@consiliency/agent-board-schema 1.28.0 → 1.35.0

package/tests/agent_board_enroll_resumption.test.sql

@@ -194,7 +194,13 @@ select is(
      join pg_namespace n on n.oid = p.pronamespace
     where n.nspname = 'agent_board'
       and p.prokind = 'f'
-      and agent_board_test.strip_sql(p.prosrc) ~* 'insert into agent_board\.agent_signing_keys'),
+      -- stripped_body(p.oid), NOT strip_sql(p.prosrc): a SQL-standard-body function
+      -- keeps its body in prosqlbody and leaves prosrc EMPTY, so the prosrc form read
+      -- '' for it and this exact-set assertion would have reported the expected set
+      -- while a third signing-key creator was live (message-board#293). This site was
+      -- invisible to the #196 lint because that lint only inspects POSITIONAL and
+      -- NEGATIVE assertions, and this is a PRESENCE match -- see the note on the lint.
+      and agent_board_test.stripped_body(p.oid) ~* 'insert into agent_board\.agent_signing_keys'),
   '_enroll_federated_identity_once, mint_delegated_child',
   'EC-2: only the enroll creator and delegated-child mint insert signing keys (strip_sql-derived)');
 

package/tests/agent_board_federated_identity_injective_slug.test.sql

@@ -0,0 +1,388 @@
+-- message-board#246 (change 2 of 3) — the federated identity is derived through ONE
+-- injective serialization, and the ambiguous one is gone from the catalog.
+--
+-- WHAT THIS FILE HAS TO PROVE, and the shape of each proof:
+--
+--   INJ-*  The helper is injective where the old encoding was not. INJ-1 is not a
+--          "these two differ" curiosity: INJ-0 first proves the same two pairs DID
+--          collide under the old expression, so the fixture is the adversarial case
+--          from the issue and not an arbitrary pair. INJ-2 generalises to a family
+--          whose members differ only in where the separator falls, and names the
+--          offenders on failure instead of reporting a total.
+--   BF-*   The SHIPPED backfill moved four NAMED pre-existing rows -- one per recovery
+--          arm, plus one whose meta/identity values diverge from its slug -- across all
+--          four surfaces that carry the slug -- and, the assertion this
+--          whole change exists for, the #244 resumption lookup still resolves each pair
+--          to the SAME owner uuid it resolved to before. Re-deriving the handle without
+--          re-keying auth.users.email orphans the owner; that failure looks exactly
+--          like a cosmetic relabel, so it is asserted per row, by uuid, not as a
+--          property.
+--   CLS-*  Catalog-derived class invariants. The completeness claim is NOT "I grepped
+--          the files": pg_proc is asked which functions still contain a derivation and
+--          which route through the helper, and the answers are compared as NAME LISTS,
+--          so a sixth site fails and names itself. Source scans go through
+--          agent_board_test.stripped_body, the suite's one-pass comment/literal strip,
+--          because a prosrc scan that does not strip is defeated by prose -- the
+--          migration's own header quotes the old expression in a comment.
+--
+-- WHY THE FIXTURES ARE A PRE-MIGRATION SEED, not rows created here: the backfill runs
+-- once, inside the migration. Rows created inside this transaction would be created
+-- after it had already run. See tests/seeds/20260916000100_*.pre.sql for the four
+-- identities and why each exists.
+--
+-- WHAT IS NOT CLAIMED. The backfill's REFUSAL arms (a row whose pair cannot be
+-- recovered, or one with two distinct reproducing pairs) are not directly asserted
+-- here, because a fixture that triggers them aborts the migration and therefore the
+-- whole replay -- there is no green run left in which to assert. They are pinned
+-- INDIRECTLY and that is stated rather than glossed: F1 carries two agents with the
+-- same pair, so a backfill counting rows instead of DISTINCT pairs refuses F1 and every
+-- BF-1 assertion dies with the migration; F2 is reachable only through owner_user_id;
+-- F3 carries a decoy stamp that only the "reproduces the current slug" filter excludes.
