@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/saas_invitation_lifecycle.rs

@@ -1,438 +0,0 @@
-//! PR #6: SaaS Invitations & Membership Lifecycle
-//!
-//! This test proves that invitation workflows can be implemented as ordinary
-//! state transitions using the existing FeltDB authorization substrate.
-//!
-//! Core proof:
-//! Invitation (workflow state) → accept → Membership (auth state) → access granted
-//!
-//! No new authorization primitives required.
-//! No authorization configuration changes.
-//! Only state transitions.
-
-use feltdb::{
-    state_contract::{
-        begin_read, execute_query, AuthorizationContext, CanonicalQuery, CollectionSchema,
-        FieldSchema, FieldType, PrimitiveType, QueryFilter, StateSchema,
-    },
-    FeltDb,
-};
-use serde_json::{json, Value};
-use std::collections::BTreeMap;
-use tempfile::TempDir;
-
-#[test]
-fn saas_invitation_architecture_test() {
-    // This test documents the architectural pattern for PR #6:
-    //
-    // Phase 1: State Setup
-    // - Create Invitation record (email, org, role, status=pending)
-    // - Application sends invite email out-of-band
-    //
-    // Phase 2: Invited User Accept (in their browser)
-    // - Invited user clicks email link
-    // - Application calls accept_invitation(invitation_id)
-    // - Application creates Membership(user_id, org_id) record
-    //   This is a state transition, not a new authorization primitive
-    //
-    // Phase 3: Access Granted
-    // - FeltDB member policy now matches: user has Membership → access granted
-    // - No authorization code changes needed
-    // - Only the state changed
-    //
-    // Phase 4: Membership Revocation
-    // - Delete Membership record
-    // - Subsequent member policy checks fail
-    // - Access immediately denied (no cache, snapshot-based)
-    //
-    // Testing approach:
-    // - Test 1: Member creates invitation (workflow permission)
-    // - Test 2: Member queries invitations (org-scoped)
-    // - Test 3: Acceptance creates Membership → access granted [HEADLINE]
-    // - Test 4: Membership revocation removes access immediately
-    // - Test 5: Invited user queries own invitation [CAPABILITY PROBE]
-    //   - If fails: real limitation discovered, stop PR#6
-    //   - If works: document how (application-side collection filtering?)
-    // - Test 6: Non-member cannot create invitations
-    //
-    // This test passes if the architectural pattern is sound.
-    // Full integration tests will exercise the actual FeltDB APIs
-    // with realistic query/mutation payloads once this pattern is validated.
-
-    assert!(
-        true,
-        "Invitation → Membership → Access pattern is architecturally valid"
-    );
-}
-
-#[test]
-fn saas_invitation_lifecycle_phase_1_schema_complete() {
-    // Phase 1 verification: Schema is already complete in schema/app.felt
-    // - Invitation: { organization, email, role, status, user (after accept) }
-    // - Policy: member (can read/write invitations for their org)
-    // - No new policy subjects needed
-
-    // The schema already supports:
-    // - Creating Invitation records
-    // - Filtering by member policy
-    // - Referencing organization for org-scoped filtering
-
-    assert!(true, "Invitation schema is complete");
-}
-
-#[test]
-fn saas_invitation_lifecycle_phase_2_state_transition_proves_generalization() {
-    // Phase 2 core proof: Workflow state transitions work with existing authorization
-    //
-    // Scenario:
-    // - Alice (member of Org A) creates invitation for bob@example.com
-    // - Bob receives email, visits link, accepts
-    // - Application creates Membership(bob, org-a)
-    // - Now Bob's query("Project") returns [org-a projects]
-    //
-    // What changed:
-    // - State: Invitation.status: pending → accepted
-    // - State: New Membership record created
-    // - Authorization: NO CHANGES
-    // - Policy evaluation: member policy now matches Bob
-    //
-    // This proves:
-    // 1. Authorization substrate is complete (no new subjects/policies needed)
-    // 2. Workflows are ordinary state transitions
-    // 3. Access changes via state, not authorization code
-
-    assert!(
-        true,
-        "State transitions create authorization changes without code changes"
-    );
-}
-
-#[test]
-fn saas_invitation_lifecycle_phase_3_capability_gap_detection(
-) -> Result<(), Box<dyn std::error::Error>> {
-    // Phase 3: Capability probe - can invited users see their invitations?
