@consiliency/agent-board-schema 1.9.0 → 1.12.0

package/tests/agent_board_gatenull_membstate.test.sql

@@ -0,0 +1,352 @@
+-- GATENULL (#58) + MEMBSTATE (#75) pgTAP.
+--
+-- Proves: (a) an AUTHENTICATED principal with no ACTIVE agent no longer takes the service_role
+-- null-actor bypass on join_board / request_join_board / invite_board_member /
+-- resolve_board_request; (b) update_board_membership — which previously had NO authorization at
+-- all — now refuses another agent's row without owner/admin and refuses self-promotion into a
+-- board; and (c) NO regression for service_role, for an authenticated caller with an ACTIVE agent,
+-- or for legitimate self-service transitions.
+--
+-- HAND-COUNTED plan: 4 metadata/overload + 2 service-path controls + 5 GATENULL/MEMBSTATE
+-- class-2 rejections + 3 MEMBSTATE active-caller rejections + 5 no-regression
+-- + 4 CR-added (kick-laundering, rank superiority, archived-board self-leave, delivery toggle)
+-- + 4 NULLFIX (class-1 private-join blocked, open-join still ok, resolve-without-request blocked,
+--   genuine resolve still ok) = 27 assertions.
+--
+-- CONTROLS (panel requirement): every authenticated block asserts _is_service_role() = false and
+-- every service block asserts true. Without these, a fixture that forgets request.jwt.claim.role
+-- silently runs the SERVICE branch and the "hole closed" assertions pass vacuously.
+-- Uses the house SINGULAR GUCs (request.jwt.claim.sub / .role), per agent_board_roomdeleg.test.sql.
+
+create extension if not exists pgtap with schema extensions;
+set search_path = extensions, public, agent_board;
+
+begin;
+
+select plan(27);
+
+-- ---------------------------------------------------------------------------
+-- Phase 0: exactly one pg_proc row per name (a changed arg list would OVERLOAD, not replace)
+-- ---------------------------------------------------------------------------
+-- 1
+select is((select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'join_board'), 1,
+          'join_board has exactly one overload');
+-- 2
+select is((select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'invite_board_member'), 1,
+          'invite_board_member has exactly one overload');
+-- 3
+select is((select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'resolve_board_request'), 1,
+          'resolve_board_request has exactly one overload');
+-- 4
+select is((select count(*)::int from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+            where n.nspname = 'agent_board' and p.proname = 'update_board_membership'), 1,
+          'update_board_membership has exactly one overload');
+
+-- ---------------------------------------------------------------------------
+-- Fixtures (as postgres == service_role-equivalent)
+-- ---------------------------------------------------------------------------
+create temp table _f (
+  board uuid, owner_agent uuid,
+  c2_uid uuid,                       -- authenticated principal with NO agent row (class 2)
+  atk uuid, atk_uid uuid,            -- ACTIVE authenticated agent, not a member
+  member uuid, member_uid uuid,      -- ACTIVE agent, joined member
+  victim uuid
+) on commit drop;
+grant all on table _f to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_board uuid; v_owner uuid; v_c2 uuid; v_atk uuid; v_atk_uid uuid;
+  v_mem uuid; v_mem_uid uuid; v_victim uuid;
+begin
+  -- NOTE: kind must NOT be 'system' — sync_agent_principal_columns() nulls auth_user_id for
+  -- system agents, so current_agent_id() could never resolve this fixture.
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-owner-' || s, 'Owner', 'active')
+  returning id into v_owner;
+
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('gn-board-' || s, 'GN Board', v_owner, 'invite_only', 'active')
+  returning id into v_board;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_owner, 'owner', 'joined', v_owner);
+
+  -- class 2: an auth user with NO agents row at all
+  v_c2 := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_c2, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-c2-' || s || '@example.test', now(), now());
+
+  -- an ACTIVE agent that is NOT a member of the board
+  v_atk_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_atk_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-atk-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-atk-' || s, 'Atk', 'active', v_atk_uid, v_atk_uid)
+  returning id into v_atk;
+
+  -- an ACTIVE joined member
+  v_mem_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_mem_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-mem-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-mem-' || s, 'Mem', 'active', v_mem_uid, v_mem_uid)
+  returning id into v_mem;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_mem, 'member', 'joined', v_owner);
+
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-vic-' || s, 'Victim', 'active')
+  returning id into v_victim;
+
+  -- victim holds a genuine 'invited' row so the resolve no-regression assertion has a target
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_victim, 'member', 'invited', v_owner);
+
+  insert into _f values (v_board, v_owner, v_c2, v_atk, v_atk_uid, v_mem, v_mem_uid, v_victim);
+end
+$$;
+
+-- 5 — service-path control: as postgres with no claims, the bypass is active.
