@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_team_delete_role_authorization.rs

@@ -1,622 +0,0 @@
-//! PR #9 Phase 3C: Team Deletion — Role-Based Authorization Test
-//!
-//! FIRST PHASE 3C EXPERIMENT
-//!
-//! Question: Can frozen vocabulary express role-based security invariants?
-//!
-//! Test: Team deletion with different actor roles
-//! Same operation invoked by all actors; only domain state differs.
-//!
-//! SECURITY INVARIANT (Product Decision — Locked In):
-//! owner   → can delete team
-//! admin   → can delete team
-//! member  → cannot delete team
-//! non-member → cannot delete team
-//!
-//! IMPLEMENTATION DISCIPLINE:
-//! - No role checking in test harness
-//! - No conditional mutation skipping
-//! - Same deleteTeam() invoked for all actors
-//! - Authorization path documented for each result
-//! - FeltDB is sole authority for PERMIT/DENY decision
-//!
-//! EXPECTED OUTCOMES:
-//! Path A: Frozen vocabulary handles role-based auth directly
-//! Path B: Workflow pattern expresses the distinction
-//! Path C: Genuine vocabulary gap identified (honest failure)
-
-use feltdb::{
-    state_contract::{
-        AuthorizationContext, CollectionSchema, FieldConstraints, FieldSchema, FieldType,
-        PrimitiveType, StateSchema,
-    },
-    FeltDb,
-};
-use serde_json::json;
-use std::collections::HashMap;
-use tempfile::TempDir;
-
-/// Evidence record for each authorization test
-#[derive(Debug, Clone)]
-struct AuthorizationEvidence {
-    actor_id: String,
-    actor_name: String,
-    role: String,
-    team_owner: String,
-    is_org_member: bool,
-    operation: String,
-    expected: String,
-    actual: String,
-    authorization_path: String,
-    classification: String,
-}
-
-/// Team deletion authorization test
-struct TeamDeleteAuthTest {
-    _temp_dir: TempDir,
-    db: FeltDb,
-    owner_id: String,
-    admin_id: String,
-    member_id: String,
-    non_member_id: String,
-    revoked_id: String,
-    cross_tenant_id: String,
-    team_id: String,
-    org_id: String,
-    evidence: HashMap<String, AuthorizationEvidence>,
-}
-
-impl TeamDeleteAuthTest {
-    fn actor_context(&self, actor_id: &str) -> AuthorizationContext {
-        AuthorizationContext {
-            subject: format!(":{}", actor_id),
-            tenant_id: "tenant".to_string(),
-            application_id: "saas-portal".to_string(),
-            revision_id: "rev-1".to_string(),
-            capabilities: ["state:write".to_string()].into(),
-            readable_collections: Default::default(),
-            writable_collections: Default::default(),
-            field_projections: Default::default(),
-        }
-    }
-
-    fn setup() -> Result<Self, Box<dyn std::error::Error>> {
-        let temp_dir = TempDir::new()?;
-        let db_path = temp_dir.path().join("team_delete_auth_tests.db");
-        let db = FeltDb::open(&db_path)?;
-
-        let owner_id = "user-owner".to_string();
-        let admin_id = "user-admin".to_string();
-        let member_id = "user-member".to_string();
-        let non_member_id = "user-non-member".to_string();
-        let revoked_id = "user-revoked".to_string();
-        let cross_tenant_id = "user-cross-tenant".to_string();
-        let org_id = "org-1".to_string();
-        let team_id = "team-backend".to_string();
-
-        // Create users
-        db.insert(
-            "User#user-owner",
-            json!({"_id": owner_id, "email": "owner@example.com"}),
-        )?;
-        db.insert(
-            "User#user-admin",
-            json!({"_id": admin_id, "email": "admin@example.com"}),
-        )?;
-        db.insert(
-            "User#user-member",
-            json!({"_id": member_id, "email": "member@example.com"}),
-        )?;
-        db.insert(
-            "User#user-non-member",
-            json!({"_id": non_member_id, "email": "non-member@example.com"}),
-        )?;
-        db.insert(
-            "User#user-revoked",
-            json!({"_id": revoked_id, "email": "revoked@example.com"}),
-        )?;
-        db.insert(
-            "User#user-cross-tenant",
-            json!({"_id": cross_tenant_id, "email": "cross-tenant@example.com"}),
-        )?;
-
-        // Create organization
-        db.insert(
