@feltdb/core 0.4.14 → 0.4.16

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_role_based_authorization.rs

@@ -0,0 +1,313 @@
+//! PR #9 Phase 3C: Role-Based Authorization Testing
+//!
+//! CRITICAL DISCIPLINE:
+//! - Same privileged operation invoked by all actors
+//! - No application gatekeeping or role checking before FeltDB call
+//! - Authorization decision made entirely by FeltDB runtime
+//! - Document the authorization path (why PERMIT/DENY, not just the boolean)
+//! - Test whether frozen vocabulary can express role-based security invariant
+//!
+//! PRODUCT DECISION (Locked In):
+//! Admin is an authorization boundary.
+//! A team admin is authorized to perform privileged team operations
+//! that ordinary members are not.
+//!
+//! QUESTION:
+//! Can existing frozen vocabulary (authenticated, self, owner, member)
+//! express this authorization using TeamMembership.role as domain fact?
+//!
+//! TEST STRATEGY:
+//! 1. Create identical privileged operation
+//! 2. Invoke it with owner, admin, member, non_member actors
+//! 3. Document what FeltDB permits/denies and why
+//! 4. Analyze: Does frozen vocabulary handle role-based auth?
+
+use feltdb::{
+    state_contract::{
+        StateSchema, CollectionSchema, FieldSchema, FieldType, PrimitiveType,
+        FieldConstraints, AuthorizationContext,
+    },
+    FeltDb,
+};
+use serde_json::json;
+use tempfile::TempDir;
+
+/// Test fixture for Phase 3C role-based authorization investigation
+struct RoleAuthTestFixture {
+    db: FeltDb,
+    // Actors
+    owner_id: String,
+    admin_id: String,
+    member_id: String,
+    non_member_id: String,
+    // Resources
+    team_id: String,
+    org_id: String,
+}
+
+impl RoleAuthTestFixture {
+    fn actor_context(&self, actor_id: &str) -> AuthorizationContext {
+        AuthorizationContext {
+            subject: format!(":{}", actor_id),
+            tenant_id: "tenant".to_string(),
+            application_id: "saas-portal".to_string(),
+            revision_id: "rev-1".to_string(),
+            capabilities: ["state:read".to_string()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        }
+    }
+
+    fn setup() -> Result<Self, Box<dyn std::error::Error>> {
+        let temp_dir = TempDir::new()?;
+        let db_path = temp_dir.path().join("role_auth_tests.db");
+        let db = FeltDb::open(&db_path)?;
+
+        let owner_id = "user-owner".to_string();
+        let admin_id = "user-admin".to_string();
+        let member_id = "user-member".to_string();
+        let non_member_id = "user-non-member".to_string();
+        let org_id = "org-1".to_string();
+        let team_id = "team-backend".to_string();
+
+        // Create users
+        db.insert("User#user-owner", json!({"_id": owner_id, "email": "owner@example.com"}))?;
+        db.insert("User#user-admin", json!({"_id": admin_id, "email": "admin@example.com"}))?;
+        db.insert("User#user-member", json!({"_id": member_id, "email": "member@example.com"}))?;
+        db.insert("User#user-non-member", json!({"_id": non_member_id, "email": "non-member@example.com"}))?;
+
+        // Create organization
+        db.insert("Organization#org-1", json!({"_id": org_id, "name": "Org 1"}))?;
+
+        // Create organization memberships (all users are org members except non_member)
+        db.insert(
+            "Membership#mem-owner",
+            json!({"_id": "mem-owner", "user": owner_id, "organization": org_id}),
+        )?;
+        db.insert(
+            "Membership#mem-admin",
+            json!({"_id": "mem-admin", "user": admin_id, "organization": org_id}),
+        )?;
+        db.insert(
+            "Membership#mem-member",
+            json!({"_id": "mem-member", "user": member_id, "organization": org_id}),
+        )?;
+
+        // Create team with owner field
+        db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": team_id,
+                "organization": org_id,
+                "name": "Backend Team",
+                "owner": owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        )?;
+
+        // Create team memberships with roles
+        // CRITICAL: Role is domain state, not yet an authorization fact
+        // Question: Can frozen vocabulary make it an authorization fact?
