// file: crates/ksp-store-postgres-lib/tests/hardening_completeness.rs // version: 23 #![warn(missing_docs)] #![deny(unreachable_pub)] #![forbid(unsafe_code)] //! Hardening, exact-surface and scope canaries for the physical PostgreSQL Store backend. const SECRET_CANARY: &str = "KSP-POSTGRES-SECRET-CANARY-PRE009"; fn poll_ready(future: impl std::future::Future) -> T { let mut future = std::boxed::Box::pin(future); let waker = std::task::Waker::noop(); let mut context = std::task::Context::from_waker(waker); return match std::future::Future::poll(future.as_mut(), &mut context) { std::task::Poll::Ready(value) => value, std::task::Poll::Pending => panic!("PostgreSQL hardening pre-I/O rejection unexpectedly became pending"), }; } fn network() -> ksp_store_api::RawNetworkId { return match ksp_store_api::RawNetworkId::new("devnet") { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => panic!("valid backend hardening network rejected: {error:?}"), }; } fn settings(connection_uri: &str, tls_mode: ksp_store_postgres_lib::PostgresBackendTlsMode) -> ksp_store_postgres_lib::PostgresBackendSettings { return ksp_store_postgres_lib::PostgresBackendSettings::new( network(), connection_uri, 8, std::time::Duration::from_secs(10), std::time::Duration::from_secs(5), std::time::Duration::from_secs(10), std::time::Duration::from_secs(5), tls_mode, true, std::time::Duration::from_secs(30), std::time::Duration::from_secs(10), ); } fn public_reexport_names(source: &str) -> std::vec::Vec<&str> { let mut names = std::vec::Vec::new(); for line in source.lines() { let trimmed = line.trim(); if !trimmed.starts_with("pub use ") || !trimmed.ends_with(';') { continue; } let without_semicolon = trimmed.trim_end_matches(';'); let name = match without_semicolon.rsplit("::").next() { std::option::Option::Some(value) => value, std::option::Option::None => continue, }; names.push(name); } names.sort_unstable(); return names; } fn manifest_dependency_names(source: &str) -> std::vec::Vec<&str> { let dependencies_tail = match source.split("[dependencies]").nth(1) { std::option::Option::Some(value) => value, std::option::Option::None => return std::vec::Vec::new(), }; let dependencies = match dependencies_tail.split("[lints]").next() { std::option::Option::Some(value) => value, std::option::Option::None => return std::vec::Vec::new(), }; let mut names = std::vec::Vec::new(); for line in dependencies.lines() { let content = match line.split('#').next() { std::option::Option::Some(value) => value.trim(), std::option::Option::None => continue, }; if content.is_empty() { continue; } let key = match content.split('=').next() { std::option::Option::Some(value) => value.trim().trim_end_matches(".workspace"), std::option::Option::None => continue, }; if !key.is_empty() { names.push(key); } } names.sort_unstable(); return names; } fn assert_pre_io_rejection(connection_uri: &str, tls_mode: ksp_store_postgres_lib::PostgresBackendTlsMode, expected_phase: &str) { let settings = settings(connection_uri, tls_mode); let rendered_settings = std::format!("{settings:?}"); assert!(!rendered_settings.contains(SECRET_CANARY)); assert!(rendered_settings.contains("")); let result = poll_ready(ksp_store_postgres_lib::PostgresBackend::open(settings)); let error = match result { std::result::Result::Err(value) => value, std::result::Result::Ok(_) => panic!("hostile PostgreSQL settings unexpectedly opened"), }; assert_eq!(error.kind(), ksp_store_postgres_lib::PostgresBackendErrorKind::ConfigInvalid); assert_eq!(error.phase(), expected_phase); assert!(!std::format!("{error:?}").contains(SECRET_CANARY)); return; } #[test] fn pre_009_backend_modules_exports_and_manifest_dependencies_are_exact() { let crate_root = include_str!("../src/lib.rs"); for required in ["mod constants;", "mod error;", "mod health;", "mod migration;", "mod raw_account;", "mod raw_transaction;", "mod runtime;", "mod schema;"] { assert!