ng-eventually/packages/client/test/isolation-active.test.ts

/**
 * ReadCap ACTIVE — end-to-end proof that isolation is enforced by the emulated
 * cap registry (not merely by the app's social isolation filter).
 *
 * This mirrors exactly what the app's storeRegistry wrapper does: create an
 * entity document through the REAL registry (`createEntityDoc`), then declare
 * its cap policy via `getCaps().open(doc, scope, owner)`. The read filter then
 * hides one owner's private document from another principal — the faithful
 * per-DOCUMENT NextGraph behavior.
 */
import { test, expect, mock, afterAll } from "bun:test";
import { createEntityDoc, resetRegistryCache } from "../src/store-registry";
import type { RegistrySession } from "../src/store-registry";
import {
  configure,
  configureStoreRegistry,
  resetStoreRegistry,
  resetConfig,
  getCaps,
  resetCaps,
  declareConnections,
} from "../src/polyfill";
import { filterReadable } from "../src/read-filter";
import { connectionsFromLinks } from "../src/isolation";

afterAll(() => {
  resetConfig();
  resetStoreRegistry();
  resetCaps();
});

const SESSION: RegistrySession = { sessionId: "sid", privateStoreId: "PRIV" };

function inject() {
  let n = 0;
  const ng = {
    doc_create: mock(async () => `did:ng:o:doc${++n}`),
    sparql_update: mock(async () => undefined),
    sparql_query: mock(async () => ({ results: { bindings: [] } })),
  };
  configure({ ng: ng as any, useShape: (() => {}) as any });
  configureStoreRegistry({ getSession: async () => SESSION, normalizeUser: (u) => u.trim() });
  resetRegistryCache();
  resetCaps();
  return ng;
}

test("ReadCap active: a private entity doc created via the real registry is hidden from another principal", async () => {
  inject();

  // Alice creates a PRIVATE entity document via the REAL store-registry, then
  // (as the app wrapper does) declares its cap policy: owner-only read.
  const aliceDoc = await createEntityDoc("alice", "private");
  getCaps().open(aliceDoc, "private", "alice");

  // Bob creates a PUBLIC entity document (world-readable).
  const bobDoc = await createEntityDoc("bob", "public");
  getCaps().open(bobDoc, "public", "bob");

  // The reactive set as the broker would deliver it (mono-store: items carry
  // their @graph = the document they live in).
  const items = [
    { "@graph": aliceDoc, "@id": "a1", label: "alice-private" },
    { "@graph": bobDoc, "@id": "b1", label: "bob-public" },
  ];

  // Bob cannot read alice's private doc; he CAN read the public one and, since
  // the read filter is now under a policy, alice's private item is filtered out.
  const bobView = filterReadable(items, getCaps(), "bob").map((i) => i["@id"]);
  expect(bobView).toEqual(["b1"]);

  // Alice reads her own private doc AND the public one.
  const aliceView = filterReadable(items, getCaps(), "alice").map((i) => i["@id"]);
  expect(aliceView.sort()).toEqual(["a1", "b1"]);

  // Anonymous sees only the public doc.
  const anonView = filterReadable(items, getCaps(), null).map((i) => i["@id"]);
  expect(anonView).toEqual(["b1"]);

  // Sanity: this is the REGISTRY talking, not app-level isolation — the caps
  // registry has an active read policy.
  expect(getCaps().hasReadPolicy()).toBe(true);
});

test("ReadCap active: a PROTECTED entity doc is hidden from an unconnected principal, revealed after they connect, PUBLIC readable regardless", async () => {
  inject();

  // Alice creates a PROTECTED entity document + a PUBLIC one, declaring the caps
  // exactly as the app wrapper does (createEntityDoc → getCaps().open).
  const aliceProtected = await createEntityDoc("alice", "protected");
  getCaps().open(aliceProtected, "protected", "alice");
  const alicePublic = await createEntityDoc("alice", "public");
  getCaps().open(alicePublic, "public", "alice");

  const items = [
    { "@graph": aliceProtected, "@id": "p1", label: "alice-protected" },
    { "@graph": alicePublic, "@id": "u1", label: "alice-public" },
  ];

  const view = (user: string) => filterReadable(items, getCaps(), user).map((i) => i["@id"]).sort();

  // BEFORE any connection: bob (unconnected) sees ONLY alice's public item, NOT
  // her protected one. Alice sees both.
  expect(view("bob")).toEqual(["u1"]);
  expect(view("alice")).toEqual(["p1", "u1"]);

  // The app declares the CONNECTIONS graph to the SDK (domain sharing act): now
  // alice and bob are connected. The SDK issues the protected doc's read cap to
  // bob (owner's connection). Public is unaffected.
  declareConnections(connectionsFromLinks([{ a: "alice", b: "bob" }]));

  // AFTER connecting: bob reads alice's PROTECTED item too; PUBLIC still readable.
  expect(view("bob")).toEqual(["p1", "u1"]);
  // A THIRD, still-unconnected principal (carol) sees only the public one.
  expect(view("carol")).toEqual(["u1"]);
});