test(visibility): black-box invariant — hidden library absent from every surface
Adds the permanent auditor for per-user library visibility: a restricted user with a hidden library sees none of its items on any media-returning surface (media list, search, dashboard sections, series, facets, OPDS device catalog, collection detail, scoped/detail access). RED now, on exactly the surfaces the audit predicted: the dashboard section queries (GetNotStartedItems / GetRecentlyAddedItems / GetCollectionItemsForDashboard et al.) never carried the visible_library_ids clause, and the collection-detail endpoint (mobile View All) exposes the full section query results. Clause-protected surfaces (media list, search, series) pass, proving the test itself isn't a false positive. Implementation-agnostic on purpose: it asserts the user-level invariant through the public API, so it stays valid when RLS replaces the per-query clauses and catches any future regression regardless of how the code is written. Also pins: hidden library_id=403 (never silently passed), item detail denial, and that the hide is USER-scoped (admin still sees the hidden library). Test-lesson encoded: cleanup ordering is LIFO — the pool Close must be registered BEFORE fixture cleanups, or library deletes run against a closed pool and fail silently into ignored errors.
This commit is contained in:
John O'Keefe committed
1 parent
2b122f2481
commit
3dcb794032
1 file changed
+251
@@ -0,0 +1,251 @@
|
||||
package main
|
||||
|
||||
// rls_visibility_test.go — the PERMANENT black-box auditor for per-user
|
||||
// library visibility (plan §3, ~/.opencode/plan/server-rls-library-visibility.md).
|
||||
//
|
||||
// The invariant, in one sentence: a user with library H hidden sees
|
||||
// NOTHING from H, on ANY media-returning surface.
|
||||
//
|
||||
// Implementation-agnostic ON PURPOSE: it asserts the user-level
|
||||
// invariant through the public API only, so it stays valid when RLS
|
||||
// replaces the per-query visible_library_ids clauses and catches any
|
||||
// future regression regardless of how the code is written.
|
||||
//
|
||||
// Auth failures fail DIFFERENTLY than content: an authorized fetch that
|
||||
// returns 200-but-empty must never be confused with a 401.
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"github.com/jackc/pgx/v5/pgtype"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"bookhoard/internal/database"
|
||||
)
|
||||
|
||||
// rlsFixture is the shared data for the invariant test.
|
||||
type rlsFixture struct {
|
||||
marker string // unique marker shared by every fixture title
|
||||
hiddenLibID string // library hidden from the restricted user
|
||||
visibleLibID string // control library (visible to everyone)
|
||||
hiddenIDs []string // media item ids inside the hidden library
|
||||
hiddenBooks []string // their titles (markers)
|
||||
controlBook string // title of the visible control book
|
||||
}
|
||||
|
||||
func setupRlsFixture(t *testing.T, setup *TestServerSetup) (UserTestData, string, *rlsFixture) {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
|
||||
admin := createTestUserOnce(t, setup.DB) // shared admin — never edited (§1.8)
|
||||
restricted := createRegularUserOnce(t, setup.DB)
|
||||
token := loginUserWithCredentials(t, setup.Server, restricted.Email, restricted.Password)
|
||||
require.NotEmpty(t, token, "restricted user login must succeed")
|
||||
|
||||
marker := fmt.Sprintf("RLSMARKER%x", time.Now().UnixNano())
|
||||
hiddenLib := createLibraryDirect(t, setup.DB, admin.ID, marker+"-hidden-lib", "ebooks")
|
||||
visibleLib := createLibraryDirect(t, setup.DB, admin.ID, marker+"-visible-lib", "ebooks")
|
||||
// createLibraryDirect does not self-clean (mirrors its other callers):
|
||||
// media items + visibility rows cascade with the library delete.
|
||||
hiddenLibPG := uuidToPGType(uuid.MustParse(hiddenLib))
|
||||
visibleLibPG := uuidToPGType(uuid.MustParse(visibleLib))
|
||||
t.Cleanup(func() {
|
||||
_ = setup.DB.DeleteLibrary(context.Background(), hiddenLibPG)
|
||||
_ = setup.DB.DeleteLibrary(context.Background(), visibleLibPG)
|
||||
})
|
||||
|
||||
fix := &rlsFixture{
|
||||
marker: marker,
|
||||
hiddenLibID: hiddenLib,
|
||||
visibleLibID: visibleLib,
|
||||
hiddenBooks: []string{marker + "-hidden-one", marker + "-hidden-two"},
|
||||
controlBook: marker + "-visible-control",
|
||||
}
|
||||
|
||||
createBook := func(libID, title string) string {
|
||||
media, err := setup.DB.CreateMediaItem(ctx, database.CreateMediaItemParams{
|
||||
LibraryID: uuidToPGType(uuid.MustParse(libID)),
|
||||
Title: title,
|
||||
Authors: []string{"RLS Invariant Author"},
|
||||
FilePath: fmt.Sprintf("/tmp/%s.epub", title),
|
||||
FileSize: pgtype.Int8{Int64: 1024, Valid: true},
|
||||
MimeType: pgtype.Text{String: "application/epub+zip", Valid: true},
|
||||
})
|
||||
require.NoError(t, err, "should create test media item")
|
||||
id, err := uuid.FromBytes(media.ID.Bytes[0:16])
|
||||
require.NoError(t, err)
|
||||
return id.String()
|
||||
}
|
||||
for _, title := range fix.hiddenBooks {
|
||||
fix.hiddenIDs = append(fix.hiddenIDs, createBook(hiddenLib, title))
|
||||
}
|
||||
createBook(visibleLib, fix.controlBook)
|
||||
|
||||
// Hide the hidden library from the restricted user — the exact
|
||||
// write the admin visibility route performs, via the same sqlc query.
