@consiliency/agent-board-schema 1.2.0

package/tests/agent_board_workload_providers.test.sql

@@ -0,0 +1,15 @@
+-- pgTAP tests for workload provider registry
+begin;
+select plan(8);
+
+select has_table('agent_board', 'workload_providers', 'workload_providers table exists');
+select has_column('agent_board', 'workload_providers', 'issuer', 'workload_providers has issuer');
+select has_column('agent_board', 'workload_providers', 'audience', 'workload_providers has audience');
+select has_column('agent_board', 'workload_providers', 'supported', 'workload_providers has supported');
+select has_column('agent_board', 'workload_providers', 'policy_approved', 'workload_providers has policy approval');
+select has_column('agent_board', 'workload_providers', 'allowed_repositories', 'workload_providers has repository allowlist');
+select has_column('agent_board', 'workload_providers', 'allowed_workflows', 'workload_providers has workflow allowlist');
+select has_column('agent_board', 'workload_providers', 'allowed_board_scopes', 'workload_providers has board-scope allowlist');
+
+select * from finish();
+rollback;

package/tests/fixtures/adopter-base.sql

@@ -0,0 +1,19 @@
+-- Adopter-base fixture — external prerequisites the canonical agent_board bundle
+-- assumes are already present in an adopter Supabase project.
+--
+-- These are NOT part of the Message Board-owned agent_board schema. They are
+-- Portal-owned `public` objects the bundle references (documented as external
+-- dependencies in schema-manifest.json). In the Portal production project they
+-- already exist from earlier Portal migrations; this fixture provides minimal,
+-- read/upsert-compatible stubs so the bundle can replay standalone on a fresh
+-- Supabase base for parity + tests. It creates nothing under agent_board and so
+-- does not affect the canonical agent_board catalog digest.
+create table if not exists public.user_org_roles (
+  user_id    uuid,
+  role       text,
+  granted_at timestamptz default now()
+);
+create table if not exists public.app_settings (
+  key   text primary key,
+  value jsonb
+);

package/tests/fixtures/operator-hardening.sql

@@ -0,0 +1,27 @@
+-- Portal OPERATOR security overlay — NOT part of the canonical agent_board bundle.
+--
+-- CORRECTION (four-agent review, Finding A): the source migration
+-- Consiliency/consiliency-portal @ 7ddb0bbb :
+-- supabase/migrations/20260630030100_client_portal_b2_deny_default.sql is NOT
+-- "grant removal only." Via dynamic SQL it also ENABLEs ROW LEVEL SECURITY and
+-- CREATEs policies (incl. a RESTRICTIVE agent_board_b2_deny_client_jwt_select and
+-- the b2_realtime_* policies) on ~14 agent_board tables, keyed on the
+-- Portal-specific auth.jwt()->>'accountType' = 'client' claim.
+--
+-- This fixture models ONLY the minimal piece the standalone bundle suite needs:
+-- the direct authenticated/anon SELECT revoke on agent_board.schema_version that
+-- one lane test (agent_board_schema_version_rpc, assertion 4) asserts as the
+-- POST-adoption posture. It deliberately does NOT create the b2 RLS policies
+-- (that would enable RLS on other tables and perturb unrelated tests). The full
+-- overlay + its Phase-7 equivalence handling are enumerated in
+-- plans/MBPLANE-PORTAL-208-MAPPING.json (operatorGrantOverlay) and
+-- plans/MBPLANE-EXTRACTION-PARITY.md §4. Applied AFTER the bundle migrations.
+DO $$
+BEGIN
+  IF to_regclass('agent_board.schema_version') IS NOT NULL THEN
+    -- Portal-side grant removal only. Do not alter the agent_board table shape
+    -- or bump agent_board.schema_version.
+    REVOKE SELECT ON TABLE agent_board.schema_version FROM anon, authenticated;
+    GRANT SELECT ON TABLE agent_board.schema_version TO service_role;
+  END IF;
+END $$;

package/tests/fixtures/test-prereqs.sql

@@ -0,0 +1,84 @@
+-- Test-only external prerequisites.
+--
+-- Portal-owned helpers the pgTAP suite calls to mint an authenticated user
+-- (auth.users + auth.identities). NOT part of the agent_board bundle; the Portal
+-- test environment provides them via its own migrations. Copied verbatim from
+-- Consiliency/consiliency-portal @ 94f9c269 :
+--   supabase/migrations/20260416000500_access_tiers_and_user_provision.sql
+-- so the canonical agent_board tests can run standalone.
+CREATE OR REPLACE FUNCTION public.ensure_github_user(
+  p_github_id text,
+  p_email     text,
+  p_login     text,
+  p_name      text
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE
+  v_user_id uuid;
+BEGIN
+  -- Already provisioned? Return the existing id.
+  SELECT ai.user_id INTO v_user_id
+    FROM auth.identities ai
+   WHERE ai.provider = 'github'
+     AND ai.provider_id = p_github_id
+   LIMIT 1;
+
+  IF v_user_id IS NOT NULL THEN
+    RETURN v_user_id;
+  END IF;
+
+  -- New user. Create auth.users row.
+  v_user_id := gen_random_uuid();
+
+  INSERT INTO auth.users (
+    id, instance_id, email, email_confirmed_at,
+    encrypted_password, created_at, updated_at,
+    raw_app_meta_data, raw_user_meta_data,
+    aud, role
+  ) VALUES (
+    v_user_id,
+    '00000000-0000-0000-0000-000000000000',
+    p_email,
+    NOW(),
+    '',
+    NOW(), NOW(),
+    jsonb_build_object('provider', 'github', 'providers', jsonb_build_array('github')),
+    jsonb_build_object(
+      'provider_id', p_github_id,
+      'user_name',   p_login,
+      'name',        p_name,
+      'email',       p_email
+    ),
+    'authenticated',
+    'authenticated'
+  );
+
+  -- Link the GitHub identity. provider_id is the source of truth for
+  -- resolve_*_by_github lookups.
+  INSERT INTO auth.identities (
+    id, user_id, provider_id, provider,
+    identity_data, last_sign_in_at, created_at, updated_at
+  ) VALUES (
+    gen_random_uuid(),
+    v_user_id,
+    p_github_id,
+    'github',
+    jsonb_build_object(
+      'sub',       p_github_id,
+      'user_name', p_login,
+      'email',     p_email,
+      'name',      p_name
+    ),
+    NOW(), NOW(), NOW()
+  );
+
+  RETURN v_user_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.ensure_github_user(text, text, text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.ensure_github_user(text, text, text, text) TO service_role;