@consiliency/agent-board-schema 1.7.0 → 1.10.0

package/tests/agent_board_roomuiapi.test.sql

@@ -0,0 +1,225 @@
+-- ROOMUIAPI pgTAP: owner/admin-gated list_board_pending_memberships reader +
+-- SECURITY INVOKER resolve_agent_handle resolver.
+--
+-- Runs as the postgres db role; request.jwt.claim.role toggles _is_service_role()
+-- ('authenticated' => false) and request.jwt.claim.sub picks the acting agent.
+-- Fixture style mirrors agent_board_roomdeleg.test.sql (ensure_github_user,
+-- set_config role/sub, suspended-agent-as-null-actor trick).
+--
+-- Pending fixture rows (requested/invited/admin/board-B/dedup/demote-leave) are
+-- seeded by DIRECT INSERT into board_memberships (runs as postgres, bypassing RLS +
+-- the owner-gate coupling of request_join_board/invite_board_member). The owner
+-- membership comes from create_board's ROOMOWN seed.
+--
+-- HAND-COUNTED plan: R1,R2,R3,R4,R5,R6,R7,R8,U-4,H1,H2,H3 = 12 assertions, one each.
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(12);
+
+create temp table _roomuiapi_fixture (
+  board_a uuid,
+  board_b uuid,
+  alice uuid,            -- creator, seeded owner of board A (and B)
+  admin uuid,            -- role 'admin' on board A
+  plainmember uuid,      -- role 'member', joined on board A (PRIVACY CRUX actor)
+  nomember uuid,         -- active agent, no membership on board A
+  suspended uuid,        -- suspended agent WITH a valid auth user (null actor)
+  demoteleave uuid,      -- current row role=member/state=left (U-4 gate reject)
+  requester uuid,        -- pending 'requested' on board A
+  invitee uuid,          -- pending 'invited' on board A
+  dedup uuid,            -- older 'requested' + newer 'joined' (R8: not returned)
+  boardb_requester uuid, -- pending 'requested' on board B (R7 isolation)
+  requester_handle text,
+  suspended_handle text,
+  alice_user uuid,
+  admin_user uuid,
+  plainmember_user uuid,
+  nomember_user uuid,
+  suspended_user uuid,
+  demoteleave_user uuid
+) on commit drop;
+
+do $$
+declare
+  v_suffix text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_alice_user uuid;
+  v_admin_user uuid;
+  v_plainmember_user uuid;
+  v_nomember_user uuid;
+  v_suspended_user uuid;
+  v_demoteleave_user uuid;
+  v_alice uuid := gen_random_uuid();
+  v_admin uuid := gen_random_uuid();
+  v_plainmember uuid := gen_random_uuid();
+  v_nomember uuid := gen_random_uuid();
+  v_suspended uuid := gen_random_uuid();
+  v_demoteleave uuid := gen_random_uuid();
+  v_requester uuid := gen_random_uuid();
+  v_invitee uuid := gen_random_uuid();
+  v_dedup uuid := gen_random_uuid();
+  v_boardb_requester uuid := gen_random_uuid();
+  v_board_a uuid;
+  v_board_b uuid;
+begin
+  v_alice_user := public.ensure_github_user('ru-alice-' || v_suffix, 'ru-alice-' || v_suffix || '@example.test', 'ru-alice-' || v_suffix, 'RU Alice');
+  v_admin_user := public.ensure_github_user('ru-admin-' || v_suffix, 'ru-admin-' || v_suffix || '@example.test', 'ru-admin-' || v_suffix, 'RU Admin');
+  v_plainmember_user := public.ensure_github_user('ru-member-' || v_suffix, 'ru-member-' || v_suffix || '@example.test', 'ru-member-' || v_suffix, 'RU Member');
+  v_nomember_user := public.ensure_github_user('ru-nomember-' || v_suffix, 'ru-nomember-' || v_suffix || '@example.test', 'ru-nomember-' || v_suffix, 'RU NoMember');
+  v_suspended_user := public.ensure_github_user('ru-susp-' || v_suffix, 'ru-susp-' || v_suffix || '@example.test', 'ru-susp-' || v_suffix, 'RU Suspended');
+  v_demoteleave_user := public.ensure_github_user('ru-demo-' || v_suffix, 'ru-demo-' || v_suffix || '@example.test', 'ru-demo-' || v_suffix, 'RU DemoteLeave');
+
+  insert into agent_board.agents(id, agent_type, handle, display_name, status, auth_user_id, owner_user_id)
+  values
+    (v_alice, 'agent', 'ru-alice-' || v_suffix, 'RU Alice', 'active', v_alice_user, v_alice_user),
+    (v_admin, 'agent', 'ru-admin-' || v_suffix, 'RU Admin', 'active', v_admin_user, v_admin_user),
+    (v_plainmember, 'agent', 'ru-member-' || v_suffix, 'RU Member', 'active', v_plainmember_user, v_plainmember_user),
+    (v_nomember, 'agent', 'ru-nomember-' || v_suffix, 'RU NoMember', 'active', v_nomember_user, v_nomember_user),
+    -- Suspended agent WITH a valid auth user: current_agent_id() filters status='active'
+    -- so it resolves to null while auth.uid() still maps (fail-closed test).
