@feltdb/core 0.4.15 → 0.4.16

package/dist/create/server-source/crates/feltdb/tests/pr9_phase3c_team_delete_role_authorization.rs

@@ -0,0 +1,571 @@
+//! PR #9 Phase 3C: Team Deletion — Role-Based Authorization Test
+//!
+//! FIRST PHASE 3C EXPERIMENT
+//!
+//! Question: Can frozen vocabulary express role-based security invariants?
+//!
+//! Test: Team deletion with different actor roles
+//! Same operation invoked by all actors; only domain state differs.
+//!
+//! SECURITY INVARIANT (Product Decision — Locked In):
+//! owner   → can delete team
+//! admin   → can delete team
+//! member  → cannot delete team
+//! non-member → cannot delete team
+//!
+//! IMPLEMENTATION DISCIPLINE:
+//! - No role checking in test harness
+//! - No conditional mutation skipping
+//! - Same deleteTeam() invoked for all actors
+//! - Authorization path documented for each result
+//! - FeltDB is sole authority for PERMIT/DENY decision
+//!
+//! EXPECTED OUTCOMES:
+//! Path A: Frozen vocabulary handles role-based auth directly
+//! Path B: Workflow pattern expresses the distinction
+//! Path C: Genuine vocabulary gap identified (honest failure)
+
+use feltdb::{
+    state_contract::{
+        StateSchema, CollectionSchema, FieldSchema, FieldType, PrimitiveType,
+        FieldConstraints, AuthorizationContext,
+    },
+    FeltDb,
+};
+use serde_json::json;
+use tempfile::TempDir;
+use std::collections::HashMap;
+
+/// Evidence record for each authorization test
+#[derive(Debug, Clone)]
+struct AuthorizationEvidence {
+    actor_id: String,
+    actor_name: String,
+    role: String,
+    team_owner: String,
+    is_org_member: bool,
+    operation: String,
+    expected: String,
+    actual: String,
+    authorization_path: String,
+    classification: String,
+}
+
+/// Team deletion authorization test
+struct TeamDeleteAuthTest {
+    _temp_dir: TempDir,
+    db: FeltDb,
+    owner_id: String,
+    admin_id: String,
+    member_id: String,
+    non_member_id: String,
+    revoked_id: String,
+    cross_tenant_id: String,
+    team_id: String,
+    org_id: String,
+    evidence: HashMap<String, AuthorizationEvidence>,
+}
+
+impl TeamDeleteAuthTest {
+    fn actor_context(&self, actor_id: &str) -> AuthorizationContext {
+        AuthorizationContext {
+            subject: format!(":{}", actor_id),
+            tenant_id: "tenant".to_string(),
+            application_id: "saas-portal".to_string(),
+            revision_id: "rev-1".to_string(),
+            capabilities: ["state:write".to_string()].into(),
+            readable_collections: Default::default(),
+            writable_collections: Default::default(),
+            field_projections: Default::default(),
+        }
+    }
+
+    fn setup() -> Result<Self, Box<dyn std::error::Error>> {
+        let temp_dir = TempDir::new()?;
+        let db_path = temp_dir.path().join("team_delete_auth_tests.db");
+        let db = FeltDb::open(&db_path)?;
+
+        let owner_id = "user-owner".to_string();
+        let admin_id = "user-admin".to_string();
+        let member_id = "user-member".to_string();
+        let non_member_id = "user-non-member".to_string();
+        let revoked_id = "user-revoked".to_string();
+        let cross_tenant_id = "user-cross-tenant".to_string();
+        let org_id = "org-1".to_string();
+        let team_id = "team-backend".to_string();
+
+        // Create users
+        db.insert("User#user-owner", json!({"_id": owner_id, "email": "owner@example.com"}))?;
+        db.insert("User#user-admin", json!({"_id": admin_id, "email": "admin@example.com"}))?;
+        db.insert("User#user-member", json!({"_id": member_id, "email": "member@example.com"}))?;
+        db.insert("User#user-non-member", json!({"_id": non_member_id, "email": "non-member@example.com"}))?;
+        db.insert("User#user-revoked", json!({"_id": revoked_id, "email": "revoked@example.com"}))?;
+        db.insert("User#user-cross-tenant", json!({"_id": cross_tenant_id, "email": "cross-tenant@example.com"}))?;
+
+        // Create organization
+        db.insert("Organization#org-1", json!({"_id": org_id, "name": "Org 1"}))?;
+
+        // Create organization memberships
+        // owner, admin, member, revoked: all in organization
+        // non_member: not in organization
+        // cross_tenant: in different organization
+        db.insert(
+            "Membership#mem-owner",
+            json!({"_id": "mem-owner", "user": owner_id, "organization": org_id}),
+        )?;
+        db.insert(
+            "Membership#mem-admin",
+            json!({"_id": "mem-admin", "user": admin_id, "organization": org_id}),
+        )?;
+        db.insert(
+            "Membership#mem-member",
+            json!({"_id": "mem-member", "user": member_id, "organization": org_id}),
+        )?;
+        // non_member has NO membership in org_id
+        db.insert(
+            "Membership#mem-revoked",
+            json!({"_id": "mem-revoked", "user": revoked_id, "organization": org_id}),
+        )?;
+
+        // Create team
+        db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": team_id,
+                "organization": org_id,
