test: add schema enforcement and schema-less table integration tests

Add four test cases per issue #1194:

- @Sealed enforcement: PUT and operations-API insert with undeclared
  fields are rejected with HTTP 400 and "is not allowed" error.
  (schema-enforcement.test.mjs)

- [String] @indexed array element search: REST queries on an indexed
  array field return only records whose array contains the queried
  element. (schema-enforcement.test.mjs)

- Brotli Blob Content-Encoding pass-through: a sourced resource that
  stores Brotli-compressed bytes and sets Content-Encoding: br in the
  get() response delivers that header through Harper's REST layer.
  (blob.test.mjs — new Brotli Blob suite)

- Schema-less table for MQTT retained messages: a table created via the
  operations API with no declared attributes (only hash_attribute)
  accepts arbitrary fields; upsert correctly overwrites the record for
  the same id, modelling retained-message semantics.
  (configuration.test.mjs)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: github-actions[bot]

integrationTests/apiTests/blob.test.mjs

@@ -27,6 +27,7 @@ import { setTimeout } from 'node:timers/promises';
 import { startHarper, teardownHarper } from '@harperfast/integration-testing';
 import { createApiClient } from './utils/client.mjs';
 import { restartHttpWorkers } from './utils/lifecycle.mjs';
+import { installAppComponent } from './utils/components.mjs';
 
 const skipSuite = process.platform === 'win32' || process.env.HARPER_RUNTIME === 'bun';
 
@@ -262,3 +263,92 @@ suite('Blob lifecycle', { skip: skipSuite }, (ctx) => {
 		}
 	});
 });
+
+// ── Brotli Blob Content-Encoding pass-through ─────────────────────────────────
+//
+// Validates that a sourced resource can store Brotli-compressed bytes as a Blob
+// and serve them back with Content-Encoding: br. Harper must pass through the
+// header rather than re-compressing or stripping it.
+//
+// Skipped under the same conditions as the parent suite (Windows crash on
+// restart_service http_workers; unreliable Bun timing).
+
+const BROTLI_SCHEMA_GRAPHQL =
+	'type BrotliCache @table(database: "brotlidb") @export {\n' +
+	'\tid: ID @primaryKey\n' +
+	'\tbrotliContent: Blob!\n' +
+	'\tcontentSize: Int\n' +
+	'\thttpStatus: Int\n' +
+	'}\n\n';
+
+const BROTLI_RESOURCES_JS =
+	"import { brotliCompressSync } from 'zlib';\n" +
+	'\n' +
+	'const { BrotliCache } = databases.brotlidb;\n' +
+	"const rawContent = Buffer.from('Brotli Content-Encoding pass-through test. '.repeat(500));\n" +
+	'const compressed = brotliCompressSync(rawContent);\n' +
+	'\n' +
+	'export class brotlicache extends BrotliCache {\n' +
+	'\tasync get() {\n' +
+	'\t\treturn {\n' +
+	'\t\t\tstatus: this.httpStatus || 200,\n' +
+	"\t\t\theaders: { 'Content-Encoding': 'br' },\n" +
+	'\t\t\tbody: this.brotliContent,\n' +
+	'\t\t};\n' +
+	'\t}\n' +
+	'}\n' +
+	'\n' +
+	'export class BrotliCacheSource extends Resource {\n' +
+	'\tasync get() {\n' +
+	'\t\tconst blob = await createBlob(compressed);\n' +
+	'\t\treturn {\n' +
+	'\t\t\tbrotliContent: blob,\n' +
+	'\t\t\tcontentSize: compressed.length,\n' +
+	'\t\t\thttpStatus: 200,\n' +
+	'\t\t};\n' +
+	'\t}\n' +
+	'}\n' +
+	'\n' +
+	'brotlicache.sourcedFrom(BrotliCacheSource);\n\n';
+
+suite('Brotli Blob Content-Encoding pass-through', { skip: skipSuite }, (ctx) => {
+	let client;
+	const brotliId = randomInt(1000000);
+
+	before(async () => {
+		await startHarper(ctx, { config: {}, env: {} });
+		client = createApiClient(ctx.harper);
+
+		// Probe the list endpoint (/brotlicache/) — it returns 404 until the component
+		// registers its routes, and 200 (empty list) once ready. Avoids triggering
+		// BrotliCacheSource on /brotlicache/{id}, which would create a spurious record.
+		await installAppComponent(client, {
+			project: 'brotliblobs',
+			files: { 'schema.graphql': BROTLI_SCHEMA_GRAPHQL, 'resources.js': BROTLI_RESOURCES_JS },
+			probePath: '/brotlicache/',
+			restartTimeoutMs: 120000,
+		});
+	});
+
+	after(async () => {
+		await teardownHarper(ctx);
+	});
+
+	test('GET Brotli blob triggers source and returns Content-Encoding: br', async () => {
+		const r = await client.reqRest(`/brotlicache/${brotliId}`).set('Accept', '*/*').expect(200);
+		assert.equal(
+			r.headers['content-encoding'],
+			'br',
+			`expected Content-Encoding: br in response headers, got: ${JSON.stringify(r.headers)}`
+		);
+	});
+
+	test('subsequent GET Brotli blob still returns Content-Encoding: br', async () => {
+		const r = await client.reqRest(`/brotlicache/${brotliId}`).set('Accept', '*/*').expect(200);
+		assert.equal(
+			r.headers['content-encoding'],
+			'br',
+			`expected Content-Encoding: br on cached blob, got: ${JSON.stringify(r.headers)}`
+		);
+	});
+});

