@consiliency/agent-board-schema 1.22.0 → 1.23.0

package/tests/agent_board_atomic_fleet_onboarding_backfill.test.sql

@@ -0,0 +1,142 @@
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+select plan(20);
+
+select is(
+  (select metadata #>> '{federation,replay,issuer}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  'https://legacy.atomic.test',
+  'shipped migration backfills the stable issuer'
+);
+select is(
+  (select metadata #> '{federation,replay,audience}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  '["message-board", "secondary-audience"]'::jsonb,
+  'shipped migration derives the normalized multi-audience claim projection'
+);
+select is(
+  (select metadata #>> '{federation,replay,subject}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  'legacy-complete',
+  'shipped migration backfills the configured stable human subject'
+);
+select is(
+  (select metadata #>> '{federation,replay,requestedSlug}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  'atomic-backfill-complete',
+  'legacy handle is the fail-closed requested-slug baseline'
+);
+select is(
+  (select metadata #> '{federation,replay,actorSub}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  'null'::jsonb,
+  'independent null actor subject stays null-stable'
+);
+select is(
+  (select metadata #> '{federation,replay,requestedScopes}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  '["board:read", "board:send"]'::jsonb,
+  'requested scope ceiling is preserved byte-for-byte'
+);
+select is(
+  (select metadata #> '{federation,replay,requestedBoardScopes}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  '[]'::jsonb,
+  'historically mutable board scopes are sanitized to the least-privilege baseline'
+);
+select ok(
+  not ((select metadata #> '{federation}' from agent_board.agents
+        where id = '16200000-0000-0000-0000-000000000002') ? 'replay'),
+  'ambiguous legacy row remains non-replayable'
+);
+select is(
+  (select metadata #>> '{federation,subject}' from agent_board.agents
+    where id = '16200000-0000-0000-0000-000000000001'),
+  'legacy-complete',
+  'backfill does not overwrite the immutable original federation snapshot'
+);
+
+select is(
+  (select count(*)::int from agent_board.agent_signing_keys
+    where agent_id = '16200000-0000-0000-0000-000000000001'),
+  1,
+  'the pre-migration fixture contains exactly one proven legacy key'
+);
+select is(
+  (select count(*)::int from agent_board.enrollment_federation_audit
+    where agent_id = '16200000-0000-0000-0000-000000000001'),
+  1,
+  'the pre-migration fixture contains exactly one immutable legacy audit claim'
+);
+
+update agent_board.identity_providers
+   set policy_approved = true
+ where id = 'legacy-atomic-provider';
+
+create temp table _legacy_replay as
+select * from agent_board.enroll_federated_identity(
+  'https://legacy.atomic.test', 'message-board', 'legacy-complete',
+  '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete","iat":900,"exp":9999999999,"jti":"rotated"}'::jsonb,
+  'atomic-backfill-complete',
+  'TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+  'raw_ed25519_base64url',
+  'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+  true, null, 'agent', ARRAY['board:read','board:send'], ARRAY[]::text[], null
+);
+select is((select agent_id from _legacy_replay),
+          '16200000-0000-0000-0000-000000000001'::uuid,
+  'rotating claims replay to the pre-migration agent');
+select is((select signing_key_id from _legacy_replay),
+          '16200000-0000-0000-0000-000000000011'::uuid,
+  'rotating claims replay to the pre-migration proven key');
+select is((select granted_scopes from _legacy_replay),
+          ARRAY['board:read']::text[],
+  'legacy replay returns the original server-granted scope rather than requested scopes');
+select is((select count(*)::int from agent_board.agents
+            where handle = 'atomic-backfill-complete'), 1,
+  'legacy replay creates no duplicate agent');
+select is((select count(*)::int from agent_board.agent_signing_keys
+            where fingerprint = 'sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I'), 1,
+  'legacy replay creates no duplicate key');
+
+select throws_ok(
+  $$select * from agent_board.enroll_federated_identity(
+    'https://legacy.atomic.test','message-board','legacy-complete',
+    '{"iss":"https://legacy.atomic.test","aud":["message-board","new-audience"],"uid":"legacy-complete"}'::jsonb,
+    'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+    'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+  '23505', null, 'changed normalized audience projection conflicts'
+);
+select throws_ok(
+  $$select * from agent_board.enroll_federated_identity(
+    'https://legacy.atomic.test','message-board','changed-subject',
+    '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"changed-subject"}'::jsonb,
+    'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+    'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+  '23505', null, 'changed stable subject conflicts'
+);
+select throws_ok(
+  $$select * from agent_board.enroll_federated_identity(
+    'https://legacy.atomic.test','message-board','legacy-complete',
+    '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
+    'changed-slug','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+    'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    true,null,'agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+  '23505', null, 'changed requested slug conflicts'
+);
+select throws_ok(
+  $$select * from agent_board.enroll_federated_identity(
+    'https://legacy.atomic.test','message-board','legacy-complete',
+    '{"iss":"https://legacy.atomic.test","aud":["message-board","secondary-audience"],"uid":"legacy-complete"}'::jsonb,
+    'atomic-backfill-complete','TauOMxwU-TW-deqQjil1DLDy_AvJrfoG_eXGwwvaRUk',
+    'raw_ed25519_base64url','sha256:QnDuPiA99wAIcCJlk4ZS_ZJV4gQPW8cX0LVmKQJNl0I',
+    true,'new-actor','agent',ARRAY['board:read','board:send'],ARRAY[]::text[],null)$$,
+  '23505', null, 'changed independent actor subject conflicts'
+);
+
+select * from finish();
+rollback;