Janady13/missionmatch / internal/integration/graph_bench_integration_test.go

1//go:build integration 2 3package integration 4 5import ( 6 "context" 7 "testing" 8 9 "github.com/google/uuid" 10 11 "github.com/missionworkforce/missionmatch/internal/modules/ai" 12) 13 14// ---------- G4 bench graph helpers (seed via the BYPASSRLS migrator so we can write across tenants) ---------- 15 16// seedCandidateSkill attaches a global skill to a candidate in one org via the migrator. The composite FK 17// (organization_id, candidate_id) means the candidate must already exist in the org; the skill is a global 18// row from seedSkillByName. 19func seedCandidateSkill(t *testing.T, org, candidate, skill uuid.UUID) { 20 t.Helper() 21 if _, err := migrator.Exec(context.Background(), 22 `INSERT INTO candidate_skills (organization_id, candidate_id, skill_id) VALUES ($1,$2,$3) 23 ON CONFLICT (candidate_id, skill_id) DO NOTHING`, 24 org, candidate, skill); err != nil { 25 t.Fatalf("seed candidate skill: %v", err) 26 } 27} 28 29// seedRequirementWithLevel creates a requirement at a given required clearance level for one org and returns 30// its id. It uses the migrator so the seed crosses tenants for the RLS isolation proof. 31func seedRequirementWithLevel(t *testing.T, org uuid.UUID, level string) uuid.UUID { 32 t.Helper() 33 var id uuid.UUID 34 if err := migrator.QueryRow(context.Background(), 35 `INSERT INTO requirements (organization_id, title, required_level, required_poly) 36 VALUES ($1,'Bench Gap Req',$2,'none') RETURNING id`, 37 org, level).Scan(&id); err != nil { 38 t.Fatalf("seed requirement: %v", err) 39 } 40 return id 41} 42 43// seedRequiredSkill attaches a required skill to a requirement in one org via the migrator. 44func seedRequiredSkill(t *testing.T, org, requirement, skill uuid.UUID, mandatory bool) { 45 t.Helper() 46 if _, err := migrator.Exec(context.Background(), 47 `INSERT INTO required_skills (organization_id, requirement_id, skill_id, mandatory) VALUES ($1,$2,$3,$4) 48 ON CONFLICT (requirement_id, skill_id) DO NOTHING`, 49 org, requirement, skill, mandatory); err != nil { 50 t.Fatalf("seed required skill: %v", err) 51 } 52} 53 54// seedEvaluation writes one candidate_evaluations row (the already audited frozen engine decision) for a 55// candidate against a requirement, with the given band. The score columns are filled with valid placeholders 56// (the band is the only field the readiness distribution reads), so the row satisfies the NOT NULL and CHECK 57// constraints. It uses the migrator so the seed crosses tenants for the RLS isolation proof. 58func seedEvaluation(t *testing.T, org, candidate, requirement uuid.UUID, band string) { 59 t.Helper() 60 if _, err := migrator.Exec(context.Background(), 61 `INSERT INTO candidate_evaluations ( 62 organization_id, candidate_id, requirement_id, total_score, band, 63 clearance_score, skills_score, certs_score, customer_score, experience_score, location_score, 64 explanation, model_version 65 ) VALUES ($1,$2,$3,80,$4,100,100,100,100,100,100,'seeded for the readiness distribution test','v1.4.0') 66 ON CONFLICT (organization_id, candidate_id, requirement_id) DO UPDATE SET band = EXCLUDED.band`, 67 org, candidate, requirement, band); err != nil { 68 t.Fatalf("seed evaluation: %v", err) 69 } 70} 71 72// bucketCount returns the published headcount for a bucket label from a skill or gap partition, or minus one 73// when that cell is suppressed or absent (so a caller asserting an exact published count fails loudly). 74func skillBucketCount(rows []ai.BenchSkillRow, bucket string) int { 75 for _, r := range rows { 76 if r.Bucket == bucket { 77 if r.Cell.Suppressed { 78 return -1 79 } 80 return r.Cell.Count 81 } 82 } 83 return -1 84} 85 86func gapBucketCount(rows []ai.BenchGapRow, bucket string) int { 87 for _, r := range rows { 88 if r.Bucket == bucket { 89 if r.Cell.Suppressed { 90 return -1 91 } 92 return r.Cell.Count 93 } 94 } 95 return -1 96} 97 98func bandCount(rows []ai.BenchBandRow, band string) int { 99 for _, r := range rows { 100 if r.Band == band { 101 if r.Cell.Suppressed { 102 return -1 103 } 104 return r.Cell.Count 105 } 106 } 107 return -1 108} 109 110// ---------- C1 bench_skill_coverage ---------- 111 112// TestG4BenchSkillCoverageSuppressesSubK proves bench_skill_coverage live under RLS: it seeds one org with at 