Janady13/missionmatch / internal/platform/scrub/fixtures_test.go

1package scrub 2 3import ( 4 "errors" 5 "fmt" 6 "strings" 7 "testing" 8) 9 10// GATE 2, THE EXTERNAL BOUNDARY FIXTURES. The directive requires that a fixture containing a CANDIDATE ROW 11// and a fixture of TENANT UPLOADED DOCUMENT TEXT each FAIL the scrub suite when placed ANYWHERE in an 12// external bound payload. 13// 14// These fixtures are realistic rather than convenient, and writing them that way is what exposed the gap 15// they now guard. A candidate row carrying an email is trivially caught by a marker scan and proves nothing. 16// The interesting cases are the two that a careful person would actually produce and still get wrong: 17// 18// a candidate row with the identifiers already stripped, which is still one named cleared human 19// a customer's own solicitation text, which contains no personal data at all 20// 21// Neither was caught by the original gate. The first is private because of WHAT IT IS, the second because 22// of WHERE IT CAME FROM, and no pattern match on the bytes can recover either fact once a caller has 23// flattened it into a string. That is why provenance is now the primary control. 24 25// A candidate row as the product actually holds one, identifiers present. 26const candidateRowWithIdentifiers = `{"id":"7c9e6679-7425-40de-944b-e07fc1f90ae7","full_name":"Dana Whitfield",` + 27 `"email":"dana.whitfield@example.com","phone":"(703) 555-0142","clearance":"TS/SCI",` + 28 `"skills":["Kubernetes","Splunk","Python"],"years_experience":12}` 29 30// The same person after a caller has helpfully removed the obvious identifiers. 31const candidateRowStripped = `Dana Whitfield, TS/SCI with CI polygraph, 12 years, Reston Virginia, ` + 32 `Kubernetes and Splunk and Python, currently available, last screened for the PACAF cyber task order` 33 34// An excerpt from a customer's own solicitation package. No personal data whatsoever. 35const tenantDocumentText = `SECTION C.3.2 PERFORMANCE WORK STATEMENT. The contractor shall provide ` + 36 `continuous monitoring of the enclave in accordance with the customer's internal baseline dated ` + 37 `14 March, including the two unadvertised sites identified in Attachment J-7.` 38 39// insertions places a fixture at the start, the middle, and the end of an otherwise innocuous payload, so 40// "anywhere in the payload" is tested rather than assumed. 41func insertions(fixture string) map[string]string { 42 head := `{"task":"normalize","notice":"Solicitation W912DY-26-R-0001 seeks cybersecurity support."` 43 tail := `,"model":"llama3.1:8b"}` 44 return map[string]string{ 45 "at the start": fixture + head + tail, 46 "in the middle": head + `,"context":"` + fixture + `"` + tail, 47 "at the end": head + tail + fixture, 48 } 49} 50 51// A candidate row declared with its TRUE provenance is refused outright, whatever class it claims. 52func TestCandidateRowIsRefusedByProvenance(t *testing.T) { 53 classes := []EgressClass{ClassPublicKnowledge, ClassPublicDataSummary, ClassOntologySuggest, ClassRequirementNormalize} 54 for _, class := range classes { 55 for where, payload := range insertions(candidateRowStripped) { 56 err := AllowEgress([]Provenance{ProvenanceTenantRecord}, class, []byte(payload)) 57 if err == nil { 58 t.Fatalf("class %s, candidate row %s: a tenant record left the local plane", class, where) 59 } 60 if !errors.Is(err, ErrEgressProvenanceForbidden) { 61 t.Fatalf("class %s, candidate row %s: refused for the wrong reason: %v", class, where, err) 62 } 63 } 64 } 65} 66 67// Tenant uploaded document text is private because of its PROVENANCE. It contains no personal data and must 68// still never leave, because the class permitting external normalization exists for PUBLIC notice text only. 69// No content scan could tell these two apart; only the source can. 70func