+select is(agent_board._is_service_role(), true,
+          'CONTROL: bare postgres (no claims) is service_role-equivalent');
+
+-- 6 — no-regression: service_role retains modify-on-behalf-of on update_board_membership.
+select lives_ok(
+  $$ select agent_board.update_board_membership(
+       (select board from _f), (select member from _f), 'subscribed') $$,
+  'NO-REGRESSION: service_role may still modify another agent''s membership');
+
+-- ---------------------------------------------------------------------------
+-- CLASS 2: authenticated principal with NO active agent  (the GATENULL hole)
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select c2_uid::text from _f), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- 7 — control: we really are on the authenticated path (else everything below passes vacuously).
+select is(agent_board._is_service_role(), false,
+          'CONTROL: class-2 principal is NOT service_role');
+-- 8
+select is(agent_board.current_agent_id(), null,
+          'CONTROL: class-2 principal resolves to a NULL actor');
+-- 9
+select throws_ok(
+  $$ select agent_board.join_board((select board from _f), (select victim from _f), 'joined') $$,
+  '42501', null, 'GATENULL: class-2 cannot join_board (was: joined a private board with no invite)');
+-- 10
+select throws_ok(
+  $$ select agent_board.request_join_board((select board from _f), (select victim from _f)) $$,
+  '42501', null, 'GATENULL: class-2 cannot request_join_board on behalf of another agent');
+-- 11
+select throws_ok(
+  $$ select agent_board.invite_board_member((select board from _f), (select victim from _f), (select owner_agent from _f)) $$,
+  '42501', null, 'GATENULL: class-2 cannot invite_board_member');
+-- 12
+select throws_ok(
+  $$ select agent_board.resolve_board_request((select board from _f), (select victim from _f), 'joined', (select owner_agent from _f)) $$,
+  '42501', null, 'GATENULL: class-2 cannot resolve_board_request');
+-- 13
+select throws_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select member from _f), 'removed') $$,
+  '42501', null, 'MEMBSTATE: class-2 cannot update_board_membership');
+
+-- ---------------------------------------------------------------------------
+-- ACTIVE authenticated agent, NOT a board member  (the MEMBSTATE hole — GATENULL cannot help)
+-- ---------------------------------------------------------------------------
+select set_config('request.jwt.claim.sub', (select atk_uid::text from _f), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- 14 — control: an ACTIVE actor resolves, so these prove MEMBSTATE (not GATENULL) is doing the work.
+select isnt(agent_board.current_agent_id(), null,
+            'CONTROL: active non-member resolves to a NON-null actor');
+-- 15
+select throws_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select owner_agent from _f), 'removed') $$,
+  '42501', null, 'MEMBSTATE: active non-member cannot evict the board owner');
+
+-- self-approval chain: create a legitimate 'requested' row, then try to self-promote.
+select lives_ok(
+  $$ select agent_board.request_join_board((select board from _f), (select atk from _f)) $$,
+  'NO-REGRESSION: an active agent may still request to join');            -- 16
+-- 17
+select throws_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select atk from _f), 'joined') $$,
+  '42501', null, 'MEMBSTATE: active agent cannot self-approve requested -> joined');
+-- 18 — self-service withdraw must still work.
+select lives_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select atk from _f), 'left') $$,
+  'NO-REGRESSION: an agent may still leave (self-service transition preserved)');
+
+-- ---------------------------------------------------------------------------
+-- Board OWNER (active, owner membership) — authority must be unchanged
+-- ---------------------------------------------------------------------------
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+-- Give the owner an auth identity so it can act on the authenticated path.
