fix(just): run the integration suites as the superuser role #496

Merged

longjacksonle merged 1 commit from fix/test-integration-createdb-role into main

2026-08-06 20:00:00 +02:00

longjacksonle commented

2026-08-06 19:50:40 +02:00

Owner

just test-integration and just verify-demo currently fail at test setup against any dev stack whose database roles have been provisioned:

failed to connect to setup test database: PgDatabaseError { code: "42501", message: "permission denied to create database" }

Cause

#[sqlx::test] creates a database per test. The compose server service exports a DATABASE_URL that connects as mokosh_migrator, and PMS-489 provisions that role with LOGIN BYPASSRLS and deliberately without CREATEDB (src/db/provision.rs). So the role the recipes use cannot do the one thing the test harness requires.

CI never surfaced this because .forgejo/workflows/integration.yml points DATABASE_URL at the postgres superuser. The recipes carry a comment claiming they mirror that workflow one-to-one, and they had quietly stopped doing so: the comment even asserted that "the server dev service already exports a usable DATABASE_URL", which is what makes the failure read as a broken local environment rather than a recipe bug.

The failure is invisible on a fresh clone and appears only once the roles exist, which is why it survived: just dev provisions them on first boot, so the recipes work right up until the stack has been started once.

Fix

Both recipes override DATABASE_URL to MOKOSH_ADMIN_DATABASE_URL for the duration of the run, which restores the true one-to-one mirror of integration.yml. The override is expanded inside the container, so the credential stays in the compose environment and never reaches the host shell or a process listing.

The stale comment is replaced with a note explaining the override and naming the error, so the next person to hit 42501 finds the reason next to the code that causes it.

Alternative rejected

Granting CREATEDB to mokosh_migrator in provision.rs would also make the suites pass, but that role holds the same privileges in staging and production as it does locally. Widening a production role to suit a local test runner is the wrong trade, and it would erode the PMS-489 split that keeps the migrator role narrow on purpose.

Verification

just verify-demo: green (seed_demo 8/8, plus data_transfer).
just test-integration: green end to end, 713 passed, 0 failed, 71 test binaries, recipe exit 0.
Confirmed the pre-fix failure mode first: the same suite on this stack returned 42501 before the change, and 28P01 before that when the roles did not yet exist at all.

`just test-integration` and `just verify-demo` currently fail at test setup against any dev stack whose database roles have been provisioned: ``` failed to connect to setup test database: PgDatabaseError { code: "42501", message: "permission denied to create database" } ``` ## Cause `#[sqlx::test]` creates a database per test. The compose `server` service exports a DATABASE_URL that connects as `mokosh_migrator`, and PMS-489 provisions that role with `LOGIN BYPASSRLS` and deliberately without `CREATEDB` (`src/db/provision.rs`). So the role the recipes use cannot do the one thing the test harness requires. CI never surfaced this because `.forgejo/workflows/integration.yml` points DATABASE_URL at the postgres superuser. The recipes carry a comment claiming they mirror that workflow one-to-one, and they had quietly stopped doing so: the comment even asserted that "the `server` dev service already exports a usable DATABASE_URL", which is what makes the failure read as a broken local environment rather than a recipe bug. The failure is invisible on a fresh clone and appears only once the roles exist, which is why it survived: `just dev` provisions them on first boot, so the recipes work right up until the stack has been started once. ## Fix Both recipes override DATABASE_URL to `MOKOSH_ADMIN_DATABASE_URL` for the duration of the run, which restores the true one-to-one mirror of integration.yml. The override is expanded inside the container, so the credential stays in the compose environment and never reaches the host shell or a process listing. The stale comment is replaced with a note explaining the override and naming the error, so the next person to hit `42501` finds the reason next to the code that causes it. ## Alternative rejected Granting `CREATEDB` to `mokosh_migrator` in `provision.rs` would also make the suites pass, but that role holds the same privileges in staging and production as it does locally. Widening a production role to suit a local test runner is the wrong trade, and it would erode the PMS-489 split that keeps the migrator role narrow on purpose. ## Verification - `just verify-demo`: green (`seed_demo` 8/8, plus `data_transfer`). - `just test-integration`: green end to end, 713 passed, 0 failed, 71 test binaries, recipe exit 0. - Confirmed the pre-fix failure mode first: the same suite on this stack returned `42501` before the change, and `28P01` before that when the roles did not yet exist at all.

longjacksonle added 1 commit

2026-08-06 19:50:41 +02:00

fix(just): run the integration suites as the superuser role

Check / fmt + clippy + build + tests (pull_request) Successful in 2m21s

Details

Integration / integration tests (pull_request) Successful in 5m51s

Details

E2E / Playwright against staging (pull_request) Failing after 6m28s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

955283b831

`just test-integration` and `just verify-demo` fail at test setup with `42501 permission denied to create database` against any dev stack whose roles have been provisioned. `#[sqlx::test]` creates a database per test, but the `server` service's DATABASE_URL connects as `mokosh_migrator`, which PMS-489 provisions with `LOGIN BYPASSRLS` and deliberately without `CREATEDB` (src/db/provision.rs).

CI never hit this because integration.yml points DATABASE_URL at the postgres superuser, so the recipes had quietly stopped mirroring the workflow they claim to mirror. Both now override DATABASE_URL to MOKOSH_ADMIN_DATABASE_URL for the duration of the run, expanded inside the container so the credential stays in the compose environment instead of reaching the host shell.

Granting CREATEDB to `mokosh_migrator` would also make the suites pass, but that role's privileges are the same ones it holds in staging and production, so widening them to suit a local test runner is the wrong trade.

The stale claim that "the `server` dev service already exports a usable DATABASE_URL" is replaced with a note explaining the override, since that comment is what made the breakage look like a local environment fault.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011myibMMwyb6za3GVWJGkiX

longjacksonle scheduled this pull request to auto merge when all checks succeed

2026-08-06 19:51:39 +02:00