(
+ token,
+ `runs?id=eq.${selected}&select=*,run_steps(*),completions(*)&run_steps.order=step_number.asc`,
+ { signal },
+ ),
+ });
+ const mutation = useMutation({
+ mutationFn: (next: Action) => submit(token, next),
+ onSuccess: async (result, submitted) => {
+ setSuccess(
+ submitted.kind === "start"
+ ? "Run started. Your checklist is ready."
+ : "Step completion confirmed.",
+ );
+ if (submitted.kind === "start") {
+ setSelected(result.run_id);
+ setLabel("");
+ }
+ await Promise.all([
+ client.invalidateQueries({ queryKey: ["runs"] }),
+ client.invalidateQueries({ queryKey: ["run", result.run_id] }),
+ ]);
+ setAction(null);
+ },
+ });
+
+ function send(next: Action) {
+ setSuccess("");
+ setAction(next);
+ mutation.mutate(next);
+ }
+
+ function start(event: FormEvent) {
+ event.preventDefault();
+ if (action) return;
+ send({
+ kind: "start",
+ payload: {
+ p_request_id: crypto.randomUUID(),
+ p_template_id: templateId || templates.data?.[0]?.id || "",
+ p_label: label,
+ },
+ });
+ }
+
+ const readError = templates.error || runs.error || detail.error;
+ const current = detail.data?.[0];
+ return (
+ <>
+ {readError && (
+
+ {readError.message}{" "}
+
+
+ )}
+ {success && (
+
+ {success}
+
+ )}
+ {mutation.isPending && (
+
+ Confirming your action…
+
+ )}
+ {mutation.error && action && (
+
+ {mutation.error.message}
+
+ Retry sends the same request key and captured details. A missing
+ response does not prove the action failed.
+
+
+
+ Request key: {action.payload.p_request_id}
+
+ )}
+
+
+
+ {selected === null ? (
+
+
Ready when you are
+
Choose a run
+
Pick a run to see its saved checklist and completion notes.
+
Loading checklist…
+ ) : !current ? (
+
+ No accessible run was found. Refresh the list or choose another
+ run.
+
+ ) : (
+
+ send({
+ kind: "complete",
+ payload: {
+ p_request_id: crypto.randomUUID(),
+ p_run_id: current.id,
+ p_step_number: step,
+ p_note: note,
+ },
+ })
+ }
+ />
+ )}
+
+
+ Token and cached results exist only for this connection. Disconnecting
+ does not revoke the token or undo an action already sent.
+
+
+ );
+}
+
+function RunView({
+ run,
+ disabled,
+ complete,
+}: {
+ run: RunDetail;
+ disabled: boolean;
+ complete: (step: number, note: string) => void;
+}) {
+ return (
+ <>
+
+ Saved checklist · version {run.template_version}
+
+
+
+
{run.label}
+
{run.template_title}
+
+
+ {run.completed_at ? "Completed" : "Open"}
+
+
+
+ {run.completed_steps} of {run.total_steps} steps complete
+
+
+
+ {run.completed_at && (
+ This run is complete. Its record is retained.
+ )}
+
+ {run.run_steps.map((step) => {
+ const completion = run.completions.find(
+ (c) => c.step_number === step.step_number,
+ );
+ return (
+ complete(step.step_number, note)}
+ />
+ );
+ })}
+
+
+ );
+}
+
+function StepCard({
+ title,
+ number,
+ note,
+ done,
+ disabled,
+ complete,
+}: {
+ title: string;
+ number: number;
+ note?: string;
+ done: boolean;
+ disabled: boolean;
+ complete: (note: string) => void;
+}) {
+ const [draft, setDraft] = useState("");
+ return (
+
+
+ {done ? "✓" : number}
+
{title}
+
+ {done ? (
+ <>
+ Completion confirmed
+ {note || "No note added."}
+
+ ) : (
+
+ )}
+
+ );
+}
+
+createRoot(document.getElementById("root")!).render(
+
+
+ ,
+);
diff --git a/applications/checklist-runs/src/style.css b/applications/checklist-runs/src/style.css
new file mode 100644
index 00000000..2dd4c1c8
--- /dev/null
+++ b/applications/checklist-runs/src/style.css
@@ -0,0 +1,330 @@
+:root {
+ font-family: ui-sans-serif, system-ui, sans-serif;
+ color: #193b3a;
+ background: #f1f4ef;
+ font-synthesis: none;
+ line-height: 1.5;
+}
+* {
+ box-sizing: border-box;
+}
+body {
+ margin: 0;
+}
+main {
+ max-width: 1180px;
+ margin: auto;
+ padding: 42px 30px 20px;
+}
+h1,
+h2,
+h3,
+p {
+ margin: 0 0 12px;
+}
+h1 {
+ font-size: clamp(2rem, 5vw, 3rem);
+ line-height: 1.1;
+ letter-spacing: -0.04em;
+}
+h2 {
+ font-size: 1.45rem;
+ letter-spacing: -0.02em;
+}
+h3 {
+ font-size: 1rem;
+ margin: 0;
+}
+.masthead {
+ display: flex;
+ align-items: flex-start;
+ justify-content: space-between;
+ gap: 22px;
+ margin-bottom: 30px;
+}
+.masthead p {
+ max-width: 560px;
+ color: #526664;
+ margin-top: 16px;
+}
+.eyebrow {
+ display: block;
+ text-transform: uppercase;
+ letter-spacing: 0.13em;
+ font-size: 0.7rem;
+ font-weight: 750;
+ color: #567e70;
+ margin-bottom: 10px;
+}
+.card {
+ background: #fff;
+ border: 1px solid #dae3da;
+ border-radius: 18px;
+ padding: 26px;
+ box-shadow: 0 5px 22px #23352c05;
+}
+.workspace {
+ display: grid;
+ grid-template-columns: 340px 1fr;
+ gap: 24px;
+ align-items: start;
+}
+aside {
+ display: grid;
+ gap: 22px;
+}
+.connect {
+ max-width: 580px;
+ margin: 48px auto 100px;
+}
+.connect p {
+ margin-bottom: 24px;
+}
+form {
+ display: grid;
+ gap: 10px;
+}
+label {
+ font-size: 0.85rem;
+ font-weight: 650;
+ margin-top: 5px;
+}
+input,
+select {
+ width: 100%;
+ min-height: 44px;
+ font: inherit;
+ background: #fff;
+ border: 1px solid #b7c9c0;
+ border-radius: 8px;
