From f6d1734679634b576498c49061ab7b29dc4d0755 Mon Sep 17 00:00:00 2001 From: Sylvain Duchesne Date: Sun, 16 Aug 2026 17:23:27 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20=C3=A0=20la=20reconnexion,=20on=20retrou?= =?UTF-8?q?ve=20ce=20qu'on=20poss=C3=A8de=20=E2=80=94=20pas=20seulement=20?= =?UTF-8?q?ce=20qu'on=20a=20re=C3=A7u?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Une application signalait deux symptômes. Ils sont indépendants, et ils ont une racine commune : se connecter ne rejouait qu'UN des registres durables du portefeuille. connectedUser lisait les AddLink de la branche User — ce qu'on vous a partagé — et rien d'autre. Les capacités des documents que vous avez FAITS vivent sur la branche Store, et un seul chemin les relisait : listMyEntityDocs. Une application qui recharge et va droit à sa note ne tenait donc rien pour elle. Constaté : capFor(note) vaut undefined juste après une connexion résolue, et devient défini dès que listMyEntityDocs passe. Le public survivait en lecture parce que fetchReadCap va rechercher la clé dans le store ; il échouait quand même à l'écriture, qui ne fait pas cette démarche. Deuxième défaut : myInboxes énumérait les inbox sans en remettre la clé au détenteur. Se connecter demandait donc un document qu'on n'avait pas de quoi lire — sur une inbox, que l'application n'a jamais nommée puisque rien ne le lui permet. Troisième défaut, et c'est lui qui rendait tout ça fatal : un drainage refusé faisait échouer toute la connexion. Une inbox n'étant pas consommée par un échec, elle refusait à chaque tentative suivante. D'où le « trois fois sur trois », et d'où un verrouillage plutôt qu'un partage manquant. C'est ma spécification qui l'a créé. En rendant les échecs visibles j'avais écrasé une distinction : ne pas ATTEINDRE la file est une panne, et refuser la session est juste ; ne pas pouvoir APPLIQUER un élément est une donnée, et ça ne doit priver personne de sa session. Le drainage par inbox est désormais isolé — signalé haut et fort, les autres files drainées, la session accordée — tandis qu'énumérer les files et restaurer rejettent toujours. Le parcours e2e ratait les deux : personne ne se reconnecte après avoir ouvert son document aux messages. Il s'arrêtait une reconnexion trop tôt. --- .project/concepts/sign-in/_debt.md | 1 + .../src/emulated-verifier/branch-registers.ts | 124 +++++- .../polyfill/src/emulated-verifier/connect.ts | 104 ++++- .../src/shared-wallet/account-registry.ts | 13 +- .../test/connection-surfaces-failure.test.ts | 92 +++- .../polyfill/test/reload-inbox-drain.test.ts | 134 ++++++ .../polyfill/test/reload-own-document.test.ts | 414 ++++++++++++++++++ packages/polyfill/test/wallet-fake.ts | 280 ++++++++++++ 8 files changed, 1113 insertions(+), 49 deletions(-) create mode 100644 packages/polyfill/test/reload-inbox-drain.test.ts create mode 100644 packages/polyfill/test/reload-own-document.test.ts create mode 100644 packages/polyfill/test/wallet-fake.ts diff --git a/.project/concepts/sign-in/_debt.md b/.project/concepts/sign-in/_debt.md index c6daf88..b67e690 100644 --- a/.project/concepts/sign-in/_debt.md +++ b/.project/concepts/sign-in/_debt.md @@ -6,3 +6,4 @@ ## Raw markers (consolidate into blocks, then delete) - TOUCHED packages/polyfill/src/shared-wallet/account-registry.ts @2026-08-16 (session f93872b5-293a-4916-a353-181409a96d42) - TOUCHED packages/polyfill/src/shared-wallet/bootstrap.ts @2026-08-16 (session f93872b5-293a-4916-a353-181409a96d42) +- TOUCHED packages/polyfill/src/emulated-verifier/connect.ts @2026-08-16 (session f93872b5-293a-4916-a353-181409a96d42) diff --git a/packages/polyfill/src/emulated-verifier/branch-registers.ts b/packages/polyfill/src/emulated-verifier/branch-registers.ts index 0e154d0..f50e29c 100644 --- a/packages/polyfill/src/emulated-verifier/branch-registers.ts +++ b/packages/polyfill/src/emulated-verifier/branch-registers.ts @@ -37,7 +37,7 @@ import { sparqlQuery } from "../surface/docs"; import { readForHolder, registerUpdate } from "./register-write"; import { getCaps, getCurrentUser } from "../shared-wallet/bootstrap"; import { escapeLiteral } from "../surface/sparql"; -import { hasReadCap, isNuri, toNuri } from "../model/nuri"; +import { hasReadCap, isNuri, targetOf, toNuri } from "../model/nuri"; import { mustNotAttempt } from "./reach"; import { fetchReadCap } from "./public-store"; import { ensureRepoOpen } from "./open-repo"; @@ -51,6 +51,7 @@ import { session, readBindings, bindingValue, + lookupAccount, resolveAccount, storeOf, readUserStore, @@ -188,28 +189,97 @@ export async function publishInboxAddress(doc: Nuri, inbox: Nuri): Promise * The ReadCaps recorded on a store's Store branch — its documents, each with its * key. The emulated replay of `AddRepo`, and the reason a fresh session recovers * what it owns without recomputing anything. + * + * **Propagates a failed read**, like {@link readLinks} beside it and for the same reason: + * empty and unreadable are the same value here and could not mean more different things — + * "I own nothing in this store" against "every document I own is invisible and nothing + * said so". {@link restoreOwnCaps} is the caller that cannot survive the confusion, since + * its whole contract is that the connection either did the restore or says it did not. + * A caller that genuinely prefers to carry on catches it itself, and one of them does. */ export async function readStoreCaps(storeDoc: Nuri): Promise { const s = await session(); const out: ReadCap[] = []; - try { - const res = await sparqlQuery( - s.sessionId, - `SELECT ?c WHERE { <${STORE_BRANCH_SUBJECT}> <${P.readCap}> ?c }`, - undefined, - storeDoc, - "readStoreCaps", - ); - for (const row of readBindings(res)) { - const v = bindingValue(row, "c"); - if (v && hasReadCap(v)) out.push(v); - } - } catch (error) { - console.error(accessLogPrefix() + " readStoreCaps failed:", error); + const res = await sparqlQuery( + s.sessionId, + `SELECT ?c WHERE { <${STORE_BRANCH_SUBJECT}> <${P.readCap}> ?c }`, + undefined, + storeDoc, + "readStoreCaps", + ); + for (const row of readBindings(res)) { + const v = bindingValue(row, "c"); + if (v && hasReadCap(v)) out.push(v); } return out; } +/** + * Put back in the connected user's hands the key of EVERY document it owns — the three + * Store branches read back, which is the emulated replay of `AddRepo { read_cap }` + * (`AddRepo::verify` → `Verifier::load_repo_from_read_cap`, + * `engine/verifier/src/verifier.rs:2237`). + * + * ── Why connecting has to do this, and why the store record is not enough ── + * A document's cap is written in exactly one durable place — the Store branch of the + * store it was created in ({@link holdOwnCap}) — and until 2026-08-16 exactly one path + * read it back: `listMyEntityDocs`. So a creator that reloaded the page and went straight + * to the document it had just made, without listing that scope first, held nothing for it: + * the read was refused, the batch read (`readUnion`) dropped it silently, and the write + * was refused. Its own document, denied to its own author, on the first refresh. + * + * Restoring what a user HOLDS is already what connecting means here — that is what the + * User-branch Links step does for caps RECEIVED from others. Its own documents are the + * other half of the same act, and the more fundamental one: a received cap is a bonus, a + * created document is the user's own content. + * + * The scope stores are filed first ({@link fileOwnStructure}), because the Store branch + * lives INSIDE the store document and reading it is itself a guarded read. Not left to a + * side effect of whatever ran before: the order is carried by this composition rather than + * by where the call happens to sit. + * + * `holderKey` is the ring these land in — captured by the caller when it decided whose + * connection this is, and handed back here, exactly as `readLinks`' caller does. See + * `caps.holderKey`. + * + * Nothing to restore is not a failure: an identity with no account yet owns no store to + * read. A failed READ is one, and it propagates — the caller is `connect.connectedUser`, + * whose contract is that it did the work or said it did not. + */ +export async function restoreOwnCaps(holderKey: string): Promise { + const holder = getCurrentUser(); + if (holder === null) return; + // `lookupAccount`, not `resolveAccount`: a read that could not ANSWER must not arrive + // here as "this identity has no account", which is the one absence entitled to silence. + // Its caller resolved the same account a moment ago, so this is a cache hit. + const record = await lookupAccount(holder); + if (record === null) return; + // The store documents themselves, or the reads below would be refused for want of the + // very structure this user owns by BEING a user. + fileOwnStructure(holder, record); + const caps = getCaps(); + for (const scope of ["public", "protected", "private"] as const) { + const store = storeOf(record, scope); + if (!store) continue; + // COLD-START heal, and it is the whole point of this function running at CONNECTION + // time: on a fresh session the store repo is not yet in the verifier's `self.repos`, + // and an anchored read of a repo that is not open returns 0 rows — it does not fail. + // Without this the restore would answer "you own nothing" on exactly the session that + // needs it, silently, which is the failure-as-absence this whole path exists against. + // Same guard `readUserStore` and `readLinks` already apply to the same documents. + await ensureRepoOpen(store); + for (const cap of await readStoreCaps(store)) { + // `learnFor`, never a fresh mint: the cap must be the value the Store branch + // carries — see the note in `holdOwnCap` on why a second mint locks the owner out + // the day the stand-in value becomes a real key. + caps.learnFor(holderKey, cap); + // Which store a document sits in is a registry fact, not one recorded beside the + // caps, so it is re-applied here — marking only, like `listMyEntityDocs` does. + if (scope === "public") caps.markInPublicStore(targetOf(cap)); + } + } +} + /** * WHERE to deposit for `doc` — its inbox address, or `undefined` if its owner never * opened one. The deposit-side counterpart of {@link openDocumentInbox}, and the @@ -348,6 +418,24 @@ export async function readInboxCapsFor(doc: Nuri): Promise { /** * Every inbox this user may READ: its own, plus one per document it opened an * inbox on. What `connect.connectedUser` drains, and what `isOwnInbox` answers from. + * + * ── Listing an inbox PUTS IT IN YOUR HANDS, both levels alike ───────────── + * An `AddInboxCap` record is not a note that an inbox exists — upstream it IS the key: + * `AddInboxCapV0 { repo_id, overlay, priv_key }` (`engine/repo/src/types.rs:1973`), which + * `update_inbox_cap_v0` applies straight into the repo (`verifier.rs:1920`). So a session + * that can enumerate an inbox from that record can read it, by construction. + * + * Here the record carries the pair and not the key, so the entitlement it expresses is + * honoured the same way {@link fileOwnInbox} already honours it for a user's OWN two + * inboxes, one line above: the cap is minted from the NURI for the holder the record + * belongs to. Same emulation, same stand-in, and at migration both are replaced by the + * `priv_key` the record carries. + * + * Left out until 2026-08-16 for the DOCUMENT inboxes, and the consequence was not a + * missing feature: connecting enumerated an inbox it then had no key to read, the guarded + * read refused it, and the refusal came back out of `ensureIdentity()` — a rejected + * sign-in, on a document the application had never named, repeating at every connection + * because the record is durable. Reported live, three sign-ins out of three. */ export async function myInboxes(): Promise { const holder = getCurrentUser(); @@ -358,7 +446,11 @@ export async function myInboxes(): Promise { if ((await resolveAccount(holder)) !== null) { for (const scope of ["public", "protected"] as const) out.push(await userInbox(holder, scope)); } - for (const { inbox } of await readInboxCapPairs()) out.push(inbox); + for (const { inbox } of await readInboxCapPairs()) { + // The record entitles this holder to read it — see the note above. + fileOwnInbox(holder, inbox); + out.push(inbox); + } return out; } diff --git a/packages/polyfill/src/emulated-verifier/connect.ts b/packages/polyfill/src/emulated-verifier/connect.ts index e622a24..9baa0b7 100644 --- a/packages/polyfill/src/emulated-verifier/connect.ts +++ b/packages/polyfill/src/emulated-verifier/connect.ts @@ -9,14 +9,28 @@ * * Two steps, in order, and the order matters: * - * 1. **Restore** — read the Links already applied (`storeRegistry.readLinks`, the - * emulated `AddLink` records on the User branch of the private store) back into - * what this user holds. This is durable state; it costs one read and needs no inbox. + * 1. **Restore** — replay the durable registers back into what this user holds. All of + * them: the Store branches of its three stores (the emulated `AddRepo { read_cap }` — + * the documents it CREATED, `branch-registers.restoreOwnCaps`) and the User branch's + * Links (the emulated `AddLink` — the caps it was GIVEN, `readLinks`). Durable state, + * a handful of reads, no inbox needed. * 2. **Process** — drain the user's inbox (`inbox.processInbox`), which files any * new Link durably and puts it among what the user holds. * - * Restoring first means a reconnecting user can read its shared documents - * immediately, without waiting on the inbox round-trip. + * Restoring first means a reconnecting user can read its documents immediately, without + * waiting on the inbox round-trip. + * + * ── Restoring means ALL the registers, and that is a scar ───────────────── + * Until 2026-08-16 this step read the Links and nothing else, so a fresh page put back the + * caps a person had been GIVEN and not the ones for documents they had MADE. The Store + * branch was read by exactly one other path — `listMyEntityDocs` — so a creator who + * reloaded and went straight back to its own note (a route, a deep link) was refused it: + * the read threw, the batch read dropped it silently, and the write was refused. Its own + * document, denied to its own author, on the first refresh. + * + * The lesson generalises past that one register: what connecting owes is *everything the + * wallet durably says this user holds*, and any register left out of this step is a + * capability that exists on disk and not in the session. * * ── Fire-and-forget, on purpose ─────────────────────────────────────────── * `setCurrentUser` is synchronous and every consumer calls it from synchronous @@ -36,9 +50,30 @@ import { getCaps, getCurrentUser } from "../shared-wallet/bootstrap"; import { lookupAccount } from "../shared-wallet/account-registry"; -import { accessLogPrefix } from "../shared-wallet/access-log"; -import { myInboxes, readLinks } from "./branch-registers"; +import { accessLogPrefix, shortNuri } from "../shared-wallet/access-log"; +import { myInboxes, readLinks, restoreOwnCaps } from "./branch-registers"; import { processInbox } from "../surface/inbox"; +import type { Nuri } from "../model/types"; + +/** + * Where the failure of ONE queue goes. + * + * Not a rejection — see the rule on {@link connectedUser} for why a queue is not the + * connection — and emphatically not silence. Same channel, same prefix and the same + * ungated `console.error` as {@link startConnect} below and as the deferred drain + * (`emulated-verifier/inbox-processor.ts`, whose header argues this exact point): a + * diagnostic may be opt-in, a failure may not. + */ +function reportUndrained(inbox: Nuri, error: unknown): void { + console.error( + accessLogPrefix() + + " connected, but this queue could not be drained — a share deposited in it is not " + + "applied yet, and connecting again will try it again: " + + shortNuri(inbox) + + ":", + error, + ); +} /** The in-flight connection work, per user key — so two calls do not race. */ const inFlight = new Map>(); @@ -55,8 +90,9 @@ const inFlight = new Map>(); * a swallowed error. It swallowed **every** failure until 2026-08-13, offline broker * included, and that is what this shape replaces. * - * The rule, one line: **any failure rejects; only "there was nothing to do" resolves - * quietly.** Exactly three cases are nothing to do, and none of them is a failure: + * The rule, one line: **failing to ESTABLISH the session rejects; failing to apply one of + * its queues is reported and does not deny anyone their session.** And "there was nothing + * to do" resolves quietly. Exactly three cases are nothing to do, and none is a failure: * * - **no identity connected** — anonymous holds nothing and owns no inbox; * - **the identity has no account yet** — nothing to restore, no queue to drain, and @@ -66,9 +102,26 @@ const inFlight = new Map>(); * - **the identity changed under the run** — abandoning is correct, and the next * connection picks the work up (see `stillConnected`). * - * A restore that did not happen makes every shared document invisible, and an inbox that - * was not drained leaves a share unapplied. Both are the same event for the person using - * the application, so both are failures — there is no third category here. + * ── Why a queue is NOT the connection, corrected 2026-08-16 ─────────────── + * This said "there is no third category here" and rejected on an undrained inbox too. The + * reasoning was that an unapplied share and a lost restore look the same to a person. What + * it missed is what happens NEXT: an inbox is not consumed by failing, so a queue that + * cannot be applied is still on the list at the following connection, and the one after + * that. One unapplicable item therefore did not delay a share — it **locked the person out + * of the application, permanently**, and got worse rather than better with time. Reported + * live by a consuming application, three sign-ins out of three. + * + * That is strictly worse than the silence the 2026-08-13 shape replaced, and it collapsed + * a distinction that has to stay open: **failing to REACH the queues** (the session cannot + * proceed at all — reject, unchanged) against **failing to apply what is in one** (data, + * one queue, one person's share — report it, drain the others, let them in). + * + * The split needs no error classification, and that is what makes it trustworthy: the + * restore step is a plain `await` and still rejects, so a broker that cannot answer fails + * the connection there, before any queue is reached. Only the per-inbox drain is caught. + * + * Not silence: {@link reportUndrained} is loud and ungated, and the caps a share carries + * are not lost — the deposit stays in the queue, so the next connection applies it. * * Not fixed with a retry, a timeout or a flag on purpose: deciding *what to do* about a * broker that cannot answer belongs to the caller, and it can only decide if it is told. @@ -113,7 +166,12 @@ export async function connectedUser(): Promise { // the same fault `inbox.share` was fixed for on 2026-08-10. if ((await lookupAccount(holder)) === null) return; if (!stillConnected()) return; - // 1. Durable first: what this user has already applied. + // 1. Durable first, and ALL of it — see the header. The documents this user MADE, from + // the Store branches of its own stores, and then the caps it was GIVEN, from the + // User branch. Own documents first: they are the user's own content, and a person + // coming back to the note they wrote should not be waiting on anybody's share. + await restoreOwnCaps(holderKey); + if (!stillConnected()) return; const links = await readLinks(); if (!stillConnected()) return; for (const cap of links) getCaps().learnFor(holderKey, cap); @@ -124,14 +182,24 @@ export async function connectedUser(): Promise { // applies to the SAME private store, and interleaving those writes buys // nothing on a queue that is nearly always empty. // - // A queue that cannot be read stops the loop, so the inboxes after it are left - // undrained — as before. What changed is that stopping is now audible: the caller - // is told the connection did not complete instead of being handed a resolved - // promise over a half-drained wallet. + // A queue that fails is reported and the next one is still drained — see the rule + // above for why one unapplicable item must not deny a person their session, nor + // take the OTHER queues down with it. Enumerating them is a different act and is + // not caught: not knowing which queues exist is the session failing to establish. const inboxes = await myInboxes(); for (const inbox of inboxes) { if (!stillConnected()) return; - await processInbox(inbox); + try { + await processInbox(inbox); + } catch (error) { + // An identity that moved MID-DRAIN throws here too — `processInbox` resolves the + // holder at each step, so the new one is refused an inbox that is not theirs. That + // is abandoning, which this function has always called "not a failure", and + // reporting it would put a broker-looking error in the log every time a page + // switches user. The loop is about to return for the same reason. + if (!stillConnected()) return; + reportUndrained(inbox, error); + } } })(); diff --git a/packages/polyfill/src/shared-wallet/account-registry.ts b/packages/polyfill/src/shared-wallet/account-registry.ts index 4ec1b8f..fc3f6ea 100644 --- a/packages/polyfill/src/shared-wallet/account-registry.ts +++ b/packages/polyfill/src/shared-wallet/account-registry.ts @@ -1291,7 +1291,18 @@ export async function listMyEntityDocs(id: string, scope: Scope): Promise { - // Draining is what APPLIES a share. An inbox that could not be read may hold the cap this - // very reconnection was for, so a silent skip loses it with no trace — and it took the - // remaining inboxes down with it, silently too. It still stops at the first failure; the - // difference is that stopping is now audible. +/** + * The one branch where a failure does NOT reject — and the four things that have to hold + * at once for that to be honest. Rewritten 2026-08-16, when the previous contract + * ("stop at the first failure, reject") was reported doing this to a live application: + * one queue it could not apply denied its user the application, at every sign-in, because + * an inbox that fails is not consumed and is still there next time. See `connect.ts`. + * + * A queue is not the session. Failing to REACH the queues still rejects — that case is + * the test above, and it is untouched. + */ +test("an inbox that cannot be drained is reported, the rest are drained, and the session stands", async () => { + const faults = noFaults(); + const ng = inject(faults); + const note = await aliceSharesANoteWithBob(); + + adoptCurrentUser("bob"); + const publicInbox = await userInbox("bob", "public"); // the first of the two drained + const protectedInbox = await userInbox("bob", "protected"); // where Alice's share landed + faults.inboxRead = publicInbox; + + const reported: string[] = []; + const realError = console.error; + console.error = (...args: unknown[]): void => void reported.push(args.map(String).join(" ")); + try { + // 1. The person gets their session. This is what the previous contract denied them. + await connectedUser(); + } finally { + console.error = realError; + } + + // 2. The queue after the failing one was still drained — a failure that took the others + // down with it lost shares that had nothing to do with it. + expect(ng.inboxReads).toEqual([publicInbox, protectedInbox]); + // 3. …so the share this reconnection was for actually arrived. + expect(holds(note)).toBe(true); + // 4. And it is NOT silence: the failure names the queue and carries the broker's error. + // Ungated — this suite never turns the access log on. + expect(reported.some((line) => line.includes("RepoNotFound"))).toBe(true); + expect(reported.some((line) => line.includes("could not be drained"))).toBe(true); +}); + +// The property the live report was actually about: not one refused sign-in, but EVERY one +// of them. An inbox is not consumed by failing to be read, so a fault that persists is +// still on the drain list at the next connection — which, under the previous contract, made +// the first refusal permanent rather than transient. Signing in twice over the same +// standing fault is the cheapest way to pin that it no longer is. +test("a queue that keeps failing does not deny the session at the NEXT connection either", async () => { const faults = noFaults(); const ng = inject(faults); await aliceSharesANoteWithBob(); adoptCurrentUser("bob"); - const publicInbox = await userInbox("bob", "public"); // the first of the two drained - faults.inboxRead = publicInbox; + const publicInbox = await userInbox("bob", "public"); + faults.inboxRead = publicInbox; // a standing fault: nothing about it heals - await expect(connectedUser()).rejects.toThrow(/RepoNotFound/); - expect(ng.inboxReads).toEqual([publicInbox]); // the protected one was never reached + const realError = console.error; + console.error = (): void => undefined; + try { + await connectedUser(); + // A second connection, the way a reload produces one: the caches go, the wallet stays. + resetRegistryCache(); + resetCaps(); + adoptCurrentUser("bob"); + await connectedUser(); + } finally { + console.error = realError; + } + + // Both connections went all the way through the list rather than stopping at the fault. + expect(ng.inboxReads.filter((r) => r === publicInbox).length).toBe(2); }); // --- abandoning on an identity switch: not a failure ------------------------ diff --git a/packages/polyfill/test/reload-inbox-drain.test.ts b/packages/polyfill/test/reload-inbox-drain.test.ts new file mode 100644 index 0000000..869b6c1 --- /dev/null +++ b/packages/polyfill/test/reload-inbox-drain.test.ts @@ -0,0 +1,134 @@ +/** + * reload-inbox-drain.test.ts — signing in again, over an inbox that was opened last time. + * + * ── The report this reproduces ──────────────────────────────────────────── + * *"`ensureIdentity()` rejects inside its own inbox processing, about a document the + * application never named. The application deposits through a published call; the failure + * happens afterwards, inside the package."* + * + * The document nobody named is an INBOX. An application opens one on a note it owns + * (`storeRegistry.openDocumentInbox`) and hands out nothing: the deposit side names the + * NOTE (`inbox.postToDocument`) and the read side names it too (`inbox.readForDocument`). + * There is deliberately no published way to ask for an address, so the inbox document is + * the package's from end to end. + * + * Connecting drains every inbox the user may read — its own two, plus one per document it + * opened one on, read back from the User branch (the emulated `AddInboxCap`). Reading an + * inbox is a guarded read like any other, so a session that does not hold the inbox's key + * cannot drain it. And that key reaches the owner's hands exactly once, when the inbox is + * MINTED; nothing puts it back on a later session. + * + * So the second connection asks for a document it may not touch, is refused, and the + * refusal comes back out of `ensureIdentity()` — not as an empty screen but as a rejected + * sign-in. It will be rejected at every future connection too, because an inbox that could + * not be drained is still on the list next time. + * + * ── Why the applicative journey never saw it ────────────────────────────── + * `e2e/notebook.ts` journey 3 has Alice open her note for messages and Bob deposit into + * it; Bob reopens the application, Alice never does. The journey stops one reconnection + * short of the state this suite starts from. + */ + +import { test, expect, describe, afterAll, beforeEach } from "bun:test"; +import { docs, inbox as inboxSurface, storeRegistry } from "../src/index"; +import { getCaps } from "../src/shared-wallet/bootstrap"; +import { runScheduledInboxProcessingNow } from "../src/emulated-verifier/inbox-processor"; +import { bootPage, forgetEverything, reloadPage, signIn, SESSION, type Quad } from "./wallet-fake"; +import type { Nuri } from "../src/model/types"; + +const TITLE = "urn:test:title"; +const MESSAGE = "j'apporte le café"; + +/** + * The first visit, in the application's own vocabulary: Alice writes a note and opens it + * for messages; Bob leaves one on it. Both of them name the NOTE and nothing else. + * + * Returns the note, which is all an application ever holds — the inbox NURI is read off + * the wallet afterwards, by the test alone, to say WHICH document the refusal is about. + */ +async function aNoteOpenForMessages(quads: Quad[]): Promise { + bootPage(quads); + await signIn("alice"); + const note = await storeRegistry.createEntityDoc("public"); + await docs.sparqlUpdate( + SESSION.sessionId, + `INSERT DATA { <${note}> <${TITLE}> "Courses" }`, + note, + "writeEntity", + ); + await storeRegistry.openDocumentInbox(note); + + await signIn("bob"); + await inboxSurface.postToDocument(note, { payload: { text: MESSAGE }, from: "bob", ts: 1 }); + return note; +} + +/** + * The inbox Alice's note was opened on, read off the WALLET — the emulated `AddInboxCap` + * record, which is where the connection's drain list comes from. The test asks the wallet + * because no application can ask the package. + */ +function inboxOnTheNote(quads: Quad[], note: Nuri): Nuri { + const record = quads.find((q) => q.p === "urn:ng-eventually:shim:inboxCap" && q.o.startsWith(note + " ")); + if (!record) throw new Error("no AddInboxCap record was written for the note"); + return record.o.split(" ")[1] as Nuri; +} + +/** Alice's note, found the way her application finds it: by listing her own store. */ +async function myNote(): Promise { + const mine = await storeRegistry.listMyEntityDocs("public"); + const note = mine[0]; + if (!note) throw new Error("the note Alice wrote is not in her store"); + return note; +} + +beforeEach(() => { + forgetEverything(); +}); + +afterAll(() => { + forgetEverything(); +}); + +describe("signing in again, after opening one of my documents for messages", () => { + test("the connection work `ensureIdentity()` awaits does not reject", async () => { + const quads: Quad[] = []; + await aNoteOpenForMessages(quads); + + reloadPage(quads); + await signIn("alice"); + }); + + test("the reconnected session holds the key of the inbox it is asked to drain", async () => { + const quads: Quad[] = []; + const note = await aNoteOpenForMessages(quads); + const inbox = inboxOnTheNote(quads, note); + + reloadPage(quads); + await signIn("alice").catch(() => undefined); + + expect(getCaps().capFor(inbox)).toBeDefined(); + }); + + test("the message left on my note is there when I come back", async () => { + const quads: Quad[] = []; + await aNoteOpenForMessages(quads); + + reloadPage(quads); + await signIn("alice").catch(() => undefined); + + const mine = await inboxSurface.readForDocument(await myNote()); + expect(mine.map((d) => (d.payload as { text: string }).text)).toEqual([MESSAGE]); + }); + + // The deferred drain runs under whoever is connected — Bob, here — and reports to the + // access log rather than to a caller. It must not decide whether the owner can sign in. + test("a deferred drain having run first does not change the owner's sign-in", async () => { + const quads: Quad[] = []; + await aNoteOpenForMessages(quads); + await runScheduledInboxProcessingNow(); + + reloadPage(quads); + await signIn("alice"); + }); +}); diff --git a/packages/polyfill/test/reload-own-document.test.ts b/packages/polyfill/test/reload-own-document.test.ts new file mode 100644 index 0000000..6f28a2e --- /dev/null +++ b/packages/polyfill/test/reload-own-document.test.ts @@ -0,0 +1,414 @@ +/** + * reload-own-document.test.ts — the creator, after a page RELOAD, meets its own document. + * + * ── The report this reproduces ──────────────────────────────────────────── + * *"Create an object, refresh the browser, and the creator is denied access to the object + * it just created."* + * + * A page reload is not a subtle event: every module-level cache the library holds is gone + * (the caps registry among them), and the durable wallet is exactly as the first session + * left it. What survives is what was WRITTEN — the scope index's Main branch (`contains`), + * its Store branch (`readCap`, the emulated `AddRepo`), and the document's own triples. + * + * So the question this suite asks is: after `ensureIdentity()` has connected the same + * identity over the same wallet, what does the creator get when it goes back to the + * document it made? And it asks it three ways, because three different defects hide behind + * the word "denied": + * + * - the document is ABSENT from the listing; + * - it is listed, and reading it returns NOTHING; + * - reading it is REFUSED with an error. + * + * …and for all three scopes, because a document in a public store serves its key to + * whoever asks (`emulated-verifier/public-store.ts`) while a protected or private one + * does not — so the scope is exactly the variable that decides. + * + * ── How the reload is simulated ─────────────────────────────────────────── + * By dropping every piece of the library's module state ({@link reload}) while the fake + * broker keeps its quads. Nothing is hand-planted: the second session starts from an + * empty cap registry and an unresolved shim, and has to find its way back through the + * pointer, the doc-shim and the account record exactly as a fresh page does. + */ + +import { test, expect, describe, mock, afterAll, beforeEach } from "bun:test"; +import { configure, docs, storeRegistry, readUnion } from "../src/index"; +import { + configureStoreRegistry, + setCurrentUser, + resetCaps, + resetConfig, + resetStoreRegistry, + getCaps, +} from "../src/shared-wallet/bootstrap"; +import { resetRegistryCache } from "../src/shared-wallet/account-registry"; +import type { RegistrySession } from "../src/shared-wallet/account-registry"; +import { resetOpenedRepos } from "../src/emulated-verifier/open-repo"; +import { resetPublicStoreFetches } from "../src/emulated-verifier/public-store"; +import { connectedUser } from "../src/emulated-verifier/connect"; +import type { NgLike, Nuri, Scope, UseShapeLike } from "../src/model/types"; + +const SESSION: RegistrySession = { sessionId: "sid-reload", privateStoreId: "PRIV-RELOAD" }; + +const SHIM = "urn:ng-eventually:shim"; +const INBOX = "urn:ng-eventually:inbox"; +const RDF_TYPE = "http://www.w3.org/1999/02/22-rdf-syntax-ns#type"; +/** The application's own predicate — the note's title, in the document it created. */ +const TITLE = "urn:test:title"; + +const ALL_SCOPES: Scope[] = ["public", "protected", "private"]; + +// --- the fake broker ------------------------------------------------------- + +interface Quad { + g: string; + s: string; + p: string; + o: string; +} + +/** Reverse of the lib's `escapeLiteral`: one left-to-right pass over `\x`. */ +function unescapeLiteral(s: string): string { + let out = ""; + for (let i = 0; i < s.length; i++) { + if (s[i] === "\\" && i + 1 < s.length) { + const next = s[++i]; + out += next === "n" ? "\n" : next === "r" ? "\r" : next === "t" ? "\t" : next!; + } else out += s[i]; + } + return out; +} + +interface Token { + kind: "term" | "sep"; + value: string; +} + +/** + * Tokenize a triple body into IRIs, literals, `a`, `;` and `.