@serfab/cadre-host 1.13.0 → 1.15.0

package/src/__tests__/orchestrator-pin-keys.test.ts

@@ -1,152 +0,0 @@
-/**
- * HostProcessOrchestrator pinned-owner-key tests — the load-bearing wiring for
- * the node-donation flow.
- *
- * A donated node joins a FOREIGN cadre and must accept a requester-signed seed,
- * so the orchestrator threads `request.pinnedOwnerKeys` into the child as the
- * comma-separated `CADRE_OWNER_KEYS` env var (which `cadre-cli start` turns into
- * a cold-start pinned-key trust policy). The same signal marks the node as
- * foreign-party, which suppresses the host's own push credentials (meaningless
- * to another cadre's app).
- *
- * A fake CLI records `CADRE_OWNER_KEYS` from its environment to a file so the
- * env threading is observable without a real cadre node.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import type { PushCredentials } from '@serfab/cadre-core';
-import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-import { removeAllNodes } from './orchestrator-teardown.js';
-
-// Writes CADRE_OWNER_KEYS (as seen in the child env) next to the startup token,
-// then behaves like a minimal long-lived node.
-const FAKE_CLI = `
-import fs from 'node:fs';
-import path from 'node:path';
-const args = process.argv.slice(2);
-const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
-const tokenPath = get('--startup-token-file');
-const token = process.env.CADRE_STARTUP_TOKEN ?? '';
-if (tokenPath) {
-  const dir = path.dirname(tokenPath);
-  try { fs.writeFileSync(path.join(dir, 'owner-keys.txt'), process.env.CADRE_OWNER_KEYS ?? '', 'utf8'); } catch (e) { console.error(e); }
-  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
-}
-process.on('SIGTERM', () => process.exit(0));
-setInterval(() => {}, 1 << 30);
-`;
-
-const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-SECRET-PEM' };
-
-let tmpRoot: string;
-let scriptPath: string;
-const orchestrators: HostProcessOrchestrator[] = [];
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-pin-'));
-  scriptPath = join(tmpRoot, 'fake-cli.mjs');
-  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
-});
-
-afterEach(async () => {
-  try {
-    await removeAllNodes(orchestrators);
-  } finally {
-    await sleep(50);
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  }
-});
-
-function makeOrchestrator(rootDir: string, pushResolver?: () => Promise<PushCredentials | undefined>): HostProcessOrchestrator {
-  mkdirSync(rootDir, { recursive: true });
-  const orch = new HostProcessOrchestrator({
-    rootDir,
-    portRange: { start: 18500, end: 18999 },
-    stopTimeoutMs: 1500,
-    spawn: { entrypoint: scriptPath },
-    ...(pushResolver ? { pushResolver } : {}),
-  });
-  orchestrators.push(orch);
-  return orch;
-}
-
-function readChildConfig(rootDir: string, containerId: string): Record<string, unknown> {
-  return JSON.parse(readFileSync(join(rootDir, containerId, 'cadre.json'), 'utf8')) as Record<string, unknown>;
-}
-
-async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (existsSync(path)) return readFileSync(path, 'utf8');
-    await sleep(50);
-  }
-  throw new Error(`file never appeared: ${path}`);
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((res) => setTimeout(res, ms));
-}
-
-describe('HostProcessOrchestrator pinned owner keys', () => {
-  it('threads pinnedOwnerKeys into the child as comma-separated CADRE_OWNER_KEYS', async () => {
-    const rootDir = join(tmpRoot, 'a');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'donated-1',
-      partyId: 'foreign-P',
-      bootstrapNodes: [],
-      profile: 'storage',
-      pinnedOwnerKeys: ['key-a', 'key-b'],
-    });
-
-    const keys = await waitForFile(join(rootDir, 'donated-1', 'owner-keys.txt'));
-    expect(keys).toBe('key-a,key-b');
-  });
-
-  it('suppresses host push for a foreign-party (pinned-key) node even on storage profile', async () => {
-    const rootDir = join(tmpRoot, 'b');
-    const orch = makeOrchestrator(rootDir, async () => ({ fcm: FCM }));
-    await orch.init();
-
-    // Foreign-party donated node: pinned keys present → no host push injected.
-    await orch.createContainer({
-      containerId: 'donated-2',
-      partyId: 'foreign-P',
-      bootstrapNodes: [],
-      profile: 'storage',
-      pinnedOwnerKeys: ['key-a'],
-    });
-    expect(readChildConfig(rootDir, 'donated-2').push).toBeUndefined();
-
-    // Control: a host-own storage node (no pinned keys) DOES get push.
-    await orch.createContainer({
-      containerId: 'own-1',
-      partyId: 'host-P',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-    expect(readChildConfig(rootDir, 'own-1').push).toEqual({ fcm: FCM });
-  });
-
-  it('omits CADRE_OWNER_KEYS when no pinned keys are supplied', async () => {
-    const rootDir = join(tmpRoot, 'c');
-    const orch = makeOrchestrator(rootDir);
-    await orch.init();
-
-    await orch.createContainer({
-      containerId: 'own-2',
-      partyId: 'host-P',
-      bootstrapNodes: [],
-      profile: 'storage',
-    });
-
-    const keys = await waitForFile(join(rootDir, 'own-2', 'owner-keys.txt'));
-    expect(keys).toBe(''); // env var absent → child reads empty string
-  });
-});

