@consiliency/agent-board-schema 1.4.0 → 1.7.0

package/tests/agent_board_roomown.test.sql

@@ -0,0 +1,233 @@
+-- ROOMOWN pgTAP: room ownership (create_board owner-seed + owner-only slug-collision
+-- + bootstrap repair) and self-service authority (grant_board_role activated for
+-- authenticated owners/admins with a privilege-escalation-safe grantor binding).
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- (''/service_role => true, 'authenticated' => false) and request.jwt.claim.sub picks
+-- the acting agent. Fixture style mirrors agent_board_board_role.test.sql.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(21);
+
+create temp table _roomown_fixture (
+  board uuid,
+  board_slug text,
+  board2 uuid,
+  board2_owner uuid,
+  alice uuid,
+  bob uuid,
+  member_agent uuid,
+  grantee uuid,
+  nomember uuid,
+  suspended uuid,
+  alice_user uuid,
+  bob_user uuid,
+  member_user uuid,
+  suspended_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_alice_user uuid;
+  v_bob_user uuid;
+  v_member_user uuid;
+  v_suspended_user uuid;
+  v_alice uuid := gen_random_uuid();
+  v_bob uuid := gen_random_uuid();
+  v_member uuid := gen_random_uuid();
+  v_grantee uuid := gen_random_uuid();
+  v_nomember uuid := gen_random_uuid();
+  v_suspended uuid := gen_random_uuid();
+  v_b2owner uuid := gen_random_uuid();
+  v_board uuid;
+  v_slug text := 'roomown-board-' || v_suffix;
+  v_board2 uuid := gen_random_uuid();
+begin
+  v_alice_user := public.ensure_github_user('ro-alice-' || v_suffix, 'ro-alice-' || v_suffix || '@example.test', 'ro-alice-' || v_suffix, 'RO Alice');
+  v_bob_user := public.ensure_github_user('ro-bob-' || v_suffix, 'ro-bob-' || v_suffix || '@example.test', 'ro-bob-' || v_suffix, 'RO Bob');
+  v_member_user := public.ensure_github_user('ro-member-' || v_suffix, 'ro-member-' || v_suffix || '@example.test', 'ro-member-' || v_suffix, 'RO Member');
+  v_suspended_user := public.ensure_github_user('ro-susp-' || v_suffix, 'ro-susp-' || v_suffix || '@example.test', 'ro-susp-' || v_suffix, 'RO Suspended');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_alice, 'agent', 'ro-alice-' || v_suffix, 'RO Alice', 'active', v_alice_user, v_alice_user),
+    (v_bob, 'agent', 'ro-bob-' || v_suffix, 'RO Bob', 'active', v_bob_user, v_bob_user),
+    (v_member, 'agent', 'ro-member-' || v_suffix, 'RO Member', 'active', v_member_user, v_member_user),
+    -- Suspended agent WITH a valid auth user: current_agent_id() filters status='active'
+    -- so it resolves to null while auth.uid() still maps (the A1 escalation vector).
+    (v_suspended, 'agent', 'ro-susp-' || v_suffix, 'RO Suspended', 'suspended', v_suspended_user, v_suspended_user),
+    (v_grantee, 'agent', 'ro-grantee-' || v_suffix, 'RO Grantee', 'active', null, null),
+    (v_nomember, 'agent', 'ro-nomember-' || v_suffix, 'RO NoMember', 'active', null, null),
+    (v_b2owner, 'agent', 'ro-b2owner-' || v_suffix, 'RO B2 Owner', 'active', null, null);
+
+  -- Alice creates board B (service_role null-actor here -> supplied arg is honored):
+  -- create_board seeds Alice's joined owner membership.
+  select board_id into v_board
+    from agent_board.create_board(v_alice, v_slug, 'ROOMOWN Board', 'roomown test', '{}'::jsonb, 'private');
+
+  -- Genuine NON-creator members: a member (rank member) + a grant target (observer).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board, v_member, 'joined', v_alice, 'member'),
+    (v_board, v_grantee, 'joined', v_alice, 'observer');
+
+  -- Board B2: an owner-LESS board (direct insert, no membership) for the bootstrap sweep.
+  insert into agent_board.boards(id, slug, name, description, created_by_agent_id, visibility)
+  values (v_board2, 'roomown-board2-' || v_suffix, 'ROOMOWN Board2', 'owner-less', v_b2owner, 'private');