`. + * + * A tokenizer rather than one regex per known query shape: the reload path issues + * writes from six different modules, and a per-shape fake would answer only the shapes + * whoever wrote it happened to think of — which is how a fake ends up green on a state + * the library never reaches. + */ +function tokenize(body: string): Token[] { + const re = /<([^>]*)>|"((?:[^"\\]|\\.)*)"|(;)|(\.)|\ba\b/g; + const out: Token[] = []; + let m: RegExpExecArray | null; + while ((m = re.exec(body)) !== null) { + if (m[1] !== undefined) out.push({ kind: "term", value: m[1] }); + else if (m[2] !== undefined) out.push({ kind: "term", value: unescapeLiteral(m[2]) }); + else if (m[3] !== undefined) out.push({ kind: "sep", value: ";" }); + else if (m[4] !== undefined) out.push({ kind: "sep", value: "." }); + else out.push({ kind: "term", value: RDF_TYPE }); + } + return out; +} + +/** ` p o ; p o . p o` → the triples it carries. */ +function parseTriples(body: string): Array<{ s: string; p: string; o: string }> { + const toks = tokenize(body); + const out: Array<{ s: string; p: string; o: string }> = []; + let subject: string | null = null; + let i = 0; + while (i < toks.length) { + const t = toks[i]!; + if (t.kind === "sep") { + if (t.value === ".") subject = null; + i += 1; + continue; + } + if (subject === null) { + subject = t.value; + i += 1; + continue; + } + const p = toks[i]; + const o = toks[i + 1]; + if (!p || !o || p.kind === "sep" || o.kind === "sep") break; + out.push({ s: subject, p: p.value, o: o.value }); + i += 2; + } + return out; +} + +/** + * A quad-store fake `ng`. It holds the wallet; the library holds nothing across a + * {@link reload}, which is the whole point. + * + * No `doc_subscribe`: `ensureRepoOpen` is then the documented no-op of the unit-fake path + * (`emulated-verifier/open-repo.ts`), so an anchored read resolves directly. That is a + * limit of the fake broker, not a library state — the defect under test is about keys, + * not about bringing a repo into the session. + */ +function makeWallet(quads: Quad[] = []) { + let docCounter = 0; + + const doc_create = mock(async () => `did:ng:o:doc${++docCounter}`); + + const sparql_update = mock(async (...a: unknown[]) => { + const query = a[1] as string; + const anchor = a[2] as string | undefined; + + const del = query.match(/DELETE\s+WHERE\s*\{([\s\S]*)\}/i); + if (del) { + const pattern = del[1]!.match(/<([^>]+)>\s+<([^>]+)>\s+\?/); + if (pattern && anchor !== undefined) { + for (let i = quads.length - 1; i >= 0; i--) { + const q = quads[i]!; + if (q.g === anchor && q.s === pattern[1] && q.p === pattern[2]) quads.splice(i, 1); + } + } + return undefined; + } + + const wrapped = query.match(/GRAPH\s+<([^>]+)>\s*\{([\s\S]*)\}/); + const g = wrapped ? wrapped[1]! : anchor; + if (g === undefined) return undefined; + const body = wrapped + ? wrapped[2]! + : query.replace(/^[\s\S]*?INSERT\s+DATA\s*\{/i, "").replace(/\}\s*$/, ""); + for (const t of parseTriples(body)) quads.push({ g, ...t }); + return undefined; + }); + + const sparql_query = mock(async (...a: unknown[]) => { + const query = a[1] as string; + const anchor = a[3] as string | undefined; + const wrapped = query.match(/GRAPH\s+<([^>]+)>/); + const g = wrapped ? wrapped[1]! : anchor; + const inGraph = quads.filter((q) => q.g === g); + + // The whole-document read (`read-model.readDoc`). + if (/SELECT\s+\?s\s+\?p\s+\?o/.test(query)) { + return { + results: { + bindings: inGraph.map((q) => ({ + s: { value: q.s }, + p: { value: q.p }, + o: { value: q.o }, + })), + }, + }; + } + + // The account record — several predicates on one subject. + if (query.includes(`<${SHIM}:docPublic>`)) { + const subjM = query.match(/<([^>]+)>\s+a\s+<[^>]*:Account>/); + const only = subjM ? subjM[1]! : null; + const bySubject = new Map>(); + for (const q of inGraph) { + if (only !== null && q.s !== only) continue; + const rec = bySubject.get(q.s) ?? {}; + if (q.p === `${SHIM}:id`) rec.id = q.o; + if (q.p === `${SHIM}:docPublic`) rec.docPublic = q.o; + if (q.p === `${SHIM}:docProtected`) rec.docProtected = q.o; + if (q.p === `${SHIM}:docPrivate`) rec.docPrivate = q.o; + bySubject.set(q.s, rec); + } + const bindings = [...bySubject.values()] + .filter((r) => r.id !== undefined) + .map((r) => ({ + id: { value: r.id! }, + docPublic: { value: r.docPublic ?? "" }, + docProtected: { value: r.docProtected ?? "" }, + docPrivate: { value: r.docPrivate ?? "" }, + })); + return { results: { bindings } }; + } + + // An inbox's deposits — several predicates on one subject, `from` optional. + if (query.includes(`<${INBOX}:payload>`)) { + const bySubject = new Map>(); + for (const q of inGraph) { + const rec = bySubject.get(q.s) ?? {}; + if (q.p === `${INBOX}:payload`) rec.payload = q.o; + if (q.p === `${INBOX}:ts`) rec.ts = q.o; + if (q.p === `${INBOX}:from`) rec.from = q.o; + bySubject.set(q.s, rec); + } + const bindings = [...bySubject.values()] + .filter((r) => r.payload !== undefined && r.ts !== undefined) + .map((r) => { + const row: Record = { + payload: { value: r.payload! }, + ts: { value: r.ts! }, + }; + if (r.from !== undefined) row.from = { value: r.from }; + return row; + }); + return { results: { bindings } }; + } + + // Everything else the library reads is one bound subject, one bound predicate, + // one variable: the pointer, the store index, the Store/User/Header branches, + // the inbox index and its owner. + const one = query.match(/<([^>]+)>\s+<([^>]+)>\s+\?(\w+)/); + if (one) { + const bindings = inGraph + .filter((q) => q.s === one[1] && q.p === one[2]) + .map((q) => ({ [one[3]!]: { value: q.o } })); + return { results: { bindings } }; + } + return { results: { bindings: [] } }; + }); + + return { doc_create, sparql_update, sparql_query, _quads: quads }; +} + +// --- the page -------------------------------------------------------------- + +function boot(quads: Quad[]): ReturnType { + const ng = makeWallet(quads); + configure({ ng: ng as unknown as NgLike, useShape: (() => {}) as unknown as UseShapeLike }); + configureStoreRegistry({ getSession: async () => SESSION, normalizeId: (id) => id.trim() }); + return ng; +} + +/** + * A page RELOAD: everything the library holds in module scope goes, the wallet stays. + * + * Each call here drops one module's state, and together they are all of it — the config + * and the captured session, the registry caches (accounts, the resolved doc-shim, the + * inbox index), the opened repos, the outer-overlay memo, the caps, and who is connected. + * A fresh page has none of them, so neither does the session that follows. + */ +function reload(quads: Quad[]): ReturnType { + setCurrentUser(null); + resetConfig(); + resetStoreRegistry(); + resetRegistryCache(); + resetOpenedRepos(); + resetPublicStoreFetches(); + resetCaps(); + return boot(quads); +} + +/** Sign in and let the connection work finish — what `ensureIdentity()` awaits. */ +async function signIn(id: string): Promise { + setCurrentUser(id); + await connectedUser(); +} + +/** The first visit: sign in, create the note, write its title into it. */ +async function firstVisit(quads: Quad[], scope: Scope): Promise { + boot(quads); + await signIn("alice"); + const note = await storeRegistry.createEntityDoc(scope); + await docs.sparqlUpdate( + SESSION.sessionId, + `INSERT DATA { <${note}> <${TITLE}> "the note" }`, + note, + "writeEntity", + ); + return note; +} + +beforeEach(() => { + setCurrentUser(null); + resetConfig(); + resetStoreRegistry(); + resetRegistryCache(); + resetOpenedRepos(); + resetPublicStoreFetches(); + resetCaps(); +}); + +afterAll(() => { + setCurrentUser(null); + resetConfig(); + resetStoreRegistry(); + resetRegistryCache(); + resetOpenedRepos(); + resetPublicStoreFetches(); + resetCaps(); +}); + +// --- the reproduction ------------------------------------------------------ + +describe("after a reload, the creator comes back to its own document", () => { + // Shape 1 — is it even there? The listing is the path the applicative journey takes, + // and it is also the path that REFILES the caps, so it is asked first and alone. + for (const scope of ALL_SCOPES) { + test(`[${scope}] it is still LISTED among my documents`, async () => { + const quads: Quad[] = []; + const note = await firstVisit(quads, scope); + + reload(quads); + await signIn("alice"); + + expect(await storeRegistry.listMyEntityDocs(scope)).toContain(note); + }); + } + + // Shape 2 — listed, but does reading it answer? `readUnion` is the library's own + // listing read, and it DROPS a document whose cap the reader does not hold: a failure + // that arrives as an absence, which is the family this project has been bitten by. + for (const scope of ALL_SCOPES) { + test(`[${scope}] reading it by reference answers its content`, async () => { + const quads: Quad[] = []; + const note = await firstVisit(quads, scope); + + reload(quads); + await signIn("alice"); + + // The application kept the reference (a route, a deep link) and reads it directly, + // without listing its store first. + const subjects = await readUnion([note]); + expect(subjects.map((s) => s.props[TITLE]?.[0])).toEqual(["the note"]); + }); + } + + // Shape 3 — is it REFUSED? The guarded passage point, which is what an application + // reaches through `docs.*` and what every read of the library goes through. + for (const scope of ALL_SCOPES) { + test(`[${scope}] reading it through the guarded surface is not refused`, async () => { + const quads: Quad[] = []; + const note = await firstVisit(quads, scope); + + reload(quads); + await signIn("alice"); + + await docs.sparqlQuery( + SESSION.sessionId, + "SELECT ?s ?p ?o WHERE { ?s ?p ?o }", + undefined, + note, + "readDoc", + ); + }); + } + + // …and the same question for a WRITE: editing the note one made is the other half of + // "denied access to the object it just created". + for (const scope of ALL_SCOPES) { + test(`[${scope}] writing to it again is not refused`, async () => { + const quads: Quad[] = []; + const note = await firstVisit(quads, scope); + + reload(quads); + await signIn("alice"); + + await docs.sparqlUpdate( + SESSION.sessionId, + `INSERT DATA { <${note}> <${TITLE}> "edited" }`, + note, + "writeEntity", + ); + }); + } + + // What the connection itself restored, stated as a fact rather than inferred from the + // symptom: does the reconnected session HOLD the key of the document it created? + for (const scope of ALL_SCOPES) { + test(`[${scope}] the reconnected session holds its key`, async () => { + const quads: Quad[] = []; + const note = await firstVisit(quads, scope); + + reload(quads); + await signIn("alice"); + + expect(getCaps().capFor(note)).toBeDefined(); + }); + } +}); diff --git a/packages/polyfill/test/wallet-fake.ts b/packages/polyfill/test/wallet-fake.ts new file mode 100644 index 0000000..1e18fca --- /dev/null +++ b/packages/polyfill/test/wallet-fake.ts @@ -0,0 +1,280 @@ +/** + * wallet-fake — a durable fake broker, and the page RELOAD that runs over it. + * + * Not a `*.test.ts`, so `bun test` does not pick it up: it is the montage two suites share + * ({@link reloadOwnDocument} / the inbox drain), and both of them are about what survives a + * reload — which is exactly the thing a per-file fake cannot express, because the wallet + * has to outlive the library while the library keeps nothing. + * + * ── What makes it a wallet and not a stub ───────────────────────────────── + * The quads live in the fake, never in the library. {@link reloadPage} drops every piece of + * the library's module state and hands back a session that has to find its way home through + * the store-root pointer, the doc-shim and the account record — the way a fresh page does. + * Nothing is planted: a second session sees exactly what the first one WROTE. + * + * The SPARQL it answers is a tokenizer plus five shapes, rather than one regex per query + * the author happened to think of: the reload path issues reads and writes from six + * modules, and a fake that answers only the shapes someone enumerated is how a suite goes + * green over a state the library never reaches. + */ + +import { mock } from "bun:test"; +import { configure } from "../src/index"; +import { + configureStoreRegistry, + setCurrentUser, + resetCaps, + resetConfig, + resetStoreRegistry, +} from "../src/shared-wallet/bootstrap"; +import { resetRegistryCache } from "../src/shared-wallet/account-registry"; +import type { RegistrySession } from "../src/shared-wallet/account-registry"; +import { resetOpenedRepos } from "../src/emulated-verifier/open-repo"; +import { resetPublicStoreFetches } from "../src/emulated-verifier/public-store"; +import { connectedUser } from "../src/emulated-verifier/connect"; +import type { NgLike, UseShapeLike } from "../src/model/types"; + +export const SESSION: RegistrySession = { sessionId: "sid-wallet", privateStoreId: "PRIV-WALLET" }; + +const SHIM = "urn:ng-eventually:shim"; +const INBOX = "urn:ng-eventually:inbox"; +const RDF_TYPE = "http://www.w3.org/1999/02/22-rdf-syntax-ns#type"; + +export interface Quad { + g: string; + s: string; + p: string; + o: string; +} + +/** Reverse of the lib's `escapeLiteral`: one left-to-right pass over `\x`. */ +function unescapeLiteral(s: string): string { + let out = ""; + for (let i = 0; i < s.length; i++) { + if (s[i] === "\\" && i + 1 < s.length) { + const next = s[++i]; + out += next === "n" ? "\n" : next === "r" ? "\r" : next === "t" ? "\t" : next!; + } else out += s[i]; + } + return out; +} + +interface Token { + kind: "term" | "sep"; + value: string; +} + +/** Tokenize a triple body into IRIs, literals, `a`, `;` and `.`. */ +function tokenize(body: string): Token[] { + const re = /<([^>]*)>|"((?:[^"\\]|\\.)