From 47af46fd092871e5411ad2c6c9572b064ef4abd6 Mon Sep 17 00:00:00 2001 From: Sylvain Duchesne Date: Mon, 3 Aug 2026 14:10:44 +0200 Subject: [PATCH] Probe a protected ENTITY, not the protected store, in the connections scenario MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scenario reads "an account not connected to another does not read its protected ENTITY, then reads it after connecting", but the probe was reading `did:ng:${protected_store_id}` — the STORE document — and writing its test entities straight into it. Under an ACL that shortcut was harmless. Under key possession it is wrong, and for a reason the model states outright: sharing a store capability would hand over everything the store contains, present and future. The unit of sharing is the document. `declareConnections` therefore shares the keys of entity documents, the store is not one of them, and the reader legitimately saw nothing. The code was right; the probe was standing in the store for an entity. Writing several entities into a store-level document also broke this repo's own one-document-per-entity rule. The probe now creates a real protected entity document, writes the entity there, and mounts its subscription on THAT document. A second defect surfaced while fixing the first: `connect()` asserted both directions from the READER's session, but a capability can only be shared by whoever holds it, and `capFor` answers for the connected identity alone — so the owner-side call returned early having shared nothing. Each direction is now asserted from its own session, and the reader drains its inbox afterwards. The reader is a genuine second identity (per-run identifiers give it its own account, stores, inbox and keyring), not the same one in disguise — a test that passes because the state is unreal proves nothing. Checked by breaking it on purpose: without `connect` it fails with `expected +0 to equal 1`. Also recorded, and worth knowing before writing another probe: `resetCaps()` clears the "a capability was issued" flag, which disarms the read filter entirely — it has to run BEFORE the first mint, or reads go straight through and the reader sees everything. tsc 0, @ui 7/7, target scenario green, read-filter not regressed. --- .project/concepts/bdd-testing/_debt.md | 1 + .project/concepts/data-layer/_debt.md | 1 + reports/cucumber-report.html | 2 +- reports/cucumber-report.json | 2353 +---------------- .../steps/data/protected-connections.steps.ts | 92 +- src/shared/shapes/shex/festipodShapes.shex | 2 + src/shared/test-harness/harness-ng.tsx | 109 +- 7 files changed, 158 insertions(+), 2402 deletions(-) diff --git a/.project/concepts/bdd-testing/_debt.md b/.project/concepts/bdd-testing/_debt.md index ae5adfd..811dd8b 100644 --- a/.project/concepts/bdd-testing/_debt.md +++ b/.project/concepts/bdd-testing/_debt.md @@ -6,3 +6,4 @@ ## Raw markers (consolidate into blocks, then delete) - TOUCHED src/modules/event/steps/data/reconnexion.steps.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) - TOUCHED src/shared/test-harness/harness-ng.tsx @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) +- TOUCHED src/modules/workshop/steps/data/protected-connections.steps.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/.project/concepts/data-layer/_debt.md b/.project/concepts/data-layer/_debt.md index 49f74a8..6f460b2 100644 --- a/.project/concepts/data-layer/_debt.md +++ b/.project/concepts/data-layer/_debt.md @@ -8,3 +8,4 @@ - TOUCHED src/shared/utils/ngBootstrap.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) - TOUCHED src/shared/utils/ngSession.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) - TOUCHED src/shared/context/FestipodDataContext.tsx @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) +- TOUCHED src/shared/shapes/shex/festipodShapes.shex @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/reports/cucumber-report.html b/reports/cucumber-report.html index fedcea4..574bf3c 100644 --- a/reports/cucumber-report.html +++ b/reports/cucumber-report.html @@ -50,7 +50,7 @@