Merge pull request #2 from Arcoders/LASAGNA-120526/test-coverage

test: E2E

Author: Arcoders

.c8rc.json

@@ -0,0 +1,22 @@
+{
+  "all": true,
+  "src": ["src"],
+  "include": ["src/**/*.ts"],
+  "exclude": [
+    "src/**/*.d.ts",
+    "src/commands/commands.json",
+    "src/types/**",
+    "build/**",
+    "bin/**",
+    "tests/**",
+    "examples/**"
+  ],
+  "reporter": ["text-summary", "lcov"],
+  "report-dir": "./coverage",
+  "clean": true,
+  "check-coverage": false,
+  "lines": 0,
+  "branches": 0,
+  "functions": 0,
+  "statements": 0
+}

.github/workflows/ci.yml

@@ -33,8 +33,16 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Test (unit)
-        run: npm test
+      - name: Test (unit) + coverage
+        run: npm run test:coverage
+
+      - name: Upload unit coverage
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-unit
+          path: coverage/lcov.info
+          if-no-files-found: warn
 
       # Surfaces unused exports / orphaned files / unused deps. `--no-exit-code`
       # so the report is informational; flip to required once the baseline
@@ -76,6 +84,13 @@ jobs:
           --health-timeout 5s
           --health-retries 10
 
+      # Wire-compliant OIDC server for sso_oidc_real.spec.ts.
+      # (MinIO can't run here — Actions services don't allow CMD overrides.)
+      mock-oidc:
+        image: ghcr.io/navikt/mock-oauth2-server:2.1.10
+        ports:
+          - 8080:8080
+
     env:
       TZ: UTC
       NODE_ENV: test
@@ -97,6 +112,18 @@ jobs:
       CACHE_REDIS_HOST: 127.0.0.1
       CACHE_REDIS_PORT: 6379
       CACHE_REDIS_DB: 2
+      # Optional Stripe test-mode key (sk_test_…) for stripe_real_smoke.spec.ts.
+      # Unset → spec skips visibly. Add via Settings → Secrets → Actions.
+      STRIPE_TEST_API_KEY: ${{ secrets.STRIPE_TEST_API_KEY }}
+      # MinIO (S3) for backup_s3.spec.ts. Unset → spec skips.
+      BACKUP_S3_ENDPOINT: http://127.0.0.1:9000
+      BACKUP_S3_BUCKET: lasagna-test
+      BACKUP_S3_REGION: us-east-1
+      AWS_ACCESS_KEY_ID: minioadmin
+      AWS_SECRET_ACCESS_KEY: minioadmin
+      # mock-oauth2-server for sso_oidc_real.spec.ts. `default` = mock's
+      # placeholder issuer path for unspecified issuers.
+      MOCK_OIDC_BASE_URL: http://127.0.0.1:8080/default
 
     steps:
       - uses: actions/checkout@v4
@@ -111,8 +138,43 @@ jobs:
           npm_config_ignore_scripts: 'false'
         run: npm install --legacy-peer-deps --include=optional
 
-      - name: Test (integration)
-        run: npm run test:integration
+      # Run MinIO directly (Actions services can't pass `server /data`).
+      - name: Start MinIO (S3-compatible)
+        run: |
+          docker run -d --rm --name lasagna-minio \
+            -p 9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:latest server /data
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            if curl -fsS http://127.0.0.1:9000/minio/health/ready > /dev/null; then
+              echo "minio ready"; exit 0
+            fi
+            sleep 1
+          done
+          echo "minio failed to become ready"; docker logs lasagna-minio; exit 1
+
+      # Fail fast if the mock-oidc service container didn't come up.
+      - name: Probe mock-oauth2-server
+        run: |
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            if curl -fsS "$MOCK_OIDC_BASE_URL/.well-known/openid-configuration" > /dev/null; then
+              echo "mock-oidc ready"; exit 0
+            fi
+            sleep 1
+          done
+          echo "mock-oidc failed to become ready"; exit 1
+
+      - name: Test (integration) + coverage
+        run: npm run test:integration:coverage
+
+      - name: Upload integration coverage
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-integration
+          path: coverage/lcov.info
+          if-no-files-found: warn
 
   test-e2e-demo:
     name: E2E (demo app)

.gitignore

@@ -1,5 +1,7 @@
 node_modules/
 build/
+coverage/
+.nyc_output/
 .env
 *.log
 .claude