+        db.insert(
+            "TeamMembership#tm-owner",
+            json!({
+                "_id": "tm-owner",
+                "team": team_id,
+                "user": owner_id,
+                "role": "owner"
+            }),
+        )?;
+        db.insert(
+            "TeamMembership#tm-admin",
+            json!({
+                "_id": "tm-admin",
+                "team": team_id,
+                "user": admin_id,
+                "role": "admin"
+            }),
+        )?;
+        db.insert(
+            "TeamMembership#tm-member",
+            json!({
+                "_id": "tm-member",
+                "team": team_id,
+                "user": member_id,
+                "role": "member"
+            }),
+        )?;
+
+        Ok(RoleAuthTestFixture {
+            db,
+            owner_id,
+            admin_id,
+            member_id,
+            non_member_id,
+            team_id,
+            org_id,
+        })
+    }
+}
+
+#[test]
+fn pr9_phase3c_role_authorization_matrix() -> Result<(), Box<dyn std::error::Error>> {
+    let fixture = RoleAuthTestFixture::setup()?;
+
+    println!("\n═══════════════════════════════════════════════════════════════");
+    println!("PHASE 3C: Role-Based Authorization Investigation");
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("PRODUCT DECISION (Locked In)\n");
+    println!("Admin is an authorization boundary.");
+    println!("A team admin is authorized to perform privileged team operations");
+    println!("that ordinary members are not.\n");
+
+    println!("HYPOTHESIS (Frozen Vocabulary)\n");
+    println!("Existing primitives suffice: authenticated, self, owner, member\n");
+
+    println!("QUESTION\n");
+    println!("Can frozen vocabulary express role-based authorization using");
+    println!("TeamMembership.role as the domain fact?\n");
+
+    println!("TEST MATRIX: Identical Privileged Operation\n");
+
+    println!("Actor\t\tRole\t\tTeam.owner?\tOrg Member?\tExpected\tActual\tAuth Path");
+    println!("─────────────────────────────────────────────────────────────────────────────");
+
+    // Owner: Has Team.owner field AND admin role
+    // Policy must PERMIT via owner field
+    let owner_ctx = fixture.actor_context(&fixture.owner_id);
+    println!("owner\t\towner\t\tYES\t\tYES\t\tPERMIT\t\t?\t\tTeam.owner");
+
+    // Admin: Does NOT have Team.owner field, but has role="admin"
+    // Policy must PERMIT via... what? This is the question.
+    let admin_ctx = fixture.actor_context(&fixture.admin_id);
+    println!("admin\t\tadmin\t\tNO\t\tYES\t\tPERMIT\t\t?\t\tTeamMembership.role?");
+
+    // Member: Does NOT have owner status, role="member"
+    // Policy must DENY
+    let member_ctx = fixture.actor_context(&fixture.member_id);
+    println!("member\t\tmember\t\tNO\t\tYES\t\tDENY\t\t?\t\tNo authorization");
+
+    // Non-member: Not in organization
+    // Policy must DENY at org level
+    let non_member_ctx = fixture.actor_context(&fixture.non_member_id);
+    println!("non-member\t—\t\tNO\t\tNO\t\tDENY\t\t?\t\tOrg member check");
+
+    println!("\n─────────────────────────────────────────────────────────────────────────────");
+    println!("INVESTIGATION\n");
+
+    println!("KEY OBSERVATION:");
+    println!("  Owner is authorized via Team.owner field (existing owner primitive)");
+    println!("  Admin must be authorized via TeamMembership.role field (new test)\n");
+
+    println!("CRITICAL DISCIPLINE:");
+    println!("  Same operation invoked by all actors");
+    println!("  No application gatekeeping (role checking before FeltDB call)");
+    println!("  Authorization decision made entirely by FeltDB runtime\n");
+
+    println!("EXPECTED RESULTS:\n");
+
+    println!("Path A Success:");
+    println!("  Frozen vocabulary directly handles role-based auth");
+    println!("  Admin: PERMIT via TeamMembership.role evaluation");
+    println!("  Member: DENY via policy evaluation");
+    println!("  Result: Vocabulary sufficient, no new primitives\n");
+
+    println!("Path B Success:");
+    println!("  Different operations have different policies");
+    println!("  E.g., mark_deleted (member) vs. hard_delete (owner|admin)");
+    println!("  Result: Workflow pattern sufficient, no new primitives\n");
+
+    println!("Path C (Honest Failure):");
+    println!("  Frozen vocabulary cannot express this distinction");
+    println!("  TeamMembership.role cannot be authorization fact without new primitive");
+    println!("  Result: Evidence of vocabulary gap identified\n");
+
+    println!("CRITICAL CONSTRAINT FOR EVIDENCE:");
+    println!("For any PERMIT or DENY result, document WHY:");
+    println!("  - Which authorization relationship FeltDB evaluated");
+    println!("  - How TeamMembership.role was interpreted (or not)");
+    println!("  - Whether frozen vocabulary was sufficient\n");
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    Ok(())
+}
+
+#[test]
+fn pr9_phase3c_discipline_note() {
+    println!("\n═══════════════════════════════════════════════════════════════");
+    println!("PHASE 3C: Implementation Discipline");
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("DO NOT encode role checking in test harness:");
+    println!("  ✗ WRONG: if (user.role == 'admin') {{ allow_operation() }}");
+    println!("  ✓ CORRECT: db.operation() // FeltDB decides\n");
+
+    println!("DO isolate authorization decision to FeltDB:");
+    println!("  ✗ Application gatekeeping before FeltDB call");
+    println!("  ✓ Same operation, all actors, FeltDB decides\n");
+
+    println!("DO document the authorization path:");
+    println!("  ✗ Result: PERMIT (boolean only)");
+    println!("  ✓ Result: PERMIT via owner field evaluation\n");
+
+    println!("DO test with identical mutations:");
+    println!("  ✗ Admin calls admin_delete(), member calls member_delete()");
+    println!("  ✓ Same delete() invoked by admin and member actors\n");
+
+    println!("RATIONALE:");
+    println!("If FeltDB permits admin and denies member for the SAME operation,");
+    println!("we can isolate which authorization relationship FeltDB evaluated.\n");
+
+    println!("If admin is PERMITTED only because application didn't invoke");
+    println!("the operation, that's not evidence of role-based authorization.");
+    println!("It's evidence of application gatekeeping.\n");
+
+    println!("Phase 3C proves whether frozen vocabulary can express");
+    println!("role-based security invariants at the database boundary.\n");
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+}
+
+#[test]
+fn pr9_phase3c_evidence_template() {
+    println!("\n═══════════════════════════════════════════════════════════════");
+    println!("PHASE 3C: Evidence Template");
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("For each actor, record:\n");
+
+    println!("Actor\t\tRole\t\tTeam.owner?\tOrg Member?\tExpected\tActual\tPolicy Evaluated\tPath");
+    println!("─────────────────────────────────────────────────────────────────────────────────────────");
+    println!("owner\t\towner\t\tYES\t\tYES\t\tPERMIT\t\t?\t\t?\t\t\t?\n");
+
+    println!("Analysis for each result:\n");
+
+    println!("1. PERMIT Evaluation:");
+    println!("   - Did FeltDB evaluate Team.owner field? (owner primitive)");
+    println!("   - Did FeltDB evaluate TeamMembership.role? (role-based auth)");
+    println!("   - Did FeltDB evaluate Membership in organization? (member primitive)");
+    println!("   - Which relationship granted authorization?\n");
+
+    println!("2. DENY Evaluation:");
+    println!("   - Which policy rule caused denial?");
+    println!("   - Did FeltDB check: org membership? owner? role?");
+    println!("   - Was denial at expected level (role, org, or tenant)?\n");
+
+    println!("3. Authorization Path:");
+    println!("   - Frozen vocabulary interpretation used");
+    println!("   - Domain state referenced (Team.owner, TeamMembership.role)");
+    println!("   - Whether role was readable by FeltDB");
+    println!("   - Whether field inspection occurred (regression indicator)\n");
+
+    println!("EVIDENCE SUCCESS:");
+    println!("For admin PERMIT: Documented that FeltDB evaluated");
+    println!("the existing authorization relationship from domain state.\n");
+
+    println!("NOT merely: 'Admin got PERMIT'");
+    println!("BUT: 'Admin got PERMIT because FeltDB evaluated...[specific mechanism]'\n");
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+}

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_simple_auth_delete.rs

@@ -0,0 +1,90 @@
+//! PR #9 Phase 3C: Simple Authorization Delete Test
+//!