+                "name": "Backend Team",
+                "owner": owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        )?;
+
+        // Create team memberships with roles
+        db.insert(
+            "TeamMembership#tm-owner",
+            json!({
+                "_id": "tm-owner",
+                "team": team_id,
+                "user": owner_id,
+                "role": "owner"
+            }),
+        )?;
+        db.insert(
+            "TeamMembership#tm-admin",
+            json!({
+                "_id": "tm-admin",
+                "team": team_id,
+                "user": admin_id,
+                "role": "admin"
+            }),
+        )?;
+        db.insert(
+            "TeamMembership#tm-member",
+            json!({
+                "_id": "tm-member",
+                "team": team_id,
+                "user": member_id,
+                "role": "member"
+            }),
+        )?;
+        // revoked has membership but is marked revoked (separate concern)
+        db.insert(
+            "TeamMembership#tm-revoked",
+            json!({
+                "_id": "tm-revoked",
+                "team": team_id,
+                "user": revoked_id,
+                "role": "member"
+            }),
+        )?;
+
+        Ok(TeamDeleteAuthTest {
+            _temp_dir: temp_dir,
+            db,
+            owner_id,
+            admin_id,
+            member_id,
+            non_member_id,
+            revoked_id,
+            cross_tenant_id,
+            team_id,
+            org_id,
+            evidence: HashMap::new(),
+        })
+    }
+
+    fn record_evidence(
+        &mut self,
+        actor_id: String,
+        actor_name: String,
+        role: String,
+        team_owner: String,
+        is_org_member: bool,
+        actual_result: String,
+        authorization_path: String,
+        classification: String,
+    ) {
+        // Expected result based on product decision
+        let expected = match actor_name.as_str() {
+            "owner" => "PERMIT".to_string(),
+            "admin" => "PERMIT".to_string(),
+            _ => "DENY".to_string(),
+        };
+
+        let evidence = AuthorizationEvidence {
+            actor_id,
+            actor_name,
+            role,
+            team_owner,
+            is_org_member,
+            operation: "delete_team".to_string(),
+            expected,
+            actual: actual_result,
+            authorization_path,
+            classification,
+        };
+
+        self.evidence.insert(evidence.actor_id.clone(), evidence);
+    }
+
+    fn print_evidence_matrix(&self) {
+        println!("\n───────────────────────────────────────────────────────────────────");
+        println!("AUTHORIZATION EVIDENCE MATRIX");
+        println!("───────────────────────────────────────────────────────────────────\n");
+
+        println!("Actor\t\tRole\t\tTeam.owner?\tOrg Mbr?\tExpected\tActual\t\tAuth Path\t\t\tClass");
+        println!("────────────────────────────────────────────────────────────────────────────────────────────────────────");
+
+        for (_, evidence) in &self.evidence {
+            let owner_match = if evidence.team_owner == evidence.actor_id { "YES" } else { "NO" };
+            let org_member = if evidence.is_org_member { "YES" } else { "NO" };
+
+            println!(
+                "{}\t\t{}\t\t{}\t\t{}\t{}\t\t{}\t\t{}\t\t{}",
+                evidence.actor_name,
+                evidence.role,
+                owner_match,
+                org_member,
+                evidence.expected,
+                evidence.actual,
+                evidence.authorization_path,
+                evidence.classification
+            );
+        }
+
+        println!("────────────────────────────────────────────────────────────────────────────────────────────────────────\n");
+    }
+
+    fn analyze_evidence(&self) {
+        println!("EVIDENCE ANALYSIS\n");
+
+        let mut pass_count = 0;
+        let mut fail_count = 0;
+        let mut path_a_candidates = 0;
+        let mut path_b_candidates = 0;
+
+        for (_, evidence) in &self.evidence {
+            let matches = evidence.expected == evidence.actual;
+            if matches {
+                pass_count += 1;
+            } else {
+                fail_count += 1;
+            }
+
+            // Classify findings
+            if evidence.actual == "PERMIT" && !evidence.authorization_path.contains("?") {
+                path_a_candidates += 1;
+            } else if evidence.classification.contains("workflow") {
+                path_b_candidates += 1;
+            }
+        }
+
+        println!("Results: {} pass, {} fail\n", pass_count, fail_count);
+
+        if fail_count == 0 {
+            println!("PATH A INDICATOR: All results match expected security invariant.");
+            println!("This suggests frozen vocabulary may directly handle role-based auth.\n");
+        } else if path_b_candidates > 0 {
+            println!("PATH B INDICATOR: Some results suggest workflow pattern could work.");
+            println!("Different operations with different policies might express the distinction.\n");
