diff --git a/.env.example b/.env.example index 2f1799c..d2f14e8 100644 --- a/.env.example +++ b/.env.example @@ -1,20 +1,25 @@ # Festipod — variables d'environnement (exemple) # -# Copier en `.env` (chargé automatiquement par Bun) et renseigner les valeurs. +# Copier en `.env` et renseigner les valeurs. # En dev (`bun run dev`) ET en prod (`bun run start`), l'app sert depuis src/ et # lit ces variables au RUNTIME (via l'endpoint /festipod-config.json de src/index.ts). -# Sans elles, l'app tombe en mode dégradé : la barrière d'accès n'affiche que le -# champ identifiant, sans l'assistance de chargement du portefeuille partagé. +# +# REQUIS POUR LES TESTS. La suite Cucumber tourne sous `node` (pas sous Bun), qui +# ne charge pas `.env` tout seul : le harness le lit explicitement et LÈVE UNE +# ERREUR NOMMÉE si le mot de passe ou le fichier manquent. Or `.env` ET `*.ngw` +# sont tous deux gitignorés — un clone frais n'a donc ni l'un ni l'autre et ne +# peut pas exécuter `@data`/`@e2e` tant que ces deux valeurs ne sont pas fournies. # ── Portefeuille partagé (stopgap staging) ───────────────────────────────── # Mot de passe du portefeuille partagé. -# VIDE => hasSharedWallet() faux => la barrière n'affiche QUE le champ identifiant -# (pas les 3 étapes « télécharger + importer le portefeuille »). REQUIS en staging -# pour l'onboarding d'un appareil qui n'a pas encore de wallet. +# VIDE => rien n'est passé à `configure({ sharedWallet })` => le SDK refuse de +# signer l'entrée et l'app affiche son panneau d'erreur au lieu de démarrer. +# REQUIS en staging (onboarding d'un appareil sans wallet) ET pour les tests. FESTIPOD_SHARED_WALLET_PASSWORD= -# Chemin ABSOLU vers le fichier portefeuille partagé (.ngw). Servi en -# téléchargement à /shared-wallet.ngw depuis la barrière d'accès. +# Chemin vers le fichier portefeuille partagé (.ngw), absolu ou relatif à la +# racine. Servi en téléchargement à /shared-wallet.ngw — par le build de l'app, +# et par le serveur du harness pendant les tests. FESTIPOD_SHARED_WALLET_FILE=/chemin/absolu/vers/festipod-wallet.ngw # ── Seed automatique (opt-in) ────────────────────────────────────────────── @@ -30,11 +35,7 @@ PORT=3000 NODE_ENV= # ── Outillage dev (facultatif) ───────────────────────────────────────────── -# Override du chemin local du polyfill @ng-eventually/client pour `pnpm run -# link:polyfill` (lien local réactif). Défaut = ../nextgraph/ng-eventually-js/packages/client. +# Override du chemin local du polyfill @ng-eventually/sdk pour `pnpm run +# link:polyfill` (lien local réactif). Défaut = ../nextgraph/ng-eventually-js/packages/sdk. NG_EVENTUALLY_LOCAL= -# ── Build only (build.ts / `bun run build`, PAS le runtime) ──────────────── -# ACCESS_GATE_DISABLED=1 => build SANS barrière d'accès (l'app démarre directement). -# Réservé à un build de démo/no-gate ; ne pas utiliser pour un déploiement réel. -ACCESS_GATE_DISABLED= diff --git a/.gitignore b/.gitignore index 090ed90..05fa390 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,6 @@ storybook-static dist-staging/ *.ngw .tasks/ + +# Per-developer contract access map (canonical provider → local checkout) — never committed. +.project/contracts.local.yaml diff --git a/.project/concepts/app-architecture/_debt.md b/.project/concepts/app-architecture/_debt.md deleted file mode 100644 index 992b96a..0000000 --- a/.project/concepts/app-architecture/_debt.md +++ /dev/null @@ -1,7 +0,0 @@ -# Doc-debt — app-architecture - -> Presence of a block = doc to update. Processed → delete the block; no blocks left → delete this file. -> One block = one "big change": `why` + `files` + `verify` (leaves to review). - -## Raw markers (consolidate into blocks, then delete) -- TOUCHED src/shared/context/FestipodDataContext.tsx @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/.project/concepts/app-architecture/_overview.md b/.project/concepts/app-architecture/_overview.md index d1fd346..a484d29 100644 --- a/.project/concepts/app-architecture/_overview.md +++ b/.project/concepts/app-architecture/_overview.md @@ -19,7 +19,8 @@ How the app's code is **structured** and **assembled**. *Feature-based* architec - [[knowledge_routing]] — path-based routing (History API), route table, hooks - [[knowledge_screens]] — screen inventory, registry, component library - [[knowledge_screen-pattern]] — canonical anatomy of a screen (no props, flex layout, showToast) -- [[caveat_identity-ids-in-screens]] — `currentUserId` (principal) vs `currentUser.id` (profile NURI): two id spaces that are not interchangeable +- [[caveat_identity-ids-in-screens]] — `currentUserId` is the profile document's NURI and is **empty until the protected read lands**; empty reads like "no data" +- [[caveat_boot-unverified-outside-broker]] — the unconditional `ensureIdentity()` await is verified inside the broker iframe; standalone/top-level boot is unverified - [[knowledge_styling-system]] — `src/index.css`, `app-*` classes, vars, pitfalls (Tailwind unused, `user-content` inert) - [[cookbook_add-screen]] — procedure for wiring up a new screen (registry + router + shell) - `tech-stack` — build, Bun bundler, commands diff --git a/.project/concepts/app-architecture/caveat_boot-unverified-outside-broker.md b/.project/concepts/app-architecture/caveat_boot-unverified-outside-broker.md new file mode 100644 index 0000000..9d4f8ea --- /dev/null +++ b/.project/concepts/app-architecture/caveat_boot-unverified-outside-broker.md @@ -0,0 +1,25 @@ +--- +type: caveat +summary: The standalone boot (app opened directly, not in the broker iframe) is covered by NO test, and it broke SILENTLY once — a blank page with no error, because nothing started a session and ensureIdentity() then settled neither way. Fixed by making the session start unconditionally; still untested, so break it and you will not hear about it. +last_checked: 2026-08-10 +--- + +# Pitfall: nothing tests the app booting outside the broker iframe + +## What happened, VERIFIED + +`AuthGate` awaits `ensureIdentity()` and renders **nothing** until it settles. `NextGraphProvider` used to start the NextGraph session **only inside the broker iframe** — standalone, the session was started by the user pressing "Entrer" on the app's own access screen. + +That screen was deleted the same day (the SDK shows the barrier now, see [[decision_2026-08-10_sdk-renders-the-barrier]]), and the iframe-only condition survived it. Standalone, the result was: no session ever started → the `getSession` thunk never returned → `ensureIdentity()` **neither resolved nor rejected** → `AuthGate` returned `null` forever. **A blank page with nothing in the console.** + +Note the shape of the failure, because it is the instructive part: a rejection would have been *shown* (`AuthGate` renders a named error panel). What produced silence was a promise that never settled at all — the one outcome no error path catches. Found by a human opening the app, not by any suite. + +The fix: the session starts unconditionally, in the iframe and standalone alike, through one `startSession()` in `NextGraphContext`. Standalone, `initNg()` redirects to the broker — that redirect **is** the sign-in flow now that nothing is left to click. + +## What is still true + +**No test exercises this path.** `@data` runs the harness inside the broker iframe; `@e2e` drives the real app inside the broker iframe too. The standalone top-level boot — the one a developer uses every day with `bun run dev`, and the one a first-time visitor hits — is covered by nothing. + +So: a change to `AuthGate`, to `NextGraphProvider`, or to what `configure()` receives can break the app's entry completely while every suite stays green. If you touch any of them, **open the app standalone yourself** before believing the tests. + +Two related pieces: [[caveat_first-time-entry-untested]] (the wallet-import journey, same blind spot seen from the user's side) and [[caveat_shared-wallet-global-before-gate-import]] (a missing wallet password now makes `ensureIdentity()` throw, which at least fails loudly). diff --git a/.project/concepts/app-architecture/caveat_identity-ids-in-screens.md b/.project/concepts/app-architecture/caveat_identity-ids-in-screens.md index ade18b3..16a1a09 100644 --- a/.project/concepts/app-architecture/caveat_identity-ids-in-screens.md +++ b/.project/concepts/app-architecture/caveat_identity-ids-in-screens.md @@ -1,28 +1,24 @@ --- type: caveat -summary: A screen juggles TWO ids for the current user that are not interchangeable — currentUserId (principal urn:festipod:user:…) for participation/friendship queries, currentUser.id (profile NURI) to compare against rendered profiles; getting it wrong raises no error, it just yields an empty list or counts you as an unknown participant -last_checked: 2026-07-27 +summary: currentUserId is now the profile document's NURI — the same value as currentUser.id — so the old two-id-spaces pitfall is gone; the live hazard is that it is EMPTY until the protected profile read lands, and nothing raises when a screen keys on it too early +last_checked: 2026-08-10 --- -# Pitfall: two ids for the current user inside a screen +# Pitfall: the current user arrives late, and empty reads like a value -`useFestipodData()` exposes **two** identifiers for the current user. They live in **different spaces** and are **never equal in connected mode**: +## What is true now — one id, not two -| Value | Space | What it is for | -|---|---|---| -| `currentUserId` | stable **principal** derived from the login identifier (`urn:festipod:user:`) | this is what **participations** and **friendships** store | -| `currentUser.id` | **NURI of the profile document** (`did:ng:…`) | this is what rendered **profiles** carry | +`currentUserId` **is** `currentUser?.id`: the **NURI of the profile document** the app reads back in its own protected scope. The two are no longer distinct spaces, because the app no longer derives a principal from anything it was told — it stopped naming its own identity altogether (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]). A participation written today carries that same NURI in `fp:user`. -In seed/demo mode the two coincide (`user-1`) — **the pitfall only shows up when connected**, and never as an error: just a wrong result. +> The earlier pitfall — a stable principal `urn:festipod:user:` on one side and a profile NURI on the other, never equal in connected mode — **no longer applies to values written today**. The provider still resolves the older principal form on read (`resolveParticipantUser`, concept `data-layer` → [[knowledge_context-internals]]); a screen never sees it. -## The rule +## The live hazard: `''` before the read lands -- Queries that **filter participations/friendships** — `getUserEvents(userId)`, `isParticipating(eventId, userId?)`, `getFriends(userId?)` — expect the **principal**. Their default value (`currentUserId`) is correct; **do not pass them** a profile `user.id`, or the list comes back **empty**. -- `getEventParticipants(eventId)` returns **profiles**. Any comparison over its result (typically "remove myself from the list") therefore goes through **`currentUser?.id`**, never `currentUserId`. +`currentUserId` is **empty** until the protected profile read resolves — and empty is a perfectly ordinary string. Nothing throws. -## What the mistake costs (observed) +- A **query** keyed on it (`getUserEvents`, `isParticipating`, `getFriends` — all defaulting to `currentUserId`) returns an **empty result** rather than an error, which renders as "you have nothing" instead of "not ready yet". +- A **mutation** that needs it refuses rather than writing a malformed entity: `joinEvent` logs `empty user principal — refusing to write a participation with no fp:user` and returns. A screen that assumed the write happened shows a success it did not get. -- Comparing `participant.id !== currentUserId` to filter yourself out **removes nothing**: you show up in your own list, and since the row is no longer recognized it renders as « participant inconnu ». -- Symmetrically, a screen displaying **another user's** events from their **profile id** (`getUserEvents(viewedUser.id)`) yields an empty list when connected — same cause. +**The rule**: treat an empty `currentUserId` as *not ready*, never as *no data*. Gate on it before rendering an emptiness verdict or firing a mutation that stores it. -The participation→profile join itself is **not** the screen's business: it is done in the provider (`resolveParticipantUser`), through the normalized identifier. Full mechanics and the write/read invariant: concept `data-layer`, [[knowledge_context-internals]]. +The participation→profile join itself is **not** the screen's business: it is done in the provider (`resolveParticipantUser`). Full mechanics and the write/read invariant: concept `data-layer`, [[knowledge_context-internals]]. diff --git a/.project/concepts/app-architecture/knowledge_app-shell.md b/.project/concepts/app-architecture/knowledge_app-shell.md index 6ffcee5..963e4be 100644 --- a/.project/concepts/app-architecture/knowledge_app-shell.md +++ b/.project/concepts/app-architecture/knowledge_app-shell.md @@ -1,7 +1,7 @@ --- type: knowledge -summary: src/app/ is the app's real shell — App.tsx stacks the providers (Theme > NextGraph > Account > FestipodData > Router), AuthGate keeps every routed screen behind the access barrier, and the shell switches screens according to the route -last_checked: 2026-07-27 +summary: src/app/ is the app's real shell — App.tsx stacks the providers (Theme > NextGraph > FestipodData > Router), AuthGate makes the one unconditional ensureIdentity() await and renders nothing of its own until it settles, and the shell switches screens according to the route +last_checked: 2026-08-10 --- # App shell @@ -16,28 +16,22 @@ last_checked: 2026-07-27 ``` ThemeProvider - └ NextGraphProvider (NextGraph connection cycle — concept data-layer) - └ AccountProvider (current identity = the identifier — concept app-security) - └ FestipodDataProvider (data, connected/demo mode — concept data-layer) - └ RouterProvider (current route + navigate) - └ div.app-container - ├ AuthGate (access barrier) - │ └ AppContent (switch route.page → screen) - └ ToastContainer + └ NextGraphProvider (NextGraph connection cycle — concept data-layer) + └ FestipodDataProvider (data, connected/demo mode — concept data-layer) + └ RouterProvider (current route + navigate) + └ div.app-container + ├ AuthGate (the one ensureIdentity() await; renders nothing of its own) + │ └ AppContent (switch route.page → screen) + └ ToastContainer ``` -`AppContent` reads `useRouter()` to resolve `route.page` → the screen to render. +`AppContent` reads `useRouter()` to resolve `route.page` → the screen to render. **There is no identity provider**: the app names no identity of its own (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]), so there is nothing to hold above the data provider. ### Ordering invariants (what breaks if you move a layer) -- **`AccountProvider` sits ABOVE `FestipodDataProvider`.** The data provider calls `useAccount()` to derive its principal (`currentUserId`) *and* to reset its session when the identity changes. Reversing the order breaks the whole identity resolution, silently. -- **`AuthGate` sits INSIDE the router**: it reads `useRouter()`/`useNavigate()` to leave the logged-out landing route once connected **and** identified. Moving it out of `RouterProvider` breaks it. -- **`AuthGate` wraps EVERY routed screen.** As long as the wallet is not open **or** the identifier is not resolved, `AccessGateScreen` is rendered **instead of** `AppContent`. Consequence: **no screen may assume it is reachable without an identity** — unless the barrier is disabled (see below). -- **`ToastContainer` sits OUTSIDE `AuthGate`** (but inside `.app-container`): it is mounted regardless of the barrier's state. - -### Disabling the barrier (two consumers) - -`AuthGate` is **ON by default**; it steps aside only if `globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__ === true`, set either by `build.ts` (from `ACCESS_GATE_DISABLED=1`, barrier-free build) or by the test harness via `addInitScript` for the `@e2e` tests (which exercise the screens, not the auth flow). **Impact**: the barrier flow is therefore **not** covered by the `@e2e` tests — its guards are `@ui` tests (concept `bdd-testing`). +- **`AuthGate` sits INSIDE the router**: it reads `useRouter()`/`useNavigate()` to leave the logged-out landing route once identified. Moving it out of `RouterProvider` breaks it. +- **`AuthGate` wraps EVERY routed screen**, and it holds them behind **one** condition: the single `await ensureIdentity()` (`@ng-eventually/polyfill`) it fires unconditionally on mount has resolved. Until it does, `AuthGate` renders **nothing at all** — there is no Festipod screen standing in for `AppContent` while it waits (concept `app-security`, [[decision_2026-08-10_sdk-renders-the-barrier]]). `AuthGate` does not read `useNextGraph()` — no `status`, no `connect()`, no error branch of its own. The identity await is not decoration: `ensureIdentity()` also does the connection work (restoring what others shared with us), so a screen mounted before it resolves would read as an identity that is not yet settled. Consequence: **no screen may assume it is reachable without a settled identity**, and there is no longer a way to disable the barrier — see [[caveat_boot-unverified-outside-broker]] for the one path this leaves unverified. +- **`ToastContainer` sits OUTSIDE `AuthGate`** (but inside `.app-container`): it is mounted regardless of whether identity has settled. ## Entry points diff --git a/.project/concepts/app-architecture/knowledge_module-structure.md b/.project/concepts/app-architecture/knowledge_module-structure.md index 8fc8304..3c5450c 100644 --- a/.project/concepts/app-architecture/knowledge_module-structure.md +++ b/.project/concepts/app-architecture/knowledge_module-structure.md @@ -30,11 +30,11 @@ Each module may contain: | Directory | Contents | |---|---| | `components/` | UI component library (see [[knowledge_screens]]) | -| `context/` | `ThemeContext`, `NextGraphContext`, `AccountContext` (current identity — concept `app-security`), `FestipodDataContext` (concept `data-layer`); their **stacking order** is constrained, see [[knowledge_app-shell]] | +| `context/` | `ThemeContext`, `NextGraphContext`, `FestipodDataContext` (concept `data-layer`); their **stacking order** is constrained, see [[knowledge_app-shell]]. There is no identity context — the app names no identity of its own (concept `app-security`) | | `data/` | User stories, `features.ts` (auto-generated), `seedData.ts`, `types.ts` | -| `hooks/` | `useShapeWithDefaults` (NextGraph) | +| `hooks/` | empty — the reactive read binding lives in `data/useShapeQuery.ts` (concept `data-layer`) | | `shapes/` | SHEX + ORM bindings (see concept `data-layer`) | -| `utils/` | `ngSession.ts`, `ngBootstrap.ts`, `ngGraph.ts` | +| `utils/` | `ngSession.ts`, `ngBootstrap.ts`, `ngGraph.ts`, `storeRegistry.ts`, `connections.ts`, `identifier.ts` | | `steps/`, `support/` | Shared Cucumber step definitions and hooks (concept `bdd-testing`) | | `lib/` | Helpers (`cn`, etc.) | diff --git a/.project/concepts/app-architecture/knowledge_screen-pattern.md b/.project/concepts/app-architecture/knowledge_screen-pattern.md index c659b0f..fdc163b 100644 --- a/.project/concepts/app-architecture/knowledge_screen-pattern.md +++ b/.project/concepts/app-architecture/knowledge_screen-pattern.md @@ -1,6 +1,7 @@ --- type: knowledge -summary: Canonical anatomy of a screen — named function with no props, reads everything through useFestipodData/useNavigate/useParams, flex column layout (Header / scrollable content / BottomNav on hub screens), feedback via showToast, hard-coded French labels +summary: Canonical anatomy of a screen — named function with no props, reads everything through useFestipodData/useNavigate/useParams, flex column layout (Header / scrollable content / BottomNav), feedback via showToast, hard-coded French labels; zero-prop rule has no exception left +last_checked: 2026-08-10 --- # Canonical screen pattern @@ -34,10 +35,8 @@ export function MyScreen() { // named function, NEVER any props ## Invariants -- **Zero props**: a screen receives nothing; everything comes from context/hooks (`useFestipodData`, `useNavigate`, `useParams`). Two exceptions, of different kinds: - - `WelcomeScreen` does not use `useFestipodData` (intro) — but still takes no props. (`LoginScreen`/`ConnexionScreen` no longer exist.) - - **`AccessGateScreen` is the only genuine exception to the zero-prop rule**: it is **not a routed screen**, it is rendered by `src/app/AuthGate.tsx`, which passes it `status`/`error`/`initialIdentifier`/`onEnter`. It therefore sits **outside the registry and outside the route table**, and has access to neither the router nor the data. See [[knowledge_screens]] and [[knowledge_app-shell]]. -- **Identity: two id spaces.** `currentUserId` (principal) and `currentUser.id` (profile NURI) are **not** interchangeable depending on the query — see [[caveat_identity-ids-in-screens]] before comparing an id inside a screen. +- **Zero props, no exception left**: every registered screen receives nothing; everything comes from context/hooks (`useFestipodData`, `useNavigate`, `useParams`). `WelcomeScreen` does not use `useFestipodData` (intro) — but still takes no props. (`LoginScreen`/`ConnexionScreen`/`AccessGateScreen` no longer exist — Festipod renders no access screen of its own; see [[knowledge_screens]] and [[knowledge_app-shell]].) +- **Identity: the current user may not be there yet.** `currentUserId` is the profile document the app reads back in its own protected scope, so it is **empty until that read lands** — see [[caveat_identity-ids-in-screens]] before keying anything on it. - **Layout**: full-height flex column; `Header` at the top, content at `flex:1; overflow:auto`, `BottomNav` at the bottom **only for hub screens** (Home, Events, Profile, Friends). Flow screens (creation, editing, detail) have no `BottomNav`. - **Feedback**: `showToast(message, 'success'|'info'|'error')` (`ToastContainer` mechanism exported by `sketchy/`). - **Labels**: **French, hard-coded** — no i18n, no translation keys anywhere in the project. diff --git a/.project/concepts/app-architecture/knowledge_screens.md b/.project/concepts/app-architecture/knowledge_screens.md index b5dc437..d4758ba 100644 --- a/.project/concepts/app-architecture/knowledge_screens.md +++ b/.project/concepts/app-architecture/knowledge_screens.md @@ -1,6 +1,7 @@ --- type: knowledge -summary: Inventory of screens per module, central registry src/screens/index.ts, and the component library under shared/components/sketchy/ — whose NAME is kept but which renders a modern theme (not hand-drawn) +summary: Inventory of screens per module, central registry src/screens/index.ts, and the component library under shared/components/sketchy/ — whose NAME is kept but which renders a modern theme (not hand-drawn); the auth module now holds only WelcomeScreen, no access screen of its own +last_checked: 2026-08-10 --- # Screens and components @@ -30,11 +31,9 @@ Screens per module (IDs = registry keys): - **home/**: `welcome`, `home`, `settings` - **event/**: `events`, `event-detail`, `create-event`, `update-event`, `invite`, `participants-list`, `meeting-points` - **user/**: `profile`, `update-profile`, `user-profile`, `friends-list`, `share-profile` -- **auth/**: `WelcomeScreen` (intro, routed at `/`) and `AccessGateScreen` — the **access barrier** (NextGraph login + identifier entry), rendered by `src/app/AuthGate.tsx`, **outside the registry and outside routing** (it is not a routed screen) and **driven by props** (`status`/`error`/`initialIdentifier`/`onEnter`), the only exception to the zero-prop rule ([[knowledge_screen-pattern]]). The former `LoginScreen`, then `ConnexionScreen`, have been removed (see concept `app-security`, [[knowledge_authentication]]). +- **auth/**: `WelcomeScreen` (intro, routed at `/`) is the only screen left in this module. Festipod renders **no access screen of its own** any more: `AccessGateScreen`, its route and its registration are deleted, along with the `LoginScreen`/`ConnexionScreen` that preceded it. Signing in is `src/app/AuthGate.tsx`'s single `await ensureIdentity()`; whatever a user sees or does while that resolves is drawn entirely by the SDK, outside the registry, outside routing, and outside this app's component tree (concept `app-security`, [[decision_2026-08-10_sdk-renders-the-barrier]]). - Structurally, this screen does **not** render a standard screen layout but a **choice between three mutually exclusive access branches**, driven by `status` + the presence of a shared wallet. **Impact**: a new access case is added as a branch here, **not** as a route. The content and ordering of the branches are `app-security` doctrine ([[knowledge_authentication]]) — do not redefine them from here. - -> The path → screen mapping lives in [[knowledge_routing]]. Most screens consume `useFestipodData()` (concept `data-layer`); exceptions: `WelcomeScreen` and the `AccessGateScreen` barrier. +> The path → screen mapping lives in [[knowledge_routing]]. Most screens consume `useFestipodData()` (concept `data-layer`); the exception is `WelcomeScreen`. ## Pitfall: incomplete registry diff --git a/.project/concepts/app-security/_overview.md b/.project/concepts/app-security/_overview.md index aa65e15..11fbd77 100644 --- a/.project/concepts/app-security/_overview.md +++ b/.project/concepts/app-security/_overview.md @@ -2,7 +2,7 @@ type: _overview summary: Festipod's security & privacy — isolation between scopes is enforced by the data SDK, the app trusts it and carries no authorization logic in the screens; wallet-based authentication; target authorization matrix still incubating triggers: - keywords: [sécurité, security, confidentialité, privacy, accès, "access control", contrôle d'accès, trust, confiance, authz, autorisation, permission, wallet, auth, authentification, anonyme, anonymat, pseudonyme, traçage, corrélation, overlay, cap-less, identité, login, scope, isolation] + keywords: [sécurité, security, confidentialité, privacy, accès, "access control", contrôle d'accès, trust, confiance, authz, autorisation, permission, wallet, auth, authentification, anonyme, anonymat, pseudonyme, traçage, corrélation, identité, login, scope, isolation] paths: ["src/modules/auth/**", "src/shared/context/NextGraphContext.tsx"] --- @@ -10,17 +10,20 @@ triggers: Festipod's **security, privacy and authorization** model. -- **Enforced model** — **isolation between scopes** (public / protected / private) is **enforced by the data SDK** (`@ng-eventually/client`), which exposes to each user only what they are entitled to. The app **trusts** the SDK: no screen carries authorization logic. See [[knowledge_trust-model]]. +- **Enforced model** — **isolation between scopes** (public / protected / private) is **enforced by the data SDK** (`@ng-eventually/polyfill`), which exposes to each user only what they are entitled to. The app **trusts** the SDK: no screen carries authorization logic. See [[knowledge_trust-model]]. - **Target authorization matrix** — the detail of *who may do what* per actor × verb (personal data = network, anonymity through the notification inbox): [[brief_2026-05-18_authorization-matrix]]. **Incubating.** It will graduate into `rule_`/`behavior_` as the product settles. -## Pitfalls (read BEFORE designing anything "anonymous") +## Pitfalls -- [[caveat_stable-overlay-pseudonym]] — a cap-less reference exposes a **permanent pseudonym** of the person; a single cross-reference de-anonymizes their entire history **retroactively**, and no rotation is known -- [[caveat_shared-wallet-global-before-gate-import]] — since the shared wallet is the only mode, a password global set **after** the barrier has been imported makes it unusable (config error screen, no field at all) +- [[caveat_shared-wallet-global-before-gate-import]] — a wallet-password global set **after** `sharedWallet.ts` has been imported makes `ensureIdentity()` throw and the app render nothing, silently + +> **Before designing anything "anonymous"**, read the closing section of [[knowledge_trust-model]]: the contract guarantees isolation, never anonymity, so a Festipod action that circulates a reference to someone's document is pseudonymous at best. ## Links - [[knowledge_trust-model]] — the app delegates isolation to the SDK, no access control in the screens -- [[knowledge_authentication]] — wallet-based auth, everyone authenticated, no anonymous access +- [[knowledge_authentication]] — wallet-based auth, everyone authenticated, no anonymous access, no screen of Festipod's own +- [[decision_2026-08-10_the-barrier-names-no-identity]] — the app names no identity: the barrier takes nothing, signing in is one `ensureIdentity()` +- [[decision_2026-08-10_sdk-renders-the-barrier]] — Festipod renders no access screen of its own; the SDK draws whatever a first-time device needs to see - [[brief_2026-05-18_authorization-matrix]] — target authorization matrix (incubating) - Concept `functional-domain` → [[knowledge_data-scopes-and-discovery]] — which scope for which entity (product fact) diff --git a/.project/concepts/app-security/caveat_shared-wallet-global-before-gate-import.md b/.project/concepts/app-security/caveat_shared-wallet-global-before-gate-import.md index a55b05c..eebd010 100644 --- a/.project/concepts/app-security/caveat_shared-wallet-global-before-gate-import.md +++ b/.project/concepts/app-security/caveat_shared-wallet-global-before-gate-import.md @@ -1,21 +1,22 @@ --- type: caveat -summary: The shared wallet password is captured at the EVALUATION of src/modules/auth/sharedWallet.ts; now that the shared wallet is the only mode, a value missing at that instant no longer yields a degraded form but a configuration error screen WITHOUT any identifier field — every entry point that renders AccessGateScreen must set the global BEFORE the module is first imported -last_checked: 2026-07-27 +summary: The wallet password is captured at the EVALUATION of src/shared/utils/sharedWallet.ts; a value set after that first import is never re-read — a missing one used to yield AccessGateScreen's error block, now it makes ensureIdentity() throw and the app render nothing at all, silently +last_checked: 2026-08-10 --- -# Pitfall: set the shared-wallet global BEFORE importing the barrier +# Pitfall: set the wallet-password global BEFORE the module is first imported -**The invariant.** `src/modules/auth/sharedWallet.ts` reads `globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__` **exactly once, at module evaluation** (the `SHARED_WALLET_PASSWORD` constant, surfaced by `hasSharedWallet()`). A value set *after* that first import is never re-read. +The contract requires a deployment to **serve a wallet file and pass its URL and password to `configure`** ([[contract_polyfill-surface]]). Festipod does that from one module, and *when* that module is evaluated decides whether the value arrives at all. -**Why it became blocking.** As long as "no shared wallet" was a fallback mode, a missing global degraded into a still-usable form — evaluation order was cosmetic. Since [[decision_2026-07-20_shared-wallet-only-mode]], `hasSharedWallet() === false` is a **configuration error**: `AccessGateScreen` renders an error block **with no identifier field**. The barrier becomes a dead end, not a degraded login. +**The invariant.** `src/shared/utils/sharedWallet.ts` reads `globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__` **exactly once, at module evaluation** (the `SHARED_WALLET_PASSWORD` constant, surfaced by `hasSharedWallet()`). A value set *after* that first import is never re-read. This module used to be `src/modules/auth/sharedWallet.ts`; that file, and `AccessGateScreen` which was its only reason to sit in the `auth` module, are both deleted — the surviving copy lives in `shared/utils/` and is imported by `src/shared/utils/ngSession.ts`, which reads `hasSharedWallet()` to decide whether to pass a `sharedWallet` config into the SDK's `configure()`. + +**Why it still matters, and how the consequence changed.** `hasSharedWallet() === false` is a **misconfiguration**, not a degraded mode: the contract makes serving a wallet file and passing its URL and password a deployment requirement, so an app without them cannot sign anyone in. With no `sharedWallet` passed, `ensureIdentity()` **throws**, and `AuthGate` shows its named error panel — loud, which is the point. What must never come back is a silent fallback that renders screens anyway: a session that failed looks exactly like an account that owns nothing. ## Impact — if I touch X, Y breaks -- **Static import = trap.** A static `import` of `AccessGateScreen` (or of any module that transitively reaches `sharedWallet.ts`) from an entry point that sets the global itself is **hoisted above the assignment** → empty password → error screen, with no JS error to signal it. The remedy is a **dynamic import** (`await import(...)`) executed after setting the global. -- **Entry points concerned today**: the frontend served from `src/` (`src/app/frontend.tsx` fetches `/festipod-config.json`, sets the global, then imports the app dynamically — mechanics detailed in tech-stack → [[knowledge_build-pipeline]]) and the `@ui` harness that renders the barrier (`src/modules/auth/steps/ui/barriere-acces.steps.ts`, same set-then-lazy-import sequence). A bundle produced by `build.ts` is **not** concerned: there the value is inlined by `define`. -- **Operations**: a server without `FESTIPOD_SHARED_WALLET_PASSWORD` serves **no** working barrier at all — by design (fail loudly). Treat it as a configuration outage, not as a screen bug. +- **Static import = trap.** A static `import` reaching `ngSession.ts` (hence `sharedWallet.ts`) from an entry point that sets the global itself is **hoisted above the assignment** → empty password → the failure mode above, with no JS error at the import site to signal it. The remedy is a **dynamic import** (`await import(...)`) executed after setting the global. +- **The real entry point that must get this right**: the frontend served from `src/` (`src/app/frontend.tsx` fetches `/festipod-config.json`, sets the global, then imports `App` dynamically — mechanics in `tech-stack` → [[knowledge_build-pipeline]]). A bundle produced by `build.ts` is **not** concerned: there the value is inlined by `define`. +- **`@ui` reaches the module too, but harmlessly today.** `screens/index.ts` eagerly imports every screen including `SettingsScreen`, which imports `ngSession.ts` — so any `@ui` test already evaluates `sharedWallet.ts` with the global unset. This does not currently break anything because no `@ui` path calls `ensureIdentity()` (`renderScreen()` bypasses `AuthGate`/`NextGraphProvider` entirely); see `bdd-testing` → [[knowledge_ui-layer]] for the detail and for what would make it stop being harmless. +- **Operations**: a server without `FESTIPOD_SHARED_WALLET_PASSWORD` now fails **silently** (blank page, console-only) rather than with a screen saying so — worth knowing when diagnosing "the app shows nothing." -**Verified (2026-07-27)**: capture at evaluation time in `sharedWallet.ts`, and the `!hasSharedWallet()` guard as the first branch of `AccessGateScreen`. - -> Caveat: the header of `sharedWallet.ts` still describes the old fallback ("the gate falls back to the plain flow") — an obsolete comment; what `AccessGateScreen` actually renders is authoritative. +**Verified (2026-08-10)**: capture at evaluation time in `src/shared/utils/sharedWallet.ts`; the `sharedWallet: hasSharedWallet() ? {...} : undefined` branch in `ngSession.ts`'s `configure()` call; the `throw` in `ensureIdentity()` when no `sharedWallet` config is present; `AuthGate`'s `.catch(err => console.error(...))` with no fallback UI. diff --git a/.project/concepts/app-security/caveat_stable-overlay-pseudonym.md b/.project/concepts/app-security/caveat_stable-overlay-pseudonym.md deleted file mode 100644 index 38ae1bb..0000000 --- a/.project/concepts/app-security/caveat_stable-overlay-pseudonym.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -type: caveat -summary: Any cap-less reference to a person's protected document exposes the `:v:` of their store — a STABLE AND PERMANENT pseudonym, identical everywhere and forever. It does not say who, but a single cross-reference RETROACTIVELY de-anonymizes all of their past and future references. It is the very same bit of information that makes anonymous dedup possible. No known rotation. -last_checked: 2026-07-27 ---- - -# Pitfall: the `:v:` of a cap-less reference is a permanent pseudonym - -**Read this before designing anything that circulates cap-less references** (registrations, invitations, mentions, indexes, notifications). - -## The fact - -A NURI is written `did:ng:o:{document}:v:{overlay}`. The `:v:` segment does **not** come from the document but from **its store** — and a person has **exactly one** *protected* store. Therefore: - -> **All** cap-less references to **any** of a person's protected documents carry the **same** `:v:`. Everywhere, and forever. - -VERIFIED in `nextgraph-rs` (the details and the pointers live on the polyfill side, `docs/readcap-and-nuri-model.md`): the value injected when a document is created is the overlay of the containing store; a `Repo` carries no overlay of its own, and every block access of a `Store` goes through **its** `overlay_id` — a per-document overlay is therefore structurally impossible, not merely absent. - -## Why this is a pitfall and not just a limitation - -This `:v:` **does not say who** — it is a non-invertible `BLAKE3` of the store id. The temptation is therefore to treat it as opaque, hence harmless. It is not: it is a **constant handle**. - -- **Correlation** — anyone collecting cap-less references can link together all those belonging to one and the same person, without ever identifying them. Recurring presence, memberships, rhythm. -- **Retroactive de-anonymization** — this is the real danger. **One single** cross-reference, **one single time** (a person naming themselves, a channel that leaks, a match against outside data), is enough for `:v:X` to become attached to an identity. At that instant, **all** of the history tied to that `:v:` flips at once — including what was published years earlier in the belief that it was anonymous. -- **No way out** — VERIFIED, along four axes: no overlay rotation (the outer one is a pure hash of the store id, with no secret); the store id is generated once at identity creation and never regenerated; there is no migration path for content towards a new store; and no form of reference allows locating a document without exposing its store's overlay. Renewing capabilities would only change the *inner* overlay — the outer one, the only one present in cap-less NURIs, would survive it. **The only way out is to abandon the entire identity**, which carries none of the content along. Reported upstream as a possible design flaw (`orm-tests/INBOX/2026-07-27-outer-overlay-permanent-pseudonym-no-rotation.md`, see [[rule_nextgraph-inbox]]). - -## The coupling you must not hope to break - -That very same `:v:` is what makes it possible to **deduplicate without reading** — two references sharing a `:v:` come from the same person, and that is the basis of the anonymous participant counter ([[brief_2026-07-20_attendance-set-model]] on the `data-layer` side). - -**It is the same bit of information.** Anonymous dedup and untraceability are not two requirements to be reconciled: they are two readings of one and the same piece of data. You cannot obtain one by removing the other. The only real dial is **how the stores are carved up** — which shifts the trade-off without making it disappear. - -And this is **not** an artifact of the polyfill: the property survives into real NextGraph. - -## What to do about it - -- **Never present an action to the user** as "anonymous" without a caveat if it circulates a cap-less reference. It is **pseudonymous**, and the pseudonym is permanent. -- **Count** the occurrences of a `:v:` that you expose: every additional context in which it appears widens the cross-referencing surface. -- **Recheck** this caveat if NextGraph introduces overlay rotation or an indirect form of reference — it would then become moot, which would be good news. - -Links: [[knowledge_trust-model]], [[brief_2026-05-18_authorization-matrix]], data-layer ([[brief_2026-07-20_attendance-set-model]], [[rule_capture-nextgraph-findings]], [[rule_nextgraph-inbox]]). diff --git a/.project/concepts/app-security/decision_2026-07-06_identifier-at-access-barrier.md b/.project/concepts/app-security/decision_2026-07-06_identifier-at-access-barrier.md deleted file mode 100644 index c42acd3..0000000 --- a/.project/concepts/app-security/decision_2026-07-06_identifier-at-access-barrier.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -type: decision -summary: The identifier of the virtual space is entered at the access barrier (AccessGateScreen), in the same act that opens the wallet; the separate "perceived login" screen (ConnexionScreen, « choisissez un nom d'utilisateur ») is removed; the identifier is a lowercase-normalized technical id, not a Festipod username ---- - -# Decision (2026-07-06): identifier entered at the access barrier - -## Context - -The earlier stopgap flow (decision of 2026-06-15, a note that disappeared along with the `nextgraph-platform` concept — see `git log`) chained **two screens**: (1) `AccessGateScreen`, the access barrier (the real NextGraph login, opening the shared wallet); (2) `ConnexionScreen`, a "perceived login" where the user picked a **username**. That application-level identity was in fact the key of the **virtual wallet** (shim account / cap owner key), not a product username — so the "username" framing was misleading (confusing `setUsername` logic). - -## Decision - -The user enters their **identifier** directly in `AccessGateScreen`, **in the same act** that opens the wallet (« Entrer » records the identifier, then triggers `connect()`). `ConnexionScreen` is **deleted**. The identifier: - -- is a **technical id** that names the virtual space (a nickname in practice, **not** a Festipod username); -- is **normalized** on entry (trimmed, `@` stripped, **lowercased**) and persisted before the broker redirect (so it survives the round-trip); -- **is** the identity id handed to the SDK (`setCurrentUser`), and the key for the caps and the shim account — no more mixed-case handle to reconcile. - -`AuthGate` therefore shows the barrier as long as the wallet is not open **or** the identifier is not set, then the app directly — with no intermediate screen. - -## Rejected alternatives - -- **Keeping both screens**: the second, "username" screen perpetuated the confusion between product identity and wallet identifier, and added a step with no value. -- **Deriving the identifier from the wallet** (no entry at all): impossible here — there is a single shared wallet; the identifier is precisely what distinguishes the virtual spaces inside that wallet (emulation, see concept `data-layer` and the `@ng-eventually/client` SDK). - -## Scope - -Supersedes the "screen 2 / perceived login" part of the 2026-06-15 stopgap flow (opening the shared wallet through the broker is unchanged). Current state of the flow: [[knowledge_authentication]]. diff --git a/.project/concepts/app-security/decision_2026-07-20_shared-wallet-only-mode.md b/.project/concepts/app-security/decision_2026-07-20_shared-wallet-only-mode.md deleted file mode 100644 index 36a9050..0000000 --- a/.project/concepts/app-security/decision_2026-07-20_shared-wallet-only-mode.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -type: decision -summary: The shared wallet is the ONLY operating mode (the @ng-eventually/client polyfill relies on it as its data backend); the "no shared wallet" fallback is removed — misconfiguration → a blunt error screen, no more bare form. Reaffirms that the barrier's identifier = the wallet/space id, distinct from the profile username. ---- - -# Decision (2026-07-20) — the shared wallet is the only mode; identifier ≠ profile username - -## Context - -Observed regression: on opening, the app landed on a **bare form asking for an identifier**, without the wallet-loading assistance. Cause: `FESTIPOD_SHARED_WALLET_PASSWORD` undefined in the server environment → `hasSharedWallet()` false → `AccessGateScreen` switched to its fallback mode. But that mode is a **dead end**: a device with no wallet cannot connect once the import assistance is hidden. In parallel, the old notion of "username" was still lingering to designate the **wallet identity**, which conflated it with the real profile username. - -## Decision - -1. **The shared wallet is the only supported mode.** Festipod does not work without it — the `@ng-eventually/client` polyfill uses it as its data backend (see [[knowledge_authentication]], `rule_app-uses-sdk-surface-only`). `hasSharedWallet() === false` is therefore **not a functional mode**: it is a **misconfiguration** → `AccessGateScreen` displays a **blunt error screen** (« Portefeuille partagé non configuré, définir `FESTIPOD_SHARED_WALLET_PASSWORD` »), never the dead-end bare form. - -2. **The barrier's identifier ≠ the profile username.** The identifier entered in `AccessGateScreen` is the **technical id of the wallet/space** (lowercase-normalized, carried by the `?id=` URL param), not a username. The **username** is a distinct concept living in `UserProfile` (`@handle`, predicate `http://festipod.org/username`). Code and tests must no longer label the wallet identity "username/user" (renamed to `identifier`). Reaffirms and extends [[decision_2026-07-06_identifier-at-access-barrier]]. - -## Consequences - -- `AccessGateScreen`: three-branch rendering (config error / assisted import flow when not connected / identifier field alone when already connected). -- `username → identifier` rename of the wallet identity across the test infrastructure (`freshScenarioIdentifier`, `freshIdentifier`), `registration.ts`, `ngSession`, plus comments; **`UserProfile.username` untouched** (profile, seed, display, SHEX). -- `.env.example` added at the root to make the configuration explicit (including `FESTIPOD_SHARED_WALLET_PASSWORD`, `FESTIPOD_SHARED_WALLET_FILE`). - -## Rejected alternative - -Keeping the wallet-less fallback as a future "own-wallet flow": rejected **for now** — no own-wallet flow in the near term, and the silent fallback created a misleading dead end. To be reintroduced **explicitly** the day an own-wallet mode (each user with their own NextGraph wallet) exists, outside the stopgap. - -## Links - -- Shared-wallet stopgap: `decision_2026-06-15_shared-wallet-login-flow` (referenced by `AccessGateScreen`/`AccountContext`). -- [[decision_2026-07-06_identifier-at-access-barrier]] — the identifier at the barrier. -- [[knowledge_authentication]], [[knowledge_trust-model]]. diff --git a/.project/concepts/app-security/decision_2026-08-10_sdk-renders-the-barrier.md b/.project/concepts/app-security/decision_2026-08-10_sdk-renders-the-barrier.md new file mode 100644 index 0000000..0e0b04a --- /dev/null +++ b/.project/concepts/app-security/decision_2026-08-10_sdk-renders-the-barrier.md @@ -0,0 +1,26 @@ +--- +type: decision +summary: Festipod deleted its own access-gate screen (AccessGateScreen, its route, its wallet module) and relies entirely on the SDK's ensureIdentity() to show whatever a first-time device needs to see; cost accepted: the app can no longer test that path itself, from any layer +--- + +# Decision (2026-08-10): the SDK renders the barrier, Festipod renders none + +## Context + +[[decision_2026-08-10_the-barrier-names-no-identity]] settled *what* the barrier asks (nothing — no identifier). It left open a separate question: *who draws the screen* a device sees while `ensureIdentity()` resolves — a Festipod component still fed by SDK state, or nothing on Festipod's side at all. + +## Decision + +**Festipod renders no access screen of its own.** `AccessGateScreen`, its route, its registration, and `src/modules/auth/sharedWallet.ts` (the wallet re-export whose only consumer it was) are deleted. `src/app/AuthGate.tsx` makes a single unconditional `await ensureIdentity()` and renders nothing until it settles — it no longer couples to `useNextGraph()`'s status, `connect()`, or error state. Whatever a user has to see or do while the wallet loads onto a first-time device belongs to the SDK, which shows it: the library owns that flow end to end and absorbed it precisely so consumer applications can delete theirs (see [[contract_polyfill-surface]] on `ensureIdentity`). `src/shared/utils/sharedWallet.ts` keeps the one surviving copy of the wallet material (file URL, password, import URL) and hands it to the SDK through `configure({ sharedWallet })` — Festipod's only remaining involvement is supplying those three values, never displaying them. + +## Cost accepted + +Festipod now has **no test at all** proving a first-time device can get in. The contract publishes no testid, no DOM contract and no call for a test to interact with the SDK's barrier, so the scenario that used to drive `AccessGateScreen`'s own DOM ("Parcours humain — le testeur importe le portefeuille fourni par Festipod et se connecte", `workshop/multibrowser-harness.feature`) had nothing left to assert and was deleted rather than rewritten. See [[caveat_first-time-entry-untested]] (concept `bdd-testing`). Raised with the provider. + +## Rejected alternative + +**Keep a thin Festipod wrapper around the SDK's state** (a `status`/`error`/`onEnter`-driven screen, still Festipod-rendered). Rejected: it would recreate the exact code the library moved out of consumer applications, for a flow already declared owned by the SDK — a wrapper an application must still write, test and delete at migration is not an absorption, it is the old cost with new labels. + +## Scope + +Distinct from [[decision_2026-08-10_the-barrier-names-no-identity]] (that one settles *what* the barrier asks; this one settles *who draws it*). Current state of the flow: [[knowledge_authentication]]. diff --git a/.project/concepts/app-security/decision_2026-08-10_the-barrier-names-no-identity.md b/.project/concepts/app-security/decision_2026-08-10_the-barrier-names-no-identity.md new file mode 100644 index 0000000..c339b3d --- /dev/null +++ b/.project/concepts/app-security/decision_2026-08-10_the-barrier-names-no-identity.md @@ -0,0 +1,34 @@ +--- +type: decision +summary: The access barrier no longer takes an identifier — the SDK surface stopped letting an application name its own identity, so signing in is one ensureIdentity() call that takes nothing; supersedes the identifier half of the 2026-07-06 and 2026-07-20 arbitrations +--- + +# Decision (2026-08-10): the barrier names no identity + +## Context + +Earlier arbitrations put an **identifier** at the access barrier: the user typed it in the same act that opened the wallet, and the application handed it to the data layer. They rested on a premise the provider has since withdrawn — that an application **names its own identity**. (Those leaves were deleted on 2026-08-16, with everything else that described the data layer's internals; `git log` has them.) + +The pulled [[contract_polyfill-surface]] removes that premise explicitly. `ensureIdentity()` takes **no identifier**, and the contract states why: naming your own identity is *"the gesture that inverts the model"*, so a "set my identity" call was removed rather than renamed. There is no successor call — the capability is gone, not relocated. + +## Decision + +**Festipod does not name, persist or switch its own identity.** Concretely: + +- The barrier asks for nothing but the wallet: « Entrer » triggers the broker redirect and nothing else. +- Signing in is **one await on `ensureIdentity()`**, in `src/app/AuthGate.tsx`, before any screen renders. +- All app-side identity machinery is deleted: the identity context, the `?id=` URL param that carried it across the broker round-trip, the localStorage key, the app-level (faux) logout. The only logout left is the **wallet session** one. +- **Who the current user is** is no longer derived from an input; it is **the profile document read back in the app's own protected scope**. + +## Consequences accepted with it + +- **Multi-identity on one page is no longer expressible**, and that is correct rather than missing: it was a property of *one wallet hosting several identities*, i.e. emulation scaffolding. Multi-user is exercised as it is lived — several browser contexts, each signing in as itself ([[rule_tests-validate-festipod-not-the-sdk]] in bdd-testing). +- **The `@data` layer lost its per-scenario determinism**, which the app used to provide by planting a fresh identity per scenario. The app cannot restore it — choosing which identity comes up is exactly what the surface no longer allows. Open, with the provider: [[caveat_data-scenarios-share-one-wallet]]. + +## Rejected alternative + +**Keeping an app-side identifier and mapping it onto the SDK behind the scenes.** Rejected: it would teach the application a model it must unlearn, and it would convert a deliberate provider decision into an app-side workaround nobody revisits ([[rule_app-uses-sdk-surface-only]]). + +## Scope + +Supersedes every earlier arbitration that put an identifier at the barrier. Current state of the flow: [[knowledge_authentication]]. diff --git a/.project/concepts/app-security/knowledge_authentication.md b/.project/concepts/app-security/knowledge_authentication.md index 25953d7..9624337 100644 --- a/.project/concepts/app-security/knowledge_authentication.md +++ b/.project/concepts/app-security/knowledge_authentication.md @@ -1,24 +1,33 @@ --- type: knowledge -summary: A user's identity = their NextGraph wallet; every user is authenticated (no anonymous access); auth is delegated to the SDK, the app has no application-level accounts or passwords +summary: A user's identity = their NextGraph wallet; every user is authenticated (no anonymous access); the app never names, persists or switches its own identity, and renders no access screen of its own — AuthGate awaits ONE unconditional ensureIdentity() before anything renders +last_checked: 2026-08-10 --- # Authentication -**A user's identity = their NextGraph wallet.** There is **no anonymous access** to the app: every user is authenticated (see concept `functional-domain`). There is **no application-level account/password system** — authentication is **delegated to the data SDK** (`@ng-eventually/client`): opening your session means opening your wallet. +**A user's identity = their NextGraph wallet.** There is **no anonymous access** to the app: every user is authenticated (see concept `functional-domain`). There is **no application-level account/password system** — authentication is **delegated to the data SDK** (`@ng-eventually/polyfill`): opening your session means opening your wallet. -## Flow +## The flow — one act, no screen of Festipod's own -- The **access barrier** (`AccessGateScreen`, rendered by `src/app/AuthGate.tsx`) is the real NextGraph login: it opens the shared wallet through the broker redirect. **In the same act**, the user enters an **identifier** that names their virtual space (`onEnter`). There is **no separate "perceived login" screen any more** (the former `ConnexionScreen`, « choisissez un nom d'utilisateur », has been removed — see [[decision_2026-07-06_identifier-at-access-barrier]]; supersedes the two-screen flow of the 2026-06-15 stopgap). -- **The shared wallet is the ONLY supported mode**: `AccessGateScreen` has **three branches** — (1) *configuration error* if no shared wallet is configured (no more dead-end bare form), (2) the **assisted import** flow as long as the session is not connected, (3) the **identifier field alone** once connected. See [[decision_2026-07-20_shared-wallet-only-mode]], and the evaluation-order pitfall [[caveat_shared-wallet-global-before-gate-import]] (the password global must be set before the screen is first imported, otherwise you land on branch 1). -- **Vocabulary in the code**: the wallet identity is called `identifier` everywhere (`registration.ts`, `ngSession`, hooks and test steps) — **never** `username`, which exclusively designates the profile handle `UserProfile.username`. Do not relabel one as the other: they are two distinct identity spaces. -- This **identifier is a technical id** (a nickname in practice, **not** a Festipod username): it is **normalized** (trimmed, `@` stripped, **lowercased**) then persisted (`AccountContext` → `IdentityStore`), so a reload — or another device reopening the same shared wallet — lands back on the same space. It is this id that is handed to the SDK (`setCurrentUser`) and on which the caps and the shim account are keyed. -- **Carried across the boundary by a URL PARAM `?id=`** (source of truth), NOT by localStorage. The app runs in two contexts — **top-level** (`127.0.0.1:3000` directly, `window.self === window.top`, where the barrier is displayed) and **iframe** (embedded under `nextgraph.net` after the broker round-trip, `window.self !== window.top`). The browser **partitions storage by top-level site**: the top-level's localStorage and the iframe's are **two distinct partitions** → localStorage CANNOT carry the identity from one context to the other (observed symptom: two diverging values depending on the context). The SDK redirects via `location.href = broker + encodeURIComponent(window.location.href)` (embedding the full app URL, query string included, into the `o=` that is reloaded in the iframe), so a **URL param does cross over**. `AuthGate` writes `?id=` (`history.replaceState`) **before** `connect()`; `AccountContext` resolves the identifier by priority: **(1) `?id=` from the URL** then **(2) localStorage** (prefill/convenience within the same partition only). localStorage key: `festipod.account.identifier`. -- **Entered ONLY ONCE on first access + prefilled on return.** On a top-level reload the NG session is not restored automatically (`NextGraphContext` starts back at `disconnected`): `AuthGate` shows the barrier again as long as `status !== 'connected'`, but the `AccessGateScreen` field is **prefilled** (`initialIdentifier` prop) — never a bare, empty field. Regressions guarded by `src/modules/auth/features/{barriere-acces-identifiant,identifiant-resolution}.feature` (@ui) — all the more useful because the barrier flow is **disabled** in the @e2e tests (`__FESTIPOD_ACCESS_GATE_DISABLED__`), and therefore invisible at that layer. -- Once the session is open, the current user and their access to the per-scope stores are provided by `NextGraphContext`. +**Signing in is `src/app/AuthGate.tsx`'s single, unconditional `await ensureIdentity()`.** It fires on mount, with no dependency on `NextGraphContext`'s connection status. **Nothing of the app renders before it resolves**: `ensureIdentity()` settles who we are *and* does the connection work (restoring what others shared with us). A screen mounted earlier would read as an identity that is not yet settled. + +**Festipod renders no access screen of its own.** `AccessGateScreen`, its route and its registration are deleted; whatever a user has to see or do while the SDK resolves — opening the shared wallet, loading it onto a first-time device — is drawn entirely by the SDK. The library owns that flow and absorbed it precisely so consumer applications can delete theirs. See [[decision_2026-08-10_sdk-renders-the-barrier]]. + +**The application never names, persists or switches its own identity.** `ensureIdentity()` takes **no identifier**, deliberately, and the contract states that **no other call takes one either** ([[contract_polyfill-surface]]). There is consequently **no** app-side identity state at all: no identity context, no `?id=` URL param, no localStorage identity key, no "set my identity" call. See [[decision_2026-08-10_the-barrier-names-no-identity]]. + +**Festipod's only remaining involvement is supplying the wallet material, never displaying it.** `src/shared/utils/sharedWallet.ts` holds the one copy of the file URL, password and import URL this deployment hands out, and passes them to the SDK through `configure({ sharedWallet })` in `src/shared/utils/ngSession.ts` — the contract makes that a deployment requirement. The one hazard left around that module is an evaluation-order trap, [[caveat_shared-wallet-global-before-gate-import]]. Misconfiguration (no password set) makes `ensureIdentity()` throw, and `AuthGate` shows its named error panel instead of any screen. + +**Signing out.** The only logout left is the **wallet session** one (`logoutNg`, offered as « Quitter l'environnement de test » in the settings screen): it stops the shared-wallet session so the next access goes back through the broker. There is no app-level sign-out, because there is no app-level identity to sign out of. + +## Who the current user IS, seen from the app + +The app does not derive an identity from anything it was told; **what it is, is the profile document it reads back in its own protected scope**. That value is therefore empty until the protected read lands — the mechanics and the hazard that follows live in concept `data-layer`, [[knowledge_context-internals]] and `app-architecture` → [[caveat_identity-ids-in-screens]]. + +**Vocabulary.** `username` designates the profile handle `UserProfile.username` and nothing else. `normalizeIdentifier` (`src/shared/utils/identifier.ts`) is a **pure string normalization** of that handle, applied only to `UserProfile.username` — the join between a profile and the person it belongs to, and the name given when sharing a document with a neighbour. It is never applied to the identity: normalising an identity belongs to the data layer, which the contract states outright, and no configuration hook takes it from us. It names no space, account or session. ## The test wallet -The `@data`/`@e2e` tests open a real wallet (`festipod-tests`, persistent profile) — see concept `bdd-testing`. These are **plaintext test credentials**, with no security stake, dedicated to staging. +The `@data`/`@e2e` tests open a real wallet (`festipod-tests`, persistent profile) — see concept `bdd-testing`. These are **plaintext test credentials**, with no security stake, dedicated to staging. Since no call takes an identifier, a scenario cannot choose which identity it comes up as: every scenario in a run shares that one wallet, which keeps growing — [[caveat_data-scenarios-share-one-wallet]] (bdd-testing). > The authorization model that will build on this identity (bilateral connections, personal data = network, host anonymity) is incubating: [[brief_2026-05-18_authorization-matrix]]. diff --git a/.project/concepts/app-security/knowledge_trust-model.md b/.project/concepts/app-security/knowledge_trust-model.md index a74bca7..f9069b5 100644 --- a/.project/concepts/app-security/knowledge_trust-model.md +++ b/.project/concepts/app-security/knowledge_trust-model.md @@ -1,21 +1,25 @@ --- type: knowledge -summary: Isolation between scopes (public/protected/private) is enforced by the data SDK; the app trusts it and only displays what it returns — no access control in the screens, all privacy rests on the SDK -last_checked: 2026-07-06 +summary: Isolation between scopes (public/protected/private) is enforced by the data SDK; the app trusts it and only displays what it returns — no access control in the screens, and the only thing it declares is which of its own documents it shares with whom +last_checked: 2026-08-10 --- # Trust model -**Stance:** the app reads data through the ORM subscriptions of the `@ng-eventually/client` SDK and displays it **with no app-side authorization logic** (`src/shared/context/FestipodDataContext.tsx`, `useNgData`). +**Stance:** the app reads data through the ORM subscriptions of the `@ng-eventually/polyfill` SDK and displays it **with no app-side authorization logic** (`src/shared/context/FestipodDataContext.tsx`, `useNgData`). Principles: 1. **Isolation is delegated to the SDK.** Every entity lives in the store of its **scope** (public / protected / private, see concept `functional-domain` → [[knowledge_data-scopes-and-discovery]]); the SDK **exposes to the current user only what they are entitled to**. The app assumes that whatever it receives is already authorized — privacy rests on the SDK, not on Festipod code. 2. **Screens carry no access rules.** No "is this user allowed to see this data" check in the components, nor in the data context. The public / network / private separation is a property of **placement by scope**, not of an application-level filter. -3. **The relationship between users ("connections") is an application-level notion, not an SDK primitive.** NextGraph has no bilateral connection/friendship primitive; on the SDK side there is only a **directed read grant** towards an identity. The app therefore **owns** its relationship graph (`src/shared/utils/connections.ts`) and **translates** it into per-document directed grants handed to the SDK — it does not delegate the notion of a relationship to the SDK, only the **enforcement** of the isolation that follows from it. What the app declares to the SDK stays minimal: **its identity** (the identifier, see [[knowledge_authentication]]) and **those grants**; it still carries no access logic in the screens. +3. **The relationship between users ("connections") is an application-level notion.** The contract publishes no connection or friendship primitive: it models reading as **key possession**, and giving someone that key is **one act** — `inbox.share(doc, toUser)`, naming the document and the person. The app therefore **owns** its relationship graph (`src/shared/utils/connections.ts`) and, once a link is two-sided, **shares its own protected documents** with that neighbour. It does not delegate the notion of a relationship, only the **enforcement** of the isolation that follows from it. + + What the app declares to the SDK is now **only those shares**: it declares **no identity** ([[decision_2026-08-10_the-barrier-names-no-identity]]), and it **never handles a key or an inbox address** — neither exists in app code. Sharing is also **irreversible**: the contract publishes no revocation, so an act of sharing is permanent ([[contract_polyfill-surface]]). ## The point to watch Because the app **displays everything it receives**, privacy rests entirely on the SDK exposing only what is legitimate. It is a deliberate choice (the app stays thin), but it means **never reintroducing on the screen side a piece of data that the scope should not have let through**. +**And never promise anonymity.** The contract guarantees isolation per document; it guarantees **no anonymity** — nothing per reader on a public document, no revocation, and a reference that names a person's document remains comparable wherever it travels. So a Festipod action that circulates such a reference (a sign-up, an invitation, a mention, an index entry) is **pseudonymous at best**: do not label it "anonymous" in the interface, and count the contexts in which you expose the same reference. + > To check when in doubt: `useNgData` in `FestipodDataContext.tsx` contains no identity-filtering branch — that is intentional, isolation comes from below. diff --git a/.project/concepts/bdd-testing/_debt.md b/.project/concepts/bdd-testing/_debt.md deleted file mode 100644 index 811dd8b..0000000 --- a/.project/concepts/bdd-testing/_debt.md +++ /dev/null @@ -1,9 +0,0 @@ -# Doc-debt — bdd-testing - -> Presence of a block = doc to update. Processed → delete the block; no blocks left → delete this file. -> One block = one "big change": `why` + `files` + `verify` (leaves to review). - -## Raw markers (consolidate into blocks, then delete) -- TOUCHED src/modules/event/steps/data/reconnexion.steps.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/shared/test-harness/harness-ng.tsx @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/modules/workshop/steps/data/protected-connections.steps.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/.project/concepts/bdd-testing/_overview.md b/.project/concepts/bdd-testing/_overview.md index 987751a..b51dc61 100644 --- a/.project/concepts/bdd-testing/_overview.md +++ b/.project/concepts/bdd-testing/_overview.md @@ -2,7 +2,7 @@ type: _overview summary: BDD Cucumber/Gherkin in French across 3 layers (@ui, @data, @e2e) — setup, layer contract (what to test where), real broker harness, and the source-grep leftovers pitfall triggers: - keywords: [cucumber, gherkin, bdd, feature, scenario, scénario, step, steps, "@ui", "@data", "@e2e", playwright, broker, harness, wallet, world, hooks, renderHelper, multibrowser, multi-navigateur, "@multibrowser", "@private-wallet", "@shared-wallet", storageState, "@wip"] + keywords: [cucumber, gherkin, bdd, feature, scenario, scénario, step, steps, "@ui", "@data", "@e2e", playwright, broker, harness, wallet, world, hooks, renderHelper, multibrowser, multi-navigateur, "@multibrowser", "@shared-wallet", storageState, "@wip", "@humain"] paths: ["src/modules/*/features/**", "src/modules/*/steps/**", "src/shared/steps/**", "src/shared/support/**", "src/shared/test-harness/**", "cucumber.json"] --- @@ -10,7 +10,7 @@ triggers: BDD tests written in **Cucumber/Gherkin in French** (`Etant donné`, `Quand`, `Alors`) across **3 layers** of increasing cost. -**Read before writing a test:** [[rule_test-layer-contracts]] — each layer answers a distinct question; mixing them produces brittle tests. That is the rule which decides *where* an assertion belongs. +**Read before writing a test:** [[rule_test-layer-contracts]] — each layer answers a distinct question; mixing them produces brittle tests. That is the rule which decides *where* an assertion belongs. And [[rule_tests-validate-festipod-not-the-sdk]] — which decides *whether the assertion belongs here at all*. ## The 3 layers @@ -26,12 +26,15 @@ BDD tests written in **Cucumber/Gherkin in French** (`Etant donné`, `Quand`, `A ## Links - [[rule_test-layer-contracts]] — what to test at each layer (the contract) +- [[rule_tests-validate-festipod-not-the-sdk]] — the subject under test is Festipod's behaviour, never the SDK's; no shortcut past the published surface - [[knowledge_cucumber-setup]] — config, layout, scripts, auto-generated files - [[knowledge_ui-layer]] — the `@ui` layer: render helper, fixtures, good and bad patterns - [[knowledge_data-layer-broker]] — the `@data` layer: broker harness, wallet lifecycle, bridge - [[knowledge_e2e-layer]] — the `@e2e` layer: the real app inside the iframe -- [[knowledge_multibrowser-harness]] — several isolated browsers × wallet model (private/shared), storageState injection +- [[knowledge_multibrowser-harness]] — several isolated browsers on the shared wallet (storageState injection); the only way multi-user is exercised +- [[caveat_data-scenarios-share-one-wallet]] — a scenario cannot choose its identity, so all of them share one wallet that nothing empties: no per-scenario isolation - [[caveat_reconnexion-froide-local-vs-broker]] — a "fresh page" is not a cold start: which setup proves broker durability, and which one just re-reads local +- [[caveat_first-time-entry-untested]] — **open**: no test proves a first-time device can get into Festipod any more; the SDK's replacement barrier publishes nothing to test against - [[decision_2026-03-12_headless-wallet-creation]] — why the test wallet is created through a headless UI - [[caveat_source-grep-vestiges]] — leftovers from the "source analysis" era in `world.ts` - [[cookbook_add-scenario]] — adding a scenario/step (layers, `evaluate` serialization pitfall, `@wip`) diff --git a/.project/concepts/bdd-testing/caveat_data-scenarios-share-one-wallet.md b/.project/concepts/bdd-testing/caveat_data-scenarios-share-one-wallet.md new file mode 100644 index 0000000..9534b92 --- /dev/null +++ b/.project/concepts/bdd-testing/caveat_data-scenarios-share-one-wallet.md @@ -0,0 +1,25 @@ +--- +type: caveat +summary: A @data scenario cannot choose which identity it comes up as — no published call takes an identifier — so every scenario in a run shares one identity and one physical wallet, which nothing empties. Per-scenario isolation is GONE, and the wallet grows for the whole run. +last_checked: 2026-08-10 +--- + +# Pitfall: one wallet, one identity, nothing that empties it + +## What is verified + +**No scenario can name the identity it opens as.** [[contract_polyfill-surface]] is explicit: `ensureIdentity()` takes no identifier, *"and no other call takes one"*. So a scenario gets whatever identity the wallet in `.playwright-profile` resolves to — the same one, every time. + +Machinery from when this was not true is still in the tree and is now **inert**: the `Before` hook mints a unique identifier (`freshScenarioIdentifier`, `src/shared/support/hooks.ts`) and injects it via `addInitScript` into `localStorage['festipod.account.identifier']`, and several steps re-inject it. Nothing consumes that key. **Do not build new setup on it, and do not "repair" it** by making the app read it again — naming your own identity is exactly what the surface refuses. + +## What follows, and gets worse + +**Everything a run writes lands in ONE wallet, and nothing removes it.** There is no per-scenario reset: the old one (`resetDataState()`, a SPARQL DELETE on the anchor graph) was dropped for cost and its helper is gone. So each scenario leaves its documents behind for every later scenario to carry — within a run, and across runs. That is the source of [[caveat_wallet-bloat-hang]]. + +The practical signature: hook timeouts on `__testData.ready` that appear **partway through a run** and get worse the longer the profile has lived, **with no console error at all**. Silence is the tell — a wallet that has stopped answering just stops answering. + +So: a scenario failing on **stale data from an earlier scenario** is expected, not a surprise — scenarios are not isolated. A scenario **timing out in `Before`**, especially the fifth one onward, is the wallet, not the assertion. Move the profile aside and re-measure before diagnosing anything else ([[caveat_wallet-bloat-hang]]). + +## What is missing + +A way to start a scenario from a clean slate. The surface publishes no teardown and no throwaway-wallet call, and there is nothing to fake here: it is a **gap to raise with the provider**, stated as the need — *a scenario must be able to begin on an empty space*. Until then, per-scenario determinism is not available at the `@data` layer, and scenarios must be written so they do not depend on it. diff --git a/.project/concepts/bdd-testing/caveat_first-time-entry-untested.md b/.project/concepts/bdd-testing/caveat_first-time-entry-untested.md new file mode 100644 index 0000000..7c0f9a4 --- /dev/null +++ b/.project/concepts/bdd-testing/caveat_first-time-entry-untested.md @@ -0,0 +1,29 @@ +--- +type: caveat +summary: No test proves a first-time device can get into Festipod — the scenario that drove AccessGateScreen's own DOM was deleted with the screen, and the SDK's replacement barrier publishes no testid or contract to write a new one against +last_checked: 2026-08-10 +--- + +# Caveat: first-time entry has no test, and none can be written from here + +## What is gone + +`workshop/multibrowser-harness.feature` used to carry « Parcours humain — le testeur importe le portefeuille fourni par Festipod et se connecte »: a fresh browser opened the staging app, `AccessGateScreen` offered the wallet file and password, the file was downloaded **from the screen** (`[data-testid=shared-wallet-download]`), the password checked against the wallet's own (`[data-testid=shared-wallet-password]`), imported on `nextgraph.eu`, then an identifier typed (`[data-testid=identifier-input]`) and « Entrer » clicked — landing on the connected home screen. Every step drove **Festipod's own DOM**. + +`AccessGateScreen` is deleted (concept `app-security`, [[decision_2026-08-10_sdk-renders-the-barrier]]), and with it every testid the scenario asserted on, the steps that drove them (`src/modules/workshop/steps/data/multibrowser.steps.ts`), and the helpers built only for this scenario (`pool.ensureStagingApp`, `pool.importWalletViaFile`, `findE2eWalletFile`, the `dist-staging` build in `hooks.ts`). + +## Why it cannot be rewritten, not just why it was deleted + +The scenario was not migrated to assert against something else, because there is nothing to migrate it to: `ensureIdentity()` (`@ng-eventually/polyfill`) is a plain async function with no published testid, no documented DOM contract, and no call a test could make to drive or observe what it shows a first-time device. [[contract_polyfill-surface]] (concept `data-layer`) states only the call's signature and behaviour, not a UI shape — by design, since that UI is exactly the part the SDK owns and Festipod must not couple to. + +## What is true today + +**No test at all — `@ui`, `@data`, `@e2e`, or `@humain` — proves that a first-time device can sign into Festipod.** The `@shared-wallet` multi-browser scenario ([[knowledge_multibrowser-harness]]) injects the wallet via `storageState`, bypassing the import entirely; every `@data`/`@e2e` scenario runs on a persistent profile that is already signed in before `ensureIdentity()` ever runs ([[caveat_data-scenarios-share-one-wallet]]), so none of them exercises the path a genuinely new user takes either. + +## What would close it + +A test contract published by the SDK for its own barrier (a testid, an event, a promise a test can await) — this is a gap in what Festipod consumes, not in what Festipod tests. Raised with the provider. Until one exists, this path is verified only by hand. + +## Links + +[[knowledge_multibrowser-harness]] — where the deleted scenario lived. Concept `app-architecture` → [[caveat_boot-unverified-outside-broker]] — the related, narrower question of whether the boot even completes outside the broker iframe. diff --git a/.project/concepts/bdd-testing/caveat_reconnexion-froide-local-vs-broker.md b/.project/concepts/bdd-testing/caveat_reconnexion-froide-local-vs-broker.md index 9850afd..ca78f32 100644 --- a/.project/concepts/bdd-testing/caveat_reconnexion-froide-local-vs-broker.md +++ b/.project/concepts/bdd-testing/caveat_reconnexion-froide-local-vs-broker.md @@ -1,7 +1,7 @@ --- type: caveat -summary: A "fresh page" opened via ctx.newPage() on the PERSISTENT Chromium context NEVER proves broker durability — it re-reads the local IndexedDB of the very same profile. Only a non-persistent context spawned from freshBrowser, seeded solely by the storageState captured at BeforeAll, settles broker-vs-local. -last_checked: 2026-07-27 +summary: A "fresh page" on the PERSISTENT context never proves broker durability — it re-reads the same profile's IndexedDB; only a non-persistent context spawned from freshBrowser, seeded solely by the BeforeAll storageState, settles broker-vs-local +last_checked: 2026-08-10 --- # Pitfall: a "fresh page" is not a cold start (local vs broker) @@ -12,7 +12,7 @@ last_checked: 2026-07-27 | Setup | Where | What it proves | What it does NOT prove | |---|---|---|---| -| `this.page!.context().newPage()` — fresh page on the **persistent** context (`.playwright-profile`) | `reconnexion.steps.ts` (@data), `reconnexion-persistance.steps.ts` (@e2e) | a new broker login → **fresh verifier session** (empty memory), full remount of the providers | nothing about **broker durability**: the profile **still holds the local repos** in IndexedDB, so a "fresh" reader may well reopen **from local** | +| `this.page!.context().newPage()` — fresh page on the **persistent** context (`.playwright-profile`) | `reconnexion.steps.ts` (@data), `reconnexion-persistance.steps.ts` (@e2e) | a new broker login and a full remount of the providers, with nothing carried over in memory | nothing about **broker durability**: the profile **still holds local data** in IndexedDB, so a "fresh" reader may well read **from local** | | `spawnContext('shared')` — **non-persistent** context spawned from `freshBrowser` | `reconnexion-froide-sans-local.steps.ts` (@data) | that the data **reached the broker** (or did not) | nothing about the real UI journey (this is the harness, not the app) | **Invariant.** Any assertion of the form "the write is durable broker-side" **requires** the second setup. Making that assertion on a fresh page of the persistent context produces a false green (or a red blamed on the broker when it is really local/timing). @@ -27,24 +27,21 @@ Three conditions, all met in `reconnexion-froide-sans-local.steps.ts`: > **Impact if you touch the storageState capture** (`hooks.ts` `BeforeAll` → `pool.sharedWalletState`): moving it later, re-capturing it per scenario, or adding a warm-up that writes data **silently invalidates** the verdict of every "cold, no local" scenario — they would turn green by re-reading the snapshot. The step **fails outright** when `sharedWalletState` is missing (by design: no verdict beats a false verdict). -## Reconnection is not isolation — the identifier decides +## Reconnection vs isolation — the identifier no longer decides anything -`isolation.steps.ts` and `reconnexion.steps.ts` set up **the same machinery** (fresh page plus an identifier injected into `localStorage['festipod.account.identifier']` via `addInitScript`, before any script, on every origin). Only one thing tells them apart: +`isolation.steps.ts` and `reconnexion.steps.ts` set up **the same machinery** (fresh page plus an identifier written into `localStorage['festipod.account.identifier']` via `addInitScript`). That identifier used to be the **only** thing telling them apart — same value re-injected = reconnection, new value = a distinct identity B. -- **reconnection**: `this.freshIdentifier` is re-injected — **the SAME identity** as the writing page. -- **isolation**: a **new** identifier is minted → a distinct identity B. - -Changing that identifier therefore silently turns a reconnection test into an isolation test (and the other way round). `this.freshIdentifier` is set by the `Before` hook in `hooks.ts` for **every** single-browser `@data`/`@e2e` scenario. +**It decides nothing now**: nothing reads that key, so both setups yield the **same** identity. The reconnection sense still holds (a fresh page on the same wallet is genuinely a reconnection); the **isolation** sense is gone — the setup can no longer produce a second identity at all, which is why `event/isolation-deux-identites.feature` is `@wip`. Proving isolation now needs **two genuinely separate browser contexts**, each signing in for itself ([[rule_tests-validate-festipod-not-the-sdk]]). Background: [[caveat_data-scenarios-share-one-wallet]]. ## Reads stay reactive, even when "waiting a long time" -The reconnection `Then` steps read the **reactive** state (`homeEventTitles` on the bridge, via `waitForFunction`) — never a broker re-read loop ([[rule_no-broker-polling]]). The long diagnostic step (« … en laissant jusqu'à 60 secondes à la barrière avec rechargements ») does loop, but over the **reactive state already pushed** plus **full page reloads** (each reload = new mount = new sync-barrier attempt): that is the pragmatic fallback the rule explicitly allows, not broker polling. The distinction to keep in mind — *observing the reactive state* versus *re-issuing a broker read*. +The reconnection `Then` steps read the **reactive** state (`homeEventTitles` on the bridge, via `waitForFunction`) — never a broker re-read loop ([[rule_no-broker-polling]]). The long diagnostic step (« … en laissant jusqu'à 60 secondes à la barrière avec rechargements ») does loop, but over the **reactive state already pushed** plus **full page reloads** (each reload = a new mount, hence a fresh attempt at reaching a synced state): that is the pragmatic fallback the rule explicitly allows, not broker polling. The distinction to keep in mind — *observing the reactive state* versus *re-issuing a broker read*. ## Current state of the scenarios `reconnexion-froide-sans-local.feature`, the `@reconnexion-pause` scenario of `reconnexion-meme-identite.feature` and `reconnexion-persistance-e2e.feature` are **`@wip`**: they are **diagnostic instruments** (they print a verdict to stdout / as a Cucumber attachment), not regression guards. `@wip` is excluded from the default run (`cucumber.json`) — run them explicitly with `--tags`. The **non-`@wip`** scenario of `reconnexion-meme-identite.feature`, on the other hand, is a genuine guard and must stay green. -> The *why* on the NextGraph side (what a write must clear to be durable, socket behaviour, repo reopening) belongs to the `@ng-eventually/client` SDK — not to this repo. Here we only describe **the test setup that produces a readable verdict**. +> This leaf describes **the test setup that produces a readable verdict**, and nothing else. What a write has to clear to be durable is not this repo's to explain — if a verdict comes back negative, that is a finding to raise with the provider, not a mechanism to write up here. ## Links diff --git a/.project/concepts/bdd-testing/caveat_wallet-bloat-hang.md b/.project/concepts/bdd-testing/caveat_wallet-bloat-hang.md index 1ee21aa..af89b86 100644 --- a/.project/concepts/bdd-testing/caveat_wallet-bloat-hang.md +++ b/.project/concepts/bdd-testing/caveat_wallet-bloat-hang.md @@ -1,21 +1,37 @@ --- type: caveat -summary: The shared test wallet (.playwright-profile) accumulates data on every run; past a threshold, sparql_query calls anchored to the private store hang (>15s) and the whole @data suite fails during setup — starting from a fresh profile restores ~1s reads -last_checked: 2026-07-06 +summary: The @data suite degrades within a run and across runs, silently — later scenarios time out in Before with nothing in the console. Moving .playwright-profile aside does NOT reset the data (the served wallet file is what holds it), so two "fresh profile" runs measure the same accumulated state; the only real lever is serving a new wallet file, which nothing here does yet. +last_checked: 2026-08-16 --- -# Pitfall: the test wallet bloats and makes @data reads hang +# Pitfall: the test wallet saturates — within a run, and across runs -The persistent Chromium profile `.playwright-profile` (at the root of the working tree) carries the **shared wallet** opened by the whole `@data`/`@e2e` suite. That wallet **accumulates data on every run**: shim accounts (one per scenario, through the fresh identifier `freshScenarioIdentifier`), seeded entity docs, historical inbox deposits… The private store is the **anchor point of the shim** (account resolution) and is queried by **every** read and write (`resolveAccount`, `listMyEntityDocs`, …). +The persistent Chromium profile `.playwright-profile` (at the root of the working tree) carries the **wallet** the whole `@data`/`@e2e` suite opens. Every scenario reads and writes through it, so anything that slows that wallet down slows everything. -**Symptom.** Past a certain volume (observed around 99 MB of profile), a `sparql_query` **anchored to the private store** stops returning within 15 s — it hangs. Since account resolution sits on the path of **every** read/write, **the entire @data suite fails during setup** (0 events loaded, timeouts), with no explicit error. Verified diagnosis: on a fresh wallet the same query comes back in **~1.5 s** and the seed completes normally. +Two distinct phenomena, and the first is the one that bites today. -**Workaround.** Move the bloated profile aside and let the auth hook (beforeAll) recreate a fresh one: +## Within a single run — the binding constraint -```bash -mv .playwright-profile /tmp/festipod-bloated-$(date +%s) -``` +**Symptom, VERIFIED.** On a **fresh** profile, on an idle machine, per-scenario duration climbs monotonically (observed 7 s → 53 s across the six that pass), then every later scenario dies in the `Before` hook on `frame.waitForFunction` at its 30 s cap. **Silently** — no error, no rejection, nothing in the console. Reproduced twice with identical results (6 of 14 passing, 8 min 34 s and 8 min 37 s). -The per-scenario fresh identifier (`freshScenarioIdentifier`) bounds the account *registry* but **not** the physical growth of the shared private store — hence the recurrence. Durable hygiene (periodic purge / throwaway wallet per run) still has to be put in place; until then, if the `resolveAccount failed` errors and timeouts come back, start again from a fresh profile. +**What it is NOT.** Runs that never exit leave a Chromium and two servers resident (see below), and it was reasonable to suspect that pressure. **Ruled out by measurement**: one of the two runs above happened with four leaked browsers and two leaked servers alive, the other on a cleaned machine — same pass count, same duration. Leaked processes are a real defect and not this cause. -> The *why* on the broker side (how an anchored query reaches the private store repo) belongs to the `@ng-eventually/client` SDK, not here — this caveat only describes the consequence on the test side. +**The likely mechanism, INFERRED.** Every scenario in a run writes into the **same wallet**, and nothing removes what it wrote ([[caveat_data-scenarios-share-one-wallet]]) — so each one leaves behind documents that every later scenario carries. That is not something tidying the test code can fix. What would settle it is a reset the surface does not publish (a teardown call, or a throwaway wallet per run): raise it with the provider rather than faking one here. + +**Practical reading.