@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/__tests__/invite-redemption-service.test.ts

@@ -7,6 +7,39 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+// Mock the gateway IPC bridge used by the redemption service for the
+// authoritative pre-mutation claim (record_invite_redemption). Tests drive the
+// claim result via `gatewayIpc`.
+const gatewayIpc = {
+  claim: { ok: true, updated: true, mirrored: true } as {
+    ok: boolean;
+    updated: boolean;
+    mirrored: boolean;
+  },
+  claimThrows: false,
+  calls: [] as { method: string; params?: Record<string, unknown> }[],
+};
+
+mock.module("../ipc/gateway-client.js", () => ({
+  ipcCallPersistent: async (
+    method: string,
+    params?: Record<string, unknown>,
+  ) => {
+    gatewayIpc.calls.push({ method, params });
+    if (method === "record_invite_redemption") {
+      if (gatewayIpc.claimThrows) throw new Error("gateway unreachable");
+      return gatewayIpc.claim;
+    }
+    return undefined;
+  },
+}));
+
+function resetGatewayIpc() {
+  gatewayIpc.claim = { ok: true, updated: true, mirrored: true };
+  gatewayIpc.claimThrows = false;
+  gatewayIpc.calls = [];
+}
+
 import {
   findContactChannel,
   getContact,
@@ -26,7 +59,7 @@ import {
 } from "../runtime/invite-redemption-service.js";
 import { hashVoiceCode } from "../util/voice-code.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables() {
   getSqlite().run("DELETE FROM assistant_ingress_invites");
@@ -40,9 +73,12 @@ function createTargetContact(displayName = "Target Contact"): string {
 }
 
 describe("invite-redemption-service", () => {
-  beforeEach(resetTables);
+  beforeEach(() => {
+    resetTables();
+    resetGatewayIpc();
+  });
 
-  test("redeems a valid invite and returns typed outcome", () => {
+  test("redeems a valid invite and returns typed outcome", async () => {
     const targetContactId = createTargetContact();
     const { rawToken, invite } = createInvite({
       sourceChannel: "telegram",
@@ -50,7 +86,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -65,7 +101,7 @@ describe("invite-redemption-service", () => {
     });
   });
 
-  test("marks channel as verified via invite on redemption", () => {
+  test("marks channel as verified via invite on redemption", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -73,7 +109,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -92,7 +128,7 @@ describe("invite-redemption-service", () => {
     expect(result!.channel.status).toBe("active");
   });
 
-  test("marks channel as verified via invite on 6-digit code redemption", () => {
+  test("marks channel as verified via invite on 6-digit code redemption", async () => {
     const targetContactId = createTargetContact();
     const inviteCode = "123456";
     createInvite({
@@ -102,7 +138,7 @@ describe("invite-redemption-service", () => {
       inviteCodeHash: hashVoiceCode(inviteCode),
     });
 
-    const outcome = redeemInviteByCode({
+    const outcome = await redeemInviteByCode({
       code: inviteCode,
       sourceChannel: "telegram",
       externalUserId: "code-user-1",
@@ -121,8 +157,8 @@ describe("invite-redemption-service", () => {
     expect(result!.channel.status).toBe("active");
   });
 
-  test("returns invalid_token for a bogus token", () => {
-    const outcome = redeemInvite({
+  test("returns invalid_token for a bogus token", async () => {
+    const outcome = await redeemInvite({
       rawToken: "totally-bogus-token",
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -131,7 +167,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
   });
 
-  test("returns expired for an expired invite", () => {
+  test("returns expired for an expired invite", async () => {
     const targetContactId = createTargetContact();
     // Create an invite that expired 1 ms ago
     const { rawToken } = createInvite({
@@ -141,7 +177,7 @@ describe("invite-redemption-service", () => {
       expiresInMs: -1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -150,7 +186,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "expired" });
   });
 
