@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/src/authorization_security_tests.rs

@@ -1,1122 +0,0 @@
-//! Phase 5: Authorization Security & Adversarial Verification
-//!
-//! Comprehensive tests proving the authorization system cannot be bypassed through:
-//! - Caller attribute spoofing
-//! - Cross-organization access
-//! - Query/mutation isolation violations
-//! - Transaction atomicity breaks
-//! - Reference integrity violations
-//! - Membership revocation handling
-//! - Policy interaction vulnerabilities
-
-#[cfg(test)]
-mod security_tests {
-    use crate::*;
-    use serde_json::json;
-    use std::sync::Arc;
-
-    // ============================================================================
-    // Helpers
-    // ============================================================================
-
-    fn make_stored_row(collection: &str, key: &str, value: serde_json::Value) -> StoredRow {
-        StoredRow {
-            capability: format!("tenant:test:{}", collection),
-            key: key.into(),
-            rust_type: "json".into(),
-            value,
-            unix_ms: 0,
-            content_hash: None,
-            flow_ref: None,
-            deleted: false,
-            operation: None,
-        }
-    }
-
-    fn make_schema_with_collections(
-        collections: Vec<state_contract::CollectionSchema>,
-    ) -> Arc<state_contract::StateSchema> {
-        Arc::new(state_contract::StateSchema {
-            contract_version: 1,
-            schema_version: 1,
-            application_id: "app".into(),
-            revision_id: "rev".into(),
-            collections,
-        })
-    }
-
-    fn make_collection(
-        name: &str,
-        fields: Vec<state_contract::FieldSchema>,
-    ) -> state_contract::CollectionSchema {
-        state_contract::CollectionSchema {
-            name: name.into(),
-            version: 1,
-            fields,
-            indexes: vec![],
-        }
-    }
-
-    fn make_field(
-        name: &str,
-        field_type: state_contract::FieldType,
-    ) -> state_contract::FieldSchema {
-        state_contract::FieldSchema {
-            name: name.into(),
-            field_type,
-            nullable: false,
-            required: true,
-            default: None,
-            constraints: state_contract::FieldConstraints::default(),
-            computed: None,
-        }
-    }
-
-    fn make_auth_state(
-        schema: Arc<state_contract::StateSchema>,
-        snapshot: Vec<StoredRow>,
-    ) -> policy_evaluation::AuthorizationState {
-        policy_evaluation::AuthorizationState::new(schema, "tenant:test", Arc::new(snapshot))
-    }
-
-    // ============================================================================
-    // Invariant A: No Caller Authorization Facts
-    // ============================================================================
-
-    #[test]
-    fn invariant_a_caller_organization_id_ignored() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let project = json!({"_id": "proj1", "organization": "org-A"});
-        let membership = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", project),
-            make_stored_row("Membership", "mem1", membership),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Test that correct record from snapshot authorizes
-        let correct_context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A"}), // Correct org from snapshot
-        )
-        .with_state(auth_state.clone());
-
-        // This should succeed
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &correct_context,
-        );
-        assert!(result.is_ok());
-
-        // Now test that even if we spoof the field, it doesn't matter because
-        // the record value should come from authoritative snapshot
-        let spoofed_context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-B"}), // Spoofed
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &spoofed_context,
-        );
-        // This fails because org-B != org-A (the membership org)
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    #[test]
-    fn invariant_a_caller_is_member_attribute_ignored() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let project = json!({"_id": "proj1", "organization": "org-A"});
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", project),
-            // No membership record
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Caller claims is_member=true but no actual membership record exists
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A", "is_member": "true"}), // Spoofed attribute
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // Must deny because no actual membership record exists
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    #[test]
-    fn invariant_a_caller_role_attribute_ignored() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let project = json!({"_id": "proj1", "organization": "org-A"});
-        let snapshot = vec![make_stored_row("Project", "proj1", project)];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Caller claims role=admin but no membership exists
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A", "role": "admin"}), // Spoofed
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    // ============================================================================
-    // Invariant B: Query Isolation
-    // ============================================================================
-
-    #[test]
-    fn invariant_b_query_cannot_bypass_record_auth() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        // Three projects: alice can access proj1 and proj3 (org-A),
-        // cannot access proj2 (org-B)
-        let proj1 = json!({"_id": "proj1", "organization": "org-A"});
-        let proj2 = json!({"_id": "proj2", "organization": "org-B"});
-        let proj3 = json!({"_id": "proj3", "organization": "org-A"});
-
-        let mem_a = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", proj1.clone()),
-            make_stored_row("Project", "proj2", proj2.clone()),
-            make_stored_row("Project", "proj3", proj3.clone()),
-            make_stored_row("Membership", "mem1", mem_a),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Test authorization for each project
-        let projects = vec![(proj1, "proj1"), (proj2, "proj2"), (proj3, "proj3")];
-
-        for (proj, proj_id) in projects.iter() {
-            let context = policy_evaluation::RecordAuthorizationContext::new(
-                Some(policy_evaluation::Actor::new("alice")),
-                "Project",
-                *proj_id,
-                proj.clone(),
-            )
-            .with_state(auth_state.clone());