integrationTests/apiTests/configuration.test.mjs

@@ -22,6 +22,7 @@ import { createApiClient } from './utils/client.mjs';
 const SCHEMA = 'dev';
 const ATTR_TEST_TABLE = 'create_attr_test';
 const DROP_ATTR_TABLE = 'AttributeDropTest';
+const SCHEMALESS_TABLE = 'MqttRetained';
 
 const TEST_ROLE = 'test_dev_role';
 const TEST_USER = 'test_user';
@@ -311,4 +312,77 @@ suite('Configuration', (ctx) => {
 			.expect((r) => assert.equal(r.body.message, `${TEST_ROLE} successfully deleted`, r.text))
 			.expect(200);
 	});
+
+	// ── schema-less table (no declared attributes) ───────────────────────────
+
+	test('create schema-less table with no declared attributes', async () => {
+		await client
+			.req()
+			.send({ operation: 'create_table', schema: SCHEMA, table: SCHEMALESS_TABLE, hash_attribute: 'id' })
+			.expect((r) => assert.ok(r.body.message.includes('successfully created'), r.text))
+			.expect(200);
+	});
+
+	test('schema-less table accepts insert with arbitrary fields', async () => {
+		await client
+			.req()
+			.send({
+				operation: 'insert',
+				schema: SCHEMA,
+				table: SCHEMALESS_TABLE,
+				records: [
+					{
+						id: '/sensors/temperature/room1',
+						payload: '{"temperature":22.5,"unit":"C"}',
+						qos: 1,
+						retained: true,
+						timestamp: 1699000000000,
+					},
+				],
+			})
+			.expect((r) => assert.equal(r.body.message, 'inserted 1 of 1 records', r.text))
+			.expect(200);
+	});
+
+	test('schema-less table stores and retrieves arbitrary fields', async () => {
+		const r = await client
+			.req()
+			.send({ operation: 'sql', sql: `SELECT * FROM ${SCHEMA}.${SCHEMALESS_TABLE}` })
+			.expect(200);
+		assert.ok(Array.isArray(r.body), r.text);
+		assert.equal(r.body.length, 1, r.text);
+		const record = r.body[0];
+		assert.equal(record.id, '/sensors/temperature/room1', r.text);
+		assert.equal(record.payload, '{"temperature":22.5,"unit":"C"}', r.text);
+		assert.equal(record.qos, 1, r.text);
+		assert.equal(record.retained, true, r.text);
+	});
+
+	test('schema-less table upsert overwrites retained message for same id', async () => {
+		await client
+			.req()
+			.send({
+				operation: 'upsert',
+				schema: SCHEMA,
+				table: SCHEMALESS_TABLE,
+				records: [
+					{
+						id: '/sensors/temperature/room1',
+						payload: '{"temperature":23.0,"unit":"C"}',
+						qos: 1,
+						retained: true,
+						timestamp: 1699001000000,
+					},
+				],
+			})
+			.expect((r) => assert.ok(r.body.upserted_hashes?.length === 1, r.text))
+			.expect(200);
+
+		const r = await client
+			.req()
+			.send({ operation: 'sql', sql: `SELECT * FROM ${SCHEMA}.${SCHEMALESS_TABLE}` })
+			.expect(200);
+		assert.equal(r.body.length, 1, `expected 1 retained record after upsert\n${r.text}`);
+		assert.equal(r.body[0].payload, '{"temperature":23.0,"unit":"C"}', r.text);
+	});
 });