+-- Each of those three mutations makes the migration itself abort with a message naming
+-- the offending uid, which is a louder failure than a `not ok`, but it is a failure of a
+-- different kind and the mutation table reports it as such, with an assertion count of 0.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public;
+
+begin;
+
+select plan(34);
+
+-- ---------------------------------------------------------------------------
+-- INJ: the serialization
+-- ---------------------------------------------------------------------------
+
+-- INJ-0. The premise. Under the OLD expression these two distinct pairs -- the exact
+-- example in the issue -- produce ONE slug. Without this, INJ-1 proves nothing: any two
+-- unrelated pairs differ under any hash.
+select is(
+  'fed-human-' || substr(encode(extensions.digest(convert_to(
+     'https://idp.example' || '|' || 'user|123', 'UTF8'), 'sha256'), 'hex'), 1, 32),
+  'fed-human-' || substr(encode(extensions.digest(convert_to(
+     'https://idp.example|user' || '|' || '123', 'UTF8'), 'sha256'), 'hex'), 1, 32),
+  'INJ-0: under the OLD encoding ("https://idp.example","user|123") and ("https://idp.example|user","123") derive the SAME slug');
+
+-- INJ-1. The same two pairs under the helper. Named individually so the failure line
+-- shows which slug moved.
+select isnt(
+  agent_board._federated_identity_slug('https://idp.example', 'user|123'),
+  agent_board._federated_identity_slug('https://idp.example|user', '123'),
+  'INJ-1: under the helper ("https://idp.example","user|123") and ("https://idp.example|user","123") derive DIFFERENT slugs');
+
+-- INJ-2. The family, not the instance: nine pairs whose concatenations are equal or
+-- near-equal and which differ only in where the boundary falls. The assertion compares
+-- a NAME LIST of colliding tag-pairs against '(none)', so a regression prints the tags
+-- that collided rather than a count that says only "some did".
+--
+-- Tags h/i carry their own weight: they collide under a COLON separator, not under a
+-- pipe one, so they fail a serialization that swapped the delimiter for the one the
+-- netstring form also uses while dropping the length prefixes. Without them, INJ-2 would
+-- red only for mutations INJ-1 already reds, and would be decoration.
+select is(
+  (with p(tag, iss, sub) as (values
+     ('a', 'https://idp.example',      'user|123'),
+     ('b', 'https://idp.example|user', '123'),
+     ('c', 'https://idp.example|',     'user|123'),
+     ('d', 'https://idp.example',      '|user|123'),
+     ('e', 'ab',                       'c'),
+     ('f', 'a',                        'bc'),
+     ('g', 'a|b',                      'c'),
+     ('h', 'x',                        'y:z'),
+     ('i', 'x:y',                      'z'))
+   select coalesce(string_agg(x.pair, ', ' order by x.pair), '(none)')
+     from (select distinct p1.tag || '/' || p2.tag as pair
+             from p p1 join p p2
+               on p1.tag < p2.tag
+              and agent_board._federated_identity_slug(p1.iss, p1.sub)
+                = agent_board._federated_identity_slug(p2.iss, p2.sub)) x),
+  '(none)',
+  'INJ-2: no two of the nine boundary-shifted pairs share a slug (offending tag pairs are named)');
+
+-- INJ-3..6. Fail closed on a missing component rather than deriving one shared
+-- degenerate owner. Four separate assertions because they are four separate conjuncts:
+-- a single "null input raises" would be satisfied by a guard on issuer alone.
