@consiliency/agent-board-schema 1.12.0 → 1.23.0

package/tests/fixtures/isolation-substrate.sql

@@ -0,0 +1,93 @@
+-- Minimal Supabase substrate for the two-session ISOLATION harness only.
+--
+-- The pgTAP runner applies the agent_board bundle onto the DB that `supabase
+-- start` provisions (54322/postgres), which already carries GoTrue's `auth`
+-- schema, the `extensions` schema, pgcrypto, and the base roles. The isolation
+-- harness instead builds a THROWAWAY template database (specs COMMIT across
+-- sessions and cannot share the live DB), so it must self-provision the same
+-- substrate the migrations assume.
+--
+-- Rather than replay GoTrue's full ~2000-line schema (webauthn/saml/oauth/mfa +
+-- cross-schema net/role dependencies that drift with every GoTrue bump), this
+-- reproduces ONLY the surface the agent_board migrations actually touch:
+--
+--   * auth.users        FK target for agents.auth_user_id / owner_user_id, and
+--                        written by provision/ensure_github_user with 11 columns.
+--   * auth.identities    written by ensure_github_user; looked up by (provider,
+--                        provider_id).
+--   * auth.uid()/role()  read request.jwt.claim.* — the identity the RPCs gate on.
+--   * extensions.pgcrypto  extensions.digest / extensions.gen_random_bytes.
+--
+-- auth.sessions is intentionally omitted: it appears in the migrations only in a
+-- comment, never in SQL. Base ROLES (service_role/authenticated/anon) are NOT
+-- created here — they are cluster-global on the Supabase server this template is
+-- built on (both local `supabase start` and CI), so migration GRANTs resolve.
+--
+-- If a future migration touches an auth column/table not modelled here, the apply
+-- fails LOUDLY (a missing-column/relation error) — the signal to extend this file,
+-- never a silent skip. Keep it minimal and driven by real usage.
+
+create schema if not exists auth;
+create schema if not exists extensions;
+
+create extension if not exists pgcrypto with schema extensions;
+create extension if not exists "uuid-ossp" with schema extensions;
+
+-- GoTrue's auth.users, reduced to the columns the bundle inserts/reads. Everything
+-- is nullable or defaulted so the canonical 11-column provision insert succeeds.
+create table if not exists auth.users (
+  id uuid primary key,
+  instance_id uuid,
+  email text,
+  email_confirmed_at timestamptz,
+  encrypted_password text,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  raw_app_meta_data jsonb,
+  raw_user_meta_data jsonb,
+  aud text,
+  role text,
+  -- read-safety padding for common GoTrue columns a future path might SELECT
+  phone text,
+  confirmed_at timestamptz,
+  last_sign_in_at timestamptz,
+  is_sso_user boolean default false,
+  is_anonymous boolean default false
+);
+
+create table if not exists auth.identities (
+  id uuid primary key,
+  user_id uuid references auth.users(id) on delete cascade,
+  provider_id text,
+  provider text,
+  identity_data jsonb,
+  last_sign_in_at timestamptz,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  unique (provider, provider_id)
+);
+
+-- The identity helpers the bundle's RLS/RPCs gate on. Copied VERBATIM from the
+-- live Supabase auth schema (supabase/postgres:17.6) so the harness exercises the
+-- exact identity resolution production uses: coalesce the flattened
+-- `request.jwt.claim.<key>` GUC with the `request.jwt.claims` JSON blob, so either
+-- form the runtime sets resolves the caller.
+create or replace function auth.uid() returns uuid
+  language sql stable
+  as $$
+  select
+  coalesce(
+    nullif(current_setting('request.jwt.claim.sub', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+  )::uuid
+$$;
+
+create or replace function auth.role() returns text
+  language sql stable
+  as $$
+  select
+  coalesce(
+    nullif(current_setting('request.jwt.claim.role', true), ''),
+    (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')
+  )::text
+$$;

package/tests/fixtures/test-prereqs.sql

@@ -82,3 +82,36 @@ $$;
 