package/src/auth/__tests__/duration.test.ts

@@ -1,28 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { parseDuration } from '../duration.js';
-
-describe('parseDuration', () => {
-  it('parses common units', () => {
-    expect(parseDuration('500ms')).toBe(500);
-    expect(parseDuration('30s')).toBe(30_000);
-    expect(parseDuration('5m')).toBe(5 * 60 * 1000);
-    expect(parseDuration('24h')).toBe(24 * 60 * 60 * 1000);
-    expect(parseDuration('7d')).toBe(7 * 24 * 60 * 60 * 1000);
-    expect(parseDuration('2w')).toBe(2 * 7 * 24 * 60 * 60 * 1000);
-  });
-
-  it('treats bare numbers as milliseconds', () => {
-    expect(parseDuration('1234')).toBe(1234);
-  });
-
-  it('accepts whitespace and decimals', () => {
-    expect(parseDuration('  1.5h  ')).toBe(Math.round(1.5 * 60 * 60 * 1000));
-  });
-
-  it('throws on garbage input', () => {
-    expect(() => parseDuration('abc')).toThrow();
-    expect(() => parseDuration('1y')).toThrow();
-    expect(() => parseDuration('')).toThrow();
-  });
-});

package/src/auth/__tests__/self-label.test.ts

@@ -1,85 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { SELF_LABEL, ensureSelfLabel } from '../self-label.js';
-import { TrustCircleStore } from '../trust-circle-store.js';
-
-let tmpRoot: string;
-let store: TrustCircleStore;
-
-const NOW = new Date('2025-06-01T12:00:00.000Z');
-const now = (): Date => NOW;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-self-label-'));
-  store = new TrustCircleStore(tmpRoot);
-});
-
-afterEach(() => {
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('ensureSelfLabel', () => {
-  it('writes a self-flagged label for the owner peer ID', async () => {
-    const peerId = await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
-
-    expect(peerId).toBe('12D3KooWOwner');
-    expect(store.getMember('12D3KooWOwner')).toEqual({
-      peerId: '12D3KooWOwner',
-      label: SELF_LABEL,
-      addedAt: NOW.toISOString(),
-      self: true,
-    });
-  });
-
-  it('keeps an admin-renamed label on a second run', async () => {
-    store.addMember({ peerId: '12D3KooWOwner', label: 'Basement PC', addedAt: 't0', self: true });
-
-    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
-
-    expect(store.getMember('12D3KooWOwner')).toMatchObject({ label: 'Basement PC', addedAt: 't0', self: true });
-  });
-
-  it('stamps the self flag onto a pre-existing unflagged row', async () => {
-    store.addMember({ peerId: '12D3KooWOwner', label: 'Basement PC', addedAt: 't0' });
-
-    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWOwner', now });
-
-    expect(store.getMember('12D3KooWOwner')).toEqual({
-      peerId: '12D3KooWOwner',
-      label: 'Basement PC',
-      addedAt: 't0',
-      self: true,
-    });
-  });
-
-  it('drops a stale self label after the node identity changes', async () => {
-    store.addMember({ peerId: '12D3KooWOld', label: SELF_LABEL, addedAt: 't0', self: true });
-    store.addMember({ peerId: '12D3KooWPhone', label: "Mom's phone", addedAt: 't1' });
-
-    await ensureSelfLabel({ store, getPeerId: async () => '12D3KooWNew', now });
-
-    expect(store.getMember('12D3KooWOld')).toBeUndefined();
-    expect(store.getMember('12D3KooWNew')).toMatchObject({ label: SELF_LABEL, self: true });
-    // Non-self labels are untouched.
-    expect(store.getMember('12D3KooWPhone')).toMatchObject({ label: "Mom's phone" });
-  });
-
-  it('writes nothing when the node is not ready yet (empty peer ID)', async () => {
-    const peerId = await ensureSelfLabel({ store, getPeerId: async () => '', now });
-
-    expect(peerId).toBeUndefined();
-    expect(store.listMembers()).toEqual([]);
-  });
-
-  it('propagates a getPeerId failure to the caller', async () => {
-    await expect(ensureSelfLabel({
-      store,
-      getPeerId: async () => { throw new Error('owner node unavailable'); },
-      now,
-    })).rejects.toThrow('owner node unavailable');
-    expect(store.listMembers()).toEqual([]);
-  });
-});

