fix(openapi): harden story 2.1 production lifecycle

apps/admin-api/tests/config_startup.rs

@@ -1,4 +1,11 @@
-use std::process::Command;
+use std::{
+    fs,
+    io::Read,
+    os::unix::fs::PermissionsExt,
+    process::{Command, Stdio},
+    sync::atomic::{AtomicU64, Ordering},
+    time::{SystemTime, UNIX_EPOCH},
+};
 
 use crank_registry::{MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry};
 use crank_runtime::SecretCrypto;
@@ -7,6 +14,7 @@ use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
 const REGISTERED_MASTER_KEY: &str = "registered-master-key-CANARY_SECRET_VALUE-00000000";
 const WRONG_MASTER_KEY: &str = "wrong-master-key-CANARY_SECRET_VALUE-0000000000000";
+static NEXT_STORAGE_ROOT: AtomicU64 = AtomicU64::new(0);
 
 fn run_with(entries: &[(&str, &str)]) -> String {
     let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
@@ -78,6 +86,105 @@ async fn fresh_database_startup_is_read_only() {
     assert!(!present);
 }
 
+#[tokio::test]
+async fn real_admin_startup_runs_immediate_import_maintenance() {
+    let unique = NEXT_STORAGE_ROOT.fetch_add(1, Ordering::Relaxed);
+    let epoch = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let database_url =
+        crank_test_support::postgres_schema_url(&format!("startup_maint_{epoch}_{unique}")).await;
+    let applied = Command::new(env!("CARGO_BIN_EXE_crank-migrate"))
+        .arg("apply")
+        .env("CRANK_DATABASE_URL", &database_url)
+        .output()
+        .expect("migration command executes");
+    assert!(
+        applied.status.success(),
+        "{}",
+        String::from_utf8_lossy(&applied.stderr)
+    );
+    let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
+    assert_eq!(
+        sqlx::query_scalar::<_, Option<i64>>("select max(version) from __crank_migrations")
+            .fetch_one(&pool)
+            .await
+            .unwrap(),
+        Some(13),
+        "migration binary must install the current canonical ledger",
+    );
+    sqlx::query(
+        "insert into import_jobs (
+            id, workspace_id, kind, source_format, source_version, status,
+            preview_payload, created_operation_ids, error_text, created_at, expires_at, finished_at
+         ) values (
+            'imp_startup_expired', 'ws_default', 'openapi', 'openapi', null, 'pending',
+            '{\"source\": {\"source_id\": 1}}'::jsonb, '[]'::jsonb, null,
+            now() - interval '2 hours', now() - interval '1 hour', null
+         )",
+    )
+    .execute(&pool)
+    .await
+    .unwrap();
+
+    let storage_root = std::env::temp_dir().join(format!(
+        "crank-admin-startup-maintenance-{}-{epoch}-{unique}",
+        std::process::id()
+    ));
+    fs::create_dir(&storage_root).unwrap();
+    fs::set_permissions(&storage_root, fs::Permissions::from_mode(0o700)).unwrap();
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let bind_addr = listener.local_addr().unwrap().to_string();
+    drop(listener);
+
+    let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
+    for field in crank_config::field_registry() {
+        command.env_remove(field.env_name);
+    }
+    let mut child = command
+        .envs([
+            ("CRANK_DATABASE_URL", database_url.as_str()),
+            ("CRANK_MASTER_KEY", TEST_MASTER_KEY),
+            ("CRANK_SESSION_SECRET", "session"),
+            ("CRANK_PASSWORD_PEPPER", "pepper"),
+            ("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
+            ("CRANK_BOOTSTRAP_ADMIN_PASSWORD", "password"),
+            ("CRANK_ADMIN_BIND", bind_addr.as_str()),
+            ("CRANK_STORAGE_ROOT", storage_root.to_str().unwrap()),
+        ])
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("admin binary starts");
+
+    let mut cleaned = false;
+    for _ in 0..200 {
+        if let Some(status) = child.try_wait().unwrap() {
+            let mut stderr = String::new();
+            if let Some(mut stream) = child.stderr.take() {
+                stream.read_to_string(&mut stderr).unwrap();
+            }
+            panic!("admin binary exited before startup maintenance: {status}: {stderr}");
+        }
+        let remaining: i64 =
+            sqlx::query_scalar("select count(*) from import_jobs where id = 'imp_startup_expired'")
+                .fetch_one(&pool)
+                .await
+                .unwrap();
+        if remaining == 0 {
+            cleaned = true;
+            break;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+    }
+
+    child.kill().expect("admin binary can be stopped");
+    child.wait().expect("admin binary can be reaped");
+    fs::remove_dir_all(&storage_root).unwrap();
+    assert!(cleaned, "real startup did not clean the expired import job");
+}
+
 #[tokio::test]
 async fn master_key_mismatch_blocks_startup_with_safe_diagnostic() {
     let database_url = crank_test_support::postgres_schema_url("admin_master_key_mismatch").await;

