From 0803047535bef44c55f1f4501cece0715e3f8c46 Mon Sep 17 00:00:00 2001 From: anthony Date: Fri, 31 Jul 2026 16:19:24 +0000 Subject: [PATCH] db: enforce foreign keys, and ship the licence package.json claims MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two things that were true on paper and not in fact. SQLite ignores every REFERENCES clause unless `PRAGMA foreign_keys = ON` is set, per connection, and nothing here ever set it. So the ON DELETE CASCADE on moshpit_names.user_id, moshpit_name_purchases.user_id, moshpit_name_pins.user_id and sessions.user_id have all been decorative: deleting a user left their names, purchases, published keys and sessions behind, pointing at a row that no longer exists. A published key outliving its owner is a key nobody can revoke. Set once at import and not awaited — every statement goes through the same client and libSQL serialises on the connection, so the PRAGMA is on the wire before anything that depends on it. A failure is logged rather than thrown: the app still works without it, it just enforces less. The risk in turning this on is old inserts that reference rows which do not exist, which would now fail rather than quietly succeed. 292 tests say there are none. package.json has claimed "license": "MIT" with no LICENSE file in the repo, so the claim was unenforceable and GitHub reported the project as all-rights- reserved. The file is moshcoding's verbatim, same copyright holder. Co-Authored-By: Claude Opus 5 (1M context) --- LICENSE | 21 ++++++++++++++++ apps/pwa/src/db.mjs | 17 +++++++++++++ apps/pwa/test/moshpit-terms.test.mjs | 36 ++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..dd4f1f7 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Profullstack, Inc. (dba moshcoding) + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/apps/pwa/src/db.mjs b/apps/pwa/src/db.mjs index 9515986..5c58edb 100644 --- a/apps/pwa/src/db.mjs +++ b/apps/pwa/src/db.mjs @@ -13,6 +13,23 @@ if (config.db.url.startsWith("file:")) { export const db = createClient({ url: config.db.url, authToken: config.db.authToken }); +/** + * Turn on foreign keys. + * + * SQLite ignores every REFERENCES clause unless this is set, per connection — + * which means the `ON DELETE CASCADE` on moshpit_names.user_id, + * moshpit_name_purchases.user_id, moshpit_name_pins.user_id and sessions.user_id + * have all been decorative. Deleting a user left their names, purchases, + * published keys and sessions behind, pointing at a row that no longer exists. + * + * Fired once at import and not awaited: every later statement goes through the + * same client, and libSQL serialises on the connection, so the PRAGMA is on the + * wire before anything that depends on it. A failure is logged rather than + * thrown because the app is still usable without it — it just enforces less. + */ +db.execute("PRAGMA foreign_keys = ON") + .catch((error) => console.error("[db] could not enable foreign keys:", error.message)); + /** Run a statement; returns the raw result. */ export const run = (sql, args = []) => db.execute({ sql, args }); diff --git a/apps/pwa/test/moshpit-terms.test.mjs b/apps/pwa/test/moshpit-terms.test.mjs index 5933325..b6f45dd 100644 --- a/apps/pwa/test/moshpit-terms.test.mjs +++ b/apps/pwa/test/moshpit-terms.test.mjs @@ -165,3 +165,39 @@ test("ending terms", { skip: installed ? false : "pwa dependencies not installed assert.equal(m.isExpired({ expires_at: Date.now() + 1000 }), false); }); }); + +test("deleting a user takes their rows with them", { skip: installed ? false : "pwa dependencies not installed" }, async (t) => { + const { migrate } = await import("../src/migrate.mjs"); + await migrate(); + const { run, all } = await import("../src/db.mjs"); + const { randomBytes: rb } = await import("node:crypto"); + + await t.test("foreign keys are actually on", async () => { + // SQLite ignores every REFERENCES clause without this, per connection. The + // cascades in the schema were decorative for as long as it was unset. + assert.equal((await all("PRAGMA foreign_keys"))[0].foreign_keys, 1); + }); + + await t.test("names, pins and purchases follow the user out", async () => { + const uid = `u${rb(4).toString("hex")}`; + const tld = `fk${rb(4).toString("hex")}`; + const now = Date.now(); + await run(`INSERT INTO users (id,email,created_at) VALUES (?,?,?)`, [uid, `${uid}@e.com`, now]); + await run(`INSERT INTO moshpit_tlds (tld,user_id,created_at) VALUES (?,?,?)`, [tld, uid, now]); + await run(`INSERT INTO moshpit_names (tld,label,user_id,created_at) VALUES (?,?,?,?)`, [tld, "a", uid, now]); + await run(`INSERT INTO moshpit_name_pins (tld,label,pin,kind,user_id,created_at) VALUES (?,?,?,?,?,?)`, + [tld, "a", "AAAA", "tls", uid, now]); + + const mine = async (table) => + (await all(`SELECT 1 FROM ${table} WHERE user_id = ?`, [uid])).length; + assert.equal(await mine("moshpit_names"), 1); + assert.equal(await mine("moshpit_name_pins"), 1); + + await run(`DELETE FROM users WHERE id = ?`, [uid]); + + // Orphans here are not cosmetic: a published key outliving its owner is a + // key nobody can revoke. + assert.equal(await mine("moshpit_names"), 0); + assert.equal(await mine("moshpit_name_pins"), 0); + }); +});