113// least k candidates HOLDING a skill (published) and fewer than k LACKING it (the smaller side), then asserts 114// the sub k bucket renders the SuppressionSentinel (never the raw number), and complementary suppression 115// hides at least two cells so the small bucket is never recoverable as the bench size minus the published 116// bucket. The published plus the seeded (suppressed) counts sum to the seeded bench size, the two bucket 117// partition invariant. Org and skill ids are unique per run. 118func TestG4BenchSkillCoverageSuppressesSubK(t *testing.T) { 119 org := seedOrg(t) 120 k := ai.ConfiguredSuppressionThreshold() 121 skill := seedSkillByName(t, "BenchSkill-"+uuid.NewString()) 122 123 // holds: k plus 2 candidates that carry the skill (published regardless of a configured k). 124 holds := k + 2 125 for i := 0; i < holds; i++ { 126 c := seedCandidate(t, org, "secret", "active", true) 127 seedCandidateSkill(t, org, c.ID, skill) 128 } 129 // lacks: 3 candidates with no skill row (below any valid k, which is floored at 5), so it must suppress. 130 lacks := 3 131 for i := 0; i < lacks; i++ { 132 seedCandidate(t, org, "secret", "active", true) 133 } 134 seededTotal := holds + lacks 135 136 rows, err := ai.BenchSkillCoverage(ctxOrg(org), appDB, skill.String(), k) 137 if err != nil { 138 t.Fatalf("bench skill coverage: %v", err) 139 } 140 if len(rows) != 2 { 141 t.Fatalf("the skill coverage must return the two bucket partition, got %d cells", len(rows)) 142 } 143 144 // A two bucket partition with one sub k bucket fully suppresses. Primary suppression hides the small 145 // lacks cell (3), then complementary suppression hides the holds cell too, because the owner knows the 146 // bench size so a lone published holds would let lacks be recovered by subtraction. The privacy correct 147 // outcome for a two bucket partition with ANY sub k cell is that BOTH cells suppress. 148 hiddenCells, totalCount := 0, 0 149 for _, r := range rows { 150 totalCount += r.Cell.Count 151 if r.Cell.Suppressed { 152 hiddenCells++ 153 if ai.RenderCount(r.Cell) != ai.SuppressionSentinel { 154 t.Errorf("a suppressed cell must render the sentinel %q, got %q", ai.SuppressionSentinel, ai.RenderCount(r.Cell)) 155 } 156 } else { 157 t.Errorf("bucket %q published a count, but a two bucket partition with a sub k cell must hide both, the complement is recoverable by subtraction", r.Bucket) 158 } 159 } 160 if hiddenCells != 2 { 161 t.Errorf("a two bucket partition with a sub k cell must hide BOTH cells, got %d hidden", hiddenCells) 162 } 163 // The complete partition's counts sum to the seeded bench size even though both cells render the sentinel. 164 if totalCount != seededTotal { 165 t.Errorf("the two bucket partition counts must sum to the seeded bench size %d, got %d", seededTotal, totalCount) 166 } 167 168 // Re run determinism: the same org and skill yield the same suppression pattern. 169 again, err := ai.BenchSkillCoverage(ctxOrg(org), appDB, skill.String(), k) 170 if err != nil { 171 t.Fatalf("bench skill coverage re run: %v", err) 172 } 173 if len(again) != len(rows) { 174 t.Fatalf("the coverage must be byte stable on a re run, got %d then %d cells", len(rows), len(again)) 175 } 176 for i := range rows { 177 if rows[i].Bucket != again[i].Bucket || rows[i].Cell.Suppressed != again[i].Cell.Suppressed { 178 t.Errorf("the suppression pattern must be deterministic across runs at index %d", i) 179 } 180 } 181} 182 183// TestG4BenchSkillCoverageRLSIsolation proves the skill coverage is RLS scoped: a second org's bench never 184// enters the first org's partition. Each org holds a distinct number of holders of the SAME global skill; 185// org A's coverage must report only org A's holders, never org A plus org B. Org ids are unique per run. 186func TestG4BenchSkillCoverageRLSIsolation(t *testing.T) { 187 orgA, orgB := seedOrg(t), seedOrg(t) 188 k := ai.ConfiguredSuppressionThreshold() 189 skill := seedSkillByName(t, "BenchSkillRLS-"+uuid.NewString()) 190 191 // A two bucket partition only publishes when NEITHER side is a small cell, so each org gets holders AND 192 // at least k lackers (candidates without the skill), making both buckets at or above k so the holds count 193 // publishes. org A: k+5 holders, org B: k+1 holders, each with k lackers. The holds count must reflect 194 // only the querying