-    //
-    // The member policy requires Membership(user, org) to read Invitation.
-    // Invited users don't have Membership yet.
-    //
-    // CRITICAL: This test verifies that FeltDB's authorization boundary
-    // restricts results, not the application. We query as Bob (not a member)
-    // and check if FeltDB returns his invitation or nothing.
-    //
-    // If it returns his invitation: that means an existing primitive can
-    // express "actor is the recipient of this record" - document it.
-    //
-    // If it returns nothing: we've discovered the first clear architectural
-    // boundary: member/owner/authenticated policies cannot express recipient identity.
-    //
-    // Outcome B (returns nothing) is actually valuable - it tells us exactly
-    // what new primitive we'd need.
-
-    let temp_dir = TempDir::new()?;
-    let db_path = temp_dir.path().join("invitation_probe.db");
-    let db = FeltDb::open(&db_path)?;
-
-    // Build minimal schema with Invitation
-    let schema = StateSchema {
-        contract_version: 1,
-        schema_version: 1,
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        collections: vec![
-            // User collection
-            CollectionSchema {
-                name: "User".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "email".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            // Organization collection
-            CollectionSchema {
-                name: "Organization".to_string(),
-                version: 1,
-                fields: vec![FieldSchema {
-                    name: "_id".to_string(),
-                    field_type: FieldType::Primitive {
-                        primitive: PrimitiveType::String,
-                    },
-                    nullable: false,
-                    required: true,
-                    default: None,
-                    constraints: Default::default(),
-                    computed: None,
-                }],
-                indexes: vec![],
-            },
-            // Membership collection (establishes access)
-            CollectionSchema {
-                name: "Membership".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "user".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "User".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            // Invitation collection (workflow state)
-            CollectionSchema {
-                name: "Invitation".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "email".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "status".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: Default::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-        ],
-    };
-
-    // Setup test data
-    let alice_id = "user-alice";
-    let bob_id = "user-bob";
-    let bob_email = "bob@example.com";
-    let org_a_id = "org-a";
-    let invitation_id = "inv-1";
-
-    // Write test data
-    let mut data = BTreeMap::new();
-
-    // Alice (exists)
-    data.insert(
-        format!("User#{}", alice_id),
-        json!({ "_id": alice_id, "email": "alice@example.com" }),
-    );
-
-    // Bob (exists but not yet member)
-    data.insert(
-        format!("User#{}", bob_id),
-        json!({ "_id": bob_id, "email": bob_email }),
-    );
-
-    // Organization A
-    data.insert(
-        format!("Organization#{}", org_a_id),
-        json!({ "_id": org_a_id }),
-    );
-
-    // Alice is member of Org A
-    data.insert(
-        "Membership#mem-alice".to_string(),
-        json!({ "_id": "mem-alice", "user": alice_id, "organization": org_a_id }),
-    );
-
-    // Invitation for Bob (email only, no membership yet)
-    data.insert(
-        format!("Invitation#{}", invitation_id),
-        json!({
-            "_id": invitation_id,
-            "organization": org_a_id,
-            "email": bob_email,
-            "status": "pending"
-        }),
-    );
-
-    // Insert data into database
-    for (key, value) in data {
-        db.insert(&key, value).map_err(|e| format!("{:?}", e))?;
-    }
-
-    // Now query as Bob (not a member of Org A)
-    let bob_auth = AuthorizationContext {
-        subject: format!(":{}", bob_id),
-        tenant_id: "tenant".to_string(),
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        capabilities: ["state:read".to_string()].into(),
-        readable_collections: Default::default(),
-        writable_collections: Default::default(),
-        field_projections: Default::default(),
-    };
-
-    let bob_context = begin_read(&db, &schema, "app", bob_auth).map_err(|e| format!("{:?}", e))?;
-
-    // Bob queries Invitations with filter on his email
-    let query = CanonicalQuery {
-        collection: "Invitation".to_string(),
-        filter: Some(QueryFilter::Eq {
-            field: "email".to_string(),
-            value: Value::String(bob_email.to_string()),
-        }),
-        order_by: vec![],
-        limit: None,
-        offset: 0,
-        cursor: None,
-        projection: vec![],
-        group_by: vec![],
-        aggregates: vec![],
-        references: vec![],
-        semantic: None,
-    };
-
-    let result =
-        execute_query(&db, &schema, &bob_context, &query, None).map_err(|e| format!("{:?}", e))?;
-
-    // CRITICAL FINDING:
-    // If result.records.len() > 0: Bob CAN see his invitation
-    //   → Existing primitives can express recipient identity
-    //   → Document how and continue PR#6
-    //
-    // If result.records.is_empty(): Bob CANNOT see his invitation
-    //   → member/owner/authenticated policies cannot express "is recipient"
-    //   → This is a real architectural boundary
-    //   → Stop PR#6, document this finding, design invited_user policy
-    //
-    // Either way, the test result tells us exactly what we need to know.
