EDU-007 — Verify tenant-scoped practice creation and restoration

Status: done — bounded create/restore contract verified against V4030 PostgreSQL
Type: implementation/verification
Phase: 2
Blockers: EDU-004, EDU-006

Implementation result

The existing create/restore aggregate was retained and re-verified rather than rebuilt. Practice endpoints now require a UserTypeEnum.MEMBER Student Principal and continue deriving user/tenant only from the authenticated principal. Concurrent creation now uses the existing PostgreSQL ON CONFLICT DO NOTHING mapper seam, avoiding a query inside an aborted duplicate-key transaction. Real PostgreSQL tests prove identical concurrent requests return one session and conflicting fingerprints produce one winner plus one idempotency mismatch.

Focused tests also prove provider failure leaves no partial state and restore uses the persisted Question Snapshot after source content changes. The service create/restore suite now runs on the V4030 Flyway-owned PostgreSQL schema.

PUBLIC catalog read predicates and provider-neutral safety remain unchanged. Cross-scope PUBLIC graph-integrity semantics remain an explicit later architecture decision; EDU-007 does not claim or invent those constraints. Legacy entitlement/quota, timed practice, rich blueprint/random/review modes, and discovery of multiple active sessions are outside this bounded ticket.

Scope

Verify or complete session creation idempotency.
Verify session ownership and tenant isolation.
Restore immutable safe question snapshots.
Preserve provider-neutral question safety from EDU-001.
Verify PUBLIC catalog reads continue using the existing explicit scope predicates; tenant-consistent PUBLIC graph constraints remain blocked on the graph decision.
Remove no existing core-loop behavior unless a regression proves it invalid.

Acceptance criteria

Current user and tenant derive from a Member security principal at the controller boundary.
Duplicate client session ID with identical fingerprint returns the existing session.
Conflicting fingerprint, user, or tenant does not expose the existing session.
Underfilled, invisible, malformed, disabled, and unavailable content fails closed.
Restored content remains stable after source content changes.
Cross-tenant and wrong-user access is denied.
Provider-neutral question safety and existing PUBLIC read predicates are preserved; graph-integrity enforcement remains blocked on the recorded architecture decision.
PostgreSQL uniqueness and transaction behavior are tested against the EDU-006 schema.

Verification

Focused create/restore service, Mapper, controller, and PostgreSQL tests; then required diff/compile gates.

Verification performed

Against an isolated PostgreSQL database using the V4010/V4020/V4030 Flyway chain:

PracticeSessionControllerHttpTest:                 15 passed
PracticeSessionServiceImplTest:                    25 passed
PracticeSessionServicePostgreSqlIntegrationTest:    2 passed
Total:                                             42 passed
Failures/errors/skipped:                            0

The PostgreSQL concurrency tests use bounded latches and prove both identical and conflicting fingerprint races. No database migration was added or changed by EDU-007.

Risk and rollback

Risk: Medium session-ownership and compatibility risk.
Rollback: Application rollback; retain forward-compatible schema.

3.4 KiB Raw Blame History