@learncard/network-brain-service 3.18.0 → 3.19.1

package/test/dids.spec.ts

@@ -168,7 +168,7 @@ describe('did:web profile document generation with signing authorities', () => {
         await deleteDidDocForProfile(profileId);
     });
 
-    it('never emits a fragment on a verificationMethod controller', async () => {
+    it('renders controller-owned verification and key-agreement methods', async () => {
         const profile = await getProfileByProfileId(profileId);
         const sa = await createSigningAuthority(SA_ENDPOINT);
         await createUseSigningAuthorityRelationship(profile!, sa, 'lca-sa', SA_DID, true);
@@ -195,6 +195,15 @@ describe('did:web profile document generation with signing authorities', () => {
         );
         expect(saVm).toBeDefined();
         expect((saVm as { controller: string }).controller).toBe(did);
+
+        const ownerKeyAgreement = (doc.keyAgreement ?? []).find(
+            method => typeof method === 'object' && method.controller === did
+        );
+        expect(ownerKeyAgreement).toMatchObject({
+            type: 'X25519KeyAgreementKey2019',
+            controller: did,
+            publicKeyBase58: expect.any(String),
+        });
     });
 
     it('de-duplicates repeated signing-authority relationships in the rendered document', async () => {

package/test/guardian-gated-routes.spec.ts

@@ -225,6 +225,19 @@ describe('Guardian-approved consent mutations', () => {
         expect(await ConsentFlowTransaction.findMany({ where: {} })).toEqual([]);
     });
 
+    it('does not guardian-gate a managed service profile', async () => {
+        await Profile.update({ isServiceProfile: true }, { where: { profileId: 'child-user' } });
+        await manageChild();
+
+        const { termsUri } = await childCaller().contracts.consentToContract({
+            contractUri,
+            terms: minimalTerms,
+        });
+        const record = await getContractTermsByUri(termsUri);
+        expect(record?.terms.status).toBe('live');
+        expect(record?.terms.guardianApproval).toBeUndefined();
+    });
+
     it('records the verified guardian and contract version on consent and permission updates', async () => {
         await manageChild();
         const beforeApproval = Date.now();

package/test/helpers/inbox-e2e-environment.ts

@@ -4,11 +4,17 @@ declare module 'vitest' {
     export interface ProvidedContext {
         'inbox-redis-host': string;
         'inbox-redis-port': number;
+        'inbox-queue-endpoint': string;
+        'inbox-queue-url': string;
+        'inbox-dead-letter-url': string;
     }
 }
 
 // Set before importing the app, which captures its validated environment once.
 process.env.REDIS_HOST = inject('inbox-redis-host');
+process.env.INBOX_QUEUE_ENDPOINT = inject('inbox-queue-endpoint');
+process.env.INBOX_QUEUE_URL = inject('inbox-queue-url');
+process.env.INBOX_DEAD_LETTER_QUEUE_URL = inject('inbox-dead-letter-url');
 process.env.REDIS_PORT = String(inject('inbox-redis-port'));
 process.env.NEO4J_URI = inject('neo4j-uri');
 process.env.NEO4J_USERNAME = 'neo4j';

package/test/helpers/share-link-fixtures.ts

@@ -0,0 +1,94 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { v4 as uuid } from 'uuid';
+import { neogma } from '@instance';
+import { computeShareLinkRequestHash } from '@helpers/share-link-lifecycle';
+import { reserveCreate } from '../../src/accesslayer/share-link';
+
+export const nextShareId = (): string => randomBytes(16).toString('base64url');
+
+export const contentBinding = (seed: string) => ({
+    contentHash: createHash('sha256').update(`content:${seed}`).digest('hex'),
+    contentBytes: 128,
+    recoveryHash: createHash('sha256').update(`recovery:${seed}`).digest('hex'),
+    recoveryBytes: 256,
+});
+
+export const clearLifecycleGraph = async (): Promise<void> => {
+    await neogma.queryRunner.run(
+        `MATCH (n)
+         WHERE n:ShareLink OR n:ShareLinkReservation OR n:ShareLinkOperation OR n:ShareContentCleanupJob
+         DETACH DELETE n`
+    );
+};
+
+export type ReservedCreate = {
+    namespace: string;
+    ownerProfileId: string;
+    shareId: string;
+    clientRequestId: string;
+    requestHash: string;
+    operationId: string;
+    objectRef: string;
+    generation: number;
+    leaseOwner: string;
+};
+
+export const reserveShareFixture = async (options: {
+    ownerProfileId: string;
+    shareId?: string;
+    expiresAt?: string | null;
+    selectedCount?: number;
+    title?: string;
+    leaseMs?: number;
+    now: Date;
+    clientRequestId?: string;
+    requestHash?: string;
+    namespace: string;
+}): Promise<ReservedCreate> => {
+    const namespace = options.namespace;
+    const ownerProfileId = options.ownerProfileId;
+    const shareId = options.shareId ?? nextShareId();
+    const clientRequestId = options.clientRequestId ?? uuid();
+    const selectedCount = options.selectedCount ?? 1;
+    const content = contentBinding(shareId);
+    const requestHash =
+        options.requestHash ??
+        computeShareLinkRequestHash('create', {
+            id: shareId,
+            title: options.title ?? 'Shared credentials',
+            selectedCount,
+            ...content,
+        });
+
+    const result = await reserveCreate({
+        namespace,
+        ownerProfileId,
+        clientRequestId,
+        shareId,
+        title: options.title ?? 'Shared credentials',
+        note: null,
+        expiresAt: options.expiresAt ?? null,
+        selectedCount,
+        content,
+        requestHash,
+        leaseOwner: 'worker-1',
+        leaseMs: options.leaseMs,
+        now: options.now,
+    });
+
+    if (result.outcome !== 'reserved' || !result.reservation.objectRef) {
+        throw new Error(`expected reserved create, got ${result.outcome}`);
+    }
+
+    return {
+        namespace,
+        ownerProfileId,
+        shareId,
+        clientRequestId,
+        requestHash,
+        operationId: result.reservation.operationId,
+        objectRef: result.reservation.objectRef,
+        generation: result.reservation.generation,
+        leaseOwner: result.reservation.leaseOwner,
+    };
+};