@serfab/cadre-host 0.7.1 → 0.9.0

package/src/auth/__tests__/trust-circle.test.ts

@@ -9,11 +9,12 @@ import { TrustCircleService, createTrustCircleHandlers } from '../trust-circle.j
 import { TrustCircleStore } from '../trust-circle-store.js';
 import { TrustCircleError } from '../types.js';
 import type { CadreNodeLike } from '../trust-circle.js';
+import { OwnerNodeUnavailableError } from '../../owner/owner-node-client.js';
 
 /**
- * Minimal in-memory mock of CadreNode + ControlDatabase. Records calls so
- * assertions can verify the auth + redemption flow without standing up a
- * real libp2p control network.
+ * Minimal in-memory mock of the owner-node channel adapter. Records calls
+ * so assertions can verify the auth + redemption flow without standing up a
+ * real libp2p control network or admin channel.
  */
 class MockCadreNode implements CadreNodeLike {
   readonly authorizedPeers = new Set<string>();
@@ -23,14 +24,14 @@ class MockCadreNode implements CadreNodeLike {
 
   /** Toggle to make acceptPhone reject. */
   acceptShouldThrow: Error | null = null;
-  /** Toggle to make getControlDatabase return null (simulate offline). */
-  dbAvailable = true;
+  /** When false, membership calls throw OwnerNodeUnavailableError. */
+  nodeAvailable = true;
 
   async createInvite(token?: string, expiresIn?: number) {
     this.issuedInvites.push({ token, expiresIn });
     const invite: CadreInvite = {
       partyId: 'party-test',
-      authorityAddrs: ['/ip4/127.0.0.1/tcp/4001'],
+      ownerAddrs: ['/ip4/127.0.0.1/tcp/4001'],
       token,
       createdAt: Date.now(),
       ...(expiresIn ? { expiresAt: Date.now() + expiresIn } : {}),
@@ -53,21 +54,14 @@ class MockCadreNode implements CadreNodeLike {
     return 'enc:' + JSON.stringify(invite);
   }
 
-  getControlDatabase() {
-    if (!this.dbAvailable) return null;
-    const peers = this.authorizedPeers;
-    return {
-      getDatabase: () => ({
-        async *eval(_sql: string, params?: unknown[]) {
-          if (params && params.length > 0) {
-            const target = params[0] as string;
-            if (peers.has(target)) yield { PeerId: target };
-            return;
-          }
-          for (const p of peers) yield { PeerId: p };
-        },
-      }),
-    } as unknown as ReturnType<CadreNodeLike['getControlDatabase']>;
+  async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
+  }
+
+  async isMember(peerId: string): Promise<boolean> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return this.authorizedPeers.has(peerId);
   }
 }
 
