fix(calendar): bind connection lookup evidence to exact authority

[seonghobae]

Security/data-integrity outcome

Prevent PostgresCalendarConnectionRepository.getActiveConnection() from promoting a durable row whose opaque connection, workspace, or user identity differs from the exact lookup authority.

Test-first sequence

1. calendar-connection-lookup-evidence-identity.test.ts supplies an otherwise valid active calendar row with a different UUIDv4 connection_id. Against protected main 5fdb8ee899991cbfd27c41ce59079648829b2a30, the repository would return it because the post-query evidence check validated lifecycle status only.
2. The repository now requires returned connectionId, workspaceId, and userId to equal the already-validated lookup input before durable evidence can leave the persistence boundary.
3. The focused SQL fixture uses an explicit unknown bridge so the generic test client remains type-safe under strict TypeScript checking.

The SQL query already scopes all three fields. This second boundary makes corrupted, incorrect, or alternate SQL-client adapters fail closed instead of relying on query intent as proof of returned identity.

Scope

Two-file persistence-integrity hardening only. No migration, OAuth, secret-handle, provider, public HTTP or synchronization semantics change.

Verification

Require unchanged exact head 8f463695d346ee80fbf041cdd5609dd406304add to pass calendar-service tests/typecheck/build, configured coverage/docstring gates, CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness and all current review findings before merge. No predecessor evidence transfers.

Refs #129.

Summary by CodeRabbit

• 버그 수정
  • 활성 캘린더 연결을 조회할 때 연결 ID뿐 아니라 워크스페이스와 사용자 정보도 요청 범위와 일치하는지 확인합니다.
  • 조회된 연결 정보가 요청 대상과 다르면 오류로 처리하여 잘못된 연결이 사용되는 문제를 방지합니다.
  • 비정상적인 데이터베이스 조회 결과에 대한 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ecce383f-e3d8-45c1-bcde-411668a30ce0

📥 Commits

Reviewing files that changed from the base of the PR and between 5fdb8ee and 8f46369.

📒 Files selected for processing (2)

• apps/integration-calendar-service/src/calendar-connection-lookup-evidence-identity.test.ts
• apps/integration-calendar-service/src/calendar-connection-repository.ts

---

📝 Walkthrough

Walkthrough

getActiveConnection이 조회 결과의 연결 ID, 워크스페이스 ID, 사용자 ID를 요청값과 비교합니다. 불일치하면 CalendarConnectionPersistenceError를 발생시킵니다. 연결 ID 불일치 동작을 검증하는 테스트를 추가했습니다.

Changes

연결 조회 범위 검증

Layer / File(s)	Summary
저장소 검증 및 불일치 테스트 apps/integration-calendar-service/src/calendar-connection-repository.ts, apps/integration-calendar-service/src/calendar-connection-lookup-evidence-identity.test.ts	getActiveConnection이 연결 상태와 요청된 연결 ID, 워크스페이스 ID, 사용자 ID를 함께 검증합니다. 식별자가 불일치하면 CalendarConnectionPersistenceError를 발생시킵니다. 테스트는 불일치한 연결 행을 반환하는 클라이언트를 사용해 이 동작을 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/life-os#156: PostgreSQL 저장소에서 테넌트 및 사용자 범위의 persistence evidence를 검증하는 변경과 관련됩니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 정확한 권한에 연결 조회 증거를 바인딩하는 핵심 변경을 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/calendar-connection-lookup-evidence-identity

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.