@learncard/network-brain-service 4.0.3 → 4.1.0

package/test/consentflow.spec.ts

@@ -1,4 +1,19 @@
 import { vi, describe, beforeAll, beforeEach, afterEach, it, expect } from 'vitest';
+
+// Wraps the real signer so a test can inspect the credential it was handed.
+const signingAuthorityMocks = vi.hoisted(() => ({ issueCredential: vi.fn() }));
+
+vi.mock('@helpers/signingAuthority.helpers', async importOriginal => {
+    const actual = await importOriginal<typeof import('@helpers/signingAuthority.helpers')>();
+    signingAuthorityMocks.issueCredential.mockImplementation(
+        actual.issueCredentialWithSigningAuthority
+    );
+    return {
+        ...actual,
+        issueCredentialWithSigningAuthority: signingAuthorityMocks.issueCredential,
+    };
+});
+
 import {
     promiscuousTerms,
     minimalContract,
@@ -1951,6 +1966,92 @@ describe('Consent Flow Contracts', () => {
             expect(hasAutoBoostTx).toBeTruthy();
         });
 
+        describe('first-consent auto-boost issuance dates', () => {
+            // A malformed date seen on a production Boost template; DIDKit refuses to sign it.
+            const MALFORMED_DATE = '2025-10-19+053008:18:16';
+            const TEMPLATE_DATE = '2025-10-19T08:18:16.000Z';
+
+            const consentWithAutoBoost = async (credential: Record<string, unknown>) => {
+                await userA.clients.fullAuth.profile.registerSigningAuthority({
+                    endpoint: 'http://localhost:5000/api',
+                    name: 'mysa',
+                    did: 'did:key:z6MkitsQTk2GDNYXAFckVcQHtC68S9j9ruVFYWrixM6RG5Mw',
+                });
+
+                const boostUri = await userA.clients.fullAuth.boost.createBoost({
+                    credential: credential as typeof testUnsignedBoost,
+                    category: 'Achievement',
+                    name: 'Auto-issued Boost',
+                });
+
+                const contractUri =
+                    await userA.clients.fullAuth.contracts.createConsentFlowContract({
+                        contract: normalContract,
+                        name: 'Auto Boost Contract',
+                        autoboosts: [
+                            {
+                                boostUri,
+                                signingAuthority: {
+                                    endpoint: 'http://localhost:5000/api',
+                                    name: 'mysa',
+                                },
+                            },
+                        ],
+                    });
+
+                signingAuthorityMocks.issueCredential.mockClear();
+                const before = Date.now();
+                const { termsUri } = await userB.clients.fullAuth.contracts.consentToContract({
+                    contractUri,
+                    terms: normalFullTerms,
+                });
+
+                expect(signingAuthorityMocks.issueCredential).toHaveBeenCalledTimes(1);
+                const unsigned = signingAuthorityMocks.issueCredential.mock.calls[0]![1];
+                const { records } =
+                    await userB.clients.fullAuth.contracts.getCredentialsForContract({ termsUri });
+
+                return { unsigned, records, before };
+            };
+
+            const expectFreshDate = (value: unknown, before: number) => {
+                expect(typeof value).toBe('string');
+                expect(value).toBe(new Date(value as string).toISOString());
+                expect(Date.parse(value as string)).toBeGreaterThanOrEqual(before);
+            };
+
+            it('restamps a malformed issuanceDate on a VC 1.1 template', async () => {
+                const { unsigned, records, before } = await consentWithAutoBoost({
+                    ...testUnsignedBoost,
+                    issuanceDate: MALFORMED_DATE,
+                });
+
+                expectFreshDate(unsigned.issuanceDate, before);
+                // Consent swallows signing errors, so a missing record means signing failed.
+                expect(records).toHaveLength(1);
+            });
+
+            it('drops a leftover issuanceDate on a VC 2.0 template', async () => {
+                const { unsigned, records, before } = await consentWithAutoBoost({
+                    '@context': [
+                        'https://www.w3.org/ns/credentials/v2',
+                        'https://ctx.learncard.com/boosts/1.0.1.json',
+                    ],
+                    type: ['VerifiableCredential', 'BoostCredential'],
+                    issuer: 'did:example:issuer',
+                    validFrom: TEMPLATE_DATE,
+                    issuanceDate: TEMPLATE_DATE,
+                    name: 'VC 2.0 Auto Boost',
+                    credentialSubject: { id: 'did:example:subject' },
+                });
+
+                expectFreshDate(unsigned.validFrom, before);
+                // The VC 2.0 context doesn't define issuanceDate, so DIDKit won't sign with it.
+                expect(unsigned).not.toHaveProperty('issuanceDate');
+                expect(records).toHaveLength(1);
+            });
+        });
+
         it('should auto-issue boosts when reconsenting to a contract with auto-boosts', async () => {
             await userA.clients.fullAuth.profile.registerSigningAuthority({
                 endpoint: 'http://localhost:5000/api',

