256 lines
11 KiB
PL/PgSQL
256 lines
11 KiB
PL/PgSQL
\set ON_ERROR_STOP on
|
|
|
|
-- Regression (redteam r2-24): deleting a history entry or meeting (e.g. from the
|
|
-- phone, which deletes only the parent row) must queue its raw audio for removal
|
|
-- instead of leaving an unreachable object in the audio bucket forever.
|
|
-- Requires 20260929000004_audio_retention_on_delete.sql.
|
|
|
|
BEGIN;
|
|
|
|
CREATE OR REPLACE FUNCTION pg_temp.assert_true(condition boolean, message text)
|
|
RETURNS void
|
|
LANGUAGE plpgsql
|
|
AS $$
|
|
BEGIN
|
|
IF condition IS NOT TRUE THEN
|
|
RAISE EXCEPTION 'assertion_failed: %', message;
|
|
END IF;
|
|
END;
|
|
$$;
|
|
|
|
INSERT INTO auth.users (
|
|
id, aud, role, email, encrypted_password, email_confirmed_at,
|
|
raw_app_meta_data, raw_user_meta_data, created_at, updated_at
|
|
) VALUES
|
|
(
|
|
'24000000-0000-4000-8000-000000000001', 'authenticated', 'authenticated',
|
|
'audio-retention-owner@example.invalid', crypt('fixture-password', gen_salt('bf')), now(),
|
|
'{"provider":"email","providers":["email"]}'::jsonb, '{}'::jsonb, now(), now()
|
|
),
|
|
(
|
|
'24000000-0000-4000-8000-000000000002', 'authenticated', 'authenticated',
|
|
'audio-retention-leaver@example.invalid', crypt('fixture-password', gen_salt('bf')), now(),
|
|
'{"provider":"email","providers":["email"]}'::jsonb, '{}'::jsonb, now(), now()
|
|
);
|
|
|
|
INSERT INTO public.history (id, user_id, original_text, duration)
|
|
VALUES
|
|
('24100000-0000-4000-8000-000000000001', '24000000-0000-4000-8000-000000000001', 'dictation one', 1),
|
|
('24100000-0000-4000-8000-000000000002', '24000000-0000-4000-8000-000000000001', 'dictation two', 1),
|
|
('24100000-0000-4000-8000-000000000003', '24000000-0000-4000-8000-000000000002', 'leaver dictation', 1);
|
|
|
|
INSERT INTO public.meetings (id, user_id, title, status)
|
|
VALUES ('24200000-0000-4000-8000-000000000001', '24000000-0000-4000-8000-000000000001', 'Retention meeting', 'completed');
|
|
|
|
INSERT INTO public.audio_files (
|
|
id, user_id, history_id, meeting_id, source, storage_key, mime_type, size_bytes, sha256, upload_status
|
|
) VALUES
|
|
('24300000-0000-4000-8000-000000000001', '24000000-0000-4000-8000-000000000001',
|
|
'24100000-0000-4000-8000-000000000001', NULL, 'recording',
|
|
'24000000-0000-4000-8000-000000000001/history/one.wav', 'audio/wav', 10, repeat('a', 64), 'uploaded'),
|
|
('24300000-0000-4000-8000-000000000002', '24000000-0000-4000-8000-000000000001',
|
|
NULL, '24200000-0000-4000-8000-000000000001', 'recording',
|
|
'24000000-0000-4000-8000-000000000001/meetings/m.wav', 'audio/wav', 10, repeat('b', 64), 'uploaded'),
|
|
('24300000-0000-4000-8000-000000000003', '24000000-0000-4000-8000-000000000001',
|
|
'24100000-0000-4000-8000-000000000002', NULL, 'file-picker',
|
|
'24000000-0000-4000-8000-000000000001/' || repeat('c', 64) || '/memo.m4a', 'audio/mp4', 10, repeat('c', 64), 'uploaded'),
|
|
('24300000-0000-4000-8000-000000000004', '24000000-0000-4000-8000-000000000002',
|
|
'24100000-0000-4000-8000-000000000003', NULL, 'recording',
|
|
'24000000-0000-4000-8000-000000000002/history/leaver.wav', 'audio/wav', 10, repeat('d', 64), 'uploaded');
|
|
|
|
-- 1) Clients cannot see or drive the purge queue. Checked through the catalog:
|
|
-- calling a function whose EXECUTE is denied segfaults the local
|
|
-- supabase/postgres 17.6.1.104 image, which would take the shared DB down.
