Refresh Stock Reservation example: Hono, Bun.SQL and ClickHouse Managed Postgres

.github/workflows/stock-reservation.yml

@@ -31,4 +31,4 @@ jobs:
       - run: bun run test:unit
 
 # Managed Postgres integration tests are an explicit run with dedicated fixtures.
-# See applications/stock-reservation/tests/README.md for the managed-service suite.
+# See the "Test" section of applications/stock-reservation/README.md.

README.md

@@ -114,8 +114,7 @@ Browse [all local analytics examples](./local-analytics/README.md) for more file
 
 | Directory | What you'll find |
 | --- | --- |
-| [applications](./applications/) | Application examples: a link shortener, feature request board, report results, and run history with ClickHouse Cloud. |
-| [applications](./applications/) | Application examples: workshop bookings, a link shortener, report results, and run history with ClickHouse Cloud. |
+| [applications](./applications/) | Application examples: stock reservations, workshop bookings, a feature request board, a link shortener, report results, and run history with ClickHouse Cloud. |
 | [ai](./ai/README.md) | AI agents, MCP integrations, and workflows using `clickhousectl`. |
 | [blog-examples](./blog-examples/) | Code and resources accompanying the [ClickHouse Blog](https://clickhouse.com/blog). |
 | [clickstack](./clickstack/) | Observability examples for LLM applications and MCP servers. |

applications/stock-reservation/package.json

@@ -9,7 +9,7 @@
     "dev": "bun --watch src/server.ts",
     "start": "bun src/server.ts",
     "typecheck": "tsc --noEmit",
-    "test": "bun test tests/unit.test.ts",
+    "test": "tsc --noEmit && bun test tests/unit.test.ts",
     "test:unit": "bun test tests/unit.test.ts",
     "test:integration": "bun test --timeout 30000 tests/integration.test.ts tests/tls.test.ts"
   },

applications/stock-reservation/sql/bootstrap.sql → applications/stock-reservation/sql/01_roles.sql

@@ -1,8 +1,8 @@
 -- Run ONCE as the service administrator with psql -X -v ON_ERROR_STOP=1.
 -- Passwords come from the environment, not process arguments or committed files.
--- PG_MIGRATION_PASSWORD and PG_APP_PASSWORD must contain random generated passwords.
-\getenv migration_password PG_MIGRATION_PASSWORD
-\getenv app_password PG_APP_PASSWORD
+-- MIGRATOR_PASSWORD and APP_PASSWORD must contain random generated passwords.
+\getenv migration_password MIGRATOR_PASSWORD
+\getenv app_password APP_PASSWORD
 
 BEGIN;
 

applications/stock-reservation/sql/cleanup.sql → applications/stock-reservation/sql/99_cleanup.sql

@@ -1,5 +1,5 @@
 -- DESTRUCTIVE: removes all Stock Reservation example data and its three roles.
--- Stop the API first. Run as the same service administrator used for bootstrap.
+-- Stop the API first. Run as the same service administrator that ran 01_roles.sql.
 -- This does not delete the ClickHouse Cloud service or affect other schemas.
 BEGIN;
 

applications/stock-reservation/src/database.ts

@@ -1,6 +1,16 @@
 import { SQL } from "bun";
 import { validateDatabaseUrl, type DatabaseConfig } from "./config.ts";
 
+// ClickHouse Managed Postgres: verify the server certificate and hostname against
+// the service CA from `clickhousectl cloud postgres certs get`. Keep the URL plain
+// (no sslmode or channel_binding); TLS is configured here. Everything else is plain
+// Postgres.
+//
+// Bun 1.4.2 can fail with CERT_SIGNATURE_FAILURE on a CA bundle that holds several
+// roots with the same subject (as during a CA rotation). On that error only, each
+// certificate in the bundle is tried on its own, still verifying certificate and
+// hostname. The first anchor that works is kept for the life of the process, so
+// re-download the bundle and restart after a CA rotation.
 export async function createDatabase(config: DatabaseConfig): Promise<SQL> {
   const url = validateDatabaseUrl(config.url);
   // Only this known Bun option is added internally. It overrides ambient PGSSLMODE;
@@ -37,9 +47,7 @@ export async function createDatabase(config: DatabaseConfig): Promise<SQL> {
     return await connect(ca);
   } catch (originalError) {
     if (errorCode(originalError) !== "CERT_SIGNATURE_FAILURE" || certificates.length < 2) throw originalError;
-    // Bun 1.4.2 can reject a rotation bundle containing roots with the same subject.
-    // Retry only the supplied trust anchors, always verifying certificate AND hostname.
-    // The first successful pool retains that CA until the application restarts.
+    // See the CA bundle note above: retry each supplied anchor on its own.
     for (const certificate of certificates) {
       try {
         return await connect(certificate);

applications/stock-reservation/tests/integration.test.ts

@@ -30,7 +30,7 @@ type Reservation = {
 
 function required(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`Integration tests require ${name}; see tests/README.md.`);
+  if (!value) throw new Error(`Integration tests require ${name}; see the README Test section.`);
   return value;
 }
 

applications/stock-reservation/tests/tls.test.ts

@@ -10,7 +10,7 @@ let trusted: SQL;
 beforeAll(async () => {
   const url = process.env.DATABASE_URL;
   const caCertPath = process.env.PG_CA_CERT_PATH;
-  if (!url || !caCertPath) throw new Error("TLS tests require DATABASE_URL and PG_CA_CERT_PATH; see tests/README.md.");
+  if (!url || !caCertPath) throw new Error("TLS tests require DATABASE_URL and PG_CA_CERT_PATH; see the README Test section.");
   configuration = { url, caCertPath, maxConnections: 1 };
   trusted = await createDatabase(configuration);
   // Establish the positive control first. Offline/bad-credential failures must