package/test/credential-share-previews.spec.ts

@@ -0,0 +1,97 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const owner = { profileId: 'owner-1', did: 'did:key:owner', displayName: 'Owner' };
+const storage = vi.hoisted(() => ({
+    create: vi.fn(
+        async (ownerId: string, preview: { id?: string }): Promise<string | null> =>
+            preview.id ?? '5b58ff0c-bb55-4f25-a2a5-b4de3778c649'
+    ),
+    get: vi.fn(async (_id: string, _shareUri: string) => null as unknown),
+    delete: vi.fn(async (_ownerId: string, _id: string) => false),
+}));
+const sentry = vi.hoisted(() => ({
+    trpcMiddleware: vi.fn(() => async (options: { next: () => unknown }) => options.next()),
+    setUser: vi.fn(),
+    configureScope: vi.fn(),
+}));
+vi.mock('@accesslayer/credential-share-previews', () => ({
+    createCredentialSharePreview: storage.create,
+    getCredentialSharePreview: storage.get,
+    deleteCredentialSharePreview: storage.delete,
+}));
+vi.mock('@accesslayer/profile/read', () => ({ getProfileByDid: vi.fn(async () => owner) }));
+vi.mock('@sentry/serverless', () => ({
+    Handlers: { trpcMiddleware: sentry.trpcMiddleware },
+    setUser: sentry.setUser,
+    configureScope: sentry.configureScope,
+}));
+import { credentialSharePreviewsRouter } from '../src/routes/credential-share-previews';
+
+const caller = (user?: { did: string; isChallengeValid: boolean }) =>
+    credentialSharePreviewsRouter.createCaller({
+        domain: 'network.example.com',
+        tenant: { id: 'default' },
+        ...(user ? { user } : {}),
+    } as never);
+const authenticated = { did: owner.did, isChallengeValid: true };
+const id = '5b58ff0c-bb55-4f25-a2a5-b4de3778c649';
+const shareUri = 'urn:encrypted:opaque';
+
+describe('credential share previews route', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        storage.get.mockResolvedValue(null);
+        storage.delete.mockResolvedValue(false);
+        storage.create.mockImplementation(async (_owner, preview) => preview.id ?? id);
+    });
+
+    it('requires authentication and rejects private fields in published metadata', async () => {
+        const preview = {
+            name: 'Badge',
+            issuer: 'Issuer',
+            image: 'https://cdn.example/badge.png',
+            shareUri,
+        };
+        await expect(caller().publish(preview)).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            caller(authenticated).publish({ ...preview, credential: { id: 'private' } } as never)
+        ).rejects.toBeInstanceOf(TRPCError);
+    });
+
+    it('rejects unauthenticated deletion', async () => {
+        await expect(caller().delete({ id })).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('reports missing refreshes with the machine-readable recovery code', async () => {
+        storage.create.mockResolvedValueOnce(null);
+        await expect(
+            caller(authenticated).publish({ id, name: 'Badge', issuer: 'Issuer', shareUri })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    });
+
+    it('fails closed if storage returns non-public fields', async () => {
+        storage.get.mockResolvedValueOnce({
+            name: 'Badge',
+            issuer: 'Issuer',
+            seed: 'must-never-be-returned',
+            shareUri,
+            ownerProfileId: owner.profileId,
+            createdAt: new Date(0).toISOString(),
+            updatedAt: new Date(0).toISOString(),
+        });
+        await expect(caller().get({ id, shareUri })).rejects.toMatchObject({
+            code: 'INTERNAL_SERVER_ERROR',
+        });
+    });
+
+    it('requires both public lookup keys and reports missing previews', async () => {
+        await expect(caller().get({ id } as never)).rejects.toBeInstanceOf(TRPCError);
+        await expect(caller().get({ id: 'not-a-uuid', shareUri })).rejects.toBeInstanceOf(
+            TRPCError
+        );
+        await expect(caller().get({ id, shareUri })).rejects.toMatchObject({
+            code: 'NOT_FOUND',
+        });
+    });
+});