+ padding: 9px 12px;
+ color: #193b3a;
+}
+input:focus,
+select:focus {
+ outline: 3px solid #c6ead9;
+ outline-offset: 1px;
+}
+button {
+ font: inherit;
+ font-size: 0.85rem;
+ font-weight: 650;
+ min-height: 42px;
+ cursor: pointer;
+ color: #fff;
+ border: 1px solid #215650;
+ background: #215650;
+ border-radius: 8px;
+ padding: 10px 16px;
+}
+form > button {
+ margin-top: 8px;
+}
+button:hover:not(:disabled) {
+ filter: brightness(0.94);
+}
+button:disabled {
+ opacity: 0.5;
+ cursor: default;
+}
+button.secondary {
+ color: #215650;
+ background: #fff;
+ border-color: #bfd0c7;
+}
+button.inline {
+ background: none;
+ color: #215650;
+ padding: 4px;
+ min-height: 34px;
+ border: 0;
+ text-decoration: underline;
+}
+.muted {
+ color: #61736d;
+ font-weight: 400;
+}
+.tiny {
+ font-size: 0.75rem;
+ margin: 14px 0 0;
+}
+.notice {
+ padding: 16px 20px;
+ border-radius: 10px;
+ background: #e3ede6;
+ margin-bottom: 20px;
+ overflow-wrap: anywhere;
+}
+.error {
+ color: #7e3632;
+ background: #fff0ec;
+}
+.error button {
+ margin-right: 8px;
+ margin-bottom: 10px;
+}
+.error small {
+ display: block;
+}
+.success {
+ color: #246b49;
+}
+.section-head {
+ display: flex;
+ align-items: start;
+ justify-content: space-between;
+ gap: 15px;
+}
+.run-list ul,
+.steps {
+ list-style: none;
+ padding: 0;
+ margin: 0;
+}
+.run-list li {
+ margin-bottom: 9px;
+}
+button.run {
+ width: 100%;
+ text-align: left;
+ display: grid;
+ gap: 3px;
+ color: #284842;
+ background: #f6f8f4;
+ border-color: #e3e9e1;
+}
+button.run strong {
+ overflow-wrap: anywhere;
+}
+button.run span,
+button.run small {
+ font-weight: 400;
+ font-size: 0.78rem;
+}
+button.run.selected {
+ background: #e2f0e7;
+ border-color: #90b9a4;
+}
+.pagination {
+ display: flex;
+ justify-content: space-between;
+ gap: 10px;
+ margin-top: 18px;
+}
+.pagination button {
+ font-size: 0.75rem;
+ padding: 8px 10px;
+}
+.detail {
+ min-height: 440px;
+ padding: 30px;
+}
+.empty {
+ text-align: center;
+ margin: 95px auto;
+ max-width: 290px;
+ color: #56706a;
+}
+.badge {
+ font-size: 0.7rem;
+ font-weight: 700;
+ border-radius: 20px;
+ padding: 6px 12px;
+ background: #eef0e7;
+ color: #687047;
+ white-space: nowrap;
+}
+.badge.done {
+ background: #dff1e6;
+ color: #2b6e4b;
+}
+.progress-label {
+ font-size: 0.85rem;
+ margin: 18px 0 8px;
+}
+progress {
+ width: 100%;
+ height: 9px;
+ accent-color: #327e61;
+ margin-bottom: 24px;
+}
+.steps {
+ display: grid;
+ gap: 16px;
+}
+.step {
+ border: 1px solid #dde6dd;
+ border-radius: 12px;
+ padding: 19px;
+}
+.step.complete {
+ background: #f4faf5;
+}
+.step-heading {
+ display: flex;
+ align-items: center;
+ gap: 12px;
+ margin-bottom: 15px;
+}
+.step-number {
+ display: grid;
+ place-items: center;
+ background: #e9f0e8;
+ border-radius: 50%;
+ width: 28px;
+ height: 28px;
+ flex-shrink: 0;
+ font-size: 0.8rem;
+ font-weight: 700;
+}
+.completion-label {
+ color: #327052;
+ font-size: 0.73rem;
+ font-weight: 750;
+ display: block;
+ margin-bottom: 5px;
+}
+.step p {
+ margin: 0;
+ overflow-wrap: anywhere;
+}
+.connection-note {
+ margin: 23px 0;
+ font-size: 0.78rem;
+}
+footer {
+ text-align: center;
+ color: #7d8e82;
+ font-size: 0.75rem;
+ margin-top: 38px;
+ padding: 20px 0;
+}
+@media (max-width: 740px) {
+ main {
+ padding: 25px 16px 12px;
+ }
+ .workspace {
+ grid-template-columns: 1fr;
+ gap: 20px;
+ }
+ .masthead {
+ gap: 12px;
+ }
+ .masthead button {
+ padding: 8px 10px;
+ font-size: 0.75rem;
+ }
+ .card,
+ .detail {
+ padding: 22px;
+ }
+ .connect {
+ margin: 24px auto 50px;
+ }
+ .empty {
+ margin: 45px auto;
+ }
+ .notice {
+ padding: 15px;
+ }
+}
diff --git a/applications/checklist-runs/src/vite-env.d.ts b/applications/checklist-runs/src/vite-env.d.ts
new file mode 100644
index 00000000..11f02fe2
--- /dev/null
+++ b/applications/checklist-runs/src/vite-env.d.ts
@@ -0,0 +1 @@
+///
diff --git a/applications/checklist-runs/tests/acceptance.py b/applications/checklist-runs/tests/acceptance.py
new file mode 100644
index 00000000..d980abc8
--- /dev/null
+++ b/applications/checklist-runs/tests/acceptance.py
@@ -0,0 +1,419 @@
+"""Real HTTP/RLS/transaction controls against an explicitly disposable Cloud fixture."""
+
+from concurrent.futures import ThreadPoolExecutor
+import hashlib
+import hmac
+import importlib.util
+import json
+import os
+from pathlib import Path
+import time
+import unittest
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+import psycopg
+
+spec = importlib.util.spec_from_file_location(
+ "tokens", Path(__file__).parents[1] / "scripts/tokens.py"
+)
+tokens = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(tokens)
+BASE = os.environ.get("API_BASE_URL", "http://127.0.0.1:3000")
+TEMPLATE = "10000000-0000-4000-8000-000000000001"
+SECRET = os.environ["PGRST_JWT_SECRET"]
+
+
+def signed(claims, secret=SECRET):
+ values = [{"alg": "HS256", "typ": "JWT"}, claims]
+ body = ".".join(
+ tokens.b64url(json.dumps(v, separators=(",", ":")).encode()) for v in values
+ )
+ return (
+ body
+ + "."