|
|
SELECT pg_temp.assert_true(
|
|
NOT has_table_privilege('authenticated', 'public.audio_purge_queue', 'SELECT')
|
|
AND NOT has_table_privilege('anon', 'public.audio_purge_queue', 'SELECT')
|
|
AND NOT has_table_privilege('authenticated', 'public.audio_purge_queue', 'INSERT')
|
|
AND NOT has_function_privilege('authenticated', 'public.claim_audio_purge_batch_v1(integer, integer)', 'EXECUTE')
|
|
AND NOT has_function_privilege('anon', 'public.claim_audio_purge_batch_v1(integer, integer)', 'EXECUTE')
|
|
AND NOT has_function_privilege('authenticated', 'public.complete_audio_purge_v1(bigint[], uuid)', 'EXECUTE')
|
|
AND NOT has_function_privilege('authenticated', 'public.dispatch_audio_purge_v1()', 'EXECUTE')
|
|
AND has_function_privilege('service_role', 'public.claim_audio_purge_batch_v1(integer, integer)', 'EXECUTE')
|
|
AND has_function_privilege('service_role', 'public.complete_audio_purge_v1(bigint[], uuid)', 'EXECUTE'),
|
|
'purge queue and worker RPCs are service-only'
|
|
);
|
|
|
|
SET LOCAL ROLE authenticated;
|
|
SELECT set_config(
|
|
'request.jwt.claims',
|
|
'{"sub":"24000000-0000-4000-8000-000000000001","role":"authenticated"}',
|
|
true
|
|
);
|
|
|
|
-- 2) The phone deletes only the parent rows (RLS path, like deleteHistoryRevisionSafe).
|
|
DELETE FROM public.history WHERE id = '24100000-0000-4000-8000-000000000001';
|
|
DELETE FROM public.meetings WHERE id = '24200000-0000-4000-8000-000000000001';
|
|
DELETE FROM public.history WHERE id = '24100000-0000-4000-8000-000000000002';
|
|
|
|
RESET ROLE;
|
|
|
|
SELECT pg_temp.assert_true(
|
|
(SELECT count(*) FROM public.audio_files
|
|
WHERE id IN ('24300000-0000-4000-8000-000000000001',
|
|
'24300000-0000-4000-8000-000000000002',
|
|
'24300000-0000-4000-8000-000000000003')
|
|
AND upload_status = 'deleted'
|
|
AND history_id IS NULL AND meeting_id IS NULL) = 3,
|
|
'orphaned audio rows are marked deleted'
|
|
);
|
|
|
|
SELECT pg_temp.assert_true(
|
|
(SELECT array_agg(storage_key ORDER BY storage_key) FROM public.audio_purge_queue
|
|
WHERE user_id = '24000000-0000-4000-8000-000000000001')
|
|
= ARRAY[
|
|
'24000000-0000-4000-8000-000000000001/' || repeat('c', 64) || '/memo.m4a',
|
|
'24000000-0000-4000-8000-000000000001/history/one.wav',
|
|
'24000000-0000-4000-8000-000000000001/meetings/m.wav'
|
|
],
|
|
'history and meeting deletes queue their audio keys'
|
|
);
|
|
|
|
-- 3) Re-importing the same content-addressed file reclaims the key: the pending
|
|
-- purge is cancelled and the stale deleted row no longer blocks the UNIQUE key.