+
+  insert into _roomown_fixture values
+    (v_board, v_slug, v_board2, v_b2owner, v_alice, v_bob, v_member, v_grantee, v_nomember, v_suspended,
+     v_alice_user, v_bob_user, v_member_user, v_suspended_user);
+end
+$$;
+
+-- 1. create_board seeds the creator's joined owner membership --------------------
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.alice
+    where bm.membership_state = 'joined' and bm.role = 'owner'),
+  1, 'create_board seeds exactly one joined owner membership for the creator');
+
+-- A5.1 create_board actor-guard: authenticated Bob cannot create as Alice ---------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select bob_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'Bob As Alice', null, '{}'::jsonb, 'private')$q$,
+     alice, 'roomown-bobasalice-' || replace(board::text, '-', '')) from _roomown_fixture),
+  '42501', 'p_created_by_agent_id must match current_agent_id()',
+  'actor-guard: authenticated Bob cannot create_board as Alice');
+
+-- A5.2 slug-collision guard: non-owner Bob colliding on Alice's slug -> 42501 -----
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'HIJACK', null, '{}'::jsonb, 'open')$q$,
+     bob, board_slug) from _roomown_fixture),
+  '42501', 'board slug already in use',
+  'slug-collision: non-owner colliding on an existing slug is rejected');
+select is(
+  (select name from agent_board.boards b join _roomown_fixture f on b.id = f.board),
+  'ROOMOWN Board', 'slug-collision: the existing board name is unchanged (no hijack mutation)');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.bob),
+  0, 'slug-collision: the non-owner gains no membership on the existing board');
+
+-- 2. owner-seed idempotent: re-create by the owner does not add an owner row -------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'ROOMOWN Board', 'roomown test', '{}'::jsonb, 'private')$q$,
+     alice, board_slug) from _roomown_fixture),
+  'owner re-create on the same slug is admitted (owner-only update path)');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.alice
+    where bm.membership_state in ('joined', 'subscribed')),
+  1, 'owner-seed is idempotent: re-create does not duplicate the owner membership');
+
+-- 3. bootstrap repairs an owner-less board's created_by membership ----------------
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  'bootstrap_board_owner_memberships runs for service_role');
+select is(
+  (select count(*)::int from agent_board.board_memberships bm
+     join _roomown_fixture f on bm.board_id = f.board2 and bm.agent_id = f.board2_owner
+    where bm.membership_state = 'joined' and bm.role = 'owner'),
+  1, 'bootstrap seeds a joined owner membership for the owner-less board''s created_by');
+
+-- 4. bootstrap is service_role-only ----------------------------------------------
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select throws_ok(
+  $$select agent_board.bootstrap_board_owner_memberships()$$,
+  '42501', 'bootstrap_board_owner_memberships is service_role-only',
+  'bootstrap rejects an authenticated (mapped) caller');
+
+-- 5. owner grants admin (within ceiling, no ceiling row = owner) ------------------
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  'owner grants admin (grantor bound to current_agent_id, no explicit arg)');
+select is(
+  (select role from agent_board.board_memberships bm join _roomown_fixture f on bm.board_id = f.board and bm.agent_id = f.grantee),
+  'admin', 'the grantee role is upserted to admin');
+
+-- 6. a member cannot grant above its own rank ------------------------------------
+select set_config('request.jwt.claim.sub', (select member_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'a member grantor cannot grant admin (grantee-bounded ceiling)');