** A `Before` timing out, especially from roughly the sixth scenario onward, is the wallet — not the assertion below it, and not the step definition. Diagnose the run's shape before diagnosing the scenario. + +## Moving the profile aside does NOT reset the data — corrected 2026-08-16 + +The reset this leaf used to prescribe (`mv .playwright-profile …`) gives a fresh **browser profile**, not fresh **data**. The suite's data lives in the wallet file the deployment serves (`FESTIPOD_SHARED_WALLET_FILE`, a fixed `.ngw` at the working-copy root), which is the same file on every run and whose state persists outside the profile entirely. Recreating the profile makes the harness build a new broker-side wallet to get *into* the broker; the app then opens the same served wallet as always. + +This matters beyond the inconvenience: two measurements taken "on a fresh profile" are **not** two measurements on fresh data. A pair of identical numbers from them proves reproducibility and nothing about accumulation — a conclusion drawn from exactly that mistake had to be withdrawn. + +**The lever we actually have** is the served wallet file: it is the application's own deployment parameter, not something the provider controls. Serving a new one gives genuinely empty data. Nothing in this repo does that yet. + +Until it does, treat any `@data` number as **relative to whatever that wallet already holds**, and do not compare two runs taken days apart as if they measured the same thing. + +## The leak that makes it worse + +A Cucumber run prints its summary and then **does not exit**, leaving a Chromium and two servers alive (runs observed still resident 2-3 hours after reporting). It does not cause the degradation above, but it fills the machine and forces manual cleanup. Kill the process after reading the summary until the teardown releases what it opens. + +> This caveat describes only what is observable on the test side. Why a saturated wallet stops answering is not this repo's to explain. diff --git a/.project/concepts/bdd-testing/knowledge_data-layer-broker.md b/.project/concepts/bdd-testing/knowledge_data-layer-broker.md index 306c679..0c60395 100644 --- a/.project/concepts/bdd-testing/knowledge_data-layer-broker.md +++ b/.project/concepts/bdd-testing/knowledge_data-layer-broker.md @@ -1,7 +1,7 @@ --- type: knowledge -summary: The @data layer — Playwright drives Chromium (persistent profile), which logs into the real NextGraph broker that loads harness-ng.tsx in an iframe; automated wallet lifecycle (creation + bootstrap login), window.__testData bridge, mock fallback; per-scenario isolation through a fresh virtual identifier (this.freshIdentifier), no more per-scenario purge -last_checked: 2026-07-27 +summary: The @data layer — Playwright drives Chromium (persistent profile) into the real broker, which loads harness-ng.tsx in an iframe; automated wallet lifecycle, window.__testData bridge, mock fallback; the harness signs in exactly as the app does, and per-scenario isolation is currently ABSENT +last_checked: 2026-08-10 --- # The `@data` layer (real broker) @@ -33,10 +33,10 @@ Cucumber → Playwright (Chromium, persistent profile) - **Chromium flags** (`--disable-web-security`, `--allow-insecure-localhost`, Private Network Access turned off): necessary because the public broker loads a `http://127.0.0.1` harness in an iframe. - **Persistent profile** `.playwright-profile/` (gitignored, wallet in localStorage) — requires the real Chrome binary, not `chrome-headless-shell`. - **HTTP server** started in `BeforeAll` (auto-assigned port), serving the HTML plus `/harness.js` (separate files — an inline script breaks because of special characters in the bundle). -- **The bridge is the real app path (per entity).** Since the move to *one document per entity* (concept `data-layer`, [[rule_document-per-entity]]), the `window.__testData` bridge (`events`/`users`/`participations`, `joinEvent`/`leaveEvent`/`isParticipating`/`getEventParticipants`, `loadTestData`) **delegates to the app's data context** (`appData` through `FestipodDataProvider`) — this is the real per-entity path the screens use, not a read at root-store level. The harness therefore mounts the **`AccountProvider`** and logs in by default (`@mariedupont`) to establish the current identity (without it the ReadCap filter would only let public data through). It reads `appData` through a **live ref** (a captured snapshot goes stale after a seed re-render). - - Low-level probe paths are kept (root-store scope `protectedNuri`) for the ReadCap/isolation scenarios that *govern* that document: `rawJoin`/`rawParticipations`, `governDocument`/`governProtected`/`documentNuri`, `FilterProbe`/`FanoutProbe`. -- **Identity before writing.** A `Participation` has a mandatory `fp:user`; since reading the profile can lag behind the public events, the steps wait for `ensureCurrentUser()` before `joinEvent` (otherwise a participation is written without a user → dropped on read, and never makes the round trip) and then wait (`waitForFunction`) for the participation to be read back. -- **Per-scenario isolation = a fresh virtual identifier, NOT a purge.** The @data `Before` hook mints a unique identifier per scenario (`freshScenarioIdentifier` in `hooks.ts`), exposes it as `this.freshIdentifier` on the World, and injects it via `addInitScript` into `localStorage['festipod.account.identifier']` **on every origin** (including the harness iframe on 127.0.0.1) — before any script. The shim then serves a **fresh, empty virtual account**, whose registry starts empty *by construction*: **nothing to purge**. The old per-scenario reset (`window.__testData.resetDataState()`, a SPARQL DELETE of the `urn:ng-eventually:shim:Account` records on the anchor graph) is **no longer called** — it cost up to 10 s taken out of the 60 s budget of the `Before` hook, already eaten by the broker login. The helper still exists on the bridge (`harness-ng.tsx`) but is no longer on the default path: do not put it back into the `Before` hook without measuring. - - **What the fresh identifier does NOT bound**: the *physical* growth of the shared wallet — see [[caveat_wallet-bloat-hang]] (profile to be moved aside when anchored reads start to hang). - - `this.freshIdentifier` is also what distinguishes a **reconnection** test (same identifier re-injected) from an **isolation** test (new identifier) — see [[caveat_reconnexion-froide-local-vs-broker]]. - - The connected seed stays **lightweight** (few docs) because each `docCreate` is a serial broker round trip of about 2s. +- **The bridge is the real app path (per entity).** Since the move to *one document per entity* (concept `data-layer`, [[rule_document-per-entity]]), the `window.__testData` bridge (`events`/`users`/`participations`, `joinEvent`/`leaveEvent`/`isParticipating`/`getEventParticipants`, `loadTestData`) **delegates to the app's data context** (`appData` through `FestipodDataProvider`) — this is the real per-entity path the screens use, not a read at root-store level. It reads `appData` through a **live ref** (a captured snapshot goes stale after a seed re-render). +- **The harness signs in exactly as the app does.** It mounts `NextGraphProvider > FestipodDataProvider` — **no identity provider, no default login** — and awaits the single `ensureIdentity()` before exposing the bridge, mirroring the order `AuthGate` imposes (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]). Nothing may read before it resolves. The low-level probes that used to reach past the app path are **gone**, along with the scenarios whose subject was the SDK rather than Festipod ([[rule_tests-validate-festipod-not-the-sdk]]). +- **Identity before writing.** A `Participation` has a mandatory `fp:user`; the current user is **the profile document read back in the protected scope**, so it lags behind the public events. Steps wait for `ensureCurrentUser()` before `joinEvent` (otherwise the mutation refuses, or writes a participation with no user → dropped on read) and then wait (`waitForFunction`) for the participation to be read back. +- **Per-scenario isolation is currently ABSENT — read [[caveat_data-scenarios-share-one-wallet]] before trusting a green run.** The `Before` hook still mints `this.freshIdentifier` and injects it into `localStorage['festipod.account.identifier']`, and several steps re-inject it, but **nothing reads that key any more**: no published call takes an identifier. Every scenario therefore runs as the same identity on one accumulating wallet. That machinery is inert, not load-bearing — do not build new setup on it, and do not "repair" it by making the app honour the key again. + - The old per-scenario reset (`resetDataState()`, a SPARQL DELETE on the anchor graph) was dropped for cost (up to 10 s of the `Before` hook's 60 s budget, already eaten by the broker login) and its helper is gone too. + - The **physical** growth of the shared wallet was never bounded by any of this — see [[caveat_wallet-bloat-hang]] (profile to be moved aside when reads start to hang). + - The connected seed stays **lightweight** (few docs): creating a document is a serial round trip, so the seed's cost is linear in the number of documents it writes. diff --git a/.project/concepts/bdd-testing/knowledge_e2e-layer.md b/.project/concepts/bdd-testing/knowledge_e2e-layer.md index 0fd0eb7..0fd77d6 100644 --- a/.project/concepts/bdd-testing/knowledge_e2e-layer.md +++ b/.project/concepts/bdd-testing/knowledge_e2e-layer.md @@ -1,7 +1,7 @@ --- type: knowledge -summary: The @e2e layer — Playwright boots the REAL app (not a harness) inside the broker iframe, interacts through appFrame.evaluate()/locator(), reuses setupBrokerPage() from @data; tests navigation/redirects/clicks, no mock fallback; per-scenario identity (this.freshIdentifier) plus the access barrier disabled by init script; "close and reopen" idiom for reconnection scenarios -last_checked: 2026-07-27 +summary: The @e2e layer — Playwright boots the REAL app inside the broker iframe, driven through appFrame.evaluate()/locator(); no mock fallback; there is no more access-gate-disable flag, and no scenario has had to drive the SDK's own barrier because the persistent profile comes up already signed in +last_checked: 2026-08-10 --- # The `@e2e` layer (real app) @@ -43,21 +43,20 @@ Navigation: `window.history.pushState` plus a `popstate` dispatch (path-based ro > **Do not re-check in `@e2e` what `@ui` already covers** — `@e2e` must break when the *collaboration* between layers breaks, not when an icon changes (see [[rule_test-layer-contracts]]). -## Scenario identity + access barrier +## Scenario identity, and why no scenario drives the SDK's barrier -Two settings applied by the `Before` hook in `hooks.ts` govern **every** `@e2e` scenario: +The `Before` hook still plants `this.freshIdentifier` — a unique identifier minted per scenario (`freshScenarioIdentifier`) and injected via `addInitScript` into `localStorage['festipod.account.identifier']` on the **persistent** context. **Nothing consumes it**: no published call takes an identifier, so a scenario cannot choose who it opens as. Treat it as inert machinery, not as a determinism lever — [[caveat_data-scenarios-share-one-wallet]]. -- **`this.freshIdentifier`** — a virtual identifier **unique to each scenario**, injected via `addInitScript` into `localStorage['festipod.account.identifier']` on **every** origin before any script. The real app therefore boots straight into that identity, and each scenario starts from an empty space. This is the **same** machinery as in `@data` (same World field). -- **Access barrier disabled** — `browserContext.addInitScript` sets `globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__ = true` on the **persistent** context: `@e2e` sees the app, not the `AccessGateScreen`. **Fresh** contexts (`@humain`, see [[knowledge_multibrowser-harness]]) do not inherit that setting → the barrier is ON for them. +**There is no more access-gate-disable flag.** `AccessGateScreen` and the `__FESTIPOD_ACCESS_GATE_DISABLED__` global it used to check are both gone. What keeps every `@e2e` scenario from having to drive the SDK's barrier is simply that the **persistent profile already carries an open wallet session** — the automated broker login in the shared `@data`/`@e2e` setup put it there. **Fresh** contexts (multi-browser, see [[knowledge_multibrowser-harness]]) carry no such session, but no scenario left loads the real app through a fresh context — and none could assert against that barrier anyway ([[caveat_first-time-entry-untested]]). -> **Impact:** any page opened by hand inside a step (`ctx.newPage()`) must **re-apply both init scripts itself** — the context's `addInitScript` only applies to pages of that context, and the identifier must be written **before** the app's first script. +> **Impact:** any page opened by hand inside a step (`ctx.newPage()`) does **not** inherit page-level init scripts — `addInitScript` applies only to the pages of the context it was called on. ## The "close and reopen" idiom (reconnection scenarios) `reconnexion-persistance-e2e.feature` / `src/modules/event/steps/e2e/reconnexion-persistance.steps.ts` reproduce the "I create, I close, I come back" journey inside the REAL app: 1. **Creation through the real form** — the step drives the actual creation wizard at DOM level (3-step wizard, selection by *placeholder*: event name, venue; submit button by its label). ⚠️ **These steps are coupled to the French labels of the creation screen**: renaming a placeholder or the submit button breaks the scenario, not the app. -2. **Reopening** — a second page on the **same** persistent context, with the **same** `this.freshIdentifier` and the barrier disabled, then `pool.setupBrokerPage(page, pool.appUrl!)` → new broker login, fresh verifier session. +2. **Reopening** — a second page on the **same** persistent context, replanting `this.freshIdentifier` on it (page-level `addInitScript` only covers the page it is called on), then `pool.setupBrokerPage(page, pool.appUrl!)` → new broker login, same identity. 3. **Proof** — the step captures the console of **both** pages and publishes a summary through `this.attach` (Cucumber attachment) plus stdout; a raw dump of the connection/sync lines is **opt-in** through the `RECO_RAW_DUMP=1` environment variable (noisy, off by default). > **Limitation to know about**: this setup proves the reconnection *of the journey*, **not** the broker durability of the write — the second page shares the IndexedDB of the persistent profile. See [[caveat_reconnexion-froide-local-vs-broker]] for the setup that does settle broker-vs-local. diff --git a/.project/concepts/bdd-testing/knowledge_multibrowser-harness.md b/.project/concepts/bdd-testing/knowledge_multibrowser-harness.md index fbd1d40..8767cd8 100644 --- a/.project/concepts/bdd-testing/knowledge_multibrowser-harness.md +++ b/.project/concepts/bdd-testing/knowledge_multibrowser-harness.md @@ -1,26 +1,22 @@ --- type: knowledge -summary: Multi-browser harness along TWO orthogonal axes — number of browsers (the machinery, isolated fresh contexts spawned from a non-persistent freshBrowser) AND wallet model (own/@private-wallet vs shared/@shared-wallet); shared is provisioned by storageState injection (test-only); an @humain e2e validates the REAL product mechanism through the real staging app (.ngw file downloaded from the screen → nextgraph.eu "Import a Wallet File" → Entrer → connected); @wip convention excluded through cucumber.json -last_checked: 2026-06-16 +summary: Multi-browser harness — isolated contexts spawned from a non-persistent freshBrowser, all carrying the shared wallet by storageState injection (test-only); the scenario that once drove the real access screen end to end is gone with the screen, and nothing replaces it +last_checked: 2026-08-10 --- -# Multi-browser harness (private-wallet vs shared-wallet) +# Multi-browser harness (shared wallet) -The ability of the `@data`/`@e2e` harness to drive **several isolated browsers** within a single scenario, along **two orthogonal axes**. It makes it possible to test both the "everyone has their own wallet" model (`@private-wallet`) and the "wallet shared between browsers" model (`@shared-wallet`). +The ability of the `@data`/`@e2e` harness to drive **several isolated browsers** within a single scenario. This is also the **only** way multi-user is exercised now: each browser context signs in **as itself**, since nothing lets a single page hold two identities ([[rule_tests-validate-festipod-not-the-sdk]]). That capability is not yet fully used: `isolation-deux-identites.feature` needs exactly this — two real contexts, each connecting for itself — and is currently `@wip` because it still assumes the old single-page identity switch (product-level statement of the gap: concept `functional-domain` → [[knowledge_roadmap]]). -## The two axes (orthogonal) - -| Axis | What it decides | Expressed by | +| Concern | What it decides | Expressed by | |---|---|---| | **Number of browsers** (machinery) | 1..N isolated named contexts | `openBrowser(name, …)` + steps `… dans le navigateur "X"` | -| **Wallet model** | distinct vs shared NG identity | **step phrasing + tag** (see below) | +| **Wallet model** | which wallet a context carries | the `WalletModel` argument (`'own'` \| `'shared'`) | -Do **not** confuse `@multibrowser` (several browsers) with `@shared-wallet` (same wallet): we run multibrowser **in private** (everyone with their own wallet) **and in shared** (shared wallet), and compare both setups with the **same** behavioural steps. +## Wallet model — one is exercised, one is dormant -## Wallet model: phrasing + tags - -- `Étant donné un navigateur "A" avec son propre wallet` → **own** model, tag `@private-wallet`. -- `Étant donné un navigateur "A" avec le wallet partagé` → **shared** model, tag `@shared-wallet`. +- `Étant donné un navigateur "A" avec le wallet partagé` → **shared** model, tag `@shared-wallet`. This is what every scenario uses. +- The **own-wallet** model (`'own'`, an empty partition with no wallet) still exists in `spawnContext`, but **no scenario exercises it**: the two `@private-wallet` scenarios were **deleted** because what they proved — Playwright's storage partitioning — is a property of the tooling, not a Festipod behaviour. Keep the machinery, do not re-add scenarios whose subject is the isolation of the tooling. - Umbrella tag `@multibrowser` (whole feature). ## Architecture (where things live) @@ -34,25 +30,21 @@ Do **not** confuse `@multibrowser` (several browsers) with `@shared-wallet` (sam - **own**: empty `newContext()` → distinct NG identity / no wallet. - **shared**: `newContext({ storageState })`, where `storageState` is **captured once** at `BeforeAll` from the persistent profile (warm-up through `setupBrokerPage`, then `browserContext.storageState()`), exposed as `pool.sharedWalletState`. **Empirically verified (2026-06-16)**: the `nextgraph.eu` and `nextgraph.net` origins round-trip into the fresh contexts, and two **shared** browsers both reach the app **connected** to NextGraph (`window.__testData.ready`) **without any manual login**. -> This provisioning is **test-only** — distinct from the **product** mechanism (FILE-assisted import). The shared-wallet scenario using storageState **bypasses the import**; to validate the REAL mechanism, see the `@humain` e2e below. +> This provisioning is **test-only** — distinct from the **product** mechanism (FILE-assisted import). The shared-wallet scenario using storageState **bypasses the import**, and nothing left validates that import end to end: see [[caveat_first-time-entry-untested]] (concept `bdd-testing`). -## Human journey — e2e of the product mechanism (green) +## No scenario left drives the real app through a fresh context -The `@humain` scenario validates the REAL wallet distribution flow **end to end, through the real app**, not through test injection. A blank browser opens the staging app → the `AccessGateScreen` offers the **file** and the **password** → the file is downloaded **from the screen**, the displayed password is checked to **equal** the wallet's own → import on `nextgraph.eu` "Import a Wallet File" → back to the app → an **identifier is typed in**, then a click on « Entrer » (naming the space and opening the wallet are a single act, see concept `app-security` [[decision_2026-07-06_identifier-at-access-barrier]]) → app connected, landing straight on the home screen (no more separate « nom d'utilisateur » screen). +There used to be a `@humain` scenario here that drove `AccessGateScreen` end to end on a fresh context: download the wallet file from the screen, import it on `nextgraph.eu`, come back, type an identifier, land connected. `AccessGateScreen`, its testids (`shared-wallet-download`, `shared-wallet-password`, `identifier-input`), and every helper built only for that scenario (`pool.ensureStagingApp`, `pool.importWalletViaFile`, `findE2eWalletFile`, the `dist-staging` build) are **deleted** along with the screen itself (concept `app-security`, [[decision_2026-08-10_sdk-renders-the-barrier]]) — nothing of Festipod's own is left to assert against. What this leaves unproven: [[caveat_first-time-entry-untested]]. -- **e2e wallet**: a `.ngw` file (`festipod-e2e-tests`, password = identifier) placed **at the root of the worktree**; `findE2eWalletFile()` locates it (`*.ngw`). Gitignored → each environment has to add it (otherwise a clear error is raised). -- `pool.ensureStagingApp()` (`hooks.ts`) — an **isolated** build `bun run build.ts --outdir=dist-staging` (access barrier **ON by default**; password baked in and the **file copied** to `/shared-wallet.ngw`, see `build.ts`), served statically. Memoized and lazy (only `@humain` pays for it). -- **Barrier bypass for `@e2e`**: the harness calls `browserContext.addInitScript` on the **persistent** context to set `globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__ = true` (which applies to the app iframe before its scripts) → `@e2e` sees the app directly, not the barrier. Fresh contexts (`@humain`) leave it alone → barrier ON. The old `/login` `LoginScreen` has been removed. -- `pool.importWalletViaFile(page, filePath, password)` — `nextgraph.eu/#/wallet/login` → `setInputFiles('input[type=file]')` (wait for the SPA to render, otherwise `EncryptionError`) → password field → unlock. -- `pool.completeBrokerLogin(page, appUrl, walletPassword?)` — the "broker login" half extracted from `setupBrokerPage`. **Robust waiting**: after the (multi-hop) redirect, it waits for either the app iframe or the "Click here to login with your wallet" link, then unlocks with the password. Since the broker session is **not** persisted between launches, this wallet login is required on every run (warm-up + `@e2e` + `@humain`). +The `@shared-wallet` scenario above is unaffected — it never drove the import, and it loads the **harness** (`loadAppInBrowser(name, 'harness')`), not the real app, so it never touched `AccessGateScreen` or `ensureIdentity()` either. -> **The e2e is what guarantees it works for a real human**: Festipod hands out the RIGHT file plus password, and importing that file yields a working wallet on a blank device. The `@shared-wallet` scenario (storageState) remains a test provisioning shortcut, it does not validate the import. - -## Isolation (guaranteed at 3 levels, proven by the scenarios) +## Isolation of the contexts (a property of the harness, not a tested behaviour) 1. `freshBrowser` runs in a **separate process** from the persistent profile carrying the wallet → an **own** browser starts **with no wallet**. 2. Every `newContext()` is a **hermetic storage partition** (Playwright guarantee). -3. Isolation is proven not only on the **local** origin (`127.0.0.1`) but also on the **broker origin** `nextgraph.net` **where the wallet actually lives** (a localStorage probe written in A is absent from B). +3. That holds on the **local** origin (`127.0.0.1`) and on the **broker origin** `nextgraph.net` **where the wallet actually lives**. + +These three are what makes a cold-start verdict meaningful ([[caveat_reconnexion-froide-local-vs-broker]]). They are **no longer asserted by scenarios** — they were, and those scenarios were deleted: their subject was the tooling. ## Files @@ -68,3 +60,4 @@ The `@humain` scenario validates the REAL wallet distribution flow **end to end, - [[knowledge_data-layer-broker]] — the single-browser `@data` layer (persistent profile) that this capability extends. - [[cookbook_add-scenario]] — the `@wip` convention, step pitfalls. +- [[caveat_first-time-entry-untested]] — the hole left by the deleted `@humain` scenario. diff --git a/.project/concepts/bdd-testing/knowledge_ui-layer.md b/.project/concepts/bdd-testing/knowledge_ui-layer.md index 7f4ca9a..273a1fd 100644 --- a/.project/concepts/bdd-testing/knowledge_ui-layer.md +++ b/.project/concepts/bdd-testing/knowledge_ui-layer.md @@ -1,7 +1,7 @@ --- type: knowledge -summary: The @ui layer — renderHelper.tsx renders any screen inside LocalDataProvider + happy-dom, world.renderCurrentScreen() invokes it on every navigateTo, assertions run against the rendered DOM with the deterministic seed fixtures; pitfall of screens reading a global injected at build time (access barrier → lazy import mandatory) -last_checked: 2026-07-27 +summary: The @ui layer — renderHelper.tsx renders a screen inside LocalDataProvider + happy-dom, assertions run against the rendered DOM; there is no access screen left to render, and a dormant module-evaluation-order trap around sharedWallet.ts survives, currently harmless +last_checked: 2026-08-10 --- # The `@ui` layer @@ -31,17 +31,10 @@ expect(labels.some(t => t.includes("Nom de l'événement *"))).to.be.true; - `currentScreenId: string | null` — the current screen. - Assertion helpers: `getDomText()` (DOM text), `hasText(t)`, `hasField(name)`, `hasElement(selector)` — they **prefer the rendered DOM** but **fall back to the screens' source** for unmigrated steps (a leftover, see [[caveat_source-grep-vestiges]]). -## ⚠️ Screens that read a global injected at **build** time (access barrier) +## ⚠️ No `@ui` module renders an access screen — there is none left to render -`src/modules/auth/sharedWallet.ts` **captures, at module evaluation time**, a global set by `build.ts` (`__FESTIPOD_SHARED_WALLET_PASSWORD__`). The `@ui` harness runs under Node **without going through the build** → that global is missing, `hasSharedWallet()` returns false, and since the **shared wallet is the only supported mode** (concept `app-security`), `AccessGateScreen` renders its **configuration error** branch: **no identifier field at all** in the DOM → every barrier step fails with a misleading message ("field not found"). +Festipod deleted its own access screen (`AccessGateScreen`) entirely; signing in is now one `ensureIdentity()` call, entirely SDK-owned (concept `app-security`, [[decision_2026-08-10_sdk-renders-the-barrier]]). The two features that used to cover the identifier field and its resolution were **deleted** with the screen — there is nothing left for a `@ui` scenario to render or assert here, and `renderElement()` (the helper `renderHelper.tsx` used to expose for prop-driven components like that screen) is gone too. -**The mandatory setup** (applied in `src/modules/auth/steps/ui/barriere-acces.steps.ts`): - -1. set the global **at the top of the steps module**, before any import of the screen; -2. **import the screen lazily** (memoized `await import(...)`) — a static `import` would be **hoisted above** the assignment and `sharedWallet.ts` would capture an empty value. - -> **Impact if you touch this:** -> - Adding a static `import` of `AccessGateScreen` (or of any module that reaches `sharedWallet.ts`) in **any** `@ui` steps file re-introduces the bug — Cucumber loads every steps module, so the screen would be evaluated before the global is set. -> - The current determinism relies on **this file being the only** `@ui` module that reaches `sharedWallet.ts`. A second entry point would make the evaluation order unguaranteed → the global injection would then have to move into the shared support, not be duplicated. +**A dormant trap survives, unrelated to the screen's deletion.** `src/shared/utils/sharedWallet.ts` (the module used to be `src/modules/auth/sharedWallet.ts`, now deleted — the surviving copy moved) still **captures, at module evaluation time**, a global set by `build.ts` (`__FESTIPOD_SHARED_WALLET_PASSWORD__`). The `@ui` harness runs under Node **without going through the build**, and it reaches this module regardless of which screen a scenario renders: `screens/index.ts` eagerly imports every screen including `SettingsScreen`, which imports `src/shared/utils/ngSession.ts`, which imports `sharedWallet.ts` — so `hasSharedWallet()` is always `false` under `@ui`. This is currently **harmless**: `configure()` just runs with `sharedWallet: undefined`, and no `@ui` path ever calls `ensureIdentity()` (`renderScreen()` bypasses `AuthGate`/`NextGraphProvider` entirely). It stops being harmless the day a `@ui` scenario does call `ensureIdentity()` — full mechanics: `app-security` → [[caveat_shared-wallet-global-before-gate-import]]. > The `app-*` classes confirm the modern theme (see `app-architecture`). Anti-patterns (regexes over the source, implementation details) are banned by [[rule_test-layer-contracts]]. To write a new scenario, see [[cookbook_add-scenario]]. diff --git a/.project/concepts/bdd-testing/rule_no-broker-polling.md b/.project/concepts/bdd-testing/rule_no-broker-polling.md index d140607..487d417 100644 --- a/.project/concepts/bdd-testing/rule_no-broker-polling.md +++ b/.project/concepts/bdd-testing/rule_no-broker-polling.md @@ -1,12 +1,12 @@ --- type: rule -summary: NEVER poll the broker (re-reading in a loop "is it there yet?"). NextGraph is subscription-based — data arrives by PUSH, and the first `State` of a `doc_subscribe` is the deterministic sync barrier (after it — presence guaranteed, absence definitive). Tests AND app wait for the push / for the reactive state to settle, never a broker re-read loop. +summary: NEVER poll the broker (re-reading in a loop "is it there yet?"). The read surface is push-based and says itself when a scope has finished syncing — `isPending` differs from `isSuccess` with empty `data`. App and tests wait for the push, never a broker re-read loop. last_checked: 2026-07-09 --- # Never poll the broker — wait for the subscription -NextGraph is **subscription-based (reactive)**. A read is NOT "query in a loop until it shows up"; it is "subscribe, react to the push". The **first `State`** of a `doc_subscribe` marks the end of the initial synchronization (a synchronous barrier): after it, the **presence** of a piece of data is **guaranteed** and its **absence** is **definitive**. Contract verified empirically on the SDK side (`@ng-eventually/client`, e2e test « CONTRAT 3 »). +The published read surface is **push-based**: `watchShape` resolves a scope, pushes on every change, and carries its own readiness — `isPending` (still syncing) is distinct from `isSuccess` with empty `data` (synced and genuinely empty). A read is therefore never "query in a loop until it shows up"; the surface already answers *"has it finished?"*, and a loop that re-asks the question is asking something the answer is already available for. ## The anti-pattern to ban @@ -14,14 +14,14 @@ NextGraph is **subscription-based (reactive)**. A read is NOT "query in a loop u for (i = 0; i < N; i++) { if (await authParticipationCount(...) === X) break; sleep(500); } ``` -Any loop that **re-queries the broker** (repeated `authParticipationCount`, `listMyEntityDocs`, `sparql_query`) in order to "wait" for data is forbidden: it hides the real mechanism, makes the test brittle (guessed timeout), and directly contradicts the NextGraph model. That remark is what caused the deletion of the old caveat which wrongly held polling up as a practice. +Any loop that **re-queries the broker** (repeated `authParticipationCount`, `listMyEntityDocs`, `sparqlQuery`) in order to "wait" for data is forbidden: it hides the real mechanism, makes the test brittle (guessed timeout), and contradicts the surface the app is built on. That remark is what caused the deletion of the old caveat which wrongly held polling up as a practice. ## What to do instead -Wait for the **reactive push**. In practice (app AND test): the reactive state (`AD().*` fed by `subscribeDoc` in the data context) updates **on push**. We wait for THAT state to reflect the expectation — we **observe the settled reactive state**, we do NOT re-issue a broker read. The data mechanism is the subscription; waiting only **observes the reactive result**. +Wait for the **reactive push**. In practice (app AND test): the reactive state updates **on push**. We wait for THAT state to reflect the expectation — we **observe the settled reactive state**, we do NOT re-issue a broker read. -- App: the screen is already reactive (`subscribeDoc` → re-render on push) — no application-level polling, no spinner driven by a guessed timeout (if a waiting state is wanted, it comes from the native subscription barrier, not from an added signal). -- Test: **a helper that reliably waits for the push/barrier is welcome** (it makes things reliable without making them brittle). What is banned is the **re-read loop**, not waiting for a signal. +- App: the screen is already reactive (re-render on push) — no application-level polling, no spinner driven by a guessed timeout (if a waiting state is wanted, it comes from the surface's own readiness flags, not from an added signal). +- Test: **a helper that reliably waits for the push/readiness is welcome** (it makes things reliable without making them brittle). What is banned is the **re-read loop**, not waiting for a signal. - **Pragmatic fallback**: if strictly waiting for the push/signal turns out to be brittle one way or another, a **short interval** (`setInterval` / closely spaced re-checks) that **observes the ALREADY updated reactive state** (the local state fed by the subscription — NOT a broker re-read) is acceptable: it is as close as it gets to what the user experiences, simply **waiting** for the (reactive) screen to update. The red line is invariant: **never re-query the broker in a loop**; observing the settled reactive state, yes. -See also [[caveat_wallet-bloat-hang]] (another source of @data flakiness, orthogonal to this one). The non-polling mechanism on the library side (`open-repo`: subscribe + wait for the first State + read) lives in the `@ng-eventually/client` repo, not here. +See also [[caveat_wallet-bloat-hang]] (another source of `@data` flakiness, orthogonal to this one). diff --git a/.project/concepts/bdd-testing/rule_tests-validate-festipod-not-the-sdk.md b/.project/concepts/bdd-testing/rule_tests-validate-festipod-not-the-sdk.md new file mode 100644 index 0000000..fbce162 --- /dev/null +++ b/.project/concepts/bdd-testing/rule_tests-validate-festipod-not-the-sdk.md @@ -0,0 +1,26 @@ +--- +type: rule +summary: Festipod's tests validate FESTIPOD's behaviour — multi-user included — never the SDK's, and they take NO shortcut past the published surface. Multi-user is exercised the way it is lived, several browser contexts each signing in as itself, since no published call lets one page hold two identities. +--- + +# The tests validate Festipod, not the SDK — and they take no shortcut + +## The rule + +Stated by the project owner on 2026-08-10, when the app moved onto the pulled [[contract_polyfill-surface]]: + +1. **Festipod is a consumer entirely ignorant of how the SDK is implemented, and its tests may take no shortcut.** No deep import into the package, no reaching for a symbol the contract does not publish, no fixture that reaches past the published surface to get to a state faster. +2. **The subject under test is Festipod's behaviour — multi-user included — never the SDK's.** An assertion whose subject is "the capability was learned", "the store served the key", "the inbox holds two deposits" is testing the provider. It does not belong here; if it is worth having, it belongs in the provider's own suite. +3. **Multi-user is tested the way it is lived**: several browser contexts, each signing in as itself through `ensureIdentity()`. Each actor obtains what it consumes through the application, under its own session. + +## Why + +The contract publishes no way to name or switch identity: signing in is one call that takes **no identifier**, and *"no other call takes one"*. A session is one user's. So "play two identities on one page" is not a capability that went missing — it is something no published call offers, and a test that manufactured it would be exercising something below the surface and would keep passing while the real behaviour rotted; worse, it would hand one actor's values to another through a shared variable, which is exactly the shape that once hid a real bug behind a green test (see [[multi-actor-tests-obtain-not-receive]]). + +The rule also protects the thing the contract exists for. Every shortcut past the surface is a place the app learns something it must unlearn, and it silently converts a **provider gap** — which should be written down and raised — into an app-side workaround nobody revisits. + +## How to apply + +The tell is mechanical: a test import that is not `@ng-eventually/polyfill`, or an assertion naming an SDK concept rather than something a Festipod user would observe. + +When a scenario cannot be written without a shortcut, that is a finding, not an obstacle to route around: the missing thing is either a **product behaviour Festipod does not expose yet** (build it) or a **gap in the provider's contract** (raise it with the provider and leave the scenario unwritten or `@wip` meanwhile — [[rule_app-uses-sdk-surface-only]]). Deleting a scenario whose subject turns out to be the SDK is the correct outcome, not a loss of coverage. diff --git a/.project/concepts/data-layer/_debt.md b/.project/concepts/data-layer/_debt.md deleted file mode 100644 index 6f460b2..0000000 --- a/.project/concepts/data-layer/_debt.md +++ /dev/null @@ -1,11 +0,0 @@ -# Doc-debt — data-layer - -> Presence of a block = doc to update. Processed → delete the block; no blocks left → delete this file. -> One block = one "big change": `why` + `files` + `verify` (leaves to review). - -## Raw markers (consolidate into blocks, then delete) -- TOUCHED src/shared/data/entityWrites.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/shared/utils/ngBootstrap.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/shared/utils/ngSession.ts @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/shared/context/FestipodDataContext.tsx @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) -- TOUCHED src/shared/shapes/shex/festipodShapes.shex @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/.project/concepts/data-layer/_overview.md b/.project/concepts/data-layer/_overview.md index 17fec5c..d0d26f4 100644 --- a/.project/concepts/data-layer/_overview.md +++ b/.project/concepts/data-layer/_overview.md @@ -1,40 +1,34 @@ --- type: _overview -summary: How Festipod persists its data through the @ng-eventually/client SDK — entities stored as documents placed by scope, direct SPARQL writes + union-model reads, SHEX stack, connected/demo modes, seed +summary: How Festipod persists its data through the @ng-eventually/polyfill SDK — entities stored as documents placed by scope, direct SPARQL writes + reactive shape reads, SHEX stack, connected/demo modes, seed triggers: - keywords: [nextgraph, "@ng-eventually", polyfill, union, readUnion, readEntities, SHEX, shape, scope, "@graph", NURI, overlay, ReadCap, WriteCap, cap-less, sparql, seed, wallet, FestipodData, ngSession, ngGraph, bootstrap, document, entité, déconnexion, reconnexion, durabilité, outbox, SerializationError] - paths: ["src/shared/shapes/**", "src/shared/data/readEntities.ts", "src/shared/data/entityWrites.ts", "src/shared/context/NextGraphContext.tsx", "src/shared/context/FestipodDataContext.tsx", "src/shared/utils/ng*", "src/shared/data/seedData.ts"] + keywords: [nextgraph, "@ng-eventually", polyfill, watchShape, useShape, useShapeQuery, SHEX, shape, scope, "@graph", NURI, inbox, share, sparql, seed, wallet, FestipodData, ngSession, ngGraph, storeRegistry, bootstrap, document, entité, déconnexion, reconnexion] + paths: ["src/shared/shapes/**", "src/shared/data/**", "src/shared/context/NextGraphContext.tsx", "src/shared/context/FestipodDataContext.tsx", "src/shared/utils/*", "src/shared/data/seedData.ts"] --- # Data layer -How Festipod **persists its data** through NextGraph (P2P, local-first, end-to-end encrypted). The data SDK is **`@ng-eventually/client`**: we treat it as a finished NextGraph SDK — every entity is a **document** placed in the store of its **scope** (public / protected / private). A **write** is direct SPARQL into the entity's own document; a **read** is the **union model** (resolve the documents on demand → open/sync → **one** unanchored `sparql_query` over the union → re-query on signal), not a fan-out reactive ORM subscription (which *hangs*). See [[rule_document-per-entity]]. The mapping *which entity → which scope* is a **product** fact (concept `functional-domain`, [[knowledge_data-scopes-and-discovery]]); this concept describes the **persistence mechanics**. +How Festipod **persists its data** through NextGraph (P2P, local-first, end-to-end encrypted). The data SDK is **`@ng-eventually/polyfill`**: every entity is a **document** placed in its **scope** (public / protected / private). A **write** is direct SPARQL into the entity's own document; a **read** is the SDK's **reactive shape surface** (`watchShape(shape, scope)` → the app's `useShapeQuery` binding), which resolves the scope itself and pushes on change — the app resolves, lists and re-queries nothing. See [[rule_document-per-entity]]. The mapping *which entity → which scope* is a **product** fact (concept `functional-domain`, [[knowledge_data-scopes-and-discovery]]); this concept describes **how Festipod uses the surface**. -> **SDK boundary.** Festipod's data SDK is `@ng-eventually/client` — initialized/injected **exactly once** through `ngSession.configure(...)`. We write against it as a **finished** NextGraph SDK: never document NextGraph's current state here (constraints, workarounds, broker internals) — that lives in the `@ng-eventually/client` repo. See [[knowledge_nextgraph-stack]]. +> **SDK boundary.** `@ng-eventually/polyfill` is injected **exactly once** through `ngSession.configure(...)`. The pulled contract is the whole of what this repo knows about it: never describe here how the data layer is implemented underneath. See [[rule_app-uses-sdk-surface-only]]. ## Model & data -- [[knowledge_sdk-surface]] — **the data contract**: the `@ng-eventually/client` surface the app codes against (reads, writes, documents, inbox, discovery, capabilities, identity) and what may / may not be assumed of each -- [[knowledge_nextgraph-stack]] — the `@ng-eventually/client` SDK, SHEX shapes, reactive ORM, `build:orm`, injection through `ngSession` +- [[contract_polyfill-surface]] — **the data contract, PULLED from the provider and version-pinned**: the `@ng-eventually/polyfill` surface the app codes against, what it guarantees and what it refuses to promise. The ONLY reference — never open the provider's own sources. +- [[knowledge_nextgraph-stack]] — the SHEX shapes, the reactive ORM bindings, `build:orm`, injection through `ngSession` - [[knowledge_data-modes]] — connected (SDK) vs disconnected/demo (seeded local state), how the provider is chosen - [[knowledge_entities]] — the `Fp*` types and their SHEX shapes - [[knowledge_seed-data]] — seed data, `CURRENT_USER_ID` -- [[knowledge_context-internals]] — pitfalls of `FestipodDataContext` (currentUser, **two id spaces** principal ↔ profile NURI, dev auto-seed, `participantCount` cache, reset on identity change, local no-op) +- [[knowledge_context-internals]] — pitfalls of `FestipodDataContext` (who the current user is and when it arrives, the legacy principal space, dev auto-seed, `participantCount`, local no-op) ## Write rules -- [[rule_document-per-entity]] — every entity gets **its own document** (per scope), never one at store level; this is what makes the SDK's per-document isolation possible -- [[rule_app-uses-sdk-surface-only]] — the app behaves as if NextGraph were finished; every workaround lives in the polyfill - -## What leaves this repo (two destinations, don't confuse them) - -- [[rule_capture-nextgraph-findings]] — established **knowledge** about how NextGraph actually works → the **polyfill**'s reference docs, at the moment of discovery -- [[rule_nextgraph-inbox]] — a NextGraph **malfunction**, or a **gap** we need and emulate in the meantime → a note in `orm-tests/INBOX/`, which tracks upstream progress and says what to remove from the polyfill +- [[rule_document-per-entity]] — every entity gets **its own document** (per scope), never one at store level; access is granted per document, so this is what makes isolation possible +- [[rule_app-uses-sdk-surface-only]] — the pulled contract is the only reference; a gap in it is raised with the provider, never worked around here ## Pitfalls (read before touching deletions / event fields) - [[caveat_participation-deletion]] — withdrawal must be **authoritative** and must not come back - [[caveat_event-fields-not-persisted]] — `startTime`/`themes`… not covered by the Event shape → lost when connected -- [[caveat_write-durability-across-disconnect]] — a write made just before an idle period / socket drop can be **lost** (no broker durability); the account survives. Open incident → post-mortem in the polyfill > Confidentiality (scope isolation, trusting the SDK): concept `app-security`. Product scopes per entity + discovery: concept `functional-domain`. diff --git a/.project/concepts/data-layer/brief_2026-07-06_reactive-reads-and-attendance.md b/.project/concepts/data-layer/brief_2026-07-06_reactive-reads-and-attendance.md deleted file mode 100644 index 3565c61..0000000 --- a/.project/concepts/data-layer/brief_2026-07-06_reactive-reads-and-attendance.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -type: brief -summary: Implementation design (historical) — make reads REACTIVE via doc_subscribe (per-document, without the ORM fan-out that hangs) and replace the mutated-in-place participantCount with the Option-B flow (the participant deposits into the event's inbox, the owner materializes and increments their own doc). READ IN THIS LIGHT — the app-side doc_subscribe wiring was later SUPERSEDED by the SDK's watchShape/useShapeQuery surface, and the « reactive with no reload » framing was RETRACTED for « the owner processes their inbox at their next connection »; Option B (P4-P5) is still pending ---- - -# Reactive reads + correct participant count (Option B) - -Implementation brief, anchored in the current code. Goal: two coupled evolutions of Festipod's data layer (connected mode / `@ng-eventually/client`). - -1. **Cross-session reactive reads** — replace the one-shot `readUnion` + `bumpRead` (manual re-query, local-only) with real broker-pushed reactivity, **never polling** and **without the ORM fan-out that hangs**. -2. **Correct participant count (Option B)** — remove the current isolation violation (the participant writes `participantCount` on the event doc, which is not theirs) and replace it with the inbox-deposit → owner-materialization flow. - -This brief describes **what to build and in what order**. No code change is made here. - -Cross-cutting references: [[knowledge_context-internals]], [[rule_document-per-entity]], [[caveat_participation-deletion]], `functional-domain/knowledge_data-scopes-and-discovery`, `app-security/knowledge_trust-model`, and the `@ng-eventually/client` SDK contract (`docs/sdk-reference.md`, `docs/read-model.md`, `docs/nextgraph-current-state.md`). - ---- - -## 0. Current state (the starting point, file:function) - -### Reads (one-shot, manual re-query) -`src/shared/context/FestipodDataContext.tsx` → `useNgData()`: -- The set of docs to read **on demand** is two `useState`s: `publicDocs` / `protectedDocs` (lines 232-233). It is fed by (a) the listing effect (lines 302-332) which calls `listMyEntityDocs(owner, 'public'|'protected')` (bounded to my own account) + `readDiscoveredEvents()` (the global index), and (b) `registerDoc(scope, nuri)` (lines 251-255) which adds a freshly created doc. -- The **actual read** (lines 347-364): `readEntities(allReadDocs)` → `readModel.readUnion(docs)` (one `sparql_query` anchored per doc, in parallel, per-doc tolerant). It **re-runs** when `allReadDocs` changes **or** when `readTick` changes. -- `readTick`/`bumpRead` (lines 236-237) = a **manual re-query signal**, bumped after every mutation. **There is NO signal coming from the broker**: a write made by ANOTHER session never increments this session's `readTick` → **no cross-session reactivity**. That is the gap this brief fills. -- `listTick`/`relist` (lines 246-247) replays the listing effect after a seed. - -### Writing the counter (the violation to remove) -- `joinEvent` (lines 597-668): after writing its own `Participation` (protected doc, lines 621-631), it calls `updateEntityField(eventId, eventId, 'participantCount', int(next))` on **the event's doc** (lines 635-640) — but that doc belongs to the **event's owner**, not to the participant. That is an out-of-scope write. It *also* deposits into the inbox via `depositRegistration` (line 652) — that deposit is the right channel; it is the direct `participantCount` write that must go. -- `leaveEvent` (lines 670-712): symmetrically, decrements `participantCount` on the event's doc (lines 705-710) after the authoritative DELETE of the participation. -- `caveat_participation-deletion`: the participation DELETE must remain **authoritative** (SPARQL DELETE-WHERE via `deleteParticipation`, `src/shared/data/registration.ts` lines 260-334, verified `remaining === 0`) — this brief does not change that contract. -- [[knowledge_context-internals]] already documents that `participantCount` is a **cache mutated in place**, never recomputed, and "not a source of truth". Option B turns it into a value **derived and owned by the owner**. - -### Display (already "count + anonymous", to be kept) -`src/modules/event/screens/EventDetailScreen.tsx`: -- `joined = isParticipating(eventId)` (line 20). -- `participants = getEventParticipants(eventId)` (line 21) → in the context, `getEventParticipants` (FestipodDataContext lines 108-111) filters the known `participations` by `eventId` and joins the **readable** `users` (so only my connections, per the protected cap). -- `knownParticipants = participants.filter(p => p.id !== currentUserId)` (line 33). -- The label **« Participants ({event.participantCount}) »** (line 146) displays the **derived count**, and `knownParticipants.length < event.participantCount` renders the **« voir tous les participants » placeholders** (lines 163-170) — exactly the intended "count + anonymous" model. **This display does not change**: Option B only makes `participantCount` correct and reactive, and `knownParticipants` remains governed by the protected read cap. - -### The lib's polling watchers (to be replaced) -Confirmed by reading the lib (`packages/client/src/`): -- `inbox.watch(target, onDeposits, {intervalMs=1000})` (`inbox.ts:195-223`) = **`setInterval` polling**, firing only when `deposits.length` changes. -- `discovery.watchIndex(onEntries, {intervalMs=1000})` (`discovery.ts:163-187`) = the same **`setInterval` polling**. -- `useShape` (`use-shape.ts:12`) IS push-based/reactive, but **only safe on ONE already-open document** — the `graphs:[…]` fan-out hangs (§2). -- **No `doc_subscribe` wrapper is exposed today** in `docs.ts` (which only exposes `docCreate` / `sparqlUpdate` / `sparqlQuery`). The `ng.doc_subscribe` primitive is reachable *untyped* through the `ng` proxy (`ng-proxy.ts:54-56` passthrough), but there is **no typed layer** → **the lib must add one** (§A). - ---- - -## 1. The platform primitives (nextgraph-rs, verified) - -- `doc_subscribe(repo_o: String, session_id, callback)` (`sdk/js/lib-wasm/src/lib.rs:1907`) is **per-document**: a single repo NURI, a single callback. It mounts a subscription on **one branch** of the doc (`verifier.rs:352` `create_branch_subscription`), first pushes a `TabInfo` + initial `State` (`verifier.rs:470-477`), then a stream of `Patch`es on every commit. -- The push: on every verified transaction on a branch B, the verifier calls `push_app_response(&B, AppResponse::…)` (`verifier.rs:252`) on the `Sender` registered in `branch_subscriptions[B]` (`verifier.rs:115`). **Unit of subscription = one branch of one doc.** -- The **ORM fan-out** lives elsewhere: `orm_start_graph(scope.graphs[], …)` (a single call over an array). There, a **single** unsynchronized repo in the array makes `open_for_target → resolve_target` return `RepoNotFound` (`request_processor.rs:147-171`, and above all the `initialize.rs:125-128` loop where the `?` **aborts the whole subscription**). The `readyPromise` then never resolves → **~75s hang** (`nextgraph-current-state.md` § *The ORM fan-out hang*, quoted in `read-model.md:93-98` and the header of `read-model.ts:24-31`). **Corollary: per-doc `doc_subscribe` does NOT have this flaw** — it is not subject to fan-out, so a missing doc only breaks its own subscription. -- **Writes are membership-bound, with no append** (confirmed, `repo.rs:584` `verify_permission`: a non-member author → `PermissionDenied`; `commit.rs`: a transaction requires `WriteAsync`/`WriteSync`, obtainable only via a grant from the owner; **there is no `Append` variant in `PermissionV0`**). ⇒ **Option A is impossible**: a participant cannot write to / increment a counter on someone else's public doc. Hence Option B through the inbox. -- **The inbox is a real platform primitive** (`server_broker.rs:826` `inbox_post`: no membership check on the sender; the message is sealed to the inbox's key, readable only by the registered *readers*). That is exactly the "anyone deposits, only the owner drains" channel. Today the lib emulates it over the shared wallet (`inbox.ts` post/read RDF), the native one being deferred. - ---- - -## A. Reactive reads — the design - -### Principle: per-doc `doc_subscribe` as a **change signal**, `readUnion` remains the reader -We do **not** make `readUnion` reactive and we do **not** introduce an ORM fan-out. We keep the documented pattern (`read-model.md:100-110`): - -> a lightweight reactive subscription (`doc_subscribe`, or the ORM on a single already-open store — never a per-entity fan-out) on the synchronized docs; on its change signal, replay the bounded set of per-doc `sparql_query` calls (`readUnion`). - -Concretely: - -1. **The lib exposes a typed `doc_subscribe` wrapper.** It does not exist today. Add to `packages/client/src/docs.ts` (or a new `subscribe.ts`) a function, e.g.: - ```ts - // returns an unsubscribe; onChange called on the initial State then on every Patch - export function subscribeDoc(nuri: Nuri, onChange: (r: AppResponse) => void): () => void - ``` - which wraps `ng.doc_subscribe(nuri, sessionId, cb)` and normalizes the AppResponse (initial + patches) plus stream teardown. It is **per-document** (a single NURI), hence immune to the fan-out hang. - - Also expose a helper to subscribe to **a set** of docs by mounting **one subscription per doc** (a `nuri → unsubscribe` map), with **per-doc error isolation**: a `RepoNotFound` / unsynchronized doc only fails ITS OWN subscription (retry/skip), never the others. That is the key point that avoids reproducing the fan-out. The SDK contract (`sdk-reference.md`) will need to document this wrapper. - -2. **The data context (FestipodDataContext) mounts a per-doc subscription over the set it already reads.** The `allReadDocs` set (union of `publicDocs` ∪ `protectedDocs`) is already bounded and on-demand. A new effect in `useNgData()`: - ``` - useEffect(() => { - const unsubs = allReadDocs.map(nuri => subscribeDoc(nuri, () => bumpRead())); - return () => unsubs.forEach(u => u()); - }, [allReadDocs]); - ``` - → on **any** patch of a subscribed doc (written by THIS session OR another one), `bumpRead()` re-triggers the existing `readUnion` (lines 347-364). **`readTick`/`bumpRead` stay** — they stop being "manual after my own mutation" and become "pushed by the broker". The shape of the context (`events`/`users`/`participations` values in `useState`) **does not change**; screens keep reading through `useFestipodData()` unmodified. - -3. **NEW docs entering the subscribed set, without a fan-out hang:** - - **A newly discovered event**: reactive discovery replaces `discovery.watchIndex` (setInterval) with a **`doc_subscribe` subscription on the global index doc** (the index inbox, a single doc — `resolveInboxAnchor`-style). On every patch of the index → re-read `readDiscoveredEvents()` → the new `doc` NURIs enter `publicDocs` (via `setPublicDocs`), which **grows `allReadDocs`**, which **remounts the per-doc subscription** (the new `useEffect` above) → the new event is read AND from then on subscribed. No fan-out: each doc is subscribed **individually**, as it enters. - - **A new inbox deposit** (new participant, host notification): likewise, replace `inbox.watch` (setInterval) with a **`doc_subscribe` subscription on the relevant inbox doc** (a single doc). A patch → re-materialize (§B). - - **A doc I just created**: `registerDoc` keeps adding it to `publicDocs`/`protectedDocs` → it enters `allReadDocs` → it gets subscribed. (An immediate `bumpRead` keeps perceived local latency at zero.) - -4. **The lib replaces its polling watchers**: `inbox.watch` and `discovery.watchIndex` become `doc_subscribe` wrappers on the inbox doc / index doc respectively (one doc each — no fan-out). The public signature is preserved (callback + unsubscribe) so callers do not break; the implementation moves from `setInterval(read)` to `subscribeDoc(anchor, () => read().then(onX))`. - -### What does NOT change -- `readUnion` stays one-shot, per-doc, tolerant (a failing doc → `[]`, never an abort). -- The `readEntities` mapping (`src/shared/data/readEntities.ts`) is unchanged. -- **No per-entity `useShape({graphs:[…]})` is introduced** — the only remaining `useShape` is the test harness's `FanoutProbe` (whose very purpose is to *demonstrate* the hang), not an application path. - ---- - -## B. Participant count — Option B (deposit → owner materialization) - -### The documents / inboxes involved -- **The participant's participation doc**: protected, **owned by the participant** (already created by `joinEvent`, `createEntityDoc(owner,'protected')` + `writeEntity(ENTITY_TYPE.participation, …)`). Readable in plaintext only by the participant's **connections** (protected cap + `declareConnections`). -- **The event's inbox**: resolved by `hostInboxNuri(eventId)` → `resolveInboxAnchor()` (today a single anchor; after migration, one inbox doc per event — `hostInboxNuri` already reserves the `eventId` param). That is where the participant **deposits the participation link**. -- **The event's doc**: public, **owned by the owner**. It is **the owner** who writes `participantCount` there — never the participant. -- **A (reference) recorded by the owner**: an entry linking the incremented count to the deposit (idempotence + audit); it can live in the event's doc (reference to an already-materialized deposit) or in a protected doc of the owner's. - -### The flow (who writes what) -1. **Participant — `joinEvent`** (modified): - - Writes its own `Participation` (protected, theirs) — **unchanged**. - - **Deposits into the event's inbox** a `{ kind:'new-participant', eventId, participationDoc, participantId, uid }` payload via `depositRegistration` (today `inbox.post(target, {from:null, payload})`, `registration.ts:110-125`). `from` stays anonymous at the transport level (the SDK binds `from` to the identity and rejects a spoof — see `registration.ts:106-108`); the domain identity travels in the payload. **The deposit carries the NURI of the participation doc** (`participationDoc`) so that the owner, if they are a connection, can read it in plaintext. - - **REMOVES the `participantCount` write on the event's doc** (current lines 635-640). The participant never writes to someone else's doc again. -2. **Owner — materialization (when connected)**: the owner's session is subscribed (`doc_subscribe`, §A.3) to their event's inbox doc. On a new `new-participant` deposit: - - dedup via `uid` (idempotence: do not re-count an already materialized deposit — check the recorded (reference)); - - **increments `participantCount` on THEIR OWN event doc** (`updateEntityField(eventDoc, eventDoc, 'participantCount', int(next))`) — **the owner writing their own doc**, not a read privilege nor an out-of-scope write; - - records the **(reference)** of the materialized deposit (idempotence marker). - - This logic replaces/extends the existing **notification materialization** effect (FestipodDataContext lines 443-479, `readRegistrationNotifications`): today it only surfaces notifications; it also becomes the point where the counter is incremented. The trigger moves from implicit polling to the `doc_subscribe` subscription on the inbox. -3. **Other sessions see the count change**: the event's doc is **public**, so **every** session that has it in its `allReadDocs` is subscribed to it (§A). The owner's write produces a patch → `bumpRead()` → `readUnion` re-reads → `event.participantCount` updated → `EventDetailScreen` re-renders « Participants (N) » **with no reload and no user action**. That is the complete reactive path, cross-session. - -### Withdrawal (symmetric, authoritative) -- `leaveEvent`: keeps the **authoritative DELETE** of the participation (`deleteParticipation`, verified `remaining === 0`) — [[caveat_participation-deletion]] intact (it must not come back to life). -- **Removes the direct decrement** of `participantCount` by the participant (lines 705-710). Instead, the participant **deposits a `leave`** (`{ kind:'leave-participant', eventId, uid }`) into the event's inbox; the owner materializes → **decrements their own doc** (idempotent via `uid`, `max(0, n-1)`, and refuses to re-decrement an already processed `uid` so as not to "resurrect" a wrong count). -- **Owner-offline case = eventual behaviour, ACCEPTED**: if the owner is not connected, the deposit stays in the inbox; the count is **not** updated until they reconnect and materialize. **This is accepted behaviour** (eventual consistency, local-first). Others see the count correct itself when the owner comes back. To be stated as such in the product contract. - -### Identity (C) -- A participant is shown **by name** only if the viewer is a **connection** of that participant: the participation doc + the participant's profile are protected, so they are readable in plaintext only through the cap granted by `declareConnections` (`src/shared/utils/connections.ts` → `grantRead(protectedDocsOf(owner), neighbour)`). Otherwise the doc stays unreadable → the participant does **not** appear in `getEventParticipants` (which joins on the `users`/`participations` that were read) → they fall into the **« inconnu » placeholders** of `EventDetailScreen` (lines 163-170), the derived count remaining visible through `participantCount`. -- **No privileged read for the host**: the owner does not read participations; they only **count deposits** and write their own counter. They see a named participant only if they are a connection of theirs — exactly like any other viewer. This matches `functional-domain/knowledge_data-scopes-and-discovery` ("identified if known, anonymous otherwise") and `app-security/knowledge_trust-model` (no application-level access control; isolation is per-document and delegated to the SDK). - ---- - -## D. Test plan (real e2e, no polling) - -### D.1 — POLYFILL low-level: `doc_subscribe` really does react -Goal: prove the reactive primitive works, independently of Festipod. -- Location: a unit/integration test of the lib (`packages/client`) — or a Festipod `@data` test if the broker harness is required. -- Setup: two "views" of the **same** doc (two subscriptions, or one subscription plus a write through another path). Mount `subscribeDoc(nuri, onChange)`, write to the doc via `sparqlUpdate`. -- **Assertion**: `onChange` is called (initial State) **and then** called again after the write, **without polling** (no `setInterval`; the assertion waits on an event, not on a timeout). Check that a write on **another** doc does NOT trigger `onChange` (per-branch isolation). Check that an unsynchronized doc which fails **does not abort** the other subscriptions (per-doc). - -### D.2 — FESTIPOD app-level: 2 real browsers, with no reload and no action from A -Goal: B signs up → A's `EventDetailScreen` shows `participantCount` incremented **and** an "unknown participant", **without A reloading or acting**. -- Extend `src/modules/event/features/e2e-multibrowser.feature` (`@multibrowser @shared-wallet`) and `src/modules/event/steps/e2e/multibrowser-features.steps.ts`. -- New scenario (French Gherkin sketch): - ``` - Scénario: Un participant apparaît réactivement dans l'autre navigateur sans reload - Étant donné un navigateur "A" avec le wallet partagé - Et un navigateur "B" avec le wallet partagé - Et le navigateur "A" charge l'application via le broker - Et le navigateur "B" charge l'application via le broker - Et le navigateur "A" est connecté à NextGraph - Et le navigateur "B" est connecté à NextGraph - Et le navigateur "A" crée l'événement "Apéro réactif" - Et le navigateur "A" ouvre le détail de l'événement "Apéro réactif" - Et le compteur de participants affiché dans "A" pour "Apéro réactif" vaut 1 - Quand le navigateur "B" s'inscrit à l'événement "Apéro réactif" - Alors sans recharger, le compteur de participants affiché dans "A" pour "Apéro réactif" passe à 2 - Et le navigateur "A" affiche un participant "inconnu" pour "Apéro réactif" - ``` -- **Exact assertions**: - 1. `participantCount` **on A's side** goes from 1 to 2 — asserted via `frame.waitForFunction` on the context's reactive state (`__testData.events` → the event → `participantCount === 2`) **and then** confirmed on the rendered DOM (the « Participants (2) » label of `EventDetailScreen`), **with no `loadAppInBrowser`/reload call** between B's join and A's assertion. - 2. **Unknown placeholder**: `knownParticipants.length < participantCount` → assert the presence of the « Voir tous les participants » block (or an anonymous count = `participantCount − knownParticipants.length ≥ 1`), B not being a connection of A → not named. - 3. **Negative, no-polling**: the 1→2 transition arrives through the subscription (event-driven); the test waits on the event, and must not depend on a fixed `waitForTimeout` as the *source* of the update (a guard timeout remains tolerated to let the broker sync, as in the existing withdrawal scenario, line 131). -- **Harness helpers required** (in `harness-ng.tsx`, exposed on `window.__testData`, and replicated in BOTH harnesses — see `bdd-testing/cookbook_add-scenario`): - - a getter for an event's reactive `participantCount` (already reachable via `__testData.events`). - - a way to reach A's **rendered** `EventDetailScreen` **without manual navigation**: either mount the real app on the detail route (the @e2e path), or expose `knownParticipants` / the anonymous count. Reuse `createEventReal` (line 232), `appJoinEvent` (line 245), `readInboxDeposits` (line 283), `authParticipationCount` (line 302). - - a "the owner has materialized" hook: since A is the owner AND connected, their inbox subscription must increment their own doc — the test observes the outcome (count 2) without driving materialization by hand. -- **Withdrawal symmetry**: extend the existing scenario « la désinscription ne ressuscite pas » (lines 36-48) with a reactive assertion: after B's leave, `participantCount` on A's side **goes back to 1 without a reload**, and `authParticipationCount === 0` (already covered). - ---- - -## E. Risks / open questions - -1. **The fan-out hang** (risk #1). The design avoids it **by construction**: **per-document** subscription (`doc_subscribe`), never `orm_start_graph(graphs:[…])`. To be kept as an invariant: every new doc enters through an **individual** subscription with per-doc error isolation — an unsynchronized doc must never be able to abort the other subscriptions nor block `readUnion` (which stays per-doc tolerant). Residual risk: the **volume** of per-doc subscriptions (one per doc read) — to be validated against the real broker; failing that, cap/prioritize the subscribed docs (current event + its inbox + my own docs) rather than the whole union. - -2. **Owner-offline count = eventual — DECIDED (2026-07-06).** As long as the owner is not connected, no deposit is materialized → `participantCount` stays stale for everyone else (the participation itself is persisted broker-side — nothing is lost, only the aggregate waits for the host to reconnect). Accepted for V1. **Later, a SERVICE will take over** when the owner is disconnected (the deferred `@ng-eventually/service` package — the "curator" mentioned in the lib's inbox docs): an always-available actor will materialize the inbox in the host's stead. No « N+ en attente » fallback in V1. - -3. **Per-doc `doc_subscribe` — DONE (lib `c0498a6`).** The lib now exposes `subscribeDoc`/`subscribeDocs` (per-doc error isolation, no ORM fan-out), `inbox.watch`/`discovery.watchIndex` have moved to `doc_subscribe` (no more polling), and the contract is in `sdk-reference.md`. Validated against the real broker (the callback crosses the iframe RPC and fires on change). Remaining: wire the subscription into the app's read path (P3). - -> **The SDK's reactive hooks** (clarification): NextGraph's React adapter exposes `useShape` (reactive RDF shapes) and `useDiscrete` (discrete CRDT docs) — there is no `useQuery`. The lib re-exposes `useShape`. For a UNION read over N docs (Festipod's case), `useShape`/the ORM in fan-out *hangs*; the app's reactive path therefore goes through `subscribeDocs` (per-doc) + a re-`readUnion`, possibly wrapped into a reactive read hook on the lib side (to be decided in P3). - -Other points to settle: - -> ⚠️ **REFRAMED + CORRECTED (2026-07-13).** The claim below, "Proven by the D.2 e2e … with no reload", was **FALSE** (the "green" came from a bloated wallet). But more importantly the framing "reactive / no reload / cross-session push" was an **OVER-FRAMING**: the real spec is **"the owner reliably processes their inbox at their NEXT CONNECTION"** (not a live real-time notification between two connected users). The bug fixed under that framing: the materializer read the inbox **before it had synced** (→ a memoized 0). Fix = inbox read **gated on a barrier** (`inbox.readSynced` = `ensureRepoOpen` + `read`) + triggering on connection + a single source of truth, `event.participantCount`. The `event/e2e-multibrowser.feature` scenario was **reframed as "at the next connection" and un-`@wip`'d, GREEN on a fresh profile** (a reconnection/re-materialization by A is the accepted mechanism). Details: [[knowledge_context-internals]] §participantCount. The phasing plan below must be re-read in that light ("no reload" is no longer the requirement). - -- **Phasing order:** ~~(P1) lib: `subscribeDoc` + multi-doc variant + D.1 tests~~ **DONE (`c0498a6`)**; ~~(P2) lib: replace `inbox.watch`/`discovery.watchIndex` with `doc_subscribe`~~ **DONE (`c0498a6`)**; ~~(P3) app: wire the per-doc subscription into `useNgData` (pushed bumpRead) + reactive discovery~~ **DONE, then SUPERSEDED** — P3 first wired an app-side `subscribeDocs(allReadDocs, …)` effect + a reactive discovery effect on top of the one-shot `readUnion`. That app-side wiring **no longer exists**: the read path has since moved entirely behind the SDK surface (`watchShape` bound by `useShapeQuery`), with no doc set, no `bumpRead` and no per-doc subscription left in the app (verified 2026-07-28 — see [[rule_app-uses-sdk-surface-only]] and [[rule_document-per-entity]] §Reads). **Validation — the earlier « proven by the D.2 e2e, with no reload » claim is RETRACTED**: per the REFRAMED + CORRECTED box above, that green came from a bloated wallet, and « live cross-session push with no reload » was never the spec. What `e2e-multibrowser.feature` covers is the reframed contract — **the owner reliably processes their inbox at their NEXT CONNECTION** (un-`@wip`'d, green on a fresh profile). So P3 is delivered as *the app reads through a reactive SDK surface*, **not** as *a proven reload-free live push*. ; (P4) app: Option B join (remove the participant's counter write, owner materialization); (P5) app: symmetric Option B leave; ~~(P6) e2e D.2~~ **DONE with P3** (the reactive scenario above; the reactive withdrawal symmetry remains to be added with P5). P1→P3 deliver reactivity; P4→P6 the correct counter. P1–P3 can ship before P4–P6. -- **Materialization idempotence**: the per-deposit `uid` (`RegistrationPayload.uid`, `registration.ts:56`) is the pivot; the (reference) recorded by the owner must be consulted before any increment/decrement so as never to double-count (sync replay) nor "resurrect" a count. -- **Native inbox migration**: today the inbox is emulated over the shared wallet (`inbox.ts` post/read RDF). On migration to the native broker inbox (`inbox_post`/`inbox_pop_for_user`, sealed), the Option B flow **remains valid** (non-member deposits allowed, reads reserved to the *readers* = the owner), but the `subscribeDoc` wrapper on the inbox will have to target the native deposit-notification mechanism. To be checked at migration time. diff --git a/.project/concepts/data-layer/brief_2026-07-20_attendance-set-model.md b/.project/concepts/data-layer/brief_2026-07-20_attendance-set-model.md index ec19be4..ac47478 100644 --- a/.project/concepts/data-layer/brief_2026-07-20_attendance-set-model.md +++ b/.project/concepts/data-layer/brief_2026-07-20_attendance-set-model.md @@ -1,6 +1,6 @@ --- type: brief -summary: Target model for sign-ups — a Participation READABLE by everyone (event ref + `active` boolean + cap-less did to the participant's profile), deposited into the event's inbox; the creator processes the inbox, dedups on the overlay without knowing who, files the reference into a Set on the event and PURGES the cancelled ones; count = Set.size with no filtering (accepted upper bound); only connections hold the profile cap and recognize the person. Supersedes Option-B (mutated counter + plaintext userId). +summary: Target model for sign-ups — a Participation READABLE by everyone (event ref + `active` boolean + a key-less reference to the participant's profile), deposited into the event's inbox; the creator processes the inbox, dedups WITHOUT knowing who, files the reference into a Set on the event and PURGES the cancelled ones; count = Set.size with no filtering (accepted upper bound); only connections can read the profile and recognize the person. Supersedes the mutated counter + plaintext userId. --- # Brief (2026-07-20, revised 2026-07-27) — Set-based sign-ups @@ -9,10 +9,10 @@ summary: Target model for sign-ups — a Participation READABLE by everyone (eve Laid down and refined by the PO on 2026-07-27. Everything is **keys and URLs** — no roles, no membership, no allow-list. -1. The participant creates a **Participation** object, **readable by everyone**, holding: the **reference to the event**, an **`active` boolean**, and a **cap-less did to their *protected* profile**. **Nothing else** — no description for now. -2. They deposit the **Participation's did** into the **event's inbox**. +1. The participant creates a **Participation** object, **readable by everyone**, holding: the **reference to the event**, an **`active` boolean**, and a **reference to their *protected* profile that carries no key**. **Nothing else** — no description for now. +2. They deposit the **Participation's reference** into the **event's inbox**. 3. The **creator** processes their inbox **automatically**, as soon as they are online. -4. They **dedup** (see below) — **without knowing who the participant is**: they hold the profile's did, not its cap. +4. They **dedup** (see below) — **without knowing who the participant is**: they hold a name for the profile, not the key to read it. 5. They file a **reference** to the Participation into a **Set** carried by the event's document. 6. Anyone reads **`Set.size`** → the number of participants. 7. Someone **connected** to the participant holds their profile's cap, reads it, and **recognizes** the person. @@ -25,47 +25,40 @@ Three properties follow: **anonymous attendance by default** (even the creator c The object **controlled by the participant** is what counts. Any message — an inbox deposit, a purge notification — is only a **hint** that triggers a check, never an authority. -Consequence: **forgery becomes structurally harmless**. A fake « purge X » leads the creator to read X, find it still active, and do nothing. That is why inbox deposits **need not be signed** — which is just as well, since NextGraph does not offer that (see table). +Consequence: **forgery becomes structurally harmless**. A fake « purge X » leads the creator to read X, find it still active, and do nothing. That is why inbox deposits **need not be signed** — which is just as well, since the contract promises no authenticated sender. ### Why a flag rather than a deletion -A **deletion** is **not detectable** without the read key (VERIFIED: append-only, encrypted tombstone). A **readable** object carrying a **flag** transforms the problem: the cancellation no longer has to be *detected*, it is simply *read*. The blocker disappears instead of being worked around with a forgeable message. +Without the read key, a **deletion** cannot be told apart from "nothing was ever there". A **readable** object carrying a **flag** transforms the problem: the cancellation no longer has to be *detected*, it is simply *read*. The blocker disappears instead of being worked around with a forgeable message. ### Why the identity pointer targets the existing profile -No need for a second document per participation: the participant's **protected profile** already plays that role, and their connections **already** hold its cap — that is the very definition of being connected. A third party sees an opaque did. +No need for a second document per participation: the participant's **protected profile** already plays that role, and their connections **already** hold the key to read it — that is the very definition of being connected. A third party sees an opaque reference. -The advantage over an encrypted field inside the Participation: **adding a connection rewrites nothing**. The profile's cap is sealed to them once, durably. An encrypted field would require re-sealing to N recipients and rewriting the Participation on every new connection. *(Incidentally, an encrypted field is not a NextGraph primitive: the encryption granularity is the document, all-or-nothing.)* +The advantage over an encrypted field inside the Participation: **adding a connection rewrites nothing**. The profile is shared with a new connection once, durably (and irreversibly — the contract publishes no revocation). An encrypted field would require re-encrypting to N recipients and rewriting the Participation on every new connection. -## What this rests on — facts established in NextGraph +## What this rests on -Verified by reading `nextgraph-rs`. Details and pointers live on the polyfill side (`docs/readcap-and-nuri-model.md`) — see [[rule_capture-nextgraph-findings]]. +Two guarantees the contract publishes, and one thing it does not. -| Fact | Status | Role here | -|---|---|---| -| The **overlay** (`:v:`) is **store-scoped**, never document-scoped | VERIFIED | **The dedup key** | -| A cap-less NURI **names without granting read access** | VERIFIED | The profile's did points without disclosing | -| A cap is **sealed durably** to a recipient (no ACL re-declared) | VERIFIED | The profile's cap, sealed once to the connections | -| Without the key, blocks remain **ciphertext** | VERIFIED | The creator genuinely cannot read the profile | -| A **deletion** is **NOT** detectable without the key | VERIFIED | **Why this is a flag, not a deletion** | -| An inbox deposit is **NOT authenticated** (anonymous sealed box) | VERIFIED | **Why messages must stay hints** | -| Author signature verification **is not implemented** at runtime, and would require decrypting | VERIFIED | Rules out the « signed inbox deposit » alternative | +| What the model needs | Where it stands | +|---|---| +| A reference can **name without granting read access** | Published: *"A returned reference carries no key… A reference found inside a document yields a name, not a key."* | +| Sharing is **per document, durable and one-way** | Published: `inbox.share(doc, toUser)` — one act, no revocation, nothing per reader on a public document | +| **Anyone may deposit, only the owner reads** the inbox | Published: `inbox.postToDocument` / `inbox.read` | +| A **dedup key** letting the creator count distinct people without reading them | **NOT published.** See below — this is the open dependency. | -## The dedup: on exactly what +## The dedup: the requirement, and the gap -**Validated by the PO (2026-07-27).** +**The requirement, validated by the PO (2026-07-27)**: the creator must be able to tell two references from the *same* person apart from two references from *different* people, **without ever knowing who** — otherwise the count is not a count of people, and a participant could inflate it by creating several Participations. -A NURI's `:v:` segment comes **not from the document** but from **its store**. And a person has a single store per scope. So **all their Participations carry the same `:v:`**, however many objects they create. That is what the creator dedups on: two references with the same `:v:` in the Set of a single event = the same person. **Without ever knowing who.** +**The contract publishes nothing that does this.** A reference "yields a name, not a key", and no call answers "do these two references belong to one person?". So the mechanism is **not Festipod's to specify**: it is a **gap to raise with the provider**, stated as a need — *a stable, per-person discriminator that can be compared without reading the referenced document*. -This is the **robust** criterion — more so than the profile's did, which a participant could multiply by creating several profile documents in their store. +Design consequence, whatever the mechanism turns out to be: the Set is **keyed by that discriminator** — at most one reference per person. `Set.size` = the number of distinct people. -Design consequence: the Set is **keyed by `:v:`** — at most one reference per `:v:`. `Set.size` = the number of distinct `:v:` = the number of distinct people. +### The reservation that must outlive this brief -### The trade-off — a standing reservation, not to be lost - -> **It lives in `app-security/`[[caveat_stable-overlay-pseudonym]]**, not here. This brief is meant to be dissolved when it graduates; the reservation must outlive it. - -In short: this `:v:` is a **stable, permanent pseudonym** for the person, present in every cap-less reference to their documents. It does not say *who*, but a **single** cross-reference de-anonymizes their whole history **retroactively** — and **no way out exists** (no rotation is possible, VERIFIED). It is **the same bit of information** that makes it possible to dedup without reading and to trace from one event to the next: the two cannot be separated. Making the Participation public **increases the collection surface** for this pseudonym. +Any such discriminator is by construction a **pseudonym**: it does not say *who*, but it is comparable across contexts, so whoever collects references can link them. **Never present a Festipod action as "anonymous"** when it circulates one — the contract guarantees no anonymity, and making the Participation public widens the surface on which it is collected. Whether the pseudonym can be rotated, or scoped, is part of the gap above. ## Trade-offs deliberately accepted (PO, 2026-07-27) @@ -74,14 +67,14 @@ In short: this `:v:` is a **stable, permanent pseudonym** for the person, presen - **No description** in the Participation for now. *(To be reopened when the need arises: whatever we put there would become public.)* - **Creator offline**: the Set does not move until they have processed their inbox. Accepted. -## What changes vs the current implementation (Option-B) +## What changes vs the current implementation -What exists today ([[brief_2026-07-06_reactive-reads-and-attendance]]) derives a `participantCount` **mutated in place** from inbox markers carrying the **plaintext `userId`**. +What exists today ([[knowledge_context-internals]] §participantCount) derives a `participantCount` **written by the owner** from inbox markers carrying the **plaintext `userId`**. -- **Drop the `userId`** from inbox deposits → only the **Participation's did** remains. -- **Count distinct references** (by `:v:`), no longer `userId`s. -- **The mutated `event.participantCount` goes away**, replaced by `Set.size`. -- **Identity resolution** now goes through **reading the profile** (hence through its cap), no longer through the marker. +- **Drop the `userId`** from inbox deposits → only the **Participation's reference** remains. +- **Count distinct people** through the discriminator above, no longer `userId`s. +- **`event.participantCount` goes away**, replaced by `Set.size`. +- **Identity resolution** now goes through **reading the profile** (hence through being connected), no longer through the marker. - **Withdrawal stops being a deletion** → `active` set to false + a purge by the creator. See [[caveat_participation-deletion]], whose requirement (« authoritative, must not come back ») still holds but changes mechanism. Still valid as-is: **reactive reads**, **re-arming on reconnection**, and the **id-space fix** already shipped. @@ -89,16 +82,16 @@ Still valid as-is: **reactive reads**, **re-arming on reconnection**, and the ** ## Open points - **Participation scope** — it becomes **public**, whereas current product doctrine places it in *protected* ([[knowledge_data-scopes-and-discovery]], concept `functional-domain`). That leaf describes **what is implemented**: do not change it until this brief has graduated, but **do update it at that point**. -- **Recognition by connections** (step 7) — how the profile's cap gets sealed, and what happens to a broken connection (revocation is a coarse, non-retroactive re-key). Explicitly deferred to a second stage. +- **Recognition by connections** (step 7) — and what happens to a broken connection: the contract publishes **no revocation**, so sharing a profile is permanent. Explicitly deferred to a second stage. - **Public reads are not recursive** — this is the principle the whole model rests on, and it deserves to be stated on its own: *an item in the **public** store is public — whoever has the URL reads the content.* But **not recursively**: public content may **reference** private content, and **that is exactly our case**. So the creator reads the Participation (public) and **cannot** follow the reference to the profile (protected). That is what yields both readability by the creator and anonymity towards them — with no additional mechanism. ## Dependencies -- **Blocking**: the **polyfill's caps emulation**. Today `caps.ts` models an **ACL** (a set of principals per document) where the reality is **key possession**, and the content stays readable in plaintext (`sparqlQuery` and `inbox.read` bypass the filter). Until that is fixed, coding anonymity on the Festipod side would produce code that **claims** to isolate without isolating. Polyfill brief `2026-07-20-caps-emulation-alignment`, batch P1. +- **Blocking — a contract gap**: no published way to **dedup without reading** (see above). Until the contract answers it, coding this model would produce a count that **claims** to be a count of people without being one. Raise it with the provider; do not emulate it here. - **Parked**: **identity terminology** (wallet / user / profile) — see `.project/to-discuss.md`. ## Status: model settled, implementation gated -The model is **settled** (PO, 2026-07-27) and its foundations are **verified**. What remains gated is the **implementation**: it is waiting on the polyfill's P1 batch. **Do not remove Option-B** in the meantime. +The model is **settled** (PO, 2026-07-27). What remains gated is the **implementation**, waiting on the dependency above. **Do not remove the current owner-derived counter** in the meantime ([[knowledge_context-internals]]). -Links: [[brief_2026-07-06_reactive-reads-and-attendance]] (superseded), [[caveat_participation-deletion]], [[rule_capture-nextgraph-findings]], [[rule_document-per-entity]], app-security ([[caveat_stable-overlay-pseudonym]], [[brief_2026-05-18_authorization-matrix]], [[knowledge_trust-model]]), polyfill `readcap-and-nuri-model.md` + `docs/vision.md`. +Links: [[caveat_participation-deletion]], [[rule_document-per-entity]], [[rule_app-uses-sdk-surface-only]], app-security ([[brief_2026-05-18_authorization-matrix]], [[knowledge_trust-model]]). diff --git a/.project/concepts/data-layer/caveat_event-fields-not-persisted.md b/.project/concepts/data-layer/caveat_event-fields-not-persisted.md index f43b44d..17f7f1b 100644 --- a/.project/concepts/data-layer/caveat_event-fields-not-persisted.md +++ b/.project/concepts/data-layer/caveat_event-fields-not-persisted.md @@ -6,7 +6,9 @@ last_checked: 2026-06-15 # Caveat: event fields not persisted in connected mode -The app type `FpEventData` (`src/shared/data/types.ts`) and the seed (`seedData.ts`) carry the fields **`startDate`, `endDate`, `startTime`, `endTime`, `themes`** — but the **SHEX `Event` shape** (`src/shared/shapes/shex/festipodShapes.shex`) does **not** define them. The shape only covers: `title, description, date, location, distance, participantCount, coverImage, hostName, hostInitials` (to be checked in the `.shex`). +The app type `FpEventData` (`src/shared/data/types.ts`) and the seed (`seedData.ts`) carry the fields **`startDate`, `endDate`, `startTime`, `endTime`, `themes`** — but the **SHEX `Event` shape** (`src/shared/shapes/shex/festipodShapes.shex`) does **not** define them. The shape covers exactly (verified 2026-08-10 in the `.shex`): `title, description, date, location, distance, participantCount, coverImage, hostName, hostInitials`, plus an optional `inbox`. + +> That `inbox` field is a **vestige, and it must stay unused**: it was there to publish an event's inbox address so others could deposit into it. The app no longer handles an inbox address anywhere — a deposit **names the document** (`inbox.postToDocument(doc, …)`) and the owner opens its own with `openDocumentInbox(doc)`. Writing an address into the entity would put back exactly what the surface removed ([[rule_document-per-entity]]). ## Consequence diff --git a/.project/concepts/data-layer/caveat_write-durability-across-disconnect.md b/.project/concepts/data-layer/caveat_write-durability-across-disconnect.md deleted file mode 100644 index 87f61f2..0000000 --- a/.project/concepts/data-layer/caveat_write-durability-across-disconnect.