CHANGELOG.md

@@ -6,6 +6,94 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.2.1] — 2026-05-17
+
+Hardening release. Three production-affecting bug fixes uncovered by
+a test-coverage audit, plus a substantial integration + E2E expansion
+(now 505 unit + 355 integration + 123 e2e).
+
+### Fixed
+
+- **Package queue jobs are now resolvable by `queue:work`**.
+  `MultitenancyProvider.boot()` registers `InstallTenant`,
+  `UninstallTenant`, `CloneTenant`, `BackupTenant`, `RestoreTenant`,
+  `ProcessStripeEventJob`, `BillingCleanupJob`, and `ReportUsageBatchJob`
+  with `@adonisjs/queue`'s `Locator`. Pre-fix, host apps' job
+  auto-discovery (`app/jobs/**`) didn't reach into `node_modules`, so
+  any dispatched package job was dead-lettered at the worker. Jobs are
+  registered (and dispatched) under `lasagna.<JobName>` so a host
+  app's same-named job can't collide.
+- **`CloneService` integer-sequence reset now actually runs**.
+  `#resetIntegerSequences` was passing `$1`/`$2` bindings to
+  `trx.rawQuery()`; Knex rejects those (it expects `?`), but the
+  failure was swallowed by the surrounding savepoint rollback.
+  Result: every cloned tenant inherited its source's sequence, so the
+  next insert PK-collided with a copied row. Identifiers are now
+  interpolated directly into the SQL (guarded by
+  `assertSafeIdentifier` upstream).
+- **`ImpersonationMiddleware` constructor no longer breaks IoC
+  resolution**. The optional typed constructor parameter forced the
+  AdonisJS container to try injecting `ImpersonationService` at
+  middleware resolution time, which it can't (the service needs a
+  config-validated boot). Refactored to a `protected getService()`
+  seam that subclasses can override for tests.
+
+### Changed
+
+- **Build artefact no longer embeds TypeScript source**.
+  `inlineSources: true` removed from `tsconfig.json`. `.js.map` files
+  in `build/` still reference `.ts` paths for stack traces but no
+  longer carry the full source bytes — smaller install footprint for
+  consumers.
+- **Test coverage tooling**. Added `c8` with `test:coverage` /
+  `test:integration:coverage` scripts and `.c8rc.json` (thresholds
+  report-only at 0; ratchet after a baseline is captured). CI uploads
+  `lcov.info` as an artifact.
+- **CI provisions MinIO + mock-oauth2-server** so the new S3 / OIDC
+  integration specs run against real backends. Optional
+  `STRIPE_TEST_API_KEY` secret enables the Stripe live-API smoke
+  test; without it the spec reports itself skipped.
+
+### Test coverage
+
+Closing the gap between "lots of tests" and "production confidence".
+New end-to-end coverage for previously-thin paths:
+
+- `examples/api/tests/e2e/commands_lifecycle.spec.ts` (10 tests) —
+  real ace command execution for `tenant:list`/`suspend`/`activate`/
+  `import`/`purge-expired`/`maintenance`/`impersonate`/`backups:run`/
+  `webhooks:retry`.
+- `examples/api/tests/e2e/queue_jobs.spec.ts` (2 tests) — real
+  `queue:work` subprocess provisioning and tearing down tenants.
+- `tests/integration/services/backup_s3.spec.ts` (real MinIO),
+  `sso_oidc_real.spec.ts` (real `mock-oauth2-server`),
+  `stripe_real_smoke.spec.ts` (real Stripe test API).
+- `tests/integration/middleware/rate_limit.spec.ts` (6 tests, real
+  Redis pipeline) and `impersonation_middleware.spec.ts` (real HTTP +
+  Redis).
+- `tests/integration/services/bootstrapper_isolation.spec.ts` (9
+  tests, cross-tenant isolation + 16-way `AsyncLocalStorage`
+  concurrency), `clone_service.spec.ts`, `doctor_checks_real.spec.ts`,
+  `telemetry_export.spec.ts` (with real OTel SDK +
+  `AsyncLocalStorageContextManager`).
+- `tests/integration/billing/diagnostics_commands.spec.ts`
+  (`tenant:billing:doctor` + `tenant:billing:test-webhook`).
+- `tests/integration/billing/stripe_real_smoke.spec.ts` expanded to
+  cover every Stripe SDK call-site.
+
+### Upgrade notes
+
+- **Drain your queue before upgrading** if you have unprocessed
+  package jobs in Redis under the old names (`InstallTenant`,
+  `UninstallTenant`, etc.). After upgrade, the worker resolves them
+  under `lasagna.<JobName>`, so any pending pre-upgrade jobs will
+  dead-letter at the worker.
+- **Subclassers of `ImpersonationMiddleware`**: the constructor
+  parameter is gone. Override `getService()` instead of injecting via
+  `new ImpersonationMiddleware(service)`.
+
+---
+
 ## [0.2.0] — 2026-05-09
 
 Adds the **Stripe billing satellite** as the ninth opt-in feature.