package/test/inbox-batch.spec.ts

@@ -2,7 +2,13 @@ import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vites
 import Fastify, { type FastifyInstance } from 'fastify';
 import { fastifyTRPCOpenApiPlugin } from 'trpc-to-openapi';
 import { randomUUID } from 'node:crypto';
-import type { InboxBatchReceipt, IssueInboxCredentialBatch, VC, VP } from '@learncard/types';
+import type {
+    InboxBatchReceipt,
+    IssueInboxCredentialBatch,
+    UnsignedVC,
+    VC,
+    VP,
+} from '@learncard/types';
 import { appRouter, createContext } from '../src/app';
 import { getClient, getUser } from './helpers/getClient';
 import { testUnsignedBoost } from './helpers/send';
@@ -29,6 +35,7 @@ import {
 } from '@helpers/inbox-queue.helpers';
 import { fingerprint } from '@helpers/inbox-batch.helpers';
 import * as jobStore from '@accesslayer/inbox-batch/store';
+import { createInboxBatchSchemaInitializer } from '@accesslayer/inbox-batch/schema';
 import * as issuance from '@helpers/inbox.helpers';
 import { SQSClient, SendMessageCommand, SendMessageBatchCommand } from '@aws-sdk/client-sqs';
 
@@ -168,6 +175,36 @@ describe('Universal Inbox batch issuance', () => {
             { batchId }
         );
 
+    it('initializes an empty batch schema concurrently in independent cold API and worker instances', async () => {
+        // Testcontainers owns this database. Recreate the cold condition rather than
+        // exercising the process-local cache against already-created schema.
+        for (let round = 0; round < 3; round++) {
+            const constraints = await neogma.queryRunner.run(
+                'SHOW CONSTRAINTS YIELD name WHERE name STARTS WITH "inboxbatch" RETURN name'
+            );
+            for (const record of constraints.records)
+                await neogma.queryRunner.run(`DROP CONSTRAINT ${record.get('name')}`);
+            const indexes = await neogma.queryRunner.run(
+                'SHOW INDEXES YIELD name WHERE name STARTS WITH "inbox_batch_" RETURN name'
+            );
+            for (const record of indexes.records)
+                await neogma.queryRunner.run(`DROP INDEX ${record.get('name')}`);
+
+            const processes = Array.from({ length: 4 }, () =>
+                createInboxBatchSchemaInitializer(neogma.driver)
+            );
+            await Promise.all(processes.map(ensure => ensure()));
+            const ready = await neogma.queryRunner.run(
+                'SHOW CONSTRAINTS YIELD name WHERE name STARTS WITH "inboxbatch" RETURN count(*) AS total'
+            );
+            expect(ready.records[0].get('total').toNumber()).toBe(4);
+            const readyIndexes = await neogma.queryRunner.run(
+                'SHOW INDEXES YIELD name WHERE name STARTS WITH "inbox_batch_" RETURN count(*) AS total'
+            );
+            expect(readyIndexes.records[0].get('total').toNumber()).toBe(6);
+        }
+    });
+
     it('accepts a one-item batch without waiting for a slow worker and restricts polling to its issuer', async () => {
         const receipt = await submit({
             items: [{ recipient: email('slow@test.com'), credential: await signed() }],
@@ -983,6 +1020,157 @@ describe('Universal Inbox batch issuance', () => {
         expect(names).toEqual(['Ada', 'Grace']);
     });
 
