v0.3.4-pre.010

crates/ksp-store-postgres-lib/tests/hardening_completeness.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-store-postgres-lib/tests/hardening_completeness.rs
-// version: 16
+// version: 17
 
 #![warn(missing_docs)]
 #![deny(unreachable_pub)]
@@ -342,3 +342,73 @@ fn pre_010_raw_transaction_private_sql_keeps_keyset_navigation_and_bounded_state
     }
     return;
 }
+
+#[test]
+fn pre_010_raw_account_private_sql_is_non_destructive_keyset_and_family_local() {
+    let source = include_str!("../src/raw_account.rs");
+    let cursor = include_str!("../src/raw_account/cursor.rs");
+    for required in [
+        "ON CONFLICT (pubkey, slot, state_hash) DO NOTHING",
+        "ON CONFLICT (observation_key) DO NOTHING",
+        "FOR UPDATE",
+        "FOR KEY SHARE",
+        "ORDER BY slot ASC, pubkey ASC, state_hash ASC",
+        "ORDER BY slot DESC, pubkey DESC, state_hash DESC",
+        "(slot, pubkey, state_hash) >",
+        "(slot, pubkey, state_hash) <",
+    ] {
+        assert!(source.contains(required), "required hardened RawAccount SQL contract missing: {required}");
+    }
+    for forbidden in [
+        " OFFSET ",
+        "SELECT *",
+        "ON CONFLICT DO UPDATE",
+        "UPDATE ksp_raw_account",
+        "DELETE FROM ksp_raw_account",
+        "TRUNCATE",
+        "batch_size",
+        "priority",
+    ] {
+        assert!(!source.contains(forbidden), "forbidden RawAccount scope/policy SQL detected: {forbidden}");
+    }
+    for required in ["b\"KSPA\"", "KSP/raw-account-state-cursor/v1", "CURSOR_BYTES: usize = 109"] {
+        assert!(cursor.contains(required), "missing hardened RawAccount cursor family contract: {required}");
+    }
+    assert!(!cursor.contains("b\"KSPT\""));
+    let state_fk = include_str!("../migrations/v002_raw_account_state/constraints/003_fk_ksp_raw_account_observations_state.sql");
+    let transaction_signature = include_str!("../migrations/v002_raw_account_state/constraints/028_ck_ksp_raw_account_observations_transaction_signature.sql");
+    assert!(state_fk.contains("REFERENCES ksp_raw_account_states(pubkey, slot, state_hash)"));
+    assert!(!state_fk.contains("ksp_raw_transactions"));
+    assert!(transaction_signature.contains("octet_length(transaction_signature) = 64"));
+    assert!(!transaction_signature.contains("REFERENCES"));
+    assert!(!transaction_signature.contains("ksp_raw_transactions"));
+    return;
+}
+
+#[test]
+fn pre_010_v002_schema_inventory_is_exact_family_local_and_query_justified() {
+    let schema = include_str!("../src/schema.rs");
+    let v002_tail = match schema.split("pub(crate) const V002_RESOURCES: &[SchemaResource] = &[").nth(1) {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => panic!("V002 resource inventory missing"),
+    };
+    let v002 = match v002_tail.split("\n];").next() {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => panic!("V002 resource inventory terminator missing"),
+    };
+    assert_eq!(v002.matches("SchemaResource {").count(), 32);
+    assert_eq!(v002.matches("SchemaObjectContract::Table(").count(), 2);
+    assert_eq!(v002.matches("kind: \"p\"").count(), 2);
+    assert_eq!(v002.matches("kind: \"f\"").count(), 1);
+    assert_eq!(v002.matches("kind: \"c\"").count(), 26);
+    assert_eq!(v002.matches("SchemaObjectContract::Index(").count(), 1);
+    assert_eq!(v002.matches("predicate_fragment: std::option::Option::None").count(), 1);
+    assert!(v002.contains("key_fragment: \"slot,pubkey,state_hash\""));
+    assert!(!v002.contains("ksp_raw_transactions"));
+    assert!(!v002.contains("ksp_raw_transaction_observations"));
+    for forbidden in ["owner", "provider", "received_at_unix_millis", "acquisition_method"] {
+        let index_marker = std::format!("key_fragment: \"{forbidden}");
+        assert!(!v002.contains(index_marker.as_str()), "unjustified V002 business index detected: {forbidden}");
+    }
+    return;
+}