refactor: add session accessor seam with gateway consumer (#90463)

Merged via squash.

Prepared head SHA: 58aa59eaf8
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
Reviewed-by: @jalehman

(cherry picked from commit ef47dd610c)

test/scripts/check-session-accessor-boundary.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import {
+  findSessionAccessorBoundaryViolations,
+  migratedSessionAccessorFiles,
+} from "../../scripts/check-session-accessor-boundary.mjs";
+
+describe("session accessor boundary guard", () => {
+  it("ratchets only the files migrated by the session accessor gateway slice", () => {
+    expect(migratedSessionAccessorFiles).toEqual(
+      new Set([
+        "src/config/sessions/combined-store-gateway.ts",
+        "src/gateway/session-utils.ts",
+        "src/gateway/sessions-resolve.ts",
+        "src/gateway/server-methods/sessions.ts",
+      ]),
+    );
+  });
+
+  it("flags legacy reader imports", () => {
+    expect(
+      findSessionAccessorBoundaryViolations(`
+        import { loadSessionStore, readSessionEntries as readEntries } from "../config/sessions.js";
+      `),
+    ).toEqual([
+      { line: 2, reason: 'imports legacy session store reader "loadSessionStore"' },
+      { line: 2, reason: 'imports legacy session store reader "readSessionEntries"' },
+    ]);
+  });
+
+  it("flags direct and namespace legacy reader calls", () => {
+    expect(
+      findSessionAccessorBoundaryViolations(`
+        loadSessionStore(storePath);
+        sessions.readSessionEntries(storePath);
+        sessions["loadSessionStore"](storePath);
+      `),
+    ).toEqual([
+      { line: 2, reason: 'calls legacy session store reader "loadSessionStore"' },
+      { line: 3, reason: 'references legacy session store reader "readSessionEntries"' },
+      { line: 4, reason: 'references legacy session store reader "loadSessionStore"' },
+    ]);
+  });
+
+  it("flags aliased namespace reader references", () => {
+    expect(
+      findSessionAccessorBoundaryViolations(`
+        const load = sessions.loadSessionStore;
+        const { readSessionEntries: readEntries } = sessions;
+        const { loadSessionStore } = sessions;
+      `),
+    ).toEqual([
+      { line: 2, reason: 'references legacy session store reader "loadSessionStore"' },
+      { line: 3, reason: 'aliases legacy session store reader "readSessionEntries"' },
+      { line: 4, reason: 'aliases legacy session store reader "loadSessionStore"' },
+    ]);
+  });
+
+  it("allows migrated accessor reads", () => {
+    expect(
+      findSessionAccessorBoundaryViolations(`
+        import { listSessionEntries } from "../config/sessions/session-accessor.js";
+        listSessionEntries({ storePath });
+      `),
+    ).toEqual([]);
+  });
+
+  it("ignores comments and strings that describe legacy readers", () => {
+    expect(
+      findSessionAccessorBoundaryViolations(`
+        // loadSessionStore and readSessionEntries used to be called here.
+        const description = "loadSessionStore";
+      `),
+    ).toEqual([]);
+  });
+});

test/scripts/ci-workflow-guards.test.ts

@@ -16,6 +16,22 @@ function readCriticalQualityWorkflow() {
 }
 
 describe("ci workflow guards", () => {
+  it("runs the session accessor ratchet as a visible additional check", () => {
+    const workflow = readCiWorkflow();
+    const additionalJob = workflow.jobs["check-additional-shard"];
+    const matrixRows = additionalJob.strategy.matrix.include;
+    expect(matrixRows).toContainEqual({
+      check_name: "check-session-accessor-boundary",
+      group: "session-accessor-boundary",
+    });
+
+    const runStep = additionalJob.steps.find((step) => step.name === "Run additional check shard");
+    expect(runStep.run).toContain("session-accessor-boundary)");
+    expect(runStep.run).toContain(
+      'run_check "lint:tmp:session-accessor-boundary" pnpm run lint:tmp:session-accessor-boundary',
+    );
+  });
+
   it("kills timed manual checkout fetches after the grace period", () => {
     const workflowPaths = [
       ".github/workflows/ci.yml",

test/scripts/run-additional-boundary-checks.test.ts

@@ -94,7 +94,7 @@ describe("run-additional-boundary-checks", () => {
   });
 
   it("keeps the raw HTTP/2 import guard in source boundary checks", () => {
-    expect(BOUNDARY_CHECKS[6]).toEqual({
+    expect(BOUNDARY_CHECKS).toContainEqual({
       label: "lint:tmp:no-raw-http2-imports",
       command: "pnpm",
       args: ["run", "lint:tmp:no-raw-http2-imports"],