 REVOKE ALL ON FUNCTION public.ensure_github_user(text, text, text, text) FROM PUBLIC;
 GRANT EXECUTE ON FUNCTION public.ensure_github_user(text, text, text, text) TO service_role;
+
+-- ---------------------------------------------------------------------------
+-- Deterministic consistent (public_key, fingerprint) pair generators for pgTAP
+-- fixtures. MINTHARDEN (#138) installs a BEFORE INSERT OR UPDATE trigger on
+-- agent_board.agent_signing_keys asserting fingerprint = raw-byte derivation of
+-- public_key for raw_ed25519_base64url keys. Fixtures that seed keys directly must
+-- therefore use a CANONICAL key whose fingerprint MATCHES. These helpers derive a
+-- distinct canonical 43-char base64url raw-Ed25519 key from a seed (public_key =
+-- base64url(sha256(seed))) and the matching raw-byte fingerprint
+-- (sha256:base64url(sha256(raw_bytes))) — byte-identical to agent_board._raw_key_fingerprint
+-- WITHOUT depending on it (so this file still loads before the migrations). Seed on a
+-- distinct value per row (its key/agent uuid or a unique label) to avoid UNIQUE collisions.
+CREATE OR REPLACE FUNCTION public.test_pubkey(p_seed text)
+RETURNS text
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT rtrim(translate(encode(extensions.digest(convert_to(p_seed, 'UTF8'), 'sha256'), 'base64'), '+/', '-_'), '=');
+$$;
+
+CREATE OR REPLACE FUNCTION public.test_key_fingerprint(p_seed text)
+RETURNS text
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT 'sha256:' || rtrim(translate(encode(
+    extensions.digest(extensions.digest(convert_to(p_seed, 'UTF8'), 'sha256'), 'sha256'),
+    'base64'), '+/', '-_'), '=');
+$$;
+
+REVOKE ALL ON FUNCTION public.test_pubkey(text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.test_key_fingerprint(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.test_pubkey(text), public.test_key_fingerprint(text) TO service_role;

package/tests/isolation/expected/atomic_fedsession_fleet_lock_order.out

@@ -0,0 +1,79 @@
+Parsed test spec with 4 sessions
+
+starting permutation: guard_begin guard_board_key_share fleet_begin fleet_onboard portal_begin portal_enroll guard_commit fleet_commit portal_commit check
+count
+-----
+    1
+(1 row)
+
+step guard_begin: BEGIN;
+step guard_board_key_share: 
+  select slug from agent_board.boards
+   where slug='atomic-cross-board' for key share;
+
+slug              
+------------------
+atomic-cross-board
+(1 row)
+
+step fleet_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step fleet_onboard: 
+  select identity_disposition, membership_disposition, binding_disposition
+    from agent_board.onboard_federated_fleet_agent(
+      'https://atomic-cross.test', 'message-board', 'cross-human',
+      jsonb_build_object('iss','https://atomic-cross.test','aud','message-board','sub','cross-human','iat',100),
+      'atomic-cross-agent',
+      'eRHZmllEy_TZHAG2zB-Qe_a5BFLkaavMTazWWfaE3f0',
+      'raw_ed25519_base64url',
+      'sha256:z8d5LQPfBMYnfZfvu8wVz684_jkp578-SPDU2OMObS8',
+      true, null, 'agent', ARRAY['board:send'], ARRAY[]::text[],
+      (select code from agent_board.board_invite_tokens where created_by_agent_id='162a0000-0000-0000-0000-000000000001'),
+      (select id from agent_board.boards where slug='atomic-cross-board'),
+      '162a0000-0000-0000-0000-000000000003',
+      'codex', 'phase-loop', 'message-board', 'sha256:atomic-cross-repo',
+      'worker', 'phase_worker', 'atomic-cross-agent'
+    );
+ <waiting ...>
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-cross.test', 'message-board', 'cross-human',
+    jsonb_build_object('sub','cross-human','iat',200), 'Cross Human'
+  );
+ <waiting ...>
+step guard_commit: COMMIT;
+step fleet_onboard: <... completed>
+identity_disposition|membership_disposition|binding_disposition
+--------------------+----------------------+-------------------
+created             |created               |created            
+(1 row)
+
+step fleet_commit: COMMIT;
+step portal_enroll: <... completed>
+status
+------
+active
+(1 row)
+
+step portal_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.agents
+      where owner_user_id=(select auth_user_id from agent_board.agents
+                            where metadata #>> ARRAY['federation','subject']='cross-human'
+                            order by kind='human' desc limit 1)) as owned_agents,
+    (select count(*) from agent_board.board_memberships m
+      join agent_board.agents a on a.id=m.agent_id
+     where m.board_id=(select id from agent_board.boards where slug='atomic-cross-board')
+       and a.owner_user_id=(select auth_user_id from agent_board.agents
+                            where metadata #>> ARRAY['federation','subject']='cross-human'
+                            order by kind='human' desc limit 1)) as memberships,
+    (select count(*) from agent_board.fleet_machine_agents b
+      join agent_board.agents a on a.id=b.agent_id
+     where a.handle='atomic-cross-agent') as bindings;
+
+owned_agents|memberships|bindings
+------------+-----------+--------
+           2|          2|       1
+(1 row)
+

