@learncard/network-brain-service 4.1.3 → 5.0.0

package/test/inbox-refresh.spec.ts

@@ -119,6 +119,52 @@ beforeEach(async () => {
 });
 
 describe('managed Universal Inbox refresh', () => {
+    it('retries keyed issuance across retained digest key rotation', async () => {
+        try {
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'old-inbox-test-key');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v1');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS', '{}');
+            const first = await issue({ idempotencyKey: 'rotation-issue' });
+            const readDigest = async () =>
+                (
+                    await neogma.queryRunner.run(
+                        'MATCH (ic:InboxCredential {id: $id}) RETURN ic.refreshRequestDigest AS digest',
+                        { id: first.issuanceId }
+                    )
+                ).records[0]!.get('digest');
+            const stored = await readDigest();
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'new-inbox-test-key');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v2');
+            vi.stubEnv(
+                'CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS',
+                JSON.stringify({ v1: 'old-inbox-test-key' })
+            );
+            expect(await issue({ idempotencyKey: 'rotation-issue' })).toEqual(first);
+            expect(await readDigest()).toBe(stored);
+            // Resume before claim-link persistence to exercise the atomic create/reuse check.
+            await neogma.queryRunner.run(
+                'MATCH (ic:InboxCredential {id: $id}) REMOVE ic.refreshClaimUrl',
+                { id: first.issuanceId }
+            );
+            const resumed = await issue({ idempotencyKey: 'rotation-issue' });
+            expect(resumed.issuanceId).toBe(first.issuanceId);
+            expect(resumed.refresh).toEqual(first.refresh);
+            expect(await readDigest()).toBe(stored);
+            await expect(
+                issue({
+                    idempotencyKey: 'rotation-issue',
+                    credential: { ...template(), name: 'Different' },
+                })
+            ).rejects.toMatchObject({ code: 'CONFLICT' });
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS', '{}');
+            await expect(issue({ idempotencyKey: 'rotation-issue' })).rejects.toMatchObject({
+                code: 'CONFLICT',
+            });
+        } finally {
+            vi.unstubAllEnvs();
+        }
+    });
+
     it.each(['email', 'phone'] as const)(
         'allocates for unknown %s, claims latest, then publishes normally',
         async type => {
@@ -362,6 +408,46 @@ describe('managed Universal Inbox refresh', () => {
         ).rejects.toMatchObject({ code: 'CONFLICT' });
     });
 
+    it('retries unified inbox send across retained digest key rotation', async () => {
+        try {
+            await issuer.clients.fullAuth.profile.setPrimarySigningAuthority(SA);
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'old-inbox-send-test-key');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v1');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS', '{}');
+            const input = {
+                type: 'boost' as const,
+                recipient: 'unknown@example.com',
+                template: { credential: template() },
+                refresh: true,
+                idempotencyKey: 'rotation-unified-key',
+                options: { suppressDelivery: true },
+            };
+            const first = await issuer.clients.fullAuth.boost.send(input);
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'new-inbox-send-test-key');
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v2');
+            vi.stubEnv(
+                'CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS',
+                JSON.stringify({ v1: 'old-inbox-send-test-key' })
+            );
+            expect(await issuer.clients.fullAuth.boost.send(input)).toEqual(first);
+            await expect(
+                issuer.clients.fullAuth.boost.send({ ...input, recipient: 'different@example.com' })
+            ).rejects.toMatchObject({ code: 'CONFLICT' });
+            for (const label of ['Boost', 'InboxCredential', 'CredentialRefresh']) {
+                const count = await neogma.queryRunner.run(
+                    `MATCH (n:${label}) RETURN count(n) AS count`
+                );
+                expect(Number(count.records[0]!.get('count'))).toBe(1);
+            }
+            vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS', '{}');
+            await expect(issuer.clients.fullAuth.boost.send(input)).rejects.toMatchObject({
+                code: 'CONFLICT',
+            });
+        } finally {
+            vi.unstubAllEnvs();
+        }
+    });
+
     it('retains escrow when signing fails and can retry the same claim', async () => {
         const issued = await issue();
         mocks.sign.mockRejectedValueOnce(new Error('Authority unavailable'));
@@ -430,6 +516,25 @@ describe('managed Universal Inbox refresh', () => {
         ).toBeTruthy();
     });
 