(crate_root.contains(required), "missing PostgreSQL backend module: {required}"); } assert!(!crate_root.contains("pub mod ")); let actual_exports = public_reexport_names(crate_root); let mut expected_exports = [ "ERROR_CODE_POSTGRES_RETENTION_COMPACTION_UNSUPPORTED", "PostgresBackend", "PostgresBackendError", "PostgresBackendErrorKind", "PostgresBackendHealthSnapshot", "PostgresBackendRuntimeSnapshot", "PostgresBackendSettings", "PostgresBackendTlsMode", ]; expected_exports.sort_unstable(); assert_eq!(actual_exports.as_slice(), expected_exports.as_slice()); assert_eq!(actual_exports.len(), 8); let manifest = include_str!("../Cargo.toml"); let actual_dependencies = manifest_dependency_names(manifest); let expected_dependencies = [ "deadpool-postgres", "ksp-logging-lib", "ksp-store-api", "rustls", "rustls-native-certs", "sha2", "tokio", "tokio-postgres", "tokio-postgres-rustls", ]; assert_eq!(actual_dependencies.as_slice(), expected_dependencies.as_slice()); return; } #[test] fn pre_009_hostile_uri_matrix_is_rejected_before_io_without_secret_echo() { let malformed = std::format!("not-a-postgresql-uri-{SECRET_CANARY}"); assert_pre_io_rejection(malformed.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "connection_uri"); let oversized = std::format!("{}{SECRET_CANARY}", "x".repeat(4_097)); assert_pre_io_rejection(oversized.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "connection_uri"); let hostaddr_only = std::format!("hostaddr=127.0.0.1 user=operator password={SECRET_CANARY} dbname=ksp"); assert_pre_io_rejection(hostaddr_only.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::VerifyFull, "tls_server_identity"); let server_options = std::format!("host=localhost user=operator password={SECRET_CANARY} dbname=ksp options='-c application_name={SECRET_CANARY}'"); assert_pre_io_rejection(server_options.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "server_options"); return; } #[test] fn pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text() { let error_source = include_str!("../src/error.rs"); assert!(error_source.contains("kind: PostgresBackendErrorKind")); assert!(error_source.contains("phase: &'static str")); for forbidden in ["String", "source:", "message:", "tokio_postgres::Error", "deadpool_postgres::PoolError"] { assert!(!error_source.contains(forbidden), "backend error type can retain forbidden external material: {forbidden}"); } let runtime = include_str!("../src/runtime.rs"); assert!(runtime.contains("deadpool_postgres::PoolError::Backend(_)")); assert!(!runtime.contains("deadpool_postgres::PoolError::Backend(error)")); for source in [ runtime, include_str!("../src/migration.rs"), include_str!("../src/health.rs"), include_str!("../src/raw_account.rs"), include_str!("../src/raw_account/cursor.rs"), include_str!("../src/raw_transaction.rs"), include_str!("../src/raw_transaction/cursor.rs"), ] { for forbidden in ["format!(\"{error", "format!(\"{error:?", "error = ?", "error = %"] { assert!(!source.contains(forbidden), "backend source renders external error material: {forbidden}"); } } return; } #[test] fn pre_009_backend_has_no_env_bypass_reverse_facade_edge_and_keeps_account_impls_in_runtime_bridge() { let production = std::format!( "{} {} {} {} {} {} {} {} {}", include_str!("../src/error.rs"), include_str!("../src/health.rs"), include_str!("../src/lib.rs"), include_str!("../src/migration.rs"), include_str!("../src/raw_account.rs"), include_str!("../src/raw_transaction.rs"), include_str!("../src/raw_transaction/cursor.rs"), include_str!("../src/runtime.rs"), include_str!("../src/schema.rs") ); for forbidden in [ "std::env", "dotenv", "KSP_SECRET_", "KSPB_", "PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", ".pgpass", ".postgresql/", "sslrootcert", "sslcert", "sslkey", "ksp_store_lib", "ksp_config_lib", "sqlx::", ] { assert!