@learncard/network-brain-service 3.19.1 → 4.0.0

package/test/share-link-lifecycle.neo4j.spec.ts

@@ -1,10 +1,16 @@
 import { randomBytes } from 'node:crypto';
 
+import {
+    consumeShareViewReceipt,
+    persistShareViewReceipt,
+} from '../src/accesslayer/share-link/receipt';
+
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 import { v4 as uuid } from 'uuid';
 
 import { computeShareLinkRequestHash } from '@helpers/share-link-lifecycle';
 import { neogma } from '@instance';
+import { withShareLinkRead } from '../src/accesslayer/share-link/transaction';
 
 import {
     abandonReservation,
@@ -23,7 +29,12 @@ import {
 import { ensureShareLinkConstraints } from '../src/models/share-link-constraints';
 import { toOwnerShareLink } from '../src/helpers/share-link-owner-projection';
 import type { ShareLinkPolicySnapshot } from '../src/helpers/share-link-policy/types';
-import { resolveCurrentShareLinkPolicy } from '../src/helpers/share-link-policy/production';
+import {
+    createProductionShareLinkPolicySource,
+    productionShareViewEligibilitySource,
+    resolveCurrentShareLinkPolicy,
+} from '../src/helpers/share-link-policy/production';
+import { createShareLinkPolicyResolver } from '../src/helpers/share-link-policy/resolver';
 import type { ShareLinkRecord } from '../src/models/ShareLink';
 
 import {
@@ -782,7 +793,7 @@ describe('share-link lifecycle repository (Neo4j)', () => {
 
         const protectedShare = await finalizeReservation({
             ...protect.reservation,
-            resolveCurrentPolicy: async () => policy,
+            resolveCurrentPolicy: async () => ({ ...policy, isServiceProfile: false }),
             now: NOW,
         });
         if (protectedShare.outcome !== 'finalized') throw new Error('expected protected share');
@@ -1265,4 +1276,136 @@ describe('share-link lifecycle repository (Neo4j)', () => {
             );
         }
     });
+
+    it('exempts managed service owners but keeps managed child owners restricted in Neo4j', async () => {
+        const serviceProfileId = `service-policy-${uuid()}`;
+        const childProfileId = `child-policy-${uuid()}`;
+        const unknownServiceId = `service-unknown-${uuid()}`;
+        const serviceManagerId = `manager-${uuid()}`;
+        const childManagerId = `manager-${uuid()}`;
+        await neogma.queryRunner.run(
+            `CREATE (service:Profile {profileId: $serviceId, isServiceProfile: true})
+             CREATE (serviceManager:ProfileManager {id: $serviceManagerId, created: $created})
+             CREATE (serviceManager)-[:MANAGES]->(service)
+             CREATE (child:Profile {profileId: $childId, dob: '1990-01-01', isServiceProfile: false})
+             CREATE (child)-[:MANAGED_BY]->(guardian:Profile {profileId: $childManagerId})
+             CREATE (serviceManager)-[:ADMINISTRATED_BY]->(guardian)
+             CREATE (:Profile {profileId: $unknownServiceId, isServiceProfile: true})`,
+            {
+                serviceId: serviceProfileId,
+                serviceManagerId,
+                childId: childProfileId,
+                childManagerId,
+                unknownServiceId,
+                created: NOW.toISOString(),
+            }
+        );
+        try {
+            const shareId = nextShareId();
+            const requestId = uuid();
+            const policy: ShareLinkPolicySnapshot = {
+                isMinor: false,
+                policyResolved: true,
+                defaultExpiryDays: 365,
+                viewCountingEnabled: true,
+            };
+            const reserved = await reserveCreate({
+                namespace: NAMESPACE,
+                ownerProfileId: serviceProfileId,
+                clientRequestId: requestId,
+                shareId,
+                title: 'Service policy integration',
+                note: null,
+                expiresAt: null,
+                selectedCount: 1,
+                content: contentBinding(shareId),
