cassproject 5.0.22 → 5.0.23

package/src/test/1.EcEncryptedValue.helpers.test.js

@@ -0,0 +1,236 @@
+require('../../index.js');
+const chai = require('chai');
+const sinon = require('sinon');
+const EcEncryptedValue = require('../org/cassproject/ebac/repository/EcEncryptedValue.js');
+const EcRsaOaepAsyncWorker = require('../com/eduworks/ec/crypto/EcRsaOaepAsyncWorker.js');
+const EcAesCtrAsyncWorker = require('../com/eduworks/ec/crypto/EcAesCtrAsyncWorker.js');
+const EcPpk = require('../com/eduworks/ec/crypto/EcPpk.js');
+const EcPk = require('../com/eduworks/ec/crypto/EcPk.js');
+
+const assert = chai.assert;
+
+const PEM = "-----BEGIN RSA PRIVATE KEY-----MIIEpAIBAAKCAQEAz4BiFucFE9bNcKfGD+e6aPRHl402YM4Z6nrurDRNlnwsWpsCoZasPLkjC314pVtHAI2duZo+esGKDloBsiLxASRJo3R2XiXVh2Y8U1RcHA5mWL4tMG5UY2d0libpNEHbHPNBmooVYpA2yhxN/vGibIk8x69uZWxJcFOxOg6zWG8EjF8UMgGnRCVSMTY3THhTlfZ0cGUzvrfb7OvHUgdCe285XkmYkj/V9P/m7hbWoOyJAJSTOm4/s6fIKpl72lblfN7bKaxTCsJp6/rQdmUeo+PIaa2lDOfo7dWbuTMcqkZ93kispNfYYhsEGUGlCsrrVWhlve8MenO4GdLsFP+HRwIDAQABAoIBAGaQpOuBIYde44lNxJ7UAdYi+Mg2aqyK81Btl0/TQo6hriLTAAfzPAt/z4y8ZkgFyCDD3zSAw2VWCPFzF+d/UfUohKWgyWlb9iHJLQRbbHQJwhkXV6raviesWXpmnVrROocizkie/FcNxac9OmhL8+cGJt7lHgJP9jTpiW6TGZ8ZzM8KBH2l80x9AWdvCjsICuPIZRjc706HtkKZzTROtq6Z/F4Gm0uWRnwAZrHTRpnh8qjtdBLYFrdDcUoFtzOM6UVRmocTfsNe4ntPpvwY2aGTWY7EmTj1kteMJ+fCQFIS+KjyMWQHsN8yQNfD5/j2uv6/BdSkO8uorGSJT6DwmTECgYEA8ydoQ4i58+A1udqA+fujM0Zn46++NTehFe75nqIt8rfQgoduBam3lE5IWj2U2tLQeWxQyr1ZJkLbITtrAI3PgfMnuFAii+cncwFo805Fss/nbKx8K49vBuCEAq3MRhLjWy3ZvIgUHj67jWvl50dbNqc7TUguxhS4BxGr/cPPkP0CgYEA2nbJPGzSKhHTETL37NWIUAdU9q/6NVRISRRXeRqZYwE1VPzs2sIUxA8zEDBHX7OtvCKzvZy1Lg5Unx1nh4nCEVkbW/8npLlRG2jOcZJF6NRfhzwLz3WMIrP6j9SmjJaB+1mnrTjfsg36tDEPDjjJLjJHCx9z/qRJh1v4bh4aPpMCgYACG31T2IOEEZVlnvcvM3ceoqWT25oSbAEBZ6jSLyWmzOEJwJK7idUFfAg0gAQiQWF9K+snVqzHIB02FIXA43nA7pKRjmA+RiqZXJHEShFgk1y2HGiXGA8mSBvcyhTTJqbBy4vvjl5eRLzrZNwBPSUVPC3PZajCHrvZk9WhxWivIQKBgQCzCu1MH2dy4R7ZlqsIJ8zKweeJMZpfQI7pjclO0FTrhh7+Yzd+5db9A/P2jYrBTVHSwaILgTYf49DIguHJfEZXz26TzB7iapqlWxTukVHISt1ryPNo+E58VoLAhChnSiaHJ+g7GESE+d4A9cAACNwgh0YgQIvhIyW70M1e+j7KDwKBgQDQSBLFDFmvvTP3sIRAr1+0OZWd1eRcwdhs0U9GwootoCoUP/1Y64pqukT6B9oIB/No9Nyn8kUX3/ZDtCslaGKEUGMJXQ4hc5J+lq0tSi9ZWBdhqOuMPEfUF3IxW+9yeILP4ppUBn1m5MVOWg5CvuuEeCmy4bhMaUErUlHZ78t5cA==-----END RSA PRIVATE KEY-----";
+const PK_A = EcPpk.fromPem(PEM).toPk().toPem();
+// Any parseable public keys will do here; encryption is stubbed and keyed by PEM.
