@peers-app/peers-sdk 0.27.3 → 0.27.5

package/dist/device/get-trust-level-fn.test.js

@@ -1,685 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils_1 = require("../utils");
-const get_trust_level_fn_1 = require("./get-trust-level-fn");
-const socket_type_1 = require("./socket.type");
-jest.mock("../context", () => ({
-    getUserContext: jest.fn(),
-}));
-jest.mock("../data", () => ({
-    Devices: jest.fn(),
-    Users: jest.fn(),
-    UserTrustLevels: jest.fn(),
-}));
-jest.mock("../identity/key-change", () => ({
-    evaluatePresentedKey: jest.fn(async () => ({ accepted: false, state: "pending" })),
-    detectIdentityRotatedAway: jest.fn(async () => undefined),
-}));
-const context_1 = require("../context");
-const data_1 = require("../data");
-const key_change_1 = require("../identity/key-change");
-const mockGetUserContext = context_1.getUserContext;
-const mockDevices = data_1.Devices;
-const mockUsers = data_1.Users;
-const mockUserTrustLevels = data_1.UserTrustLevels;
-function makeDeviceTable(deviceRecord = null) {
-    return {
-        get: jest.fn().mockResolvedValue(deviceRecord),
-        save: jest.fn().mockResolvedValue(undefined),
-    };
-}
-function makeUsersTable(userRecord = null) {
-    return {
-        get: jest.fn().mockResolvedValue(userRecord),
-        save: jest.fn().mockResolvedValue(undefined),
-    };
-}
-function makeTrustTable(trustRecord = null) {
-    return {
-        get: jest.fn().mockResolvedValue(trustRecord),
-    };
-}
-function makeTestIdentity() {
-    return {
-        userId: (0, utils_1.newid)(),
-        publicKey: `pk_${(0, utils_1.newid)()}`,
-        publicBoxKey: `pbk_${(0, utils_1.newid)()}`,
-        deviceId: (0, utils_1.newid)(),
-    };
-}
-function setupMocks(deviceRecord = null, userRecord = null, trustRecord = null) {
-    const mockUserDataContext = {};
-    mockGetUserContext.mockResolvedValue({
-        userDataContext: mockUserDataContext,
-        groupDataContexts: new Map(),
-    });
-    const devTable = makeDeviceTable(deviceRecord);
-    const usersTable = makeUsersTable(userRecord);
-    const trustTable = makeTrustTable(trustRecord);
-    mockDevices.mockReturnValue(devTable);
-    mockUsers.mockReturnValue(usersTable);
-    mockUserTrustLevels.mockReturnValue(trustTable);
-    return { devTable, usersTable, trustTable };
-}
-describe("getTrustLevelFn", () => {
-    beforeEach(() => {
-        jest.clearAllMocks();
-    });
-    // ─── Own-device fast path ───────────────────────────────────────────────────
-    describe("own device (userId + publicKey + publicBoxKey all match)", () => {
-        it("returns NewDevice when device is newly seen (< 2 days old)", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me };
-            const recentDate = new Date(Date.now() - 1000 * 60 * 60 * 24); // 1 day ago
-            const existingDevice = {
-                deviceId: me.deviceId,
-                userId: me.userId,
-                firstSeen: recentDate,
-                lastSeen: recentDate,
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            const { devTable } = setupMocks(existingDevice);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(deviceInfo);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({ trustLevel: socket_type_1.TrustLevel.NewDevice }), expect.objectContaining({ restoreIfDeleted: true, weakInsert: true }));
-        });
-        it("returns Trusted when own device has been seen for more than 2 days", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me };
-            const oldDate = new Date(Date.now() - 1000 * 60 * 60 * 24 * 3); // 3 days ago
-            const existingDevice = {
-                deviceId: me.deviceId,
-                userId: me.userId,
-                firstSeen: oldDate,
-                lastSeen: oldDate,
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            setupMocks(existingDevice);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(deviceInfo);
-            expect(result).toBe(socket_type_1.TrustLevel.Trusted);
-        });
-        it("creates a new device record if own device has not been seen before", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me };
-            const { devTable } = setupMocks(null); // no existing device
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me, "https://myserver.example.com");
-            const result = await getTrustLevel(deviceInfo);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({
-                deviceId: me.deviceId,
-                userId: me.userId,
-                serverUrl: "https://myserver.example.com",
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            }), expect.objectContaining({ restoreIfDeleted: true, weakInsert: true }));
-        });
-        it("does not look up Users or UserTrustLevels for own device", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me };
-            setupMocks(null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            await getTrustLevel(deviceInfo);
-            expect(mockUsers).not.toHaveBeenCalled();
-            expect(mockUserTrustLevels).not.toHaveBeenCalled();
-        });
-        it("updates lastSeen on every call for own device", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me };
-            const pastDate = new Date(Date.now() - 1000 * 60 * 5); // 5 minutes ago
-            const existingDevice = {
-                deviceId: me.deviceId,
-                userId: me.userId,
-                firstSeen: pastDate,
-                lastSeen: pastDate,
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            const { devTable } = setupMocks(existingDevice);
-            const before = Date.now();
-            await (0, get_trust_level_fn_1.getTrustLevelFn)(me)(deviceInfo);
-            const after = Date.now();
-            const savedDevice = devTable.save.mock.calls[0][0];
-            expect(savedDevice.lastSeen.getTime()).toBeGreaterThanOrEqual(before);
-            expect(savedDevice.lastSeen.getTime()).toBeLessThanOrEqual(after);
-        });
-        it("stores the owner-reported name without replacing a local device label", async () => {
-            const me = makeTestIdentity();
-            const deviceInfo = { ...me, deviceName: "Owner's laptop" };
-            const existingDevice = {
-                deviceId: me.deviceId,
-                userId: me.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                name: "My local label",
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            const { devTable } = setupMocks(existingDevice);
-            await (0, get_trust_level_fn_1.getTrustLevelFn)(me)(deviceInfo);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({
-                name: "My local label",