-
-            let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-                policy_evaluation::PolicySubject::Member,
-                &context,
-            );
-
-            if *proj_id == "proj2" {
-                // proj2 is in org-B, alice is only member of org-A
-                assert!(result.is_err());
-                assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-            } else {
-                // proj1 and proj3 are in org-A
-                assert!(result.is_ok());
-            }
-        }
-    }
-
-    // ============================================================================
-    // Invariant D: Update Authorization Uses Pre-Update State
-    // ============================================================================
-
-    #[test]
-    fn invariant_d_update_auth_uses_existing_state() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![make_collection(
-            "Project",
-            vec![
-                make_field(
-                    "_id",
-                    FieldType::Primitive {
-                        primitive: state_contract::PrimitiveType::String,
-                    },
-                ),
-                make_field(
-                    "owner_id",
-                    FieldType::Primitive {
-                        primitive: state_contract::PrimitiveType::String,
-                    },
-                ),
-            ],
-        )]);
-
-        // Existing project owned by alice
-        let existing = json!({"_id": "proj1", "owner_id": "alice", "title": "Secret"});
-
-        let snapshot = vec![make_stored_row("Project", "proj1", existing.clone())];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("bob")),
-            "Project",
-            "proj1",
-            existing, // Authorization uses EXISTING state, not proposed
-        )
-        .with_state(auth_state);
-
-        // Owner policy checks if bob == owner_id
-        // Existing owner_id is alice, so bob is not owner
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Owner,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    // ============================================================================
-    // Invariant J: Cross-Org Isolation
-    // ============================================================================
-
-    #[test]
-    fn invariant_j_member_cannot_access_other_org_resource() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        // Alice is member of org-A only
-        let mem_a = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        // Project is in org-B
-        let proj_b = json!({"_id": "proj2", "organization": "org-B"});
-
-        let snapshot = vec![
-            make_stored_row("Membership", "mem1", mem_a),
-            make_stored_row("Project", "proj2", proj_b),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj2",
-            json!({"_id": "proj2", "organization": "org-B"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // Alice is not member of org-B
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    #[test]
-    fn invariant_j_cannot_become_member_through_update() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        // Alice is member of org-A
-        let mem_a = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        // Existing project is in org-A
-        let proj_a = json!({"_id": "proj1", "organization": "org-A"});
-
-        let snapshot = vec![
-            make_stored_row("Membership", "mem1", mem_a),
-            make_stored_row("Project", "proj1", proj_a.clone()),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Alice tries to update the project to org-B (where she's not a member)
-        // But authorization uses the EXISTING state (org-A)
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            proj_a, // Authorization uses existing org-A
-        )
-        .with_state(auth_state);
-
-        // Alice is member of org-A, so this should authorize
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // This will ALLOW because authorization uses existing (org-A)
-        // The update to org-B would happen only if auth passes
-        // Then downstream checks would ensure the new org is valid
-        assert!(result.is_ok());
-    }
-
-    // ============================================================================
-    // Reference Integrity Tests
-    // ============================================================================
-
-    #[test]
-    fn reference_missing_organization_reference_in_schema() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![make_collection(
-            "Project",
-            vec![
-                make_field(
-                    "_id",
-                    FieldType::Primitive {
-                        primitive: state_contract::PrimitiveType::String,
-                    },
-                ),
-                // No organization reference
-            ],
-        )]);
-
-        let proj = json!({"_id": "proj1"});
-        let snapshot = vec![make_stored_row("Project", "proj1", proj)];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // Must fail because schema doesn't define organization reference
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
-    }
-
-    #[test]
-    fn reference_missing_organization_value_in_record() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![make_collection(
-            "Project",
-            vec![
-                make_field(
-                    "_id",
-                    FieldType::Primitive {
-                        primitive: state_contract::PrimitiveType::String,
-                    },
-                ),
-                make_field(
-                    "organization",
-                    FieldType::Reference {
-                        collection: "Organization".into(),
-                    },
-                ),
-            ],
-        )]);
-
-        let proj = json!({"_id": "proj1"}); // Missing organization field
-        let snapshot = vec![make_stored_row("Project", "proj1", proj)];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
-    }
-
-    #[test]
-    fn reference_null_organization_value() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![make_collection(
-            "Project",
-            vec![
-                make_field(
-                    "_id",
-                    FieldType::Primitive {
-                        primitive: state_contract::PrimitiveType::String,
-                    },
-                ),
-                make_field(
-                    "organization",
-                    FieldType::Reference {
-                        collection: "Organization".into(),