+select throws_ok(
+  $$select agent_board._federated_identity_slug(null, 'sub')$$,
+  '22023',
+  'federated identity slug requires a non-empty issuer and subject',
+  'INJ-3: a NULL issuer raises 22023 instead of deriving a slug');
+select throws_ok(
+  $$select agent_board._federated_identity_slug('', 'sub')$$,
+  '22023',
+  'federated identity slug requires a non-empty issuer and subject',
+  'INJ-4: an EMPTY issuer raises 22023 instead of deriving a slug');
+select throws_ok(
+  $$select agent_board._federated_identity_slug('https://idp.example', null)$$,
+  '22023',
+  'federated identity slug requires a non-empty issuer and subject',
+  'INJ-5: a NULL subject raises 22023 instead of deriving a slug');
+select throws_ok(
+  $$select agent_board._federated_identity_slug('https://idp.example', '')$$,
+  '22023',
+  'federated identity slug requires a non-empty issuer and subject',
+  'INJ-6: an EMPTY subject raises 22023 instead of deriving a slug');
+
+-- ---------------------------------------------------------------------------
+-- BF: the three named pre-existing identities the shipped backfill re-keyed
+-- ---------------------------------------------------------------------------
+
+-- F1 — the HUMAN arm. uid d2460001-0000-4000-8000-000000000001,
+-- pair ("https://fixture-246.example/idp-a", "fixture-246-subject-a"),
+-- slug fed-human-d50f81b6913e066dba4c19f5cb6b202a -> fed-human-6c056fe12e1fb58fb2c072ff8bd9a613.
+
+select is(
+  (select u.email from auth.users u where u.id = 'd2460001-0000-4000-8000-000000000001'),
+  'agent+fed-human-6c056fe12e1fb58fb2c072ff8bd9a613@agent-board.local',
+  'BF-1a: F1 auth.users.email re-keyed to the new slug (the value _ensure_agent_auth_user looks up)');
+
+select is(
+  (select u.raw_user_meta_data->>'slug' from auth.users u
+    where u.id = 'd2460001-0000-4000-8000-000000000001'),
+  'fed-human-6c056fe12e1fb58fb2c072ff8bd9a613',
+  'BF-1b: F1 auth.users.raw_user_meta_data->>slug re-keyed to the new slug');
+
+select is(
+  (select i.provider_id || '|' || (i.identity_data->>'sub') || '|' || (i.identity_data->>'slug')
+     from auth.identities i where i.user_id = 'd2460001-0000-4000-8000-000000000001'),
+  'fed-human-6c056fe12e1fb58fb2c072ff8bd9a613|fed-human-6c056fe12e1fb58fb2c072ff8bd9a613|fed-human-6c056fe12e1fb58fb2c072ff8bd9a613',
+  'BF-1c: F1 auth.identities provider_id AND identity_data.sub AND identity_data.slug all re-keyed (each position shown)');
+
+select is(
+  (select a.handle from agent_board.agents a
+    where a.id = 'd2460101-0000-4000-8000-000000000001'),
+  'fed-human-6c056fe12e1fb58fb2c072ff8bd9a613',
+  'BF-1d: F1 human agent handle re-keyed (the handle IS the slug on this path)');
+
+-- THE ASSERTION THIS CHANGE EXISTS FOR. enroll_federated_identity resolves the resuming
+-- owner by a pure lookup on format('agent+%s@agent-board.local', <derived slug>). If the
+-- derivation moved and the email did not, this returns NULL, the non-null owner
+-- conjunct fails, and the owner cannot resume. Asserted by uuid, per row.
+select is(
+  (select u.id from auth.users u
+    where lower(u.email) = format('agent+%s@agent-board.local',
+      agent_board._federated_identity_slug('https://fixture-246.example/idp-a', 'fixture-246-subject-a'))),
+  'd2460001-0000-4000-8000-000000000001'::uuid,
+  'BF-1e: F1 the #244 resumption lookup still resolves the pair to the SAME owner uuid');
+
+-- A count of 2 is satisfied by one agent twice, or by two agents that are not these
+-- two -- the message says "both", so the body names both. (message-board#246 panel; the
+-- same shape shipped twice in #306.)