-                reportedName: "Owner's laptop",
-            }), expect.anything());
-        });
-    });
-    // ─── Blocked device early exit ──────────────────────────────────────────────
-    describe("explicitly blocked device (trustLevel < Unknown)", () => {
-        it("returns Untrusted immediately without saving any records", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const blockedDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Untrusted,
-            };
-            const { devTable } = setupMocks(blockedDevice);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            // All three tables are fetched in parallel before the block check
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-            // Should not save anything — returns early before any writes
-            expect(devTable.save).not.toHaveBeenCalled();
-        });
-        it("returns Malicious immediately for malicious-flagged devices", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const maliciousDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Malicious,
-            };
-            setupMocks(maliciousDevice);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Malicious);
-        });
-    });
-    // ─── Key-mismatch guard ─────────────────────────────────────────────────────
-    describe("key-mismatch guard (user AND device both exist)", () => {
-        it("returns Untrusted when publicKey does not match stored user record", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: `different_pk_${(0, utils_1.newid)()}`,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            setupMocks(existingDevice, existingUser);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-        it("returns Untrusted when publicBoxKey does not match stored user record", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: `different_pbk_${(0, utils_1.newid)()}`,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            setupMocks(existingDevice, existingUser);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-        it("returns Untrusted when device.userId does not match deviceInfo.userId", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: (0, utils_1.newid)(), // different userId stored on device record
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            setupMocks(existingDevice, existingUser);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-        it("does NOT return Untrusted when only device exists (no user record yet)", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            // user record is null — mismatch check is skipped
-            setupMocks(existingDevice, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).not.toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-        it("returns Untrusted for a known user's signing-key mismatch on a new device", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: `different_pk_${(0, utils_1.newid)()}`, // key mismatch present but device is missing
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            // device record is null — mismatch check is skipped
-            setupMocks(null, existingUser);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-        it("returns Untrusted for a known user's box-key mismatch on a new device", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: `different_pbk_${(0, utils_1.newid)()}`,
-                name: "Alice",
-            };
-            setupMocks(null, existingUser);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-        });
-    });
-    // ─── Trusted fast path ──────────────────────────────────────────────────────
-    describe("trusted fast path", () => {
-        it("returns Trusted immediately when device and userTrustLevel are both >= Trusted", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 30),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Trusted,
-            };
-            const trustRecord = {
-                userId: other.userId,
-                trustLevel: socket_type_1.TrustLevel.Trusted,
-            };
-            const { devTable } = setupMocks(existingDevice, existingUser, trustRecord);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Trusted);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({ trustLevel: socket_type_1.TrustLevel.Trusted }), expect.objectContaining({ restoreIfDeleted: true }));
-        });
-        it("does NOT trigger fast path when device is Trusted but userTrustLevel is not", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 10),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Trusted,
-            };
-            const trustRecord = {
-                userId: other.userId,
-                trustLevel: socket_type_1.TrustLevel.Known, // below Trusted
-            };
-            const { devTable } = setupMocks(existingDevice, existingUser, trustRecord);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            await getTrustLevel(other);
-            // save was called via the normal path (weakInsert), not the fast path
-            expect(devTable.save).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ weakInsert: true }));
-        });
-        it("does NOT trigger fast path when userTrustLevel is Trusted but device is not", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 10),
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Known, // below Trusted
-            };
-            const trustRecord = {
-                userId: other.userId,
-                trustLevel: socket_type_1.TrustLevel.Trusted,
-            };
-            setupMocks(existingDevice, existingUser, trustRecord);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).not.toBe(socket_type_1.TrustLevel.Trusted);
-        });
-    });
-    // ─── New user / new device resolution ───────────────────────────────────────
-    describe("new user and new device", () => {
-        it("returns NewDevice and saves a user stub when both user and device are unseen", async () => {
-            const me = makeTestIdentity();
-            const other = {
-                ...makeTestIdentity(),
-                userName: "Alice",
-                deviceName: "Alice's phone",
-            };
-            const { devTable, usersTable } = setupMocks(null, null, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me, "https://server.example.com");
-            const result = await getTrustLevel(other);
-            // The local `trustLevel` variable is set to NewUser (10), but the function returns
-            // `device.trustLevel` which remains NewDevice (20). The NewUser assignment was
-            // intended for the now-commented-out `device.trustLevel = remoteTrustLevel || trustLevel`.