apps/admin-api/tests/integration/openapi_import.rs

@@ -81,6 +81,7 @@ async fn previews_openapi_and_creates_draft_operations() {
         .unwrap();
 
     assert_eq!(created.created.len(), 1);
+    assert_eq!(created.created[0].operation_key, "GET /v2/latest");
     assert_eq!(created.created[0].name, "latest_rates");
     assert!(created.skipped.is_empty());
 
@@ -176,6 +177,46 @@ async fn previews_openapi_and_creates_draft_operations() {
     assert_eq!(renamed.findings[0].code, "operation_name_renamed");
 }
 
+#[tokio::test]
+#[serial]
+async fn unknown_selected_operations_are_persisted_in_the_canonical_replay() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry,
+        test_storage_root("openapi_import_unknown_replay"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let payload = OpenApiImportCreatePayload {
+        selected_operation_keys: vec!["GET /v2/latest".to_owned(), "GET /missing".to_owned()],
+        server_url: Some("https://api.frankfurter.dev".to_owned()),
+        conflict_mode: "skip".to_owned(),
+    };
+
+    let first = service
+        .create_openapi_import(
+            &workspace_id,
+            &preview.job_id.as_str().into(),
+            payload.clone(),
+        )
+        .await
+        .unwrap();
+    let replayed = service
+        .create_openapi_import(&workspace_id, &preview.job_id.as_str().into(), payload)
+        .await
+        .unwrap();
+
+    assert_eq!(first.created, replayed.created);
+    assert_eq!(first.skipped, replayed.skipped);
+    assert_eq!(first.skipped.len(), 1);
+    assert_eq!(first.skipped[0].operation_key, "GET /missing");
+}
+
 #[tokio::test]
 #[serial]
 async fn concurrent_openapi_import_replays_the_same_atomic_result() {
@@ -231,6 +272,55 @@ async fn concurrent_openapi_import_replays_the_same_atomic_result() {
     assert!(conflicting_replay.is_err());
 }
 
+#[tokio::test]
+#[serial]
+async fn apply_fails_closed_when_the_preview_parser_contract_drifts() {
+    let registry = test_registry().await;
+    let service = test_service(
+        registry.clone(),
+        test_storage_root("openapi_import_parser_drift"),
+        test_auth_settings(),
+        test_secret_crypto(),
+    );
+    let workspace_id = WorkspaceId::new("ws_default");
+    let preview = service
+        .preview_openapi_import(&workspace_id, openapi_upload())
+        .await
+        .unwrap();
+    let job_id: crank_registry::ImportJobId = preview.job_id.as_str().into();
+    sqlx::query(
+        "update import_jobs
+            set preview_payload = jsonb_set(preview_payload, '{preview_digest}', to_jsonb($1::text))
+          where id = $2",
+    )
+    .bind("0".repeat(64))
+    .bind(job_id.as_str())
+    .execute(registry.pool())
+    .await
+    .unwrap();
+
+    let result = service
+        .create_openapi_import(
+            &workspace_id,
+            &job_id,
+            OpenApiImportCreatePayload {
+                selected_operation_keys: vec!["GET /v2/latest".to_owned()],
+                server_url: Some("https://api.frankfurter.dev".to_owned()),
+                conflict_mode: "rename".to_owned(),
+            },
+        )
+        .await;
+
+    assert!(result.is_err());
+    assert!(
+        service
+            .list_operations(&workspace_id)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+}
+
 fn openapi_upload() -> OpenApiUpload {
     OpenApiUpload {
         bytes: OPENAPI3.as_bytes().to_vec(),