+ + tokens.b64url(
+ hmac.new(secret.encode(), body.encode(), hashlib.sha256).digest()
+ )
+ )
+
+
+def call(path, token=None, payload=None, method=None, headers=None):
+ request_headers = {"Authorization": "Bearer " + token} if token else {}
+ request_headers.update(headers or {})
+ data = None if payload is None else json.dumps(payload).encode()
+ if data is not None:
+ request_headers["Content-Type"] = "application/json"
+ request = urllib.request.Request(
+ BASE + "/" + path, data=data, headers=request_headers, method=method
+ )
+ try:
+ response = urllib.request.urlopen(request, timeout=30)
+ except urllib.error.HTTPError as error:
+ response = error
+ raw = response.read()
+ return response.status, json.loads(raw) if raw else None, dict(response.headers)
+
+
+def owner():
+ return psycopg.connect(
+ user=os.environ["TEST_OWNER_USER"], password=os.environ["TEST_OWNER_PASSWORD"]
+ )
+
+
+def wait_for_blockers(connection, count=2):
+ blocker = connection.info.backend_pid
+ deadline = time.monotonic() + 4
+ while time.monotonic() < deadline:
+ observed = connection.execute(
+ """WITH RECURSIVE blockers(request_pid, blocked_by) AS (
+ SELECT DISTINCT pid, unnest(pg_blocking_pids(pid)) FROM pg_locks WHERE NOT granted
+ UNION
+ SELECT b.request_pid, unnest(pg_blocking_pids(b.blocked_by)) FROM blockers b
+ ) SELECT count(DISTINCT request_pid) FROM blockers WHERE blocked_by = %s""",
+ (blocker,),
+ ).fetchone()[0]
+ if observed >= count:
+ print(
+ f"Observed {observed} independent HTTP transactions blocked by owner PID {blocker}.",
+ flush=True,
+ )
+ return
+ time.sleep(0.05)
+ raise AssertionError("Competing HTTP work did not reach the held database lock.")
+
+
+class CloudAcceptance(unittest.TestCase):
+ @classmethod
+ def setUpClass(cls):
+ cls.north = tokens.issue(SECRET, "checklist_north")
+ cls.south = tokens.issue(SECRET, "checklist_south")
+
+ def start(self, label, key=None, token=None):
+ payload = {
+ "p_request_id": key or str(uuid.uuid4()),
+ "p_template_id": TEMPLATE,
+ "p_label": label,
+ }
+ status, value, _ = call("rpc/start_run", token or self.north, payload)
+ self.assertEqual(status, 200, value)
+ self.assertIsInstance(value["run_id"], str)
+ return value, payload
+
+ def complete(self, run_id, step, key=None, note="", token=None):
+ payload = {
+ "p_request_id": key or str(uuid.uuid4()),
+ "p_run_id": run_id,
+ "p_step_number": step,
+ "p_note": note,
+ }
+ return call("rpc/complete_step", token or self.north, payload), payload
+
+ def test_01_lifecycle_snapshot_and_retained_results(self):
+ initial, payload = self.start(" Acceptance opening ")
+ status, repeated, _ = call(
+ "rpc/start_run", self.north, {**payload, "p_label": "Acceptance opening"}
+ )
+ self.assertEqual((status, repeated), (200, initial))
+ self.assertEqual(
+ call("rpc/start_run", self.north, {**payload, "p_label": "Changed"})[0], 409
+ )
+ path = (
+ "runs?id=eq."
+ + initial["run_id"]
+ + "&select=*,run_steps(*),completions(*)&run_steps.order=step_number.asc"
+ )
+ status, rows, _ = call(path, self.north)
+ self.assertEqual(status, 200, rows)
+ self.assertEqual(
+ [s["title"] for s in rows[0]["run_steps"]],
+ ["Check lights", "Arrange chairs", "Test display"],
+ )
+ first = None
+ for step in range(1, 4):
+ (status, result, _), completion_payload = self.complete(
+ initial["run_id"], step, note=" Checked "
+ )
+ self.assertEqual(status, 200, result)
+ self.assertEqual(result["completed_steps"], step)
+ if step == 1:
+ first = result, completion_payload
+ self.assertEqual(result["status"], "completed")
+ self.assertEqual(
+ call("rpc/complete_step", self.north, first[1])[:2], (200, first[0])
+ )
+ self.assertEqual(
+ call("rpc/complete_step", self.north, {**first[1], "p_note": "Changed"})[0],
+ 409,
+ )
+ self.assertEqual(self.complete(initial["run_id"], 1)[0][0], 409)
+ self.assertEqual(call("rpc/start_run", self.north, payload)[:2], (200, initial))
+ final = call(path, self.north)[1][0]
+ self.assertEqual((final["completed_steps"], len(final["completions"])), (3, 3))
+
+ def test_02_competing_matching_starts(self):
+ payload = {
+ "p_request_id": str(uuid.uuid4()),
+ "p_template_id": TEMPLATE,
+ "p_label": "Concurrent start",
+ }
+ with owner() as connection, ThreadPoolExecutor(max_workers=2) as workers:
+ connection.execute(
+ "SELECT 1 FROM checklist_storage.operators WHERE role_name = 'checklist_north' FOR UPDATE"
+ )
+ requests = [
+ workers.submit(call, "rpc/start_run", self.north, payload)
+ for _ in range(2)
+ ]
+ wait_for_blockers(connection)
+ connection.commit()
+ responses = [request.result() for request in requests]
+ self.assertEqual([r[0] for r in responses], [200, 200], responses)
+ self.assertEqual(responses[0][1], responses[1][1])
+ with owner() as connection:
+ count = connection.execute(
+ "SELECT count(*) FROM checklist_storage.runs WHERE operator_role = 'checklist_north' AND request_id = %s",
+ (payload["p_request_id"],),
+ ).fetchone()[0]
+ self.assertEqual(count, 1)
+
+ def test_03_competing_completions_increment_once(self):
+ run, _ = self.start("Concurrent completion")
+ payload = {
+ "p_request_id": str(uuid.uuid4()),
+ "p_run_id": run["run_id"],
+ "p_step_number": 1,
+ "p_note": "One retained note",
+ }
+ with owner() as connection, ThreadPoolExecutor(max_workers=2) as workers:
+ connection.execute(
+ "SELECT 1 FROM checklist_storage.runs WHERE id = %s FOR UPDATE",
+ (run["run_id"],),
+ )
+ requests = [
+ workers.submit(call, "rpc/complete_step", self.north, payload)
+ for _ in range(2)
+ ]
+ wait_for_blockers(connection)
+ connection.commit()
+ responses = [request.result() for request in requests]
+ self.assertEqual([r[0] for r in responses], [200, 200], responses)
+ self.assertEqual(responses[0][1], responses[1][1])
+ with owner() as connection:
+ row = connection.execute(
+ "SELECT completed_steps, (SELECT count(*) FROM checklist_storage.completions WHERE run_id = r.id) FROM checklist_storage.runs r WHERE r.id = %s",
+ (run["run_id"],),