(!production.contains(forbidden), "forbidden backend ownership/reverse-edge material detected: {forbidden}"); } let bootstrap_sql = include_str!("../migrations/v000_bootstrap/tables/001_ksp_store_schema_migrations.sql"); assert!(bootstrap_sql.contains("ksp_store_schema_migrations")); for forbidden in ["RawTransaction", "RawAccountState", "raw_transaction", "raw_account", "CORE", "DECODE", "SPECIALIZED"] { assert!(!bootstrap_sql.contains(forbidden), "business schema leaked into foundation migration: {forbidden}"); } return; } #[test] fn pre_009_live_raw_account_proof_is_opt_in_isolated_secret_safe_and_cross_family() { let live = include_str!("postgres_raw_account_live.rs"); for required in [ "#[ignore = \"opt-in real PostgreSQL RawAccountState proof; reads one dedicated URI from stdin\"]", "std::io::stdin().read_line", "managed_schema_preexisting_refusal", "prove_schema_update_policy", "prove_state_extremes", "MAX_RAW_ACCOUNT_DATA_BYTES", "u64::MAX", "prove_atomic_idempotence_and_conflicts", "prove_additional_observations", "ReferenceNotFound", "prove_pagination_and_cursors", "prove_account_inspection", "inspect_raw_account_states", "RawAccountStateInspectionQuery", "KSPT", "prove_cross_family_coexistence", "persist_raw_transaction_acquisition", "prove_concurrent_identical_insert", "prove_concurrent_divergent_insert", "prove_cancellation_rollback", "task.abort()", "cleanup_verification", "ksp_raw_account_states", "ksp_raw_account_observations", "ksp_raw_transactions", ] { assert!(live.contains(required), "missing pre.009 RawAccount live proof guard/scenario: {required}"); } for forbidden in ["std::env", "KSP_SECRET_", "PGPASSWORD", "connection_uri = %", "connection_uri = ?", "println!(uri", "eprintln!(uri"] { assert!(!live.contains(forbidden), "pre.009 RawAccount live proof contains forbidden secret/environment material: {forbidden}"); } return; } #[test] fn pre_009_live_raw_transaction_proof_is_opt_in_isolated_and_secret_safe() { let live = include_str!("postgres_raw_transaction_live.rs"); for required in [ "#[ignore = \"opt-in real PostgreSQL RawTransaction proof; reads one dedicated URI from stdin\"]", "std::io::stdin().read_line", "managed_schema_preexisting_refusal", "prove_schema_update_policy", "prove_concurrent_identical_insert", "prove_concurrent_divergent_insert", "prove_pagination", "prove_inspection", "prove_retention_and_rehydrate", "prove_retention_races", "prove_cancellation_rollback", "task.abort()", "cleanup_verification", "ksp_raw_account_states", "ksp_raw_account_observations", ] { assert!(live.contains(required), "missing pre.009 live proof guard/scenario: {required}"); } for forbidden in ["std::env", "KSP_SECRET_", "PGPASSWORD", "connection_uri = %", "connection_uri = ?", "println!(uri", "eprintln!(uri"] { assert!(!live.contains(forbidden), "pre.009 live proof contains forbidden secret/environment material: {forbidden}"); } return; } #[test] fn v0_3_8_pre_009_raw_capability_implementation_inventory_is_exactly_fourteen() { let runtime = include_str!("../src/runtime.rs"); let capability_impls = [ "impl ksp_store_api::RawAccountObservationInspectionRead for PostgresBackend", "impl ksp_store_api::RawAccountObservationRead for PostgresBackend", "impl ksp_store_api::RawAccountObservationWrite for PostgresBackend", "impl ksp_store_api::RawAccountStateInspectionRead for PostgresBackend", "impl ksp_store_api::RawAccountStateRead for PostgresBackend", "impl ksp_store_api::RawAccountStateWrite for PostgresBackend", "impl ksp_store_api::RawTransactionInspectionRead for PostgresBackend", "impl ksp_store_api::RawTransactionObservationInspectionRead for PostgresBackend", "impl ksp_store_api::RawTransactionObservationRead for PostgresBackend", "impl ksp_store_api::RawTransactionObservationWrite for PostgresBackend", "impl ksp_store_api::RawTransactionRead for PostgresBackend", "impl ksp_store_api::RawTransactionRetentionRead for PostgresBackend", "impl ksp_store_api::RawTransactionRetentionWrite for PostgresBackend", "impl ksp_store_api::RawTransactionWrite for PostgresBackend", ]; for implementation in capability_impls { assert_eq!