+                requestHash: computeShareLinkRequestHash('create', {
+                    id: shareId,
+                    title: 'Service policy integration',
+                }),
+                leaseOwner: 'worker-1',
+                policy,
+                now: NOW,
+            });
+            if (reserved.outcome !== 'reserved' || !reserved.reservation.objectRef) {
+                throw new Error('expected service share reservation');
+            }
+            const finalized = await finalizeReservation({
+                ...reserved.reservation,
+                resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                now: NOW,
+            });
+            const created = {
+                namespace: NAMESPACE,
+                shareId,
+                committed: finalized.share,
+                objectRef: reserved.reservation.objectRef,
+                operationId: reserved.reservation.operationId,
+            };
+            const preflight = createShareLinkPolicyResolver(
+                createProductionShareLinkPolicySource()
+            );
+            expect((await preflight.resolve(serviceProfileId)).viewCountingEnabled).toBe(true);
+            expect((await preflight.resolve(childProfileId)).viewCountingEnabled).toBe(false);
+            expect((await preflight.resolve(unknownServiceId)).viewCountingEnabled).toBe(true);
+            expect(
+                await withShareLinkRead(tx =>
+                    resolveCurrentShareLinkPolicy(tx, serviceProfileId, NOW)
+                )
+            ).toMatchObject({ viewCountingEnabled: true });
+            const receipt = randomBytes(32).toString('base64url');
+            expect(
+                await persistShareViewReceipt({
+                    receipt,
+                    namespace: created.namespace,
+                    ownerProfileId: serviceProfileId,
+                    shareId: created.shareId,
+                    shareVersion: created.committed.version,
+                    contentVersion: created.committed.contentVersion,
+                    objectRef: created.objectRef,
+                    operationId: created.operationId,
+                    ttlSeconds: 60,
+                    eligibilitySource: productionShareViewEligibilitySource,
+                    now: () => NOW,
+                })
+            ).toBe(true);
+            expect(
+                await consumeShareViewReceipt({
+                    receipt,
+                    namespace: created.namespace,
+                    eligibilitySource: productionShareViewEligibilitySource,
+                    now: () => NOW,
+                })
+            ).toBe('consumed');
+            const counted = await neogma.queryRunner.run(
+                'MATCH (s:ShareLink {id: $shareId}) RETURN s.viewCount AS viewCount',
+                { shareId: created.shareId }
+            );
+            expect(Number(counted.records[0]?.get('viewCount'))).toBe(1);
+            expect(
+                await withShareLinkRead(tx =>
+                    resolveCurrentShareLinkPolicy(tx, childProfileId, NOW)
+                )
+            ).toMatchObject({ viewCountingEnabled: false });
+            expect(
+                await withShareLinkRead(tx =>
+                    resolveCurrentShareLinkPolicy(tx, unknownServiceId, NOW)
+                )
+            ).toMatchObject({ viewCountingEnabled: true });
+        } finally {
+            await neogma.queryRunner.run(
+                `MATCH (n)
+                 WHERE (n:Profile AND n.profileId IN [$serviceId, $childId, $unknownServiceId, $childManagerId])
+                    OR (n:ProfileManager AND n.id = $serviceManagerId)
+                 DETACH DELETE n`,
+                {
+                    serviceId: serviceProfileId,
+                    childId: childProfileId,
+                    unknownServiceId,
+                    serviceManagerId,
+                    childManagerId,
+                }
+            );
+        }
+    });
 });

