Sylvain Duchesne
908f7ea973
Participation privacy (decision_2026-10-29_participation-privacy-mechanism): a sign-up is a private Join naming the meeting point, addressed to nobody, handled by the backend on emission. Attendee lists hold member URNs hashed from (WebID, event, a secret kept in the participant's profile), so counts stay public and only contacts recognise anyone; the creator has no read right and is notified anonymously. Each person's participations collection, created by the backend at the first sign-up, is readable by their /contacts WAC group only, never world-readable. The member URN is sticky per (meeting point, participant) and every collection write is verified by reading back, so a refused write leaves the act unrecorded and retryable. The EventRef mechanism and its browser-side provisioning are gone. The backend now runs with WebACL on, as the reference apps do, on its own secure datasets festipod / settings-festipod instead of the pod provider's settings dataset; pod-notifications needs it. The compose header and the deployment leaf say how to reset a stack whose datasets predate this. The rights matrix covers the new mechanism live (148 hard lines), including a forged contact Accept between throwaway accounts: the stranger enters the contacts list (platform defect, reported upstream) but is refused the profile and the participations. Tests may attack as long as they never break the dev environment (rule_tests-never-break-the-dev-environment). Also lands the coherence-pass work that was still uncommitted: contacts as the Pod's social graph and invite links, image upload to the Pod, the meeting-point form, profile completion gate, and the doctrine for them. Superseded briefs and decisions are deleted rather than annotated.
65 lines
3.7 KiB
JavaScript
65 lines
3.7 KiB
JavaScript
const { test, expect, describe } = require('bun:test');
|
|
const { itemsOf, readItems, expectItem } = require('./collection-items');
|
|
|
|
const C = 'http://localhost:3000/alice/data/as/collection/c1';
|
|
const ALICE = 'http://localhost:3000/alice';
|
|
const A = 'urn:festipod:userref:aa';
|
|
const B = 'urn:festipod:userref:bb';
|
|
|
|
/** A ctx whose `pod-resources.get` answers `reply` (a `{ status, body }`, or a function of the call). */
|
|
const pod = reply => {
|
|
const calls = [];
|
|
return {
|
|
calls,
|
|
call: async (action, params) => {
|
|
calls.push({ action, params });
|
|
if (action !== 'pod-resources.get') throw new Error(`unexpected call ${action}`);
|
|
return typeof reply === 'function' ? reply(params) : reply;
|
|
}
|
|
};
|
|
};
|
|
const collection = extra => ({ status: 200, body: { id: C, type: 'Collection', ...extra } });
|
|
|
|
describe('itemsOf — the item URIs a collection lists inline', () => {
|
|
test('every spelling of items / orderedItems; strings and nodes; none', () => {
|
|
expect(itemsOf({ items: [A, B] })).toEqual([A, B]);
|
|
expect(itemsOf({ items: A })).toEqual([A]);
|
|
expect(itemsOf({ items: [{ id: A }, { '@id': B }] })).toEqual([A, B]);
|
|
expect(itemsOf({ orderedItems: [A] })).toEqual([A]);
|
|
expect(itemsOf({ 'as:items': [A] })).toEqual([A]);
|
|
expect(itemsOf({ 'https://www.w3.org/ns/activitystreams#items': [{ '@id': A }] })).toEqual([A]);
|
|
expect(itemsOf({ totalItems: 0 })).toEqual([]);
|
|
});
|
|
});
|
|
|
|
describe('readItems — a failed read throws, it never means "empty"', () => {
|
|
test('a 200 with the collection: its items, read as the given actor', async () => {
|
|
const ctx = pod(collection({ items: [A, B] }));
|
|
expect(await readItems(ctx, { collectionUri: C, actorUri: ALICE })).toEqual([A, B]);
|
|
expect(ctx.calls).toEqual([{ action: 'pod-resources.get', params: { resourceUri: C, actorUri: ALICE } }]);
|
|
expect(await readItems(pod(collection({ totalItems: 0 })), { collectionUri: C, actorUri: ALICE })).toEqual([]);
|
|
});
|
|
|
|
test('any other status, no body, another resource, a paged root: throws', async () => {
|
|
for (const status of [0, 401, 403, 404, 500]) {
|
|
await expect(readItems(pod({ status }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow(`(HTTP ${status})`);
|
|
}
|
|
await expect(readItems(pod({ status: 200 }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('does not return the collection');
|
|
await expect(readItems(pod({ status: 200, body: { id: `${C}-other`, items: [A] } }), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('another resource');
|
|
await expect(readItems(pod(collection({ first: `${C}?page=1`, totalItems: 3 })), { collectionUri: C, actorUri: ALICE })).rejects.toThrow('is paged');
|
|
});
|
|
});
|
|
|
|
describe('expectItem — a write is checked by reading the collection back', () => {
|
|
test('present after an add, absent after a remove: resolves', async () => {
|
|
await expect(expectItem(pod(collection({ items: [A] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: true })).resolves.toBeUndefined();
|
|
await expect(expectItem(pod(collection({ items: [B] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).resolves.toBeUndefined();
|
|
});
|
|
|
|
test('a write that did not take effect, or a read-back that fails: throws', async () => {
|
|
await expect(expectItem(pod(collection({ items: [B] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: true })).rejects.toThrow(`does not hold ${A} after the add`);
|
|
await expect(expectItem(pod(collection({ items: [A] })), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).rejects.toThrow(`still holds ${A} after the remove`);
|
|
await expect(expectItem(pod({ status: 500 }), { collectionUri: C, itemUri: A, actorUri: ALICE, present: false })).rejects.toThrow('(HTTP 500)');
|
|
});
|
|
});
|