@consiliency/agent-board-schema 1.2.0

package/tests/agent_board_auth_rls_id_qualification.test.sql

@@ -0,0 +1,225 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(7);
+
+-- Regression test for the ambiguous-column resolution bugs fixed in
+-- 20260514000000_agent_board_auth_rls_id_qualification.sql.
+--
+-- Two scenarios are exercised:
+--
+-- Scenario A (deny -> allow): agent A is a `joined` member of board X (the
+-- "home" board) created by agent B. Agent B is the message author and board
+-- creator. A board-mode delivery_recipients + inbox_items row exists for
+-- agent A on board X. Pre-fix, the messages/boards policies' unqualified `id`
+-- resolved to the inner alias's primary key, so agent A could not read either
+-- the boards row or the messages row (and v_board_feed returned zero rows).
+-- Post-fix, agent A sees all of these rows for board X.
+--
+-- Scenario B (leak -> denied): a second board Y is created by agent B with
+-- a board-mode delivery_recipients + inbox_items row addressed only to agent
+-- B (no membership for agent A). Pre-fix, the unqualified `board_id` in the
+-- EXISTS subquery resolved to bm.board_id (always true for any membership
+-- row), so agent A — by virtue of being a joined member of board X —
+-- could read delivery_recipients and inbox_items rows scoped to board Y.
+-- Post-fix, agent A must not see those cross-board rows.
+
+create temp table _rls_idqual_fixture (
+  user_a uuid,
+  agent_a uuid,
+  agent_b uuid,
+  board_home uuid,
+  board_other uuid,
+  message_home uuid,
+  inbox_home uuid,
+  inbox_other uuid,
+  delivery_other uuid
+) on commit drop;
+grant all on table _rls_idqual_fixture to authenticated, service_role;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_user_a uuid;
+  v_user_b uuid;
+  v_agent_a uuid := gen_random_uuid();
+  v_agent_b uuid := gen_random_uuid();
+  v_thread_home uuid := gen_random_uuid();
+  v_thread_other uuid := gen_random_uuid();
+  v_board_home uuid := gen_random_uuid();
+  v_board_other uuid := gen_random_uuid();
+  v_membership_a uuid := gen_random_uuid();
+  v_message_home uuid := gen_random_uuid();
+  v_message_other uuid := gen_random_uuid();
+  v_recipient_home uuid := gen_random_uuid();
+  v_recipient_other uuid := gen_random_uuid();
+  v_inbox_home uuid := gen_random_uuid();
+  v_inbox_other uuid := gen_random_uuid();
+  v_membership_b_home uuid := gen_random_uuid();
+  v_membership_b_other uuid := gen_random_uuid();
+begin
+  v_user_a := public.ensure_github_user(
+    'rls-idqual-a-' || v_suffix,
+    'rls-idqual-a-' || v_suffix || '@example.test',
+    'rls-idqual-a-' || v_suffix,
+    'RLS IdQual Agent A ' || v_suffix
+  );
+  v_user_b := public.ensure_github_user(
+    'rls-idqual-b-' || v_suffix,
+    'rls-idqual-b-' || v_suffix || '@example.test',
+    'rls-idqual-b-' || v_suffix,
+    'RLS IdQual Agent B ' || v_suffix
+  );
+
+  insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_agent_a, 'agent', 'agent', 'rls-idqual-a-' || v_suffix, 'IdQual A', 'active', v_user_a, v_user_a),
+    (v_agent_b, 'agent', 'agent', 'rls-idqual-b-' || v_suffix, 'IdQual B', 'active', v_user_b, v_user_b);
+
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values
+    (v_thread_home, 'coordination', v_agent_b, 'IdQual home thread'),
+    (v_thread_other, 'coordination', v_agent_b, 'IdQual other thread');
+
+  -- "home" board: agent A is a joined member; A is a board-mode recipient.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (v_board_home, 'rls-idqual-home-' || v_suffix, 'RLS IdQual Home', v_agent_b);
+
+  insert into agent_board.board_memberships(id, board_id, agent_id, membership_state, created_by_agent_id)
+  values
+    (v_membership_b_home, v_board_home, v_agent_b, 'joined', v_agent_b),
+    (v_membership_a,      v_board_home, v_agent_a, 'joined', v_agent_a);
+
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+  values (v_message_home, v_thread_home, v_agent_b, 1, 'comment', 'board post visible to joined member A');
+
+  insert into agent_board.delivery_recipients(id, delivery_mode, recipient_agent_id, source_kind, source_message_id, board_id, board_membership_id)
+  values (v_recipient_home, 'board', v_agent_a, 'message', v_message_home, v_board_home, v_membership_a);
+
+  insert into agent_board.inbox_items(
+    id, delivery_recipient_id, recipient_agent_id, board_id, delivery_mode, source_kind,
+    source_message_id, subject, preview, priority, action_state,
+    visible_in_inbox, visible_in_board_feed, fetch_descriptor
+  )
+  values (
+    v_inbox_home, v_recipient_home, v_agent_a, v_board_home, 'board', 'message',
+    v_message_home, 'IdQual home post', 'preview', 'medium', 'new',
+    true, true,
+    jsonb_build_object('surface', 'board', 'targetId', v_board_home::text, 'view', 'agent_board.v_board_feed', 'filters', jsonb_build_object(), 'reason', 'rls idqual home')
+  );
+
+  -- "other" board: agent A is NOT a member. Delivery + inbox row are scoped
+  -- to agent B as a board-mode recipient. Pre-fix, the unqualified board_id
+  -- in the RLS EXISTS subquery would let agent A read these rows via her
+  -- membership on board_home. Post-fix, she must be denied.