-  test("returns revoked for a revoked invite", () => {
+  test("returns revoked for a revoked invite", async () => {
     const targetContactId = createTargetContact();
     const { rawToken, invite } = createInvite({
       sourceChannel: "telegram",
@@ -159,7 +195,7 @@ describe("invite-redemption-service", () => {
     });
     revokeStoreFn(invite.id);
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -168,7 +204,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "revoked" });
   });
 
-  test("returns max_uses_reached when invite is fully consumed", () => {
+  test("returns max_uses_reached when invite is fully consumed", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -177,7 +213,7 @@ describe("invite-redemption-service", () => {
     });
 
     // First redemption should succeed
-    const first = redeemInvite({
+    const first = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -185,7 +221,7 @@ describe("invite-redemption-service", () => {
     expect(first.ok).toBe(true);
 
     // Second attempt should fail — the invite is now fully redeemed
-    const second = redeemInvite({
+    const second = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-2",
@@ -194,7 +230,7 @@ describe("invite-redemption-service", () => {
     expect(second).toEqual({ ok: false, reason: "max_uses_reached" });
   });
 
-  test("returns channel_mismatch when redeeming on wrong channel", () => {
+  test("returns channel_mismatch when redeeming on wrong channel", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -202,7 +238,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "phone",
       externalUserId: "user-1",
@@ -211,7 +247,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "channel_mismatch" });
   });
 
-  test("returns missing_identity when no externalUserId or externalChatId", () => {
+  test("returns missing_identity when no externalUserId or externalChatId", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -219,7 +255,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
     });
@@ -227,7 +263,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "missing_identity" });
   });
 
-  test("returns already_member when user is already an active member", () => {
+  test("returns already_member when user is already an active member", async () => {
     // Pre-create an active member and find their contact
     const member = upsertContactChannel({
       sourceChannel: "telegram",
@@ -242,7 +278,7 @@ describe("invite-redemption-service", () => {
       maxUses: 5,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "existing-user",
@@ -259,7 +295,7 @@ describe("invite-redemption-service", () => {
     ).toEqual(expect.any(String));
   });
 
-  test("returns invalid_token for a blocked member to avoid leaking membership status", () => {
+  test("returns invalid_token for a blocked member to avoid leaking membership status", async () => {
     // Pre-create a blocked member and find their contact
     const member = upsertContactChannel({
       sourceChannel: "telegram",
@@ -274,7 +310,7 @@ describe("invite-redemption-service", () => {
       maxUses: 5,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "blocked-user",
@@ -283,7 +319,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
   });
 
-  test("binds redeemer to the invite's target contact, not the guardian", () => {
+  test("binds redeemer to the invite's target contact, not the guardian", async () => {
     // Pre-create a guardian contact with a revoked telegram channel
     const guardianContact = upsertContact({
       displayName: "Guardian",
@@ -311,7 +347,7 @@ describe("invite-redemption-service", () => {
     });
 
     // Redeem using the guardian's Telegram identity
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "guardian-tg-id",
@@ -336,7 +372,7 @@ describe("invite-redemption-service", () => {
     expect(guardian!.role).toBe("guardian");
   });
 
-  test("downgrades guardian to contact when redeeming invite targeting own contact", () => {
+  test("downgrades guardian to contact when redeeming invite targeting own contact", async () => {
     // Create a guardian contact with a revoked channel
     const guardianContact = upsertContact({
       displayName: "Guardian",
@@ -357,7 +393,7 @@ describe("invite-redemption-service", () => {
       maxUses: 5,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "guardian-own-id",
@@ -370,7 +406,7 @@ describe("invite-redemption-service", () => {
     expect(updated!.role).toBe("contact");
   });
 
-  test("binds redeemer to the invite's target contact via 6-digit code, not the guardian", () => {
+  test("binds redeemer to the invite's target contact via 6-digit code, not the guardian", async () => {
     // Pre-create a guardian contact with a revoked telegram channel
     const guardianContact = upsertContact({
       displayName: "Guardian",
@@ -401,7 +437,7 @@ describe("invite-redemption-service", () => {
     });
 
