@consiliency/agent-board-schema 1.55.0 → 1.57.0

package/tests/agent_board_onboard_requests.test.sql

@@ -0,0 +1,353 @@
+-- ONBOARD (v11) SL-2 pgTAP: list_my_board_requests() (IF-0-ONBOARD-4) and
+-- invite_board_for_display(text) (IF-0-ONBOARD-11), migration 20261007000100.
+--
+-- Driven by the real operations only: request_join_board, resolve_board_request (approve and
+-- reject), leave_board then request_join_board again, create_invite_link / redeem_invite_link /
+-- revoke_invite_link, enroll_federated_human. Two fixtures are AGE only, because now() is
+-- constant inside the test transaction and neither the TTL nor an invite expiry can be waited
+-- out: one request event's created_at is moved 31 days back (OB-L13), and one invite's
+-- expires_at is moved into the past (OB-I05). Both rows were first written by the real RPC.
+--
+-- Identity is set by the whole-JSON claim GUC only (the consent suite's method): SET LOCAL
+-- ROLE is never used, so EXECUTE posture is asserted separately through
+-- has_function_privilege, not by calling as a role.
+--
+-- Every call to a function under test is a lives_ok capture into a temp table, then separate
+-- state checks (AGENTS.md rule 3): a missing or re-signatured function FAILS the capture and
+-- leaves the checks to fail on an empty table, instead of aborting the file.
+--
+-- Mutation receipts (plans/evidence/onboard/mutation-receipts.md, "## SL-2"):
+--   identity parameter added          -> OB-L02
+--   agent_id = caller dropped         -> OB-L10, OB-L16
+--   created_by_agent_id as the source -> OB-L10
+--   service_role granted              -> OB-L05
+--   IF-11 granted to authenticated    -> OB-I13
+--   revoked / expired / exhausted predicate dropped -> OB-I04 / OB-I05 / OB-I07
+--
+-- HAND-COUNTED plan: OB-L01..L23 (23) + OB-I01..I16 with I03b (17) + OB-R01..R03 and the two
+-- named redeem pins (5) = 45.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(45);
+
+create function pg_temp.claims(p_sub text) returns void language plpgsql as $$
+begin
+  perform set_config('request.jwt.claims', json_build_object('role','authenticated','sub',p_sub)::text, true);
+end $$;
+create function pg_temp.service() returns void language plpgsql as $$
+begin perform set_config('request.jwt.claims', '', true); end $$;
+create function pg_temp.state(b uuid, a uuid) returns text language sql as $$
+  select membership_state from agent_board.board_memberships
+   where board_id = b and agent_id = a
+   order by case when membership_state in ('joined','subscribed') then 0 else 1 end,
+            created_at desc, id desc
+   limit 1;
+$$;
+create function pg_temp.sha(p_code text) returns text language sql as $$
+  select encode(extensions.digest(p_code, 'sha256'), 'hex');
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Fixture: principals and boards (service context; create_board seeds the owner).
+-- ---------------------------------------------------------------------------
+insert into auth.users(id, instance_id, aud, role, email)
+select ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid,
+       '00000000-0000-0000-0000-000000000000','authenticated','authenticated','onb'||n||'@t.test'
+from generate_series(1,4) n;
+
+-- 1 = owner, 2 = requester R, 3 = another principal X, 4 = invite redeemer / exhauster Y.
+insert into agent_board.agents(id, agent_type, kind, handle, display_name, status, auth_user_id)
+select ('0b100000-0000-4000-8000-' || lpad(n::text,12,'0'))::uuid,
+       'agent','agent','onb-agent-'||n,'ONB Agent '||n,'active',
+       ('0b000000-0000-0000-0000-' || lpad(n::text,12,'0'))::uuid
+from generate_series(1,4) n;
+
+create temp table _ob (
+  owner uuid, r uuid, x uuid, y uuid, h uuid, h_user uuid,
+  b_approve uuid, b_reject uuid, b_rerequest uuid, b_expire uuid,
+  b_invite uuid, b_other uuid, b_human uuid, b_links uuid,
+  code_join text, code_live text, code_revoked text, code_expired text,
+  code_exhaust text, code_replay text, code_other text
+) on commit drop;
+
+do $$
+declare
+  v_owner uuid := '0b100000-0000-4000-8000-000000000001';
+  v_iss text := 'https://onb-fed-' || replace(substr(gen_random_uuid()::text, 1, 8), '-', '') || '.test';
+  v_h uuid; v_h_user uuid;
+  v_ba uuid; v_bb uuid; v_bc uuid; v_bd uuid; v_be uuid; v_bg uuid; v_bf uuid; v_bk uuid;
+begin
+  select board_id into v_ba from agent_board.create_board(v_owner, 'onb-approve', 'ONB Approve', null, '{}'::jsonb, 'open');
+  select board_id into v_bb from agent_board.create_board(v_owner, 'onb-reject', 'ONB Reject', null, '{}'::jsonb, 'open');
+  select board_id into v_bc from agent_board.create_board(v_owner, 'onb-rerequest', 'ONB Rerequest', null, '{}'::jsonb, 'open');
+  select board_id into v_bd from agent_board.create_board(v_owner, 'onb-expire', 'ONB Expire', null, '{}'::jsonb, 'invite_only');
+  select board_id into v_be from agent_board.create_board(v_owner, 'onb-invite', 'ONB Invite', null, '{}'::jsonb, 'open');
+  select board_id into v_bg from agent_board.create_board(v_owner, 'onb-other', 'ONB Other', null, '{}'::jsonb, 'open');
+  select board_id into v_bf from agent_board.create_board(v_owner, 'onb-human', 'ONB Human', null, '{}'::jsonb, 'open');
+  select board_id into v_bk from agent_board.create_board(v_owner, 'onb-links', 'ONB Links', null, '{}'::jsonb, 'private');
+
+  -- A Portal human: the federated provider, then the fed-human agent it provisions.
