auramaxx 0.0.20 → 0.1.1

package/src/server/tests/lib/sessions.test.ts

@@ -1,327 +0,0 @@
-/**
- * Tests for session management and spending limits
- *
- * Tests:
- * - Session creation and tracking
- * - Spending limit enforcement
- * - Per-type spending tracking (fund, send, swap)
- * - Token revocation
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import {
-  getSession,
-  checkLimitByType,
-  recordSpendByType,
-  getRemainingByType,
-  revokeToken,
-  isRevoked,
-  clearSessions,
-  listSessions,
-} from '../../lib/sessions';
-import { createTokenSync as createToken, getTokenHash } from '../../lib/auth';
-import { cleanDatabase } from '../setup';
-
-describe('Session Management', () => {
-  beforeEach(async () => {
-    await cleanDatabase();
-    clearSessions();
-  });
-
-  afterEach(() => {
-    clearSessions();
-  });
-
-  describe('getSession()', () => {
-    it('should create a session for a new token', () => {
-      const token = createToken({
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      });
-      const tokenHash = getTokenHash(token);
-
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-
-      const session = getSession(tokenHash, payload);
-
-      expect(session).toBeDefined();
-      expect(session.token).toEqual(payload);
-      expect(session.spent).toBe(0);
-      expect(session.spentByType).toEqual({ fund: 0, send: 0, swap: 0 });
-    });
-
-    it('should return same session for same token hash', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      const session1 = getSession(tokenHash, payload);
-      const session2 = getSession(tokenHash, payload);
-
-      expect(session1).toBe(session2);
-    });
-  });
-
-  describe('Spending Limits', () => {
-    it('should allow spending within limit', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      // Initialize session
-      getSession(tokenHash, payload);
-
-      // Check limit for 0.5 ETH - should pass
-      const canSpend = checkLimitByType(tokenHash, payload, 'fund', 0.5);
-      expect(canSpend).toBe(true);
-    });
-
-    it('should reject spending over limit', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // Check limit for 1.5 ETH - should fail
-      const canSpend = checkLimitByType(tokenHash, payload, 'fund', 1.5);
-      expect(canSpend).toBe(false);
-    });
-
-    it('should track cumulative spending', async () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // First spend
-      await recordSpendByType(tokenHash, 'fund', 0.5);
-
-      // Check remaining
-      const remaining = getRemainingByType(tokenHash, payload, 'fund');
-      expect(remaining).toBeCloseTo(0.5);
-
-      // Second spend should fail if over limit
-      const canSpend = checkLimitByType(tokenHash, payload, 'fund', 0.6);
-      expect(canSpend).toBe(false);
-
-      // But 0.4 should still work
-      const canSpendLess = checkLimitByType(tokenHash, payload, 'fund', 0.4);
-      expect(canSpendLess).toBe(true);
-    });
-
-    it('should track spending per type independently', async () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund', 'send:hot'],
-        limits: { fund: 1.0, send: 2.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // Spend from fund
-      await recordSpendByType(tokenHash, 'fund', 0.8);
-
-      // Fund should have 0.2 remaining
-      expect(getRemainingByType(tokenHash, payload, 'fund')).toBeCloseTo(0.2);
-
-      // Send should still have full 2.0
-      expect(getRemainingByType(tokenHash, payload, 'send')).toBeCloseTo(2.0);
-    });
-
-    it('should include fund spent from spentByType in listSessions', async () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      const session = getSession(tokenHash, payload);
-      session.spentByType = { fund: 0.4, send: 0, swap: 0 };
-      session.spent = 0;
-
-      const sessions = listSessions();
-      const [row] = sessions.filter(s => s.tokenHash === tokenHash);
-
-      expect(row.spent).toBe(0.4);
-      expect(row.remaining).toBe(0.6);
-    });
-
-    it('should aggregate fund spend across currencies in listSessions when spent is currency-keyed', async () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 2.5 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      const session = getSession(tokenHash, payload);