+const PK_B = "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzzy0+Hau1QfZoZo/cUUaEdqWHoN3f+BezVUM8DZpxWrrnsKhKSV+ieEHZRduVM4LfxeByWhbzjkAvE8IWbQIGOA60UhZSjgjuSpNtlHRgmommkBtkvMN65TQwfuD6Z1GnPrE+T2PciKOPiiD5/5836zadSn4tMrM52jMZbUS/zi8P61y9TZejXI1KCgKYoi7po91eXmklTN192nG7iiOoUxz2TQFHG8VxqRi2UcBS+WuFEvLOayvCH5aZpZvN9GlR3EdbrCcZkDLFF9gict9Z3LbSWAe+0/RejgCe24MpfQsWnPNl/9ZSiFG7mbeH6G1hZl0Hahr+xBKrqdNMGfk8wIDAQAB-----END PUBLIC KEY-----";
+const PK_C = "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr8oXR8sAu5zJvWk0BRbL/yFfz7zTv76nlwk498FqfyVtfnL13CAiwKWqDx6aNvlYXEVFvjMIclMkIFVqHFJRFBiVEQpuP//Ltd4WKzsRWlWWAGvNUfrgKMip62fZHQstC5MJUSDyCd3ljZe/1HjLFrvDsvjJ3o+GPOaJaHtlkz+Y0K7GrbBM4AzduzowNgcsHbmJ154QTTN6uw4ke1BAf3dRZ7ysyDKonJEtQGVGWvmYOOm5gwf5CHIqx7zp+zDROxzXvFHu0Wevh2WSzPO8u5cW3INe7kjgsG/mQm9QUW3m0+HT/wMh4WOTaR5yBwYMt7akC9Xs9zl2Vus80QQ4+QIDAQAB-----END PUBLIC KEY-----";
+
+function typed(context, type) {
+    const v = new EcEncryptedValue();
+    v.encryptedContext = context;
+    v.encryptedType = type;
+    return v;
+}
+
+describe('EcEncryptedValue helpers', () => {
+    afterEach(() => sinon.restore());
+
+    describe('getEncryptedFullType / getEncryptedDottedType', () => {
+        it('returns the type when there is no context or the type is already a URL', () => {
+            assert.equal(typed(null, 'Thing').getEncryptedFullType(), 'Thing');
+            assert.isUndefined(typed(undefined, undefined).getEncryptedFullType());
+            assert.equal(typed('http://ctx/', 'https://other/Thing').getEncryptedFullType(), 'https://other/Thing');
+            assert.equal(typed('http://ctx/', 'xhttpy').getEncryptedFullType(), 'xhttpy');
+        });
+        it('joins a string context and the type', () => {
+            assert.equal(typed('http://ctx', 'Thing').getEncryptedFullType(), 'http://ctx/Thing');
+            assert.equal(typed('http://ctx/', 'Thing').getEncryptedFullType(), 'http://ctx/Thing');
+        });
+        it('resolves prefixes and @vocab from an object context', () => {
+            assert.equal(typed({ ce: 'https://ce.org/terms' }, 'ce:Thing').getEncryptedFullType(), 'https://ce.org/terms/Thing');
+            assert.equal(typed({ ce: 'https://ce.org/terms/' }, 'ce:Thing').getEncryptedFullType(), 'https://ce.org/terms/Thing');
+            assert.equal(typed({ '@vocab': 'https://v.org' }, 'Thing').getEncryptedFullType(), 'https://v.org/Thing');
+            assert.throws(() => typed({ a: 'b' }, 'Thing').getEncryptedFullType(), TypeError);
+        });
+        it('dots the full type', () => {
+            assert.equal(typed('https://schema.cassproject.org/0.4/', 'Competency').getEncryptedDottedType(), 'schema.cassproject.org.0.4.Competency');
+            assert.equal(typed('http://a/b/', 'C').getEncryptedDottedType(), 'a.b.C');
+            assert.equal(typed(null, 'x/y/z').getEncryptedDottedType(), 'x.y.z');
+            assert.equal(typed(null, 'http://a/https://b/c').getEncryptedDottedType(), 'a.b.c');
+        });
+    });
+
+    describe('isAnEncrypted', () => {
+        it('compares the whole type or its last path segment', () => {
+            assert.isFalse(new EcEncryptedValue().isAnEncrypted('http://a/Thing'));
+            assert.isTrue(typed(null, 'Thing').isAnEncrypted('http://a/Thing'));
+            assert.isTrue(typed(null, 'http://a/Thing').isAnEncrypted('http://a/Thing'));
+            assert.isTrue(typed(null, 'Thing').isAnEncrypted('Thing'));
+            assert.isFalse(typed(null, 'Thing').isAnEncrypted('http://a/Thing/'));
+            assert.isFalse(typed(null, 'a').isAnEncrypted('http://a/Thing'));
