@learncard/network-brain-service 3.19.0 → 4.0.0

package/test/managed-recipient-inbox.spec.ts

@@ -0,0 +1,152 @@
+import { vi, describe, it, expect, beforeEach, afterAll, beforeAll } from 'vitest';
+import { getClient, getUser } from './helpers/getClient';
+import { testUnsignedBoost } from './helpers/send';
+import {
+    Profile,
+    InboxCredential,
+    ContactMethod,
+    SigningAuthority,
+    Boost,
+    ProfileManager,
+} from '@models';
+import { createContactMethod } from '@accesslayer/contact-method/create';
+import { createProfileContactMethodRelationship } from '@accesslayer/contact-method/relationships/create';
+import { sendSpy } from './helpers/spies';
+
+vi.mock('@services/delivery/delivery.factory', () => ({
+    getDeliveryService: () => ({ send: sendSpy }),
+}));
+
+type SentNotification = {
+    contactMethod: { value: string };
+    templateId: string;
+    templateModel?: { claimUrl?: string };
+};
+
+let userA: Awaited<ReturnType<typeof getUser>>;
+
+const clearDb = async (): Promise<void> => {
+    await ProfileManager.delete({ detach: true, where: {} });
+    await Profile.delete({ detach: true, where: {} });
+    await InboxCredential.delete({ detach: true, where: {} });
+    await ContactMethod.delete({ detach: true, where: {} });
+    await SigningAuthority.delete({ detach: true, where: {} });
+    await Boost.delete({ detach: true, where: {} });
+};
+
+const createManagedRecipient = async (
+    profileId: string,
+    email: string,
+    isServiceProfile: boolean,
+    parentCategory = isServiceProfile ? 'ID' : 'Family',
+    profileType?: string
+): Promise<void> => {
+    const boostUri = await userA.clients.fullAuth.boost.createBoost({
+        credential: testUnsignedBoost,
+        category: parentCategory,
+    });
+    const managerDid = await userA.clients.fullAuth.profileManager.createChildProfileManager({
+        parentUri: boostUri,
+        profile: {},
+    });
+    const managerClient = getClient({ did: managerDid, isChallengeValid: true });
+    await managerClient.profileManager.createManagedProfile({
+        profileId,
+        displayName: profileId,
+        isServiceProfile,
+        ...(profileType ? { type: profileType } : {}),
+    });
+
+    const contactMethod = await createContactMethod({
+        type: 'email',
+        value: email,
+        isVerified: true,
+        isPrimary: true,
+    });
+    await createProfileContactMethodRelationship(profileId, contactMethod.id);
+};
+
+const sendTo = async (recipient: string) => {
+    const signedVc = await userA.learnCard.invoke.issueCredential({
+        ...testUnsignedBoost,
+        issuer: userA.learnCard.id.did(),
+    });
+
+    return userA.clients.fullAuth.boost.send({
+        type: 'boost',
+        recipient,
+        template: { credential: testUnsignedBoost },
+        signedCredential: signedVc,
+    });
+};
+
+describe('Inbox send to managed recipients', () => {
+    beforeAll(async () => {
+        userA = await getUser('a'.repeat(64));
+    });
+
+    beforeEach(async () => {
+        sendSpy.mockClear();
+        await clearDb();
+        await userA.clients.fullAuth.profile.createProfile({
+            profileId: 'usera',
+            displayName: 'User A',
+        });
+    });
+
+    afterAll(async () => {
+        sendSpy.mockClear();
+        await clearDb();
+    });
+
+    it.each([
+        { parentCategory: 'Family', profileType: undefined },
+        { parentCategory: 'ID', profileType: 'child' },
+    ])(
+        'rejects a service flag for child creation through $parentCategory / $profileType',
+        async ({ parentCategory, profileType }) => {
+            await expect(
+                createManagedRecipient(
+                    'service-child',
+                    'child@example.com',
+                    true,
+                    parentCategory,
+                    profileType
+                )
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+            expect(await Profile.findMany({ where: { profileId: 'service-child' } })).toEqual([]);
+        }
+    );
+
+    it('delivers directly to a managed service profile without a guardian gate', async () => {
+        await createManagedRecipient('managed-org', 'org@example.com', true);
+
+        const result = await sendTo('org@example.com');
+
+        expect(result.inbox?.status).toBe('ISSUED');
+        expect(result.inbox?.guardianStatus).toBeUndefined();
+
+        const credentials = await InboxCredential.findMany({ where: {} });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0]!.guardianStatus).toBeFalsy();
+    });
+
+    it('gates a managed child and sends the claim email with a valid template', async () => {
+        await createManagedRecipient('managed-child', 'child@example.com', false);
+
+        const result = await sendTo('child@example.com');
+
+        expect(result.inbox?.status).toBe('PENDING');
+
+        const credentials = await InboxCredential.findMany({ where: {} });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0]!.guardianStatus).toBe('AWAITING_GUARDIAN');
+
+        const childEmail = sendSpy.mock.calls
+            .map(call => call[0] as SentNotification)
+            .find(notification => notification.contactMethod.value === 'child@example.com');
+
+        expect(childEmail?.templateId).toBe('universal-inbox-claim');
+        expect(childEmail?.templateModel?.claimUrl).toBeTruthy();
+    });
+});

