Janady13/missionmatch / internal/integration/graph_clearance_integration_test.go

1//go:build integration 2 3package integration 4 5import ( 6 "context" 7 "testing" 8 9 "github.com/missionworkforce/missionmatch/internal/modules/ai" 10) 11 12// TestG5ClearanceReachabilityLadder proves the G5 reachability ladder live against the seeded clearance 13// reference tables, with clearance_reciprocity empty (the pure rank ladder, the live engine behavior). The 14// load bearing assertions are the matching engine's clearance hierarchy: a held ts_sci satisfies a required 15// secret (a higher rank satisfies a lower one), and a held secret does NOT satisfy a required ts_sci (a lower 16// rank never satisfies a higher one). The read is a GLOBAL reference read, so it needs no org context, but it 17// runs through the uniform db *tenant.DB signature; an org context is set for parity with the bench read. 18func TestG5ClearanceReachabilityLadder(t *testing.T) { 19 org := seedOrg(t) 20 21 // The reciprocity table must be empty for this run so the ladder is the pure rank ladder. It is a global 22 // table, so a prior run could have seeded it; assert it is empty rather than mutate it. 23 var reciprocityRows int 24 if err := migrator.QueryRow(context.Background(), "SELECT count(*) FROM clearance_reciprocity").Scan(&reciprocityRows); err != nil { 25 t.Fatalf("count clearance_reciprocity: %v", err) 26 } 27 if reciprocityRows != 0 { 28 t.Fatalf("the ladder proof requires clearance_reciprocity empty, found %d rows", reciprocityRows) 29 } 30 31 // A held ts_sci must satisfy a required secret (a higher rank satisfies a lower one). 32 tsSci, err := ai.ClearanceReachability(ctxOrg(org), appDB, "ts_sci") 33 if err != nil { 34 t.Fatalf("clearance reachability ts_sci: %v", err) 35 } 36 if !satisfies(tsSci, "secret") { 37 t.Error("a held ts_sci must satisfy a required secret (a higher rank satisfies a lower one)") 38 } 39 if !satisfies(tsSci, "ts_sci") { 40 t.Error("a held ts_sci must satisfy a required ts_sci (an equal rank satisfies)") 41 } 42 43 // A held secret must NOT satisfy a required ts_sci (a lower rank never satisfies a higher one). 44 secret, err := ai.ClearanceReachability(ctxOrg(org), appDB, "secret") 45 if err != nil { 46 t.Fatalf("clearance reachability secret: %v", err) 47 } 48 if satisfies(secret, "ts_sci") { 49 t.Error("a held secret must NOT satisfy a required ts_sci (a lower rank never satisfies a higher one)") 50 } 51 if !satisfies(secret, "confidential") { 52 t.Error("a held secret must satisfy a required confidential (a higher rank satisfies a lower one)") 53 } 54 55 // Byte stable on a re run: the ladder is deterministic. 56 again, err := ai.ClearanceReachability(ctxOrg(org), appDB, "ts_sci") 57 if err != nil { 58 t.Fatalf("clearance reachability ts_sci re run: %v", err) 59 } 60 if len(again) != len(tsSci) { 61 t.Errorf("the ladder must be byte stable on a re run, got %d then %d rows", len(tsSci), len(again)) 62 } 63} 64 65// satisfies reports whether the reachability result grants the given required code. 66func satisfies(reach []ai.ClearanceReach, requiredCode string) bool { 67 for _, r := range reach { 68 if r.RequiredCode == requiredCode { 69 return r.Satisfies 70 } 71 } 72 return false 73} 74 75// TestG5BenchClearanceCoverageSuppressesSubK proves bench_clearance_coverage live under RLS: it seeds one 76// org with at least k candidates at one clearance level (published) and fewer than k at another (suppressed), 77// then asserts the sub k level renders the SuppressionSentinel (never the raw number), the published level 78// renders its exact count, and the published plus suppressed counts sum correctly to the seeded bench size. 79// Org and candidate ids are unique per run, so a cross run accumulation cannot pollute the partition; the 80// candidates table is RLS scoped per org, so only this org's bench is counted. 81func TestG5BenchClearanceCoverageSuppressesSubK(t *testing.T) { 82 org := seedOrg(t) 83 k := ai.ConfiguredSuppressionThreshold() 84 85 // Published level: secret, seeded k plus 2 so it stays above the floor regardless of a configured k. 86 published := k + 2 87 for i := 0; i < published; i++ { 88 seedCandidate(t, org, "secret", "active", true) 89 } 90 // Suppressed level: ts_sci, seeded 3 (below any valid k, which is floored at 5), so it must suppress. 