+        });
+    });
+
+    describe('encryptValueActual', () => {
+        let reuse, map;
+        beforeEach(() => {
+            reuse = EcEncryptedValue.secretReuse;
+            map = EcEncryptedValue.secretReuseMap;
+            EcEncryptedValue.secretReuseMap = {};
+            sinon.useFakeTimers({ now: 1000000, toFake: ['Date'] });
+            sinon.stub(EcAesCtrAsyncWorker, 'encrypt').resolves('CIPHER');
+            sinon.stub(EcRsaOaepAsyncWorker, 'encrypt').callsFake(async (pk, json) => 'E(' + pk.toPem().length + ')' + json);
+        });
+        afterEach(() => {
+            EcEncryptedValue.secretReuse = reuse;
+            EcEncryptedValue.secretReuseMap = map;
+        });
+        const secretJson = (s) => JSON.stringify({ v: s });
+
+        it('encrypts the payload and the secret for each owner and reader', async () => {
+            EcEncryptedValue.secretReuse = false;
+            const v = new EcEncryptedValue();
+            let seen = null;
+            const r = await EcEncryptedValue.encryptValueActual(v, 'text', 'IV', 'SECRET', 'ID', [PK_A], [PK_B], (x) => { seen = x; return x; }, null);
+            assert.strictEqual(r, v);
+            assert.strictEqual(seen, v);
+            assert.deepEqual(EcAesCtrAsyncWorker.encrypt.firstCall.args, ['text', 'SECRET', 'IV']);
+            assert.equal(v.payload, 'CIPHER');
+            assert.equal(v.iv, 'IV');
+            assert.equal(v.id, 'ID');
+            assert.deepEqual(v.owner, [PK_A]);
+            assert.deepEqual(v.reader, [PK_B]);
+            const calls = EcRsaOaepAsyncWorker.encrypt.getCalls();
+            assert.deepEqual(calls.map((c) => c.args[0].toPem()), [PK_A, PK_B]);
+            assert.include(calls[0].args[1], '"SECRET"');
+            assert.deepEqual(v.secret, calls.map((c) => 'E(' + c.args[0].toPem().length + ')' + c.args[1]));
+            assert.deepEqual(EcEncryptedValue.secretReuseMap, {});
+        });
+        it('handles missing owners and readers', async () => {
+            EcEncryptedValue.secretReuse = false;
+            const v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 'text', 'IV', 'SECRET', 'ID', null, null);
+            assert.isNull(v.owner);
+            assert.isNull(v.reader);
+            assert.deepEqual(v.secret, []);
+        });
+        it('without a reuse entry encrypts the secret every time', async () => {
+            EcEncryptedValue.secretReuse = true;
+            await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null);
+            await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null);
+            assert.equal(EcRsaOaepAsyncWorker.encrypt.callCount, 2);
+            assert.deepEqual(EcEncryptedValue.secretReuseMap, {});
+        });
+        it('reuses the encrypted secret for a fresh entry with the same secret', async () => {
+            EcEncryptedValue.secretReuse = true;
+            const key = [PK_A, PK_B].join(',');
+            const entry = { secret: 'S', expires: 1000001 };
+            EcEncryptedValue.secretReuseMap[key] = entry;
+            const v1 = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], [PK_B]);
+            assert.deepEqual(Object.keys(entry.encryptedSecret), [PK_A, PK_B]);
+            assert.instanceOf(entry.encryptedSecret[PK_A], Promise);
+            const v2 = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't2', 'IV2', 'S', 'ID2', [PK_A], [PK_B]);
+            assert.equal(EcRsaOaepAsyncWorker.encrypt.callCount, 2);
+            assert.deepEqual(v2.secret, v1.secret);
+            assert.strictEqual(EcEncryptedValue.secretReuseMap[key], entry);