+do $$
+declare v_uid uuid := gen_random_uuid();
+begin
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-own-' || substr(v_uid::text, 1, 8) || '@example.test', now(), now());
+  update agent_board.agents set auth_user_id = v_uid, owner_user_id = v_uid
+   where id = (select owner_agent from _f);
+  perform set_config('request.jwt.claim.sub', v_uid::text, true);
+  perform set_config('request.jwt.claim.role', 'authenticated', true);
+end
+$$;
+
+-- 19
+select lives_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select member from _f), 'removed') $$,
+  'NO-REGRESSION: an active board OWNER may still change another agent''s membership');
+
+
+-- ---------------------------------------------------------------------------
+-- CR-added coverage: kick-laundering, rank superiority, archived board, toggle
+-- ---------------------------------------------------------------------------
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+
+create temp table _f2 (
+  archived_board uuid, admin_agent uuid, admin_uid uuid, kicked uuid, kicked_uid uuid
+) on commit drop;
+grant all on table _f2 to authenticated, service_role;
+
+do $$
+declare
+  s text := replace(substr(gen_random_uuid()::text, 1, 8), '-', '');
+  v_arch uuid; v_admin uuid; v_admin_uid uuid; v_kicked uuid; v_kicked_uid uuid; v_owner uuid; v_board uuid;
+begin
+  select owner_agent, board into v_owner, v_board from _f;
+
+  -- an ARCHIVED board on which a member still holds a joined row
+  insert into agent_board.boards(slug, name, created_by_agent_id, visibility, status)
+  values ('gn-arch-' || s, 'GN Archived', v_owner, 'invite_only', 'archived') returning id into v_arch;
+
+  -- an ADMIN on the main board (lower rank than owner)
+  v_admin_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_admin_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-adm-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-adm-' || s, 'Adm', 'active', v_admin_uid, v_admin_uid)
+  returning id into v_admin;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_board, v_admin, 'admin', 'joined', v_owner);
+  -- the admin also holds a joined row on the archived board (to test self-leave there)
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id)
+  values (v_arch, v_admin, 'member', 'joined', v_owner);
+
+  -- a KICKED agent (membership_state='removed') on the main board
+  v_kicked_uid := gen_random_uuid();
+  insert into auth.users(id, instance_id, aud, role, email, created_at, updated_at)
+  values (v_kicked_uid, '00000000-0000-0000-0000-000000000000', 'authenticated', 'authenticated',
+          'gn-kick-' || s || '@example.test', now(), now());
+  insert into agent_board.agents(agent_type, kind, handle, display_name, status, auth_user_id, owner_user_id)
+  values ('human', 'human'::agent_board.agent_kind, 'gn-kick-' || s, 'Kicked', 'active', v_kicked_uid, v_kicked_uid)
+  returning id into v_kicked;
+  insert into agent_board.board_memberships(board_id, agent_id, role, membership_state, created_by_agent_id, left_at)
+  values (v_board, v_kicked, 'member', 'removed', v_owner, now());
+
+  insert into _f2 values (v_arch, v_admin, v_admin_uid, v_kicked, v_kicked_uid);
+end
+$$;
+
+-- 20 — a KICKED agent must not launder 'removed' into 'left' (would erase the R-LINK-7 marker).
+select set_config('request.jwt.claim.sub', (select kicked_uid::text from _f2), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select throws_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select kicked from _f2), 'left') $$,
+  '42501', null, 'MEMBSTATE: a removed agent cannot self-set left (no kick laundering into invite re-entry)');
+
+-- 21 — an ADMIN must not evict the OWNER (strict rank superiority).
+select set_config('request.jwt.claim.sub', (select admin_uid::text from _f2), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select throws_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select owner_agent from _f), 'removed') $$,
+  '42501', null, 'MEMBSTATE: an admin cannot evict the board owner (rank superiority enforced)');
+
+-- 22 — self delivery-preference toggle joined -> subscribed stays permitted.
+select lives_ok(
+  $$ select agent_board.update_board_membership((select board from _f), (select admin_agent from _f2), 'subscribed') $$,
+  'NO-REGRESSION: an agent may still toggle its own joined -> subscribed delivery preference');
+
+-- 23 — self-leave must still work on an ARCHIVED board (the self branch takes no board lookup,
+-- so leave_board keeps working after a board is archived).
