feat(usable): integrate current dbtool implementation snapshot

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-02 08:26:18 +00:00
parent a28dab4cd9
commit d5f69462b0
73 changed files with 5895 additions and 322 deletions
--- a/scripts/qa/run-failure-path-evidence-sidecar.sh
+++ b/scripts/qa/run-failure-path-evidence-sidecar.sh
@@ -19,7 +19,8 @@ sidecar_image="${QA_SIDECAR_IMAGE:-paperclip-local-db-codex}"
 docker_network="${QA_DOCKER_NETWORK:-dbtool-cli-v1_default}"
 postgres_container="${QA_POSTGRES_CONTAINER:-dbtool-cli-v1-postgres-1}"
 mysql_container="${QA_MYSQL_CONTAINER:-dbtool-cli-v1-mysql-1}"
-postgres_user="${QA_POSTGRES_USER:-dbtool}"
+postgres_admin_user="${QA_POSTGRES_ADMIN_USER:-postgres}"
+postgres_admin_password="${QA_POSTGRES_ADMIN_PASSWORD:-dbtoolroot}"
 postgres_db="${QA_POSTGRES_DB:-dbtool_demo}"
 mysql_root_password="${QA_MYSQL_ROOT_PASSWORD:-dbtoolroot}"
 sidecar_root="/tmp/work"
@@ -42,8 +43,8 @@ mkdir -p "$output_dir"

 docker image inspect "$sidecar_image" >/dev/null

-docker exec -i "$postgres_container" \
-  psql -v ON_ERROR_STOP=1 -U "$postgres_user" -d "$postgres_db" \
+docker exec -e "PGPASSWORD=$postgres_admin_password" -i "$postgres_container" \
+  psql -v ON_ERROR_STOP=1 -U "$postgres_admin_user" -d "$postgres_db" \
  < "$root_dir/examples/fixtures/postgres/init.sql" >/dev/null