-      session.spentByType = {
-        fund: { '0xaaa': 1.0, '0xbbb': 0.5 },
-        send: 0,
-        swap: 0,
-      };
-      session.spent = 0;
-
-      const sessions = listSessions();
-      const [row] = sessions.filter(s => s.tokenHash === tokenHash);
-
-      expect(row.spent).toBe(1.5);
-      expect(row.remaining).toBe(1.0);
-    });
-
-    it('should allow unlimited spending when no limit set at all', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['send:hot'],
-        // No limits set, no fund limit
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // Should allow any amount (no fund limit = no send limit)
-      const canSpend = checkLimitByType(tokenHash, payload, 'send', 1000000);
-      expect(canSpend).toBe(true);
-
-      // Remaining should be Infinity
-      expect(getRemainingByType(tokenHash, payload, 'send')).toBe(Infinity);
-    });
-
-    it('should default send limit to fund limit when send not explicitly set', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['send:hot', 'fund'],
-        limit: 1.0, // Fund limit of 1.0 ETH, no explicit send limit
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // Send limit should default to fund limit (1.0)
-      expect(checkLimitByType(tokenHash, payload, 'send', 0.5)).toBe(true);
-      expect(checkLimitByType(tokenHash, payload, 'send', 1.5)).toBe(false);
-      expect(getRemainingByType(tokenHash, payload, 'send')).toBeCloseTo(1.0);
-    });
-
-    it('should use explicit send limit over fund limit when both set', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['send:hot', 'fund'],
-        limits: { fund: 2.0, send: 0.5 }, // Explicit send limit lower than fund
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-
-      // Send limit should be 0.5, not 2.0
-      expect(checkLimitByType(tokenHash, payload, 'send', 0.3)).toBe(true);
-      expect(checkLimitByType(tokenHash, payload, 'send', 0.6)).toBe(false);
-      expect(getRemainingByType(tokenHash, payload, 'send')).toBeCloseTo(0.5);
-
-      // Fund limit should still be 2.0
-      expect(getRemainingByType(tokenHash, payload, 'fund')).toBeCloseTo(2.0);
-    });
-  });
-
-  describe('Token Revocation', () => {
-    it('should mark token as revoked', () => {
-      const token = createToken({
-        agentId: 'test-agent',
-        permissions: ['wallet:list'],
-        exp: Date.now() + 3600000,
-      });
-      const tokenHash = getTokenHash(token);
-
-      expect(isRevoked(tokenHash)).toBe(false);
-
-      revokeToken(tokenHash);
-
-      expect(isRevoked(tokenHash)).toBe(true);
-    });
-
-    it('should persist revocation across session lookups', () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['wallet:list'],
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      // Create session
-      getSession(tokenHash, payload);
-
-      // Revoke
-      revokeToken(tokenHash);
-
-      // Should still be revoked
-      expect(isRevoked(tokenHash)).toBe(true);
-    });
-  });
-
-  describe('clearSessions()', () => {
-    it('should clear all sessions and spending', async () => {
-      const payload = {
-        agentId: 'test-agent',
-        permissions: ['fund'],
-        limits: { fund: 1.0 },
-        exp: Date.now() + 3600000,
-      };
-      const token = createToken(payload);
-      const tokenHash = getTokenHash(token);
-
-      getSession(tokenHash, payload);
-      await recordSpendByType(tokenHash, 'fund', 0.5);
-
-      // Clear sessions
-      clearSessions();
-
-      // New session should have fresh spending
-      const newSession = getSession(tokenHash, payload);
-      expect(newSession.spent).toBe(0);
-      expect(getRemainingByType(tokenHash, payload, 'fund')).toBe(1.0);
-    });
-  });
-});

package/src/server/tests/lib/social/create.test.ts

@@ -1,207 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-import { testPrisma } from '../../setup';
-import {
-  createPost,
-  createReaction,
-  createFollow,
-  createUnfollow,
-  createProfileUpdate,