+    it('issues standard per-person Evidence with pure VC2 and Open Badges contexts', async () => {
+        const template = structuredClone(testUnsignedBoost);
+        template['@context'] = [
+            'https://www.w3.org/ns/credentials/v2',
+            'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',
+        ];
+        template.type = ['VerifiableCredential', 'OpenBadgeCredential'];
+        delete template.issuanceDate;
+        template.validFrom = new Date().toISOString();
+        const templateUri = await issuer.clients.fullAuth.boost.createBoost({
+            credential: template,
+            name: 'Standard evidence',
+            category: 'Achievement',
+        });
+        const evidence = [
+            {
+                id: 'https://portfolio.test/work.pdf',
+                type: ['Evidence'],
+                name: 'Work sample',
+                genre: 'document',
+            },
+        ];
+        const batch = await issue({
+            configuration: { signingAuthority },
+            items: [
+                {
+                    recipient: email('standard-evidence@test.com'),
+                    templateUri,
+                    configuration: { templateData: { evidence } },
+                },
+            ],
+        });
+        expect(batch.summary.failed).toBe(0);
+        const result = batch.results[0];
+        if (!result.success) throw new Error('Expected successful issuance');
+        const credential = JSON.parse(
+            await decryptInboxCredential((await stored(result.issuanceId)).credential)
+        );
+        expect(credential.evidence).toEqual(evidence);
+        expect(credential['@context']).toEqual(template['@context']);
+        expect(credential.type).not.toContain('BoostCredential');
+        const claimed = await claim(result.claimUrl!);
+        expect(claimed[0].proof).toBeDefined();
+        expect(claimed[0].evidence).toEqual(evidence);
+    });
+
+    it('materializes numeric credits and awarded dates before queued issuance and signing', async () => {
+        const template = structuredClone(testUnsignedBoost) as unknown as Record<string, unknown>;
+        template['@context'] = [
+            'https://www.w3.org/ns/credentials/v2',
+            'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',
+        ];
+        template.type = ['VerifiableCredential', 'OpenBadgeCredential'];
+        delete template.issuanceDate;
+        template.validFrom = '{{issue_date}}';
+        template.awardedDate = '{{award_date}}';
+        const subject = template.credentialSubject as Record<string, unknown>;
+        subject.creditsEarned = '{{credits}}';
+        subject.result = [
+            { type: ['Result'], resultDescription: 'urn:uuid:quiz', value: '{{percent}}' },
+        ];
+        (subject.achievement as Record<string, unknown>).resultDescription = [
+            {
+                id: 'urn:uuid:quiz',
+                type: ['ResultDescription'],
+                name: 'Quiz',
+                resultType: 'Percent',
+                valueMin: '0',
+                valueMax: '100',
+            },
+        ];
+        const templateUri = await issuer.clients.fullAuth.boost.createBoost({
+            credential: template as UnsignedVC,
+            name: 'Mapped spreadsheet',
+            category: 'Achievement',
+        });
+        const batch = await issue({
+            configuration: { signingAuthority },
+            items: ['0', '1.5', '12 hours'].map((credits, index) => ({
+                recipient: email(`mapped-${index}@test.com`),
+                templateUri,
+                configuration: {
+                    templateData: { credits, percent: '95', award_date: '2024-04-03T00:00:00Z' },
+                },
+            })),
+        });
+        expect(batch.summary).toMatchObject({ succeeded: 2, failed: 1 });
+        for (const [index, result] of batch.results.entries()) {
+            if (index === 2) {
+                expect(result.success).toBe(false);
+                continue;
+            }
+            if (!result.success) throw new Error('Expected successful mapped row');
+            const credential = JSON.parse(
+                await decryptInboxCredential((await stored(result.issuanceId)).credential)
+            );
+            expect(credential.credentialSubject.creditsEarned).toBe(index === 0 ? 0 : 1.5);
+            expect(credential.credentialSubject.result[0].value).toBe('95');
+            expect(credential.awardedDate).toBe('2024-04-03T00:00:00.000Z');
+            expect(credential.validFrom).not.toBe(credential.awardedDate);
+        }
+        const first = batch.results[0];
+        if (!first.success) throw new Error('Expected first result');
+        const claimed = await claim(first.claimUrl!);
+        expect(claimed[0].proof).toBeDefined();
+        expect(claimed[0].credentialSubject).toMatchObject({ creditsEarned: 0 });
+    });
+
+    it('still rejects extension EvidenceFile fields without their defining context', async () => {
+        const template = structuredClone(testUnsignedBoost);
+        template['@context'] = [
+            'https://www.w3.org/ns/credentials/v2',
+            'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',
+        ];
+        template.type = ['VerifiableCredential', 'OpenBadgeCredential'];
+        delete template.issuanceDate;
+        template.validFrom = new Date().toISOString();
+        const templateUri = await issuer.clients.fullAuth.boost.createBoost({
+            credential: template,
+            name: 'Extension evidence',
+            category: 'Achievement',
+        });
+        const batch = await issue({
+            configuration: { signingAuthority },
+            items: [
+                {
+                    recipient: email('extension@test.com'),
+                    templateUri,
+                    configuration: {
+                        templateData: {
+                            evidence: [
+                                {
+                                    id: 'https://proof.test/file',
+                                    type: ['EvidenceFile'],
+                                    fileName: 'file.pdf',
+                                },
+                            ],
+                        },
+                    },
+                },
+            ],
+        });
+        expect(batch.results[0]).toMatchObject({
+            success: false,
+            error: {
+                code: 'BAD_REQUEST',
+                message: expect.stringContaining('Failed to prepare boost credential template'),
+            },
+        });
+    });
+
     it('returns HTTP 202 then exposes partial success and passes tenant branding to delivery', async () => {
         const response = await post({
             items: [

