Merge issue-31-ci-test-db-fix: CI test database guards (#31)

Author: alexeygrigorev

_docs/architecture/shared-primitives.md

@@ -71,9 +71,11 @@ dispatch models remain owned by their named `core` or `jobs` modules. Domain cod
 services instead of importing presentation or worker code.
 
 PostgreSQL row and statement triggers reject application `UPDATE`, `DELETE`, and `TRUNCATE` of
-append-only audit evidence. The test settings module explicitly opts into omitting the truncate
-trigger, and the migration accepts that opt-in only for a Django-generated database whose name has
-the `test_` prefix, so `TransactionTestCase` can flush without weakening a deployed database.
+append-only audit evidence. The code-owned test settings module explicitly opts into omitting the
+truncate trigger, and the migration accepts that opt-in only for the ephemeral CI database
+`dtc_test` or a Django-generated database whose name has the `test_` prefix. A database name alone
+never enables the exception, so `TransactionTestCase` can flush without weakening a deployed
+database.
 Production maintenance must use an explicitly reviewed privileged procedure. These triggers harden
 normal application and operator paths, but they do not protect against a database table owner who
 deliberately drops or disables them.

core/migrations/0001_initial.py

@@ -16,6 +16,15 @@
     ),
 )
 
+APPEND_ONLY_EXPLICIT_TEST_DATABASE_NAMES = frozenset({"dtc_test"})
+
+
+def is_append_only_test_database(database_name):
+    return (
+        database_name in APPEND_ONLY_EXPLICIT_TEST_DATABASE_NAMES
+        or database_name.startswith("test_")
+    )
+
 
 def install_append_only_guards(apps, schema_editor):
     del apps
@@ -26,7 +35,7 @@ def install_append_only_guards(apps, schema_editor):
     allow_test_flush = bool(
         getattr(settings, "CORE_ALLOW_APPEND_ONLY_TEST_FLUSH", False)
     )
-    if allow_test_flush and not database_name.startswith("test_"):
+    if allow_test_flush and not is_append_only_test_database(database_name):
         raise RuntimeError("append-only test flush requires a Django test database")
     for table, function, retention_column in APPEND_ONLY_GUARDS:
         trigger = f"{function}_trigger"

core/tests/test_shared_primitives.py

@@ -688,19 +688,50 @@ def test_migration_test_flush_exception_requires_explicit_setting_and_test_name(
         source = migration.read_text()
         self.assertIn("BEFORE TRUNCATE", source)
         self.assertIn("CORE_ALLOW_APPEND_ONLY_TEST_FLUSH", source)
+        self.assertIn('frozenset({"dtc_test"})', source)
         self.assertIn('database_name.startswith("test_")', source)
         self.assertIn("truncate_trigger", source)
 
         migration_module = import_module("core.migrations.0001_initial")
-        schema_editor = mock.Mock()
-        schema_editor.connection.vendor = "postgresql"
-        schema_editor.connection.settings_dict = {"NAME": "production"}
-        with (
-            override_settings(CORE_ALLOW_APPEND_ONLY_TEST_FLUSH=True),
-            self.assertRaisesRegex(RuntimeError, "requires a Django test database"),
+
+        def schema_editor_for(database_name: str):
+            schema_editor = mock.Mock()
+            schema_editor.connection.vendor = "postgresql"
+            schema_editor.connection.settings_dict = {"NAME": database_name}
+            schema_editor.connection.ops.quote_name.side_effect = lambda value: f'"{value}"'
+            return schema_editor
+
+        for database_name in ("dtc_test", "test_dtc_test", "test_dtc_test_1"):
+            with self.subTest(database_name=database_name):
+                schema_editor = schema_editor_for(database_name)
+                with override_settings(CORE_ALLOW_APPEND_ONLY_TEST_FLUSH=True):
+                    migration_module.install_append_only_guards(None, schema_editor)
+                statements = "\n".join(
+                    str(call.args[0]) for call in schema_editor.execute.call_args_list
+                )
+                self.assertNotIn("BEFORE TRUNCATE", statements)
+                self.assertIn("BEFORE UPDATE OR DELETE", statements)
+
+        for database_name in (
+            "production",
+            "website_test",
+            "dtc_test_1",
+            "dtc_test_backup",
         ):
+            with self.subTest(database_name=database_name):
+                schema_editor = schema_editor_for(database_name)
+                with (
+                    override_settings(CORE_ALLOW_APPEND_ONLY_TEST_FLUSH=True),
+                    self.assertRaisesRegex(RuntimeError, "requires a Django test database"),
+                ):
+                    migration_module.install_append_only_guards(None, schema_editor)
+                schema_editor.execute.assert_not_called()
+
+        schema_editor = schema_editor_for("dtc_test")
+        with override_settings(CORE_ALLOW_APPEND_ONLY_TEST_FLUSH=False):
             migration_module.install_append_only_guards(None, schema_editor)
-        schema_editor.execute.assert_not_called()
+        statements = "\n".join(str(call.args[0]) for call in schema_editor.execute.call_args_list)
+        self.assertIn("BEFORE TRUNCATE", statements)
 
     @skipUnlessDBFeature("has_select_for_update")
     def test_postgresql_production_truncate_guards_reject_and_reapply(self) -> None:

website/settings/test.py

@@ -26,8 +26,9 @@
 NOINDEX = True
 OBSERVABILITY_EVENT_BACKENDS = ["noop"]
 # Django's TransactionTestCase flushes tables with TRUNCATE. The core migration
-# also requires the connection's generated database name to start with `test_`,
-# so this code-owned opt-in cannot weaken a deployed database accidentally.
+# also requires either Django's generated `test_*` name or the explicitly
+# provisioned CI database `dtc_test`, so this code-owned opt-in cannot weaken a
+# deployed database merely because of its name.
 CORE_ALLOW_APPEND_ONLY_TEST_FLUSH = True
 Q_CLUSTER = {**Q_CLUSTER, "sync": True}  # noqa: F405
 MIDDLEWARE = [