khadhroony-solana-project/crates/ksp-store-postgres-lib/tests/hardening_completeness.rs

// file: crates/ksp-store-postgres-lib/tests/hardening_completeness.rs
// version: 4

#![warn(missing_docs)]
#![deny(unreachable_pub)]
#![forbid(unsafe_code)]

//! Hardening, exact-surface and scope canaries for the physical PostgreSQL Store backend.

const SECRET_CANARY: &str = "KSP-POSTGRES-SECRET-CANARY-PRE009";

fn poll_ready<T>(future: impl std::future::Future<Output = T>) -> T {
    let mut future = std::boxed::Box::pin(future);
    let waker = std::task::Waker::noop();
    let mut context = std::task::Context::from_waker(waker);
    return match std::future::Future::poll(future.as_mut(), &mut context) {
        std::task::Poll::Ready(value) => value,
        std::task::Poll::Pending => panic!("PostgreSQL hardening pre-I/O rejection unexpectedly became pending"),
    };
}

fn network() -> ksp_store_api::RawNetworkId {
    return match ksp_store_api::RawNetworkId::new("devnet") {
        std::result::Result::Ok(value) => value,
        std::result::Result::Err(error) => panic!("valid backend hardening network rejected: {error:?}"),
    };
}

fn settings(connection_uri: &str, tls_mode: ksp_store_postgres_lib::PostgresBackendTlsMode) -> ksp_store_postgres_lib::PostgresBackendSettings {
    return ksp_store_postgres_lib::PostgresBackendSettings::new(
        network(),
        connection_uri,
        8,
        std::time::Duration::from_secs(10),
        std::time::Duration::from_secs(5),
        std::time::Duration::from_secs(10),
        std::time::Duration::from_secs(5),
        tls_mode,
        true,
        std::time::Duration::from_secs(30),
        std::time::Duration::from_secs(10),
    );
}

fn public_reexport_names(source: &str) -> std::vec::Vec<&str> {
    let mut names = std::vec::Vec::new();
    for line in source.lines() {
        let trimmed = line.trim();
        if !trimmed.starts_with("pub use ") || !trimmed.ends_with(';') {
            continue;
        }
        let without_semicolon = trimmed.trim_end_matches(';');
        let name = match without_semicolon.rsplit("::").next() {
            std::option::Option::Some(value) => value,
            std::option::Option::None => continue,
        };
        names.push(name);
    }
    names.sort_unstable();
    return names;
}

fn manifest_dependency_names(source: &str) -> std::vec::Vec<&str> {
    let dependencies_tail = match source.split("[dependencies]").nth(1) {
        std::option::Option::Some(value) => value,
        std::option::Option::None => return std::vec::Vec::new(),
    };
    let dependencies = match dependencies_tail.split("[lints]").next() {
        std::option::Option::Some(value) => value,
        std::option::Option::None => return std::vec::Vec::new(),
    };
    let mut names = std::vec::Vec::new();
    for line in dependencies.lines() {
        let content = match line.split('#').next() {
            std::option::Option::Some(value) => value.trim(),
            std::option::Option::None => continue,
        };
        if content.is_empty() {
            continue;
        }
        let key = match content.split('=').next() {
            std::option::Option::Some(value) => value.trim().trim_end_matches(".workspace"),
            std::option::Option::None => continue,
        };
        if !key.is_empty() {
            names.push(key);
        }
    }
    names.sort_unstable();
    return names;
}

fn assert_pre_io_rejection(connection_uri: &str, tls_mode: ksp_store_postgres_lib::PostgresBackendTlsMode, expected_phase: &str) {
    let settings = settings(connection_uri, tls_mode);
    let rendered_settings = std::format!("{settings:?}");
    assert!(!rendered_settings.contains(SECRET_CANARY));
    assert!(rendered_settings.contains("<redacted>"));
    let result = poll_ready(ksp_store_postgres_lib::PostgresBackend::open(settings));
    let error = match result {
        std::result::Result::Err(value) => value,
        std::result::Result::Ok(_) => panic!("hostile PostgreSQL settings unexpectedly opened"),
    };
    assert_eq!(error.kind(), ksp_store_postgres_lib::PostgresBackendErrorKind::ConfigInvalid);
    assert_eq!(error.phase(), expected_phase);
    assert!(!std::format!("{error:?}").contains(SECRET_CANARY));
    return;
}