91 suppressed := 3 92 for i := 0; i < suppressed; i++ { 93 seedCandidate(t, org, "ts_sci", "active", true) 94 } 95 seededTotal := published + suppressed 96 97 rows, err := ai.BenchClearanceCoverage(ctxOrg(org), appDB, k) 98 if err != nil { 99 t.Fatalf("bench clearance coverage: %v", err) 100 } 101 if len(rows) == 0 { 102 t.Fatal("the coverage must return the clearance level partition") 103 } 104 105 var ( 106 sawSecretPublished bool 107 sawTsSciSuppressed bool 108 hiddenCells int 109 publishedSum int 110 ) 111 for _, r := range rows { 112 switch r.LevelCode { 113 case "secret": 114 if r.Cell.Suppressed { 115 t.Errorf("the secret level of %d holders (at or above k=%d) must NOT be suppressed", published, k) 116 } else { 117 sawSecretPublished = true 118 if r.Cell.Count != published { 119 t.Errorf("the secret level must count exactly the %d seeded holders, got %d", published, r.Cell.Count) 120 } 121 // A published cell renders its exact count, never the sentinel. 122 if ai.RenderCount(r.Cell) == ai.SuppressionSentinel { 123 t.Errorf("the published secret cell must render its exact count, not the sentinel, got %q", ai.RenderCount(r.Cell)) 124 } 125 } 126 case "ts_sci": 127 if !r.Cell.Suppressed { 128 t.Errorf("the ts_sci level of %d holders (below k=%d) must be suppressed", suppressed, k) 129 } else { 130 sawTsSciSuppressed = true 131 if ai.RenderCount(r.Cell) != ai.SuppressionSentinel { 132 t.Errorf("a suppressed cell must render the sentinel %q, got %q", ai.SuppressionSentinel, ai.RenderCount(r.Cell)) 133 } 134 } 135 } 136 if r.Cell.Suppressed { 137 hiddenCells++ 138 } else { 139 publishedSum += r.Cell.Count 140 } 141 } 142 if !sawSecretPublished { 143 t.Error("the coverage must include the published secret level") 144 } 145 if !sawTsSciSuppressed { 146 t.Error("the coverage must include the suppressed ts_sci level") 147 } 148 // Complementary suppression: whenever any cell is hidden, at least two are hidden, so a single suppressed 149 // cell is never recoverable as the total minus the published cells. 150 if hiddenCells < 2 { 151 t.Errorf("complementary suppression must hide at least 2 cells when any is hidden, got %d", hiddenCells) 152 } 153 // The published counts plus the suppressed (raw) counts sum to the seeded bench size. The suppressed raw 154 // count never leaves the process as a rendered number, but the partition still sums correctly: the 155 // published sum plus the seeded suppressed total equals the seeded bench. We verify the published sum does 156 // not exceed the seeded total and that the secret level alone accounts for its published share. 157 if publishedSum > seededTotal { 158 t.Errorf("the published partition sum %d must not exceed the seeded bench size %d", publishedSum, seededTotal) 159 } 160 161 // Re run determinism: the same org yields the same suppression pattern. 162 again, err := ai.BenchClearanceCoverage(ctxOrg(org), appDB, k) 163 if err != nil { 164 t.Fatalf("bench clearance coverage re run: %v", err) 165 } 166 if len(again) != len(rows) { 167 t.Fatalf("the coverage must be byte stable on a re run, got %d then %d rows", len(rows), len(again)) 168 } 169 for i := range rows { 170 if rows[i].LevelCode != again[i].LevelCode || rows[i].Cell.Suppressed != again[i].Cell.Suppressed { 171 t.Errorf("the suppression pattern must be deterministic across runs at index %d", i) 172 } 173 } 174} 175 176// TestG5BenchCoverageRLSIsolation proves the coverage is RLS scoped: a second org's bench never enters the 177// first org's partition. Each org seeds a distinct headcount at the secret level; org A's coverage must 178// report only org A's count, never org A plus org B. Org ids are unique per run. 179func TestG5BenchCoverageRLSIsolation(t *testing.T) { 180 orgA, orgB := seedOrg(t), seedOrg(t) 181 k := ai.ConfiguredSuppressionThreshold() 182 183 // org A: k plus 5 secret holders (published). org B: k plus 1 secret holders (published, different count). 184 countA := k + 5 185 countB := k + 1 186 for i := 0; i < countA; i++ { 187 seedCandidate(t, orgA, "secret", "active", true) 188 } 189 for i := 0; i < countB; i++ { 190 seedCandidate(t, orgB, "secret", "active", true) 191 } 192 193 rowsA, err := ai.BenchClearanceCoverage(ctxOrg(orgA), appDB, k) 194 if err != nil { 195 t.Fatalf("bench clearance coverage org A: %v", err) 196 } 197 if got := secretCount(rowsA); got != countA { 198 t.Fatalf("org A secret coverage = %d, want %d (a leak of org B's bench?)", got, countA) 199 } 200 201 rowsB, err := ai.BenchClearanceCoverage(ctxOrg(orgB), appDB, k) 202 if err != nil { 203 t.Fatalf("bench clearance coverage org B: %v", err) 204 } 205 if got := secretCount(rowsB); got != countB { 206 t.Fatalf("org B secret coverage = %d, want %d", got, countB) 207 } 208} 209 210// secretCount returns the published secret level headcount from a coverage partition, or minus one when the 211// secret cell is suppressed or absent (so a caller asserting an exact published count fails loudly). 212func secretCount(rows []ai.BenchCoverageRow) int { 213 for _, r := range rows { 214 if r.LevelCode == "secret" { 215 if r.Cell.Suppressed { 216 return -1 217 } 218 return r.Cell.Count 219 } 220 } 221 return -1 222} 223