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-            expect(usersTable.save).toHaveBeenCalledWith(expect.objectContaining({
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            }), expect.objectContaining({ restoreIfDeleted: true, weakInsert: true }));
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({
-                deviceId: other.deviceId,
-                userId: other.userId,
-                reportedName: "Alice's phone",
-                serverUrl: "https://server.example.com",
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            }), expect.objectContaining({ restoreIfDeleted: true, weakInsert: true }));
-        });
-        it("uses a fallback name from userId suffix when serverUrl is not provided", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const { usersTable } = setupMocks(null, null, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me); // no serverUrl
-            await getTrustLevel(other);
-            const savedUser = usersTable.save.mock.calls[0][0];
-            expect(savedUser.name).toBe(`Unnamed_${other.userId.substring(20)}`);
-        });
-        it("does not save a user stub when user already exists", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const { usersTable } = setupMocks(null, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            await getTrustLevel(other);
-            expect(usersTable.save).not.toHaveBeenCalled();
-        });
-    });
-    // ─── Device aging ────────────────────────────────────────────────────────────
-    describe("device aging", () => {
-        it("returns NewDevice for a device first seen < 7 days ago", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 5), // 5 days ago
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            setupMocks(existingDevice, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-        });
-        it("promotes device to Known when first seen > 7 days ago", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 8), // 8 days ago
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            const { devTable } = setupMocks(existingDevice, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Known);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({ trustLevel: socket_type_1.TrustLevel.Known }), expect.anything());
-        });
-        it("bumps existing device with Unknown trust level up to NewDevice", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 3), // 3 days, under 7-day threshold
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Unknown,
-            };
-            const { devTable } = setupMocks(existingDevice, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({ trustLevel: socket_type_1.TrustLevel.NewDevice }), expect.anything());
-        });
-        it("does not downgrade a device already at Known when re-evaluated before 7 days", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 5), // 5 days — under 7-day threshold
-                lastSeen: new Date(),
-                trustLevel: socket_type_1.TrustLevel.Known, // manually promoted already
-            };
-            setupMocks(existingDevice, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.Known);
-        });
-        it("updates lastSeen on the device record each time", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const pastDate = new Date(Date.now() - 1000 * 60 * 60); // 1 hour ago
-            const existingDevice = {
-                deviceId: other.deviceId,
-                userId: other.userId,
-                firstSeen: new Date(Date.now() - 1000 * 60 * 60 * 24 * 2),
-                lastSeen: pastDate,
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            };
-            const { devTable } = setupMocks(existingDevice, existingUser, null);
-            const before = Date.now();
-            await (0, get_trust_level_fn_1.getTrustLevelFn)(me)(other);
-            const after = Date.now();
-            const savedDevice = devTable.save.mock.calls[0][0];
-            expect(savedDevice.lastSeen.getTime()).toBeGreaterThanOrEqual(before);
-            expect(savedDevice.lastSeen.getTime()).toBeLessThanOrEqual(after);
-        });
-    });
-    // ─── Existing user, no device ────────────────────────────────────────────────
-    describe("existing user but no device record", () => {
-        it("creates a new device record with NewDevice trust level", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-                name: "Alice",
-            };
-            const { devTable } = setupMocks(null, existingUser, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me, "https://relay.example.com");
-            const result = await getTrustLevel(other);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-            expect(devTable.save).toHaveBeenCalledWith(expect.objectContaining({
-                deviceId: other.deviceId,
-                userId: other.userId,
-                serverUrl: "https://relay.example.com",
-                trustLevel: socket_type_1.TrustLevel.NewDevice,
-            }), expect.anything());
-        });
-    });
-    // ─── Parallel DB lookups ────────────────────────────────────────────────────
-    describe("parallel DB lookups for non-self devices", () => {
-        it("queries Users, Devices and UserTrustLevels in parallel", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            setupMocks(null, null, null);
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            await getTrustLevel(other);
-            expect(mockDevices).toHaveBeenCalled();
-            expect(mockUsers).toHaveBeenCalled();
-            expect(mockUserTrustLevels).toHaveBeenCalled();
-        });
-    });
-    describe("anchor confirmation", () => {
-        it("accepts a different key when the anchors confirm a rotation", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: `stored_${(0, utils_1.newid)()}`,
-                publicBoxKey: `stored_box_${(0, utils_1.newid)()}`,
-                name: "Alice",
-            };
-            const { usersTable } = setupMocks(null, existingUser, null);
-            usersTable.get.mockResolvedValueOnce(existingUser).mockResolvedValueOnce({
-                ...existingUser,
-                publicKey: other.publicKey,
-                publicBoxKey: other.publicBoxKey,
-            });
-            key_change_1.evaluatePresentedKey.mockResolvedValueOnce({
-                accepted: true,
-                state: "confirmed-rotation",
-            });
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(other);
-            expect(key_change_1.evaluatePresentedKey).toHaveBeenCalledWith(expect.objectContaining({
-                userId: other.userId,
-                presentedKey: other.publicKey,
-            }));
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-        });
-        it("writes nothing for a contact's key the anchors have not confirmed", async () => {
-            // Pending, vetoed, and a recovery still in its delay all land here: the handshake is
-            // refused and neither a device record nor a user stub is created for the presenter.