package/test/verification/campaigns.ts

@@ -0,0 +1,49 @@
+/**
+ * Real signed SDK requests against an owned Linux verification stack.
+ * Positive admin/data coverage lives in campaigns.spec.ts (disposable Neo4j): the
+ * default stack intentionally grants no campaign administration to test actors.
+ *
+ * bun run --cwd apps/learn-card-app lc verify script \
+ *   services/learn-card-network/brain-service/test/verification/campaigns.ts --dir <owned-dir>
+ */
+import type { VerificationScript } from '../../../../../apps/learn-card-app/scripts/verification/script';
+
+const script: VerificationScript = async v => {
+    const learner = await v.sdk(v.actors.learner);
+    const other = await v.sdk(v.actors.recipient);
+    const campaignId = 'verification-denied-campaign';
+
+    await v.step(null, 'campaign-sdk-authorization', async () => {
+        v.expect(await learner.invoke.campaignsIsAdmin()).toBe(false);
+        await v
+            .expect(
+                learner.invoke.campaignsCreate({
+                    id: campaignId,
+                    name: 'Not authorized',
+                    channels: ['inApp'],
+                    message: { title: 'Denied' },
+                })
+            )
+            .rejects.toThrow(/Campaign administrator access required/);
+        await v
+            .expect(other.invoke.campaignsList())
+            .rejects.toThrow(/Campaign administrator access required/);
+    });
+
+    await v.step(null, 'campaign-sdk-user-isolation', async () => {
+        v.expect(await learner.invoke.getMyCampaigns()).toEqual([]);
+        v.expect(await other.invoke.getMyCampaigns()).toEqual([]);
+        v.expect(await learner.invoke.recordCampaignEvent(campaignId, 'shown')).toBe(false);
+        await v
+            .expect(learner.invoke.enrollInCampaign(campaignId))
+            .rejects.toThrow(/Campaign not found/);
+    });
+
+    return {
+        authorization: 'passed',
+        userIsolation: 'passed',
+        adminDataCoverage: 'separate Neo4j integration suite',
+    };
+};
+
+export default script;

