Janady13/missionmatch / internal/integration/pertenant_isolation_integration_test.go

1//go:build integration 2 3package integration 4 5import ( 6 "context" 7 "errors" 8 "os" 9 "testing" 10 "time" 11 12 "github.com/google/uuid" 13 "github.com/jackc/pgx/v5" 14 "github.com/jackc/pgx/v5/pgxpool" 15 16 "github.com/missionworkforce/missionmatch/internal/platform/database/dbgen" 17 "github.com/missionworkforce/missionmatch/internal/platform/directory" 18 "github.com/missionworkforce/missionmatch/internal/platform/identity" 19 "github.com/missionworkforce/missionmatch/internal/platform/secrets" 20 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 21 "github.com/missionworkforce/missionmatch/internal/platform/tenantpool" 22) 23 24// perTenantEnv holds the staging DSNs for the per_tenant validation. The test skips when they are unset. 25// 26// MM_CP_APP_DSN / MM_CP_MIGRATOR_DSN control plane (identity, directory) 27// MM_TA_MIGRATOR_DSN / MM_TB_MIGRATOR_DSN the two tenant databases (for seeding) 28// MM_TENANT_DSN_TENANT_ALPHA / _BETA the app DSNs the secrets resolver returns (the routing path) 29type perTenantEnv struct { 30 cpApp, cpMig, taMig, tbMig string 31} 32 33func loadPerTenantEnv(t *testing.T) perTenantEnv { 34 t.Helper() 35 e := perTenantEnv{ 36 cpApp: os.Getenv("MM_CP_APP_DSN"), 37 cpMig: os.Getenv("MM_CP_MIGRATOR_DSN"), 38 taMig: os.Getenv("MM_TA_MIGRATOR_DSN"), 39 tbMig: os.Getenv("MM_TB_MIGRATOR_DSN"), 40 } 41 if e.cpApp == "" || e.cpMig == "" || e.taMig == "" || e.tbMig == "" { 42 t.Skip("per_tenant DSNs not set (MM_CP_APP_DSN, MM_CP_MIGRATOR_DSN, MM_TA_MIGRATOR_DSN, MM_TB_MIGRATOR_DSN); skipping per_tenant validation") 43 } 44 if os.Getenv("MM_TENANT_DSN_TENANT_ALPHA") == "" || os.Getenv("MM_TENANT_DSN_TENANT_BETA") == "" { 45 t.Skip("per_tenant secret env DSNs not set (MM_TENANT_DSN_TENANT_ALPHA, MM_TENANT_DSN_TENANT_BETA)") 46 } 47 return e 48} 49 50func openPool(t *testing.T, dsn string) *pgxpool.Pool { 51 t.Helper() 52 p, err := pgxpool.New(context.Background(), dsn) 53 if err != nil { 54 t.Fatalf("pool %s: %v", dsn, err) 55 } 56 t.Cleanup(p.Close) 57 return p 58} 59 60// TestPerTenantPhysicalIsolation is the core proof of the database per tenant model: a request 61// authenticated as tenant A, run through the REAL routing stack (the directory, the secrets resolver, and 62// the bounded pool manager), reads only tenant A's rows, because tenant A's pool is bound to a DIFFERENT 63// physical database than tenant B's. There is no cross database query path, so the isolation does not 64// depend on RLS (RLS is verified separately, inside each tenant database, as defense in depth). 65func TestPerTenantPhysicalIsolation(t *testing.T) { 66 env := loadPerTenantEnv(t) 67 ctx := context.Background() 68 69 cpMig := openPool(t, env.cpMig) 70 cpApp := openPool(t, env.cpApp) 71 taMig := openPool(t, env.taMig) 72 tbMig := openPool(t, env.tbMig) 73 74 orgA, orgB := uuid.New(), uuid.New() 75 userA, userB := uuid.New(), uuid.New() 76 77 // 1. Seed identity in the CONTROL PLANE: two orgs, an owner each, and the directory rows mapping each 78 // org to its tenant database (secret_ref is the env key the resolver maps to the tenant app DSN). 79 seedOrgUser(t, cpMig, orgA, userA, "Alpha Org", "alpha-"+orgA.String()[:8]) 80 seedOrgUser(t, cpMig, orgB, userB, "Beta Org", "beta-"+orgB.String()[:8]) 81 dir := directory.New(cpMig) 82 mustRegister(t, dir, orgA, "tenant_alpha", "tenant_alpha") 83 mustRegister(t, dir, orgB, "tenant_beta", "tenant_beta") 84 t.Cleanup(func() { 85 _, _ = cpMig.Exec(context.Background(), "DELETE FROM tenant_directory WHERE organization_id IN ($1,$2)", orgA, orgB) 86 }) 87 88 // 2. Seed each tenant database: the org and owner (so business foreign keys resolve), then ONE distinct 89 // candidate per tenant. This is the onboarding identity seed (A5) plus the tenant's own data. 90 if _, err := identity.SeedTenant(ctx, cpMig, taMig, orgA); err != nil { 91 t.Fatalf("seed identity into tenant_alpha: %v", err) 92 } 93 if _, err := identity.SeedTenant(ctx, cpMig, tbMig, orgB); err != nil { 94 t.Fatalf("seed identity into tenant_beta: %v", err) 95 } 96 seedCandidateInto(t, taMig, orgA, "Alpha Analyst") 97 seedCandidateInto(t, tbMig, orgB, "Beta Builder") 98 99 // 3. Build the REAL routing stack the API uses in per_tenant mode: the env secrets resolver, the 100 // directory read by the app pool, and the bounded pool manager, wrapped as a routing tenant.DB. 101 sec, err := secrets.New("env", time.Minute) 102 if err != nil { 103 t.Fatalf("secrets: %v", err) 104 } 105 mgr := tenantpool.New(directory.New(cpApp), sec, tenantpool.Config{MaxPools: 8, MaxConnsPerPool: 4, IdleEvict: time.Minute}) 106 t.Cleanup(mgr.Close) 107 routing := tenant.NewRouting(mgr) 108 109 // 4. The proof: tenant A's request reads only Alpha Analyst; tenant B's reads only Beta Builder. 110 aNames := listCandidateNames(t, routing, orgA) 111 bNames := listCandidateNames(t, routing, orgB) 112 113 if !contains(aNames, "Alpha Analyst") { 114 t.Fatalf("tenant A must see its own candidate, got %v", aNames) 115 } 116 if contains(aNames, "Beta Builder") { 117 t.Fatalf("ISOLATION BREACH: tenant A saw tenant B's candidate (%v)", aNames) 118 } 119 if !contains(bNames, "Beta Builder") { 120 t.Fatalf("tenant B must see its own candidate, got %v", bNames) 121 } 122 if contains(bNames, "Alpha Analyst") { 123 t.Fatalf("ISOLATION BREACH: tenant B saw tenant A's candidate (%v)", bNames) 124 } 125 t.Logf("physical isolation proven: A=%v (own database tenant_alpha) B=%v (own database tenant_beta)", aNames, bNames) 126 127 // 5. An unknown organization is a typed denial through the real manager, never a fallback. 128 if _, _, err := mgr.Acquire(ctx, uuid.New()); !errors.Is(err, directory.ErrUnknownTenant) { 129 t.Fatalf("an unknown org must be ErrUnknownTenant through the manager, got %v", err) 130 } 131 // 6. A request with no validated org reaches zero data (fail closed) even on the routing DB. 132 if err := routing.RunInTenantTx(context.Background(), func(context.Context, pgx.Tx) error { return nil }); !errors.Is(err, tenant.ErrNoTenant) { 133 t.Fatalf("a request with no validated org must fail closed, got %v", err) 134 } 135} 136 137func seedOrgUser(t *testing.T, cp *pgxpool.Pool, org, user uuid.UUID, name, slug string) { 138 t.Helper() 139 ctx := context.Background() 140 if _, err := cp.Exec(ctx, "INSERT INTO organizations (id, name, slug) VALUES ($1,$2,$3) ON CONFLICT (id) DO NOTHING", org, name, slug); err != nil { 141 t.Fatalf("seed org: %v", err) 142 } 143 if _, err := cp.Exec(ctx, 144 "INSERT INTO users (id, organization_id, email, full_name, role, status) VALUES ($1,$2,$3,$4,'owner','active') ON CONFLICT (organization_id, id) DO NOTHING", 145 user, org, slug+"@example.com", name+" Owner"); err != nil { 146 t.Fatalf("seed user: %v", err) 147 } 148} 149 150func mustRegister(t *testing.T, dir *directory.Directory, org uuid.UUID, dbName, secretRef string) { 151 t.Helper() 152 if err := dir.Register(context.Background(), directory.TenantConn{ 153 OrganizationID: org, DBName: dbName, Host: "100.94.8.94", Port: 5432, 154 SecretRef: secretRef, Status: directory.StatusActive, Cloud: "local", 155 }); err != nil { 156 t.Fatalf("register %s: %v", dbName, err) 157 } 158} 159 160func seedCandidateInto(t *testing.T, pool *pgxpool.Pool, org uuid.UUID, name string) { 161 t.Helper() 162 if _, err := dbgen.New(pool).CreateCandidate(context.Background(), dbgen.CreateCandidateParams{ 163 OrganizationID: org, FullName: name, ClearanceLevel: "secret", ClearancePoly: "none", 164 ClearanceStatus: "active", Available: true, 165 }); err != nil { 166 t.Fatalf("seed candidate %q: %v", name, err) 167 } 168} 169 170func listCandidateNames(t *testing.T, db *tenant.DB, org uuid.UUID) []string { 171 t.Helper() 172 var names []string 173 err := db.RunInTenantTx(tenant.WithOrg(context.Background(), org.String()), func(ctx context.Context, tx pgx.Tx) error { 174 rows, err := tx.Query(ctx, "SELECT full_name FROM candidates ORDER BY full_name") 175 if err != nil { 176 return err 177 } 178 defer rows.Close() 179 for rows.Next() { 180 var n string 181 if err := rows.Scan(&n); err != nil { 182 return err 183 } 184 names = append(names, n) 185 } 186 return rows.Err() 187 }) 188 if err != nil { 189 t.Fatalf("list candidates for %s: %v", org, err) 190 } 191 return names 192} 193 194func contains(xs []string, s string) bool { 195 for _, x := range xs { 196 if x == s { 197 return true 198 } 199 } 200 return false 201} 202