+
+-- 7. grantor binding: a member passing p_grantor=<owner> is still rejected (A1) ---
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  '42501', 'p_grantor_agent_id must match current_agent_id()',
+  'grantor binding: an authenticated member cannot impersonate the owner via p_grantor_agent_id');
+
+-- 8. board ceiling caps an owner grant -------------------------------------------
+insert into agent_board.board_authority_ceilings(board_id, max_grantable_role)
+select board, 'member' from _roomown_fixture;
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'admin')$q$, board, grantee) from _roomown_fixture),
+  '42501', 'grant exceeds grantor role or board authority ceiling',
+  'the board ceiling caps an over-ceiling grant even for an owner grantor');
+
+-- A5.3 grantee-membership required -> P0002 --------------------------------------
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member')$q$, board, nomember) from _roomown_fixture),
+  'P0002', 'grantee has no membership on this board',
+  'grant to an agent with no membership raises P0002');
+
+-- A5.4 service_role regression: explicit p_grantor honored on the null actor ------
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+select lives_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'member', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  'service_role: an explicit p_grantor_agent_id is honored (null actor via _is_service_role)');
+
+-- A5.5 null-actor escalation BLOCKED (proves A1) ---------------------------------
+-- An authenticated sub mapped to a SUSPENDED agent (current_agent_id() null) passing
+-- p_grantor=<owner> must be rejected at actor resolution, NOT self-escalated.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select suspended_user from _roomown_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.grant_board_role(%L::uuid, %L::uuid, 'owner', %L::uuid)$q$, board, grantee, alice) from _roomown_fixture),
+  '42501', 'current agent principal not resolved',
+  'null-actor escalation is blocked: a suspended principal cannot grant via a supplied owner id');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+-- 9. grant_board_role EXECUTE is granted to authenticated (live) -----------------
+select function_privs_are(
+  'agent_board', 'grant_board_role', array['uuid', 'uuid', 'text', 'uuid'],
+  'authenticated', array['EXECUTE'], 'grant_board_role execute is granted to authenticated (self-service authority live)');
+
+-- A5.6 demoted creator cannot mutate via slug-collision (current-owner authz, NOT created_by) --
+-- Panel finding: the slug-collision UPDATE path must key on CURRENT owner membership, not the
+-- immutable created_by. Alice (still owner after the grant tests) self-demotes to member, then
+-- her re-create on the same slug must be rejected and mutate nothing.
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select set_config('request.jwt.claim.sub', (select alice_user from _roomown_fixture)::text, true);
+-- self-demote to member (member <= min(owner, ceiling)); bare statement, not an assertion
+select agent_board.grant_board_role(board, alice, 'member') from _roomown_fixture;
+select throws_ok(
+  (select format($q$select agent_board.create_board(%L::uuid, %L, 'REOPEN', null, '{}'::jsonb, 'open')$q$,
+     alice, board_slug) from _roomown_fixture),
+  '42501', 'board slug already in use',
+  'demoted creator (no current owner membership) cannot mutate the board via slug-collision');
+select is(
+  (select visibility from agent_board.boards b join _roomown_fixture f on b.id = f.board),
+  'private', 'demoted-creator slug-collision leaves visibility unchanged (no private->open flip)');
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;