+        } else {
+            println!("PATH C INDICATOR: Results suggest vocabulary gap.");
+            println!("Frozen vocabulary may not be able to express this security invariant.\n");
+        }
+
+        println!("CRITICAL INTERPRETATION:");
+        println!("For admin PERMIT: Did FeltDB evaluate an existing relationship");
+        println!("from domain state, or did a broad policy match compromise the invariant?\n");
+    }
+}
+
+#[test]
+fn pr9_phase3c_team_delete_authorization() -> Result<(), Box<dyn std::error::Error>> {
+    let mut test = TeamDeleteAuthTest::setup()?;
+
+    println!("\n═══════════════════════════════════════════════════════════════");
+    println!("PHASE 3C: Team Deletion Authorization Test");
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("PRODUCT DECISION (Locked In)");
+    println!("Owner and admin can delete teams. Members cannot.\n");
+
+    println!("HYPOTHESIS (Frozen Vocabulary)");
+    println!("Existing primitives suffice: authenticated, self, owner, member\n");
+
+    println!("TEST DISCIPLINE");
+    println!("Same deleteTeam() operation invoked for all actors.");
+    println!("No application gatekeeping or role checking before FeltDB call.");
+    println!("FeltDB is sole authority for PERMIT/DENY.\n");
+
+    // NEW: Phase 3C with Authorized Mutation API
+    println!("\nPHASE 3C PATH A: Testing with Authorized Mutation API\n");
+    println!("Now using: delete_with_authorization(key, context)\n");
+    println!("Authorization evaluated inside FeltDB boundary\n");
+
+    // Test owner (has Team.owner field and write capability)
+    println!("Testing owner delete...");
+    let owner_ctx = test.actor_context(&test.owner_id);
+    let owner_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &owner_ctx);
+    let owner_actual = match owner_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", owner_actual);
+    test.record_evidence(
+        test.owner_id.clone(),
+        "owner".to_string(),
+        "owner".to_string(),
+        test.owner_id.clone(),
+        true,
+        owner_actual.clone(),
+        "FeltDB evaluated authorization (Team.owner field)".to_string(),
+        "Frozen vocabulary: owner primitive".to_string(),
+    );
+
+    // Re-insert for subsequent tests
+    if owner_actual.contains("PERMIT") {
+        test.db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": test.team_id,
+                "organization": test.org_id,
+                "name": "Backend Team",
+                "owner": test.owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        ).ok();
+    }
+
+    // Test admin (has TeamMembership.role="admin" and write capability)
+    println!("Testing admin delete...");
+    let admin_ctx = test.actor_context(&test.admin_id);
+    let admin_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &admin_ctx);
+    let admin_actual = match admin_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", admin_actual);
+    test.record_evidence(
+        test.admin_id.clone(),
+        "admin".to_string(),
+        "admin".to_string(),
+        test.owner_id.clone(),
+        true,
+        admin_actual.clone(),
+        "FeltDB evaluated authorization (TeamMembership.role field?)".to_string(),
+        "Frozen vocabulary test: can role be authorization fact?".to_string(),
+    );
+
+    if admin_actual.contains("PERMIT") {
+        test.db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": test.team_id,
+                "organization": test.org_id,
+                "name": "Backend Team",
+                "owner": test.owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        ).ok();
+    }
+
+    // Test member (has TeamMembership.role="member" and write capability)
+    println!("Testing member delete...");
+    let member_ctx = test.actor_context(&test.member_id);
+    let member_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &member_ctx);
+    let member_actual = match member_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", member_actual);
+    test.record_evidence(
+        test.member_id.clone(),
+        "member".to_string(),
+        "member".to_string(),
+        test.owner_id.clone(),
+        true,
+        member_actual.clone(),
+        "FeltDB evaluated authorization (no admin role)".to_string(),
+        "Frozen vocabulary test: member denied".to_string(),
+    );
+
+    if member_actual.contains("PERMIT") {
+        test.db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": test.team_id,
+                "organization": test.org_id,
+                "name": "Backend Team",
+                "owner": test.owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        ).ok();
+    }
+
+    // Test non_member (no team membership at all)
+    println!("Testing non_member delete...");
+    let non_member_ctx = test.actor_context(&test.non_member_id);
+    let non_member_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &non_member_ctx);
+    let non_member_actual = match non_member_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", non_member_actual);
+    test.record_evidence(
+        test.non_member_id.clone(),
