@learncard/network-brain-service 3.19.0 → 3.19.1

package/test/guardian-gated-routes.spec.ts

@@ -225,6 +225,19 @@ describe('Guardian-approved consent mutations', () => {
         expect(await ConsentFlowTransaction.findMany({ where: {} })).toEqual([]);
     });
 
+    it('does not guardian-gate a managed service profile', async () => {
+        await Profile.update({ isServiceProfile: true }, { where: { profileId: 'child-user' } });
+        await manageChild();
+
+        const { termsUri } = await childCaller().contracts.consentToContract({
+            contractUri,
+            terms: minimalTerms,
+        });
+        const record = await getContractTermsByUri(termsUri);
+        expect(record?.terms.status).toBe('live');
+        expect(record?.terms.guardianApproval).toBeUndefined();
+    });
+
     it('records the verified guardian and contract version on consent and permission updates', async () => {
         await manageChild();
         const beforeApproval = Date.now();

package/test/helpers/share-link-fixtures.ts

@@ -0,0 +1,94 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { v4 as uuid } from 'uuid';
+import { neogma } from '@instance';
+import { computeShareLinkRequestHash } from '@helpers/share-link-lifecycle';
+import { reserveCreate } from '../../src/accesslayer/share-link';
+
+export const nextShareId = (): string => randomBytes(16).toString('base64url');
+
+export const contentBinding = (seed: string) => ({
+    contentHash: createHash('sha256').update(`content:${seed}`).digest('hex'),
+    contentBytes: 128,
+    recoveryHash: createHash('sha256').update(`recovery:${seed}`).digest('hex'),
+    recoveryBytes: 256,
+});
+
+export const clearLifecycleGraph = async (): Promise<void> => {
+    await neogma.queryRunner.run(
+        `MATCH (n)
+         WHERE n:ShareLink OR n:ShareLinkReservation OR n:ShareLinkOperation OR n:ShareContentCleanupJob
+         DETACH DELETE n`
+    );
+};
+
+export type ReservedCreate = {
+    namespace: string;
+    ownerProfileId: string;
+    shareId: string;
+    clientRequestId: string;
+    requestHash: string;
+    operationId: string;
+    objectRef: string;
+    generation: number;
+    leaseOwner: string;
+};
+
+export const reserveShareFixture = async (options: {
+    ownerProfileId: string;
+    shareId?: string;
+    expiresAt?: string | null;
+    selectedCount?: number;
+    title?: string;
+    leaseMs?: number;
+    now: Date;
+    clientRequestId?: string;
+    requestHash?: string;
+    namespace: string;
+}): Promise<ReservedCreate> => {
+    const namespace = options.namespace;
+    const ownerProfileId = options.ownerProfileId;
+    const shareId = options.shareId ?? nextShareId();
+    const clientRequestId = options.clientRequestId ?? uuid();
+    const selectedCount = options.selectedCount ?? 1;
+    const content = contentBinding(shareId);
+    const requestHash =
+        options.requestHash ??
+        computeShareLinkRequestHash('create', {
+            id: shareId,
+            title: options.title ?? 'Shared credentials',
+            selectedCount,
+            ...content,
+        });
+
+    const result = await reserveCreate({
+        namespace,
+        ownerProfileId,
+        clientRequestId,
+        shareId,
+        title: options.title ?? 'Shared credentials',
+        note: null,
+        expiresAt: options.expiresAt ?? null,
+        selectedCount,
+        content,
+        requestHash,
+        leaseOwner: 'worker-1',
+        leaseMs: options.leaseMs,
+        now: options.now,
+    });
+
+    if (result.outcome !== 'reserved' || !result.reservation.objectRef) {
+        throw new Error(`expected reserved create, got ${result.outcome}`);
+    }
+
+    return {
+        namespace,
+        ownerProfileId,
+        shareId,
+        clientRequestId,
+        requestHash,
+        operationId: result.reservation.operationId,
+        objectRef: result.reservation.objectRef,
+        generation: result.reservation.generation,
+        leaseOwner: result.reservation.leaseOwner,
+    };
+};