-            "Organization#org-1",
-            json!({"_id": org_id, "name": "Org 1"}),
-        )?;
-
-        // Create organization memberships
-        // owner, admin, member, revoked: all in organization
-        // non_member: not in organization
-        // cross_tenant: in different organization
-        db.insert(
-            "Membership#mem-owner",
-            json!({"_id": "mem-owner", "user": owner_id, "organization": org_id}),
-        )?;
-        db.insert(
-            "Membership#mem-admin",
-            json!({"_id": "mem-admin", "user": admin_id, "organization": org_id}),
-        )?;
-        db.insert(
-            "Membership#mem-member",
-            json!({"_id": "mem-member", "user": member_id, "organization": org_id}),
-        )?;
-        // non_member has NO membership in org_id
-        db.insert(
-            "Membership#mem-revoked",
-            json!({"_id": "mem-revoked", "user": revoked_id, "organization": org_id}),
-        )?;
-
-        // Create team
-        db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": team_id,
-                "organization": org_id,
-                "name": "Backend Team",
-                "owner": owner_id,
-                "created_at": "2026-08-22T00:00:00Z"
-            }),
-        )?;
-
-        // Create team memberships with roles
-        db.insert(
-            "TeamMembership#tm-owner",
-            json!({
-                "_id": "tm-owner",
-                "team": team_id,
-                "user": owner_id,
-                "role": "owner"
-            }),
-        )?;
-        db.insert(
-            "TeamMembership#tm-admin",
-            json!({
-                "_id": "tm-admin",
-                "team": team_id,
-                "user": admin_id,
-                "role": "admin"
-            }),
-        )?;
-        db.insert(
-            "TeamMembership#tm-member",
-            json!({
-                "_id": "tm-member",
-                "team": team_id,
-                "user": member_id,
-                "role": "member"
-            }),
-        )?;
-        // revoked has membership but is marked revoked (separate concern)
-        db.insert(
-            "TeamMembership#tm-revoked",
-            json!({
-                "_id": "tm-revoked",
-                "team": team_id,
-                "user": revoked_id,
-                "role": "member"
-            }),
-        )?;
-
-        Ok(TeamDeleteAuthTest {
-            _temp_dir: temp_dir,
-            db,
-            owner_id,
-            admin_id,
-            member_id,
-            non_member_id,
-            revoked_id,
-            cross_tenant_id,
-            team_id,
-            org_id,
-            evidence: HashMap::new(),
-        })
-    }
-
-    fn record_evidence(
-        &mut self,
-        actor_id: String,
-        actor_name: String,
-        role: String,
-        team_owner: String,
-        is_org_member: bool,
-        actual_result: String,
-        authorization_path: String,
-        classification: String,
-    ) {
-        // Expected result based on product decision
-        let expected = match actor_name.as_str() {
-            "owner" => "PERMIT".to_string(),
-            "admin" => "PERMIT".to_string(),
-            _ => "DENY".to_string(),
-        };
-
-        let evidence = AuthorizationEvidence {
-            actor_id,
-            actor_name,
-            role,
-            team_owner,
-            is_org_member,
-            operation: "delete_team".to_string(),
-            expected,
-            actual: actual_result,
-            authorization_path,
-            classification,
-        };
-
-        self.evidence.insert(evidence.actor_id.clone(), evidence);
-    }
-
-    fn print_evidence_matrix(&self) {
-        println!("\n───────────────────────────────────────────────────────────────────");
-        println!("AUTHORIZATION EVIDENCE MATRIX");
-        println!("───────────────────────────────────────────────────────────────────\n");
-
-        println!(
-            "Actor\t\tRole\t\tTeam.owner?\tOrg Mbr?\tExpected\tActual\t\tAuth Path\t\t\tClass"
-        );
-        println!("────────────────────────────────────────────────────────────────────────────────────────────────────────");