-} from '../../../lib/social/create';
-import { ed25519 } from '@noble/curves/ed25519.js';
-import { blake3 } from '@noble/hashes/blake3.js';
-
-const TEST_MNEMONIC =
-  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
-const TEST_AGENT_ID = 'test-social-agent';
-const TEST_AURA_ID = 42;
-
-async function cleanSocialTables() {
-  await testPrisma.socialMessage.deleteMany();
-  await testPrisma.agentProfile.deleteMany();
-}
-
-async function seedAgentProfile(auraId: number | null = TEST_AURA_ID) {
-  return testPrisma.agentProfile.create({
-    data: {
-      agentId: TEST_AGENT_ID,
-      auraId,
-    },
-  });
-}
-
-describe('social/create', () => {
-  beforeEach(async () => {
-    await cleanSocialTables();
-  });
-
-  describe('createPost()', () => {
-    it('should create a post_add message with pending syncStatus', async () => {
-      await seedAgentProfile();
-
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'gm auramaxxnow');
-
-      expect(msg.agentId).toBe(TEST_AGENT_ID);
-      expect(msg.type).toBe('post_add');
-      expect(msg.syncStatus).toBe('pending');
-      expect(msg.hash).toMatch(/^[0-9a-f]{64}$/);
-      expect(msg.signature).toMatch(/^[0-9a-f]{128}$/);
-      expect(msg.signer).toMatch(/^[0-9a-f]{64}$/);
-
-      const body = JSON.parse(msg.body);
-      expect(body.text).toBe('gm auramaxxnow');
-    });
-
-    it('should include optional fields in body', async () => {
-      await seedAgentProfile();
-
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'hello', {
-        embeds: ['https://example.com'],
-        parentPostHash: 'abc123',
-        mentions: [7, 11],
-      });
-
-      const body = JSON.parse(msg.body);
-      expect(body.text).toBe('hello');
-      expect(body.embeds).toEqual(['https://example.com']);
-      expect(body.parentPostHash).toBe('abc123');
-      expect(body.mentions).toEqual([7, 11]);
-    });
-
-    it('should omit empty optional fields', async () => {
-      await seedAgentProfile();
-
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'simple post');
-
-      const body = JSON.parse(msg.body);
-      expect(body).toEqual({ text: 'simple post' });
-      expect(body.embeds).toBeUndefined();
-      expect(body.parentPostHash).toBeUndefined();
-      expect(body.mentions).toBeUndefined();
-    });
-
-    it('should produce a verifiable signature', async () => {
-      await seedAgentProfile();
-
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'verify me');
-
-      const hashBytes = Buffer.from(msg.hash, 'hex');
-      const sigBytes = Buffer.from(msg.signature, 'hex');
-      const pubBytes = Buffer.from(msg.signer, 'hex');
-      expect(ed25519.verify(sigBytes, hashBytes, pubBytes)).toBe(true);
-    });
-  });
-
-  describe('createReaction()', () => {
-    it('should create a reaction_add message', async () => {
-      await seedAgentProfile();
-
-      const msg = await createReaction(TEST_AGENT_ID, TEST_MNEMONIC, 'abc123', 'like');
-
-      expect(msg.type).toBe('reaction_add');
-      const body = JSON.parse(msg.body);
-      expect(body.postHash).toBe('abc123');
-      expect(body.reactionType).toBe('like');
-    });
-  });
-
-  describe('createFollow()', () => {
-    it('should create a link_add message', async () => {
-      await seedAgentProfile();
-
-      const targetPubKey = 'ab'.repeat(32);
-      const msg = await createFollow(TEST_AGENT_ID, TEST_MNEMONIC, targetPubKey);
-
-      expect(msg.type).toBe('link_add');
-      const body = JSON.parse(msg.body);
-      expect(body.followeePublicKey).toBe(targetPubKey);
-      expect(body.linkType).toBe('follow');
-    });
-  });
-
-  describe('createUnfollow()', () => {
-    it('should create a link_remove message', async () => {
-      await seedAgentProfile();
-
-      const targetPubKey = 'ab'.repeat(32);
-      const msg = await createUnfollow(TEST_AGENT_ID, TEST_MNEMONIC, targetPubKey);
-
-      expect(msg.type).toBe('link_remove');
-      const body = JSON.parse(msg.body);
-      expect(body.followeePublicKey).toBe(targetPubKey);
-      expect(body.linkType).toBe('follow');
-    });
-  });
-
-  describe('createProfileUpdate()', () => {
-    it('should create a user_data_add message', async () => {
-      await seedAgentProfile();
-
-      const msg = await createProfileUpdate(
-        TEST_AGENT_ID,
-        TEST_MNEMONIC,
-        'display',
-        'Agent Smith',
-      );
-
-      expect(msg.type).toBe('user_data_add');
-      const body = JSON.parse(msg.body);
-      expect(body.type).toBe('display');
-      expect(body.value).toBe('Agent Smith');
-    });
-  });
-
-  describe('error handling', () => {
-    it('should throw if agent has no auraId', async () => {
-      await seedAgentProfile(null);
-
-      await expect(
-        createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'should fail'),
-      ).rejects.toThrow('no auraId');
-    });
-
-    it('should throw if agent profile does not exist', async () => {
-      await expect(
-        createPost('nonexistent-agent', TEST_MNEMONIC, 'should fail'),
-      ).rejects.toThrow('no auraId');
-    });
-  });
-
-  describe('persistence', () => {
-    it('should persist the message in SocialMessage table', async () => {
-      await seedAgentProfile();
-
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'persisted');
-
-      const found = await testPrisma.socialMessage.findUnique({
-        where: { hash: msg.hash },
-      });
-      expect(found).not.toBeNull();
-      expect(found!.agentId).toBe(TEST_AGENT_ID);
-      expect(found!.syncStatus).toBe('pending');
-    });
-
-    it('should reject duplicate hashes', async () => {
-      await seedAgentProfile();
-
-      // Two messages with same content at same timestamp would produce same hash.
-      // In practice timestamps differ, but we test the unique constraint.
-      const msg = await createPost(TEST_AGENT_ID, TEST_MNEMONIC, 'first');
-
-      // Force a duplicate by inserting directly
-      await expect(
-        testPrisma.socialMessage.create({
-          data: {
-            agentId: msg.agentId,
-            hash: msg.hash, // duplicate
-            type: msg.type,
-            body: msg.body,
-            timestamp: msg.timestamp,
-            network: msg.network,
-            signature: msg.signature,
-            signer: msg.signer,
-          },
-        }),
-      ).rejects.toThrow();
-    });
-  });
-});

package/src/server/tests/lib/social/sign.test.ts

@@ -1,163 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { signMessage, type MessageData, type SignedEnvelope } from '../../../lib/social/sign';
-import { blake3 } from '@noble/hashes/blake3.js';
-import { ed25519 } from '@noble/curves/ed25519.js';
-
-const TEST_MNEMONIC =
-  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
-
-const POST_DATA: MessageData = {
-  type: 'post_add',
-  timestamp: 1700000000000,
-  network: 'mainnet',
-  body: { text: 'gm auramaxxnow' },
-};
-
-describe('signMessage()', () => {
-  it('should return a valid SignedEnvelope', () => {
-    const env = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    expect(env.data).toEqual(POST_DATA);
-    expect(env.hashScheme).toBe('blake3');
-    expect(env.signatureScheme).toBe('ed25519');
-    expect(env.hash).toMatch(/^[0-9a-f]{64}$/);
-    expect(env.signature).toMatch(/^[0-9a-f]{128}$/);
-    expect(env.signer).toMatch(/^[0-9a-f]{64}$/);
-  });
-
-  it('should be deterministic (same input -> same output)', () => {
-    const env1 = signMessage(POST_DATA, TEST_MNEMONIC);
-    const env2 = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    expect(env1.hash).toBe(env2.hash);
-    expect(env1.signature).toBe(env2.signature);
-    expect(env1.signer).toBe(env2.signer);
-  });
-
-  it('should produce a verifiable ED25519 signature', () => {
-    const env = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    const hashBytes = Buffer.from(env.hash, 'hex');
-    const sigBytes = Buffer.from(env.signature, 'hex');
-    const pubBytes = Buffer.from(env.signer, 'hex');
-
-    expect(ed25519.verify(sigBytes, hashBytes, pubBytes)).toBe(true);
-  });
-
-  it('should produce a BLAKE3 hash matching re-hashed canonical form', () => {
-    const env = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    // Reconstruct canonical form in the hub's fixed field order.