package/test/notificationMessages.spec.ts

@@ -45,6 +45,7 @@ const SUPPORTED_KEYS = [
     'credentialSuspendedUnnamed',
     'credentialRestoredNamed',
     'credentialRestoredUnnamed',
+    'shareViewed',
 ] as NotificationMessageKey[];
 
 const LOCALES = ['en', 'es', 'fr', 'ar'];
@@ -72,6 +73,18 @@ describe('notificationMessages catalog', () => {
 });
 
 describe('getNotificationMessage — interpolation', () => {
+    it('localizes private-share view alerts in every supported locale', () => {
+        const titles = ['Share viewed', 'Enlace visto', 'Partage consulté', 'تمت مشاهدة المشاركة'];
+        for (const [index, locale] of LOCALES.entries()) {
+            const message = getNotificationMessage('shareViewed', locale, {
+                title: 'Career highlights',
+                count: '3',
+            });
+            expect(message.title).toBe(titles[index]);
+            expect(message.body).toContain('Career highlights');
+            expect(message.body).toContain('3');
+        }
+    });
     it.each([
         ['en', 'Ada claimed your credential — connect?'],
         ['es', 'Ada reclamó tu credencial. ¿Conectar?'],

package/test/openapi.spec.ts

@@ -1,10 +1,9 @@
 import {
+    AllocateCredentialRefreshInputValidator,
     PublishCredentialRefreshInputValidator,
     SendBoostResponseValidator,
 } from '@learncard/types';
 
-import { openApiDocument } from '../src/openapi';
-
 const unsignedCredential = {
     '@context': ['https://www.w3.org/ns/credentials/v2'],
     type: ['VerifiableCredential'],
@@ -23,59 +22,21 @@ const signedCredential = {
     },
 };
 
-// The import itself is the test: `src/openapi.ts` calls generateOpenApiDocument
-// at module load, so a Zod 4 / trpc-to-openapi regression throws here instead of
-// at Lambda cold start.
-describe('OpenAPI generation', () => {
-    it('generates the document at boot without throwing', () => {
-        expect(openApiDocument).toBeDefined();
-        expect(Object.keys(openApiDocument.paths ?? {}).length).toBeGreaterThan(0);
-    });
-
-    it('includes the skill-search route whose $regex query previously broke generation', () => {
-        const paths = Object.keys(openApiDocument.paths ?? {});
-
-        expect(paths).toContain('/boost/skills/search');
-    });
-
-    it('exposes a root-relative server URL that resolves on any tenant domain', () => {
-        expect(openApiDocument.servers?.[0]?.url).toBe('/api');
-    });
-
-    it('documents the mutually exclusive managed refresh publication modes', () => {
-        const operation = openApiDocument.paths?.['/credential-refresh/publish']?.post;
-        const requestBody = operation?.requestBody;
-
-        expect(requestBody).toBeDefined();
-        expect(typeof requestBody).toBe('object');
-
-        const content = requestBody && !('$ref' in requestBody) ? requestBody.content : undefined;
-        const schema = content?.['application/json']?.schema;
-        const oneOf = schema && !('$ref' in schema) ? schema.oneOf : undefined;
-
-        expect(oneOf).toEqual([
-            expect.objectContaining({
-                properties: { mode: { const: 'issuer-signed' } },
-                required: ['signedCredential'],
-                not: {
-                    anyOf: [{ required: ['credential'] }, { required: ['signingAuthority'] }],
-                },
-            }),
-            expect.objectContaining({
-                properties: { mode: { const: 'signing-authority' } },
-                required: ['credential', 'signingAuthority'],
-                not: { required: ['signedCredential'] },
-            }),
-        ]);
+describe('Managed credential refresh contracts', () => {
+    it.each([
+        ['DID-only holder', { did: 'did:example:holder' }, true],
+        ['string profile ID', { did: 'did:example:holder', profileId: 'synthetic-profile' }, true],
+        ['explicit null profile ID', { did: 'did:example:holder', profileId: null }, false],
+    ])('preserves the optional-but-nonnullable allocation contract: %s', (_name, holder, valid) => {
+        const result = AllocateCredentialRefreshInputValidator.safeParse({
+            credentialId: 'urn:uuid:synthetic-credential',
+            holder,
+        });
+        expect(result.success).toBe(valid);
+        if (result.success) expect(result.data.holder).toEqual(holder);
     });
 
