Janady13/missionmatch / internal/aioe/sqlguard_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/aioe/sqlguard_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/aioe/sqlguard_test.go
Original SHA-256	567d0a5fdfc9f45b2f21300a300080210e9a92c22e60dcf29b32444626e7e8d3
Git blob SHA	6155f290d2eef385cf5cfc1ce3e5cdabfbdcfa86
Reading-copy SHA-256	567d0a5fdfc9f45b2f21300a300080210e9a92c22e60dcf29b32444626e7e8d3

Original source ↗

Every recorded occurrence

These 2 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/aioe/sqlguard_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/aioe/sqlguard_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original

Recovered source transcript

Download complete source text ↓62 lines · 2.3 KB

package aioe

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// TestUpdaterSQLTouchesOnlyAioeTables is the compile side of the isolation guarantee: every SQL
// string in this package may reference ONLY the three aioe tables and the run ledger. The
// connection side (the missionmatch_aioe role being DENIED on eeo and every other table) is proven
// by the integration suite. Together they make the updater physically unable to read protected
// data: no query names another table, and the role could not read one even if a query did.
func TestUpdaterSQLTouchesOnlyAioeTables(t *testing.T) {
	forbidden := []string{
		"eeo.", "candidate_demographics", "candidates", "candidate_evaluations",
		"users", "sessions", "requirements", "slates", "slate_members", "resumes",
		"audit_logs", "organizations",
	}
	files, err := filepath.Glob("*.go")
	if err != nil {
		t.Fatal(err)
	}
	for _, f := range files {
		if strings.HasSuffix(f, "_test.go") {
			continue
		}
		// backfill.go is the ONE file in this package that runs as the APP role under RLS (the
		// alert-sweep pattern), not as the restricted missionmatch_aioe updater role. It legitimately
		// reads the org's own slate_members, candidate_evaluations, vendor_submissions, and
		// bid_outcomes to convert real decision history into outcome_events, all RLS scoped. The
		// updater role guarantee this test enforces is about updater.go, profile.go, and compute.go,
		// the code that runs on the aioe pool. See internal/integration for backfill's RLS proof.
		if f == "backfill.go" {
			continue
		}
		src, err := os.ReadFile(f)
		if err != nil {
			t.Fatal(err)
		}
		text := strings.ToLower(string(src))
		for _, bad := range forbidden {
			// Scan only quoted SQL-ish content lines to avoid false hits in comments.
			for _, line := range strings.Split(text, "\n") {
				trimmed := strings.TrimSpace(line)
				if strings.HasPrefix(trimmed, "//") {
					continue
				}
				if !strings.Contains(trimmed, "select") && !strings.Contains(trimmed, "insert") &&
					!strings.Contains(trimmed, "update") && !strings.Contains(trimmed, "delete") &&
					!strings.Contains(trimmed, "from") && !strings.Contains(trimmed, "join") {
					continue
				}
				if strings.Contains(trimmed, bad) {
					t.Fatalf("%s: forbidden table reference %q in line: %s", f, bad, trimmed)
				}
			}
		}
	}
}