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -type: caveat -summary: An entity written just before an idle period / socket drop can be silently lost (never made durable broker-side); the account survives (no fork). Observed on Firefox. The SDK neither confirms durability nor reconnects on its own. -last_checked: 2026-07-14 ---- - -# Pitfall: a write made just before a disconnect is not guaranteed durable - -**Product symptom.** The user creates an entity (an event), it appears to succeed, then a **period of inactivity** follows; on reload / reconnection, the entity has **disappeared**. The scope reads back **empty**. The **identity/account survives** — this is NOT a fork, it is a write that was never made durable. - -**Mechanism (summary, not settled).** The broker socket can die spontaneously while idle (`SOCKET IS CLOSED … SerializationError`). The write was in the local outbox; on return, the replay fails (`Err(TopicNotFound)`) and the entity is abandoned. **Observed on Firefox only** so far. A cold @data test (2026-07-14) also showed that a **fresh** session (no local state, same account A) does **not** recover A's own scope from the broker: the @data reconnection test that "passed" was in fact re-reading the **local** IndexedDB. Still to be settled: **loss at write time** vs **failure to rehydrate from cold** (two distinct mechanisms) — see the post-mortem in the polyfill. - -**Why the app does not see it.** `NgStatus` is derived from the initial session **exactly once** → blind to drops that happen mid-session. The SDK's `disconnections_subscribe` channel does fire on the failure but **is not consumed** (neither by the polyfill nor by the app). No API confirms that a write reached the broker. - -**Do not document NextGraph internals here.** SDK boundary (see [[knowledge_nextgraph-stack]]): the root cause, the causal chain (socket, reconnection still TODO) and the fix leads live in the `@ng-eventually/client` repo → `docs/incidents/2026-07-14-write-loss-on-disconnect.md`. This note keeps only the **consumer-side impact** + the pointer. - -**Status: open, not addressed (2026-07-14).** To revisit when the core/SDK addresses reconnection or exposes a durability confirmation — this caveat will then fall away. See also the cold-read vs real-loss debate in [[brief_2026-07-06_reactive-reads-and-attendance]] (@data's `BARRIER timed-out` is a distinct signature, not confirmed to be this bug). diff --git a/.project/concepts/data-layer/contract_polyfill-surface.md b/.project/concepts/data-layer/contract_polyfill-surface.md new file mode 100644 index 0000000..075fb68 --- /dev/null +++ b/.project/concepts/data-layer/contract_polyfill-surface.md @@ -0,0 +1,150 @@ +--- +type: contract +summary: The API @ng-eventually/polyfill exposes to an application — signatures, guaranteed behaviour, and what it does not offer +pulled_from: https://gitea.reconnexion.apps.gueraud.net/Reconnexion/ng-eventually.git/.project/concepts/app-contract/contract_polyfill-surface.md +pulled_version: 1ecf511e9d8de8e0feb007f3a88f2c0d56ce455a +pulled_at: 2026-08-16 +--- + +# contract_polyfill-surface — `@ng-eventually/polyfill` + +## Scope + +This package is a polyfill of NextGraph's SDK. + +This package covers placement (creating and listing an application's documents by scope), reading (a document's subjects, one-shot or reactive), sharing a document with a named user, and depositing into inboxes. It does not cover user management, display names, transport, or the operation of a deployment. + +### Deployment requirements + +An application using this package must: + +- serve a wallet file (`.ngw`) from its own bundle, and pass its URL and password to `configure` as `sharedWallet: { fileUrl, password }`; +- call `init(…)` — this package's, not the one it passed to `configure` — and then await `ensureIdentity()`, in a browser context, before rendering its interface. `ensureIdentity()` resolves once a session is open, and a session arrives only through `init`: awaited before `init` has been called, it throws and names the call to make first. + +## Surface + +Full typed shape: the package's `types` entry, `@ng-eventually/polyfill`. A type is published only when a published signature uses it. The load-bearing signatures: + +```ts +// ── bootstrap ──────────────────────────────────────────────────────────── +export function configure(c: EventuallyConfig): void; +export interface EventuallyConfig { + ng: NgLike; // the `ng` object from @ng-org/web + useShape: UseShapeLike; // `useShape` from @ng-org/orm + sharedWallet?: SharedWalletConfig; // { fileUrl, password, importUrl? } + debugAccessLog?: boolean; + init?: (...args: any[]) => any; + initNg?: (...args: any[]) => any; +} + +// ── identity — one await before the application renders ────────────────── +export async function ensureIdentity(): Promise; // returns who you are + +// ── addressing ─────────────────────────────────────────────────────────── +export type Nuri = `did:ng:${string}`; +export type NuriLike = Nuri | string; +export type Scope = "public" | "protected" | "private"; + +// ── placement: where an application's documents live ───────────────────── +export const storeRegistry: { // no identity parameter — a session is one user's + createEntityDoc(scope: Scope): Promise; + listMyEntityDocs(scope: Scope): Promise; + resolveScopeGraph(scope: Scope): Promise; + resolveWriteGraph(scope: Scope): Promise; + openDocumentInbox(doc: NuriLike): Promise; +}; + +// ── reading ────────────────────────────────────────────────────────────── +export async function readUnion(docs: NuriLike[]): Promise; +export interface UnionSubject { subject: string; graph: Nuri; props: Record } +export function useShape(shapeType: unknown, scope: unknown): unknown; // read-filtered view +export function watchShape(query: ShapeQuery): ShapeObservable; +export function subscribeDoc(nuri: NuriLike, onChange: (r: DocChange, t: DocChangeType) => void): Unsubscribe; +export function subscribeDocs(nuris: NuriLike[], onChange: (r: DocChange, t: DocChangeType) => void): Unsubscribe; + +// ── low-level document / SPARQL primitives ─────────────────────────────── +export const docs: { + // `sessionId` is `string | number` — upstream's own declared type (`Session.session_id`). + // It is RELAYED, never converted: the wasm side deserializes a `u64`, and stringifying it + // fails for real (`Deserialization error of session_id JsValue("1")`). + docCreate(sessionId: string | number, crdt: string, cls: string, dest: string, store?: unknown): Promise; + sparqlQuery(sessionId: string | number, query: string, base?: string, anchor?: NuriLike, label?: string): Promise; + // Returns the commits the update produced, as upstream does (it typed this `void` until + // 2026-08-14 while already relaying the value). A caller that ignores it is unaffected. + sparqlUpdate(sessionId: string | number, query: string, anchor?: NuriLike, label?: string): Promise; +}; + +// ── inbox: giving to read, and depositing ──────────────────────────────── +export const inbox: { + share(doc: NuriLike, toUser: string): Promise; // give a reader the key + post(targetInbox: NuriLike, opts: PostOptions): Promise; + postToDocument(doc: NuriLike, opts: PostOptions): Promise; + read(targetInbox: NuriLike): Promise; // only your own + readForDocument(doc: NuriLike): Promise; + readSynced(targetInbox: NuriLike): Promise; + processInbox(targetInbox: NuriLike): Promise; + watch(targetInbox: NuriLike, onDeposits: (d: Deposit[]) => void): () => void; + // `materialize` (a second published name for `read`) was REMOVED on 2026-08-14 — + // an alias with no call site, and no counterpart upstream. Use `read`. +}; +export interface Deposit { from: PrincipalId | null; payload: unknown; ts: number } + +// ── the wrapped SDK objects ────────────────────────────────────────────── +export const ng: NG; // call this instead of the `ng` passed to `configure` + // `NG` is upstream's own type (`@ng-org/web`), 88 typed + // members; it was `Record` until 2026-08-14 +export function init(...args: any[]): any; // likewise — not the `init` passed to `configure` +export function initNg(...args: any[]): any; +``` + +## Guarantees + +Every entry accepts `NuriLike` and validates at the door; what it returns is a precise `Nuri`. No type guard is published. + +A returned reference carries no key — not `createEntityDoc`, not `listMyEntityDocs`, not `UnionSubject.subject` / `.graph`. A reference found inside a document yields a name, not a key. + +You read a document whose key you hold: you created it, it was shared with you, or it sits in a public store, which serves its read key to whoever asks. No call answers "may I read this?". + +What was shared with you becomes readable after `ensureIdentity()`. + +`readUnion` returns one entry per distinct subject present in a document. `subject` is that subject's IRI exactly as written, and is a `string`, because a subject may be any IRI; `graph` is the document reference you passed in, and is the `Nuri` to hand back to this surface. Properties of different subjects are never merged, and the same subject IRI found in two documents stays two entries, told apart by `graph`. Several objects in one document are allowed. Recommended placement is one document per business entity: access is granted per document. + +`urn:ng-eventually:` is reserved. Triples whose **subject** falls under that prefix are dropped on read and never returned by `readUnion`; every other IRI is returned. + +Only a document's owner writes to it. Holding its read key never grants a write. + +`inbox.share(doc, toUser)` names the document and the person; the recipient calls nothing. It refuses a recipient nobody has signed in as, rather than creating them. + +`inbox.post` refuses a target that is not an inbox; to reach a document's owner, use `inbox.postToDocument(doc, …)`. Anyone may deposit into an inbox; only its owner reads it. + +`ensureIdentity()` settles the identity, completes the connection work it starts, and returns the identity. It takes no identifier, and no other call takes one. + +It resolves **only once that work has actually completed**: if what was shared with you could not be restored, or a queue could not be drained, it throws instead of returning. So a resolved call means everything shared with you is readable — and a rejected one must not be rendered past, since the interface would show an empty account rather than an empty screen. + +`ensureIdentity()` mounts a full-screen barrier on every top-level load, and takes it down itself — past the broker round-trip it never appears. A person who comes back to the page from that round-trip finds the barrier live again, prefilled, and confirming it hands the page over a second time. The application's own page is never reloaded and nothing outside the barrier is touched. + +**The session is the package's, not yours.** You never build one, and no call takes one. Call this package's `init` (not the one you passed to `configure`): it captures the session the SDK delivers to `init`'s callback and keeps it, then calls your callback with that same event untouched — so an application that wants the `session_id` for the `docs` primitives reads it there, and one that does not may pass no callback at all. Identity normalisation is the package's too: `@Alice`, `alice ` and `ALICE` are one person. + +Where a call must first find out whether something already exists — a document's record in its store, a user's inbox — it throws when it could not find out, instead of proceeding as though the answer were "nothing". So `createEntityDoc` throws if the document cannot be recorded in its store, and resolving an inbox throws rather than handing back a second one. **A rejection means "unknown", never "absent"** — retry it or surface it, but do not read it as an empty result. + +## Non-guarantees + +**No display name.** `ensureIdentity()` returns an opaque identifier: do not parse it, split it, or render it as a readable name. + +**No revocation.** `inbox.share` cannot be undone. + +**Nothing per reader on a document in a public store.** No grant, no revocation, no audience list. + +**No delegated writing.** A received key never grants a write, and no call adds a writer to a document. + +**No mailbox model.** Do not build on the raw deposit list. + +**No cross-broker reference.** A returned reference resolves for users of the same broker. + +**No unfiltered read through `useShape`.** Members that yield items are filtered and mutations pass through; anything else throws. A document reached through that view alone, read nowhere else first, does not appear. + +## Change policy + +This surface changes, and shrinks. The package does not offer semantic-version stability. + +Re-pull this contract at every upgrade. diff --git a/.project/concepts/data-layer/knowledge_context-internals.md b/.project/concepts/data-layer/knowledge_context-internals.md index f875f9a..6656260 100644 --- a/.project/concepts/data-layer/knowledge_context-internals.md +++ b/.project/concepts/data-layer/knowledge_context-internals.md @@ -1,45 +1,47 @@ --- type: knowledge -summary: Internal pitfalls of FestipodDataContext — currentUserId = a stable principal derived from the identifier, TWO id spaces joined through the normalized identifier (resolveParticipantUser / USER_PRINCIPAL_PREFIX), OPT-IN auto-seed (FESTIPOD_AUTO_SEED, OFF by default), Option-B derived participantCount (reliable at the owner's connection because it reads under the synced-view contract; single source = event.participantCount), session reset on identity change (overlay + caps), useShapeQuery instrumentation (spinner + timing) + identity-first logs, mutations that are no-ops in local mode despite the toast -last_checked: 2026-07-27 +summary: Internal pitfalls of FestipodDataContext — currentUserId is the profile document read back in the protected scope (empty until it lands), the legacy principal space resolveParticipantUser still resolves on read, OPT-IN auto-seed, owner-derived participantCount, local-mode no-op mutations +last_checked: 2026-08-10 --- # Internals & pitfalls of `FestipodDataContext` Non-obvious behaviours of `src/shared/context/FestipodDataContext.tsx` to know about before touching the data context. -## Resolving `currentUser` (NG mode) +## Who am I — `currentUserId` is a document you read back, not a value you were given -In connected mode, the currentUser's **principal** (`currentUserId`) is **not** `CURRENT_USER_ID` ('user-1', local mode), nor the IRI of the profile that was read. When an identifier is logged in, it is an id **derived from that identifier and stable**: `urn:festipod:user:`, available immediately (without depending on reading the protected profile) and invariant for the session — the same key used by `setCurrentUser`, the owner cap and the shim account (see [[rule_document-per-entity]], identity corollary). Remaining pitfalls: -- The `currentUser` object (the displayed profile), by contrast, is resolved by `users.find(u => normalizeIdentifier(u.username) === identifiant)` with a **fallback** to `@mariedupont` then `users[0]` — a silent fallback if the identifier matches no profile (the identifier is a space id, not necessarily the `username` of a seeded profile). -- With no identifier logged in (dev/demo), `currentUserId` falls back to the IRI of the profile that was read (or `''` if the wallet is empty → a `Participation` with `user: ''`, which is invalid): only create a participation once the principal is resolved. +**The app names no identity of its own** (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]): `ensureIdentity()` takes nothing, and nothing switches identity afterwards. So the provider cannot *derive* a principal from an input. What the current user **is**, is the **profile document it reads back in its own protected scope**: `currentUserId` = that profile's `@id`, a doc NURI — the very same value as `currentUser?.id`. -## TWO id spaces meet — joining a participation to its profile +**The pitfall that follows**: it is **empty until the protected read lands**, and empty is an ordinary string that raises nothing. Mutations needing it **refuse** (`joinEvent` logs `empty user principal — refusing to write a participation with no fp:user` rather than writing an entity that would be dropped on read); queries keyed on it return **empty results** that render as "you have nothing". Treat `''` as *not ready*, never as *no data* — see `app-architecture`, [[caveat_identity-ids-in-screens]]. -**Invariant.** A `Participation` stores its user as a **principal** (`urn:festipod:user:`, = `currentUserId`), whereas a `UserProfile` has as its `id` the **NURI of its document** (`did:ng:…`). In connected mode, **these two values are never equal**. So a raw `participation.userId === profile.id` join **never** matches — a symptom that shipped and was then fixed (2026-07-27): every participant displayed as « participant inconnu ». Every participation→profile join goes through **`resolveParticipantUser`** (`FestipodDataContext`), never through a direct comparison. +> The `currentUser` object is picked with a **fallback** (`@mariedupont`, then `users[0]`) — a leftover of the demo seed, and a silent one: on a wallet holding several profiles it can settle on the wrong person. Worth a look whenever "the app thinks I am someone else". -The **bridge** between the two spaces is the **normalized identifier**: `principal − prefix` == `normalizeIdentifier(profile.username)` (the same equality that resolves `currentUser`). Hence the order in which `resolveParticipantUser` tries: (1) a **direct match** `u.id === userId` — the demo seed's space, where both sides hold the same bare id (`user-1`) and where the seeded username `@mariedupont` would *not* normalize to that id, so the direct match must come first; (2) failing that, a **match on the normalized identifier** after stripping the prefix. +## The legacy principal space — resolved on READ only -**`USER_PRINCIPAL_PREFIX` is the single source of the prefix**, shared by the **write** side (deriving `currentUserId`) and the **read** side (`resolveParticipantUser`). If you change the shape of the principal, change it **there**: otherwise write and read drift apart silently and the join falls back to « inconnu » without raising an error. +A `Participation` written **today** carries `currentUserId` in `fp:user`, i.e. a profile doc NURI, so a direct `participation.userId === profile.id` join matches. Participations written under the **earlier** scheme carry a principal of the form `urn:festipod:user:`, which matches nothing directly. -A **third** id space exists and takes **no** part in this join: the inbox deposit `uid` (`mint…`) — it identifies a **deposit** for the counter, never a user. +**`resolveParticipantUser`** (`FestipodDataContext`) is the single join point, and it tries, in order: (1) a **direct match** `u.id === userId` — today's writes, and the demo seed's bare `user-1` space; (2) failing that, strip `USER_PRINCIPAL_PREFIX` and match the remainder against `normalizeIdentifier(profile.username)` — the legacy space. Never join by direct comparison at a call site: the symptom of getting it wrong is every participant rendering as « participant inconnu », which shipped once already. -> **Horizon.** This paragraph describes **what is implemented** (Option-B). The target model drops the plaintext `userId` and routes identity resolution through **reading the profile** — see [[brief_2026-07-20_attendance-set-model]], whose implementation is gated. The id-space fix is explicitly noted there as **still valid**: do not undo it in anticipation of the target. +`USER_PRINCIPAL_PREFIX` is now **read-side only** — nothing mints it any more. It is kept so old data still resolves; it is not a shape to write against. + +A further id space takes **no** part in this join: the inbox deposit `uid` (`mint…`) — it identifies a **deposit** for the counter, never a user. + +> **Horizon.** This paragraph describes **what is implemented**. The target model drops the plaintext `userId` and routes identity resolution through **reading the profile** — see [[brief_2026-07-20_attendance-set-model]], whose implementation is gated. The id-space fix is explicitly noted there as **still valid**: do not undo it in anticipation of the target. ### Which space each query expects (the `buildQueries` contract) | Query | What it expects / returns | |---|---| -| `getUserEvents(userId)`, `isParticipating(eventId, userId?)`, `getFriends(userId?)` | **expect the principal** (they filter on `participation.userId` / `friendship.userId`) — their default is `currentUserId`, which is correct | +| `getUserEvents(userId)`, `isParticipating(eventId, userId?)`, `getFriends(userId?)` | filter on `participation.userId` / `friendship.userId`; their default is `currentUserId`, which is correct | | `getEventParticipants(eventId)` | **returns profiles** (`FpUserData` → `id` = NURI), the join being done internally | -**Screen-side impact**: filtering yourself out of a participant list compares against **`currentUser?.id`** (the profile NURI, the same space as the rendered items), **not** against `currentUserId` (the principal) — otherwise you do not remove yourself and you see yourself appear as one more participant. Conversely, passing a **profile id** to `getUserEvents`/`isParticipating` returns an **empty** list in connected mode. See `app-architecture`, [[caveat_identity-ids-in-screens]]. +**Screen-side impact**: `currentUserId` and `currentUser?.id` are now the same value, so filtering yourself out of a participant list works either way. What still bites is passing an id **before it resolves** — see `app-architecture`, [[caveat_identity-ids-in-screens]]. ## Reads = `watchShape` (the SDK surface), no more bespoke machinery -**Since 2026-07-10**: `useNgData` reads through `useShapeQuery(shape, scope)` (a `useSyncExternalStore` binding over the polyfill's `watchShape`) — THREE useQuery-shaped reads (events/public, users/protected, participations/protected) + Fp adapters (`shapeAdapters.ts`). Removed: `readEntities`, `subscribeDocs`+`bumpRead`+`readTick`, the manual listing (`publicDocs`/`protectedDocs`/`registerDoc` for reads), and `relist`. `ready` = the combination of the `isSuccess` flags. See [[rule_app-uses-sdk-surface-only]]. +**Since 2026-07-10**: `useNgData` reads through `useShapeQuery(shape, scope)` (a `useSyncExternalStore` binding over `watchShape`) — THREE useQuery-shaped reads (events/public, users/protected, participations/protected) + Fp adapters (`shapeAdapters.ts`). Removed: `readEntities`, `subscribeDocs`+`bumpRead`+`readTick`, the manual listing (`publicDocs`/`protectedDocs`/`registerDoc` for reads), and `relist`. `ready` = the combination of the `isSuccess` flags. See [[rule_app-uses-sdk-surface-only]]. -**Immediate visibility of mutations = an OPTIMISTIC overlay** (no `registerDoc`): `createEvent`/`joinEvent`/`leaveEvent` feed `pendingAddEvents`/`pendingAddParticipations`/`pendingRemoveIds`; the exposed state = merge(reactive, adds) minus removes, deduped by id (id = the doc's NURI). Reconciliation happens automatically on push (an add that shows up in the reactive state, or a remove that disappears from it, is dropped) — never a poll ([[rule_no-broker-polling]]). Cleared on identity change. +**Immediate visibility of mutations = an OPTIMISTIC overlay** (no `registerDoc`): `createEvent`/`joinEvent`/`leaveEvent` feed `pendingAddEvents`/`pendingAddParticipations`/`pendingRemoveIds`; the exposed state = merge(reactive, adds) minus removes, deduped by id (id = the doc's NURI). Reconciliation happens automatically on push (an add that shows up in the reactive state, or a remove that disappears from it, is dropped) — never a poll ([[rule_no-broker-polling]]). ## Dev auto-seed @@ -47,19 +49,19 @@ A **third** id space exists and takes **no** part in this join: the inbox deposi When it is enabled, the auto-seed fires if events AND users are both empty — **gated on `isSuccess`** (`watchShape`'s readiness), NO LONGER on a 3s `setTimeout`: we only decide "the wallet is empty" once the sync is **confirmed** (`isSuccess`), otherwise a not-yet-finished read was taken for an empty wallet → a re-seed on every reconnection (bug fixed). Remaining pitfalls: - **One seed at a time**: `loadTestData()` sets `hasTriedAutoSeed`, and the auto-seed re-checks it → an explicit load cancels the pending auto-seed (otherwise two concurrent `bootstrapWallet` calls write everything twice). -- The seed is **owned by the current identity** (`bootstrapWallet(…, owner)`): the seeded protected entities go through the owner's per-document read cap. +- The seed writes under the **connected session**, so the session that seeds **holds** what it seeded and its protected fixtures round-trip. Seeded users are fixtures, not accounts — nobody has signed in as them, which matters because `inbox.share` refuses a recipient nobody has ever been. Only **events** get an inbox opened at seed time (`openDocumentInbox`), because events are what people deposit into. - **No retry**: if the seed fails, you get an empty screen + a `console.error`. -## `participantCount` — derived and owned by the owner (Option B) +## `participantCount` — derived and owned by the owner -> ✅ **CORRECTED (2026-07-13).** The requirement is **"reliable at the owner's NEXT CONNECTION"** (the creator processes their inbox when they connect), NOT a live real-time cross-user notification. The bug was: the owner-materializer materialized **too early** (before the participant's deposit had synced) → read `active=0` → wrote 0 → **memoized that 0** → never re-processed. Fix: (1) read under the **synced-view contract** — `inbox.readSynced` instead of `inbox.read`, so a deposit already synced by another identity IS seen from a cold session (the two differ by contract, see [[knowledge_sdk-surface]]); (2) the materializer fires **directly on connection** (`[ready, ownedKey]`), no longer only on a push; (3) `materializedCountRef` no longer locks in a premature 0 (its sole role = loop guard: only write when the derived value changes); (4) **the single source of the NUMBER = `event.participantCount`** (the `participantCount: 1` literal in `CreateEventScreen` is removed → it starts at 0; the display no longer computes a local number). Kept GREEN (on a fresh profile) by `event/e2e-multibrowser.feature` « Le compteur converge chez le propriétaire à sa prochaine connexion » (un-`@wip`'d). No polling ([[rule_no-broker-polling]]). +> ✅ **CORRECTED (2026-07-13).** The requirement is **"reliable at the owner's NEXT CONNECTION"** (the creator processes their inbox when they connect), NOT a live real-time cross-user notification. The bug was: the owner-materializer materialized **too early** (before the participant's deposit had synced) → read `active=0` → wrote 0 → **memoized that 0** → never re-processed. Fix: (1) read through `inbox.readSynced` instead of `inbox.read` — the two differ by contract, and only the former is the synced view ([[contract_polyfill-surface]]); (2) the materializer fires **directly on connection** (`[ready, ownedKey]`), no longer only on a push; (3) `materializedCountRef` no longer locks in a premature 0 (its sole role = loop guard: only write when the derived value changes); (4) **the single source of the NUMBER = `event.participantCount`** (the `participantCount: 1` literal in `CreateEventScreen` is removed → it starts at 0; the display no longer computes a local number). Kept GREEN (on a fresh profile) by `event/e2e-multibrowser.feature` « Le compteur converge chez le propriétaire à sa prochaine connexion » (un-`@wip`'d). No polling ([[rule_no-broker-polling]]). -**Since Option B (2026-07-07)**: `participantCount` is no longer mutated in place by the participant. The flow is inbox-deposit → owner-materialization: -- `joinEvent`/`leaveEvent` **no longer** write `participantCount` on the event's doc (that would be an isolation violation — the participant writing someone else's doc; NextGraph writes are membership-bound, with no append). The participant only writes their **own** participation doc (protected), then **deposits** a marker into the event's inbox (`depositRegistration` on join, `depositLeave` on leave, `src/shared/data/registration.ts`). -- The event **owner's** session does the materializing: it is subscribed (`inbox.watch`, `doc_subscribe`, no polling) to the inbox of the events it owns (`ownedEventIds` = `listMyEntityDocs(owner,'public')` + freshly created events), and on every deposit it **recomputes** `participantCount` on **its own** event doc (`updateEntityField` on its own doc). It is the counter's only writer. -- **The counter is DERIVED, not incremented**: `materializeAttendance` (registration.ts) reads the inbox and computes the **set** of distinct active sign-ups (`new-participant` deposits deduped by `uid`, MINUS those cancelled by a `leave-participant` — by exact `regUid` or by the `(eventId, userId)` fallback). `participantCount = |active set|` — **no host baseline**: the creator does not attend automatically (there is no notion of host, see concept `functional-domain`), so the counter starts at **0** on creation and only moves on real sign-ups. `createEvent` **no longer writes** a participation at creation time (it used to write a host participation and set the counter to 1); the creator sees « J'y serai » and can join/leave their own event like anyone else. Because it is a **pure function of the inbox**, a broker sync replay converges — never double-counting nor a phantom decrement (idempotence). The write is guarded (it only writes when the value changes), a loop guard. Covered by the `@data` scenario « Le créateur ne participe pas automatiquement à son événement » (us-13): counter 0 + `isParticipating(E)===false` at creation, then join→true / leave→false. -- **Owner offline = eventual**: only the owner's session materializes; while they are disconnected, the counter does not move for anyone else (the participations/deposits stay persisted — nothing is lost; a future service will materialize in their stead). -- The counter nevertheless remains an **aggregate**, not the list of named participants: `getEventParticipants` (named identity) is still governed by the protected read cap ([[caveat_participation-deletion]] for the authoritative deletion, unchanged). See the brief `brief_2026-07-06_reactive-reads-and-attendance` §B. +**Since 2026-07-07**: `participantCount` is no longer mutated in place by the participant. The flow is inbox-deposit → owner-materialization: +- `joinEvent`/`leaveEvent` **no longer** write `participantCount` on the event's doc — **only a document's owner writes to it**, so a participant cannot touch someone else's. The participant only writes their **own** participation doc (protected), then **deposits** a marker into the event's inbox (`depositRegistration` on join, `depositLeave` on leave, `src/shared/data/registration.ts`). +- The event **owner's** session does the materializing: it watches (`inbox.watch`, no polling) the inbox of the events it owns (`ownedEventIds` = `listMyEntityDocs('public')` + freshly created events), and on every deposit it **recomputes** `participantCount` on **its own** event doc (`updateEntityField` on its own doc). It is the counter's only writer. +- **The counter is DERIVED, not incremented**: `materializeAttendance` (registration.ts) reads the inbox and computes the **set** of distinct active sign-ups (`new-participant` deposits deduped by `uid`, MINUS those cancelled by a `leave-participant` — by exact `regUid` or by the `(eventId, userId)` fallback). `participantCount = |active set|` — **no host baseline**: the creator does not attend automatically (there is no notion of host, see concept `functional-domain`), so the counter starts at **0** on creation and only moves on real sign-ups. `createEvent` **no longer writes** a participation at creation time (it used to write a host participation and set the counter to 1); the creator sees « J'y serai » and can join/leave their own event like anyone else. Because it is a **pure function of the inbox**, a replay converges — never double-counting nor a phantom decrement (idempotence). The write is guarded (it only writes when the value changes), a loop guard. Covered by the `@data` scenario « Le créateur ne participe pas automatiquement à son événement » (us-13): counter 0 + `isParticipating(E)===false` at creation, then join→true / leave→false. +- **Owner offline = eventual**: only the owner's session materializes; while they are disconnected, the counter does not move for anyone else (the participations and deposits stay persisted — nothing is lost). +- The counter nevertheless remains an **aggregate**, not the list of named participants: `getEventParticipants` (named identity) is still governed by what the protected scope hands back ([[caveat_participation-deletion]] for the authoritative deletion, unchanged). ### Id-form invariant: match on the CANONICAL form of the event id @@ -69,19 +71,13 @@ An event's `@id` **is** its document NURI (`did:ng:o:[:v:]`). The **Rule**: match the event id on its **canonical form** — the base repo id, with any `:v:` suffix stripped (`canonicalEventId`, `src/shared/data/registration.ts`). This canonical form is used for **matching** in `materializeAttendance` / `readRegistrationNotifications`, and for **deduplicating** `ownedEventIds` (`ownedKey`, FestipodDataContext) so that one and the same event reached through two paths is not materialized twice. **Careful**: only the **matching** uses the stripped form; the counter is always **written** to the real owned NURI (a live, openable doc) — a stripped id must never serve as a write target or an anchor. This is an **app-side** invariant (not a NextGraph detail): however the lib makes the overlay vary, the app matches on the common base. -## Identity change = a fresh session (isolation) +## There is no identity switch any more -> **History of the symptom** (the paragraph that follows describes the setup of the time — the bespoke read set `publicDocs`/`protectedDocs`/`readTick` **no longer exists** since the move to `watchShape`). It is kept because it explains *why* the reset rule exists; the **current mechanism** is described further down. +The app settles its identity **once**, before anything renders (`ensureIdentity()` in `AuthGate`), and offers no way to change it — the surface stopped publishing one (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]). So the provider carries **no identity-change reset**: no `useEffect([identifier])`, no cap reset, no registry-cache reset. Those symbols are gone; do not reintroduce a reset for a transition that cannot happen. -The on-demand read set (`publicDocs`/`protectedDocs`) **accumulated** the current identity's scope docs (so as not to lose a just-created doc before the re-listing). But the shared-wallet stopgap keeps **a single React tree** across a fake logout + re-login under a **different identifier** (no page reload — `AccountContext.login` merely rewrites the identifier in localStorage, and `AuthGate` remounts nothing). Without a reset, **the previous identity's PROTECTED docs (its participations) survive in the new identity's read set and leak** through the union read: the cap gate cannot filter them out when the (in-memory) cap registry does not govern that doc in *this* session (a doc persisted from an earlier run, or a fresh load where the caps are empty). Symptom observed: a user B saw A's participation (and A's event appeared on B's **home screen**, since home = `getUserEvents(currentUserId)`, see concept `app-architecture`). - -**Rule**: treat **any identifier change** as a **fresh session**. A `useEffect([identifier])`, **ref-guarded** (it does not fire on first mount, only on a genuine value change), resets **all session state carried by the app**. Isolation remains per-document/emulated (concept `app-security`, [[knowledge_trust-model]]); this reset only removes the carry-over of state between identities. - -**Current mechanism** (since reads go through `watchShape`): the **read** side has nothing left to reset — `watchShape` re-resolves its scope against the new `getCurrentUser()` on the next push. What the effect clears is the **app-side** state: `ownedEventIds` (the owner materializer's set), the `joinUids` map (the current session's deposit uids), the **optimistic overlay** (`pendingAddEvents`/`pendingAddParticipations`/`pendingRemoveIds` — otherwise the old identity's mutations bleed into the new one's reads), then `resetCaps()` + `resetRegistryCache()`. - -> **Impact — the invariant not to break**: **any new session state** added to the provider (a cache, a `useRef`, the overlay, a doc set) must be added to that effect. Forgotten state **leaks from one identity to the next** with no error — exactly the class of bug the regression guard below covers. - -**Mechanism confirmed empirically (2026-07-07)**: the leak reproduces ONLY when TWO conditions coincide — (a) the read set still carries A's PROTECTED doc across the switch (no reset), AND (b) the in-memory cap registry does not govern that doc (`resetCaps()` already fired / caps empty for a doc persisted from a session earlier than the reload). Then A's participation makes it through B's union read (the per-document filter has no cap to check). With the reset fired, A's doc left B's read set BEFORE the cap-less read could expose it → no more leak whatever the state of the caps (at the time via `setProtectedDocs([])`; today it is `watchShape` that re-resolves the scope, and the reset now carries only the app-side state listed above). **Regression guarded** by the `@data` scenario « Une identité fraîche ne voit pas la participation d'une autre » (event/isolation-deux-identites.feature): A creates E and signs up to it, B (a fresh page on the same wallet, with a distinct identifier) has NEITHER E on their home screen (`getUserEvents(B)`), NOR `isParticipating(E,B)`, AND reads NO participation carrying A's principal. The historical symptom « B voit "Je participe" » mostly occurred when B **reused an identifier already used by A** (the same normalized principal) on a **bloated** wallet (docs persisted from an earlier run, empty caps). +> **Why there is nothing left to reset.** An identity-change reset only made sense while a single React tree could outlive a change of identity. It cannot: one page hosts exactly one identity for its whole life, so session state (the read set, the optimistic overlay, the owner-materializer's doc set) has no second identity to leak into. +> +> The **cross-identity isolation** behaviour is still a real Festipod requirement, but proving it needs **two genuinely separate browser contexts**, each signing in for itself. `event/isolation-deux-identites.feature` is `@wip` for exactly that reason (concept `bdd-testing`, [[rule_tests-validate-festipod-not-the-sdk]]). ## `useShapeQuery` instrumentation — global spinner + timing @@ -89,7 +85,7 @@ The on-demand read set (`publicDocs`/`protectedDocs`) **accumulated** the curren ## Logging convention — identity-first prefix, and counter before→after -Every DATA log from the provider goes through **`logPrefix`**: `[][app][data]` when the principal is resolved, `[app][data]` otherwise (a transient connection state). Reason: with the shared wallet, **two identities share the same console** (two tabs / a multi-browser run) — an unprefixed line does not say *whose* it is and becomes useless for diagnosing a leak or a stuck counter. **Adding a DATA log = reusing `logPrefix`**, not a bare `console.log`. +Every DATA log from the provider goes through **`logPrefix`**: `[][app][data]` when the principal is resolved, `[app][data]` otherwise (a transient connection state). Reason: a run often drives **several sessions at once** (two tabs, a multi-browser scenario) and their lines end up read side by side — an unprefixed line does not say *whose* it is and becomes useless for diagnosing a leak or a stuck counter. **Adding a DATA log = reusing `logPrefix`**, not a bare `console.log`. Two measurement points are laid down **as a pair** and serve together: the owner's materializer logs `participantCount` **before → after** its write, and the display read logs the value **as exposed to the render**. Comparing them tells a stuck counter apart between a **DATA** problem (never incremented) and a **DISPLAY** problem (incremented but not re-read until the next session). Do not remove one without the other — on their own they diagnose nothing. diff --git a/.project/concepts/data-layer/knowledge_data-modes.md b/.project/concepts/data-layer/knowledge_data-modes.md index b57e5f4..81a96e0 100644 --- a/.project/concepts/data-layer/knowledge_data-modes.md +++ b/.project/concepts/data-layer/knowledge_data-modes.md @@ -1,19 +1,19 @@ --- type: knowledge -summary: Two modes (connected = the @ng-eventually/client SDK, disconnected/demo = seeded local state); FestipodDataContext picks the provider based on connection status, and every screen goes through useFestipodData() +summary: Two modes (connected = the @ng-eventually/polyfill SDK, disconnected/demo = seeded local state); FestipodDataContext picks the provider based on connection status, and every screen goes through useFestipodData() --- # Data modes & contexts The app has **two modes**, both consumed through the `useFestipodData()` hook: -1. **Connected** — ORM shapes from the `@ng-eventually/client` SDK (P2P, encrypted, local-first) +1. **Connected** — ORM shapes from the `@ng-eventually/polyfill` SDK (P2P, encrypted, local-first) 2. **Disconnected / Demo** — local React state seeded from `seedData.ts` (see [[knowledge_seed-data]]) ## NextGraphContext (`src/shared/context/NextGraphContext.tsx`) - Connection cycle: `disconnected` → `connecting` → `connected` | `error`. -- Provides the session (the current user and their access to the per-scope stores). +- That status is what the data provider below keys on; the app holds no session of its own. ## FestipodDataContext (`src/shared/context/FestipodDataContext.tsx`) diff --git a/.project/concepts/data-layer/knowledge_nextgraph-stack.md b/.project/concepts/data-layer/knowledge_nextgraph-stack.md index 367dee1..311149d 100644 --- a/.project/concepts/data-layer/knowledge_nextgraph-stack.md +++ b/.project/concepts/data-layer/knowledge_nextgraph-stack.md @@ -1,23 +1,17 @@ --- type: knowledge -summary: The data SDK is @ng-eventually/client (treated as a finished NextGraph SDK) — injected exactly once through ngSession.configure; reactive useShape ORM over the festipodShapes SHEX shapes, bindings regenerated with build:orm; never document NextGraph's current state here +summary: The data SDK is @ng-eventually/polyfill, injected exactly once through ngSession.configure; reads go through the reactive useShape/watchShape surface over the festipodShapes SHEX shapes, whose ORM bindings are regenerated with build:orm --- -# Data stack (the `@ng-eventually/client` SDK) +# Data stack (SHEX shapes over the `@ng-eventually/polyfill` surface) -Festipod persists through **`@ng-eventually/client`** — the NextGraph SDK the app consumes. We treat it as a **finished, mature SDK**: documents per entity placed by scope, capabilities, inboxes, a reactive ORM. - -> **It is a polyfill, and that word carries its whole job**: closing the gap between the SDK **as it should be** and what NextGraph provides **today**. The app codes against the target and **ignores the current state entirely**; the polyfill absorbs the difference. The contract itself — which surfaces exist and what may be assumed of them — is written down in this repo: [[knowledge_sdk-surface]]. See [[rule_app-uses-sdk-surface-only]]. - -``` -@ng-eventually/client # THE app's data SDK (reactive useShape ORM, docs, scopes, inbox) -``` +Festipod persists through **`@ng-eventually/polyfill`**. What that surface offers, and what it refuses to promise, is written down in one place: [[contract_polyfill-surface]], pulled into this repo and version-pinned. See [[rule_app-uses-sdk-surface-only]]. ## SDK boundary (the golden rule) -- The app **depends on `@ng-eventually/client` only** for data. -- The SDK is **initialized/injected exactly once** through `ngSession.configure(...)` (`src/shared/utils/ngSession.ts`) — a single injection point. Everything else in the app (data plane, lifecycle, login, types) goes through the lib. -- **Never document NextGraph's current state in this repo** (constraints of the underlying SDK, workarounds, broker/verifier internals): that lives in the `@ng-eventually/client` repo. Here we describe only **how Festipod uses that SDK**. +- The app **depends on `@ng-eventually/polyfill` only** for data. +- It is **initialized/injected exactly once** through `ngSession.configure(...)` (`src/shared/utils/ngSession.ts`) — a single injection point. Everything else in the app (data plane, lifecycle, login, types) goes through it. +- **Never describe here how the data layer is implemented underneath.** This concept covers only **how Festipod uses the surface**. ## ORM & SHEX shapes @@ -31,6 +25,6 @@ The reactive ORM (`useShape`) is built on **SHEX shapes**: `src/shared/shapes/sh The ORM bindings are generated in `src/shared/shapes/orm/` (`*.schema.ts`, `*.shapeTypes.ts`, `*.typings.ts`). **Regenerate** with `bun run build:orm` after any `.shex` change. -> **Recommended way to read = the SDK's reactive hook.** The canonical way to read is `useShape`: you subscribe to a shape on a scope, you get the current value, and the component re-renders on every change (local **or** remote once synchronized) — subscription/push, never polling; one-shot reads are the exception. The SDK's full reference (read/reactivity contract + where the current emulation still diverges) lives on the lib side: `packages/client/docs/sdk-reference.md` in `@ng-eventually/client`. Do not copy NextGraph internals here. +> **The canonical way to read is the reactive hook.** `useShape`/`watchShape`: you subscribe to a shape on a scope, you get the current value, and the component re-renders on every change — subscription/push, never polling; one-shot reads are the exception. The read/reactivity contract is [[contract_polyfill-surface]] and nothing else. > `Friendship` has **no** SHEX shape and no persistence — it stays app-TS-only (see [[knowledge_entities]]). diff --git a/.project/concepts/data-layer/knowledge_sdk-surface.md b/.project/concepts/data-layer/knowledge_sdk-surface.md deleted file mode 100644 index edf54e3..0000000 --- a/.project/concepts/data-layer/knowledge_sdk-surface.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -type: knowledge -summary: The `@ng-eventually/client` contract Festipod is written against, as a FINISHED NextGraph SDK — reactive reads (`watchShape`, `useShape`), document writes (`docs`), per-scope placement (`storeRegistry`), `inbox`, `discovery`, capabilities (`capFor` / `inbox.shareCap` / `publishRepoLink`), identity — with what the app MAY and MAY NOT assume of each, so no agent ever needs to open the SDK's own repo. ---- - -# The SDK surface Festipod codes against - -This is Festipod's **data contract**: what `@ng-eventually/client` offers, and what the app is entitled to rely on. It describes the SDK **as it should be** — a finished NextGraph SDK — because that is what the app is written against ([[rule_app-uses-sdk-surface-only]]). It says **nothing** about NextGraph's or the package's implementation state, on purpose: the app ignores that entirely, and any gap is the package's to absorb, never the app's. - -Everything below is exported from the SDK entry `@ng-eventually/client`, **except** the few items explicitly marked `/polyfill` — the bootstrap subpath `@ng-eventually/client/polyfill`, the one part that disappears at migration. Injection happens exactly once, in `ngSession` ([[knowledge_nextgraph-stack]]). - -## Reactive reads — the canonical path - -**`watchShape(shapeType, scope) -> ShapeObservable`** — the read Festipod uses. It observes one SHEX shape over one **logical scope** (`'public' | 'protected' | 'private'`) and yields a `useQuery`-shaped snapshot: `{ data, isPending, isSuccess, isError, error }`. Bind it with `useSyncExternalStore` (`src/shared/data/useShapeQuery.ts`). - -May assume: - -- `data` is **always an array**, never `undefined`; its items are `UnionSubject` (`{ subject, graph, props }`) — raw per-subject property bags, mapped to `Fp*` types by `src/shared/data/shapeAdapters.ts` ([[knowledge_entities]]). -- `isPending` and `isSuccess` are **mutually exclusive**, and a synchronized-but-empty scope is `isSuccess` with `data: []` — the distinction the surface exists for. Never guess emptiness with a timer. -- The snapshot reference is **stable** until the value actually changes (safe for `useSyncExternalStore`). -- Reactivity is **push**: the snapshot updates on any change in scope, local or remote, and on any change to what the current identity may read. Never polling. -- The observable is **inert until first `subscribe()`** (or `refetch()`); the last unsubscribe tears everything down. `refetch()` forces a re-resolve and is idempotent w.r.t. subscriptions. -- `isError` fires **only** on a real thrown exception, never on a slow or absent peer. - -**`useShape(shapeType, scope) -> DeepSignalSet`** — the ORM hook, for **one already-known document NURI** as scope. Returns a live reactive set that re-renders on every change. Festipod uses it in the `@data` harness; screens go through `watchShape`. - -May not assume: any ordering of `data`; that a value seen once stays; that a document the identity holds no capability for will ever appear (it silently does not). - -## Writes — one document at a time - -**`docs.docCreate(sessionId, crdt, cls, dest, store?)`** creates one document and returns its NURI. **`docs.sparqlUpdate(sessionId, query, anchor)`** writes into it: a SPARQL `INSERT`/`DELETE` scoped to the **anchor document's** graph. **`docs.sparqlQuery(sessionId, query, base?, anchor?)`** is the one-shot, non-reactive read. - -May assume: - -- One document = one repo = one entity ([[rule_document-per-entity]]); a write is a change on that document, and every observer of it is pushed. -- A write **targets exactly one document**. There is no "write to the union", and no primitive by which a non-owner appends to someone else's document — surfacing data to another identity goes through the **inbox**, or through each identity owning its own document. - -May not assume: that `sparqlQuery` is reactive (it is a snapshot — to stay live, use `watchShape`); that an unanchored update means anything. - -## Placement by scope — `storeRegistry` - -**`storeRegistry.createEntityDoc(id, scope)`** — create the entity's own document in the right scope, and record it as the identity's. **`storeRegistry.listEntityDocs(scope)`** / **`listMyEntityDocs(id, scope)`** enumerate documents in a scope, all or mine. **`resolveWriteGraph(id, scope)`**, **`resolveScopeGraph(scope)`**, **`resolveReadGraphs(scope)`**, **`resolveInboxAnchor()`** resolve the NURIs a call needs. **`ensureAccount(id)`**, **`resolveAccount(id)`**, **`allAccounts()`** yield `AccountRecord`s (`{ id, docPublic, docProtected, docPrivate }`). - -Festipod's own glue (`src/shared/utils/storeRegistry.ts`) adds only the **domain mapping** entity kind → scope; placement itself belongs to the SDK. - -May assume: the SDK owns NURI construction and placement. May not assume: that the app may build a NURI by hand, or read/write a scope's container document directly. - -## Inbox — delivery to an identity - -**`inbox.post(targetInbox, { payload, from?, ts? })`** deposits into a document's inbox. `from` omitted defaults to the current identity; **`from: null` is an explicit anonymous deposit**, and naming another identity is rejected as a spoof. **`inbox.read(targetInbox)`** returns every `Deposit` (`{ from, payload, ts }`) sorted by ascending `ts`. **`inbox.watch(targetInbox, onDeposits)`** fires once on the initial state and again on every change; it returns an unsubscribe. **`inbox.readSynced`** is the same read under a stronger contract: it returns once the deposits synced to that inbox are visible, where `read` returns what is known locally right now. **Choose by need, not by habit**: `read` inside a session already watching the inbox, `readSynced` whenever correctness depends on a cold session seeing another identity's deposit. `inbox.materialize` is an alias of `read`. - -May assume: - -- **Any identity — even anonymous — can deposit** into an inbox it knows. That is the only way data reaches an identity that cannot write your documents. See [[rule_nextgraph-inbox]]. -- `watch` is **push, never polling**; its `intervalMs` option exists for signature compatibility and is ignored. -- `payload` is **opaque to the SDK** — Festipod defines its own kinds (`src/shared/data/registration.ts`). - -May not assume: exactly-once delivery semantics, or that a deposit is removed once read. - -## Discovery — the global index - -**`discovery.submitToIndex(ref, opts?)`** makes a reference discoverable; `SubmitOptions.from` follows the same identified/anonymous rule as `inbox.post`, and `SubmitOptions.doc` names the document being announced. **`discovery.readIndex()`** returns `IndexEntry[]` (`{ ref, from, ts }`, deduplicated). **`discovery.watchIndex(onEntries)`** is the push-based observer. - -May assume: the index admits a document only if it was **published** as a repo link — announcing something past the reach you chose for it is refused. May not assume: that `ref` means anything to the SDK (it is app-defined), or that being indexed grants any read. - -## Capabilities — reading is key possession - -The model has **no authorization list**. You hold a document's `ReadCap` (a NURI carrying a `:k:` segment) and you read it, or you do not. A bare `Nuri` **names** a document without granting anything. - -- **`capFor(nuri): ReadCap | undefined`** (`/polyfill`, also `getCaps().capFor`) — do I hold this document's key? Nothing derives a key from a bare reference; it is either in your keyring because you created the document, or it was delivered to you. -- **`inbox.shareCap(cap, toInbox)`** — the act of sharing: **one document, to one recipient inbox**. Several recipients means several calls. Recipients are addressed as **inboxes**, never as principals. -- Receiving a capability needs **no dedicated call**: it arrives as an inbox deposit, is applied inline by `inbox.read`/`watch`, and the resulting keyring change **re-triggers the reads that were empty for want of it** — a `watchShape` view fills in on its own. -- **`getCaps().publishRepoLink(nuri)`** (`/polyfill`) — publish a document as a shareable link; that link, not the bare NURI, is what goes into anything discoverable. **`getCaps().open(nuri, scope)`** records a document as mine in a scope (publishing it when `public`). -- **Public is readable by whoever has the link, and NOT recursive**: a public document may *reference* a private one without disclosing it. Festipod relies on exactly that. -- Key rotation **redelivers** through the same inbox channel; access is deferred to the next connection, never lost. The app implements nothing to "keep" an access. - -May not assume: that a store-level key grants its documents (it does not — isolation is per document); that `Nuri`/`ReadCap` are compile-time-branded (they are plain strings, checked at runtime); that revocation is retroactive. - -## Identity and lifecycle - -**`accounts.IdentityStore`** / **`accounts.browserIdentityStore(key?)`** persist the current identity id over an injected `AccountStorage`; it is an opaque id, with no notion of password or login step. `/polyfill` adds **`setCurrentUser(id)`**, **`getCurrentUser()`**, **`resetCaps()`**, **`configure(...)`** and **`configureStoreRegistry(...)`** — the bootstrap. **`init` / `initNg`** are the lifecycle entry points, and **`ng`** is the raw SDK object, both re-exported from the SDK entry. - -May assume: switching identity **switches** keyrings, it does not wipe them — a delivered capability is durable across sessions. - -## SPARQL safety - -**`escapeLiteral(value)`**, **`escapeIri(value)`**, **`assertNuri(nuri)`** — the app reuses the SDK's own escaping whenever it builds SPARQL by interpolation. Any untrusted value crossing into a query goes through one of them; never hand-roll quoting. - -## Types re-exported for the app - -`Nuri`, `ReadCap`, `Scope`, `PrincipalId`, `UnionSubject`, `ShapeQuery`, `ShapeObservable`, `IndexEntry`, `SubmitOptions`, `Deposit`, `PostOptions`, `AccountRecord`, `RegistrySession`, `AccountStorage`, `DocChange`, `Unsubscribe` — plus `ShapeType`, `BaseType`, `Schema`, `DeepSignalSet` and `NG`, so the app never imports from `@ng-org/*` directly. - -## Exported, but not for the app - -`readModel.readUnion`, `subscribeDoc` / `subscribeDocs` / `docChangeType`, and `docs.sparqlQuery` used as a listing primitive are **lower-level** surfaces. Festipod reads through `watchShape` and does **not** assemble its own reactivity on top of them ([[rule_app-uses-sdk-surface-only]]). In demo mode none of this is reached at all ([[knowledge_data-modes]]). diff --git a/.project/concepts/data-layer/rule_app-uses-sdk-surface-only.md b/.project/concepts/data-layer/rule_app-uses-sdk-surface-only.md index 48b6b01..af337dc 100644 --- a/.project/concepts/data-layer/rule_app-uses-sdk-surface-only.md +++ b/.project/concepts/data-layer/rule_app-uses-sdk-surface-only.md @@ -1,35 +1,25 @@ --- type: rule -summary: The app IGNORES NextGraph's implementation state entirely and is coded against the SDK as it SHOULD BE — the contract written down in this repo ([[knowledge_sdk-surface]]). @ng-eventually/client is a POLYFILL whose mission is to COMPENSATE THE GAP between that target SDK and what NextGraph provides today (the virtual wallet being the largest piece, not the whole mission). When something breaks, the question is never "how do we work around it in the app" but "what must the polyfill compensate". +summary: The app codes against the engagement the provider publishes — [[contract_polyfill-surface]], pulled into this repo and version-pinned — and that copy is the ONLY reference. Never open the provider's sources or its node_modules copy; never describe or reason about how the data layer is implemented; what the contract does not answer is a GAP, raised with the provider and never worked around here. --- -# The app uses the SDK surface only — never the polyfill's internals +# The app uses the published surface only ## The rule -The Festipod app treats `@ng-eventually/client` as a **finished, flawless NextGraph SDK**. Concretely: +Festipod is a consumer of **one published contract** and is entirely ignorant of how it is honoured. -1. **Reactive reads = `useShape`** (the SDK-shaped surface provided by the polyfill, **scoped to the virtual wallet**). The app does NOT read through the polyfill's internals (`readModel.readUnion`, `subscribeDoc`, a home-made read model…), and does NOT mount its own reactivity (a re-run on a signal). -2. **The app NEVER reasons about NextGraph's current state**: no code and no comment of the kind "we do X because the ORM fan-out hangs / because a cold read returns 0". From the app's point of view, those problems do not exist. +1. **The pulled contract is the only reference.** [[contract_polyfill-surface]] is the provider's engagement, version-pinned in this repo. An agent working here reads that file and **never opens the provider's repo or its `node_modules` copy** — not to check a signature, not to settle a doubt. +2. **What the contract does not answer is a gap.** Raise it with the provider and leave the app's call site as it is. An app-side workaround is a doctrine violation *even when it works*, because it hard-codes a passing state into code meant to outlive it. +3. **No description of how the data layer works underneath**, in code, in comments or in this repo's doctrine. Nothing of the form "we do X because a read behaves like Y". From the app's point of view there is only the contract and what it promises. +4. **No shortcut, in the app or in its tests.** Deep imports into the package are refused by its `exports` map, and that refusal is correct — see [[rule_tests-validate-festipod-not-the-sdk]]. -## The contract is the SDK as it SHOULD BE — written down here, in this repo +## The surface shrinks, and that is normal -The app is coded against the SDK **as it should be**, and that contract lives in Festipod's own doctrine: [[knowledge_sdk-surface]]. That is what an agent reads to know what it may rely on. It never needs to open the polyfill's repo, and it never needs to know what NextGraph does or does not implement today. +The contract's own change policy states that this surface **changes, and shrinks**, and that it must be re-pulled at every upgrade. A removal is therefore never a regression to absorb defensively — it is work the app deletes. -**Ignore NextGraph's implementation state — entirely.** Not "mostly", not "except when it bites". The app's code and comments must contain **nothing** of the form "we do X because NextGraph does Y today". From the app's point of view, that state does not exist. +## What the app reads through -## The polyfill's mission: COMPENSATE THE GAP +Reactive reads go through `useShapeQuery` (a `useSyncExternalStore` binding over `watchShape`) plus the Fp adapters in `src/shared/data/`. The app mounts no reactivity of its own and keeps no bespoke read model. -`@ng-eventually/client` is a **polyfill**, and its mission is exactly that of any polyfill: **close the gap between the target SDK and what the underlying platform currently provides**. - -The **virtual wallet** (several identities on one physical wallet) is the largest piece of that gap, and historically the reason the polyfill was created — but it is **one piece, not the whole mission**. Emulating capabilities, the union read-model, `open-repo`, readiness mirroring, reconnection: all of it is gap-compensation, all of it is legitimately the polyfill's job, and **none of it surfaces in the app**. - -**The operative consequence.** When something does not work, the question is never *"how do we work around NextGraph in the app?"* — it is *"what does the polyfill have to compensate?"*. An app-side workaround is a doctrine violation even when it works, because it hard-codes a temporary state of NextGraph into code that must outlive it. - -## Status (deviation resolved) - -**Resolved**: `FestipodDataContext` now reads through `useShapeQuery` (a `useSyncExternalStore` binding over the polyfill's `watchShape`) + Fp adapters (`src/shared/data/shapeAdapters.ts`). **Removed**: `readEntities.ts`, the bespoke reactivity (`subscribeDocs`+`bumpRead`+`readTick`), the manual listing (`publicDocs`/`protectedDocs`/`registerDoc` for reads), and the comments reasoning about the ORM hang. The auto-seed is gated on `isSuccess` (no more 3s timer). The app consumes nothing but the SDK surface. - -**Target (design reminder)**: the polyfill exposes a `useShape` that is **reactive and scoped to the virtual wallet**, whose **shape follows TanStack `useQuery`** — `{ data, isPending/isLoading, isSuccess, isError, … }` — **in anticipation of the PLANNED update of `useShape` by NextGraph** (which is going to adopt that behaviour). So this is not an invention: it is a future NextGraph API, emulated ahead of time, that will align once NextGraph ships it. It **natively distinguishes** `isPending` (sync in progress) from `isSuccess` + empty `data` (synchronized, genuinely empty) — exactly what is needed. Internally, the hook encapsulates readUnion over `subscribeDoc` plus the identity scoping (invisible to the app). The app **removes** its bespoke machinery (`readEntities`/`subscribeDocs`/`bumpRead`) and reads through that hook. - -The auto-seed bug (the 3s timer) is a **symptom**: with `isSuccess`, the auto-seed decides "empty" only once the sync is confirmed, instead of guessing a delay. See [[rule_no-broker-polling]] and [[knowledge_nextgraph-stack]]. +What the app **does** rely on is the distinction the observable carries: `isPending` (sync in progress) is not the same as `isSuccess` with empty `data` (synced and genuinely empty). Code that needs "is it really empty?" — the auto-seed gate, the `ready` flag — uses that distinction and nothing finer. diff --git a/.project/concepts/data-layer/rule_capture-nextgraph-findings.md b/.project/concepts/data-layer/rule_capture-nextgraph-findings.md deleted file mode 100644 index aa36f85..0000000 --- a/.project/concepts/data-layer/rule_capture-nextgraph-findings.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -type: rule -summary: Any important knowledge established about how NextGraph ACTUALLY works (a core/broker/verifier mechanism, a primitive's semantics, a shape property) → record it AT THE MOMENT of discovery in the polyfill's reference docs `../../nextgraph/ng-eventually-js/docs/`, never in the Festipod repo; distinguish VERIFIED from INFERRED, and never deduce the TARGET shape from the source's CURRENT state ---- - -# Rule: record NextGraph knowledge the moment you establish it - -When an investigation establishes an **important fact about how NextGraph actually works** — a primitive's mechanism, a structure's semantics, a shape property ("the overlay is *store*-scoped, never document-scoped"), an access guard, what an operation does or does not require — **write it down straight away** in the polyfill's reference documentation: - -`../../nextgraph/ng-eventually-js/docs/` (from this repo's root) — typically the reference note for the subject (caps/NURI model, current state, SDK reference). - -**Never in the Festipod repo.** `AGENTS.md` forbids it explicitly: Festipod doctrine describes *how Festipod uses the SDK*, not the state of NextGraph. See [[rule_app-uses-sdk-surface-only]]. - -## At the moment of discovery — not at the end - -"I will write it up at the end of the session" does not work: the context is compacted before that, and the fact is lost. This knowledge is **very expensive** to establish (several agent investigations through the Rust source, often contradicting each other before they converge) and **impossible to verify from memory** — a second session will pay full price again for the same answer, or worse, will settle for a wrong intuition. - -## The central pitfall: current state ≠ target shape - -**Never read `nextgraph-rs`'s current state to DEDUCE the target shape from it.** The source contains **unfinished scaffolding** that looks like model: you can find membership and permission types in it that are **inert at runtime** (never called outside unit tests, structures built empty). Deducing a "membership" primitive from that and shaping it into the polyfill means carving in a shape that will never exist — exactly the failure mode the polyfill exists to prevent. - -The source is there to **verify an existing mechanism**, never to **infer an intention**. Intentions are to be asked of NextGraph's designer. - -## Shape of the note - -- **Distinguish VERIFIED** (a path read end to end, or better: observed at runtime) from **INFERRED** (deduced, not traced). A load-bearing fact left unmarked silently turns into a certainty. -- **Point at symbols**, not line numbers (which are volatile) — and date the note. -- Write down the fact's **consequence** too, not just the fact: that is what will be re-read. -- A fact that **contradicts** an existing note → fix the note, do not pile on. - -## Sibling rule - -This one covers **knowledge** — what *is*; [[rule_nextgraph-inbox]] covers what must be **reported upstream or waited for** — the malfunctions and the gaps (→ `../../nextgraph/orm-tests/INBOX/`). One and the same investigation often produces both: file each half in its own place. See [[knowledge_nextgraph-stack]]. diff --git a/.project/concepts/data-layer/rule_document-per-entity.md b/.project/concepts/data-layer/rule_document-per-entity.md index e786784..b737a78 100644 --- a/.project/concepts/data-layer/rule_document-per-entity.md +++ b/.project/concepts/data-layer/rule_document-per-entity.md @@ -1,48 +1,49 @@ --- type: rule -summary: Festipod persists EVERY entity as ITS OWN document (through the SDK), placed in its scope (public/protected/private) — never several entities written into a store-level document. The document is the unit of sharing and of rights: the SDK's isolation is PER-DOCUMENT, so one document per entity is what makes it possible. +summary: Festipod persists EVERY entity as ITS OWN document (through the SDK), placed in its scope — never several entities in a store-level document. The document is the unit of sharing and of rights: access is granted PER DOCUMENT, so one document per entity is what makes it possible. --- # Rule: one document per entity (never at store level) -When Festipod creates an entity (event, meeting point, profile, participation, notification), it writes it as **its own document**, through the data SDK's "create a document" call ([[knowledge_nextgraph-stack]]), stating its **scope** (`public` / `protected` / `private`). The entity is then read from and written to **that** document. +When Festipod creates an entity (event, meeting point, profile, participation, notification), it writes it as **its own document**, through the surface's "create a document" call ([[knowledge_nextgraph-stack]]), stating its **scope** (`public` / `protected` / `private`). The entity is then read from and written to **that** document. **Never** write several entities into a shared "store-level" document (e.g. putting everything into a single root document). That is an anti-pattern that breaks isolation. ## Why -The **document is the SDK's unit of sharing and of rights**: isolation (who can read what) is enforced **per document**. `private` → the owner; `protected` → the owner + their connections; `public` → everyone. That discrimination is possible **only if each entity has its own document**: putting several entities (or worse, several owners) into a single document makes sharing all-or-nothing and defeats scope-based isolation. +The **document is the unit of sharing and of rights**: the contract states that **access is granted per document**. `private` → the owner; `protected` → the owner + their connections; `public` → everyone. That discrimination is possible **only if each entity has its own document**: putting several entities (or worse, several owners) into a single document makes sharing all-or-nothing and defeats scope-based isolation. -Isolation itself is **entirely handled by the SDK** ([[knowledge_trust-model]] in the `app-security` concept) — the app carries no access logic; it only declares its identity (at login) and its connections (an act of sharing), then trusts whatever the SDK returns. The "one document per entity" granularity is the write-side counterpart of that trust. +Isolation itself is **entirely the surface's business** ([[knowledge_trust-model]] in the `app-security` concept) — the app carries no access logic; it declares **no identity at all**, only which of its own documents it shares with whom, then trusts whatever it gets back. The "one document per entity" granularity is the write-side counterpart of that trust. ## How to apply it -- At creation time: ask the SDK for **a document for the entity, in its scope** (`createEntityDoc(scope)`); write the entity into it. Do not reuse a document from another scope, nor a store-level document. -- For reads: go through the SDK's **reactive shape surface** (see below) — the app names a SHEX shape and a **logical scope**, and the SDK resolves that scope to the documents to read (the discovery index for public events; its own scope documents for its own entities), opens/synchronizes them and pushes changes. No NURI resolution, no document listing and no query written on the app side. +- At creation time: ask the SDK for **a document for the entity, in its scope** — `createEntityDoc(scope)`. Placement is named by **scope alone** — the session belongs to one user, so there is no identity to pass, and a creation that cannot be recorded **throws** rather than handing back a reference that would read empty forever. Write the entity into it. Do not reuse a document from another scope, nor a store-level document. +- **A document only HAS an inbox if its owner opened one** (`openDocumentInbox(doc)`). Festipod opens one on the documents meant to **receive** deposits — its **events** — not on every entity. A deposit then **names the document**: `inbox.postToDocument(doc, …)`, never an address the app resolved itself. +- For reads: go through the **reactive shape surface** (see below) — the app names a SHEX shape and a **logical scope**, and the surface resolves that scope to the documents to read, synchronizes them and pushes changes. No NURI resolution, no document listing and no query written on the app side. - The *entity → scope* mapping (event/meeting point → public, network profile/participation → protected, settings → private) is a product fact (concept `functional-domain`, [[knowledge_data-scopes-and-discovery]]). ## Reads: the SDK's reactive shape surface (`watchShape` / `useShapeQuery`) **Reads go through the SDK surface only** ([[rule_app-uses-sdk-surface-only]]). The app names a shape and a scope, and gets a live, `useQuery`-shaped result back: -1. `watchShape(shapeType, scope)` (SDK) returns an **observable** — `{ data, isPending, isSuccess, isError }` — which resolves the scope against the current identity's wallet (its own scope documents, plus the discovery index for `public`), waits for the sync barrier, and **pushes** on every change. `data` is always an array; a synced-but-empty scope reads `{ data: [], isPending: false, isSuccess: true }`, which is what distinguishes "still syncing" from "genuinely empty". +1. `watchShape(shapeType, scope)` returns an **observable** — `{ data, isPending, isSuccess, isError }` — which resolves the scope itself and **pushes** on every change. `data` is always an array; a synced-but-empty scope reads `{ data: [], isPending: false, isSuccess: true }`, which is what distinguishes "still syncing" from "genuinely empty". 2. `useShapeQuery(shapeType, scope)` (`src/shared/data/useShapeQuery.ts`) is the app's **only** React binding over it (`useSyncExternalStore`), memoized per (shape, scope) so the underlying document subscriptions are not churned on every render. -3. `FestipodDataContext` mounts exactly three of them — events (`public`), profiles (`protected`), participations (`protected`) — and maps the SDK's `UnionSubject` property bags onto the app's `Fp*` domain types through `src/shared/data/shapeAdapters.ts`. +3. `FestipodDataContext` mounts exactly three of them — events (`public`), profiles (`protected`), participations (`protected`) — and maps the returned `UnionSubject` property bags onto the app's `Fp*` domain types through `src/shared/data/shapeAdapters.ts`. -**The app resolves, lists, registers and re-queries nothing.** There is no app-side document set, no manual re-read signal and no per-document subscription: reactivity is the SDK's own push. The single app-side layer laid over the read is a **pure optimistic overlay** (`pendingAdd*` / `pendingRemoveIds` in `FestipodDataContext`), auto-reconciled the moment the reactive set catches up — it hides the broker's push latency, it is not a read path. +**The app resolves, lists, registers and re-queries nothing.** There is no app-side document set, no manual re-read signal and no per-document subscription: reactivity is the surface's own push. The single app-side layer laid over the read is a **pure optimistic overlay** (`pendingAdd*` / `pendingRemoveIds` in `FestipodDataContext`), auto-reconciled the moment the reactive set catches up — it hides push latency, it is not a read path. > **Removed (verified 2026-07-28).** An earlier version of this rule described reads as a bespoke union model: an on-demand document set (`publicDocs`/`protectedDocs` fed by `listMyEntityDocs` + `registerDoc`), a one-shot `readEntities` → `readModel.readUnion`, and a manual re-query signal (`bumpRead`/`readTick`). **None of those read symbols exist in `src/` any more** — `src/shared/data/readEntities.ts` is gone, and the surviving mentions are historical code comments. Do not code against them ([[rule_app-uses-sdk-surface-only]]). ## Direct writes (the round-trip pitfall) -**Writing** an entity happens **directly into its own document** (through the SDK's SPARQL call — `src/shared/data/entityWrites.ts`, `writeEntity`), **not** by adding to a reactive set. Reason: a reactive set is only *writable* if the target document is **already** within its subscription scope; but registering the freshly created document is React state that only takes effect on the **next** render → you cannot create-then-add in a single synchronous pass (seed loop, first creation). Against the real broker, an `add` on an empty scope raises "Set is readonly because scope is empty" (the fake-ng unit tests do not catch it). +**Writing** an entity happens **directly into its own document** (through the surface's SPARQL call — `src/shared/data/entityWrites.ts`, `writeEntity`), **not** by adding to a reactive set. Reason: a reactive set is only *writable* if the target document is **already** within its subscription scope; but registering the freshly created document is React state that only takes effect on the **next** render → you cannot create-then-add in a single synchronous pass (seed loop, first creation). The observable symptom when you try: an `add` on an empty scope raises "Set is readonly because scope is empty". So: **write = direct SPARQL into the entity's document** (immediate, per-document); **read = the SDK's reactive shape surface** (above). -**Graph convention (write into the anchored default graph).** A write passes the document's NURI as the **anchor** of `docs.sparqlUpdate` and writes the SPARQL body **without** an explicit `GRAPH <…>` clause; the SDK's shape read queries that same anchored default graph. This is the **canonical, always-safe** form — to be kept for `writeEntity`, `updateEntityField` and `registration.ts`. - -> **Correction (2026-07-06).** An earlier comment (and an earlier version of this paragraph) claimed that an explicit `GRAPH ` body writes into a *distinct named graph* that an anchored read would not see → the entity would "disappear". **That is false on the current broker** (`@ng-org/web 0.1.2-alpha.13`): the lib's real e2e harness (`packages/client/e2e/`) verifies that an `INSERT DATA { GRAPH {…} }` **anchored** to the doc round-trips (read back both from the default graph and from `GRAPH `). The "0 entities" symptom we had attributed to that "pitfall" in fact came from the **bloated-wallet hang** (see `bdd-testing/caveat_wallet-bloat-hang`), not from a graph mismatch. So the "no `GRAPH` wrapper" rule remains a choice of **simplicity/safety**, not a round-trip necessity. (The *why* on the SDK side lives in `@ng-eventually/client`, not here.) +**Graph convention (write into the anchored default graph).** A write passes the document's NURI as the **anchor** of `docs.sparqlUpdate` and writes the SPARQL body **without** an explicit `GRAPH <…>` clause; the shape read queries that same anchored default graph. This is the **canonical** form — to be kept for `writeEntity`, `updateEntityField` and `registration.ts`. It is a choice of **simplicity and uniformity**, not a round-trip necessity: an explicit `GRAPH` wrapper anchored to the same document does round-trip, so a "0 entities" symptom is never evidence of a graph mismatch — look at the test wallet first (`bdd-testing/caveat_wallet-bloat-hang`). The same goes for **mutating an existing field** (e.g. `participantCount`): mutating a value in memory does not hold — the reactive read re-reads the **persisted** value from the broker (reverting to the old value) → persist through SPARQL (`updateEntityField`: DELETE then INSERT of the triple) so that the change sticks and the re-read agrees. Each field is written with the **right RDF term** according to the SHEX shape (xsd:integer / float / boolean, or an IRI for the `Participation.event`/`.user` references) — a missing or mistyped mandatory field makes the read **discard the entity** (it never round-trips). The entity's **subject** = its document's **NURI** (one entity = one document), which yields an `@id` of the form `did:ng:…`. -Identity corollary: a `Participation` carries a **mandatory** `fp:user` — never write it with an empty principal (the entity would be discarded on read). The current user's principal is **stable and derived from the username** (`urn:festipod:user:`), available **immediately** after login (no dependency on reading the protected profile, which may lag) and **invariant** (it does not flip from a fallback to the profile IRI mid-session, which would desynchronize a participation written under one value from a check made under the other). It is the same principal that the SDK identity (`setCurrentUser`) and the owner cap derive from the username; bilateral connections (`declareConnections`) are declared with those same username keys (not profile IRIs) so that "protected = my connections" discriminates. +Identity corollary: a `Participation` carries a **mandatory** `fp:user` — never write it with an empty value (the entity would be discarded on read). What goes in it is `currentUserId`, i.e. the **NURI of the profile document the app read back in its own protected scope**; the app derives it from nothing, because it names no identity ([[decision_2026-08-10_the-barrier-names-no-identity]] in `app-security`). It therefore **arrives late**: a mutation fired before the protected read lands must refuse rather than write, which is what `joinEvent` does. See [[knowledge_context-internals]]. + +Sharing keys off a different space: `inbox.share(doc, toUser)` names a **person**, so bilateral connections (`declareConnections`) are declared with **normalized profile handles**, not document NURIs — the data context maps each peer IRI to that key before declaring, and skips peers whose profile it cannot read (they cannot be named). diff --git a/.project/concepts/data-layer/rule_nextgraph-inbox.md b/.project/concepts/data-layer/rule_nextgraph-inbox.md deleted file mode 100644 index 4518f37..0000000 --- a/.project/concepts/data-layer/rule_nextgraph-inbox.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -type: rule -summary: The shared NextGraph inbox `../../nextgraph/orm-tests/INBOX/` takes TWO families of notes — malfunctions (a primitive misbehaves) AND gaps (a primitive we need, not yet implemented, which we emulate in the polyfill in the meantime). It doubles as a tracker of NextGraph's progress: when a gap is filled upstream, its note says what to REMOVE from the polyfill. ---- - -# Rule: the NextGraph inbox takes malfunctions AND gaps - -The shared NextGraph inbox is `../../nextgraph/orm-tests/INBOX/` (from this repo's root) — in the sibling repo `nextgraph/orm-tests`, which hosts the ORM integration tests against a real broker (`tests/standalone/` for repros). - -It is **not** just a bug tracker. It has **two inputs** and **one feedback loop**. - -## Input 1 — malfunctions - -A NextGraph primitive exists but **misbehaves**: a socket that dies (`SerializationError`), no automatic reconnection, a `doc_subscribe` that does not deliver or delivers late, a slow repo cold-open, a write that is not durable broker-side, a reachable panic. - -## Input 2 — the gaps we need - -A primitive **is not implemented yet** (or is only inert scaffolding) while our model depends on it. File it too, with the three pieces of information that make it valuable: - -- **what we need** and why — the model that depends on it; -- **what the polyfill does in the meantime** — the emulation that fills the hole; -- **what will have to be removed** from the polyfill the day it lands upstream. - -It is that third point that turns the note into a **cleanup ticket**. Without it, the emulation outlives its reason for existing and the polyfill starts drifting away from the target — exactly what it exists to prevent. - -## What does NOT qualify - -An **app** bug (a badly wired React effect, an effect's gating) or a **polyfill wiring** issue (wrong NURI, subscription not re-armed). Those are fixed **on our side**. The distinction is crucial: first prove that the primitive is at fault — ideally with a test — not our integration. See [[rule_app-uses-sdk-surface-only]]. - -## The loop: the inbox tracks NextGraph's progress - -The notes do not only travel upstream, they are also **re-read**: taken together, they say where NextGraph stands relative to what Festipod needs. When a note is resolved upstream, the polyfill update follows — often by **removing** emulation that has become useless, not by adding code. - -## Note format - -Name: `YYYY-MM-DD-.md`. Contents: nature (**malfunction** or **gap**), symptom or need, **verbatim evidence** (logs, measurements, source pointers marked "to re-verify"), a repro when it is a malfunction (ideally a standalone in `orm-tests/tests/standalone/`), expected vs observed, and — for a gap — the **polyfill workaround** and **what will have to be removed**. Severity + status. - -The inbox receives the **report that is actionable for the NextGraph maintainers**; a longer post-mortem can live on the polyfill side. - -## Sibling rule - -This one covers what must be **reported upstream or waited for**; [[rule_capture-nextgraph-findings]] covers established **knowledge** about how things actually work (→ the polyfill's reference docs). One and the same investigation often produces both: file each half in its own place. See [[knowledge_nextgraph-stack]]. diff --git a/.project/concepts/functional-domain/knowledge_data-scopes-and-discovery.md b/.project/concepts/functional-domain/knowledge_data-scopes-and-discovery.md index 6db3ef4..661f287 100644 --- a/.project/concepts/functional-domain/knowledge_data-scopes-and-discovery.md +++ b/.project/concepts/functional-domain/knowledge_data-scopes-and-discovery.md @@ -1,11 +1,11 @@ --- type: knowledge -summary: The product model of confidentiality and discovery — every entity lives in a SCOPE (public / protected / private) depending on who must see it; events & meeting points = public, network profile & participations = protected (network), settings = private; bilateral connections = the dialog scope; discovery reads a global event index +summary: The product model of confidentiality and discovery — every entity lives in a SCOPE (public / protected / private) depending on who must see it; events & meeting points = public, network profile & participations = protected (network), settings = private; bilateral connections = the dialog scope; discovery = reading the public scope --- # Data scopes and discovery -The **product** model of who sees what, and of how events are found. This is **domain**: the technical *how* (documents, capabilities, index) is handled by the `@ng-eventually/client` data SDK — the app only states **the business intent**. +The **product** model of who sees what, and of how events are found. This is **domain**: the technical *how* is the `@ng-eventually/polyfill` data SDK's business — the app only states **the business intent**. ## Three scopes per piece of data @@ -27,13 +27,13 @@ Guiding principle: **the "public" side (meeting point, event) and the "personal" - **The host is the sole holder of write rights** on their meeting point; the declarer has no particular right over the meeting points grafted onto their event. - **Bilateral connection**: `DemandeDeConnexion` (unilateral, transient) → `Connexion` (bilateral, persistent) — the latter opens access to the other person's *protected* data. -Festipod **places each entity in the store of its scope**; isolation between scopes is **handled by the data SDK**, not by application code (see concept `app-security`). +Festipod **places each entity in its scope**; isolation between scopes is **handled by the data SDK**, not by application code (see concept `app-security`). ## Event discovery -A user discovers the events they did not create through a **global index**: the SDK reads that index, which yields the references (NURIs) of the event documents, then synchronizes and queries locally. **Primary** discovery goes through that index; a **secondary**, relational axis is layered on top (the connections' *protected* participations: "my friends are attending…"). +A user discovers the events they did not create simply by **reading the `public` scope**: the app names the shape and the scope, and gets back everyone's public events, not just its own. That is the **primary** discovery axis; a **secondary**, relational one is layered on top (the connections' *protected* participations: "my friends are attending…"). -> **Sign-up notification (product intent).** Signing up to a meeting point notifies its host: identified if the participant is one of the host's connections, **anonymous otherwise**. This "identified if known, anonymous otherwise" is a property of the data model — the app relies on it, the mechanism is provided by the SDK. +> **Sign-up notification (product intent).** Signing up to a meeting point notifies its host: identified if the participant is one of the host's connections, **unnamed otherwise**. This "identified if known, unnamed otherwise" falls out of scope placement — the host can read the sign-up, but not the *protected* profile it points at unless they are connected. The app states the intent; it implements no filter of its own. ## Open questions (business) diff --git a/.project/concepts/functional-domain/knowledge_roadmap.md b/.project/concepts/functional-domain/knowledge_roadmap.md index 8c5e585..c5def37 100644 --- a/.project/concepts/functional-domain/knowledge_roadmap.md +++ b/.project/concepts/functional-domain/knowledge_roadmap.md @@ -17,7 +17,9 @@ summary: What is implemented today (event + meeting point lifecycle, profiles, c > Signing up to / withdrawing from a meeting point is **genuinely wired** on the data side: `joinEvent` persists a Participation, notifies the meeting point's host and creates a Notification; `leaveEvent` deletes the Participation authoritatively (see concept `data-layer`, [[caveat_participation-deletion]] on the data-layer side). Public discovery — a user seeing another user's public event — works too. -> **Product reservation — persistence is not guaranteed end to end.