@consiliency/agent-board-schema 1.12.0 → 1.22.0

package/tests/agent_board_actorspoof.test.sql

@@ -0,0 +1,349 @@
+-- MBHYGIENE ACTORSPOOF pgTAP: bind addressing actors to the resolved principal.
+--
+-- These are SECURITY DEFINER RPC probes. Authenticated posture is therefore
+-- driven by JWT claims only; SET LOCAL ROLE would not affect the RPC execution
+-- and would make the required _is_service_role() control unavailable.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+create temp table _actorspoof_fixture (
+  actor_user uuid,
+  actor_agent uuid,
+  foreign_agent uuid,
+  recipient_agent uuid,
+  thread_key text
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_actor_user uuid;
+  v_actor_agent uuid := gen_random_uuid();
+  v_foreign_agent uuid := gen_random_uuid();
+  v_recipient_agent uuid := gen_random_uuid();
+  v_thread_key text := 'actorspoof-thread-' || v_suffix;
+begin
+  v_actor_user := public.ensure_github_user(
+    'actorspoof-actor-' || v_suffix,
+    'actorspoof-actor-' || v_suffix || '@example.test',
+    'actorspoof-actor-' || v_suffix,
+    'ACTORSPOOF Actor'
+  );
+
+  insert into agent_board.agents(
+    id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id
+  )
+  values
+    (
+      v_actor_agent,
+      'agent',
+      'agent',
+      'actorspoof-actor-' || v_suffix,
+      'ACTORSPOOF Actor',
+      'active',
+      v_actor_user,
+      v_actor_user
+    ),
+    (
+      v_foreign_agent,
+      'agent',
+      'agent',
+      'actorspoof-foreign-' || v_suffix,
+      'ACTORSPOOF Foreign',
+      'active',
+      null,
+      null
+    ),
+    (
+      v_recipient_agent,
+      'agent',
+      'agent',
+      'actorspoof-recipient-' || v_suffix,
+      'ACTORSPOOF Recipient',
+      'active',
+      null,
+      null
+    );
+
+  insert into agent_board.threads(
+    id, thread_type, created_by_agent_id, subject, metadata
+  )
+  values (
+    gen_random_uuid(),
+    'coordination',
+    v_foreign_agent,
+    'ACTORSPOOF foreign reusable thread',
+    jsonb_build_object('addressingThreadKey', v_thread_key)
+  );
+
+  insert into _actorspoof_fixture(
+    actor_user, actor_agent, foreign_agent, recipient_agent, thread_key
+  )
+  values (
+    v_actor_user, v_actor_agent, v_foreign_agent, v_recipient_agent, v_thread_key
+  );
+end
+$$;
+
+-- 1. Service/operator control.
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select is(
+  agent_board._is_service_role(),
+  true,
+  'control: service-role addressing block really runs as service_role');
+
+-- 2-5. ALLOW: service_role retains explicit-actor operation and its NULL contract.
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}'
+    )
+    from agent_board.resolve_recipients(
+      (select foreign_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      )
+    ) r
+  ),
+  (
+    select jsonb_build_object(
+      'count', 1,
+      'recipient', recipient_agent::text
+    )
+    from _actorspoof_fixture
+  ),
+  'service_role may resolve recipients with an explicit actor');
+
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}',
+      'reuse', r."idempotentThreadReuse"
+    )
+    from agent_board.expand_recipients_dry_run(
+      (select foreign_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      ),
+      (select thread_key from _actorspoof_fixture)
+    ) r
+  ),
+  (
+    select jsonb_build_object(
+      'count', 1,
+      'recipient', recipient_agent::text,
+      'reuse', true
+    )
+    from _actorspoof_fixture
+  ),
+  'service_role explicit actor retains the idempotent-thread reuse probe');
+
+select throws_ok(
+  $$
+    select *
+    from agent_board.resolve_recipients(
+      null,
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      )
+    )
+  $$,
+  '22023',
+  null,
+  'service_role resolve_recipients still requires a non-NULL actor');
+
+select throws_ok(
+  $$
+    select *
+    from agent_board.expand_recipients_dry_run(
+      null,
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      ),
+      (select thread_key from _actorspoof_fixture)
+    )
+  $$,
+  '22023',
+  null,
+  'service_role expand_recipients_dry_run still requires a non-NULL actor');
+
+-- Authenticated SECURITY DEFINER probes: JWT claims only, never SET LOCAL ROLE.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config(
+  'request.jwt.claim.sub',
+  (select actor_user::text from _actorspoof_fixture),
+  true
+);
+
+-- 6-7. Required non-vacuity controls.
+select is(
+  agent_board._is_service_role(),
+  false,
+  'control: authenticated ACTORSPOOF block is not service_role');
+select is(
+  agent_board.current_agent_id(),
+  (select actor_agent from _actorspoof_fixture),
+  'control: authenticated ACTORSPOOF block resolves the expected actor');
+
+-- 8-9. DENY: a caller-supplied foreign actor is rejected at both public RPCs.
+select throws_ok(
+  $$
+    select *
+    from agent_board.resolve_recipients(
+      (select foreign_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      )
+    )
+  $$,
+  '42501',
+  null,
+  'authenticated resolve_recipients rejects a foreign p_actor_agent_id');
+
+select throws_ok(
+  $$
+    select *
+    from agent_board.expand_recipients_dry_run(
+      (select foreign_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      ),
+      (select thread_key from _actorspoof_fixture)
+    )
+  $$,
+  '42501',
+  null,
+  'authenticated expand_recipients_dry_run rejects a foreign p_actor_agent_id');
+
+-- 10-13. ALLOW: self and omitted actors preserve the resolved recipient set.
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}'
+    )
+    from agent_board.resolve_recipients(
+      (select actor_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      )
+    ) r
+  ),
+  (
+    select jsonb_build_object('count', 1, 'recipient', recipient_agent::text)
+    from _actorspoof_fixture
+  ),
+  'authenticated resolve_recipients accepts the caller self id');
+
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}'
+    )
+    from agent_board.resolve_recipients(
+      null,
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      )
+    ) r
+  ),
+  (
+    select jsonb_build_object('count', 1, 'recipient', recipient_agent::text)
+    from _actorspoof_fixture
+  ),
+  'authenticated resolve_recipients binds an omitted actor to the caller');
+
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}',
+      'reuse', r."idempotentThreadReuse"
+    )
+    from agent_board.expand_recipients_dry_run(
+      (select actor_agent from _actorspoof_fixture),
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      ),
+      (select thread_key from _actorspoof_fixture)
+    ) r
+  ),
+  (
+    select jsonb_build_object(
+      'count', 1,
+      'recipient', recipient_agent::text,
+      'reuse', false
+    )
+    from _actorspoof_fixture
+  ),
+  'authenticated dry-run accepts self without leaking a foreign reuse probe');
+
+select is(
+  (
+    select jsonb_build_object(
+      'count', jsonb_array_length(r."resolvedRecipients"),
+      'recipient', r."resolvedRecipients" #>> '{0,agentId}',
+      'reuse', r."idempotentThreadReuse"
+    )
+    from agent_board.expand_recipients_dry_run(
+      null,
+      jsonb_build_array(
+        jsonb_build_object(
+          'kind', 'agent_id',
+          'agentId', (select recipient_agent::text from _actorspoof_fixture)
+        )
+      ),
+      (select thread_key from _actorspoof_fixture)
+    ) r
+  ),
+  (
+    select jsonb_build_object(
+      'count', 1,
+      'recipient', recipient_agent::text,
+      'reuse', false
+    )
+    from _actorspoof_fixture
+  ),
+  'authenticated dry-run binds an omitted actor without leaking foreign reuse metadata');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;