+        });
+        it('treats missing owners or readers as empty when looking up a reuse entry', async () => {
+            EcEncryptedValue.secretReuse = true;
+            const entryB = { secret: 'S', expires: 2000000 };
+            EcEncryptedValue.secretReuseMap[PK_B] = entryB;
+            let v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', null, [PK_B]);
+            assert.isNull(v.owner);
+            assert.deepEqual(Object.keys(entryB.encryptedSecret), [PK_B]);
+            const entryA = { secret: 'S', expires: 2000000, encryptedSecret: { [PK_A]: Promise.resolve('CACHED') } };
+            EcEncryptedValue.secretReuseMap[PK_A] = entryA;
+            v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null);
+            assert.isNull(v.reader);
+            assert.deepEqual(v.secret, ['CACHED']);
+            assert.equal(EcRsaOaepAsyncWorker.encrypt.callCount, 1);
+        });
+        it('drops a reuse entry with another secret or that has expired', async () => {
+            EcEncryptedValue.secretReuse = true;
+            EcEncryptedValue.secretReuseMap[PK_A] = { secret: 'OTHER', expires: 2000000 };
+            let v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null);
+            assert.notProperty(EcEncryptedValue.secretReuseMap, PK_A);
+            assert.equal(v.secret.length, 1);
+            EcEncryptedValue.secretReuseMap[PK_A] = { secret: 'S', expires: 1000000 };
+            v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null);
+            assert.notProperty(EcEncryptedValue.secretReuseMap, PK_A);
+            assert.equal(EcRsaOaepAsyncWorker.encrypt.callCount, 2);
+        });
+        it('drops a mismatched entry once and encrypts for every key', async () => {
+            EcEncryptedValue.secretReuse = true;
+            const key = [PK_A, PK_B].join(',');
+            EcEncryptedValue.secretReuseMap[key] = { secret: 'S', expires: 1000001 };
+            const v = await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'OTHER', 'ID', [PK_A], [PK_B]);
+            assert.notProperty(EcEncryptedValue.secretReuseMap, key);
+            assert.equal(v.secret.length, 2);
+            assert.equal(EcRsaOaepAsyncWorker.encrypt.callCount, 2);
+        });
+        it('rejects when the payload cannot be encrypted', async () => {
+            EcAesCtrAsyncWorker.encrypt.rejects(new Error('aes'));
+            let failed = null;
+            await EcEncryptedValue.encryptValueActual(new EcEncryptedValue(), 't', 'IV', 'S', 'ID', [PK_A], null, null, (e) => { failed = e; });
+            assert.equal(failed.message, 'aes');
+        });
+    });
+
+    describe('addReader / removeReader', () => {
+        function value() {
+            const v = new EcEncryptedValue();
+            v.owner = [PK_A];
+            v.reader = [PK_B];
+            v.secret = ['sA', 'sB'];
+            return v;
+        }
+        const secret = { toEncryptableJson: () => 'JSON' };
+
+        it('addReader rejects with a string when the secret is unknown', async () => {
+            const v = value();
+            sinon.stub(v, 'decryptSecret').resolves(null);
+            const e = await v.addReader(EcPk.fromPem(PK_C)).catch((x) => x);
+            assert.strictEqual(e, "Cannot add a Reader if you don't know the secret");
+            assert.deepEqual(v.reader, [PK_B, PK_C]);
+            assert.deepEqual(v.secret, ['sA', 'sB']);
+        });
+        it('addReader encrypts the secret for the new reader', async () => {
+            const v = value();
+            const eim = {};