+    (v_suspended, 'agent', 'ru-susp-' || v_suffix, 'RU Suspended', 'suspended', v_suspended_user, v_suspended_user),
+    (v_demoteleave, 'agent', 'ru-demo-' || v_suffix, 'RU DemoteLeave', 'active', v_demoteleave_user, v_demoteleave_user),
+    (v_requester, 'agent', 'ru-requester-' || v_suffix, 'RU Requester', 'active', null, null),
+    (v_invitee, 'agent', 'ru-invitee-' || v_suffix, 'RU Invitee', 'active', null, null),
+    (v_dedup, 'agent', 'ru-dedup-' || v_suffix, 'RU Dedup', 'active', null, null),
+    (v_boardb_requester, 'agent', 'ru-brequester-' || v_suffix, 'RU BRequester', 'active', null, null);
+
+  -- Alice creates both boards (service_role null-actor here -> supplied arg honored);
+  -- create_board seeds Alice's joined owner membership (ROOMOWN) on each.
+  select board_id into v_board_a
+    from agent_board.create_board(v_alice, 'roomuiapi-a-' || v_suffix, 'ROOMUIAPI Board A', 'reader test', '{}'::jsonb, 'private');
+  select board_id into v_board_b
+    from agent_board.create_board(v_alice, 'roomuiapi-b-' || v_suffix, 'ROOMUIAPI Board B', 'isolation', '{}'::jsonb, 'private');
+
+  -- Direct-insert the remaining board A memberships (bypasses RLS + owner-gate).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board_a, v_admin, 'joined', v_alice, 'admin'),
+    (v_board_a, v_plainmember, 'joined', v_alice, 'member'),
+    (v_board_a, v_requester, 'requested', v_requester, 'member'),
+    (v_board_a, v_invitee, 'invited', v_alice, 'member');
+
+  -- U-4: demote-and-leave. Under in-place upsert an agent keeps ONE row; here the
+  -- current row is role=member/state=left, so the plain-exists owner/admin gate must
+  -- reject it (no stale owner/joined row lingers to falsely satisfy exists()).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role, left_at)
+  values
+    (v_board_a, v_demoteleave, 'left', v_alice, 'member', now());
+
+  -- R8 dedup: EXPLICIT distinct created_at (the whole suite runs in one begin; so
+  -- default now() is constant). Older 'requested' + newer 'joined' -> latest row is
+  -- 'joined' -> the reader's distinct-on-latest drops this agent from the pending set.
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role, created_at)
+  values
+    (v_board_a, v_dedup, 'requested', v_dedup, 'member', now() - interval '1 hour'),
+    (v_board_a, v_dedup, 'joined', v_alice, 'member', now());
+
+  -- Board B: its own pending requester (R7 cross-board isolation).
+  insert into agent_board.board_memberships(board_id, agent_id, membership_state, created_by_agent_id, role)
+  values
+    (v_board_b, v_boardb_requester, 'requested', v_boardb_requester, 'member');
+
+  insert into _roomuiapi_fixture values
+    (v_board_a, v_board_b, v_alice, v_admin, v_plainmember, v_nomember, v_suspended,
+     v_demoteleave, v_requester, v_invitee, v_dedup, v_boardb_requester,
+     'ru-requester-' || v_suffix, 'ru-susp-' || v_suffix,
+     v_alice_user, v_admin_user, v_plainmember_user, v_nomember_user, v_suspended_user, v_demoteleave_user);
+end
+$$;
+
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- === list_board_pending_memberships ===============================================
+-- R1: owner (Alice) reads board A -> exactly the 2 pending rows (requested+invited).
+select set_config('request.jwt.claim.sub', (select alice_user from _roomuiapi_fixture)::text, true);
+select is(
+  (select count(*)::int from agent_board.list_board_pending_memberships((select board_a from _roomuiapi_fixture))),
+  2, 'R1: the owner sees exactly the two pending memberships (requested + invited)');
+
+-- R2: admin reads board A -> same 2 pending rows.