package/test/share-link-maintenance.unit.spec.ts

@@ -81,10 +81,11 @@ const makeCleanupRepository = (
 
 const makeDeleteClient = (
     result: unknown = { ok: true, value: {} }
-): CleanupRunnerDependencies['client'] =>
+): Parameters<typeof runShareLinkMaintenancePass>[0]['client'] =>
     ({
         delete: vi.fn().mockResolvedValue(result),
-    }) as unknown as CleanupRunnerDependencies['client'];
+        stat: vi.fn().mockResolvedValue({ ok: false, error: 'NOT_FOUND' }),
+    }) as Parameters<typeof runShareLinkMaintenancePass>[0]['client'];
 
 const makeRecoveryRepository = (): RecoveryRunnerDependencies['repository'] =>
     ({
@@ -307,6 +308,31 @@ describe('share-link maintenance pass', () => {
         expect(summary.categories).toEqual({});
     });
 
+    it('runs bounded attachment stage collection and reports a safe failure for retry', async () => {
+        const config = enabledConfig();
+        const now = new Date(NOW_ISO);
+        const expireAttachmentStages = vi.fn().mockResolvedValue(3);
+        const dependencies = {
+            ...runnerDependencies(config, { expireAttachmentStages, now: () => now }),
+            client: makeDeleteClient(),
+        };
+        const summary = await runShareLinkMaintenancePass(dependencies);
+        expect(expireAttachmentStages).toHaveBeenCalledWith({
+            namespace: NAMESPACE,
+            limit: 10,
+            now,
+            transaction: { timeoutMs: config.graphTimeoutMs, noInlineRetry: true },
+        });
+        expect(summary.attachmentStages).toEqual({ queued: 3 });
+        expireAttachmentStages.mockRejectedValueOnce(new Error('raw private detail'));
+        const failed = await runShareLinkMaintenancePass(dependencies);
+        expect(failed.status).toBe('failed');
+        expect(failed.categories).toMatchObject({
+            share_link_maintenance_attachment_stage_failed: 1,
+        });
+        expect(JSON.stringify(toMaintenanceLogEvent(failed))).not.toContain('raw private detail');
+    });
+
     it('does not start receipt pruning when the graph budget is exhausted', async () => {
         let clock = 0;
         // budget 1000ms, reserve 100ms. Recovery discovery needs 500ms and cleanup
@@ -727,6 +753,7 @@ describe('C7 independent review regressions', () => {
             client,
             logger: silentLogger,
             remainingTimeMs: () => 6_000,
+            pruneReceipts: vi.fn().mockResolvedValue(0),
         });
         expect(summary.status).toBe('deadline_exhausted');
         expect(cleanupRepository.claimCleanupJobs).not.toHaveBeenCalled();
@@ -1034,14 +1061,14 @@ describe('C7a dependency setup caching', () => {
 
 describe('C7a scheduler terminal stop and synchronous failure', () => {
     it('does not run a queued timer callback after stop', async () => {
-        let queued: (() => void) | null = null;
+        const timer: { queued: (() => void) | null } = { queued: null };
         const runOnce = vi.fn().mockResolvedValue(undefined);
         const scheduler = createShareLinkMaintenanceScheduler({
             runOnce,
             intervalMs: 1_000,
             logger: silentLogger,
             setTimeoutFn: handler => {
-                queued = handler;
+                timer.queued = handler;
                 return 1;
             },
             clearTimeoutFn: () => undefined,
@@ -1051,7 +1078,7 @@ describe('C7a scheduler terminal stop and synchronous failure', () => {
         await scheduler.stop();
 
         // Simulate a timer callback that was already queued when stop ran.
-        queued?.();
+        timer.queued?.();
         await Promise.resolve();
         await Promise.resolve();
 

package/test/share-link-owner-route.unit.spec.ts

@@ -220,6 +220,72 @@ beforeEach(() => {
     recoveryRunner.recoverShareLinkOperation.mockReset();
 });
 
+describe('owner attachment route authorization', () => {
+    const input = {
+        id: SHARE_ID,
+        contentVersion: 1,
+        attachmentId: OPERATION_ID,
+        chunkIndex: 0,
+        chunkCount: 1,
+        envelope,
+        ownerEncryptedRecovery: recovery,
+    };
+    const setup = () => ({
+        ...makeDependencies(),
+        attachments: {
+            put: vi.fn(async () => ({ ok: true as const })),
+            delete: vi.fn(async () => ({ ok: true })),
+        },
+    });
+    it('requires authenticated profile and write scope before any staging', async () => {
+        const dependencies = setup();
+        for (const user of [
+            undefined,
+            { ...authenticatedUser, isChallengeValid: false },
+            { ...authenticatedUser, scope: AUTH_GRANT_SHARE_LINKS_READ_SCOPE },
+        ]) {
+            await expect(
+                makeCaller(dependencies, { user }).putAttachmentChunk(input)
+            ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        }
+        expect(dependencies.attachments.put).not.toHaveBeenCalled();
+        await expect(makeCaller(dependencies).putAttachmentChunk(input)).resolves.toEqual({
+            ok: true,
+        });
+        expect(dependencies.attachments.put).toHaveBeenCalledWith(input, {
+            namespace: NAME,
+            ownerProfileId: OWNER_PROFILE.profileId,
+        });
+    });
+    it('rejects arbitrary tuples and overlarge chunks before staging', async () => {
+        const dependencies = setup();
+        await expect(
+            makeCaller(dependencies).putAttachmentChunk({
+                ...input,
+                namespace: 'arbitrary',
+            } as never)
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        await expect(
+            makeCaller(dependencies).putAttachmentChunk({
+                ...input,
+                envelope: { ...envelope, ct: Buffer.alloc(256 * 1024 + 17).toString('base64url') },
+            })
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect(dependencies.attachments.put).not.toHaveBeenCalled();
+    });
+    it('derives cleanup owner and passes only the validated exact stage key', async () => {
+        const dependencies = setup();
+        const key = { id: SHARE_ID, contentVersion: 1, attachmentId: OPERATION_ID, chunkCount: 1 };
+        await expect(makeCaller(dependencies).deleteAttachmentChunks(key)).resolves.toEqual({
+            ok: true,
+        });
+        expect(dependencies.attachments.delete).toHaveBeenCalledWith(key, {
+            namespace: NAME,
+            ownerProfileId: OWNER_PROFILE.profileId,
+        });
+    });
+});
+
 describe.each([
     ['standard', profileRoute],
     ['private input', profileRouteWithoutInputCapture],
@@ -678,7 +744,8 @@ describe('share-link owner route boundary', () => {
             );
 