-    const canonical = {
-      body: { text: 'gm auramaxxnow' },
-      network: 'mainnet',
-      timestamp: 1700000000000,
-      type: 'post_add',
-      wireType: 'CAST_ADD',
-      version: 1,
-    };
-    const jsonBytes = new TextEncoder().encode(JSON.stringify(canonical));
-    const expected = Buffer.from(blake3(jsonBytes)).toString('hex');
-
-    expect(env.hash).toBe(expected);
-  });
-
-  it('should canonicalize deterministically with fixed field set', () => {
-    const env = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    const canonical = {
-      body: { text: 'gm auramaxxnow' },
-      network: 'mainnet',
-      timestamp: 1700000000000,
-      type: 'post_add',
-      wireType: 'CAST_ADD',
-      version: 1,
-    };
-    const jsonBytes = new TextEncoder().encode(JSON.stringify(canonical));
-    const expected = Buffer.from(blake3(jsonBytes)).toString('hex');
-
-    expect(env.hash).toBe(expected);
-  });
-
-  it('should change hash when body changes', () => {
-    const env1 = signMessage(POST_DATA, TEST_MNEMONIC);
-    const env2 = signMessage(
-      { ...POST_DATA, body: { text: 'different message' } },
-      TEST_MNEMONIC,
-    );
-
-    expect(env1.hash).not.toBe(env2.hash);
-    expect(env1.signature).not.toBe(env2.signature);
-  });
-
-  it('should change signer when mnemonic changes', () => {
-    const other =
-      'zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong';
-    const env1 = signMessage(POST_DATA, TEST_MNEMONIC);
-    const env2 = signMessage(POST_DATA, other);
-
-    expect(env1.signer).not.toBe(env2.signer);
-    expect(env1.hash).toBe(env2.hash); // same data -> same hash
-    expect(env1.signature).not.toBe(env2.signature); // different key -> different sig
-  });
-
-  it('should map all 7 wire types', () => {
-    const types = [
-      ['post_add', 'CAST_ADD'],
-      ['post_remove', 'CAST_REMOVE'],
-      ['reaction_add', 'REACTION_ADD'],
-      ['reaction_remove', 'REACTION_REMOVE'],
-      ['link_add', 'LINK_ADD'],
-      ['link_remove', 'LINK_REMOVE'],
-      ['user_data_add', 'USER_DATA_ADD'],
-    ] as const;
-
-    for (const [type, wireType] of types) {
-      const data: MessageData = { ...POST_DATA, type };
-      const env = signMessage(data, TEST_MNEMONIC);
-
-      // Verify wireType is embedded in canonical form by re-hashing
-      expect(env.hash).toMatch(/^[0-9a-f]{64}$/);
-      expect(ed25519.verify(
-        Buffer.from(env.signature, 'hex'),
-        Buffer.from(env.hash, 'hex'),
-        Buffer.from(env.signer, 'hex'),
-      )).toBe(true);
-    }
-  });
-
-  it('should throw for unknown message type', () => {
-    const bad: MessageData = { ...POST_DATA, type: 'invalid_type' };
-    expect(() => signMessage(bad, TEST_MNEMONIC)).toThrow('Unknown message type: invalid_type');
-  });
-
-  it('should sort nested body keys canonically', () => {
-    const data1: MessageData = {
-      ...POST_DATA,
-      body: { text: 'hello', embeds: ['https://example.com'], mentions: [7, 11] },
-    };
-    const data2: MessageData = {
-      ...POST_DATA,
-      body: { mentions: [7, 11], text: 'hello', embeds: ['https://example.com'] },
-    };
-
-    const env1 = signMessage(data1, TEST_MNEMONIC);
-    const env2 = signMessage(data2, TEST_MNEMONIC);
-
-    expect(env1.hash).toBe(env2.hash);
-    expect(env1.signature).toBe(env2.signature);
-  });
-
-  // Deterministic test vector: pin hash + signer for the test mnemonic
-  it('should match pinned test vectors', () => {
-    const env = signMessage(POST_DATA, TEST_MNEMONIC);
-
-    // Signer is the public key derived from m/44'/501'/0'/0' of the test mnemonic
-    // This value is stable across runs.
-    expect(env.signer).toHaveLength(64);
-
-    // Verify the full roundtrip is deterministic
-    const env2 = signMessage(POST_DATA, TEST_MNEMONIC);
-    expect(env).toEqual(env2);
-  });
-});