org's bench, never the other org's. 195 countA := k + 5 196 countB := k + 1 197 lackers := k 198 for i := 0; i < countA; i++ { 199 c := seedCandidate(t, orgA, "secret", "active", true) 200 seedCandidateSkill(t, orgA, c.ID, skill) 201 } 202 for i := 0; i < lackers; i++ { 203 seedCandidate(t, orgA, "secret", "active", true) 204 } 205 for i := 0; i < countB; i++ { 206 c := seedCandidate(t, orgB, "secret", "active", true) 207 seedCandidateSkill(t, orgB, c.ID, skill) 208 } 209 for i := 0; i < lackers; i++ { 210 seedCandidate(t, orgB, "secret", "active", true) 211 } 212 213 rowsA, err := ai.BenchSkillCoverage(ctxOrg(orgA), appDB, skill.String(), k) 214 if err != nil { 215 t.Fatalf("bench skill coverage org A: %v", err) 216 } 217 if got := skillBucketCount(rowsA, "holds"); got != countA { 218 t.Fatalf("org A holds coverage = %d, want %d (a leak of org B's bench?)", got, countA) 219 } 220 221 rowsB, err := ai.BenchSkillCoverage(ctxOrg(orgB), appDB, skill.String(), k) 222 if err != nil { 223 t.Fatalf("bench skill coverage org B: %v", err) 224 } 225 if got := skillBucketCount(rowsB, "holds"); got != countB { 226 t.Fatalf("org B holds coverage = %d, want %d", got, countB) 227 } 228} 229 230// ---------- C2 bench_readiness_distribution ---------- 231 232// TestG4BenchReadinessDistributionSuppressesSubK proves bench_readiness_distribution live under RLS, reading 233// the already audited candidate_evaluations band (never recomputing a score): it seeds one requirement with 234// at least k green evaluations (published) and fewer than k yellow (suppressed), then asserts the sub k band 235// renders the sentinel, complementary suppression hides at least two cells, and the published plus seeded 236// counts sum to the seeded evaluated count. 237func TestG4BenchReadinessDistributionSuppressesSubK(t *testing.T) { 238 org := seedOrg(t) 239 k := ai.ConfiguredSuppressionThreshold() 240 req := seedRequirementWithLevel(t, org, "secret") 241 242 // green: k plus 2 evaluated candidates (published). yellow: 3 (suppressed). red: 0 (a true zero). 243 green := k + 2 244 for i := 0; i < green; i++ { 245 c := seedCandidate(t, org, "secret", "active", true) 246 seedEvaluation(t, org, c.ID, req, "green") 247 } 248 yellow := 3 249 for i := 0; i < yellow; i++ { 250 c := seedCandidate(t, org, "secret", "active", true) 251 seedEvaluation(t, org, c.ID, req, "yellow") 252 } 253 evaluatedTotal := green + yellow 254 255 rows, err := ai.BenchReadinessDistribution(ctxOrg(org), appDB, req.String(), k) 256 if err != nil { 257 t.Fatalf("bench readiness distribution: %v", err) 258 } 259 if len(rows) != 3 { 260 t.Fatalf("the readiness distribution must return the green, yellow, red partition, got %d cells", len(rows)) 261 } 262 263 var hiddenCells, publishedSum int 264 for _, r := range rows { 265 if r.Cell.Suppressed { 266 hiddenCells++ 267 if ai.RenderCount(r.Cell) != ai.SuppressionSentinel { 268 t.Errorf("a suppressed band cell must render the sentinel, got %q", ai.RenderCount(r.Cell)) 269 } 270 } else { 271 publishedSum += r.Cell.Count 272 if r.Band == "green" && r.Cell.Count != green { 273 t.Errorf("the green band must count exactly the %d seeded green evaluations, got %d", green, r.Cell.Count) 274 } 275 } 276 } 277 if got := bandCount(rows, "green"); got != green { 278 t.Errorf("the green band of %d (at or above k=%d) must be published with its exact count, got %d", green, k, got) 279 } 280 // The yellow band of 3 is sub k and must be suppressed; complementary suppression then hides a second cell. 281 if hiddenCells < 2 { 282 t.Errorf("complementary suppression must hide at least 2 band cells when any is hidden, got %d", hiddenCells) 283 } 284 if publishedSum > evaluatedTotal { 285 t.Errorf("the published distribution sum %d must not exceed the seeded evaluated total %d", publishedSum, evaluatedTotal) 286 } 287} 288 289// ---------- C3 bench_gap_for_requirement ---------- 290 291// TestG4BenchGapForRequirementSuppressesSubK proves bench_gap_for_requirement live under RLS as a STRUCTURAL 292// coverage count (never a match score): it seeds a requirement at secret with one required skill, at least k 293// candidates that MEET it (hold secret or higher AND hold the required skill, published), and fewer than k 294// that do NOT meet it (a lower clearance, suppressed), then asserts the sub k bucket renders the sentinel, 295// complementary suppression hides at least two cells, and the published plus seeded counts sum to the seeded 296// bench size. 297func TestG4BenchGapForRequirementSuppressesSubK(t *testing.T) { 298 org := seedOrg(t) 299 k := ai.ConfiguredSuppressionThreshold() 300 req := seedRequirementWithLevel(t, org, "secret") 301 skill := seedSkillByName(t, "GapSkill-"+uuid.NewString()) 302 seedRequiredSkill(t, org, req, skill, true) 303 304 // meets: k plus 2 candidates at secret holding the required skill (published). 