             const result = await caller.list({ limit: 25 });
-            const record = result.records[0];
+            expect(result.records).toHaveLength(1);
+            const record = result.records[0]!;
 
             expect(resolveViewCountingEligibility).toHaveBeenCalledTimes(1);
             expect(record).not.toHaveProperty('activeObjectRef');
@@ -708,8 +775,9 @@ describe('share-link owner route boundary', () => {
 
             const result = await caller.list({ limit: 25 });
 
+            expect(result.records).toHaveLength(1);
             expect(result.records[0]).not.toHaveProperty('viewCount');
-            expect(result.records[0].lastViewedAt).toBeNull();
+            expect(result.records[0]!.lastViewedAt).toBeNull();
         });
 
         it('maps a repository failure to a fixed safe error without leaking the cause', async () => {

package/test/share-link-policy.unit.spec.ts

@@ -42,13 +42,24 @@ describe('share-link policy decision table', () => {
         expect(composeShareLinkPolicy('unknown', false)).toEqual(DEFAULT_SHARE_LINK_POLICY);
         expect(composeShareLinkPolicy('unknown', true)).toEqual(DEFAULT_SHARE_LINK_POLICY);
     });
+
+    it.each(['unknown', 'minor'] as const)(
+        'allows service tracking with %s age without changing the expiry default',
+        age => {
+            expect(composeShareLinkPolicy(age, true, true)).toEqual({
+                isMinor: false,
+                policyResolved: true,
+                defaultExpiryDays: 30,
+                viewCountingEnabled: true,
+            });
+        }
+    );
 });
 
 describe('createShareLinkPolicyResolver', () => {
     it('fails closed to the conservative default when a source throws', async () => {
         const resolver = createShareLinkPolicyResolver({
-            resolveOwnerAge: vi.fn().mockRejectedValue(new Error('age source down')),
-            isManaged: vi.fn().mockResolvedValue(false),
+            resolveOwner: vi.fn().mockRejectedValue(new Error('profile source down')),
         });
 
         await expect(resolver.resolve('owner-1')).resolves.toEqual(DEFAULT_SHARE_LINK_POLICY);
@@ -56,8 +67,11 @@ describe('createShareLinkPolicyResolver', () => {
 
     it('never returns an adult policy when the age source is unknown', async () => {
         const resolver = createShareLinkPolicyResolver({
-            resolveOwnerAge: vi.fn().mockResolvedValue('unknown'),
-            isManaged: vi.fn().mockResolvedValue(false),
+            resolveOwner: vi.fn().mockResolvedValue({
+                age: 'unknown',
+                isManaged: false,
+                isServiceProfile: false,
+            }),
         });
 
         const policy = await resolver.resolve('owner-1');

package/test/share-link-production-policy.unit.spec.ts

@@ -1,9 +1,11 @@
-import { describe, expect, it, vi } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 vi.mock('@accesslayer/profile/read', () => ({ getProfileByProfileId: vi.fn() }));
 vi.mock('@accesslayer/profile/relationships/read', () => ({ isProfileManaged: vi.fn() }));
 vi.mock('@helpers/profile.helpers', () => ({
     transformProfileId: (id: string) => id.toLowerCase(),
+    isServiceProfileExemptFromGuardianship: (isServiceProfile: unknown, type: unknown) =>
+        isServiceProfile === true && type !== 'child',
 }));
 
 import {
@@ -15,6 +17,7 @@ import {
 import { getProfileByProfileId } from '@accesslayer/profile/read';
 import { isProfileManaged } from '@accesslayer/profile/relationships/read';
 import type { ShareLinkTransaction } from '@accesslayer/share-link/transaction';
+import { createShareLinkPolicyResolver } from '@helpers/share-link-policy/resolver';
 
 const NOW = new Date('2026-09-25T12:00:00.000Z');
 