+            const decrypt = sinon.stub(v, 'decryptSecret').resolves(secret);
+            const encrypt = sinon.stub(EcRsaOaepAsyncWorker, 'encrypt').resolves('sC');
+            const pkC = EcPk.fromPem(PK_C);
+            const r = await v.addReader(pkC, eim);
+            assert.isUndefined(r);
+            assert.strictEqual(decrypt.firstCall.args[0], eim);
+            assert.strictEqual(encrypt.firstCall.args[0], pkC);
+            assert.equal(encrypt.firstCall.args[1], 'JSON');
+            assert.deepEqual(v.reader, [PK_B, PK_C]);
+            assert.deepEqual(v.secret, ['sA', 'sB', 'sC']);
+            await v.addReader(pkC, eim);
+            assert.deepEqual(v.secret, ['sA', 'sB', 'sC']);
+        });
+        it('addReader rejects when encryption fails', async () => {
+            const v = value();
+            sinon.stub(v, 'decryptSecret').resolves(secret);
+            sinon.stub(EcRsaOaepAsyncWorker, 'encrypt').rejects(new Error('rsa'));
+            const e = await v.addReader(EcPk.fromPem(PK_C)).catch((x) => x);
+            assert.equal(e.message, 'rsa');
+        });
+        it('removeReader re-encrypts the secret for the remaining owners and readers', async () => {
+            const v = value();
+            v.reader = [PK_B, PK_C];
+            sinon.stub(v, 'decryptSecret').resolves(secret);
+            sinon.stub(EcRsaOaepAsyncWorker, 'encrypt').callsFake(async (pk) => 'for ' + pk.toPem().length + pk.toPem().slice(-30));
+            const r = await v.removeReader(EcPk.fromPem(PK_B));
+            assert.isUndefined(r);
+            assert.deepEqual(v.reader, [PK_C]);
+            assert.deepEqual(v.secret, [PK_A, PK_C].map((p) => 'for ' + p.length + p.slice(-30)));
+        });
+        it('removeReader with no readers re-encrypts for owners only', async () => {
+            const v = value();
+            v.reader = null;
+            sinon.stub(v, 'decryptSecret').resolves(secret);
+            sinon.stub(EcRsaOaepAsyncWorker, 'encrypt').resolves('x');
+            await v.removeReader(EcPk.fromPem(PK_B));
+            assert.isNull(v.reader);
+            assert.deepEqual(v.secret, ['x']);
+        });
+        it('removeReader rejects when the secret is unknown', async () => {
+            const v = value();
+            sinon.stub(v, 'decryptSecret').resolves(null);
+            const e = await v.removeReader(EcPk.fromPem(PK_B)).catch((x) => x);
+            assert.instanceOf(e, TypeError);
+            assert.deepEqual(v.secret, []);
+        });
+    });
+});

package/src/test/1.EcHelpers.misc.test.js

@@ -0,0 +1,259 @@
+require("../../index.js");
+const { expect } = require("chai");
+const sinon = require("sinon");
+const EcArray = require("../com/eduworks/ec/array/EcArray.js");
+const EcObject = require("../com/eduworks/ec/array/EcObject.js");
+const EcAsyncHelper = require("../com/eduworks/ec/array/EcAsyncHelper.js");
+const helpers = require("../com/eduworks/ec/promises/helpers.js");
+const EcDirectedGraph = require("../com/eduworks/ec/graph/EcDirectedGraph.js");
+const EcFrameworkGraph = require("../com/eduworks/ec/graph/EcFrameworkGraph.js");
+const EcAsyncTask = require("../com/eduworks/ec/task/EcAsyncTask.js");
+const EcAsyncTaskManager = require("../com/eduworks/ec/task/EcAsyncTaskManager.js");
+const EcAsyncTaskWorker = require("../com/eduworks/ec/task/EcAsyncTaskWorker.js");
+const Task = require("../com/eduworks/ec/task/Task.js");
+
+describe("Helper classes (pinned behaviour)", () => {
+	describe("EcArray.isArray / EcObject.isObject type tags", () => {
+		it("classifies values by their Object.prototype.toString tag", () => {
