@blamejs/blamejs-shop 0.3.35 → 0.3.37

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-field-derived-hash.test.js

@@ -88,6 +88,50 @@ async function run() {
   } catch (e) { badColMode = /mode must be/.test(e.message); }
   check("bad per-column mode throws at registerTable", badColMode);
 
+  // ---- computeNamespacedHash: pseudo-field indexed hash (FTS substrate) ----
+  // Wraps _computeDerivedHash for namespaces that have no registered
+  // derived-hash column (e.g. the sealed-token mail-store FTS index).
+  var ns = "bj-mail_messages-body:fts:";
+
+  // Default mode is salted-sha3 → byte-identical to the legacy hand-roll.
+  var saltHex = b.vault.getDerivedHashSalt().toString("hex");
+  var legacyRef = b.crypto.sha3Hash(saltHex + ns + "kubernetes");
+  var cnhDefault = b.cryptoField.computeNamespacedHash(ns, "kubernetes");
+  check("computeNamespacedHash default is salted-sha3 (128 hex)", cnhDefault.length === 128);
+  check("computeNamespacedHash default == legacy hand-roll", cnhDefault === legacyRef);
+
+  // truncateBytes slices the hex to that many bytes (2 hex chars each).
+  var cnhTrunc = b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+    { mode: "salted-sha3", truncateBytes: 8 });
+  check("computeNamespacedHash truncateBytes:8 -> 16 hex", cnhTrunc.length === 16);
+  check("computeNamespacedHash truncate is a prefix of full", legacyRef.slice(0, 16) === cnhTrunc);
+
+  // Keyed mode differs from the salted default and is unforgeable
+  // without the MAC key.
+  var cnhKeyed = b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+    { mode: "hmac-shake256", truncateBytes: 8 });
+  check("computeNamespacedHash hmac-shake256 -> 16 hex", /^[0-9a-f]{16}$/.test(cnhKeyed));
+  check("computeNamespacedHash keyed differs from salted", cnhKeyed !== cnhTrunc);
+  check("computeNamespacedHash is deterministic",
+    cnhKeyed === b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+      { mode: "hmac-shake256", truncateBytes: 8 }));
+
+  // Config-time throws: bad mode, non-positive / non-integer truncateBytes.
+  var cnhBadMode = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { mode: "md5" }); }
+  catch (e) { cnhBadMode = /mode must be/.test(e.message); }
+  check("computeNamespacedHash bad mode throws", cnhBadMode);
+
+  var cnhBadTruncZero = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { truncateBytes: 0 }); }
+  catch (e) { cnhBadTruncZero = /truncateBytes must be/.test(e.message); }
+  check("computeNamespacedHash truncateBytes:0 throws", cnhBadTruncZero);
+
+  var cnhBadTruncFloat = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { truncateBytes: 2.5 }); }
+  catch (e) { cnhBadTruncFloat = /truncateBytes must be/.test(e.message); }
+  check("computeNamespacedHash non-integer truncateBytes throws", cnhBadTruncFloat);
+
   console.log("OK — crypto-field derived-hash tests");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/mail-store-fts.test.js

@@ -240,6 +240,212 @@ async function testQueryKeyMapping() {
         b.mailStore.fts.columnAndFieldFor("unknown") === null);
 }
 