-    it('documents the unified send route with the refresh receipt in its response schema', () => {
-        const paths = openApiDocument.paths ?? {};
-
-        expect(paths['/send']).toBeDefined();
-
-        // The managed receipt must survive response schema generation: the schema is
-        // derived from SendBoostResponseValidator, which carries the optional receipt.
+    it('strips credential contents from issuance receipts', () => {
         const response = SendBoostResponseValidator.safeParse({
             type: 'boost',
             uri: 'https://localhost%3A3000/boost/abc',

package/test/presentations.spec.ts

@@ -2,6 +2,9 @@ import { vi } from 'vitest';
 import { getClient, getUser } from './helpers/getClient';
 import { testVp, sendPresentation } from './helpers/send';
 import { Profile, Credential, Presentation } from '@models';
+import * as Notifications from '@helpers/notifications.helpers';
+import { addNotificationToQueueSpy } from './helpers/spies';
+import { LCNNotificationTypeEnumValidator } from '@learncard/types';
 
 const noAuthClient = getClient();
 let userA: Awaited<ReturnType<typeof getUser>>;
@@ -13,6 +16,10 @@ describe('Presentations', () => {
         userA = await getUser();
         userB = await getUser('b'.repeat(64));
         userC = await getUser('c'.repeat(64));
+
+        vi.spyOn(Notifications, 'addNotificationToQueue').mockImplementation(
+            addNotificationToQueueSpy
+        );
     });
 
     describe('sendPresentation', () => {
@@ -22,6 +29,8 @@ describe('Presentations', () => {
             await Presentation.delete({ detach: true, where: {} });
             await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
             await userB.clients.fullAuth.profile.createProfile({ profileId: 'userb' });
+
+            addNotificationToQueueSpy.mockReset();
         });
 
         afterAll(async () => {
@@ -52,6 +61,25 @@ describe('Presentations', () => {
                     presentation: testVp,
                 })
             ).resolves.not.toThrow();
+
+            expect(addNotificationToQueueSpy).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    type: LCNNotificationTypeEnumValidator.enum.PRESENTATION_RECEIVED,
+                    to: expect.objectContaining({ profileId: 'userb' }),
+                    from: expect.objectContaining({ profileId: 'usera' }),
+                })
+            );
+        });
+
+        it('should not notify a profile when it sends a presentation to itself', async () => {
+            await expect(
+                userA.clients.fullAuth.presentation.sendPresentation({
+                    profileId: 'usera',
+                    presentation: testVp,
+                })
+            ).resolves.not.toThrow();
+
+            expect(addNotificationToQueueSpy).not.toHaveBeenCalled();
         });
 
         it('should allow sending a presentation to did:web', async () => {
@@ -137,7 +165,7 @@ describe('Presentations', () => {
             ).resolves.not.toThrow();
         });
 
-        it('should not allow accepting the same presentation twice', async () => {
+        it('should accept the same presentation idempotently', async () => {
             const uri = await userA.clients.fullAuth.presentation.sendPresentation({
                 profileId: 'userb',
                 presentation: testVp,
@@ -148,13 +176,14 @@ describe('Presentations', () => {
                 userB.clients.fullAuth.presentation.acceptPresentation({ uri })
             ).resolves.not.toThrow();
 
-            // Second acceptance should fail
+            // A retry after a lost response should also succeed without creating another edge.
             await expect(
                 userB.clients.fullAuth.presentation.acceptPresentation({ uri })
-            ).rejects.toMatchObject({
-                code: 'BAD_REQUEST',
-                message: expect.stringContaining('already been received'),
-            });
+            ).resolves.not.toThrow();
+
+            await expect(
+                userB.clients.fullAuth.presentation.receivedPresentations()
+            ).resolves.toHaveLength(1);
         });
     });
 
@@ -228,6 +257,25 @@ describe('Presentations', () => {
             vi.useRealTimers();
         });
 