** An event that was created can **disappear** after a period of inactivity followed by a reconnection under the same identity (same wallet). This is an **open defect**, not a property of the product model: impact and pointer on the `data-layer` side → [[caveat_write-durability-across-disconnect]]. Consequence for the domain: "my events / my sign-ups" behave as *implemented* but **not yet as durable** — do not build any product promise (reminders, history, commitment) on top of them while this caveat is open. The `src/modules/event/features/reconnexion-*.feature` scenarios of the `event` module are the non-regression guard for that promise (execution status: concept `bdd-testing`). +> **The reconnection promise is guarded, not assumed.** "I come back later and my events and sign-ups are still there" is a product promise like any other, and it is the one whose failure would be least visible — nothing on screen distinguishes "you have nothing" from "it did not come back". The `src/modules/event/features/reconnexion-*.feature` scenarios of the `event` module are its non-regression guard; keep them meaningful, and read [[caveat_reconnexion-froide-local-vs-broker]] (concept `bdd-testing`) before trusting one of them green, because the natural setup proves less than it looks. + +> **Product reservation — a user cannot be shown two identities on one device.** Signing in is one act with no choice attached: the user does not name, pick or switch an identity, and there is no in-app sign-out from one identity into another (concept `app-security`, [[decision_2026-08-10_the-barrier-names-no-identity]]). One session = one person, for the life of the page. Consequence for the domain: **do not design a flow that asks "who are you signing in as"**, nor an account-switcher, nor a demo that plays two people side by side on one device — none of them is expressible. Two people means two devices (or two browser contexts). The **isolation between two identities** is still a real requirement, but it is currently unproven at the `@data` layer for the same reason (concept `bdd-testing`). ## Identified evolutions (not implemented) diff --git a/.project/concepts/tech-stack/_debt.md b/.project/concepts/tech-stack/_debt.md deleted file mode 100644 index 3ed8dea..0000000 --- a/.project/concepts/tech-stack/_debt.md +++ /dev/null @@ -1,7 +0,0 @@ -# Doc-debt — tech-stack - -> Presence of a block = doc to update. Processed → delete the block; no blocks left → delete this file. -> One block = one "big change": `why` + `files` + `verify` (leaves to review). - -## Raw markers (consolidate into blocks, then delete) -- TOUCHED tsconfig.json @2026-08-03 (session 0b064e8b-1717-421f-a20e-a4318ad217b1) diff --git a/.project/concepts/tech-stack/caveat_firefox-lna-blocks-broker-iframe.md b/.project/concepts/tech-stack/caveat_firefox-lna-blocks-broker-iframe.md index cfbca51..5a18b14 100644 --- a/.project/concepts/tech-stack/caveat_firefox-lna-blocks-broker-iframe.md +++ b/.project/concepts/tech-stack/caveat_firefox-lna-blocks-broker-iframe.md @@ -1,7 +1,7 @@ --- type: caveat summary: Firefox 151+ blocks (Local Network Access) the hosted broker embedding the local dev app in its iframe → blank iframe, zero app logs, no error at all. This is NOT a code bug. Browser-side fix — about:config network.lna.enabled=false. -last_checked: 2026-07-13 +last_checked: 2026-08-10 --- # Firefox LNA blocks the broker's app iframe in local dev @@ -16,7 +16,7 @@ In local dev, the app runs INSIDE the hosted broker's iframe (`nextgraph.eu`/`ne `Local Network Access detected: ... accessing target "…festipod.localhost…" (127.0.0.1) … prompt action: auto_deny`. Two corollaries that mislead: -- **The top level loads just fine**: navigating directly to `https://festipod.localhost:1355` (the AccessGateScreen barrier) is NOT subject to LNA. Only **iframe embedding** by the broker is. So "the cert is already accepted / the app starts up" before the iframe does not mean the iframe will go through. +- **The top level loads just fine**: navigating directly to `https://festipod.localhost:1355` is NOT subject to LNA. Only **iframe embedding** by the broker is. So "the cert is already accepted / the app starts up" before the iframe does not mean the iframe will go through. - **HTTPS changes nothing**: LNA targets the **local destination address**, not the protocol. Switching to `portless proxy start --https` (app on `https://festipod.localhost`) does not unblock it. ## Fix (browser, not code) diff --git a/.project/concepts/tech-stack/knowledge_build-pipeline.md b/.project/concepts/tech-stack/knowledge_build-pipeline.md index 5ea4ee1..ce73178 100644 --- a/.project/concepts/tech-stack/knowledge_build-pipeline.md +++ b/.project/concepts/tech-stack/knowledge_build-pipeline.md @@ -1,13 +1,16 @@ --- type: knowledge summary: Dev runs on bun --hot, prod builds through build.ts (Bun bundler + Tailwind plugin) into dist/, path alias @/* → ./src/* +last_checked: 2026-08-10 --- # Build pipeline - **Dev**: `bun --hot src/index.ts` (through `bun run dev`) — HMR, port 3000. - **Prod**: `bun run build` → `build.ts` (Bun bundler + Tailwind plugin) → `dist/`. -- **Path alias**: `@/* → ./src/*` (declared in `tsconfig.json`). +- **Path alias**: `@/* → ./src/*` (declared in `tsconfig.json`, resolved relative to that file — `paths` has needed no `baseUrl` since TS 4.4). + +> ⚠️ **Never put `baseUrl` back in `tsconfig.json`.** TypeScript 6 reports it as an **error that aborts the whole compilation**, and the failure is silent where it hurts: `tsc --noEmit` then exits **0 having checked nothing**, so the typecheck gate goes green over any amount of broken code. A green typecheck is only meaningful if `tsc` actually ran — treat an instant, output-free `tsc` as a red flag, not a fast pass. The server serves `src/index.html`, which loads `src/app/frontend.tsx` (see `app-architecture` §app-shell). The bundler transpiles the TSX and bundles the CSS without any external tool — no Vite/webpack/esbuild (see [[rule_bun-first]]). @@ -18,7 +21,7 @@ The server serves `src/index.html`, which loads `src/app/frontend.tsx` (see `app ## Build-time globals vs runtime config (the shared wallet pitfall) -`build.ts` injects **compile-time globals** through `define` (e.g. `__FESTIPOD_SHARED_WALLET_PASSWORD__` from `FESTIPOD_SHARED_WALLET_PASSWORD`, `__FESTIPOD_ACCESS_GATE_DISABLED__`, and `__FESTIPOD_AUTO_SEED__` from `FESTIPOD_AUTO_SEED` — the dev auto-seed, OFF when absent). **Pitfall**: the `src/index.ts` server (used by `bun run dev` AND `bun run start`) bundles `index.html` through Bun's HTML import, which **applies no `define`** — neither `bun --define` nor `process.env` propagates there (verified). So an environment variable passed to `bun run dev` never reaches the frontend bundle along that path. +`build.ts` injects **compile-time globals** through `define`: `__FESTIPOD_SHARED_WALLET_PASSWORD__` from `FESTIPOD_SHARED_WALLET_PASSWORD`, and `__FESTIPOD_AUTO_SEED__` from `FESTIPOD_AUTO_SEED` — the dev auto-seed, OFF when absent. **Pitfall**: the `src/index.ts` server (used by `bun run dev` AND `bun run start`) bundles `index.html` through Bun's HTML import, which **applies no `define`** — neither `bun --define` nor `process.env` propagates there (verified). So an environment variable passed to `bun run dev` never reaches the frontend bundle along that path. For those paths served from `src/`, the configuration therefore goes through the **runtime**: `src/index.ts` exposes `/festipod-config.json` (read from the environment), and the `src/app/frontend.tsx` entry **fetches it first**, sets the global, **then imports the app dynamically** (`await import('./App')`) — so that `sharedWallet.ts` reads the value when it is evaluated. In a `build.ts` bundle the value is already inlined by `define`, so the fetch is skipped (`NODE_ENV === 'production'`). Practical consequence: to exercise the "shared wallet" flow in dev **end to end** (download plus a working import), pass the REAL password of the e2e wallet **and** the file — the password shown on screen must match the imported `.ngw`, otherwise the import fails (a dummy value such as `1` merely makes the screen appear): diff --git a/.project/concepts/tech-stack/knowledge_deployment.md b/.project/concepts/tech-stack/knowledge_deployment.md index 0b091e0..fad76aa 100644 --- a/.project/concepts/tech-stack/knowledge_deployment.md +++ b/.project/concepts/tech-stack/knowledge_deployment.md @@ -9,7 +9,7 @@ last_checked: 2026-07-14 ## Dockerfile A `Dockerfile` exists (multi-stage Bun Alpine). **Installation goes through pnpm, but runtime/build/test stay on bun** (see [[knowledge_stack-and-commands]]): -- `FROM oven/bun:1-alpine`, `install` stage: `apk add --no-cache git nodejs npm` then `npm install -g pnpm@10.26.0` (the bun image has neither Node nor pnpm; Alpine's `apk nodejs` does not ship corepack), `COPY package.json pnpm-lock.yaml`, then `pnpm install --frozen-lockfile`. `git` is required because `@ng-eventually/client` is a public **git+https** dependency (Gitea, no auth). `release` stage: copies `node_modules` plus the source. +- `FROM oven/bun:1-alpine`, `install` stage: `apk add --no-cache git nodejs npm` then `npm install -g pnpm@10.26.0` (the bun image has neither Node nor pnpm; Alpine's `apk nodejs` does not ship corepack), `COPY package.json pnpm-lock.yaml`, then `pnpm install --frozen-lockfile`. `git` is required because `@ng-eventually/polyfill` is a public **git+https** dependency (Gitea, no auth). `release` stage: copies `node_modules` plus the source. - `ENV NODE_ENV=production`, `USER bun`, `EXPOSE 3000/tcp`, `ENTRYPOINT ["bun","run","start"]`. **`bun` peer pitfall**: `bun-plugin-tailwind` declares `bun` as a peerDependency → pnpm materializes the npm `bun` package and **creates a `node_modules/.bin/bun` shim** that shadows the `bun` from the PATH under `bun run`/`pnpm run`. Its postinstall is ignored by default → broken shim → `bun run start` fails. Fixed by approving the build: `pnpm.onlyBuiltDependencies: ["bun"]` in `package.json` (the postinstall then downloads the real binary). Without that, the whole pnpm migration breaks startup. @@ -29,4 +29,4 @@ A `Dockerfile` exists (multi-stage Bun Alpine). **Installation goes through pnpm `bun run dev` = **`portless festipod bun --hot src/index.ts`** — it goes through the **`portless`** wrapper (an external port-management tool), not a bare `bun --hot`. HMR is active outside production. -**Reactive local link to the polyfill**: in production the `@ng-eventually/client` dependency comes from Gitea (git+https, pinned by `pnpm-lock.yaml`). To edit the polyfill locally and see the changes live, `pnpm run link:polyfill` (script `scripts/link-polyfill.ts`, strategy S2) replaces `node_modules/@ng-eventually/client` with a **real copy** of the local source (`…/ng-eventually-js/packages/client`) — **without** its own `node_modules/@ng-org` — and resyncs `src/` on every edit. That is what guarantees **a single `@ng-org/web` instance** (a single verifier): a symlink to the monorepo checkout would carry its own `@ng-org` → a 2nd instance → broken SDK. To go back to the committed state: `pnpm install`. +**Reactive local link to the SDK**: in production the `@ng-eventually/polyfill` dependency comes from Gitea (git+https, pinned by `pnpm-lock.yaml`). When the provider's package has to be exercised from a local checkout, `pnpm run link:polyfill` (script `scripts/link-polyfill.ts`) replaces `node_modules/@ng-eventually/polyfill` with a **real copy** of that checkout (location overridable with `NG_EVENTUALLY_LOCAL`) — **without** its own `node_modules/@ng-org` — and resyncs on every edit. Copying rather than symlinking is what keeps **a single `@ng-org/*` instance** installed: a symlink would drag in a second one and the SDK would stop working. To go back to the committed state: `pnpm install`. diff --git a/.project/concepts/tech-stack/knowledge_stack-and-commands.md b/.project/concepts/tech-stack/knowledge_stack-and-commands.md index c7e6218..b428dbb 100644 --- a/.project/concepts/tech-stack/knowledge_stack-and-commands.md +++ b/.project/concepts/tech-stack/knowledge_stack-and-commands.md @@ -1,6 +1,6 @@ --- type: knowledge -summary: Stack components (Bun runtime/build/test, install through pnpm, React, NextGraph, Storybook, Cucumber, Tailwind-inside-the-build) and the real list of package.json scripts, quirks included (cucumber through node+tsx, build:ng for the local fork, link:polyfill for the reactive local link) +summary: Stack components (Bun runtime/build/test, install through pnpm, React, NextGraph, Storybook, Cucumber, Tailwind-inside-the-build) and the real list of package.json scripts, quirks included (cucumber through node+tsx, link:polyfill for the reactive local link) --- # Stack & commands @@ -10,7 +10,7 @@ summary: Stack components (Bun runtime/build/test, install through pnpm, React, | Layer | Technology | |---|---| | Runtime / bundler / test | **Bun** (see [[rule_bun-first]]) | -| **Dependency installation** | **pnpm** (`pnpm install`, `pnpm-lock.yaml`) — **only** installation moves to pnpm; runtime/build/test stay on bun. Reason: `@ng-eventually/client` is resolved from Gitea over **git+https** (pnpm handles `git+…#main&path:/packages/client` cleanly, along with deduplication of the `@ng-org` peers). Do not switch installation back to bun/npm. | +| **Dependency installation** | **pnpm** (`pnpm install`, `pnpm-lock.yaml`) — **only** installation moves to pnpm; runtime/build/test stay on bun. Reason: `@ng-eventually/polyfill` is resolved from Gitea over **git+https** (pnpm handles `git+…#main&path:/packages/polyfill` cleanly, along with deduplication of the `@ng-org` peers). Do not switch installation back to bun/npm. | | UI | **React** (mobile-first, max width 768px — styling covered by concept `app-architecture`) | | Data | **NextGraph** P2P local-first (concept `data-layer`) | | CSS build | **Tailwind** (`tailwindcss` + `bun-plugin-tailwind`) — present in the build, but the screens style themselves with `app-*`/inline, no Tailwind utilities (see concept `app-architecture`) | @@ -33,7 +33,7 @@ summary: Stack components (Bun runtime/build/test, install through pnpm, React, | `steps:extract` | `bun scripts/extract-step-definitions.ts` | | `build:orm` | `rdf-orm build --input ./src/shared/shapes/shex --output ./src/shared/shapes/orm` | | `build:ng` | `bash scripts/build-ng-packages.sh` — (re)builds the NextGraph packages from a local source (optional tool) | -| `link:polyfill` | `bun scripts/link-polyfill.ts` — **reactive** local link to the `@ng-eventually/client` polyfill (strategy S2: copy-overlay + watcher), preserving the single `@ng-org` instance. Details in [[knowledge_deployment]]. | +| `link:polyfill` | `bun scripts/link-polyfill.ts` — **reactive** local link to `@ng-eventually/polyfill` (copy-overlay + watcher). Details in [[knowledge_deployment]]. | | `storybook` / `build-storybook` | Storybook dev (6006) / static build | ## Pitfalls diff --git a/.project/concepts/tech-stack/rule_bun-first.md b/.project/concepts/tech-stack/rule_bun-first.md index a4c428b..7e3a768 100644 --- a/.project/concepts/tech-stack/rule_bun-first.md +++ b/.project/concepts/tech-stack/rule_bun-first.md @@ -1,6 +1,6 @@ --- type: rule -summary: By default use Bun and its native APIs, never the Node equivalents — bun instead of node/ts-node, bun test/build, bunx, and no express/ws/pg/dotenv. EXCEPTION — package installation goes through pnpm (in both repos), not bun install +summary: By default use Bun and its native APIs, never the Node equivalents — bun instead of node/ts-node, bun test/build, bunx, and no express/ws/pg/dotenv. EXCEPTION — package installation goes through pnpm, not bun install --- # Rule: Bun-first @@ -28,9 +28,9 @@ API details: [[knowledge_bun-apis]]. ## Exception: package installation goes through pnpm -**Dependencies are installed with `pnpm install` — not `bun install` — in BOTH repos** (Festipod *and* the `@ng-eventually/client` polyfill). Everything else stays on Bun: **runtime, build, test, scripts** (`bun run dev`, `bun build`, `bun test`, `bunx`). Only the installation step changes package manager. +**Dependencies are installed with `pnpm install`, not `bun install`.** Everything else stays on Bun: **runtime, build, test, scripts** (`bun run dev`, `bun build`, `bun test`, `bunx`). Only the installation step changes package manager. -**Why.** In production the polyfill is installed from a Gitea repository as a **subdirectory** git dependency: `git+https://…/ng-eventually.git#main&path:/packages/client`. pnpm (≥ 10.26) resolves that `#&path:/…` format and guarantees a **single** instance of `@ng-org/*` (a single verifier); `bun install` does not handle this workflow cleanly. The reference lockfile is therefore `pnpm-lock.yaml`, and the reactive local link to the polyfill goes through `pnpm run link:polyfill` (see [[knowledge_deployment]]). +**Why.** The data SDK is installed from a Gitea repository as a **subdirectory** git dependency: `git+https://…/ng-eventually.git#main&path:/packages/polyfill`. pnpm (≥ 10.26) resolves that `#&path:/…` format and guarantees a **single** instance of `@ng-org/*`; `bun install` does not handle this workflow cleanly. The reference lockfile is therefore `pnpm-lock.yaml`, and the reactive local link goes through `pnpm run link:polyfill` (see [[knowledge_deployment]]). **Practical consequence.** npm scripts that relied on `node_modules/.bin/*` may break (pnpm puts shell shims there, not JS entries) — call the package's actual JS entry (e.g. `node_modules/@cucumber/cucumber/bin/cucumber.js`) rather than the `.bin/` shim. diff --git a/.project/contracts.yaml b/.project/contracts.yaml new file mode 100644 index 0000000..1c5e38d --- /dev/null +++ b/.project/contracts.yaml @@ -0,0 +1,22 @@ +# Inter-repo contracts. Festipod is a CONSUMER only: it publishes no interface of its own, +# and it consumes exactly one — the SDK surface `@ng-eventually/polyfill` engages toward the +# applications built on it. +# +# The pulled copy under `into:` IS the specification Festipod codes against. An agent +# working here reads that copy and never opens the provider's own source: a gap is raised +# upstream (see `data-layer/rule_app-uses-sdk-surface-only`), never peeked around. +# +# `pullFrom:` names the canonical identity of the provider (its git remote URL + the +# repo-relative path of the leaf), so the manifest travels with the branch. Per-developer +# access to a local checkout lives in `.project/contracts.local.yaml`, which is never +# committed. + +consume: + - contract: polyfill-surface + into: concepts/data-layer + type: git + pullFrom: https://gitea.reconnexion.apps.gueraud.net/Reconnexion/ng-eventually.git/.project/concepts/app-contract/contract_polyfill-surface.md + # The contract is published from the branch that carries it while that branch is still + # in flight; it moves to `main` once the provider lands it there. Flip this line then, + # and re-pull — the stamp records which commit the local copy actually came from. + ref: caps-p1a-and-virtual-user-boundary diff --git a/.project/to-discuss.md b/.project/to-discuss.md index bf3907f..34ea52f 100644 --- a/.project/to-discuss.md +++ b/.project/to-discuss.md @@ -1,4 +1,3 @@ # To discuss -- [ ] revoir l'implémentation des ReadCap et WriteCap, aligner avec NextGraph et vérifier que le polyfill enforce bien la logique de droits d'accès en attendant que cela soit implémenté -- [ ] clarifier la terminologie identité NextGraph (wallet = liste de clés ; user = données + username ; profils = identités contenues dans le user) et réconcilier avec decision_2026-07-06 (« identifiant = wallet »), decision_2026-07-20 (« username dans le profil ») et le modèle principal/identity du polyfill +- [ ] clarifier le vocabulaire d'identité employé par Festipod (wallet, utilisateur, profil, username) et réconcilier decision_2026-07-06 (« identifiant = wallet ») et decision_2026-07-20 (« username dans le profil ») avec ce que le contrat publie aujourd'hui : `ensureIdentity()` ne prend aucun identifiant, et `username` ne désigne plus que `UserProfile.username` diff --git a/AGENTS.md b/AGENTS.md index b398cee..c78ced8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -14,15 +14,15 @@ Web app mobile-first où les utilisateurs créent des **points de rencontre** qu - **Un module n'importe QUE depuis `shared/` — jamais d'un autre module.** C'est l'invariant qui rend l'archi réelle. - **Bun-first** : `bun` / `bun install` / `bun test` / `bun build`, jamais node/npm/vite/jest. `bun run dev` (port 3000). -## Frontière SDK NextGraph +## Frontière SDK -Le SDK de données de Festipod est **`@ng-eventually/client`** — traité comme un **SDK NextGraph fini et mature** (documents par entité placés par scope public/protected/private, capabilities, inboxes). Il est injecté une seule fois via `ngSession.configure(...)`. +Le SDK de données de Festipod est **`@ng-eventually/polyfill`**, injecté une seule fois via `ngSession.configure(...)`. -**`@ng-eventually/client` est un POLYFILL**, et ce mot dit toute sa mission : **compenser l'écart** entre le SDK **tel qu'il devrait être** et ce que NextGraph fournit **aujourd'hui**. Le wallet virtuel (plusieurs identités sur un wallet physique) en est la plus grosse pièce, pas la totalité. +**L'engagement que le fournisseur publie est tiré dans ce repo et épinglé** : `data-layer`, fiche `contract_polyfill-surface`. **C'est la seule référence.** On n'ouvre jamais les sources du fournisseur ni sa copie dans `node_modules`, pas même pour vérifier une signature. Ce que le contrat ne dit pas, ce repo ne le sait pas : **un manque est remonté au fournisseur**, jamais contourné ici ni documenté ici. Vaut aussi pour les tests, qui valident **Festipod** et jamais le SDK (`bdd-testing`, `rule_tests-validate-festipod-not-the-sdk`). -**L'app ignore ENTIÈREMENT l'état d'implémentation de NextGraph.** Elle est codée contre le SDK cible, dont le contrat est écrit **dans ce repo** (concept `data-layer`, fiche `knowledge_sdk-surface`). Aucun code ni commentaire du type « on fait X parce que NextGraph fait Y aujourd'hui ». Quand quelque chose ne marche pas, la question n'est jamais « comment contourner dans l'app » mais **« qu'est-ce que le polyfill doit compenser »**. +Le contrat se re-tire à chaque montée de version : `python3 ~/projects/skills/concept/contracts.py pull` (dérive : `… check`). Sa surface **rétrécit** — un symbole retiré est du code que l'app supprime, pas une régression à amortir. -**Ne jamais documenter dans ce repo l'état courant de NextGraph** (contraintes du SDK sous-jacent, contournements, internes broker/verifier) : cela vit dans le repo `@ng-eventually/client`. La doctrine Festipod décrit uniquement *le contrat SDK cible* + *comment Festipod l'utilise* + le domaine + l'architecture + le contrat BDD. +**Ne jamais décrire dans ce repo comment la couche de données est implémentée.** La doctrine Festipod décrit uniquement *le contrat* + *comment Festipod l'utilise* + le domaine + l'architecture + le contrat BDD. ## Doctrine du projet — concepts (livrée automatiquement) @@ -33,7 +33,7 @@ La connaissance détaillée vit dans `.project/concepts/` (système *concept*) : | `functional-domain` | Modèle produit : point de rencontre, acteurs, concepts métier, périmètres public/protected/private par entité, découverte, défi déduplication | | `app-architecture` | Modules, invariant d'imports, app shell, routing path-based, écrans | | `tech-stack` | Bun-first, APIs Bun, build pipeline, commandes | -| `data-layer` | Persistance via le SDK `@ng-eventually/client` : entités-documents par scope, shapes SHEX/ORM, modes connected/demo, pièges | +| `data-layer` | Persistance via le SDK `@ng-eventually/polyfill` : entités-documents par scope, shapes SHEX/ORM, modes connected/demo, pièges | | `bdd-testing` | Cucumber multi-couches FR, contrat `@ui`/`@data`/`@e2e`, harness broker, cookbook | | `app-security` | Isolation déléguée au SDK (pas de contrôle d'accès dans les écrans), auth wallet, matrice d'autorisations cible | diff --git a/build.ts b/build.ts index b43fa84..05045c6 100644 --- a/build.ts +++ b/build.ts @@ -133,12 +133,9 @@ const result = await Bun.build({ sourcemap: "linked", define: { "process.env.NODE_ENV": JSON.stringify("production"), - // Access gate (ON by default) + shared wallet password, baked into the - // browser bundle as globals (see src/app/AuthGate.tsx, sharedWallet.ts). The + // Shared wallet password, baked into the browser bundle as a global (see + // sharedWallet.ts) and handed to the SDK by the ONE `configure` call. The // wallet FILE is copied into the outdir below (served at /shared-wallet.ngw). - "globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__": JSON.stringify( - process.env.ACCESS_GATE_DISABLED === "1", - ), "globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__": JSON.stringify( process.env.FESTIPOD_SHARED_WALLET_PASSWORD ?? "", ), @@ -151,8 +148,9 @@ const result = await Bun.build({ ...cliConfig, }); -// Staging: copy the shared wallet FILE into the bundle so the access gate can -// offer it for download (served at /shared-wallet.ngw). See sharedWallet.ts. +// Staging: copy the shared wallet FILE into the bundle so it can be offered for +// download (served at /shared-wallet.ngw — the `fileUrl` the app hands the SDK +// through `configure`). See sharedWallet.ts. if (process.env.FESTIPOD_SHARED_WALLET_FILE) { const { copyFileSync } = await import("fs"); copyFileSync(process.env.FESTIPOD_SHARED_WALLET_FILE, path.join(outdir, "shared-wallet.ngw")); diff --git a/package.json b/package.json index 5316a82..f5d33ff 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "build-storybook": "storybook build" }, "dependencies": { - "@ng-eventually/client": "git+https://gitea.reconnexion.apps.gueraud.net/Reconnexion/ng-eventually.git#main&path:/packages/client", + "@ng-eventually/polyfill": "git+https://gitea.reconnexion.apps.gueraud.net/Reconnexion/ng-eventually.git#main&path:/packages/polyfill", "@ng-org/alien-deepsignals": "0.1.2-alpha.11", "@ng-org/orm": "0.1.2-alpha.18", "@ng-org/shex-orm": "0.1.2-alpha.8", diff --git a/scripts/link-polyfill.ts b/scripts/link-polyfill.ts index 922f818..faaa1ef 100644 --- a/scripts/link-polyfill.ts +++ b/scripts/link-polyfill.ts @@ -1,20 +1,20 @@ #!/usr/bin/env bun /** - * link-polyfill.ts — Reactive local link for the @ng-eventually/client polyfill (S2). + * link-polyfill.ts — Reactive local link for the @ng-eventually/polyfill polyfill. * - * WHY S2 (copy-overlay) and not a symlink (S1): - * The committed prod dependency installs @ng-eventually/client from Gitea (git+https) + * WHY a copy-overlay and not a symlink: + * The committed prod dependency installs @ng-eventually/polyfill from Gitea (git+https) * into pnpm's store WITHOUT its own node_modules/@ng-org → @ng-org/web resolves up to * Festipod → ONE @ng-org instance (one verifier). The local polyfill CHECKOUT, however, * carries its own node_modules/@ng-org/* (symlinks into the ng-eventually-js monorepo - * store). Symlinking node_modules/@ng-eventually/client to that checkout puts the + * store). Symlinking node_modules/@ng-eventually/polyfill to that checkout puts the * checkout's @ng-org in the resolution path → a SECOND @ng-org instance → broken SDK * (two verifiers). So we overlay a real directory that contains ONLY the polyfill's * source (no node_modules) and keep it in sync by copying — @ng-org still resolves to * Festipod, single instance preserved. * * WHAT IT DOES: - * 1. Replaces node_modules/@ng-eventually/client (the pnpm store symlink) with a real + * 1. Replaces node_modules/@ng-eventually/polyfill (the pnpm store symlink) with a real * directory holding the local polyfill's package.json + src (NO node_modules). * 2. Asserts the single-instance invariant (same @ng-org/web realpath from Festipod and * from the overlay) — aborts if it would break. @@ -24,12 +24,12 @@ * USAGE (reactive dev): * Terminal 1: pnpm run link:polyfill # overlays local source, then watches * Terminal 2: bun run dev # portless festipod bun --hot src/index.ts - * Edit files under packages/client/src → they land in node_modules → bun --hot reloads. + * Edit files under packages/polyfill/src → they land in node_modules → bun --hot reloads. * * pnpm run link:polyfill --once # overlay + verify, no watch (CI / one-shot) * Return to the committed git-installed dependency: pnpm install * - * Override the local checkout path with NG_EVENTUALLY_LOCAL=/path/to/packages/client. + * Override the local checkout path with NG_EVENTUALLY_LOCAL=/path/to/packages/polyfill. */ import { existsSync, lstatSync, mkdirSync, rmSync, cpSync, copyFileSync, realpathSync } from "node:fs"; import { watch } from "node:fs"; @@ -38,8 +38,8 @@ import { join, dirname } from "node:path"; const FESTIPOD = realpathSync(join(import.meta.dir, "..")); const LOCAL = process.env.NG_EVENTUALLY_LOCAL ?? - "/home/sylvain/projects/nextgraph/ng-eventually-js/packages/client"; -const TARGET = join(FESTIPOD, "node_modules", "@ng-eventually", "client"); + "/home/sylvain/projects/nextgraph/ng-eventually-js/packages/polyfill"; +const TARGET = join(FESTIPOD, "node_modules", "@ng-eventually", "polyfill"); const SRC_LOCAL = join(LOCAL, "src"); const SRC_TARGET = join(TARGET, "src"); const ONCE = process.argv.includes("--once"); diff --git a/src/app/App.tsx b/src/app/App.tsx index bd1ec53..a2c7b58 100644 --- a/src/app/App.tsx +++ b/src/app/App.tsx @@ -1,7 +1,6 @@ import { RouterProvider, useRouter } from './router'; import { ThemeProvider } from '../shared/context/ThemeContext'; import { NextGraphProvider } from '../shared/context/NextGraphContext'; -import { AccountProvider } from '../shared/context/AccountContext'; import { FestipodDataProvider } from '../shared/context/FestipodDataContext'; import { AuthGate } from './AuthGate'; import { ToastContainer } from '../shared/components/sketchy'; @@ -57,18 +56,16 @@ export function App() { return ( - - - -
- - - - -
- - - + + +
+ + + + +
+ + ); diff --git a/src/app/AuthGate.tsx b/src/app/AuthGate.tsx index 080612b..bbd5b75 100644 --- a/src/app/AuthGate.tsx +++ b/src/app/AuthGate.tsx @@ -1,89 +1,101 @@ /** - * AuthGate — the stopgap access flow (see decision_2026-06-15_shared-wallet-login-flow): - * 1. Access barrier + identifier (AccessGateScreen) → the user names their - * virtual space (an identifier) and opens the SHARED wallet via the broker - * redirect (with the wallet file + guide it hands the user). Naming the - * space and opening it are ONE act. - * 2. The app. + * AuthGate — the ONE await the application makes before it renders. * - * The gate is ON BY DEFAULT (Festipod never functions without NextGraph). It is - * disabled only when `globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__ === true` — - * injected by `build.ts` (from ACCESS_GATE_DISABLED=1) for a no-gate build, or - * by the test harness via `context.addInitScript` for @e2e (which exercises the - * screens, not the auth flow). Absent → gate ON. + * Signing in is `ensureIdentity()` and nothing else: it takes no identifier, + * resolves who we are and does the connection work (restoring what others shared + * with us, draining our inboxes). Whatever a user has to see or do while that + * resolves — opening the wallet, loading it onto a first-time device — belongs to + * the SDK: it mounts a full-screen barrier of its own on every top-level load and + * takes it down itself, and it owns the return from the broker round-trip (the + * barrier comes back prefilled, and confirming it hands the page over a second + * time; our page is never reloaded and nothing outside the barrier is touched). + * Festipod renders no access screen of its own and re-drives nothing. + * + * TWO CALLS, IN ORDER, AND THE ORDER IS CONTRACTUAL: start the session (`init`), + * then await `ensureIdentity()`. A session arrives only through `init`, and + * `ensureIdentity()` awaited before it has been called THROWS. The order is a fact + * of the statement sequence below, not of React's effect ordering — which would + * get it wrong: this gate's effect runs BEFORE its parent provider's. + * + * It hands back WHO WE ARE, and this is the app's only upstream answer to that + * question — everything else it knows about the user it has to read first. The + * value is published for display (`shared/utils/currentPrincipal`) and goes + * nowhere near a data call: no call takes an identity, because the session + * already belongs to one user. + * + * Nothing of the app renders before that await settles: a screen mounted earlier + * would read as an identity that is not yet settled. + * + * AND NOTHING RENDERS IF IT FAILS. A rejected `ensureIdentity()` is not a mode the + * app degrades through: an app that could not sign in but still shows its screens + * is indistinguishable from an app whose user simply owns nothing — a total + * failure wearing the face of an empty account. So the rejection is SHOWN, and the + * children stay unmounted, which is also what keeps the data layer from settling + * on its empty stand-in provider for the rest of the session. */ -import { useEffect, type ReactNode } from 'react'; -import { useNextGraph } from '../shared/context/NextGraphContext'; -import { useAccount, normalizeIdentifier } from '../shared/context/AccountContext'; -import { AccessGateScreen } from '../modules/auth/screens/AccessGateScreen'; +import { useEffect, useState, type ReactNode } from 'react'; +import { ensureIdentity } from '@ng-eventually/polyfill'; +import { startNgSession } from '../shared/utils/ngSession'; +import { setCurrentPrincipal } from '../shared/utils/currentPrincipal'; import { useRouter, useNavigate } from './router'; -declare global { - // eslint-disable-next-line no-var - var __FESTIPOD_ACCESS_GATE_DISABLED__: boolean | undefined; -} -const GATE_DISABLED = globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__ === true; - export function AuthGate({ children }: { children: ReactNode }) { - const { status, error, connect } = useNextGraph(); - const { identifier, login } = useAccount(); const { route } = useRouter(); const navigate = useNavigate(); + // Whether the ONE identity await has resolved. + const [identityReady, setIdentityReady] = useState(false); + // Why it did NOT resolve. Set once, never cleared: signing in is attempted once. + const [signInError, setSignInError] = useState(null); - // Once connected AND identified, leave the disconnected welcome screen for the - // app home. The identifier is now set at the barrier (before the broker - // round-trip), so on return the app can land on '/' with a session already - // open; the removed ConnexionScreen used to do this navigate on login. useEffect(() => { - if (!GATE_DISABLED && status === 'connected' && identifier && route.page === 'welcome') { + let cancelled = false; + // FIRST — a session arrives only through the SDK's `init`. Idempotent, so the + // provider above may have started it already; what matters is that it has been + // called before the await below, or the await throws. + void startNgSession(); + void ensureIdentity() + .then(principal => { + // Publish who we are BEFORE anything renders — the identity is a fact of + // the session, not state of this component, so it is recorded even if the + // effect was torn down in between. + setCurrentPrincipal(principal); + if (!cancelled) setIdentityReady(true); + }) + .catch(err => { + console.error('[Auth] ensureIdentity failed:', err); + if (!cancelled) setSignInError(err instanceof Error ? err.message : String(err)); + }); + return () => { cancelled = true; }; + }, []); + + // Once identified, leave the disconnected welcome screen for the app home. + useEffect(() => { + if (identityReady && route.page === 'welcome') { navigate('/home'); } - }, [status, identifier, route.page, navigate]); + }, [identityReady, route.page, navigate]); - // Gate explicitly disabled (no-gate build / @e2e harness) → straight to app. - if (GATE_DISABLED) { - return <>{children}; + // Signing in FAILED — say so. The app has nothing legitimate to show, and + // showing it anyway would pass a broken session off as an empty one. + if (signInError) { + return ( + + ); } - // Access barrier — shown until BOTH the wallet is open AND the space is named. - // "Entrer" records the identifier (persisted to localStorage AND written into - // the `?id=` URL param, which is what actually survives the broker redirect - // across the partitioned frontier) and, if the wallet isn't open yet, triggers - // the connect. - // - // On return (reload / broker round-trip) the identifier is already stored, so - // we PREFILL the field with it (`initialIdentifier`) — the user never sees a - // bare empty prompt they must re-type. It is captured ONCE, at first access. - if (status !== 'connected' || !identifier) { - const onEnter = (entered: string) => { - login(entered); - // Carry the identifier across the broker frontier via the URL. localStorage - // is partitioned by top-level site, so the value written here (127.0.0.1) - // is NOT what the app reads inside the broker iframe (nextgraph.net). The - // `@ng-org/web` redirect embeds the FULL app URL (query included) in the - // broker `o=`, which is reloaded in the iframe — so writing the normalized - // id into `?id=` BEFORE connect() makes it travel. `history.replaceState` - // (not push) keeps a single history entry. See AccountContext resolution. - if (typeof window !== 'undefined') { - try { - const url = new URL(window.location.href); - url.searchParams.set('id', normalizeIdentifier(entered)); - window.history.replaceState(window.history.state, '', url.toString()); - } catch { - /* URL construction can't fail for a real page URL; ignore defensively */ - } - } - if (status !== 'connected') connect(); - }; - return ( - - ); + // Signing in is not settled yet. Render NOTHING — the SDK's own full-screen + // barrier is what is on screen, it put it there and it takes it down. Anything + // of ours here would be a second thing competing with it. + if (!identityReady) { + return null; } // The app. diff --git a/src/index.ts b/src/index.ts index a23716b..90d8f1b 100644 --- a/src/index.ts +++ b/src/index.ts @@ -53,7 +53,7 @@ const server = serve({ autoSeed: process.env.FESTIPOD_AUTO_SEED ?? "", }), - // The shared wallet file (download target of the access barrier), when configured. + // The shared wallet file — the `fileUrl` the app hands the SDK, when configured. "/shared-wallet.ngw": async () => { const p = process.env.FESTIPOD_SHARED_WALLET_FILE; if (p) { diff --git a/src/modules/auth/features/barriere-acces-identifiant.feature b/src/modules/auth/features/barriere-acces-identifiant.feature deleted file mode 100644 index 17dc23f..0000000 --- a/src/modules/auth/features/barriere-acces-identifiant.feature +++ /dev/null @@ -1,27 +0,0 @@ -# language: fr -@AUTH @priority-1 -Fonctionnalité: Barrière d'accès — l'identifiant se saisit une seule fois - En tant qu'utilisateur qui revient dans Festipod - Je veux retrouver l'identifiant que j'ai déjà choisi, pré-rempli - Afin de ne jamais avoir à le retaper à l'arrivée - - # Garde-fou contre la régression rapportée : au retour (rechargement / round-trip - # broker) la barrière re-demandait un identifiant NU et VIDE alors qu'il était - # déjà stocké. L'identifiant est capturé UNE FOIS au premier accès, persisté, - # puis pré-rempli. Voir AuthGate + AccessGateScreen. - - @ui - Scénario: Le champ identifiant est pré-rempli avec la valeur déjà stockée - Étant donné que la barrière d'accès s'affiche avec l'identifiant stocké "alice" - Alors le champ identifiant contient "alice" - - @ui - Scénario: Un premier accès sans identifiant stocké affiche un champ vide - Étant donné que la barrière d'accès s'affiche sans identifiant stocké - Alors le champ identifiant est vide - - @ui - Scénario: Entrer remonte l'identifiant saisi - Étant donné que la barrière d'accès s'affiche avec l'identifiant stocké "alice" - Quand je clique sur "Entrer" dans la barrière - Alors l'identifiant remonté à l'application est "alice" diff --git a/src/modules/auth/features/connexion-nextgraph.feature b/src/modules/auth/features/connexion-nextgraph.feature index bdedb5e..c3a5530 100644 --- a/src/modules/auth/features/connexion-nextgraph.feature +++ b/src/modules/auth/features/connexion-nextgraph.feature @@ -6,10 +6,10 @@ Fonctionnalité: Connexion NextGraph et chargement des données Et charger les données de test dans mon portefeuille Afin d'utiliser l'application avec mes propres données - # NB : l'ancien écran /login (LoginScreen) a été retiré — l'accès NextGraph - # passe désormais par l'AccessGateScreen (barrière ON par défaut), cf. - # decision_2026-06-17_assisted-wallet-import. Les scénarios @ui qui testaient - # le LoginScreen ont été supprimés en conséquence. + # NB : Festipod n'affiche plus d'écran d'accès à lui. Se connecter, c'est le + # SEUL `ensureIdentity()` attendu par AuthGate ; ce qu'un utilisateur voit ou + # fait pendant cette attente appartient au SDK, qui le montre. Aucun scénario + # ici ne pilote donc une barrière d'accès. # --- Data layer: comportement du portefeuille --- diff --git a/src/modules/auth/features/identifiant-resolution.feature b/src/modules/auth/features/identifiant-resolution.feature deleted file mode 100644 index 5a01085..0000000 --- a/src/modules/auth/features/identifiant-resolution.feature +++ /dev/null @@ -1,42 +0,0 @@ -# language: fr -@AUTH @priority-1 -Fonctionnalité: Résolution de l'identifiant — le param d'URL prime sur localStorage - En tant qu'application relancée dans l'iframe du broker après le round-trip - Je veux résoudre l'identifiant depuis le param d'URL "?id=" - Afin qu'il traverse la frontière top-level↔iframe (que localStorage ne franchit pas) - - # Le flux wallet-partagé fait tourner l'app dans DEUX contextes avec DEUX - # partitions localStorage distinctes (top-level 127.0.0.1 vs iframe - # nextgraph.net). localStorage ne traverse pas la frontière ; le param "?id=" - # embarqué dans le redirect broker (o=) la traverse. AccountContext résout donc - # dans l'ordre : (1) param d'URL "?id=" (source de vérité) ; (2) sinon - # localStorage (préremplissage même-partition). Voir AccountContext + AuthGate. - - @ui - Scénario: Le param d'URL est la source de vérité quand il est présent - Étant donné que localStorage contient l'identifiant "alice" - Et que l'URL porte le param id "bob" - Quand le contexte de compte résout l'identifiant - Alors l'identifiant résolu est "bob" - - @ui - Scénario: Le param d'URL prime même sur une valeur localStorage différente et est persisté - Étant donné que localStorage contient l'identifiant "alice" - Et que l'URL porte le param id "carol" - Quand le contexte de compte résout l'identifiant - Alors l'identifiant résolu est "carol" - Et localStorage contient désormais l'identifiant "carol" - - @ui - Scénario: Sans param d'URL, localStorage sert de repli - Étant donné que localStorage contient l'identifiant "dave" - Et que l'URL ne porte aucun param id - Quand le contexte de compte résout l'identifiant - Alors l'identifiant résolu est "dave" - - @ui - Scénario: Le param d'URL est normalisé (minuscules, @ retiré) - Étant donné que localStorage ne contient aucun identifiant - Et que l'URL porte le param id "@Erin" - Quand le contexte de compte résout l'identifiant - Alors l'identifiant résolu est "erin" diff --git a/src/modules/auth/screens/AccessGateScreen.tsx b/src/modules/auth/screens/AccessGateScreen.tsx deleted file mode 100644 index 1c80f67..0000000 --- a/src/modules/auth/screens/AccessGateScreen.tsx +++ /dev/null @@ -1,183 +0,0 @@ -/** - * AccessGateScreen — the *technical access barrier* of the stopgap. - * - * SHARED WALLET IS THE SOLE SUPPORTED MODE. Festipod does not function without - * the shared wallet (the SDK polyfill runs on it). "No shared wallet configured" - * is therefore NOT an offered flow — it is a loud MISCONFIGURATION error - * (`!hasSharedWallet()` → a config-error block, no functional form). Configure it - * via FESTIPOD_SHARED_WALLET_PASSWORD. - * - * STOPGAP (see decision_2026-06-15_shared-wallet-login-flow). This is the - * REAL NextGraph login, shown before the app renders. Because it precedes the - * app, the user reads it as "access to the test environment", not as an app - * login. The user also types an IDENTIFIER here — the id that names their - * virtual space (a technical id, a pseudo in practice, NOT a Festipod profile - * handle like `@mariedupont`). - * Clicking "Entrer" records that identifier and triggers `connect()`, which - * redirects to the broker to open the SHARED wallet. After return the identity - * is already set (persisted before the redirect), so NG auto-connects straight - * into the app — there is no separate "choose a handle" screen. - * - * ASSISTED IMPORT (see decision_2026-06-17). The hosted broker can't import a - * wallet inline during - * web-app auth: a first-time device has no wallet, so the broker redirect would - * dead-end. We therefore HAND the user the shared wallet FILE (download) + the - * shared password and guide a one-time import on nextgraph.eu ("Import a Wallet - * File"), BEFORE they click "Entrer". The wallet FILE is the correct static - * primitive — a TextCode is a transient 5-min transfer, unusable to embed. This - * assisted flow is the default whenever the shared wallet is open pending. - */ - -import { useState, type ReactNode } from 'react'; -import { Button, Input, Title, Text } from '../../../shared/components/sketchy'; -import { SHARED_WALLET_PASSWORD, SHARED_WALLET_FILE_URL, WALLET_IMPORT_URL, hasSharedWallet } from '../sharedWallet'; - -interface AccessGateScreenProps { - status: 'disconnected' | 'connecting' | 'connected' | 'error'; - error?: string; - /** - * The identifier already stored for this space (the persisted one), used to - * PREFILL the field so a returning user never re-types it. Empty on a truly - * first access. Normalized upstream; shown verbatim. - */ - initialIdentifier?: string; - /** Enter the space: the raw identifier the user typed (normalized upstream). */ - onEnter: (identifier: string) => void; -} - -// One numbered step: a badge + a title + the action for that step. -function Step({ n, title, children }: { n: number; title: string; children: ReactNode }) { - return ( -
-
{n}
-
- {title} - {children} -
-
- ); -} - -export function AccessGateScreen({ status, error, initialIdentifier, onEnter }: AccessGateScreenProps) { - const connecting = status === 'connecting'; - const [copied, setCopied] = useState(false); - // The identifier that names this virtual space (a technical id — a pseudo in - // practice, but not a Festipod profile handle). Entered HERE, at wallet access, so a - // single act both names the space and opens it. Normalized (lowercased) upstream. - // PREFILLED from the stored identifier so a returning user (reload / broker - // round-trip) sees the value they already chose and never re-types it. - const [identifier, setIdentifier] = useState(initialIdentifier ?? ''); - - const copyPassword = async () => { - try { - await navigator.clipboard.writeText(SHARED_WALLET_PASSWORD); - setCopied(true); - setTimeout(() => setCopied(false), 2000); - } catch { - // clipboard may be blocked — the password stays selectable - } - }; - - const canEnter = !connecting && identifier.trim().length > 0; - const enter = () => { if (canEnter) onEnter(identifier); }; - - // Identifier field + Entrer: naming the space and opening it are one act. - const entrer = ( -
- ) => setIdentifier(e.target.value)} - onKeyDown={(e: React.KeyboardEvent) => { if (e.key === 'Enter') enter(); }} - /> - - Il identifie votre espace (mis en minuscules). - - -
- ); - - return ( -
-
- Festipod - Espace de test - - {!hasSharedWallet() ? ( - // SOLE-MODE guard: Festipod cannot run without the shared wallet, so a - // missing one is a misconfiguration, NOT a functional login form. - - Portefeuille partagé non configuré. Festipod ne fonctionne pas sans - (définir FESTIPOD_SHARED_WALLET_PASSWORD). - - ) : status !== 'connected' ? ( - <> - - Première connexion sur cet appareil ?
Chargez le portefeuille partagé, une seule fois. - - - - - ⬇ Télécharger le portefeuille - - - - - - - Ouvrir la page d'import - {' '}(nouvel onglet) → « Import a Wallet File » → choisissez le fichier → mot de passe : - -
- - {SHARED_WALLET_PASSWORD} - - -
- - - - {entrer} - - - ) : ( - entrer - )} - - {status === 'error' && ( - - {error || "Accès à l'environnement impossible. Réessayez."} - - )} -
- - - Version beta - -
- ); -} diff --git a/src/modules/auth/steps/data/connexion.steps.ts b/src/modules/auth/steps/data/connexion.steps.ts index e456445..2dacbd4 100644 --- a/src/modules/auth/steps/data/connexion.steps.ts +++ b/src/modules/auth/steps/data/connexion.steps.ts @@ -5,18 +5,15 @@ import type { FestipodWorld } from '../../../../shared/support/world'; // --- Setup --- Given('le portefeuille est vide', async function (this: FestipodWorld) { - // Each @data scenario runs under a UNIQUE identifier (see hooks.ts - // freshScenarioIdentifier), so the shim hands it a FRESH, EMPTY virtual wallet: - // "le portefeuille est vide" is trivially true on entry. So this is a fast - // INSTANT CHECK — assert the reactive read already shows nothing — NOT the old - // `clearWallet` per-entity-doc fan-out (a full physical-wallet enumeration that - // was itself slow). No mutation, no polling: a fresh wallet has no docs to scan. + // A fast INSTANT CHECK — assert the reactive read already shows nothing — NOT + // the old `clearWallet` per-entity-doc fan-out (a full wallet enumeration that + // was itself slow). No mutation, no polling. const counts = await this.appFrame!.evaluate(() => { const td = (window as any).__testData; return { events: td.events.size, users: td.users.size }; }); - expect(counts.events, 'Fresh virtual wallet should have no events').to.equal(0); - expect(counts.users, 'Fresh virtual wallet should have no users').to.equal(0); + expect(counts.events, 'An empty wallet should have no events').to.equal(0); + expect(counts.users, 'An empty wallet should have no users').to.equal(0); }); Given('le portefeuille contient déjà des événements', async function (this: FestipodWorld) { @@ -30,9 +27,12 @@ Given('le portefeuille contient déjà des événements', async function (this: const td = (window as any).__testData; td.loadTestData(); }); - // Wait for data to propagate + // Wait for data to propagate. `waitForFunction(fn, arg, options)` — the + // timeout goes in the THIRD slot; passed second it is silently taken as the + // predicate's argument and the wait runs on the 30s default instead. await this.appFrame!.waitForFunction( () => (window as any).__testData.events.size > 0, + undefined, { timeout: 75000 }, ); } @@ -72,6 +72,7 @@ When('je charge les données de test', async function (this: FestipodWorld) { const td = (window as any).__testData; return td.events.size > 0 && td.users.size > 0; }, + undefined, { timeout: 75000 }, ).catch(() => { // Timeout tolerated — the assertions below surface the real failure with a diff --git a/src/modules/auth/steps/ui/barriere-acces.steps.ts b/src/modules/auth/steps/ui/barriere-acces.steps.ts deleted file mode 100644 index 89151d1..0000000 --- a/src/modules/auth/steps/ui/barriere-acces.steps.ts +++ /dev/null @@ -1,123 +0,0 @@ -/** - * @ui steps for the access barrier (AccessGateScreen). - * - * These render the prop-driven AccessGateScreen directly (via renderElement) — - * it is NOT a registry/route screen, its state comes from props (status, - * initialIdentifier, onEnter). We assert on the rendered DOM: the identifier - * field is PREFILLED from the stored value, and "Entrer" reports the identifier. - * - * Guards the reported regression: on return the barrier used to re-ask for a - * bare, empty identifier despite one being stored. See AuthGate.tsx. - * - * SHARED WALLET IS THE SOLE SUPPORTED MODE (see AccessGateScreen header): the - * identifier field lives INSIDE the assisted-import flow, which renders only when - * a shared wallet is configured; otherwise the barrier shows a config-error with - * NO field. Production always configures one, but the @ui node harness does not - * inject the build global, so we set it HERE — before the screen module is first - * imported, so `sharedWallet.ts` captures it at module-eval — and lazy-import the - * screen. This file is the only @ui module that reaches sharedWallet.ts, so this - * ordering is deterministic. - */ -import { Given, When, Then } from '@cucumber/cucumber'; -import { expect } from 'chai'; -import React from 'react'; -import { renderElement } from '../../../../shared/test-harness/renderHelper'; -import type { FestipodWorld } from '../../../../shared/support/world'; - -globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__ = 'test-shared-wallet'; - -// Lazy so sharedWallet.ts evaluates AFTER the global above is set (a static -// import would hoist above it, capturing an empty password → config-error). -type Gate = typeof import('../../screens/AccessGateScreen')['AccessGateScreen']; -let gateComponent: Gate | null = null; -async function loadGate(): Promise { - if (!gateComponent) { - gateComponent = (await import('../../screens/AccessGateScreen')).AccessGateScreen; - } - return gateComponent; -} - -// Local per-scenario state (kept off the World to avoid touching its type). -interface GateState { - doc: Document | null; - entered: string | null; -} -const gateStates = new WeakMap(); -function stateFor(world: object): GateState { - let s = gateStates.get(world); - if (!s) { - s = { doc: null, entered: null }; - gateStates.set(world, s); - } - return s; -} - -async function renderGate(world: object, initialIdentifier?: string): Promise { - const s = stateFor(world); - s.entered = null; - const AccessGateScreen = await loadGate(); - // 'connecting' would disable the button; 'disconnected' is the returning-user - // state (session not yet restored) — the exact case that re-prompted before. - s.doc = await renderElement( - React.createElement(AccessGateScreen, { - status: 'disconnected', - initialIdentifier, - onEnter: (id: string) => { - s.entered = id; - }, - }), - ); -} - -Given( - 'la barrière d\'accès s\'affiche avec l\'identifiant stocké {string}', - async function (this: FestipodWorld, identifier: string) { - await renderGate(this, identifier); - }, -); - -Given( - 'la barrière d\'accès s\'affiche sans identifiant stocké', - async function (this: FestipodWorld) { - await renderGate(this, ''); - }, -); - -function identifierField(world: object): HTMLInputElement { - const s = stateFor(world); - expect(s.doc, 'The access barrier should be rendered').to.not.be.null; - const input = s.doc!.querySelector('[data-testid="identifier-input"]') as HTMLInputElement | null; - expect(input, 'The identifier field should be present').to.not.be.null; - return input!; -} - -Then( - 'le champ identifiant contient {string}', - function (this: FestipodWorld, expected: string) { - expect(identifierField(this).value).to.equal(expected); - }, -); - -Then('le champ identifiant est vide', function (this: FestipodWorld) { - expect(identifierField(this).value).to.equal(''); -}); - -When('je clique sur {string} dans la barrière', function (this: FestipodWorld, _label: string) { - const s = stateFor(this); - const input = identifierField(this); - // Submit via Enter on the field (canEnter is satisfied by the prefilled value). - const KeyboardEventCtor = (globalThis as { KeyboardEvent?: typeof KeyboardEvent }).KeyboardEvent; - const evt = KeyboardEventCtor - ? new KeyboardEventCtor('keydown', { key: 'Enter', bubbles: true }) - : Object.assign(new (globalThis as { Event: typeof Event }).Event('keydown', { bubbles: true }), { key: 'Enter' }); - input.dispatchEvent(evt); - expect(s.doc, 'The access barrier should be rendered').to.not.be.null; -}); - -Then( - 'l\'identifiant remonté à l\'application est {string}', - function (this: FestipodWorld, expected: string) { - const s = stateFor(this); - expect(s.entered, 'onEnter should have been called with the identifier').to.equal(expected); - }, -); diff --git a/src/modules/auth/steps/ui/identifiant-resolution.steps.ts b/src/modules/auth/steps/ui/identifiant-resolution.steps.ts deleted file mode 100644 index 1a33a64..0000000 --- a/src/modules/auth/steps/ui/identifiant-resolution.steps.ts +++ /dev/null @@ -1,111 +0,0 @@ -/** - * @ui steps for AccountContext identifier resolution. - * - * Guards the cross-frontier fix: the shared-wallet flow runs the app in TWO - * localStorage partitions (top-level 127.0.0.1 vs broker iframe nextgraph.net), - * so localStorage does NOT cross. The `?id=` URL param — embedded in the broker - * redirect `o=` — DOES cross. AccountContext resolution therefore PRIORITIZES the - * URL param over localStorage, and (when present) persists it to localStorage for - * same-partition convenience. Normalization (trim, `@`-strip, lowercase) applies. - * - * These render a tiny probe inside a real AccountProvider (via renderElement), - * having first seeded window.location.search and window.localStorage through the - * happy-dom harness — so the resolution logic runs for real, not mocked. - */ -import { Given, When, Then } from '@cucumber/cucumber'; -import { expect } from 'chai'; -import React from 'react'; -import { - renderElement, - setRenderUrl, - setRenderLocalStorage, - getRenderLocalStorage, -} from '../../../../shared/test-harness/renderHelper'; -import { AccountProvider, useAccount } from '../../../../shared/context/AccountContext'; -import type { FestipodWorld } from '../../../../shared/support/world'; - -const STORAGE_KEY = 'festipod.account.identifier'; - -// Per-scenario intent (kept off the World type via a WeakMap). -interface ResolveState { - storageSeed: string | null; - url: string; - doc: Document | null; -} -const states = new WeakMap(); -function stateFor(world: object): ResolveState { - let s = states.get(world); - if (!s) { - s = { storageSeed: null, url: 'http://localhost/', doc: null }; - states.set(world, s); - } - return s; -} - -// Probe: renders the resolved identifier so the DOM can be asserted. -function IdentifierProbe(): React.ReactElement { - const { identifier } = useAccount(); - return React.createElement('div', { 'data-testid': 'resolved-identifier' }, identifier ?? ''); -} - -Given( - 'localStorage contient l\'identifiant {string}', - function (this: FestipodWorld, value: string) { - stateFor(this).storageSeed = value; - }, -); - -Given('localStorage ne contient aucun identifiant', function (this: FestipodWorld) { - stateFor(this).storageSeed = null; -}); - -Given('l\'URL porte le param id {string}', function (this: FestipodWorld, id: string) { - const s = stateFor(this); - const url = new URL('http://localhost/'); - url.searchParams.set('id', id); - s.url = url.toString(); -}); - -Given('l\'URL ne porte aucun param id', function (this: FestipodWorld) { - stateFor(this).url = 'http://localhost/'; -}); - -When('le contexte de compte résout l\'identifiant', async function (this: FestipodWorld) { - const s = stateFor(this); - // Seed the happy-dom window (URL + localStorage) BEFORE mounting the provider, - // so the provider's init-time resolution reads exactly this state. - await setRenderUrl(s.url); - await setRenderLocalStorage(STORAGE_KEY, s.storageSeed); - s.doc = await renderElement( - React.createElement(AccountProvider, null, React.createElement(IdentifierProbe)), - ); -}); - -function resolved(world: object): string { - const s = stateFor(world); - expect(s.doc, 'The probe should be rendered').to.not.be.null; - const el = s.doc!.querySelector('[data-testid="resolved-identifier"]'); - expect(el, 'The resolved-identifier probe should be present').to.not.be.null; - return el!.textContent ?? ''; -} - -Then('l\'identifiant résolu est {string}', function (this: FestipodWorld, expected: string) { - expect(resolved(this)).to.equal(expected); -}); - -Then( - 'localStorage contient désormais l\'identifiant {string}', - async function (this: FestipodWorld, expected: string) { - // The URL-param → localStorage persistence runs in a mount useEffect, which - // React flushes AFTER the render's first microtask. Yield a few macrotask - // ticks (bounded, no polling of any live resource) so the effect has run - // before asserting — otherwise the read races the effect and flakes. - let stored: string | null = null; - for (let i = 0; i < 10; i++) { - stored = await getRenderLocalStorage(STORAGE_KEY); - if (stored === expected) break; - await new Promise((r) => setTimeout(r, 0)); - } - expect(stored).to.equal(expected); - }, -); diff --git a/src/modules/event/features/e2e-multibrowser.feature b/src/modules/event/features/e2e-multibrowser.feature index d722451..fbc1216 100644 --- a/src/modules/event/features/e2e-multibrowser.feature +++ b/src/modules/event/features/e2e-multibrowser.feature @@ -60,8 +60,7 @@ Fonctionnalité: Validation e2e multi-navigateurs des nouvelles features (T02.f) # vise pas « sans reload ». # # FIX (appliqué) : la matérialisation du propriétaire lit l'inbox APRÈS sa barrière - # de sync (`inbox.readSynced` → `ensureRepoOpen` + `read`, lib - # `@ng-eventually/client`), de sorte qu'un dépôt de l'inscrit déjà synchronisé au + # de sync (`inbox.readSynced`, SDK `@ng-eventually/polyfill`), de sorte qu'un dépôt de l'inscrit déjà synchronisé au # broker EST vu (plus de « 0 prématuré » mémoïsé) ; le materializer est lancé # directement à la connexion ([ready, ownedKey]), pas seulement sur un push # d'inbox. Source unique du NOMBRE : `event.participantCount` (le littéral local diff --git a/src/modules/event/features/isolation-deux-identites.feature b/src/modules/event/features/isolation-deux-identites.feature index d1faeb7..ba00bf5 100644 --- a/src/modules/event/features/isolation-deux-identites.feature +++ b/src/modules/event/features/isolation-deux-identites.feature @@ -1,21 +1,21 @@ # language: fr -@EVENT @priority-1 @data +# SUSPENDU (@wip) — comportement Festipod bien réel, mais inexprimable aujourd'hui : il faut DEUX contextes navigateur réellement séparés, chacun se connectant pour lui-même via `ensureIdentity()`, ce que le support multi-navigateur n'offre pas encore. +@EVENT @priority-1 @data @wip Fonctionnalité: Isolation entre deux identités sur le wallet partagé - En tant qu'utilisateur qui nomme son espace virtuel par un identifiant à la - barrière d'accès, sur le MÊME wallet physique partagé, + En tant qu'utilisateur qui se connecte pour lui-même, sur le MÊME wallet + physique partagé qu'un autre utilisateur, Je ne dois voir NI l'inscription NI l'accueil d'une autre identité Afin que les participations restent privées à leur propriétaire. # Régression du leak d'isolation : une identité A crée un événement et le - # rejoint ; une identité fraîche B arrive sur le même wallet (faux-logout + - # re-login sous un autre identifiant, sans reload — le stopgap wallet-partagé). + # rejoint ; une identité fraîche B arrive sur le même wallet physique, dans son + # propre contexte navigateur, et se connecte pour elle-même. # B ne doit PAS voir la participation de A : ni sur son accueil # (getUserEvents(B)), ni via isParticipating(E, B), ni dans son set de - # participations réactif. Le mécanisme : le changement d'identifiant est traité - # comme une session fraîche (reset du jeu de lecture + caps + registre), sinon - # les docs PROTECTED de A survivent dans le jeu de lecture de B et fuient par la - # lecture union. Voir data-layer/knowledge_context-internals § « Changement - # d'identité = session fraîche ». + # participations réactif. Ce qui est sous test, c'est le comportement de + # Festipod : rien de ce que l'app affiche à B ne provient des documents + # PROTECTED de A, quand bien même les deux identités vivent sur un seul wallet + # physique. @data Scénario: Une identité fraîche ne voit pas la participation d'une autre diff --git a/src/modules/event/screens/CreateEventScreen.tsx b/src/modules/event/screens/CreateEventScreen.tsx index 25211af..3134d5d 100644 --- a/src/modules/event/screens/CreateEventScreen.tsx +++ b/src/modules/event/screens/CreateEventScreen.tsx @@ -79,25 +79,36 @@ export function CreateEventScreen() { ? (endDate ? `${startDate} - ${endDate}` : startDate) : 'Date à définir'; - const newEvent = await createEvent({ - title: name || 'Nouvel événement', - date: dateLabel, - startDate, - endDate, - startTime, - endTime, - location: location || 'Lieu à définir', - description, - // Option B: the creator does NOT auto-participate (no host notion). The count - // starts at 0 and is DERIVED by the owner-materializer from real inbox - // deposits (|active registrations|) — never a local literal. Passing 1 here was - // the "local number" bug: the creator's own view showed 1 while the derived - // truth (and every other viewer) was 0. - participantCount: 0, - themes: ['Social'], - hostName: 'Moi', - hostInitials: 'MD', - }); + // A creation that cannot be recorded FAILS — it never hands back an event + // that would read empty forever. So the success toast and the navigation + // belong AFTER the create resolves, and a failure must say so rather than + // send the user to a page for an event that does not exist. + let newEvent; + try { + newEvent = await createEvent({ + title: name || 'Nouvel événement', + date: dateLabel, + startDate, + endDate, + startTime, + endTime, + location: location || 'Lieu à définir', + description, + // Option B: the creator does NOT auto-participate (no host notion). The count + // starts at 0 and is DERIVED by the owner-materializer from real inbox + // deposits (|active registrations|) — never a local literal. Passing 1 here was + // the "local number" bug: the creator's own view showed 1 while the derived + // truth (and every other viewer) was 0. + participantCount: 0, + themes: ['Social'], + hostName: 'Moi', + hostInitials: 'MD', + }); + } catch (err) { + console.error('[CreateEvent] createEvent failed:', err); + showToast("L'événement n'a pas pu être relayé", 'error'); + return; + } showToast('Événement relayé', 'success'); navigate(`/events/${newEvent.id}`); }; diff --git a/src/modules/event/screens/EventDetailScreen.tsx b/src/modules/event/screens/EventDetailScreen.tsx index 194a1b5..4c8c515 100644 --- a/src/modules/event/screens/EventDetailScreen.tsx +++ b/src/modules/event/screens/EventDetailScreen.tsx @@ -40,11 +40,22 @@ export function EventDetailScreen() { const handleToggleJoin = () => { if (!eventId) return; + // The optimistic toast stays immediate (the overlay already reflects the + // change), but the write can genuinely FAIL — a participation document that + // cannot be recorded throws instead of reading empty forever, and an + // unconfirmed withdrawal throws too. Surface it rather than leave the user + // with a success message and nothing written. + const failed = (message: string) => (err: unknown) => { + console.error('[EventDetail] participation write failed:', err); + showToast(message, 'error'); + }; if (joined) { - leaveEvent(eventId); + void Promise.resolve(leaveEvent(eventId)) + .catch(failed("La désinscription n'a pas pu être enregistrée")); showToast('Participation annulée', 'info'); } else { - joinEvent(eventId); + void Promise.resolve(joinEvent(eventId)) + .catch(failed("L'inscription n'a pas pu être enregistrée")); showToast('Tu participes à cet événement', 'success'); } }; diff --git a/src/modules/event/steps/data/isolation.steps.ts b/src/modules/event/steps/data/isolation.steps.ts index 765b96d..8674eb3 100644 --- a/src/modules/event/steps/data/isolation.steps.ts +++ b/src/modules/event/steps/data/isolation.steps.ts @@ -1,18 +1,18 @@ -import { Given, When, Then } from '@cucumber/cucumber'; +import { Given, Then } from '@cucumber/cucumber'; import { expect } from 'chai'; import type { FestipodWorld } from '../../../../shared/support/world'; -import { pool } from '../../../../shared/support/browserPool'; -// Two-identity isolation (@data, real broker). Identity A (the fresh per-scenario -// identifier set in localStorage) creates an event E and joins it; a genuinely- -// different identity B is brought up on the SAME wallet; B must read NONE of A's -// protected participation, E must not be on B's home, isParticipating(E,B) false. +// Isolation entre deux utilisateurs (@data, broker réel). A crée un événement et +// s'y inscrit ; B ne doit rien lire de la participation PROTECTED de A. // -// B is brought up via a FRESH PAGE on the SAME persistent wallet context with B's -// identifier in localStorage — the closest analogue to the real app's re-enter- -// gate / reload path (a brand-new NgDataProvider mount, identifier=B, on a wallet -// that already holds A's docs). This exercises the identity-switch reset that -// keeps A's protected docs out of B's read set. +// LE « QUAND » DE CE SCÉNARIO N'EXISTE PLUS ICI, et c'est délibéré : faire venir B +// demande son PROPRE contexte navigateur avec son PROPRE wallet — deux personnes +// sur deux appareils. Un contexte navigateur est UN utilisateur, et `ensureIdentity()` +// dit lequel ; rien ne le choisit. Le scénario est donc suspendu (@wip dans +// isolation-deux-identites.feature) jusqu'à ce que le harness sache monter un second +// contexte avec son wallet à lui. Le Given ci-dessous reste : il est réutilisé par +// les scénarios de reconnexion. Les Alors restent aussi — les assertions sont +// intactes, c'est le montage de B qui manque. Given('l\'identité A crée l\'événement {string} et s\'y inscrit', { timeout: 180000 }, async function (this: FestipodWorld, title: string) { const out = await this.appFrame!.evaluate(async (title) => { @@ -37,28 +37,8 @@ Given('l\'identité A crée l\'événement {string} et s\'y inscrit', { timeout: (this as any).isoAId = out.aId; }); -When('une identité fraîche B arrive sur le même wallet partagé', { timeout: 120000 }, async function (this: FestipodWorld) { - const bId = `iso-b-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`; - (this as any).isoBId = bId; - const ctx = this.page!.context(); - const bPage = await ctx.newPage(); - await bPage.addInitScript((u: string) => { - try { window.localStorage.setItem('festipod.account.identifier', u); } catch { /* opaque */ } - }, bId); - await bPage.addInitScript(() => { - (globalThis as Record).__FESTIPOD_ACCESS_GATE_DISABLED__ = true; - }); - bPage.on('console', (msg) => { if (msg.type() === 'error') console.error('[Bpage console]', msg.text()); }); - const bFrame = await pool.setupBrokerPage!(bPage, pool.harnessUrl!); - await bFrame.waitForFunction(() => (window as any).__testData?.ready === true, { timeout: 60000 }); - // Let B's listing effect + union read run (rebuilds the read set bounded to B). - await bFrame.evaluate(async () => { - const td = (window as any).__testData; - await td.ensureCurrentUser(); - await new Promise(r => setTimeout(r, 6000)); - }); - (this as any).isoBFrame = bFrame; -}); +// Le « Quand une identité fraîche B arrive… » n'a pas d'équivalent : il faut à B son +// propre contexte navigateur avec son propre wallet (voir l'en-tête de ce fichier). Then('l\'événement {string} n\'est pas sur l\'accueil de B', async function (this: FestipodWorld, title: string) { const bFrame = (this as any).isoBFrame; diff --git a/src/modules/event/steps/data/reconnexion-froide-sans-local.steps.ts b/src/modules/event/steps/data/reconnexion-froide-sans-local.steps.ts index b39d615..ee985c7 100644 --- a/src/modules/event/steps/data/reconnexion-froide-sans-local.steps.ts +++ b/src/modules/event/steps/data/reconnexion-froide-sans-local.steps.ts @@ -31,8 +31,6 @@ When( 'un navigateur frais non-persistant recharge pour la MÊME identité A avec le wallet partagé', { timeout: 120000 }, async function (this: FestipodWorld) { - // SAME identity A: the per-scenario virtual identifier set by the Before hook. - const aIdentifier = (this as any).freshIdentifier as string; if (!pool.sharedWalletState) { throw new Error( 'sharedWalletState non capturé au BeforeAll — impossible de provisionner un ' + @@ -41,25 +39,16 @@ When( ); } - // FRESH, non-persistent, hermetic context seeded with ONLY the shared wallet - // storageState (captured before A's event existed). Separate storage partition - // from the persistent write page → no shared IndexedDB, no local copy of A's - // just-created event. Its ONLY source for A's event is the broker. + // FRESH, non-persistent, hermetic context seeded with ONLY the deployment + // wallet's storageState (captured before A's event existed). Separate storage + // partition from the persistent write page → no shared IndexedDB, no local copy + // of A's just-created event. Its ONLY source for A's event is the broker. + // It comes up as the SAME person because it opens the SAME wallet — that is + // what makes this a reconnect, and nothing here names an identity. const ctx = await spawnContext('shared'); (this as any).recoColdCtx = ctx; // closed by freshBrowser.close() in AfterAll const freshPage = await ctx.newPage(); - // SAME identity A: inject A's app-level identifier on every origin BEFORE any - // script (incl. the harness iframe on 127.0.0.1), so the shim keys to the SAME - // virtual account A — a reconnect, not an identity switch. Identical injection - // to isolation.steps.ts / reconnexion.steps.ts, but into a FRESH context. - await freshPage.addInitScript((u: string) => { - try { window.localStorage.setItem('festipod.account.identifier', u); } catch { /* opaque */ } - }, aIdentifier); - await freshPage.addInitScript(() => { - (globalThis as Record).__FESTIPOD_ACCESS_GATE_DISABLED__ = true; - }); - // Broad console capture (ALL types) so the SDK diagnostic lines // (BARRIER synced|timed-out, OUTBOX, readScopeIndex → N, CONNECTION ESTABLISHED, // REPLAY TOPIC NOT FOUND, …) surface verbatim to stdout as the verdict's proof. diff --git a/src/modules/event/steps/data/reconnexion.steps.ts b/src/modules/event/steps/data/reconnexion.steps.ts index 0741781..f029947 100644 --- a/src/modules/event/steps/data/reconnexion.steps.ts +++ b/src/modules/event/steps/data/reconnexion.steps.ts @@ -3,23 +3,18 @@ import { expect } from 'chai'; import type { FestipodWorld } from '../../../../shared/support/world'; import { pool } from '../../../../shared/support/browserPool'; -// RECONNECTION of the SAME identity on the SAME persistent wallet (@data, real -// broker). Distinct from the two-identity isolation scenario: here the fresh page -// re-enters under the SAME identifier A (same virtual wallet), on a NEW broker -// login (fresh verifier session). The defect under test: the fresh page reads its -// OWN data EMPTY (home=[], isParticipating=false, authCount=0) because the anchored -// listing path (listMyEntityDocs → readScopeIndex, then readUnion/readDoc) queries -// repos not yet in `self.repos` at cold-start and silently returns 0 rows. +// RECONNECTION of the same user on the same persistent wallet (@data, real +// broker). The fresh page re-enters on a NEW broker login (fresh verifier +// session). The defect under test: the fresh page reads its OWN data EMPTY +// (home=[], isParticipating=false, authCount=0) because the anchored listing path +// (listMyEntityDocs → readScopeIndex, then readUnion/readDoc) queries repos not +// yet in `self.repos` at cold-start and silently returns 0 rows. // -// Identity A is the scenario's fresh virtual-wallet identifier (this.freshIdentifier, set -// by the Before hook into localStorage on every origin). A creates E via the REAL -// app path (createEventReal) and joins it (appJoinEvent) on the MAIN page. Then a -// FRESH PAGE is brought up on the SAME persistent wallet context with the SAME -// identifier A in localStorage BEFORE any script — the closest analogue to the real -// app's re-enter-gate / reload path (a brand-new NgDataProvider mount + a fresh -// broker session that must re-open A's own repos). Montage identical to -// isolation.steps.ts, except the fresh page reuses this.freshIdentifier (SAME A) rather -// than minting a new identifier B. +// A creates E via the REAL app path (createEventReal) and joins it (appJoinEvent) +// on the MAIN page. Then a FRESH PAGE is opened on the SAME browser context — one +// context is one user, so that page comes up as the same person, and it is the +// closest analogue to the real app's re-entry / reload path (a brand-new +// NgDataProvider mount + a fresh broker session that must re-open A's own repos). // The Given "l'identité A crée l'événement {string} et s'y inscrit" is REUSED from // isolation.steps.ts (same wording, same behavior — A creates E and joins on the @@ -106,18 +101,11 @@ Then('l\'événement {string} finit par apparaître sur la page fraîche A en la }); When('une page fraîche pour la MÊME identité A recharge sur le même wallet', { timeout: 120000 }, async function (this: FestipodWorld) { - // SAME identity A as the main page: reuse the scenario's fresh virtual-wallet - // identifier (set by the Before hook). NOT a new identifier — this is a reconnect, - // not an identity switch. - const aIdentifier = (this as any).freshIdentifier as string; + // SAME user as the main page — by construction, not by declaration: the new page + // is opened on the SAME browser context, and a browser context is one user. This + // is a reconnect, and there is nothing to select. const ctx = this.page!.context(); const freshPage = await ctx.newPage(); - await freshPage.addInitScript((u: string) => { - try { window.localStorage.setItem('festipod.account.identifier', u); } catch { /* opaque */ } - }, aIdentifier); - await freshPage.addInitScript(() => { - (globalThis as Record).__FESTIPOD_ACCESS_GATE_DISABLED__ = true; - }); // Broadened to ALL console types (not just 'error') for the pause-reproduction // investigation: the SDK's diagnostic lines (logStage: BARRIER/OUTBOX/ // readScopeIndex) are emitted via console.log, not console.error, and would diff --git a/src/modules/event/steps/e2e/reconnexion-persistance.steps.ts b/src/modules/event/steps/e2e/reconnexion-persistance.steps.ts index 8dc3274..d70c827 100644 --- a/src/modules/event/steps/e2e/reconnexion-persistance.steps.ts +++ b/src/modules/event/steps/e2e/reconnexion-persistance.steps.ts @@ -6,14 +6,13 @@ import { pool } from '../../../../shared/support/browserPool'; // RECONNECTION-PERSISTENCE at the @e2e layer (REAL app, real broker). // // Mirrors reconnexion.steps.ts (@data) but drives the REAL app (pool.appUrl), -// NOT the harness. The main page is booted by the @e2e Before hook: identity = -// this.freshIdentifier (set into localStorage['festipod.account.identifier'] on every -// origin by the hook), gate disabled → the real app boots directly on that -// identity. We create an event via the REAL create form (same DOM path the app -// user takes), verify it appears, then open a SECOND page in the SAME persistent -// wallet context with the SAME identifier + gate disabled, and a FRESH broker -// login → a fresh verifier session (empty memory) that must re-read everything -// from the broker. That is the faithful analogue of "close and reopen". +// NOT the harness. The main page is booted by the @e2e Before hook; who it comes +// up as is `ensureIdentity()`'s answer, and nothing here selects it. We create an +// event via the REAL create form (same DOM path the app user takes), verify it +// appears, then open a SECOND page in the SAME browser context — one context is +// one user, so it is the same person — with a FRESH broker login → a fresh +// verifier session (empty memory) that must re-read everything from the broker. +// That is the faithful analogue of "close and reopen". // // The step captures console logs from BOTH pages and reports (via cucumber // attachments) the timing of `WRITE`-ish lines vs `CONNECTION ESTABLISHED`, and @@ -171,18 +170,11 @@ Given('l\'événement {string} apparaît sur l\'accueil de l\'utilisateur', { ti // --- Step 2: reconnect faithfully — a fresh page/session for the SAME identity --- When('l\'utilisateur ferme et rouvre l\'app sous la même identité dans une session broker fraîche', { timeout: 180000 }, async function (this: FestipodWorld) { - const identifier = (this as any).freshIdentifier as string; + // SAME browser context → same wallet → same person. The reopened app asks + // `ensureIdentity()` who it is, exactly as the first page did. const ctx = this.page!.context(); const freshPage = await ctx.newPage(); - // SAME identity in localStorage BEFORE any script (what the reopened app reads, - // gate disabled) + gate disabled so the real app boots straight onto that id. - await freshPage.addInitScript((u: string) => { - try { window.localStorage.setItem('festipod.account.identifier', u); } catch { /* opaque */ } - }, identifier); - await freshPage.addInitScript(() => { - (globalThis as Record).__FESTIPOD_ACCESS_GATE_DISABLED__ = true; - }); const freshLogs: StampedLog[] = []; (this as any).recoFreshLogs = freshLogs; diff --git a/src/modules/home/screens/SettingsScreen.tsx b/src/modules/home/screens/SettingsScreen.tsx index 6011994..49491b5 100644 --- a/src/modules/home/screens/SettingsScreen.tsx +++ b/src/modules/home/screens/SettingsScreen.tsx @@ -2,29 +2,19 @@ import { useState } from 'react'; import { ArrowLeft } from 'lucide-react'; import { Header, Text, ListItem, Toggle, Divider, BottomNav } from '../../../shared/components/sketchy'; import { useNavigate } from '../../../app/router'; -import { useAccount } from '../../../shared/context/AccountContext'; import { logoutNg } from '../../../shared/utils/ngSession'; export function SettingsScreen() { const navigate = useNavigate(); - const { logout } = useAccount(); const [notifications, setNotifications] = useState(true); const [darkMode, setDarkMode] = useState(false); const [location, setLocation] = useState(true); - // Faux logout: clears the current identifier only — the shared wallet stays - // open underneath. In staging this returns to the access barrier (identifier - // prompt), since the gate shows until an identifier is set again. - const handleLogout = () => { - logout(); - navigate('/'); - }; - - // Real logout (HIDDEN): stops the shared wallet session — forces a broker - // redirect on next access. Stopgap-only escape hatch. + // The ONLY logout: stop the session of the wallet this deployment serves, which + // forces a broker redirect on the next access. There is nothing app-side to sign + // out of — the app never names an identity, so it holds none to drop. const handleLeaveEnvironment = async () => { await logoutNg(); - logout(); if (typeof window !== 'undefined') window.location.reload(); }; @@ -93,13 +83,9 @@ export function SettingsScreen() { - - Se déconnecter - - - {/* Stopgap escape hatch — real wallet logout, kept discreet. */} + {/* Stopgap escape hatch — the real wallet logout. */} - + Quitter l'environnement de test diff --git a/src/modules/workshop/features/multibrowser-harness.feature b/src/modules/workshop/features/multibrowser-harness.feature index cdd9a39..a3dbdcb 100644 --- a/src/modules/workshop/features/multibrowser-harness.feature +++ b/src/modules/workshop/features/multibrowser-harness.feature @@ -1,32 +1,10 @@ # language: fr @data @multibrowser -Fonctionnalité: Harness multi-navigateur — modèles private-wallet et shared-wallet - Pour comparer sereinement les deux modèles de wallet (chacun le sien vs partagé) +Fonctionnalité: Harness multi-navigateur — modèle shared-wallet + Pour valider le provisioning du wallet partagé sur plusieurs navigateurs En tant que développeur du stopgap puis de la cible NextGraph Le harness e2e doit piloter plusieurs navigateurs isolés dans un seul scénario, - sous l'un OU l'autre modèle de wallet — deux axes orthogonaux. - - # --- Axe machinerie : isolation des contextes (modèle private-wallet) --- - - @private-wallet - Scénario: Deux navigateurs avec leur propre wallet ont des stockages locaux indépendants - Étant donné un navigateur "A" avec son propre wallet - Et un navigateur "B" avec son propre wallet - Quand j'écris "valeur-A" sous la clé "sonde" dans le navigateur "A" - Alors la clé "sonde" vaut "valeur-A" dans le navigateur "A" - Et la clé "sonde" est absente dans le navigateur "B" - - # Le wallet NextGraph vit sur l'origine du broker (nextgraph.net). Ce scénario - # prouve l'isolation du stockage LÀ, pas seulement sur l'origine locale. - @private-wallet - Scénario: Sur l'origine du broker, deux navigateurs private-wallet restent isolés - Étant donné un navigateur "A" avec son propre wallet - Et un navigateur "B" avec son propre wallet - Quand le navigateur "A" charge l'origine du broker - Et le navigateur "B" charge l'origine du broker - Et j'écris "faux-wallet" sous la clé "ng_probe" dans le navigateur "A" - Alors la clé "ng_probe" vaut "faux-wallet" dans le navigateur "A" - Et la clé "ng_probe" est absente dans le navigateur "B" + tous porteurs du wallet partagé. # --- Axe wallet : provisioning shared-wallet (injection storageState) --- @@ -40,34 +18,3 @@ Fonctionnalité: Harness multi-navigateur — modèles private-wallet et shared- Et le navigateur "B" charge l'application via le broker Alors le navigateur "A" est connecté à NextGraph Et le navigateur "B" est connecté à NextGraph - - # --- Distribution produit : import ASSISTÉ (pas d'auto-import zéro-touche) --- - # - # L'auto-import zéro-touche par l'app est PROUVÉ IMPOSSIBLE avec le broker - # hébergé : il n'implémente pas l'import inline pendant l'auth web-app et - # renvoie vers nextgraph.eu (cross-origin, non pilotable par Festipod). Voir - # concept nextgraph-platform → knowledge_broker-import-constraint et - # decision_2026-06-17_assisted-wallet-import. - # - # PARCOURS HUMAIN COMPLET — exerce la VRAIE app (staging, gate ON) de bout en - # bout : Festipod propose le FICHIER du portefeuille → l'humain le télécharge et - # l'importe sur nextgraph.eu (« Import a Wallet File » + mot de passe) → revient - # → « Entrer » → connecté. Le FICHIER est la primitive correcte (statique, - # réutilisable) — le TextCode est un transfert temporaire 5 min, inutilisable à - # embarquer (cf. nextgraph-platform → knowledge_broker-import-constraint). - # (≠ scénario @shared-wallet ci-dessus, qui INJECTE le wallet via storageState - # et court-circuite donc l'import — provisioning de TEST, pas le flux produit.) - # - # EXCLU DU RUN PAR DÉFAUT (cucumber.json : "not @wip and not @humain", T02.f) : - # ce scénario pilote nextgraph.eu EN DIRECT (import du fichier wallet sur un site - # externe non maîtrisé par Festipod) → non déterministe en CI et, en cas d'échec - # réseau, il ferme le contexte navigateur et faisait CASCADER les scénarios @data - # suivants. C'est une validation de FIDÉLITÉ HUMAINE, à lancer explicitement - # (`--tags @humain`), pas un test automatisé du run par défaut. - @shared-wallet @assisted-import @humain - Scénario: Parcours humain — le testeur importe le portefeuille fourni par Festipod et se connecte - Étant donné un nouveau testeur ouvre Festipod en staging sur un navigateur vierge - Alors Festipod affiche l'écran d'accès avec le portefeuille à télécharger - Quand le testeur télécharge le portefeuille et l'importe sur nextgraph.eu - Et le testeur revient sur Festipod, saisit un identifiant et clique « Entrer » - Alors il arrive sur l'accueil de l'application diff --git a/src/modules/workshop/features/protected-connections.feature b/src/modules/workshop/features/protected-connections.feature deleted file mode 100644 index d279238..0000000 --- a/src/modules/workshop/features/protected-connections.feature +++ /dev/null @@ -1,19 +0,0 @@ -# language: fr -@WORKSHOP @priority-1 -Fonctionnalité: Isolation protégée par connexions (ng-eventually) - En tant que développeur - Je veux valider, contre le vrai broker, que l'isolation est ACTIVE via le SDK : - un compte ne lit PAS l'entité PROTÉGÉE d'un autre compte tant qu'ils ne sont - pas connectés, la lit une fois qu'ils se connectent, et lit toujours l'entité - PUBLIQUE de cet autre compte — le tout appliqué par le SDK (filtre ReadCap + - déclaration de connexions), pas par un filtre applicatif. - - @data - Scénario: Un compte non connecté ne lit pas l'entité protégée d'un autre, puis la lit après connexion - Étant donné le wallet contient l'entité protégée du compte "alice" - Et le compte "bob" est courant sans connexion à "alice" - Alors "bob" ne voit aucune entité protégée d'"alice" - Mais "bob" voit l'entité publique d'"alice" - Quand l'app déclare la connexion entre "alice" et "bob" - Alors "bob" voit l'entité protégée d'"alice" - Et "bob" voit toujours l'entité publique d'"alice" diff --git a/src/modules/workshop/features/protected-store.feature b/src/modules/workshop/features/protected-store.feature deleted file mode 100644 index 72da3fd..0000000 --- a/src/modules/workshop/features/protected-store.feature +++ /dev/null @@ -1,20 +0,0 @@ -# language: fr -@WORKSHOP @priority-1 -Fonctionnalité: Store protected natif — ouverture et aller-retour (axe A) - En tant que développeur - Je veux vérifier, contre le vrai broker NextGraph, que le store natif protected - (`did:ng:${protected_store_id}`) s'ouvre pour lecture ET écriture comme le store - private, avant de basculer les entités du domaine vers lui (T02.h, axe A). - - # --- Data (broker réel) — ÉTAPE GATING --- - - @data - Scénario: L'ORM lit et écrit dans le store protected natif (aller-retour) - Étant donné le store protected natif est souscrit via l'ORM - Quand j'écris une participation dans le store protected via l'ORM - Alors la participation est lisible dans le store protected - - @data - Scénario: SPARQL fait l'aller-retour dans le store protected natif - Quand j'écris puis relis un triplet dans le store protected via SPARQL - Alors le triplet est retrouvé dans le store protected sans RepoNotFound diff --git a/src/modules/workshop/features/read-filter.feature b/src/modules/workshop/features/read-filter.feature deleted file mode 100644 index 804a8ae..0000000 --- a/src/modules/workshop/features/read-filter.feature +++ /dev/null @@ -1,17 +0,0 @@ -# language: fr -@WORKSHOP @priority-1 -Fonctionnalité: Filtre ReadCap (ng-eventually) - En tant que développeur - Je veux valider, contre le vrai broker, que le filtre de lecture de la lib - applique les ReadCap au niveau du DOCUMENT (le repo où vit chaque item) sur le - vrai set réactif de l'ORM : on ne voit un document que si on détient sa ReadCap. - En mono-store (tout dans un seul repo) c'est donc tout-ou-rien sur ce document - — le comportement fidèle de NextGraph. - - @data - Scénario: On ne voit un document que si on détient sa ReadCap - Étant donné le wallet contient des participations dans un document - Quand je gouverne ce document par une ReadCap accordée à un autre utilisateur - Alors l'utilisateur courant ne voit aucune participation de ce document - Quand l'utilisateur courant obtient la ReadCap du document - Alors il voit toutes les participations du document diff --git a/src/modules/workshop/steps/data/multibrowser.steps.ts b/src/modules/workshop/steps/data/multibrowser.steps.ts index 636ebce..bce72c8 100644 --- a/src/modules/workshop/steps/data/multibrowser.steps.ts +++ b/src/modules/workshop/steps/data/multibrowser.steps.ts @@ -9,81 +9,11 @@ import { pool } from '../../../../shared/support/browserPool'; // The wallet model is carried explicitly by the Given phrasing. // See brief_2026-06-15_shared-wallet-shim. -Given('un navigateur {string} avec son propre wallet', async function (this: FestipodWorld, name: string) { - const handle = await this.openBrowser(name, 'own'); - // Land on the local harness origin (no NG stack) so localStorage is available. - await handle.page.goto(`${pool.harnessUrl}/blank`, { waitUntil: 'domcontentloaded' }); -}); - Given('un navigateur {string} avec le wallet partagé', async function (this: FestipodWorld, name: string) { const handle = await this.openBrowser(name, 'shared'); await handle.page.goto(`${pool.harnessUrl}/blank`, { waitUntil: 'domcontentloaded' }); }); -// --- Parcours HUMAIN complet (e2e fidèle) --- -// Ouvre la VRAIE app en staging (gate ON), lit le code À L'ÉCRAN, l'importe sur -// nextgraph.eu, revient, clique « Entrer » → app connectée. C'est la garantie -// que Festipod remet à l'humain un code qui marche. Browser fixe "H". - -Given('un nouveau testeur ouvre Festipod en staging sur un navigateur vierge', async function (this: FestipodWorld) { - const url = await pool.ensureStagingApp(); - (this as any).stagingUrl = url; - const handle = await this.openBrowser('H', 'own'); // vierge, AUCUN wallet - await handle.page.goto(url, { waitUntil: 'domcontentloaded' }); - // L'écran d'accès (AccessGateScreen) doit s'afficher. - await handle.page.getByText('Entrer', { exact: true }).waitFor({ state: 'visible', timeout: 15000 }); -}); - -Then('Festipod affiche l\'écran d\'accès avec le portefeuille à télécharger', async function (this: FestipodWorld) { - const page = this.browser('H').page; - // Le fichier du portefeuille est proposé au téléchargement… - const downloadVisible = await page.locator('[data-testid=shared-wallet-download]').isVisible(); - expect(downloadVisible, 'le bouton de téléchargement du portefeuille doit être affiché').to.equal(true); - // …et le mot de passe partagé est affiché (c'est bien CELUI du wallet e2e). - const pwd = (await page.locator('[data-testid=shared-wallet-password]').innerText()).trim(); - expect(pwd, 'le mot de passe affiché doit être celui du wallet partagé').to.equal(pool.sharedWalletPassword); - (this as any).displayedPassword = pwd; -}); - -When('le testeur télécharge le portefeuille et l\'importe sur nextgraph.eu', async function (this: FestipodWorld) { - const page = this.browser('H').page; - // Télécharge le fichier DEPUIS l'écran Festipod (le vrai geste humain)… - const [download] = await Promise.all([ - page.waitForEvent('download'), - page.locator('[data-testid=shared-wallet-download]').click(), - ]); - const filePath = await download.path(); - // …et l'importe via "Import a Wallet File" avec le mot de passe lu à l'écran. - await pool.importWalletViaFile(page, filePath!, (this as any).displayedPassword); -}); - -When('le testeur revient sur Festipod, saisit un identifiant et clique « Entrer »', async function (this: FestipodWorld) { - const handle = this.browser('H'); - await handle.page.goto((this as any).stagingUrl, { waitUntil: 'domcontentloaded' }); - // Saisit son identifiant (il nomme l'espace virtuel) — « Entrer » reste désactivé - // tant qu'il est vide. Naming the space and opening the wallet are one act. - const idf = handle.page.locator('[data-testid=identifier-input]'); - await idf.waitFor({ state: 'visible', timeout: 15000 }); - await idf.fill('testeur'); - const entrer = handle.page.getByText('Entrer', { exact: true }); - await entrer.click(); // enregistre l'identifiant PUIS déclenche le redirect broker - await handle.page.waitForURL('**nextgraph**', { timeout: 20000 }).catch(() => {}); - // Le broker demande de déverrouiller le wallet fraîchement importé → son mot de - // passe (completeBrokerLogin attend la page de login wallet de façon robuste). - handle.appFrame = await pool.completeBrokerLogin(handle.page, (this as any).stagingUrl, pool.sharedWalletPassword); -}); - -Then('il arrive sur l\'accueil de l\'application', async function (this: FestipodWorld) { - const frame = this.browser('H').appFrame!; - // On atterrit sur /home (l'app), PAS sur l'onboarding hors-connexion ('/' - // WelcomeScreen « Rejoindre la communauté »). - await frame.waitForFunction( - () => window.location.pathname.endsWith('/home') && - !