+// Compute the legacy (v1) salted-sha3-truncated token hash exactly the
+// way the pre-keyed mail-store-fts.hashToken did: sha3Hash(saltHex + ns
+// + token).slice(0, 16). Used to forge an old-format FTS index so the
+// reindex-on-upgrade path has a stale index to rebuild.
+function _legacyHashToken(table, field, token) {
+  if (typeof token !== "string" || token.length === 0) return "";
+  var ns = "bj-" + table + "-" + field + ":fts:";
+  var saltHex = b.vault.getDerivedHashSalt().toString("hex");
+  return b.crypto.sha3Hash(saltHex + ns + token).slice(0, 16);
+}
+
+function _legacyHashTokens(table, field, tokens) {
+  var seen = Object.create(null);
+  var out = [];
+  for (var i = 0; i < tokens.length; i += 1) {
+    var h = _legacyHashToken(table, field, tokens[i]);
+    if (!h || seen[h]) continue;
+    seen[h] = true;
+    out.push(h);
+  }
+  return out.join(" ");
+}
+
+// Rewrite the FTS index into the legacy (v1) format AND set the format
+// marker stale, simulating an on-disk index written by a pre-keyed
+// build. Reads the sealed messages table, unseals each row, retokenizes
+// the plaintext, and reinserts under the legacy salted-sha3 hash.
+// `markerValue` selects the stale marker: "1" (old format) or null
+// (no marker row at all - pre-format-version store).
+function _forgeLegacyIndex(db, prefix, table, markerValue) {
+  var ftsTable = '"' + prefix + '_messages_fts"';
+  var msgsTable = '"' + prefix + '_messages"';
+  var metaTable = '"' + prefix + '_meta"';
+  var rows = db.prepare("SELECT * FROM " + msgsTable).all();
+  db.prepare("DELETE FROM " + ftsTable).run();
+  var insert = db.prepare("INSERT INTO " + ftsTable +
+    " (objectid, subject_toks, addr_toks, body_toks) VALUES (?, ?, ?, ?)");
+  for (var i = 0; i < rows.length; i += 1) {
+    var clear = b.cryptoField.unsealRow(table, rows[i]);
+    var subjTokens = b.mailStore.fts.tokenize(clear.subject || "");
+    var addrTokens = b.mailStore.fts.tokenize(clear.from_addr || "")
+      .concat(b.mailStore.fts.tokenize(clear.to_addrs || ""));
+    var bodyTokens = b.mailStore.fts.tokenize(clear.body_text || "");
+    insert.run(
+      clear.objectid,
+      _legacyHashTokens(table, "subject", subjTokens),
+      _legacyHashTokens(table, "addr", addrTokens),
+      _legacyHashTokens(table, "body", bodyTokens)
+    );
+  }
+  if (markerValue === null) {
+    db.prepare("DELETE FROM " + metaTable + " WHERE key = ?").run("fts_format");
+  } else {
+    db.prepare("INSERT INTO " + metaTable + " (key, value) VALUES (?, ?) " +
+      "ON CONFLICT(key) DO UPDATE SET value = excluded.value").run("fts_format", markerValue);
+  }
+}
+
+function _readMarker(db, prefix) {
+  var row = db.prepare('SELECT value FROM "' + prefix + '_meta" WHERE key = ?').get("fts_format");
+  return row ? row.value : null;
+}
+
+async function testFtsReindexOnUpgrade() {
+  // Forge an old-format (v1 salted-sha3) index, then construct a fresh
+  // store: create() must detect the stale marker, rebuild the index
+  // from the sealed messages table under the new keyed hash, find the
+  // seeded docs again, and advance the marker to the current format.
+  var fx = await _setupStore("reindex");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX", _msg("alice@example.com", "bob@example.com",
+                                       "Kubernetes deploy plan",
+                                       "We should deploy on kubernetes next monday."));
+    store.appendMessage("INBOX", _msg("carol@example.com", "bob@example.com", "Lunch?",
+                                       "Wanna grab lunch this week?"));
+
+    check("fresh store stamps current marker",
+          _readMarker(fx.db, fx.prefix) === String(b.mailStore.fts.FTS_FORMAT_VERSION));
+
+    // Rewrite the index into the legacy format + stale marker.
+    _forgeLegacyIndex(fx.db, fx.prefix, fx.prefix + "_messages", "1");
+    check("forged marker is stale", _readMarker(fx.db, fx.prefix) === "1");
+
+    // A new store handle against the same db triggers the reindex.
+    var store2 = b.mailStore.create({ backend: fx.db });
+
+    check("marker advanced to current after reindex",
+          _readMarker(fx.db, fx.prefix) === String(b.mailStore.fts.FTS_FORMAT_VERSION));
+
+    // Search now finds the seeded docs under the rebuilt keyed index.
+    var r1 = store2.search("INBOX", { text: "kubernetes" });
+    check("reindexed: text=kubernetes hits 1 row",  r1.rows.length === 1);
+    check("reindexed: not flagged ftsUnavailable",  r1.ftsUnavailable !== true);
+    var r2 = store2.search("INBOX", { text: "lunch" });
+    check("reindexed: text=lunch hits 1 row",       r2.rows.length === 1);
+    var r3 = store2.search("INBOX", { from: "alice@example.com" });
+    check("reindexed: from=alice hits 1 row",       r3.rows.length === 1);
+
+    // Idempotent - a third construction sees the current marker and does
+    // not rebuild (search still works).
+    var store3 = b.mailStore.create({ backend: fx.db });
+    var r4 = store3.search("INBOX", { text: "kubernetes" });
+    check("idempotent reindex: still 1 row",        r4.rows.length === 1);
+  } finally { _teardown(fx); }
+}
+
+async function testFtsReindexRollsBackOnInterruption() {
+  // Inject a failure into the reindex INSERT LOOP: the Nth FTS insert
+  // throws. The whole rebuild must roll back, leaving the OLD index
