Janady13/missionmatch / internal/integration/mission_tags_integration_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/integration/mission_tags_integration_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/integration/mission_tags_integration_test.go
Original SHA-256	f58d778158fb1e1d7a1ba1537814935d86e5e0b2cd0e457b9a1a920de0a7a15e
Git blob SHA	d10d85380fc0f9e2adfcf16e24fe323892455760
Reading-copy SHA-256	f58d778158fb1e1d7a1ba1537814935d86e5e0b2cd0e457b9a1a920de0a7a15e

Original source ↗

Every recorded occurrence

These 15 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / internal/integration/mission_tags_integration_test.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓95 lines · 3.4 KB

//go:build integration

// Mission tag RLS isolation: a tenant candidate_mission_tag written by org A must be invisible to org B
// and visible to org A, proving the WS7 tenant tag tables (migration 0027) inherit the same row level
// security boundary as every other tenant table. Mission tags are never a scoring input and never reach
// the eeo schema; this test only exercises the tenancy guarantee.
package integration

import (
	"context"
	"testing"

	"github.com/jackc/pgx/v5"

	"github.com/missionworkforce/missionmatch/internal/platform/database/dbgen"
)

func TestCandidateMissionTagRLSIsolation(t *testing.T) {
	orgA, orgB := seedOrg(t), seedOrg(t)
	candA := seedCandidate(t, orgA, "secret", "active", true)

	// As org A, write a SIGINT tag for org A's candidate through the APP pool (RLS scoped write).
	if err := appDB.RunInTenantTx(ctxOrg(orgA), func(ctx context.Context, tx pgx.Tx) error {
		return dbgen.New(tx).UpsertCandidateMissionTag(ctx, dbgen.UpsertCandidateMissionTagParams{
			OrganizationID: orgA, CandidateID: candA.ID, MissionCode: "SIGINT",
			Mechanism: "keyword", Evidence: "signals intelligence",
		})
	}); err != nil {
		t.Fatalf("org A write candidate mission tag: %v", err)
	}

	// Org A lists candidates by the SIGINT mission and MUST see its own tagged candidate.
	var listedA []dbgen.Candidate
	if err := appDB.RunInTenantTx(ctxOrg(orgA), func(ctx context.Context, tx pgx.Tx) error {
		var e error
		listedA, e = dbgen.New(tx).ListCandidatesByMission(ctx, dbgen.ListCandidatesByMissionParams{
			MissionCode: "SIGINT", RowLimit: 1000,
		})
		return e
	}); err != nil {
		t.Fatalf("org A list by mission: %v", err)
	}
	sawA := false
	for _, c := range listedA {
		sawA = sawA || c.ID == candA.ID
	}
	if !sawA {
		t.Fatal("org A must see its own SIGINT tagged candidate")
	}

	// Org B lists candidates by the SAME mission and MUST NOT see org A's candidate (RLS hides the join).
	var listedB []dbgen.Candidate
	if err := appDB.RunInTenantTx(ctxOrg(orgB), func(ctx context.Context, tx pgx.Tx) error {
		var e error
		listedB, e = dbgen.New(tx).ListCandidatesByMission(ctx, dbgen.ListCandidatesByMissionParams{
			MissionCode: "SIGINT", RowLimit: 1000,
		})
		return e
	}); err != nil {
		t.Fatalf("org B list by mission: %v", err)
	}
	for _, c := range listedB {
		if c.ID == candA.ID {
			t.Fatal("ISOLATION BREACH: org B saw org A's SIGINT tagged candidate")
		}
		if c.OrganizationID != orgB {
			t.Fatalf("ISOLATION BREACH: org B saw a foreign tenant candidate %s", c.OrganizationID)
		}
	}

	// Belt and suspenders: a direct count of candidate_mission_tags under org B's session is zero, the
	// default deny shape every tenant table shares.
	var n int
	if err := appDB.RunInTenantTx(ctxOrg(orgB), func(ctx context.Context, tx pgx.Tx) error {
		return tx.QueryRow(ctx,
			"SELECT count(*) FROM candidate_mission_tags WHERE candidate_id = $1", candA.ID).Scan(&n)
	}); err != nil {
		t.Fatalf("org B count tags: %v", err)
	}
	if n != 0 {
		t.Fatalf("RLS breached: org B counted %d of org A's mission tags (want 0)", n)
	}

	// And under org A the same count is exactly one, proving the row is real, not silently dropped.
	if err := appDB.RunInTenantTx(ctxOrg(orgA), func(ctx context.Context, tx pgx.Tx) error {
		return tx.QueryRow(ctx,
			"SELECT count(*) FROM candidate_mission_tags WHERE candidate_id = $1", candA.ID).Scan(&n)
	}); err != nil {
		t.Fatalf("org A count tags: %v", err)
	}
	if n != 1 {
		t.Fatalf("org A should count exactly 1 of its own mission tags, got %d", n)
	}
}