package/test/managed-recipient-inbox.spec.ts

@@ -0,0 +1,130 @@
+import { vi, describe, it, expect, beforeEach, afterAll, beforeAll } from 'vitest';
+import { getClient, getUser } from './helpers/getClient';
+import { testUnsignedBoost } from './helpers/send';
+import {
+    Profile,
+    InboxCredential,
+    ContactMethod,
+    SigningAuthority,
+    Boost,
+    ProfileManager,
+} from '@models';
+import { createContactMethod } from '@accesslayer/contact-method/create';
+import { createProfileContactMethodRelationship } from '@accesslayer/contact-method/relationships/create';
+import { sendSpy } from './helpers/spies';
+
+vi.mock('@services/delivery/delivery.factory', () => ({
+    getDeliveryService: () => ({ send: sendSpy }),
+}));
+
+type SentNotification = {
+    contactMethod: { value: string };
+    templateId: string;
+    templateModel?: { claimUrl?: string };
+};
+
+let userA: Awaited<ReturnType<typeof getUser>>;
+
+const clearDb = async (): Promise<void> => {
+    await ProfileManager.delete({ detach: true, where: {} });
+    await Profile.delete({ detach: true, where: {} });
+    await InboxCredential.delete({ detach: true, where: {} });
+    await ContactMethod.delete({ detach: true, where: {} });
+    await SigningAuthority.delete({ detach: true, where: {} });
+    await Boost.delete({ detach: true, where: {} });
+};
+
+const createManagedRecipient = async (
+    profileId: string,
+    email: string,
+    isServiceProfile: boolean
+): Promise<void> => {
+    const boostUri = await userA.clients.fullAuth.boost.createBoost({
+        credential: testUnsignedBoost,
+    });
+    const managerDid = await userA.clients.fullAuth.profileManager.createChildProfileManager({
+        parentUri: boostUri,
+        profile: {},
+    });
+    const managerClient = getClient({ did: managerDid, isChallengeValid: true });
+    await managerClient.profileManager.createManagedProfile({
+        profileId,
+        displayName: profileId,
+        isServiceProfile,
+    });
+
+    const contactMethod = await createContactMethod({
+        type: 'email',
+        value: email,
+        isVerified: true,
+        isPrimary: true,
+    });
+    await createProfileContactMethodRelationship(profileId, contactMethod.id);
+};
+
+const sendTo = async (recipient: string) => {
+    const signedVc = await userA.learnCard.invoke.issueCredential({
+        ...testUnsignedBoost,
+        issuer: userA.learnCard.id.did(),
+    });
+
+    return userA.clients.fullAuth.boost.send({
+        type: 'boost',
+        recipient,
+        template: { credential: testUnsignedBoost },
+        signedCredential: signedVc,
+    });
+};
+
+describe('Inbox send to managed recipients', () => {
+    beforeAll(async () => {
+        userA = await getUser('a'.repeat(64));
+    });
+
+    beforeEach(async () => {
+        sendSpy.mockClear();
+        await clearDb();
+        await userA.clients.fullAuth.profile.createProfile({
+            profileId: 'usera',
+            displayName: 'User A',
+        });
+    });
+
+    afterAll(async () => {
+        sendSpy.mockClear();
+        await clearDb();
+    });
+
+    it('delivers directly to a managed service profile without a guardian gate', async () => {
+        await createManagedRecipient('managed-org', 'org@example.com', true);
+
+        const result = await sendTo('org@example.com');
+
+        expect(result.inbox?.status).toBe('ISSUED');
+        expect(result.inbox?.guardianStatus).toBeUndefined();
+
+        const credentials = await InboxCredential.findMany({ where: {} });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0]!.guardianStatus).toBeFalsy();
+    });
+
+    it('gates a managed child and sends the claim email with a valid template', async () => {
+        await createManagedRecipient('managed-child', 'child@example.com', false);
+
+        const result = await sendTo('child@example.com');
+
+        expect(result.inbox?.status).toBe('PENDING');
+        expect(result.inbox?.guardianStatus).toBe('AWAITING_GUARDIAN');
+
+        const credentials = await InboxCredential.findMany({ where: {} });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0]!.guardianStatus).toBe('AWAITING_GUARDIAN');
+
+        const childEmail = sendSpy.mock.calls
+            .map(call => call[0] as SentNotification)
+            .find(notification => notification.contactMethod.value === 'child@example.com');
+
+        expect(childEmail?.templateId).toBe('universal-inbox-claim');
+        expect(childEmail?.templateModel?.claimUrl).toBeTruthy();
+    });
+});

package/test/notificationMessages.spec.ts

@@ -45,6 +45,7 @@ const SUPPORTED_KEYS = [
     'credentialSuspendedUnnamed',
     'credentialRestoredNamed',
     'credentialRestoredUnnamed',
+    'shareViewed',
 ] as NotificationMessageKey[];
 
 const LOCALES = ['en', 'es', 'fr', 'ar'];
@@ -72,6 +73,18 @@ describe('notificationMessages catalog', () => {
 });
 