+  // intact + queryable and the marker NOT advanced - a retriable state,
+  // never a silently half-built index.
+  var fx = await _setupStore("interrupt");
+  try {
+    var store = b.mailStore.create({ backend: fx.db });
+    store.appendMessage("INBOX", _msg("alice@example.com", "bob@example.com",
+                                       "Kubernetes deploy plan",
+                                       "We should deploy on kubernetes next monday."));
+    store.appendMessage("INBOX", _msg("carol@example.com", "bob@example.com",
+                                       "Picnic plan", "lets plan a picnic on saturday."));
+
+    var table = fx.prefix + "_messages";
+    _forgeLegacyIndex(fx.db, fx.prefix, table, "1");
+
+    // Snapshot the forged (old-format) index so we can prove it survives
+    // the rolled-back rebuild byte-for-byte.
+    var ftsTable = '"' + fx.prefix + '_messages_fts"';
+    var beforeRows = fx.db.prepare("SELECT objectid, subject_toks, addr_toks, body_toks FROM " +
+                                   ftsTable + " ORDER BY objectid").all();
+    check("forged index has 2 rows", beforeRows.length === 2);
+
+    // A pre-rebuild MATCH against the OLD keyed scheme must hit. Compute
+    // the legacy hash for "kubernetes" in the body namespace.
+    var legacyKube = _legacyHashToken(table, "body", "kubernetes");
+    var preHit = fx.db.prepare("SELECT objectid FROM " + ftsTable + " WHERE " +
+                               ftsTable + " MATCH ?").all("body_toks:(" + legacyKube + ")");
+    check("old index queryable pre-interruption", preHit.length === 1);
+
+    // Wrap the backend so the SECOND FTS insert in the reindex loop
+    // throws. Every other call delegates to the real handle - this is a
+    // thin fault-injection shim around the live db, not a mock of the
+    // store logic.
+    var ftsInsertCalls = 0;
+    var wrapped = {
+      prepare: function (sql) {
+        var stmt = fx.db.prepare(sql);
+        if (/INSERT INTO .*_messages_fts/.test(sql)) {
+          return {
+            run: function () {
+              ftsInsertCalls += 1;
+              if (ftsInsertCalls === 2) {
+                throw new Error("injected backend failure on the 2nd FTS insert");
+              }
+              return stmt.run.apply(stmt, arguments);
+            },
+            get: function () { return stmt.get.apply(stmt, arguments); },
+            all: function () { return stmt.all.apply(stmt, arguments); },
+          };
+        }
+        return stmt;
+      },
+    };
+
+    var threw = false;
+    try {
+      b.mailStore.create({ backend: wrapped });
+    } catch (e) {
+      threw = true;
+      check("reindex failure surfaces as MailStoreError",
+            e && e.name === "MailStoreError");
+    }
+    check("interrupted reindex throws", threw);
+
+    // Marker did NOT advance to the current format - it's the sentinel
+    // (written before the DELETE), so a later create() retries.
+    check("marker did not advance to current",
+          _readMarker(fx.db, fx.prefix) !== String(b.mailStore.fts.FTS_FORMAT_VERSION));
+
+    // The OLD index survives the rollback intact, byte-for-byte.
+    var afterRows = fx.db.prepare("SELECT objectid, subject_toks, addr_toks, body_toks FROM " +
+                                  ftsTable + " ORDER BY objectid").all();
+    check("old index row count intact after rollback", afterRows.length === beforeRows.length);
+    var identical = afterRows.length === beforeRows.length;
+    for (var i = 0; i < afterRows.length && identical; i += 1) {
+      identical = afterRows[i].objectid === beforeRows[i].objectid &&
+                  afterRows[i].subject_toks === beforeRows[i].subject_toks &&
+                  afterRows[i].addr_toks === beforeRows[i].addr_toks &&
+                  afterRows[i].body_toks === beforeRows[i].body_toks;
+    }
+    check("old index rows unchanged after rollback", identical);
+
+    // And the OLD index is still queryable under the legacy scheme.
+    var postHit = fx.db.prepare("SELECT objectid FROM " + ftsTable + " WHERE " +
+                                ftsTable + " MATCH ?").all("body_toks:(" + legacyKube + ")");
+    check("old index still queryable after rollback", postHit.length === 1);
+
+    // Retriable: a clean create() against the real backend now completes
+    // the rebuild and advances the marker.
+    var store2 = b.mailStore.create({ backend: fx.db });
+    check("retry advances marker to current",
+          _readMarker(fx.db, fx.prefix) === String(b.mailStore.fts.FTS_FORMAT_VERSION));
+    var r = store2.search("INBOX", { text: "kubernetes" });
+    check("retry: search finds the doc", r.rows.length === 1);
+  } finally { _teardown(fx); }
+}
+
 async function run() {
   // One-time vault init for the sync tokenizer + hash tests — the
   // hash routine reads vault.getDerivedHashSalt() so the salt MUST
@@ -263,6 +469,8 @@ async function run() {
   await testFtsRowIsSealed();
   await testSearchRespectsLimitCap();
   await testQueryKeyMapping();
+  await testFtsReindexOnUpgrade();
+  await testFtsReindexRollsBackOnInterruption();
 
   try { nodeFs.rmSync(bootDir, { recursive: true, force: true }); } catch (_e) {}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.35",
+  "version": "0.3.37",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {