🧪 test(pypi): exercise shadow read faults

An oversized repository route stopped reaching the shadow query after startup
began enforcing repository persistence errors.

Corrupt a valid stored decision through the metadata migration boundary so both
fixtures exercise the intended decode failure through the public HTTP route.

Author: gaborbernat

crates/peryx-ecosystem-pypi/tests/system-suite/tests/cases/shadow.rs

@@ -12,7 +12,9 @@ use peryx_ecosystem_pypi::upload::Uploaded;
 use peryx_ecosystem_pypi::{CoreMetadata, File, Provenance, Yanked};
 use peryx_identity::{GrantScope, Role};
 use peryx_policy::{PolicyAction, PolicyDecisionState};
-use peryx_storage::meta::NewPolicyDecision;
+use peryx_storage::meta::{
+    LegacyMetadataSource, MetadataMigration, MetadataRecord, MetadataRecordSet, NewPolicyDecision,
+};
 use tower::ServiceExt as _;
 
 use crate::config::{Config, IndexConfig, IndexKind, SecretSource};
@@ -163,23 +165,6 @@ async fn seeded_state() -> (tempfile::TempDir, Arc<AppState>) {
     (dir, state)
 }
 
-async fn seeded_state_named(repository: &str) -> (tempfile::TempDir, Arc<AppState>) {
-    let dir = tempfile::tempdir().unwrap();
-    let mut root = virtual_root();
-    root.name = repository.to_owned();
-    root.route = repository.to_owned();
-    let config = Config {
-        data_dir: dir.path().to_path_buf(),
-        indexes: vec![cached_pypi(), hosted(), root],
-        ..Config::default()
-    };
-    let state = build_state(&config).unwrap();
-    provision_admin(&state).await;
-    seed_hosted(&state);
-    seed_cached(&state);
-    (dir, state)
-}
-
 async fn app() -> (tempfile::TempDir, axum::Router) {
     let (dir, state) = seeded_state().await;
     (dir, router_for(state))
@@ -339,13 +324,21 @@ async fn test_a_denied_filename_carries_its_decision_on_every_member_row() {
 
 #[tokio::test]
 async fn test_a_failed_decision_read_surfaces_as_a_server_error() {
-    let repository = "r".repeat(513);
-    let (_dir, state) = seeded_state_named(&repository).await;
+    let (_dir, state) = seeded_state().await;
+    record_decision(
+        &state,
+        Some(HOSTED_FILE),
+        PolicyAction::Serve,
+        PolicyDecisionState::Allow,
+        "read-fault",
+        None,
+    );
+    state.serving.meta.migrate_metadata(&UnreadableDecision).unwrap();
     let router = router_for(state);
 
     let (status, _headers, body) = get(
         &router,
-        &format!("/+shadow/candidates?repository={repository}&project=acme-pkg"),
+        "/+shadow/candidates?repository=root/pypi&project=acme-pkg",
         Some(("Alice", PASSWORD)),
     )
     .await;
@@ -355,6 +348,33 @@ async fn test_a_failed_decision_read_surfaces_as_a_server_error() {
     assert_eq!(document["error"], "shadow query failed");
 }
 
+struct UnreadableDecision;
+
+impl MetadataMigration for UnreadableDecision {
+    fn name(&self) -> &'static str {
+        "unreadable-decision"
+    }
+
+    fn record_sets(&self) -> &[MetadataRecordSet] {
+        &[MetadataRecordSet::PolicyDecisionHistory]
+    }
+
+    fn legacy_sources(&self) -> &[LegacyMetadataSource] {
+        &[]
+    }
+
+    fn rewrite(
+        &self,
+        _record_set: MetadataRecordSet,
+        record: &MetadataRecord,
+    ) -> Result<Option<MetadataRecord>, String> {
+        Ok(Some(MetadataRecord {
+            key: record.key.clone(),
+            value: b"{".to_vec(),
+        }))
+    }
+}
+
 #[tokio::test]
 async fn test_a_waiting_filename_reports_its_retry_window() {
     let (_dir, state) = seeded_state().await;

crates/peryx-ecosystem-pypi/tests/unit/shadow/coverage_tests.rs

@@ -12,7 +12,9 @@ use peryx_identity::{Action, Glob, Grant, GrantScope, IndexAcl, NamedToken, Role
 use peryx_index::{Index, IndexKind};
 use peryx_policy::{Policy, PolicyAction, PolicyDecisionState};
 use peryx_storage::blob::BlobStorage;
-use peryx_storage::meta::{MetaStore, NewPolicyDecision};
+use peryx_storage::meta::{
+    LegacyMetadataSource, MetaStore, MetadataMigration, MetadataRecord, MetadataRecordSet, NewPolicyDecision,
+};
 use redb::TableDefinition;
 use rstest::rstest;
 use tower::ServiceExt as _;
@@ -347,13 +349,14 @@ async fn shadow_contract_reports_malformed_parameters() {
 
 #[tokio::test]
 async fn shadow_candidates_hide_decision_store_errors() {
-    let repository = "r".repeat(513);
-    let (_directory, state) = seeded_state(&repository, &repository, IndexAcl::default());
-    let authorization = local_reader(&state, &repository).await;
+    let (_directory, state) = seeded_state("root-pypi", "root/pypi", IndexAcl::default());
+    record_decisions(&state);
+    state.serving.meta.migrate_metadata(&UnreadableDecision).unwrap();
+    let authorization = local_reader(&state, "root-pypi").await;
 
     let (status, _, body) = request(
         &state,
-        &format!("/+shadow/candidates?repository={repository}&project={PROJECT}"),
+        "/+shadow/candidates?repository=root/pypi&project=acme-pkg",
         Some(HeaderValue::from_str(&authorization).unwrap()),
     )
     .await;
@@ -365,6 +368,33 @@ async fn shadow_candidates_hide_decision_store_errors() {
     );
 }
 
+struct UnreadableDecision;
+
+impl MetadataMigration for UnreadableDecision {
+    fn name(&self) -> &'static str {
+        "unreadable-decision"
+    }
+
+    fn record_sets(&self) -> &[MetadataRecordSet] {
+        &[MetadataRecordSet::PolicyDecisionHistory]
+    }
+
+    fn legacy_sources(&self) -> &[LegacyMetadataSource] {
+        &[]
+    }
+
+    fn rewrite(
+        &self,
+        _record_set: MetadataRecordSet,
+        record: &MetadataRecord,
+    ) -> Result<Option<MetadataRecord>, String> {
+        Ok(Some(MetadataRecord {
+            key: record.key.clone(),
+            value: b"{".to_vec(),
+        }))
+    }
+}
+
 #[rstest]
 #[case::missing(None)]
 #[case::wrong_scheme(Some(HeaderValue::from_static("Bearer token")))]