integrationTests/apiTests/schema-enforcement.test.mjs

@@ -0,0 +1,149 @@
+/**
+ * Schema enforcement integration tests.
+ *
+ * Validates:
+ * - @sealed table rejects records that include undeclared fields (REST PUT and
+ *   operations API insert both enforce the constraint with HTTP 400)
+ * - [String] @indexed field supports element-level REST search — a query on the
+ *   array attribute returns only records whose array contains that element
+ *
+ * Both require a component with a GraphQL schema, so each uses
+ * installAppComponent + HTTP worker restart. Grouped in a single suite to share
+ * the Harper instance and reduce startup cost.
+ *
+ * Skipped on Windows: restart_service http_workers crashes on the Windows
+ * single-worker model (HarperFast/harper#549).
+ */
+import { suite, test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { startHarper, teardownHarper } from '@harperfast/integration-testing';
+import { createApiClient } from './utils/client.mjs';
+import { installAppComponent } from './utils/components.mjs';
+
+const skipSuite = process.platform === 'win32';
+
+const CONFIG_YAML = "rest: true\ngraphqlSchema:\n  files: '*.graphql'\ngraphql: true\n";
+
+// Only id, name, and count are declared — any other property must be rejected.
+const SEALED_SCHEMA =
+	'type SealedRecord @table @sealed @export {\n' +
+	'\tid: ID @primaryKey\n' +
+	'\tname: String\n' +
+	'\tcount: Int\n' +
+	'}\n';
+
+// tags is a [String] @indexed array — element-level REST queries must work.
+const TAGGED_SCHEMA =
+	'type TaggedItem @table @export {\n' +
+	'\tid: ID @primaryKey\n' +
+	'\tlabel: String\n' +
+	'\ttags: [String] @indexed\n' +
+	'}\n';
+
+suite('Schema enforcement features', { skip: skipSuite }, (ctx) => {
+	let client;
+
+	before(async () => {
+		await startHarper(ctx, { config: {}, env: {} });
+		client = createApiClient(ctx.harper);
+
+		await installAppComponent(client, {
+			project: 'sealedTest',
+			files: { 'schema.graphql': SEALED_SCHEMA, 'config.yaml': CONFIG_YAML },
+			probePath: '/SealedRecord/',
+			restartTimeoutMs: 120000,
+		});
+
+		await installAppComponent(client, {
+			project: 'taggedTest',
+			files: { 'schema.graphql': TAGGED_SCHEMA, 'config.yaml': CONFIG_YAML },
+			probePath: '/TaggedItem/',
+			restartTimeoutMs: 120000,
+		});
+
+		await client
+			.req()
+			.send({
+				operation: 'insert',
+				table: 'TaggedItem',
+				records: [
+					{ id: '1', label: 'alpha-beta', tags: ['alpha', 'beta'] },
+					{ id: '2', label: 'beta-gamma', tags: ['beta', 'gamma'] },
+					{ id: '3', label: 'gamma-delta', tags: ['gamma', 'delta'] },
+				],
+			})
+			.expect((r) => assert.ok(r.body.message?.includes('inserted 3 of 3 records'), r.text))
+			.expect(200);
+	});
+
+	after(async () => {
+		await teardownHarper(ctx);
+	});
+
+	// ── @sealed enforcement ────────────────────────────────────────────────────
+
+	test('@sealed: PUT with declared fields only succeeds', async () => {
+		await request(client.restURL)
+			.put('/SealedRecord/1')
+			.set(client.headers)
+			.send({ id: '1', name: 'allowed', count: 5 })
+			.expect(204);
+	});
+
+	test('@sealed: PUT with undeclared field is rejected with 400', async () => {
+		await request(client.restURL)
+			.put('/SealedRecord/2')
+			.set(client.headers)
+			.send({ id: '2', name: 'test', count: 3, extraField: 'not allowed' })
+			.expect((r) => {
+				assert.ok(r.text.includes('is not allowed'), `expected "is not allowed" in error body, got: ${r.text}`);
+			})
+			.expect(400);
+	});
+
+	test('@sealed: operations API insert with undeclared field is rejected with 400', async () => {
+		await client
+			.req()
+			.send({
+				operation: 'insert',
+				table: 'SealedRecord',
+				records: [{ id: '3', name: 'test', count: 1, hiddenField: 'forbidden' }],
+			})
+			.expect((r) => {
+				assert.ok(r.text.includes('is not allowed'), `expected "is not allowed" in error body, got: ${r.text}`);
+			})
+			.expect(400);
+	});
+
+	// ── [String] @indexed — element-level REST search ──────────────────────────
+
+	test('[String] @indexed: search by element shared by two records returns both', async () => {
+		const r = await client.reqRest('/TaggedItem/?tags=beta').expect(200);
+		assert.ok(Array.isArray(r.body), r.text);
+		assert.equal(r.body.length, 2, `expected 2 records with tag "beta", got ${r.body.length}: ${r.text}`);
+		const ids = r.body.map((item) => item.id).sort();
+		assert.deepEqual(ids, ['1', '2'], r.text);
+	});
+
+	test('[String] @indexed: search by unique element returns single record', async () => {
+		const r = await client.reqRest('/TaggedItem/?tags=alpha').expect(200);
+		assert.ok(Array.isArray(r.body), r.text);
+		assert.equal(r.body.length, 1, `expected 1 record with tag "alpha", got ${r.body.length}: ${r.text}`);
+		assert.equal(r.body[0].id, '1', r.text);
+	});
+
+	test('[String] @indexed: search by element shared by second pair returns both', async () => {
+		const r = await client.reqRest('/TaggedItem/?tags=gamma').expect(200);
+		assert.ok(Array.isArray(r.body), r.text);
+		assert.equal(r.body.length, 2, `expected 2 records with tag "gamma", got ${r.body.length}: ${r.text}`);
+		const ids = r.body.map((item) => item.id).sort();
+		assert.deepEqual(ids, ['2', '3'], r.text);
+	});
+
+	test('[String] @indexed: search by absent element returns empty array', async () => {
+		const r = await client.reqRest('/TaggedItem/?tags=nope').expect(200);
+		assert.ok(Array.isArray(r.body), r.text);
+		assert.equal(r.body.length, 0, `expected 0 records for absent tag, got ${r.body.length}: ${r.text}`);
+	});
+});