From 247e2836b84775042e04170a13ec575f5f98a04a Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Wed, 1 Jul 2026 19:34:22 +0200 Subject: [PATCH] =?UTF-8?q?feat(sealed):=20consume=20sealed=20at=20the=20t?= =?UTF-8?q?wo=20suppression=20gates=20(=C2=A711=20tail=20M3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The runtime effect: a sealed group template ignores a descendant's opt-out. - Trigger dispatch: `AND t.sealed = FALSE` inside TRIGGER_SUPPRESSION_ANTIJOIN — a sealed row is never excluded, so it fires through the suppression (one edit covers list_matching_kv/docs/files + pubsub fan-out). - Route rebuild: compile_effective_routes gates its suppression `continue` on `!er.route.sealed`, so a sealed inherited route stays in the app's slice. Pinned by tests/sealed_templates.rs (live-DB): a sealed trigger + route survive an app's suppression of both; an unsealed sibling with the same suppression is still declined — the gate is exactly `sealed`. Co-Authored-By: Claude Opus 4.8 (1M context) --- crates/manager-core/src/route_admin.rs | 6 +- crates/manager-core/src/trigger_repo.rs | 3 +- crates/manager-core/tests/sealed_templates.rs | 237 ++++++++++++++++++ 3 files changed, 244 insertions(+), 2 deletions(-) create mode 100644 crates/manager-core/tests/sealed_templates.rs diff --git a/crates/manager-core/src/route_admin.rs b/crates/manager-core/src/route_admin.rs index 96f2433..1184aac 100644 --- a/crates/manager-core/src/route_admin.rs +++ b/crates/manager-core/src/route_admin.rs @@ -466,7 +466,11 @@ pub fn compile_effective_routes( } // §11 tail: an inherited route whose path this app suppresses is // dropped — the binding 404s. Gated to inherited rows (`depth > 0`). - if er.depth > 0 && suppressed_paths.contains(&(er.effective_app_id, er.route.path.clone())) + // A `sealed` template is non-suppressible: the descendant's opt-out is + // ignored, so it stays in the slice regardless of the suppression. + if er.depth > 0 + && !er.route.sealed + && suppressed_paths.contains(&(er.effective_app_id, er.route.path.clone())) { continue; } diff --git a/crates/manager-core/src/trigger_repo.rs b/crates/manager-core/src/trigger_repo.rs index f0966b7..b753693 100644 --- a/crates/manager-core/src/trigger_repo.rs +++ b/crates/manager-core/src/trigger_repo.rs @@ -28,7 +28,8 @@ pub(crate) const TRIGGER_SUPPRESSION_ANTIJOIN: &str = " \ JOIN scripts s ON s.id = t.script_id \ WHERE ts.app_id = $1 AND ts.target_kind = 'trigger' \ AND LOWER(ts.reference) = LOWER(s.name) \ - AND t.group_id IS NOT NULL)"; + AND t.group_id IS NOT NULL \ + AND t.sealed = FALSE)"; #[derive(Debug, thiserror::Error)] pub enum TriggerRepoError { diff --git a/crates/manager-core/tests/sealed_templates.rs b/crates/manager-core/tests/sealed_templates.rs new file mode 100644 index 0000000..96116bf --- /dev/null +++ b/crates/manager-core/tests/sealed_templates.rs @@ -0,0 +1,237 @@ +//! §11 tail integration test: `sealed` (non-suppressible) group templates. +//! A group marks a TRIGGER and a ROUTE template `sealed = true`; a descendant +//! app that declares a `[suppress]` for both references STILL fires the trigger +//! (dispatch anti-join skips a sealed row) and STILL serves the route +//! (rebuild-time skip is gated on `!sealed`). The gate is exactly `sealed`: an +//! UNSEALED sibling template with the same suppression is still declined. +//! +//! Deterministic: drives `list_matching_kv` + `list_effective` / +//! `compile_effective_routes` directly (no async dispatcher). Skips cleanly +//! when `DATABASE_URL` is unset. + +#![allow( + clippy::needless_pass_by_value, + clippy::many_single_char_names, + clippy::too_many_lines +)] + +use std::collections::HashSet; + +use picloud_manager_core::route_admin::compile_effective_routes; +use picloud_manager_core::route_repo::{PostgresRouteRepository, RouteRepository}; +use picloud_manager_core::trigger_repo::{PostgresTriggerRepo, TriggerRepo}; +use picloud_shared::{AppId, KvEventOp}; +use sqlx::postgres::PgPoolOptions; +use sqlx::PgPool; +use uuid::Uuid; + +async fn pool_or_skip() -> Option { + let Ok(url) = std::env::var("DATABASE_URL") else { + eprintln!("sealed_templates: DATABASE_URL unset — skipping"); + return None; + }; + let pool = PgPoolOptions::new() + .max_connections(2) + .connect(&url) + .await + .expect("connect to DATABASE_URL"); + sqlx::migrate!("./migrations") + .run(&pool) + .await + .expect("apply migrations"); + Some(pool) +} + +async fn id1(pool: &PgPool, sql: &str, bind: &str) -> Uuid { + let row: (Uuid,) = sqlx::query_as(sql) + .bind(bind) + .fetch_one(pool) + .await + .expect("insert returning id"); + row.0 +} + +/// A group-owned script handler. +async fn group_handler(pool: &PgPool, name: &str, group: Uuid) -> Uuid { + let row: (Uuid,) = sqlx::query_as( + "INSERT INTO scripts (name, source, group_id) VALUES ($1, 'x', $2) RETURNING id", + ) + .bind(name) + .bind(group) + .fetch_one(pool) + .await + .expect("group handler"); + row.0 +} + +/// A group-owned kv trigger TEMPLATE (glob `*`, op insert), with `sealed`. +async fn kv_template(pool: &PgPool, group: Uuid, script: Uuid, admin: Uuid, sealed: bool) -> Uuid { + let row: (Uuid,) = sqlx::query_as( + "INSERT INTO triggers \ + (group_id, script_id, kind, enabled, dispatch_mode, \ + retry_max_attempts, retry_backoff, retry_base_ms, \ + registered_by_principal, name, sealed) \ + VALUES ($1, $2, 'kv', TRUE, 'async', 3, 'exponential', 1000, $3, $4, $5) RETURNING id", + ) + .bind(group) + .bind(script) + .bind(admin) + .bind(Uuid::new_v4().simple().to_string()) + .bind(sealed) + .fetch_one(pool) + .await + .expect("kv template"); + sqlx::query( + "INSERT INTO kv_trigger_details (trigger_id, collection_glob, ops) \ + VALUES ($1, '*', ARRAY['insert'])", + ) + .bind(row.0) + .execute(pool) + .await + .expect("kv details"); + row.0 +} + +/// A group-owned route TEMPLATE at `path`, with `sealed`. +async fn route_template(pool: &PgPool, group: Uuid, script: Uuid, path: &str, sealed: bool) { + sqlx::query( + "INSERT INTO routes \ + (group_id, script_id, host_kind, host, path_kind, path, method, sealed) \ + VALUES ($1, $2, 'any', '', 'exact', $3, NULL, $4)", + ) + .bind(group) + .bind(script) + .bind(path) + .bind(sealed) + .execute(pool) + .await + .expect("route template"); +} + +/// Whether `app`'s compiled route slice serves `path`. +async fn serves(repo: &PostgresRouteRepository, app: Uuid, path: &str) -> bool { + let effective = repo.list_effective().await.expect("list_effective"); + let suppressed: HashSet<(AppId, String)> = repo + .list_route_suppressions() + .await + .expect("list_route_suppressions") + .into_iter() + .collect(); + compile_effective_routes(&effective, &suppressed) + .into_iter() + .any(|c| c.app_id == AppId::from(app) && format!("{:?}", c.path).contains(path)) +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn sealed_template_survives_suppression_unsealed_still_declined() { + let Some(pool) = pool_or_skip().await else { + return; + }; + let sfx = Uuid::new_v4().simple().to_string(); + let admin = id1( + &pool, + "INSERT INTO admin_users (username, password_hash) VALUES ($1, 'x') RETURNING id", + &format!("seal-{sfx}"), + ) + .await; + + // Group G owns two handlers, each with a trigger + a route template: + // `audit` → SEALED (non-suppressible) + // `plain` → unsealed (suppressible, the control) + let g = id1( + &pool, + "INSERT INTO groups (slug, name) VALUES ($1, $1) RETURNING id", + &format!("seal-g-{sfx}"), + ) + .await; + let audit_name = format!("audit-{sfx}"); + let plain_name = format!("plain-{sfx}"); + let audit = group_handler(&pool, &audit_name, g).await; + let plain = group_handler(&pool, &plain_name, g).await; + + let sealed_trig = kv_template(&pool, g, audit, admin, true).await; + let plain_trig = kv_template(&pool, g, plain, admin, false).await; + route_template(&pool, g, audit, "/sealed", true).await; + route_template(&pool, g, plain, "/plain", false).await; + + // App A suppresses BOTH handlers + BOTH paths. + let a: (Uuid,) = + sqlx::query_as("INSERT INTO apps (slug, name, group_id) VALUES ($1, $1, $2) RETURNING id") + .bind(format!("seal-a-{sfx}")) + .bind(g) + .fetch_one(&pool) + .await + .expect("app A"); + let a = a.0; + sqlx::query( + "INSERT INTO template_suppressions (app_id, target_kind, reference) VALUES \ + ($1, 'trigger', $2), ($1, 'trigger', $3), \ + ($1, 'route', '/sealed'), ($1, 'route', '/plain')", + ) + .bind(a) + .bind(&audit_name) + .bind(&plain_name) + .execute(&pool) + .await + .expect("suppressions for A"); + + let trig = PostgresTriggerRepo::new(pool.clone()); + let routes = PostgresRouteRepository::new(pool.clone()); + + let matched = trig + .list_matching_kv(AppId::from(a), "users", KvEventOp::Insert) + .await + .expect("match A"); + + // Sealed template: suppression is IGNORED — the trigger still fires and the + // route still serves. + assert!( + matched.iter().any(|m| m.trigger_id == sealed_trig.into()), + "a SEALED trigger template fires despite the suppression" + ); + assert!( + serves(&routes, a, "/sealed").await, + "a SEALED route template serves despite the suppression" + ); + + // Unsealed control: the same suppression DOES decline it — proving the gate + // is exactly `sealed`, not a blanket bypass. + assert!( + !matched.iter().any(|m| m.trigger_id == plain_trig.into()), + "an UNSEALED trigger template is still declined by the suppression" + ); + assert!( + !serves(&routes, a, "/plain").await, + "an UNSEALED route template is still declined by the suppression" + ); + + // Cleanup (FK order). + let _ = sqlx::query("DELETE FROM triggers WHERE id = ANY($1)") + .bind(vec![sealed_trig, plain_trig]) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM routes WHERE group_id = $1") + .bind(g) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM template_suppressions WHERE app_id = $1") + .bind(a) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM scripts WHERE id = ANY($1)") + .bind(vec![audit, plain]) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM apps WHERE id = $1") + .bind(a) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM groups WHERE id = $1") + .bind(g) + .execute(&pool) + .await; + let _ = sqlx::query("DELETE FROM admin_users WHERE id = $1") + .bind(admin) + .execute(&pool) + .await; +}