package/src/auth/__tests__/trust-circle-integration.test.ts

@@ -1,152 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { generateKeyPair } from '@libp2p/crypto/keys';
-import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import { CadreNode, ed25519KeyPairFromLibp2p } from '@serfab/cadre-core';
-
-import { ensureSelfLabel } from '../self-label.js';
-import { TrustCircleService } from '../trust-circle.js';
-import { TrustCircleStore } from '../trust-circle-store.js';
-
-/**
- * End-to-end integration test: stand up a real host CadreNode with a real
- * Quereus control DB and exercise the full TrustCircleService issue → redeem
- * → list → remove cycle. The "phone" peerId is derived from a fresh Ed25519
- * key (no second libp2p node) since the test only validates host-side state.
- *
- * This replaces the mock CadreNodeLike in trust-circle.test.ts with the real
- * CadreNode to validate that:
- *  - `acceptPhone` (called from redeemInvite with a sparse reconstructed
- *    invite) actually inserts a CadrePeer row;
- *  - `list()` picks up the new peer via the canonical CadrePeer query;
- *  - `removeMember` deletes the row from CadrePeer via the
- *    DELETE-with-context syntax that cadre-core trusts from
- *    `quereus/docs/sql.md`.
- */
-describe('TrustCircleService — real CadreNode integration', () => {
-  let tmpRoot: string;
-  let host: CadreNode;
-  let store: TrustCircleStore;
-  let service: TrustCircleService;
-  let hostOwnerPrivateKey: string;
-  let hostOwnerPublicKey: string;
-
-  beforeEach(async () => {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
-
-    // Own-owner host: the node's libp2p identity key IS its owner key
-    // (the cadre-cli `--owner` shape), so registerSelf can owner-sign the
-    // INSERT of its own CadrePeer row.
-    const hostKey = await generateKeyPair('Ed25519');
-    const owner = ed25519KeyPairFromLibp2p(hostKey);
-    hostOwnerPrivateKey = owner.privateKeyB64;
-    hostOwnerPublicKey = owner.publicKeyB64;
-
-    const baseId = Math.random().toString(36).slice(2);
-
-    host = new CadreNode({
-      controlNetwork: { partyId: `host-${baseId}`, bootstrapNodes: [] },
-      privateKey: hostKey,
-      profile: 'transaction'
-    });
-
-    await host.start();
-
-    const db = host.getControlDatabase();
-    expect(db).not.toBeNull();
-    await db!.insertOwnerKey(hostOwnerPublicKey);
-
-    await host.initializeSeedBootstrap(hostOwnerPrivateKey);
-
-    // The owner writes its own CadrePeer row up-front (the implement ticket's
-    // CLI change). After this the host's own peerId is a member, so it shows up
-    // alongside any redeemed peers in the trust-circle listing.
-    await host.registerSelf();
-
-    store = new TrustCircleStore(tmpRoot);
-    // Same self-labelling call bin/host.ts makes at startup, wired to the real
-    // node's peer ID instead of an OwnerNodeClient (this test constructs
-    // TrustCircleService directly against a CadreNode, so no client is in play).
-    await ensureSelfLabel({ store, getPeerId: async () => host.peerId!.toString() });
-    service = new TrustCircleService({ cadreNode: host, store });
-  }, 60_000);
-
-  afterEach(async () => {
-    try { await host.stop(); } catch { /* ignore */ }
