpenSpec S14.17明确方言原生对照。 |
| 57 | +struct PostgresFixture { |
| 58 | + tool: PathBuf, |
| 59 | + id: Option<String>, |
| 60 | +} |
| 61 | +impl PostgresFixture { |
| 62 | + fn run(&self, args: &[&str]) -> ProcessOutcome { |
| 63 | + let env = [ |
| 64 | + "PATH", |
| 65 | + "HOME", |
| 66 | + "DOCKER_HOST", |
| 67 | + "DOCKER_CONTEXT", |
| 68 | + "DOCKER_CONFIG", |
| 69 | + ] |
| 70 | + .into_iter() |
| 71 | + .filter_map(|k| std::env::var_os(k).map(|v| (OsString::from(k), v))) |
| 72 | + .collect::<BTreeMap<_, _>>(); |
| 73 | + run_process( |
| 74 | + &ProcessSpec { |
| 75 | + executable: self.tool.clone(), |
| 76 | + args: args.iter().map(OsString::from).collect(), |
| 77 | + cwd: std::env::temp_dir(), |
| 78 | + env, |
| 79 | + stdin: None, |
| 80 | + deadline: Instant::now() + Duration::from_secs(15), |
| 81 | + output_limit_bytes: 64 * 1024, |
| 82 | + }, |
| 83 | + &AtomicBool::new(false), |
| 84 | + ) |
| 85 | + } |
| 86 | +} |
| 87 | +impl Drop for PostgresFixture { |
| 88 | + fn drop(&mut self) { |
| 89 | + if let Some(id) = &self.id { |
| 90 | + let _ = self.run(&["rm", "--force", id]); |
| 91 | + } |
| 92 | + } |
| 93 | +} |
| 94 | + |
| 95 | +#[test] |
| 96 | +#[ignore = "requires explicit CODEGUARD_DOCKER_TOOL and already cached pinned PostgreSQL image; never pulls"] |
| 97 | +fn isolated_native_postgres_confirms_empty_projection_and_distinct_counterexample() { |
| 98 | + let tool = |
| 99 | + PathBuf::from(std::env::var_os("CODEGUARD_DOCKER_TOOL").expect("explicit Docker path")); |
| 100 | + assert!(tool.is_absolute()); |
| 101 | + let mut fixture = PostgresFixture { tool, id: None }; |
| 102 | + let evidence = oracle(); |
| 103 | + let image = evidence["image_id"].as_str().unwrap(); |
| 104 | + let existing = fixture.run(&["image", "inspect", "--format", "{{.Id}}", image]); |
| 105 | + assert_eq!(existing.termination, Termination::Exited(0)); |
| 106 | + assert_eq!(String::from_utf8(existing.stdout).unwrap().trim(), image); |
| 107 | + let name = format!( |
| 108 | + "codeguard-pg-oracle-{}-{}", |
| 109 | + std::process::id(), |
| 110 | + SystemTime::now() |
| 111 | + .duration_since(UNIX_EPOCH) |
| 112 | + .unwrap() |
| 113 | + .as_nanos() |
| 114 | + ); |
| 115 | + let started = fixture.run(&[ |
| 116 | + "run", |
| 117 | + "--detach", |
| 118 | + "--rm", |
| 119 | + "--pull=never", |
| 120 | + "--network", |
| 121 | + "none", |
| 122 | + "--name", |
| 123 | + &name, |
| 124 | + "--tmpfs", |
| 125 | + "/var/lib/postgresql:rw", |
| 126 | + "-e", |
| 127 | + "PGDATA=/var/lib/postgresql/data", |
| 128 | + "-e", |
| 129 | + "POSTGRES_HOST_AUTH_METHOD=trust", |
| 130 | + image, |
| 131 | + ]); |
| 132 | + assert_eq!( |
| 133 | + started.termination, |
| 134 | + Termination::Exited(0), |
| 135 | + "{:?}", |
| 136 | + started.stderr |
| 137 | + ); |
| 138 | + let id = String::from_utf8(started.stdout).unwrap().trim().to_owned(); |
| 139 | + assert!(id.len() == 64 && id.bytes().all(|b| b.is_ascii_hexdigit())); |
| 140 | + fixture.id = Some(id.clone()); |
| 141 | + let mut ready = false; |
| 142 | + for _ in 0..40 { |
| 143 | + if fixture |
| 144 | + .run(&["exec", &id, "pg_isready", "-U", "postgres"]) |