apps/admin-api/tests/integration/openapi_source.rs

@@ -385,6 +385,16 @@ async fn multipart_boundary_rejections_are_localized_and_leave_no_entities() {
         Some("no supported methods"),
     )
     .await;
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>(
+            "select count(*) from artifact_sources where lifecycle = 'active'",
+        )
+        .fetch_one(registry.pool())
+        .await
+        .unwrap(),
+        0,
+        "no_methods must not leave an active source behind",
+    );
     assert_rejected(
         &client,
         &server,
@@ -432,6 +442,42 @@ async fn multipart_boundary_rejections_are_localized_and_leave_no_entities() {
     assert!(!rendered.contains("digest"));
 }
 
+#[tokio::test(flavor = "multi_thread")]
+#[serial]
+async fn cleanup_is_bounded_and_malformed_expired_jobs_do_not_block_later_rows() {
+    let registry = test_registry().await;
+    for index in 0..129 {
+        sqlx::query(
+            "insert into import_jobs (
+                id, workspace_id, kind, source_format, source_version, status,
+                preview_payload, created_operation_ids, error_text, created_at, expires_at, finished_at
+             ) values (
+                $1, 'ws_default', 'openapi', 'openapi', null, 'pending',
+                '{\"source\": {\"source_id\": 1}}'::jsonb, '[]'::jsonb, null,
+                now() - interval '2 hours', now() - interval '1 hour', null
+             )",
+        )
+        .bind(format!("imp_cleanup_{index:03}"))
+        .execute(registry.pool())
+        .await
+        .unwrap();
+    }
+
+    let first = registry.cleanup_expired_import_jobs(128).await.unwrap();
+    assert_eq!(first.deleted_jobs, 128);
+    assert!(first.more_work);
+    let second = registry.cleanup_expired_import_jobs(128).await.unwrap();
+    assert_eq!(second.deleted_jobs, 1);
+    assert!(!second.more_work);
+    assert_eq!(
+        sqlx::query_scalar::<_, i64>("select count(*) from import_jobs")
+            .fetch_one(registry.pool())
+            .await
+            .unwrap(),
+        0,
+    );
+}
+
 async fn wait_for_source_lifecycle(
     registry: &crank_registry::PostgresRegistry,
     lifecycle: ArtifactSourceLifecycle,
@@ -746,11 +792,15 @@ async fn cancellation_detaches_and_restart_cleanup_recovers_a_dangling_source()
     preview_task.abort();
     let cancellation = preview_task.await.unwrap_err();
     assert!(cancellation.is_cancelled());
-    wait_for_blocked_import_insert_to_stop(&observer).await;
+    // Dropping a sqlx query future does not synchronously cancel the backend
+    // statement. Release the artificial blocker first; the abandoned
+    // transaction can then finish and roll back before the detach fallback
+    // obtains another pooled connection.
     sqlx::query("select pg_advisory_unlock(2147483001)")
         .execute(&mut *lock_connection)
         .await
         .unwrap();
+    wait_for_blocked_import_insert_to_stop(&observer).await;
     wait_for_specific_source_lifecycle(
         &registry,
         &cancelled_source_id,