+ ).fetchone()
+ self.assertEqual(row, (1, 1))
+ self.assertEqual(self.complete(run["run_id"], 1)[0][0], 409)
+
+ def test_04_after_update_child_failure_rolls_back(self):
+ run, _ = self.start("Rollback control")
+ with owner() as connection:
+ connection.execute(
+ """CREATE FUNCTION checklist_storage.fail_completion() RETURNS trigger
+ LANGUAGE plpgsql SET search_path = pg_catalog AS $$ BEGIN
+ IF NEW.note = 'after-update-failure' THEN RAISE check_violation USING MESSAGE = 'Synthetic child failure'; END IF;
+ RETURN NEW; END; $$"""
+ )
+ connection.execute(
+ "CREATE TRIGGER fail_completion BEFORE INSERT ON checklist_storage.completions FOR EACH ROW EXECUTE FUNCTION checklist_storage.fail_completion()"
+ )
+ try:
+ (status, value, _), payload = self.complete(
+ run["run_id"], 1, note="after-update-failure"
+ )
+ self.assertEqual(status, 400, value)
+ self.assertEqual(value["code"], "23514")
+ with owner() as connection:
+ row = connection.execute(
+ "SELECT completed_steps, (SELECT count(*) FROM checklist_storage.completions WHERE run_id = r.id) FROM checklist_storage.runs r WHERE r.id = %s",
+ (run["run_id"],),
+ ).fetchone()
+ self.assertEqual(row, (0, 0))
+ finally:
+ with owner() as connection:
+ connection.execute(
+ "DROP TRIGGER fail_completion ON checklist_storage.completions"
+ )
+ connection.execute("DROP FUNCTION checklist_storage.fail_completion()")
+ self.assertEqual(call("rpc/complete_step", self.north, payload)[0], 200)
+
+ def test_05_scope_and_exposed_write_denial(self):
+ run, _ = self.start("North private")
+ self.assertEqual(
+ call(
+ "runs?id=eq." + run["run_id"] + "&select=*,run_steps(*),completions(*)",
+ self.south,
+ )[:2],
+ (200, []),
+ )
+ self.assertEqual(
+ call("run_steps?run_id=eq." + run["run_id"], self.south)[:2], (200, [])
+ )
+ self.assertEqual(self.complete(run["run_id"], 1, token=self.south)[0][0], 404)
+ self.assertEqual(call("runs", self.north, {"label": "Direct insert"})[0], 403)
+ self.assertEqual(
+ call("templates", self.north, {"title": "Edited"}, method="PATCH")[0], 403
+ )
+ self.assertEqual(
+ call("runs", self.north, headers={"Accept-Profile": "checklist_storage"})[
+ 0
+ ],
+ 406,
+ )
+ southern, _ = self.start("South private", token=self.south)
+ self.assertNotIn(
+ southern["run_id"], [r["id"] for r in call("rpc/list_runs", self.north)[1]]
+ )
+
+ def test_06_native_jwt_rejections(self):
+ now = int(time.time())
+ good = {
+ "role": "checklist_north",
+ "aud": "checklist-runs",
+ "iat": now,
+ "exp": now + 60,
+ }
+ self.assertEqual(call("templates")[0], 401)
+ cases = [
+ signed(good, "b" * 128),
+ signed({**good, "iat": now - 180, "exp": now - 120}),
+ signed({**good, "aud": "wrong-audience"}),
+ signed({k: v for k, v in good.items() if k != "aud"}),
+ signed({**good, "exp": now + 901}),
+ ]
+ for value in cases:
+ self.assertEqual(call("templates", value)[0], 401)
+ self.assertEqual(
+ call("templates", signed({**good, "role": "checklist_owner"}))[0], 403
+ )
+
+ def test_07_numeric_cursor_exact_bigint_and_get_read_only(self):
+ self.assertEqual(call("rpc/list_runs?p_limit=21", self.north)[0], 422)
+ self.assertEqual(call("rpc/list_runs?p_after=-1", self.north)[0], 422)
+ self.assertLessEqual(len(call("runs?limit=1000", self.north)[1]), 20)
+ with owner() as connection:
+ connection.execute(
+ "ALTER SEQUENCE checklist_storage.runs_id_seq RESTART WITH 9007199254740993"
+ )
+ run, payload = self.start("Exact large ID")
+ self.assertEqual(run["run_id"], "9007199254740993")
+ self.assertEqual(
+ call("rpc/list_runs?p_after=9007199254740992", self.north)[1][0]["id"],
+ run["run_id"],
+ )
+ self.assertEqual(self.complete(run["run_id"], 1)[0][0], 200)
+ params = urllib.parse.urlencode({**payload, "p_request_id": str(uuid.uuid4())})
+ status, value, _ = call("rpc/start_run?" + params, self.north)
+ self.assertEqual(status, 405, value)
+ self.assertEqual(value["code"], "25006")
+ self.assertEqual(
+ call("rpc/start_run", self.north, {**payload, "p_label": "x" * 81})[0], 422
+ )
+ self.assertEqual(
+ call("rpc/start_run", self.north, {**payload, "p_label": "bad\u0001label"})[
+ 0
+ ],
+ 422,
+ )
+
+ def test_09_native_json_and_scalar_boundaries(self):
+ payload = {
+ "p_request_id": str(uuid.uuid4()),
+ "p_template_id": TEMPLATE,
+ "p_label": "Native input boundary",
+ }
+ self.assertEqual(
+ call("rpc/start_run", self.north, {**payload, "p_label": "\ud800"})[0], 400
+ )
+ self.assertEqual(
+ call(
+ "rpc/start_run", self.north, {**payload, "p_template_id": "not-a-uuid"}
+ )[0],
+ 400,
+ )
+ self.assertEqual(
+ call("rpc/start_run", self.north, {**payload, "p_label": None})[0], 422
+ )
+ completion = {
+ "p_request_id": str(uuid.uuid4()),
+ "p_run_id": "1" * 5000,
+ "p_step_number": 1,
+ "p_note": "",
+ }
+ self.assertEqual(call("rpc/complete_step", self.north, completion)[0], 400)
+ with owner() as connection:
+ self.assertEqual(
+ connection.execute(
+ "SELECT count(*) FROM checklist_storage.runs WHERE request_id = %s",
+ (payload["p_request_id"],),
+ ).fetchone()[0],
+ 0,
+ )
+
+ def test_08_authenticator_memberships_roles_and_quota(self):
+ with psycopg.connect() as connection:
+ self.assertEqual(
+ connection.execute(
+ "SELECT rolinherit FROM pg_roles WHERE rolname = current_user"
+ ).fetchone()[0],
+ False,
+ )
+ roles = connection.execute(
+ "SELECT parent.rolname FROM pg_auth_members m JOIN pg_roles parent ON parent.oid = m.roleid JOIN pg_roles child ON child.oid = m.member WHERE child.rolname = current_user ORDER BY parent.rolname"
+ ).fetchall()
+ self.assertEqual(roles, [("checklist_north",), ("checklist_south",)])
+ for sql in (
+ "SET ROLE checklist_owner",
+ "CREATE TABLE public.denied(id int)",
+ "CREATE TEMP TABLE denied(id int)",
+ "SELECT * FROM checklist_storage.runs",
+ ):
+ with self.assertRaises(psycopg.errors.InsufficientPrivilege):
+ connection.execute(sql)
+ connection.rollback()
+ connection.execute("SET ROLE checklist_north")
+ self.assertEqual(
+ connection.execute(