+select is(
+  (select string_agg(a.id::text, ', ' order by a.id::text) from agent_board.agents a
+    where a.owner_user_id = 'd2460001-0000-4000-8000-000000000001'),
+  'd2460101-0000-4000-8000-000000000001, d2460102-0000-4000-8000-000000000001',
+  'BF-1f: F1 still owns exactly its human row d2460101 and its owned agent d2460102 (the uuid moved nowhere, so no FK moved)');
+
+-- F2 — the OWNER-ONLY arm. uid d2460002-0000-4000-8000-000000000002, no agent carries
+-- this auth_user_id; the pair is reachable only through owner_user_id.
+-- slug fed-human-7ab9c8b527e1cce671305defc65fe7c0 -> fed-human-ec861cc1407f8f585e94cb9e8ece6039.
+
+select is(
+  (select u.email from auth.users u where u.id = 'd2460002-0000-4000-8000-000000000002'),
+  'agent+fed-human-ec861cc1407f8f585e94cb9e8ece6039@agent-board.local',
+  'BF-2a: F2 auth.users.email re-keyed although the pair is reachable only via owner_user_id');
+
+select is(
+  (select u.raw_user_meta_data->>'slug' from auth.users u
+    where u.id = 'd2460002-0000-4000-8000-000000000002'),
+  'fed-human-ec861cc1407f8f585e94cb9e8ece6039',
+  'BF-2b: F2 auth.users.raw_user_meta_data->>slug re-keyed');
+
+select is(
+  (select i.provider_id || '|' || (i.identity_data->>'sub') || '|' || (i.identity_data->>'slug')
+     from auth.identities i where i.user_id = 'd2460002-0000-4000-8000-000000000002'),
+  'fed-human-ec861cc1407f8f585e94cb9e8ece6039|fed-human-ec861cc1407f8f585e94cb9e8ece6039|fed-human-ec861cc1407f8f585e94cb9e8ece6039',
+  'BF-2c: F2 auth.identities provider_id AND identity_data.sub AND identity_data.slug all re-keyed (each position shown)');
+
+-- The complement of BF-1d: an agent whose handle is NOT the slug must not be touched.
+-- "update agents set handle = new where handle = old" is narrow on purpose.
+select is(
+  (select a.handle from agent_board.agents a
+    where a.id = 'd2460201-0000-4000-8000-000000000002'),
+  'mb246-fixture-a2',
+  'BF-2d: F2 owned agent keeps its own handle -- only a handle that IS the slug is rewritten');
+
+select is(
+  (select u.id from auth.users u
+    where lower(u.email) = format('agent+%s@agent-board.local',
+      agent_board._federated_identity_slug('https://fixture-246.example/idp-b', 'fixture-246-subject-b'))),
+  'd2460002-0000-4000-8000-000000000002'::uuid,
+  'BF-2e: F2 the #244 resumption lookup still resolves the pair to the SAME owner uuid');
+
+select is(
+  (select string_agg(a.id::text, ', ' order by a.id::text) from agent_board.agents a
+    where a.owner_user_id = 'd2460002-0000-4000-8000-000000000002'),
+  'd2460201-0000-4000-8000-000000000002',
+  'BF-2f: F2 still owns exactly its one agent d2460201 (named, not counted)');
+
+-- F3 — the DECOY arm. uid d2460003-0000-4000-8000-000000000003 owns an agent stamped
+-- with an unrelated pair; only the "reproduces the current slug" filter excludes it.
+-- slug fed-human-def7953eb096d786392090ce33952d9d -> fed-human-d4211005ca6d96ac0f8a90d2065dceda.