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  });
-
-  it('issues → redeems → lists against the real control DB (listMembers path)', async () => {
-    // Derive a shape-valid peerId from a fresh Ed25519 key — same pattern as
-    // packages/cadre-core/test/seed-bootstrap.spec.ts. The AuthorizedInsert
-    // constraint only checks the signature over digest(PeerId,…); peerId
-    // *liveness* doesn't matter for the host-side CRUD path under test.
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    // Issue
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    expect(issued.token).toBeTruthy();
-    expect(issued.encodedInvite).toBeTruthy();
-
-    // Redeem — this calls host.acceptPhone() with the sparse reconstructed
-    // invite, which in turn calls authorizePeer and inserts CadrePeer.
-    const redeemed = await service.redeemInvite({
-      token: issued.token,
-      peerId: phonePeerId
-    });
-    expect(redeemed).toEqual({ peerId: phonePeerId, label: "Mom's phone" });
-
-    // Verify directly against the control DB: the row is there.
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    // List — exercises the CadreNode.listMembers() path. CadrePeer now carries
-    // the host's own self-registered row in addition to the redeemed phone.
-    const snap = await service.list();
-    expect(snap.members).toHaveLength(2);
-    const phoneMember = snap.members.find((m) => m.peerId === phonePeerId);
-    expect(phoneMember).toBeDefined();
-    expect(phoneMember!.label).toBe("Mom's phone");
-    // The host's own peerId is present too (unlabeled → bare peerId as label).
-    expect(snap.members.some((m) => m.peerId === host.peerId!.toString())).toBe(true);
-    expect(snap.pending).toHaveLength(0);
-  }, 90_000);
-
-  // The signed `CadrePeer` DELETE previously threw a Quereus deferred-constraint
-  // error ("No row context found for column PeerId") inside cadre-core's
-  // removePeer. That upstream bug is fixed (`quereus-cadrepeer-delete-no-row-context`,
-  // landed), so the full issue → redeem → remove cycle is now exercised here.
-  it('removes a member from CadrePeer', async () => {
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    await service.redeemInvite({ token: issued.token, peerId: phonePeerId });
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    await service.removeMember(phonePeerId);
-
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(false);
-    expect(store.getMember(phonePeerId)).toBeUndefined();
-    const afterRemove = await service.list();
-    // The phone is gone; the host's own self-registered row remains.
-    expect(afterRemove.members.map((m) => m.peerId)).not.toContain(phonePeerId);
-    expect(afterRemove.members).toHaveLength(1);
-    expect(afterRemove.members[0]!.peerId).toBe(host.peerId!.toString());
-  }, 90_000);
-});
-
-async function isInCadrePeer(node: CadreNode, peerId: string): Promise<boolean> {
-  const db = node.getControlDatabase();
-  if (!db) return false;
-  const inner = db.getDatabase();
-  for await (const row of inner.eval(
-    'select PeerId from CadreControl.CadrePeer where PeerId = ?',
-    [peerId]
-  )) {
-    if (row.PeerId === peerId) return true;
-  }
-  return false;
-}