+  insert into agent_board.identity_providers
+    (issuer, audience, supported, policy_approved, allowed_agent_kinds, default_board_id)
+  values (v_iss, 'message-board', true, true, '{human}', null);
+  select e.agent_id, e.auth_user_id into v_h, v_h_user
+    from agent_board.enroll_federated_human(
+      v_iss, 'message-board', 'onb-human-sub',
+      jsonb_build_object('sub', 'onb-human-sub', 'email_verified', false), 'ONB Human') e;
+
+  insert into _ob(owner, r, x, y, h, h_user,
+                  b_approve, b_reject, b_rerequest, b_expire, b_invite, b_other, b_human, b_links)
+  values (v_owner,
+          '0b100000-0000-4000-8000-000000000002', '0b100000-0000-4000-8000-000000000003',
+          '0b100000-0000-4000-8000-000000000004', v_h, v_h_user,
+          v_ba, v_bb, v_bc, v_bd, v_be, v_bg, v_bf, v_bk);
+
+  update _ob set
+    code_join    = (select code from agent_board.create_invite_link(v_be, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_live    = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_revoked = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_expired = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_exhaust = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', 1, null, v_owner, '{}'::jsonb)),
+    code_replay  = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb)),
+    code_other   = (select code from agent_board.create_invite_link(v_bk, 'member', 'joined', null, null, v_owner, '{}'::jsonb));
+end
+$$;
+
+create temp table _req (
+  who text, board_id uuid, board_name text, board_slug text, requested_at timestamptz,
+  membership_state text, expires_at timestamptz, expired boolean
+) on commit drop;
+create temp table _disp (
+  label text, board_id uuid, board_name text, board_slug text, preset_role text
+) on commit drop;
+
+-- ===========================================================================
+-- list_my_board_requests: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.list_my_board_requests()') is not null,
+  'OB-L01: list_my_board_requests() exists with no arguments');
+select is(
+  (select string_agg(coalesce(pg_get_function_arguments(p.oid), ''), '|')
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  '',
+  'OB-L02: exactly one list_my_board_requests overload, and it takes NO parameter (identity is never an argument)');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'list_my_board_requests'),
+  'true/s',
+  'OB-L03: list_my_board_requests is SECURITY DEFINER and STABLE');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  true, 'OB-L04: authenticated holds EXECUTE on list_my_board_requests');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L05: service_role holds NO EXECUTE on list_my_board_requests (no caller identity)');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L06: anon holds NO EXECUTE on list_my_board_requests');
+select is(has_function_privilege('public', to_regprocedure('agent_board.list_my_board_requests()'), 'EXECUTE'),
+  false, 'OB-L07: PUBLIC holds NO EXECUTE on list_my_board_requests');
+
+-- ===========================================================================
+-- Real operations
+-- ===========================================================================
+-- R requests four boards.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.r);
+  perform agent_board.request_join_board(o.b_reject, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_expire, o.r);
+end $$;
+
+-- X requests the approve board and a board R never asked for.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_approve, o.x);
+  perform agent_board.request_join_board(o.b_other, o.x);
+end $$;
+
+-- The owner approves A and C, rejects B. Passing the owner as p_created_by_agent_id makes the
+-- sink overwrite created_by_agent_id on R's rows -- the reason that column is not a source.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.resolve_board_request(o.b_approve, o.r, 'joined', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_reject, o.r, 'removed', o.owner, '{}'::jsonb);
+  perform agent_board.resolve_board_request(o.b_rerequest, o.r, 'joined', o.owner, '{}'::jsonb);
+end $$;
+
+-- R leaves C and requests it again; R joins E through an invite with no request.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.leave_board(o.b_rerequest, o.r);
+  perform agent_board.request_join_board(o.b_rerequest, o.r);
+  perform agent_board.redeem_invite_link(o.code_join);
+end $$;
+
+-- The Portal human requests F from its own session.