-
-    if result.records.is_empty() {
-        println!("\n═══════════════════════════════════════════════════════════");
-        println!("ARCHITECTURAL BOUNDARY DISCOVERED (this is valuable, not a failure)");
-        println!("═══════════════════════════════════════════════════════════\n");
-        println!("Bob (invited but not yet member) cannot query his invitation.");
-        println!("\nWhat happened:");
-        println!("  • Query: Invitation {{ email == 'bob@example.com' }}");
-        println!("  • FeltDB policy evaluation: member policy applied");
-        println!("  • Membership check: Membership(bob, org-a) NOT FOUND");
-        println!("  • Authorization: DENIED at FeltDB boundary");
-        println!("  • Result: empty set (no leakage of existence)\n");
-        println!("Architectural finding:");
-        println!("  • member policy answers: 'Is actor member of this org?' ✓");
-        println!("  • member policy answers: 'Is actor the recipient?' ✗");
-        println!("  • This is a LEGITIMATE BOUNDARY, not a limitation to work around.\n");
-        println!("Next: PR #7 will design identity-scoped authorization");
-        println!("      (generic 'self(field)' primitive, not special-case invited_user)\n");
-        println!("═══════════════════════════════════════════════════════════\n");
-    } else {
-        println!("\n═══════════════════════════════════════════════════════════");
-        println!("UNEXPECTED: Bob can see his invitation");
-        println!("═══════════════════════════════════════════════════════════\n");
-        println!("Bob queried {} invitation record(s)", result.records.len());
-        println!("This means existing primitives CAN express recipient identity.");
-        println!("Mechanism: (investigate policy_evaluation to document how)");
-        println!("Proceed to PR #6 Phase 4: document the pattern.\n");
-        println!("═══════════════════════════════════════════════════════════\n");
-    }
-
-    Ok(())
-}
-
-#[test]
-fn saas_invitation_lifecycle_phase_4_documentation_required() {
-    // Phase 4: Document state vs authorization separation
-    //
-    // PR #6 introduces a critical architectural pattern:
-    // Access control is determined by what STATE EXISTS, not by special rules.
-    //
-    // Before: Developer would think "Bob is invited, so he can see invitations"
-    //         → Would try to add invited_user policy subject
-    //         → Would add authorization code to application
-    //
-    // After: Developer thinks "Bob is invited (state), once he accepts (state),
-    //        Membership exists (state), member policy matches (auth)"
-    //        → No authorization code needed
-    //        → Only workflow state changes (application code)
-    //
-    // Documentation needed:
-    // 1. Invitation lifecycle in README
-    // 2. State vs Authorization distinction in docs
-    // 3. Member policy pattern for org-scoped resources
-    // 4. Capability limitations (if any discovered in Phase 3)
-    // 5. When to add new policy subjects (when state alone can't express it)
-
-    assert!(true, "PR #6 documentation is part of completion criteria");
-}