+  insert into agent_board.boards(id, slug, name, created_by_agent_id)
+  values (v_board_other, 'rls-idqual-other-' || v_suffix, 'RLS IdQual Other', v_agent_b);
+
+  insert into agent_board.board_memberships(id, board_id, agent_id, membership_state, created_by_agent_id)
+  values (v_membership_b_other, v_board_other, v_agent_b, 'joined', v_agent_b);
+
+  insert into agent_board.messages(id, thread_id, author_agent_id, message_sequence, message_type, body)
+  values (v_message_other, v_thread_other, v_agent_b, 1, 'comment', 'other-board post, off-limits for agent A');
+
+  insert into agent_board.delivery_recipients(id, delivery_mode, recipient_agent_id, source_kind, source_message_id, board_id, board_membership_id)
+  values (v_recipient_other, 'board', v_agent_b, 'message', v_message_other, v_board_other, v_membership_b_other);
+
+  insert into agent_board.inbox_items(
+    id, delivery_recipient_id, recipient_agent_id, board_id, delivery_mode, source_kind,
+    source_message_id, subject, preview, priority, action_state,
+    visible_in_inbox, visible_in_board_feed, fetch_descriptor
+  )
+  values (
+    v_inbox_other, v_recipient_other, v_agent_b, v_board_other, 'board', 'message',
+    v_message_other, 'IdQual other post', 'preview', 'medium', 'new',
+    true, true,
+    jsonb_build_object('surface', 'board', 'targetId', v_board_other::text, 'view', 'agent_board.v_board_feed', 'filters', jsonb_build_object(), 'reason', 'rls idqual other')
+  );
+
+  insert into _rls_idqual_fixture(user_a, agent_a, agent_b, board_home, board_other, message_home, inbox_home, inbox_other, delivery_other)
+  values (v_user_a, v_agent_a, v_agent_b, v_board_home, v_board_other, v_message_home, v_inbox_home, v_inbox_other, v_recipient_other);
+end
+$$;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+do $$
+declare
+  v_fixture record;
+  v_board_count bigint;
+  v_message_count bigint;
+  v_feed_count bigint;
+  v_leak_delivery bigint;
+  v_leak_inbox bigint;
+  v_inbox_home bigint;
+begin
+  select * into v_fixture from _rls_idqual_fixture;
+  perform set_config('request.jwt.claim.sub', v_fixture.user_a::text, true);
+
+  -- A) Deny-class regression: joined-not-creator agent A must see her own board.
+  select count(*) into v_board_count
+    from agent_board.boards b
+   where b.id = v_fixture.board_home;
+  if v_board_count <> 1 then
+    raise exception 'joined member A should see home board %, saw % rows', v_fixture.board_home, v_board_count;
+  end if;
+
+  -- B) Deny-class regression: board-delivery recipient A must see the home message.
+  select count(*) into v_message_count
+    from agent_board.messages m
+   where m.id = v_fixture.message_home;
+  if v_message_count <> 1 then
+    raise exception 'recipient A should see home message %, saw % rows', v_fixture.message_home, v_message_count;
+  end if;
+
+  -- C) Deny-class regression: v_board_feed inner-joins boards and messages.
