[MackWiser1]

test: add meaningful Vitest coverage for the query allowlist

Summary

Adds the first test suite for src/allowlist/index.ts, the security-critical module that decides whether an incoming SQL statement is permitted to run. The module previously had zero tests despite gating every query when features.allowlist is enabled.

The suite is test-only: no production code or configuration was changed.

Cases covered

Bypass behaviour

• Feature disabled (isEnabled: false) allows any SQL without touching the database.
• role: 'admin' allows any SQL without touching the database.
• role: 'client' does not bypass and actually loads the allowlist.

Valid input

• Exact allowlist match is allowed.
• Trailing semicolon / surrounding whitespace is normalized on both sides.
• Allowed query containing a -1 literal.
• Allowed query containing an IS NULL comparison.
• Rejections are written to tmp_allowlist_rejections with the correct sql_statement and source params.

Invalid / fake input

• Fake table name not on the allowlist is rejected.
• Stacked statement appended to an allowed query (SELECT ...; DROP TABLE ...) is rejected.
• Query with different literal values than the allowlist entry is rejected (documents current exact-literal matching behaviour).
• Allowlist rows belonging to a different data source are ignored.
• Malformed SQL surfaces the parser error.

Omitted input

• Empty string SQL returns Error('No SQL provided for allowlist check') (the function returns, rather than throws, this Error).
• undefined SQL returns the same Error.
• Whitespace-only SQL is rejected rather than mistakenly allowed.

Error handling

• Allowlist load failure logs and falls back to rejecting the query (fail-closed).
• Failure while recording a rejected query still rejects with Query not allowed.
• Load failure is irrelevant when the feature is disabled.

Coverage

src/allowlist coverage from this suite:

Metric	Coverage
Statements	98%
Branches	91.17%
Functions	97.77%
Lines	100%

How to run

npx vitest run src/allowlist/index.test.ts

Or the full suite:

npx vitest run

Verification notes

• npx vitest run src/allowlist/index.test.ts ? 19/19 tests pass.
• Full suite: 170 passed, 4 failed. The 4 failures are pre-existing in src/rls/index.test.ts and reproduce on a clean checkout (they are unrelated to this change).
• npx prettier --check src/allowlist/index.test.ts ? clean.
• npx tsc --noEmit reports no errors in the new test file (the repo has other pre-existing type errors, e.g. in src/cache/index.test.ts, src/do.test.ts, and plugins/cdc).

Relates to #71