d3ro-voice/server/supabase/tests/team-push-security.integration.sql

\set ON_ERROR_STOP on

BEGIN;

CREATE OR REPLACE FUNCTION pg_temp.assert_true(condition boolean, message text)
RETURNS void
LANGUAGE plpgsql
AS $$
BEGIN
  IF condition IS NOT TRUE THEN
    RAISE EXCEPTION 'assertion_failed: %', message;
  END IF;
END;
$$;

INSERT INTO auth.users (
  id, aud, role, email, encrypted_password, email_confirmed_at,
  raw_app_meta_data, raw_user_meta_data, created_at, updated_at
) VALUES
  (
    '30000000-0000-4000-8000-000000000001', 'authenticated', 'authenticated',
    'team-owner@example.invalid', crypt('fixture-password', gen_salt('bf')), now(),
    '{"provider":"email","providers":["email"]}'::jsonb,
    '{"name":"Team Owner"}'::jsonb, now(), now()
  ),
  (
    '30000000-0000-4000-8000-000000000002', 'authenticated', 'authenticated',
    'team-member@example.invalid', crypt('fixture-password', gen_salt('bf')), now(),
    '{"provider":"email","providers":["email"]}'::jsonb,
    '{"name":"Team Member"}'::jsonb, now(), now()
  ),
  (
    '30000000-0000-4000-8000-000000000003', 'authenticated', 'authenticated',
    'team-invitee@example.invalid', crypt('fixture-password', gen_salt('bf')), now(),
    '{"provider":"email","providers":["email"]}'::jsonb,
    '{"name":"Team Invitee"}'::jsonb, now(), now()
  );

SELECT pg_temp.assert_true(
  has_function_privilege('authenticated', 'public.create_team(text)', 'EXECUTE'),
  'authenticated may call atomic team creation'
);
SELECT pg_temp.assert_true(
  NOT has_function_privilege('anon', 'public.create_team(text)', 'EXECUTE'),
  'anonymous may not create teams'
);
SELECT pg_temp.assert_true(
  NOT has_table_privilege('authenticated', 'public.push_dispatch_attempts', 'SELECT'),
  'dispatch audit ledger is service-only'
);

SET LOCAL ROLE authenticated;
SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000001","role":"authenticated"}',
  true
);

DO $$
BEGIN
  INSERT INTO public.teams (name, owner_id)
  VALUES ('Direct write must fail', auth.uid());
  RAISE EXCEPTION 'direct_team_insert_was_allowed';
EXCEPTION
  WHEN insufficient_privilege THEN NULL;
END;
$$;

SELECT (public.create_team('  Security Team  ')->>'id')::uuid AS team_id \gset
SELECT set_config('test.team_id', :'team_id', true);

SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.teams WHERE id = :'team_id') = 1,
  'atomic create returns a readable team'
);
SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.team_members
    WHERE team_id = :'team_id'
      AND user_id = auth.uid()
      AND role = 'owner') = 1,
  'atomic create installs exactly one owner membership'
);

SELECT public.create_team_invite(
  :'team_id',
  'team-member@example.invalid',
  'member'
) AS first_invite \gset
SELECT (:'first_invite'::jsonb->>'token') AS member_invite_token \gset
SELECT (:'first_invite'::jsonb->>'id')::uuid AS member_invite_id \gset

SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.team_invites WHERE team_id = :'team_id') = 0,
  'team members cannot read bearer invite tokens directly'
);

SELECT pg_temp.assert_true(
  public.resolve_team_invite_recipient(:'member_invite_id') =
    '30000000-0000-4000-8000-000000000002'::uuid,
  'inviter can resolve an active invite recipient without exposing auth.users'
);

-- A repeated active invite is idempotent and returns the same token.
SELECT public.create_team_invite(
  :'team_id',
  'TEAM-MEMBER@example.invalid',
  'member'
) AS duplicate_invite \gset
SELECT pg_temp.assert_true(
  :'duplicate_invite'::jsonb->>'token' = :'member_invite_token'
    AND (:'duplicate_invite'::jsonb->>'duplicate')::boolean,
  'active invite replay is idempotent and case-normalized'
);

-- The caller-bound RLS helpers must not disclose another account's teams.
SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.user_team_ids(
    '30000000-0000-4000-8000-000000000002'::uuid
  )) = 0,
  'team helper rejects an arbitrary requested user id'
);

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000002","role":"authenticated"}',
  true
);

SELECT pg_temp.assert_true(
  public.resolve_team_invite_recipient(:'member_invite_id') IS NULL,
  'invite recipient cannot use inviter-only recipient resolution'
);