+  select count(*) into v_feed_count
+    from agent_board.v_board_feed
+   where message_id = v_fixture.message_home;
+  if v_feed_count <> 1 then
+    raise exception 'v_board_feed should expose home post to A, saw % rows', v_feed_count;
+  end if;
+
+  -- D) Deny-class regression: A's own inbox row on home board must be visible.
+  select count(*) into v_inbox_home
+    from agent_board.inbox_items i
+   where i.id = v_fixture.inbox_home;
+  if v_inbox_home <> 1 then
+    raise exception 'inbox_items home row should be visible to recipient A, saw % rows', v_inbox_home;
+  end if;
+
+  -- E) Leak-class regression: A must NOT see delivery_recipients rows scoped
+  -- to the other board (recipient is agent B; A has no membership on that
+  -- board). Pre-fix, the unqualified board_id let A read them.
+  select count(*) into v_leak_delivery
+    from agent_board.delivery_recipients dr
+   where dr.id = v_fixture.delivery_other;
+  if v_leak_delivery <> 0 then
+    raise exception 'cross-board leak: A should not see delivery_recipients row %, saw % rows', v_fixture.delivery_other, v_leak_delivery;
+  end if;
+
+  -- F) Leak-class regression: A must NOT see inbox_items rows scoped to the
+  -- other board (recipient is agent B; A has no membership on that board).
+  select count(*) into v_leak_inbox
+    from agent_board.inbox_items i
+   where i.id = v_fixture.inbox_other;
+  if v_leak_inbox <> 0 then
+    raise exception 'cross-board leak: A should not see inbox_items row %, saw % rows', v_fixture.inbox_other, v_leak_inbox;
+  end if;
+end
+$$;
+
+select pass('Joined board member can select boards row via qualified RLS predicate');
+select pass('Board-delivery recipient can select messages row via qualified RLS predicate');
+select pass('v_board_feed exposes the board-delivered post to a joined member after qualification fix');
+select pass('Board-delivery recipient can select own inbox_items row on home board');
+select pass('Cross-board leak closed: delivery_recipients rows scoped to another board are hidden');
+select pass('Cross-board leak closed: inbox_items rows scoped to another board are hidden');
+select pass('All ambiguous-column RLS resolution regressions covered');
+
+select finish();
+
+rollback;

package/tests/agent_board_auth_rpcs.test.sql

@@ -0,0 +1,311 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(7);
+
+select has_function('agent_board', 'provision_agent', array['text', 'text', 'jsonb', 'uuid'], 'provision_agent exists');
+select has_function('agent_board', 'rotate_agent_token', array['uuid'], 'rotate_agent_token exists');
+select has_function('agent_board', 'revoke_agent', array['uuid', 'text'], 'revoke_agent exists');
+
+create temp table _agent_board_authrpc_fixture (
+  platform_admin_user_id uuid,
+  non_admin_user_id uuid,
+  owner_user_id uuid,
+  agent_one_handle text,
+  agent_two_handle text,
+  agent_two_id uuid,
+  agent_two_auth_user_id uuid
+) on commit drop;
+
+grant all on table _agent_board_authrpc_fixture to authenticated, service_role;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_platform_admin_user_id uuid;
+  v_non_admin_user_id uuid;
+  v_owner_user_id uuid;
+begin
+  v_platform_admin_user_id := public.ensure_github_user(
+    'agent-board-authrpc-admin-' || v_suffix,
+    'agent-board-authrpc-admin-' || v_suffix || '@example.test',
+    'agent-board-authrpc-admin-' || v_suffix,
+    'Agent Board Auth RPC Admin ' || v_suffix
+  );
+  v_non_admin_user_id := public.ensure_github_user(
+    'agent-board-authrpc-nonadmin-' || v_suffix,
+    'agent-board-authrpc-nonadmin-' || v_suffix || '@example.test',
+    'agent-board-authrpc-nonadmin-' || v_suffix,
+    'Agent Board Auth RPC Non Admin ' || v_suffix
+  );
+  v_owner_user_id := public.ensure_github_user(
+    'agent-board-authrpc-owner-' || v_suffix,
+    'agent-board-authrpc-owner-' || v_suffix || '@example.test',
+    'agent-board-authrpc-owner-' || v_suffix,
+    'Agent Board Auth RPC Owner ' || v_suffix
+  );
+
+  insert into public.user_org_roles(user_id, role)
+  values (v_platform_admin_user_id, 'platform_admin')
+  on conflict do nothing;
+
+  insert into _agent_board_authrpc_fixture(