|
||||
_, err := setup.DB.SetLibraryVisibility(ctx, database.SetLibraryVisibilityParams{
|
||||
UserID: uuidToPGType(restricted.ID),
|
||||
LibraryID: uuidToPGType(uuid.MustParse(hiddenLib)),
|
||||
IsVisible: false,
|
||||
})
|
||||
require.NoError(t, err, "should hide library from restricted user")
|
||||
|
||||
return restricted, token, fix
|
||||
}
|
||||
|
||||
func rlsGet(t *testing.T, ts *httptest.Server, token, path string) (int, string) {
|
||||
t.Helper()
|
||||
req, _ := http.NewRequest(http.MethodGet, ts.URL+path, nil)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = resp.Body.Close() }()
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
require.NoError(t, err)
|
||||
return resp.StatusCode, string(body)
|
||||
}
|
||||
|
||||
// TestRlsInvariant_NoHiddenContentOnAnySurface — the auditor itself.
|
||||
func TestRlsInvariant_NoHiddenContentOnAnySurface(t *testing.T) {
|
||||
setup := setupTestServer(t)
|
||||
// Cleanup is LIFO: registering Close FIRST makes it run LAST, after
|
||||
// the fixture's library deletes (a closed pool would swallow them).
|
||||
t.Cleanup(func() { _ = setup.Close() })
|
||||
restricted, restrictedToken, fix := setupRlsFixture(t, setup)
|
||||
|
||||
adminToken := setup.Token
|
||||
|
||||
// Media-returning surfaces. control=true: the visible control book
|
||||
// must appear (proves the fetch is authorized AND lists books).
|
||||
surfaces := []struct {
|
||||
name string
|
||||
path string
|
||||
control bool
|
||||
adminSeesHid bool // admin is expected to see the hidden books here
|
||||
}{
|
||||
{"media items list", "/api/media-items", true, true},
|
||||
{"media items search", "/api/media-items/search?query=" + fix.marker, true, true},
|
||||
{"dashboard sections", "/api/dashboard/sections", true, true},
|
||||
{"series", "/api/series", false, false},
|
||||
{"media facets", "/api/media-items/facets", false, false},
|
||||
}
|
||||
|
||||
for _, tc := range surfaces {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
// RESTRICTED: authorized, and H's markers appear NOWHERE.
|
||||
status, body := rlsGet(t, setup.Server, restrictedToken, tc.path)
|
||||
require.Equal(t, http.StatusOK, status,
|
||||
"authorized fetch must succeed — an auth failure here is a broken test, not a pass")
|
||||
assert.NotContains(t, body, fix.hiddenBooks[0], "hidden library book leaked")
|
||||
assert.NotContains(t, body, fix.hiddenBooks[1], "hidden library book leaked")
|
||||
assert.NotContains(t, body, fix.hiddenLibID, "hidden library id leaked")
|
||||
if tc.control {
|
||||
assert.Contains(t, body, fix.controlBook,
|
||||
"control book missing — surface returned nothing; do not mistake this for a pass")
|
||||
}
|
||||
|
||||
// ADMIN: the hide is USER-SCOPED, not global — the admin
|
||||
// must still see the hidden library's books.
|
||||
aStatus, aBody := rlsGet(t, setup.Server, adminToken, tc.path)
|
||||
require.Equal(t, http.StatusOK, aStatus)
|
||||
if tc.adminSeesHid {
|
||||
assert.Contains(t, aBody, fix.hiddenBooks[0],
|
||||
"hide must be per-user: admin should still see the hidden library")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
t.Run("collection detail (View All amplification)", func(t *testing.T) {
|
||||
// The mobile View All surface: GET /api/collections/{system id}
|
||||
// returns the FULL section query results (limit-1000 branch).