README.md

@@ -21,7 +21,7 @@ flags, metrics, and Stripe billing.
 [![AdonisJS](https://img.shields.io/badge/AdonisJS-7-5a45ff)](https://adonisjs.com)
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-%E2%89%A514-336791)](https://www.postgresql.org)
 [![Redis](https://img.shields.io/badge/Redis-%E2%89%A56-DC382D)](https://redis.io)
-[![Tests](https://img.shields.io/badge/tests-404%20unit%20%2B%20105%20integration%20%2B%20111%20e2e-brightgreen)](./tests)
+[![Tests](https://img.shields.io/badge/tests-505%20unit%20%2B%20355%20integration%20%2B%20123%20e2e-brightgreen)](./tests)
 [![Docs](https://img.shields.io/badge/docs-published-C26A4B)](https://arcoders.github.io/Adonisjs-lasagna-saas-tenancy/)
 [![License](https://img.shields.io/badge/License-MIT-blue)](./LICENSE)
 
@@ -36,7 +36,7 @@ nothing leaked, you already know the problem this solves.
 If you'd rather see it run than read about it, jump to
 [examples/api/](examples/api/). It's a real AdonisJS 7 app that
 exercises every feature, and one `npm run test:e2e` brings up the stack
-and runs 111 tests against it.
+and runs 123 tests against it.
 
 🔒 **Audited against real production failure modes** — cross-tenant isolation under concurrency, quota atomicity, SSO replay, audit immutability, header-vs-domain hijack, and more. [See what we verified →](https://arcoders.github.io/Adonisjs-lasagna-saas-tenancy/why#hardened-against-the-failures-that-bite-you-in-production)
 
@@ -112,7 +112,7 @@ docker compose -f compose.test.yml up -d
 npm run test:e2e
 ```
 
-The 111-test e2e suite covers provisioning, schema isolation,
+The 123-test e2e suite covers provisioning, schema isolation,
 contextual logging across HTTP + queue, the doctor command, backups +
 restore + clone, quotas → 429, lifecycle events, the admin REST API,
 mail context propagation, replica routing, and the webhook delivery

bin/test.integration.ts

@@ -16,18 +16,27 @@ const FIXTURE_ROOT = new URL('../tests/fixtures/', import.meta.url)
 // passed. Swallow this *specific* error only after we've started the
 // shutdown handshake; anything else still surfaces as a real failure.
 let isShuttingDown = false
-process.on('unhandledRejection', (reason) => {
+const isConnectionTerminated = (reason: unknown): boolean => {
   const message =
     reason instanceof Error
       ? reason.message
       : typeof reason === 'string'
         ? reason
         : ''
-  if (isShuttingDown && /^Connection terminated/.test(message)) {
-    return
-  }
+  return /^Connection terminated/.test(message)
+}
+process.on('unhandledRejection', (reason) => {
+  if (isShuttingDown && isConnectionTerminated(reason)) return
   throw reason
 })
+// Same root cause as the unhandledRejection above, but pg surfaces it
+// via the Client's `'error'` event when no query is queued — with no
+// listener, Node escalates to uncaughtException and the process exits 1
+// even though every test passed.
+process.on('uncaughtException', (err) => {
+  if (isShuttingDown && isConnectionTerminated(err)) return
+  throw err
+})
 
 const IMPORTER = (filePath: string) => {
   if (filePath.startsWith('./') || filePath.startsWith('../')) {

docs/.vitepress/config.ts

@@ -91,7 +91,7 @@ export default defineConfig({
       { text: 'Showcase', link: '/showcase' },
       { text: 'Sponsor', link: '/sponsor' },
       {
-        text: 'v0.2.0',
+        text: 'v0.2.1',
         items: [
           { text: 'Changelog', link: `${REPO}/blob/master/CHANGELOG.md` },
           { text: 'Release notes', link: '/docs/release-notes' },

docs/.vitepress/theme/components/HomeLayered.vue

@@ -68,7 +68,7 @@ const pillars: Pillar[] = [
     <section class="hl-hero">
       <div class="hl-hero__copy">
         <p class="hl-eyebrow">
-          <PhStar :size="14" weight="fill" /> AdonisJS · v0.2.0
+          <PhStar :size="14" weight="fill" /> AdonisJS · v0.2.1
         </p>
         <h1 class="hl-title">
           The only multi-tenant layer

docs/data/comparison.json

@@ -1,7 +1,7 @@
 {
   "$schema": "comparison.schema",
   "package": "@adonisjs-lasagna/saas-tenancy",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "compared": "stancl/tenancy v3 (Tenancy for Laravel)",
   "categories": [
     { "id": "identification", "label": "Tenant identification" },