@consiliency/agent-board-schema 1.22.0 → 1.23.0

package/tests/seeds/20260901000100_agent_board_atomic_fleet_onboarding.sql.pre.sql

@@ -0,0 +1,110 @@
+-- Legacy rows present before Consiliency/message-board#162. The migration must
+-- derive replay metadata from the stored federation facts, not from a fixture
+-- inserted after deployment.
+insert into agent_board.identity_providers(
+  id, issuer, audience, supported, policy_approved,
+  allowed_scopes, allowed_board_scopes, allowed_agent_kinds, subject_claim
+) values (
+  'legacy-atomic-provider', 'https://legacy.atomic.test', 'message-board', true, false,
+  ARRAY['board:read','board:send'], ARRAY['member'], ARRAY['agent'], 'uid'
+);
+
+insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+values (
+  '16200000-0000-0000-0000-000000000099',
+  '00000000-0000-0000-0000-000000000000',
+  'authenticated', 'authenticated', 'atomic-backfill@example.test', now(), now()
+) on conflict (id) do nothing;
+
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id, metadata)
+values (
+  '16200000-0000-0000-0000-000000000001', 'agent', 'agent',
+  'atomic-backfill-complete', 'Atomic Backfill Complete', 'active',
+  '16200000-0000-0000-0000-000000000099',
+  jsonb_build_object('federation', jsonb_build_object(
+    'issuer', 'https://legacy.atomic.test',
+    'audience', 'message-board',
+    'subject', 'legacy-complete',
+    'actorSub', null,
+    'providerId', 'legacy-atomic-provider',
+    'signingKeyFingerprint', 'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    'requestedScopes', jsonb_build_array('board:read', 'board:send'),
+    'requestedBoardScopes', jsonb_build_array('member')
+  ))
+), (
+  '16200000-0000-0000-0000-000000000002', 'agent', 'agent',
+  'atomic-backfill-ambiguous', 'Atomic Backfill Ambiguous', 'active', null,
+  jsonb_build_object('federation', jsonb_build_object(
+    'issuer', 'https://legacy.atomic.test',
+    'audience', 'message-board',
+    'actorSub', 'delegated-actor',
+    'providerId', 'legacy-atomic-provider',
+    'requestedScopes', jsonb_build_array('board:read'),
+    'requestedBoardScopes', jsonb_build_array('member'),
+    'replay', jsonb_build_object(
+      'issuer', 'https://forged.atomic.test',
+      'audience', jsonb_build_array('message-board'),
+      'subject', 'forged-ambiguous-subject',
+      'requestedSlug', 'atomic-backfill-ambiguous',
+      'agentKind', 'agent',
+      'actorSub', null,
+      'requestedScopes', jsonb_build_array('admin'),
+      'requestedBoardScopes', jsonb_build_array('owner'),
+      'providerId', 'legacy-atomic-provider'
+    )
+  ))
+);
+
+insert into agent_board.agent_signing_keys(
+  id, agent_id, key_id, key_version, public_key, public_key_format,
+  fingerprint, status, proof_state
+) values (
+  '16200000-0000-0000-0000-000000000011',
+  '16200000-0000-0000-0000-000000000001',
+  'legacy-atomic-key', 1,
+  'TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+  'raw_ed25519_base64url',
+  'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+  'active', 'proven'
+);
+
+insert into agent_board.enrollment_federation_audit(
+  id, issuer, audience, subject, human_identity_claim, provider_id,
+  agent_id, auth_user_id, requested_scopes, granted_scopes
+) values (
+  '16200000-0000-0000-0000-000000000021',
+  'https://legacy.atomic.test', 'message-board', 'legacy-complete',
+  jsonb_build_object(
+    'iss', 'https://legacy.atomic.test',
+    'aud', jsonb_build_array('secondary-audience', 'message-board'),
+    'uid', 'legacy-complete',
+    'iat', 100,
+    'jti', 'legacy-original'
+  ),
+  'legacy-atomic-provider',
+  '16200000-0000-0000-0000-000000000001',
+  '16200000-0000-0000-0000-000000000099',
+  ARRAY['board:read','board:send'], ARRAY['board:read']
+);
+
+-- Exercise the historical authenticated mutation path before the protecting
+-- trigger exists. The shipped migration must overwrite this forged replay and
+-- derive authorization-bearing scopes only from the append-only audit row.
+set role authenticated;
+select set_config('request.jwt.claim.sub', '16200000-0000-0000-0000-000000000099', false);
+select count(*) from agent_board.register_agent(
+  'agent', 'atomic-backfill-complete', 'Atomic Backfill Complete', 'active',
+  jsonb_build_object('federation', jsonb_build_object(
+    'issuer', 'https://legacy.atomic.test',
+    'audience', 'message-board',
+    'subject', 'legacy-complete',
+    'actorSub', 'forged-actor',
+    'providerId', 'legacy-atomic-provider',
+    'signingKeyFingerprint', 'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    'requestedScopes', jsonb_build_array('admin'),
+    'requestedBoardScopes', jsonb_build_array('owner'),
+    'replay', jsonb_build_object('subject', 'forged-subject', 'requestedScopes', jsonb_build_array('admin'))
+  ))
+);
+reset role;
+select set_config('request.jwt.claim.sub', '', false);