+			expect(EcArray.isArray([])).to.equal(true);
+			expect(EcArray.isArray(new Array(3))).to.equal(true);
+			expect(EcArray.isArray({ length: 0 })).to.equal(false);
+			expect(EcArray.isArray(null)).to.equal(false);
+			expect(EcArray.isArray(undefined)).to.equal(false);
+			expect(EcArray.isArray("[]")).to.equal(false);
+			expect(EcObject.isObject({})).to.equal(true);
+			expect(EcObject.isObject([])).to.equal(false);
+			expect(EcObject.isObject(null)).to.equal(false);
+			expect(EcObject.isObject(undefined)).to.equal(false);
+			expect(EcObject.isObject("x")).to.equal(false);
+			expect(EcObject.isObject(new Date())).to.equal(true);
+		});
+	});
+
+	describe("EcAsyncHelper.eachSet", () => {
+		it("replaces values and drops falsy results before calling after", (done) => {
+			let arr = [1, 2, 3, 4, 5];
+			let results = { 1: "a", 2: 0, 3: null, 4: "", 5: "e" };
+			new EcAsyncHelper().eachSet(arr, (item, cb) => cb(results[item]), (out) => {
+				try {
+					expect(out).to.deep.equal(["a", "e"]);
+					expect(arr).to.deep.equal(["a", 0, null, "", "e"]);
+					done();
+				} catch (e) {
+					done(e);
+				}
+			});
+		});
+		it("calls after immediately with the same array when empty", () => {
+			let arr = [];
+			let got = null;
+			new EcAsyncHelper().eachSet(arr, () => { }, (out) => got = out);
+			expect(got).to.equal(arr);
+		});
+	});
+
+	describe("promises/helpers", () => {
+		it("cassReturnNullAsPromise resolves null", async () => {
+			expect(await helpers.cassReturnNullAsPromise()).to.equal(null);
+		});
+		it("cassReturnNullAsPromise passes null to success and returns its result", async () => {
+			let success = sinon.stub().returns("ok");
+			let failure = sinon.spy();
+			expect(await helpers.cassReturnNullAsPromise(success, failure)).to.equal("ok");
+			expect(success.calledOnceWithExactly(null)).to.equal(true);
+			expect(failure.called).to.equal(false);
+		});
+		it("cassReturnNullAsPromise with only failure resolves null", async () => {
+			let failure = sinon.spy();
+			expect(await helpers.cassReturnNullAsPromise(null, failure)).to.equal(null);
+			expect(failure.called).to.equal(false);
+		});
+		it("cassReturnNullAsPromise resolves asynchronously", () => {
+			let success = sinon.spy();
+			helpers.cassReturnNullAsPromise(success);
+			expect(success.called).to.equal(false);
+		});
+	});
+
+	describe("EcDirectedGraph.getIncidentVertices", () => {
+		it("returns source then destination, de-duplicated", () => {
+			let graph = new EcDirectedGraph();
+			let v1 = { equals: (v) => v === v1 };
+			let v2 = { equals: (v) => v === v2 };
+			let e1 = { equals: (e) => e === e1 };
+			let e2 = { equals: (e) => e === e2 };
+			graph.addEdge(e1, v2, v1);
+			graph.addEdge(e2, v1, v1);
+			expect(graph.getIncidentVertices(e1)).to.deep.equal([v2, v1]);
+			expect(graph.getIncidentVertices(e2)).to.deep.equal([v1]);
+			expect(graph.getIncidentVertices({ equals: () => false })).to.deep.equal([]);
+		});
+	});
+
+	describe("EcFrameworkGraph.processAssertionsBooleanPerAssertion", () => {
+		let graph, msc, comp;
+		let mkAssertion = (id, registration) => ({ shortId: () => id, registration });
+		beforeEach(() => {
+			graph = new EcFrameworkGraph();
+			msc = {};
+			comp = { shortId: () => "c1", equals: (o) => o === comp };
+			sinon.stub(graph, "getMetaStateCompetency").returns(msc);
+			sinon.stub(graph, "getOutEdges").returns([]);
+			sinon.stub(graph, "getInEdges").returns([]);
+		});
+		afterEach(() => sinon.restore());
+
+		it("returns early if the competency was already visited", async () => {
+			let visited = [comp];