package/tests/agent_board_agentsdir.test.sql

@@ -0,0 +1,154 @@
+-- AGENTSDIR (#80) pgTAP — agent_board.agents column read posture for `authenticated`.
+--
+-- Proves: (a) the SHAPE of the grant (so deleting the migration turns CI red — no test anywhere
+-- referenced this grant/policy before, meaning the exposure could be reintroduced silently);
+-- (b) directory columns stay readable; (c) every identity-linkage column is denied; (d) NO product
+-- regression — v_board_feed / v_board_directory / v_agent_dashboard return the same rows as before
+-- and invite-by-handle still resolves a stranger.
+--
+-- HAND-COUNTED plan: 3 shape + 1 allow + 5 deny + 4 no-regression = 13 assertions.
+--
+-- METHODOLOGY (load-bearing — this exact mistake was made and caught during the #80 audit):
+-- column grants and RLS are enforced against the DATABASE ROLE, not JWT claims. Setting
+-- request.jwt.claim.* while still connected as `postgres` measures an RLS/grant-EXEMPT session and
+-- silently reports "no leak" (or a false "no change"). Every read below is therefore captured
+-- inside `set local role authenticated`, stashed in a temp table, and asserted after `reset role`
+-- (pgTAP's own functions are not assumed executable by `authenticated`).
+-- Teardown clears BOTH jwt GUCs: `reset role` alone leaves request.jwt.claim.role set, which would
+-- poison later assertions in the same file (precedent: agent_board_fedsession.test.sql).
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(13);
+
+-- ---------------------------------------------------------------------------
+-- Phase 0 — GRANT SHAPE. Asserted from the catalog, so removing the migration fails CI.
+-- ---------------------------------------------------------------------------
+-- 1
+select is(
+  (select coalesce(array_agg(column_name::text order by column_name), '{}')
+     from information_schema.column_privileges
+    where table_schema = 'agent_board' and table_name = 'agents'
+      and grantee = 'authenticated' and privilege_type = 'SELECT'),
+  array['agent_type','created_at','display_name','handle','id','kind','status','updated_at'],
+  'authenticated may SELECT exactly the eight directory columns of agents');
+
+-- 2 — the identity-linkage columns must be absent from that grant.
+select is(
+  (select count(*)::int
+     from information_schema.column_privileges
+    where table_schema = 'agent_board' and table_name = 'agents'
+      and grantee = 'authenticated' and privilege_type = 'SELECT'
+      and column_name in ('auth_user_id','owner_user_id','parent_agent_id','root_agent_id','metadata')),
+  0, 'authenticated holds NO grant on auth_user_id/owner_user_id/lineage/metadata');
+
+-- 3 — anon must hold nothing at all on this table.
+select is(
+  (select count(*)::int from information_schema.column_privileges
+    where table_schema = 'agent_board' and table_name = 'agents' and grantee = 'anon'),
+  0, 'anon holds no privileges on agent_board.agents');
+
+-- ---------------------------------------------------------------------------
+-- Fixtures + behavioural capture as a REAL authenticated principal
+-- ---------------------------------------------------------------------------
+create temp table _ad (k text primary key, v text) on commit drop;
+grant all on table _ad to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_owner uuid; v_board uuid; v_reader uuid; v_uid uuid; v_th uuid;
+begin
+  -- an owner + a board + a message, and a separate reader who is a co-member
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('agent', 'agent'::agent_board.agent_kind, 'ad-own-' || s, 'AD Owner', 'active')
+  returning id into v_owner;
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('ad-b-' || s, 'AD Board', v_owner, 'invite_only', 'active') returning id into v_board;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_owner, 'owner', 'joined', v_owner);
+
+  v_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'ad-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('agent', 'agent'::agent_board.agent_kind, 'ad-rd-' || s, 'AD Reader', 'active', v_uid, v_uid)
+  returning id into v_reader;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_reader, 'member', 'joined', v_owner);
+
+  select thread_id into v_th from agent_board.create_thread(v_owner, 'ad thread');
+  perform agent_board.post_board_message(v_th, v_owner, v_board, 'seed', 'body');
+
+  insert into _ad values ('reader_uid', v_uid::text), ('owner_handle', 'ad-own-' || s);
+end
+$$;
+
+select set_config('request.jwt.claim.sub', (select v from _ad where k = 'reader_uid'), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+set local role authenticated;
