orchestra/internal/store/store_test.go

package store

import (
	"encoding/json"
	"os"
	"path/filepath"
	"testing"

	"orchestra/internal/authz"
	"orchestra/internal/domain"
)

func created(id string) domain.Event {
	b, _ := json.Marshal(map[string]any{"source": "jsonl", "external_id": "42", "project": "demo", "capability": []string{"mechanical"}})
	return domain.Event{ID: id, Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.System)}
}

func TestAppendReplayAndDeduplicate(t *testing.T) {
	dir := t.TempDir()
	s, err := Open(dir)
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Append(created("e1")); err != nil {
		t.Fatal(err)
	}
	if err := s.Append(created("e2")); err != nil {
		t.Fatal(err)
	}
	if got := len(s.Events(0)); got != 1 {
		t.Fatalf("duplicate ingest appended %d events", got)
	}
	ref, err := s.PutArtifact([]byte("report"))
	if err != nil {
		t.Fatal(err)
	}
	completion, _ := json.Marshal(map[string]any{"report_ref": ref, "receipt": map[string]any{"harness_id": "h", "consumed": 1}})
	if err := s.Append(domain.Event{Type: "TaskCompleted", TaskID: "task-1", Version: 2, Payload: completion, Surface: string(authz.System)}); err != nil {
		t.Fatal(err)
	}
	if err := s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Surface: string(authz.System), Payload: json.RawMessage(`{"handoff_ref":"` + ref + `","anchor_sha":"0123456789012345678901234567890123456789"}`)}); err != domain.ErrConflict {
		t.Fatalf("expected conflict, got %v", err)
	}
	s2, err := Open(dir)
	if err != nil {
		t.Fatal(err)
	}
	if got := s2.Tasks()[0].State; got != domain.StateCompleted {
		t.Fatalf("replay state = %s", got)
	}
	if _, err := os.Stat(filepath.Join(dir, "snapshot.json")); err != nil {
		t.Fatal(err)
	}
}

func TestArtifactIsContentAddressed(t *testing.T) {
	s, err := Open(t.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	h1, err := s.PutArtifact([]byte("proof"))
	if err != nil {
		t.Fatal(err)
	}
	h2, err := s.PutArtifact([]byte("proof"))
	if err != nil {
		t.Fatal(err)
	}
	if h1 != h2 {
		t.Fatal("same artifact received different hashes")
	}
	if _, err := os.Stat(filepath.Join(s.cas, h1)); err != nil {
		t.Fatal(err)
	}
}

func TestLifecycleEventsRequireEvidence(t *testing.T) {
	cases := []struct {
		name string
		typ  string
		body string
	}{
		{"release", "TaskReleased", `{}`},
		{"complete", "TaskCompleted", `{}`},
		{"block", "TaskBlocked", `{}`},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			err := domain.ValidateEvent(domain.Event{Type: tc.typ, TaskID: "task-1", Version: 1, Payload: json.RawMessage(tc.body), Surface: string(authz.System)})
			if err == nil {
				t.Fatal("expected lifecycle evidence validation error")
			}
		})
	}
}

// TestAppendEnforcesAuthorizationAtTheBus proves authorization is checked
// once at the append boundary (spec §7.1/§1.4), not only in HTTP handlers:
// a caller writing to the store directly with a notify-only surface, or with
// no declared surface at all, is rejected exactly like an HTTP request would
// be — there is no in-process bypass for the router, coordinator, or a
// provider adapter that forgets to declare who it's acting as.
func TestAppendEnforcesAuthorizationAtTheBus(t *testing.T) {
	s, err := Open(t.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	b, _ := json.Marshal(map[string]any{"source": "jsonl", "external_id": "1", "project": "demo"})

	// A notify-only surface (e.g. Telegram) must never be able to create a
	// task by calling the store directly, even though it bypasses HTTP.
	if err := s.Append(domain.Event{ID: "e1", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.Telegram)}); err == nil {
		t.Fatal("notify-only surface created a task via direct store access")
	}

	// An internal producer that forgets to declare a surface is rejected,
	// not silently trusted as the plane.
	if err := s.Append(domain.Event{ID: "e2", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b}); err == nil {
		t.Fatal("event with no declared surface was accepted")
	}

	// The plane (router/coordinator/provider) authorizes as System and
	// succeeds.
	if err := s.Append(domain.Event{ID: "e3", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.System)}); err != nil {
		t.Fatalf("system surface rejected: %v", err)
	}
}

func TestExpectedVersionIsCheckedForEveryWriter(t *testing.T) {
	s, err := Open(t.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	if err := s.Append(created("create")); err != nil {
		t.Fatal(err)
	}
	p := json.RawMessage(`{"reason":"rotate","expected_version":0}`)
	err = s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Payload: p, Surface: string(authz.System)})
	if err != domain.ErrConflict {
		t.Fatalf("expected CAS conflict, got %v", err)
	}
}