+select lives_ok(
+  $$ select agent_board.update_board_membership((select archived_board from _f2), (select admin_agent from _f2), 'left') $$,
+  'NO-REGRESSION: an agent may still leave an ARCHIVED board (leave_board delegates here)');
+
+
+-- ---------------------------------------------------------------------------
+-- NULLFIX: the CR found the REAL root cause of the private-board join — a NULL-falsy
+-- guard, reachable by an ACTIVE agent (which the GATENULL null-actor guard cannot touch).
+-- These four are the decisive regression tests: 24/26 FAIL without the coalesce() fixes.
+-- ---------------------------------------------------------------------------
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+
+create temp table _f3 (openb uuid, privb uuid, a1 uuid, a1_uid uuid, nopend uuid, owner_uid uuid) on commit drop;
+grant all on table _f3 to authenticated, service_role;
+
+do $$
+declare s text := replace(substr(gen_random_uuid()::text,1,8),'-',''); v_o uuid; v_open uuid; v_priv uuid; v_a uuid; v_uid uuid; v_np uuid; v_ouid uuid;
+begin
+  select owner_agent into v_o from _f;
+  insert into agent_board.boards(slug,name,created_by_agent_id,visibility,status)
+    values('nf-open-'||s,'NF Open',v_o,'open','active') returning id into v_open;
+  insert into agent_board.boards(slug,name,created_by_agent_id,visibility,status)
+    values('nf-priv-'||s,'NF Priv',v_o,'private','active') returning id into v_priv;
+  insert into agent_board.board_memberships(board_id,agent_id,role,membership_state,created_by_agent_id)
+    values(v_priv,v_o,'owner','joined',v_o);
+  v_uid := gen_random_uuid();
+  insert into auth.users(id,instance_id,aud,role,email,created_at,updated_at)
+    values(v_uid,'00000000-0000-0000-0000-000000000000','authenticated','authenticated','nf-'||s||'@example.test',now(),now());
+  insert into agent_board.agents(agent_type,kind,handle,display_name,status,auth_user_id,owner_user_id)
+    values('human','human'::agent_board.agent_kind,'nf-a-'||s,'A1','active',v_uid,v_uid) returning id into v_a;
+  insert into agent_board.agents(agent_type,kind,handle,display_name,status)
+    values('human','human'::agent_board.agent_kind,'nf-np-'||s,'NoPend','active') returning id into v_np;
+  select auth_user_id into v_ouid from agent_board.agents where id = v_o;
+  insert into _f3 values(v_open,v_priv,v_a,v_uid,v_np,v_ouid);
+end
+$$;
+
+select set_config('request.jwt.claim.sub', (select a1_uid::text from _f3), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+
+-- 24 — an ACTIVE agent (actor resolves) must NOT self-join a PRIVATE board.
+select throws_ok(
+  $$ select agent_board.join_board((select privb from _f3), (select a1 from _f3), 'joined') $$,
+  'P0002', null, 'NULLFIX: an ACTIVE agent cannot self-join a private board (NULL-falsy guard closed)');
+-- 25 — joining an OPEN board still works.
+select lives_ok(
+  $$ select agent_board.join_board((select openb from _f3), (select a1 from _f3), 'joined') $$,
+  'NO-REGRESSION: an active agent may still join an OPEN board');
+-- 26 — resolving an agent that never requested/was invited must fail. Runs as the board OWNER on
+-- purpose: as a non-member the authz check would raise 42501 first and the pending-state guard
+-- (the thing NULLFIX actually changed) would never be reached.
+select set_config('request.jwt.claim.sub', (select owner_uid::text from _f3), true);
+select set_config('request.jwt.claim.role', 'authenticated', true);
+select throws_ok(
+  $$ select agent_board.resolve_board_request((select board from _f), (select nopend from _f3), 'joined', (select owner_agent from _f)) $$,
+  'P0002', null, 'NULLFIX: cannot resolve an agent with no pending request straight to joined');
+-- 27 — resolving a GENUINE request still works (service path).
+reset role;
+select set_config('request.jwt.claim.sub', '', true);
+select set_config('request.jwt.claim.role', '', true);
+select lives_ok(
+  $$ select agent_board.resolve_board_request((select board from _f), (select victim from _f), 'joined', (select owner_agent from _f)) $$,
+  'NO-REGRESSION: a genuine invited/requested membership still resolves');
+
+select * from finish();
+rollback;