 docker exec -i "$mysql_container" \
@@ -78,10 +79,10 @@ docker exec \
  -e QA_EXECUTION_PATH=sidecar \
  -e QA_COMMIT_SHA="$commit_sha" \
  -e QA_BRANCH_NAME="$branch_name" \
-  -e DBTOOL_POSTGRES_HOST=postgres \
+  -e DBTOOL_POSTGRES_HOST="${DBTOOL_POSTGRES_HOST:-$postgres_container}" \
  -e DBTOOL_POSTGRES_PORT=5432 \
  -e DBTOOL_POSTGRES_NET_PORT=59999 \
-  -e DBTOOL_MYSQL_HOST=mysql \
+  -e DBTOOL_MYSQL_HOST="${DBTOOL_MYSQL_HOST:-$mysql_container}" \
  -e DBTOOL_MYSQL_PORT=3306 \
  -e DBTOOL_MYSQL_NET_PORT=59998 \
  "$cid" \
--- a/scripts/qa/test-failure-path-evidence-format.sh
+++ b/scripts/qa/test-failure-path-evidence-format.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+tmp_dir="$(mktemp -d)"
+output_dir="$tmp_dir/out"
+
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+
+cat >"$tmp_dir/fake-dbtool" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "${1:-}" = "--version" ]; then
+  echo "fake-dbtool 0.1.0"
+  exit 0
+fi
+kind="authentication"
+for arg in "$@"; do
+  case "$arg" in
+    59999|59998)
+      kind="connection"
+      ;;
+    *failing_query.sql)
+      kind="query"
+      ;;
+  esac
+done
+printf '{"status":"error","state":"error","error":{"kind":"%s"}}\n' "$kind"
+exit 2
+EOF
+chmod +x "$tmp_dir/fake-dbtool"
+
+QA_HOST_LABEL="runner-host-01" \
+QA_BINARY_PATH_LABEL="./target/release/dbtool" \
+QA_BINARY_VERSION="dbtool 0.1.0" \
+QA_EXECUTION_PATH="host" \
+QA_COMMIT_SHA="deadbeefcafebabe" \
+QA_BRANCH_NAME="qa-fixture-branch" \
+"$root_dir/scripts/qa/run-failure-path-evidence.sh" \
+  "$tmp_dir/fake-dbtool" \
+  postgres \
+  "$output_dir" >/dev/null
+
+evidence_file="$output_dir/PG-CONN-AUTH-001.md"
+raw_file="$output_dir/PG-CONN-AUTH-001.out"
+[ -f "$evidence_file" ] || {
+  echo "expected evidence markdown not found: $evidence_file" >&2
+  exit 80
+}
+[ -f "$raw_file" ] || {
+  echo "expected raw output file not found: $raw_file" >&2
+  exit 81
+}
+
+expected_lines=(
+  '### PG-CONN-AUTH-001'
+  '- Date (UTC): `'
+  '- Operator: `qa-engineer`'
+  '- Host: `runner-host-01`'
+  '- Execution Path: `host`'
+  '- Binary Path: `./target/release/dbtool`'
+  '- Binary Version: `dbtool 0.1.0`'
+  '- Commit SHA: `deadbeefcafebabe`'
+  '- Branch: `qa-fixture-branch`'
+  '- Driver: `postgres`'
+  '- Scenario ID: `PG-CONN-AUTH-001`'
+  '- Command: `./target/release/dbtool connect --driver postgres'
+  '- Exit Code: `2`'
+  '- Key Output: `status=error, state=error, error.kind=authentication`'
+  'Output (excerpt):'
+  '```'
+  '{"status":"error","state":"error","error":{"kind":"authentication"}}'
+  'Verdict:'
+  '- Expected: non-zero exit, `status=error`, `state=error`, `error.kind=authentication`, no secret leakage'
+  '- Traceability check: `complete` (none)'
+  '- Secret leakage check: `not-detected` (exact)'
+  '- Actual: see output excerpt above'
+  '- Result: `pass`'
+)
+
+last_line=0
+for expected in "${expected_lines[@]}"; do
+  current_line="$(grep -nF -- "$expected" "$evidence_file" | head -n 1 | cut -d: -f1)"
+  if [ -z "$current_line" ]; then
+    echo "missing expected markdown line: $expected" >&2
+    exit 82
+  fi
+  if [ "$current_line" -le "$last_line" ]; then
+    echo "markdown order regression near: $expected" >&2
+    exit 83
+  fi
+  last_line="$current_line"
+done
+
+grep -Fq '{"status":"error","state":"error","error":{"kind":"authentication"}}' "$raw_file" || {
+  echo "raw output file content mismatch" >&2
+  exit 84
+}
+
+echo "failure-path markdown format fixture passed"
--- a/scripts/qa/test-failure-path-evidence-sidecar.sh
+++ b/scripts/qa/test-failure-path-evidence-sidecar.sh
@@ -6,6 +6,7 @@ tmp_dir="$(mktemp -d)"
 state_dir="$tmp_dir/state"
 fake_bin_dir="$tmp_dir/bin"
 output_dir="$tmp_dir/out"
+docker_log="$tmp_dir/docker.log"
 mkdir -p "$state_dir/container_fs" "$fake_bin_dir" "$output_dir"

 cleanup() {
@@ -31,10 +32,13 @@ set -euo pipefail

 state_dir="${MOCK_DOCKER_STATE_DIR:?}"
 container_fs="$state_dir/container_fs"
+docker_log="${MOCK_DOCKER_LOG:?}"

 cmd="${1:?}"
 shift

+printf '%s %s\n' "$cmd" "$*" >>"$docker_log"
+
 copy_into_container() {
  local src="$1"
  local dest="$2"
@@ -143,6 +147,7 @@ chmod +x "$fake_bin_dir/docker"

 export PATH="$fake_bin_dir:$PATH"
 export MOCK_DOCKER_STATE_DIR="$state_dir"
+export MOCK_DOCKER_LOG="$docker_log"
 export QA_HOST_LABEL="runner-host-01"
 export QA_BINARY_PATH_LABEL="./target/release/dbtool"
 export QA_BINARY_VERSION="dbtool 0.1.0"
@@ -157,12 +162,34 @@ evidence_file="$output_dir/PG-CONN-AUTH-001.md"
  exit 95
 }