+do $$
+declare n int;
+begin
+  -- ALLOW: directory columns
+  begin
+    select count(*) into n from (select id, handle, display_name, kind, agent_type, status
+                                   from agent_board.agents) q;
+    insert into _ad values ('directory_readable', 'yes:' || n);
+  exception when others then insert into _ad values ('directory_readable', 'ERR ' || sqlstate); end;
+  -- DENY: each identity-linkage column, probed individually
+  begin select count(auth_user_id)   into n from agent_board.agents; insert into _ad values ('auth_user_id','READABLE');
+  exception when others then insert into _ad values ('auth_user_id', sqlstate); end;
+  begin select count(owner_user_id)  into n from agent_board.agents; insert into _ad values ('owner_user_id','READABLE');
+  exception when others then insert into _ad values ('owner_user_id', sqlstate); end;
+  begin select count(parent_agent_id) into n from agent_board.agents; insert into _ad values ('parent_agent_id','READABLE');
+  exception when others then insert into _ad values ('parent_agent_id', sqlstate); end;
+  begin select count(root_agent_id)  into n from agent_board.agents; insert into _ad values ('root_agent_id','READABLE');
+  exception when others then insert into _ad values ('root_agent_id', sqlstate); end;
+  begin select count(*) into n from agent_board.agents where metadata is not null; insert into _ad values ('metadata','READABLE');
+  exception when others then insert into _ad values ('metadata', sqlstate); end;
+  -- NO REGRESSION: the product read surfaces
+  begin select count(*) into n from agent_board.v_board_feed;      insert into _ad values ('v_board_feed', n::text);
+  exception when others then insert into _ad values ('v_board_feed', 'ERR ' || sqlstate); end;
+  begin select count(*) into n from agent_board.v_board_directory; insert into _ad values ('v_board_directory', n::text);
+  exception when others then insert into _ad values ('v_board_directory', 'ERR ' || sqlstate); end;
+  begin select count(*) into n from agent_board.v_agent_dashboard; insert into _ad values ('v_agent_dashboard', n::text);
+  exception when others then insert into _ad values ('v_agent_dashboard', 'ERR ' || sqlstate); end;
+  -- NO REGRESSION: invite-by-handle resolves an agent the reader does NOT own (row-scoping killed this)
+  begin
+    select count(*) into n from agent_board.resolve_agent_handle((select v from _ad where k = 'owner_handle'));
+    insert into _ad values ('invite_by_handle', n::text);
+  exception when others then insert into _ad values ('invite_by_handle', 'ERR ' || sqlstate); end;
+end
+$$;
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+
+-- ---------------------------------------------------------------------------
+-- Assertions (as postgres, over what the authenticated session actually observed)
+-- ---------------------------------------------------------------------------
+-- 4 — ALLOW control. Without this, a fail-closed bug would look like a successful lockdown.
+select alike(( select v from _ad where k = 'directory_readable'), 'yes:%',
+  'ALLOW CONTROL: authenticated can still read the directory columns');
+-- 5..9 — DENY, one per identity-linkage column (42501 = insufficient_privilege)
+select is((select v from _ad where k = 'auth_user_id'),    '42501', 'auth_user_id is DENIED to authenticated');
+select is((select v from _ad where k = 'owner_user_id'),   '42501', 'owner_user_id is DENIED to authenticated');
+select is((select v from _ad where k = 'parent_agent_id'), '42501', 'parent_agent_id (lineage) is DENIED to authenticated');
+select is((select v from _ad where k = 'root_agent_id'),   '42501', 'root_agent_id (lineage) is DENIED to authenticated');
+select is((select v from _ad where k = 'metadata'),        '42501', 'metadata is DENIED to authenticated');
+-- 10..12 — NO REGRESSION on the product read surfaces (row-scoping would have emptied these)
+select is((select v from _ad where k = 'v_board_feed'),      '1', 'v_board_feed still returns the board message');
+select is((select v from _ad where k = 'v_board_directory'), '1', 'v_board_directory still returns the board');
+select isnt((select v from _ad where k = 'v_agent_dashboard'), '0', 'v_agent_dashboard is not emptied');
+-- 13 — invite-by-handle still resolves a stranger (the feature row-scoping would have killed)
+select is((select v from _ad where k = 'invite_by_handle'), '1',
+  'resolve_agent_handle still resolves an agent the caller does not own (invite-by-handle intact)');
+
+select * from finish();
+rollback;