 describe('getNotificationMessage — interpolation', () => {
+    it('localizes private-share view alerts in every supported locale', () => {
+        const titles = ['Share viewed', 'Enlace visto', 'Partage consulté', 'تمت مشاهدة المشاركة'];
+        for (const [index, locale] of LOCALES.entries()) {
+            const message = getNotificationMessage('shareViewed', locale, {
+                title: 'Career highlights',
+                count: '3',
+            });
+            expect(message.title).toBe(titles[index]);
+            expect(message.body).toContain('Career highlights');
+            expect(message.body).toContain('3');
+        }
+    });
     it.each([
         ['en', 'Ada claimed your credential — connect?'],
         ['es', 'Ada reclamó tu credencial. ¿Conectar?'],

package/test/openapi.spec.ts

@@ -32,6 +32,26 @@ describe('OpenAPI generation', () => {
         expect(Object.keys(openApiDocument.paths ?? {}).length).toBeGreaterThan(0);
     });
 
+    it('mounts the anonymous public share routes on paths distinct from the owner route', () => {
+        const paths = Object.keys(openApiDocument.paths ?? {});
+
+        // The import above would have thrown Duplicate procedure for the old
+        // colliding GET /share-links/{id} registration.
+        expect(paths.filter(path => path === '/share-links/{id}')).toHaveLength(1);
+        expect(paths).toContain('/public/share-links/{id}');
+        expect(paths).toContain('/public/share-links/{id}/content');
+        expect(paths).toContain('/public/share-links/acknowledge-view');
+    });
+
+    it('mounts the bounded owner list on GET /share-links, distinct from /share-links/{id}', () => {
+        const paths = Object.keys(openApiDocument.paths ?? {});
+
+        // A collection path with no trailing segment cannot be captured by the
+        // `{id}` param route, so /list -> /{id} shadowing is impossible.
+        expect(paths.filter(path => path === '/share-links')).toHaveLength(1);
+        expect(openApiDocument.paths?.['/share-links']?.get).toBeDefined();
+    });
+
     it('includes the skill-search route whose $regex query previously broke generation', () => {
         const paths = Object.keys(openApiDocument.paths ?? {});
 

package/test/presentations.spec.ts

@@ -2,6 +2,9 @@ import { vi } from 'vitest';
 import { getClient, getUser } from './helpers/getClient';
 import { testVp, sendPresentation } from './helpers/send';
 import { Profile, Credential, Presentation } from '@models';
+import * as Notifications from '@helpers/notifications.helpers';
+import { addNotificationToQueueSpy } from './helpers/spies';
+import { LCNNotificationTypeEnumValidator } from '@learncard/types';
 
 const noAuthClient = getClient();
 let userA: Awaited<ReturnType<typeof getUser>>;
@@ -13,6 +16,10 @@ describe('Presentations', () => {
         userA = await getUser();
         userB = await getUser('b'.repeat(64));
         userC = await getUser('c'.repeat(64));
+
+        vi.spyOn(Notifications, 'addNotificationToQueue').mockImplementation(
+            addNotificationToQueueSpy
+        );
     });
 
     describe('sendPresentation', () => {
@@ -22,6 +29,8 @@ describe('Presentations', () => {
             await Presentation.delete({ detach: true, where: {} });
             await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
             await userB.clients.fullAuth.profile.createProfile({ profileId: 'userb' });
+
+            addNotificationToQueueSpy.mockReset();
         });
 
         afterAll(async () => {
@@ -52,6 +61,25 @@ describe('Presentations', () => {
                     presentation: testVp,
                 })
             ).resolves.not.toThrow();
+
+            expect(addNotificationToQueueSpy).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    type: LCNNotificationTypeEnumValidator.enum.PRESENTATION_RECEIVED,
+                    to: expect.objectContaining({ profileId: 'userb' }),
+                    from: expect.objectContaining({ profileId: 'usera' }),
+                })
+            );
+        });
+
+        it('should not notify a profile when it sends a presentation to itself', async () => {
+            await expect(
+                userA.clients.fullAuth.presentation.sendPresentation({
+                    profileId: 'usera',
+                    presentation: testVp,
+                })
+            ).resolves.not.toThrow();
+
+            expect(addNotificationToQueueSpy).not.toHaveBeenCalled();
         });
 
         it('should allow sending a presentation to did:web', async () => {
@@ -137,7 +165,7 @@ describe('Presentations', () => {
             ).resolves.not.toThrow();
         });
 
-        it('should not allow accepting the same presentation twice', async () => {
+        it('should accept the same presentation idempotently', async () => {
             const uri = await userA.clients.fullAuth.presentation.sendPresentation({
                 profileId: 'userb',
                 presentation: testVp,
@@ -148,13 +176,14 @@ describe('Presentations', () => {
                 userB.clients.fullAuth.presentation.acceptPresentation({ uri })
             ).resolves.not.toThrow();
 