|
||||
status, body := rlsGet(t, setup.Server, restrictedToken, "/api/dashboard/sections")
|
||||
require.Equal(t, http.StatusOK, status)
|
||||
var resp struct {
|
||||
Sections []struct {
|
||||
ID string `json:"id"`
|
||||
CollectionID string `json:"collection_id"`
|
||||
} `json:"sections"`
|
||||
}
|
||||
require.NoError(t, json.Unmarshal([]byte(body), &resp), "sections should decode: %s", body)
|
||||
recentlyAdded := ""
|
||||
for _, sec := range resp.Sections {
|
||||
if sec.ID == "Recently Added" {
|
||||
recentlyAdded = sec.CollectionID // the real handle (view_all_url uses it)
|
||||
}
|
||||
}
|
||||
require.NotEmpty(t, recentlyAdded, "Recently Added section should exist")
|
||||
|
||||
cStatus, cBody := rlsGet(t, setup.Server, restrictedToken, "/api/collections/"+recentlyAdded)
|
||||
require.Equal(t, http.StatusOK, cStatus)
|
||||
assert.NotContains(t, cBody, fix.hiddenBooks[0], "hidden library book leaked via collection detail")
|
||||
assert.NotContains(t, cBody, fix.hiddenBooks[1], "hidden library book leaked via collection detail")
|
||||
})
|
||||
|
||||
t.Run("scoped library_id=hidden is 403, never silently passed", func(t *testing.T) {
|
||||
status, _ := rlsGet(t, setup.Server, restrictedToken, "/api/media-items?library_id="+fix.hiddenLibID)
|
||||
assert.Equal(t, http.StatusForbidden, status,
|
||||
"explicit hidden library_id must 403 per the family-lens doctrine")
|
||||
|
||||
aStatus, aBody := rlsGet(t, setup.Server, adminToken, "/api/media-items?library_id="+fix.hiddenLibID)
|
||||
require.Equal(t, http.StatusOK, aStatus)
|
||||
assert.Contains(t, aBody, fix.hiddenBooks[0], "admin should see the hidden library when scoped")
|
||||
})
|
||||
|
||||
t.Run("hidden item detail denied to restricted, open to admin", func(t *testing.T) {
|
||||
for _, id := range fix.hiddenIDs {
|
||||
status, body := rlsGet(t, setup.Server, restrictedToken, "/api/media-items/"+id)
|
||||
assert.NotEqual(t, http.StatusOK, status,
|
||||
"restricted user fetched a hidden item's detail: %s", body)
|
||||
assert.NotContains(t, body, fix.marker, "hidden item detail leaked content")
|
||||
|
||||
aStatus, aBody := rlsGet(t, setup.Server, adminToken, "/api/media-items/"+id)
|
||||
require.Equal(t, http.StatusOK, aStatus)
|
||||
assert.Contains(t, aBody, fix.marker, "admin should see hidden-library item detail")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("opds device catalog excludes hidden library", func(t *testing.T) {
|
||||
// OPDS authenticates via per-device bearer tokens (not JWT) —
|
||||
// the catalog must be scoped to the DEVICE OWNER's visibility.
|
||||
deviceToken := fmt.Sprintf("dev_%s", uuid.New().String())
|
||||
device, err := setup.DB.CreateDevice(context.Background(), database.CreateDeviceParams{
|
||||
UserID: uuidToPGType(restricted.ID),
|
||||
DeviceName: "RLS OPDS Device",
|
||||
DeviceType: "koreader",
|
||||
DeviceIdentifier: "rls-invariant-opds-" + fix.marker,
|
||||
AuthToken: deviceToken,
|
||||
SyncEnabled: pgtype.Bool{Bool: true, Valid: true},
|
||||
AutoSync: pgtype.Bool{Bool: true, Valid: true},
|
||||
SyncFrequencyMinutes: pgtype.Int4{Int32: 5, Valid: true},
|
||||
DeviceMetadata: []byte("{}"),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
deviceID, err := uuid.FromBytes(device.ID.Bytes[0:16])
|
||||
require.NoError(t, err)
|
||||
t.Cleanup(func() {
|
||||
_ = setup.DB.DeleteDevice(context.Background(), device.ID)
|
||||
})
|
||||
|
||||
req, _ := http.NewRequest(http.MethodGet,
|
||||
setup.Server.URL+"/opds/devices/"+deviceID.String()+"/catalog", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+deviceToken)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = resp.Body.Close() }()
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, http.StatusOK, resp.StatusCode, "device-authenticated catalog must succeed")
|
||||
|
||||
assert.NotContains(t, string(body), fix.hiddenBooks[0], "hidden library book leaked via OPDS")
|
||||
assert.NotContains(t, string(body), fix.hiddenBooks[1], "hidden library book leaked via OPDS")
|
||||
})
|
||||
}
|
||||
Reference in new issue
Block a user