Add account based multiplayer hosting and bug report retention

scripts/test-bug-reports-sql.mjs

@@ -248,6 +248,133 @@ try {
   ).rows[0];
   assert.equal(claimed.bug_finder, true);
   assert.equal(claimed.name_glow, false);
+  const closeEvent = randomUUID();
+  await db.query("select public.receive_bug_close($1,$2)", [
+    report,
+    closeEvent,
+  ]);
+  let closed = (
+    await db.query("select * from public.bug_reports where id=$1", [report])
+  ).rows[0];
+  assert.equal(closed.state, "done");
+  assert.equal(
+    new Date(closed.delete_after) - new Date(closed.closed_at),
+    3 * 86400000,
+  );
+  await db.query("select public.set_bug_report_done($1,true,null)", [report]);
+  assert.equal(
+    String(
+      (
+        await db.query("select closed_at from public.bug_reports where id=$1", [
+          report,
+        ])
+      ).rows[0].closed_at,
+    ),
+    String(closed.closed_at),
+    "repeat close preserves deadline",
+  );
+  assert.equal(
+    (
+      await db.query("select public.begin_bug_purge($1,$2) as ok", [
+        report,
+        closed.closed_at,
+      ])
+    ).rows[0].ok,
+    false,
+    "cannot purge before three days",
+  );
+  await assert.rejects(
+    db.query(
+      "insert into public.bug_report_messages(report_id,kind,body,author_name) values($1,'user','new message','Guest')",
+      [report],
+    ),
+    /Done/,
+  );
+  await db.query("select public.set_bug_report_done($1,false,null)", [report]);
+  assert.equal(
+    (
+      await db.query("select public.receive_bug_close($1,$2) as ok", [
+        report,
+        closeEvent,
+      ])
+    ).rows[0].ok,
+    false,
+    "replayed close command cannot reclose a reopened report",
+  );
+  await db.query(
+    "select public.set_bug_report_done($1,true,clock_timestamp()-interval '4 days')",
+    [report],
+  );
+  closed = (
+    await db.query("select * from public.bug_reports where id=$1", [report])
+  ).rows[0];
+  assert.equal(
+    (
+      await db.query("select public.begin_bug_purge($1,$2) as ok", [
+        report,
+        closed.closed_at,
+      ])
+    ).rows[0].ok,
+    false,
+    "Linear completion must be confirmed",
+  );
+  await db.query(
+    "update public.bug_reports set linear_done_synced=true where id=$1",
+    [report],
+  );
+  assert.equal(
+    (
+      await db.query("select public.begin_bug_purge($1,$2) as ok", [
+        report,
+        closed.closed_at,
+      ])
+    ).rows[0].ok,
+    true,
+  );
+  assert.equal(
+    (
+      await db.query("select public.set_bug_report_done($1,false,null) as ok", [
+        report,
+      ])
+    ).rows[0].ok,
+    false,
+    "cannot reopen midway through irreversible purge",
+  );
+  await db.query("select public.finish_bug_purge($1,$2)", [
+    report,
+    closed.closed_at,
+  ]);
+  assert.equal(
+    (
+      await db.query(
+        "select count(*)::int as n from public.bug_report_messages where report_id=$1",
+        [report],
+      )
+    ).rows[0].n,
+    0,
+    "messages cascade on purge",
+  );
+  assert.equal(
+    (
+      await db.query("select bug_finder from public.profiles where id=$1", [
+        account,
+      ])
+    ).rows[0].bug_finder,
+    true,
+    "account recognition survives report deletion",
+  );
+  for (const role of ["anon", "authenticated"]) {
+    await db.exec(`set role ${role}`);
+    await assert.rejects(
+      db.query("select public.set_bug_report_done($1,true,null)", [guest]),
+      /permission denied/,
+    );
+    await assert.rejects(
+      db.query("select public.finish_bug_purge($1,now())", [guest]),
+      /permission denied/,
+    );
+    await db.exec("reset role");
+  }
   console.log(
     "Bug report SQL passed: private tables, lease retries, guest claims, staff reply deduplication, grant/revoke rewards and privilege isolation.",
   );