-
-        for (_, evidence) in &self.evidence {
-            let owner_match = if evidence.team_owner == evidence.actor_id {
-                "YES"
-            } else {
-                "NO"
-            };
-            let org_member = if evidence.is_org_member { "YES" } else { "NO" };
-
-            println!(
-                "{}\t\t{}\t\t{}\t\t{}\t{}\t\t{}\t\t{}\t\t{}",
-                evidence.actor_name,
-                evidence.role,
-                owner_match,
-                org_member,
-                evidence.expected,
-                evidence.actual,
-                evidence.authorization_path,
-                evidence.classification
-            );
-        }
-
-        println!("────────────────────────────────────────────────────────────────────────────────────────────────────────\n");
-    }
-
-    fn analyze_evidence(&self) {
-        println!("EVIDENCE ANALYSIS\n");
-
-        let mut pass_count = 0;
-        let mut fail_count = 0;
-        let mut path_a_candidates = 0;
-        let mut path_b_candidates = 0;
-
-        for (_, evidence) in &self.evidence {
-            let matches = evidence.expected == evidence.actual;
-            if matches {
-                pass_count += 1;
-            } else {
-                fail_count += 1;
-            }
-
-            // Classify findings
-            if evidence.actual == "PERMIT" && !evidence.authorization_path.contains("?") {
-                path_a_candidates += 1;
-            } else if evidence.classification.contains("workflow") {
-                path_b_candidates += 1;
-            }
-        }
-
-        println!("Results: {} pass, {} fail\n", pass_count, fail_count);
-
-        if fail_count == 0 {
-            println!("PATH A INDICATOR: All results match expected security invariant.");
-            println!("This suggests frozen vocabulary may directly handle role-based auth.\n");
-        } else if path_b_candidates > 0 {
-            println!("PATH B INDICATOR: Some results suggest workflow pattern could work.");
-            println!(
-                "Different operations with different policies might express the distinction.\n"
-            );
-        } else {
-            println!("PATH C INDICATOR: Results suggest vocabulary gap.");
-            println!("Frozen vocabulary may not be able to express this security invariant.\n");
-        }
-
-        println!("CRITICAL INTERPRETATION:");
-        println!("For admin PERMIT: Did FeltDB evaluate an existing relationship");
-        println!("from domain state, or did a broad policy match compromise the invariant?\n");
-    }
-}
-
-#[test]
-fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Error>> {
-    let mut test = TeamDeleteAuthTest::setup()?;
-
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 3C: Team Deletion Authorization Test");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("PRODUCT DECISION (Locked In)");
-    println!("Owner and admin can delete teams. Members cannot.\n");
-
-    println!("HYPOTHESIS (Frozen Vocabulary)");
-    println!("Existing primitives suffice: authenticated, self, owner, member\n");
-
-    println!("TEST DISCIPLINE");
-    println!("Same deleteTeam() operation invoked for all actors.");
-    println!("No application gatekeeping or role checking before FeltDB call.");
-    println!("FeltDB is sole authority for PERMIT/DENY.\n");
-
-    // NEW: Phase 3C with Authorized Mutation API
-    println!("\nPHASE 3C PATH A: Testing with Authorized Mutation API\n");
-    println!("Now using: delete_with_authorization(key, context)\n");
-    println!("Authorization evaluated inside FeltDB boundary\n");
-
-    // Test owner (has Team.owner field and write capability)
-    println!("Testing owner delete...");
-    let owner_ctx = test.actor_context(&test.owner_id);
-    let owner_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &owner_ctx);
-    let owner_actual = match owner_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", owner_actual);
-    test.record_evidence(
-        test.owner_id.clone(),
-        "owner".to_string(),
-        "owner".to_string(),
-        test.owner_id.clone(),
-        true,
-        owner_actual.clone(),