+    it('keeps stored public names on pending publication without copying the private VC name', async () => {
+        const issued = await issue();
+        const refreshId = issued.refresh!.refreshId;
+        await neogma.queryRunner.run(
+            `MATCH (refresh:CredentialRefresh {refreshId: $refreshId})-[:INBOX]->(ic:InboxCredential)
+             SET ic.credentialName = 'Stored label', refresh.credentialDisplayName = 'Stored label'`,
+            { refreshId }
+        );
+        await queue(issued, 'Private Updated Name');
+        const rows = await neogma.queryRunner.run(
+            `MATCH (refresh:CredentialRefresh {refreshId: $refreshId})-[:INBOX]->(ic:InboxCredential)
+             RETURN ic.credentialName AS inboxName, refresh.credentialDisplayName AS displayName`,
+            { refreshId }
+        );
+        expect(rows.records[0]!.get('inboxName')).toBe('Stored label');
+        expect(rows.records[0]!.get('displayName')).toBe('Stored label');
+        expect((await getCredentialRefresh(refreshId))?.currentVersion).toBe(2);
+    });
+
     it('concurrent pending publications with one key create one revision', async () => {
         const issued = await issue();
         const outcomes = await Promise.all([

package/test/inbox-security.e2e.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import Fastify, { type FastifyInstance } from 'fastify';
 import { fastifyTRPCOpenApiPlugin } from 'trpc-to-openapi';
-import { readFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import {
     JWEValidator,
@@ -311,12 +310,15 @@ describe('Universal Inbox escrow (HTTP + isolated Neo4j/Redis)', () => {
             const store = credentialStorage.storeCredential;
             const storeSpy = vi
                 .spyOn(credentialStorage, 'storeCredential')
-                .mockImplementation(async payload => {
-                    expect(await getRecord(issued.issuanceId)).toMatchObject({
-                        currentStatus: 'ISSUED',
-                    });
+                .mockImplementation(async (payload, transaction, ownerProfileId) => {
+                    expect(transaction).toBeDefined();
+                    const result = await transaction!.run(
+                        'MATCH (n:InboxCredential {id: $id}) RETURN n.currentStatus AS status',
+                        { id: issued.issuanceId }
+                    );
+                    expect(result.records[0]?.get('status')).toBe('ISSUED');
                     if (outcome === 'storage failure') throw new Error('Storage unavailable');
-                    return store(payload);
+                    return store(payload, transaction, ownerProfileId);
                 });
             if (outcome === 'lost race') {
                 // Another request wins after this request has read the pending payload.
@@ -336,7 +338,7 @@ describe('Universal Inbox escrow (HTTP + isolated Neo4j/Redis)', () => {
             }
 
             expect(await claim(issued.claimUrl!)).toEqual(
-                outcome === 'lost race' ? [] : [credential]
+                outcome === 'success' ? [credential] : []
             );
             expect(storeSpy).toHaveBeenCalledTimes(outcome === 'lost race' ? 0 : 1);
             const stored = await neogma.queryRunner.run(
@@ -348,7 +350,15 @@ describe('Universal Inbox escrow (HTTP + isolated Neo4j/Redis)', () => {
                 'MATCH ()-[r:CLAIMED_INBOX_CREDENTIAL]->(n:InboxCredential {id: $id}) RETURN count(r) AS count',
                 { id: issued.issuanceId }
             );
-            expect(audit.records[0]!.get('count').toNumber()).toBe(outcome === 'lost race' ? 0 : 1);
+            expect(audit.records[0]!.get('count').toNumber()).toBe(outcome === 'success' ? 1 : 0);
+            if (outcome === 'storage failure') {
+                expect(await getRecord(issued.issuanceId)).toMatchObject({
+                    currentStatus: 'PENDING',
+                });
+                storeSpy.mockRestore();
+                expect(await claim(issued.claimUrl!)).toEqual([credential]);
+                await expectStoredStatus(credential);
+            }
         }
     );
 
@@ -898,18 +908,4 @@ describe('Universal Inbox escrow (HTTP + isolated Neo4j/Redis)', () => {
             currentStatus: 'EXPIRED',
         });
     });
-
-    it('wires the maintenance worker to an enabled daily schedule', async () => {
-        const config = await readFile(new URL('../serverless.yml', import.meta.url), 'utf8');
-        expect(config).toMatch(
-            /inboxMaintenance:\s+handler: lambda\.inboxMaintenanceHandler[\s\S]*?rate: rate\(1 day\)\s+enabled: true/
-        );
-        // lambda.ts is a thin bootstrap entry that delegates to the lazily imported lambdaApp.ts.
-        const entry = await readFile(new URL('../lambda.ts', import.meta.url), 'utf8');
-        expect(entry).toMatch(
-            /export const inboxMaintenanceHandler[\s\S]*?\(await getApplication\(\)\)\.inboxMaintenanceHandler\(/
-        );
-        const handler = await readFile(new URL('../lambdaApp.ts', import.meta.url), 'utf8');
-        expect(handler).toMatch(/inboxMaintenanceHandler[\s\S]*?await runInboxMaintenance\(\)/);
-    });
 });