(document.body?.innerText ?? '').includes('Rejoindre la communauté'), - { timeout: 15000 }, - ); -}); - When('le navigateur {string} charge l\'application via le broker', async function (this: FestipodWorld, name: string) { // Drive the named browser through the broker into the NG harness iframe. // A 'shared' browser carries the wallet (storageState) → the broker recognises @@ -100,36 +30,3 @@ Then('le navigateur {string} est connecté à NextGraph', async function (this: { timeout: 30000 }, ); }); - -When('le navigateur {string} charge l\'origine du broker', async function (this: FestipodWorld, name: string) { - // Navigate top-level to the broker origin (nextgraph.net) — the exact origin - // where the NG wallet localStorage lives. Each fresh context has its own - // storage partition there too. - await this.browser(name).page.goto(pool.brokerOrigin, { waitUntil: 'domcontentloaded' }); -}); - -When( - 'j\'écris {string} sous la clé {string} dans le navigateur {string}', - async function (this: FestipodWorld, value: string, key: string, name: string) { - await this.browser(name).page.evaluate( - ([k, v]) => localStorage.setItem(k, v), - [key, value] as [string, string], - ); - }, -); - -Then( - 'la clé {string} vaut {string} dans le navigateur {string}', - async function (this: FestipodWorld, key: string, expected: string, name: string) { - const actual = await this.browser(name).page.evaluate((k) => localStorage.getItem(k), key); - expect(actual, `localStorage["${key}"] dans le navigateur ${name}`).to.equal(expected); - }, -); - -Then( - 'la clé {string} est absente dans le navigateur {string}', - async function (this: FestipodWorld, key: string, name: string) { - const actual = await this.browser(name).page.evaluate((k) => localStorage.getItem(k), key); - expect(actual, `localStorage["${key}"] dans le navigateur ${name} doit être isolé`).to.equal(null); - }, -); diff --git a/src/modules/workshop/steps/data/protected-connections.steps.ts b/src/modules/workshop/steps/data/protected-connections.steps.ts deleted file mode 100644 index a07bb38..0000000 --- a/src/modules/workshop/steps/data/protected-connections.steps.ts +++ /dev/null @@ -1,93 +0,0 @@ -import { Given, When, Then } from '@cucumber/cucumber'; -import { expect } from 'chai'; -import type { FestipodWorld } from '../../../../shared/support/world'; - -// Proves ISOLATION IS ACTIVE through the SDK (not a mere app filter): a PROTECTED -// ENTITY DOCUMENT owned by `alice` is hidden from an unconnected `bob`, revealed -// once the app declares the alice↔bob connection (declareConnections — the domain -// sharing act), while alice's PUBLIC document stays readable for bob regardless. -// Runs on the REAL ORM set via against the broker. -// -// The probed document is a real per-entity document (`createEntityDoc(owner, -// 'protected')`, rule_document-per-entity), NOT the protected STORE document: the -// unit of sharing is the document, and `declareConnections` hands over entity -// documents' keys. Handing over a store's key would give away everything it holds, -// present and future — the model refuses that, so a store-level probe can only ever -// read 0 after connecting. -// -// `alice` and `bob` are two GENUINELY DISTINCT identities: each is derived from the -// scenario's fresh identifier, so each gets its own account, its own scope stores, -// its own inbox and its own set of held keys. `bob` holds nothing of `alice`'s until -// a key is delivered to its inbox. - -/** The scenario's identity for a Gherkin handle ("alice"/"bob") — distinct per - * scenario, so nothing accumulates in the shared test wallet across runs. */ -function identityFor(world: FestipodWorld, handle: string): string { - return `${(world as any).freshIdentifier}-${handle}`; -} - -Given('le wallet contient l\'entité protégée du compte {string}', async function (this: FestipodWorld, owner: string) { - const ownerId = identityFor(this, owner); - // `owner` creates its OWN protected entity document and writes its entity into - // it — the creator is the one holding the key, no declaration involved. - const { total } = await this.appFrame!.evaluate( - (id: string) => (window as any).__testData.setupProtectedEntity(id), - ownerId, - ); - (this as any).pc = { owner: ownerId, total }; - expect(total, 'the protected entity document holds an entity').to.be.greaterThan(0); - // mounts over that document; wait for the reactive set to carry the - // entity while the OWNER is still the connected identity (it holds the key, so it - // reads its own document). Observes the pushed reactive state — no broker re-read. - await this.appFrame!.waitForFunction( - () => (window as any).__readFilter?.ready === true, - null, - { timeout: 15000 }, - ); - await this.appFrame!.waitForFunction( - (expected: number) => (window as any).__readFilter.snapshot().count === expected, - total, - { timeout: 20000 }, - ); -}); - -Given('le compte {string} est courant sans connexion à {string}', async function (this: FestipodWorld, reader: string, owner: string) { - const readerId = identityFor(this, reader); - const ownerId = identityFor(this, owner); - (this as any).pc = { ...(this as any).pc, reader: readerId, owner: ownerId }; - // `owner` publishes its public probe and hands the link to `reader`, who becomes - // the connected identity — holding no key of the protected entity document. - await this.appFrame!.evaluate( - (args: { owner: string; reader: string }) => - (window as any).__testData.governProtected(args.owner, args.reader), - { owner: ownerId, reader: readerId }, - ); -}); - -Then('{string} ne voit aucune entité protégée d\'{string}', async function (this: FestipodWorld, _reader: string, _owner: string) { - const snap = await this.appFrame!.evaluate(() => (window as any).__readFilter.snapshot()); - expect(snap.count, 'an unconnected reader sees none of the protected entity document').to.equal(0); -}); - -Then('{string} voit l\'entité publique d\'{string}', async function (this: FestipodWorld, _reader: string, _owner: string) { - const canRead = await this.appFrame!.evaluate(() => (window as any).__testData.canReadPublicProbe()); - expect(canRead, 'the public entity is readable regardless of connection').to.equal(true); -}); - -When('l\'app déclare la connexion entre {string} et {string}', async function (this: FestipodWorld, a: string, b: string) { - await this.appFrame!.evaluate( - (args: { a: string; b: string }) => (window as any).__testData.connect(args.a, args.b), - { a: identityFor(this, a), b: identityFor(this, b) }, - ); -}); - -Then('{string} voit l\'entité protégée d\'{string}', async function (this: FestipodWorld, _reader: string, _owner: string) { - const { total } = (this as any).pc; - const snap = await this.appFrame!.evaluate(() => (window as any).__readFilter.snapshot()); - expect(snap.count, 'a connected reader sees the whole protected entity document').to.equal(total); -}); - -Then('{string} voit toujours l\'entité publique d\'{string}', async function (this: FestipodWorld, _reader: string, _owner: string) { - const canRead = await this.appFrame!.evaluate(() => (window as any).__testData.canReadPublicProbe()); - expect(canRead, 'the public entity stays readable after connecting').to.equal(true); -}); diff --git a/src/modules/workshop/steps/data/protected-store.steps.ts b/src/modules/workshop/steps/data/protected-store.steps.ts deleted file mode 100644 index 7746cc7..0000000 --- a/src/modules/workshop/steps/data/protected-store.steps.ts +++ /dev/null @@ -1,57 +0,0 @@ -import { Given, When, Then } from '@cucumber/cucumber'; -import { expect } from 'chai'; -import type { FestipodWorld } from '../../../../shared/support/world'; - -// T02.h GATING — validate, against the REAL broker, that the native protected -// store (`did:ng:${protected_store_id}`) opens for ORM reads/writes AND SPARQL -// round-trips the same way private does (decision_2026-03-17). If either path -// hits RepoNotFound, the domain-scope switch MUST NOT happen (blocker). - -// --- Scenario 1: ORM round-trip on the protected store --- - -Given('le store protected natif est souscrit via l\'ORM', async function (this: FestipodWorld) { - await this.appFrame!.evaluate(() => (window as any).__testData.mountProtectedProbe()); - await this.appFrame!.waitForFunction( - () => (window as any).__protected?.ready === true, - null, - { timeout: 15000 }, - ); -}); - -When('j\'écris une participation dans le store protected via l\'ORM', async function (this: FestipodWorld) { - await this.appFrame!.evaluate(() => (window as any).__protected.add()); -}); - -Then('la participation est lisible dans le store protected', async function (this: FestipodWorld) { - await this.appFrame!.waitForFunction( - () => (window as any).__protected.count() >= 1, - null, - { timeout: 15000 }, - ); - const items = await this.appFrame!.evaluate(() => (window as any).__protected.items()); - expect(items.length, 'participation should be readable via ORM on the protected store').to.be.greaterThan(0); -}); - -// --- Scenario 2: SPARQL round-trip on the protected store --- - -When('j\'écris puis relis un triplet dans le store protected via SPARQL', async function (this: FestipodWorld) { - const res = await this.appFrame!.evaluate( - async () => await (window as any).__testData.protectedSparqlRoundTrip(), - ); - (this as any).protectedRoundTrip = res; -}); - -Then('le triplet est retrouvé dans le store protected sans RepoNotFound', function (this: FestipodWorld) { - const r = (this as any).protectedRoundTrip; - expect(r, 'round-trip result should exist').to.exist; - expect(r.protectedNuri, 'session should carry a protected_store_id').to.be.a('string'); - expect( - r.insertError, - `SPARQL INSERT into the protected store should not error (got: ${r.insertError})`, - ).to.equal(null); - expect( - r.queryError, - `SPARQL SELECT from the protected store should not error (got: ${r.queryError})`, - ).to.equal(null); - expect(r.count, 'the inserted triple should be read back from the protected store').to.be.greaterThan(0); -}); diff --git a/src/modules/workshop/steps/data/read-filter.steps.ts b/src/modules/workshop/steps/data/read-filter.steps.ts deleted file mode 100644 index f49dfe8..0000000 --- a/src/modules/workshop/steps/data/read-filter.steps.ts +++ /dev/null @@ -1,67 +0,0 @@ -import { Given, When, Then } from '@cucumber/cucumber'; -import { expect } from 'chai'; -import type { FestipodWorld } from '../../../../shared/support/world'; - -// Validates ng-eventually's READ FILTER (ReadCap) on the REAL ORM set, against -// the broker. The filter is per-DOCUMENT (an item's @graph = the repo it lives -// in): you see a document only if you hold its read cap. In mono-store, every -// participation shares one document, so governing it is all-or-nothing — the -// faithful NextGraph behavior. Two synthetic users discriminate cap possession, -// NOT the participation's own `user` field. - -Given('le wallet contient des participations dans un document', async function (this: FestipodWorld) { - // Deterministic: ensure ≥1 participation exists in the wallet document. - // joinEvent is idempotent on (event,user), so this doesn't accumulate. - await this.appFrame!.evaluate(async () => { - const td = (window as any).__testData; - // Store-root document (the one FilterProbe/governDocument govern) — use the - // RAW path so the participations land in `documentNuri`, not per-entity docs. - td.rawJoin('urn:rf:event', 'urn:rf:p1'); - td.rawJoin('urn:rf:event', 'urn:rf:p2'); - }); - await this.appFrame!.waitForFunction( - () => { - const ps = [...(window as any).__testData.rawParticipations]; - return ps.some((p: any) => p.user === 'urn:rf:p1') && ps.some((p: any) => p.user === 'urn:rf:p2'); - }, - null, - { timeout: 15000 }, - ); - const data = await this.appFrame!.evaluate(() => { - const td = (window as any).__testData; - // Raw set (no policy yet) → true total in the document. - return { total: [...td.rawParticipations].length, documentNuri: td.documentNuri }; - }); - (this as any).rf = { ...data, reader: 'urn:rf:alice', other: 'urn:rf:bob' }; - expect(data.total, 'the document holds participations').to.be.greaterThan(0); -}); - -When('je gouverne ce document par une ReadCap accordée à un autre utilisateur', async function (this: FestipodWorld) { - const { reader, other } = (this as any).rf; - // Grant the document's read cap to `reader`; current user is `other` (no cap). - await this.appFrame!.evaluate( - (args: { reader: string; user: string }) => (window as any).__testData.governDocument(args.reader, args.user), - { reader, user: other }, - ); - await this.appFrame!.waitForFunction( - () => (window as any).__readFilter?.ready === true, - null, - { timeout: 15000 }, - ); -}); - -Then('l\'utilisateur courant ne voit aucune participation de ce document', async function (this: FestipodWorld) { - const snap = await this.appFrame!.evaluate(() => (window as any).__readFilter.snapshot()); - expect(snap.count, 'a user without the read cap sees nothing of the document').to.equal(0); -}); - -When('l\'utilisateur courant obtient la ReadCap du document', async function (this: FestipodWorld) { - const { reader } = (this as any).rf; - await this.appFrame!.evaluate((u: string) => (window as any).__testData.setUser(u), reader); -}); - -Then('il voit toutes les participations du document', async function (this: FestipodWorld) { - const { total } = (this as any).rf; - const snap = await this.appFrame!.evaluate(() => (window as any).__readFilter.snapshot()); - expect(snap.count, 'the cap holder sees every participation of the document').to.equal(total); -}); diff --git a/src/shared/context/AccountContext.tsx b/src/shared/context/AccountContext.tsx deleted file mode 100644 index 18040d4..0000000 --- a/src/shared/context/AccountContext.tsx +++ /dev/null @@ -1,149 +0,0 @@ -/** - * AccountContext — the current identity of the stopgap. - * - * STOPGAP (see decision_2026-06-15_shared-wallet-login-flow.md). - * - * The user names their virtual space with an IDENTIFIER at the access barrier - * (AccessGateScreen), in the same act that opens the SHARED wallet — there is no - * separate app login. The identifier is a technical id (a pseudo in practice, - * not a Festipod display name): it is normalized (trimmed, `@`-stripped, - * lowercased) and carried across the broker round-trip. - * - * IDENTIFIER RESOLUTION — the `?id=` URL param is the SOURCE OF TRUTH. - * The shared-wallet flow runs the app in TWO contexts with TWO separate - * localStorage partitions: the top-level page (127.0.0.1) and the broker - * iframe (nextgraph.net) — the browser partitions storage by top-level site, - * so a value written top-level is NOT the value the iframe reads. localStorage - * cannot cross that boundary. But the `@ng-org/web` redirect embeds the FULL - * app URL (query included) in the broker `o=`, which is reloaded in the iframe - * — so a URL param DOES cross. Hence resolution priority: - * (1) `?id=` in the URL — wins whenever present (crosses the frontier); - * (2) else localStorage — same-partition convenience / prefill only. - * When the param is present it also gets persisted to localStorage (same - * partition, convenience) so a plain reload without the param still prefills. - * - * `login()` / `logout()` here only read/write that identifier in localStorage; - * they NEVER call NextGraph (ng.session_stop / wallet_close) — the shared wallet - * stays open underneath. The real logout lives, hidden, in Settings. - * - * The stored value IS the identity id handed to the SDK - * (`setCurrentUser(identifier)`); it is the key the caps and the shim account - * are keyed on. It holds this normalized identifier, not a mixed-case display - * handle. - * - * Default value is non-null so `useAccount()` never throws outside a provider - * (the @ui render harness wraps screens without this provider). - */ - -import { createContext, useContext, useState, useCallback, useMemo, useEffect, type ReactNode } from 'react'; -// The SDK's framework-agnostic IdentityStore persists the current identity id -// (localStorage-backed). This file keeps the React Context/Provider glue and the -// Festipod identifier handle; `normalizeIdentifier` (the handle → id mapping) is -// the app's own choice. See decision_2026-06-17_eventually-library. -import { accounts } from '@ng-eventually/client'; -// Set the current identity on the SDK: the app tells NextGraph WHO is reading, so -// the SDK returns only the data this identity is authorized to see (isolation is -// the SDK's job — see knowledge_trust-model). This is the SDK's "current -// identity" call, not an access rule the app enforces itself. -import { setCurrentUser } from '@ng-eventually/client/polyfill'; - -// Festipod localStorage key for the current identifier (same-partition -// prefill/convenience only — never the cross-frontier carrier; that's the URL -// param). Renamed to `.identifier` from a historical key that mislabeled this -// account id → any pre-existing stored logins under the old key are dropped -// (acceptable: this is a stopgap test env; the URL param carries identity anyway). -const STORAGE_KEY = 'festipod.account.identifier'; - -/** Name of the URL param that carries the identifier across the broker frontier. */ -const ID_PARAM = 'id'; - -/** Normalise an identifier handle into the identity id the SDK is given. */ -export function normalizeIdentifier(identifier: string | null | undefined): string { - return (identifier ?? '').trim().replace(/^@+/, '').toLowerCase(); -} - -/** Read the `?id=` URL param (source of truth), normalized. Null when absent. */ -function identifierFromUrl(): string | null { - if (typeof window === 'undefined') return null; - try { - const raw = new URLSearchParams(window.location.search).get(ID_PARAM); - if (raw == null) return null; - const norm = normalizeIdentifier(raw); - return norm.length > 0 ? norm : null; - } catch { - return null; - } -} - -export interface AccountContextValue { - /** App-level identity (the perceived "login"). null = not connected. */ - identifier: string | null; - /** Faux login — persists the identifier. No NextGraph call. */ - login: (identifier: string) => void; - /** Faux logout — clears the identifier only. No NextGraph call. */ - logout: () => void; -} - -/** Browser-safe storage (null in SSR → the store degrades to non-persisting). */ -function makeStore(): accounts.IdentityStore { - const ls = typeof window !== 'undefined' ? window.localStorage : null; - return new accounts.IdentityStore(ls, STORAGE_KEY); -} - -const AccountContext = createContext({ - identifier: null, - login: () => {}, - logout: () => {}, -}); - -export function AccountProvider({ children }: { children: ReactNode }) { - const store = useMemo(() => makeStore(), []); - // Resolution priority at init: (1) URL param `?id=` (source of truth, crosses - // the top-level↔iframe frontier), then (2) localStorage (same-partition - // convenience). The URL param wins whenever present. - const [identifier, setIdentifier] = useState(() => { - return identifierFromUrl() ?? store.get(); - }); - - // If the URL param is present, it is authoritative: persist it to localStorage - // (same partition, convenience for a subsequent plain reload without the param) - // so the store and the resolved identity agree. Runs once at mount. - useEffect(() => { - const fromUrl = identifierFromUrl(); - if (fromUrl && fromUrl !== store.get()) { - store.set(fromUrl); - } - // eslint-disable-next-line react-hooks/exhaustive-deps - }, []); - - // Tell the SDK who the current identity is, on mount and whenever the account - // changes (login/logout). The SDK uses it to gate reads to what this identity - // may see; the app performs no access check of its own. Normalize the - // identifier handle into the identity id everything else uses. - useEffect(() => { - setCurrentUser(identifier ? normalizeIdentifier(identifier) : null); - }, [identifier]); - - const login = useCallback((name: string) => { - // The identifier is normalized (trimmed, `@`-stripped, lowercased) at the - // door, so the stored value IS the identity id — the same key the SDK, the - // caps and the shim account are keyed on. No mixed-case handle to reconcile. - const next = store.set(normalizeIdentifier(name)); - if (next) setIdentifier(next); - }, [store]); - - const logout = useCallback(() => { - store.clear(); - setIdentifier(null); - }, [store]); - - return ( - - {children} - - ); -} - -export function useAccount(): AccountContextValue { - return useContext(AccountContext); -} diff --git a/src/shared/context/FestipodDataContext.tsx b/src/shared/context/FestipodDataContext.tsx index 791f545..0fba0f3 100644 --- a/src/shared/context/FestipodDataContext.tsx +++ b/src/shared/context/FestipodDataContext.tsx @@ -8,7 +8,6 @@ import type { FpNotificationData, } from '../data/types'; import { - hostInboxNuri, depositRegistration, depositLeave, buildNotification, @@ -19,8 +18,8 @@ import { countUserParticipations, canonicalEventId, } from '../data/registration'; -import { inbox, isNuri } from '@ng-eventually/client'; -import type { Nuri } from '@ng-eventually/client'; +import { inbox } from '@ng-eventually/polyfill'; +import type { Nuri } from '@ng-eventually/polyfill'; import { CURRENT_USER_ID, seedEvents, @@ -30,12 +29,16 @@ import { seedFriendships, } from '../data/seedData'; import { useNextGraph } from './NextGraphContext'; -import { useAccount, normalizeIdentifier } from './AccountContext'; +import { normalizeIdentifier } from '../utils/identifier'; // Relationship is a Festipod concept: the app keeps its own bilateral registry // and shares its own documents' keys with its neighbours (see shared/utils/connections). import { declareConnections } from '../utils/connections'; -import { listMyEntityDocs, createEntityDoc, resetRegistryCache } from '../utils/storeRegistry'; -import { resetCaps } from '@ng-eventually/client/polyfill'; +import { + listMyEntityDocs, + createEntityDoc, + openDocumentInbox, +} from '../utils/storeRegistry'; +import { useCurrentPrincipal } from '../utils/currentPrincipal'; import { useShapeQuery } from '../data/useShapeQuery'; import { adaptEvents, adaptUsers, adaptParticipations } from '../data/shapeAdapters'; import { @@ -54,6 +57,13 @@ import { autoSeedEnabled, shouldAutoSeed } from '../utils/autoSeed'; interface FestipodDataContextValue { currentUserId: string; currentUser: FpUserData | undefined; + /** + * WHO THE SESSION SIGNED IN AS — the identity `ensureIdentity()` returned, + * known before any document is read. For DISPLAY (and log attribution) only: + * it is a different id space from `currentUserId` (a profile document NURI), + * it is never written into an entity, and no data call takes it. + */ + currentPrincipal: string; events: FpEventData[]; users: FpUserData[]; @@ -99,15 +109,16 @@ function nextId(prefix: string): string { return `${prefix}-${++idCounter}`; } -// The STABLE user-principal prefix. A Participation stores its user (`fp:user`) as -// this principal derived from the login identifier — `urn:festipod:user:` — -// NOT as the UserProfile's `did:ng:` document NURI. `currentUserId` is minted with -// the SAME prefix below, so a participation keyed on it stays consistent with the -// identity the SDK/caps derive. The single source of truth for the prefix, shared -// by the WRITE (currentUserId) and the READ (resolveParticipantUser) so they never -// drift. +// LEGACY, READ ONLY. Participations written by an older version key their user +// (`fp:user`) as `urn:festipod:user:` instead of the UserProfile's `did:ng:` +// document NURI. Nothing MINTS this any more — today's writes carry the profile +// NURI (`currentUserId`) — but `resolveParticipantUser` must still recognize the +// old form, or those participations render as "participant inconnu". const USER_PRINCIPAL_PREFIX = 'urn:festipod:user:'; +/** Waits between attempts at resolving the owned-event set (see its effect). */ +const OWNED_RETRY_BACKOFF_MS = [500, 1500, 4000]; + /** * Resolve a Participation's `fp:user` to its UserProfile across the TWO id spaces * that meet at this join (the root cause of the "unknown participant" bug): @@ -198,7 +209,6 @@ function buildQueries( // ============================================================================ function useLocalData(empty?: boolean): FestipodDataContextValue { - const { identifier } = useAccount(); const [selectedEventId, setSelectedEventId] = useState(empty ? '' : 'event-1'); const [selectedUserId, setSelectedUserId] = useState(''); @@ -208,15 +218,16 @@ function useLocalData(empty?: boolean): FestipodDataContextValue { const meetingPoints = empty ? [] : seedMeetingPoints; const friendships = empty ? [] : seedFriendships; - // Resolve current user from the chosen account identifier; fall back to the - // demo default so @ui tests and standalone dev keep working unchanged. - const accountUser = identifier - ? users.find(u => normalizeIdentifier(u.username) === normalizeIdentifier(identifier)) - : undefined; - const currentUserId = empty ? '' : (accountUser?.id ?? CURRENT_USER_ID); - // Identity-first log prefix: current user id when resolved, else the bare - // `[app][data]` form (e.g. the transient `empty` connecting state). - const logPrefix = currentUserId ? `[${currentUserId}][app][data]` : '[app][data]'; + // Demo mode has a single fixture user — the app names no identity of its own. + const currentUserId = empty ? '' : CURRENT_USER_ID; + // Who signed in, when the barrier has settled. Demo mode reads no document, so + // this is the only real identity it can attribute a log line to. + const currentPrincipal = useCurrentPrincipal(); + // Identity-first log prefix: the fixture user when there is one, else the + // signed-in principal, else the bare `[app][data]` form. + const logPrefix = currentUserId || currentPrincipal + ? `[${currentUserId || currentPrincipal}][app][data]` + : '[app][data]'; const currentUser = users.find(u => u.id === currentUserId); const selectedEvent = events.find(e => e.id === selectedEventId); const selectedUser = users.find(u => u.id === selectedUserId); @@ -256,7 +267,7 @@ function useLocalData(empty?: boolean): FestipodDataContextValue { }, []); return { - currentUserId, currentUser, + currentUserId, currentUser, currentPrincipal, events, users, participations, meetingPoints, friendships, notifications: [], selectedEventId, setSelectedEventId, selectedEvent, @@ -273,7 +284,6 @@ function useLocalData(empty?: boolean): FestipodDataContextValue { function useNgData(): FestipodDataContextValue { const { session } = useNextGraph(); - const { identifier } = useAccount(); // The app speaks ONLY in logical scopes — it holds no store id and builds no // `did:ng:${…}` NURI. It creates ONE document PER ENTITY in its scope // (`createEntityDoc(scope)`, the SDK create) and READS via the SDK's reactive, @@ -380,39 +390,15 @@ function useNgData(): FestipodDataContextValue { const readReady = eventQuery.isSuccess && userQuery.isSuccess && partQuery.isSuccess; - // IDENTITY SWITCH = FRESH SESSION (isolation). The shared-wallet stopgap keeps - // ONE React tree across a faux logout + re-login under a DIFFERENT identifier (no - // page reload — see AuthGate/AccountContext). `watchShape` re-resolves its scope - // to the new `getCurrentUser()` on the next container/index push, but the - // emulated caps + registry cache and the app-side owned-events set must be reset - // so nothing from the old identity lingers. Ref-guarded so it fires only on a - // real change, not on the first mount. // Session-local map `${eventId}|${userId}` → the join deposit's uid, so a leave // in the SAME session can carry `regUid` for a precise cancellation. Absent it // (cross-session leave), the owner's materializer falls back to (event, user) // matching — so this is an optimization, not a correctness dependency. + // + // Nothing ever clears this map, and nothing needs to: a browser context is one + // user for its whole life (`ensureIdentity()` answers once, before anything + // renders), so there is never anyone else's leftovers in it. const joinUidsRef = useRef>(new Map()); - const prevOwnerRef = useRef(undefined); - useEffect(() => { - if (prevOwnerRef.current === undefined) { - prevOwnerRef.current = identifier; - return; - } - if (prevOwnerRef.current === identifier) return; - prevOwnerRef.current = identifier; - // Fresh session for the new identity: reset the emulated isolation state and - // the owned-events set. `watchShape` re-resolves reads for the new identity on - // its own (scope re-resolution keyed on `getCurrentUser()`). - setOwnedEventIds([]); - joinUidsRef.current.clear(); - // Drop the optimistic overlay too: it belongs to the OLD identity's session - // and must not bleed into the new identity's reads (isolation). - setPendingAddEvents([]); - setPendingAddParticipations([]); - setPendingRemoveIds(new Set()); - resetCaps(); - resetRegistryCache(); - }, [identifier]); // OPTION B — the set of event docs the CURRENT identity OWNS (its own public // event docs). Each such NURI IS the event `@id` (writeEntity uses the doc NURI @@ -420,26 +406,65 @@ function useNgData(): FestipodDataContextValue { // and writes `participantCount` on THAT (owned) doc — never on someone else's. const [ownedEventIds, setOwnedEventIds] = useState([]); + /** + * Fold documents THIS SESSION just created into the owned set. + * + * The backfill below runs once, on connection, so it only ever knows what + * existed at mount. Everything created afterwards has to announce itself, or it + * is owned in fact and unowned as far as this tree is concerned — and the + * owner-materializer, which only ever looks at this set, never runs on it. + */ + const claimOwnedEventDocs = useCallback((created: Nuri[]) => { + if (created.length === 0) return; + setOwnedEventIds(prev => [...new Set([...prev, ...created])]); + }, []); + // Resolve the CURRENT identity's owned public event docs for the materializer // ONLY (decoupled from the read — `watchShape` resolves reads itself). Bounded to - // the current account (`listMyEntityDocs(owner, 'public')`, NO cross-account - // fan-out). Runs on (re)login to backfill events owned before this mount; - // `createEvent` appends freshly-created events directly. This is NOT a read path - // (it feeds no `events`/`users`/`participations`), only the owner-count derivation. + // this session's own documents (`listMyEntityDocs('public')` — "mine" needs no + // identity, the session is one user's). Runs on connection to backfill events + // owned before this mount; `createEvent` and the seed (`loadTestData` / + // auto-seed) claim what they create through `claimOwnedEventDocs`. This is NOT a + // read path (it feeds no `events`/`users`/`participations`), only the + // owner-count derivation. + // + // A REJECTION HERE MEANS "UNKNOWN", NEVER "THIS SESSION OWNS NOTHING". The two + // are indistinguishable downstream — both leave the set empty — but only one of + // them is true, and taking the wrong one silently disables the owner + // materializer, so every event this session hosts stops converging. So the + // failure is RETRIED, and if it still will not answer, it is said loudly instead + // of leaving a plausible-looking empty set behind. useEffect(() => { - if (!ready || !identifier) return; + if (!ready) return; let cancelled = false; (async () => { - try { - const myPublic = await listMyEntityDocs(identifier, 'public'); - if (cancelled) return; - setOwnedEventIds(prev => [...new Set([...prev, ...myPublic])]); - } catch (err) { - console.error(`${logPrefix} owned-events resolution failed:`, err); + for (let attempt = 0; !cancelled; attempt++) { + try { + const myPublic = await listMyEntityDocs('public'); + if (cancelled) return; + setOwnedEventIds(prev => [...new Set([...prev, ...myPublic])]); + return; + } catch (err) { + const wait = OWNED_RETRY_BACKOFF_MS[attempt]; + if (wait === undefined) { + console.error( + `${logPrefix} owned-events resolution FAILED after ${OWNED_RETRY_BACKOFF_MS.length + 1} ` + + `attempts — the owned set is UNKNOWN, not empty, and events hosted by this session ` + + `will not converge until it is known:`, + err, + ); + return; + } + console.warn( + `${logPrefix} owned-events resolution failed (attempt ${attempt + 1}) — retrying in ${wait}ms:`, + err, + ); + await new Promise(r => setTimeout(r, wait)); + } } })(); return () => { cancelled = true; }; - }, [ready, identifier]); + }, [ready]); // Not in SHEX shapes yet const [meetingPoints, setMeetingPoints] = useState([]); @@ -484,35 +509,57 @@ function useNgData(): FestipodDataContextValue { // Enabled AND synced-empty → a real empty wallet. Seed once. hasTriedAutoSeed.current = true; console.log(`${logPrefix} Auto-seed (FESTIPOD_AUTO_SEED): wallet empty (synced), bootstrapping…`); - bootstrapWallet(false, createEntityDoc, identifier || undefined) + bootstrapWallet(false, createEntityDoc) + // The seed's public event docs were created BY THIS SESSION — they are mine. + .then(result => claimOwnedEventDocs(result.createdDocs.public)) .catch(err => console.error(`${logPrefix} Auto-seed failed:`, err)); // The reactive `watchShape` reads pick the seeded per-entity docs up on their // own (each createEntityDoc appends to the scope index → the container-index // subscription re-resolves → the new docs enter the read). No registerDoc/relist. - }, [ready, readReady, events.length, users.length, identifier]); + }, [ready, readReady, events.length, users.length, claimOwnedEventDocs]); // --- Derived --- - // Resolve current user from the chosen account identifier (the perceived - // login); fall back to the legacy default while the account layer hydrates. + // WHO AM I — answered in TWO id spaces that must not be confused. + // + // (1) `currentPrincipal` — what signing in returned. Known as soon as the one + // identity await settles, i.e. before any document has been read. It names + // a PERSON. It is for display and log attribution; no data call takes it, + // and it is never written into an entity. + // (2) `currentUserId` — the app's own entity space: the `@id` of the profile + // DOCUMENT read back in the protected scope (a doc NURI). This is what a + // Participation's `fp:user` carries and what `resolveParticipantUser` + // matches directly, so it is the only value a mutation may write. It stays + // empty until the protected read lands — mutations that need it refuse + // rather than write an entity the read would drop. + // + // THE JOIN between the two is explicit and lives HERE, in one place: a profile + // belongs to the signed-in person when its username normalizes to the + // principal — the same bridge `resolveParticipantUser` uses for the legacy + // `urn:festipod:user:` space. Nothing merges the spaces: the principal selects + // a profile, it never stands in for one. + const currentPrincipal = useCurrentPrincipal(); const currentUser = - (identifier ? users.find(u => normalizeIdentifier(u.username) === normalizeIdentifier(identifier)) : undefined) + (currentPrincipal + ? users.find(u => u.username && normalizeIdentifier(u.username) === currentPrincipal) + : undefined) + // No profile answers to the signed-in person (the wallet holds fixtures, or + // the profile read has not landed): fall back to the demo-seed pick. KNOWN + // HAZARD — this GUESSES a profile, so the app can show the wrong person as + // "you" while the real answer has simply not been read yet. Note what is and + // is not guessed: the identity itself never is (it is exactly what + // `ensureIdentity()` returned); only the profile it selects can be wrong. || users.find(u => u.username === '@mariedupont') || users[0]; - // The current user's PRINCIPAL. When logged in, this is a STABLE - // identifier-derived id (`urn:festipod:user:`) — - // available IMMEDIATELY (no dependency on the protected profile read, which can - // lag) and INVARIANT (it never flips from a fallback to the profile IRI - // mid-session, which would desync a participation written under one value from - // a check under the other). It is the SAME principal the SDK identity - // (`setCurrentUser`) and the cap owner derive from the identifier, so - // participations keyed on it are consistent with reads and isolation. Falls - // back to the read profile's IRI only when there is no login (dev/demo). - const currentUserId = - (identifier ? `${USER_PRINCIPAL_PREFIX}${normalizeIdentifier(identifier)}` : (currentUser?.id || '')); + const currentUserId = currentUser?.id || ''; // Identity-first log prefix, reused by every DATA log below (including the // closures defined earlier in this function body — they only execute after - // this render has finished, by which point `logPrefix` is initialized). - const logPrefix = currentUserId ? `[${currentUserId}][app][data]` : '[app][data]'; + // this render has finished, by which point `logPrefix` is initialized). Several + // browser contexts can be tailed at once, so a line must say WHOSE it is: the + // profile NURI once it is read, and the signed-in principal before that — which + // is now from the very first render, instead of the anonymous `[app][data]`. + const logPrefix = currentUserId || currentPrincipal + ? `[${currentUserId || currentPrincipal}][app][data]` + : '[app][data]'; const selectedEvent = events.find(e => e.id === selectedEventId); // DISPLAY READ — log participantCount exactly as currently exposed for // rendering. Compared against the owner-materializer's WRITE logs below, this @@ -534,11 +581,8 @@ function useNgData(): FestipodDataContextValue { // writing the event doc: the joiner only deposits; the owner counts. // // Reactive, no polling: subscribe the inbox document via `inbox.watch` (a - // `doc_subscribe` push). Today all events share ONE inbox anchor (`hostInboxNuri` - // ignores the eventId → `resolveInboxAnchor()`), so ONE subscription serves all - // my owned events; each push re-materializes every owned event from the full - // deposit list. At per-event-inbox migration this fans to one watch per owned - // event (still one doc each). + // `doc_subscribe` push). One watch PER owned event: each event has its OWN + // inbox, whose address its owner obtains with `openDocumentInbox`. // // IDEMPOTENCE / CONVERGENCE: the count is DERIVED from the SET of distinct // active registrations (`materializeAttendance`: distinct join uids MINUS @@ -586,9 +630,10 @@ function useNgData(): FestipodDataContextValue { ); const notifs: FpNotificationData[] = []; for (const evId of owned) { - // Each event has its OWN inbox document (`documentInbox`), resolved from - // the event doc I own. There is no anchor common to every event any more. - const targetInbox = await hostInboxNuri(evId); + // Each event has its OWN inbox, and only its OWNER can open it. This + // call returns the address the owner reads and watches; a depositor + // never sees it (they name the document instead). + const targetInbox = await openDocumentInbox(evId); // BEFORE — the event's readable detail (short id + title) and the // participantCount value as currently READ/exposed (the app-side `events` // state), captured before this cycle's derive+write. Comparing this to the @@ -683,7 +728,7 @@ function useNgData(): FestipodDataContextValue { const unsubscribes: Array<() => void> = []; (async () => { for (const evId of owned) { - const targetInbox = await hostInboxNuri(evId); + const targetInbox = await openDocumentInbox(evId); if (cancelled) return; unsubscribes.push(inbox.watch(targetInbox, () => void materialize('inbox-push'))); } @@ -702,18 +747,15 @@ function useNgData(): FestipodDataContextValue { // the resulting per-document grants. No store id, no document NURI crosses here. useEffect(() => { if (!ready || !currentUserId) return; - // Connection ids must be the SAME key space as the cap owners: each doc is - // opened with `normalizeIdentifier(owner)`, and the reader identity is set via - // `setCurrentUser(normalizeIdentifier(identifier))`. The app models - // friendships with user IRIs, so map each peer IRI → its id key before - // declaring, and assert AS the current user's id key. Peers with no known id - // are skipped (can't be keyed). This is what makes "protected = my bilateral - // connections" actually discriminate in @data. + // `inbox.share(doc, toUser)` names a PERSON, so the app models both sides of + // a relationship in ONE key space: the normalized profile username. It maps + // each peer IRI → that key before declaring, and asserts AS its own key. + // Peers with no known profile are skipped (they cannot be named). const idKeyOf = (userIri: string): string | undefined => { const u = users.find(x => x.id === userIri); return u?.username ? normalizeIdentifier(u.username) : undefined; }; - const selfKey = identifier ? normalizeIdentifier(identifier) : idKeyOf(currentUserId); + const selfKey = idKeyOf(currentUserId); if (!selfKey) return; const myPeers = friendships .filter(f => f.userId === currentUserId || f.friendId === currentUserId) @@ -724,7 +766,7 @@ function useNgData(): FestipodDataContextValue { // fire-and-forget from this effect — nothing downstream waits on it. void declareConnections(myPeers, selfKey) .catch(err => console.error(`${logPrefix} declareConnections failed:`, err)); - }, [ready, friendships, currentUserId, users, identifier]); + }, [ready, friendships, currentUserId, users]); const queries = buildQueries( events, users, participations, meetingPoints, friendships, currentUserId, @@ -744,18 +786,23 @@ function useNgData(): FestipodDataContextValue { const createEvent = useCallback(async (event: Omit): Promise => { console.log(`${logPrefix} createEvent (NG):`, event.title); - // Owner principal = the account identifier (what setCurrentUser declares). The - // SDK create returns THIS entity's OWN public document and declares its - // ReadCap policy (public → world-readable). Fall back to a generic account - // label when no login is present (dev/demo). - const owner = identifier || currentUserId || 'anon'; + // The SDK create returns THIS entity's OWN public document and declares its + // access policy (public → world-readable). Placement is named by SCOPE + // alone: the session belongs to one user, so there is no owner to name. + // A creation that cannot be recorded THROWS — it never hands back a + // reference that would read empty forever — so this rejects the whole + // `createEvent` rather than returning a half-made event. // Create the event's OWN document in the PUBLIC scope (one doc per entity), // then WRITE the event RDF DIRECTLY into that document (writeEntity) — not via // the scope-coupled `ngSet.add`, which can't write into a not-yet-subscribed // per-entity doc against the real broker. The doc's NURI is appended to the // public scope index, which `watchShape('public')` subscribes → the event // enters the reactive read on the push. The written subject IRI is the `@id`. - const eventGraph = await createEntityDoc(owner, 'public'); + const eventGraph = await createEntityDoc('public'); + // An event is a document people SIGN UP TO, so its owner opens its inbox + // here, at creation. A document only HAS one if its owner opened it; without + // this, a registrant's deposit would have nothing to reach. + await openDocumentInbox(eventGraph); const eventId = await writeEntity(eventGraph, ENTITY_TYPE.event, { title: str(event.title), description: str(event.description), date: str(event.date), location: str(event.location), distance: flt(event.distance), @@ -793,7 +840,7 @@ function useNgData(): FestipodDataContextValue { // work. Until it lands, a created event is reachable by its creator only. } return { ...event, id: addedEvent?.["@id"] || `ng-pending-${Date.now()}` }; - }, [currentUserId, identifier]); + }, [currentUserId]); const updateEvent = useCallback(async (id: string, updates: Partial) => { console.log(`${logPrefix} updateEvent (NG):`, id, updates); @@ -801,13 +848,8 @@ function useNgData(): FestipodDataContextValue { // it is both the write graph and the subject. Persist each provided mutable // field DIRECTLY via SPARQL (the durable write); `watchShape` re-reads on the // resulting broker push (the doc is already subscribed) — no manual re-query. - // `id` reaches us as a plain domain string (it was read back off a document), - // so narrow it here — the boundary where an untyped string becomes a NURI. - // Anything that is not one names no document and cannot be written to. - if (!isNuri(id)) { - console.error(`${logPrefix} updateEvent: "${id}" is not a document NURI — nothing to write.`); - return; - } + // No pre-flight NURI guard: every SDK entry takes the reference as it stands + // and validates at its own door. const graph = id; const persists: Promise[] = []; if (updates.participantCount !== undefined) { @@ -837,18 +879,24 @@ function useNgData(): FestipodDataContextValue { // The reactive participation set can lag a just-written participation, so a // second join checking only the set would write a DUPLICATE (breaking "exactly // one participation"). The broker query sees the real state regardless of lag. - const already = await countUserParticipations(identifier || uid || 'anon', eventId, uid).catch(() => 0); + // + // A FAILED count is UNKNOWN, not zero, so it is NOT caught here: reading it as + // "not participating yet" is precisely how a duplicate gets written. The + // rejection propagates out of `joinEvent`, and the screen that called it says + // the sign-up could not be recorded — which is the truth. + const already = await countUserParticipations(eventId, uid); if (already > 0) { console.log(`${logPrefix} Already participating (broker-confirmed), skipping`); return; } // 1) Persist the Participation as its OWN document in the PROTECTED scope - // (one doc per entity). Owner = the account identifier (setCurrentUser key). - // Its NURI is appended to the protected scope index, which - // `watchShape('protected')` subscribes → the participation enters the - // reactive read on the push. - const owner = identifier || uid || 'anon'; - const partGraph = await createEntityDoc(owner, 'protected'); + // (one doc per entity). Its NURI is appended to the protected scope index, + // which `watchShape('protected')` subscribes → the participation enters + // the reactive read on the push. + // A creation that cannot be recorded THROWS, so a failure here rejects + // `joinEvent` instead of depositing a registration for a participation + // document that would read empty forever. + const partGraph = await createEntityDoc('protected'); // WRITE the participation RDF DIRECTLY into its own document (writeEntity) — // not via the scope-coupled `ngSet.add` (can't write a not-yet-subscribed // per-entity doc against the real broker). The written subject is the @@ -883,14 +931,8 @@ function useNgData(): FestipodDataContextValue { // we key the host inbox/notification on the eventId (the host of THAT // event). This is the domain injection the generic lib deliberately omits. const recipientId = eventId; - // The event's `@id` IS its document NURI, and that document is what carries - // the inbox. `eventId` arrives as a plain string (a caller's argument), so - // narrow it here — the boundary. Throwing lands in this block's own catch, - // which is already the "deposit is best-effort" contract. - if (!isNuri(eventId)) { - throw new Error(`event id "${eventId}" is not a document NURI — no event inbox to deposit into`); - } - const targetInbox = await hostInboxNuri(eventId); + // The event's `@id` IS its document NURI, and a deposit NAMES that document + // — the joiner resolves no inbox and holds no address. // Carry the joiner's participation-doc NURI so the owner (if a connection) // could read it in clear; the count itself does not depend on reading it. console.log( @@ -898,15 +940,18 @@ function useNgData(): FestipodDataContextValue { `event=${canonicalEventId(eventId)} user=${uid} (count now moves via the OWNER ` + `materializing this deposit on its own doc, at its next connection)`, ); - const { ts, uid: depositUid } = await depositRegistration(targetInbox, eventId, registrantId, partGraph); + const { ts, uid: depositUid } = await depositRegistration(eventId, registrantId, partGraph); // Remember the join uid so a same-session leave can cancel it precisely. joinUidsRef.current.set(`${eventId}|${uid}`, depositUid); const notif = buildNotification(recipientId, eventId, registrantId, ts); // The host FpNotification is its OWN document in the PROTECTED scope (one - // doc per entity). Best-effort — the inbox materialization is the source of - // truth; this direct write only pre-warms the reactive read. - const notifGraph = await createEntityDoc(owner, 'protected'); - await insertNotification(notifGraph, notif).catch(() => { /* data-level best-effort */ }); + // doc per entity). The inbox materialization remains the source of truth; + // this direct write only pre-warms the reactive read — but a FAILED write is + // not swallowed: it used to be dropped silently, and the line below then + // surfaced a notification nothing had recorded. The rejection reaches the + // catch under this block, which names it. + const notifGraph = await createEntityDoc('protected'); + await insertNotification(notifGraph, notif); // Surface immediately in reactive state (materialization also refreshes it). // Use the stable per-deposit uid for the id (F5 dedup) so it matches the // notification id from the inbox and same-ms/anon deposits never collide. @@ -914,7 +959,7 @@ function useNgData(): FestipodDataContextValue { } catch (err) { console.error(`${logPrefix} joinEvent inbox/notify failed:`, err); } - }, [events, currentUserId, identifier]); + }, [events, currentUserId]); const leaveEvent = useCallback(async (eventId: string, userId?: string) => { const uid = userId || currentUserId; @@ -929,13 +974,7 @@ function useNgData(): FestipodDataContextValue { // removes the Participation server-side so it does NOT resurrect after re-sync. // The delete targets the participation's own document (part.id) and is // identified by its OWN subject IRI (part.id), not a string-match on object IRIs. - // `part.id` was read back off a document, so narrow it here (the boundary) — - // a value that names no document cannot be the delete's anchor. const graphNuri = part.id; - if (!isNuri(graphNuri)) { - console.error(`${logPrefix} leaveEvent: participation id "${graphNuri}" is not a document NURI — refusing to delete.`); - return; - } const subjectIri = part.id; let result; try { @@ -979,12 +1018,8 @@ function useNgData(): FestipodDataContextValue { // is derived from the SET of distinct active registrations, not from −1). try { const registrantId = uid || null; - // Same boundary as `joinEvent`: narrow the event id before resolving the - // document's inbox; the throw lands in this block's own best-effort catch. - if (!isNuri(eventId)) { - throw new Error(`event id "${eventId}" is not a document NURI — no event inbox to deposit into`); - } - const targetInbox = await hostInboxNuri(eventId); + // Same as `joinEvent`: the leave marker NAMES the event document; no inbox + // address is resolved on the depositor's side. // Carry the join uid when this session minted it (precise cancellation); // otherwise the owner falls back to (eventId, userId) matching. const regUid = joinUidsRef.current.get(`${eventId}|${uid}`); @@ -992,7 +1027,7 @@ function useNgData(): FestipodDataContextValue { `${logPrefix} leaveEvent — depositing participation leave marker into event inbox: ` + `event=${canonicalEventId(eventId)} user=${uid} regUid=${regUid ?? '(none)'}`, ); - await depositLeave(targetInbox, eventId, registrantId, regUid); + await depositLeave(eventId, registrantId, regUid); joinUidsRef.current.delete(`${eventId}|${uid}`); } catch (err) { console.error(`${logPrefix} leaveEvent inbox deposit failed:`, err); @@ -1001,7 +1036,7 @@ function useNgData(): FestipodDataContextValue { // DELETE pushes → the reactive read drops it (`isParticipating` reflects it). // The count itself follows the owner's materialization of the leave marker // (reactive, cross-session). - }, [participations, events, currentUserId, identifier]); + }, [participations, events, currentUserId]); const addMeetingPoint = useCallback((mp: Omit) => { setMeetingPoints(prev => [...prev, { ...mp, id: `ng-mp-${Date.now()}` }]); @@ -1022,13 +1057,7 @@ function useNgData(): FestipodDataContextValue { // The current user's profile is its own document (subject IRI = doc NURI). const target = currentUser ?? users[0]; if (!target) return; - // Same boundary as `updateEvent`: the profile `@id` comes back as a plain - // string from the read, so narrow it before it is used as a write target. const graph = target.id; - if (!isNuri(graph)) { - console.error(`${logPrefix} updateProfile: "${graph}" is not a document NURI — nothing to write.`); - return; - } const persists: Promise[] = []; if (updates.name !== undefined) persists.push(updateEntityField(graph, graph, 'name', str(updates.name))); if (updates.initials !== undefined) persists.push(updateEntityField(graph, graph, 'initials', str(updates.initials))); @@ -1045,15 +1074,20 @@ function useNgData(): FestipodDataContextValue { // the window where the auto-seed effect could also fire on a still-empty read). hasTriedAutoSeed.current = true; const walletHasData = events.length > 0 || users.length > 0; - const result = await bootstrapWallet(walletHasData, createEntityDoc, identifier || undefined); + const result = await bootstrapWallet(walletHasData, createEntityDoc); // The seeded per-entity docs are appended to their scope indices, which // `watchShape` subscribes → they enter the reactive reads on the push. No // manual registration / re-list. + // OWNERSHIP is a different question from READING, and it is not answered by + // the push: these public event docs were created by THIS session, so claim + // them — otherwise the owner-materializer never opens their inboxes and their + // `participantCount` is never derived. + claimOwnedEventDocs(result.createdDocs.public); return result; - }, [events.length, users.length, identifier]); + }, [events.length, users.length, claimOwnedEventDocs]); return { - currentUserId, currentUser, + currentUserId, currentUser, currentPrincipal, events, users, participations, meetingPoints, @@ -1083,15 +1117,28 @@ function NgDataProvider({ children }: { children: ReactNode }) { export function FestipodDataProvider({ children }: { children: ReactNode }) { const { status } = useNextGraph(); - // No identity resolved at this level (only NG connection status is known here) — - // identity-first prefix falls back to the bare `[app][data]` form. - console.log('[app][data] Provider — NG status:', status); + // SIGNING IN MUST HAVE SETTLED BEFORE THE DATA PROVIDER STARTS. Every call the + // NG provider makes addresses "MY documents" — placement by scope + // (`createEntityDoc` / `listMyEntityDocs`) and the reactive scope reads alike — + // and there is no "my" until `ensureIdentity()` has answered. Being CONNECTED is + // not being SIGNED IN: the session opens first, the identity settles after. A + // provider mounted in between fires its reads and its owned-documents + // resolution against no identity — they fail once, at mount, and the memoized + // observables never retry, so the screens stay empty for the whole session + // while the writes that come later succeed. + // + // The order is carried HERE, by which provider is mounted, rather than by a + // guard repeated in every effect — the invariant cannot then be forgotten by + // the next call site. + const signedIn = useCurrentPrincipal() !== ''; + console.log('[app][data] Provider — NG status:', status, '| signed in:', signedIn); - if (status === 'connected') { + if (status === 'connected' && signedIn) { return {children}; } - if (status === 'connecting') { - // NG initializing: show empty state (no misleading seed data flash) + if (status === 'connecting' || status === 'connected') { + // NG initializing, or connected but not signed in yet: show empty state (no + // misleading seed data flash, and no read issued before there is a "my"). return {children}; } // Disconnected or error: demo mode with seed data diff --git a/src/shared/context/NextGraphContext.tsx b/src/shared/context/NextGraphContext.tsx index c2280f1..50ff821 100644 --- a/src/shared/context/NextGraphContext.tsx +++ b/src/shared/context/NextGraphContext.tsx @@ -1,5 +1,5 @@ -import React, { createContext, useContext, useState, useCallback, useEffect, type ReactNode } from 'react'; -import { session, sessionPromise, init as initNg, type NextGraphSession } from '../utils/ngSession'; +import { createContext, useContext, useState, useCallback, useEffect, type ReactNode } from 'react'; +import { session, sessionPromise, startNgSession, type NextGraphSession } from '../utils/ngSession'; type NgStatus = 'disconnected' | 'connecting' | 'connected' | 'error'; @@ -7,17 +7,15 @@ interface NextGraphContextValue { status: NgStatus; session: NextGraphSession | undefined; error: string | undefined; - connect: () => void; } const NextGraphContext = createContext({ status: 'disconnected', session: undefined, error: undefined, - connect: () => {}, }); -// Track whether initNg() has been called (module-level to survive re-renders) +// Track whether the session start has been triggered (module-level to survive re-renders) let ngInitStarted = false; // Detect if we're running inside the NG broker iframe @@ -28,22 +26,37 @@ export function NextGraphProvider({ children }: { children: ReactNode }) { const [ngSession, setNgSession] = useState(session); const [error, setError] = useState(); - // Auto-init ONLY when running inside the broker iframe. - // Outside the broker, initNgWeb() would redirect the page — wait for explicit connect(). - useEffect(() => { - if (!isInsideBroker || ngInitStarted) return; + // Start the session ALWAYS, inside the broker iframe and standalone alike. + // + // It used to be iframe-only, because outside the broker starting the session + // REDIRECTS the page and that had to stay a deliberate act — the user clicked + // "Entrer" on the app's own access screen. That screen is gone: signing in is + // `ensureIdentity()`, and the SDK shows whatever a user must see. Nothing is + // left to click, so the redirect must fire on its own. + // + // And it is no longer optional: a session arrives ONLY through the SDK's `init`, + // and `ensureIdentity()` awaited before that call has been made throws. An + // unconditional start is what the contract asks for, in every context. + // + // `startNgSession` is itself idempotent (AuthGate calls it too, right before its + // await, so the order does not depend on React's effect ordering). What this + // provider adds on top is the CONNECTION STATUS the app displays. + const startSession = useCallback(() => { + if (ngInitStarted) return; ngInitStarted = true; - console.log('[NG] Inside broker iframe — auto-init'); + console.log(`[NG] session start (${isInsideBroker ? 'broker iframe' : 'standalone → redirect'})`); setStatus('connecting'); - initNg(); + setError(undefined); + startNgSession(); sessionPromise .then((s) => { - // The session (incl. native store ids) is handed to the SDK at the - // sanctioned injection point (ngSession/storeRegistry). The app context - // itself does not surface or manipulate store ids — it only tracks the - // connection status and the opaque session handle. + // Nothing is handed to the SDK here: the session is the SDK's, captured by + // its own `init`, and no call takes one. What this context keeps is the + // opaque handle the app reads a `session_id` off for the `docs` + // primitives, plus the connection status the screens display. No store id + // crosses this boundary — placement is named by scope alone. console.log('[NG] Session obtained — connected'); setNgSession(s); setStatus('connected'); @@ -55,49 +68,17 @@ export function NextGraphProvider({ children }: { children: ReactNode }) { }); }, []); - // Un-stick the gate after a broker redirect that didn't complete (e.g. "no - // wallet": the user imports in another tab, comes back via the back button). - // The standalone page is restored from bfcache with status frozen on - // 'connecting' → "Entrer" stays disabled. Reset it so they can retry. - useEffect(() => { - if (isInsideBroker) return; - const onPageShow = (e: PageTransitionEvent) => { - if (e.persisted && !session) { - ngInitStarted = false; - setStatus('disconnected'); - setError(undefined); - } - }; - window.addEventListener('pageshow', onPageShow); - return () => window.removeEventListener('pageshow', onPageShow); - }, []); + useEffect(() => { startSession(); }, [startSession]); - // connect(): called by the user clicking "Se connecter". - // When outside the broker, initNgWeb() will redirect to the broker. - const connect = useCallback(() => { - if (status === 'connecting' || status === 'connected') return; - - console.log('[NG] connect() called, current status:', status); - setStatus('connecting'); - setError(undefined); - - ngInitStarted = true; - initNg(); - - sessionPromise - .then((s) => { - setNgSession(s); - setStatus('connected'); - }) - .catch((err) => { - console.error('[NG] Connection failed:', err); - setError(err?.message || 'Connexion NextGraph impossible'); - setStatus('error'); - }); - }, [status]); + // NO retry on the return from the broker round-trip. That journey belongs to the + // SDK: coming back to the page finds its barrier live again and prefilled, and + // confirming it hands the page over a second time — our page is never reloaded + // and nothing outside the barrier is touched. A `pageshow` handler of ours that + // re-started the session would be a second actor driving the same journey, and + // it would redirect out from under the barrier the SDK just put up. return ( - + {children} ); diff --git a/src/shared/data/entityWrites.ts b/src/shared/data/entityWrites.ts index 63dbdb7..9de432a 100644 --- a/src/shared/data/entityWrites.ts +++ b/src/shared/data/entityWrites.ts @@ -28,9 +28,10 @@ * round-trip through the shape. */ -import { docs, escapeLiteral, assertNuri } from '@ng-eventually/client'; -import type { Nuri } from '@ng-eventually/client'; +import { docs } from '@ng-eventually/polyfill'; +import type { Nuri, NuriLike } from '@ng-eventually/polyfill'; import { sessionPromise } from '../utils/ngSession'; +import { escapeLiteral, escapeIri } from './sparqlEscape'; /** The RDF `@type` IRIs of the Festipod entities written per-document. */ export const ENTITY_TYPE = { @@ -70,9 +71,10 @@ function renderTerm(t: EntityTerm): string | null { case 'boolean': return `"${t.value ? 'true' : 'false'}"^^<${XSD}boolean>`; case 'iri': - // The reference IRIs are trusted-shaped NURIs (entity subject IRIs coming - // back from a prior write / the ORM) → validate as a NURI, embed as `<…>`. - return `<${assertNuri(String(t.value))}>`; + // The reference IRIs are entity subject IRIs (coming back from a prior + // write / the ORM). No pre-flight guard: the SDK validates at its own + // door, and here the value only has to be a well-formed IRIREF body. + return `<${escapeIri(String(t.value))}>`; } } @@ -85,22 +87,21 @@ function renderTerm(t: EntityTerm): string | null { * the re-read consistent. `subject` is the entity `@id` (= its document NURI). */ export async function updateEntityField( - graphNuri: Nuri, + graphNuri: NuriLike, subject: string, field: string, term: EntityTerm, ): Promise { const sid = (await sessionPromise).session_id; - const s = assertNuri(subject); + const s = escapeIri(subject); const pred = `${FP}${field}`; const obj = renderTerm(term); // NO explicit `GRAPH <…>` wrapper: anchored to `graphNuri`, both the DELETE and // the INSERT target that doc's anchored DEFAULT graph — the exact graph the // anchored read queries. This no-GRAPH default-graph form is the CANONICAL SDK // write shape (same as writeEntity / registration.ts); SDK graph details live in - // `@ng-eventually/client`, not here. `assertNuri(graphNuri)` is done implicitly - // by `docs.sparqlUpdate`'s anchor handling — validate `subject` here as it lands - // in an IRI position. + // `@ng-eventually/polyfill`, not here. `docs.sparqlUpdate` validates the anchor at + // its own door — `subject` only needs escaping, as it lands in an IRI position. const del = `DELETE WHERE { <${s}> <${pred}> ?o }`; await docs.sparqlUpdate(sid, del, graphNuri); if (obj !== null) { @@ -137,10 +138,10 @@ export async function writeEntity( // that doc's anchored DEFAULT graph — the exact graph the anchored read queries. // This is the CANONICAL SDK write shape (anchor scopes the write, no GRAPH clause; // same as updateEntityField / registration.ts); SDK graph details live in - // `@ng-eventually/client`, not here. + // `@ng-eventually/polyfill`, not here. const update = ` INSERT DATA { - <${assertNuri(subject)}> ${triples.join(' ;\n ')} . + <${escapeIri(subject)}> ${triples.join(' ;\n ')} . }`; await docs.sparqlUpdate(sid, update, graphNuri); return subject; diff --git a/src/shared/data/features.ts b/src/shared/data/features.ts index 1dad82d..4ab5cf1 100644 --- a/src/shared/data/features.ts +++ b/src/shared/data/features.ts @@ -102,6 +102,50 @@ export const parsedFeatures: ParsedFeature[] = [ "user-profile" ] }, + { + "id": "isolation-deux-identites", + "name": "Isolation entre deux identités sur le wallet partagé", + "description": "En tant qu'utilisateur qui se connecte pour lui-même, sur le MÊME wallet physique partagé qu'un autre utilisateur, Je ne dois voir NI l'inscription NI l'accueil d'une autre identité Afin que les participations restent privées à leur propriétaire.", + "tags": [ + "@EVENT", + "@priority-1", + "@data", + "@wip" + ], + "category": "EVENT", + "priority": 1, + "scenarios": [ + { + "name": "Une identité fraîche ne voit pas la participation d'une autre", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "l'identité A crée l'événement \"Événement privé de A\" et s'y inscrit" + }, + { + "keyword": "Quand", + "text": "une identité fraîche B arrive sur le même wallet partagé" + }, + { + "keyword": "Alors", + "text": "l'événement \"Événement privé de A\" n'est pas sur l'accueil de B" + }, + { + "keyword": "Et", + "text": "B n'est pas participant de l'événement \"Événement privé de A\"" + }, + { + "keyword": "Et", + "text": "B ne lit aucune participation de A" + } + ] + } + ], + "filePath": "src/modules/event/features/isolation-deux-identites.feature", + "rawContent": "# language: fr\n# SUSPENDU (@wip) — comportement Festipod bien réel, mais inexprimable aujourd'hui : il faut DEUX contextes navigateur réellement séparés, chacun se connectant pour lui-même via `ensureIdentity()`, ce que le support multi-navigateur n'offre pas encore.\n@EVENT @priority-1 @data @wip\nFonctionnalité: Isolation entre deux identités sur le wallet partagé\n En tant qu'utilisateur qui se connecte pour lui-même, sur le MÊME wallet\n physique partagé qu'un autre utilisateur,\n Je ne dois voir NI l'inscription NI l'accueil d'une autre identité\n Afin que les participations restent privées à leur propriétaire.\n\n # Régression du leak d'isolation : une identité A crée un événement et le\n # rejoint ; une identité fraîche B arrive sur le même wallet physique, dans son\n # propre contexte navigateur, et se connecte pour elle-même.\n # B ne doit PAS voir la participation de A : ni sur son accueil\n # (getUserEvents(B)), ni via isParticipating(E, B), ni dans son set de\n # participations réactif. Ce qui est sous test, c'est le comportement de\n # Festipod : rien de ce que l'app affiche à B ne provient des documents\n # PROTECTED de A, quand bien même les deux identités vivent sur un seul wallet\n # physique.\n\n @data\n Scénario: Une identité fraîche ne voit pas la participation d'une autre\n Étant donné que l'identité A crée l'événement \"Événement privé de A\" et s'y inscrit\n Quand une identité fraîche B arrive sur le même wallet partagé\n Alors l'événement \"Événement privé de A\" n'est pas sur l'accueil de B\n Et B n'est pas participant de l'événement \"Événement privé de A\"\n Et B ne lit aucune participation de A\n", + "screenIds": [] + }, { "id": "us-7", "name": "US-7 M'inscrire/me désinscrire à un événement", @@ -173,10 +217,6 @@ export const parsedFeatures: ParsedFeature[] = [ "keyword": "Et", "text": "l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"" }, - { - "keyword": "Et", - "text": "l'événement \"Formation CNV\" a 8 participants au départ" - }, { "keyword": "Quand", "text": "l'utilisateur s'inscrit à l'événement \"Formation CNV\"" @@ -188,10 +228,6 @@ export const parsedFeatures: ParsedFeature[] = [ { "keyword": "Et", "text": "l'utilisateur apparaît dans la liste des participants de l'événement \"Formation CNV\"" - }, - { - "keyword": "Et", - "text": "l'événement \"Formation CNV\" compte 9 participants" } ] }, @@ -207,10 +243,6 @@ export const parsedFeatures: ParsedFeature[] = [ "keyword": "Et", "text": "l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"" }, - { - "keyword": "Et", - "text": "l'événement \"Résidence Reconnexion\" a 12 participants au départ" - }, { "keyword": "Quand", "text": "l'utilisateur se désinscrit de l'événement \"Résidence Reconnexion\"" @@ -222,10 +254,6 @@ export const parsedFeatures: ParsedFeature[] = [ { "keyword": "Et", "text": "l'utilisateur n'apparaît plus dans la liste des participants de l'événement \"Résidence Reconnexion\"" - }, - { - "keyword": "Et", - "text": "l'événement \"Résidence Reconnexion\" compte 11 participants" } ] }, @@ -241,10 +269,6 @@ export const parsedFeatures: ParsedFeature[] = [ "keyword": "Et", "text": "l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"" }, - { - "keyword": "Et", - "text": "l'événement \"Résidence Reconnexion\" a 12 participants au départ" - }, { "keyword": "Quand", "text": "l'utilisateur essaie de s'inscrire une seconde fois à l'événement \"Résidence Reconnexion\"" @@ -252,10 +276,6 @@ export const parsedFeatures: ParsedFeature[] = [ { "keyword": "Alors", "text": "l'inscription est idempotente pour l'événement \"Résidence Reconnexion\"" - }, - { - "keyword": "Et", - "text": "l'événement \"Résidence Reconnexion\" compte 12 participants" } ] }, @@ -271,10 +291,6 @@ export const parsedFeatures: ParsedFeature[] = [ "keyword": "Et", "text": "l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"" }, - { - "keyword": "Et", - "text": "l'événement \"Formation CNV\" a 8 participants au départ" - }, { "keyword": "Quand", "text": "l'utilisateur se désinscrit de l'événement \"Formation CNV\"" @@ -282,16 +298,34 @@ export const parsedFeatures: ParsedFeature[] = [ { "keyword": "Alors", "text": "l'utilisateur n'est plus participant de l'événement \"Formation CNV\"" + } + ] + }, + { + "name": "L'inscription fait converger le compteur dérivé du propriétaire", + "tags": [], + "steps": [ + { + "keyword": "Étant donné", + "text": "un événement \"Formation CNV\" existe" }, { "keyword": "Et", - "text": "l'événement \"Formation CNV\" compte 8 participants" + "text": "l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"" + }, + { + "keyword": "Quand", + "text": "l'utilisateur s'inscrit à l'événement \"Formation CNV\"" + }, + { + "keyword": "Alors", + "text": "le compteur dérivé de l'événement \"Formation CNV\" reflète l'inscription" } ] } ], "filePath": "src/modules/event/features/us-7-inscription-evenement.feature", - "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: US-7 M'inscrire/me désinscrire à un événement\n En tant qu'utilisateur\n Je peux m'inscrire/me désinscrire à un événement\n Après avoir consulté la description de l'événement, les dates et le lieu\n S'il existe déjà dans le système ou en le retrouvant dans une base existante\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n # --- UI ---\n\n Scénario: Consulter un événement avant inscription\n Étant donné que je suis sur la page \"détail événement\"\n Alors l'écran affiche les informations de l'événement\n\n Scénario: Voir le bouton d'inscription sur l'écran\n Étant donné que je suis sur la page \"détail événement\"\n Alors je peux m'inscrire à l'événement\n\n Scénario: Rechercher un événement existant\n Étant donné que je suis sur la page \"découvrir\"\n Alors je peux voir la liste des événements\n\n # --- Data ---\n\n @data\n Scénario: S'inscrire à un événement\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"\n Et l'événement \"Formation CNV\" a 8 participants au départ\n Quand l'utilisateur s'inscrit à l'événement \"Formation CNV\"\n Alors l'utilisateur est participant de l'événement \"Formation CNV\"\n Et l'utilisateur apparaît dans la liste des participants de l'événement \"Formation CNV\"\n Et l'événement \"Formation CNV\" compte 9 participants\n\n @data\n Scénario: Se désinscrire d'un événement\n Étant donné un événement \"Résidence Reconnexion\" existe\n Et l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"\n Et l'événement \"Résidence Reconnexion\" a 12 participants au départ\n Quand l'utilisateur se désinscrit de l'événement \"Résidence Reconnexion\"\n Alors l'utilisateur n'est plus participant de l'événement \"Résidence Reconnexion\"\n Et l'utilisateur n'apparaît plus dans la liste des participants de l'événement \"Résidence Reconnexion\"\n Et l'événement \"Résidence Reconnexion\" compte 11 participants\n\n @data\n Scénario: L'inscription est idempotente\n Étant donné un événement \"Résidence Reconnexion\" existe\n Et l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"\n Et l'événement \"Résidence Reconnexion\" a 12 participants au départ\n Quand l'utilisateur essaie de s'inscrire une seconde fois à l'événement \"Résidence Reconnexion\"\n Alors l'inscription est idempotente pour l'événement \"Résidence Reconnexion\"\n Et l'événement \"Résidence Reconnexion\" compte 12 participants\n\n @data\n Scénario: Se désinscrire d'un événement auquel on n'est pas inscrit\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"\n Et l'événement \"Formation CNV\" a 8 participants au départ\n Quand l'utilisateur se désinscrit de l'événement \"Formation CNV\"\n Alors l'utilisateur n'est plus participant de l'événement \"Formation CNV\"\n Et l'événement \"Formation CNV\" compte 8 participants\n", + "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: US-7 M'inscrire/me désinscrire à un événement\n En tant qu'utilisateur\n Je peux m'inscrire/me désinscrire à un événement\n Après avoir consulté la description de l'événement, les dates et le lieu\n S'il existe déjà dans le système ou en le retrouvant dans une base existante\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n # --- UI ---\n\n Scénario: Consulter un événement avant inscription\n Étant donné que je suis sur la page \"détail événement\"\n Alors l'écran affiche les informations de l'événement\n\n Scénario: Voir le bouton d'inscription sur l'écran\n Étant donné que je suis sur la page \"détail événement\"\n Alors je peux m'inscrire à l'événement\n\n Scénario: Rechercher un événement existant\n Étant donné que je suis sur la page \"découvrir\"\n Alors je peux voir la liste des événements\n\n # --- Data ---\n #\n # Option B (participantCount dérivé et possédé par le propriétaire) : le compteur\n # n'est plus incrémenté par l'inscrit. L'inscrit écrit sa propre participation\n # (protected) + dépose un marqueur dans l'inbox de l'événement ; la session du\n # PROPRIÉTAIRE matérialise l'inbox et recalcule participantCount =\n # |inscriptions actives distinctes| sur SON propre doc (PAS de base « hôte » : le\n # créateur ne participe pas automatiquement), de façon RÉACTIVE et cross-session.\n # Ce que le @data mono-session prouve ici : la participation elle-même\n # (persistance, idempotence, désinscription AUTORITATIVE). La CONVERGENCE du\n # compteur dérivé (0→1 sans reload) est validée là où elle a du sens — le\n # scénario @multibrowser réactif (e2e-multibrowser.feature « Un participant apparaît\n # réactivement… »), avec un vrai propriétaire (A) et un vrai inscrit (B).\n\n @data\n Scénario: S'inscrire à un événement\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"\n Quand l'utilisateur s'inscrit à l'événement \"Formation CNV\"\n Alors l'utilisateur est participant de l'événement \"Formation CNV\"\n Et l'utilisateur apparaît dans la liste des participants de l'événement \"Formation CNV\"\n\n @data\n Scénario: Se désinscrire d'un événement\n Étant donné un événement \"Résidence Reconnexion\" existe\n Et l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"\n Quand l'utilisateur se désinscrit de l'événement \"Résidence Reconnexion\"\n Alors l'utilisateur n'est plus participant de l'événement \"Résidence Reconnexion\"\n Et l'utilisateur n'apparaît plus dans la liste des participants de l'événement \"Résidence Reconnexion\"\n\n @data\n Scénario: L'inscription est idempotente\n Étant donné un événement \"Résidence Reconnexion\" existe\n Et l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\"\n Quand l'utilisateur essaie de s'inscrire une seconde fois à l'événement \"Résidence Reconnexion\"\n Alors l'inscription est idempotente pour l'événement \"Résidence Reconnexion\"\n\n @data\n Scénario: Se désinscrire d'un événement auquel on n'est pas inscrit\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"\n Quand l'utilisateur se désinscrit de l'événement \"Formation CNV\"\n Alors l'utilisateur n'est plus participant de l'événement \"Formation CNV\"\n\n # --- Data : compteur dérivé (Option B) ---\n #\n # La matérialisation par le PROPRIÉTAIRE dérive l'ensemble actif de l'inbox de\n # l'événement. L'id d'événement est apparié sur sa forme CANONIQUE (id de repo de\n # base, en retirant tout suffixe `:v:`) à travers ownedEventIds / la clé\n # de dépôt / le filtre du matérialiseur — donc le propriétaire matérialise les\n # dépôts d'un événement qu'il possède quelle que soit la voie d'id (create OU\n # listMyEntityDocs OU après reload). Ce scénario assère le DELTA : l'inscrit qui\n # vient de rejoindre EST dans l'ensemble actif dérivé du propriétaire (déterministe\n # même si l'inbox partagée accumule des dépôts, rendant le compteur ABSOLU\n # non-borné au scénario). La convergence 1→2 réactive absolue reste prouvée par le\n # scénario @multibrowser réactif (propriétaire A + inscrit B, e2e-multibrowser).\n # Voir data-layer/knowledge_context-internals § participantCount + le caveat id-form.\n @data\n Scénario: L'inscription fait converger le compteur dérivé du propriétaire\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\"\n Quand l'utilisateur s'inscrit à l'événement \"Formation CNV\"\n Alors le compteur dérivé de l'événement \"Formation CNV\" reflète l'inscription\n", "screenIds": [ "event-detail", "events" @@ -299,11 +333,12 @@ export const parsedFeatures: ParsedFeature[] = [ }, { "id": "decouverte-publique", - "name": "Découverte publique cross-comptes", + "name": "Découverte publique via l'index global", "description": "En tant qu'utilisateur Je veux découvrir les événements publics des autres comptes sans être connecté à eux, afin de trouver des points de rencontre à rejoindre au-delà de mon propre réseau.", "tags": [ "@EVENT", - "@priority-1" + "@priority-1", + "@wip" ], "category": "EVENT", "priority": 1, @@ -330,13 +365,13 @@ export const parsedFeatures: ParsedFeature[] = [ }, { "keyword": "Et", - "text": "l'index public cross-comptes liste le document de l'événement" + "text": "l'index global liste le document de l'événement" } ] } ], "filePath": "src/modules/event/features/decouverte-publique.feature", - "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: Découverte publique cross-comptes\n En tant qu'utilisateur\n Je veux découvrir les événements publics des autres comptes sans être connecté\n à eux, afin de trouver des points de rencontre à rejoindre au-delà de mon\n propre réseau.\n\n # Modèle simple (wallet partagé) : on agrège les documents de périmètre PUBLIC\n # de TOUS les comptes (allAccounts → chaque docPublic → listEntityDocs('public'))\n # puis on lit ces documents via un abonnement multi-graphes. Les documents\n # publics sont makePublic (T02.d) → lisibles sans capability, donc le fan-out\n # n'est jamais bloqué par le filtre ReadCap.\n\n @data\n Scénario: Un compte découvre l'événement public d'un autre compte non connecté\n Étant donné le compte \"@bob-public\" publie un événement public \"Concert au parc\"\n Et le compte \"@alice-public\" n'est pas connecté à \"@bob-public\"\n Quand \"@alice-public\" découvre les événements publics\n Alors \"@alice-public\" voit l'événement public \"Concert au parc\"\n Et l'index public cross-comptes liste le document de l'événement\n", + "rawContent": "# language: fr\n# SUSPENDU (@wip) le 2026-08-03 — l'index global de découverte a été RETIRÉ du SDK :\n# il n'y a pas de découverte, on ne joint un document qu'en suivant un lien reçu.\n# Ce scénario décrit donc une capacité qui n'existe plus telle quelle. Il est\n# conservé, non supprimé : le besoin produit demeure, et il sera réalisé par un\n# ANNUAIRE Festipod — un document public dont l'app connaît le lien, alimenté par\n# dépôt et matérialisé par son curateur. À ce moment-là ce scénario est réécrit\n# sur l'annuaire et redevient actif.\n@EVENT @priority-1 @wip\nFonctionnalité: Découverte publique via l'index global\n En tant qu'utilisateur\n Je veux découvrir les événements publics des autres comptes sans être connecté\n à eux, afin de trouver des points de rencontre à rejoindre au-delà de mon\n propre réseau.\n\n # Découverte = lire l'INDEX GLOBAL. Publier un événement public, c'est soumettre\n # sa référence à l'index (submitEventToIndex) ; découvrir, c'est lire l'index\n # (readDiscoveredEvents) puis s'abonner aux documents référencés. L'app ne fait\n # AUCUN fan-out cross-comptes et ne connaît ni l'hôte de l'index ni sa\n # mécanique — le SDK possède l'index de bout en bout.\n\n @data\n Scénario: Un compte découvre l'événement public d'un autre compte non connecté\n Étant donné le compte \"@bob-public\" publie un événement public \"Concert au parc\"\n Et le compte \"@alice-public\" n'est pas connecté à \"@bob-public\"\n Quand \"@alice-public\" découvre les événements publics\n Alors \"@alice-public\" voit l'événement public \"Concert au parc\"\n Et l'index global liste le document de l'événement\n", "screenIds": [] }, { @@ -421,6 +456,41 @@ export const parsedFeatures: ParsedFeature[] = [ "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: Inscription réelle au point de rencontre via inbox (T02.c)\n En tant qu'utilisateur qui s'inscrit à un point de rencontre\n Mon inscription est persistée, l'hôte reçoit une notification par son inbox,\n Et ma désinscription est durable (elle ne ressuscite pas via la sync broker)\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n @data\n Scénario: S'inscrire dépose dans l'inbox de l'hôte et crée une notification\n Étant donné un événement \"Formation CNV\" existe\n Et l'utilisateur n'est pas inscrit à l'événement \"Formation CNV\" via l'app\n Quand l'utilisateur s'inscrit à l'événement \"Formation CNV\" via l'app\n Alors l'utilisateur devient participant de l'événement \"Formation CNV\"\n Et l'inbox de l'événement \"Formation CNV\" contient au moins un dépôt\n Et une notification \"new-participant\" est créée pour l'événement \"Formation CNV\"\n\n @data\n Scénario: La désinscription est persistante (ne ressuscite pas)\n Étant donné un événement \"Résidence Reconnexion\" existe\n Et l'utilisateur est inscrit à l'événement \"Résidence Reconnexion\" via l'app\n Quand l'utilisateur se désinscrit de l'événement \"Résidence Reconnexion\" via l'app\n Alors l'utilisateur n'est plus participant de l'événement \"Résidence Reconnexion\"\n Et le broker ne contient plus aucune participation à l'événement \"Résidence Reconnexion\"\n Et l'utilisateur reste non-inscrit à l'événement \"Résidence Reconnexion\" après re-sync\n", "screenIds": [] }, + { + "id": "reconnexion-froide-sans-local", + "name": "Reconnexion à froid SANS état local NextGraph (durabilité broker réelle)", + "description": "En tant qu'utilisateur qui crée un événement puis se reconnecte sous la MÊME identité depuis un appareil/onglet SANS aucune donnée NextGraph locale, Je dois relire MON PROPRE événement — sinon c'est qu'il n'a jamais atteint le broker.", + "tags": [ + "@EVENT", + "@priority-1", + "@data" + ], + "category": "EVENT", + "priority": 1, + "scenarios": [ + { + "name": "A relit son propre événement après une reconnexion à froid sans état local", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "l'identité A crée l'événement \"Événement froid sans local de A\" et s'y inscrit" + }, + { + "keyword": "Quand", + "text": "un navigateur frais non-persistant recharge pour la MÊME identité A avec le wallet partagé" + }, + { + "keyword": "Alors", + "text": "l'événement \"Événement froid sans local de A\" est sur l'accueil de la page fraîche A" + } + ] + } + ], + "filePath": "src/modules/event/features/reconnexion-froide-sans-local.feature", + "rawContent": "# language: fr\n@EVENT @priority-1 @data\nFonctionnalité: Reconnexion à froid SANS état local NextGraph (durabilité broker réelle)\n En tant qu'utilisateur qui crée un événement puis se reconnecte sous la MÊME\n identité depuis un appareil/onglet SANS aucune donnée NextGraph locale,\n Je dois relire MON PROPRE événement — sinon c'est qu'il n'a jamais atteint le broker.\n\n # POURQUOI CE SCÉNARIO (2026-07-14) — question unique qu'il tranche.\n # Le scénario @data « reconnexion-meme-identite » reconnecte A via ctx.newPage()\n # sur le MÊME contexte persistant (.playwright-profile). Ce contexte détient\n # ENCORE les repos de A en IndexedDB LOCAL — un « verifier frais » y rouvre donc\n # depuis le LOCAL et ne prouve jamais la durabilité BROKER. C'est le raccourci à\n # supprimer.\n #\n # Ici, A se reconnecte depuis un CONTEXTE NAVIGATEUR FRAIS, NON-PERSISTANT\n # (freshBrowser), partition de stockage hermétique séparée de la page d'écriture\n # → AUCUN IndexedDB partagé. Le seul état pré-injecté est le storageState du\n # wallet partagé capturé au BeforeAll (AVANT que A ne soit créé) : il ne peut donc\n # PAS contenir l'événement de A. La seule source possible de l'événement est le\n # BROKER.