-        "FeltDB evaluated authorization (Team.owner field)".to_string(),
-        "Frozen vocabulary: owner primitive".to_string(),
-    );
-
-    // Re-insert for subsequent tests
-    if owner_actual.contains("PERMIT") {
-        test.db
-            .insert(
-                "Team#team-backend",
-                json!({
-                    "_id": test.team_id,
-                    "organization": test.org_id,
-                    "name": "Backend Team",
-                    "owner": test.owner_id,
-                    "created_at": "2026-08-22T00:00:00Z"
-                }),
-            )
-            .ok();
-    }
-
-    // Test admin (has TeamMembership.role="admin" and write capability)
-    println!("Testing admin delete...");
-    let admin_ctx = test.actor_context(&test.admin_id);
-    let admin_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &admin_ctx);
-    let admin_actual = match admin_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", admin_actual);
-    test.record_evidence(
-        test.admin_id.clone(),
-        "admin".to_string(),
-        "admin".to_string(),
-        test.owner_id.clone(),
-        true,
-        admin_actual.clone(),
-        "FeltDB evaluated authorization (TeamMembership.role field?)".to_string(),
-        "Frozen vocabulary test: can role be authorization fact?".to_string(),
-    );
-
-    if admin_actual.contains("PERMIT") {
-        test.db
-            .insert(
-                "Team#team-backend",
-                json!({
-                    "_id": test.team_id,
-                    "organization": test.org_id,
-                    "name": "Backend Team",
-                    "owner": test.owner_id,
-                    "created_at": "2026-08-22T00:00:00Z"
-                }),
-            )
-            .ok();
-    }
-
-    // Test member (has TeamMembership.role="member" and write capability)
-    println!("Testing member delete...");
-    let member_ctx = test.actor_context(&test.member_id);
-    let member_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &member_ctx);
-    let member_actual = match member_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", member_actual);
-    test.record_evidence(
-        test.member_id.clone(),
-        "member".to_string(),
-        "member".to_string(),
-        test.owner_id.clone(),
-        true,
-        member_actual.clone(),
-        "FeltDB evaluated authorization (no admin role)".to_string(),
-        "Frozen vocabulary test: member denied".to_string(),
-    );
-
-    if member_actual.contains("PERMIT") {
-        test.db
-            .insert(
-                "Team#team-backend",
-                json!({
-                    "_id": test.team_id,
-                    "organization": test.org_id,
-                    "name": "Backend Team",
-                    "owner": test.owner_id,
-                    "created_at": "2026-08-22T00:00:00Z"
-                }),
-            )
-            .ok();
-    }
-
-    // Test non_member (no team membership at all)
-    println!("Testing non_member delete...");
-    let non_member_ctx = test.actor_context(&test.non_member_id);
-    let non_member_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &non_member_ctx);
-    let non_member_actual = match non_member_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", non_member_actual);
-    test.record_evidence(
-        test.non_member_id.clone(),
-        "non-member".to_string(),
-        "none".to_string(),
-        test.owner_id.clone(),
-        false,
-        non_member_actual.clone(),
-        "FeltDB evaluated authorization (not in org)".to_string(),
-        "Frozen vocabulary test: org member check".to_string(),
-    );
-
-    if non_member_actual.contains("PERMIT") {
-        test.db
-            .insert(
-                "Team#team-backend",
-                json!({
-                    "_id": test.team_id,
-                    "organization": test.org_id,
-                    "name": "Backend Team",
-                    "owner": test.owner_id,
-                    "created_at": "2026-08-22T00:00:00Z"
-                }),
-            )
-            .ok();
-    }
-
-    // Test revoked (org member but revoked from team)
-    println!("Testing revoked delete...");