*)"|(;)|(\.)|\ba\b/g; + const out: Token[] = []; + let m: RegExpExecArray | null; + while ((m = re.exec(body)) !== null) { + if (m[1] !== undefined) out.push({ kind: "term", value: m[1] }); + else if (m[2] !== undefined) out.push({ kind: "term", value: unescapeLiteral(m[2]) }); + else if (m[3] !== undefined) out.push({ kind: "sep", value: ";" }); + else if (m[4] !== undefined) out.push({ kind: "sep", value: "." }); + else out.push({ kind: "term", value: RDF_TYPE }); + } + return out; +} + +/** ` p o ; p o . p o` → the triples it carries. */ +function parseTriples(body: string): Array<{ s: string; p: string; o: string }> { + const toks = tokenize(body); + const out: Array<{ s: string; p: string; o: string }> = []; + let subject: string | null = null; + let i = 0; + while (i < toks.length) { + const t = toks[i]!; + if (t.kind === "sep") { + if (t.value === ".") subject = null; + i += 1; + continue; + } + if (subject === null) { + subject = t.value; + i += 1; + continue; + } + const p = toks[i]; + const o = toks[i + 1]; + if (!p || !o || p.kind === "sep" || o.kind === "sep") break; + out.push({ s: subject, p: p.value, o: o.value }); + i += 2; + } + return out; +} + +export interface FakeWallet { + doc_create: ReturnType; + sparql_update: ReturnType; + sparql_query: ReturnType; + _quads: Quad[]; +} + +/** + * A quad-store fake `ng` over `quads` — the durable half. The library holds nothing across + * a {@link reloadPage}; this does. + * + * No `doc_subscribe`: `ensureRepoOpen` is then the documented no-op of the unit-fake path + * (`emulated-verifier/open-repo.ts`), so an anchored read resolves directly. A limit of the + * fake broker, not a library state. + */ +export function makeWallet(quads: Quad[]): FakeWallet { + let docCounter = 0; + + const doc_create = mock(async () => `did:ng:o:doc${++docCounter}`); + + const sparql_update = mock(async (...a: unknown[]) => { + const query = a[1] as string; + const anchor = a[2] as string | undefined; + + const del = query.match(/DELETE\s+WHERE\s*\{([\s\S]*)\}/i); + if (del) { + const pattern = del[1]!.match(/<([^>]+)>\s+<([^>]+)>\s+\?/); + if (pattern && anchor !== undefined) { + for (let i = quads.length - 1; i >= 0; i--) { + const q = quads[i]!; + if (q.g === anchor && q.s === pattern[1] && q.p === pattern[2]) quads.splice(i, 1); + } + } + return undefined; + } + + const wrapped = query.match(/GRAPH\s+<([^>]+)>\s*\{([\s\S]*)\}/); + const g = wrapped ? wrapped[1]! : anchor; + if (g === undefined) return undefined; + const body = wrapped + ? wrapped[2]! + : query.replace(/^[\s\S]*?INSERT\s+DATA\s*\{/i, "").replace(/\}\s*$/, ""); + for (const t of parseTriples(body)) quads.push({ g, ...t }); + return undefined; + }); + + const sparql_query = mock(async (...a: unknown[]) => { + const query = a[1] as string; + const anchor = a[3] as string | undefined; + const wrapped = query.match(/GRAPH\s+<([^>]+)>/); + const g = wrapped ? wrapped[1]! : anchor; + const inGraph = quads.filter((q) => q.g === g); + + // The whole-document read (`read-model.readDoc`). + if (/SELECT\s+\?s\s+\?p\s+\?o/.test(query)) { + return { + results: { + bindings: inGraph.map((q) => ({ + s: { value: q.s }, + p: { value: q.p }, + o: { value: q.o }, + })), + }, + }; + } + + // The account record — several predicates on one subject. + if (query.includes(`<${SHIM}:docPublic>`)) { + const subjM = query.match(/<([^>]+)>\s+a\s+<[^>]*:Account>/); + const only = subjM ? subjM[1]! : null; + const bySubject = new Map>(); + for (const q of inGraph) { + if (only !== null && q.s !== only) continue; + const rec = bySubject.get(q.s) ?? {}; + if (q.p === `${SHIM}:id`) rec.id = q.o; + if (q.p === `${SHIM}:docPublic`) rec.docPublic = q.o; + if (q.p === `${SHIM}:docProtected`) rec.docProtected = q.o; + if (q.p === `${SHIM}:docPrivate`) rec.docPrivate = q.o; + bySubject.set(q.s, rec); + } + const bindings = [...bySubject.values()] + .filter((r) => r.id !== undefined) + .map((r) => ({ + id: { value: r.id! }, + docPublic: { value: r.docPublic ?? "" }, + docProtected: { value: r.docProtected ?? "" }, + docPrivate: { value: r.docPrivate ?? "" }, + })); + return { results: { bindings } }; + } + + // An inbox's deposits — several predicates on one subject, `from` optional. + if (query.includes(`<${INBOX}:payload>`)) { + const bySubject = new Map>(); + for (const q of inGraph) { + const rec = bySubject.get(q.s) ?? {}; + if (q.p === `${INBOX}:payload`) rec.payload = q.o; + if (q.p === `${INBOX}:ts`) rec.ts = q.o; + if (q.p === `${INBOX}:from`) rec.from = q.o; + bySubject.set(q.s, rec); + } + const bindings = [...bySubject.values()] + .filter((r) => r.payload !== undefined && r.ts !== undefined) + .map((r) => { + const row: Record = { + payload: { value: r.payload! }, + ts: { value: r.ts! }, + }; + if (r.from !== undefined) row.from = { value: r.from }; + return row; + }); + return { results: { bindings } }; + } + + // Everything else the library reads is one bound subject, one bound predicate, one + // variable: the pointer, the store index, the Store/User/Header branches, the inbox + // index and its owner. + const one = query.match(/<([^>]+)>\s+<([^>]+)>\s+\?(\w+)/); + if (one) { + const bindings = inGraph + .filter((q) => q.s === one[1] && q.p === one[2]) + .map((q) => ({ [one[3]!]: { value: q.o } })); + return { results: { bindings } }; + } + return { results: { bindings: [] } }; + }); + + return { doc_create, sparql_update, sparql_query, _quads: quads }; +} + +/** Wire the library onto `quads` — what a page load does. */ +export function bootPage(quads: Quad[]): FakeWallet { + const ng = makeWallet(quads); + configure({ ng: ng as unknown as NgLike, useShape: (() => {}) as unknown as UseShapeLike }); + configureStoreRegistry({ getSession: async () => SESSION, normalizeId: (id) => id.trim() }); + return ng; +} + +/** + * Drop everything the library holds in module scope — what a page reload does. + * + * Each call drops one module's state, and together they are all of it: the config and the + * captured session, the registry caches (accounts, the resolved doc-shim, the inbox index), + * the opened repos, the outer-overlay memo, the caps, and who is connected. + */ +export function forgetEverything(): void { + setCurrentUser(null); + resetConfig(); + resetStoreRegistry(); + resetRegistryCache(); + resetOpenedRepos(); + resetPublicStoreFetches(); + resetCaps(); +} + +/** A page RELOAD: the library forgets, the wallet does not. */ +export function reloadPage(quads: Quad[]): FakeWallet { + forgetEverything(); + return bootPage(quads); +} + +/** + * Sign in and let the connection work finish — what `ensureIdentity()` awaits, reached by + * the harness's internal path rather than through the `barrier` (there is no DOM here). + * + * It REJECTS exactly where `ensureIdentity()` would, which is the point: a suite about a + * sign-in that fails cannot use a sign-in that cannot fail. + */ +export async function signIn(id: string): Promise { + setCurrentUser(id); + await connectedUser(); +}