\n #\n # VERDICT :\n # - l'événement REAPPARAÎT → BROKER-DURABLE (l'écriture a atteint le broker).\n # - l'événement RESTE ABSENT → LOCAL-ONLY (@data ne peut pas prouver la\n # durabilité broker du scope propre de A ; le RED antérieur était un artefact\n # local/timing).\n # Lecture RÉACTIVE uniquement (waitForFunction sur homeEventTitles), jamais de\n # boucle de re-lecture broker (rule_no-broker-polling).\n\n @wip @data @reco-cold-nolocal\n Scénario: A relit son propre événement après une reconnexion à froid sans état local\n Étant donné que l'identité A crée l'événement \"Événement froid sans local de A\" et s'y inscrit\n Quand un navigateur frais non-persistant recharge pour la MÊME identité A avec le wallet partagé\n Alors l'événement \"Événement froid sans local de A\" est sur l'accueil de la page fraîche A\n", + "screenIds": [] + }, { "id": "us-13", "name": "US-13 Relayer/Modifier/Supprimer un événement", @@ -498,6 +568,40 @@ export const parsedFeatures: ParsedFeature[] = [ } ] }, + { + "name": "Le créateur ne participe pas automatiquement à son événement", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "le créateur relaie l'événement \"Signalé par le créateur\"" + }, + { + "keyword": "Alors", + "text": "le créateur n'est pas participant de l'événement \"Signalé par le créateur\"" + }, + { + "keyword": "Et", + "text": "le compteur de participants de l'événement \"Signalé par le créateur\" vaut 0" + }, + { + "keyword": "Quand", + "text": "le créateur rejoint son événement \"Signalé par le créateur\"" + }, + { + "keyword": "Alors", + "text": "le créateur est participant de l'événement \"Signalé par le créateur\"" + }, + { + "keyword": "Quand", + "text": "le créateur quitte son événement \"Signalé par le créateur\"" + }, + { + "keyword": "Alors", + "text": "le créateur n'est pas participant de l'événement \"Signalé par le créateur\"" + } + ] + }, { "name": "Modifier un événement", "tags": [], @@ -515,7 +619,7 @@ export const parsedFeatures: ParsedFeature[] = [ } ], "filePath": "src/modules/event/features/us-13-creer-evenement.feature", - "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: US-13 Relayer/Modifier/Supprimer un événement\n En tant qu'utilisateur\n Je peux relayer/modifier/supprimer un événement\n En choisissant les dates, horaires, lieu et thématique\n Afin de relayer/présenter le contenu de cet événement et le catégoriser\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n Scénario: Accéder au formulaire de relai d'événement\n Étant donné que je suis sur la page \"accueil\"\n Quand je navigue vers \"relayer un événement\"\n Alors je vois l'écran \"create-event\"\n\n Scénario: Vérifier les champs obligatoires du formulaire\n Étant donné que l'écran \"create-event\" est affiché\n Alors le formulaire contient les champs obligatoires suivants:\n | Nom de l'événement |\n | Date de début |\n\n Scénario: Vérifier la présence du bouton de relai\n Étant donné que je suis sur la page \"relayer un événement\"\n Alors l'écran contient un bouton \"Suivant\"\n\n Scénario: Pouvoir annuler le relai d'événement\n Étant donné que je suis sur la page \"relayer un événement\"\n Alors je peux annuler et revenir à l'écran précédent\n\n Scénario: Modifier un événement\n * Scénario non implémenté\n\n Scénario: Supprimer un événement\n * Scénario non implémenté\n\n Scénario: Retirer une organisation (personne ou structure)\n * Scénario non implémenté\n", + "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: US-13 Relayer/Modifier/Supprimer un événement\n En tant qu'utilisateur\n Je peux relayer/modifier/supprimer un événement\n En choisissant les dates, horaires, lieu et thématique\n Afin de relayer/présenter le contenu de cet événement et le catégoriser\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n Scénario: Accéder au formulaire de relai d'événement\n Étant donné que je suis sur la page \"accueil\"\n Quand je navigue vers \"relayer un événement\"\n Alors je vois l'écran \"create-event\"\n\n Scénario: Vérifier les champs obligatoires du formulaire\n Étant donné que l'écran \"create-event\" est affiché\n Alors le formulaire contient les champs obligatoires suivants:\n | Nom de l'événement |\n | Date de début |\n\n Scénario: Vérifier la présence du bouton de relai\n Étant donné que je suis sur la page \"relayer un événement\"\n Alors l'écran contient un bouton \"Suivant\"\n\n Scénario: Pouvoir annuler le relai d'événement\n Étant donné que je suis sur la page \"relayer un événement\"\n Alors je peux annuler et revenir à l'écran précédent\n\n # --- Data : le créateur ne participe pas automatiquement (décision produit) ---\n #\n # Il n'y a PAS de notion d'hôte : l'événement est public, simplement signalé par\n # le créateur, qui n'est PAS obligé de participer. À la création, aucune\n # participation n'est écrite et le compteur démarre à 0. Le créateur voit « J'y\n # serai » et peut rejoindre/quitter son propre événement comme tout le monde.\n @data\n Scénario: Le créateur ne participe pas automatiquement à son événement\n Étant donné que le créateur relaie l'événement \"Signalé par le créateur\"\n Alors le créateur n'est pas participant de l'événement \"Signalé par le créateur\"\n Et le compteur de participants de l'événement \"Signalé par le créateur\" vaut 0\n Quand le créateur rejoint son événement \"Signalé par le créateur\"\n Alors le créateur est participant de l'événement \"Signalé par le créateur\"\n Quand le créateur quitte son événement \"Signalé par le créateur\"\n Alors le créateur n'est pas participant de l'événement \"Signalé par le créateur\"\n\n Scénario: Modifier un événement\n * Scénario non implémenté\n\n Scénario: Supprimer un événement\n * Scénario non implémenté\n\n Scénario: Retirer une organisation (personne ou structure)\n * Scénario non implémenté\n", "screenIds": [ "create-event", "home" @@ -778,6 +882,109 @@ export const parsedFeatures: ParsedFeature[] = [ "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: Cycle de vie d'un événement\n En tant qu'utilisateur connecté\n Je peux créer, consulter, modifier et participer à des événements\n Et ces actions persistent dans mon portefeuille NextGraph\n\n Contexte:\n Étant donné que le portefeuille contient des données de test\n\n # --- Création et persistance ---\n\n @e2e\n Scénario: Créer un événement et vérifier qu'il apparaît sur l'accueil\n Quand l'utilisateur navigue vers l'écran \"create-event\"\n Et l'utilisateur remplit le formulaire de création d'événement:\n | champ | valeur |\n | Nom de l'événement | Pique-nique au parc |\n | Date de début | 2026-06-15 |\n | Heure de début | 14:00 |\n | Lieu | Parc Bordelais, Bordeaux |\n Et l'utilisateur clique sur le bouton \"Relayer l'événement\"\n Alors l'application affiche l'écran \"event-detail\"\n Et l'écran contient le texte \"Pique-nique au parc\"\n Quand l'utilisateur navigue vers l'écran \"home\"\n Alors l'écran contient le texte \"Pique-nique au parc\"\n\n @e2e\n Scénario: L'événement créé persiste après reconnexion\n Alors l'écran d'accueil contient le texte \"Pique-nique au parc\"\n\n # --- Consultation ---\n\n @e2e\n Scénario: Consulter le détail d'un événement depuis l'accueil\n Quand l'utilisateur clique sur un événement de l'accueil\n Alors l'application affiche l'écran \"event-detail\"\n Et l'écran contient le texte \"Participants\"\n\n # --- Inscription / Désinscription ---\n\n @e2e\n Scénario: S'inscrire à un événement\n Quand l'utilisateur navigue vers l'écran \"events\"\n Et l'utilisateur clique sur un événement de la liste\n Et l'utilisateur attend que l'écran \"event-detail\" soit affiché\n Et l'utilisateur clique sur le bouton \"J'y serai\" si visible\n Alors l'écran contient le texte \"Je participe\"\n\n # Auto-suffisant : on s'inscrit d'abord (précondition), puis on se désinscrit,\n # le tout dans la même session — ne dépend ni de l'état inter-scénarios ni de\n # la persistance après reconnexion.\n # FIX T02.c (2026-07-03) : le @wip est LEVÉ. La désinscription se reflète\n # désormais dans l'UI et est DURABLE — leaveEvent supprime la Participation\n # côté données via SPARQL DELETE-WHERE (docs.sparqlUpdate, le ng injecté), donc\n # l'item ne ressuscite plus via la sync broker (l'ancien bug CRDT décrit dans\n # caveat_participation-deletion). Prouvé : ce scénario @e2e passe + le scénario\n # @data « désinscription persistante » de inscription-inbox.feature. (La\n # validation multi-navigateur complète reste T02.f.)\n @e2e\n Scénario: Se désinscrire d'un événement\n Quand l'utilisateur navigue vers l'écran \"events\"\n Et l'utilisateur clique sur un événement de la liste\n Et l'utilisateur attend que l'écran \"event-detail\" soit affiché\n Et l'utilisateur clique sur le bouton \"J'y serai\" si visible\n Alors l'écran contient le texte \"Je participe\"\n Quand l'utilisateur clique sur le bouton \"Je participe\"\n Alors l'écran contient le texte \"J'y serai\"\n\n # --- Modification ---\n\n @e2e\n Scénario: Modifier un événement et vérifier la persistance\n Quand l'utilisateur navigue vers l'écran \"home\"\n Et l'utilisateur clique sur un événement de l'accueil\n Et l'utilisateur attend que l'écran \"event-detail\" soit affiché\n Et l'utilisateur clique sur le bouton de modification\n Et l'utilisateur attend que l'écran \"update-event\" soit affiché\n Et l'utilisateur modifie le champ lieu avec \"Jardin Public, Bordeaux\"\n Et l'utilisateur clique sur le bouton \"Enregistrer les modifications\"\n Alors l'application affiche l'écran \"event-detail\"\n Et l'écran contient le texte \"Jardin Public\"\n", "screenIds": [] }, + { + "id": "reconnexion-meme-identite", + "name": "Reconnexion d'une même identité sur le wallet persistant", + "description": "En tant qu'utilisateur qui, sur le MÊME wallet physique, ouvre une PAGE FRAÎCHE (nouveau login broker, session fraîche) sous le MÊME identifiant qu'avant, Je dois relire MES PROPRES données (mon événement, ma participation) Afin que rien ne disparaisse à la reconnexion.", + "tags": [ + "@EVENT", + "@priority-1", + "@data" + ], + "category": "EVENT", + "priority": 1, + "scenarios": [ + { + "name": "Une page fraîche pour la même identité relit ses propres données", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "l'identité A crée l'événement \"Événement de reconnexion de A\" et s'y inscrit" + }, + { + "keyword": "Quand", + "text": "une page fraîche pour la MÊME identité A recharge sur le même wallet" + }, + { + "keyword": "Alors", + "text": "l'événement \"Événement de reconnexion de A\" est sur l'accueil de la page fraîche A" + }, + { + "keyword": "Et", + "text": "la page fraîche A est participante de l'événement \"Événement de reconnexion de A\"" + }, + { + "keyword": "Et", + "text": "le compte autoritatif de participation de A à l'événement \"Événement de reconnexion de A\" est 1" + } + ] + }, + { + "name": "Une pause avant la reconnexion ne doit pas faire perdre l'événement", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "l'identité A crée l'événement \"Événement de reconnexion de A (pause)\" et s'y inscrit" + }, + { + "keyword": "Quand", + "text": "on attend 20 secondes sans aucune activité" + }, + { + "keyword": "Et", + "text": "une page fraîche pour la MÊME identité A recharge sur le même wallet" + }, + { + "keyword": "Alors", + "text": "l'événement \"Événement de reconnexion de A (pause)\" finit par apparaître sur la page fraîche A en laissant jusqu'à 60 secondes à la barrière avec rechargements" + } + ] + } + ], + "filePath": "src/modules/event/features/reconnexion-meme-identite.feature", + "rawContent": "# language: fr\n@EVENT @priority-1 @data\nFonctionnalité: Reconnexion d'une même identité sur le wallet persistant\n En tant qu'utilisateur qui, sur le MÊME wallet physique, ouvre une PAGE FRAÎCHE\n (nouveau login broker, session fraîche) sous le MÊME identifiant qu'avant,\n Je dois relire MES PROPRES données (mon événement, ma participation)\n Afin que rien ne disparaisse à la reconnexion.\n\n # Régression de RECONNEXION (distincte de l'isolation deux-identités). CORRIGÉ :\n # ce scénario passe désormais sous broker réel (2/2 vérifié).\n #\n # SYMPTÔME (broker réel) : une identité A crée E + s'y inscrit sur la page\n # principale ; une PAGE FRAÎCHE pour la MÊME identité A (même wallet, nouveau\n # login → session verifier fraîche) relisait VIDE (home=[], isParticipating=false,\n # count=0). La page fraîche retrouve maintenant E, sa participation, et un count\n # autoritatif de 1.\n #\n # CAUSE : à froid, plusieurs lecteurs (watchShape public/protected + effet owned-\n # events) appelaient `ensureAccount(A)` en parallèle AVANT sync du shim → chacun\n # lisait 0 ligne et PROVISIONNAIT un nouveau jeu de docs de scope (fork de compte\n # par lecteur). `canonicalDoc` faisait alors choisir au lecteur frais le docProtected\n # lexicographiquement-min ≠ celui où l'écrivain avait joué joinEvent → readScopeIndex\n # vide. FIX (lib) : `ensureAccount` dé-doublonne les provisions concurrentes (map\n # in-flight par clé de compte) → une seule provision, écrivain et lecteur convergent\n # sur le même docProtected canonique. Complété par le heal cold-start de\n # `discovery.readIndex` (ouverture du repo d'index avant lecture ancrée).\n # Mesuré (fresh page, broker réel) : partProt converge isSuccess n=1, pub isSuccess\n # n≥1 ; userProt reste isSuccess n=0 (aucun profil écrit dans ce scénario — attendu).\n\n @data\n Scénario: Une page fraîche pour la même identité relit ses propres données\n Étant donné que l'identité A crée l'événement \"Événement de reconnexion de A\" et s'y inscrit\n Quand une page fraîche pour la MÊME identité A recharge sur le même wallet\n Alors l'événement \"Événement de reconnexion de A\" est sur l'accueil de la page fraîche A\n Et la page fraîche A est participante de l'événement \"Événement de reconnexion de A\"\n Et le compte autoritatif de participation de A à l'événement \"Événement de reconnexion de A\" est 1\n\n # REPRODUCTION par ATTENTE SIMPLE (aucune déconnexion injectée) : identique au\n # scénario ci-dessus, mais une PAUSE sépare l'écriture (création + inscription)\n # de la reconnexion fraîche. Hypothèse sous test : le socket broker meurt tout\n # seul pendant une pause (SOCKET IS CLOSED … SerializationError observé en\n # Firefox réel), l'écriture n'atteint jamais durablement le broker, et la\n # reconnexion relit alors un événement disparu (Err(TopicNotFound) / REPLAY\n # TOPIC NOT FOUND / readScopeIndex → 0). RED attendu si le socket meurt en env\n # de test ; PASS si le socket de test survit à la pause (résultat négatif\n # valide — la mort spontanée serait alors spécifique à Firefox réel).\n @wip @data @reconnexion-pause\n Scénario: Une pause avant la reconnexion ne doit pas faire perdre l'événement\n Étant donné que l'identité A crée l'événement \"Événement de reconnexion de A (pause)\" et s'y inscrit\n Quand on attend 20 secondes sans aucune activité\n Et une page fraîche pour la MÊME identité A recharge sur le même wallet\n Alors l'événement \"Événement de reconnexion de A (pause)\" finit par apparaître sur la page fraîche A en laissant jusqu'à 60 secondes à la barrière avec rechargements\n", + "screenIds": [] + }, + { + "id": "reconnexion-persistance-e2e", + "name": "Persistance d'un événement à la reconnexion (app réelle, @e2e)", + "description": "En tant qu'utilisateur qui, dans la VRAIE app, crée un événement puis FERME et ROUVRE l'app sous la MÊME identité (même wallet, session verifier fraîche), Je dois retrouver mon événement à la reconnexion Afin que rien ne disparaisse quand je reviens.", + "tags": [ + "@EVENT", + "@priority-1" + ], + "category": "EVENT", + "priority": 1, + "scenarios": [ + { + "name": "Un événement créé survit à une reconnexion fidèle de la même identité", + "tags": [], + "steps": [ + { + "keyword": "Étant donné que ", + "text": "l'utilisateur crée un événement \"Événement persistant e2e\" via le vrai formulaire" + }, + { + "keyword": "Et", + "text": "l'événement \"Événement persistant e2e\" apparaît sur l'accueil de l'utilisateur" + }, + { + "keyword": "Quand", + "text": "l'utilisateur ferme et rouvre l'app sous la même identité dans une session broker fraîche" + }, + { + "keyword": "Alors", + "text": "l'événement \"Événement persistant e2e\" est toujours présent après reconnexion" + } + ] + } + ], + "filePath": "src/modules/event/features/reconnexion-persistance-e2e.feature", + "rawContent": "# language: fr\n@EVENT @priority-1\nFonctionnalité: Persistance d'un événement à la reconnexion (app réelle, @e2e)\n En tant qu'utilisateur qui, dans la VRAIE app, crée un événement puis FERME\n et ROUVRE l'app sous la MÊME identité (même wallet, session verifier fraîche),\n Je dois retrouver mon événement à la reconnexion\n Afin que rien ne disparaisse quand je reviens.\n\n # POURQUOI CE SCÉNARIO EXISTE (2026-07-13)\n # Bug rapporté en condition RÉELLE : user1 crée un événement (visible), ferme et\n # se reconnecte (même identité, même wallet) → l'événement a DISPARU ; la console\n # montre `REPLAY TOPIC NOT FOUND` en masse, un re-provisioning (fork) de compte,\n # et l'ancien docPublic relit vide.\n #\n # Le scénario @data « reconnexion-meme-identite » PASSE, mais il charge un HARNESS\n # de test, PAS l'app réelle — il ne valide donc pas le parcours de l'utilisateur.\n # Ce scénario @e2e boote la VRAIE app dans l'iframe broker (setupBrokerPage),\n # crée l'événement via le VRAI formulaire, puis ouvre une SECONDE page/session\n # broker FRAÎCHE pour la MÊME identité — le miroir fidèle de « fermer et rouvrir ».\n #\n # HYPOTHÈSE À TESTER (NON présumée vraie) : les écritures faites avant que le\n # broker soit vraiment connecté partiraient dans une outbox non-durable → jamais\n # acceptées → REPLAY TOPIC NOT FOUND à la reconnexion → perte. Le step de\n # reconnexion CAPTURE les logs console des DEUX pages (timing des `WRITE` vs\n # `CONNECTION ESTABLISHED`, occurrences de `REPLAY TOPIC NOT FOUND`) comme preuve.\n\n @e2e @wip\n Scénario: Un événement créé survit à une reconnexion fidèle de la même identité\n Étant donné que l'utilisateur crée un événement \"Événement persistant e2e\" via le vrai formulaire\n Et l'événement \"Événement persistant e2e\" apparaît sur l'accueil de l'utilisateur\n Quand l'utilisateur ferme et rouvre l'app sous la même identité dans une session broker fraîche\n Alors l'événement \"Événement persistant e2e\" est toujours présent après reconnexion\n", + "screenIds": [] + }, { "id": "e2e-multibrowser", "name": "Validation e2e multi-navigateurs des nouvelles features (T02.f)", @@ -891,6 +1098,92 @@ export const parsedFeatures: ParsedFeature[] = [ } ] }, + { + "name": "Le compteur converge chez le propriétaire à sa prochaine connexion", + "tags": [], + "steps": [ + { + "keyword": "Étant donné", + "text": "un navigateur \"A\" avec le wallet partagé" + }, + { + "keyword": "Et", + "text": "un navigateur \"B\" avec le wallet partagé" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" charge l'application via le broker" + }, + { + "keyword": "Et", + "text": "le navigateur \"B\" charge l'application via le broker" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" est connecté à NextGraph" + }, + { + "keyword": "Et", + "text": "le navigateur \"B\" est connecté à NextGraph" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" crée l'événement \"Apéro réactif\"" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" ouvre le détail de l'événement \"Apéro réactif\"" + }, + { + "keyword": "Et", + "text": "le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 0" + }, + { + "keyword": "Quand", + "text": "le navigateur \"B\" s'inscrit à l'événement \"Apéro réactif\"" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" se reconnecte et matérialise l'inbox" + }, + { + "keyword": "Alors", + "text": "le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 1" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" affiche un participant \"inconnu\" pour \"Apéro réactif\"" + }, + { + "keyword": "Et", + "text": "le navigateur \"B\" se reconnecte et matérialise l'inbox" + }, + { + "keyword": "Et", + "text": "le compteur de participants réactif dans \"B\" pour \"Apéro réactif\" vaut 1" + }, + { + "keyword": "Quand", + "text": "le navigateur \"B\" se désinscrit de l'événement \"Apéro réactif\"" + }, + { + "keyword": "Et", + "text": "le navigateur \"A\" se reconnecte et matérialise l'inbox" + }, + { + "keyword": "Alors", + "text": "le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 0" + }, + { + "keyword": "Et", + "text": "le navigateur \"B\" se reconnecte et matérialise l'inbox" + }, + { + "keyword": "Et", + "text": "le compteur de participants réactif dans \"B\" pour \"Apéro réactif\" vaut 0" + } + ] + }, { "name": "Un navigateur découvre l'événement public publié dans l'autre", "tags": [], @@ -935,7 +1228,7 @@ export const parsedFeatures: ParsedFeature[] = [ } ], "filePath": "src/modules/event/features/e2e-multibrowser.feature", - "rawContent": "# language: fr\n@EVENT @priority-1 @multibrowser @shared-wallet\nFonctionnalité: Validation e2e multi-navigateurs des nouvelles features (T02.f)\n En tant que développeur validant les fonctionnalités T02\n Je pilote DEUX navigateurs isolés (contextes Playwright distincts, sessions\n NextGraph indépendantes) portant le wallet partagé, chacun chargé dans l'app\n via le broker réel (nextgraph.net), afin de prouver que les comportements\n démontrables round-trippent réellement à travers le broker d'un navigateur à\n l'autre — pas seulement dans le set réactif d'une seule page.\n\n # NB périmètre : l'isolation cryptographique réelle (ReadCap/write-guard actifs,\n # mono-document + setCurrentUser) est DIFFÉRÉE (mécanisme validé mais dormant,\n # cf. T02.d/T02.g). Ces scénarios ne prouvent donc PAS l'isolation crypto entre\n # navigateurs ; ils valident les COMPORTEMENTS démontrables cross-navigateur.\n\n # --- Inscription + notification hôte (T02.c) ---\n # Navigateur A = l'hôte (crée l'événement/PdR) ; navigateur B = un second\n # compte qui s'inscrit. A reçoit la notification, matérialisée depuis l'inbox.\n\n Scénario: Inscription dans un navigateur, notification hôte dans l'autre\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Quand le navigateur \"A\" crée l'événement \"Rencontre au kiosque\"\n Et le navigateur \"B\" s'inscrit à l'événement \"Rencontre au kiosque\"\n Alors le navigateur \"B\" devient participant de l'événement \"Rencontre au kiosque\"\n Et l'inbox de l'événement \"Rencontre au kiosque\" reçoit un dépôt \"new-participant\"\n\n # --- Désinscription persistante (T02.c, fix @wip) ---\n # B se désinscrit → la participation disparaît côté broker (SELECT autoritatif)\n # ET ne ressuscite pas après une re-sync du broker.\n\n Scénario: La désinscription dans un navigateur ne ressuscite pas après re-sync\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Et le navigateur \"A\" crée l'événement \"Café des curieux\"\n Et le navigateur \"B\" s'inscrit à l'événement \"Café des curieux\"\n Et le navigateur \"B\" devient participant de l'événement \"Café des curieux\"\n Quand le navigateur \"B\" se désinscrit de l'événement \"Café des curieux\"\n Alors le broker ne contient plus aucune participation à l'événement \"Café des curieux\" pour le navigateur \"B\"\n Et l'inscription de l'événement \"Café des curieux\" ne ressuscite pas dans le navigateur \"B\" après re-sync\n\n # --- Découverte publique cross-comptes (T02.e) ---\n # Bob (navigateur B) publie un événement PUBLIC ; Alice (navigateur A) le\n # découvre SANS être connectée/amie avec Bob, via le fan-out public.\n\n Scénario: Un navigateur découvre l'événement public publié dans l'autre\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Quand le compte \"@bob-mb\" publie un événement public \"Concert au kiosque\" dans le navigateur \"B\"\n Et le compte \"@alice-mb\" découvre les événements publics dans le navigateur \"A\" sans être connecté à \"@bob-mb\"\n Alors le navigateur \"A\" voit l'événement public \"Concert au kiosque\"\n", + "rawContent": "# language: fr\n@EVENT @priority-1 @multibrowser @shared-wallet\nFonctionnalité: Validation e2e multi-navigateurs des nouvelles features (T02.f)\n En tant que développeur validant les fonctionnalités T02\n Je pilote DEUX navigateurs isolés (contextes Playwright distincts, sessions\n NextGraph indépendantes) portant le wallet partagé, chacun chargé dans l'app\n via le broker réel (nextgraph.net), afin de prouver que les comportements\n démontrables round-trippent réellement à travers le broker d'un navigateur à\n l'autre — pas seulement dans le set réactif d'une seule page.\n\n # NB périmètre : l'isolation cryptographique réelle (ReadCap/write-guard actifs,\n # mono-document + setCurrentUser) est DIFFÉRÉE (mécanisme validé mais dormant,\n # cf. T02.d/T02.g). Ces scénarios ne prouvent donc PAS l'isolation crypto entre\n # navigateurs ; ils valident les COMPORTEMENTS démontrables cross-navigateur.\n\n # --- Inscription + notification hôte (T02.c) ---\n # Navigateur A = l'hôte (crée l'événement/PdR) ; navigateur B = un second\n # compte qui s'inscrit. A reçoit la notification, matérialisée depuis l'inbox.\n\n Scénario: Inscription dans un navigateur, notification hôte dans l'autre\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Quand le navigateur \"A\" crée l'événement \"Rencontre au kiosque\"\n Et le navigateur \"B\" s'inscrit à l'événement \"Rencontre au kiosque\"\n Alors le navigateur \"B\" devient participant de l'événement \"Rencontre au kiosque\"\n Et l'inbox de l'événement \"Rencontre au kiosque\" reçoit un dépôt \"new-participant\"\n\n # --- Désinscription persistante (T02.c, fix @wip) ---\n # B se désinscrit → la participation disparaît côté broker (SELECT autoritatif)\n # ET ne ressuscite pas après une re-sync du broker.\n\n Scénario: La désinscription dans un navigateur ne ressuscite pas après re-sync\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Et le navigateur \"A\" crée l'événement \"Café des curieux\"\n Et le navigateur \"B\" s'inscrit à l'événement \"Café des curieux\"\n Et le navigateur \"B\" devient participant de l'événement \"Café des curieux\"\n Quand le navigateur \"B\" se désinscrit de l'événement \"Café des curieux\"\n Alors le broker ne contient plus aucune participation à l'événement \"Café des curieux\" pour le navigateur \"B\"\n Et l'inscription de l'événement \"Café des curieux\" ne ressuscite pas dans le navigateur \"B\" après re-sync\n\n # --- Découverte publique cross-comptes (T02.e) ---\n # Bob (navigateur B) publie un événement PUBLIC ; Alice (navigateur A) le\n # découvre SANS être connectée/amie avec Bob, via le fan-out public.\n\n # --- Compteur fiable à la connexion du propriétaire (Option B, brief §D.2) ---\n # Cadrage (recadré 2026-07-13) : ce n'est PAS une exigence de push temps-réel\n # cross-session. Le compteur est STOCKÉ dans l'événement, SEUL le propriétaire\n # l'écrit ; l'inscrit DÉPOSE dans l'inbox de l'événement ; le propriétaire traite\n # ces dépôts à sa PROCHAINE CONNEXION (matérialisation fiable, barrière de sync de\n # l'inbox). Une reconnexion / re-matérialisation de A est donc ACCEPTÉE — on ne\n # vise pas « sans reload ».\n #\n # FIX (appliqué) : la matérialisation du propriétaire lit l'inbox APRÈS sa barrière\n # de sync (`inbox.readSynced`, SDK `@ng-eventually/polyfill`), de sorte qu'un dépôt de l'inscrit déjà synchronisé au\n # broker EST vu (plus de « 0 prématuré » mémoïsé) ; le materializer est lancé\n # directement à la connexion ([ready, ownedKey]), pas seulement sur un push\n # d'inbox. Source unique du NOMBRE : `event.participantCount` (le littéral local\n # `participantCount: 1` du CreateEventScreen est retiré → départ à 0).\n Scénario: Le compteur converge chez le propriétaire à sa prochaine connexion\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Et le navigateur \"A\" crée l'événement \"Apéro réactif\"\n Et le navigateur \"A\" ouvre le détail de l'événement \"Apéro réactif\"\n # Le créateur ne participe PAS automatiquement (pas de notion d'hôte) : à la\n # création le compteur démarre à 0 (|inscriptions actives| = 0).\n Et le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 0\n Quand le navigateur \"B\" s'inscrit à l'événement \"Apéro réactif\"\n # À sa PROCHAINE CONNEXION, A traite l'inbox (barrière de sync) et matérialise le\n # dépôt de B sur son propre doc → participantCount passe à 1. Symétrie avec B :\n # après reconnexion, B lit le doc public mis à jour par A et voit 1 aussi.\n Et le navigateur \"A\" se reconnecte et matérialise l'inbox\n Alors le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 1\n Et le navigateur \"A\" affiche un participant \"inconnu\" pour \"Apéro réactif\"\n Et le navigateur \"B\" se reconnecte et matérialise l'inbox\n Et le compteur de participants réactif dans \"B\" pour \"Apéro réactif\" vaut 1\n # Option B symétrique : B se désinscrit → à la prochaine connexion de A, A\n # matérialise le marqueur \"leave\" depuis l'inbox et RECALCULE participantCount\n # sur son propre doc → le compteur repasse à 0.\n Quand le navigateur \"B\" se désinscrit de l'événement \"Apéro réactif\"\n Et le navigateur \"A\" se reconnecte et matérialise l'inbox\n Alors le compteur de participants réactif dans \"A\" pour \"Apéro réactif\" vaut 0\n # Symétrie côté inscrit après désinscription : B voit aussi 0 après reconnexion.\n Et le navigateur \"B\" se reconnecte et matérialise l'inbox\n Et le compteur de participants réactif dans \"B\" pour \"Apéro réactif\" vaut 0\n\n Scénario: Un navigateur découvre l'événement public publié dans l'autre\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Et le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Et le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n Quand le compte \"@bob-mb\" publie un événement public \"Concert au kiosque\" dans le navigateur \"B\"\n Et le compte \"@alice-mb\" découvre les événements publics dans le navigateur \"A\" sans être connecté à \"@bob-mb\"\n Alors le navigateur \"A\" voit l'événement public \"Concert au kiosque\"\n", "screenIds": [] }, { @@ -1144,7 +1437,7 @@ export const parsedFeatures: ParsedFeature[] = [ } ], "filePath": "src/modules/auth/features/connexion-nextgraph.feature", - "rawContent": "# language: fr\n@AUTH @priority-1\nFonctionnalité: Connexion NextGraph et chargement des données\n En tant qu'utilisateur\n Je peux me connecter à mon portefeuille NextGraph\n Et charger les données de test dans mon portefeuille\n Afin d'utiliser l'application avec mes propres données\n\n # NB : l'ancien écran /login (LoginScreen) a été retiré — l'accès NextGraph\n # passe désormais par l'AccessGateScreen (barrière ON par défaut), cf.\n # decision_2026-06-17_assisted-wallet-import. Les scénarios @ui qui testaient\n # le LoginScreen ont été supprimés en conséquence.\n\n # --- Data layer: comportement du portefeuille ---\n\n @data\n Scénario: Un portefeuille connecté est vide par défaut\n Alors le portefeuille est connecté\n Et le portefeuille ne contient aucun événement de démonstration\n\n @data\n Scénario: Charger les données de test dans le portefeuille\n Étant donné que le portefeuille est vide\n Quand je charge les données de test\n Alors le portefeuille contient des événements\n Et le portefeuille contient des utilisateurs\n\n @data\n Scénario: Les données de test ne sont pas rechargées si le portefeuille contient déjà des données\n Étant donné que le portefeuille contient déjà des événements\n Quand je charge les données de test\n Alors le nombre d'événements n'a pas changé\n\n @data\n Scénario: Les données du portefeuille sont distinctes des données par défaut\n Étant donné que le portefeuille est vide\n Quand je charge les données de test\n Alors les événements ont des identifiants NextGraph\n Et les utilisateurs ont des identifiants NextGraph\n\n # --- E2E layer: comportement réel dans le navigateur ---\n\n @e2e\n Scénario: La navigation interne met à jour l'URL\n Quand l'utilisateur navigue vers l'écran \"events\"\n Alors l'URL contient \"/events\"\n\n @e2e\n Scénario: L'application ne redirige pas vers le broker quand elle est dans l'iframe\n Alors l'application est toujours dans l'iframe\n\n @e2e\n Scénario: La liste des événements est peuplée après connexion\n Quand l'utilisateur navigue vers l'écran \"events\"\n Alors l'écran d'accueil affiche des événements\n", + "rawContent": "# language: fr\n@AUTH @priority-1\nFonctionnalité: Connexion NextGraph et chargement des données\n En tant qu'utilisateur\n Je peux me connecter à mon portefeuille NextGraph\n Et charger les données de test dans mon portefeuille\n Afin d'utiliser l'application avec mes propres données\n\n # NB : Festipod n'affiche plus d'écran d'accès à lui. Se connecter, c'est le\n # SEUL `ensureIdentity()` attendu par AuthGate ; ce qu'un utilisateur voit ou\n # fait pendant cette attente appartient au SDK, qui le montre. Aucun scénario\n # ici ne pilote donc une barrière d'accès.\n\n # --- Data layer: comportement du portefeuille ---\n\n @data\n Scénario: Un portefeuille connecté est vide par défaut\n Alors le portefeuille est connecté\n Et le portefeuille ne contient aucun événement de démonstration\n\n @data\n Scénario: Charger les données de test dans le portefeuille\n Étant donné que le portefeuille est vide\n Quand je charge les données de test\n Alors le portefeuille contient des événements\n Et le portefeuille contient des utilisateurs\n\n @data\n Scénario: Les données de test ne sont pas rechargées si le portefeuille contient déjà des données\n Étant donné que le portefeuille contient déjà des événements\n Quand je charge les données de test\n Alors le nombre d'événements n'a pas changé\n\n @data\n Scénario: Les données du portefeuille sont distinctes des données par défaut\n Étant donné que le portefeuille est vide\n Quand je charge les données de test\n Alors les événements ont des identifiants NextGraph\n Et les utilisateurs ont des identifiants NextGraph\n\n # --- E2E layer: comportement réel dans le navigateur ---\n\n @e2e\n Scénario: La navigation interne met à jour l'URL\n Quand l'utilisateur navigue vers l'écran \"events\"\n Alors l'URL contient \"/events\"\n\n @e2e\n Scénario: L'application ne redirige pas vers le broker quand elle est dans l'iframe\n Alors l'application est toujours dans l'iframe\n\n @e2e\n Scénario: La liste des événements est peuplée après connexion\n Quand l'utilisateur navigue vers l'écran \"events\"\n Alors l'écran d'accueil affiche des événements\n", "screenIds": [] }, { @@ -1553,170 +1846,6 @@ export const parsedFeatures: ParsedFeature[] = [ "user-profile" ] }, - { - "id": "multistore-stopgap", - "name": "Stopgap multi-store — primitives de données", - "description": "En tant que développeur Je veux valider, contre le vrai broker NextGraph, les primitives du stopgap wallet partagé (création de documents, ORM sur un document créé, aller-retour du sharedWalletShim) avant d'activer le mode multi-document.", - "tags": [ - "@WORKSHOP", - "@priority-1" - ], - "category": "WORKSHOP", - "priority": 1, - "scenarios": [ - { - "name": "L'ORM lit et écrit dans un document créé par doc_create", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "un nouveau document de graphe est créé dans le wallet partagé" - }, - { - "keyword": "Quand", - "text": "j'écris une participation dans ce document via l'ORM" - }, - { - "keyword": "Alors", - "text": "la participation est lisible dans ce document" - } - ] - }, - { - "name": "Le sharedWalletShim fait l'aller-retour par le wallet", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "un compte \"@smoketest\" est enregistré dans le shim" - }, - { - "keyword": "Alors", - "text": "le compte \"@smoketest\" est retrouvé après rechargement du shim" - }, - { - "keyword": "Et", - "text": "le compte \"@smoketest\" possède trois documents de périmètre distincts" - } - ] - }, - { - "name": "Lecture fan-out sur plusieurs documents d'entité (1 doc par entité)", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "deux comptes ayant chacun un document d'événement indexé" - }, - { - "keyword": "Quand", - "text": "j'écris un événement dans chacun de ces deux documents" - }, - { - "keyword": "Alors", - "text": "un abonnement multi-graphes lit les deux événements ensemble" - }, - { - "keyword": "Et", - "text": "l'index public liste les deux documents" - } - ] - } - ], - "filePath": "src/modules/workshop/features/multistore-stopgap.feature", - "rawContent": "# language: fr\n@WORKSHOP @priority-1\nFonctionnalité: Stopgap multi-store — primitives de données\n En tant que développeur\n Je veux valider, contre le vrai broker NextGraph, les primitives du stopgap\n wallet partagé (création de documents, ORM sur un document créé, aller-retour\n du sharedWalletShim) avant d'activer le mode multi-document.\n\n # --- Data (broker réel) ---\n\n @data\n Scénario: L'ORM lit et écrit dans un document créé par doc_create\n Étant donné un nouveau document de graphe est créé dans le wallet partagé\n Quand j'écris une participation dans ce document via l'ORM\n Alors la participation est lisible dans ce document\n\n @data\n Scénario: Le sharedWalletShim fait l'aller-retour par le wallet\n Étant donné un compte \"@smoketest\" est enregistré dans le shim\n Alors le compte \"@smoketest\" est retrouvé après rechargement du shim\n Et le compte \"@smoketest\" possède trois documents de périmètre distincts\n\n @data\n Scénario: Lecture fan-out sur plusieurs documents d'entité (1 doc par entité)\n Étant donné deux comptes ayant chacun un document d'événement indexé\n Quand j'écris un événement dans chacun de ces deux documents\n Alors un abonnement multi-graphes lit les deux événements ensemble\n Et l'index public liste les deux documents\n", - "screenIds": [] - }, - { - "id": "protected-store", - "name": "Store protected natif — ouverture et aller-retour (axe A)", - "description": "En tant que développeur Je veux vérifier, contre le vrai broker NextGraph, que le store natif protected (`did:ng:${protected_store_id}`) s'ouvre pour lecture ET écriture comme le store private, avant de basculer les entités du domaine vers lui (T02.h, axe A).", - "tags": [ - "@WORKSHOP", - "@priority-1" - ], - "category": "WORKSHOP", - "priority": 1, - "scenarios": [ - { - "name": "L'ORM lit et écrit dans le store protected natif (aller-retour)", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "le store protected natif est souscrit via l'ORM" - }, - { - "keyword": "Quand", - "text": "j'écris une participation dans le store protected via l'ORM" - }, - { - "keyword": "Alors", - "text": "la participation est lisible dans le store protected" - } - ] - }, - { - "name": "SPARQL fait l'aller-retour dans le store protected natif", - "tags": [], - "steps": [ - { - "keyword": "Quand", - "text": "j'écris puis relis un triplet dans le store protected via SPARQL" - }, - { - "keyword": "Alors", - "text": "le triplet est retrouvé dans le store protected sans RepoNotFound" - } - ] - } - ], - "filePath": "src/modules/workshop/features/protected-store.feature", - "rawContent": "# language: fr\n@WORKSHOP @priority-1\nFonctionnalité: Store protected natif — ouverture et aller-retour (axe A)\n En tant que développeur\n Je veux vérifier, contre le vrai broker NextGraph, que le store natif protected\n (`did:ng:${protected_store_id}`) s'ouvre pour lecture ET écriture comme le store\n private, avant de basculer les entités du domaine vers lui (T02.h, axe A).\n\n # --- Data (broker réel) — ÉTAPE GATING ---\n\n @data\n Scénario: L'ORM lit et écrit dans le store protected natif (aller-retour)\n Étant donné le store protected natif est souscrit via l'ORM\n Quand j'écris une participation dans le store protected via l'ORM\n Alors la participation est lisible dans le store protected\n\n @data\n Scénario: SPARQL fait l'aller-retour dans le store protected natif\n Quand j'écris puis relis un triplet dans le store protected via SPARQL\n Alors le triplet est retrouvé dans le store protected sans RepoNotFound\n", - "screenIds": [] - }, - { - "id": "read-filter", - "name": "Filtre ReadCap (ng-eventually)", - "description": "En tant que développeur Je veux valider, contre le vrai broker, que le filtre de lecture de la lib applique les ReadCap au niveau du DOCUMENT (le repo où vit chaque item) sur le vrai set réactif de l'ORM : on ne voit un document que si on détient sa ReadCap. En mono-store (tout dans un seul repo) c'est donc tout-ou-rien sur ce document — le comportement fidèle de NextGraph.", - "tags": [ - "@WORKSHOP", - "@priority-1" - ], - "category": "WORKSHOP", - "priority": 1, - "scenarios": [ - { - "name": "On ne voit un document que si on détient sa ReadCap", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "le wallet contient des participations dans un document" - }, - { - "keyword": "Quand", - "text": "je gouverne ce document par une ReadCap accordée à un autre utilisateur" - }, - { - "keyword": "Alors", - "text": "l'utilisateur courant ne voit aucune participation de ce document" - }, - { - "keyword": "Quand", - "text": "l'utilisateur courant obtient la ReadCap du document" - }, - { - "keyword": "Alors", - "text": "il voit toutes les participations du document" - } - ] - } - ], - "filePath": "src/modules/workshop/features/read-filter.feature", - "rawContent": "# language: fr\n@WORKSHOP @priority-1\nFonctionnalité: Filtre ReadCap (ng-eventually)\n En tant que développeur\n Je veux valider, contre le vrai broker, que le filtre de lecture de la lib\n applique les ReadCap au niveau du DOCUMENT (le repo où vit chaque item) sur le\n vrai set réactif de l'ORM : on ne voit un document que si on détient sa ReadCap.\n En mono-store (tout dans un seul repo) c'est donc tout-ou-rien sur ce document\n — le comportement fidèle de NextGraph.\n\n @data\n Scénario: On ne voit un document que si on détient sa ReadCap\n Étant donné le wallet contient des participations dans un document\n Quand je gouverne ce document par une ReadCap accordée à un autre utilisateur\n Alors l'utilisateur courant ne voit aucune participation de ce document\n Quand l'utilisateur courant obtient la ReadCap du document\n Alors il voit toutes les participations du document\n", - "screenIds": [] - }, { "id": "us-19", "name": "US-19 Recevoir un récapitulatif des prochaines rencontres", @@ -2440,10 +2569,44 @@ export const parsedFeatures: ParsedFeature[] = [ "rawContent": "# language: fr\n@EVENT @priority-3\nFonctionnalité: US-8 Consulter et m'inscrire à un macro-événement\n En tant qu'utilisateur\n Je peux consulter et m'inscrire à un événement de type \"Macro-événement\"\n En créant ou en rattachant des événements existants à ce macro-événement\n Afin de voir une consolidation des commentaires/liens/ressources/participants\n\n Contexte:\n Étant donné que je suis connecté en tant qu'utilisateur\n\n Scénario: Consulter un macro-événement\n * Scénario non implémenté\n\n Scénario: Voir les événements rattachés\n * Scénario non implémenté\n\n Scénario: Rattacher un événement existant\n * Scénario non implémenté\n\n Scénario: Voir la consolidation des participants\n * Scénario non implémenté\n\n Scénario: Créer un macro-événement\n * Scénario non implémenté\n\n Scénario: Voir la consolidation des commentaires/liens/ressources\n * Scénario non implémenté\n\n Scénario: Rattacher à une thématique particulière\n * Scénario non implémenté\n\n Scénario: Gérer un événement répété sur plusieurs périodes\n * Scénario non implémenté\n", "screenIds": [] }, + { + "id": "accueil-connecte-rend", + "name": "L'accueil connecté rend du contenu réel", + "description": "En tant qu'utilisateur qui vient de se connecter Je veux que l'écran d'accueil rende réellement l'application Afin de ne jamais retomber sur une page blanche une fois connecté", + "tags": [ + "@e2e", + "@smoke" + ], + "category": "UNKNOWN", + "priority": 3, + "scenarios": [ + { + "name": "L'accueil rend du contenu réel sans erreur après connexion", + "tags": [], + "steps": [ + { + "keyword": "Quand", + "text": "l'application connectée affiche l'accueil" + }, + { + "keyword": "Alors", + "text": "l'accueil rend un contenu d'application réel" + }, + { + "keyword": "Et", + "text": "aucune erreur runtime n'a été émise pendant le boot connecté" + } + ] + } + ], + "filePath": "src/modules/home/features/accueil-connecte-rend.feature", + "rawContent": "# language: fr\n#\n# SMOKE « crash de rendu connecté / page blanche ».\n#\n# Régression gardée : après connexion au broker, seul le bandeau de l'iframe\n# s'affichait et le vrai App ne rendait rien (page blanche). Aucun test\n# n'attrapait cette CLASSE de bug — un crash de rendu qui ne survient QUE une\n# fois l'app connectée et montée sur des données réelles.\n#\n# Ce smoke boote le VRAI App (serveur src/index.ts, pas le harness __testData),\n# se connecte au broker (fourni par le hook Before @e2e), navigue vers l'accueil\n# connecté (HomeScreen, qui consomme useFestipodData) et vérifie DEUX choses :\n# 1. l'accueil rend un élément d'app significatif (barre de navigation + bouton\n# « Relayer »), preuve que HomeScreen a monté — pas juste un spinner ou le\n# bandeau du broker ;\n# 2. AUCUNE erreur runtime (pageerror / console.error) n'a été émise pendant\n# le boot connecté — un throw dans un composant/provider monté après\n# connexion vire le smoke au rouge.\n#\n# Tout futur crash de rendu connecté = ce smoke passe au rouge.\n\n@e2e @smoke\nFonctionnalité: L'accueil connecté rend du contenu réel\n En tant qu'utilisateur qui vient de se connecter\n Je veux que l'écran d'accueil rende réellement l'application\n Afin de ne jamais retomber sur une page blanche une fois connecté\n\n Scénario: L'accueil rend du contenu réel sans erreur après connexion\n Quand l'application connectée affiche l'accueil\n Alors l'accueil rend un contenu d'application réel\n Et aucune erreur runtime n'a été émise pendant le boot connecté\n", + "screenIds": [] + }, { "id": "multibrowser-harness", - "name": "Harness multi-navigateur — modèles private-wallet et shared-wallet", - "description": "Pour comparer sereinement les deux modèles de wallet (chacun le sien vs partagé) En tant que développeur du stopgap puis de la cible NextGraph Le harness e2e doit piloter plusieurs navigateurs isolés dans un seul scénario, sous l'un OU l'autre modèle de wallet — deux axes orthogonaux.", + "name": "Harness multi-navigateur — modèle shared-wallet", + "description": "Pour valider le provisioning du wallet partagé sur plusieurs navigateurs En tant que développeur du stopgap puis de la cible NextGraph Le harness e2e doit piloter plusieurs navigateurs isolés dans un seul scénario, tous porteurs du wallet partagé.", "tags": [ "@data", "@multibrowser" @@ -2451,66 +2614,6 @@ export const parsedFeatures: ParsedFeature[] = [ "category": "UNKNOWN", "priority": 3, "scenarios": [ - { - "name": "Deux navigateurs avec leur propre wallet ont des stockages locaux indépendants", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "un navigateur \"A\" avec son propre wallet" - }, - { - "keyword": "Et", - "text": "un navigateur \"B\" avec son propre wallet" - }, - { - "keyword": "Quand", - "text": "j'écris \"valeur-A\" sous la clé \"sonde\" dans le navigateur \"A\"" - }, - { - "keyword": "Alors", - "text": "la clé \"sonde\" vaut \"valeur-A\" dans le navigateur \"A\"" - }, - { - "keyword": "Et", - "text": "la clé \"sonde\" est absente dans le navigateur \"B\"" - } - ] - }, - { - "name": "Sur l'origine du broker, deux navigateurs private-wallet restent isolés", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "un navigateur \"A\" avec son propre wallet" - }, - { - "keyword": "Et", - "text": "un navigateur \"B\" avec son propre wallet" - }, - { - "keyword": "Quand", - "text": "le navigateur \"A\" charge l'origine du broker" - }, - { - "keyword": "Et", - "text": "le navigateur \"B\" charge l'origine du broker" - }, - { - "keyword": "Et", - "text": "j'écris \"faux-wallet\" sous la clé \"ng_probe\" dans le navigateur \"A\"" - }, - { - "keyword": "Alors", - "text": "la clé \"ng_probe\" vaut \"faux-wallet\" dans le navigateur \"A\"" - }, - { - "keyword": "Et", - "text": "la clé \"ng_probe\" est absente dans le navigateur \"B\"" - } - ] - }, { "name": "Deux navigateurs partageant le wallet se connectent tous deux à NextGraph", "tags": [], @@ -2540,44 +2643,10 @@ export const parsedFeatures: ParsedFeature[] = [ "text": "le navigateur \"B\" est connecté à NextGraph" } ] - }, - { - "name": "Parcours humain — le testeur importe le portefeuille fourni par Festipod et se connecte", - "tags": [], - "steps": [ - { - "keyword": "Étant donné", - "text": "un nouveau testeur ouvre Festipod en staging sur un navigateur vierge" - }, - { - "keyword": "Alors", - "text": "Festipod affiche l'écran d'accès avec le portefeuille à télécharger" - }, - { - "keyword": "Quand", - "text": "le testeur télécharge le portefeuille et l'importe sur nextgraph.eu" - }, - { - "keyword": "Et", - "text": "le testeur revient sur Festipod et clique « Entrer »" - }, - { - "keyword": "Alors", - "text": "Festipod est connecté et propose de choisir un nom d'utilisateur" - }, - { - "keyword": "Quand", - "text": "le testeur choisit un nom d'utilisateur" - }, - { - "keyword": "Alors", - "text": "il arrive sur l'accueil de l'application" - } - ] } ], "filePath": "src/modules/workshop/features/multibrowser-harness.feature", - "rawContent": "# language: fr\n@data @multibrowser\nFonctionnalité: Harness multi-navigateur — modèles private-wallet et shared-wallet\n Pour comparer sereinement les deux modèles de wallet (chacun le sien vs partagé)\n En tant que développeur du stopgap puis de la cible NextGraph\n Le harness e2e doit piloter plusieurs navigateurs isolés dans un seul scénario,\n sous l'un OU l'autre modèle de wallet — deux axes orthogonaux.\n\n # --- Axe machinerie : isolation des contextes (modèle private-wallet) ---\n\n @private-wallet\n Scénario: Deux navigateurs avec leur propre wallet ont des stockages locaux indépendants\n Étant donné un navigateur \"A\" avec son propre wallet\n Et un navigateur \"B\" avec son propre wallet\n Quand j'écris \"valeur-A\" sous la clé \"sonde\" dans le navigateur \"A\"\n Alors la clé \"sonde\" vaut \"valeur-A\" dans le navigateur \"A\"\n Et la clé \"sonde\" est absente dans le navigateur \"B\"\n\n # Le wallet NextGraph vit sur l'origine du broker (nextgraph.net). Ce scénario\n # prouve l'isolation du stockage LÀ, pas seulement sur l'origine locale.\n @private-wallet\n Scénario: Sur l'origine du broker, deux navigateurs private-wallet restent isolés\n Étant donné un navigateur \"A\" avec son propre wallet\n Et un navigateur \"B\" avec son propre wallet\n Quand le navigateur \"A\" charge l'origine du broker\n Et le navigateur \"B\" charge l'origine du broker\n Et j'écris \"faux-wallet\" sous la clé \"ng_probe\" dans le navigateur \"A\"\n Alors la clé \"ng_probe\" vaut \"faux-wallet\" dans le navigateur \"A\"\n Et la clé \"ng_probe\" est absente dans le navigateur \"B\"\n\n # --- Axe wallet : provisioning shared-wallet (injection storageState) ---\n\n # Deux navigateurs distincts portent LE MÊME wallet partagé (injecté au niveau\n # harness). Tous deux atteignent l'app connectée à NextGraph sans login manuel.\n @shared-wallet\n Scénario: Deux navigateurs partageant le wallet se connectent tous deux à NextGraph\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Quand le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Alors le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n\n # --- Distribution produit : import ASSISTÉ (pas d'auto-import zéro-touche) ---\n #\n # L'auto-import zéro-touche par l'app est PROUVÉ IMPOSSIBLE avec le broker\n # hébergé : il n'implémente pas l'import inline pendant l'auth web-app et\n # renvoie vers nextgraph.eu (cross-origin, non pilotable par Festipod). Voir\n # concept nextgraph-platform → knowledge_broker-import-constraint et\n # decision_2026-06-17_assisted-wallet-import.\n #\n # PARCOURS HUMAIN COMPLET — exerce la VRAIE app (staging, gate ON) de bout en\n # bout : Festipod propose le FICHIER du portefeuille → l'humain le télécharge et\n # l'importe sur nextgraph.eu (« Import a Wallet File » + mot de passe) → revient\n # → « Entrer » → connecté. Le FICHIER est la primitive correcte (statique,\n # réutilisable) — le TextCode est un transfert temporaire 5 min, inutilisable à\n # embarquer (cf. nextgraph-platform → knowledge_broker-import-constraint).\n # (≠ scénario @shared-wallet ci-dessus, qui INJECTE le wallet via storageState\n # et court-circuite donc l'import — provisioning de TEST, pas le flux produit.)\n #\n # EXCLU DU RUN PAR DÉFAUT (cucumber.json : \"not @wip and not @humain\", T02.f) :\n # ce scénario pilote nextgraph.eu EN DIRECT (import du fichier wallet sur un site\n # externe non maîtrisé par Festipod) → non déterministe en CI et, en cas d'échec\n # réseau, il ferme le contexte navigateur et faisait CASCADER les scénarios @data\n # suivants. C'est une validation de FIDÉLITÉ HUMAINE, à lancer explicitement\n # (`--tags @humain`), pas un test automatisé du run par défaut.\n @shared-wallet @assisted-import @humain\n Scénario: Parcours humain — le testeur importe le portefeuille fourni par Festipod et se connecte\n Étant donné un nouveau testeur ouvre Festipod en staging sur un navigateur vierge\n Alors Festipod affiche l'écran d'accès avec le portefeuille à télécharger\n Quand le testeur télécharge le portefeuille et l'importe sur nextgraph.eu\n Et le testeur revient sur Festipod et clique « Entrer »\n Alors Festipod est connecté et propose de choisir un nom d'utilisateur\n Quand le testeur choisit un nom d'utilisateur\n Alors il arrive sur l'accueil de l'application\n", + "rawContent": "# language: fr\n@data @multibrowser\nFonctionnalité: Harness multi-navigateur — modèle shared-wallet\n Pour valider le provisioning du wallet partagé sur plusieurs navigateurs\n En tant que développeur du stopgap puis de la cible NextGraph\n Le harness e2e doit piloter plusieurs navigateurs isolés dans un seul scénario,\n tous porteurs du wallet partagé.\n\n # --- Axe wallet : provisioning shared-wallet (injection storageState) ---\n\n # Deux navigateurs distincts portent LE MÊME wallet partagé (injecté au niveau\n # harness). Tous deux atteignent l'app connectée à NextGraph sans login manuel.\n @shared-wallet\n Scénario: Deux navigateurs partageant le wallet se connectent tous deux à NextGraph\n Étant donné un navigateur \"A\" avec le wallet partagé\n Et un navigateur \"B\" avec le wallet partagé\n Quand le navigateur \"A\" charge l'application via le broker\n Et le navigateur \"B\" charge l'application via le broker\n Alors le navigateur \"A\" est connecté à NextGraph\n Et le navigateur \"B\" est connecté à NextGraph\n", "screenIds": [] }, { diff --git a/src/shared/data/registration.ts b/src/shared/data/registration.ts index 77bbf85..6872aa1 100644 --- a/src/shared/data/registration.ts +++ b/src/shared/data/registration.ts @@ -1,12 +1,11 @@ /** * Registration domain glue — the FESTIPOD interpretation layered on top of the - * GENERIC `@ng-eventually/client` `inbox` mechanism (T02.b) and the low-level + * GENERIC `@ng-eventually/polyfill` `inbox` mechanism (T02.b) and the low-level * `docs` SPARQL primitives. * - * The lib stays domain-agnostic: it knows only "deposit an opaque payload into - * an inbox document NURI" and "run a SPARQL update against the real injected - * ng". THIS module supplies the Festipod domain: - * - how to derive a meeting-point / host inbox NURI (`hostInboxNuri`), + * The SDK stays domain-agnostic: it knows only "deposit an opaque payload for a + * document" and "run a SPARQL update against the real injected ng". THIS module + * supplies the Festipod domain: * - the shape of the deposit payload (`RegistrationPayload`), * - how a deposit becomes a host-facing `FpNotification` (`buildNotification`), * - the SPARQL DELETE-WHERE that DURABLY removes a Participation server-side @@ -14,13 +13,14 @@ * bug (see caveat_participation-deletion). * * Importable by `shared/` and by domain modules (meeting/notification) — it never - * imports a module, only the lib. See T02.a (shapes) / T02.b (inbox). + * imports a module, only the SDK. See T02.a (shapes) / T02.b (inbox). */ -import { inbox, docs, escapeLiteral, escapeIri, assertNuri } from '@ng-eventually/client'; -import type { Nuri } from '@ng-eventually/client'; +import { inbox, docs } from '@ng-eventually/polyfill'; +import type { Nuri, NuriLike } from '@ng-eventually/polyfill'; import { sessionPromise } from '../utils/ngSession'; -import { documentInbox, listMyEntityDocs } from '../utils/storeRegistry'; +import { listMyEntityDocs } from '../utils/storeRegistry'; +import { escapeLiteral, escapeIri } from './sparqlEscape'; import type { FpNotificationData } from './types'; /** Notification IRI/type constants (mirror the SHEX Notification shape). */ @@ -113,25 +113,6 @@ export function canonicalEventId(id: string): string { return i === -1 ? id : id.slice(0, i); } -/** - * Resolve the inbox document NURI for a meeting point / host. - * - * Preference order: the explicit MeetingPoint `inbox` NURI (SHEX field, T02.a) - * when known → else THE EVENT DOCUMENT'S OWN INBOX (`documentInbox(eventDoc)`). - * - * An inbox BELONGS to someone — there is no inbox common to every identity — so - * the deposit target is the inbox of the document the deposit is ABOUT. `eventId` - * is the event's document NURI (one document per entity: the entity's `@id` IS - * its document), which is exactly what `documentInbox` takes. The owner reads it - * back at its next connection; a depositor that is not the owner must have been - * GIVEN the inbox NURI — that is `explicitInbox` (the MeetingPoint `fp:inbox` - * field), the only cross-identity path. - */ -export async function hostInboxNuri(eventId: Nuri, explicitInbox?: Nuri): Promise { - if (explicitInbox) return explicitInbox; - return documentInbox(eventId); -} - /** * Build the host-facing notification from a registration deposit. The recipient * is the event host; `ref` points at the event; the payload carries the raw @@ -154,9 +135,12 @@ export function buildNotification( } /** - * Deposit a registration into the host's inbox (generic lib `inbox.post`) + + * Deposit a registration FOR THE EVENT DOCUMENT (`inbox.postToDocument`) + * return the deposit ts so the caller can mint a matching notification. * + * A deposit names the DOCUMENT it is about, never an address: the depositor + * holds no inbox address and needs none. Only the event's owner reads it back. + * * The registrant identity travels in the PAYLOAD (`userId`), which the host * materializer reads. The transport-level `from` is left ANONYMOUS (`null`): the * SDK binds `from` to the depositor's own identity and rejects a mismatched one @@ -164,13 +148,15 @@ export function buildNotification( * domain identity belongs in the payload, not in the transport `from`. */ export async function depositRegistration( - targetInbox: Nuri, - eventId: string, + eventDoc: NuriLike, registrantId: string | null, participationDoc?: string, ): Promise<{ ts: number; uid: string }> { const ts = Date.now(); const uid = mintDepositUid(); + // One document per entity: the event's `@id` IS its document, so the deposit + // target and the payload's event key are the same value. + const eventId: string = eventDoc; const payload: RegistrationPayload = { kind: NOTIF_TYPE_NEW_PARTICIPANT, eventId, @@ -178,7 +164,7 @@ export async function depositRegistration( uid, participationDoc, }; - await inbox.post(targetInbox, { from: null, payload, ts }); + await inbox.postToDocument(eventDoc, { from: null, payload, ts }); console.log( `[Attendance] deposit new-participant → inbox for event=${canonicalEventId(eventId)} ` + `user=${registrantId ?? '(anon)'} uid=${uid}`, @@ -187,7 +173,7 @@ export async function depositRegistration( } /** - * Deposit a LEAVE marker into the event's inbox (Option B, symmetric to + * Deposit a LEAVE marker FOR THE EVENT DOCUMENT (Option B, symmetric to * `depositRegistration`). The owner materializes it to remove the matching * registration from the active set. `regUid` (the join deposit's uid) lets the * owner cancel exactly that registration; when unknown, the owner falls back to @@ -195,13 +181,13 @@ export async function depositRegistration( * re-synced leave removes an already-removed registration → no double-decrement. */ export async function depositLeave( - targetInbox: Nuri, - eventId: string, + eventDoc: NuriLike, registrantId: string | null, regUid?: string, ): Promise<{ ts: number; uid: string }> { const ts = Date.now(); const uid = mintDepositUid(); + const eventId: string = eventDoc; const payload: RegistrationPayload = { kind: NOTIF_TYPE_LEAVE_PARTICIPANT, eventId, @@ -209,7 +195,7 @@ export async function depositLeave( uid, regUid, }; - await inbox.post(targetInbox, { from: null, payload, ts }); + await inbox.postToDocument(eventDoc, { from: null, payload, ts }); console.log( `[Attendance] deposit leave-participant → inbox for event=${canonicalEventId(eventId)} ` + `user=${registrantId ?? '(anon)'} uid=${uid} regUid=${regUid ?? '(none)'}`, @@ -347,20 +333,23 @@ export async function readRegistrationNotifications( * just-written participation, so a second join checking only the reactive set would * write a duplicate. Querying the broker sees the real state regardless of read lag. * - * Scoped to the CURRENT account (`identifier`) via `listMyEntityDocs` — a user's own - * participations live in their own account, so there is NO need to fan out over all - * accounts (which would open/sync other accounts' unsynced docs → the ~75s hang). + * Scoped to MY OWN protected documents via `listMyEntityDocs` — a user's own + * participations live in their own documents, so there is NO need to fan out over + * anyone else's (which would open/sync unsynced docs → the ~75s hang). */ export async function countUserParticipations( - identifier: string, eventId: string, userId: string, ): Promise { const sid = (await sessionPromise).session_id; - const docs_ = await listMyEntityDocs(identifier, 'protected'); + const docs_ = await listMyEntityDocs('protected'); let total = 0; for (const g of docs_) { - total += await countParticipations(sid, g, eventId, userId).catch(() => 0); + // NO `.catch(() => 0)` here. A failed count means UNKNOWN, never zero: this + // number decides whether a participation already exists, and answering "none" + // when we could not find out is what writes a duplicate. The rejection travels + // to the caller, which surfaces it. + total += await countParticipations(sid, g, eventId, userId); } return total; } @@ -387,8 +376,8 @@ export interface DeleteParticipationResult { * serialized these fields — this is a COUNT (read-only), so tolerance here is * safe (unlike a DELETE, it can never over-remove). */ async function countParticipations( - sid: string, - graphNuri: Nuri, + sid: string | number, + graphNuri: NuriLike, eventId: string, userId: string, ): Promise { @@ -398,7 +387,7 @@ async function countParticipations( // into the anchored DEFAULT graph (one doc per entity), so this count reads that // same anchored default graph — anchored to `graphNuri`, no `GRAPH` clause. This // is the CANONICAL SDK read/write shape (write and read the same anchored default - // graph); SDK graph details live in `@ng-eventually/client`, not here. + // graph); SDK graph details live in `@ng-eventually/polyfill`, not here. const query = ` SELECT (COUNT(DISTINCT ?s) AS ?n) WHERE { ?s a <${P.partType}> ; @@ -446,7 +435,7 @@ async function countParticipations( * state for the immediate UI, AND only once `remaining === 0`. */ export async function deleteParticipation( - graphNuri: Nuri, + graphNuri: NuriLike, eventId: string, userId: string, subjectIri?: string, @@ -487,7 +476,7 @@ export async function deleteParticipation( // graph — anchored to `graphNuri`, no `GRAPH` clause. Write, read and delete all // use the one CANONICAL anchored-default-graph shape so they stay consistent (a // mismatched target here would no-op the delete → the F2 resurrection). SDK graph - // details live in `@ng-eventually/client`, not here. + // details live in `@ng-eventually/polyfill`, not here. const sweep = ` DELETE { ?s ?p ?o } WHERE { @@ -506,8 +495,8 @@ export async function deleteParticipation( // known. This catches the residual case where an object-form drift makes the // (event, user) sweep miss a subject we nonetheless hold the id for — exact, // bound as an IRI, cannot no-op on drift. - if (hasSubject) { - const s = assertNuri(subjectIri!); + if (subjectIri && hasSubject) { + const s = escapeIri(subjectIri); // Anchored default-graph (no `GRAPH` clause), like the sweep above. const bySubject = ` DELETE { <${s}> ?p ?o } @@ -535,7 +524,7 @@ export async function insertNotification( // recipient/ref are bare domain ids ("user-1", "event-1"), not absolute IRIs; // store them as string literals to keep the INSERT valid (the raw shape read // is not the primary surfacing path — the inbox read is). Every literal is - // escaped via the lib's escapeLiteral (guards \ " \n \r \t — SPARQL injection). + // escaped via the app's escapeLiteral (guards \ " \n \r \t — SPARQL injection). const refTriple = notif.ref ? `\n <${P.ref}> "${escapeLiteral(notif.ref)}" ;` : ''; const payloadTriple = notif.payload ? `\n <${P.payload}> "${escapeLiteral(notif.payload)}" ;` @@ -543,10 +532,10 @@ export async function insertNotification( // NO explicit `GRAPH <…>` wrapper: anchored to `graphNuri`, the INSERT lands in // that doc's anchored DEFAULT graph — the CANONICAL SDK write shape, consistent // with every other per-entity write (writeEntity / updateEntityField). SDK graph - // details live in `@ng-eventually/client`, not here. + // details live in `@ng-eventually/polyfill`, not here. const update = ` INSERT DATA { - <${assertNuri(subject)}> a <${NOTIF_TYPE_IRI}> ; + <${escapeIri(subject)}> a <${NOTIF_TYPE_IRI}> ; <${P.recipient}> "${escapeLiteral(notif.recipientId)}" ; <${P.type}> "${escapeLiteral(notif.type)}" ;${refTriple}${payloadTriple} <${P.timestamp}> "${escapeLiteral(notif.timestamp)}" ; diff --git a/src/shared/data/shapeAdapters.ts b/src/shared/data/shapeAdapters.ts index 1c97a10..55f850c 100644 --- a/src/shared/data/shapeAdapters.ts +++ b/src/shared/data/shapeAdapters.ts @@ -12,7 +12,7 @@ * mapping remains, extracted here. */ -import type { UnionSubject } from '@ng-eventually/client'; +import type { UnionSubject } from '@ng-eventually/polyfill'; import type { FpEventData, FpUserData, FpParticipationData } from './types'; const FP = 'http://festipod.org/'; diff --git a/src/shared/data/sparqlEscape.ts b/src/shared/data/sparqlEscape.ts new file mode 100644 index 0000000..1689fac --- /dev/null +++ b/src/shared/data/sparqlEscape.ts @@ -0,0 +1,36 @@ +/** + * SPARQL escaping for the app's own raw-query paths — the ONE place Festipod + * escapes a value it splices into a SPARQL string. + * + * The SDK publishes no escaper: every SDK entry takes a value and validates it + * at the door. But `docs.sparqlQuery` / `docs.sparqlUpdate` take a query STRING + * the app builds itself (entityWrites, registration), so the app owns the + * escaping of anything it interpolates into that string. Kept minimal and used + * from both call sites rather than duplicated. + */ + +/** + * Escape a value landing inside a `"…"` SPARQL literal: backslash and quote + * first (so the added escapes are not re-escaped), then the control characters + * that would otherwise terminate the literal. + */ +export function escapeLiteral(value: string): string { + return value + .replace(/\\/g, '\\\\') + .replace(/"/g, '\\"') + .replace(/\n/g, '\\n') + .replace(/\r/g, '\\r') + .replace(/\t/g, '\\t'); +} + +/** + * Escape a value landing inside a `<…>` SPARQL IRIREF: percent-encode every + * character an IRIREF may not contain (the delimiters, plus the C0 controls and + * space). A well-formed document reference passes through unchanged. + */ +export function escapeIri(value: string): string { + return value.replace( + /[<>"{}|^`\\\u0000-\u0020]/g, + c => `%${c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0')}`, + ); +} diff --git a/src/shared/data/stepDefinitions.ts b/src/shared/data/stepDefinitions.ts index 3eda0a5..740d93c 100644 --- a/src/shared/data/stepDefinitions.ts +++ b/src/shared/data/stepDefinitions.ts @@ -14,358 +14,736 @@ export const stepDefinitions: StepDefinitionInfo[] = [ "pattern": "le portefeuille est vide", "keyword": "Given", "file": "connexion.steps.ts", - "sourceCode": "Given('le portefeuille est vide', async function (this: FestipodWorld) {\n // Verify starting state: the harness graph should have its own seeded data.\n // We clear events/users/participations to simulate a truly empty wallet.\n await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n // Delete all events\n for (const e of [...td.events]) td.events.delete(e);\n // Delete all users\n for (const u of [...td.users]) td.users.delete(u);\n // Delete all participations\n for (const p of [...td.participations]) td.participations.delete(p);\n });", - "lineNumber": 10 + "sourceCode": "Given('le portefeuille est vide', async function (this: FestipodWorld) {\n // A fast INSTANT CHECK — assert the reactive read already shows nothing — NOT\n // the old `clearWallet` per-entity-doc fan-out (a full wallet enumeration that\n // was itself slow). No mutation, no polling.\n const counts = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return { events: td.events.size, users: td.users.size };\n });", + "lineNumber": 7 }, { "pattern": "le portefeuille contient déjà des événements", "keyword": "Given", "file": "connexion.steps.ts", "sourceCode": "Given('le portefeuille contient déjà des événements', async function (this: FestipodWorld) {\n const count = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.events.size;\n });", - "lineNumber": 32 + "lineNumber": 19 }, { "pattern": "je charge les données de test", "keyword": "When", "file": "connexion.steps.ts", "sourceCode": "When('je charge les données de test', async function (this: FestipodWorld) {\n // Store count before loading for the idempotency test\n const countBefore = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.events.size;\n });", - "lineNumber": 53 + "lineNumber": 43 }, { "pattern": "le portefeuille est connecté", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('le portefeuille est connecté', async function (this: FestipodWorld) {\n const hasSession = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.session !== undefined && td.session !== null;\n });", - "lineNumber": 81 + "lineNumber": 86 }, { "pattern": "le portefeuille ne contient aucun événement de démonstration", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('le portefeuille ne contient aucun événement de démonstration', async function (this: FestipodWorld) {\n // Wallet should be empty — no auto-seeding.\n // Also verify through the app's data context (same view as screens).\n const result = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return {\n walletEvents: td.events.size,\n appEvents: td.appData?.events?.length ?? -1,\n ngStatus: td.ngStatus,\n };\n });", - "lineNumber": 89 + "lineNumber": 94 }, { "pattern": "le portefeuille contient des événements", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('le portefeuille contient des événements', async function (this: FestipodWorld) {\n const count = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.events.size;\n });", - "lineNumber": 106 + "lineNumber": 111 }, { "pattern": "le portefeuille contient des utilisateurs", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('le portefeuille contient des utilisateurs', async function (this: FestipodWorld) {\n const count = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.users.size;\n });", - "lineNumber": 114 + "lineNumber": 119 }, { "pattern": "le nombre d'événements n'a pas changé", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('le nombre d\\'événements n\\'a pas changé', async function (this: FestipodWorld) {\n const countBefore = (this as any)._eventCountBefore as number;\n const countAfter = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return td.events.size;\n });", - "lineNumber": 122 + "lineNumber": 127 }, { "pattern": "les événements ont des identifiants NextGraph", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('les événements ont des identifiants NextGraph', async function (this: FestipodWorld) {\n const ids = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return [...td.events].map((e: any) => e['@id']);\n });", - "lineNumber": 131 + "lineNumber": 136 }, { "pattern": "les utilisateurs ont des identifiants NextGraph", "keyword": "Then", "file": "connexion.steps.ts", "sourceCode": "Then('les utilisateurs ont des identifiants NextGraph', async function (this: FestipodWorld) {\n const ids = await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n return [...td.users].map((u: any) => u['@id']);\n });", - "lineNumber": 142 + "lineNumber": 147 }, { "pattern": "l'utilisateur navigue vers l'écran {string}", "keyword": "When", "file": "connexion.steps.ts", - "sourceCode": "When('l\\'utilisateur navigue vers l\\'écran {string}', async function (this: FestipodWorld, screenId: string) {\n await this.appFrame!.evaluate((id: string) => {\n window.location.hash = `#/demo/${id}`;\n }, screenId);\n // Wait for React to process the navigation\n await this.appFrame!.waitForTimeout(1500);\n});", - "lineNumber": 19 + "sourceCode": "When('l\\'utilisateur navigue vers l\\'écran {string}', async function (this: FestipodWorld, screenId: string) {\n const target = pathForScreen(screenId);\n await this.appFrame!.evaluate((path: string) => {\n window.history.pushState(null, '', path);\n window.dispatchEvent(new PopStateEvent('popstate'));\n }, target);\n await this.appFrame!.waitForTimeout(1500);\n});", + "lineNumber": 56 }, { "pattern": "l'utilisateur navigue vers l'écran {string} sans historique", "keyword": "When", "file": "connexion.steps.ts", - "sourceCode": "When('l\\'utilisateur navigue vers l\\'écran {string} sans historique', async function (this: FestipodWorld, screenId: string) {\n // Use replaceState to navigate without creating a back-history entry\n // (simulates the app being loaded directly at a DemoMode URL in the broker iframe)\n await this.appFrame!.evaluate((id: string) => {\n window.history.replaceState(null, '', `#/demo/${id}`);\n window.dispatchEvent(new HashChangeEvent('hashchange'));\n }, screenId);\n await this.appFrame!.waitForTimeout(1500);\n});", - "lineNumber": 27 + "sourceCode": "When('l\\'utilisateur navigue vers l\\'écran {string} sans historique', async function (this: FestipodWorld, screenId: string) {\n const target = pathForScreen(screenId);\n await this.appFrame!.evaluate((path: string) => {\n window.history.replaceState(null, '', path);\n window.dispatchEvent(new PopStateEvent('popstate'));\n }, target);\n await this.appFrame!.waitForTimeout(1500);\n});", + "lineNumber": 65 }, { "pattern": "l'application est toujours dans l'iframe", "keyword": "Then", "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'application est toujours dans l\\'iframe', async function (this: FestipodWorld) {\n // Verify the app didn't redirect away (initNgWeb would redirect if not in iframe)\n const url = await this.appFrame!.evaluate(() => window.location.href);\n expect(url, 'App should still be on localhost, not redirected to broker').to.include('127.0.0.1');\n\n // Verify the app rendered (not a blank page or error)\n const hasContent = await this.appFrame!.evaluate(() => {\n const root = document.getElementById('root');\n return root && root.innerHTML.length > 100;\n });", - "lineNumber": 37 + "sourceCode": "Then('l\\'application est toujours dans l\\'iframe', async function (this: FestipodWorld) {\n const url = await this.appFrame!.evaluate(() => window.location.href);\n expect(url, 'App should still be on localhost, not redirected to broker').to.include('127.0.0.1');\n\n const hasContent = await this.appFrame!.evaluate(() => {\n const root = document.getElementById('root');\n return root && root.innerHTML.length > 100;\n });", + "lineNumber": 74 }, { "pattern": "l'application affiche l'écran {string}", "keyword": "Then", "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'application affiche l\\'écran {string}', async function (this: FestipodWorld, expectedScreenId: string) {\n const marker = SCREEN_MARKERS[expectedScreenId];\n\n // Wait for the expected screen to appear (handles async redirects like login→home)\n const appeared = await this.appFrame!.waitForFunction(\n ([id, markerText]: [string, string | undefined]) => {\n const hash = window.location.hash;\n if (!hash.includes(`demo/${id}`)) return false;\n\n const root = document.getElementById('root');\n if (!root || root.innerHTML.length < 100) return false;\n\n // If we have a marker, verify screen content too\n if (markerText) {\n return root.textContent?.includes(markerText) ?? false;\n }\n return true;\n },\n [expectedScreenId, marker] as [string, string | undefined],\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n // Gather debug info on failure\n const debug = await this.appFrame!.evaluate(() => ({\n hash: window.location.hash,\n rootText: document.getElementById('root')?.textContent?.substring(0, 300),\n }));\n expect.fail(\n `Expected screen \"${expectedScreenId}\" but got hash=\"${debug.hash}\", ` +\n `content: \"${debug.rootText}\"`,\n );\n }\n});", - "lineNumber": 50 + "sourceCode": "Then('l\\'application affiche l\\'écran {string}', async function (this: FestipodWorld, expectedScreenId: string) {\n const marker = SCREEN_MARKERS[expectedScreenId];\n const expectedPath = pathForScreen(expectedScreenId).replace('$id$', '');\n\n const appeared = await this.appFrame!.waitForFunction(\n ([path, markerText]: [string, string | undefined]) => {\n const current = window.location.pathname;\n // Allow for paths with dynamic ids — match the prefix\n const matchesPath = path.endsWith('/')\n ? current.startsWith(path)\n : current === path || current.startsWith(path + '/');\n if (!matchesPath) return false;\n\n const root = document.getElementById('root');\n if (!root || root.innerHTML.length < 100) return false;\n\n if (markerText) {\n return root.textContent?.includes(markerText) ?? false;\n }\n return true;\n },\n [expectedPath, marker] as [string, string | undefined],\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n const debug = await this.appFrame!.evaluate(() => ({\n pathname: window.location.pathname,\n rootText: document.getElementById('root')?.textContent?.substring(0, 300),\n }));\n expect.fail(\n `Expected screen \"${expectedScreenId}\" (path \"${expectedPath}\", marker \"${marker}\") ` +\n `but got pathname=\"${debug.pathname}\", content: \"${debug.rootText}\"`,\n );\n }\n});", + "lineNumber": 85 }, { "pattern": "l'URL contient {string}", "keyword": "Then", "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'URL contient {string}', async function (this: FestipodWorld, expected: string) {\n const hash = await this.appFrame!.evaluate(() => window.location.hash);\n expect(hash, `URL hash should contain \"${expected}\"`).to.include(expected);\n});", - "lineNumber": 85 + "sourceCode": "Then('l\\'URL contient {string}', async function (this: FestipodWorld, expected: string) {\n const pathname = await this.appFrame!.evaluate(() => window.location.pathname);\n expect(pathname, `URL pathname should contain \"${expected}\"`).to.include(expected);\n});", + "lineNumber": 122 }, { "pattern": "l'utilisateur clique sur le bouton {string}", "keyword": "When", "file": "connexion.steps.ts", - "sourceCode": "When('l\\'utilisateur clique sur le bouton {string}', async function (this: FestipodWorld, buttonText: string) {\n // Click button matching the text inside the app iframe\n const button = this.appFrame!.locator(`button`, { hasText: buttonText });", - "lineNumber": 90 - }, - { - "pattern": "la galerie affiche le bouton {string}", - "keyword": "Then", - "file": "connexion.steps.ts", - "sourceCode": "Then('la galerie affiche le bouton {string}', async function (this: FestipodWorld, buttonText: string) {\n // The app starts at the Gallery in e2e mode — verify button is visible\n const appeared = await this.appFrame!.waitForFunction(\n (text: string) => {\n const buttons = Array.from(document.querySelectorAll('button'));\n return buttons.some(b => b.textContent?.includes(text));\n },\n buttonText,\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n const debug = await this.appFrame!.evaluate(() => ({\n buttons: Array.from(document.querySelectorAll('button')).map(b => b.textContent?.trim()),\n rootText: document.getElementById('root')?.textContent?.substring(0, 300),\n }));\n expect.fail(\n `Button \"${buttonText}\" not found. Buttons: ${JSON.stringify(debug.buttons)}. Content: \"${debug.rootText}\"`,\n );\n }\n});", - "lineNumber": 97 + "sourceCode": "When('l\\'utilisateur clique sur le bouton {string}', async function (this: FestipodWorld, buttonText: string) {\n const button = this.appFrame!.locator(`button`, { hasText: buttonText });", + "lineNumber": 127 }, { "pattern": "l'utilisateur attend la fin du chargement", "keyword": "When", "file": "connexion.steps.ts", - "sourceCode": "When('l\\'utilisateur attend la fin du chargement', async function (this: FestipodWorld) {\n // Wait for the \"Chargement...\" button to disappear (bootstrap finished)\n await this.appFrame!.waitForFunction(\n () => {\n const buttons = Array.from(document.querySelectorAll('button'));\n return !buttons.some(b => b.textContent?.includes('Chargement...'));\n },\n { timeout: 30000 },\n );\n // Extra wait for ORM to flush all microtasks and broker to process\n await this.appFrame!.waitForTimeout(2000);\n});", - "lineNumber": 119 + "sourceCode": "When('l\\'utilisateur attend la fin du chargement', async function (this: FestipodWorld) {\n await this.appFrame!.waitForFunction(\n () => {\n const buttons = Array.from(document.querySelectorAll('button'));\n return !buttons.some(b => b.textContent?.includes('Chargement...'));\n },\n { timeout: 60000 },\n );\n await this.appFrame!.waitForTimeout(2000);\n});", + "lineNumber": 133 }, { "pattern": "l'écran d'accueil affiche des événements", "keyword": "Then", "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'écran d\\'accueil affiche des événements', async function (this: FestipodWorld) {\n const appeared = await this.appFrame!.waitForFunction(\n () => {\n const root = document.getElementById('root');\n if (!root) return false;\n const text = root.textContent || '';\n // Home screen shows \"Mes événements à venir\" with event cards containing \"inscrits\" badges\n return text.includes('Mes événements à venir') && text.includes('inscrits');\n },\n { timeout: 15000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n const debug = await this.appFrame!.evaluate(() => ({\n hash: window.location.hash,\n rootText: document.getElementById('root')?.textContent?.substring(0, 500),\n }));\n expect.fail(\n `Expected home screen with events (containing \"inscrits\") but got hash=\"${debug.hash}\", ` +\n `content: \"${debug.rootText}\"`,\n );\n }\n});", - "lineNumber": 132 + "sourceCode": "Then('l\\'écran d\\'accueil affiche des événements', async function (this: FestipodWorld) {\n // Navigate to the events screen (path-based) and verify cards are rendered.\n // Home shows only events the current user participates in, which depends\n // on participations hydrating from NG — flaky for a basic data check.\n await this.appFrame!.evaluate(() => {\n window.history.pushState(null, '', '/events');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 144 }, { - "pattern": "l'application affiche la galerie", - "keyword": "Then", - "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'application affiche la galerie', async function (this: FestipodWorld) {\n const appeared = await this.appFrame!.waitForFunction(\n () => {\n const root = document.getElementById('root');\n if (!root) return false;\n const hash = window.location.hash;\n // Gallery is at #/ or empty hash\n const isGalleryHash = hash === '#/' || hash === '' || hash === '#';\n // Gallery shows screen thumbnails — look for \"Tous les écrans\" or screen grid\n const isGalleryContent = root.textContent?.includes('Wireframe') ?? false;\n return isGalleryHash || isGalleryContent;\n },\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n const debug = await this.appFrame!.evaluate(() => ({\n hash: window.location.hash,\n rootText: document.getElementById('root')?.textContent?.substring(0, 300),\n }));\n expect.fail(\n `Expected Gallery but got hash=\"${debug.hash}\", content: \"${debug.rootText}\"`,\n );\n }\n});", - "lineNumber": 156 + "pattern": "le créateur relaie l'événement {string}", + "keyword": "Given", + "file": "createur.steps.ts", + "sourceCode": "Given('le créateur relaie l\\'événement {string}', { timeout: 180000 }, async function (this: FestipodWorld, title: string) {\n const out = await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n await td.ensureCurrentUser();\n const created = await td.createEventReal(title);\n return { eventId: created.id };\n }, title);\n (this as any).creatorEventId = out.eventId;\n (this as any).creatorEventTitle = title;\n});", + "lineNumber": 9 }, { - "pattern": "l'écran gère la redirection automatique après connexion", + "pattern": "le créateur n'est pas participant de l'événement {string}", "keyword": "Then", - "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'écran gère la redirection automatique après connexion', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n // LoginScreen must have a useEffect that navigates on status === 'connected'\n const hasAutoNavigate =\n source.includes('useEffect') &&\n source.includes(\"status === 'connected'\") &&\n source.includes(\"navigate\") &&\n source.includes(\"'home'\");\n expect(hasAutoNavigate, 'LoginScreen should auto-navigate to home when status becomes connected').to.be.true;\n});", - "lineNumber": 5 + "file": "createur.steps.ts", + "sourceCode": "Then('le créateur n\\'est pas participant de l\\'événement {string}', { timeout: 60000 }, async function (this: FestipodWorld, title: string) {\n const eventId = (this as any).creatorEventId;\n // Wait for the REACTIVE state to settle to \"not participating\" (observes AD().*\n // fed by the subscription push — NOT a broker re-read), the sign the sync has\n // passed. Then do ONE authoritative broker read to prove the 0 is durable.\n await this.appFrame!.waitForFunction(\n (eventId) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n return !!uid && !td.isParticipating(eventId, uid);\n },\n eventId,\n { timeout: 30000 },\n ).catch(() => { /* fall through to the single authoritative read */ });", + "lineNumber": 20 }, { - "pattern": "l'écran gère l'état de connexion en cours", + "pattern": "le compteur de participants de l'événement {string} vaut {int}", "keyword": "Then", - "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'écran gère l\\'état de connexion en cours', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n const hasConnectingState =\n source.includes(\"status === 'connecting'\") ||\n source.includes(\"Connexion NextGraph en cours\");\n expect(hasConnectingState, 'LoginScreen should handle connecting state').to.be.true;\n});", - "lineNumber": 16 + "file": "createur.steps.ts", + "sourceCode": "Then('le compteur de participants de l\\'événement {string} vaut {int}', { timeout: 60000 }, async function (this: FestipodWorld, title: string, expected: number) {\n const eventId = (this as any).creatorEventId;\n // The count is DERIVED by the owner materializing the inbox. On a freshly\n // created event with no joins, no deposit exists → the reactive count reflects\n // the create-time value (0). Read the reactive event state.\n const count = await this.appFrame!.evaluate((eventId: string) => {\n const td = (window as any).__testData;\n const ev = td.getEvent(eventId);\n return ev ? (ev.participantCount ?? -1) : -2;\n }, eventId);\n expect(count, `participantCount of \"${title}\" must be ${expected}`).to.equal(expected);\n});", + "lineNumber": 42 }, { - "pattern": "l'écran n'importe pas de données de démonstration", + "pattern": "le créateur rejoint son événement {string}", + "keyword": "When", + "file": "createur.steps.ts", + "sourceCode": "When('le créateur rejoint son événement {string}', { timeout: 120000 }, async function (this: FestipodWorld, _title: string) {\n const eventId = (this as any).creatorEventId;\n await this.appFrame!.evaluate(async ({ eventId }: { eventId: string }) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n await td.appJoinEvent(eventId, uid);\n }, { eventId });", + "lineNumber": 55 + }, + { + "pattern": "le créateur quitte son événement {string}", + "keyword": "When", + "file": "createur.steps.ts", + "sourceCode": "When('le créateur quitte son événement {string}', { timeout: 120000 }, async function (this: FestipodWorld, _title: string) {\n const eventId = (this as any).creatorEventId;\n await this.appFrame!.evaluate(async ({ eventId }: { eventId: string }) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n await td.appLeaveEvent(eventId, uid);\n }, { eventId });", + "lineNumber": 64 + }, + { + "pattern": "le créateur est participant de l'événement {string}", "keyword": "Then", - "file": "connexion.steps.ts", - "sourceCode": "Then('l\\'écran n\\'importe pas de données de démonstration', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n const importsSeedData = source.includes('seedData') || source.includes('seedEvents');\n const usesFestipodData = source.includes('useFestipodData');\n expect(importsSeedData, 'LoginScreen should not import seed data').to.be.false;\n expect(usesFestipodData, 'LoginScreen should not use FestipodData context').to.be.false;\n});", - "lineNumber": 24 + "file": "createur.steps.ts", + "sourceCode": "Then('le créateur est participant de l\\'événement {string}', { timeout: 60000 }, async function (this: FestipodWorld, title: string) {\n const eventId = (this as any).creatorEventId;\n // Wait for the REACTIVE join to settle (observes AD().isParticipating fed by the\n // subscription push — NOT a broker re-read), then take ONE authoritative broker\n // count to prove the participation is durable at the data level.\n await this.appFrame!.waitForFunction(\n (eventId) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n return !!uid && td.isParticipating(eventId, uid);\n },\n eventId,\n { timeout: 45000 },\n ).catch(() => { /* fall through to the single authoritative read */ });", + "lineNumber": 73 + }, + { + "pattern": "le compte {string} publie un événement public {string}", + "keyword": "Given", + "file": "decouverte.steps.ts", + "sourceCode": "Given('le compte {string} publie un événement public {string}', async function (this: FestipodWorld, publisher: string, title: string) {\n const res = await this.appFrame!.evaluate(\n async (p) => await (window as any).