nodedb 0.3.0

Local-first, real-time, edge-to-cloud hybrid database for multi-modal workloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

// SPDX-License-Identifier: BUSL-1.1

//! Cross-tenant isolation: Key-Value engine — negative (write-collision) cases.
//!
//! Verifies that Tenant B writing to the same key-space as Tenant A cannot
//! overwrite or delete Tenant A's data.  After each cross-tenant write
//! attempt, Tenant A's key must still return its original value.

use nodedb::bridge::envelope::{ErrorCode, Status};
use nodedb_physical::physical_plan::{KvOp, PhysicalPlan};

use crate::helpers::*;

/// Tenant B Put on the same key must not overwrite Tenant A's value.
#[test]
fn kv_cross_tenant_put_does_not_overwrite() {
    let (mut core, mut tx, mut rx, _dir) = make_core();

    // Tenant A inserts a key.
    send_ok_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Put {
            collection: "cache".into(),
            key: b"shared_key".to_vec(),
            value: b"tenant_a_value".to_vec(),
            ttl_ms: 0,
            surrogate: nodedb_types::Surrogate::ZERO,
        }),
    );

    // Tenant B writes to the same collection + key with a different value.
    // This must NOT overwrite Tenant A's entry.
    send_ok_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_B,
        PhysicalPlan::Kv(KvOp::Put {
            collection: "cache".into(),
            key: b"shared_key".to_vec(),
            value: b"tenant_b_value".to_vec(),
            ttl_ms: 0,
            surrogate: nodedb_types::Surrogate::ZERO,
        }),
    );

    // Tenant A's read must still return a non-empty, non-null payload
    // (A's entry must be intact in A's namespace).
    let resp_a = send_raw_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Get {
            collection: "cache".into(),
            key: b"shared_key".to_vec(),
            rls_filters: Vec::new(),
            surrogate_ceiling: None,
        }),
    );
    assert_eq!(resp_a.status, Status::Ok);
    let is_present = !resp_a.payload.is_empty()
        && resp_a.error_code != Some(ErrorCode::NotFound)
        && !payload_json(&resp_a.payload).contains("null");
    assert!(
        is_present,
        "Tenant A's value must be intact after Tenant B's cross-tenant Put; payload len={}",
        resp_a.payload.len()
    );
}

/// Tenant B Delete on a key that Tenant A owns must not remove Tenant A's entry.
#[test]
fn kv_cross_tenant_delete_does_not_affect_owner() {
    let (mut core, mut tx, mut rx, _dir) = make_core();

    // Tenant A inserts a key.
    send_ok_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Put {
            collection: "sessions".into(),
            key: b"sess_xyz".to_vec(),
            value: b"secret_token".to_vec(),
            ttl_ms: 0,
            surrogate: nodedb_types::Surrogate::ZERO,
        }),
    );

    // Tenant B attempts to delete the same key.
    // The engine must silently succeed (key doesn't exist in B's namespace)
    // without touching A's entry.
    let resp_del = send_raw_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_B,
        PhysicalPlan::Kv(KvOp::Delete {
            collection: "sessions".into(),
            keys: vec![b"sess_xyz".to_vec()],
        }),
    );
    // Either Ok (deleted 0 rows from B's namespace) or NotFound — both correct.
    let ok_or_not_found =
        resp_del.status == Status::Ok || resp_del.error_code == Some(ErrorCode::NotFound);
    assert!(
        ok_or_not_found,
        "Cross-tenant delete must be Ok or NotFound, got {:?}",
        resp_del.error_code
    );

    // Tenant A's key must still be present (non-empty, non-null payload).
    let resp_a = send_raw_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Get {
            collection: "sessions".into(),
            key: b"sess_xyz".to_vec(),
            rls_filters: Vec::new(),
            surrogate_ceiling: None,
        }),
    );
    assert_eq!(resp_a.status, Status::Ok);
    let is_present = !resp_a.payload.is_empty()
        && resp_a.error_code != Some(ErrorCode::NotFound)
        && !payload_json(&resp_a.payload).contains("null");
    assert!(
        is_present,
        "Tenant A's KV entry must survive Tenant B's cross-tenant delete; payload len={}",
        resp_a.payload.len()
    );
}