Sylvain Duchesne
ae9c32e271
Two batches, verified against nextgraph-rs throughout. P1a — the capability surface. Reading was an ACL (Map<doc, Set<principal>>), the exact inversion of key possession. It is now possession: `capFor(nuri)` is the only question, there is no principal parameter anywhere, and nothing turns a bare reference into a cap. Sharing is `shareCap(cap, toInbox)`, a Link deposit; receiving needs no operation. `Nuri` and `ReadCap` are template literal types, so passing a bare reference where a cap belongs is a compile error, with runtime guards behind it for JavaScript callers. The virtual user boundary. Every access function is now confined to the connected user, through two rules on one criterion (possession), implemented in two places so a lapse in either is caught by the other: authorization at the passage points, and "do not even attempt" at the callers. The polyfill's own machinery moved to physical.ts — unguarded, never exported — which replaced an exemption list: the machinery no longer gets waved through the guard, it calls something the guard never saw. Removed, as emulating capabilities the target does not have: - discovery.ts and its global index. There is no discovery in NextGraph; you follow links. It also pooled user data across wallets. - the cross-account fan-out (listEntityDocs, resolveReadGraphs, allAccounts, loadShim), which was cross-user enumeration by construction. - resolveInboxAnchor, a single inbox common to every user. Caps are now stored where NextGraph stores them, and read back rather than recomputed: AddRepo on the store's Store branch for documents a user creates, AddLink on its User branch for caps received. Inboxes belong to someone — the user's own, plus one per document — and connecting a user drains them all; that is the library's job, not the app's. Corrections worth recording: a ReadCap is `r:`, not `:k:` (reported by NextGraph's developer, verified in BlockRef::readcap_nuri); received caps DO have a register (AddLink), contrary to what this repo's notes claimed; and "wallet" upstream means keyring — what owns three stores is a user, so the vocabulary follows. The cap value is the constant OK: the only question the emulation answers is whether a cap is held. P1b replaces that one constant with a real key. After this the shape is right and the isolation is still fake. Nothing here may be described as anonymous or private.
91 lines
3.1 KiB
TypeScript
91 lines
3.1 KiB
TypeScript
import { test, expect, mock, afterEach } from "bun:test";
|
|
import { makeNg } from "../src/ng-proxy";
|
|
import {
|
|
configure,
|
|
resetConfig,
|
|
getCaps,
|
|
resetCaps,
|
|
setCurrentUser,
|
|
} from "../src/polyfill";
|
|
|
|
// This suite injects a fake `ng` via configure() and declares WRITE caps —
|
|
// which stay an authorization list on purpose: only READING is key possession
|
|
// (P1a). The write axis is decorative until P1b (every internal writer bypasses
|
|
// this proxy). Reset after each test so the docs.test.ts "not configured" guard
|
|
// still holds and no cap leaks into another suite.
|
|
afterEach(() => {
|
|
resetConfig();
|
|
resetCaps();
|
|
setCurrentUser(null);
|
|
});
|
|
|
|
function fakeNg() {
|
|
return { sparql_update: mock(async (..._a: unknown[]) => undefined) };
|
|
}
|
|
|
|
function inject() {
|
|
const ng = fakeNg();
|
|
configure({ ng: ng as any, useShape: (() => {}) as any });
|
|
return ng;
|
|
}
|
|
|
|
const DOC = "did:ng:o:doc";
|
|
const UPDATE = `INSERT DATA { GRAPH <${DOC}> { <s> <p> <o> } }`;
|
|
|
|
test("write guard: passthrough when NO write policy is declared (no regression)", async () => {
|
|
const ng = inject();
|
|
setCurrentUser("bob"); // not a writer, but there's no policy at all
|
|
const proxy = makeNg();
|
|
await proxy.sparql_update("sid", UPDATE, DOC);
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
test("write guard: passthrough for an UNGOVERNED doc even when a policy exists elsewhere", async () => {
|
|
const ng = inject();
|
|
getCaps().grantWrite("did:ng:o:other", "alice"); // policy on another doc
|
|
setCurrentUser("bob");
|
|
const proxy = makeNg();
|
|
await proxy.sparql_update("sid", UPDATE, DOC); // DOC itself is ungoverned
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
test("write guard: REJECTS when the doc is governed and the user lacks the write cap", async () => {
|
|
const ng = inject();
|
|
getCaps().grantWrite(DOC, "alice"); // alice holds the write cap
|
|
setCurrentUser("bob"); // bob does not
|
|
const proxy = makeNg();
|
|
await expect(proxy.sparql_update("sid", UPDATE, DOC)).rejects.toThrow(
|
|
/write denied/,
|
|
);
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(0); // never reached the real ng
|
|
});
|
|
|
|
test("write guard: REJECTS an anonymous (null) user on a governed doc", async () => {
|
|
const ng = inject();
|
|
getCaps().grantWrite(DOC, "alice");
|
|
setCurrentUser(null);
|
|
const proxy = makeNg();
|
|
await expect(proxy.sparql_update("sid", UPDATE, DOC)).rejects.toThrow(
|
|
/write denied/,
|
|
);
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(0);
|
|
});
|
|
|
|
test("write guard: ALLOWS the write-cap holder", async () => {
|
|
const ng = inject();
|
|
getCaps().grantWrite(DOC, "alice");
|
|
setCurrentUser("alice"); // owner always holds the write cap
|
|
const proxy = makeNg();
|
|
await proxy.sparql_update("sid", UPDATE, DOC);
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
test("write guard: passthrough when anchor is omitted (cannot scope the guard)", async () => {
|
|
const ng = inject();
|
|
getCaps().grantWrite(DOC, "alice");
|
|
setCurrentUser("bob");
|
|
const proxy = makeNg();
|
|
await proxy.sparql_update("sid", "INSERT DATA {}"); // no anchor → passthrough
|
|
expect(ng.sparql_update).toHaveBeenCalledTimes(1);
|
|
});
|