@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/packages/core/tests/client-pinned.test.ts

@@ -0,0 +1,626 @@
+/**
+ * The view of a client pinned to a principal: the internal seam that
+ * `@ic-reactor/react`'s `useClient()` reads through
+ * `Symbol.for("ic-reactor.client.as")` (#813).
+ *
+ * A server renders as nobody, and so does a hydrating render, whoever the
+ * browser's session says calls. The keys such a render builds must be the
+ * anonymous ones the server dehydrated, while the client's live caller is
+ * already the user. The view builds keys and read options for the principal
+ * it was pinned to, with the client's own options otherwise, and is the
+ * client's own for everything else. A read it builds still goes out as its
+ * key's principal or not at all (D20), and so does a write through its
+ * `mutationOptions` (#894); a direct call through a canister signs as
+ * whoever is current when it runs.
+ */
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { c } from "@meantjs/schema"
+import { Ed25519KeyIdentity } from "@icp-sdk/core/identity"
+import { Principal } from "@icp-sdk/core/principal"
+import {
+  MutationObserver,
+  QueryClient,
+  QueryObserver,
+} from "@tanstack/query-core"
+import { createClient, isReactorError, type Client } from "../src/index.js"
+import { createTestClient } from "../src/testing/index.js"
+import { ANONYMOUS } from "./canister-helpers.js"
+
+const AS = Symbol.for("ic-reactor.client.as")
+
+/** Calls the seam as `useClient()` does: on the provider's client, with the principal React rendered. */
+function pin(client: Client, principal: string): Client {
+  const seam = (client as unknown as Record<symbol, unknown>)[AS]
+  if (typeof seam !== "function") throw new Error("the client has no seam")
+  return (seam as (this: Client, principal: string) => Client).call(
+    client,
+    principal
+  )
+}
+
+const SEED_1 = "psith-oknjz-x73tv-7x3p4-a2sji-7o6lo-g2754-yfgfl-3vlqe-irrrt-4ae"
+const CANISTER = "rdmx6-jaaaa-aaaaa-aaadq-cai"
+
+/** A query that answers with its caller, and an update that does too. */
+const WHO = c.service({
+  whoami: c.func([], [c.text], "query"),
+  stamp: c.func([], [c.text], "update"),
+})
+type Who = {
+  whoami: () => Promise<string>
+  stamp: () => Promise<string>
+}
+
+const made: ReturnType<typeof createTestClient>[] = []
+afterEach(() => {
+  for (const test of made.splice(0)) test.client.dispose()
+})
+
+/** A test client signed in as seed 1, over a replica that runs {@link WHO}. */
+function signedIn() {
+  const test = createTestClient({ identity: 1 })
+  test.mock<Who>(WHO, CANISTER, {
+    whoami: ({ caller }) => `read by ${caller}`,
+    stamp: ({ caller }) => `written by ${caller}`,
+  })
+  made.push(test)
+  const who = test.client.canister<Who>(WHO, { id: CANISTER })
+  const sent = (method: string) =>
+    test.requests
+      .filter(({ methodName }) => methodName === method)
+      .map(({ caller }) => caller)
+  return { ...test, who, sent }
+}
+
+describe("a client pinned to a principal", () => {
+  it("builds the keys of the pinned principal while another one is live", () => {
+    const { client, who } = signedIn()
+    expect(client.caller()).toBe(SEED_1)
+
+    const view = pin(client, ANONYMOUS)
+
+    expect(view.caller()).toBe(ANONYMOUS)
+    expect(view.authState()).toEqual({
+      status: "anonymous",
+      principal: ANONYMOUS,
+    })
+    expect(view.queryKey(who, "whoami")).toEqual([
+      "ic-reactor",
+      client.network,
+      ANONYMOUS,
+      CANISTER,
+      "whoami",
+      ...client.queryKey(who, "whoami").slice(5),
+    ])
+    expect(view.queryKey(who)[2]).toBe(ANONYMOUS)
+    expect(view.queryOptions(who, "whoami").queryKey).toEqual(
+      view.queryKey(who, "whoami")
+    )
+    // The client itself still builds for its live caller.
+    expect(client.queryKey(who, "whoami")[2]).toBe(SEED_1)
+    expect(client.queryOptions(who, "whoami").queryKey[2]).toBe(SEED_1)
+    // Pinned to the live user, it says what the client says, the session's
+    // expiry included.
+    expect(pin(client, SEED_1).authState()).toEqual({
+      status: "signed-in",
+      principal: SEED_1,
+      expiresAt: expect.any(Number),
+    })
+  })
+
+  it("builds the client's own read options but for the key", async () => {
+    const { client, who, auth } = signedIn()
+    const options = pin(client, ANONYMOUS).queryOptions(who, "whoami")
+    const idempotent = pin(client, ANONYMOUS).queryOptions(
+      who,
+      "stamp",
+      undefined,
+      { update: "idempotent" }
+    )
+    await auth.signOut()
+
+    // No held reads and no disabled options: what the client itself builds
+    // for the anonymous caller, function for function.
+    const own = client.queryOptions(who, "whoami")
+    const { queryFn: _a, ...rest } = options
+    const { queryFn: _b, ...ownRest } = own
+    expect(rest).toEqual(ownRest)
+    expect(Object.keys(options).sort()).toEqual(Object.keys(own).sort())
+    const { queryFn: _c, ...idempotentRest } = idempotent
+    const { queryFn: _d, ...ownIdempotent } = client.queryOptions(
+      who,
+      "stamp",
+      undefined,
+      { update: "idempotent" }
+    )
+    expect(idempotentRest).toEqual(ownIdempotent)
+  })
+
+  it("finds what a server prefetched as nobody, under the same key", async () => {
+    const server = createTestClient({ identity: 1, signedIn: false })
+    made.push(server)
+    server.mock<Who>(WHO, CANISTER, { whoami: () => "prefetched" })
+    const serverWho = server.client.canister<Who>(WHO, { id: CANISTER })
+    await server.client.queryClient.prefetchQuery(
+      server.client.queryOptions(serverWho, "whoami")
+    )
+    const { client, who } = signedIn()
+
+    const view = pin(client, ANONYMOUS)
+
+    expect(view.queryOptions(who, "whoami").queryKey).toEqual(
+      server.client.queryOptions(serverWho, "whoami").queryKey
+    )
+  })
+
+  it("cancels a read it built while someone else is current, and sends nothing", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const view = pin(client, ANONYMOUS)
+    const options = view.queryOptions(who, "whoami")
+
+    const failure: unknown = await client.queryClient
+      .fetchQuery({ ...options, retry: false })
+      .catch((error: unknown) => error)
+
+    expect(isReactorError(failure) && failure.kind).toBe("cancelled")
+    expect(isReactorError(failure) && failure.code).toBe("caller_changed")
+    expect(sent("whoami")).toEqual([])
+
+    // Once nobody is current, the same read goes out, as nobody.
+    await auth.signOut()
+    await expect(
+      client.queryClient.fetchQuery({ ...options, retry: false })
+    ).resolves.toBe(`read by ${ANONYMOUS}`)
+    expect(sent("whoami")).toEqual([ANONYMOUS])
+  })
+
+  it("leaves a key that holds data as it found it when a read it built is cancelled", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const view = pin(client, ANONYMOUS)
+    const options = { ...view.queryOptions(who, "whoami"), retry: false }
+    // What a server dehydrated as nobody, stale by now.
+    client.queryClient.setQueryData(options.queryKey, "prefetched", {
+      updatedAt: 1,
+    })
+    const errors: unknown[] = []
+    const stop = client.queryClient.getQueryCache().subscribe((event) => {
+      if (event.type === "updated" && event.action.type === "error") {
+        errors.push(event.action.error)
+      }
+    })
+
+    // TanStack 5.90 and later resolve the reverted fetch with the data the
+    // key holds; earlier ones reject it with their CancelledError.
+    await client.queryClient.fetchQuery(options).catch(() => undefined)
+    stop()
+
+    expect(sent("whoami")).toEqual([])
+    expect(client.queryClient.getQueryState(options.queryKey)).toMatchObject({
+      status: "success",
+      fetchStatus: "idle",
+      data: "prefetched",
+      dataUpdatedAt: 1,
+      error: null,
+    })
+    expect(
+      errors.filter((error) => isReactorError(error) && error.code)
+    ).toEqual([])
+
+    // Still stale: once nobody is current, an observer reads it again.
+    await auth.signOut()
+    const observer = new QueryObserver(client.queryClient, options)
+    const unsubscribe = observer.subscribe(() => {})
+    await vi.waitFor(() =>
+      expect(observer.getCurrentResult().data).toBe(`read by ${ANONYMOUS}`)
+    )
+    unsubscribe()
+    expect(sent("whoami")).toEqual([ANONYMOUS])
+  })
+
+  it("clears the cancellation from a key with no data once its principal is current again", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const pinned = { ...pin(client, ANONYMOUS).queryOptions(who, "whoami") }
+    await client.queryClient.fetchQuery(pinned).catch(() => undefined)
+    // Kept while the user is current: a hydrating suspense read that was
+    // refused needs it, or it would fetch again at once and be refused again.
+    expect(client.queryClient.getQueryState(pinned.queryKey)).toMatchObject({
+      status: "error",
+      error: { kind: "cancelled", code: "caller_changed" },
+    })
+
+    // The client's own read, refused because its caller left, keeps D20's
+    // error even where the key holds data, and once that caller is back.
+    const own = { ...client.queryOptions(who, "whoami"), retry: false }
+    let statusSeen: string | undefined
+    const unsubscribe = client.subscribe(() => {
+      statusSeen ??= client.queryClient.getQueryState(pinned.queryKey)?.status
+    })
+    await auth.signOut()
+    unsubscribe()
+    // The sign-out removed the user's reads; this is data that reaches the
+    // key after its caller left (a hydration, or the app's setQueryData).
+    client.queryClient.setQueryData(own.queryKey, "earlier", { updatedAt: 1 })
+    await expect(client.queryClient.fetchQuery(own)).rejects.toMatchObject({
+      kind: "cancelled",
+      code: "caller_changed",
+    })
+
+    // Cleared before any listener heard of the sign-out.
+    expect(statusSeen).toBe("pending")
+    expect(client.queryClient.getQueryState(pinned.queryKey)).toMatchObject({
+      status: "pending",
+      fetchStatus: "idle",
+      error: null,
+    })
+    await auth.signIn()
+    expect(client.queryClient.getQueryState(own.queryKey)?.status).toBe("error")
+    expect(sent("whoami")).toEqual([])
+  })
+
+  it("keeps the error of a key with no data that no view's refusal left, once its principal is current again", async () => {
+    const test = createTestClient({ identity: 1 })
+    made.push(test)
+    test.mock<Who>(WHO, CANISTER, {
+      whoami: () => {
+        throw new Error("the canister is down")
+      },
+      stamp: ({ caller }) => `written by ${caller}`,
+    })
+    const { client, auth } = test
+    const who = client.canister<Who>(WHO, { id: CANISTER })
+    await auth.signOut()
+    const failed = { ...client.queryOptions(who, "whoami"), retry: false }
+    const rejected: unknown = await client.queryClient
+      .fetchQuery(failed)
+      .catch((error: unknown) => error)
+    expect(isReactorError(rejected) && rejected.kind).not.toBe("cancelled")
+    // The client's own read, refused (D20) because its caller left.
+    await auth.signIn()
+    const own = { ...client.queryOptions(who, "whoami"), retry: false }
+    expect(own.queryKey).not.toEqual(failed.queryKey)
+    await auth.signOut()
+    await expect(client.queryClient.fetchQuery(own)).rejects.toMatchObject({
+      code: "caller_changed",
+    })
+
+    // Each key's principal is current again: neither error is a view's
+    // refusal, so neither is cleared.
+    await auth.signIn()
+    expect(client.queryClient.getQueryState(own.queryKey)).toMatchObject({
+      status: "error",
+      error: { kind: "cancelled", code: "caller_changed" },
+    })
+    await auth.signOut()
+    expect(client.queryClient.getQueryState(failed.queryKey)).toMatchObject({
+      status: "error",
+      error: rejected,
+    })
+  })
+
+  it("leaves a fetch that replaced a cancelled refused read of the key running", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const pinned = {
+      ...pin(client, ANONYMOUS).queryOptions(who, "whoami"),
+      retry: false,
+    }
+    client.queryClient.setQueryData(pinned.queryKey, "prefetched", {
+      updatedAt: 1,
+    })
+
+    // The view's read is refused at once, and TanStack cancels it (as a
+    // refetch does) before the refusal settles; the key is then read again
+    // as nobody, whose session has just ended.
