Janady13/missionmatch / internal/platform/sourcing/ingest_bench_test.go

1package sourcing 2 3// WS9 bench ingest unit tests. No database: a fake DBTX records every query the ingest path runs and a 4// fake extractor stands in for the deterministic extraction port, so the embed skip path, the clearance 5// stays unknown invariant, and the application role tag classification are proven with no DB connection. 6 7import ( 8 "context" 9 "strings" 10 "testing" 11 12 "github.com/google/uuid" 13 "github.com/jackc/pgx/v5" 14 "github.com/jackc/pgx/v5/pgconn" 15 pgvector "github.com/pgvector/pgvector-go" 16 17 "github.com/missionworkforce/missionmatch/internal/platform/database/dbgen" 18 "github.com/missionworkforce/missionmatch/internal/platform/extraction" 19 "github.com/missionworkforce/missionmatch/internal/platform/missionclass" 20 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 21) 22 23// recordedCall captures one query the ingest path ran, by SQL text and arguments, so a test can assert 24// what was sent to the database without a database. 25type recordedCall struct { 26 sql string 27 args []any 28} 29 30// fakeRow is a pgx.Row that scans canned values into the caller's destinations. It dispatches on the SQL 31// so UpsertExternalCandidate and FindCandidateByEmail get a uuid and UpsertSkill gets a Skill, matching 32// the dbgen scan shapes. 33type fakeRow struct { 34 id uuid.UUID 35 skill bool 36 noRows bool 37 skillID uuid.UUID 38 name string 39} 40 41func (r fakeRow) Scan(dest ...any) error { 42 if r.noRows { 43 return pgx.ErrNoRows 44 } 45 if r.skill { 46 // dbgen UpsertSkill scans id, name, category, embedding, created_at, source, soc_code in order; the 47 // test only needs id and name to be populated, the rest stay zero values. 48 if len(dest) > 0 { 49 if p, ok := dest[0].(*uuid.UUID); ok { 50 *p = r.skillID 51 } 52 } 53 if len(dest) > 1 { 54 if p, ok := dest[1].(*string); ok { 55 *p = r.name 56 } 57 } 58 return nil 59 } 60 if len(dest) > 0 { 61 if p, ok := dest[0].(*uuid.UUID); ok { 62 *p = r.id 63 } 64 } 65 return nil 66} 67 68// fakeDBTX is a dbgen.DBTX that records every Exec and QueryRow and returns canned rows. A new candidate is 69// always created (FindCandidateByEmail and FindCandidateByNameLocation return no rows), then the upsert 70// returns candID, each UpsertSkill returns a fresh skill id, and every Exec is recorded. 71type fakeDBTX struct { 72 candID uuid.UUID 73 calls []recordedCall 74 queryRows []recordedCall 75} 76 77func (f *fakeDBTX) Exec(_ context.Context, sql string, args ...any) (pgconn.CommandTag, error) { 78 f.calls = append(f.calls, recordedCall{sql: sql, args: args}) 79 return pgconn.CommandTag{}, nil 80} 81 82func (f *fakeDBTX) Query(_ context.Context, _ string, _ ...any) (pgx.Rows, error) { 83 return nil, nil 84} 85 86func (f *fakeDBTX) QueryRow(_ context.Context, sql string, args ...any) pgx.Row { 87 f.queryRows = append(f.queryRows, recordedCall{sql: sql, args: args}) 88 switch { 89 case strings.Contains(sql, "name: FindCandidateByEmail"), strings.Contains(sql, "name: FindCandidateByNameLocation"): 90 return fakeRow{noRows: true} // force the new insert path 91 case strings.Contains(sql, "name: UpsertExternalCandidate"): 92 return fakeRow{id: f.candID} 93 case strings.Contains(sql, "name: UpsertSkill"): 94 return fakeRow{skill: true, skillID: uuid.New(), name: "skill"} 95 default: 96 return fakeRow{noRows: true} 97 } 98} 99 100// allArgsContain reports whether any recorded Exec or QueryRow argument, stringified, contains needle. The 101// clearance invariant test uses this to prove the extracted clearance code never reached any query arg. 102func allArgsContain(f *fakeDBTX, needle string) bool { 103 check := func(calls []recordedCall) bool { 104 for _, c := range calls { 105 for _, a := range c.args { 106 if s, ok := a.(string); ok && strings.Contains(strings.ToLower(s), strings.ToLower(needle)) { 107 return true 108 } 109 if s, ok := a.