+
+select is(
+  (select u.email from auth.users u where u.id = 'd2460003-0000-4000-8000-000000000003'),
+  'agent+fed-human-d4211005ca6d96ac0f8a90d2065dceda@agent-board.local',
+  'BF-3a: F3 auth.users.email re-keyed to the slug of the pair that REPRODUCES its old slug, not the decoy');
+
+select is(
+  (select u.raw_user_meta_data->>'slug' from auth.users u
+    where u.id = 'd2460003-0000-4000-8000-000000000003'),
+  'fed-human-d4211005ca6d96ac0f8a90d2065dceda',
+  'BF-3b: F3 auth.users.raw_user_meta_data->>slug re-keyed');
+
+select is(
+  (select i.provider_id || '|' || (i.identity_data->>'sub') || '|' || (i.identity_data->>'slug')
+     from auth.identities i where i.user_id = 'd2460003-0000-4000-8000-000000000003'),
+  'fed-human-d4211005ca6d96ac0f8a90d2065dceda|fed-human-d4211005ca6d96ac0f8a90d2065dceda|fed-human-d4211005ca6d96ac0f8a90d2065dceda',
+  'BF-3c: F3 auth.identities provider_id AND identity_data.sub AND identity_data.slug all re-keyed (each position shown)');
+
+select is(
+  (select a.handle from agent_board.agents a
+    where a.id = 'd2460301-0000-4000-8000-000000000003'),
+  'fed-human-d4211005ca6d96ac0f8a90d2065dceda',
+  'BF-3d: F3 human agent handle re-keyed');
+
+select is(
+  (select u.id from auth.users u
+    where lower(u.email) = format('agent+%s@agent-board.local',
+      agent_board._federated_identity_slug('https://fixture-246.example/idp-c', 'fixture-246-subject-c'))),
+  'd2460003-0000-4000-8000-000000000003'::uuid,
+  'BF-3e: F3 the #244 resumption lookup still resolves the pair to the SAME owner uuid');
+
+-- The stamp is the PAIR. Reading only the issuer left a subject-only rewrite green while
+-- the message claimed "both ... its stamp"; both stamp fields are read here.
+select is(
+  (select a.handle || '|' || (a.metadata->'federation'->>'issuer')
+                   || '|' || (a.metadata->'federation'->>'subject')
+     from agent_board.agents a
+    where a.id = 'd2460302-0000-4000-8000-000000000003'),
+  'mb246-fixture-f3-decoy|https://fixture-246.example/idp-decoy|fixture-246-subject-decoy',
+  'BF-3f: F3 decoy-stamped agent is untouched in its handle AND in both fields of its stamp (each position shown)');
+
+-- F4 — the DIVERGENT arm. uid d2460004-0000-4000-8000-000000000004, pair
+-- ("https://fixture-246.example/idp-d", "fixture-246-subject-d"),
+-- slug fed-human-38b45a2207cfb4847a4c62c9973cd676 -> fed-human-25bf058f71a25339995a9a2012ced65b.
+--
+-- Two of the backfill's four surfaces are rewritten only when they EQUAL the old slug --
+-- raw_user_meta_data.slug and identity_data.sub/slug, one `case` arm each. F1-F3 all have
+-- them equal, so making both arms UNCONDITIONAL passed every assertion in this file. This
+-- fixture is the complement of BF-2d, which pins the same narrowness for agents.handle,
+-- and it was simply missing.
+
+select is(
+  (select u.email from auth.users u where u.id = 'd2460004-0000-4000-8000-000000000004'),
+  'agent+fed-human-25bf058f71a25339995a9a2012ced65b@agent-board.local',
+  'BF-4a: F4 auth.users.email re-keyed -- this row WAS visited, so BF-4b/4c below are not passing vacuously');
+
+select is(
+  (select u.raw_user_meta_data->>'slug' from auth.users u
+    where u.id = 'd2460004-0000-4000-8000-000000000004'),
+  'mb246-f4-legacy-meta-slug',
+  'BF-4b: F4 raw_user_meta_data->>slug is NOT rewritten, because it never held the old slug');
+
+select is(
+  (select i.provider_id || '|' || (i.identity_data->>'sub') || '|' || (i.identity_data->>'slug')
+     from auth.identities i where i.user_id = 'd2460004-0000-4000-8000-000000000004'),
+  'fed-human-25bf058f71a25339995a9a2012ced65b|mb246-f4-legacy-sub|mb246-f4-legacy-slug',
+  'BF-4c: F4 identities provider_id IS re-keyed while identity_data.sub and .slug are NOT -- each of the three positions shown');
+
+-- Population-wide, not fixture-wide: every fed-human owner email in the database must be
+-- reproducible from a stamp under the NEW derivation. Old and new slugs are
+-- shape-identical, so "no old-form rows remain" is not something a pattern can see;
+-- reproducibility is what can be checked, and the failure names the uids.