__testData.publishPublicEventAs(p, ''),\n publisher,\n );\n (this as any).discovery = { publisher, title, doc: res.doc };\n expect(res.doc, 'publisher public event doc NURI').to.be.a('string');\n});", + "lineNumber": 14 + }, + { + "pattern": "le compte {string} n'est pas connecté à {string}", + "keyword": "Given", + "file": "decouverte.steps.ts", + "sourceCode": "Given('le compte {string} n\\'est pas connecté à {string}', function (this: FestipodWorld, discoverer: string, _publisher: string) {\n // No connection is ever declared: the discoverer only exists in the shim.\n // Recorded so the When step knows which account performs the discovery.\n (this as any).discovery = { ...(this as any).discovery, discoverer };\n});", + "lineNumber": 23 + }, + { + "pattern": "{string} découvre les événements publics", + "keyword": "When", + "file": "decouverte.steps.ts", + "sourceCode": "When('{string} découvre les événements publics', async function (this: FestipodWorld, discoverer: string) {\n const { doc, title } = (this as any).discovery;\n // Discoverer READS THE GLOBAL INDEX (materialize) and mounts a multi-graph\n // subscription over the referenced docs — no cross-account fan-out.\n const res = await this.appFrame!.evaluate(\n async (d) => await (window as any).__testData.discoverPublicEventsAs(d),\n discoverer,\n );\n (this as any).discovery.listed = res.listed;\n // Wait for to mount the useShape({graphs}) over the listed docs.\n await this.appFrame!.waitForFunction(\n () => (window as any).__fanout?.ready === true,\n null,\n { timeout: 15000 },\n );\n // Publisher writes its public event into its own doc (now part of the fan-out).\n await this.appFrame!.evaluate(\n ([d, t]: [string, string]) => (window as any).__fanout.addEventTo(d, t),\n [doc, title] as [string, string],\n );\n});", + "lineNumber": 29 + }, + { + "pattern": "{string} voit l'événement public {string}", + "keyword": "Then", + "file": "decouverte.steps.ts", + "sourceCode": "Then('{string} voit l\\'événement public {string}', async function (this: FestipodWorld, _discoverer: string, title: string) {\n await this.appFrame!.waitForFunction(\n (t) => ((window as any).__fanout.titles() as string[]).includes(t),\n title,\n { timeout: 15000 },\n );\n const titles = await this.appFrame!.evaluate(() => (window as any).__fanout.titles());\n expect(titles, `discoverer should see the publisher's public event \"${title}\"`).to.include(title);\n});", + "lineNumber": 51 + }, + { + "pattern": "l'index global liste le document de l'événement", + "keyword": "Then", + "file": "decouverte.steps.ts", + "sourceCode": "Then('l\\'index global liste le document de l\\'événement', function (this: FestipodWorld) {\n const { doc, listed } = (this as any).discovery;\n expect(listed, 'the global index should list the publisher event doc').to.include(doc);\n});", + "lineNumber": 61 + }, + { + "pattern": "l'utilisateur n'est pas inscrit à l'événement {string} via l'app", + "keyword": "Given", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Given('l\\'utilisateur n\\'est pas inscrit à l\\'événement {string} via l\\'app', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.appLeaveEvent(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n});", + "lineNumber": 20 + }, + { + "pattern": "l'utilisateur est inscrit à l'événement {string} via l'app", + "keyword": "Given", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Given('l\\'utilisateur est inscrit à l\\'événement {string} via l\\'app', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.appJoinEvent(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n});", + "lineNumber": 28 + }, + { + "pattern": "l'utilisateur s'inscrit à l'événement {string} via l'app", + "keyword": "When", + "file": "inscription-inbox.steps.ts", + "sourceCode": "When('l\\'utilisateur s\\'inscrit à l\\'événement {string} via l\\'app', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.appJoinEvent(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n});", + "lineNumber": 38 + }, + { + "pattern": "l'utilisateur se désinscrit de l'événement {string} via l'app", + "keyword": "When", + "file": "inscription-inbox.steps.ts", + "sourceCode": "When('l\\'utilisateur se désinscrit de l\\'événement {string} via l\\'app', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.appLeaveEvent(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n});", + "lineNumber": 46 + }, + { + "pattern": "l'inbox de l'événement {string} contient au moins un dépôt", + "keyword": "Then", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Then('l\\'inbox de l\\'événement {string} contient au moins un dépôt', async function (this: FestipodWorld, eventTitle: string) {\n const count = await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return -1;\n const deposits = await td.readInboxDeposits(event['@id']);\n return deposits.length;\n }, eventTitle);\n expect(count, `host inbox of \"${eventTitle}\" should hold >= 1 deposit`).to.be.greaterThan(0);\n});", + "lineNumber": 56 + }, + { + "pattern": "une notification {string} est créée pour l'événement {string}", + "keyword": "Then", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Then('une notification {string} est créée pour l\\'événement {string}', async function (this: FestipodWorld, type: string, eventTitle: string) {\n const found = await this.appFrame!.evaluate(async ([type, title]: [string, string]) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n // The notification surfaces either via the reactive state (immediate on join)\n // or via the emulated curator reading the deposit back — accept either.\n const reactive = (td.appNotifications() as any[]).some(\n (n) => n.type === type && n.ref === event['@id'],\n );\n if (reactive) return true;\n const deposits = await td.readInboxDeposits(event['@id']);\n return deposits.some((d: any) => d?.payload?.kind === type);\n }, [type, eventTitle] as [string, string]);\n expect(found, `a \"${type}\" notification should exist for \"${eventTitle}\"`).to.be.true;\n});", + "lineNumber": 67 + }, + { + "pattern": "l'utilisateur devient participant de l'événement {string}", + "keyword": "Then", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Then('l\\'utilisateur devient participant de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // The app-path join writes to the FestipodDataContext participation set, which\n // converges with the harness's own useShape set via the shared store. Poll\n // in-browser (waitForFunction) until it appears, to absorb that sync latency.\n // Poll: the participation is written into its own protected doc and read back\n // reactively; under a busy wallet that read can lag, so accept the AUTHORITATIVE\n // broker count as well (the write is durable regardless of the reactive re-read).\n // Wait for the REACTIVE participation to settle (observes AD().liveIsParticipating\n // fed by the subscription push — NOT a broker re-read). Generous window: this\n // reactive convergence IS the sync-passed signal.\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n if (!td.currentUserId) return false; // wait for the profile read to hydrate\n const event = [...td.events].find((e: any) => e.title === title);\n return !!event && td.liveIsParticipating(event['@id']);\n },\n eventTitle,\n { timeout: 45000 },\n ).catch(() => { /* fall through to a single authoritative confirmation */ });", + "lineNumber": 84 + }, + { + "pattern": "le broker ne contient plus aucune participation à l'événement {string}", + "keyword": "Then", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Then('le broker ne contient plus aucune participation à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // AUTHORITATIVE (not reactive): re-query the broker directly for the current\n // user's participations to \"eventTitle\". A durable désinscription leaves 0.\n const count = await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return -1;\n return td.authParticipationCount(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n expect(count, `broker must hold 0 participations to \"${eventTitle}\" after leave (authoritative re-query)`).to.equal(0);\n});", + "lineNumber": 115 + }, + { + "pattern": "l'utilisateur reste non-inscrit à l'événement {string} après re-sync", + "keyword": "Then", + "file": "inscription-inbox.steps.ts", + "sourceCode": "Then('l\\'utilisateur reste non-inscrit à l\\'événement {string} après re-sync', async function (this: FestipodWorld, eventTitle: string) {\n // Give the broker sync time to (attempt to) resurrect the item, then assert it\n // stayed deleted. The SPARQL DELETE-WHERE fix means the participation must NOT\n // come back (the @wip bug: it resurrected). We poll in-browser: if it EVER\n // reappears within the window the waitForFunction below flips it back to\n // participating and the final check fails.\n await this.appFrame!.waitForTimeout(3000);\n const stillGone = await this.appFrame!.evaluate((title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n return !td.liveIsParticipating(event['@id']);\n }, eventTitle);\n expect(stillGone, `participation to \"${eventTitle}\" must NOT resurrect after re-sync`).to.be.true;\n});", + "lineNumber": 127 }, { "pattern": "un événement {string} existe", "keyword": "Given", "file": "inscription.steps.ts", - "sourceCode": "Given('un événement {string} existe', async function (this: FestipodWorld, eventTitle: string) {\n // Ensure wallet has data (seed if empty)\n await this.appFrame!.evaluate(() => {\n const td = (window as any).__testData;\n if (td.events.size === 0) td.loadTestData();\n });", + "sourceCode": "Given('un événement {string} existe', async function (this: FestipodWorld, eventTitle: string) {\n // Ensure wallet has data (seed if empty)\n await this.appFrame!.evaluate(async () => {\n const td = (window as any).__testData;\n if (td.events.size === 0) await td.loadTestData();\n });", "lineNumber": 10 }, { "pattern": "l'utilisateur n'est pas inscrit à l'événement {string}", "keyword": "Given", "file": "inscription.steps.ts", - "sourceCode": "Given('l\\'utilisateur n\\'est pas inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.leaveEvent(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n});", + "sourceCode": "Given('l\\'utilisateur n\\'est pas inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // Clean slate for the current user's participation. The app leave is\n // authoritative (SPARQL DELETE on the participation's own doc) but reactive-gated\n // (it only acts on a participation present in the reactive set); enough for the\n // common case. Kept LIGHT (no full-wallet fan-out — that saturates the browser\n // on a busy wallet).\n await this.appFrame!.evaluate(\n async (title) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.leaveEvent(event['@id'], uid);\n },\n eventTitle,\n );\n});", "lineNumber": 27 }, { "pattern": "l'utilisateur est inscrit à l'événement {string}", "keyword": "Given", "file": "inscription.steps.ts", - "sourceCode": "Given('l\\'utilisateur est inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.joinEvent(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n});", - "lineNumber": 38 - }, - { - "pattern": "l'événement {string} a {int} participants au départ", - "keyword": "Given", - "file": "inscription.steps.ts", - "sourceCode": "Given('l\\'événement {string} a {int} participants au départ', async function (this: FestipodWorld, eventTitle: string, count: number) {\n await this.appFrame!.evaluate(\n ([title, c]: [string, number]) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.updateEvent(event['@id'], { participantCount: c });", - "lineNumber": 49 + "sourceCode": "Given('l\\'utilisateur est inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n async (title) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.joinEvent(event['@id'], uid);\n },\n eventTitle,\n );\n});", + "lineNumber": 44 }, { "pattern": "l'utilisateur s'inscrit à l'événement {string}", "keyword": "When", "file": "inscription.steps.ts", - "sourceCode": "When('l\\'utilisateur s\\'inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.joinEvent(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n});", - "lineNumber": 62 + "sourceCode": "When('l\\'utilisateur s\\'inscrit à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n async (title) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.joinEvent(event['@id'], uid);\n },\n eventTitle,\n );\n});", + "lineNumber": 58 }, { "pattern": "l'utilisateur se désinscrit de l'événement {string}", "keyword": "When", "file": "inscription.steps.ts", - "sourceCode": "When('l\\'utilisateur se désinscrit de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.leaveEvent(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n});", - "lineNumber": 73 + "sourceCode": "When('l\\'utilisateur se désinscrit de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n async (title) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.leaveEvent(event['@id'], uid);\n },\n eventTitle,\n );\n});", + "lineNumber": 70 }, { "pattern": "l'utilisateur essaie de s'inscrire une seconde fois à l'événement {string}", "keyword": "When", "file": "inscription.steps.ts", - "sourceCode": "When('l\\'utilisateur essaie de s\\'inscrire une seconde fois à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) td.joinEvent(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n});", - "lineNumber": 84 + "sourceCode": "When('l\\'utilisateur essaie de s\\'inscrire une seconde fois à l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.evaluate(\n async (title) => {\n const td = (window as any).__testData;\n const uid = await td.ensureCurrentUser();\n const event = [...td.events].find((e: any) => e.title === title);\n if (event) await td.joinEvent(event['@id'], uid);\n },\n eventTitle,\n );\n});", + "lineNumber": 82 }, { "pattern": "l'utilisateur est participant de l'événement {string}", "keyword": "Then", "file": "inscription.steps.ts", - "sourceCode": "Then('l\\'utilisateur est participant de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n const participating = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n return td.isParticipating(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n expect(participating, `User should be participating in \"${eventTitle}\"`).to.be.true;\n});", - "lineNumber": 97 + "sourceCode": "Then('l\\'utilisateur est participant de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // The participation is written into its own protected document and read back\n // reactively — poll (the read lags the write against the broker), resolving the\n // current user id at call time.\n // Wait for the REACTIVE participation to settle (observes AD().isParticipating fed\n // by the subscription push — NOT a broker re-read). Generous window: this reactive\n // convergence IS the sync-passed signal.\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n if (!uid) return false;\n const event = [...td.events].find((e: any) => e.title === title);\n return !!event && td.isParticipating(event['@id'], uid);\n },\n eventTitle,\n { timeout: 45000 },\n ).catch(() => { /* fall through to a single authoritative confirmation */ });", + "lineNumber": 96 }, { "pattern": "l'utilisateur n'est plus participant de l'événement {string}", "keyword": "Then", "file": "inscription.steps.ts", - "sourceCode": "Then('l\\'utilisateur n\\'est plus participant de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n const participating = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n return td.isParticipating(event['@id'], td.currentUserId);\n },\n eventTitle,\n );\n expect(participating, `User should NOT be participating in \"${eventTitle}\"`).to.be.false;\n});", - "lineNumber": 110 + "sourceCode": "Then('l\\'utilisateur n\\'est plus participant de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // AUTHORITATIVE: the désinscription must be durable at the DATA level — the\n // broker itself must hold 0 participations for (event, user). The reactive read\n // can lag or briefly resurrect; the broker count is the source of truth. Poll it\n // to 0 (bounded).\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n return !!event && !td.isParticipating(event['@id'], td.currentUserId);\n },\n eventTitle,\n { timeout: 20000 },\n ).catch(() => { /* fall through to the authoritative broker check */ });", + "lineNumber": 126 }, { - "pattern": "l'événement {string} compte {int} participants", + "pattern": "le compteur dérivé de l'événement {string} reflète l'inscription", "keyword": "Then", "file": "inscription.steps.ts", - "sourceCode": "Then('l\\'événement {string} compte {int} participants', async function (this: FestipodWorld, eventTitle: string, expectedCount: number) {\n const count = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n return event?.participantCount ?? -1;\n },\n eventTitle,\n );\n expect(count, `Event \"${eventTitle}\" participant count`).to.equal(expectedCount);\n});", - "lineNumber": 123 + "sourceCode": "Then('le compteur dérivé de l\\'événement {string} reflète l\\'inscription', async function (this: FestipodWorld, eventTitle: string) {\n // OPTION B — the count is DERIVED by the OWNER materializing the event's inbox\n // (see data-layer/knowledge_context-internals §participantCount). The event-id is\n // matched on its CANONICAL form (base repo id, stripping any `:v:`) across\n // ownedEventIds / the deposit key / the materializer filter, so an owner\n // materializes deposits for an event it owns regardless of the id-form path (create\n // OR listMyEntityDocs OR after reload) — the fix that makes this converge.\n //\n // ASSERT THE DELTA, not an absolute count: the shared inbox anchor accumulates\n // deposits across the wallet's life, so |active| is not bounded to this scenario —\n // but \"the just-joined user IS in the owner's derived active set\" is deterministic.\n // (The absolute 1→2 convergence stays proven end-to-end by the @multibrowser\n // reactive scenario with a real owner A + joiner B.) Poll (the deposit's index\n // append + broker sync lag), bounded.\n // First wait for the REACTIVE join to settle (observes AD().isParticipating fed by\n // the subscription push — the sign the deposit's write path has run — NOT a broker\n // re-read). THEN materialize the owner's derived active set from the broker ONCE.\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n if (!uid) return false;\n const ev = [...td.events].find((e: any) => e.title === title);\n return !!ev && td.isParticipating(ev['@id'], uid);\n },\n eventTitle,\n { timeout: 45000 },\n ).catch(() => { /* fall through to the single authoritative materialization */ });", + "lineNumber": 149 }, { "pattern": "l'utilisateur apparaît dans la liste des participants de l'événement {string}", "keyword": "Then", "file": "inscription.steps.ts", - "sourceCode": "Then('l\\'utilisateur apparaît dans la liste des participants de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n const found = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n return td.getEventParticipants(event['@id']).some((p: any) => p.user === td.currentUserId);\n },\n eventTitle,\n );\n expect(found, `User should appear in participants of \"${eventTitle}\"`).to.be.true;\n});", - "lineNumber": 135 + "sourceCode": "Then('l\\'utilisateur apparaît dans la liste des participants de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n if (!uid) return false;\n const event = [...td.events].find((e: any) => e.title === title);\n return !!event && td.getEventParticipants(event['@id']).some((p: any) => p.user === uid);\n },\n eventTitle,\n { timeout: 30000 },\n ).catch(async () => {\n const n = await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return 0;\n return td.authParticipationCount(event['@id'], await td.ensureCurrentUser());\n }, eventTitle);\n expect(n, `User should appear in participants of \"${eventTitle}\"`).to.be.greaterThan(0);\n });", + "lineNumber": 188 }, { "pattern": "l'utilisateur n'apparaît plus dans la liste des participants de l'événement {string}", "keyword": "Then", "file": "inscription.steps.ts", "sourceCode": "Then('l\\'utilisateur n\\'apparaît plus dans la liste des participants de l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n const found = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return false;\n return td.getEventParticipants(event['@id']).some((p: any) => p.user === td.currentUserId);\n },\n eventTitle,\n );\n expect(found, `User should NOT appear in participants of \"${eventTitle}\"`).to.be.false;\n});", - "lineNumber": 148 + "lineNumber": 210 }, { "pattern": "l'inscription est idempotente pour l'événement {string}", "keyword": "Then", "file": "inscription.steps.ts", - "sourceCode": "Then('l\\'inscription est idempotente pour l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n const count = await this.appFrame!.evaluate(\n (title) => {\n const td = (window as any).__testData;\n const event = [...td.events].find((e: any) => e.title === title);\n if (!event) return 0;\n return td.getEventParticipants(event['@id']).filter((p: any) => p.user === td.currentUserId).length;\n },\n eventTitle,\n );\n expect(count, 'User should have exactly one participation record').to.equal(1);\n});", - "lineNumber": 161 + "sourceCode": "Then('l\\'inscription est idempotente pour l\\'événement {string}', async function (this: FestipodWorld, eventTitle: string) {\n // Idempotence at the DATA level: exactly ONE participation on the broker for\n // (event, user), no matter how many times the join was attempted. Assert the\n // AUTHORITATIVE broker count == 1 (bypasses reactive-read lag/dupes). POLL the\n // authoritative count: the participation is written into its own protected doc\n // and its index-append propagates async, so a single unpolled read can catch 0\n // before the write is queryable (observed flake) — poll until the durable state\n // (exactly 1) is visible, which also proves the second join did NOT add a dupe.\n // First wait for the REACTIVE participation to settle (observes AD().isParticipating\n // fed by the subscription push — the sync-passed signal — NOT a broker re-read).\n // THEN read the AUTHORITATIVE broker count ONCE: exactly 1 proves the second join\n // added no dupe (bypasses reactive-read lag).\n await this.appFrame!.waitForFunction(\n (title) => {\n const td = (window as any).__testData;\n const uid = td.currentUserId;\n if (!uid) return false;\n const event = [...td.events].find((e: any) => e.title === title);\n return !!event && td.isParticipating(event['@id'], uid);\n },\n eventTitle,\n { timeout: 45000 },\n ).catch(() => { /* fall through to the single authoritative count */ });", + "lineNumber": 223 + }, + { + "pattern": "l'identité A crée l'événement {string} et s'y inscrit", + "keyword": "Given", + "file": "isolation.steps.ts", + "sourceCode": "Given('l\\'identité A crée l\\'événement {string} et s\\'y inscrit', { timeout: 180000 }, async function (this: FestipodWorld, title: string) {\n const out = await this.appFrame!.evaluate(async (title) => {\n const td = (window as any).__testData;\n const aId = await td.ensureCurrentUser();\n const created = await td.createEventReal(title);\n await td.appJoinEvent(created.id, aId);\n return { eventId: created.id, aId };\n }, title);\n // OBSERVE the REACTIVE set until A's own join has settled (isParticipating reads\n // AD() fed by the subscription push — NOT a broker re-read). This is the barrier\n // that A's participation exists before B arrives; no broker polling.\n const aParticipates = await this.appFrame!.waitForFunction(\n ({ eventId, aId }: { eventId: string; aId: string }) =>\n (window as any).__testData.isParticipating(eventId, aId),\n { eventId: out.eventId, aId: out.aId },\n { timeout: 45000 },\n ).then(() => true).catch(() => false);\n expect(aParticipates, 'A must be participating in its own event before B arrives').to.be.true;\n (this as any).isoEventId = out.eventId;\n (this as any).isoEventTitle = title;\n (this as any).isoAId = out.aId;\n});", + "lineNumber": 17 + }, + { + "pattern": "l'événement {string} n'est pas sur l'accueil de B", + "keyword": "Then", + "file": "isolation.steps.ts", + "sourceCode": "Then('l\\'événement {string} n\\'est pas sur l\\'accueil de B', async function (this: FestipodWorld, title: string) {\n const bFrame = (this as any).isoBFrame;\n const onHome = await bFrame.evaluate((title: string) => {\n const td = (window as any).__testData;\n return td.homeEventTitles().includes(title);\n }, title);\n expect(onHome, `\"${title}\" must NOT appear on B's home (getUserEvents(B))`).to.be.false;\n});", + "lineNumber": 43 + }, + { + "pattern": "B n'est pas participant de l'événement {string}", + "keyword": "Then", + "file": "isolation.steps.ts", + "sourceCode": "Then('B n\\'est pas participant de l\\'événement {string}', async function (this: FestipodWorld, title: string) {\n const bFrame = (this as any).isoBFrame;\n const eventId = (this as any).isoEventId;\n const isPart = await bFrame.evaluate(async ({ eventId }: { eventId: string }) => {\n const td = (window as any).__testData;\n const bId = await td.ensureCurrentUser();\n return td.isParticipating(eventId, bId);\n }, { eventId });", + "lineNumber": 52 + }, + { + "pattern": "B ne lit aucune participation de A", + "keyword": "Then", + "file": "isolation.steps.ts", + "sourceCode": "Then('B ne lit aucune participation de A', async function (this: FestipodWorld) {\n const bFrame = (this as any).isoBFrame;\n const aId = (this as any).isoAId;\n const leaks = await bFrame.evaluate((aId: string) => {\n const td = (window as any).__testData;\n return td.currentParticipations().filter((p: any) => p.userId === aId);\n }, aId);\n expect(leaks, `B must read NONE of A's protected participations (found ${JSON.stringify(leaks)})`).to.have.lengthOf(0);\n});", + "lineNumber": 63 + }, + { + "pattern": "on attend {int} secondes sans aucune activité", + "keyword": "When", + "file": "reconnexion.steps.ts", + "sourceCode": "When('on attend {int} secondes sans aucune activité', { timeout: 60000 }, async function (this: FestipodWorld, seconds: number) {\n const page = this.page!;\n const onConsole = (msg: import('playwright').ConsoleMessage) => {\n console.log(`[PauseWatch:${msg.type()}] ${msg.text()}`);\n };\n page.on('console', onConsole);\n console.log(`[PauseWatch] starting a ${seconds}s PASSIVE pause (no disconnect injected) — watching for a spontaneous socket death…`);\n await new Promise((resolve) => setTimeout(resolve, seconds * 1000));\n console.log(`[PauseWatch] ${seconds}s pause complete — proceeding to the fresh reconnection.`);\n // Leave the listener attached: the signature may also surface once the fresh\n // page's reconnection kicks the outbox (SENDING EVENTS FROM OUTBOX …).\n});", + "lineNumber": 31 + }, + { + "pattern": "l'événement {string} finit par apparaître sur la page fraîche A en laissant jusqu'à 60 secondes à la barrière avec rechargements", + "keyword": "Then", + "file": "reconnexion.steps.ts", + "sourceCode": "Then('l\\'événement {string} finit par apparaître sur la page fraîche A en laissant jusqu\\'à 60 secondes à la barrière avec rechargements', { timeout: 120000 }, async function (this: FestipodWorld, title: string) {\n const freshPage = (this as any).recoFreshPage as import('playwright').Page;\n let freshFrame = (this as any).recoFreshFrame as import('playwright').Frame;\n const startedAt = Date.now();\n const BUDGET_MS = 60000;\n const reloadAtMs = [20000, 40000]; // force a fresh barrier attempt at these marks\n let reloadIdx = 0;\n let appearedAtMs = -1;\n\n const readHome = async (): Promise => {\n try {\n return await freshFrame.evaluate((t: string) => {\n const td = (window as any).__testData;\n return td && td.homeEventTitles ? td.homeEventTitles() : [];\n }, title);\n } catch { return []; }\n };\n\n while (Date.now() - startedAt < BUDGET_MS) {\n const elapsed = Date.now() - startedAt;\n const titles = await readHome();\n if (titles.includes(title)) { appearedAtMs = elapsed; break; }\n // At each reload mark, do a FULL reload → new NgDataProvider mount → new barrier.\n const reloadMark = reloadAtMs[reloadIdx];\n if (reloadMark !== undefined && elapsed >= reloadMark) {\n reloadIdx++;\n console.log(`[LongPoll] t=${elapsed}ms still ABSENT — forcing a full reload (#${reloadIdx}) to re-attempt the barrier…`);\n try {\n freshFrame = await pool.setupBrokerPage!(freshPage, pool.harnessUrl!);\n await freshFrame.waitForFunction(() => (window as any).__testData?.ready === true, { timeout: 60000 });", + "lineNumber": 56 + }, + { + "pattern": "une page fraîche pour la MÊME identité A recharge sur le même wallet", + "keyword": "When", + "file": "reconnexion.steps.ts", + "sourceCode": "When('une page fraîche pour la MÊME identité A recharge sur le même wallet', { timeout: 120000 }, async function (this: FestipodWorld) {\n // SAME user as the main page — by construction, not by declaration: the new page\n // is opened on the SAME browser context, and a browser context is one user. This\n // is a reconnect, and there is nothing to select.\n const ctx = this.page!.context();\n const freshPage = await ctx.newPage();\n // Broadened to ALL console types (not just 'error') for the pause-reproduction\n // investigation: the SDK's diagnostic lines (logStage: BARRIER/OUTBOX/\n // readScopeIndex) are emitted via console.log, not console.error, and would\n // otherwise be invisible here — purely diagnostic, does not affect assertions.\n freshPage.on('console', (msg) => { console.log(`[FreshApage:${msg.type()}]`, msg.text()); });", + "lineNumber": 103 + }, + { + "pattern": "l'événement {string} est sur l'accueil de la page fraîche A", + "keyword": "Then", + "file": "reconnexion.steps.ts", + "sourceCode": "Then('l\\'événement {string} est sur l\\'accueil de la page fraîche A', { timeout: 60000 }, async function (this: FestipodWorld, title: string) {\n const freshFrame = (this as any).recoFreshFrame;\n // OBSERVE the REACTIVE home set (homeEventTitles reads AD().getUserEvents fed by\n // the subscription push — NOT a broker re-read). waitForFunction re-evaluates the\n // reactive getter until the cold-start union read converges; no broker polling.\n const onHome = await freshFrame.waitForFunction(\n (title: string) => (window as any).__testData.homeEventTitles().includes(title),\n title,\n { timeout: 30000 },\n ).then(() => true).catch(() => false);\n expect(onHome, `\"${title}\" MUST appear on the fresh A page's home (getUserEvents(A) after reconnect)`).to.be.true;\n});", + "lineNumber": 133 + }, + { + "pattern": "la page fraîche A est participante de l'événement {string}", + "keyword": "Then", + "file": "reconnexion.steps.ts", + "sourceCode": "Then('la page fraîche A est participante de l\\'événement {string}', { timeout: 60000 }, async function (this: FestipodWorld, title: string) {\n const freshFrame = (this as any).recoFreshFrame;\n const eventId = (this as any).isoEventId;\n await freshFrame.evaluate(async () => { await (window as any).__testData.ensureCurrentUser(); });", + "lineNumber": 146 + }, + { + "pattern": "le compte autoritatif de participation de A à l'événement {string} est {int}", + "keyword": "Then", + "file": "reconnexion.steps.ts", + "sourceCode": "Then('le compte autoritatif de participation de A à l\\'événement {string} est {int}', { timeout: 60000 }, async function (this: FestipodWorld, _title: string, expected: number) {\n const freshFrame = (this as any).recoFreshFrame;\n const eventId = (this as any).isoEventId;\n await freshFrame.evaluate(async () => { await (window as any).__testData.ensureCurrentUser(); });", + "lineNumber": 165 + }, + { + "pattern": "le portefeuille contient des données de test", + "keyword": "Given", + "file": "evenement.steps.ts", + "sourceCode": "Given('le portefeuille contient des données de test', async function (this: FestipodWorld) {\n // Navigate to /events to verify the wallet has events. We use /events\n // rather than /home because home filters by the current user's\n // participations, which may hydrate after a longer delay in NG mode.\n await this.appFrame!.evaluate(() => {\n window.history.pushState(null, '', '/events');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 11 + }, + { + "pattern": "l'utilisateur attend que l'écran {string} soit affiché", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur attend que l\\'écran {string} soit affiché', async function (this: FestipodWorld, screenId: string) {\n // We match on pathname prefix to allow for dynamic ids (event-detail etc.).\n const expectedPath = screenId === 'event-detail' ? '/events/' :\n screenId === 'update-event' ? '/edit' :\n screenId === 'create-event' ? '/events/new' :\n screenId === 'home' ? '/home' :\n screenId === 'events' ? '/events' :\n '/' + screenId;\n\n await this.appFrame!.waitForFunction(\n (path: string) => {\n const current = window.location.pathname;\n if (path === '/edit') return current.endsWith('/edit');\n return current.startsWith(path);\n },\n expectedPath,\n { timeout: 10000 },\n );\n await this.appFrame!.waitForTimeout(1000);\n});", + "lineNumber": 37 + }, + { + "pattern": "l'utilisateur remplit le formulaire de création d'événement:", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur remplit le formulaire de création d\\'événement:', async function (this: FestipodWorld, dataTable: any) {\n const rows = dataTable.hashes() as { champ: string; valeur: string }[];\n\n // The new CreateEventScreen is a 3-step wizard:\n // Step 1: name + dates\n // Step 2: similar-event warning (skipped if none)\n // Step 3: location + description + times\n //\n // We'll fill Step 1 fields first, click Next, then fill remaining fields.\n\n const formReady = await this.appFrame!.waitForFunction(\n () => !!document.querySelector('input[placeholder=\"Donnez un nom à votre événement\"]'),\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!formReady) {\n const debug = await this.appFrame!.evaluate(() => ({\n pathname: window.location.pathname,\n inputs: Array.from(document.querySelectorAll('input')).map(i => i.placeholder),\n rootText: document.getElementById('root')?.textContent?.substring(0, 300),\n }));\n throw new Error(`Create form not found. Path: ${debug.pathname}, inputs: ${JSON.stringify(debug.inputs)}, content: ${debug.rootText}`);\n }\n\n const byChamp: Record = {};\n for (const { champ, valeur } of rows) byChamp[champ] = valeur;\n\n // Step 1: name + start/end date\n if (byChamp['Nom de l\\'événement']) {\n const input = this.appFrame!.locator('input[placeholder=\"Donnez un nom à votre événement\"]');\n await input.fill(byChamp['Nom de l\\'événement']);\n }\n if (byChamp['Date de début']) {\n await this.appFrame!.locator('input[type=\"date\"]').first().fill(byChamp['Date de début']);\n }\n if (byChamp['Date de fin']) {\n await this.appFrame!.locator('input[type=\"date\"]').nth(1).fill(byChamp['Date de fin']);\n }\n\n // Advance to step 3 (may pass through step 2 if a similar event matches)\n let stepBtn = this.appFrame!.locator('button', { hasText: 'Suivant' });", + "lineNumber": 60 + }, + { + "pattern": "l'utilisateur modifie le champ lieu avec {string}", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur modifie le champ lieu avec {string}', async function (this: FestipodWorld, valeur: string) {\n // UpdateEventScreen has a \"Lieu *\" label followed by an Input. Find the input\n // adjacent to that label.\n await this.appFrame!.waitForFunction(\n () => document.getElementById('root')?.textContent?.includes('Lieu') ?? false,\n { timeout: 10000 },\n );\n await this.appFrame!.evaluate((val: string) => {\n const labels = document.querySelectorAll('*');\n for (const el of labels) {\n if (el.textContent?.trim() === 'Lieu *' && el.tagName !== 'DIV') {\n const parent = el.parentElement;\n const input = parent?.querySelector('input');\n if (input) {\n const nativeInputValueSetter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value')!.set!;\n nativeInputValueSetter.call(input, val);\n input.dispatchEvent(new Event('input', { bubbles: true }));\n input.dispatchEvent(new Event('change', { bubbles: true }));\n return;\n }\n }\n }\n }, valeur);\n await this.appFrame!.waitForTimeout(500);\n});", + "lineNumber": 129 + }, + { + "pattern": "l'utilisateur clique sur un événement de l'accueil", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur clique sur un événement de l\\'accueil', async function (this: FestipodWorld) {\n // HomeScreen renders only events the current user participates in. If\n // participations haven't hydrated from NG yet, the screen is empty — fall\n // back to /events (no participation filter).\n await this.appFrame!.evaluate(() => {\n window.history.pushState(null, '', '/home');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 157 + }, + { + "pattern": "l'utilisateur clique sur un événement de la liste", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur clique sur un événement de la liste', async function (this: FestipodWorld) {\n // EventsScreen also uses Card with .app-card class.\n await this.appFrame!.waitForFunction(\n () => document.querySelectorAll('.app-card').length > 0,\n { timeout: 10000 },\n );\n const clicked = await this.appFrame!.evaluate(() => {\n const cards = document.querySelectorAll('.app-card');\n for (const card of cards) {\n const el = card as HTMLElement;\n if (el.style.cursor === 'pointer' || window.getComputedStyle(el).cursor === 'pointer') {\n el.click();\n return true;\n }\n }\n return false;\n });", + "lineNumber": 210 + }, + { + "pattern": "l'utilisateur clique sur le bouton de modification", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur clique sur le bouton de modification', async function (this: FestipodWorld) {\n // The edit button shows \"✎\" in the header — only visible if user is event owner\n const editBtn = this.appFrame!.locator('text=✎').first();\n await editBtn.click();\n await this.appFrame!.waitForTimeout(1500);\n});", + "lineNumber": 233 + }, + { + "pattern": "l'utilisateur clique sur le bouton {string} si visible", + "keyword": "When", + "file": "evenement.steps.ts", + "sourceCode": "When('l\\'utilisateur clique sur le bouton {string} si visible', async function (this: FestipodWorld, buttonText: string) {\n const button = this.appFrame!.locator('button', { hasText: buttonText }).first();\n if (await button.isVisible({ timeout: 3000 }).catch(() => false)) {\n await button.click();\n await this.appFrame!.waitForTimeout(1000);\n }\n});", + "lineNumber": 240 + }, + { + "pattern": "l'écran contient le texte {string}", + "keyword": "Then", + "file": "evenement.steps.ts", + "sourceCode": "Then('l\\'écran contient le texte {string}', async function (this: FestipodWorld, expectedText: string) {\n const appeared = await this.appFrame!.waitForFunction(\n (text: string) => document.getElementById('root')?.textContent?.includes(text) ?? false,\n expectedText,\n { timeout: 10000 },\n ).then(() => true).catch(() => false);\n\n if (!appeared) {\n const debug = await this.appFrame!.evaluate(() => ({\n pathname: window.location.pathname,\n rootText: document.getElementById('root')?.textContent?.substring(0, 500),\n }));\n expect.fail(\n `Expected text \"${expectedText}\" not found. Path: \"${debug.pathname}\", content: \"${debug.rootText}\"`,\n );\n }\n});", + "lineNumber": 250 + }, + { + "pattern": "l'écran ne contient pas le texte {string}", + "keyword": "Then", + "file": "evenement.steps.ts", + "sourceCode": "Then('l\\'écran ne contient pas le texte {string}', async function (this: FestipodWorld, unexpectedText: string) {\n await this.appFrame!.waitForTimeout(500);\n const found = await this.appFrame!.evaluate(\n (text: string) => document.getElementById('root')?.textContent?.includes(text) ?? false,\n unexpectedText,\n );\n expect(found, `Text \"${unexpectedText}\" should NOT be present`).to.be.false;\n});", + "lineNumber": 268 + }, + { + "pattern": "l'écran d'accueil contient le texte {string}", + "keyword": "Then", + "file": "evenement.steps.ts", + "sourceCode": "Then('l\\'écran d\\'accueil contient le texte {string}', async function (this: FestipodWorld, expectedText: string) {\n await this.appFrame!.evaluate(() => {\n window.history.pushState(null, '', '/home');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 277 + }, + { + "pattern": "le navigateur {string} crée l'événement {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le navigateur {string} crée l\\'événement {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n const res = await frame.evaluate(\n async (t) => await (window as any).__testData.createEventReal(t),\n title,\n );\n expect(res.id, `event \"${title}\" created in browser ${name} must have an id`).to.be.a('string').and.not.equal('');\n (this as any).mbEvents = { ...((this as any).mbEvents || {}), [title]: res.id };\n});", + "lineNumber": 31 + }, + { + "pattern": "le navigateur {string} s'inscrit à l'événement {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le navigateur {string} s\\'inscrit à l\\'événement {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n const uid = secondParticipant(this);\n // Resolve the event id from the reactive set (the event created in browser A\n // has synced into browser B's independent session), then register via the REAL\n // app path (appJoinEvent → inbox deposit + notification + SPARQL persistence).\n await frame.waitForFunction(\n (t) => [...(window as any).__testData.events].some((e: any) => e.title === t),\n title,\n { timeout: 30000 },\n );\n await frame.evaluate(\n async ([t, u]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n await td.appJoinEvent(ev['@id'], u);\n },\n [title, uid] as [string, string],\n );\n});", + "lineNumber": 41 + }, + { + "pattern": "le navigateur {string} devient participant de l'événement {string}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('le navigateur {string} devient participant de l\\'événement {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n const uid = secondParticipant(this);\n await frame.waitForFunction(\n ([t, u]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n return !!ev && td.isParticipating(ev['@id'], u);\n },\n [title, uid] as [string, string],\n { timeout: 20000 },\n );\n});", + "lineNumber": 62 + }, + { + "pattern": "l'inbox de l'événement {string} reçoit un dépôt {string}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('l\\'inbox de l\\'événement {string} reçoit un dépôt {string}', async function (this: FestipodWorld, title: string, kind: string) {\n // Host-facing: read the event's inbox deposits back (the emulated curator) and\n // assert the registration deposit landed. Read from browser A (the host).\n const frame = this.browser('A').appFrame!;\n const found = await frame.waitForFunction(\n async ([t, k]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return false;\n const deposits = await td.readInboxDeposits(ev['@id']);\n return deposits.some((d: any) => d?.payload?.kind === k);\n },\n [title, kind] as [string, string],\n { timeout: 20000 },\n ).then(() => true).catch(() => false);\n expect(found, `host inbox of \"${title}\" should receive a \"${kind}\" deposit`).to.be.true;\n});", + "lineNumber": 76 + }, + { + "pattern": "le navigateur {string} se désinscrit de l'événement {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le navigateur {string} se désinscrit de l\\'événement {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n const uid = secondParticipant(this);\n // `leaveEvent` finds the participation in the reactive set before it deposits the\n // \"leave\" marker (an absent participation → early return → no deposit → the owner\n // never sees the leave). In the same-session leave (désinscription-persistante)\n // the optimistic overlay makes it present instantly; in the reconnect flow (owner-\n // convergence) B reloaded, so wait for its participation to sync back into the set\n // first. Event-driven wait on the reactive state — not a broker re-query loop.\n await frame.waitForFunction(\n ([t, u]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n return !!ev && td.isParticipating(ev['@id'], u);\n },\n [title, uid] as [string, string],\n { timeout: 30000 },\n ).catch(() => { /* proceed; leaveEvent will no-op if truly absent */ });", + "lineNumber": 96 + }, + { + "pattern": "le broker ne contient plus aucune participation à l'événement {string} pour le navigateur {string}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('le broker ne contient plus aucune participation à l\\'événement {string} pour le navigateur {string}', async function (this: FestipodWorld, title: string, name: string) {\n const frame = this.browser(name).appFrame!;\n const uid = secondParticipant(this);\n // AUTHORITATIVE re-query (not the reactive set): the broker itself must report 0\n // for (event, secondParticipant). A durable désinscription leaves 0.\n const count = await frame.evaluate(\n async ([t, u]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return -1;\n return await td.authParticipationCount(ev['@id'], u);\n },\n [title, uid] as [string, string],\n );\n expect(count, `broker must hold 0 participations to \"${title}\" after leave (authoritative re-query)`).to.equal(0);\n});", + "lineNumber": 124 + }, + { + "pattern": "l'inscription de l'événement {string} ne ressuscite pas dans le navigateur {string} après re-sync", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('l\\'inscription de l\\'événement {string} ne ressuscite pas dans le navigateur {string} après re-sync', async function (this: FestipodWorld, title: string, name: string) {\n const frame = this.browser(name).appFrame!;\n const uid = secondParticipant(this);\n // Give the broker sync time to (attempt to) resurrect the item, then assert it\n // stayed deleted — the SPARQL DELETE-WHERE fix means it must NOT come back.\n await frame.waitForTimeout(3000);\n const count = await frame.evaluate(\n async ([t, u]: [string, string]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return -1;\n return await td.authParticipationCount(ev['@id'], u);\n },\n [title, uid] as [string, string],\n );\n expect(count, `participation to \"${title}\" must NOT resurrect after re-sync`).to.equal(0);\n});", + "lineNumber": 141 + }, + { + "pattern": "le navigateur {string} ouvre le détail de l'événement {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le navigateur {string} ouvre le détail de l\\'événement {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n // Wait for the event to be in this session's reactive set, then select it (what\n // EventDetailScreen navigation does). Reads stay reactive via the subscription.\n await frame.waitForFunction(\n (t) => [...(window as any).__testData.events].some((e: any) => e.title === t),\n title,\n { timeout: 30000 },\n );\n await frame.evaluate(\n (t) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (ev) td.appData.setSelectedEventId(ev['@id']);\n },\n title,\n );\n});", + "lineNumber": 166 + }, + { + "pattern": "le navigateur {string} se reconnecte et matérialise l'inbox", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le navigateur {string} se reconnecte et matérialise l\\'inbox', async function (this: FestipodWorld, name: string) {\n const events = (this as any).mbEvents || {};\n // Reload the harness → fresh verifier re-loads the wallet from the broker,\n // pulling the other browser's synced writes (the deposit, or the owner's count).\n await this.loadAppInBrowser(name, 'harness');\n const frame = this.browser(name).appFrame!;\n await frame.waitForFunction(\n () => (window as any).__testData?.ready === true,\n null,\n { timeout: 30000 },\n );\n // Re-select every known event so the owner-materializer (keyed on ownedKey,\n // resolved from listMyEntityDocs on connect) has run its barrier-gated pass and\n // the detail view is back on the event. Best-effort per title.\n for (const title of Object.keys(events)) {\n await frame.waitForFunction(\n (t) => [...(window as any).__testData.events].some((e: any) => e.title === t),\n title,\n { timeout: 30000 },\n ).catch(() => { /* the event may not be in this browser's set yet */ });", + "lineNumber": 196 + }, + { + "pattern": "le compteur de participants réactif dans {string} pour {string} vaut {int}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('le compteur de participants réactif dans {string} pour {string} vaut {int}', async function (this: FestipodWorld, name: string, title: string, expected: number) {\n const frame = this.browser(name).appFrame!;\n // Wait (event-driven) for the reactive participantCount to reach `expected` — the\n // guard timeout only bounds the wait; the value arrives via the union re-read the\n // subscription triggers, never via the timeout itself.\n await frame.waitForFunction(\n ([t, n]: [string, number]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return false;\n const st = td.reactiveEventState(ev['@id']);\n return st.found && st.participantCount === n;\n },\n [title, expected] as [string, number],\n // The owner materializes ALL its owned events at connection (each with a\n // barrier-gated inbox read) before its own write pushes back into the reactive\n // set — so allow a generous window. This is an event-driven wait on the reactive\n // state settling (NOT a broker re-query loop, rule_no-broker-polling).\n { timeout: 45000 },\n );\n const count = await frame.evaluate(\n (t) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n return ev ? td.reactiveEventState(ev['@id']).participantCount : -1;\n },\n title,\n );\n expect(count, `reactive participantCount for \"${title}\" in browser ${name}`).to.equal(expected);\n});", + "lineNumber": 227 + }, + { + "pattern": "sans recharger, le compteur de participants réactif dans {string} pour {string} passe à {int}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('sans recharger, le compteur de participants réactif dans {string} pour {string} passe à {int}', async function (this: FestipodWorld, name: string, title: string, expected: number) {\n const frame = this.browser(name).appFrame!;\n // NO reload / no local action on A between B's join and this assertion — the\n // update MUST arrive through A's `doc_subscribe` on the (public) event doc that B\n // wrote. Event-driven wait: waitForFunction polls A's already-live reactive state\n // (no loadAppInBrowser here), succeeding only once the subscription push re-read.\n const reached = await frame.waitForFunction(\n ([t, n]: [string, number]) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return false;\n const st = td.reactiveEventState(ev['@id']);\n return st.found && st.participantCount === n;\n },\n [title, expected] as [string, number],\n { timeout: 30000 },\n ).then(() => true).catch(() => false);\n expect(reached, `reactive participantCount for \"${title}\" in browser ${name} must reach ${expected} WITHOUT reload (via doc_subscribe)`).to.be.true;\n});", + "lineNumber": 258 + }, + { + "pattern": "le navigateur {string} affiche un participant {string} pour {string}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('le navigateur {string} affiche un participant {string} pour {string}', async function (this: FestipodWorld, name: string, _kind: string, title: string) {\n const frame = this.browser(name).appFrame!;\n // B is NOT a connection of A, so its participation doc is unreadable to A → it\n // never appears as a NAMED participant; it falls into the \"unknown\" placeholder\n // count (participantCount − knownCount ≥ 1), exactly EventDetailScreen's\n // \"Voir tous les participants\" path. Assert reactively (event-driven).\n const unknown = await frame.waitForFunction(\n (t) => {\n const td = (window as any).__testData;\n const ev = [...td.events].find((e: any) => e.title === t);\n if (!ev) return false;\n const st = td.reactiveEventState(ev['@id']);\n return st.found && st.unknownCount >= 1 ? st.unknownCount : false;\n },\n title,\n { timeout: 20000 },\n ).then(h => h.jsonValue()).catch(() => 0);\n expect(Number(unknown), `browser ${name} must show ≥1 \"unknown\" participant for \"${title}\"`).to.be.at.least(1);\n});", + "lineNumber": 278 + }, + { + "pattern": "le compte {string} publie un événement public {string} dans le navigateur {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le compte {string} publie un événement public {string} dans le navigateur {string}', async function (this: FestipodWorld, publisher: string, title: string, name: string) {\n const frame = this.browser(name).appFrame!;\n const res = await frame.evaluate(\n async (p) => await (window as any).__testData.publishPublicEventAs(p, ''),\n publisher,\n );\n expect(res.doc, `publisher public event doc for ${publisher}`).to.be.a('string');\n (this as any).mbDiscovery = { publisher, title, doc: res.doc };\n});", + "lineNumber": 300 + }, + { + "pattern": "le compte {string} découvre les événements publics dans le navigateur {string} sans être connecté à {string}", + "keyword": "When", + "file": "multibrowser-features.steps.ts", + "sourceCode": "When('le compte {string} découvre les événements publics dans le navigateur {string} sans être connecté à {string}', async function (this: FestipodWorld, discoverer: string, name: string, _publisher: string) {\n const { doc, title } = (this as any).mbDiscovery;\n // The publisher doc + its account were created in the OTHER browser's verifier.\n // For THIS browser's independent verifier to discover them, it must PULL those\n // wallet writes from the broker. Two independent NextGraph verifiers on the same\n // shared-wallet document converge eventually, but a `sparqlQuery` reads the LOCAL\n // verifier copy — it won't pull on its own. Re-bootstrapping this browser's\n // harness (fresh page → fresh verifier load from the broker) forces the pull.\n // So: poll discovery, and every few attempts reload this browser's harness to\n // re-sync from the broker, until the publisher doc surfaces.\n let listed: string[] = [];\n let frame = this.browser(name).appFrame!;\n for (let attempt = 0; attempt < 12 && !listed.includes(doc); attempt++) {\n if (attempt > 0 && attempt % 3 === 0) {\n // Reload the harness → the verifier re-loads the wallet from the broker,\n // pulling the publisher's shim account + index writes.\n await this.loadAppInBrowser(name, 'harness');\n frame = this.browser(name).appFrame!;\n await frame.waitForFunction(\n () => (window as any).__testData?.ready === true,\n null,\n { timeout: 30000 },\n );\n }\n const res = await frame.evaluate(\n async (d) => await (window as any).__testData.discoverPublicEventsAs(d),\n discoverer,\n );\n listed = res.listed;\n if (!listed.includes(doc)) await frame.waitForTimeout(1500);\n }\n (this as any).mbDiscovery.listed = listed;\n expect(listed, 'cross-account public index should list the publisher doc (after cross-verifier re-sync)').to.include(doc);\n // mounts a useShape({graphs}) over the discovered docs; write the\n // publisher's public event into its own doc (now part of the discoverer fan-out).\n await frame.waitForFunction(\n () => (window as any).__fanout?.ready === true,\n null,\n { timeout: 15000 },\n );\n await frame.evaluate(\n ([d, t]: [string, string]) => (window as any).__fanout.addEventTo(d, t),\n [doc, title] as [string, string],\n );\n});", + "lineNumber": 310 + }, + { + "pattern": "le navigateur {string} voit l'événement public {string}", + "keyword": "Then", + "file": "multibrowser-features.steps.ts", + "sourceCode": "Then('le navigateur {string} voit l\\'événement public {string}', async function (this: FestipodWorld, name: string, title: string) {\n const frame = this.browser(name).appFrame!;\n await frame.waitForFunction(\n (t) => ((window as any).__fanout.titles() as string[]).includes(t),\n title,\n { timeout: 15000 },\n );\n const titles = await frame.evaluate(() => (window as any).__fanout.titles());\n expect(titles, `browser ${name} should see the public event \"${title}\"`).to.include(title);\n});", + "lineNumber": 356 + }, + { + "pattern": "l'utilisateur crée un événement {string} via le vrai formulaire", + "keyword": "Given", + "file": "reconnexion-persistance.steps.ts", + "sourceCode": "Given('l\\'utilisateur crée un événement {string} via le vrai formulaire', { timeout: 90000 }, async function (this: FestipodWorld, title: string) {\n // Start capturing console on the MAIN page from BEFORE the create write, so we\n // observe whether the create WRITE lands before/after CONNECTION ESTABLISHED.\n const mainLogs: StampedLog[] = [];\n (this as any).recoMainLogs = mainLogs;\n attachConsoleCapture(this.page!, mainLogs);\n\n const frame = this.appFrame!;\n\n // Navigate to the real create form and fill it via the DOM, exactly like the\n // real app user (mirrors evenement.steps.ts). 3-step wizard.\n await frame.evaluate(() => {\n window.history.pushState(null, '', '/events/new');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 79 + }, + { + "pattern": "l'événement {string} apparaît sur l'accueil de l'utilisateur", + "keyword": "Given", + "file": "reconnexion-persistance.steps.ts", + "sourceCode": "Given('l\\'événement {string} apparaît sur l\\'accueil de l\\'utilisateur', { timeout: 60000 }, async function (this: FestipodWorld, title: string) {\n const frame = this.appFrame!;\n // Navigate home; if home (participation-filtered) is empty, fall back to\n // /events (Découvrir, no participation filter) — the created event is public.\n await frame.evaluate(() => {\n window.history.pushState(null, '', '/home');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 137 + }, + { + "pattern": "l'utilisateur ferme et rouvre l'app sous la même identité dans une session broker fraîche", + "keyword": "When", + "file": "reconnexion-persistance.steps.ts", + "sourceCode": "When('l\\'utilisateur ferme et rouvre l\\'app sous la même identité dans une session broker fraîche', { timeout: 180000 }, async function (this: FestipodWorld) {\n // SAME browser context → same wallet → same person. The reopened app asks\n // `ensureIdentity()` who it is, exactly as the first page did.\n const ctx = this.page!.context();\n\n const freshPage = await ctx.newPage();\n\n const freshLogs: StampedLog[] = [];\n (this as any).recoFreshLogs = freshLogs;\n attachConsoleCapture(freshPage, freshLogs);\n freshPage.on('pageerror', (err) => freshLogs.push({ t: Date.now(), text: `pageerror: ${err.message}` }));\n\n // NEW broker login → fresh verifier session on the SAME persistent wallet.\n const freshFrame = await pool.setupBrokerPage!(freshPage, pool.appUrl!);\n // Wait for the real app to render.\n await freshFrame.waitForFunction(\n () => {\n const root = document.getElementById('root');\n return !!root && root.innerHTML.length > 100;\n },\n { timeout: 60000 },\n );\n // Let NG connect + the cold-start read path run.\n await freshFrame.waitForTimeout(6000);\n (this as any).recoFreshFrame = freshFrame;\n (this as any).recoFreshPage = freshPage;\n});", + "lineNumber": 172 + }, + { + "pattern": "l'événement {string} est toujours présent après reconnexion", + "keyword": "Then", + "file": "reconnexion-persistance.steps.ts", + "sourceCode": "Then('l\\'événement {string} est toujours présent après reconnexion', { timeout: 90000 }, async function (this: FestipodWorld, title: string) {\n const freshFrame = (this as any).recoFreshFrame as import('playwright').Frame;\n\n // Poll BOTH home (participation-filtered) and /events (Découvrir, public list),\n // re-navigating each attempt so the cold-start union read has time to converge.\n // This is NOT broker-polling (rule_no-broker-polling): the app is reactive; we\n // re-read the RENDERED DOM until the reactive set settles, bounded by timeout.\n const deadline = Date.now() + 60000;\n let found = false;\n while (Date.now() < deadline && !found) {\n for (const path of ['/home', '/events']) {\n await freshFrame.evaluate((p: string) => {\n window.history.pushState(null, '', p);\n window.dispatchEvent(new PopStateEvent('popstate'));\n }, path);\n found = await freshFrame.waitForFunction(\n (t: string) => document.getElementById('root')?.textContent?.includes(t) ?? false,\n title,\n { timeout: 6000 },\n ).then(() => true).catch(() => false);\n if (found) break;\n }\n }\n\n // --- Report console evidence from BOTH pages regardless of pass/fail ---\n const mainLogs = ((this as any).recoMainLogs ?? []) as StampedLog[];\n const freshLogs = ((this as any).recoFreshLogs ?? []) as StampedLog[];\n const report =\n summarizeLogs('MAIN PAGE (creator)', mainLogs) + '\\n\\n' +\n summarizeLogs('FRESH PAGE (reconnect)', freshLogs) + '\\n\\n' +\n `RESULT: event \"${title}\" ${found ? 'SURVIVED (visible after reconnect)' : 'DISAPPEARED (NOT visible after reconnect)'}`;\n this.attach(report, 'text/plain');\n // Also echo to stdout so it lands in the raw run output.\n console.log('\\n' + report + '\\n');\n\n // Opt-in RAW dump of connection/sync lines (RECO_RAW_DUMP=1) — the evidence\n // that the FRESH page is a genuine cold boot (own WASM worker + own broker\n // handshake), used to argue reconnection FIDELITY. Off by default (noise).\n if (process.env.RECO_RAW_DUMP === '1') {\n const dumpRaw = (label: string, logs: StampedLog[]) => {\n const t0 = logs.length ? logs[0]!.t : Date.now();\n const hits = logs.filter((l) => /peer|CONNECTION|ESTABLISHED|REPLAY|broker|verifier|worker|bootstrap|open_repo|\\bsync\\b/i.test(l.text));\n console.log(`\\n### RAW (${label}) — ${hits.length} connection/sync lines ###`);\n for (const l of hits) console.log(`+${((l.t - t0) / 1000).toFixed(2)}s ${l.text.slice(0, 200)}`);\n };\n dumpRaw('MAIN', mainLogs);\n dumpRaw('FRESH', freshLogs);\n }\n\n if (!found) {\n const debug = await freshFrame.evaluate(() => ({\n pathname: window.location.pathname,\n rootText: document.getElementById('root')?.textContent?.substring(0, 500),\n }));\n expect.fail(`Reconnected fresh page for the SAME identity did NOT show \"${title}\". Path: ${debug.pathname}, content: ${debug.rootText}`);\n }\n});", + "lineNumber": 200 }, { "pattern": "je clique sur un événement", "keyword": "When", "file": "event.steps.ts", - "sourceCode": "When('je clique sur un événement', async function (this: FestipodWorld) {\n this.navigateTo('#/demo/event-detail');\n});", + "sourceCode": "When('je clique sur un événement', async function (this: FestipodWorld) {\n await this.navigateTo('#/demo/event-detail');\n});", "lineNumber": 5 }, { "pattern": "je visualise l'événement {string}", "keyword": "Given", "file": "event.steps.ts", - "sourceCode": "Given('je visualise l\\'événement {string}', async function (this: FestipodWorld, eventName: string) {\n this.navigateTo('#/demo/event-detail');\n expect(this.currentScreen, 'Event detail screen should be loaded').to.not.be.null;\n this.attach(`Viewing event: ${eventName}`, 'text/plain');\n});", + "sourceCode": "Given('je visualise l\\'événement {string}', async function (this: FestipodWorld, eventName: string) {\n await this.navigateTo('#/demo/event-detail');\n expect(this.currentScreen, 'Event detail screen should be loaded').to.not.be.null;\n this.attach(`Viewing event: ${eventName}`, 'text/plain');\n});", "lineNumber": 9 }, { "pattern": "je peux annuler et revenir à l'écran précédent", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('je peux annuler et revenir à l\\'écran précédent', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('create-event');\n const source = this.getRenderedText();\n const found = /onClick\\s*=\\s*\\{\\s*\\(\\)\\s*=>\\s*navigate\\s*\\(['\"]home['\"]\\)\\s*\\}[^>]*>✕]*>[^<]+<\\/Title>/.test(source), 'Event detail should have a Title').to.be.true;\n expect(/📅/.test(source), 'Event detail should have date emoji 📅').to.be.true;\n expect(/🕓/.test(source), 'Event detail should have time emoji 🕓').to.be.true;\n expect(/📍/.test(source), 'Event detail should have location emoji 📍').to.be.true;\n expect(/À propos/.test(source), 'Event detail should have \"À propos\" section').to.be.true;\n});", - "lineNumber": 31 + "sourceCode": "Then('je peux voir les détails de l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const text = doc!.body.textContent ?? '';\n expect(text.includes('📅'), 'Event detail should show a date icon').to.be.true;\n expect(text.includes('📍'), 'Event detail should show a location icon').to.be.true;\n});", + "lineNumber": 33 }, { "pattern": "l'écran affiche les informations de l'événement", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('l\\'écran affiche les informations de l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const source = this.getRenderedText();\n expect(/]*>[^<]+<\\/Title>/.test(source), 'Event detail should have a Title').to.be.true;\n expect(/📅/.test(source), 'Event detail should have date emoji 📅').to.be.true;\n expect(/🕓/.test(source), 'Event detail should have time emoji 🕓').to.be.true;\n expect(/📍/.test(source), 'Event detail should have location emoji 📍').to.be.true;\n expect(/À propos/.test(source), 'Event detail should have \"À propos\" section').to.be.true;\n});", - "lineNumber": 41 + "sourceCode": "Then('l\\'écran affiche les informations de l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const text = doc!.body.textContent ?? '';\n expect(text.includes('📅'), 'Event detail should show a date icon').to.be.true;\n expect(text.includes('📍'), 'Event detail should show a location icon').to.be.true;\n expect(text.length, 'Event detail body should contain content').to.be.greaterThan(50);\n});", + "lineNumber": 42 }, { "pattern": "je peux voir la liste des événements", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('je peux voir la liste des événements', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n if (this.currentScreenId === 'home') {\n expect(/Mes événements à venir/.test(source), 'Home screen should have \"Événements à venir\" text').to.be.true;\n } else if (this.currentScreenId === 'events') {\n expect(/]*onClick/.test(source), 'Events screen should have clickable Card components').to.be.true;\n } else {\n expect.fail(`Unexpected screen \"${this.currentScreenId}\" - events list should be on home or events screen`);\n }\n});", - "lineNumber": 51 + "sourceCode": "Then('je peux voir la liste des événements', async function (this: FestipodWorld) {\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const text = doc!.body.textContent ?? '';\n if (this.currentScreenId === 'home') {\n expect(text.includes('En cours') || text.includes('À venir'),\n 'Home should show event section headers').to.be.true;\n } else if (this.currentScreenId === 'events') {\n const cards = doc!.querySelectorAll('.app-card');\n expect(cards.length, 'Events screen should render at least one event card').to.be.greaterThan(0);\n } else {\n expect.fail(`Unexpected screen \"${this.currentScreenId}\" - events list should be on home or events screen`);\n }\n});", + "lineNumber": 52 }, { "pattern": "les événements affichent leur lieu", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('les événements affichent leur lieu', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n const locationPattern = /📍.*]*className=\"user-content\"[^>]*>[^<]+<\\/span>/;\n expect(locationPattern.test(source), 'Event cards should display location text after 📍 emoji').to.be.true;\n});", - "lineNumber": 62 + "sourceCode": "Then('les événements affichent leur lieu', async function (this: FestipodWorld) {\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const text = doc!.body.textContent ?? '';\n // List/discover cards show \" · \" without an icon. Detail\n // screen uses 📍. Accept either signal — the assertion is that location\n // text is visible on event cards.\n const seedLocations = ['Le Revel', 'La Maison du Vélo', \"Tiers-lieu L'Hermitage\", 'MJC Montplaisir'];\n const hasSeedLocation = seedLocations.some(loc => text.includes(loc));\n expect(hasSeedLocation || text.includes('📍'),\n 'Event cards should display a location (text or 📍 icon)').to.be.true;\n});", + "lineNumber": 67 }, { "pattern": "je peux m'inscrire à l'événement", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('je peux m\\'inscrire à l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const source = this.getRenderedText();\n const hasParticiperButton = /isJoined \\? '✓ Inscrit' : 'Participer'/.test(source);\n expect(hasParticiperButton, 'Event detail should have Participer/Inscrit toggle button').to.be.true;\n});", - "lineNumber": 68 + "sourceCode": "Then('je peux m\\'inscrire à l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const buttons = Array.from(doc!.querySelectorAll('button')).map(b => b.textContent ?? '');\n const hasToggle = buttons.some(t => t.includes(\"J'y serai\") || t.includes('Je participe'));\n expect(hasToggle, 'Event detail should expose a join/leave toggle button').to.be.true;\n});", + "lineNumber": 80 }, { "pattern": "je peux me désinscrire de l'événement", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('je peux me désinscrire de l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const source = this.getRenderedText();\n const hasInscritButton = /isJoined \\? '✓ Inscrit' : 'Participer'/.test(source);\n expect(hasInscritButton, 'Event detail should have Participer/Inscrit toggle button (click to unregister)').to.be.true;\n});", - "lineNumber": 75 + "sourceCode": "Then('je peux me désinscrire de l\\'événement', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('event-detail');\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const buttons = Array.from(doc!.querySelectorAll('button')).map(b => b.textContent ?? '');\n const hasToggle = buttons.some(t => t.includes(\"J'y serai\") || t.includes('Je participe'));\n expect(hasToggle, 'Event detail should expose a join/leave toggle button').to.be.true;\n});", + "lineNumber": 89 }, { "pattern": "le formulaire contient le champ obligatoire {string}", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('le formulaire contient le champ obligatoire {string}', async function (this: FestipodWorld, fieldName: string) {\n expect(this.currentScreenId, 'This step is for form screens only').to.equal('create-event');\n const source = this.getRenderedText();\n const escapedName = fieldName.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const pattern = new RegExp(`>${escapedName}\\\\s*\\\\*<`);\n expect(pattern.test(source), `Field \"${fieldName}\" should be marked as required (with *) in create-event screen`).to.be.true;\n});", - "lineNumber": 84 + "sourceCode": "Then('le formulaire contient le champ obligatoire {string}', async function (this: FestipodWorld, fieldName: string) {\n expect(this.currentScreenId, 'This step is for form screens only').to.equal('create-event');\n expectRequiredField(this, fieldName);\n});", + "lineNumber": 100 }, { "pattern": "le formulaire contient les champs obligatoires suivants:", "keyword": "Then", "file": "event.steps.ts", - "sourceCode": "Then('le formulaire contient les champs obligatoires suivants:', async function (this: FestipodWorld, dataTable) {\n expect(this.currentScreenId, 'This step is for form screens only').to.equal('create-event');\n const source = this.getRenderedText();\n const expectedFields = dataTable.raw().flat();\n expectedFields.forEach((fieldName: string) => {\n const escapedName = fieldName.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const pattern = new RegExp(`>${escapedName}\\\\s*\\\\*<`);\n expect(pattern.test(source), `Field \"${fieldName}\" should be marked as required (with *) in create-event screen`).to.be.true;\n });", - "lineNumber": 92 + "sourceCode": "Then('le formulaire contient les champs obligatoires suivants:', async function (this: FestipodWorld, dataTable) {\n expect(this.currentScreenId, 'This step is for form screens only').to.equal('create-event');\n const expectedFields = dataTable.raw().flat();\n expectedFields.forEach((fieldName: string) => expectRequiredField(this, fieldName));\n});", + "lineNumber": 105 }, { - "pattern": "le formulaire permet de détecter les doublons", - "keyword": "Then", - "file": "event.steps.ts", - "sourceCode": "Then('le formulaire permet de détecter les doublons', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('create-event');\n const source = this.getRenderedText();\n expect(/showDuplicateWarning/.test(source), 'Form should have duplicate detection logic').to.be.true;\n expect(/Événement similaire détecté/.test(source), 'Form should have duplicate warning message').to.be.true;\n});", - "lineNumber": 103 + "pattern": "l'application connectée affiche l'accueil", + "keyword": "When", + "file": "accueil-connecte-rend.steps.ts", + "sourceCode": "When(\"l'application connectée affiche l'accueil\", async function (this: FestipodWorld) {\n // Un utilisateur connecté qui atterrit sur '/' est redirigé vers '/home' par\n // WelcomeScreen. On navigue explicitement pour rendre le smoke déterministe\n // quel que soit l'état de la redirection au moment du boot.\n await this.appFrame!.evaluate(() => {\n window.history.pushState(null, '', '/home');\n window.dispatchEvent(new PopStateEvent('popstate'));\n });", + "lineNumber": 14 }, { - "pattern": "le formulaire permet d'importer depuis Mobilizon ou Transiscope", + "pattern": "l'accueil rend un contenu d'application réel", "keyword": "Then", - "file": "event.steps.ts", - "sourceCode": "Then('le formulaire permet d\\'importer depuis Mobilizon ou Transiscope', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('create-event');\n const source = this.getRenderedText();\n expect(/importableEvents/.test(source), 'Form should have importable events data').to.be.true;\n expect(/Mobilizon/.test(source), 'Form should support Mobilizon import').to.be.true;\n expect(/Transiscope/.test(source), 'Form should support Transiscope import').to.be.true;\n expect(/Importer depuis une source externe/.test(source), 'Form should have import section').to.be.true;\n});", - "lineNumber": 110 + "file": "accueil-connecte-rend.steps.ts", + "sourceCode": "Then(\"l'accueil rend un contenu d'application réel\", async function (this: FestipodWorld) {\n // Marqueurs FORTS et propres à HomeScreen (absents de WelcomeScreen / d'un\n // simple spinner / du bandeau broker) :\n // - .app-navbar : la barre de navigation basse (BottomNav) — rendue par\n // HomeScreen, pas par l'écran d'onboarding ;\n // - le bouton « Relayer » (aria-label=\"Relayer un événement\") propre à\n // l'en-tête de l'accueil.\n // Si un throw dans HomeScreen (ou un provider monté après connexion) blanchit\n // le rendu, React démonte l'arbre (aucun ErrorBoundary) et ces marqueurs\n // disparaissent → l'attente échoue.\n const rendered = await this.appFrame!.waitForFunction(\n () => {\n const root = document.getElementById('root');\n if (!root) return false;\n const hasNavbar = document.querySelector('.app-navbar') !== null;\n const hasRelayer =\n document.querySelector('[aria-label=\"Relayer un événement\"]') !== null;\n return hasNavbar && hasRelayer;\n },\n { timeout: 15000 },\n ).then(() => true).catch(() => false);\n\n if (!rendered) {\n const debug = await this.appFrame!.evaluate(() => ({\n pathname: window.location.pathname,\n hasNavbar: document.querySelector('.app-navbar') !== null,\n hasRelayer: document.querySelector('[aria-label=\"Relayer un événement\"]') !== null,\n rootLen: document.getElementById('root')?.innerHTML.length ?? 0,\n rootText: document.getElementById('root')?.textContent?.substring(0, 400),\n }));\n expect.fail(\n `L'accueil connecté n'a pas rendu de contenu d'app réel (page blanche ?). ` +\n `path=\"${debug.pathname}\", .app-navbar=${debug.hasNavbar}, ` +\n `bouton Relayer=${debug.hasRelayer}, #root length=${debug.rootLen}, ` +\n `texte: \"${debug.rootText}\"`,\n );\n }\n});", + "lineNumber": 26 }, { - "pattern": "l'import externe ne déclenche pas d'alerte doublon", + "pattern": "aucune erreur runtime n'a été émise pendant le boot connecté", "keyword": "Then", - "file": "event.steps.ts", - "sourceCode": "Then('l\\'import externe ne déclenche pas d\\'alerte doublon', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('create-event');\n const source = this.getRenderedText();\n expect(/importedFrom/.test(source), 'Form should track import source').to.be.true;\n expect(/&& !importedFrom/.test(source), 'Duplicate warning should be disabled for imports').to.be.true;\n});", - "lineNumber": 119 + "file": "accueil-connecte-rend.steps.ts", + "sourceCode": "Then('aucune erreur runtime n\\'a été émise pendant le boot connecté', function (this: FestipodWorld) {\n // this.pageErrors est peuplé par le hook Before (pageerror + console.error de\n // la page app), réinitialisé à chaque scénario. Un crash de rendu connecté\n // (throw non attrapé dans un composant/provider) émet un `pageerror` et\n // atterrit ici → assertion rouge avec la liste exacte.\n expect(\n this.pageErrors,\n `Des erreurs runtime ont été émises pendant le boot connecté :\\n` +\n this.pageErrors.map((e, i) => ` [${i + 1}] ${e}`).join('\\n'),\n ).to.be.empty;\n});", + "lineNumber": 65 }, { "pattern": "je peux configurer mes notifications", @@ -378,77 +756,98 @@ export const stepDefinitions: StepDefinitionInfo[] = [ "pattern": "je clique sur un participant", "keyword": "When", "file": "user.steps.ts", - "sourceCode": "When('je clique sur un participant', async function (this: FestipodWorld) {\n this.navigateTo('#/demo/user-profile');\n});", + "sourceCode": "When('je clique sur un participant', async function (this: FestipodWorld) {\n await this.navigateTo('#/demo/user-profile');\n});", "lineNumber": 5 }, { "pattern": "je visualise le profil de {string}", "keyword": "Given", "file": "user.steps.ts", - "sourceCode": "Given('je visualise le profil de {string}', async function (this: FestipodWorld, userName: string) {\n this.navigateTo('#/demo/user-profile');\n expect(this.currentScreen, 'User profile screen should be loaded').to.not.be.null;\n this.attach(`Viewing profile: ${userName}`, 'text/plain');\n});", + "sourceCode": "Given('je visualise le profil de {string}', async function (this: FestipodWorld, userName: string) {\n await this.navigateTo('#/demo/user-profile');\n expect(this.currentScreen, 'User profile screen should be loaded').to.not.be.null;\n this.attach(`Viewing profile: ${userName}`, 'text/plain');\n});", "lineNumber": 9 }, { "pattern": "je peux voir mon profil", "keyword": "Then", "file": "user.steps.ts", - "sourceCode": "Then('je peux voir mon profil', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('profile');\n const source = this.getRenderedText();\n expect(/]*initials=\"MD\"[^>]*size=\"lg\"/.test(source), 'Profile should have Avatar with initials=\"MD\" and size=\"lg\"').to.be.true;\n expect(/]*>Marie Dupont<\\/Title>/.test(source), 'Profile should have Title \"Marie Dupont\"').to.be.true;\n expect(/@mariedupont/.test(source), 'Profile should have username @mariedupont').to.be.true;\n});", + "sourceCode": "Then('je peux voir mon profil', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('profile');\n expectProfileDom(this, { initials: 'MD', name: 'Marie Dupont', username: '@mariedupont' });", "lineNumber": 15 }, { "pattern": "je peux voir le profil de l'utilisateur", "keyword": "Then", "file": "user.steps.ts", - "sourceCode": "Then('je peux voir le profil de l\\'utilisateur', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('user-profile');\n const source = this.getRenderedText();\n expect(/]*initials=\"JD\"[^>]*size=\"lg\"/.test(source), 'User profile should have Avatar with initials=\"JD\" and size=\"lg\"').to.be.true;\n expect(/]*>Jean Durand<\\/Title>/.test(source), 'User profile should have Title \"Jean Durand\"').to.be.true;\n expect(/@jeandurand/.test(source), 'User profile should have username @jeandurand').to.be.true;\n});", - "lineNumber": 23 + "sourceCode": "Then('je peux voir le profil de l\\'utilisateur', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('user-profile');\n // user-profile defaults to the first non-current seed user when no userId is\n // bound — see UserProfileScreen.tsx. With current seed data that's Jean Durand.\n expectProfileDom(this, { initials: 'JD', name: 'Jean Durand', username: '@jeandurand' });", + "lineNumber": 20 }, { "pattern": "l'écran affiche les informations du profil", "keyword": "Then", "file": "user.steps.ts", - "sourceCode": "Then('l\\'écran affiche les informations du profil', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n if (this.currentScreenId === 'profile') {\n expect(/]*initials=\"MD\"/.test(source), 'Profile should have Avatar with initials=\"MD\"').to.be.true;\n expect(/]*>Marie Dupont<\\/Title>/.test(source), 'Profile should have Title \"Marie Dupont\"').to.be.true;\n expect(/@mariedupont/.test(source), 'Profile should have username @mariedupont').to.be.true;\n } else if (this.currentScreenId === 'user-profile') {\n expect(/]*initials=\"JD\"/.test(source), 'User profile should have Avatar with initials=\"JD\"').to.be.true;\n expect(/]*>Jean Durand<\\/Title>/.test(source), 'User profile should have Title \"Jean Durand\"').to.be.true;\n expect(/@jeandurand/.test(source), 'User profile should have username @jeandurand').to.be.true;\n } else {\n expect.fail(`Unexpected screen \"${this.currentScreenId}\" for profile info check`);\n }\n});", - "lineNumber": 31 + "sourceCode": "Then('l\\'écran affiche les informations du profil', async function (this: FestipodWorld) {\n const doc = this.renderedDoc;\n expect(doc, 'Screen should be rendered').to.not.be.null;\n const text = doc!.body.textContent ?? '';\n if (this.currentScreenId === 'profile') {\n expect(text.includes('Marie Dupont'), 'Profile should display \"Marie Dupont\"').to.be.true;\n expect(text.includes('@mariedupont'), 'Profile should display \"@mariedupont\"').to.be.true;\n } else if (this.currentScreenId === 'user-profile') {\n expect(text.includes('Jean Durand'), 'User profile should display \"Jean Durand\"').to.be.true;\n expect(text.includes('@jeandurand'), 'User profile should display \"@jeandurand\"').to.be.true;\n } else {\n expect.fail(`Unexpected screen \"${this.currentScreenId}\" for profile info check`);\n }\n const avatar = doc!.querySelector('.app-avatar');\n expect(avatar, 'Profile screen should render an avatar').to.not.be.null;\n});", + "lineNumber": 27 }, { "pattern": "je peux contacter l'utilisateur", "keyword": "Then", "file": "user.steps.ts", - "sourceCode": "Then('je peux contacter l\\'utilisateur', async function (this: FestipodWorld) {\n expect(this.currentScreenId).to.equal('user-profile');\n const source = this.getRenderedText();\n const hasContactButton = /`, 'i');\n expect(pattern.test(source), `Button \"${buttonName}\" should exist in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 74 + "lineNumber": 73 }, { "pattern": "je suis redirigé vers {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('je suis redirigé vers {string}', async function (this: FestipodWorld, pageName: string) {\n const screenId = resolveScreenId(pageName);\n expect(this.currentScreenId).to.equal(screenId);\n});", - "lineNumber": 81 + "lineNumber": 80 }, { "pattern": "je vois l'écran {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('je vois l\\'écran {string}', async function (this: FestipodWorld, pageName: string) {\n const screenId = resolveScreenId(pageName);\n expect(this.currentScreenId).to.equal(screenId);\n});", - "lineNumber": 86 + "lineNumber": 85 }, { "pattern": "je reste sur la page {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('je reste sur la page {string}', async function (this: FestipodWorld, pageName: string) {\n const screenId = resolveScreenId(pageName);\n expect(this.currentScreenId).to.equal(screenId);\n});", - "lineNumber": 91 + "lineNumber": 90 }, { "pattern": "l'écran contient une section {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('l\\'écran contient une section {string}', async function (this: FestipodWorld, sectionName: string) {\n expect(this.hasText(sectionName), `Section \"${sectionName}\" should be present in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 96 + "lineNumber": 95 }, { "pattern": "je peux naviguer vers {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('je peux naviguer vers {string}', async function (this: FestipodWorld, pageName: string) {\n const screenId = resolveScreenId(pageName);\n const source = this.getRenderedText();\n const pattern = new RegExp(`navigate\\\\s*\\\\(\\\\s*['\"]${screenId}['\"]\\\\s*\\\\)`);\n expect(pattern.test(source), `Navigation to \"${screenId}\" should exist in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 100 + "lineNumber": 99 }, { "pattern": "la navigation affiche {string} comme actif", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('la navigation affiche {string} comme actif', async function (this: FestipodWorld, menuItem: string) {\n const source = this.getRenderedText();\n const escapedItem = menuItem.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n const pattern = new RegExp(`label:\\\\s*['\"]${escapedItem}['\"][^}]*active:\\\\s*true`, 'i');\n expect(pattern.test(source), `Menu item \"${menuItem}\" should be active in NavBar of screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 107 + "lineNumber": 106 }, { "pattern": "l'écran contient un bouton {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('l\\'écran contient un bouton {string}', async function (this: FestipodWorld, buttonText: string) {\n expect(this.hasText(buttonText), `Button \"${buttonText}\" should be present in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 114 + "lineNumber": 113 }, { "pattern": "l'écran contient un champ {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('l\\'écran contient un champ {string}', async function (this: FestipodWorld, fieldLabel: string) {\n expect(this.hasText(fieldLabel), `Field \"${fieldLabel}\" should be present in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 118 + "lineNumber": 117 }, { "pattern": "l'écran contient un texte {string}", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('l\\'écran contient un texte {string}', async function (this: FestipodWorld, text: string) {\n expect(this.hasText(text), `Text \"${text}\" should be present in screen \"${this.currentScreenId}\"`).to.be.true;\n});", - "lineNumber": 122 + "lineNumber": 121 }, { "pattern": "l'écran contient un avatar", "keyword": "Then", "file": "navigation.steps.ts", "sourceCode": "Then('l\\'écran contient un avatar', async function (this: FestipodWorld) {\n const source = this.getRenderedText();\n const hasAvatar = /> | null; - /** Password of the e2e shared wallet file (festipod-e2e-tests) — for assertions. */ - sharedWalletPassword: string; /** * Navigate a page through the NG broker to load `appUrl` in its iframe and * return the app's Frame. Set by hooks.ts (closes over the broker login flow). @@ -52,19 +50,6 @@ export interface BrowserPool { setupBrokerPage: (page: Page, appUrl: string) => Promise; /** Finish the broker login once the page is already on the broker (post-redirect). */ completeBrokerLogin: (page: Page, appUrl: string, walletPassword?: string) => Promise; - /** - * Drive the standalone nextgraph.eu "Import a Wallet File" flow on `page`: - * upload the .ngw file, unlock with `password`. The wallet FILE is the static, - * reusable assisted-import primitive (a TextCode is a transient 5-min transfer, - * unusable to embed). After this the page's context holds the wallet. - */ - importWalletViaFile: (page: Page, filePath: string, password: string) => Promise; - /** - * Build (once) a STAGING bundle of the real app — gate ON + the shared wallet - * TextCode baked in — serve it statically, and return its URL. Used by the - * human-flow e2e to exercise the real AccessGateScreen. Memoised. - */ - ensureStagingApp: () => Promise; } export const pool: BrowserPool = { @@ -76,19 +61,12 @@ export const pool: BrowserPool = { useRealBroker: false, permissions: [], sharedWalletState: null, - sharedWalletPassword: '', setupBrokerPage: async () => { throw new Error('browserPool not initialized — did BeforeAll run?'); }, completeBrokerLogin: async () => { throw new Error('browserPool not initialized — did BeforeAll run?'); }, - importWalletViaFile: async () => { - throw new Error('browserPool not initialized — did BeforeAll run?'); - }, - ensureStagingApp: async () => { - throw new Error('browserPool not initialized — did BeforeAll run?'); - }, }; /** diff --git a/src/shared/support/hooks.ts b/src/shared/support/hooks.ts index e7aa594..6c24239 100644 --- a/src/shared/support/hooks.ts +++ b/src/shared/support/hooks.ts @@ -1,31 +1,22 @@ import { Before, After, BeforeAll, AfterAll, Status, setDefaultTimeout } from '@cucumber/cucumber'; import { chromium, type Browser, type BrowserContext, type Page, type Frame } from 'playwright'; -import { execSync, spawn, type ChildProcess } from 'child_process'; +import { execSync, execFileSync, spawn, type ChildProcess } from 'child_process'; import * as http from 'http'; import * as fs from 'fs'; import * as path from 'path'; import type { FestipodWorld } from './world'; import { pool } from './browserPool'; +// The path the app asks the SDK to fetch its wallet from — ONE constant, shared +// with the app, so the harness server and the bundle can never disagree on it. +import { SHARED_WALLET_FILE_URL } from '../utils/sharedWallet'; setDefaultTimeout(90000); -// PER-SCENARIO FRESH VIRTUAL WALLET (T03.k). The shim keys each emulated account -// (its own private virtual wallet) by the NORMALIZED app-level identifier read -// from localStorage['festipod.account.identifier'] on the harness origin. When -// every @data scenario logs in as the SAME fixed user, that ONE virtual wallet -// accumulates every doc any prior scenario/run ever wrote → per-doc anchored -// reads fan out over hundreds of docs → 90s timeouts. Giving each scenario a -// UNIQUE identifier hands it a FRESH, EMPTY virtual wallet, so reads stay O(what -// THIS scenario provisions) and are fast + independent. A monotonic counter + -// per-run nonce guarantees uniqueness within and across runs; it normalizes to -// itself (lowercase, `@`-free) and is disjoint from the reserved `@index` -// account (whose shim key uses a sentinel prefix `normalizeIdentifier` can't emit). -const RUN_NONCE = Date.now().toString(36) + Math.random().toString(36).slice(2, 6); -let scenarioSeq = 0; -function freshScenarioIdentifier(): string { - scenarioSeq += 1; - return `test-${RUN_NONCE}-${scenarioSeq}`; -} +// A BROWSER CONTEXT IS ONE USER, and nothing here names or selects that user: +// signing in is `init(…)` then `await ensureIdentity()`, and `ensureIdentity()` +// is what says who you are. The harness provisions the deployment's wallet and +// opens pages; who those pages come up as is the SDK's answer, never the +// harness's. Two users means two browser contexts, each with its own wallet. let browser: Browser; let browserContext: BrowserContext; @@ -64,12 +55,6 @@ async function launchWalletContext(): Promise { permissions: CONTEXT_PERMISSIONS, args: LAUNCH_ARGS, }); - // The persistent context drives @data/@e2e (which exercise the screens, not - // the access gate). Disable the gate there so the real app renders directly. - // Fresh contexts (@humain/@multibrowser) don't get this → gate ON by default. - await ctx.addInitScript(() => { - (globalThis as Record).