package/vitest.campaigns.config.ts

@@ -0,0 +1,21 @@
+import { createRequire } from 'node:module';
+
+import { createVitestConfig, serviceIntegrationPreset } from '../../../vitest.shared';
+
+const require = createRequire(import.meta.url);
+
+export default createVitestConfig(serviceIntegrationPreset, {
+    test: {
+        globalSetup: './test-setup.ts',
+        include: ['test/campaigns.spec.ts'],
+        alias: { '@instance': require.resolve('./test/helpers/mock-instance.ts') },
+        env: {
+            IS_E2E_TEST: 'true',
+            DOMAIN_NAME: 'localhost%3A3000',
+            SEED: 'a'.repeat(64),
+            CAMPAIGN_ADMIN_PROFILE_IDS: 'campaign-admin',
+            TRACE_CONSOLE: 'false',
+            NEO4J_SKIP_INDICES: 'true',
+        },
+    },
+});

package/vitest.config.ts

@@ -16,6 +16,7 @@ export default createVitestConfig(brainServicePreset, {
             NEO4J_SKIP_INDICES: 'true',
         },
         include: [
+            'test/credential-share-previews.spec.ts',
             'test/share-link-*.unit.spec.ts',
             'test/share-content-client.*.spec.ts',
             'test/uri-helpers.spec.ts',
@@ -51,11 +52,21 @@ export default createVitestConfig(brainServicePreset, {
             'src/helpers/status-list.helpers.test.ts',
             'src/helpers/boost-storage.helpers.test.ts',
             'src/accesslayer/credential/create.test.ts',
+            'src/accesslayer/inbox-batch/schema.test.ts',
             'src/helpers/inbox-encryption.helpers.test.ts',
             'src/helpers/send-inbox-config.helpers.test.ts',
             'src/helpers/contact-method.helpers.test.ts',
             'src/services/delivery/adapters/postmark.adapter.test.ts',
             'src/helpers/inbox-maintenance.helpers.test.ts',
+            'src/helpers/bedrock-embedding.helpers.test.ts',
+            'src/helpers/skill-embedding.helpers.test.ts',
+            'src/seed/seedSkillFrameworks.embeddings.test.ts',
+            // Opt-in, local-only Neo4j check of the embedding compare-and-set; skipped unless
+            // SKILL_EMBEDDING_TEST_NEO4J_URI points at localhost.
+            'src/config/skillEmbedding.neo4j.test.ts',
+            'src/routes/skills-semantic-search.test.ts',
+            // Opt-in, paid, real-AWS smoke test; skipped unless SKILL_EMBEDDING_BEDROCK_SMOKE=true.
+            'src/helpers/bedrock-embedding.smoke.test.ts',
         ],
     },
 });

package/vitest.integration.config.ts

@@ -19,6 +19,7 @@ export default createVitestConfig(serviceIntegrationPreset, {
             CREDENTIAL_REFRESH_ENABLED: 'true',
             LOGIN_PROVIDER_DID: 'did:key:z6Mko9uYxDPk2BetRRziLz1xHN8nR5zQWdNjytKNDPcygHJP',
             APP_STORE_ADMIN_PROFILE_IDS: 'app-store-admin',
+            CAMPAIGN_ADMIN_PROFILE_IDS: 'campaign-admin',
             TRACE_CONSOLE: 'false',
         },
     },