+select is(
+  (select coalesce(string_agg(u.id::text, ', ' order by u.id::text), '(none)')
+     from auth.users u
+    where lower(u.email) like 'agent+fed-human-%@agent-board.local'
+      and not exists (
+        select 1 from agent_board.agents a
+         where (a.auth_user_id = u.id or a.owner_user_id = u.id)
+           and a.metadata->'federation'->>'issuer'  is not null
+           and a.metadata->'federation'->>'subject' is not null
+           and agent_board._federated_identity_slug(
+                 a.metadata->'federation'->>'issuer',
+                 a.metadata->'federation'->>'subject') =
+               substring(lower(u.email) from '^agent\+(fed-human-[0-9a-f]{32})@agent-board\.local$'))),
+  '(none)',
+  'BF-POP: every fed-human owner row in the database re-derives from a stored stamp under the NEW helper (offending uids are named)');
+
+-- ---------------------------------------------------------------------------
+-- CLS: catalog-derived class invariants
+-- ---------------------------------------------------------------------------
+
+-- CLS-1. The old encoding is GONE, not shadowed. Any inline derivation must build the
+-- 'fed-human-' prefix, so the prefix literal is the class marker. Comments are stripped
+-- (keep_literals => true) because the migration header quotes the old expression in
+-- prose and an unstripped scan would be defeated by exactly that.
+select is(
+  (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and p.proname <> '_federated_identity_slug'
+      and agent_board_test.stripped_body(p.oid, true) like '%fed-human-%'),
+  '(none)',
+  'CLS-1: no agent_board function except _federated_identity_slug builds a fed-human- slug (offenders are named)');
+
+-- CLS-2. The complement of CLS-1: a re-introduced derivation that avoided the prefix
+-- literal would still carry the ambiguous separator shape. Catches the same class from
+-- the other side, so neither assertion is the only thing standing between the schema
+-- and a copied expression.
+select is(
+  (select coalesce(string_agg(p.oid::regprocedure::text, ', ' order by p.oid::regprocedure::text), '(none)')
+     from pg_proc p
+    where p.pronamespace = 'agent_board'::regnamespace
+      and agent_board_test.stripped_body(p.oid, true) ~ 'p_issuer\s*\|\|\s*''\|''\s*\|\|\s*p_subject'),
+  '(none)',
+  'CLS-2: no agent_board function still concatenates p_issuer || ''|'' || p_subject (offenders are named)');
+
+-- CLS-3. Completeness, positively and per site. Not a total: the list carries each
+-- function's NAME and its own call count, so "five callers" cannot be satisfied by one
+-- function calling five times, and enroll_federated_identity's SECOND call site (the
+-- #244 resumption lookup, which is a different site from the mint) is named separately
+-- from its first.
+select is(
+  (select coalesce(string_agg(x.entry, ', ' order by x.entry), '(none)')
+     from (select p.proname || '=' ||
+                  (select count(*) from regexp_matches(
+                     agent_board_test.stripped_body(p.oid, true),
+                     '_federated_identity_slug\(', 'g'))::text as entry
+             from pg_proc p
+            where p.pronamespace = 'agent_board'::regnamespace
+              and p.proname <> '_federated_identity_slug'
+              and agent_board_test.stripped_body(p.oid, true) like '%\_federated\_identity\_slug(%') x),
+  '_enroll_federated_human_after_revocation_gate=1, _enroll_federated_identity_once=1, enroll_federated_human=1, enroll_federated_identity=2, onboard_federated_fleet_agent=1',
+  'CLS-3: exactly these five functions route through the helper, each with its own call count');
+
+-- CLS-4. The helper is not a public lever. It is pure and mints nothing, but it is the
+-- function that decides which account a pair maps to, and CREATE FUNCTION grants EXECUTE
+-- to PUBLIC by default.