(*string); ok && s != nil && strings.Contains(strings.ToLower(*s), strings.ToLower(needle)) { 110 return true 111 } 112 } 113 } 114 return false 115 } 116 return check(f.calls) || check(f.queryRows) 117} 118 119// fakeExtractor returns a fixed RawExtraction. It carries a clearance code so the test can prove that even 120// when the extractor reports a held clearance, the ingest path never threads it to any clearance column. 121type fakeExtractor struct{ rx extraction.RawExtraction } 122 123func (e fakeExtractor) ExtractResume(_ context.Context, _ string) (extraction.RawExtraction, error) { 124 return e.rx, nil 125} 126 127func (e fakeExtractor) ExtractRequirement(_ context.Context, _ string) (extraction.RawExtraction, error) { 128 return e.rx, nil 129} 130 131func benchPerson() SourcedPerson { 132 return SourcedPerson{ 133 ExternalID: "bench-1", 134 FullName: "Pat Cleared", 135 JobTitle: "Signals Intelligence Analyst", 136 Location: "Honolulu, HI", 137 Skills: []string{"SIGINT", "RMF"}, 138 Years: 8, 139 Emails: []string{"pat@example.com"}, 140 } 141} 142 143// TestIngestBenchRecordEmbedSkip proves invariant 6: a nil vector commits the candidate WITHOUT an 144// embedding write, and a non nil vector writes exactly one UpdateCandidateEmbedding. 145func TestIngestBenchRecordEmbedSkip(t *testing.T) { 146 const upd = "name: UpdateCandidateEmbedding" 147 148 // nil vector: no embedding write at all. 149 f := &fakeDBTX{candID: uuid.New()} 150 ext := fakeExtractor{rx: extraction.RawExtraction{Certifications: []string{"Security+"}, Agencies: []string{"NSA"}}} 151 res, err := IngestBenchRecord(context.Background(), dbgen.New(f), uuid.New(), benchPerson(), ext, nil, "bench_file", "resume.pdf", "client provided cleared bench") 152 if err != nil { 153 t.Fatalf("ingest (nil vector): %v", err) 154 } 155 if !res.New { 156 t.Fatalf("expected a new candidate insert, got enrich") 157 } 158 for _, c := range f.calls { 159 if strings.Contains(c.sql, upd) { 160 t.Fatalf("nil vector must NOT write an embedding, but UpdateCandidateEmbedding ran") 161 } 162 } 163 164 // non nil vector: exactly one embedding write. 165 f2 := &fakeDBTX{candID: uuid.New()} 166 vec := pgvector.NewVector(make([]float32, 384)) 167 if _, err := IngestBenchRecord(context.Background(), dbgen.New(f2), uuid.New(), benchPerson(), ext, &vec, "bench_file", "resume.pdf", "client provided cleared bench"); err != nil { 168 t.Fatalf("ingest (vector): %v", err) 169 } 170 embedWrites := 0 171 for _, c := range f2.calls { 172 if strings.Contains(c.sql, upd) { 173 embedWrites++ 174 } 175 } 176 if embedWrites != 1 { 177 t.Fatalf("non nil vector must write exactly one embedding, got %d", embedWrites) 178 } 179} 180 181// TestIngestBenchRecordClearanceStaysUnknown proves invariant 3: even when the extractor reports a held 182// ts_sci clearance, the ingest path threads it to NO query argument, and the candidate upsert is the 183// hardcoded UpsertExternalCandidate path (whose SQL literally writes clearance_level 'unknown'). The 184// extracted clearance code can therefore never feed scoreClearance. 185func TestIngestBenchRecordClearanceStaysUnknown(t *testing.T) { 186 f := &fakeDBTX{candID: uuid.New()} 187 // The extractor reports an ACTIVE ts_sci clearance with a full scope poly; the ingest path must ignore it. 188 ext := fakeExtractor{rx: extraction.RawExtraction{ 189 ClearanceLevel: "ts_sci", 190 ClearancePoly: "full_scope", 191 ClearanceActive: true, 192 Certifications: []string{"CISSP"}, 193 }} 194 if _, err := IngestBenchRecord(context.Background(), dbgen.New(f), uuid.New(), benchPerson(), ext, nil, "bench_file", "resume.pdf", "client provided cleared bench"); err != nil { 195 t.Fatalf("ingest: %v", err) 196 } 197 198 // Structural proof 1: the candidate was written through the hardcoded upsert, which writes 'unknown'. 