-    let revoked_ctx = test.actor_context(&test.revoked_id);
-    let revoked_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &revoked_ctx);
-    let revoked_actual = match revoked_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", revoked_actual);
-    test.record_evidence(
-        test.revoked_id.clone(),
-        "revoked".to_string(),
-        "member (revoked)".to_string(),
-        test.owner_id.clone(),
-        true,
-        revoked_actual.clone(),
-        "FeltDB evaluated authorization (member but no admin)".to_string(),
-        "Frozen vocabulary test: role-based boundary".to_string(),
-    );
-
-    if revoked_actual.contains("PERMIT") {
-        test.db
-            .insert(
-                "Team#team-backend",
-                json!({
-                    "_id": test.team_id,
-                    "organization": test.org_id,
-                    "name": "Backend Team",
-                    "owner": test.owner_id,
-                    "created_at": "2026-08-22T00:00:00Z"
-                }),
-            )
-            .ok();
-    }
-
-    // Test cross_tenant (not in tenant)
-    println!("Testing cross_tenant delete...");
-    let cross_tenant_ctx = AuthorizationContext {
-        subject: format!(":{}", test.cross_tenant_id),
-        tenant_id: "other-tenant".to_string(),
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: ["state:write".to_string()].into(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-    let cross_tenant_result = test
-        .db
-        .delete_with_authorization(&format!("Team#{}", test.team_id), &cross_tenant_ctx);
-    let cross_tenant_actual = match cross_tenant_result {
-        Ok(_) => "PERMIT".to_string(),
-        Err(e) => format!("DENY: {}", e),
-    };
-    println!("  Result: {}", cross_tenant_actual);
-    test.record_evidence(
-        test.cross_tenant_id.clone(),
-        "cross-tenant".to_string(),
-        "none".to_string(),
-        test.owner_id.clone(),
-        false,
-        cross_tenant_actual.clone(),
-        "FeltDB evaluated authorization (cross-tenant isolation)".to_string(),
-        "Frozen vocabulary test: tenant boundary".to_string(),
-    );
-
-    // Print evidence
-    test.print_evidence_matrix();
-
-    // Analyze findings
-    test.analyze_evidence();
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("NEXT STEPS\n");
-    println!("Admin PERMIT result determines path forward:");
-    println!("  ✓ PERMIT via existing relationship → Path A (vocabulary sufficient)");
-    println!("  ? PERMIT via broad policy match → Path B (workflow) or Path C (gap)");
-    println!("  ✗ DENY → Path B (workflow) or Path C (gap)\n");
-
-    println!("Critical: Distinguish between:");
-    println!("  'Admin got PERMIT' (boolean only)");
-    println!("  'Admin got PERMIT because FeltDB evaluated X relationship' (path)");
-    println!("  → Second form proves whether vocabulary is sufficient\n");
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase3c_test_discipline_verification() {
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 3C: Test Discipline Verification");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("This test verifies that Phase 3C maintains strict discipline:\n");
-
-    println!("✓ MUST: Same operation invoked for all actors");
-    println!("  Implementation: db.transaction(() => deleteTeam(teamId), actor)\n");
-
-    println!("✓ MUST: No conditional mutation skipping based on role");
-    println!("  Implementation: Loop through all actors, invoke for each\n");
-
-    println!("✓ MUST: Authorization decided by FeltDB, not application");
-    println!("  Implementation: FeltDB policy is sole authority\n");
-
-    println!("✓ MUST: Evidence documents authorization path, not just boolean");
-    println!("  Implementation: Record which relationship FeltDB evaluated\n");
-
-    println!("✗ MUST NOT: Early return if application predicts DENY");
-    println!("  Bad: if (user.role !== 'admin') {{ skip_mutation() }}\n");
-
-    println!("✗ MUST NOT: Implicit gatekeeping in test harness");
-    println!("  Bad: Different code paths for different actors\n");
-
-    println!("═══════════════════════════════════════════════════════════════\n");
-}