     // Redeem using the guardian's Telegram identity
-    const outcome = redeemInviteByCode({
+    const outcome = await redeemInviteByCode({
       code,
       sourceChannel: "telegram",
       externalUserId: "guardian-code-id",
@@ -426,7 +462,7 @@ describe("invite-redemption-service", () => {
     expect(guardian!.role).toBe("guardian");
   });
 
-  test("does not return already_member for a revoked member", () => {
+  test("does not return already_member for a revoked member", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -442,7 +478,7 @@ describe("invite-redemption-service", () => {
     });
     expect(member!.channel.status).toBe("revoked");
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "revoked-user",
@@ -455,7 +491,7 @@ describe("invite-redemption-service", () => {
     ).toBe("redeemed");
   });
 
-  test("raw token is not present in the outcome object", () => {
+  test("raw token is not present in the outcome object", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "telegram",
@@ -463,7 +499,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "user-1",
@@ -474,7 +510,7 @@ describe("invite-redemption-service", () => {
     expect(serialized).not.toContain(rawToken);
   });
 
-  test("channel enforcement blocks cross-channel redemption (voice invite via slack)", () => {
+  test("channel enforcement blocks cross-channel redemption (voice invite via slack)", async () => {
     const targetContactId = createTargetContact();
     const { rawToken } = createInvite({
       sourceChannel: "phone",
@@ -482,7 +518,7 @@ describe("invite-redemption-service", () => {
       maxUses: 1,
     });
 
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "slack",
       externalUserId: "user-1",
@@ -491,7 +527,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "channel_mismatch" });
   });
 
-  test("returns invalid_token for an active member with a bogus token (no membership probing)", () => {
+  test("returns invalid_token for an active member with a bogus token (no membership probing)", async () => {
     // Pre-create an active member
     upsertContactChannel({
       sourceChannel: "telegram",
@@ -500,7 +536,7 @@ describe("invite-redemption-service", () => {
     });
 
     // Attempt to redeem with a bogus token — must NOT leak membership status
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken: "completely-bogus-token",
       sourceChannel: "telegram",
       externalUserId: "probed-user",
@@ -509,7 +545,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
   });
 
-  test("returns expired for an active member with an expired invite token", () => {
+  test("returns expired for an active member with an expired invite token", async () => {
     const targetContactId = createTargetContact();
     // Create an expired invite
     const { rawToken } = createInvite({
@@ -527,7 +563,7 @@ describe("invite-redemption-service", () => {
     });
 
     // Expired token must return expired, not already_member
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "expired-token-user",
@@ -536,7 +572,7 @@ describe("invite-redemption-service", () => {
     expect(outcome).toEqual({ ok: false, reason: "expired" });
   });
 
-  test("returns channel_mismatch for an active member with a valid token for a different channel", () => {
+  test("returns channel_mismatch for an active member with a valid token for a different channel", async () => {
     const targetContactId = createTargetContact();
     // Create an invite for voice
     const { rawToken } = createInvite({
@@ -553,7 +589,7 @@ describe("invite-redemption-service", () => {
     });
 
     // Valid token for wrong channel must return channel_mismatch, not already_member
-    const outcome = redeemInvite({
+    const outcome = await redeemInvite({
       rawToken,
       sourceChannel: "telegram",
       externalUserId: "cross-channel-user",
@@ -561,4 +597,169 @@ describe("invite-redemption-service", () => {
 