package/src/auth/__tests__/trust-circle-store.test.ts

@@ -1,115 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { TrustCircleStore } from '../trust-circle-store.js';
-import { TrustCircleError } from '../types.js';
-
-let tmpRoot: string;
-
-beforeEach(() => {
-  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-store-'));
-});
-
-afterEach(() => {
-  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-});
-
-describe('TrustCircleStore', () => {
-  it('returns empty state when file is missing', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    expect(store.listMembers()).toEqual([]);
-    expect(store.listPending()).toEqual([]);
-  });
-
-  it('round-trips members through save/load', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({
-      peerId: '12D3KooWAlice',
-      label: "Alice's phone",
-      addedAt: '2025-01-01T00:00:00.000Z',
-    });
-    store.addMember({
-      peerId: '12D3KooWBob',
-      label: 'Bob laptop',
-      addedAt: '2025-01-02T00:00:00.000Z',
-      self: true,
-    });
-
-    // Fresh instance reads from disk.
-    const reread = new TrustCircleStore(tmpRoot);
-    const members = reread.listMembers();
-    expect(members).toHaveLength(2);
-    expect(reread.getMember('12D3KooWAlice')).toMatchObject({ label: "Alice's phone" });
-    expect(reread.getMember('12D3KooWBob')?.self).toBe(true);
-  });
-
-  it('round-trips pending invites', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addPending({
-      token: 'token-A',
-      label: 'Mom',
-      createdAt: '2025-01-01T00:00:00.000Z',
-      expiresAt: '2025-01-02T00:00:00.000Z',
-    });
-    store.addPending({
-      token: 'token-B',
-      label: 'Dad',
-      createdAt: '2025-01-02T00:00:00.000Z',
-    });
-
-    const reread = new TrustCircleStore(tmpRoot);
-    expect(reread.listPending()).toHaveLength(2);
-    expect(reread.getPending('token-A')?.label).toBe('Mom');
-    expect(reread.getPending('token-B')?.expiresAt).toBeUndefined();
-  });
-
-  it('removes members and pending invites', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: 'p1', label: 'one', addedAt: 't' });
-    store.addPending({ token: 'tok', label: 'two', createdAt: 't' });
-
-    expect(store.removeMember('p1')).toBe(true);
-    expect(store.removeMember('p1')).toBe(false);
-    expect(store.removePending('tok')).toBe(true);
-    expect(store.removePending('tok')).toBe(false);
-
-    const reread = new TrustCircleStore(tmpRoot);
-    expect(reread.listMembers()).toEqual([]);
-    expect(reread.listPending()).toEqual([]);
-  });
-
-  it('writes through a temp file (atomic rename)', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: 'p1', label: 'one', addedAt: 't' });
-
-    // After save, no .tmp residue should remain.
-    expect(existsSync(join(tmpRoot, 'trust-circle.json'))).toBe(true);
-    expect(existsSync(join(tmpRoot, 'trust-circle.json.tmp'))).toBe(false);
-  });
-
-  it('throws on malformed file rather than silently wiping', () => {
-    writeFileSync(join(tmpRoot, 'trust-circle.json'), 'not json', 'utf8');
-    const store = new TrustCircleStore(tmpRoot);
-    expect(() => store.load()).toThrow(TrustCircleError);
-  });
-
-  it('throws on file with wrong shape', () => {
-    writeFileSync(
-      join(tmpRoot, 'trust-circle.json'),
-      JSON.stringify({ version: 99, foo: 'bar' }),
-      'utf8',
-    );
-    const store = new TrustCircleStore(tmpRoot);
-    expect(() => store.load()).toThrow(TrustCircleError);
-  });
-
-  it('persists version field in saved JSON', () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: 'p1', label: 'one', addedAt: 't' });
-    const raw = JSON.parse(readFileSync(join(tmpRoot, 'trust-circle.json'), 'utf8'));
-    expect(raw.version).toBe(1);
-    expect(raw.members.p1.label).toBe('one');
-  });
-});