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const existingUser = {
-                userId: other.userId,
-                publicKey: `stored_${(0, utils_1.newid)()}`,
-                publicBoxKey: `stored_box_${(0, utils_1.newid)()}`,
-                name: "Alice",
-            };
-            for (const state of ["pending", "vetoed", "recovery-pending"]) {
-                const { usersTable, devTable } = setupMocks(null, existingUser, null);
-                key_change_1.evaluatePresentedKey.mockResolvedValueOnce({ accepted: false, state });
-                const result = await (0, get_trust_level_fn_1.getTrustLevelFn)(me)(other);
-                expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-                expect(usersTable.save).not.toHaveBeenCalled();
-                expect(devTable.save).not.toHaveBeenCalled();
-            }
-        });
-        it("judges a group-only contact's new key against the group row and copies nothing into the personal table", async () => {
-            const me = makeTestIdentity();
-            const other = makeTestIdentity();
-            const groupUser = {
-                userId: other.userId,
-                publicKey: `stored_${(0, utils_1.newid)()}`,
-                publicBoxKey: `stored_box_${(0, utils_1.newid)()}`,
-                name: "Alice",
-            };
-            const { usersTable, devTable } = setupMocks(null, null, null);
-            const groupUsersTable = makeUsersTable(groupUser);
-            const groupTrustTable = makeTrustTable({ trustLevel: socket_type_1.TrustLevel.Known });
-            const groupContext = { dataContextId: "group" };
-            mockGetUserContext.mockResolvedValue({
-                userDataContext: {},
-                groupDataContexts: new Map([["group", groupContext]]),
-            });
-            mockUsers.mockImplementation(((context) => context === groupContext ? groupUsersTable : usersTable));
-            mockUserTrustLevels.mockImplementation(((context) => context === groupContext ? groupTrustTable : makeTrustTable(null)));
-            key_change_1.evaluatePresentedKey.mockResolvedValueOnce({
-                accepted: true,
-                state: "confirmed-rotation",
-            });
-            const result = await (0, get_trust_level_fn_1.getTrustLevelFn)(me)(other);
-            expect(key_change_1.evaluatePresentedKey).toHaveBeenCalledWith(expect.objectContaining({ userId: other.userId, record: groupUser }));
-            // The group row is the only record; it is not copied into the personal table.
-            expect(usersTable.save).not.toHaveBeenCalled();
-            expect(groupUsersTable.save).not.toHaveBeenCalled();
-            expect(devTable.save).toHaveBeenCalledTimes(1);
-            expect(result).toBe(socket_type_1.TrustLevel.NewDevice);
-        });
-        it("treats another device of this user on a different key as untrusted", async () => {
-            const me = makeTestIdentity();
-            const otherDevice = { ...me, deviceId: (0, utils_1.newid)(), publicKey: `other_${(0, utils_1.newid)()}` };
-            setupMocks();
-            const getTrustLevel = (0, get_trust_level_fn_1.getTrustLevelFn)(me);
-            const result = await getTrustLevel(otherDevice);
-            expect(result).toBe(socket_type_1.TrustLevel.Untrusted);
-            expect(key_change_1.detectIdentityRotatedAway).toHaveBeenCalledWith(me, expect.objectContaining({ userId: me.userId, publicKey: otherDevice.publicKey }));
-            expect(mockUsers).not.toHaveBeenCalled();
-        });
-    });
-});