+    platform_admin_user_id,
+    non_admin_user_id,
+    owner_user_id,
+    agent_one_handle,
+    agent_two_handle
+  )
+  values (
+    v_platform_admin_user_id,
+    v_non_admin_user_id,
+    v_owner_user_id,
+    'authrpc-one-' || v_suffix,
+    'authrpc-two-' || v_suffix
+  );
+end
+$$;
+
+set local role authenticated;
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+do $$
+declare
+  v_fixture record;
+  v_agent_one record;
+  v_agent_two record;
+  v_thread record;
+  v_rotated record;
+  v_revoked record;
+  v_previous_credential_id uuid;
+begin
+  select * into v_fixture from _agent_board_authrpc_fixture;
+
+  perform set_config('request.jwt.claim.sub', v_fixture.platform_admin_user_id::text, true);
+
+  select *
+    into v_agent_one
+    from agent_board.provision_agent(
+      v_fixture.agent_one_handle,
+      'agent',
+      '["direct","callback"]'::jsonb,
+      v_fixture.owner_user_id
+    );
+
+  if v_agent_one.refresh_token is null or length(v_agent_one.refresh_token) < 32 then
+    raise exception 'provision_agent did not return a one-time refresh token';
+  end if;
+
+  select *
+    into v_agent_two
+    from agent_board.provision_agent(
+      v_fixture.agent_two_handle,
+      'agent',
+      '[]'::jsonb,
+      v_fixture.owner_user_id
+    );
+
+  update _agent_board_authrpc_fixture
+     set agent_two_id = v_agent_two.agent_id,
+         agent_two_auth_user_id = v_agent_two.auth_user_id;
+
+  perform set_config('request.jwt.claim.sub', v_fixture.non_admin_user_id::text, true);
+  begin
+    perform *
+      from agent_board.provision_agent(
+        v_fixture.agent_one_handle || '-blocked',
+        'agent',
+        '[]'::jsonb,
+        v_fixture.owner_user_id
+      );
+    raise exception 'non-admin provisioning unexpectedly succeeded';
+  exception
+    when sqlstate '42501' then null;
+  end;
+
+  perform set_config('request.jwt.claim.sub', v_agent_one.auth_user_id::text, true);
+
+  if agent_board.current_agent_id() is distinct from v_agent_one.agent_id then
+    raise exception 'current_agent_id did not resolve the provisioned agent principal';
+  end if;
+
+  select *
+    into v_thread
+    from agent_board.create_thread(v_agent_one.agent_id, 'Auth RPC thread');
+
+  begin
+    perform *
+      from agent_board.create_thread(v_agent_two.agent_id, 'Impersonation attempt');
+    raise exception 'impersonating create_thread unexpectedly succeeded';
+  exception
+    when sqlstate '42501' then null;
+  end;
+
+  begin
+    perform *
+      from agent_board.register_callback_endpoint(v_agent_two.agent_id, 'https://example.test/blocked');
+    raise exception 'impersonating register_callback_endpoint unexpectedly succeeded';
+  exception
+    when sqlstate '42501' then null;
+  end;
+
+  perform set_config('request.jwt.claim.sub', v_fixture.platform_admin_user_id::text, true);
+
+  v_previous_credential_id := v_agent_one.credential_id;
+
+  select *
+    into v_rotated
+    from agent_board.rotate_agent_token(v_agent_one.agent_id);
+
+  if v_rotated.replaces_credential_id is distinct from v_previous_credential_id then
+    raise exception 'rotate_agent_token did not record replaces_credential_id';
+  end if;
+
+  select *
+    into v_revoked
+    from agent_board.revoke_agent(v_agent_one.agent_id, 'test revoke');
+
+  if v_revoked.status <> 'suspended' or v_revoked.revoked_credential_count < 1 then
+    raise exception 'revoke_agent did not suspend the agent or revoke credentials';
+  end if;
+
+  perform set_config('request.jwt.claim.sub', v_agent_one.auth_user_id::text, true);
+  if agent_board.current_agent_id() is not null then
+    raise exception 'revoked agent principal still resolves through current_agent_id';
+  end if;
+end
+$$;
+
+select pass('AUTHRPC provisioning, rotation, revocation, and impersonation checks passed');
+
+-- portal#203: provision_agent must fail closed for system principals. A system
+-- principal can never bind an auth session (trg_sync_agent_principal_columns
+-- clears auth_user_id; agents_system_owner_shape enforces it), so the RPC must
+-- reject issuance up front and leak neither an agent row nor a credential.
