@learncard/network-brain-service 4.0.4 → 4.1.0

package/test/credential-share-previews.spec.ts

@@ -0,0 +1,97 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TRPCError } from '@trpc/server';
+
+const owner = { profileId: 'owner-1', did: 'did:key:owner', displayName: 'Owner' };
+const storage = vi.hoisted(() => ({
+    create: vi.fn(
+        async (ownerId: string, preview: { id?: string }): Promise<string | null> =>
+            preview.id ?? '5b58ff0c-bb55-4f25-a2a5-b4de3778c649'
+    ),
+    get: vi.fn(async (_id: string, _shareUri: string) => null as unknown),
+    delete: vi.fn(async (_ownerId: string, _id: string) => false),
+}));
+const sentry = vi.hoisted(() => ({
+    trpcMiddleware: vi.fn(() => async (options: { next: () => unknown }) => options.next()),
+    setUser: vi.fn(),
+    configureScope: vi.fn(),
+}));
+vi.mock('@accesslayer/credential-share-previews', () => ({
+    createCredentialSharePreview: storage.create,
+    getCredentialSharePreview: storage.get,
+    deleteCredentialSharePreview: storage.delete,
+}));
+vi.mock('@accesslayer/profile/read', () => ({ getProfileByDid: vi.fn(async () => owner) }));
+vi.mock('@sentry/serverless', () => ({
+    Handlers: { trpcMiddleware: sentry.trpcMiddleware },
+    setUser: sentry.setUser,
+    configureScope: sentry.configureScope,
+}));
+import { credentialSharePreviewsRouter } from '../src/routes/credential-share-previews';
+
+const caller = (user?: { did: string; isChallengeValid: boolean }) =>
+    credentialSharePreviewsRouter.createCaller({
+        domain: 'network.example.com',
+        tenant: { id: 'default' },
+        ...(user ? { user } : {}),
+    } as never);
+const authenticated = { did: owner.did, isChallengeValid: true };
+const id = '5b58ff0c-bb55-4f25-a2a5-b4de3778c649';
+const shareUri = 'urn:encrypted:opaque';
+
+describe('credential share previews route', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        storage.get.mockResolvedValue(null);
+        storage.delete.mockResolvedValue(false);
+        storage.create.mockImplementation(async (_owner, preview) => preview.id ?? id);
+    });
+
+    it('requires authentication and rejects private fields in published metadata', async () => {
+        const preview = {
+            name: 'Badge',
+            issuer: 'Issuer',
+            image: 'https://cdn.example/badge.png',
+            shareUri,
+        };
+        await expect(caller().publish(preview)).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            caller(authenticated).publish({ ...preview, credential: { id: 'private' } } as never)
+        ).rejects.toBeInstanceOf(TRPCError);
+    });
+
+    it('rejects unauthenticated deletion', async () => {
+        await expect(caller().delete({ id })).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('reports missing refreshes with the machine-readable recovery code', async () => {
+        storage.create.mockResolvedValueOnce(null);
+        await expect(
+            caller(authenticated).publish({ id, name: 'Badge', issuer: 'Issuer', shareUri })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    });
+
+    it('fails closed if storage returns non-public fields', async () => {
+        storage.get.mockResolvedValueOnce({
+            name: 'Badge',
+            issuer: 'Issuer',
+            seed: 'must-never-be-returned',
+            shareUri,
+            ownerProfileId: owner.profileId,
+            createdAt: new Date(0).toISOString(),
+            updatedAt: new Date(0).toISOString(),
+        });
+        await expect(caller().get({ id, shareUri })).rejects.toMatchObject({
+            code: 'INTERNAL_SERVER_ERROR',
+        });
+    });
+
+    it('requires both public lookup keys and reports missing previews', async () => {
+        await expect(caller().get({ id } as never)).rejects.toBeInstanceOf(TRPCError);
+        await expect(caller().get({ id: 'not-a-uuid', shareUri })).rejects.toBeInstanceOf(
+            TRPCError
+        );
+        await expect(caller().get({ id, shareUri })).rejects.toMatchObject({
+            code: 'NOT_FOUND',
+        });
+    });
+});