+select set_config('request.jwt.claim.sub', (select admin_user from _roomuiapi_fixture)::text, true);
+select is(
+  (select count(*)::int from agent_board.list_board_pending_memberships((select board_a from _roomuiapi_fixture))),
+  2, 'R2: an admin sees the two pending memberships');
+
+-- R3: the owner sees the requester's handle (content, not just count).
+select set_config('request.jwt.claim.sub', (select alice_user from _roomuiapi_fixture)::text, true);
+select is(
+  (select p.handle
+     from agent_board.list_board_pending_memberships((select board_a from _roomuiapi_fixture)) p
+    where p.agent_id = (select requester from _roomuiapi_fixture)),
+  (select requester_handle from _roomuiapi_fixture),
+  'R3: the owner sees the requester''s handle in the pending row');
+
+-- R4: a plain joined member is rejected -> 42501 (PRIVACY CRUX).
+select set_config('request.jwt.claim.sub', (select plainmember_user from _roomuiapi_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.list_board_pending_memberships(%L::uuid)$q$, board_a) from _roomuiapi_fixture),
+  '42501', 'only a board owner or admin may list pending memberships',
+  'R4: a plain joined member cannot enumerate pending memberships');
+
+-- R5: a non-member (unmapped sub) is rejected -> 42501.
+select set_config('request.jwt.claim.sub', gen_random_uuid()::text, true);
+select throws_ok(
+  (select format($q$select agent_board.list_board_pending_memberships(%L::uuid)$q$, board_a) from _roomuiapi_fixture),
+  '42501', 'only a board owner or admin may list pending memberships',
+  'R5: a non-member is rejected');
+
+-- R6: a suspended principal (current_agent_id() null) is rejected -> 42501 (fail-closed).
+select set_config('request.jwt.claim.sub', (select suspended_user from _roomuiapi_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.list_board_pending_memberships(%L::uuid)$q$, board_a) from _roomuiapi_fixture),
+  '42501', 'only a board owner or admin may list pending memberships',
+  'R6: a suspended principal (null actor) is rejected (fail-closed)');
+
+-- R7: owner of A reading board A does NOT see board B's requester (cross-board isolation).
+select set_config('request.jwt.claim.sub', (select alice_user from _roomuiapi_fixture)::text, true);
+select is(
+  (select count(*)::int
+     from agent_board.list_board_pending_memberships((select board_a from _roomuiapi_fixture)) p
+    where p.agent_id = (select boardb_requester from _roomuiapi_fixture)),
+  0, 'R7: board B''s requester is absent from board A''s pending list (cross-board isolation)');
+
+-- R8: the dedup agent (latest row 'joined', older 'requested') is NOT returned.
+select is(
+  (select count(*)::int
+     from agent_board.list_board_pending_memberships((select board_a from _roomuiapi_fixture)) p
+    where p.agent_id = (select dedup from _roomuiapi_fixture)),
+  0, 'R8: an agent whose latest row is joined (older requested) is not returned (dedup)');
+
+-- U-4: demote-and-leave actor (current row role=member/state=left) is rejected -> 42501.
+select set_config('request.jwt.claim.sub', (select demoteleave_user from _roomuiapi_fixture)::text, true);
+select throws_ok(
+  (select format($q$select agent_board.list_board_pending_memberships(%L::uuid)$q$, board_a) from _roomuiapi_fixture),
+  '42501', 'only a board owner or admin may list pending memberships',
+  'U-4: a demoted-and-left actor (latest row member/left) is rejected by the gate');
+
+-- === resolve_agent_handle (SECURITY INVOKER) ======================================
+-- H1: exact active handle -> the agent_id.
+select set_config('request.jwt.claim.sub', (select alice_user from _roomuiapi_fixture)::text, true);
+select is(
+  (select r.agent_id
+     from agent_board.resolve_agent_handle((select requester_handle from _roomuiapi_fixture)) r),
+  (select requester from _roomuiapi_fixture),
+  'H1: the resolver maps an exact active handle to the agent_id');
+
+-- H2: unknown handle -> 0 rows.
+select is(
+  (select count(*)::int
+     from agent_board.resolve_agent_handle('ru-does-not-exist-' || gen_random_uuid()::text)),
+  0, 'H2: an unknown handle resolves to zero rows');
+
+-- H3: a suspended agent's handle -> 0 rows (status='active' filter).
+select is(
+  (select count(*)::int
+     from agent_board.resolve_agent_handle((select suspended_handle from _roomuiapi_fixture))),
+  0, 'H3: a suspended agent''s handle resolves to zero rows (active filter)');
+
+select set_config('request.jwt.claim.role', '', true);
+select set_config('request.jwt.claim.sub', '', true);
+
+select finish();
+
+rollback;