-                    },
-                ),
-            ],
-        )]);
-
-        let proj = json!({"_id": "proj1", "organization": null});
-        let snapshot = vec![make_stored_row("Project", "proj1", proj)];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": null}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
-    }
-
-    // ============================================================================
-    // Membership Tests
-    // ============================================================================
-
-    #[test]
-    fn membership_deleted_record_not_honored() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let proj = json!({"_id": "proj1", "organization": "org-A"});
-        let mut mem = make_stored_row(
-            "Membership",
-            "mem1",
-            json!({"_id": "mem1", "user": "alice", "organization": "org-A"}),
-        );
-        mem.deleted = true; // Mark as deleted
-
-        let snapshot = vec![make_stored_row("Project", "proj1", proj), mem];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // Deleted membership must not grant access
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
-    }
-
-    #[test]
-    fn membership_multiple_memberships_found_correctly() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let proj = json!({"_id": "proj1", "organization": "org-B"});
-
-        // Alice has memberships in both org-A and org-B
-        let mem_a = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-        let mem_b = json!({"_id": "mem2", "user": "alice", "organization": "org-B"});
-
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", proj),
-            make_stored_row("Membership", "mem1", mem_a),
-            make_stored_row("Membership", "mem2", mem_b),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-B"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        // Alice has membership in org-B, so should allow
-        assert!(result.is_ok());
-    }
-
-    // ============================================================================
-    // Anonymous/Unauthenticated Tests
-    // ============================================================================
-
-    #[test]
-    fn anonymous_member_policy_denied() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let proj = json!({"_id": "proj1", "organization": "org-A"});
-        let mem = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", proj),
-            make_stored_row("Membership", "mem1", mem),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // No actor (anonymous)
-        let context = policy_evaluation::RecordAuthorizationContext::new(
-            None,
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A"}),
-        )
-        .with_state(auth_state);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
-    }
-
-    #[test]
-    fn anonymous_owner_policy_denied() {
-        let proj = json!({"_id": "proj1", "owner": "alice"});
-
-        let context =
-            policy_evaluation::RecordAuthorizationContext::new(None, "Project", "proj1", proj);
-
-        let result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Owner,
-            &context,
-        );
-
-        assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
-    }
-
-    // ============================================================================
-    // Comprehensive Property Tests
-    // ============================================================================
-
-    #[test]
-    fn property_caller_attribute_changes_dont_change_authorization() {
-        use state_contract::FieldType;
-
-        let schema = make_schema_with_collections(vec![
-            make_collection(
-                "Project",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-            make_collection(
-                "Membership",
-                vec![
-                    make_field(
-                        "_id",
-                        FieldType::Primitive {
-                            primitive: state_contract::PrimitiveType::String,
-                        },
-                    ),
-                    make_field(
-                        "user",
-                        FieldType::Reference {
-                            collection: "User".into(),
-                        },
-                    ),
-                    make_field(
-                        "organization",
-                        FieldType::Reference {
-                            collection: "Organization".into(),
-                        },
-                    ),
-                ],
-            ),
-        ]);
-
-        let proj = json!({"_id": "proj1", "organization": "org-A"});
-        let mem = json!({"_id": "mem1", "user": "alice", "organization": "org-A"});
-
-        let snapshot = vec![
-            make_stored_row("Project", "proj1", proj),
-            make_stored_row("Membership", "mem1", mem),
-        ];
-
-        let auth_state = make_auth_state(schema, snapshot);
-
-        // Base case: correct state
-        let base_context = policy_evaluation::RecordAuthorizationContext::new(
-            Some(policy_evaluation::Actor::new("alice")),
-            "Project",
-            "proj1",
-            json!({"_id": "proj1", "organization": "org-A"}),
-        )
-        .with_state(auth_state.clone());
-
-        let base_result = policy_evaluation::PolicyEvaluator::evaluate_record(
-            policy_evaluation::PolicySubject::Member,
-            &base_context,
-        );
-
-        // Test with various caller-supplied attributes
-        let test_cases = vec![
-            json!({"_id": "proj1", "organization": "org-A", "is_member": "true"}),
-            json!({"_id": "proj1", "organization": "org-A", "is_member": "false"}),
-            json!({"_id": "proj1", "organization": "org-A", "role": "admin"}),
-            json!({"_id": "proj1", "organization": "org-A", "role": "member"}),
-            json!({"_id": "proj1", "organization": "org-A", "permissions": ["read", "write"]}),
-        ];
-
-        for test_record in test_cases {
-            let test_context = policy_evaluation::RecordAuthorizationContext::new(
-                Some(policy_evaluation::Actor::new("alice")),
-                "Project",
-                "proj1",
-                test_record,
-            )
-            .with_state(auth_state.clone());
-
-            let test_result = policy_evaluation::PolicyEvaluator::evaluate_record(
-                policy_evaluation::PolicySubject::Member,
-                &test_context,
-            );
-
-            // All should have the same result as base case
-            assert_eq!(base_result.is_ok(), test_result.is_ok());
-        }
-    }
-}