|
|
SET LOCAL ROLE authenticated;
|
|
INSERT INTO public.audio_files (
|
|
id, user_id, source, storage_key, mime_type, size_bytes, sha256, upload_status
|
|
) VALUES (
|
|
'24300000-0000-4000-8000-000000000005', '24000000-0000-4000-8000-000000000001', 'file-picker',
|
|
'24000000-0000-4000-8000-000000000001/' || repeat('c', 64) || '/memo.m4a', 'audio/mp4', 10, repeat('c', 64), 'pending'
|
|
);
|
|
RESET ROLE;
|
|
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.audio_purge_queue
|
|
WHERE storage_key LIKE '%/memo.m4a'),
|
|
'reclaimed key is no longer queued for purge'
|
|
);
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.audio_files WHERE id = '24300000-0000-4000-8000-000000000003'),
|
|
'stale deleted row for the reclaimed key is dropped'
|
|
);
|
|
|
|
-- 4) A key referenced by a live row again is dropped at claim time, never removed.
|
|
INSERT INTO public.audio_purge_queue (user_id, storage_key)
|
|
VALUES ('24000000-0000-4000-8000-000000000001',
|
|
'24000000-0000-4000-8000-000000000001/' || repeat('c', 64) || '/memo.m4a');
|
|
|
|
SET LOCAL ROLE service_role;
|
|
CREATE TEMP TABLE claimed ON COMMIT DROP AS
|
|
SELECT * FROM public.claim_audio_purge_batch_v1(100, 600);
|
|
RESET ROLE;
|
|
|
|
SELECT pg_temp.assert_true(
|
|
(SELECT count(*) FROM claimed) = 2
|
|
AND NOT EXISTS (SELECT 1 FROM claimed WHERE storage_key LIKE '%/memo.m4a')
|
|
AND (SELECT count(DISTINCT lease_token) FROM claimed) = 1
|
|
AND (SELECT bool_and(leased_until > now() AND attempts = 1) FROM claimed),
|
|
'claim leases only keys with no live owner'
|
|
);
|
|
|
|
-- 5) While a worker holds the lease, a live row cannot reclaim that key.
|
|
SET LOCAL ROLE authenticated;
|
|
DO $$
|
|
BEGIN
|
|
BEGIN
|
|
INSERT INTO public.audio_files (
|
|
user_id, meeting_id, source, storage_key, mime_type, size_bytes, sha256, upload_status
|
|
) VALUES (
|
|
'24000000-0000-4000-8000-000000000001', NULL, 'recording',
|
|
'24000000-0000-4000-8000-000000000001/meetings/m.wav', 'audio/wav', 10, repeat('e', 64), 'pending'
|
|
);
|
|
RAISE EXCEPTION 'assertion_failed: leased key was reclaimed';
|
|
EXCEPTION WHEN object_in_use THEN NULL;
|
|
END;
|
|
END;
|
|
$$;
|
|
RESET ROLE;
|
|
|
|
-- 6) A second claim does not hand out leased work.
|
|
SET LOCAL ROLE service_role;
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.claim_audio_purge_batch_v1(100, 600)),
|
|
'leased entries are not claimed twice'
|
|
);
|
|
|
|
-- 7) Completing with a wrong lease does nothing; the right lease clears queue and rows.
|
|
SELECT pg_temp.assert_true(
|
|
public.complete_audio_purge_v1(
|
|
(SELECT array_agg(id) FROM claimed), gen_random_uuid()
|
|
) = 0,
|
|
'foreign lease cannot complete'
|
|
);
|
|
SELECT pg_temp.assert_true(
|
|
public.complete_audio_purge_v1(
|
|
(SELECT array_agg(id) FROM claimed), (SELECT min(lease_token::text)::uuid FROM claimed)
|
|
) = 2,
|
|
'lease holder completes the batch'
|
|
);
|
|
RESET ROLE;
|
|
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.audio_purge_queue
|
|
WHERE user_id = '24000000-0000-4000-8000-000000000001'),
|
|
'completed entries leave the queue'
|
|
);
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.audio_files
|
|
WHERE id IN ('24300000-0000-4000-8000-000000000001',
|
|
'24300000-0000-4000-8000-000000000002')),
|
|
'purged audio metadata is removed'
|
|
);
|
|
SELECT pg_temp.assert_true(
|
|
EXISTS (SELECT 1 FROM public.audio_files
|
|
WHERE id = '24300000-0000-4000-8000-000000000005' AND upload_status = 'pending'),
|
|
'the reclaimed live row survives completion'
|
|
);
|
|
|
|
-- 8) Desktop upsert (ON CONFLICT on the UNIQUE key) over a deleted row reclaims it.