@@ -204,6 +198,71 @@ describe('TrustCircleService.redeemInvite', () => {
     expect(cadreNode.authorizedPeers.has('pA')).toBe(true);
     expect(cadreNode.authorizedPeers.has('pB')).toBe(false);
   });
+
+  it('preserves the pending token when acceptPhone fails with node_unavailable', async () => {
+    const { token } = await service.issueInvite({ label: 'Transient' });
+    cadreNode.acceptShouldThrow = new OwnerNodeUnavailableError('node down');
+
+    await expect(service.redeemInvite({ token, peerId: 'pTrans' }))
+      .rejects.toMatchObject({ code: 'node_unavailable' });
+
+    // Token must still be redeemable.
+    expect(store.getPending(token)).toBeDefined();
+    expect(cadreNode.authorizedPeers.has('pTrans')).toBe(false);
+
+    // Retry after the node recovers.
+    cadreNode.acceptShouldThrow = null;
+    await expect(service.redeemInvite({ token, peerId: 'pTrans' }))
+      .resolves.toMatchObject({ peerId: 'pTrans', label: 'Transient' });
+    expect(cadreNode.authorizedPeers.has('pTrans')).toBe(true);
+    expect(store.getPending(token)).toBeUndefined();
+  });
+
+  it('concurrent redeem during a gated node_unavailable leaves the token re-redeemable', async () => {
+    const { token } = await service.issueInvite({ label: 'GatedFail' });
+
+    // Gate acceptPhone — reject on release with a transient error so the
+    // first redeem hits node_unavailable. The second redeem should still
+    // bounce synchronously while the gate is held.
+    let release!: () => void;
+    const gate = new Promise<void>((_, reject) => { release = () => reject(new OwnerNodeUnavailableError('node down')); });
+    cadreNode.acceptPhone = async () => {
+      await gate;
+    };
+
+    const first = service.redeemInvite({ token, peerId: 'pA' });
+    const second = service.redeemInvite({ token, peerId: 'pB' });
+
+    await expect(second).rejects.toMatchObject({ code: 'already_redeemed' });
+
+    release();
+    await expect(first).rejects.toMatchObject({ code: 'node_unavailable' });
+
+    // Pending row preserved; in-flight Set cleared via finally.
+    expect(store.getPending(token)).toBeDefined();
+    expect(cadreNode.authorizedPeers.has('pA')).toBe(false);
+    expect(cadreNode.authorizedPeers.has('pB')).toBe(false);
+
+    // Third redeem (after in-flight slot freed) succeeds against a healthy node.
+    cadreNode.acceptPhone = async (options) => {
+      cadreNode.authorizedPeers.add(options.phonePeerId);
+    };
+    await expect(service.redeemInvite({ token, peerId: 'pC' }))
+      .resolves.toMatchObject({ peerId: 'pC', label: 'GatedFail' });
+    expect(store.getPending(token)).toBeUndefined();
+    expect(cadreNode.authorizedPeers.has('pC')).toBe(true);
+  });
+
+  it('preserves the pending token on non-transient acceptPhone failures (admin must revoke)', async () => {
+    const { token } = await service.issueInvite({ label: 'OtherFail' });
+    cadreNode.acceptShouldThrow = new Error('cadre-core rejected the peer');
+
+    await expect(service.redeemInvite({ token, peerId: 'pX' }))
+      .rejects.toThrow('cadre-core rejected the peer');
+
+    expect(store.getPending(token)).toBeDefined();
+    expect(cadreNode.authorizedPeers.has('pX')).toBe(false);
+  });
 });
 
 describe('TrustCircleService.issueInvite — label length', () => {
@@ -290,16 +349,24 @@ describe('TrustCircleService.list', () => {
     expect(store.getMember('orphan')).toBeUndefined();
   });
 
-  it('falls back to local labels when control DB is unavailable', async () => {
+  it('falls back to local labels when the owner node is unavailable', async () => {
     store.addMember({ peerId: 'pZ', label: 'Zoe', addedAt: 't' });
-    cadreNode.dbAvailable = false;
+    cadreNode.nodeAvailable = false;
 
     const snap = await service.list();
     expect(snap.members.some(m => m.peerId === 'pZ' && m.label === 'Zoe')).toBe(true);
-    // Orphan check is skipped when DB is unavailable.
+    // Orphan check is skipped when the node is unavailable.
     expect(store.getMember('pZ')).toBeDefined();
   });
 
+  it('issueInvite surfaces node_unavailable when the channel is down', async () => {
+    const downNode = new MockCadreNode();
+    downNode.createInvite = async () => { throw new OwnerNodeUnavailableError('refused'); };
+    const svc = new TrustCircleService({ cadreNode: downNode, store });
+    await expect(svc.issueInvite({ label: 'Nina' }))
+      .rejects.toMatchObject({ code: 'node_unavailable' });
+  });
+
   it('shows unlabelled CadrePeer rows with peerId as label', async () => {
     cadreNode.authorizedPeers.add('unlabeled-peer');
     const snap = await service.list();