-grep -Fq 'Host: `runner-host-01`' "$evidence_file"
-grep -Fq 'Execution Path: `sidecar`' "$evidence_file"
-grep -Fq 'Binary Path: `./target/release/dbtool`' "$evidence_file"
-grep -Fq 'Binary Version: `dbtool 0.1.0`' "$evidence_file"
-grep -Fq 'Commit SHA: `' "$evidence_file"
-grep -Fq 'Branch: `' "$evidence_file"
-grep -Fq 'Result: `pass`' "$evidence_file"
+grep -Fq 'exec -e PGPASSWORD=dbtoolroot -i dbtool-cli-v1-postgres-1 psql -v ON_ERROR_STOP=1 -U postgres -d dbtool_demo' "$docker_log" || {
+  echo "expected sidecar helper to reseed postgres with admin credentials" >&2
+  exit 98
+}
+
+expected_lines=(
+  '### PG-CONN-AUTH-001'
+  '- Host: `runner-host-01`'
+  '- Execution Path: `sidecar`'
+  '- Binary Path: `./target/release/dbtool`'
+  '- Binary Version: `dbtool 0.1.0`'
+  '- Commit SHA: `'
+  '- Branch: `'
+  '- Result: `pass`'
+)
+
+last_line=0
+for expected in "${expected_lines[@]}"; do
+  current_line="$(grep -nF -- "$expected" "$evidence_file" | head -n 1 | cut -d: -f1)"
+  if [ -z "$current_line" ]; then
+    echo "missing expected sidecar markdown line: $expected" >&2
+    exit 96
+  fi
+  if [ "$current_line" -le "$last_line" ]; then
+    echo "sidecar markdown order regression near: $expected" >&2
+    exit 97
+  fi
+  last_line="$current_line"
+done

 echo "sidecar helper fixture passed"
--- a/scripts/qa/test-failure-path-fixtures.sh
+++ b/scripts/qa/test-failure-path-fixtures.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -gt 1 ]; then
+  echo "usage: scripts/qa/test-failure-path-fixtures.sh [format|sidecar|all]" >&2
+  exit 2
+fi
+
+scope="${1:-all}"
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+run_fixture() {
+  local label="$1"
+  local script_path="$2"
+
+  echo "==> ${label}"
+  "$script_path"
+}
+
+case "$scope" in
+  format)
+    run_fixture "failure-path markdown format fixture" \
+      "$root_dir/scripts/qa/test-failure-path-evidence-format.sh"
+    ;;
+  sidecar)
+    run_fixture "failure-path sidecar fixture" \
+      "$root_dir/scripts/qa/test-failure-path-evidence-sidecar.sh"
+    ;;
+  all)
+    run_fixture "failure-path markdown format fixture" \
+      "$root_dir/scripts/qa/test-failure-path-evidence-format.sh"
+    run_fixture "failure-path sidecar fixture" \
+      "$root_dir/scripts/qa/test-failure-path-evidence-sidecar.sh"
+    ;;
+  *)
+    echo "error: scope must be one of: format, sidecar, all" >&2
+    exit 3
+    ;;
+esac
+
+echo "all requested failure-path fixtures passed"
--- a/scripts/tui/demo-stack.sh
+++ b/scripts/tui/demo-stack.sh
@@ -64,9 +64,8 @@ run_postgres_container() {
    --network "$DEMO_NETWORK_NAME" \
    -p 55432:5432 \
    -e POSTGRES_DB=dbtool_demo \
-    -e POSTGRES_USER=dbtool \
-    -e POSTGRES_PASSWORD=dbtool \
-    --health-cmd 'pg_isready -U dbtool -d dbtool_demo' \
+    -e POSTGRES_PASSWORD=dbtoolroot \
+    --health-cmd 'pg_isready -U postgres -d dbtool_demo' \
    --health-interval 5s \
    --health-timeout 5s \
    --health-retries 20 \