+    const refused = client.queryClient.fetchQuery(pinned).catch(() => undefined)
+    void client.queryClient.cancelQueries({ queryKey: pinned.queryKey })
+    auth.expire()
+    expect(client.caller()).toBe(ANONYMOUS)
+    const own = { ...client.queryOptions(who, "whoami"), retry: false }
+    expect(own.queryKey).toEqual(pinned.queryKey)
+    const fresh = client.queryClient.fetchQuery(own)
+    await refused
+
+    await expect(fresh).resolves.toBe(`read by ${ANONYMOUS}`)
+    expect(sent("whoami")).toEqual([ANONYMOUS])
+    expect(client.queryClient.getQueryData(own.queryKey)).toBe(
+      `read by ${ANONYMOUS}`
+    )
+  })
+
+  it("cancels a read pinned to a user who is no longer signed in", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const view = pin(client, SEED_1)
+    await auth.signOut()
+
+    const observer = new QueryObserver(client.queryClient, {
+      ...view.queryOptions(who, "whoami"),
+      retry: false,
+    })
+    const result = await observer.refetch()
+
+    expect(isReactorError(result.error) && result.error.code).toBe(
+      "caller_changed"
+    )
+    expect(sent("whoami")).toEqual([])
+  })
+
+  it("refuses an idempotent update it built for nobody, and sends nothing", async () => {
+    const { client, who, auth, sent } = signedIn()
+    const view = pin(client, ANONYMOUS)
+    const options = view.queryOptions(who, "stamp", undefined, {
+      update: "idempotent",
+    })
+    // Nobody is current now, so the read is not cancelled: it runs as the
+    // principal it was pinned to, who may not send an update.
+    await auth.signOut()
+
+    const failure: unknown = await client.queryClient
+      .fetchQuery({ ...options, retry: false })
+      .catch((error: unknown) => error)
+
+    expect(isReactorError(failure) && failure.kind).toBe("unauthenticated")
+    expect(isReactorError(failure) && failure.code).toBe("anonymous_write")
+    expect(sent("stamp")).toEqual([])
+  })
+
+  it("writes only as its principal: a write through it while someone else is current is refused and sends nothing", async () => {
+    const { client, auth, who, sent } = signedIn()
+    const nobody = pin(client, ANONYMOUS)
+    const user = pin(client, SEED_1)
+
+    expect(user.mutationOptions).not.toBe(client.mutationOptions)
+    const own = client.mutationOptions(who, "stamp")
+    const viewed = user.mutationOptions(who, "stamp")
+    // The key ends with the principal, so it stays a prefix match for a
+    // filter on the client's key.
+    expect(viewed.mutationKey).toEqual([...own.mutationKey, SEED_1])
+    expect(viewed.retry).toBe(own.retry)
+    // The live caller's view writes as them.
+    await expect(
+      new MutationObserver(client.queryClient, viewed).mutate()
+    ).resolves.toBe(`written by ${SEED_1}`)
+
+    // A view of someone who is not current sends nothing.
+    const refused = new MutationObserver(
+      client.queryClient,
+      nobody.mutationOptions(who, "stamp")
+    ).mutate()
+    await expect(refused).rejects.toMatchObject({
+      kind: "cancelled",
+      code: "caller_changed",
+      mayHaveExecuted: false,
+      method: "stamp",
+      canisterId: CANISTER,
+    })
+    // Marked with its canister, as a call's error is.
+    const failure: unknown = await refused.catch((error: unknown) => error)
+    expect(isReactorError(failure, who, "stamp")).toBe(true)
+    // Options built while seed 1 was current, run after a switch: refused.
+    auth.switchTo(2)
+    await expect(
+      new MutationObserver(client.queryClient, viewed).mutate()
+    ).rejects.toMatchObject({ kind: "cancelled", code: "caller_changed" })
+    expect(sent("stamp")).toEqual([SEED_1])
+    // The client's own options, and a direct call through a canister the
+    // view made, follow the live caller.
+    const second = client.caller()
+    await expect(
+      new MutationObserver(client.queryClient, own).mutate()
+    ).resolves.toBe(`written by ${second}`)
+    const direct = user.canister<Who>(WHO, { id: CANISTER })
+    await expect(direct.stamp()).resolves.toBe(`written by ${second}`)
+    expect(sent("stamp")).toEqual([SEED_1, second, second])
+  })
+
+  it("sends a view's write as its caller when an onMutate of the app's replaces the given one (the client's QueryClient)", async () => {
+    const { client, who, sent } = signedIn()
+    const viewed = pin(client, SEED_1).mutationOptions(who, "stamp")
+    // TanStack's optimistic-update recipe as written: the app's onMutate
+    // replaces the one the options carry, and the client's MutationCache
+    // still reads who pressed.