+//! Minimal test to verify authorized deletion works
+
+use feltdb::{
+    state_contract::AuthorizationContext,
+    FeltDb,
+};
+use serde_json::json;
+use tempfile::TempDir;
+
+#[test]
+fn simple_authorized_delete() -> Result<(), Box<dyn std::error::Error>> {
+    let temp_dir = TempDir::new()?;
+    let db = FeltDb::open(temp_dir.path().join("test.db"))?;
+
+    // Create a simple record
+    db.insert("Team#team-1", json!({"_id": "team-1", "name": "Engineering"}))?;
+    println!("Created Team#team-1");
+
+    // Verify it exists
+    let value = db.get::<serde_json::Value>("Team#team-1")?;
+    assert!(value.is_some(), "Record should exist");
+    println!("Verified Team#team-1 exists");
+
+    // Create authorized context
+    let context = AuthorizationContext {
+        subject: ":user-1".to_string(),
+        tenant_id: "tenant-1".to_string(),
+        application_id: "app".to_string(),
+        revision_id: "rev-1".to_string(),
+        capabilities: vec!["state:write".to_string()].into_iter().collect(),
+        readable_collections: Default::default(),
+        writable_collections: Default::default(),
+        field_projections: Default::default(),
+    };
+    println!("Created AuthorizationContext with state:write");
+
+    // Try authorized delete
+    println!("Attempting delete_with_authorization...");
+    let result = db.delete_with_authorization("Team#team-1", &context);
+    println!("Delete result: {:?}", result);
+
+    match result {
+        Ok(_) => {
+            println!("✓ Delete succeeded");
+            let value = db.get::<serde_json::Value>("Team#team-1")?;
+            assert!(value.is_none(), "Record should be deleted");
+            println!("✓ Record verified deleted");
+            Ok(())
+        }
+        Err(e) => {
+            println!("✗ Delete failed: {}", e);
+            Err(Box::new(e))
+        }
+    }
+}
+
+#[test]
+fn authorized_delete_unauthorized_context() -> Result<(), Box<dyn std::error::Error>> {
+    let temp_dir = TempDir::new()?;
+    let db = FeltDb::open(temp_dir.path().join("test2.db"))?;
+
+    // Create a record
+    db.insert("Team#team-2", json!({"_id": "team-2", "name": "Product"}))?;
+
+    // Create unauthorized context (no write capability)
+    let context = AuthorizationContext {
+        subject: ":user-2".to_string(),
+        tenant_id: "tenant-1".to_string(),
+        application_id: "app".to_string(),
+        revision_id: "rev-1".to_string(),
+        capabilities: vec!["state:read".to_string()].into_iter().collect(),
+        readable_collections: Default::default(),
+        writable_collections: Default::default(),
+        field_projections: Default::default(),
+    };
+
+    // Try delete - should fail authorization
+    let result = db.delete_with_authorization("Team#team-2", &context);
+    assert!(result.is_err(), "Delete should be denied");
+    println!("✓ Unauthorized delete correctly denied");
+
+    // Verify record still exists
+    let value = db.get::<serde_json::Value>("Team#team-2")?;
+    assert!(value.is_some(), "Record should still exist after denied delete");
+    println!("✓ Record unchanged after authorization denial");
+
+    Ok(())
+}