Persistent PostgreSQL sandbox deployment

tests/postgres-deployment.test.ts

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const read = (path: string) => readFile(new URL(`../${path}`, import.meta.url), 'utf8');
+test('persistent custody deployment remains separate, sandbox-only and password authenticated without a database host port', async () => {
+  const compose = (await read('compose.custody.yaml')).replaceAll('\r\n', '\n');
+  assert.match(compose, /WIKIDECK_CUSTODY_MODE: sandbox/);
+  assert.match(compose, /WIKIDECK_CUSTODY_STORAGE: postgres/);
+  assert.match(compose, /WIKIDECK_PAYMENT_MODE: mock/);
+  assert.match(compose, /financial: \{internal: true\}/);
+  assert.match(compose, /POSTGRES_PASSWORD_FILE:/);
+  assert.doesNotMatch(compose, /POSTGRES_HOST_AUTH_METHOD|LOCAL_TEST|5432:5432|tmpfs:.*postgresql/);
+  const database = compose.split('  database:')[1].split('  migrate:')[0];
+  assert.doesNotMatch(database, /ports:/);
+  assert.match(database, /pg-data:\/var\/lib\/postgresql\/data/);
+  const application = compose.split('  wikideck:')[1].split('networks:\n  financial:')[0];
+  assert.match(application, /pg-runtime:\/secrets\/runtime:ro/);
+  assert.doesNotMatch(application, /pg-admin:|pg-owner:|pg-tls:/);
+});
+test('database HBA requires TLS+SCRAM over TCP and provisioning refuses partial credential replacement', async () => {
+  const hba = await read('deploy/postgres/pg_hba.conf'), setup = await read('deploy/postgres/setup.mjs');
+  assert.match(hba, /hostnossl all all all reject/);
+  assert.match(hba, /hostssl wikideck_custody custody_runtime all scram-sha-256/);
+  assert.doesNotMatch(hba, /^host.*trust/m);
+  assert.match(setup, /randomBytes\(32\)/);
+  assert.match(setup, /Partial secret initialization/);
+  assert.match(setup, /subjectAltName=DNS:database/);
+  assert.match(setup, /-checkend/);
+});