From 3840eddf490e1379163acd4e35110651ba349405 Mon Sep 17 00:00:00 2001
From: Simon Gagnon <git@simoncrypta.dev>
Date: Thu, 8 Oct 2026 12:37:49 -0400
Subject: [PATCH] fix(acquire): keep the lease's role for the same database

acquire derived the role name on every call. After #44 changed role naming
for long worktree names, an existing long-named dev database mapped to a new
role: ensureDatabase handed the database to it while its tables stayed owned
by the old role (permission denied), and the rewritten lease lost the old one.

acquire now reuses the role stored in an existing lease when that lease is
for the same database (fresh drops by it too); new databases keep the new
naming. CHANGELOG corrected to describe the real behaviour.

Refs: cedar-pg-n8i

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                    |   2 +-
 src/core/lifecycle.ts           |  12 +++-
 tests/lifecycle-acquire.test.ts | 120 ++++++++++++++++++++++++++++++++
 3 files changed, 130 insertions(+), 4 deletions(-)
 create mode 100644 tests/lifecycle-acquire.test.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9233d07..ec5bc34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,7 +35,7 @@
 - TEMPLATE `cloneWorkerDatabase` reuses the worker's `<template>_c_<workerId>` in Postgres across Jest test files. The `0.2.0-beta.0` fix cached the clone on `globalThis`, but Jest resets `globalThis` and the module registry for each test file. So the second file in a worker still ran `CREATE DATABASE` and failed with `database already exists`. The in-memory memo is removed; the database is the source of truth. As a result, calling it again with a different `root` / `name` in one process no longer throws: each call clones or reuses its own name. `smoke:pg` now runs two Jest files in one worker, after a seeded crashed run.
 - TEMPLATE workers (`cloneWorkerDatabase`, and `cloneFromTemplate` / `markTemplate` without `adminUrl`) attach to the leased port like `cedarpg run --attach`: they read the lease and probe it once. They no longer rediscover the host on every test file (git, `autopg --version`, `autopg status`) and never start or revive it from a worker; a dark leased port fails with a message to re-run acquire. The outdated-autopg warning now prints once per run from setup instead of once per Jest test file.
 
-- Role and TEMPLATE clone names for long worktree names keep the full `_<mode>_<pathHash8>`. To stay within 63 chars, cedar-pg used to cut the end of the database name before adding `_role`, which kept only 3 hash characters. Two worktrees whose names cut to the same prefix then shared one role (about 1 in 4,096), and TEMPLATE setup (`fresh`) or `dispose` in one dropped the other's databases. Clone names with the default `<pid>_<time>` suffix lost the hash and mode entirely. Now the readable `<repo>_<worktree>` part is cut instead. Short names are unchanged, and existing leases keep their stored role. For long names, `fresh` does not find leftovers created under the old cut role name; drop those by hand if any remain.
+- Role and TEMPLATE clone names for long worktree names keep the full `_<mode>_<pathHash8>`. To stay within 63 chars, cedar-pg used to cut the end of the database name before adding `_role`, which kept only 3 hash characters. Two worktrees whose names cut to the same prefix then shared one role (about 1 in 4,096), and TEMPLATE setup (`fresh`) or `dispose` in one dropped the other's databases. Clone names with the default `<pid>_<time>` suffix lost the hash and mode entirely. Now the readable `<repo>_<worktree>` part is cut instead. Short names are unchanged. `acquire` (and `fresh`) keeps the role stored in an existing lease for the same database, so a long-named dev database created before this release keeps its role and its data stays readable; only new databases get the new role name. Without that lease file, `acquire` uses the new name: it does not find leftovers created under the old cut role, and an existing database would be handed to the new role while its tables stay owned by the old one. Drop such databases by hand (or restore the lease) before acquiring.
 
 ## 0.2.0-beta.1
 
diff --git a/src/core/lifecycle.ts b/src/core/lifecycle.ts
index 4c18263..c348aa3 100644
--- a/src/core/lifecycle.ts
+++ b/src/core/lifecycle.ts
@@ -53,8 +53,9 @@ export type AcquireOptions = {
   /**
    * Start from an empty database (default false): first DROP every database
    * owned by this worktree's role for `mode` — the leased DB, TEMPLATE clones,
-   * crashed-run leftovers — then create it again. Scoped by the derived role
-   * name, so it works without a lease file and never touches other worktrees.
+   * crashed-run leftovers — then create it again. Scoped by the role (the
+   * lease's when it is for this database, else the derived name), so it works
+   * without a lease file and never touches other worktrees.
    */
   fresh?: boolean;
 };
@@ -84,7 +85,12 @@ export async function acquire(options: AcquireOptions): Promise<AcquireResult> {
   const identity = resolveWorktreeIdentity(options.root);
   const mode = options.mode;
   const databaseName = buildDatabaseName(identity, mode);
-  const roleName = buildRoleName(databaseName);
+  // A lease for this database pins its role: objects inside belong to that role,
+  // and handing the DB to a newly derived name (naming changed for long names in
+  // 0.2.0-beta.2) would leave the app without access to its own tables.
+  const leased = readLease(identity.root, mode);
+  const roleName =
+    leased?.databaseName === databaseName ? leased.roleName : buildRoleName(databaseName);
 