package/tests/agent_board_scoped_send_regrant.test.sql

@@ -28,6 +28,7 @@ declare
   v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
   v_member_user uuid;
   v_other_user uuid;
+  v_creator uuid := gen_random_uuid();
   v_member uuid := gen_random_uuid();
   v_other uuid := gen_random_uuid();
   v_recipient uuid := gen_random_uuid();
@@ -42,13 +43,16 @@ begin
   values
     (v_member, 'agent', 'rg-member-' || v_suffix, 'RG Member', 'active', v_member_user, v_member_user),
     (v_other, 'agent', 'rg-other-' || v_suffix, 'RG Other', 'active', v_other_user, v_other_user),
-    (v_recipient, 'agent', 'rg-recipient-' || v_suffix, 'RG Recipient', 'active', null, null);
+    (v_recipient, 'agent', 'rg-recipient-' || v_suffix, 'RG Recipient', 'active', null, null),
+    (v_creator, 'agent', 'rg-creator-' || v_suffix, 'RG Creator', 'active', null, null);
 
+  -- Dedicated creator (owner seeded by create_board); v_member is a genuine
+  -- NON-creator member so the member send path is exercised as role 'member'.
   select board_id into v_board
-    from agent_board.create_board(v_member, 'rg-board-' || v_suffix, 'RG Board', 'regrant test', '{}'::jsonb, 'private');
+    from agent_board.create_board(v_creator, 'rg-board-' || v_suffix, 'RG Board', 'regrant test', '{}'::jsonb, 'private');
 
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
-  values (v_board, v_member, 'joined', v_member, 'member');
+  values (v_board, v_member, 'joined', v_creator, 'member');
 
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
   values

package/tests/agent_board_send_authz_matrix.test.sql

@@ -26,6 +26,7 @@ declare
   v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
   v_sb_member_user uuid;
   v_sb_observer_user uuid;
+  v_sb_creator uuid := gen_random_uuid();
   v_sb_member uuid := gen_random_uuid();
   v_sb_observer uuid := gen_random_uuid();
   v_sb_board uuid;
@@ -45,6 +46,7 @@ begin
     (v_sb_observer, 'agent', 'mtx-observer-' || v_suffix, 'MTX Observer', 'active', v_sb_observer_user, v_sb_observer_user);
   insert into agent_board.agents(id, agent_type, handle, display_name)
   values
+    (v_sb_creator, 'agent', 'mtx-sbcreator-' || v_suffix, 'MTX Send Board Creator'),
     (v_nf_sender, 'agent', 'mtx-nf-' || v_suffix, 'MTX NonFleet'),
     (v_nf_allow, 'agent', 'mtx-nfa-' || v_suffix, 'MTX NonFleet Allow'),
     (v_g_owner, 'agent', 'mtx-gowner-' || v_suffix, 'MTX Grant Owner'),
@@ -53,12 +55,13 @@ begin
     (v_g2_owner, 'agent', 'mtx-g2owner-' || v_suffix, 'MTX Grant2 Owner'),
     (v_g2_grantee, 'agent', 'mtx-g2grantee-' || v_suffix, 'MTX Grant2 Grantee');
 
-  -- Send board with member/observer roles + accessible threads.
-  select board_id into v_sb_board from agent_board.create_board(v_sb_member, 'mtx-sb-' || v_suffix, 'MTX Send Board', 'matrix', '{}'::jsonb, 'private');
+  -- Send board created by a dedicated creator (owner is seeded by create_board);
+  -- member/observer are genuine NON-creator members so their roles drive the gate.
+  select board_id into v_sb_board from agent_board.create_board(v_sb_creator, 'mtx-sb-' || v_suffix, 'MTX Send Board', 'matrix', '{}'::jsonb, 'private');
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
-    (v_sb_board, v_sb_member, 'joined', v_sb_member, 'member'),
-    (v_sb_board, v_sb_observer, 'joined', v_sb_member, 'observer');
+    (v_sb_board, v_sb_member, 'joined', v_sb_creator, 'member'),
+    (v_sb_board, v_sb_observer, 'joined', v_sb_creator, 'observer');
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)
   values
     (v_thread_member, 'coordination', v_sb_member, 'MTX member thread'),
@@ -66,17 +69,17 @@ begin
 
   -- Grant board B1: no ceiling row (ceiling defaults to owner).
   select board_id into v_b1 from agent_board.create_board(v_g_owner, 'mtx-b1-' || v_suffix, 'MTX Grant B1', 'ceiling', '{}'::jsonb, 'private');
+  -- v_g_owner's owner membership is seeded by create_board (ROOMOWN).
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
-    (v_b1, v_g_owner, 'joined', v_g_owner, 'owner'),
     (v_b1, v_g_admin, 'joined', v_g_owner, 'admin'),
     (v_b1, v_g_grantee, 'joined', v_g_owner, 'observer');
 
   -- Grant board B2: ceiling lowered to member.
   select board_id into v_b2 from agent_board.create_board(v_g2_owner, 'mtx-b2-' || v_suffix, 'MTX Grant B2', 'ceiling', '{}'::jsonb, 'private');
+  -- v_g2_owner's owner membership is seeded by create_board (ROOMOWN).
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
-    (v_b2, v_g2_owner, 'joined', v_g2_owner, 'owner'),
     (v_b2, v_g2_grantee, 'joined', v_g2_owner, 'observer');
   insert into agent_board.board_authority_ceilings(board_id, max_grantable_role) values (v_b2, 'member');
 