+ "SELECT count(*) FROM checklist_storage.runs WHERE operator_role = 'checklist_south'"
+ ).fetchone()[0],
+ 0,
+ )
+ with self.assertRaises(psycopg.errors.InsufficientPrivilege):
+ connection.execute(
+ "UPDATE checklist_storage.completions SET note = 'edited'"
+ )
+ connection.rollback()
+ with owner() as connection:
+ count = connection.execute(
+ "SELECT count(*) FROM checklist_storage.runs WHERE operator_role = 'checklist_south'"
+ ).fetchone()[0]
+ connection.execute(
+ """INSERT INTO checklist_storage.runs
+ (operator_role, request_id, start_payload, start_result, template_id, template_version,
+ template_title, template_snapshot, label, total_steps)
+ SELECT 'checklist_south', gen_random_uuid(), '{}', '{}', t.id, t.version,
+ t.title, t.steps, 'quota-fixture', jsonb_array_length(t.steps)
+ FROM checklist_storage.templates t CROSS JOIN generate_series(1, %s)
+ WHERE t.id = %s""",
+ (100 - count, TEMPLATE),
+ )
+ try:
+ payload = {
+ "p_request_id": str(uuid.uuid4()),
+ "p_template_id": TEMPLATE,
+ "p_label": "Above quota",
+ }
+ self.assertEqual(call("rpc/start_run", self.south, payload)[0], 409)
+ finally:
+ with owner() as connection:
+ connection.execute(
+ "DELETE FROM checklist_storage.runs WHERE label = 'quota-fixture'"
+ )
+
+
+if __name__ == "__main__":
+ unittest.main(verbosity=2)
diff --git a/applications/checklist-runs/tests/browser.mjs b/applications/checklist-runs/tests/browser.mjs
new file mode 100644
index 00000000..9e3d2ca6
--- /dev/null
+++ b/applications/checklist-runs/tests/browser.mjs
@@ -0,0 +1,298 @@
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { chromium } from "playwright";
+
+const evidence = process.env.EVIDENCE_DIR || "/tmp/checklist-evidence";
+const base = process.env.UI_BASE_URL || "http://127.0.0.1:5173";
+const secret = process.env.PGRST_JWT_SECRET;
+assert.ok(
+ secret && secret.length >= 64,
+ "Export the private fixture signing secret for this helper only.",
+);
+await mkdir(evidence, { recursive: true });
+
+function token(role, issued = Math.floor(Date.now() / 1000), seconds = 900) {
+ const header = Buffer.from(
+ JSON.stringify({ alg: "HS256", typ: "JWT" }),
+ ).toString("base64url");
+ const payload = Buffer.from(
+ JSON.stringify({
+ role,
+ aud: "checklist-runs",
+ iat: issued,
+ exp: issued + seconds,
+ }),
+ ).toString("base64url");
+ const body = `${header}.${payload}`;
+ return `${body}.${createHmac("sha256", secret).update(body).digest("base64url")}`;
+}
+
+function deferred() {
+ let resolve;
+ const promise = new Promise((done) => {
+ resolve = done;
+ });
+ return { promise, resolve };
+}
+
+async function connect(page, value) {
+ await page.goto(base);
+ await page.getByLabel("Operator token", { exact: true }).fill(value);
+ await page.getByRole("button", { name: "Connect", exact: true }).click();
+ await page
+ .getByRole("heading", { name: "Start a run", exact: true })
+ .waitFor({ timeout: 30000 });
+}
+
+async function ready(page) {
+ await page
+ .getByLabel("Checklist", { exact: true })
+ .locator("option")
+ .first()
+ .waitFor({ state: "attached", timeout: 30000 });
+ await page
+ .getByRole("button", { name: "Start run", exact: true })
+ .waitFor({ timeout: 30000 });
+}
+
+const browser = await chromium.launch({
+ env: { HOME: process.env.HOME, PATH: process.env.PATH, LANG: "C.UTF-8" },
+});
+const northToken = token("checklist_north");
+const southToken = token("checklist_south");
+const desktop = await browser.newContext({
+ viewport: { width: 1280, height: 900 },
+});
+const mobile = await browser.newContext({
+ viewport: { width: 390, height: 844 },
+ isMobile: true,
+ deviceScaleFactor: 1,
+});
+const a = await desktop.newPage();
+const b = await mobile.newPage();
+const unique = Date.now().toString();
+const northLabel = `Browser opening ${unique}`;
+const southLabel = `Browser closing ${unique}`;
+await desktop.tracing.start({
+ screenshots: true,
+ snapshots: true,
+ sources: true,
+});
+
+try {
+ await connect(a, northToken);
+ await ready(a);
+ await a
+ .getByLabel("Checklist", { exact: true })
+ .selectOption("10000000-0000-4000-8000-000000000001");
+ await a.getByLabel("Run label", { exact: true }).fill(northLabel);
+ const requests = [];
+ const committedStart = deferred();
+ let firstStart = true;
+ let savedRunId;
+ await a.route("**/api/rpc/start_run", async (route) => {
+ requests.push(route.request().postDataJSON());
+ if (firstStart) {
+ firstStart = false;
+ const response = await route.fetch();
+ assert.equal(response.status(), 200);
+ savedRunId = (await response.json()).run_id;
+ assert.equal(typeof savedRunId, "string");
+ await route.abort("failed");
+ committedStart.resolve();
+ } else {
+ await route.continue();
+ }
+ });
+ await a.getByRole("button", { name: "Start run", exact: true }).click();
+ await committedStart.promise;
+ await a
+ .getByRole("button", { name: "Retry same action", exact: true })
+ .waitFor({ timeout: 30000 });
+ assert.ok(await a.getByLabel("Run label", { exact: true }).isDisabled());
+ await a
+ .getByRole("button", { name: "Retry same action", exact: true })
+ .click();
+ await a
+ .getByRole("heading", { name: northLabel, exact: true })
+ .waitFor({ timeout: 30000 });
+ assert.equal(requests.length, 2);
+ assert.deepEqual(requests[0], requests[1]);
+ console.log(
+ "Ambiguous start committed, then same captured UUID/payload replayed; no automatic new key.",
+ );
+
+ const completionCommitted = deferred();
+ const releaseCompletion = deferred();
+ const refreshHeld = deferred();
+ const releaseRefresh = deferred();
+ let holdRefresh = false;
+ let firstCompletion = true;
+ await a.route("**/api/rpc/complete_step", async (route) => {
+ if (!firstCompletion) return route.continue();
+ firstCompletion = false;
+ const response = await route.fetch();
+ assert.equal(response.status(), 200);
+ completionCommitted.resolve();
+ await releaseCompletion.promise;
+ holdRefresh = true;
+ await route.fulfill({ response });
+ });