package/test/verification/campaigns.ts

@@ -0,0 +1,49 @@
+/**
+ * Real signed SDK requests against an owned Linux verification stack.
+ * Positive admin/data coverage lives in campaigns.spec.ts (disposable Neo4j): the
+ * default stack intentionally grants no campaign administration to test actors.
+ *
+ * bun run --cwd apps/learn-card-app lc verify script \
+ *   services/learn-card-network/brain-service/test/verification/campaigns.ts --dir <owned-dir>
+ */
+import type { VerificationScript } from '../../../../../apps/learn-card-app/scripts/verification/script';
+
+const script: VerificationScript = async v => {
+    const learner = await v.sdk(v.actors.learner);
+    const other = await v.sdk(v.actors.recipient);
+    const campaignId = 'verification-denied-campaign';
+
+    await v.step(null, 'campaign-sdk-authorization', async () => {
+        v.expect(await learner.invoke.campaignsIsAdmin()).toBe(false);
+        await v
+            .expect(
+                learner.invoke.campaignsCreate({
+                    id: campaignId,
+                    name: 'Not authorized',
+                    channels: ['inApp'],
+                    message: { title: 'Denied' },
+                })
+            )
+            .rejects.toThrow(/Campaign administrator access required/);
+        await v
+            .expect(other.invoke.campaignsList())
+            .rejects.toThrow(/Campaign administrator access required/);
+    });
+
+    await v.step(null, 'campaign-sdk-user-isolation', async () => {
+        v.expect(await learner.invoke.getMyCampaigns()).toEqual([]);
+        v.expect(await other.invoke.getMyCampaigns()).toEqual([]);
+        v.expect(await learner.invoke.recordCampaignEvent(campaignId, 'shown')).toBe(false);
+        await v
+            .expect(learner.invoke.enrollInCampaign(campaignId))
+            .rejects.toThrow(/Campaign not found/);
+    });
+
+    return {
+        authorization: 'passed',
+        userIsolation: 'passed',
+        adminDataCoverage: 'separate Neo4j integration suite',
+    };
+};
+
+export default script;

package/vitest.campaigns.config.ts

@@ -0,0 +1,21 @@
+import { createRequire } from 'node:module';
+
+import { createVitestConfig, serviceIntegrationPreset } from '../../../vitest.shared';
+
+const require = createRequire(import.meta.url);
+
+export default createVitestConfig(serviceIntegrationPreset, {
+    test: {
+        globalSetup: './test-setup.ts',
+        include: ['test/campaigns.spec.ts'],
+        alias: { '@instance': require.resolve('./test/helpers/mock-instance.ts') },
+        env: {
+            IS_E2E_TEST: 'true',
+            DOMAIN_NAME: 'localhost%3A3000',
+            SEED: 'a'.repeat(64),
+            CAMPAIGN_ADMIN_PROFILE_IDS: 'campaign-admin',
+            TRACE_CONSOLE: 'false',
+            NEO4J_SKIP_INDICES: 'true',
+        },
+    },
+});

package/vitest.config.ts

@@ -16,6 +16,7 @@ export default createVitestConfig(brainServicePreset, {
             NEO4J_SKIP_INDICES: 'true',
         },
         include: [
+            'test/credential-share-previews.spec.ts',
             'test/share-link-*.unit.spec.ts',
             'test/share-content-client.*.spec.ts',
             'test/uri-helpers.spec.ts',
@@ -57,6 +58,15 @@ export default createVitestConfig(brainServicePreset, {
             'src/helpers/contact-method.helpers.test.ts',
             'src/services/delivery/adapters/postmark.adapter.test.ts',
             'src/helpers/inbox-maintenance.helpers.test.ts',
+            'src/helpers/bedrock-embedding.helpers.test.ts',
+            'src/helpers/skill-embedding.helpers.test.ts',
+            'src/seed/seedSkillFrameworks.embeddings.test.ts',
+            // Opt-in, local-only Neo4j check of the embedding compare-and-set; skipped unless
+            // SKILL_EMBEDDING_TEST_NEO4J_URI points at localhost.
+            'src/config/skillEmbedding.neo4j.test.ts',
+            'src/routes/skills-semantic-search.test.ts',
+            // Opt-in, paid, real-AWS smoke test; skipped unless SKILL_EMBEDDING_BEDROCK_SMOKE=true.
+            'src/helpers/bedrock-embedding.smoke.test.ts',
         ],
     },
 });

package/vitest.integration.config.ts

@@ -19,6 +19,7 @@ export default createVitestConfig(serviceIntegrationPreset, {
             CREDENTIAL_REFRESH_ENABLED: 'true',
             LOGIN_PROVIDER_DID: 'did:key:z6Mko9uYxDPk2BetRRziLz1xHN8nR5zQWdNjytKNDPcygHJP',
             APP_STORE_ADMIN_PROFILE_IDS: 'app-store-admin',
+            CAMPAIGN_ADMIN_PROFILE_IDS: 'campaign-admin',
             TRACE_CONSOLE: 'false',
         },
     },