@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/tests/agent_board_thread_acl.test.sql

@@ -0,0 +1,129 @@
+-- MBAUTHZ SL-2 (Lane B) pgTAP: threads.access_mode, thread_memberships (+RLS),
+-- and the redefined _current_agent_can_access_thread.
+--
+-- The suite runs as the postgres db role (superuser, so it can call the
+-- grant-revoked access helper), and simulates callers by toggling
+-- request.jwt.claim.role / request.jwt.claim.sub: role='authenticated' makes
+-- _is_service_role() false so the real access logic runs; role='service_role'
+-- exercises the short-circuit.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(14);
+
+create temp table _thread_acl_fixture (
+  thread_inherit uuid,
+  thread_restricted uuid,
+  creator_user uuid,
+  member_user uuid,
+  stranger_user uuid,
+  expired_user uuid,
+  revoked_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_creator_user uuid;
+  v_member_user uuid;
+  v_stranger_user uuid;
+  v_expired_user uuid;
+  v_revoked_user uuid;
+  v_creator uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_stranger uuid := gen_random_uuid();
+  v_expired uuid := gen_random_uuid();
+  v_revoked uuid := gen_random_uuid();
+  v_thread_inherit uuid := gen_random_uuid();
+  v_thread_restricted uuid := gen_random_uuid();
+begin
+  v_creator_user := public.ensure_github_user('acl-creator-' || v_suffix, 'acl-creator-' || v_suffix || '@example.test', 'acl-creator-' || v_suffix, 'ACL Creator');
+  v_member_user := public.ensure_github_user('acl-member-' || v_suffix, 'acl-member-' || v_suffix || '@example.test', 'acl-member-' || v_suffix, 'ACL Member');
+  v_stranger_user := public.ensure_github_user('acl-stranger-' || v_suffix, 'acl-stranger-' || v_suffix || '@example.test', 'acl-stranger-' || v_suffix, 'ACL Stranger');
+  v_expired_user := public.ensure_github_user('acl-expired-' || v_suffix, 'acl-expired-' || v_suffix || '@example.test', 'acl-expired-' || v_suffix, 'ACL Expired');
+  v_revoked_user := public.ensure_github_user('acl-revoked-' || v_suffix, 'acl-revoked-' || v_suffix || '@example.test', 'acl-revoked-' || v_suffix, 'ACL Revoked');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_creator, 'agent', 'acl-creator-' || v_suffix, 'ACL Creator', 'active', v_creator_user, v_creator_user),
+    (v_member, 'agent', 'acl-member-' || v_suffix, 'ACL Member', 'active', v_member_user, v_member_user),
+    (v_stranger, 'agent', 'acl-stranger-' || v_suffix, 'ACL Stranger', 'active', v_stranger_user, v_stranger_user),
+    (v_expired, 'agent', 'acl-expired-' || v_suffix, 'ACL Expired', 'active', v_expired_user, v_expired_user),
+    (v_revoked, 'agent', 'acl-revoked-' || v_suffix, 'ACL Revoked', 'active', v_revoked_user, v_revoked_user);
+
+  -- inherit thread (default access_mode) and a restricted thread.
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
+  values (v_thread_inherit, 'coordination', v_creator, 'ACL inherit thread');
+  insert into agent_board.threads(id, thread_type, created_by_agent_id, subject, access_mode)
+  values (v_thread_restricted, 'coordination', v_creator, 'ACL restricted thread', 'restricted');
+
+  -- ACL on the restricted thread: active member, expired member, revoked member.
+  insert into agent_board.thread_memberships(thread_id, agent_id, role, granted_by_agent_id, expires_at, revoked_at)
+  values
+    (v_thread_restricted, v_member, 'member', v_creator, null, null),
+    (v_thread_restricted, v_expired, 'member', v_creator, now() - interval '1 hour', null),
+    (v_thread_restricted, v_revoked, 'member', v_creator, null, now() - interval '1 hour');
+
+  insert into _thread_acl_fixture values
+    (v_thread_inherit, v_thread_restricted, v_creator_user, v_member_user, v_stranger_user, v_expired_user, v_revoked_user);
+end
+$$;
+
+-- Structure -----------------------------------------------------------------
+select has_column('agent_board', 'threads', 'access_mode', 'threads has access_mode');
+select col_type_is('agent_board', 'threads', 'access_mode', 'text', 'access_mode is text');
+select col_has_check('agent_board', 'threads', 'access_mode', 'access_mode is check-constrained');
+select is(
+  (select access_mode from agent_board.threads t join _thread_acl_fixture f on t.id = f.thread_inherit),
+  'inherit', 'access_mode defaults to inherit');
+select has_table('agent_board', 'thread_memberships', 'thread_memberships table exists');
+select has_column('agent_board', 'thread_memberships', 'thread_id', 'thread_memberships has thread_id');
+select is(
+  (select relrowsecurity from pg_class where oid = 'agent_board.thread_memberships'::regclass),
+  true, 'RLS is enabled on thread_memberships');
+
+-- inherit mode: historical OR preserved -------------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select creator_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_inherit from _thread_acl_fixture)),
+  true, 'inherit: creator retains access');
+
+select set_config('request.jwt.claim.sub', (select stranger_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_inherit from _thread_acl_fixture)),
+  false, 'inherit: unrelated agent has no access');
+
+-- service_role short-circuit: restricted thread, no membership -> allowed ----
+select set_config('request.jwt.claim.role', 'service_role', true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_restricted from _thread_acl_fixture)),
+  true, 'service_role bypasses restricted access');
+
+-- restricted mode -----------------------------------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select creator_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_restricted from _thread_acl_fixture)),
+  false, 'restricted: creator without an ACL grant is denied');
+
+select set_config('request.jwt.claim.sub', (select member_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_restricted from _thread_acl_fixture)),
+  true, 'restricted: active ACL member is granted');
+
+select set_config('request.jwt.claim.sub', (select expired_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_restricted from _thread_acl_fixture)),
+  false, 'restricted: expired ACL member is denied');
+
+select set_config('request.jwt.claim.sub', (select revoked_user from _thread_acl_fixture)::text, true);
+select is(
+  agent_board._current_agent_can_access_thread((select thread_restricted from _thread_acl_fixture)),
+  false, 'restricted: revoked ACL member is denied');
+
+select finish();
+
+rollback;

package/tests/agent_board_v2_invariants.test.sql

@@ -323,8 +323,8 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_board_delivery),
-  2,
-  'post_board_message only reaches active joined or subscribed board members'
+  3,
+  'post_board_message only reaches active joined or subscribed board members (incl. the seeded owner-creator)'
 );
 
 select is(
@@ -369,13 +369,13 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_tasking_delivery),
-  3,
-  'tasking counts explicit and board fan-out attempts before duplicate collapse'
+  4,
+  'tasking counts explicit and board fan-out attempts before duplicate collapse (incl. the seeded owner-creator)'
 );
 
 select is(
   (select count(*)::integer from agent_board.delivery_recipients where source_task_id = (select task_id from v2_tasking_delivery)),
-  2,
+  3,
   'tasking suppresses duplicate durable recipient rows across explicit and board fan-out'
 );