+select pg_temp.claims((select h_user::text from _ob));
+do $$ declare o _ob; begin select * into o from _ob;
+  perform agent_board.request_join_board(o.b_human, o.h);
+end $$;
+
+-- AGE fixture: R's request on D is moved past the board's 30-day TTL.
+select pg_temp.service();
+update agent_board.board_membership_events e
+   set created_at = now() - interval '31 days'
+  from _ob
+ where e.board_id = _ob.b_expire and e.agent_id = _ob.r
+   and e.provenance = 'target-authored' and e.result_state = 'requested';
+
+-- ===========================================================================
+-- list_my_board_requests: behaviour
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ insert into _req select 'R', * from agent_board.list_my_board_requests() $$,
+  'OB-L08: R lists its requests [call succeeds]');
+select pg_temp.claims('0b000000-0000-0000-0000-000000000003');
+select lives_ok($$ insert into _req select 'X', * from agent_board.list_my_board_requests() $$,
+  'OB-L09: X lists its requests [call succeeds]');
+
+select is(
+  (select string_agg(board_slug, ',' order by board_slug) from _req where who = 'R'),
+  'onb-approve,onb-expire,onb-reject,onb-rerequest',
+  'OB-L10: R sees exactly its four requested boards -- approved, rejected, re-requested and expired');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'joined', 'OB-L11: an approved request reads its current state, joined');
+select is((select membership_state from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_reject),
+  'left', 'OB-L12: a rejected request reads its current state, left (REJECTSEM)');
+select is((select membership_state || '/' || expired::text from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_expire),
+  'requested/true', 'OB-L13: a request older than join_request_ttl_days is returned with expired = true');
+select is((select count(*)::int from _req where who = 'R' and not expired),
+  3, 'OB-L14: the three requests inside the TTL are expired = false');
+select is(
+  (select membership_state || '/' || (select count(*) from _req q where q.who = 'R' and q.board_id = r.board_id)::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_rerequest),
+  'requested/1',
+  'OB-L15: leave then re-request reads requested, in ONE row for the board');
+select is((select count(*)::int from _req r, _ob where r.who = 'R' and r.board_id in (_ob.b_other, _ob.b_human)),
+  0, 'OB-L16: another principal''s requests are invisible to R');
+select is(
+  (select pg_temp.state(_ob.b_invite, _ob.r) || '/' ||
+          (select count(*) from _req r where r.who = 'R' and r.board_id = _ob.b_invite)::text from _ob),
+  'joined/0',
+  'OB-L17: an invite-only join (R is joined) is NOT returned as a request');
+select is(
+  (select (r.board_name = 'ONB Approve' and r.expires_at = r.requested_at + interval '30 days')::text
+     from _req r, _ob where r.who = 'R' and r.board_id = _ob.b_approve),
+  'true', 'OB-L18: a row carries the board name and expires_at = requested_at + join_request_ttl_days');
+select is(
+  (select string_agg(board_slug || '=' || membership_state, ',' order by board_slug) from _req where who = 'X'),
+  'onb-approve=requested,onb-other=requested',
+  'OB-L19: X sees only its own requests, with its own state on the shared board');
+
+select pg_temp.claims((select h_user::text from _ob));
+select lives_ok($$ insert into _req select 'H', * from agent_board.list_my_board_requests() $$,
+  'OB-L20: the Portal human session lists [call succeeds]');
+select is((select string_agg(board_slug || '=' || membership_state, ',') from _req where who = 'H'),
+  'onb-human=requested',
+  'OB-L21: a Portal human session sees its fed-human agent''s request');
+
+select pg_temp.service();
+select lives_ok($$ insert into _req select 'S', * from agent_board.list_my_board_requests() $$,
+  'OB-L22: a session with no caller identity calls the function [call succeeds]');
+select is((select count(*)::int from _req where who = 'S'),
+  0, 'OB-L23: a session with no caller identity lists nothing');
+
+-- ===========================================================================
+-- invite_board_for_display: catalog posture
+-- ===========================================================================
+select ok(to_regprocedure('agent_board.invite_board_for_display(text)') is not null,
+  'OB-I01: invite_board_for_display(text) exists');
+select is(
+  (select count(*)::int from pg_indexes
+    where schemaname = 'agent_board' and tablename = 'board_invite_tokens'
+      and indexname = 'idx_agent_board_board_invite_tokens_code_sha256'
+      and indexdef like '%digest(code, ''sha256''%'),
+  1, 'OB-I02: board_invite_tokens has the functional digest index');
+
+-- ===========================================================================
+-- Real operations on the links board
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000001');
+do $$ begin perform agent_board.revoke_invite_link((select code_revoked from _ob)); end $$;
+select pg_temp.service();
+-- AGE fixture: a code minted by create_invite_link is moved past its expiry.