+			await graph.processAssertionsBooleanPerAssertion([mkAssertion("a")], true, comp, visited);
+			expect(visited).to.deep.equal([comp]);
+			expect(graph.getMetaStateCompetency.called).to.equal(false);
+		});
+		for (let negative of [true, false]) {
+			let field = negative ? "negativeAssertion" : "positiveAssertion";
+			it(`adds assertions to ${field} on the first visit, regardless of registration`, async () => {
+				msc.positiveAssertion = [mkAssertion("p", "r1")];
+				msc.negativeAssertion = [mkAssertion("n", "r2")];
+				let visited = [];
+				await graph.processAssertionsBooleanPerAssertion(
+					[mkAssertion("a", "r1"), mkAssertion("b", "r2"), mkAssertion("a")],
+					negative, comp, visited);
+				expect(visited).to.deep.equal([comp]);
+				expect(msc[field].map((a) => a.shortId())).to.deep.equal(negative ? ["n", "a", "b"] : ["p", "a", "b"]);
+			});
+			it(`skips ${field} assertions whose registration is already present when propagated`, async () => {
+				msc.positiveAssertion = [mkAssertion("p", "r1")];
+				msc.negativeAssertion = [mkAssertion("n", "r2")];
+				let visited = [{ equals: () => false }];
+				await graph.processAssertionsBooleanPerAssertion(
+					[mkAssertion("a", "r1"), mkAssertion("b", "r2"), mkAssertion("c", "r3"), mkAssertion("d", "r3"), mkAssertion("e")],
+					negative, comp, visited);
+				// "d" is skipped because "c" (same registration) was added to the array earlier in the loop.
+				let expected = negative ? ["n", "c", "e"] : ["p", "c", "e"];
+				expect(msc[field].map((a) => a.shortId())).to.deep.equal(expected);
+			});
+			it(`tolerates a null meta state (${field})`, async () => {
+				graph.getMetaStateCompetency.returns(null);
+				await graph.processAssertionsBooleanPerAssertion([mkAssertion("a", "r1")], negative, comp, [{ equals: () => false }]);
+			});
+		}
+		it("negative: propagates outward over out-edges, then inward over in-edges", async () => {
+			let calls = [];
+			let target = { id: "t" }, source = { id: "s" };
+			graph.getOutEdges.returns([{ target: "T" }]);
+			graph.getInEdges.returns([{ source: "S" }]);
+			sinon.stub(graph, "getCompetency").callsFake(async (id) => id == "T" ? target : source);
+			sinon.stub(graph, "processAssertionBooleanOutward").callsFake(async (al, c) => calls.push(["out", al, c]));
+			sinon.stub(graph, "processAssertionBooleanInward").callsFake(async (al, c) => calls.push(["in", al, c]));
+			await graph.processAssertionsBooleanPerAssertion([], true, comp, []);
+			expect(calls).to.deep.equal([["out", { target: "T" }, target], ["in", { source: "S" }, source]]);
+		});
+		it("positive: in-edges outward first, then out-edges outward for IMPLIES and inward otherwise", async () => {
+			let calls = [];
+			graph.getInEdges.returns([{ source: "S" }]);
+			graph.getOutEdges.returns([{ target: "T1", relationType: Relation.IMPLIES }, { target: "T2", relationType: Relation.NARROWS }]);
+			sinon.stub(graph, "getCompetency").callsFake(async (id) => ({ id }));
+			sinon.stub(graph, "processAssertionBooleanOutward").callsFake(async (al, c, as, neg) => calls.push(["out", c.id, neg]));
+			sinon.stub(graph, "processAssertionBooleanInward").callsFake(async (al, c, as, neg) => calls.push(["in", c.id, neg]));
+			await graph.processAssertionsBooleanPerAssertion([], false, comp, []);
+			expect(calls).to.deep.equal([["out", "S", false], ["out", "T1", false], ["in", "T2", false]]);
+		});
+	});
+
+	describe("EcAsyncTask", () => {
+		for (let n = 0; n <= 4; n++) {
+			it(`invoke${n} passes ${n} arguments plus a completion callback, with this = task`, () => {
+				let seen = null;
+				let task = new EcAsyncTask(function (...args) {