305 meets := k + 2 306 for i := 0; i < meets; i++ { 307 c := seedCandidate(t, org, "secret", "active", true) 308 seedCandidateSkill(t, org, c.ID, skill) 309 } 310 // does not meet: 3 candidates at confidential (a lower rank than secret), so the clearance arm fails. 311 doesNotMeet := 3 312 for i := 0; i < doesNotMeet; i++ { 313 seedCandidate(t, org, "confidential", "active", true) 314 } 315 seededTotal := meets + doesNotMeet 316 317 rows, err := ai.BenchGapForRequirement(ctxOrg(org), appDB, req.String(), k) 318 if err != nil { 319 t.Fatalf("bench gap for requirement: %v", err) 320 } 321 if len(rows) != 2 { 322 t.Fatalf("the gap must return the two bucket partition, got %d cells", len(rows)) 323 } 324 325 // A two bucket partition with one sub k bucket fully suppresses: primary hides the small does_not_meet 326 // cell (3), then complementary hides the meets cell too (the owner knows the bench size, so a lone 327 // published meets would let does_not_meet be recovered by subtraction). Both cells suppress. 328 hiddenCells, totalCount := 0, 0 329 for _, r := range rows { 330 totalCount += r.Cell.Count 331 if r.Cell.Suppressed { 332 hiddenCells++ 333 if ai.RenderCount(r.Cell) != ai.SuppressionSentinel { 334 t.Errorf("a suppressed gap cell must render the sentinel, got %q", ai.RenderCount(r.Cell)) 335 } 336 } else { 337 t.Errorf("gap bucket %q published a count, but a two bucket partition with a sub k cell must hide both", r.Bucket) 338 } 339 } 340 if hiddenCells != 2 { 341 t.Errorf("a two bucket gap partition with a sub k cell must hide BOTH cells, got %d hidden", hiddenCells) 342 } 343 if totalCount != seededTotal { 344 t.Errorf("the gap partition counts must sum to the seeded bench size %d, got %d", seededTotal, totalCount) 345 } 346} 347 348// TestG4BenchGapForRequirementRLSIsolation proves the gap count is RLS scoped: org A's gap for ITS OWN 349// requirement never counts org B's bench. The requirement is org A's; under org A's session the gap counts 350// only org A's candidates, and a foreign org requirement id returns an empty (zero) partition under org B. 351func TestG4BenchGapForRequirementRLSIsolation(t *testing.T) { 352 orgA, orgB := seedOrg(t), seedOrg(t) 353 k := ai.ConfiguredSuppressionThreshold() 354 reqA := seedRequirementWithLevel(t, orgA, "secret") 355 356 // org A: k+3 candidates at secret (meet on clearance, no required skills so the skills arm is vacuously 357 // met) AND k candidates at confidential (a lower rank, so they do NOT meet), making both buckets at or 358 // above k so the meets count publishes. org B: k+9 candidates at secret, which must NOT enter org A's gap. 359 countA := k + 3 360 for i := 0; i < countA; i++ { 361 seedCandidate(t, orgA, "secret", "active", true) 362 } 363 for i := 0; i < k; i++ { 364 seedCandidate(t, orgA, "confidential", "active", true) 365 } 366 for i := 0; i < k+9; i++ { 367 seedCandidate(t, orgB, "secret", "active", true) 368 } 369 370 rowsA, err := ai.BenchGapForRequirement(ctxOrg(orgA), appDB, reqA.String(), k) 371 if err != nil { 372 t.Fatalf("bench gap org A: %v", err) 373 } 374 if got := gapBucketCount(rowsA, "meets"); got != countA { 375 t.Fatalf("org A meets count = %d, want %d (a leak of org B's bench?)", got, countA) 376 } 377 378 // Under org B's session, org A's requirement id is invisible (RLS), so the requirement CROSS JOIN yields 379 // no rows and the partition is all zeros, hence suppressed away. The meets bucket is not published. 380 rowsB, err := ai.BenchGapForRequirement(ctxOrg(orgB), appDB, reqA.String(), k) 381 if err != nil { 382 t.Fatalf("bench gap org B against org A's requirement: %v", err) 383 } 384 if got := gapBucketCount(rowsB, "meets"); got != -1 { 385 t.Fatalf("org B must not see org A's requirement gap, expected a suppressed or absent meets cell, got %d", got) 386 } 387} 388