(runtime.matches(implementation).count(), 1, "unexpected PostgreSQL capability implementation inventory: {implementation}"); } assert_eq!(runtime.matches("impl ksp_store_api::Raw").count(), 14); let migration = include_str!("../src/migration.rs"); assert!(migration.contains("raw_account_state")); assert!(migration.contains("crate::V002_RESOURCES")); assert!(!runtime.contains("mod raw_account")); return; } #[test] fn v0_3_8_pre_004_raw_transaction_keyset_sql_remains_offset_free_and_unchanged_in_role() { let source = include_str!("../src/raw_transaction.rs"); let ascending = source.lines().find(|line| return line.starts_with("const LIST_TRANSACTIONS_ASC_SQL")); let ascending = match ascending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing canonical ascending keyset SQL"), }; let descending = source.lines().find(|line| return line.starts_with("const LIST_TRANSACTIONS_DESC_SQL")); let descending = match descending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing canonical descending keyset SQL"), }; for statement in [ascending, descending] { assert!(statement.contains("retention_state <> 'purged'")); assert!(statement.contains("LIMIT $5")); assert!(!statement.contains(" OFFSET ")); } assert!(ascending.contains("(slot, signature) >")); assert!(ascending.contains("ORDER BY slot ASC, signature ASC")); assert!(descending.contains("(slot, signature) <")); assert!(descending.contains("ORDER BY slot DESC, signature DESC")); for required in ["FOR UPDATE", "ON CONFLICT (signature) DO NOTHING", "ON CONFLICT (observation_key) DO NOTHING", "ksp_raw_transaction_archive_payloads"] { assert!(source.contains(required), "required hardened RawTransaction SQL contract missing: {required}"); } for forbidden in ["SELECT *", "ON CONFLICT DO UPDATE", "processing_state", "batch_size", "priority"] { assert!(!source.contains(forbidden), "forbidden RawTransaction scope/policy SQL detected: {forbidden}"); } return; } #[test] fn v0_3_8_pre_004_transaction_inspection_sql_is_single_statement_payload_free_counted_and_random_access() { let source = include_str!("../src/raw_transaction.rs"); let ascending = source.lines().find(|line| return line.starts_with("const INSPECT_TRANSACTIONS_ASC_SQL")); let ascending = match ascending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing ascending inspection SQL"), }; let descending = source.lines().find(|line| return line.starts_with("const INSPECT_TRANSACTIONS_DESC_SQL")); let descending = match descending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing descending inspection SQL"), }; for statement in [ascending, descending] { for required in [ "COUNT(*)::TEXT AS filtered_count_text", "COUNT(*)::TEXT FROM ksp_raw_transactions", "LEFT JOIN LATERAL", "LEFT JOIN ksp_raw_transaction_archive_payloads", "OCTET_LENGTH(transaction_row.payload)::BIGINT", "OCTET_LENGTH(archive_row.payload)::BIGINT", "LIMIT $3 OFFSET $4", "payload_size_bytes", "hot_payload_present", "archive_payload_present", ] { assert!(statement.contains(required), "missing transaction inspection SQL contract: {required}"); } assert!(!statement.contains("transaction_row.payload, transaction_row.retention_state")); assert!(!statement.contains("archive_row.payload AS")); assert!(!statement.contains("retention_state <> 'purged'")); } assert!(ascending.contains("ORDER BY transaction_row.slot ASC, transaction_row.signature ASC")); assert!(descending.contains("ORDER BY transaction_row.slot DESC, transaction_row.signature DESC")); assert!(source.contains("raw_transaction_inspection_sql_window(query.page())")); assert!(source.contains("raw_transaction_inspection_offset")); assert!