+ await a.route("**/api/runs?**", async (route) => {
+ if (!holdRefresh) return route.continue();
+ holdRefresh = false;
+ const response = await route.fetch();
+ refreshHeld.resolve();
+ await releaseRefresh.promise;
+ await route.fulfill({ response });
+ });
+ await a
+ .getByLabel("Completion note (optional)")
+ .first()
+ .fill("Lights and display checked");
+ await a.getByRole("button", { name: "Complete step 1", exact: true }).click();
+ await completionCommitted.promise;
+ assert.equal(
+ await a.getByText("Completion confirmed", { exact: true }).count(),
+ 0,
+ );
+ assert.ok(
+ await a
+ .getByRole("button", { name: "Complete step 2", exact: true })
+ .isDisabled(),
+ );
+ releaseCompletion.resolve();
+ await refreshHeld.promise;
+ assert.ok(
+ await a
+ .getByRole("button", { name: "Complete step 2", exact: true })
+ .isDisabled(),
+ );
+ releaseRefresh.resolve();
+ await a
+ .getByText("Completion confirmed", { exact: true })
+ .first()
+ .waitFor({ timeout: 30000 });
+ for (const number of [2, 3]) {
+ await a
+ .getByRole("button", { name: `Complete step ${number}`, exact: true })
+ .click();
+ await a
+ .getByText("Completion confirmed", { exact: true })
+ .nth(number - 1)
+ .waitFor({ timeout: 30000 });
+ }
+ await a
+ .getByText("This run is complete. Its record is retained.", { exact: true })
+ .waitFor({ timeout: 30000 });
+ assert.equal(await a.getByRole("progressbar").getAttribute("value"), "3");
+ assert.equal(
+ await a.evaluate(() => localStorage.length + sessionStorage.length),
+ 0,
+ );
+ assert.ok(!a.url().includes(northToken));
+ console.log(
+ "No optimistic completion: controls stay pending through invalidation; all three confirmed steps are durable.",
+ );
+ await a.screenshot({
+ path: path.join(evidence, "desktop.png"),
+ fullPage: true,
+ });
+
+ await connect(b, southToken);
+ await ready(b);
+ await b.getByLabel("Run label", { exact: true }).fill(southLabel);
+ await b.getByRole("button", { name: "Start run", exact: true }).click();
+ await b
+ .getByRole("heading", { name: southLabel, exact: true })
+ .waitFor({ timeout: 30000 });
+ assert.equal(await b.getByText(northLabel, { exact: true }).count(), 0);
+ await b.screenshot({
+ path: path.join(evidence, "mobile.png"),
+ fullPage: true,
+ });
+ assert.ok(
+ await b.evaluate(() => document.documentElement.scrollWidth <= innerWidth),
+ );
+ console.log(
+ "Second browser context sees its own scope; mobile layout fits the viewport.",
+ );
+
+ const oldReadCaptured = deferred();
+ const releaseOldRead = deferred();
+ await a.route("**/api/rpc/list_runs?**", async (route) => {
+ if (route.request().headers().authorization !== `Bearer ${northToken}`)
+ return route.continue();
+ const response = await route.fetch();
+ const rows = await response.json();
+ assert.ok(rows.some((row) => row.label === northLabel));
+ oldReadCaptured.resolve();
+ await releaseOldRead.promise;
+ try {
+ await route.fulfill({ response });
+ } catch {
+ /* The consumed AbortSignal can cancel the old route. */
+ }
+ });
+ await a.getByRole("button", { name: "Refresh", exact: true }).click();
+ await oldReadCaptured.promise;
+ await a.getByRole("button", { name: "Disconnect", exact: true }).click();
+ await a.getByLabel("Operator token", { exact: true }).fill(southToken);
+ await a.getByRole("button", { name: "Connect", exact: true }).click();
+ await a
+ .getByRole("button", { name: new RegExp(southLabel) })
+ .waitFor({ timeout: 30000 });
+ releaseOldRead.resolve();
+ await a.waitForTimeout(400);
+ assert.equal(await a.getByText(northLabel, { exact: true }).count(), 0);
+ assert.equal(
+ await a.getByText("Lights and display checked", { exact: true }).count(),
+ 0,
+ );
+ console.log(
+ "Actual old-scope HTTP read captured before switch and released afterward; fresh cache never displays old run/notes.",
+ );
+
+ const expired = await browser.newContext({
+ viewport: { width: 1100, height: 800 },
+ });
+ const expiredPage = await expired.newPage();
+ await connect(
+ expiredPage,
+ token("checklist_north", Math.floor(Date.now() / 1000) - 180, 60),
+ );
+ await expiredPage.getByRole("alert").waitFor({ timeout: 30000 });
+ assert.match(
+ await expiredPage.getByRole("alert").innerText(),
+ /invalid or expired/,
+ );
+ await expired.close();
+ console.log(
+ "Expired token produces an actionable connection error; tokens are never stored in browser persistence.",
+ );
+
+ // Preserve only nonsecret identifiers for the separate real process-restart check.
+ const { writeFile } = await import("node:fs/promises");
+ await writeFile(
+ path.join(evidence, "browser-snapshot.json"),
+ JSON.stringify(
+ { run_id: savedRunId, label: northLabel, request: requests[0] },
+ null,
+ 2,
+ ),
+ );
+ await desktop.tracing.stop();
+ console.log("Browser workflow passed.");
+} catch (error) {
+ await a
+ .screenshot({ path: path.join(evidence, "failed.png"), fullPage: true })
+ .catch(() => {});
+ await desktop.tracing
+ .stop({ path: path.join(evidence, "failed-trace.zip") })
+ .catch(() => {});
+ throw error;
+} finally {
+ await browser.close();
+}
diff --git a/applications/checklist-runs/tests/requirements.in b/applications/checklist-runs/tests/requirements.in
new file mode 100644
index 00000000..aa0ab28b
--- /dev/null
+++ b/applications/checklist-runs/tests/requirements.in
@@ -0,0 +1 @@
+psycopg[binary]==3.3.6
diff --git a/applications/checklist-runs/tests/requirements.txt b/applications/checklist-runs/tests/requirements.txt
new file mode 100644
index 00000000..6c6cc80f
--- /dev/null
+++ b/applications/checklist-runs/tests/requirements.txt
@@ -0,0 +1,3 @@
+psycopg==3.3.6
+psycopg-binary==3.3.6
+typing_extensions==4.16.0
diff --git a/applications/checklist-runs/tests/restart.py b/applications/checklist-runs/tests/restart.py
new file mode 100644
index 00000000..485aecad
--- /dev/null
+++ b/applications/checklist-runs/tests/restart.py
@@ -0,0 +1,111 @@
+"""Replace this fixture's exact PostgREST process and compare durable HTTP state.