package/tests/isolation/expected/atomic_fedsession_human_revoke.out

@@ -0,0 +1,87 @@
+Parsed test spec with 3 sessions
+
+starting permutation: portal_begin portal_enroll revoke_begin revoke_human portal_commit revoke_commit check
+count
+-----
+    1
+(1 row)
+
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-fedsession.test', 'message-board', 'portal-human-race',
+    jsonb_build_object('sub','portal-human-race','iat',200), 'Portal Human Race'
+  );
+
+status
+------
+active
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race'),
+    '16290000-0000-0000-0000-000000000001', 'portal race revoke'
+  );
+ <waiting ...>
+step portal_commit: COMMIT;
+step revoke_human: <... completed>
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step revoke_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.fleet_human_revocations where issuer='https://atomic-fedsession.test') as markers,
+    (select count(*) from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race' and status='active') as active_humans,
+    (select count(*) from agent_board.enrollment_federation_audit where issuer='https://atomic-fedsession.test') as audits;
+
+markers|active_humans|audits
+-------+-------------+------
+      1|            0|     2
+(1 row)
+
+
+starting permutation: revoke_begin revoke_human portal_begin portal_enroll revoke_commit portal_commit check
+count
+-----
+    1
+(1 row)
+
+step revoke_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step revoke_human: 
+  select revoked_agent_count from agent_board.revoke_human_subtree(
+    (select auth_user_id from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race'),
+    '16290000-0000-0000-0000-000000000001', 'portal race revoke'
+  );
+
+revoked_agent_count
+-------------------
+                  1
+(1 row)
+
+step portal_begin: BEGIN; SET LOCAL "request.jwt.claim.role" = 'service_role';
+step portal_enroll: 
+  select status from agent_board.enroll_federated_human(
+    'https://atomic-fedsession.test', 'message-board', 'portal-human-race',
+    jsonb_build_object('sub','portal-human-race','iat',200), 'Portal Human Race'
+  );
+ <waiting ...>
+step revoke_commit: COMMIT;
+step portal_enroll: <... completed>
+ERROR:  human identity is durably revoked
+step portal_commit: COMMIT;
+step check: 
+  select
+    (select count(*) from agent_board.fleet_human_revocations where issuer='https://atomic-fedsession.test') as markers,
+    (select count(*) from agent_board.agents where metadata #>> ARRAY['federation','subject'] = 'portal-human-race' and status='active') as active_humans,
+    (select count(*) from agent_board.enrollment_federation_audit where issuer='https://atomic-fedsession.test') as audits;
+
+markers|active_humans|audits
+-------+-------------+------
+      1|            0|     1
+(1 row)
+