TestTenantUploadedDocumentTextIsRefused(t *testing.T) { 71 for where, payload := range insertions(tenantDocumentText) { 72 err := AllowEgress([]Provenance{ProvenanceTenantUpload}, ClassRequirementNormalize, []byte(payload)) 73 if err == nil { 74 t.Fatalf("tenant document %s: a customer's own solicitation text left the local plane", where) 75 } 76 if !errors.Is(err, ErrEgressProvenanceForbidden) { 77 t.Fatalf("tenant document %s: refused for the wrong reason: %v", where, err) 78 } 79 } 80} 81 82// The BACKSTOP still works: a caller that MISDECLARES a full candidate row as public cache data is caught 83// by the marker scan on the uuid, the email, and the phone. 84func TestBackstopCatchesAMisdeclaredCandidateRow(t *testing.T) { 85 for where, payload := range insertions(candidateRowWithIdentifiers) { 86 err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(payload)) 87 if err == nil { 88 t.Fatalf("candidate row %s: a misdeclared candidate row passed the content backstop", where) 89 } 90 if !errors.Is(err, ErrEgressForbidden) { 91 t.Fatalf("candidate row %s: refused for the wrong reason: %v", where, err) 92 } 93 } 94} 95 96// THE HONEST LIMIT OF THE BACKSTOP, asserted so nobody later mistakes it for a guarantee. 97// 98// A caller that misdeclares a STRIPPED candidate row as public cache data is NOT caught, because there is 99// no uuid, no email, and no phone in the bytes, and prose about a cleared engineer is not distinguishable 100// from prose about a contract by pattern matching. This is documented deliberately rather than left for 101// someone to discover, and it is the entire argument for provenance being the primary control: content 102// inspection cannot recover a fact that only the caller ever knew. 103func TestBackstopLimitIsKnownAndDocumented(t *testing.T) { 104 payload := insertions(candidateRowStripped)["in the middle"] 105 err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(payload)) 106 if err != nil { 107 t.Fatalf("the backstop now catches a misdeclared stripped row, which is an improvement but makes "+ 108 "this test wrong. Replace it with a real assertion rather than deleting the coverage: %v", err) 109 } 110 t.Log("KNOWN AND ACCEPTED: a MISDECLARED stripped candidate row passes the content backstop. " + 111 "Provenance is the control that prevents it and is enforced by the tests above.") 112} 113 114// Every provenance outside the permitted two fails closed, including the empty one and one that does not 115// exist. The vocabulary is closed for the same reason the intent registry is. 116func TestProvenanceVocabularyIsClosed(t *testing.T) { 117 for _, prov := range []Provenance{ProvenanceTenantUpload, ProvenanceTenantRecord, Provenance("something_new"), Provenance("")} { 118 if err := AllowEgress([]Provenance{prov}, ClassRequirementNormalize, []byte("entirely harmless public text")); err == nil { 119 t.Fatalf("provenance %q was permitted; the vocabulary must be closed", prov) 120 } 121 } 122} 123 124// The gate must still permit what it exists to permit, or the boundary is just an outage. 125func TestGenuinelyPublicNoticeTextIsPermitted(t *testing.T) { 126 public := `{"task":"normalize","notice":"Solicitation W912DY-26-R-0001, PACAF Cyber Systems Operations ` + 127 `Support, NAICS 541512, response due 15 September 2026, Joint Base Pearl Harbor Hickam."}` 128 if err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(public)); err != nil { 129 t.Fatalf("the gate refused a genuinely public notice, making the external lane unusable: %v", err) 130 } 131 if err := AllowEgress([]Provenance{ProvenanceCuratedCard}, ClassPublicKnowledge, []byte("NYC Local Law 144 requires a bias audit.")); err != nil { 132 t.Fatalf("the gate refused a curated knowledge card: %v", err) 133 } 134} 135 136// POSITIVE CONTROL on the suite itself, required by the continuation protocol: prove the gate is actually 137// running, or a suite that silently tests nothing would report the boundary as sound. 