(source.contains("raw_transaction_inspection_limit")); return; } #[test] fn v0_3_8_pre_009_observation_inspection_sql_is_counted_random_access_safe_and_family_local() { let transaction = include_str!("../src/raw_transaction.rs"); let account = include_str!("../src/raw_account.rs"); let transaction_ascending = transaction.lines().find(|line| return line.starts_with("const INSPECT_OBSERVATIONS_ASC_SQL")); let transaction_ascending = match transaction_ascending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing ascending transaction-observation inspection SQL"), }; let transaction_descending = transaction.lines().find(|line| return line.starts_with("const INSPECT_OBSERVATIONS_DESC_SQL")); let transaction_descending = match transaction_descending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing descending transaction-observation inspection SQL"), }; for statement in [transaction_ascending, transaction_descending] { for required in [ "COUNT(*)::TEXT AS filtered_count_text", "COUNT(*)::TEXT FROM ksp_raw_transaction_observations", "LEFT JOIN LATERAL", "transaction_signature = $1", "LIMIT $2 OFFSET $3", "received_at_unix_millis", "observation_key", ] { assert!(statement.contains(required), "missing transaction-observation inspection SQL contract: {required}"); } for forbidden in ["ksp_raw_transactions", "ksp_raw_transaction_archive_payloads", "page.payload", "SELECT payload", "SELECT *"] { assert!(!statement.contains(forbidden), "transaction-observation inspection leaked unrelated/raw material: {forbidden}"); } } assert!(transaction_ascending.contains("ORDER BY received_at_unix_millis ASC, observation_key ASC")); assert!(transaction_descending.contains("ORDER BY received_at_unix_millis DESC, observation_key DESC")); let account_ascending = account.lines().find(|line| return line.starts_with("const INSPECT_ACCOUNT_OBSERVATIONS_ASC_SQL")); let account_ascending = match account_ascending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing ascending account-observation inspection SQL"), }; let account_descending = account.lines().find(|line| return line.starts_with("const INSPECT_ACCOUNT_OBSERVATIONS_DESC_SQL")); let account_descending = match account_descending { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing descending account-observation inspection SQL"), }; for statement in [account_ascending, account_descending] { for required in [ "COUNT(*)::TEXT AS filtered_count_text", "COUNT(*)::TEXT FROM ksp_raw_account_observations", "LEFT JOIN LATERAL", "account_pubkey = $1", "account_slot = $2::TEXT::NUMERIC", "account_state_hash = $3", "LIMIT $4 OFFSET $5", "received_at_unix_millis", "observation_key", ] { assert!(statement.contains(required), "missing account-observation inspection SQL contract: {required}"); } for forbidden in ["ksp_raw_account_states AS", "account_row.data", "SELECT *"] { assert!(!statement.contains(forbidden), "account-observation inspection leaked unrelated/raw material: {forbidden}"); } } assert!(account_ascending.contains("ORDER BY received_at_unix_millis ASC, observation_key ASC")); assert!(account_descending.contains("ORDER BY received_at_unix_millis DESC, observation_key DESC")); return; } #[test] fn pre_010_raw_account_private_sql_is_non_destructive_keyset_and_family_local() { let source = include_str!("../src/raw_account.rs"); let cursor = include_str!("../src/raw_account/cursor.rs"); for required in [ "ON CONFLICT (pubkey, slot, state_hash) DO NOTHING", "ON CONFLICT (observation_key) DO NOTHING", "FOR UPDATE", "FOR KEY SHARE", "ORDER BY slot ASC, pubkey ASC, state_hash ASC", "ORDER BY slot DESC, pubkey DESC, state_hash DESC", "(slot, pubkey, state_hash) >", "(slot, pubkey, state_hash) <", ] { assert!(source.contains(required), "required hardened RawAccount SQL contract missing: {required}"); } for forbidden in ["SELECT *", "ON CONFLICT DO UPDATE", "UPDATE ksp_raw_account", "DELETE FROM ksp_raw_account", "TRUNCATE", "batch_size", "priority"] { assert!