     expect(outcome).toEqual({ ok: false, reason: "channel_mismatch" });
   });
+
+  // ── Gateway lifecycle pre-check + redemption mirror ────────────────────
+
+  test("rejects redemption when the gateway claim is not consumable (no assistant mutation)", async () => {
+    const targetContactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
+
+    // Gateway row exists but was NOT consumable (revoked/exhausted/raced).
+    gatewayIpc.claim = { ok: true, updated: false, mirrored: true };
+
+    const outcome = await redeemInvite({
+      rawToken,
+      sourceChannel: "telegram",
+      externalUserId: "gw-revoked-user",
+    });
+
+    expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
+
+    // No member was created — the assistant DB was never mutated.
+    expect(
+      findContactChannel({
+        channelType: "telegram",
+        address: "gw-revoked-user",
+      }),
+    ).toBeNull();
+  });
+
+  test("proceeds and mutates when the gateway claim is consumed (updated:true)", async () => {
+    const targetContactId = createTargetContact();
+    const { rawToken, invite } = createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
+
+    gatewayIpc.claim = { ok: true, updated: true, mirrored: true };
+
+    const outcome = await redeemInvite({
+      rawToken,
+      sourceChannel: "telegram",
+      externalUserId: "gw-active-user",
+    });
+
+    expect(outcome.ok).toBe(true);
+
+    // The claim was performed against the resolved invite id.
+    const claim = gatewayIpc.calls.find(
+      (c) => c.method === "record_invite_redemption",
+    );
+    expect(claim).toBeDefined();
+    expect(claim!.params).toMatchObject({ inviteId: invite.id });
+
+    // The assistant DB was mutated.
+    expect(
+      findContactChannel({ channelType: "telegram", address: "gw-active-user" }),
+    ).not.toBeNull();
+  });
+
+  test("proceeds for a legacy invite the gateway has never seen (mirrored:false)", async () => {
+    const targetContactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
+
+    gatewayIpc.claim = { ok: true, updated: false, mirrored: false };
+
+    const outcome = await redeemInvite({
+      rawToken,
+      sourceChannel: "telegram",
+      externalUserId: "legacy-user",
+    });
+
+    expect(outcome.ok).toBe(true);
+    expect(
+      findContactChannel({ channelType: "telegram", address: "legacy-user" }),
+    ).not.toBeNull();
+  });
+
+  test("fails open when the gateway claim throws (assistant-side checks still apply)", async () => {
+    const targetContactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
+
+    gatewayIpc.claimThrows = true;
+
+    const outcome = await redeemInvite({
+      rawToken,
+      sourceChannel: "telegram",
+      externalUserId: "failopen-user",
+    });
+
+    expect(outcome.ok).toBe(true);
+    expect(
+      findContactChannel({ channelType: "telegram", address: "failopen-user" }),
+    ).not.toBeNull();
+  });
+
+  test("does not claim the gateway row for an already-active member", async () => {
+    const targetContactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+    });
+
+    // Seed an already-active member bound to the invite's target contact.
+    upsertContactChannel({
+      sourceChannel: "telegram",
+      externalUserId: "already-member-user",
+      role: "contact",
+      status: "active",
+      policy: "allow",
+      contactId: targetContactId,
+    });
+
+    const outcome = await redeemInvite({
+      rawToken,
+      sourceChannel: "telegram",
+      externalUserId: "already-member-user",
+    });
+
+    expect(outcome.ok).toBe(true);
+    expect((outcome as { type: string }).type).toBe("already_member");
+
+    // No gateway claim was made — no use must be consumed for a non-redemption.
+    expect(
+      gatewayIpc.calls.some((c) => c.method === "record_invite_redemption"),
+    ).toBe(false);
+  });
+
+  test("rejects 6-digit code redemption when the gateway claim is not consumable", async () => {
+    const targetContactId = createTargetContact();
+    const code = "654321";
+    createInvite({
+      sourceChannel: "telegram",
+      contactId: targetContactId,
+      maxUses: 1,
+      inviteCodeHash: hashVoiceCode(code),
+    });
+
+    gatewayIpc.claim = { ok: true, updated: false, mirrored: true };
+
+    const outcome = await redeemInviteByCode({
+      code,
+      sourceChannel: "telegram",
+      externalUserId: "gw-revoked-code-user",
+    });
+
+    expect(outcome).toEqual({ ok: false, reason: "invalid_token" });
+    expect(
+      findContactChannel({
+        channelType: "telegram",
+        address: "gw-revoked-code-user",
+      }),
+    ).toBeNull();
+  });
 });