138func TestSuitePositiveControl(t *testing.T) { 139 if err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte("")); err != nil { 140 t.Fatalf("positive control broken: an empty public payload should pass, got %v", err) 141 } 142 if err := AllowEgress([]Provenance{ProvenancePublicCache}, EgressClass("SOMETHING_MADE_UP"), []byte("harmless")); err == nil { 143 t.Fatal("positive control broken: an unknown egress class was permitted, so the gate is not running") 144 } 145} 146 147// A readable inventory of what the boundary refuses and why, printed on failure so the reason is legible. 148func TestBoundaryInventory(t *testing.T) { 149 cases := []struct { 150 name string 151 prov Provenance 152 payload string 153 refuse bool 154 }{ 155 {"candidate row, declared tenant record", ProvenanceTenantRecord, candidateRowWithIdentifiers, true}, 156 {"stripped candidate row, declared tenant record", ProvenanceTenantRecord, candidateRowStripped, true}, 157 {"tenant document, declared tenant upload", ProvenanceTenantUpload, tenantDocumentText, true}, 158 {"candidate row MISdeclared as public cache", ProvenancePublicCache, candidateRowWithIdentifiers, true}, 159 {"public notice, declared public cache", ProvenancePublicCache, "Solicitation W912DY seeks cyber support.", false}, 160 {"public notice, NO provenance declared", Provenance(""), "Solicitation W912DY seeks cyber support.", true}, 161 } 162 var report strings.Builder 163 failed := false 164 for _, c := range cases { 165 err := AllowEgress([]Provenance{c.prov}, ClassRequirementNormalize, []byte(c.payload)) 166 got := err != nil 167 status := "ok" 168 if got != c.refuse { 169 status = "WRONG" 170 failed = true 171 } 172 report.WriteString(fmt.Sprintf(" %-48s refused=%-5v want=%-5v %s\n", c.name, got, c.refuse, status)) 173 } 174 if failed { 175 t.Fatalf("external boundary inventory:\n%s", report.String()) 176 } 177} 178 179// ONE TENANT ELEMENT POISONS THE WHOLE PAYLOAD. This is the semantics that matter once a composer draws on 180// more than one row: a public notice with one paragraph of a customer's performance work statement pasted 181// into it IS a customer's performance work statement, and a gate that permitted it because most of the 182// payload was public would be worse than useless. 183func TestOneTenantElementRefusesTheWholePayload(t *testing.T) { 184 mixed := []Provenance{ProvenancePublicCache, ProvenancePublicCache, ProvenanceTenantUpload} 185 payload := []byte("a mostly public notice with one private paragraph folded in") 186 err := AllowEgress(mixed, ClassRequirementNormalize, payload) 187 if err == nil { 188 t.Fatal("a payload composed from two public rows and ONE tenant upload was allowed to leave") 189 } 190 if !errors.Is(err, ErrEgressProvenanceForbidden) { 191 t.Fatalf("refused for the wrong reason: %v", err) 192 } 193 // And the all public case must still pass, or the rule is just an outage. 194 if err := AllowEgress([]Provenance{ProvenancePublicCache, ProvenanceCuratedCard}, ClassRequirementNormalize, payload); err != nil { 195 t.Fatalf("an all permitted set was refused: %v", err) 196 } 197} 198 199// AN EMPTY PROVENANCE SET IS REFUSED. Silence is not permission: a payload nobody can account for is 200// exactly the payload that should not leave, and before this an empty set would have passed every loop. 201func TestEmptyProvenanceSetIsRefused(t *testing.T) { 202 if err := AllowEgress(nil, ClassRequirementNormalize, []byte("harmless public text")); err == nil { 203 t.Fatal("a payload with NO element provenance was allowed to leave") 204 } 205 if err := AllowEgress([]Provenance{}, ClassRequirementNormalize, []byte("harmless public text")); !errors.Is(err, ErrEgressNoProvenance) { 206 t.Fatalf("an empty set was refused for the wrong reason: %v", err) 207 } 208} 209