+select ok(
+  not has_function_privilege('public', 'agent_board._federated_identity_slug(text,text)', 'EXECUTE'),
+  'CLS-4: _federated_identity_slug carries no PUBLIC EXECUTE grant');
+
+-- CLS-5. create or replace (never drop) left every rebuilt function with a COMMENT -- a
+-- DROP would have silently discarded the comment AND the ACL. Named per function so a
+-- single surviving comment cannot stand in for five.
+--
+-- What this pins, stated exactly rather than implied by the word "kept": the comment is
+-- NOT NULL. It does not pin the TEXT, so a comment replaced with different prose passes.
+-- Pinning the text would pin five paragraphs of prose to the byte and fail on every
+-- wording change; non-null is the property that catches the failure mode that actually
+-- occurs here, which is a drop+recreate discarding the comment altogether.
+select is(
+  (select coalesce(string_agg(x.name, ', ' order by x.name), '(none)')
+     from (select p.proname as name from pg_proc p
+            where p.pronamespace = 'agent_board'::regnamespace
+              and p.proname in ('enroll_federated_human',
+                                '_enroll_federated_human_after_revocation_gate',
+                                '_enroll_federated_identity_once',
+                                'enroll_federated_identity',
+                                'onboard_federated_fleet_agent')
+              and obj_description(p.oid, 'pg_proc') is null) x),
+  '(none)',
+  'CLS-5: every rebuilt derivation site still carries a non-null COMMENT (functions with none are named)');
+
+select * from finish();
+
+rollback;

package/tests/agent_board_fedsession.test.sql

@@ -117,12 +117,27 @@ select is(
   (select count(*)::int from auth.users u where u.id = (select auth_user_id from _r where label='A')),
   1, 'the synthetic auth.users row for agent A exists');
 -- 11
+-- message-board#246: the derivation moved from `issuer || '|' || subject` to the
+-- netstring form `len(issuer):issuer:len(subject):subject`, because the old one was not
+-- injective and the slug keys the auth.users row. The expected value is still spelled
+-- out here rather than calling agent_board._federated_identity_slug: an assertion that
+-- calls the function under test compares it with itself and would follow any future
+-- change to it silently. This is an independent restatement of the contract.
+--
+-- The message no longer says "byte-identical to enroll_federated_identity". That was true
+-- when both functions carried their own copy of the expression and it was the risk worth
+-- naming; enroll_federated_identity now calls the same helper, so there is no second copy
+-- for this one to be byte-identical TO, and a message asserting that would be claiming
+-- something no code does.
 select is(
   (select handle from _r where label='A'),
   'fed-human-' || substr(
-    encode(extensions.digest(convert_to((select iss from _f) || '|' || (select sub_a from _f), 'UTF8'), 'sha256'), 'hex'),
+    encode(extensions.digest(convert_to(
+      length((select iss from _f))::text   || ':' || (select iss from _f)   || ':' ||
+      length((select sub_a from _f))::text || ':' || (select sub_a from _f),
+      'UTF8'), 'sha256'), 'hex'),
     1, 32),
-  'handle = fed-human-<sha256(issuer|subject)[:32]> (byte-identical to enroll_federated_identity)');
+  'handle = fed-human-<sha256(len:issuer:len:subject)[:32]> (the contract every site now shares via _federated_identity_slug)');
 
 -- metadata carries the federation snapshot, boolean-only email, no PII --------------------
 -- 12