   const host = await ensureHostRunning();
   if (options.fresh) {
diff --git a/tests/lifecycle-acquire.test.ts b/tests/lifecycle-acquire.test.ts
new file mode 100644
index 0000000..b810b84
--- /dev/null
+++ b/tests/lifecycle-acquire.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, expect, test, vi } from "vite-plus/test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readLease, writeLease, type Lease } from "../src/core/lease.ts";
+import { buildDatabaseName, buildRoleName } from "../src/core/naming.ts";
+import { resolveWorktreeIdentity } from "../src/core/worktree.ts";
+
+let registry: string;
+let root: string;
+let prevRegistry: string | undefined;
+
+beforeEach(() => {
+  registry = mkdtempSync(join(tmpdir(), "cedarpg-reg-"));
+  // Long basename → a 63-char database name, where pre-#44 role naming cut the hash.
+  root = mkdtempSync(join(tmpdir(), "cedarpg-wt-a-long-worktree-name-for-the-role-upgrade-"));
+  prevRegistry = process.env.CEDAR_PG_REGISTRY_DIR;
+  process.env.CEDAR_PG_REGISTRY_DIR = registry;
+
+  vi.resetModules();
+  vi.doMock("../src/providers/host.ts", async () => {
+    const actual = await vi.importActual<typeof import("../src/providers/host.ts")>(
+      "../src/providers/host.ts",
+    );
+    return {
+      ...actual,
+      ensureHostRunning: async () => ({
+        adminUrl: "postgresql://postgres@127.0.0.1:5432/postgres",
+        port: 5432,
+        bin: "autopg",
+      }),
+    };
+  });
+  vi.doMock("../src/providers/autopg.ts", async () => {
+    const actual = await vi.importActual<typeof import("../src/providers/autopg.ts")>(
+      "../src/providers/autopg.ts",
+    );
+    return {
+      ...actual,
+      ensureDatabase: vi.fn(async () => {}),
+      dropDatabasesOwnedByRole: vi.fn(async () => []),
+    };
+  });
+});
+
+afterEach(() => {
+  vi.doUnmock("../src/providers/host.ts");
+  vi.doUnmock("../src/providers/autopg.ts");
+  vi.resetModules();
+  if (prevRegistry === undefined) delete process.env.CEDAR_PG_REGISTRY_DIR;
+  else process.env.CEDAR_PG_REGISTRY_DIR = prevRegistry;
+  rmSync(registry, { recursive: true, force: true });
+  rmSync(root, { recursive: true, force: true });
+});
+
+function seedLease(databaseName: string, roleName: string): Lease {
+  const identity = resolveWorktreeIdentity(root);
+  const lease: Lease = {
+    schemaVersion: 1,
+    mode: "dev",
+    root: identity.root,
+    repoSlug: identity.repoSlug,
+    worktreeSlug: identity.worktreeSlug,
+    pathHash: identity.pathHash,
+    databaseName,
+    roleName,
+    port: 5432,
+    pid: 1,
+    createdAt: "2026-01-01T00:00:00.000Z",
+  };
+  writeLease(lease);
+  return lease;
+}
+
+test("acquire keeps the lease's role for the same database (pre-#44 cut role survives)", async () => {
+  const databaseName = buildDatabaseName(resolveWorktreeIdentity(root), "dev");
+  const oldRole = `${databaseName.slice(0, 58)}_role`;
+  expect(databaseName).toHaveLength(63);
+  expect(buildRoleName(databaseName)).not.toBe(oldRole);
+  seedLease(databaseName, oldRole);
+
+  const { acquire } = await import("../src/core/lifecycle.ts");
+  const autopg = await import("../src/providers/autopg.ts");
+  const result = await acquire({ root, mode: "dev", setEnv: false, fresh: true });
+
+  expect(result.roleName).toBe(oldRole);
+  expect(result.databaseUrl).toContain(`${oldRole}:`);
+  expect(autopg.ensureDatabase).toHaveBeenCalledWith(
+    expect.objectContaining({ databaseName, roleName: oldRole }),
+  );
+  expect(autopg.dropDatabasesOwnedByRole).toHaveBeenCalledWith(
+    expect.objectContaining({ roleName: oldRole }),
+  );
+  expect(readLease(root, "dev")?.roleName).toBe(oldRole);
+});
+
+test("acquire derives the role when the lease is for a different database", async () => {
+  const databaseName = buildDatabaseName(resolveWorktreeIdentity(root), "dev");
+  seedLease("cpg_other_db_dev_00000000", "cpg_other_db_dev_00000000_role");
+
+  const { acquire } = await import("../src/core/lifecycle.ts");
+  const autopg = await import("../src/providers/autopg.ts");
+  const result = await acquire({ root, mode: "dev", setEnv: false });
+
+  expect(result.databaseName).toBe(databaseName);
+  expect(result.roleName).toBe(buildRoleName(databaseName));
+  expect(autopg.ensureDatabase).toHaveBeenCalledWith(
+    expect.objectContaining({ databaseName, roleName: buildRoleName(databaseName) }),
+  );
+  expect(readLease(root, "dev")?.roleName).toBe(buildRoleName(databaseName));
+});
+
+test("acquire derives the role without a lease", async () => {
+  const databaseName = buildDatabaseName(resolveWorktreeIdentity(root), "dev");
+
+  const { acquire } = await import("../src/core/lifecycle.ts");
+  const result = await acquire({ root, mode: "dev", setEnv: false });
+
+  expect(result.roleName).toBe(buildRoleName(databaseName));
+});