+update agent_board.board_invite_tokens t set expires_at = now() - interval '1 second'
+  from _ob where t.code = _ob.code_expired;
+
+select lives_ok($$ insert into _disp select 'exhaust-before', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob))) $$,
+  'OB-I03: the capped code is looked up before its last use [call succeeds]');
+
+-- Y spends the capped code's only use.
+select pg_temp.claims('0b000000-0000-0000-0000-000000000004');
+do $$ begin perform agent_board.redeem_invite_link((select code_exhaust from _ob)); end $$;
+select pg_temp.service();
+
+select lives_ok($$
+  insert into _disp select 'live', * from agent_board.invite_board_for_display(pg_temp.sha((select code_live from _ob)));
+  insert into _disp select 'live-upper', * from agent_board.invite_board_for_display(upper(pg_temp.sha((select code_live from _ob))));
+  insert into _disp select 'revoked', * from agent_board.invite_board_for_display(pg_temp.sha((select code_revoked from _ob)));
+  insert into _disp select 'expired', * from agent_board.invite_board_for_display(pg_temp.sha((select code_expired from _ob)));
+  insert into _disp select 'exhausted', * from agent_board.invite_board_for_display(pg_temp.sha((select code_exhaust from _ob)));
+  insert into _disp select 'unknown', * from agent_board.invite_board_for_display(pg_temp.sha('onb-no-such-code'));
+$$, 'OB-I03b: every code is looked up [call succeeds]');
+
+select is((select count(*)::int from _disp where label = 'revoked'),
+  0, 'OB-I04: a revoked code returns no row');
+select is((select count(*)::int from _disp where label = 'expired'),
+  0, 'OB-I05: an expired code returns no row');
+select is(
+  (select uses_count::text || '/' || max_uses::text from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_exhaust),
+  '1/1', 'OB-I06: the capped code was exhausted by a real redeem (uses_count = max_uses)');
+select is((select count(*)::int from _disp where label = 'exhausted'),
+  0, 'OB-I07: an exhausted code returns no row');
+select is((select count(*)::int from _disp where label = 'exhaust-before'),
+  1, 'OB-I08: the same code resolved while a use remained (the exhausted check is discriminating)');
+select is((select count(*)::int from _disp where label = 'unknown'),
+  0, 'OB-I09: an unknown digest returns no row');
+select is(
+  (select (d.board_id = _ob.b_links)::text || '/' || d.board_name || '/' || d.board_slug || '/' || d.preset_role
+     from _disp d, _ob where d.label = 'live'),
+  'true/ONB Links/onb-links/member',
+  'OB-I10: a usable code resolves to its board id, name, slug and preset role');
+select is((select count(*)::int from _disp where label = 'live-upper'),
+  1, 'OB-I11: the digest is compared case-insensitively');
+select is(has_function_privilege('service_role', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  true, 'OB-I12: service_role holds EXECUTE on invite_board_for_display');
+select is(has_function_privilege('authenticated', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I13: authenticated holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('anon', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I14: anon holds NO EXECUTE on invite_board_for_display');
+select is(has_function_privilege('public', to_regprocedure('agent_board.invite_board_for_display(text)'), 'EXECUTE'),
+  false, 'OB-I15: PUBLIC holds NO EXECUTE on invite_board_for_display');
+select is(
+  (select p.prosecdef::text || '/' || p.provolatile::text
+     from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'agent_board' and p.proname = 'invite_board_for_display'),
+  'true/s',
+  'OB-I16: invite_board_for_display is SECURITY DEFINER and STABLE');
+
+-- ===========================================================================
+-- Redeem behaviour on the real RPC (EC-ONBOARD-1's pin)
+-- ===========================================================================
+select pg_temp.claims('0b000000-0000-0000-0000-000000000002');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R01: R redeems an unlimited invite [call succeeds]');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_replay from _ob)) $$,
+  'OB-R02: R replays the same invite [call succeeds]');
+select is(
+  (select uses_count from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_replay),
+  1, 'redeem_replay_no_use: replaying the same invite consumes no use');
+select lives_ok($$ select agent_board.redeem_invite_link((select code_other from _ob)) $$,
+  'OB-R03: R, already a member, redeems a different invite [call succeeds]');
+select pg_temp.service();
+select is(
+  (select pg_temp.state(_ob.b_links, _ob.r) || '/' || t.uses_count::text
+     from agent_board.board_invite_tokens t, _ob where t.code = _ob.code_other),
+  'joined/1', 'redeem_other_invite_consumes: redeeming a different invite while already a member consumes one');
+
+select * from finish();
+rollback;