+        it('should preserve presentation metadata after acceptance', async () => {
+            const metadata = {
+                type: 'learncard.share-link.v1',
+                shareId: 'AAAAAAAAAAAAAAAAAAAAAA',
+                title: 'Career highlights',
+                sharer: { profileId: 'usera', displayName: 'User A' },
+            };
+            const uri = await userA.clients.fullAuth.presentation.sendPresentation({
+                profileId: 'userb',
+                presentation: testVp,
+                metadata,
+            });
+
+            await userB.clients.fullAuth.presentation.acceptPresentation({ uri });
+
+            const presentations = await userB.clients.fullAuth.presentation.receivedPresentations();
+            expect(presentations[0]?.metadata).toEqual(metadata);
+        });
+
         it('should allow filtering received presentations by who sent them', async () => {
             await userC.clients.fullAuth.profile.createProfile({ profileId: 'userc' });
 

package/test/profiles.spec.ts

@@ -5,7 +5,15 @@ import {
     ProfileVisibilityEnum,
 } from '@learncard/types';
 import { getClient, getUser } from './helpers/getClient';
-import { Profile, SigningAuthority, Credential, Boost, ClaimHook, ContactMethod } from '@models';
+import {
+    Profile,
+    ProfileManager,
+    SigningAuthority,
+    Credential,
+    Boost,
+    ClaimHook,
+    ContactMethod,
+} from '@models';
 import cache from '@cache';
 import { testVc, sendBoost, testVp, testUnsignedBoost } from './helpers/send';
 
@@ -28,6 +36,30 @@ describe('Profiles', () => {
         userC = await getUser('c'.repeat(64));
     });
 
+    describe('createManagedProfile', () => {
+        beforeEach(async () => {
+            await ProfileManager.delete({ detach: true, where: {} });
+            await Profile.delete({ detach: true, where: {} });
+            await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
+        });
+
+        afterAll(async () => {
+            await ProfileManager.delete({ detach: true, where: {} });
+            await Profile.delete({ detach: true, where: {} });
+        });
+
+        it('should reserve sample persona profileIds', async () => {
+            const managerDid = await userA.clients.fullAuth.profileManager.createProfileManager({});
+            const managerClient = getClient({ did: managerDid, isChallengeValid: true });
+
+            await expect(
+                managerClient.profileManager.createManagedProfile({
+                    profileId: 'Sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+    });
+
     describe('createProfile', () => {
         beforeEach(async () => {
             await Profile.delete({ detach: true, where: {} });
@@ -63,6 +95,14 @@ describe('Profiles', () => {
             ).rejects.toThrow();
         });
 
+        it('should reserve sample persona profileIds', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.createProfile({
+                    profileId: 'Sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should not allow creating a profile with an email that has already been taken', async () => {
             await expect(
                 userA.clients.fullAuth.profile.createProfile({
@@ -387,6 +427,14 @@ describe('Profiles', () => {
             ).rejects.toThrow();
         });
 
+        it('should reserve sample persona profileIds', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.createServiceProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should not allow creating a profile with an email that has already been taken', async () => {
             await expect(
                 userA.clients.fullAuth.profile.createServiceProfile({
@@ -490,6 +538,16 @@ describe('Profiles', () => {
                 })
             ).resolves.not.toThrow();
         });
+
+        it('should reserve sample persona profileIds', async () => {
+            await userA.clients.fullAuth.profile.createProfile({ profileId: 'usera' });
+
+            await expect(
+                userA.clients.fullAuth.profile.createManagedServiceProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
     });
 
     describe('getManagedServiceProfile', () => {
@@ -1255,6 +1313,14 @@ describe('Profiles', () => {
             ).rejects.toMatchObject({ code: 'CONFLICT' });
         });
 
+        it('should not allow changing a profileId to the sample persona namespace', async () => {
+            await expect(
+                userA.clients.fullAuth.profile.updateProfile({
+                    profileId: 'sample-college-board',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        });
+
         it('should allow you to update your email', async () => {
             await expect(
                 userA.clients.fullAuth.profile.updateProfile({ email: 'nice@test.com' })
@@ -1281,6 +1347,36 @@ describe('Profiles', () => {
             ).resolves.not.toThrow();
         });
 
+        it('does not allow a legacy service-flagged child to change its type', async () => {
+            await Profile.update(
+                { type: 'child', isServiceProfile: true },
+                { where: { profileId: 'usera' } }
+            );
+
+            await expect(
+                userA.clients.fullAuth.profile.updateProfile({
+                    type: 'adult',
+                    profileId: 'escaped-child',
+                    displayName: 'Escaped',
+                })
+            ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+
+            await expect(userA.clients.fullAuth.profile.getProfile()).resolves.toMatchObject({
+                profileId: 'usera',
+                type: 'child',
+                isServiceProfile: true,
+            });
+            await userA.clients.fullAuth.profile.updateProfile({
+                type: 'child',
+                displayName: 'Updated child',
+            });
+            await expect(userA.clients.fullAuth.profile.getProfile()).resolves.toMatchObject({
+                type: 'child',
+                isServiceProfile: true,
+                displayName: 'Updated child',
+            });
+        });
+
         it('should allow you to update your profile image', async () => {
             await expect(
                 userA.clients.fullAuth.profile.updateProfile({