+do $$
+declare
+  v_fixture record;
+  v_system_handle text;
+  v_raised boolean := false;
+  v_msg text;
+begin
+  select * into v_fixture from _agent_board_authrpc_fixture;
+
+  perform set_config('request.jwt.claim.sub', v_fixture.platform_admin_user_id::text, true);
+
+  v_system_handle := v_fixture.agent_one_handle || '-system';
+
+  begin
+    perform *
+      from agent_board.provision_agent(
+        v_system_handle,
+        'system',
+        '[]'::jsonb,
+        null
+      );
+    raise exception 'system provisioning unexpectedly succeeded';
+  exception
+    when sqlstate '22023' then
+      v_raised := true;
+      v_msg := sqlerrm;
+  end;
+
+  if not v_raised then
+    raise exception 'system provisioning did not fail closed with sqlstate 22023';
+  end if;
+
+  -- 22023 is also raised by the slug and kind-vocabulary guards, so assert the
+  -- rejection came from the system-principal branch specifically (guards against
+  -- a future refactor passing this test for the wrong reason).
+  if v_msg not like '%system principals cannot be issued%' then
+    raise exception 'system rejection raised 22023 but with an unexpected message: %', v_msg;
+  end if;
+
+  -- The RPC raises before any insert, so no agent row is created for the handle.
+  -- agent_credentials.agent_id is FK -> agents, so the absence of an agent row is
+  -- sufficient to prove no credential leaked (checking agent_credentials directly
+  -- would require a grant the platform-admin caller role does not hold).
+  if exists (
+    select 1 from agent_board.agents where handle = v_system_handle
+  ) then
+    raise exception 'system provisioning leaked an agent row';
+  end if;
+end
+$$;
+
+select pass('AUTHRPC system provisioning fails closed and leaks no principal or credential');
+
+reset role;
+set local role service_role;
+select set_config('request.jwt.claim.role', 'service_role', true);
+
+do $$
+declare
+  v_fixture record;
+  v_endpoint record;
+begin
+  select * into v_fixture from _agent_board_authrpc_fixture;
+
+  select *
+    into v_endpoint
+    from agent_board.register_callback_endpoint(
+      v_fixture.agent_two_id,
+      'https://example.test/service-role'
+    );
+
+  if v_endpoint.owner_agent_id is distinct from v_fixture.agent_two_id then
+    raise exception 'service_role callback endpoint registration did not preserve the explicit owner principal';
+  end if;
+end
+$$;
+
+select pass('AUTHRPC preserved the service_role callback-runtime path');
+
+-- portal#203 (defense in depth): rotate_agent_token routes through the same
+-- _issue_agent_credential choke point, so a pre-existing system principal must
+-- also fail closed on rotation. Create one directly (provision_agent now rejects
+-- system) and assert rotation raises and mints nothing. Run as the superuser so
+-- the direct agents insert is permitted; rotate_agent_token still bypasses the
+-- platform-admin gate for a service/superuser caller, so the guard is exercised.
+reset role;
+do $$
+declare
+  v_fixture record;
+  v_system_handle text;
+  v_system_agent_id uuid;
+  v_raised boolean := false;
+begin
+  select * into v_fixture from _agent_board_authrpc_fixture;
+  v_system_handle := v_fixture.agent_one_handle || '-sysrot';
+
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('system', 'system', v_system_handle, 'System Principal', 'active')
+  returning id into v_system_agent_id;
+
+  begin
+    perform * from agent_board.rotate_agent_token(v_system_agent_id);
+    raise exception 'rotate_agent_token unexpectedly succeeded for a system principal';
+  exception
+    when sqlstate '22023' then
+      v_raised := true;
+  end;
+
+  if not v_raised then
+    raise exception 'rotate_agent_token did not fail closed with sqlstate 22023 for a system principal';
+  end if;
+
+  if exists (
+    select 1 from agent_board.agent_credentials where agent_id = v_system_agent_id
+  ) then
+    raise exception 'rotate_agent_token leaked a credential for a system principal';
+  end if;
+end
+$$;
+
+select pass('AUTHRPC rotate_agent_token also fails closed for system principals');
+
+select finish();
+
+rollback;