|
|
INSERT INTO public.history (id, user_id, original_text, duration)
|
|
VALUES ('24100000-0000-4000-8000-000000000004', '24000000-0000-4000-8000-000000000001', 'desktop', 1);
|
|
INSERT INTO public.audio_files (
|
|
id, user_id, history_id, source, storage_key, mime_type, size_bytes, sha256, upload_status
|
|
) VALUES (
|
|
'24300000-0000-4000-8000-000000000006', '24000000-0000-4000-8000-000000000001',
|
|
'24100000-0000-4000-8000-000000000004', 'recording',
|
|
'24000000-0000-4000-8000-000000000001/history/desk.wav', 'audio/wav', 10, repeat('f', 64), 'uploaded'
|
|
);
|
|
DELETE FROM public.history WHERE id = '24100000-0000-4000-8000-000000000004';
|
|
INSERT INTO public.history (id, user_id, original_text, duration)
|
|
VALUES ('24100000-0000-4000-8000-000000000004', '24000000-0000-4000-8000-000000000001', 'desktop again', 1);
|
|
INSERT INTO public.audio_files (
|
|
user_id, history_id, source, storage_key, mime_type, size_bytes, sha256, upload_status
|
|
) VALUES (
|
|
'24000000-0000-4000-8000-000000000001', '24100000-0000-4000-8000-000000000004', 'recording',
|
|
'24000000-0000-4000-8000-000000000001/history/desk.wav', 'audio/wav', 10, repeat('f', 64), 'uploaded'
|
|
)
|
|
ON CONFLICT (user_id, sha256, storage_key) DO UPDATE
|
|
SET history_id = EXCLUDED.history_id, upload_status = EXCLUDED.upload_status;
|
|
|
|
SELECT pg_temp.assert_true(
|
|
(SELECT count(*) FROM public.audio_files
|
|
WHERE storage_key = '24000000-0000-4000-8000-000000000001/history/desk.wav') = 1
|
|
AND EXISTS (SELECT 1 FROM public.audio_files
|
|
WHERE storage_key = '24000000-0000-4000-8000-000000000001/history/desk.wav'
|
|
AND upload_status = 'uploaded'
|
|
AND history_id = '24100000-0000-4000-8000-000000000004')
|
|
AND NOT EXISTS (SELECT 1 FROM public.audio_purge_queue WHERE storage_key LIKE '%/desk.wav'),
|
|
'desktop upsert reclaims a deleted key'
|
|
);
|
|
|
|
-- 9) Account deletion still cascades (the queue has no FK to auth.users).
|
|
DELETE FROM auth.users WHERE id = '24000000-0000-4000-8000-000000000002';
|
|
SELECT pg_temp.assert_true(
|
|
NOT EXISTS (SELECT 1 FROM public.audio_files WHERE user_id = '24000000-0000-4000-8000-000000000002'),
|
|
'account deletion removes the user audio rows'
|
|
);
|
|
|
|
-- 10) The dispatcher is a no-op when there is no ready work.
|
|
SELECT pg_temp.assert_true(
|
|
public.dispatch_audio_purge_v1() IS NULL OR NOT EXISTS (
|
|
SELECT 1 FROM public.audio_purge_queue WHERE user_id = '24000000-0000-4000-8000-000000000001'
|
|
),
|
|
'dispatcher does not fail'
|
|
);
|
|
|
|
ROLLBACK;
|