-            // Second acceptance should fail
+            // A retry after a lost response should also succeed without creating another edge.
             await expect(
                 userB.clients.fullAuth.presentation.acceptPresentation({ uri })
-            ).rejects.toMatchObject({
-                code: 'BAD_REQUEST',
-                message: expect.stringContaining('already been received'),
-            });
+            ).resolves.not.toThrow();
+
+            await expect(
+                userB.clients.fullAuth.presentation.receivedPresentations()
+            ).resolves.toHaveLength(1);
         });
     });
 
@@ -228,6 +257,25 @@ describe('Presentations', () => {
             vi.useRealTimers();
         });
 
+        it('should preserve presentation metadata after acceptance', async () => {
+            const metadata = {
+                type: 'learncard.share-link.v1',
+                shareId: 'AAAAAAAAAAAAAAAAAAAAAA',
+                title: 'Career highlights',
+                sharer: { profileId: 'usera', displayName: 'User A' },
+            };
+            const uri = await userA.clients.fullAuth.presentation.sendPresentation({
+                profileId: 'userb',
+                presentation: testVp,
+                metadata,
+            });
+
+            await userB.clients.fullAuth.presentation.acceptPresentation({ uri });
+
+            const presentations = await userB.clients.fullAuth.presentation.receivedPresentations();
+            expect(presentations[0]?.metadata).toEqual(metadata);
+        });
+
         it('should allow filtering received presentations by who sent them', async () => {
             await userC.clients.fullAuth.profile.createProfile({ profileId: 'userc' });
 

package/test/profiles.spec.ts

@@ -5,7 +5,15 @@ import {
     ProfileVisibilityEnum,
 } from '@learncard/types';
 import { getClient, getUser } from './helpers/getClient';
-import { Profile, SigningAuthority, Credential, Boost, ClaimHook, ContactMethod } from '@models';
+import {
+    Profile,
+    ProfileManager,
+    SigningAuthority,
+    Credential,
+    Boost,
+    ClaimHook,
+    ContactMethod,
+} from '@models';
 import cache from '@cache';
 import { testVc, sendBoost, testVp, testUnsignedBoost } from './helpers/send';
 
@@ -28,6 +36,30 @@ describe('Profiles', () => {
         userC = await getUser('c'.repeat(64));
     });
 
+    describe('createManagedProfile', () => {
+        beforeEach(async () => {
+            await ProfileManager.delete({ detach: true, where: {} });
+            await Profile.delete({ detach: true, where: {} });
+            await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
+        });
+
+        afterAll(async () => {
+            await ProfileManager.delete({ detach: true, where: {} });
+            await Profile.delete({ detach: true, where: {} });
+        });
+
+        it('should reserve sample persona profileIds', async () => {
+            const managerDid = await userA.clients.fullAuth.profileManager.createProfileManager({});
+            const managerClient = getClient({ did: managerDid, isChallengeValid: true });
+
+            await expect(
+                managerClient.profileManager.createManagedProfile({
+                    profileId: 'Sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+    });
+
     describe('createProfile', () => {
         beforeEach(async () => {
             await Profile.delete({ detach: true, where: {} });
@@ -63,6 +95,14 @@ describe('Profiles', () => {
             ).rejects.toThrow();
         });
 
+        it('should reserve sample persona profileIds', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.createProfile({
+                    profileId: 'Sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should not allow creating a profile with an email that has already been taken', async () => {
             await expect(
                 userA.clients.fullAuth.profile.createProfile({
@@ -387,6 +427,14 @@ describe('Profiles', () => {
             ).rejects.toThrow();
         });
 
+        it('should reserve sample persona profileIds', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.createServiceProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should not allow creating a profile with an email that has already been taken', async () => {
             await expect(
                 userA.clients.fullAuth.profile.createServiceProfile({
@@ -490,6 +538,16 @@ describe('Profiles', () => {
                 })
             ).resolves.not.toThrow();
         });
+
+        it('should reserve sample persona profileIds', async () => {
+            await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
+
+            await expect(
+                userA.clients.fullAuth.profile.createManagedServiceProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
     });
 
     describe('getManagedServiceProfile', () => {
@@ -1255,6 +1313,14 @@ describe('Profiles', () => {
             ).rejects.toMatchObject({ code: 'CONFLICT' });
         });
 
+        it('should not allow changing a profileId to the sample persona namespace', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.updateProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should allow you to update your email', async () => {
             await expect(
                 userA.clients.fullAuth.profile.updateProfile({ email: 'nice@test.com' })