+    await expect(
+      new MutationObserver(client.queryClient, {
+        ...viewed,
+        onMutate: () => ({ previous: undefined }),
+      }).mutate()
+    ).resolves.toBe(`written by ${SEED_1}`)
+    expect(sent("stamp")).toEqual([SEED_1])
+  })
+
+  it.each([
+    ["the client's QueryClient", false],
+    ["another QueryClient", true],
+  ])(
+    "keeps a write pressed as one caller refused after a switch, even once a later render's options are handed to the run (%s)",
+    async (_, another) => {
+      const { client, auth, who, sent } = signedIn()
+      const observer = new MutationObserver(
+        another ? new QueryClient() : client.queryClient,
+        pin(client, SEED_1).mutationOptions(who, "stamp")
+      )
+      // The press is handled by the render from before the switch.
+      auth.switchTo(2)
+      const run = observer.mutate()
+      // What useMutation does once the render that shows the switch commits.
+      // With the same key TanStack would hand the pending run these options;
+      // the key holds the principal, so it detaches the observer instead.
+      observer.setOptions(
+        pin(client, client.caller()).mutationOptions(who, "stamp")
+      )
+      expect(observer.getCurrentResult().isPending).toBe(false)
+
+      await expect(run).rejects.toMatchObject({
+        kind: "cancelled",
+        code: "caller_changed",
+        mayHaveExecuted: false,
+      })
+      expect(sent("stamp")).toEqual([])
+    }
+  )
+
+  it("says the client's own state while its principal is the live caller, an expired session included", () => {
+    const { client, auth } = signedIn()
+
+    expect(pin(client, SEED_1).authState()).toBe(client.authState())
+    auth.expire()
+    const nobody = pin(client, ANONYMOUS)
+    expect(nobody.authState()).toBe(client.authState())
+    expect(nobody.authState()).toEqual({
+      status: "expired",
+      principal: ANONYMOUS,
+    })
+    // A view of someone who is not current says who it was made for.
+    expect(pin(client, SEED_1).authState()).toEqual({
+      status: "signed-in",
+      principal: SEED_1,
+    })
+  })
+
+  it("is the client's own for everything but its keys, its reads and who it says calls", () => {
+    const { client, who } = signedIn()
+
+    const view = pin(client, ANONYMOUS)
+
+    // One view per client and principal, so a component's dependencies do
+    // not change from one render to the next.
+    expect(pin(client, ANONYMOUS)).toBe(view)
+    expect(Object.isFrozen(view)).toBe(true)
+    for (const member of [
+      "network",
+      "queryClient",
+      "subscribe",
+      "signIn",
+      "signOut",
+      "dispose",
+      "canister",
+      "resendOf",
+      "func",
+    ] as const) {
+      expect(view[member]).toBe(client[member])
+    }
+    // A canister made through either one is the client's, for both.
+    const fromView = view.canister<Who>(WHO, { id: CANISTER })
+    expect(fromView).toBe(who)
+    expect(() => client.queryOptions(fromView, "whoami")).not.toThrow()
+    expect(() => view.queryKey(who, "whoami")).not.toThrow()
+    // A view of a wrapper (a test's spy over a client) keeps the wrapper's members.
+    const spied = Object.create(client, {
+      dispose: { value: () => {}, enumerable: true },
+    }) as Client
+    expect(pin(spied, ANONYMOUS).dispose).toBe(spied.dispose)
+  })
+
+  it("carries the client it was made over, and makes a view asked of it from that client", () => {
+    const { client } = signedIn()
+    const OF = Symbol.for("ic-reactor.client.of")
+    const view = pin(client, ANONYMOUS)
+
+    // What `ReactorProvider` holds when a factory hands it a view.
+    expect((view as unknown as Record<symbol, unknown>)[OF]).toBe(client)
+    expect(Object.getOwnPropertyDescriptor(view, OF)?.enumerable).toBe(false)
+    expect((client as unknown as Record<symbol, unknown>)[OF]).toBeUndefined()
+    // A view of a view is the client's own view, not one over the view.