@@ -22,13 +25,27 @@ const transactionWith = (profile?: {
     dob: unknown;
     type: unknown;
     isManaged: unknown;
+    isServiceProfile?: unknown;
 }): ShareLinkTransaction => ({
     run: vi.fn(async () => ({
-        records: profile ? [{ get: (key: string) => profile[key as keyof typeof profile] }] : [],
+        records: profile
+            ? [
+                  {
+                      get: (key: string) =>
+                          key === 'profileType'
+                              ? profile.type
+                              : profile[key as keyof typeof profile],
+                  },
+              ]
+            : [],
     })),
 });
 
 describe('production share-link age policy', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+    });
+
     it('requires a valid birthdate and an eighteenth birthday before allowing adulthood', () => {
         expect(ageFromPersistedProfile({ dob: '2008-09-25' }, NOW)).toBe('adult');
         expect(ageFromPersistedProfile({ dob: '2008-09-26' }, NOW)).toBe('minor');
@@ -43,16 +60,48 @@ describe('production share-link age policy', () => {
         vi.mocked(getProfileByProfileId).mockResolvedValueOnce({ dob: '1990-01-01' } as never);
         vi.mocked(isProfileManaged).mockResolvedValueOnce(false);
 
-        const source = createProductionShareLinkPolicySource();
-        expect(await source.resolveOwnerAge('owner')).toBe('adult');
-        expect(await source.isManaged('owner')).toBe(false);
-        expect(getProfileByProfileId).toHaveBeenCalledWith('owner');
+        const resolver = createShareLinkPolicyResolver(createProductionShareLinkPolicySource());
+        expect((await resolver.resolve('owner')).viewCountingEnabled).toBe(true);
     });
+    it.each([
+        { dob: undefined, type: undefined, isServiceProfile: true, eligible: true },
+        { dob: 'not-a-date', type: undefined, isServiceProfile: true, eligible: true },
+        { dob: '2020-01-01', type: undefined, isServiceProfile: true, eligible: true },
+        { dob: '1990-01-01', type: undefined, isServiceProfile: true, eligible: true },
+        { dob: undefined, type: 'child', isServiceProfile: true, eligible: false },
+        { dob: undefined, type: undefined, isServiceProfile: 'true', eligible: false },
+    ])(
+        'uses persisted service classification in preflight and locked policy: $dob / $type / $isServiceProfile',
+        async ({ dob, type, isServiceProfile, eligible }) => {
+            vi.mocked(getProfileByProfileId).mockResolvedValue({
+                dob,
+                type,
+                isServiceProfile,
+            } as never);
+            vi.mocked(isProfileManaged).mockResolvedValue(true);
+            const resolver = createShareLinkPolicyResolver(createProductionShareLinkPolicySource());
+            const preflight = await resolver.resolve('owner');
+            const locked = await resolveCurrentShareLinkPolicy(
+                transactionWith({ dob, type, isServiceProfile, isManaged: true }),
+                'owner',
+                NOW
+            );
+            expect(preflight.viewCountingEnabled).toBe(eligible);
+            expect(locked).toEqual({ ...preflight, isServiceProfile: eligible });
+            expect(locked.defaultExpiryDays).toBe(30);
+        }
+    );
 
     it('rechecks persisted age and management inside the receipt transaction', async () => {
         const adult = transactionWith({ dob: '1990-01-01', type: null, isManaged: false });
         const managed = transactionWith({ dob: '1990-01-01', type: null, isManaged: true });
         const unknown = transactionWith();
+        const managedService = transactionWith({
+            dob: null,
+            type: null,
+            isManaged: true,
+            isServiceProfile: true,
+        });
         const input = {
             namespace: 'test',
             ownerProfileId: 'OWNER',
@@ -67,9 +116,9 @@ describe('production share-link age policy', () => {
         expect(await productionShareViewEligibilitySource.isEligible(adult, input)).toBe(true);
         expect(await productionShareViewEligibilitySource.isEligible(managed, input)).toBe(false);
         expect(await productionShareViewEligibilitySource.isEligible(unknown, input)).toBe(false);
-        expect((adult.run as ReturnType<typeof vi.fn>).mock.calls[0]?.[1]).toEqual({
-            profileId: 'owner',
-        });
+        expect(await productionShareViewEligibilitySource.isEligible(managedService, input)).toBe(
+            true
+        );
         expect(
             (await resolveCurrentShareLinkPolicy(unknown, 'owner', NOW)).viewCountingEnabled
         ).toBe(false);