SELECT public.accept_team_invite(:'member_invite_token') AS accepted_invite \gset
SELECT pg_temp.assert_true(
  (:'accepted_invite'::jsonb->>'role') = 'member'
    AND NOT (:'accepted_invite'::jsonb->>'duplicate')::boolean,
  'matching recipient accepts the invite atomically'
);

SELECT public.accept_team_invite(:'member_invite_token') AS accepted_replay \gset
SELECT pg_temp.assert_true(
  (:'accepted_replay'::jsonb->>'duplicate')::boolean
    AND (:'accepted_replay'::jsonb->>'already_member')::boolean,
  'same recipient acceptance replay is idempotent'
);

SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.list_team_members(:'team_id')) = 2,
  'members can list the limited team profile projection'
);

DO $$
DECLARE
  affected_rows integer;
BEGIN
  UPDATE public.team_members
  SET role = 'owner'
  WHERE team_id = current_setting('test.team_id')::uuid AND user_id = auth.uid();
  GET DIAGNOSTICS affected_rows = ROW_COUNT;
  IF affected_rows <> 0 THEN
    RAISE EXCEPTION 'direct_role_update_was_allowed';
  END IF;
END;
$$;

DO $$
BEGIN
  PERFORM public.update_team_member_role(
    current_setting('test.team_id')::uuid,
    '30000000-0000-4000-8000-000000000001',
    'member'
  );
  RAISE EXCEPTION 'member_changed_owner_role';
EXCEPTION
  WHEN insufficient_privilege THEN NULL;
END;
$$;

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000001","role":"authenticated"}',
  true
);

SELECT pg_temp.assert_true(
  public.update_team_member_role(
    :'team_id',
    '30000000-0000-4000-8000-000000000002',
    'admin'
  )->>'role' = 'admin',
  'owner can promote a non-owner to admin'
);

DO $$
BEGIN
  PERFORM public.remove_team_member(
    current_setting('test.team_id')::uuid,
    '30000000-0000-4000-8000-000000000001'
  );
  RAISE EXCEPTION 'owner_was_removed';
EXCEPTION
  WHEN insufficient_privilege THEN NULL;
END;
$$;

SELECT public.create_team_invite(
  :'team_id',
  'team-invitee@example.invalid',
  'member'
) AS second_invite \gset
SELECT (:'second_invite'::jsonb->>'token') AS invitee_token \gset
SELECT (:'second_invite'::jsonb->>'id')::uuid AS invitee_id \gset
SELECT set_config('test.invitee_token', :'invitee_token', true);

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000002","role":"authenticated"}',
  true
);

DO $$
BEGIN
  PERFORM public.create_team_invite(
    current_setting('test.team_id')::uuid,
    'another-admin@example.invalid',
    'admin'
  );
  RAISE EXCEPTION 'admin_invited_another_admin';
EXCEPTION
  WHEN insufficient_privilege THEN NULL;
END;
$$;

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000003","role":"authenticated"}',
  true
);

SELECT pg_temp.assert_true(
  public.accept_team_invite(:'invitee_token')->>'role' = 'member',
  'second matching recipient can join'
);

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000002","role":"authenticated"}',
  true
);

SELECT pg_temp.assert_true(
  (public.remove_team_member(
    :'team_id',
    '30000000-0000-4000-8000-000000000003'
  )->>'removed')::boolean,
  'admin can remove a regular member'
);

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000003","role":"authenticated"}',
  true
);
DO $$
BEGIN
  PERFORM public.accept_team_invite(current_setting('test.invitee_token'));
  RAISE EXCEPTION 'removed_member_reused_an_accepted_invite';
EXCEPTION
  WHEN unique_violation THEN NULL;
END;
$$;

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000002","role":"authenticated"}',
  true
);

-- Push registration is bound to an active device and hidden by RLS.
INSERT INTO public.devices (
  id, user_id, installation_id, platform, device_name, app_version, os_version
) VALUES (
  '31000000-0000-4000-8000-000000000002',
  auth.uid(),
  '32000000-0000-4000-8000-000000000002',
  'android', 'Member Phone', '1.0', 'Android test'
);

SELECT pg_temp.assert_true(
  public.register_push_registration(
    '31000000-0000-4000-8000-000000000002',
    'fcm',
    'fixture-fcm-registration-token-member-0002'
  )->>'provider' = 'fcm',
  'active Android device registers an FCM token atomically'
);

SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.push_tokens) = 0,
  'authenticated users cannot read raw push registrations'
);