+
+Requires POSTGREST_PID, runtime/test env and the browser-snapshot.json recorded
+by the browser helper in EVIDENCE_DIR. Never targets an arbitrary process.
+"""
+
+import importlib.util
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import time
+
+import psycopg
+
+from acceptance import call, owner
+from tls import APP, BINARY, environment
+
+spec = importlib.util.spec_from_file_location(
+ "fixture_tokens", APP / "scripts/tokens.py"
+)
+tokens = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(tokens)
+evidence = Path(os.environ.get("EVIDENCE_DIR", "/tmp/checklist-evidence"))
+evidence.mkdir(parents=True, exist_ok=True)
+fixture = json.loads((evidence / "browser-snapshot.json").read_text())
+old = int(os.environ["POSTGREST_PID"])
+process = Path(f"/proc/{old}")
+assert process.exists(), "The original PostgREST process is not live."
+assert (process / "cwd").resolve() == APP
+arguments = (process / "cmdline").read_bytes().split(b"\0")
+assert Path(arguments[0].decode()).name == "postgrest"
+assert b"postgrest.conf" in arguments
+token = tokens.issue(os.environ["PGRST_JWT_SECRET"], "checklist_north")
+detail_path = (
+ "runs?id=eq."
+ + fixture["run_id"]
+ + "&select=*,run_steps(*),completions(*)&run_steps.order=step_number.asc&completions.order=step_number.asc"
+)
+status, before, _ = call(detail_path, token)
+assert status == 200 and len(before) == 1 and before[0]["completed_steps"] == 3
+with owner() as connection:
+ completion = connection.execute(
+ "SELECT request_id::text, step_number, note FROM checklist_storage.completions WHERE run_id = %s ORDER BY step_number LIMIT 1",
+ (fixture["run_id"],),
+ ).fetchone()
+completion_request = {
+ "p_request_id": completion[0],
+ "p_run_id": fixture["run_id"],
+ "p_step_number": completion[1],
+ "p_note": completion[2],
+}
+start_before = call("rpc/start_run", token, fixture["request"])
+completion_before = call("rpc/complete_step", token, completion_request)
+assert start_before[0] == 200 and completion_before[0] == 200
+
+os.kill(old, signal.SIGTERM)
+deadline = time.monotonic() + 20
+while process.exists() and time.monotonic() < deadline:
+ time.sleep(0.1)
+assert not process.exists(), "The original process did not exit; refusing replacement."
+print(f"Original PostgREST PID {old} exited before replacement.", flush=True)
+output = (evidence / "replacement-private.log").open("ab")
+child = subprocess.Popen(
+ [BINARY, "postgrest.conf"],
+ cwd=APP,
+ env=environment(),
+ stdout=output,
+ stderr=output,
+ start_new_session=True,
+)
+(evidence / "replacement.pid").write_text(str(child.pid))
+deadline = time.monotonic() + 30
+while time.monotonic() < deadline:
+ assert child.poll() is None, "The replacement process exited before becoming ready."
+ try:
+ status, after, _ = call(detail_path, token)
+ if status == 200:
+ break
+ except OSError:
+ pass
+ time.sleep(0.1)
+else:
+ raise AssertionError("Replacement did not become ready.")
+assert before == after
+assert call("rpc/start_run", token, fixture["request"])[:2] == start_before[:2]
+assert call("rpc/complete_step", token, completion_request)[:2] == completion_before[:2]
+child_keys = {
+ item.split(b"=", 1)[0].decode()
+ for item in Path(f"/proc/{child.pid}/environ").read_bytes().split(b"\0")
+ if item
+}
+assert not any("OWNER" in key or "TEST_" in key or "ADMIN" in key for key in child_keys)
+assert os.environ["PGUSER"] == "checklist_authenticator"
+(evidence / "persistence.json").write_text(
+ json.dumps(
+ {
+ "old_pid": old,
+ "new_pid": child.pid,
+ "before": before,
+ "after": after,
+ "start_result": start_before[1],
+ "completion_result": completion_before[1],
+ },
+ indent=2,
+ )
+)
+print(
+ f"Replacement PID {child.pid} uses runtime-only env; exact run, three completions and both retained results agree."
+)
diff --git a/applications/checklist-runs/tests/restart_browser.mjs b/applications/checklist-runs/tests/restart_browser.mjs
new file mode 100644
index 00000000..18028209
--- /dev/null
+++ b/applications/checklist-runs/tests/restart_browser.mjs
@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { chromium } from "playwright";
+
+const evidence = process.env.EVIDENCE_DIR || "/tmp/checklist-evidence";
+const fixture = JSON.parse(
+ await readFile(path.join(evidence, "browser-snapshot.json"), "utf8"),
+);
+const issued = Math.floor(Date.now() / 1000);
+const header = Buffer.from(
+ JSON.stringify({ alg: "HS256", typ: "JWT" }),
+).toString("base64url");
+const claims = Buffer.from(
+ JSON.stringify({
+ role: "checklist_north",
+ aud: "checklist-runs",
+ iat: issued,
+ exp: issued + 900,
+ }),
+).toString("base64url");
+const body = `${header}.${claims}`;
+const token = `${body}.${createHmac("sha256", process.env.PGRST_JWT_SECRET).update(body).digest("base64url")}`;
+const browser = await chromium.launch({
+ env: { HOME: process.env.HOME, PATH: process.env.PATH, LANG: "C.UTF-8" },
+});
+try {
+ const page = await browser.newPage({
+ viewport: { width: 1280, height: 900 },
+ });
+ await page.goto(process.env.UI_BASE_URL || "http://127.0.0.1:5173");
+ await page.getByLabel("Operator token", { exact: true }).fill(token);
+ await page.getByRole("button", { name: "Connect", exact: true }).click();
+ await page
+ .getByRole("button", { name: new RegExp(fixture.label) })
+ .waitFor({ timeout: 30000 });
+ await page.getByRole("button", { name: new RegExp(fixture.label) }).click();
+ await page
+ .getByText("This run is complete. Its record is retained.", { exact: true })
+ .waitFor({ timeout: 30000 });
+ assert.equal(
+ await page.getByText("Completion confirmed", { exact: true }).count(),
+ 3,
+ );
+ await page
+ .getByText("Lights and display checked", { exact: true })
+ .waitFor({ timeout: 30000 });
+ await page.screenshot({
+ path: path.join(evidence, "restarted.png"),
+ fullPage: true,
+ });
+ console.log(
+ "Fresh browser token after actual PostgREST replacement displays the saved completed run and three immutable notes.",
+ );
+} finally {
+ await browser.close();
+}
diff --git a/applications/checklist-runs/tests/test_tokens.py b/applications/checklist-runs/tests/test_tokens.py
new file mode 100644
index 00000000..d5ad27e2
--- /dev/null
+++ b/applications/checklist-runs/tests/test_tokens.py
@@ -0,0 +1,51 @@
+import base64
+import hashlib
+import hmac
+import importlib.util
+import json
+from pathlib import Path
+import unittest
+
+spec = importlib.util.spec_from_file_location(
+ "tokens", Path(__file__).parents[1] / "scripts/tokens.py"
+)
+tokens = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(tokens)
+
+
+class FixtureIssuerTests(unittest.TestCase):
+ def test_signed_scoped_short_lived_token(self):
+ secret = "a" * 128
+ value = tokens.issue(secret, "checklist_north", 60, now=1790960000)
+ head, body, signature = value.split(".")