+					seen = { self: this, args };
+					return "ret" + n;
+				});
+				let args = [1, 2, 3, 4].slice(0, n);
+				expect(task.doTask(...args)).to.equal("ret" + n);
+				expect(seen.self).to.equal(task);
+				expect(seen.args.slice(0, n)).to.deep.equal(args);
+				expect(seen.args.length).to.equal(n + 1);
+				expect(task.getIsStarted()).to.equal(true);
+				expect(task.getIsComplete()).to.equal(false);
+				seen.args[n].call({});
+				expect(task.getIsComplete()).to.equal(true);
+				expect(task.stop).to.be.instanceOf(Date);
+			});
+		}
+		it("doTask runs only once and returns undefined for more than 4 arguments", () => {
+			let job = sinon.stub().returns(1);
+			let task = new EcAsyncTask(job);
+			expect(task.doTask(1, 2, 3, 4, 5)).to.equal(undefined);
+			expect(job.called).to.equal(false);
+			expect(task.doTask()).to.equal(undefined);
+		});
+		it("constructor collects non-null params (param3 is guarded by param2)", () => {
+			expect(new EcAsyncTask(null, 1, 2, 3, 4).getArguments()).to.deep.equal([1, 2, 3, 4]);
+			expect(new EcAsyncTask(null, 1, null, 3, null).getArguments()).to.deep.equal([1]);
+		});
+	});
+
+	describe("EcAsyncTaskManager / EcAsyncTaskWorker", () => {
+		let clock, savedLastFrame, savedHandle;
+		beforeEach(() => {
+			savedLastFrame = Task.lastFrame;
+			savedHandle = Task.updateFrameHandle;
+			clock = sinon.useFakeTimers({ now: 1000000 });
+		});
+		afterEach(() => {
+			clock.restore();
+			Task.lastFrame = savedLastFrame;
+			Task.updateFrameHandle = savedHandle;
+		});
+		it("runs assigned tasks on the worker interval and cleans them up", () => {
+			let ran = [];
+			let mgr = new EcAsyncTaskManager(1);
+			expect(mgr.workerList.length).to.equal(1);
+			let t1 = new EcAsyncTask(function (a, done) { ran.push(a); done(); }, "x");
+			let t2 = new EcAsyncTask(function (a, b, done) { ran.push(a + b); done(); }, "y", "z");
+			let ret = mgr.addTasks([t1, t2]);
+			expect(Object.values(ret)).to.deep.equal([t1, t2]);
+			expect(mgr.workerList[0].currentTask).to.equal(t1);
+			expect(mgr.workerList[0].assignedList).to.deep.equal([t2]);
+			Task.lastFrame = Date.now();
+			clock.tick(100);
+			expect(ran).to.deep.equal(["x"]);
+			expect(mgr.workerList[0].currentTask).to.equal(t2);
+			clock.tick(100);
+			expect(ran).to.deep.equal(["x", "yz"]);
+			clock.tick(2500);
+			expect(Object.keys(mgr.taskMap)).to.deep.equal([]);
+		});
+		it("cleanupTasks completes started tasks that exceeded their timeout", () => {
+			let mgr = new EcAsyncTaskManager(0);
+			let task = new EcAsyncTask(function () { });
+			task.setTimeout(5);
+			mgr.addTask(task);
+			task.doTask();
+			expect(task.getIsComplete()).to.equal(false);
+			clock.tick(5000);
+			mgr.cleanupTasks();
+			expect(Object.keys(mgr.taskMap).length).to.equal(1);
+			expect(task.getIsComplete()).to.equal(false);
+			clock.tick(1);
+			mgr.cleanupTasks();
+			expect(task.getIsComplete()).to.equal(true);
+			expect(Object.keys(mgr.taskMap).length).to.equal(0);
+		});
+		it("the manager's interval calls cleanupTasks on itself", () => {
+			let mgr = new EcAsyncTaskManager(0);
+			let spy = sinon.spy(mgr, "cleanupTasks");
+			clock.tick(2500);
+			expect(spy.calledOnce).to.equal(true);
+			expect(spy.firstCall.thisValue).to.equal(mgr);
+		});
+		it("the worker's interval calls run on itself", () => {
+			let worker = new EcAsyncTaskWorker();
+			let spy = sinon.spy(worker, "run");
+			clock.tick(100);
+			expect(spy.calledOnce).to.equal(true);
+			expect(spy.firstCall.thisValue).to.equal(worker);
+			clearInterval(worker.intervalHandler);
+		});
+	});
+});