agent-bot
ee1e53b510
Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
package auth
|
||
|
||
import (
|
||
"context"
|
||
"fmt"
|
||
"strings"
|
||
|
||
"chat-agent-system/internal/config"
|
||
"github.com/jackc/pgx/v5/pgxpool"
|
||
)
|
||
|
||
// Stores 认证账户存储与会话存储组合。
|
||
type Stores struct {
|
||
Auth AuthStore
|
||
Sessions SessionStore
|
||
}
|
||
|
||
func allowInMemoryAuthFallback(cfg *config.Config) bool {
|
||
if cfg == nil || !cfg.AllowInMemory {
|
||
return false
|
||
}
|
||
env := strings.ToLower(strings.TrimSpace(cfg.Env))
|
||
return env == "dev" || env == "test"
|
||
}
|
||
|
||
// NewStores 根据数据库与 IAM 迁移状态选择 PG 或内存实现。
|
||
// 仅当环境明确为 dev/test 且 AllowInMemory 时允许 MemoryStore；
|
||
// 环境空值、未知值、main/prod、pool 缺失或 IAM 表未就绪时 fail closed。
|
||
func NewStores(ctx context.Context, pool *pgxpool.Pool, cfg *config.Config) (*Stores, error) {
|
||
if pool != nil && IAMTablesReady(ctx, pool) {
|
||
pg, err := NewPgStore(pool, cfg)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if err := BootstrapIAM(ctx, pool, pg, cfg); err != nil {
|
||
return nil, err
|
||
}
|
||
return &Stores{Auth: pg, Sessions: pg}, nil
|
||
}
|
||
if allowInMemoryAuthFallback(cfg) {
|
||
mem := NewMemoryStore(cfg)
|
||
return &Stores{Auth: mem, Sessions: NewMemorySessionStore()}, nil
|
||
}
|
||
env := ""
|
||
if cfg != nil {
|
||
env = strings.TrimSpace(cfg.Env)
|
||
}
|
||
reason := "IAM tables not ready or database pool unavailable"
|
||
if pool == nil {
|
||
reason = "database pool is nil"
|
||
} else if !IAMTablesReady(ctx, pool) {
|
||
reason = "IAM tables not ready"
|
||
}
|
||
return nil, fmt.Errorf("auth store fail-closed: %s (env=%q); memory IAM fallback requires env=dev|test and ALLOW_IN_MEMORY=true", reason, env)
|
||
}
|