@@ -149,10 +152,10 @@ select throws_ok(
   '42501', 'grant exceeds grantor role or board authority ceiling',
   'matrix: an over-ceiling grant is rejected even for an owner grantor');
 
--- E. Dormancy: grant_board_role is revoked from authenticated -----------------
+-- E. Live: grant_board_role is now granted EXECUTE to authenticated (ROOMOWN) ---
 select function_privs_are(
   'agent_board', 'grant_board_role', array['uuid', 'uuid', 'text', 'uuid'],
-  'authenticated', array[]::text[], 'matrix: grant_board_role execute is revoked from authenticated');
+  'authenticated', array['EXECUTE'], 'matrix: grant_board_role execute is granted to authenticated (self-service authority live)');
 
 select finish();
 

package/tests/agent_board_send_role_gate.test.sql

@@ -32,6 +32,7 @@ declare
   v_member_user uuid;
   v_observer_user uuid;
   v_nonmember_user uuid;
+  v_creator uuid := gen_random_uuid();
   v_member uuid := gen_random_uuid();
   v_observer uuid := gen_random_uuid();
   v_nonmember uuid := gen_random_uuid();
@@ -50,16 +51,19 @@ begin
     (v_member, 'agent', 'srg-member-' || v_suffix, 'SRG Member', 'active', v_member_user, v_member_user),
     (v_observer, 'agent', 'srg-observer-' || v_suffix, 'SRG Observer', 'active', v_observer_user, v_observer_user),
     (v_nonmember, 'agent', 'srg-nonmember-' || v_suffix, 'SRG Nonmember', 'active', v_nonmember_user, v_nonmember_user),
-    (v_recipient, 'agent', 'srg-recipient-' || v_suffix, 'SRG Recipient', 'active', null, null);
+    (v_recipient, 'agent', 'srg-recipient-' || v_suffix, 'SRG Recipient', 'active', null, null),
+    (v_creator, 'agent', 'srg-creator-' || v_suffix, 'SRG Creator', 'active', null, null);
 
+  -- Dedicated creator (owner seeded by create_board); member/observer are genuine
+  -- NON-creator members so their roles drive the send gate.
   select board_id into v_board
-    from agent_board.create_board(v_member, 'srg-board-' || v_suffix, 'SRG Board', 'send role gate test', '{}'::jsonb, 'private');
+    from agent_board.create_board(v_creator, 'srg-board-' || v_suffix, 'SRG Board', 'send role gate test', '{}'::jsonb, 'private');
 
   -- member: role member; observer: role observer. Both active.
   insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
   values
-    (v_board, v_member, 'joined', v_member, 'member'),
-    (v_board, v_observer, 'joined', v_member, 'observer');
+    (v_board, v_member, 'joined', v_creator, 'member'),
+    (v_board, v_observer, 'joined', v_creator, 'observer');
 
   -- Threads each sending actor can access (inherit mode; creator has access).
   insert into agent_board.threads(id, thread_type, created_by_agent_id, subject)

package/tests/agent_board_v2_invariants.test.sql

@@ -323,8 +323,8 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_board_delivery),
-  2,
-  'post_board_message only reaches active joined or subscribed board members'
+  3,
+  'post_board_message only reaches active joined or subscribed board members (incl. the seeded owner-creator)'
 );
 
 select is(
@@ -369,13 +369,13 @@ select *
 
 select is(
   (select delivered_recipient_count from v2_tasking_delivery),
-  3,
-  'tasking counts explicit and board fan-out attempts before duplicate collapse'
+  4,
+  'tasking counts explicit and board fan-out attempts before duplicate collapse (incl. the seeded owner-creator)'
 );
 
 select is(
   (select count(*)::integer from agent_board.delivery_recipients where source_task_id = (select task_id from v2_tasking_delivery)),
-  2,
+  3,
   'tasking suppresses duplicate durable recipient rows across explicit and board fan-out'
 );