+    expect(pin(view, ANONYMOUS)).toBe(view)
+    expect(pin(view, SEED_1)).toBe(pin(client, SEED_1))
+  })
+
+  it("keeps no view of a principal that is neither current nor anonymous, however many switches", () => {
+    const { client, auth } = signedIn()
+    const anonymous = pin(client, ANONYMOUS)
+    const first = pin(client, SEED_1)
+    expect(pin(client, SEED_1)).toBe(first)
+
+    for (let seed = 2; seed < 200; seed++) {
+      auth.switchTo(seed)
+      pin(client, client.caller())
+    }
+
+    // The anonymous view a hydrating render asks for is kept; a user's view
+    // is not kept once a view is made for someone else.
+    expect(pin(client, ANONYMOUS)).toBe(anonymous)
+    expect(pin(client, SEED_1)).not.toBe(first)
+  })
+
+  it("hands back a view it already made without reading who calls", () => {
+    // `useClient()` asks for the anonymous view and the user's on every
+    // render, and reading the live caller converts a principal to text (#977).
+    const { client } = signedIn()
+    const anonymous = pin(client, ANONYMOUS)
+    const user = pin(client, SEED_1)
+    const toText = vi.spyOn(Principal.prototype, "toText")
+    try {
+      expect(pin(client, ANONYMOUS)).toBe(anonymous)
+      expect(pin(client, SEED_1)).toBe(user)
+      expect(toText).not.toHaveBeenCalled()
+    } finally {
+      toText.mockRestore()
+    }
+  })
+
+  it("keeps the view of a user who signed out until it makes a view for someone else", async () => {
+    const { client, auth, who, sent } = signedIn()
+    const anonymous = pin(client, ANONYMOUS)
+    const first = pin(client, SEED_1)
+
+    await client.signOut()
+    // A render after the sign-out asks only for views the client has.
+    expect(pin(client, ANONYMOUS)).toBe(anonymous)
+    expect(pin(client, SEED_1)).toBe(first)
+
+    // The same user signing in again gets that view back, and it reads and
+    // writes as the session now live.
+    auth.switchTo(1)
+    expect(pin(client, client.caller())).toBe(first)
+    expect(first.authState()).toEqual({
+      status: "signed-in",
+      principal: SEED_1,
+      expiresAt: expect.any(Number),
+    })
+    await expect(
+      client.queryClient.fetchQuery(first.queryOptions(who, "whoami"))
+    ).resolves.toBe(`read by ${SEED_1}`)
+    await expect(
+      new MutationObserver(
+        client.queryClient,
+        first.mutationOptions(who, "stamp")
+      ).mutate()
+    ).resolves.toBe(`written by ${SEED_1}`)
+    expect(sent("whoami")).toEqual([SEED_1])
+    expect(sent("stamp")).toEqual([SEED_1])
+
+    // A view made for someone else drops it.
+    auth.switchTo(2)
+    pin(client, client.caller())
+    expect(pin(client, ANONYMOUS)).toBe(anonymous)
+    expect(pin(client, SEED_1)).not.toBe(first)
+  })
+
+  it("keeps the seam in a spread copy, and pins views made over the copy", async () => {
+    const { client, who, sent } = signedIn()
+    const copy: Client = { ...client }
+
+    const view = pin(copy, ANONYMOUS)
+
+    expect(view.caller()).toBe(ANONYMOUS)
+    expect(view.queryKey(who, "whoami")[2]).toBe(ANONYMOUS)
+    expect(view.canister).toBe(copy.canister)
+    expect(view.queryClient).toBe(client.queryClient)
+    // The copy's own members are the client's: it still reads as the user.
+    await expect(
+      client.queryClient.fetchQuery(copy.queryOptions(who, "whoami"))
+    ).resolves.toBe(`read by ${SEED_1}`)
+    expect(sent("whoami")).toEqual([SEED_1])
+  })
+
+  it("is the client itself when its caller is fixed", () => {
+    const fixed = createClient({
+      network: "ic",
+      identity: Ed25519KeyIdentity.generate(),
+    })
+    const anonymous = createClient({ network: "ic", identity: "anonymous" })
+
+    expect(pin(fixed, ANONYMOUS)).toBe(fixed)
+    expect(pin(anonymous, ANONYMOUS)).toBe(anonymous)
+    fixed.dispose()
+    anonymous.dispose()
+  })
+})