DO $$
BEGIN
  UPDATE public.devices
  SET push_token = 'direct-token-must-fail-000000000000'
  WHERE id = '31000000-0000-4000-8000-000000000002';
  RAISE EXCEPTION 'direct_device_push_token_update_was_allowed';
EXCEPTION
  WHEN insufficient_privilege THEN NULL;
END;
$$;

SELECT set_config(
  'request.jwt.claims',
  '{"sub":"30000000-0000-4000-8000-000000000001","role":"authenticated"}',
  true
);

INSERT INTO public.devices (
  id, user_id, installation_id, platform, device_name, app_version, os_version
) VALUES (
  '31000000-0000-4000-8000-000000000001',
  auth.uid(),
  '32000000-0000-4000-8000-000000000001',
  'android', 'Owner Phone', '1.0', 'Android test'
);

DO $$
BEGIN
  PERFORM public.register_push_registration(
    '31000000-0000-4000-8000-000000000001',
    'fcm',
    'fixture-fcm-registration-token-member-0002'
  );
  RAISE EXCEPTION 'other_user_push_token_was_stolen';
EXCEPTION
  WHEN unique_violation THEN NULL;
END;
$$;

SELECT public.reserve_push_dispatch(
  'transcription.completed',
  '33000000-0000-4000-8000-000000000001'
) AS first_reservation \gset
SELECT pg_temp.assert_true(
  (:'first_reservation'::jsonb->>'reserved')::boolean
    AND NOT (:'first_reservation'::jsonb->>'duplicate')::boolean,
  'first push dispatch is reserved'
);

SELECT public.reserve_push_dispatch(
  'transcription.completed',
  '33000000-0000-4000-8000-000000000001'
) AS duplicate_reservation \gset
SELECT pg_temp.assert_true(
  NOT (:'duplicate_reservation'::jsonb->>'reserved')::boolean
    AND (:'duplicate_reservation'::jsonb->>'duplicate')::boolean,
  'same push event is deduplicated for thirty seconds'
);

DO $$
BEGIN
  PERFORM public.reserve_push_dispatch(
    'arbitrary.message',
    '33000000-0000-4000-8000-000000000099'
  );
  RAISE EXCEPTION 'unsupported_push_event_was_reserved';
EXCEPTION
  WHEN invalid_parameter_value THEN NULL;
END;
$$;

SELECT public.reserve_push_dispatch(
  'billing.status.changed',
  ('33000000-0000-4000-8000-' || lpad(number::text, 12, '0'))::uuid
)
FROM generate_series(2, 10) AS number;

DO $$
BEGIN
  PERFORM public.reserve_push_dispatch(
    'billing.status.changed',
    '33000000-0000-4000-8000-000000000011'
  );
  RAISE EXCEPTION 'push_rate_limit_was_not_enforced';
EXCEPTION
  WHEN program_limit_exceeded THEN NULL;
END;
$$;

RESET ROLE;

SET LOCAL ROLE service_role;
SELECT set_config('request.jwt.claims', '{"role":"service_role"}', true);
SELECT public.reserve_system_push_dispatch(
  'transcription.completed',
  '34000000-0000-4000-8000-000000000001'
) AS system_reservation \gset
SELECT pg_temp.assert_true(
  (:'system_reservation'::jsonb->>'reserved')::boolean,
  'service role reserves an internal system notification'
);
SELECT public.reserve_system_push_dispatch(
  'transcription.completed',
  '34000000-0000-4000-8000-000000000001'
) AS system_replay \gset
SELECT pg_temp.assert_true(
  (:'system_replay'::jsonb->>'duplicate')::boolean
    AND NOT (:'system_replay'::jsonb->>'reserved')::boolean,
  'system notification replay is deduplicated'
);
RESET ROLE;

SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.team_members
    WHERE team_id = :'team_id' AND role = 'owner') = 1,
  'team retains exactly one immutable owner'
);
SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.push_tokens) = 1,
  'token theft attempt leaves the original registration intact'
);
SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.push_dispatch_attempts
    WHERE caller_id = '30000000-0000-4000-8000-000000000001') = 10,
  'dedupe does not consume an additional rate-limit slot'
);
SELECT pg_temp.assert_true(
  (SELECT count(*) FROM public.push_dispatch_attempts
    WHERE actor_kind = 'system'
      AND event_type = 'transcription.completed'
      AND resource_id = '34000000-0000-4000-8000-000000000001') = 1,
  'system dispatch ledger contains exactly one reservation'
);

ROLLBACK;