+ decoded = json.loads(base64.urlsafe_b64decode(body + "=" * (-len(body) % 4)))
+ self.assertEqual(
+ decoded,
+ {
+ "role": "checklist_north",
+ "aud": "checklist-runs",
+ "iat": 1790960000,
+ "exp": 1790960060,
+ },
+ )
+ expected = hmac.new(
+ secret.encode(), (head + "." + body).encode(), hashlib.sha256
+ ).digest()
+ self.assertEqual(tokens.b64url(expected), signature)
+
+ def test_unknown_role_cannot_be_issued(self):
+ with self.assertRaises(ValueError):
+ tokens.issue("a" * 128, "checklist_owner")
+
+ def test_short_secret_rejected(self):
+ with self.assertRaises(ValueError):
+ tokens.issue("too-short", "checklist_south")
+
+ def test_lifetime_bounds(self):
+ for seconds in (0, 901, True):
+ with self.assertRaises(ValueError):
+ tokens.issue("a" * 128, "checklist_south", seconds)
+
+
+if __name__ == "__main__":
+ unittest.main()
diff --git a/applications/checklist-runs/tests/tls.py b/applications/checklist-runs/tests/tls.py
new file mode 100644
index 00000000..5cb7c7ce
--- /dev/null
+++ b/applications/checklist-runs/tests/tls.py
@@ -0,0 +1,79 @@
+"""Exercise libpq verification in the actual PostgREST application process."""
+
+import os
+from pathlib import Path
+import socket
+import subprocess
+import tempfile
+import unittest
+
+APP = Path(__file__).resolve().parents[1]
+BINARY = os.environ.get("POSTGREST_BIN", str(APP / ".local/bin/postgrest"))
+RUNTIME_KEYS = (
+ "PGHOST",
+ "PGPORT",
+ "PGDATABASE",
+ "PGUSER",
+ "PGPASSWORD",
+ "PGSSLMODE",
+ "PGSSLROOTCERT",
+ "PGCONNECT_TIMEOUT",
+ "PGRST_JWT_SECRET",
+)
+
+
+def environment():
+ return {
+ "HOME": os.environ["HOME"],
+ "PATH": "/usr/bin:/bin",
+ "LANG": "C.UTF-8",
+ **{key: os.environ[key] for key in RUNTIME_KEYS},
+ }
+
+
+class NativeTLS(unittest.TestCase):
+ def assert_connection_fails(self, changes, expected_fragments):
+ with tempfile.TemporaryFile() as output:
+ child = subprocess.Popen(
+ [BINARY, "postgrest.conf"],
+ cwd=APP,
+ env={**environment(), "PGRST_SERVER_PORT": "3001", **changes},
+ stdout=output,
+ stderr=output,
+ )
+ try:
+ code = child.wait(timeout=25)
+ finally:
+ if child.poll() is None:
+ child.terminate()
+ child.wait(timeout=5)
+ output.seek(0)
+ message = output.read().decode(errors="replace").lower()
+ self.assertNotEqual(code, 0)
+ self.assertTrue(
+ any(fragment in message for fragment in expected_fragments),
+ "The native failure did not identify the intended TLS verification control.",
+ )
+ print(
+ "Actual PostgREST process failed for the expected certificate/name reason; exit",
+ code,
+ )
+
+ def test_untrusted_ca(self):
+ self.assert_connection_fails(
+ {"PGSSLROOTCERT": "/etc/ssl/certs/ca-certificates.crt"},
+ ("certificate verify failed", "unable to get local issuer certificate"),
+ )
+
+ def test_wrong_hostname_same_actual_server(self):
+ actual_ip = socket.getaddrinfo(
+ os.environ["PGHOST"], 5432, type=socket.SOCK_STREAM
+ )[0][4][0]
+ self.assert_connection_fails(
+ {"PGHOST": "wrong-hostname.invalid", "PGHOSTADDR": actual_ip},
+ ("does not match host name", "does not match hostname"),
+ )
+
+
+if __name__ == "__main__":
+ unittest.main(verbosity=2)
diff --git a/applications/checklist-runs/tsconfig.json b/applications/checklist-runs/tsconfig.json
new file mode 100644
index 00000000..76ff729a
--- /dev/null
+++ b/applications/checklist-runs/tsconfig.json
@@ -0,0 +1,14 @@
+{
+ "compilerOptions": {
+ "target": "ES2022",
+ "lib": ["ES2022", "DOM", "DOM.Iterable"],
+ "module": "ESNext",
+ "moduleResolution": "Bundler",
+ "jsx": "react-jsx",
+ "strict": true,
+ "noEmit": true,
+ "allowImportingTsExtensions": true,
+ "skipLibCheck": true
+ },
+ "include": ["src", "vite.config.ts"]
+}
diff --git a/applications/checklist-runs/vite.config.ts b/applications/checklist-runs/vite.config.ts
new file mode 100644
index 00000000..691fb911
--- /dev/null
+++ b/applications/checklist-runs/vite.config.ts
@@ -0,0 +1,30 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+
+const proxy = {
+ "/api": {
+ target: "http://127.0.0.1:3000",
+ changeOrigin: false,
+ rewrite: (path: string) => path.replace(/^\/api(?=\/|$)/, ""),
+ },
+};
+
+export default defineConfig({
+ plugins: [react()],
+ server: {
+ host: "127.0.0.1",
+ port: 5173,
+ strictPort: true,
+ allowedHosts: ["localhost", "127.0.0.1"],
+ cors: false,
+ proxy,
+ },
+ preview: {
+ host: "127.0.0.1",
+ port: 5173,
+ strictPort: true,
+ allowedHosts: ["localhost", "127.0.0.1"],
+ cors: false,
+ proxy,
+ },
+});