fix(database): qualify RD21 saves against pinned MariaDB 12.2.2

2026-10-24 01:47:50 +02:00
parent 0d16a691e0
commit a2c9bda0d1
30 changed files with 2226 additions and 63 deletions
@@ -0,0 +1,8 @@
+// This destructive fixture accepts only the runner's canonical disposable connection.
+export function validateMariaDbBrowserConnection(connection, port) {
+  const match = /^Server=127\.0\.0\.1;Port=([0-9]{1,5});Database=(jt_it_[a-f0-9]{32});User ID=root;Password=jt-integration-only;SslMode=None;?$/.exec(connection);
+  if (!match || Number(match[1]) < 1 || Number(match[1]) > 65535 || match[1] !== port) {
+    throw new Error('MariaDB browser lane requires a canonical disposable loopback connection and matching port.');
+  }
+  return match[2];
+}
@@ -0,0 +1,13 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { validateMariaDbBrowserConnection as validate } from './mariadb-browser-connection.mjs';
+const database = 'jt_it_' + 'a'.repeat(32);
+const connection = `Server=127.0.0.1;Port=33308;Database=${database};User ID=root;Password=jt-integration-only;SslMode=None`;
+test('accepts the explicit disposable connection', () => assert.equal(validate(connection, '33308'), database));
+for (const invalid of [connection + ';Database=existing_dev', connection + ';Server=remote',
+  connection + ';Host=remote', connection.replace('127.0.0.1', 'remote'),
+  connection.replace(database, 'existing_dev'), connection.replace('33308', '65536'),
+  connection.replace('33308', '0'), connection + ';ConnectionProtocol=Pipe']) {
+  test(`rejects unsafe connection ${invalid}`, () => assert.throws(() => validate(invalid, '33308')));
+}
+test('rejects independent-reader port mismatch', () => assert.throws(() => validate(connection, '33309')));