__FESTIPOD_ACCESS_GATE_DISABLED__ = true; - }); return ctx; } @@ -119,6 +104,29 @@ const HARNESS_NG_OUT = path.join('dist', 'test-harness-ng.js'); // Persistent Chromium profile for NG wallet (not the user's daily browser) const PLAYWRIGHT_PROFILE = path.resolve('.playwright-profile'); +// `.env` IS how this project declares the two wallet variables (see .env.example), +// and everything that serves the app runs under BUN, which loads that file by +// itself. Cucumber does not: it runs under NODE (see the `cucumber:run` script), +// which loads nothing — so a suite reading `process.env` alone finds the wallet +// material missing while the very same variables are configured and working for +// the app. Load the file the way Bun would. The real environment WINS (Node's +// loader never overwrites an already-set variable), so an operator exporting the +// variables still overrides the file, exactly as for the app. +try { + process.loadEnvFile(); +} catch { + // No .env here — the environment is then the only source, which is fine. +} + +// THE DEPLOYMENT'S WALLET MATERIAL — read from the SAME two environment variables +// the app build reads (see build.ts): the password `define`d into the browser +// bundle, and the wallet file served at SHARED_WALLET_FILE_URL. The harness is a +// deployment of the app's own code, so it has to hand its bundle the same two +// things; without them `configure()` receives no `sharedWallet`, `ensureIdentity()` +// rejects, and NO scenario ever signs in. +const SHARED_WALLET_PASSWORD_ENV = process.env.FESTIPOD_SHARED_WALLET_PASSWORD ?? ''; +const SHARED_WALLET_FILE_ENV = process.env.FESTIPOD_SHARED_WALLET_FILE ?? ''; + let harnessServer: http.Server | null = null; let harnessPort = 0; let useRealBroker = false; @@ -127,26 +135,9 @@ let useRealBroker = false; let appServerProcess: ChildProcess | null = null; let appPort = 0; -// Human-flow e2e: a STAGING build of the app (gate ON + shared wallet baked in), -// served statically. Built lazily (only when the human-flow scenario runs). -const STAGING_OUTDIR = path.resolve('dist-staging'); -let stagingServer: http.Server | null = null; -let stagingAppUrl = ''; - const WALLET_NAME = 'festipod-tests'; const WALLET_PASSWORD = 'festipod-tests'; -// The SHARED wallet for the assisted-import e2e: a static .ngw file placed at the -// worktree root + its password (identifier = password, per the e2e wallet setup). -const E2E_WALLET_PASSWORD = 'festipod-e2e-tests'; -function findE2eWalletFile(): string { - const f = fs.readdirSync(process.cwd()).find((x) => x.endsWith('.ngw')); - if (!f) { - throw new Error('No .ngw wallet file at the worktree root — add the festipod-e2e-tests wallet file.'); - } - return path.resolve(f); -} - /** * Navigate through the NG broker to load an app in its iframe. * Handles wallet login and returns the app's Frame. @@ -238,74 +229,6 @@ async function completeBrokerLogin(page: Page, appUrl: string, walletPassword: s return appFrame; } -/** - * Drive the standalone nextgraph.eu "Import a Wallet File" flow: upload the .ngw - * file and unlock with the password. The wallet FILE is the STATIC, reusable - * assisted-import primitive (a TextCode is a transient 5-min device-to-device - * transfer — unusable to embed; see knowledge_broker-import-constraint). After - * this, the page's context holds the wallet. - */ -async function importWalletViaFile(page: Page, filePath: string, password: string): Promise { - await page.goto('https://nextgraph.eu/#/wallet/login', { waitUntil: 'domcontentloaded' }); - // Let the SPA render and the file input attach before uploading (uploading too - // early yields an EncryptionError — the wallet doesn't load). - await page.waitForTimeout(3000); - await page.locator('input[type=file]').waitFor({ state: 'attached', timeout: 15000 }); - await page.setInputFiles('input[type=file]', filePath); - - // A password prompt appears to unlock the wallet ("Enter your password"). - const passwordInput = page.locator('input[type=password]').first(); - await passwordInput.waitFor({ state: 'visible', timeout: 15000 }); - await passwordInput.fill(password); - await passwordInput.press('Enter'); - const confirm = page.getByRole('button', { name: /Confirm/i }); - if (await confirm.isVisible({ timeout: 2000 }).catch(() => false)) await confirm.click().catch(() => {}); - await page.waitForTimeout(8000); // unlock + verifier bootstrap from the broker -} - -/** - * Build (once) a STAGING bundle of the real app — gate ON + the shared wallet - * FILE + password baked in — and serve it statically. Returns its URL. Lets the - * human-flow e2e exercise the real AccessGateScreen (which only renders in a - * staging build). Memoised; the build is cheap (~100-300ms). - */ -async function ensureStagingApp(): Promise { - if (stagingAppUrl) return stagingAppUrl; - - // Build into a SEPARATE outdir so it never collides with the harness bundles. - // Gate is ON by default (no ACCESS_GATE_DISABLED). The build copies the .ngw to - // dist-staging/shared-wallet.ngw + bakes the password. - execSync('bun run build.ts --outdir=dist-staging', { - env: { - ...process.env, - FESTIPOD_SHARED_WALLET_FILE: findE2eWalletFile(), - FESTIPOD_SHARED_WALLET_PASSWORD: E2E_WALLET_PASSWORD, - }, - stdio: 'pipe', - }); - - const mime: Record = { - '.html': 'text/html', '.js': 'application/javascript', '.css': 'text/css', - '.svg': 'image/svg+xml', '.map': 'application/json', '.json': 'application/json', - '.ico': 'image/x-icon', '.png': 'image/png', '.woff2': 'font/woff2', - }; - stagingServer = http.createServer((req, res) => { - const urlPath = (req.url || '/').split('?')[0]!; - let filePath = path.join(STAGING_OUTDIR, urlPath === '/' ? 'index.html' : urlPath); - if (!filePath.startsWith(STAGING_OUTDIR) || !fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) { - filePath = path.join(STAGING_OUTDIR, 'index.html'); // SPA fallback - } - res.writeHead(200, { 'Content-Type': mime[path.extname(filePath)] || 'application/octet-stream' }); - fs.createReadStream(filePath).pipe(res); - }); - const port = await new Promise((resolve) => { - stagingServer!.listen(0, '127.0.0.1', () => resolve((stagingServer!.address() as { port: number }).port)); - }); - stagingAppUrl = `http://127.0.0.1:${port}`; - console.log(`[Staging] App (gate ON, wallet baked) on ${stagingAppUrl}`); - return stagingAppUrl; -} - /** * Automated wallet creation + login on nextgraph.eu. * Flow: @@ -413,8 +336,40 @@ BeforeAll({ timeout: 10 * 60 * 1000 }, async function () { // Try to build the real broker harness try { - execSync(`bun build ${HARNESS_NG_ENTRY} --outfile ${HARNESS_NG_OUT} --bundle`, { stdio: 'pipe' }); + // The harness bundle needs the SAME wallet material as the app bundle — the + // password as a build-time global, the file served by the harness's own HTTP + // server. Missing either one means no sign-in is possible at all, so say so + // instead of building a bundle that can only fail later, opaquely. + if (!SHARED_WALLET_PASSWORD_ENV.trim() || !SHARED_WALLET_FILE_ENV.trim()) { + throw new Error( + 'Shared wallet material missing — set FESTIPOD_SHARED_WALLET_PASSWORD and ' + + 'FESTIPOD_SHARED_WALLET_FILE (see .env.example). Without them the harness ' + + 'bundle has no wallet to open: ensureIdentity() rejects and no @data/@e2e ' + + 'scenario can sign in.', + ); + } + const walletFilePath = path.resolve(SHARED_WALLET_FILE_ENV); + if (!fs.existsSync(walletFilePath)) { + throw new Error( + `Shared wallet file not found: ${walletFilePath} (FESTIPOD_SHARED_WALLET_FILE).`, + ); + } + const walletFileBytes = fs.readFileSync(walletFilePath); + + // `--define` mirrors build.ts exactly (same global name, same JSON encoding). + // execFileSync, not a shell string: the password is passed as an argv entry, + // so no quoting of the value can ever mangle or leak it. + execFileSync( + 'bun', + [ + 'build', HARNESS_NG_ENTRY, '--outfile', HARNESS_NG_OUT, '--bundle', + '--define', + `globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__=${JSON.stringify(SHARED_WALLET_PASSWORD_ENV)}`, + ], + { stdio: 'pipe' }, + ); console.log(`[Harness] Built NG (${(fs.statSync(HARNESS_NG_OUT).size / 1024).toFixed(0)} KB)`); + console.log(`[Harness] Shared wallet: ${walletFilePath} → ${SHARED_WALLET_FILE_URL}`); // Ensure wallet exists in persistent profile (opens browser if needed) await ensureAuth(); @@ -432,9 +387,16 @@ BeforeAll({ timeout: 10 * 60 * 1000 }, async function () { `; harnessServer = http.createServer((req, res) => { + const urlPath = req.url?.split('?')[0]; if (req.url === '/harness.js') { res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8' }); res.end(harnessBundle); + } else if (urlPath === SHARED_WALLET_FILE_URL) { + // The wallet FILE, at the very path the bundle hands the SDK + // (`SHARED_WALLET_FILE_URL`) — the harness origin serves its own wallet, + // exactly as `src/index.ts` does for the app origin. + res.writeHead(200, { 'Content-Type': 'application/octet-stream' }); + res.end(walletFileBytes); } else if (req.url?.startsWith('/blank')) { // Minimal page on the harness origin (no NG stack) — used by // multi-browser isolation checks that only need localStorage. @@ -473,7 +435,19 @@ BeforeAll({ timeout: 10 * 60 * 1000 }, async function () { env: { ...process.env, PORT: String(appPort), NODE_ENV: 'production' }, stdio: 'pipe', cwd: process.cwd(), + // OWN PROCESS GROUP, so teardown can signal the whole tree. `bun` on PATH + // resolves to a shell shim that launches the real binary as ITS child and + // merely waits — no `exec` — so signalling the direct child kills the shim + // only and leaves the server running, re-parented to init. Detaching gives + // the pair a group id (= this pid) that `process.kill(-pid)` can reach. + detached: true, }); + // DRAIN the pipes. `stdio: 'pipe'` gives each stream a 64 KB kernel buffer; + // nobody reads them, so a chatty server fills one mid-run and then BLOCKS on + // its next write — the suite would hang with no error and no output to explain + // it. Flowing mode discards what we do not need instead of accumulating it. + appServerProcess.stdout?.resume(); + appServerProcess.stderr?.resume(); // Wait for app server to respond await new Promise((resolve, reject) => { const deadline = Date.now() + 15000; @@ -499,9 +473,6 @@ BeforeAll({ timeout: 10 * 60 * 1000 }, async function () { pool.permissions = CONTEXT_PERMISSIONS; pool.setupBrokerPage = setupBrokerPage; pool.completeBrokerLogin = completeBrokerLogin; - pool.importWalletViaFile = importWalletViaFile; - pool.ensureStagingApp = ensureStagingApp; - pool.sharedWalletPassword = E2E_WALLET_PASSWORD; // Warm up the persistent wallet profile through the broker, then capture its // storage state. Injecting this into fresh contexts provisions the SHARED @@ -580,20 +551,6 @@ Before({ timeout: 60000 }, async function (this: FestipodWorld, scenario) { // the run self-heals instead of cascading failures across the rest. this.page = await newWalletPageResilient(); - // FRESH VIRTUAL WALLET per scenario (see freshScenarioIdentifier above). Set a - // UNIQUE app-level identifier into localStorage['festipod.account.identifier'] - // on EVERY origin (the init script runs in each frame before its scripts do — - // including the harness iframe on 127.0.0.1). At mount the harness's - // IdentityStore.get() then reads THIS fresh identifier, so `if (!identifier) - // login(DEFAULT_HARNESS_USER)` is skipped and the scenario runs on a fresh, - // empty virtual wallet. Overwrites any value persisted in the Chromium profile - // (init scripts run on each navigation), so no accumulated wallet leaks in. - const freshIdentifier = freshScenarioIdentifier(); - (this as any).freshIdentifier = freshIdentifier; - await this.page.addInitScript((u: string) => { - try { window.localStorage.setItem('festipod.account.identifier', u); } catch { /* opaque origin */ } - }, freshIdentifier); - // Capture console for debugging AND collect into the World so smoke // scenarios can assert no runtime error was emitted during the connected // boot (guards the "page blanche once connected" render-crash class). @@ -615,18 +572,34 @@ Before({ timeout: 60000 }, async function (this: FestipodWorld, scenario) { const harnessUrl = `http://127.0.0.1:${harnessPort}`; this.appFrame = await setupBrokerPage(this.page!, harnessUrl); - // Wait for NG session + useShape + bridge - await this.appFrame.waitForFunction( + // Wait for NG session + useShape + bridge — OR for the harness to publish a + // terminal error. A harness that cannot sign in renders an observable + // `#harness-status[data-harness-error]` (see harness-ng.tsx); racing it + // against the bridge turns a total sign-in failure into an immediate, + // named failure instead of an anonymous 30s timeout. + const bridgeReady = this.appFrame.waitForFunction( () => (window as any).__testData?.ready === true, + undefined, { timeout: 30000 }, ); + const harnessError = this.appFrame + .waitForSelector('#harness-status[data-harness-error]', { timeout: 30000 }) + .then( + async (el) => { + const detail = await el?.getAttribute('data-harness-error'); + const state = await el?.textContent(); + throw new Error(`Harness never became usable (${state}): ${detail}`); + }, + // No error state within the window: let the bridge wait decide. + () => new Promise(() => { /* never settles */ }), + ); + await Promise.race([bridgeReady, harnessError]); - // NO per-scenario registry/wallet reset needed anymore (was T03.j - // resetDataState). Each @data scenario now runs under a UNIQUE identifier - // (freshScenarioIdentifier, set into localStorage above), so the shim hands it - // a FRESH, EMPTY virtual wallet whose account registry starts empty by - // construction — nothing to purge. This also drops the ≤10s reset cost that - // shared the Before hook's budget with the (slow) broker login. + // NO per-scenario reset. The suite does not purge the wallet between + // scenarios: the old `clearWallet` fan-out enumerated every entity document + // and cost up to 10s out of the Before hook's budget, which it shared with + // the (slow) broker login. A scenario provisions what it needs and asserts + // on that, rather than on the wallet being empty. } else { // Mock mode: load harness directly await this.page!.setContent('
'); @@ -687,6 +660,93 @@ After({ timeout: 10000 }, async function (this: FestipodWorld, scenario) { this.cleanup(); }); +/** + * Await `work`, but never longer than `ms`. A close() that never settles must not + * stop the REMAINING resources from being released — teardown continues and the + * unreleased handle is named in the log instead of silently stalling the process. + * The timer is always cleared, so this guard never becomes a handle of its own. + */ +async function withDeadline(label: string, ms: number, work: Promise): Promise { + let timer: ReturnType | undefined; + const expired = Symbol('expired'); + const deadline = new Promise((resolve) => { timer = setTimeout(() => resolve(expired), ms); }); + try { + const outcome = await Promise.race([work.then(() => undefined), deadline]); + if (outcome === expired) console.warn(`[Teardown] ${label} did not settle within ${ms}ms — moving on`); + } finally { + if (timer) clearTimeout(timer); + } +} + +/** + * Stop the E2E app server and RELEASE ITS PIPES. + * + * `spawn(..., { stdio: 'pipe' })` opens three socketpairs whose ends belong to + * THIS process, plus the child handle. `kill()` alone releases none of them + * synchronously, and nothing ever reads the child's stdout/stderr, so those two + * sockets never reach EOF: they stay ref'd on the event loop and the suite can + * never exit on its own. So: signal the whole PROCESS GROUP (the shim waiting on + * the real server is the direct child — see the `detached` note at the spawn), + * WAIT for it to actually die (that is what retires its process handle), escalate + * if it ignores SIGTERM, then destroy the three stdio sockets we own. + */ +async function stopAppServer(child: ChildProcess): Promise { + const hasExited = () => child.exitCode !== null || child.signalCode !== null; + const exited: Promise = hasExited() + ? Promise.resolve() + : new Promise((resolve) => { + child.once('exit', () => resolve()); + child.once('error', () => resolve()); + }); + // Negative pid = the whole group (shim + server). Falls back to the direct + // child if the group is already gone or was never created. + const signalTree = (signal: NodeJS.Signals) => { + try { + if (child.pid === undefined) return; + process.kill(-child.pid, signal); + } catch { + try { child.kill(signal); } catch { /* already reaped */ } + } + }; + // The shim exits the moment it is signalled, so ITS `exit` event says nothing + // about the server behind it. Signal 0 probes the group instead: it is alive + // for as long as any member — i.e. the server — is. + const groupAlive = (): boolean => { + if (child.pid === undefined) return false; + try { process.kill(-child.pid, 0); return true; } catch { return false; } + }; + const waitForGroupToDie = async (ms: number): Promise => { + const deadline = Date.now() + ms; + while (groupAlive() && Date.now() < deadline) { + await new Promise((resolve) => { setTimeout(resolve, 100); }); + } + }; + + signalTree('SIGTERM'); + await waitForGroupToDie(5000); + if (groupAlive()) { + console.warn('[Teardown] app server ignored SIGTERM — SIGKILL'); + signalTree('SIGKILL'); + await waitForGroupToDie(2000); + } + if (groupAlive()) console.warn('[Teardown] app server process group still alive after SIGKILL'); + // Let Node reap the direct child, so its process handle leaves the event loop. + await withDeadline('appServer child reap', 2000, exited); + if (!hasExited()) console.warn('[Teardown] app server child not reaped'); + for (const stream of [child.stdin, child.stdout, child.stderr]) stream?.destroy(); +} + +/** + * Close the harness HTTP server. `close()` only stops accepting and then waits + * for every established connection to end — a keep-alive socket left behind by a + * browser that went away would hold it (and the process) open forever. Drop those + * sockets explicitly first, then wait for the listener itself. + */ +async function stopHarnessServer(server: http.Server): Promise { + server.closeAllConnections(); + await new Promise((resolve) => server.close(() => resolve())); +} + AfterAll(async function () { // Teardown must be fully defensive: a Playwright context/browser can already be // closed by the time we get here (multi-browser scenarios that closed their own @@ -695,15 +755,34 @@ AfterAll(async function () { // flush, losing the whole report and masking the real pass/fail. Each step is // isolated so a flake in one never blocks the rest. This turns the documented // "browserContext already closed" teardown flake into a non-fatal event. - const safe = async (label: string, fn: () => Promise | void) => { - try { await fn(); } catch (e) { console.warn(`[Teardown] ${label} failed (non-fatal):`, (e as Error).message); } + // + // ORDER = REVERSE OF ACQUISITION (harness server → wallet context → fresh + // browser → app server), so nothing is torn down while something that talks to + // it is still alive. In particular the harness server goes LAST: the browsers + // hold keep-alive connections to it, and closing a server still has to wait for + // its connections. + const safe = async (label: string, ms: number, fn: () => Promise | unknown) => { + try { + await withDeadline(label, ms, Promise.resolve(fn())); + } catch (e) { + console.warn(`[Teardown] ${label} failed (non-fatal):`, (e as Error).message); + } }; - await safe('browserContext.close', () => browserContext?.close()); - await safe('freshBrowser.close', () => freshBrowser?.close()); - await safe('browser.close', () => browser?.close()); - await safe('harnessServer.close', () => new Promise((resolve) => harnessServer ? harnessServer.close(() => resolve()) : resolve())); - await safe('appServer.kill', () => { if (appServerProcess) { appServerProcess.kill(); appServerProcess = null; } }); - await safe('stagingServer.close', () => new Promise((resolve) => stagingServer ? stagingServer.close(() => resolve()) : resolve())); - await safe('stagingOutdir.rm', () => fs.existsSync(STAGING_OUTDIR) ? fs.promises.rm(STAGING_OUTDIR, { recursive: true, force: true }) : undefined); + if (appServerProcess) { + const child = appServerProcess; + appServerProcess = null; + await safe('appServer.stop', 10000, () => stopAppServer(child)); + } + await safe('freshBrowser.close', 30000, () => freshBrowser?.close()); + freshBrowser = null; + pool.freshBrowser = null; + await safe('browserContext.close', 30000, () => browserContext?.close()); + pool.walletContext = null; + await safe('browser.close', 30000, () => browser?.close()); + if (harnessServer) { + const server = harnessServer; + harnessServer = null; + await safe('harnessServer.close', 10000, () => stopHarnessServer(server)); + } console.log('Festipod BDD tests completed.'); }); diff --git a/src/shared/test-harness/harness-ng.tsx b/src/shared/test-harness/harness-ng.tsx index f073542..5f9de46 100644 --- a/src/shared/test-harness/harness-ng.tsx +++ b/src/shared/test-harness/harness-ng.tsx @@ -7,97 +7,88 @@ * * Exposes window.__testData for Playwright-driven Cucumber steps. */ -import React, { useEffect, useState, useRef } from 'react'; +import { useEffect, useState, useRef } from 'react'; import { createRoot } from 'react-dom/client'; import { NextGraphProvider, useNextGraph } from '../context/NextGraphContext'; -import { AccountProvider, useAccount } from '../context/AccountContext'; import { FestipodDataProvider, useFestipodData } from '../context/FestipodDataContext'; -// useShape routed through the lib (SDK-identical surface); caps from /polyfill. -import { useShape, docs, inbox as docsInbox, isNuri } from '@ng-eventually/client'; -import type { Nuri } from '@ng-eventually/client'; -import { getCaps, getCurrentUser, setCurrentUser, resetCaps, connectedUser } from '@ng-eventually/client/polyfill'; -// Relationship is an app concept: directed grants come from the app's own module. -import { declareConnections, resetConnections } from '../utils/connections'; -import { hostInboxNuri as regInboxNuri } from '../data/registration'; -// The write side of one-document-per-entity: an entity's RDF goes straight into -// its OWN document (rule_document-per-entity), never into a store-level document. -import { writeEntity, ENTITY_TYPE, iri, bool } from '../data/entityWrites'; -import type { DeepSignalSet } from '@ng-eventually/client'; -// doc_create goes through the lib's `docs` primitive (T01.a): it calls the REAL -// injected `ng` directly (never the public proxy), so postMessage marshaling -// stays intact (no DataCloneError). See decision_2026-06-17_eventually-library. +// Everything NextGraph-shaped comes from the ONE published SDK entry. +import { useShape, docs, inbox as sdkInbox, ensureIdentity } from '@ng-eventually/polyfill'; +import type { Nuri, DeepSignalSet } from '@ng-eventually/polyfill'; +// Placement — taken from the app's own module, so the harness enumerates exactly +// what the app enumerates. Placement is named by scope alone: "my documents" are +// the signed-in session's, and there is no identity to name. +import { listMyEntityDocs, openDocumentInbox, resolveScopeGraph } from '../utils/storeRegistry'; +import { setCurrentPrincipal } from '../utils/currentPrincipal'; +import { materializeAttendance, NOTIF_TYPE_NEW_PARTICIPANT } from '../data/registration'; +import type { RegistrationPayload } from '../data/registration'; import { FpEventShapeType, FpUserProfileShapeType, FpParticipationShapeType, } from '../shapes/orm/festipodShapes.shapeTypes'; import type { FpEvent, FpUserProfile, FpParticipation } from '../shapes/orm/festipodShapes.typings'; -import { normalizeIdentifier } from '../context/AccountContext'; // ============================================================================ // App — uses real providers (same tree as the real app) // ============================================================================ -// Default @data identity — the seed owner. The harness has no login UI, so we -// establish a default account (as the real app would after login) so the SDK -// knows WHO is reading. Without a current identity the per-document ReadCap -// filter passes only PUBLIC documents, so the current user's own PROTECTED -// entities (profile, participations) would be hidden and never round-trip. -const DEFAULT_HARNESS_USER = '@mariedupont'; - -/** - * Step boundary: an event id crosses from a Cucumber step as a plain string. An - * event IS its own document (rule_document-per-entity), so its id is a document - * NURI — anything else names no document and has no inbox. Narrow here rather than - * let a bad id reach the SDK as a silent no-op. - */ -/** The stand-in PUBLIC document of the T03.b probe — a literal, so it is a NURI - * by construction with nothing to narrow. */ -const PUBLIC_PROBE: Nuri = 'did:ng:o:public-probe'; - -function asEventDoc(eventId: string): Nuri { - if (!isNuri(eventId)) { - throw new Error(`[HarnessNG] "${eventId}" is not a document NURI — an event id is its document.`); - } - return eventId; -} - function DataHarnessNG() { return ( - - - - - - + + + ); } -/** Establish the default @data identity once, so `setCurrentUser` fires (via the - * AccountProvider effect) and the current user can read their own protected - * entities. Mirrors the real app's post-login state. */ -function HarnessLogin() { - const { identifier, login } = useAccount(); - useEffect(() => { - if (!identifier) login(DEFAULT_HARNESS_USER); - }, [identifier, login]); - return null; -} - -// Wait for NG connection before exposing the test bridge +// Wait for the NG connection AND for the ONE identity await before exposing the +// test bridge — the same order the real app's AuthGate imposes. `ensureIdentity()` +// IS signing in: it takes no identifier, resolves who we are and does the +// connection work, so nothing may read before it resolves. function HarnessRouter() { const { status } = useNextGraph(); + const [identityReady, setIdentityReady] = useState(false); + // Why signing in did NOT settle. A harness that failed to sign in must look + // FAILED, never "still waiting": the difference between the two is the whole + // difference between a broken suite and a slow one. + const [identityError, setIdentityError] = useState(null); - if (status === 'connected') { - return ; + useEffect(() => { + if (status !== 'connected' || identityReady || identityError) return; + let cancelled = false; + void ensureIdentity() + .then(principal => { + // Same as the app's AuthGate: signing in RETURNS who we are, and the + // harness publishes it the same way, so the tree under test sees exactly + // what the app's tree sees. + setCurrentPrincipal(principal); + if (!cancelled) setIdentityReady(true); + }) + .catch(err => { + console.error('[HarnessNG] ensureIdentity failed:', err); + if (!cancelled) setIdentityError(err instanceof Error ? err.message : String(err)); + }); + return () => { cancelled = true; }; + }, [status, identityReady, identityError]); + + // TERMINAL STATES — each observable to a Playwright locator, and none of them + // exposes the test bridge: a scenario must never read through a tree that never + // signed in. `data-harness-error` carries the reason so the failure names itself. + if (identityError) { + return ( +
IDENTITY_ERROR
+ ); } if (status === 'error') { return
ERROR
; } + if (status === 'connected' && identityReady) { + return ; + } + return
WAITING_FOR_SESSION
; } @@ -105,18 +96,48 @@ function HarnessRouter() { // Connected harness — exposes window.__testData through real providers // ============================================================================ +/** + * Resolve, ONCE, the graph each scope names — then mount the reads on them. + * + * The raw ORM sets below are anchored per SCOPE, and an entity's scope is a + * domain fact (rule_document-per-entity): EVENTS are public; user profiles and + * participations are protected. The app holds no store id and builds no + * `did:ng:` NURI of its own — `resolveScopeGraph(scope)` is the SDK's answer to + * "which graph is this scope", and the only one the harness is entitled to. + * + * The reads mount only once both graphs are known, so no shape set is ever + * anchored on `undefined`. + */ function ConnectedHarness() { + const [graphs, setGraphs] = useState<{ publicGraph: Nuri; protectedGraph: Nuri } | null>(null); + const [scopeError, setScopeError] = useState(null); + + useEffect(() => { + let cancelled = false; + void Promise.all([resolveScopeGraph('public'), resolveScopeGraph('protected')]) + .then(([publicGraph, protectedGraph]) => { + if (!cancelled) setGraphs({ publicGraph, protectedGraph }); + }) + .catch(err => { + console.error('[HarnessNG] scope resolution failed:', err); + if (!cancelled) setScopeError(err instanceof Error ? err.message : String(err)); + }); + return () => { cancelled = true; }; + }, []); + + // Terminal — same contract as the identity failure: observable, and no bridge. + if (scopeError) { + return
SCOPE_ERROR
; + } + if (!graphs) { + return
RESOLVING_SCOPES
; + } + return ; +} + +function ScopedHarness({ publicGraph, protectedGraph }: { publicGraph: Nuri; protectedGraph: Nuri }) { const ngCtx = useNextGraph(); const appData = useFestipodData(); - // Identity switch (two-identity isolation): the app has no page reload on a - // faux-logout+re-login (shared-wallet stopgap), so switching identity here - // means calling AccountContext.login() with a new identifier — which drives the - // `prevOwnerRef` reset effect in FestipodDataContext. Exposed to steps so a @data - // scenario can bring up identity A, then a genuinely-different identity B on the - // SAME wallet and assert B is isolated. - const account = useAccount(); - const accountRef = useRef(account); - accountRef.current = account; // The bridge is built once inside an effect (below) and its getters close over // `appData`. `appData` is a NEW object every render (its `events`/`users` reflect // the latest per-entity reads), so a captured snapshot goes STALE — after @@ -126,29 +147,14 @@ function ConnectedHarness() { const appDataRef = useRef(appData); appDataRef.current = appData; - // Private store NURI — the inbox shim anchor + the ReadCap-governed document. - const privateNuri: Nuri | undefined = ngCtx.session && `did:ng:${ngCtx.session.private_store_id}`; - // Protected store NURI — T02.h (axe A): the shareable DOMAIN entities (events, - // users, participations) now live in the real protected native store, so the - // harness's raw ORM sets subscribe there too (matching FestipodDataContext). - const protectedNuri: Nuri | undefined = ngCtx.session && `did:ng:${ngCtx.session.protected_store_id}`; - const events = useShape(FpEventShapeType, protectedNuri) as DeepSignalSet; - const users = useShape(FpUserProfileShapeType, protectedNuri) as DeepSignalSet; - const participations = useShape(FpParticipationShapeType, protectedNuri) as DeepSignalSet; + // Each raw ORM set is anchored on the graph of the scope ITS OWN entity lives + // in — events public, profiles and participations protected — matching + // FestipodDataContext's `useShapeQuery(shape, scope)` reads. + const events = useShape(FpEventShapeType, publicGraph) as DeepSignalSet; + const users = useShape(FpUserProfileShapeType, protectedGraph) as DeepSignalSet; + const participations = useShape(FpParticipationShapeType, protectedGraph) as DeepSignalSet; const [bridgeReady, setBridgeReady] = useState(false); - // Read-filter validation: mounts a useShape over THIS document and - // returns the read-filtered VIEW of it. Which document depends on the probe: the - // store-root one for the mono-store read-filter scenario, a real per-entity - // document for the protected-connections one. - const [filterDoc, setFilterDoc] = useState(null); - // Stopgap multi-store validation: a doc created on demand via doc_create, - // mounted into a real useShape({graphs}) by . - const [smokeDoc, setSmokeDoc] = useState(null); - // Per-entity fan-out validation: several entity docs read together. - const [fanoutGraphs, setFanoutGraphs] = useState([]); - // T02.h gating: mount a useShape(protectedNuri) to open the protected repo. - const [protectedActive, setProtectedActive] = useState(false); useEffect(() => { // Small delay for useShape to populate @@ -197,19 +203,6 @@ function ConnectedHarness() { get currentUserId() { return AD().currentUserId || currentUserId; }, session, - // --- IDENTITY SWITCH (two-identity isolation) ---------------------- - /** Faux-logout + re-login under a NEW identifier on the SAME wallet (no - * page reload), exactly as the real app's AccessGate/Settings flow does. - * Drives AccountContext.login → setCurrentUser + the FestipodDataContext - * `prevOwnerRef` reset. Returns the normalized id now in effect. */ - switchIdentity(identifier: string) { - accountRef.current.login(identifier); - return normalizeIdentifier(identifier); - }, - /** The current app-level identifier (localStorage-backed). */ - currentIdentifier() { - return accountRef.current.identifier; - }, /** Titles of the events the CURRENT user PARTICIPATES in — exactly what the * HOME screen shows (`getUserEvents(currentUserId)`). Used by the * two-identity isolation test to assert a fresh identity's home is empty. */ @@ -252,28 +245,6 @@ function ConnectedHarness() { await AD().leaveEvent(eventId, userId); }, - // --- RAW store-root path (the mono-store read-filter probe ONLY) ------- - // `read-filter.feature` states the filter's all-or-nothing behaviour on ONE - // document holding SEVERAL items — the mono-store layout — so it governs the - // STORE-ROOT protected document (`documentNuri` = protectedNuri) via - // and needs participations written into THAT document. These - // raw helpers keep that probe on the exact document it governs. Nothing else - // may use them: the app (and the protected-connections probe) writes one - // document per entity (rule_document-per-entity). - get rawParticipations() { return participations; }, - rawJoin(eventId: string, userId: string) { - const already = [...participations].some(p => p.event === eventId && p.user === userId); - if (already) return; - participations.add({ - '@graph': protectedNuri, - '@type': 'http://festipod.org/Participation', - '@id': '', - event: eventId, - user: userId, - isConfirmed: true, - } as FpParticipation); - }, - // --- Real app-path registration (T02.c) ---------------------------- // These go through the REAL FestipodDataContext mutations (appData), so // the @data scenario faces the same inbox-deposit + notification + @@ -330,19 +301,26 @@ function ConnectedHarness() { const uid = AD().currentUserId || userAdapter()[0]?.['@id'] || ''; return AD().isParticipating(eventId, uid); }, - /** The host inbox NURI for an event (domain glue, T02.c). An event id IS its - * document NURI; a step that passes anything else has no inbox to name. */ - async eventInboxNuri(eventId: string) { - return regInboxNuri(asEventDoc(eventId)); + /** The inbox address of an event, as ITS OWNER obtains it. An event id IS + * its document NURI (rule_document-per-entity) — hence the `Nuri` type, + * which is what `openDocumentInbox` takes. Only the owner opens that + * document's inbox: a depositor never sees the address, it names the + * document instead. */ + async eventInboxNuri(eventId: Nuri) { + return openDocumentInbox(eventId); }, - /** Materialize the raw registration deposits for an event (curator). The - * event's inbox may also carry other kinds, so filter to this event. */ + /** The raw registration deposits addressed to an event's document (read by + * its owner). The event's inbox may also carry other kinds, so filter to + * this event. */ async readInboxDeposits(eventId: string) { - const target = await regInboxNuri(asEventDoc(eventId)); - const deposits = await docsInbox.read(target); - return deposits.filter( - (d: any) => d?.payload?.kind === 'new-participant' && d?.payload?.eventId === eventId, - ); + const deposits = await sdkInbox.readForDocument(eventId); + return deposits.filter(d => { + // A deposit's payload is opaque to the SDK — the Festipod domain shape + // is `RegistrationPayload`, exactly as `readRegistrationNotifications` + // reads it on the app side. + const p = d.payload as Partial | null; + return p?.kind === NOTIF_TYPE_NEW_PARTICIPANT && p?.eventId === eventId; + }); }, /** OPTION B — the owner's DERIVED active-registration set for an event * (`materializeAttendance`), matched on the CANONICAL event-id form. Used @@ -350,10 +328,9 @@ function ConnectedHarness() { * is in the active set) rather than an absolute count — an inbox accumulates * deposits across the wallet's life, so |active| is not bounded to one * scenario, but "contains this uid" IS deterministic. */ - async activeRegistrationUsers(eventId: string) { - const regmod = await import('../data/registration'); - const target = await regmod.hostInboxNuri(asEventDoc(eventId)); - const active = await regmod.materializeAttendance(target, eventId); + async activeRegistrationUsers(eventId: Nuri) { + const target = await openDocumentInbox(eventId); + const active = await materializeAttendance(target, eventId); return active.map(r => r.userId); }, /** Host-facing notifications currently surfaced by the data context. */ @@ -373,23 +350,15 @@ function ConnectedHarness() { v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') .replace(/\n/g, '\\n').replace(/\r/g, '\\r').replace(/\t/g, '\\t'); // Participations are ONE DOCUMENT PER ENTITY (protected scope), not the - // store root — so re-query the broker across the protected per-entity - // documents rather than the store-root graph. This stays authoritative - // (bypasses the reactive set): it counts the (event,user) triples actually - // persisted in the broker. - const reg = await import('../utils/storeRegistry'); - // Enumerate the CURRENT account's own protected docs — the read-by-need - // path the APP uses (registration.countUserParticipations → - // listMyEntityDocs). Each @data scenario runs under a FRESH virtual account - // (freshScenarioIdentifier in localStorage), whose participation docs live - // ONLY in that account's protected scope index. There is no cross-account - // enumeration any more (a directory would be discovery, which does not - // exist): with no identity there is nothing this session may enumerate, so - // fall back to the SDK's connected identity and otherwise count nothing. - let currentUser = ''; - try { currentUser = window.localStorage.getItem('festipod.account.identifier') || ''; } catch { /* opaque origin */ } - const holder = currentUser || getCurrentUser() || ''; - const protectedDocs = holder ? await reg.listMyEntityDocs(holder, 'protected') : []; + // store root — so re-query the broker across MY OWN protected per-entity + // documents, the exact read-by-need path the APP uses + // (`registration.countUserParticipations` → `listMyEntityDocs( + // 'protected')`). There is no cross-account enumeration (a directory + // would be discovery, which does not exist), and "mine" needs no + // identity — the session is one user's. + // This stays authoritative (bypasses the reactive set): it counts the + // (event,user) triples actually persisted in the broker. + const protectedDocs = await listMyEntityDocs('protected'); let total = 0; for (const g of protectedDocs) { // Anchored default-graph (no `GRAPH` clause): participations are @@ -457,19 +426,12 @@ function ConnectedHarness() { * a persistent broker, a real empty state needs the docs' CONTENT cleared * (the store-root delete of the old model no longer applies). Bounded: on a * freshly-provisioned wallet there are only a handful of entity docs. - * Scoped to the CONNECTED identity's own documents — enumerating another - * identity's is no longer possible, and clearing them was never this - * harness's business. */ + * Scoped to MY OWN documents — enumerating anyone else's is not possible, + * and clearing them was never this harness's business. */ async clearWallet() { - const reg = await import('../utils/storeRegistry'); - reg.resetRegistryCache(); - let holder = ''; - try { holder = window.localStorage.getItem('festipod.account.identifier') || ''; } catch { /* opaque origin */ } - holder = holder || getCurrentUser() || ''; - if (!holder) return { cleared: 0 }; const [pub, prot] = await Promise.all([ - reg.listMyEntityDocs(holder, 'public'), - reg.listMyEntityDocs(holder, 'protected'), + listMyEntityDocs('public'), + listMyEntityDocs('protected'), ]); const all = [...new Set([...pub, ...prot])]; await Promise.all(all.map(g => @@ -487,257 +449,6 @@ function ConnectedHarness() { return { cleared: all.length }; }, - /** - * PER-SCENARIO STATE ISOLATION (T03.j). The @data suite runs against ONE - * persistent broker-backed wallet, so the emulated account registry (the - * `urn:ng-eventually:shim:Account` triples in the private-store anchor - * graph) ACCUMULATES every account any scenario/run ever provisioned. The - * read path is a fan-out: `allAccounts()` → one SPARQL SELECT per account - * for `listEntityDocs`. As the registry grows unbounded across runs, that - * fan-out gets slow and flaky (same class as the T03.d Chromium saturation). - * - * This gives each @data scenario a CLEAN registry: a SINGLE SPARQL DELETE - * on the ONE private-store anchor graph removes every accumulated Account - * record, so `allAccounts()` collapses to empty and the fan-out is bounded - * to whatever the CURRENT scenario re-provisions (accounts are lazily - * re-created by `ensureAccount` on first use). It is O(1) on ONE graph — NOT - * a fan-out delete (which saturated the browser before, see T03.i's removed - * `authClearParticipation`). Orphaned per-entity docs are simply never - * enumerated once their owning Account record is gone. - * - * Test-infra ONLY: touches the emulation's registry anchor, never the - * product model, the app read path, or the boundary. The lib is untouched; - * this reuses the same anchor NURI (`did:ng:${private_store_id}`) and shim - * vocabulary the lib's `loadShim`/`ensureAccount` use. - */ - async resetDataState() { - const reg = await import('../utils/storeRegistry'); - const priv: Nuri = `did:ng:${session.private_store_id}`; - const SHIM = 'urn:ng-eventually:shim'; - const t0 = Date.now(); - // Delete every Account record (and its identity/doc* predicates) from the - // anchor graph. `?p ?o` with the `a shim:Account` guard scopes the delete - // strictly to registry triples, leaving anything else in the private - // store intact. - const del = ` - DELETE { GRAPH <${priv}> { ?acc ?p ?o } } - WHERE { - GRAPH <${priv}> { - ?acc a <${SHIM}:Account> ; - ?p ?o . - } - }`; - try { - await docs.sparqlUpdate(session.session_id, del, priv); - } catch { /* best-effort — a broker flake must not fail the scenario */ } - // Drop the in-memory account cache so the next registry call re-reads the - // now-empty anchor (else a stale cache would keep the old accounts alive). - reg.resetRegistryCache(); - return { resetMs: Date.now() - t0 }; - }, - - /** ONE-TIME CLEANUP (T03.i): the private store accumulated thousands of - * historical inbox-deposit triples across test runs (the old inbox anchor - * = private store), making `loadShim` a 60s+ full-graph scan. Delete every - * inbox Deposit triple from the private store so the shim query is fast - * again. Idempotent; safe (deposits are transient test cruft). New deposits - * now land in a dedicated inbox document (lib fix), so this won't re-grow. */ - async cleanPrivateInbox() { - const priv: Nuri = `did:ng:${session.private_store_id}`; - const t0 = Date.now(); - const del = ` - DELETE { GRAPH <${priv}> { ?s ?p ?o } } - WHERE { - GRAPH <${priv}> { - ?s a ; - ?p ?o . - } - }`; - await docs.sparqlUpdate(session.session_id, del, priv); - return { deleteMs: Date.now() - t0 }; - }, - - // --- ReadCap read-filter validation (see decision_2026-06-17_eventually-library) --- - - /** The document (repo NURI) the shareable domain entities live in. After - * T02.h this is the PROTECTED native store (was private) — the ReadCap - * read-filter test governs the document that actually holds the - * participations, so it must track the domain scope. */ - documentNuri: protectedNuri, - - /** - * Put the domain document under a ReadCap regime: `reader` — and only - * `reader` — HOLDS its key, then the current user becomes `user`. Reading is - * possession, so "who holds it" is established by filing the key WHILE that - * identity is the connected one; there is no grant addressed to a third - * party. The read filter is per-DOCUMENT, so this is all-or-nothing on that - * document — the faithful NextGraph behavior in a mono-store layout. - * then exposes window.__readFilter.snapshot() over the view. - */ - governDocument(reader: string, user: string) { - if (!protectedNuri) throw new Error('no protected_store_id in session'); - resetCaps(); - setCurrentUser(reader); - getCaps().open(protectedNuri, 'protected'); - setCurrentUser(user); - setFilterDoc(protectedNuri); - }, - - /** Switch the current user (does the user now hold the document's cap?). */ - setUser(user: string) { - setCurrentUser(user); - }, - - // --- PROTECTED + connections isolation (T03.b) ---------------------- - // Prove, through the SDK's ReadCap filter on the REAL ORM set, that a - // PROTECTED ENTITY DOCUMENT owned by `owner` is: - // - hidden from an UNCONNECTED principal (only owner holds its key); - // - revealed once the app declares the connection owner↔reader; - // - a PUBLIC document stays readable throughout. - // The unit of sharing is the DOCUMENT, and each entity is its own document - // (rule_document-per-entity) — so the probe exercises a real per-entity - // document from `createEntityDoc(owner, 'protected')`, which is exactly what - // `declareConnections` hands over. The PUBLIC probe is published as a repo - // LINK and that link is then handed to the reader: public means "whoever has - // the link reads", not "everyone reads regardless of keys". - // exposes the read-filtered VIEW over the owner's protected entity document. - // `connect` calls the app's declareConnections — the domain sharing act. - - /** - * Create `owner`'s PROTECTED ENTITY document and write its entity into it, - * as `owner` — the creator is the one who holds the key, so possession is - * established by CREATING, not by declaring anything. Mounts - * over THAT document. Returns its NURI and how many entities were written - * (the count the reader must end up seeing). - * - * `resetCaps` runs FIRST: it also clears the enforcement flag, so the very - * next mint (this document's) is what arms the read filter. - */ - async setupProtectedEntity(owner: string) { - const reg = await import('../utils/storeRegistry'); - resetCaps(); - resetConnections(); // clear the app's relationship registry too - setCurrentUser(owner); - const doc = await reg.createEntityDoc(owner, 'protected'); - await writeEntity(doc, ENTITY_TYPE.participation, { - event: iri('urn:pc:event'), - user: iri('urn:pc:p1'), - isConfirmed: bool(true), - }); - setFilterDoc(doc); - // One entity, one document — so one item is the whole document. - return { doc, total: 1 }; - }, - - /** - * Bring up the UNCONNECTED reader: `owner` publishes the public probe as a - * repo link and hands it to `reader`, who becomes the connected identity. - * No cap of the protected entity document is handed over — that is what the - * connection is for. Runs AFTER `setupProtectedEntity` and deliberately does - * NOT reset caps: the owner's key on its own document must survive. - */ - governProtected(owner: string, reader: string) { - setCurrentUser(owner); - // A public entity document, published as a shareable repo link. - const publicLink = getCaps().publishRepoLink(PUBLIC_PROBE); - setCurrentUser(reader); - // The reader was handed that link — which is all "public" means here. - getCaps().learn(publicLink); - }, - /** - * Declare a bilateral owner↔reader connection (domain sharing act) the way - * two real sessions would: each side asserts from ITS OWN session, because - * sharing a key requires HOLDING it and `capFor` answers for the connected - * identity alone. Reader asserts first (nothing to share yet), then the owner - * asserts back — that second call is the one that finds a two-sided link and - * hands its protected documents' keys to the reader's inbox. Finally the - * reader reconnects and `connectedUser()` drains that inbox, which is where - * the key actually lands among what the reader holds. - */ - async connect(owner: string, reader: string) { - const reg = await import('../utils/storeRegistry'); - // The reader's own account + inbox, provisioned from the READER's session - // so what belongs to it is filed under it. - setCurrentUser(reader); - await reg.ensureAccount(reader); - await reg.walletInbox(reader); - await declareConnections([owner], reader); // reader asserts owner - setCurrentUser(owner); - await declareConnections([reader], owner); // bilateral → owner shares its keys - setCurrentUser(reader); - await connectedUser(); // the reader drains its inbox → it now holds the key - }, - /** Does the CURRENT user hold the public entity document's key — the only - * question the model can answer — regardless of the protected one? */ - canReadPublicProbe() { - return getCaps().capFor(PUBLIC_PROBE) !== undefined; - }, - - // --- Stopgap multi-store validation (see brief_2026-06-15_shared-wallet-shim) --- - - /** - * Create a fresh graph document via doc_create and mount it into a real - * useShape({graphs}) subscription (). Returns the NURI. - * Validates: doc_create returns a usable graph NURI. - */ - async createSmokeDoc() { - const nuri = await docs.docCreate(session.session_id, 'Graph', 'data:graph', 'store', undefined); - setSmokeDoc(nuri); - return nuri; - }, - - /** - * Round-trip the sharedWalletShim through the wallet: create an account - * (3 docs + SPARQL INSERT), drop the cache, reload from the wallet via - * SPARQL SELECT. Validates: doc_create ×3 + shim sparql_update/query. - */ - async validateShim(identifier: string) { - const reg = await import('../utils/storeRegistry'); - reg.resetRegistryCache(); - const created = await reg.ensureAccount(identifier); - reg.resetRegistryCache(); - // Re-read THIS account back from the wallet (there is no all-accounts - // enumeration any more — a directory is discovery, and discovery does not - // exist). `resolveAccount` reads without provisioning, which is exactly - // what a round-trip check needs. - const reloaded = await reg.resolveAccount(identifier); - return { created, reloaded }; - }, - - /** - * Per-entity granularity + fan-out: 2 accounts, one event document each - * (via createEntityDoc → indexed), then mount a multi-graph useShape over - * both (). Returns the two doc NURIs and the index listing. - * Validates: 1-doc-per-entity, index append/read, fan-out across N docs. - */ - async setupFanout() { - const reg = await import('../utils/storeRegistry'); - reg.resetRegistryCache(); - await reg.ensureAccount('@fan-a'); - await reg.ensureAccount('@fan-b'); - const docA = await reg.createEntityDoc('@fan-a', 'public'); - const docB = await reg.createEntityDoc('@fan-b', 'public'); - // The index-append (which makes docA/docB show up in the scope index) can - // lag behind createEntityDoc on the broker — poll until BOTH are listed - // (bounded) so the "index lists both docs" assertion isn't flaky. Each - // account's own index is read separately: there is no cross-account - // enumeration any more, and the fan-out under test is the READ over both - // documents, not the listing. - let listed: Nuri[] = []; - for (let i = 0; i < 12; i++) { - reg.resetRegistryCache(); - const [a, b] = await Promise.all([ - reg.listMyEntityDocs('@fan-a', 'public'), - reg.listMyEntityDocs('@fan-b', 'public'), - ]); - listed = [...new Set([...a, ...b])]; - if (listed.includes(docA) && listed.includes(docB)) break; - await new Promise(r => setTimeout(r, 1500)); - } - setFanoutGraphs([docA, docB]); - return { docA, docB, listed }; - }, - // --- Public discovery: REMOVED ------------------------------------ // The two probes that lived here (publishPublicEventAs / // discoverPublicEventsAs) exercised the SDK's global discovery index. @@ -746,46 +457,6 @@ function ConnectedHarness() { // served is @wip until Festipod publishes a directory document of its // own — at which point the probes come back, reading the directory // instead of an SDK index. - - // --- T02.h GATING: protected native store openability ----------------- - // Does the REAL protected store (`did:ng:${protected_store_id}`) open for - // ORM reads AND writes the same way private does? Private was chosen - // (decision_2026-03-17) precisely because it opened without RepoNotFound. - // Before switching the domain scope to protected, prove empirically that - // a write scoped to protectedNuri is READABLE back (round-trip). Mounting - // subscribes a useShape(protectedNuri) — that - // orm_start_graph call is what opens the repo in the verifier. - protectedNuri, - mountProtectedProbe() { - setProtectedActive(true); - }, - /** Authoritative round-trip: SPARQL INSERT a marker triple into the - * protected store graph, then SPARQL SELECT it back — bypassing the ORM - * set entirely, so a RepoNotFound surfaces as a thrown error here. */ - async protectedSparqlRoundTrip() { - if (!protectedNuri) throw new Error('no protected_store_id in session'); - const subj = `did:ng:o:probe${Date.now().toString(36)}`; - const g = protectedNuri.replace(/^did:ng:/, 'did:ng:'); - const insert = `INSERT DATA { GRAPH <${protectedNuri}> { "hit" } }`; - let insertError: string | null = null; - try { - await docs.sparqlUpdate(session.session_id, insert, protectedNuri); - } catch (e: any) { - insertError = String(e?.message ?? e); - } - void subj; void g; - let count = 0; - let queryError: string | null = null; - try { - const q = `SELECT (COUNT(*) AS ?n) WHERE { GRAPH <${protectedNuri}> { ?o } }`; - const res: any = await docs.sparqlQuery(session.session_id, q, undefined, protectedNuri); - const rows = Array.isArray(res) ? res : res?.results?.bindings ?? []; - count = parseInt(rows[0]?.n?.value ?? '0', 10) || 0; - } catch (e: any) { - queryError = String(e?.message ?? e); - } - return { insertError, queryError, count, protectedNuri }; - }, }; console.log('[HarnessNG] Ready — events:', events.size, 'users:', users.size, @@ -800,124 +471,10 @@ function ConnectedHarness() { return ( <>
{bridgeReady ? 'READY' : 'LOADING_SHAPES'}
- {filterDoc && } - {smokeDoc && } - {fanoutGraphs.length > 0 && } - {protectedActive && protectedNuri && } ); } -// ============================================================================ -// ProtectedProbe (T02.h gating) — subscribes an ORM set scoped to the REAL -// protected native store, so `orm_start_graph` opens that repo in the verifier -// (the same mechanism that made private work — decision_2026-03-17). Exposes -// window.__protected: an ORM add() + read-back, to prove the protected store -// round-trips writes the way private does (or surfaces RepoNotFound if not). -// ============================================================================ - -function ProtectedProbe({ protectedNuri }: { protectedNuri: string }) { - const set = useShape(FpParticipationShapeType, protectedNuri) as DeepSignalSet; - useEffect(() => { - (window as any).__protected = { - ready: true, - protectedNuri, - add() { - set.add({ - '@graph': protectedNuri, - '@type': 'http://festipod.org/Participation', - '@id': '', - event: 'urn:protected:event', - user: 'urn:protected:user', - isConfirmed: true, - } as FpParticipation); - }, - count() { return set.size; }, - items() { - return [...set].map(p => ({ '@id': p['@id'], event: p.event, user: p.user })); - }, - }; - }, [set, protectedNuri]); - return null; -} - -// ============================================================================ -// FilterProbe — subscribes participations AFTER a ReadCap policy is active, so -// useShape returns the read-filtered VIEW. Exposes window.__readFilter.snapshot() -// (evaluated lazily → reflects the CURRENT user) for the @data scenario that -// validates the per-document read filter on the real ORM set. -// ============================================================================ - -function FilterProbe({ documentNuri }: { documentNuri: string }) { - const set = useShape(FpParticipationShapeType, documentNuri) as DeepSignalSet; - useEffect(() => { - (window as any).__readFilter = { - ready: true, - // Lazy: the filtered view reads the current user at access time, so calling - // snapshot() after setUser() reflects the new cap holder without remount. - snapshot: () => ({ count: set.size, users: [...set].map(p => p.user) }), - }; - }, [set]); - return null; -} - -// ============================================================================ -// FanoutProbe — real useShape({graphs}) over SEVERAL entity documents. -// Exposes window.__fanout for the per-entity fan-out @data scenario. -// ============================================================================ - -function FanoutProbe({ graphs }: { graphs: string[] }) { - const set = useShape(FpEventShapeType, { graphs } as any) as DeepSignalSet; - useEffect(() => { - (window as any).__fanout = { - ready: true, - graphs, - addEventTo(docNuri: string, title: string) { - set.add({ - '@graph': docNuri, - '@type': 'http://festipod.org/Event', - '@id': '', - title, - participantCount: 1, - } as FpEvent); - }, - count() { return set.size; }, - titles() { return [...set].map(e => e.title); }, - }; - }, [set, graphs]); - return null; -} - -// ============================================================================ -// SmokeProbe — real useShape({graphs}) on a doc_create'd document. -// Exposes window.__smoke for the multi-store @data validation scenario. -// ============================================================================ - -function SmokeProbe({ docNuri }: { docNuri: string }) { - const set = useShape(FpParticipationShapeType, { graphs: [docNuri] } as any) as DeepSignalSet; - useEffect(() => { - (window as any).__smoke = { - ready: true, - docNuri, - add() { - set.add({ - '@graph': docNuri, - '@type': 'http://festipod.org/Participation', - '@id': '', - event: 'urn:smoke:event', - user: 'urn:smoke:user', - isConfirmed: true, - } as FpParticipation); - }, - count() { return set.size; }, - items() { - return [...set].map(p => ({ '@id': p['@id'], event: p.event, user: p.user })); - }, - }; - }, [set, docNuri]); - return null; -} - // ============================================================================ // Bootstrap // ============================================================================ diff --git a/src/shared/test-harness/renderHelper.tsx b/src/shared/test-harness/renderHelper.tsx index 7e090fa..64c8a27 100644 --- a/src/shared/test-harness/renderHelper.tsx +++ b/src/shared/test-harness/renderHelper.tsx @@ -12,7 +12,6 @@ */ import { Window } from 'happy-dom'; -import React from 'react'; import { getScreen } from '../../screens/index'; import { LocalDataProvider } from '../context/FestipodDataContext'; import { RouterProvider } from '../../app/router'; @@ -104,37 +103,6 @@ export async function renderScreen(screenId: string, path?: string): Promise { - await ensureDomGlobals(); - if (!window) throw new Error('DOM globals not installed'); - - if (root) { - root.unmount(); - root = null; - } - - const doc = window.document as unknown as Document; - doc.body.innerHTML = '
'; - const container = doc.getElementById('root')!; - - root = createRoot(container); - - await new Promise((resolve) => { - root.render(element); - setTimeout(resolve, 0); - }); - - return doc; -} - /** * Convert a registry path with `:id` placeholders to a concrete URL using the * first seed event/user when applicable. Tests can override via the explicit @@ -154,9 +122,10 @@ function defaultPathFor(registryPath: string): string { } /** - * Set the happy-dom window's URL (so `window.location.search` reflects a given - * query string) BEFORE a subsequent render. Used to drive context that resolves - * state from the URL — e.g. AccountContext reads the `?id=` param. Idempotent: + * Set the happy-dom window's URL (so `window.location.search` / `.pathname` + * reflect a given URL) BEFORE a subsequent render. For a screen whose state comes + * from the URL rather than from props. No caller today — the screens under @ui + * take their route through renderScreen()'s `path` argument. Idempotent: * installs the DOM globals first if needed. */ export async function setRenderUrl(url: string): Promise { diff --git a/src/shared/utils/connections.ts b/src/shared/utils/connections.ts index 5befa03..efeb51c 100644 --- a/src/shared/utils/connections.ts +++ b/src/shared/utils/connections.ts @@ -2,21 +2,21 @@ * connections (Festipod glue) — the app owns the relationship concept. * * "Connected" is a Festipod domain fact (an accepted, two-sided friendship), not - * something the data SDK models: the SDK models reading as key POSSESSION, so the - * only act available is `shareCap(cap, toInbox)` — hand ONE document's key to ONE - * recipient, addressed by their inbox. So the app keeps its own bilateral - * relationship registry here and, once a link is two-sided, SHARES the keys of its - * own protected documents with that neighbour. The app carries no access CHECK - * (that stays the SDK's job — see knowledge_trust-model); it only shares what - * follows from its own relationship graph. + * something the data SDK models: the SDK models reading as key POSSESSION, and + * giving someone that key is ONE act — `inbox.share(doc, toUser)`, naming the + * document and the person. So the app keeps its own bilateral relationship + * registry here and, once a link is two-sided, SHARES its own protected + * documents with that neighbour. The app carries no access CHECK (that stays the + * SDK's job — see knowledge_trust-model); it only shares what follows from its + * own relationship graph, and it never handles a key or an inbox address. * * A link between `a` and `b` is live only when BOTH `a → b` and `b → a` have been * asserted. A reader who unilaterally self-declares a link to an owner gets * nothing: the owner never asserted them back, so nothing is shared with them. */ -import { capFor, shareCap } from '@ng-eventually/client/polyfill'; -import { listMyEntityDocs, walletInbox } from './storeRegistry'; +import { inbox } from '@ng-eventually/polyfill'; +import { listMyEntityDocs } from './storeRegistry'; /** Accumulates directed assertions and exposes the bilateral neighbourhood. */ class RelationshipRegistry { @@ -60,22 +60,25 @@ const registry = new RelationshipRegistry(); /** * Declare the connections a session asserts, as `self`, to each id in `peers`, * then share what follows. For every bilateral link (both sides asserted), the - * session shares the key of each of ITS OWN protected documents - * (`listMyEntityDocs(self, 'protected')` + `capFor`) into that neighbour's inbox - * (`walletInbox(neighbour)` + `shareCap`). Re-callable whenever the relationship - * graph changes. + * session shares each of ITS OWN protected documents with that neighbour — + * `inbox.share(doc, neighbour)`, one act naming the document and the person. + * Re-callable whenever the relationship graph changes. * - * `self` is the id of the asserting identity (its normalized-id key, the same key - * its documents are recorded under). A session only ever asserts its own side — - * and now it can only SHARE its own side too: sharing a key requires holding it, - * and `capFor` answers for the connected identity alone. Where the previous - * version re-derived grants for every asserter (possible while reading was an ACL - * one process could edit for everyone), each identity now shares its own - * documents from its own session. + * `self` is the id of the asserting identity; a session only ever asserts — and + * only ever shares — its own side. Sharing requires holding the document, and a + * session holds only what it created. * - * Idempotent in EFFECT, not in traffic: `addLink` on the receiving side ignores a - * key it already holds, so re-sharing changes nothing for the recipient — but each - * call appends a fresh deposit to their inbox document (see the caller's note). + * A NEIGHBOUR MUST BE SOMEONE WHO EXISTS: `inbox.share` names a person, and it + * refuses a recipient nobody has signed in as rather than creating them. So the + * keys handed here must come from the relationship graph of REAL accounts — a + * key derived from a profile that is only a fixture names nobody, and the share + * rejects. Nothing downstream waits on this call (the caller is + * fire-and-forget), so such a rejection surfaces as a logged error, never as a + * silent grant. + * + * Idempotent in EFFECT, not in traffic: the recipient applies a key it already + * holds to no effect, so re-sharing changes nothing for them — but each call is + * a fresh deposit (see the caller's note). */ export async function declareConnections(peers: Iterable, self: string): Promise { if (!self) return; @@ -85,16 +88,11 @@ export async function declareConnections(peers: Iterable, self: string): if (neighbours.size === 0) return; // My own protected documents. Resolved once: the set is the same for every // neighbour, and each resolution is a broker read. - const myDocs = await listMyEntityDocs(self, 'protected'); + const myDocs = await listMyEntityDocs('protected'); if (myDocs.length === 0) return; for (const neighbour of neighbours) { - const inbox = await walletInbox(neighbour); for (const doc of myDocs) { - const cap = capFor(doc); - // No key held → nothing to share. A document I cannot read is not mine to - // hand over, and no key is ever derived from a bare reference. - if (!cap) continue; - await shareCap(cap, inbox); + await inbox.share(doc, neighbour); } } } diff --git a/src/shared/utils/currentPrincipal.ts b/src/shared/utils/currentPrincipal.ts new file mode 100644 index 0000000..b0dcfd4 --- /dev/null +++ b/src/shared/utils/currentPrincipal.ts @@ -0,0 +1,61 @@ +/** + * currentPrincipal — WHO the session signed in as, as `ensureIdentity()` hands it + * back. + * + * Signing in is one await (`ensureIdentity()`), and it now RETURNS the identity. + * That value is the app's only upstream answer to "who am I": it is known the + * moment the barrier settles, before any document has been read. + * + * WHAT IT IS FOR — display and logging, nothing else. **No call takes it**: a + * session belongs to one user, so placement is named by scope alone + * (`createEntityDoc(scope)`, `listMyEntityDocs(scope)`). Handing this value back + * to the data layer would re-create the parameter the surface deliberately + * removed, so it must never travel into an SDK call. + * + * WHAT IT IS NOT — it is NOT the id space the app's own entities live in. A + * UserProfile's id is its document NURI, and a Participation's `fp:user` carries + * that NURI; this principal is a third space. The join between the two is + * explicit and lives in one place (`FestipodDataContext`, where the principal + * selects the current user's profile through `normalizeIdentifier(username)`). + * Never compare this value to an entity id directly. + * + * WHY A MODULE STORE and not a React context: `AuthGate` — the component that + * makes the await — is mounted INSIDE `FestipodDataProvider`, so a context it + * published would be invisible to the very consumer that needs it. A plain + * module singleton observed with `useSyncExternalStore` is independent of + * provider order, exactly like `data/pendingQueries.ts`. + */ + +import { useSyncExternalStore } from 'react'; +import type { PrincipalId } from '@ng-eventually/polyfill'; + +/** `''` means "signing in has not settled yet" — never "no identity". */ +let principal: string = ''; +const listeners = new Set<() => void>(); + +/** Record the identity `ensureIdentity()` returned. Idempotent per value. */ +export function setCurrentPrincipal(id: PrincipalId): void { + if (principal === id) return; + principal = id; + for (const l of listeners) l(); +} + +/** The signed-in principal, or `''` while the one identity await is pending. */ +export function getCurrentPrincipal(): string { + return principal; +} + +function subscribe(listener: () => void): () => void { + listeners.add(listener); + return () => { + listeners.delete(listener); + }; +} + +/** + * Subscribe a component to the signed-in principal. The snapshot is a primitive + * string, stable between real changes — no render loop. + */ +export function useCurrentPrincipal(): string { + return useSyncExternalStore(subscribe, getCurrentPrincipal, getCurrentPrincipal); +} diff --git a/src/shared/utils/identifier.ts b/src/shared/utils/identifier.ts new file mode 100644 index 0000000..6e76687 --- /dev/null +++ b/src/shared/utils/identifier.ts @@ -0,0 +1,15 @@ +/** + * Identifier normalization — Festipod's OWN handle → key mapping. + * + * Nothing here is lent to the SDK. Normalizing identities is the SDK's own affair + * (`@Alice`, `alice ` and `ALICE` are one person to it, and it needs no hook from + * us to say so). What remains is a Festipod comparison: a profile's `username` is + * an app field, typed by a human, and the app matches it against the signed-in + * principal and against peer keys in its own relationship graph. That is the sole + * remaining caller (`FestipodDataContext`). + */ + +/** Trim, strip leading `@`, lowercase — the canonical form of a handle. */ +export function normalizeIdentifier(identifier: string | null | undefined): string { + return (identifier ?? '').trim().replace(/^@+/, '').toLowerCase(); +} diff --git a/src/shared/utils/ngBootstrap.ts b/src/shared/utils/ngBootstrap.ts index f30f33e..c2b36bb 100644 --- a/src/shared/utils/ngBootstrap.ts +++ b/src/shared/utils/ngBootstrap.ts @@ -11,8 +11,8 @@ * them to the live subscription set (reactivity). */ -import type { Nuri } from '@ng-eventually/client'; -import { normalizeIdentifier } from '../context/AccountContext'; +import type { Nuri } from '@ng-eventually/polyfill'; +import { openDocumentInbox } from './storeRegistry'; import { seedEvents, seedUsers, @@ -21,7 +21,8 @@ import { writeEntity, ENTITY_TYPE, str, int, flt, bool } from '../data/entityWri /** Scope of a seed entity + how to create its own document (SDK create). */ export type Scope = 'public' | 'protected' | 'private'; -export type CreateEntityDoc = (owner: string, scope: Scope) => Promise; +/** Placement is named by SCOPE ALONE — the session that seeds owns what it seeds. */ +export type CreateEntityDoc = (scope: Scope) => Promise; export interface BootstrapResult { seeded: boolean; @@ -43,7 +44,6 @@ export interface BootstrapResult { export async function bootstrapWallet( walletHasData: boolean, createEntityDoc: CreateEntityDoc, - owner?: string, ): Promise { const createdDocs: { public: Nuri[]; protected: Nuri[] } = { public: [], protected: [] }; // Already has data → returning user, nothing to seed @@ -54,20 +54,13 @@ export async function bootstrapWallet( console.log('[Bootstrap] First time for this wallet — seeding per-entity docs...'); - // OWNER: all seed entities are owned by the SINGLE seed owner account — the - // CURRENT logged-in account (`owner`), so "load test data into MY wallet" makes - // the current user the owner. This matters for PROTECTED entities (seed user - // profiles, participations): per-document isolation grants a protected doc's - // ReadCap to its OWNER (+ connections), so if the seed owned them as someone - // ELSE (e.g. the fixture's `mariedupont`) they'd be correctly HIDDEN from the - // current fresh-scenario user and never round-trip. Owning them as the current - // user makes them readable. PUBLIC events are world-readable regardless of owner. - // The seed users are FIXTURES, not real login accounts — minting a full owner - // account per seed user would be dozens of broker round-trips (unusably slow) - // with no product meaning. One account (the current user) owns them; each entity - // is still ITS OWN document (per-document isolation unchanged — only the cap - // OWNER is shared). Falls back to the fixture username when no login is present. - const seedOwner = owner ?? (seedUsers[0] ? normalizeIdentifier(seedUsers[0].username) : 'seed'); + // OWNERSHIP: "load test data into MY wallet" — every seeded entity is created + // in a SCOPE of the signed-in session, which therefore owns it. That is what + // makes the PROTECTED fixtures (user profiles, participations) round-trip: + // reading is possession of the key, and the creator holds what it created. + // The seed users are FIXTURES, not accounts anyone signs in as — they exist to + // be read, never to be addressed as a person. PUBLIC events are readable by + // whoever reaches them, ownership notwithstanding. // SEED FOOTPRINT (perf). Each entity is its OWN document, and `docCreate` is a // round-trip that does not overlap with the next one, so the seed cost grows @@ -83,16 +76,18 @@ export async function bootstrapWallet( const SEED_USER_LIMIT = 3; const usersToSeed = seedUsers.slice(0, SEED_USER_LIMIT); - // Establish the owner account ONCE, serially, BEFORE any create: the first - // `createEntityDoc(seedOwner, …)` creates the owner account and - // caches it, so later concurrent calls don't race to re-create the account. - const firstUserGraph = await createEntityDoc(seedOwner, 'protected'); + // Serialize the FIRST create, then fan out: it warms whatever the scope needs + // to exist before a document can be filed in it, so the concurrent creates that + // follow don't race to establish the same thing twice. A creation that cannot + // be recorded THROWS (it never returns a reference that would read empty + // forever), so a failure here aborts the seed instead of half-seeding it. + const firstUserGraph = await createEntityDoc('protected'); // Users — one PROTECTED document each. The written subject IRI is the entity's // stable `@id`, kept in the id map. const userIdMap = new Map(); await Promise.all(usersToSeed.map(async (u, i) => { - const graph = i === 0 ? firstUserGraph : await createEntityDoc(seedOwner, 'protected'); + const graph = i === 0 ? firstUserGraph : await createEntityDoc('protected'); createdDocs.protected.push(graph); const id = await writeEntity(graph, ENTITY_TYPE.user, { name: str(u.name), initials: str(u.initials), username: str(u.username), @@ -105,7 +100,11 @@ export async function bootstrapWallet( // Events — one PUBLIC document each (all of them: looked up by title in @data). const eventIdMap = new Map(); await Promise.all(seedEvents.map(async (e) => { - const graph = await createEntityDoc(seedOwner, 'public'); + const graph = await createEntityDoc('public'); + // An event is a document people SIGN UP TO, so its owner opens its inbox — + // a document only has one if its owner did. Without this, a registrant's + // deposit has nothing to reach. Only events get one (not every entity). + await openDocumentInbox(graph); createdDocs.public.push(graph); const id = await writeEntity(graph, ENTITY_TYPE.event, { title: str(e.title), description: str(e.description), date: str(e.date), @@ -115,8 +114,8 @@ export async function bootstrapWallet( }); eventIdMap.set(e.id, id); // The seeded event is NOT announced anywhere: there is no discovery index to - // submit it to. A fresh virtual user therefore does not see the seeded events - // — it sees its own. Restoring that requires the directory document. + // submit it to. Someone who did not run this seed therefore does not see these + // events — they see their own. Restoring that requires the directory document. })); console.log('[Bootstrap] Seeded', eventIdMap.size, 'events (participations created live)'); diff --git a/src/shared/utils/ngSession.ts b/src/shared/utils/ngSession.ts index 4666873..9459819 100644 --- a/src/shared/utils/ngSession.ts +++ b/src/shared/utils/ngSession.ts @@ -1,14 +1,21 @@ // Injection point — the ONLY app module that imports the real @ng-org SDK, to -// inject it into @ng-eventually/client. Every other Festipod module gets -// its NextGraph surface from @ng-eventually/client. Removed at migration. +// inject it into @ng-eventually/polyfill. Every other Festipod module gets its +// NextGraph surface from @ng-eventually/polyfill. Removed at migration. import { ng as realNg, init as realInit } from "@ng-org/web"; -import type { NG } from "@ng-eventually/client"; +import type { NG } from "@ng-eventually/polyfill"; import { initNg as realInitNg } from "@ng-org/orm"; import { useShape as realUseShape } from "@ng-org/orm/react"; -import { configure } from "@ng-eventually/client/polyfill"; -// SDK-shaped surface used by ngSession itself — taken from the lib, not @ng-org. -import { ng, init as initNgWeb, initNg as initNgSignals } from "@ng-eventually/client"; +// SDK-shaped surface used by ngSession itself — taken from the SDK, not @ng-org. +import { configure, ng, init as initNgWeb, initNg as initNgSignals } from "@ng-eventually/polyfill"; +// The deployment's wallet — ONE copy of these values in the app, shared with the +// access barrier (modules/auth re-exports this module). +import { + SHARED_WALLET_FILE_URL, + SHARED_WALLET_PASSWORD, + WALLET_IMPORT_URL, + hasSharedWallet, +} from "./sharedWallet"; // DIAGNOSTIC (shared-wallet isolation): the SDK access log SEES every read/write // prefixed by the active identity — the way to catch a doc read under the wrong @@ -23,13 +30,6 @@ function accessLogEnabled(): boolean { return true; } -const __accessLogOn = accessLogEnabled(); -console.log("[NG session] access-log:", __accessLogOn ? "ON" : "OFF (localStorage festipod.debug.accessLog=0)"); -configure({ - ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg, - debugAccessLog: __accessLogOn, -}); - export let session: NextGraphSession | undefined; let resolveSessionPromise: ( @@ -44,15 +44,47 @@ export let sessionPromise: Promise = new Promise( } ); +// --- The ONE bootstrap call ------------------------------------------------- +// `configure` is the single bootstrap entry, and it now injects ONE thing: the +// real @ng-org surface plus what this deployment hands its users. It carries no +// consumer wiring any more — THE SESSION IS THE SDK'S, not ours. We never build +// one and no call takes one: the SDK captures the session itself when `init` (its +// own, called below) fires, and it normalizes identities itself. The app reads +// the `session_id` off the same `init` event, for the `docs` primitives only. +const __accessLogOn = accessLogEnabled(); +console.log("[NG session] access-log:", __accessLogOn ? "ON" : "OFF (localStorage festipod.debug.accessLog=0)"); +console.log("[NG session] shared wallet:", hasSharedWallet() ? "configured" : "absent"); +configure({ + ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg, + debugAccessLog: __accessLogOn, + // What THIS deployment hands its users: the wallet file it serves and the + // password it publishes. The SDK reads no environment variable — the app + // resolves the values (build-time `define` or the runtime config endpoint) + // and passes them. No shared wallet configured → nothing to pass. + sharedWallet: hasSharedWallet() + ? { + fileUrl: SHARED_WALLET_FILE_URL, + password: SHARED_WALLET_PASSWORD, + importUrl: WALLET_IMPORT_URL, + } + : undefined, +}); + let initPromise: Promise | null = null; /** - * Register the initNgWeb callback. Idempotent — returns the same promise on repeated calls. - * Does NOT trigger login by itself. Call login() separately to open the wallet login page. + * START THE SESSION — the SDK's own `init`, which is the ONLY way a session comes + * into being. It captures the session itself and then calls this callback with the + * same event untouched; the app reads `session_id` off it, because the `docs` + * primitives are the one part of the surface that still names a session. + * + * ORDER IS CONTRACTUAL: this call must have happened before anything awaits + * `ensureIdentity()`, which throws otherwise. Idempotent — repeated calls return + * the same promise, so every entry point may (and should) call it before awaiting. */ -export function init(): Promise { +export function startNgSession(): Promise { if (initPromise) return initPromise; - console.log('[NG session] init() called — registering callback'); + console.log('[NG session] startNgSession() — registering the init callback'); initPromise = (initNgWeb( async (event: any) => { session = event.session; @@ -70,27 +102,25 @@ export function init(): Promise { return initPromise; } -/** - * Trigger the wallet login page. Must call init() first. - */ -export async function login() { - console.log('[NG session] login() called — opening wallet login'); - await ng.login(); -} +// NO `login()` HERE ANY MORE. Opening the wallet page is not something the app +// drives: `ensureIdentity()` mounts its own barrier and owns the round-trip that +// follows. Nothing called this, and the surface publishes no such call. /** * REAL NextGraph logout — stops the session of the SHARED wallet. * - * STOPGAP: must stay HIDDEN (Settings/debug only). The everyday "Déconnexion" - * is the FAUX one (AccountContext.logout, clears the identifier only). Calling - * this forces a new broker redirect on the next access — see + * STOPGAP: must stay HIDDEN (Settings/debug only). Calling this forces a new + * broker redirect on the next access — see * decision_2026-06-15_shared-wallet-login-flow. */ export async function logoutNg(): Promise { - const userId = session && (session as Record).user; - if (!userId) return; + // `session.user` comes through the event's open index signature, so narrow it + // rather than assert it: `session_stop` names a user id, and there is nothing + // to stop if the session never carried one. + const userId = session?.user; + if (typeof userId !== 'string' || !userId) return; try { - await (ng as unknown as { session_stop: (u: unknown) => Promise }).session_stop(userId); + await ng.session_stop(userId); console.log('[NG session] session_stop done'); } catch (error) { console.error('[NG session] logout error:', error); @@ -98,11 +128,14 @@ export async function logoutNg(): Promise { } export interface NextGraphSession { - // `NG` IS the type of the SDK object (re-exported by @ng-eventually/client) — + // `NG` IS the type of the SDK object (re-exported by @ng-eventually/polyfill) — // not a value whose type we could take. `typeof NG` was a type-level error that // the broken typecheck gate hid. ng: NG; - session_id: string; + // RELAYED, never converted: the `docs` primitives declare `string | number` + // because that is what a session carries, and handing them a stringified one + // fails. Declaring it `string` here would invite exactly that coercion. + session_id: string | number; protected_store_id: string; private_store_id: string; public_store_id: string; diff --git a/src/modules/auth/sharedWallet.ts b/src/shared/utils/sharedWallet.ts similarity index 69% rename from src/modules/auth/sharedWallet.ts rename to src/shared/utils/sharedWallet.ts index 70f60ae..4ce6230 100644 --- a/src/modules/auth/sharedWallet.ts +++ b/src/shared/utils/sharedWallet.ts @@ -1,14 +1,15 @@ /** - * Shared wallet material for the staging stopgap. + * Shared wallet material for the staging stopgap — the deployment's wallet. * - * STOPGAP: the hosted broker can't auto-import a wallet, so Festipod HANDS the - * user the shared wallet and guides a one-time import on nextgraph.eu. + * What this deployment HAS to hand over: the wallet file it serves, the password + * it publishes, and where a wallet is imported. The app does not use these to + * render anything — it passes all three to the SDK through the ONE `configure()` + * bootstrap (`shared/utils/ngSession`), which owns what a user sees while signing + * in. This module is the single consumer-facing copy of that material. * * The correct primitive is the **wallet FILE** (.ngw), NOT a TextCode: a * TextCode is a transient device-to-device transfer (5 min, source device * online, single use) — useless to embed. A wallet file is STATIC and reusable. - * So Festipod serves the file (download) + shows the shared password; the user - * imports it via nextgraph.eu → "Import a Wallet File". * * ZERO-SECURITY shared credential (friendly users) → embedding the file + * password is consistent with the posture. @@ -16,7 +17,7 @@ * `build.ts` copies the file (from FESTIPOD_SHARED_WALLET_FILE) to the bundle as * `/shared-wallet.ngw`, and `define`s the password global from * FESTIPOD_SHARED_WALLET_PASSWORD. Empty password → no shared wallet configured - * → the gate falls back to the plain flow. + * → nothing is passed to `configure`. */ // Build-injected global (not `process.env`, absent in the browser); any path @@ -34,5 +35,5 @@ export const SHARED_WALLET_FILE_URL = '/shared-wallet.ngw'; /** Standalone NextGraph wallet app — where the import actually happens. */ export const WALLET_IMPORT_URL = 'https://nextgraph.eu/#/wallet/login'; -/** Whether Festipod has a shared wallet to hand over (drives the assisted UI). */ +/** Whether this deployment has a shared wallet to hand the SDK. */ export const hasSharedWallet = (): boolean => SHARED_WALLET_PASSWORD.trim().length > 0; diff --git a/src/shared/utils/storeRegistry.ts b/src/shared/utils/storeRegistry.ts index 18808ff..4c13b85 100644 --- a/src/shared/utils/storeRegistry.ts +++ b/src/shared/utils/storeRegistry.ts @@ -1,18 +1,16 @@ /** - * storeRegistry (Festipod glue) — the lib owns placement; the app maps + * storeRegistry (Festipod glue) — the SDK owns placement; the app maps * entity → scope. This file keeps ONLY the Festipod domain mapping (entity kind - * → scope) and injects the consumer wiring the lib needs (session + identifier - * normalization) via `configureStoreRegistry(...)`. The app re-exports the lib - * surface so existing callers stay unchanged. + * → scope) and re-exports the SDK registry surface so existing callers stay + * unchanged. The consumer wiring the SDK needs (session + id normalization) is + * declared in the ONE `configure` call, in `./ngSession`. */ -import { - storeRegistry as libStoreRegistry, - type AccountRecord as LibAccountRecord, -} from '@ng-eventually/client'; -import { configureStoreRegistry } from '@ng-eventually/client/polyfill'; -import { sessionPromise } from './ngSession'; -import { normalizeIdentifier } from '../context/AccountContext'; +// Side-effect import: `configure` runs at ngSession's module evaluation, and it +// must have run before ANY registry call. Importing it here makes that ordering +// a fact of the module graph rather than a convention. +import './ngSession'; +import { storeRegistry as sdkStoreRegistry } from '@ng-eventually/polyfill'; export type Scope = 'public' | 'protected' | 'private'; @@ -34,54 +32,22 @@ export function entityScope(kind: EntityKind): Scope { } } -// --- Consumer wiring injected into the lib's storeRegistry --- -// The lib is Festipod-agnostic: it reaches the session and the identity-id -// normalization through these injected deps. Idempotent module-load side effect -// (the app imports storeRegistry before any registry call). -configureStoreRegistry({ - getSession: async () => { - const session = await sessionPromise; - // Sanctioned injection point: the session is handed to the lib HERE and - // nowhere else. The lib owns placement and resolves scope internally; the - // rest of the app speaks only in logical scopes. - return { - sessionId: session.session_id, - privateStoreId: session.private_store_id, - protectedStoreId: session.protected_store_id, - publicStoreId: session.public_store_id, - }; - }, - // The app maps its identifier handle to the identity id the lib keys on. - normalizeId: normalizeIdentifier, - // Pointer micro-guard (real broker): the account records now live in a - // subscribable doc-shim reached through a well-known write-once pointer triple in - // the store-root. The account read is barrier-authoritative (no account retry). - // The only residual store-root sync-lag is the pointer read itself — this bounded - // guard re-reads JUST that one triple a few times on a cold reconnect. It can never - // provision or fork an account. Bounded (never an open-ended broker poll). - pointerGuard: { attempts: 8, baseMs: 150, maxStepMs: 2000 }, -}); - -// --- Re-export the lib's account record + registry surface (unchanged API) --- -export type AccountRecord = LibAccountRecord; - +// --- Re-export the SDK's registry surface ----------------------------------- +// Placement is named by SCOPE ALONE: a session belongs to one user, so no call +// here takes an identity. "My documents" means the signed-in session's, and the +// app has no way — and no need — to name whose they are. export const { - ensureAccount, - resolveAccount, resolveWriteGraph, listMyEntityDocs, - resetRegistryCache, - // SDK-shaped scope resolvers — the app asks by scope, the lib resolves - // placement (no store-id ever crosses the boundary). + // SDK-shaped scope resolvers — the app asks by scope, the SDK resolves + // placement (no store id ever crosses the boundary). resolveScopeGraph, - // Inboxes — an inbox BELONGS to someone: `walletInbox(id)` is an identity's own - // inbox, `documentInbox(doc)` the inbox of a document its owner holds. There is - // no inbox common to every wallet any more. - walletInbox, - documentInbox, - // Per-entity document creation. The lib itself files the creator's ReadCap on - // create (and publishes the repo link for a `public` one), so the app declares - // NO cap policy here: reading is possession, and the creator holds what it - // created. Re-exported straight through so callers stay unchanged. + // A document only HAS an inbox if its owner opened one. The app opens one on + // the documents meant to RECEIVE deposits (its events), and the address this + // returns is what the owner reads and watches. + openDocumentInbox, + // Per-entity document creation. The SDK itself files the creator's key on + // create, so the app declares NO access policy here: reading is possession, + // and the creator holds what it created. createEntityDoc, -} = libStoreRegistry; +} = sdkStoreRegistry;