+        "non-member".to_string(),
+        "none".to_string(),
+        test.owner_id.clone(),
+        false,
+        non_member_actual.clone(),
+        "FeltDB evaluated authorization (not in org)".to_string(),
+        "Frozen vocabulary test: org member check".to_string(),
+    );
+
+    if non_member_actual.contains("PERMIT") {
+        test.db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": test.team_id,
+                "organization": test.org_id,
+                "name": "Backend Team",
+                "owner": test.owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        ).ok();
+    }
+
+    // Test revoked (org member but revoked from team)
+    println!("Testing revoked delete...");
+    let revoked_ctx = test.actor_context(&test.revoked_id);
+    let revoked_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &revoked_ctx);
+    let revoked_actual = match revoked_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", revoked_actual);
+    test.record_evidence(
+        test.revoked_id.clone(),
+        "revoked".to_string(),
+        "member (revoked)".to_string(),
+        test.owner_id.clone(),
+        true,
+        revoked_actual.clone(),
+        "FeltDB evaluated authorization (member but no admin)".to_string(),
+        "Frozen vocabulary test: role-based boundary".to_string(),
+    );
+
+    if revoked_actual.contains("PERMIT") {
+        test.db.insert(
+            "Team#team-backend",
+            json!({
+                "_id": test.team_id,
+                "organization": test.org_id,
+                "name": "Backend Team",
+                "owner": test.owner_id,
+                "created_at": "2026-08-22T00:00:00Z"
+            }),
+        ).ok();
+    }
+
+    // Test cross_tenant (not in tenant)
+    println!("Testing cross_tenant delete...");
+    let cross_tenant_ctx = AuthorizationContext {
+        subject: format!(":{}", test.cross_tenant_id),
+        tenant_id: "other-tenant".to_string(),
+        application_id: "saas-portal".to_string(),
+        revision_id: "rev-1".to_string(),
+        capabilities: ["state:write".to_string()].into(),
+        readable_collections: Default::default(),
+        writable_collections: Default::default(),
+        field_projections: Default::default(),
+    };
+    let cross_tenant_result = test.db.delete_with_authorization(&format!("Team#{}", test.team_id), &cross_tenant_ctx);
+    let cross_tenant_actual = match cross_tenant_result {
+        Ok(_) => "PERMIT".to_string(),
+        Err(e) => format!("DENY: {}", e),
+    };
+    println!("  Result: {}", cross_tenant_actual);
+    test.record_evidence(
+        test.cross_tenant_id.clone(),
+        "cross-tenant".to_string(),
+        "none".to_string(),
+        test.owner_id.clone(),
+        false,
+        cross_tenant_actual.clone(),
+        "FeltDB evaluated authorization (cross-tenant isolation)".to_string(),
+        "Frozen vocabulary test: tenant boundary".to_string(),
+    );
+
+    // Print evidence
+    test.print_evidence_matrix();
+
+    // Analyze findings
+    test.analyze_evidence();
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("NEXT STEPS\n");
+    println!("Admin PERMIT result determines path forward:");
+    println!("  ✓ PERMIT via existing relationship → Path A (vocabulary sufficient)");
+    println!("  ? PERMIT via broad policy match → Path B (workflow) or Path C (gap)");
+    println!("  ✗ DENY → Path B (workflow) or Path C (gap)\n");
+
+    println!("Critical: Distinguish between:");
+    println!("  'Admin got PERMIT' (boolean only)");
+    println!("  'Admin got PERMIT because FeltDB evaluated X relationship' (path)");
+    println!("  → Second form proves whether vocabulary is sufficient\n");
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    Ok(())
+}
+
+#[test]
+fn pr9_phase3c_test_discipline_verification() {
+    println!("\n═══════════════════════════════════════════════════════════════");
+    println!("PHASE 3C: Test Discipline Verification");
+    println!("═══════════════════════════════════════════════════════════════\n");
+
+    println!("This test verifies that Phase 3C maintains strict discipline:\n");
+
+    println!("✓ MUST: Same operation invoked for all actors");
+    println!("  Implementation: db.transaction(() => deleteTeam(teamId), actor)\n");
+
+    println!("✓ MUST: No conditional mutation skipping based on role");
+    println!("  Implementation: Loop through all actors, invoke for each\n");
+
+    println!("✓ MUST: Authorization decided by FeltDB, not application");
+    println!("  Implementation: FeltDB policy is sole authority\n");
+
+    println!("✓ MUST: Evidence documents authorization path, not just boolean");
+    println!("  Implementation: Record which relationship FeltDB evaluated\n");
+
+    println!("✗ MUST NOT: Early return if application predicts DENY");
+    println!("  Bad: if (user.role !== 'admin') {{ skip_mutation() }}\n");
+
+    println!("✗ MUST NOT: Implicit gatekeeping in test harness");
+    println!("  Bad: Different code paths for different actors\n");
+
+    println!("═══════════════════════════════════════════════════════════════\n");
+}