(!source.contains(forbidden), "forbidden RawAccount scope/policy SQL detected: {forbidden}"); } for required in ["b\"KSPA\"", "KSP/raw-account-state-cursor/v1", "CURSOR_BYTES: usize = 109"] { assert!(cursor.contains(required), "missing hardened RawAccount cursor family contract: {required}"); } assert!(!cursor.contains("b\"KSPT\"")); let state_fk = include_str!("../migrations/v002_raw_account_state/constraints/003_fk_ksp_raw_account_observations_state.sql"); let transaction_signature = include_str!("../migrations/v002_raw_account_state/constraints/028_ck_ksp_raw_account_observations_transaction_signature.sql"); assert!(state_fk.contains("REFERENCES ksp_raw_account_states(pubkey, slot, state_hash)")); assert!(!state_fk.contains("ksp_raw_transactions")); assert!(transaction_signature.contains("octet_length(transaction_signature) = 64")); assert!(!transaction_signature.contains("REFERENCES")); assert!(!transaction_signature.contains("ksp_raw_transactions")); return; } #[test] fn pre_010_v002_schema_inventory_is_exact_family_local_and_query_justified() { let schema = include_str!("../src/schema.rs"); let v002_tail = match schema.split("pub(crate) const V002_RESOURCES: &[SchemaResource] = &[").nth(1) { std::option::Option::Some(value) => value, std::option::Option::None => panic!("V002 resource inventory missing"), }; let v002 = match v002_tail.split("\n];").next() { std::option::Option::Some(value) => value, std::option::Option::None => panic!("V002 resource inventory terminator missing"), }; assert_eq!(v002.matches("SchemaResource {").count(), 32); assert_eq!(v002.matches("SchemaObjectContract::Table(").count(), 2); assert_eq!(v002.matches("kind: \"p\"").count(), 2); assert_eq!(v002.matches("kind: \"f\"").count(), 1); assert_eq!(v002.matches("kind: \"c\"").count(), 26); assert_eq!(v002.matches("SchemaObjectContract::Index(").count(), 1); assert_eq!(v002.matches("predicate_fragment: std::option::Option::None").count(), 1); assert!(v002.contains("key_fragment: \"slot,pubkey,state_hash\"")); assert!(!v002.contains("ksp_raw_transactions")); assert!(!v002.contains("ksp_raw_transaction_observations")); for forbidden in ["owner", "provider", "received_at_unix_millis", "acquisition_method"] { let index_marker = std::format!("key_fragment: \"{forbidden}"); assert!(!v002.contains(index_marker.as_str()), "unjustified V002 business index detected: {forbidden}"); } return; } #[test] fn v0_3_8_pre_005_raw_account_keyset_sql_remains_offset_free_while_inspection_is_random_access() { let source = include_str!("../src/raw_account.rs"); for name in [ "const LIST_ACCOUNT_STATES_ASC_SQL", "const LIST_ACCOUNT_STATES_DESC_SQL", "const LIST_ACCOUNT_STATES_BY_PUBKEY_ASC_SQL", "const LIST_ACCOUNT_STATES_BY_PUBKEY_DESC_SQL", ] { let statement = source.lines().find(|line| return line.starts_with(name)); let statement = match statement { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing canonical account keyset SQL: {name}"), }; assert!(!statement.contains(" OFFSET ")); } for name in ["const INSPECT_ACCOUNT_STATES_ASC_SQL", "const INSPECT_ACCOUNT_STATES_DESC_SQL"] { let statement = source.lines().find(|line| return line.starts_with(name)); let statement = match statement { std::option::Option::Some(value) => value, std::option::Option::None => panic!("missing account inspection SQL: {name}"), }; for required in ["COUNT(*)", "LEFT JOIN LATERAL", "OCTET_LENGTH(account_row.data)", "LIMIT $4 OFFSET $5"] { assert!(statement.contains(required), "missing account inspection SQL contract: {required}"); } assert!(!statement.contains("account_row.data,")); assert!(!statement.contains("SELECT account_row.data")); assert!(statement.contains("ORDER BY account_row.slot")); assert!(statement.contains("account_row.pubkey")); assert!(statement.contains("account_row.state_hash")); } return; }