| 145 | + .termination |
| 146 | + == Termination::Exited(0) |
| 147 | + { |
| 148 | + ready = true; |
| 149 | + break; |
| 150 | + } |
| 151 | + std::thread::sleep(Duration::from_millis(250)); |
| 152 | + } |
| 153 | + assert!(ready, "isolated server readiness exceeded"); |
| 154 | + let version = fixture.run(&["exec", &id, "postgres", "--version"]); |
| 155 | + assert_eq!(version.termination, Termination::Exited(0)); |
| 156 | + assert_eq!( |
| 157 | + String::from_utf8(version.stdout).unwrap().trim(), |
| 158 | + evidence["server_version"].as_str().unwrap() |
| 159 | + ); |
| 160 | + for case in evidence["cases"].as_array().unwrap() { |
| 161 | + let sql = format!( |
| 162 | + "CREATE TEMP TABLE users (id integer); PREPARE codeguard_case AS {};", |
| 163 | + case["source"].as_str().unwrap() |
| 164 | + ); |
| 165 | + let result = fixture.run(&[ |
| 166 | + "exec", |
| 167 | + &id, |
| 168 | + "psql", |
| 169 | + "-X", |
| 170 | + "-U", |
| 171 | + "postgres", |
| 172 | + "-v", |
| 173 | + "ON_ERROR_STOP=1", |
| 174 | + "-v", |
| 175 | + "VERBOSITY=verbose", |
| 176 | + "-c", |
| 177 | + &sql, |
| 178 | + ]); |
| 179 | + assert_eq!( |
| 180 | + result.termination, |
| 181 | + Termination::Exited(case["native_exit_code"].as_i64().unwrap() as i32) |
| 182 | + ); |
| 183 | + if case["native_valid"] == false { |
| 184 | + assert!(String::from_utf8(result.stderr).unwrap().contains("42601")); |
| 185 | + } |
| 186 | + } |
| 187 | + let removed = fixture.run(&["rm", "--force", &id]); |
| 188 | + assert_eq!(removed.termination, Termination::Exited(0)); |
| 189 | + fixture.id = None; |
| 190 | +} |
| 191 | + |
| 192 | +#[cfg(all(feature = "wasm-precheck", unix))] |
| 193 | +#[test] |
| 194 | +fn current_cfquery_worker_preserves_real_native_disagreement_without_fake_clean() { |
| 195 | + let evidence = oracle(); |
| 196 | + let directory = std::env::temp_dir() |
| 197 | + .canonicalize() |
| 198 | + .unwrap() |
| 199 | + .join(format!("cg-cfquery-dialect-{}", std::process::id())); |
| 200 | + std::fs::create_dir(&directory).unwrap(); |
| 201 | + for case in evidence["cases"].as_array().unwrap() { |
| 202 | + let source = directory.join(format!("{}.sql", case["id"].as_str().unwrap())); |
| 203 | + std::fs::write(&source, case["source"].as_str().unwrap()).unwrap(); |
| 204 | + let output = std::process::Command::new(env!("CARGO_BIN_EXE_codeguard")) |
| 205 | + .args(["grammar", "probe", "cfquery"]) |
| 206 | + .arg(&source) |
| 207 | + .arg("--format=json") |
| 208 | + .output() |
| 209 | + .unwrap(); |
| 210 | + assert_eq!(output.status.code(), Some(3)); |
| 211 | + let report: Value = serde_json::from_slice(&output.stdout).unwrap(); |
| 212 | + assert_eq!(report["source_sha256"], case["source_sha256"]); |
| 213 | + if case["native_valid"] == true { |
| 214 | + assert_eq!(report["recoveries"], serde_json::json!([])); |
| 215 | + } |
| 216 | + assert_eq!(report["status"], "incomplete"); |
| 217 | + assert_eq!(report["grammar_qualified"], false); |
| 218 | + assert_eq!(report["delivery_decision"], "not_evaluated"); |
| 219 | + } |
| 220 | + std::fs::remove_dir_all(directory).unwrap(); |
| 221 | +} |
0 commit comments