feat(store): add Area admission and audit outbox [T-010]

deploy/postgres/tests/assertions.sql

@@ -6,10 +6,12 @@ DECLARE
     default_quota integer;
     initial_version bigint;
     updated_version bigint;
+    area_initial_version bigint;
+    area_updated_version bigint;
 BEGIN
     IF current_setting('server_version_num')::integer < 170000
        OR current_setting('server_version_num')::integer >= 180000 THEN
-        RAISE EXCEPTION 'T-009 requires PostgreSQL 17.x';
+        RAISE EXCEPTION 'YoVision requires PostgreSQL 17.x';
     END IF;
 
     SELECT array_agg(column_name ORDER BY ordinal_position)
@@ -37,6 +39,43 @@ BEGIN
         RAISE EXCEPTION 'sense_app has forbidden Bell source-table privileges';
     END IF;
 
+    SELECT array_agg(column_name ORDER BY ordinal_position)
+    INTO actual_columns
+    FROM information_schema.columns
+    WHERE table_schema = 'bell' AND table_name = 'area_policy_v1';
+    IF actual_columns IS DISTINCT FROM ARRAY[
+        'tenant_id', 'site_id', 'area_id', 'capture_policy',
+        'source_version', 'source_updated_at'
+    ] THEN
+        RAISE EXCEPTION 'area_policy_v1 signature drift: %', actual_columns;
+    END IF;
+
+    IF NOT has_table_privilege('sense_app', 'bell.area_policy_v1', 'SELECT') THEN
+        RAISE EXCEPTION 'sense_app lacks SELECT on Area policy view';
+    END IF;
+    IF has_table_privilege('sense_app', 'bell.area_policy_v1', 'INSERT')
+       OR has_table_privilege('sense_app', 'bell.area_policy_v1', 'UPDATE')
+       OR has_table_privilege('sense_app', 'bell.area_policy_v1', 'DELETE')
+       OR has_table_privilege('sense_app', 'bell.areas', 'SELECT')
+       OR has_table_privilege('sense_app', 'bell.areas', 'INSERT')
+       OR has_table_privilege('sense_app', 'bell.areas', 'UPDATE')
+       OR has_table_privilege('sense_app', 'bell.areas', 'DELETE') THEN
+        RAISE EXCEPTION 'sense_app violates the Area projection boundary';
+    END IF;
+    IF has_function_privilege('sense_app', 'bell.bump_area_version()', 'EXECUTE') THEN
+        RAISE EXCEPTION 'sense_app can execute the Bell Area version trigger function';
+    END IF;
+    IF NOT has_table_privilege('sense_app', 'sense.device_operation_outbox', 'SELECT')
+       OR NOT has_table_privilege('sense_app', 'sense.device_operation_outbox', 'INSERT')
+       OR NOT has_table_privilege('sense_app', 'sense.device_operation_outbox', 'UPDATE')
+       OR NOT has_table_privilege('sense_app', 'sense.device_operation_outbox', 'DELETE') THEN
+        RAISE EXCEPTION 'sense_app lacks access to its local audit Outbox';
+    END IF;
+    IF (SELECT max(version) FROM bell.schema_migrations) <> 2
+       OR (SELECT max(version) FROM sense.schema_migrations) <> 3 THEN
+        RAISE EXCEPTION 'schema migration version drift';
+    END IF;
+
     INSERT INTO bell.sites(tenant_id, id, name)
     VALUES ('assertion-tenant', 'assertion-site', 'Assertion Site')
     RETURNING max_video_channels, version INTO default_quota, initial_version;
@@ -51,6 +90,28 @@ BEGIN
         RAISE EXCEPTION 'Bell site source_version is not monotonic';
     END IF;
 
+    INSERT INTO bell.areas(tenant_id, site_id, id, name, capture_policy)
+    VALUES (
+        'assertion-tenant', 'assertion-site', 'assertion-area',
+        'Assertion Area', 'video_allowed'
+    )
+    RETURNING version INTO area_initial_version;
+
+    UPDATE bell.areas SET capture_policy = 'non_imaging_only'
+    WHERE tenant_id = 'assertion-tenant' AND id = 'assertion-area'
+    RETURNING version INTO area_updated_version;
+    IF area_initial_version <> 1 OR area_updated_version <> area_initial_version + 1 THEN
+        RAISE EXCEPTION 'Bell Area source_version is not monotonic';
+    END IF;
+
+    BEGIN
+        INSERT INTO bell.areas(tenant_id, site_id, id, name, capture_policy)
+        VALUES ('assertion-tenant', 'assertion-site', 'invalid-area', 'Invalid', 'unknown');
+        RAISE EXCEPTION 'unknown capture_policy unexpectedly accepted';
+    EXCEPTION
+        WHEN check_violation THEN NULL;
+    END;
+
     BEGIN
         INSERT INTO bell.sites(tenant_id, id, name, max_video_channels)
         VALUES ('assertion-tenant', 'invalid-site', 'Invalid', 129);
@@ -59,6 +120,8 @@ BEGIN
         WHEN check_violation THEN NULL;
     END;
 
+    DELETE FROM bell.areas
+    WHERE tenant_id = 'assertion-tenant' AND id = 'assertion-area';
     DELETE FROM bell.sites
     WHERE tenant_id = 'assertion-tenant' AND id = 'assertion-site';
 END