#[test]
fn pre_009_backend_modules_exports_and_manifest_dependencies_are_exact() {
    let crate_root = include_str!("../src/lib.rs");
    for required in ["mod constants;", "mod error;", "mod health;", "mod migration;", "mod raw_transaction;", "mod runtime;", "mod schema;"] {
        assert!(crate_root.contains(required), "missing PostgreSQL backend module: {required}");
    }
    assert!(!crate_root.contains("pub mod "));
    let actual_exports = public_reexport_names(crate_root);
    let mut expected_exports = [
        "ERROR_CODE_POSTGRES_RETENTION_COMPACTION_UNSUPPORTED",
        "PostgresBackend",
        "PostgresBackendError",
        "PostgresBackendErrorKind",
        "PostgresBackendHealthSnapshot",
        "PostgresBackendRuntimeSnapshot",
        "PostgresBackendSettings",
        "PostgresBackendTlsMode",
    ];
    expected_exports.sort_unstable();
    assert_eq!(actual_exports.as_slice(), expected_exports.as_slice());
    assert_eq!(actual_exports.len(), 8);
    let manifest = include_str!("../Cargo.toml");
    let actual_dependencies = manifest_dependency_names(manifest);
    let expected_dependencies = [
        "deadpool-postgres",
        "ksp-logging-lib",
        "ksp-store-api",
        "rustls",
        "rustls-native-certs",
        "sha2",
        "tokio",
        "tokio-postgres",
        "tokio-postgres-rustls",
    ];
    assert_eq!(actual_dependencies.as_slice(), expected_dependencies.as_slice());
    return;
}

#[test]
fn pre_009_hostile_uri_matrix_is_rejected_before_io_without_secret_echo() {
    let malformed = std::format!("not-a-postgresql-uri-{SECRET_CANARY}");
    assert_pre_io_rejection(malformed.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "connection_uri");
    let oversized = std::format!("{}{SECRET_CANARY}", "x".repeat(4_097));
    assert_pre_io_rejection(oversized.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "connection_uri");
    let hostaddr_only = std::format!("hostaddr=127.0.0.1 user=operator password={SECRET_CANARY} dbname=ksp");
    assert_pre_io_rejection(hostaddr_only.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::VerifyFull, "tls_server_identity");
    let server_options = std::format!("host=localhost user=operator password={SECRET_CANARY} dbname=ksp options='-c application_name={SECRET_CANARY}'");
    assert_pre_io_rejection(server_options.as_str(), ksp_store_postgres_lib::PostgresBackendTlsMode::Disabled, "server_options");
    return;
}

#[test]
fn pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text() {
    let error_source = include_str!("../src/error.rs");
    assert!(error_source.contains("kind: PostgresBackendErrorKind"));
    assert!(error_source.contains("phase: &'static str"));
    for forbidden in ["String", "source:", "message:", "tokio_postgres::Error", "deadpool_postgres::PoolError"] {
        assert!(!error_source.contains(forbidden), "backend error type can retain forbidden external material: {forbidden}");
    }
    let runtime = include_str!("../src/runtime.rs");
    assert!(runtime.contains("deadpool_postgres::PoolError::Backend(_)"));
    assert!(!runtime.contains("deadpool_postgres::PoolError::Backend(error)"));
    for source in [runtime, include_str!("../src/migration.rs"), include_str!("../src/health.rs"), include_str!("../src/raw_transaction.rs")] {
        for forbidden in ["format!(\"{error", "format!(\"{error:?", "error = ?", "error = %"] {
            assert!(!source.contains(forbidden), "backend source renders external error material: {forbidden}");
        }
    }
    return;
}

#[test]
fn pre_009_backend_has_no_env_bypass_or_business_write_capability() {
    let production = std::format!(
        "{}
{}
{}
{}
{}
{}
{}",
        include_str!("../src/error.rs"),
        include_str!("../src/health.rs"),
        include_str!("../src/lib.rs"),
        include_str!("../src/migration.rs"),
        include_str!("../src/raw_transaction.rs"),
        include_str!("../src/runtime.rs"),
        include_str!("../src/schema.rs")
    );
    for forbidden in [
        "std::env",
        "dotenv",
        "KSP_SECRET_",
        "KSPB_",
        "PGHOST",
        "PGPORT",
        "PGUSER",
        "PGPASSWORD",
        ".pgpass",
        ".postgresql/",
        "sslrootcert",
        "sslcert",
        "sslkey",
        "ksp_store_lib",
        "ksp_config_lib",
        "sqlx::",
        "impl ksp_store_api::RawTransaction",
        "impl ksp_store_api::RawAccount",
    ] {
        assert!(!production.contains(forbidden), "forbidden backend ownership/capability material detected: {forbidden}");
    }
    let bootstrap_sql = include_str!("../migrations/v000_bootstrap/tables/001_ksp_store_schema_migrations.sql");
    assert!(bootstrap_sql.contains("ksp_store_schema_migrations"));
    for forbidden in ["RawTransaction", "RawAccountState", "raw_transaction", "raw_account", "CORE", "DECODE", "SPECIALIZED"] {
        assert!(!bootstrap_sql.contains(forbidden), "business schema leaked into foundation migration: {forbidden}");
    }
    return;
}