package/tests/agent_board_authbound_boundary.test.sql

@@ -42,7 +42,7 @@ begin
   values (v_credential, v_agent, extensions.digest('authbound-refresh-' || v_suffix, 'sha256'), 1, 'authbound', now() + interval '1 day');
 
   insert into agent_board.agent_signing_keys(agent_id, key_id, key_version, public_key, public_key_format, fingerprint, status, proof_state)
-  values (v_agent, 'primary', 1, repeat('A', 43), 'raw_ed25519_base64url', 'sha256:' || repeat('A', 43), 'active', 'proven')
+  values (v_agent, 'primary', 1, public.test_pubkey('authbound-' || v_suffix), 'raw_ed25519_base64url', public.test_key_fingerprint('authbound-' || v_suffix), 'active', 'proven')
   returning id into v_key;
 
   insert into _agent_board_authbound_fixture(user_id, agent_id, credential_id, signing_key_id)
@@ -98,6 +98,14 @@ $$;
 
 select pass('current_agent_id honors agent_credential_id revocation before JWT expiry');
 
+-- #118 (MBHARDEN): _signed_write_actor_id is now revoked from authenticated — it is an
+-- internal-only helper whose only callers are SECURITY DEFINER signed_* RPCs that run as the
+-- owner. Its fail-closed LOGIC (raise actor_mismatch on a missing/mismatched gateway actor)
+-- is role-independent, so exercise it as the owner rather than as authenticated (which would
+-- now hit permission-denied before reaching the logic under test). The remaining assertions
+-- below are role-agnostic catalog reads.
+reset role;
+
 select throws_like(
   $$select agent_board._signed_write_actor_id(
     '{}'::jsonb,