199 wroteThroughUpsert := false 200 for _, c := range f.queryRows { 201 if strings.Contains(c.sql, "name: UpsertExternalCandidate") { 202 wroteThroughUpsert = true 203 } 204 } 205 if !wroteThroughUpsert { 206 t.Fatalf("candidate must be written through UpsertExternalCandidate (clearance hardcoded 'unknown')") 207 } 208 209 // Structural proof 2: the extracted clearance code reached NO query argument anywhere. 210 if allArgsContain(f, "ts_sci") { 211 t.Fatalf("extracted clearance code ts_sci must never reach a query argument") 212 } 213 if allArgsContain(f, "full_scope") { 214 t.Fatalf("extracted clearance poly full_scope must never reach a query argument") 215 } 216 217 // Structural proof 3: no clearance-setting query ran at all in the bench ingest path. 218 for _, c := range append(append([]recordedCall{}, f.calls...), f.queryRows...) { 219 if strings.Contains(c.sql, "name: SetCandidateClearanceProvenance") { 220 t.Fatalf("the bench ingest path must never set a clearance provenance") 221 } 222 } 223} 224 225// fakeTagWriter records the candidate_mission_tags upsert params the tag path produced, so the 226// classification is asserted with no DB. 227type fakeTagWriter struct { 228 tags []dbgen.UpsertCandidateMissionTagParams 229 calls int 230} 231 232func (w *fakeTagWriter) upsertCandidateMissionTags(_ context.Context, tags []dbgen.UpsertCandidateMissionTagParams) error { 233 w.calls++ 234 w.tags = append(w.tags, tags...) 235 return nil 236} 237 238// TestTagCandidateMissionsClassifiesRLSScoped proves the tag path: the org is read from the GUC context 239// (never an argument), the headline and skill names are classified with a fixed AliasIndex, and the 240// expected candidate_mission_tag upsert params are produced. The writer is faked, so there is no DB. 241func TestTagCandidateMissionsClassifiesRLSScoped(t *testing.T) { 242 orgID := uuid.New() 243 candID := uuid.New() 244 // A fixed AliasIndex maps the curated alias "ew" to the EW mission code, in addition to the keyword 245 // gazetteer that already classifies "signals intelligence" as SIGINT. 246 idx := missionclass.NewAliasIndex(map[string]string{"ew": "EW"}) 247 ctx := tenant.WithOrg(context.Background(), orgID.String()) 248 249 w := &fakeTagWriter{} 250 err := tagCandidateMissions(ctx, w, candID, "Signals Intelligence Analyst", []string{"electronic warfare", "rmf"}, idx) 251 if err != nil { 252 t.Fatalf("tag: %v", err) 253 } 254 if w.calls != 1 { 255 t.Fatalf("expected one tag write call, got %d", w.calls) 256 } 257 258 got := map[string]dbgen.UpsertCandidateMissionTagParams{} 259 for _, p := range w.tags { 260 if p.OrganizationID != orgID { 261 t.Fatalf("tag org must come from the GUC context, got %v want %v", p.OrganizationID, orgID) 262 } 263 if p.CandidateID != candID { 264 t.Fatalf("tag candidate id wrong: %v", p.CandidateID) 265 } 266 got[p.MissionCode] = p 267 } 268 if _, ok := got["SIGINT"]; !ok { 269 t.Fatalf("headline 'Signals Intelligence Analyst' must classify as SIGINT, got %v", keys(got)) 270 } 271 if _, ok := got["EW"]; !ok { 272 t.Fatalf("skill 'electronic warfare' must classify as EW, got %v", keys(got)) 273 } 274} 275 276// TestTagCandidateMissionsRefusesUnscoped proves the tag path is fail closed: with no org in the context it 277// refuses to run, mirroring RunInTenantTx, so a tag can never be written unscoped. 278func TestTagCandidateMissionsRefusesUnscoped(t *testing.T) { 279 w := &fakeTagWriter{} 280 err := tagCandidateMissions(context.Background(), w, uuid.New(), "Signals Intelligence Analyst", nil, missionclass.AliasIndex{}) 281 if err == nil { 282 t.Fatalf("tagging with no org in context must fail closed") 283 } 284 if w.calls != 0 { 285 t.Fatalf("no tag write may run when unscoped, got %d calls", w.calls) 286 } 287} 288 289func keys(m map[string]dbgen.UpsertCandidateMissionTagParams) []string { 290 out := make([]string, 0, len(m)) 291 for k := range m { 292 out = append(out, k) 293 } 294 return out 295} 296