javascript-solid-server 0.0.183 → 0.0.185

package/.claude/settings.local.json

@@ -411,7 +411,9 @@
       "Bash(cp /tmp/consent-preview.html ~/consent-preview.html)",
       "Read(//home/melvin/**)",
       "Bash(/usr/bin/chromium-browser --headless --no-sandbox --disable-gpu --hide-scrollbars --window-size=520,900 --screenshot=consent.png file:///home/melvin/consent-preview.html)",
-      "Bash(sed -i '0,/\"version\": \"0.0.181\"/{s/\"version\": \"0.0.181\"/\"version\": \"0.0.182\"/}' package-lock.json)"
+      "Bash(sed -i '0,/\"version\": \"0.0.181\"/{s/\"version\": \"0.0.181\"/\"version\": \"0.0.182\"/}' package-lock.json)",
+      "WebFetch(domain:losos.org)",
+      "Bash(sed -i '0,/\"version\": \"0.0.183\"/{s/\"version\": \"0.0.183\"/\"version\": \"0.0.184\"/}' package-lock.json)"
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.183",
+  "version": "0.0.185",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",

package/src/webid/profile.js

@@ -75,7 +75,19 @@ export function generateProfileJsonLd({ webId, name, podUri, issuer }) {
       'authentication':     { '@id': 'cid:authentication', '@type': '@id', '@container': '@set' },
       'assertionMethod':    { '@id': 'cid:assertionMethod', '@type': '@id', '@container': '@set' },
       'publicKeyJwk':       { '@id': 'cid:publicKeyJwk', '@type': '@json' },
-      'publicKeyMultibase': { '@id': 'cid:publicKeyMultibase' }
+      'publicKeyMultibase': { '@id': 'cid:publicKeyMultibase' },
+      // CID v1 verificationMethod *class* names (#417). Without these
+      // term mappings, an app PATCHing in a VM with `type: "Multikey"`
+      // (the spec-example shape) emits a bare relative-IRI `<Multikey>`
+      // when JSS conneg-converts the profile to Turtle — which then
+      // resolves against the document's base URL to a fictional class
+      // like `<pod>/profile/Multikey`. Mapping the class names here
+      // means the bare term `"Multikey"` in JSON-LD expands correctly
+      // (cid:Multikey → https://www.w3.org/ns/cid/v1#Multikey) for both
+      // JSON-LD processors AND our Turtle conneg layer. Naive JSON
+      // readers comparing `type === "Multikey"` continue to work.
+      'Multikey':           'cid:Multikey',
+      'JsonWebKey':         'cid:JsonWebKey'
     },
     '@id': webId,
     '@type': ['foaf:Person', 'schema:Person'],

package/test/turtle.test.js

@@ -153,6 +153,95 @@ describe('turtle converter — unit (#320 follow-ups)', () => {
       `node n3 should appear:\n${content}`);
   });
 
+  it('emits a space before `;` and `.` terminators (#419)', async () => {
+    // The de-facto convention in W3C spec examples and Apache Jena
+    // RIOT is to separate the statement-terminator from the previous
+    // token by a space. n3.js packs them; JSS post-processes the
+    // output to add the space.
+    //
+    // Use TWO predicates on the same subject so n3.js emits a `;`
+    // continuation (multiple triples on one subject). If a future
+    // N3 upgrade ever switched to "one triple per statement" style
+    // and dropped `;` entirely, this test would otherwise pass
+    // vacuously. The presence-of-terminator assertions below pin
+    // that behavior.
+    const doc = {
+      '@context': { 'foaf': 'http://xmlns.com/foaf/0.1/' },
+      '@id': 'https://example.test/alice',
+      'foaf:name': 'Alice',
+      'foaf:age': 30,
+    };
+    const { content } = await fromJsonLd(doc, 'text/turtle', 'https://example.test/', true);
+    // Pin "at least one ` ;` and one ` .` exists" with a literal
+    // SPACE — not just any whitespace. The intended output style
+    // (matching W3C Turtle 1.1 spec examples) is a single space
+    // separator: `value ;` / `value .`. Allowing `\n;` or `\t;`
+    // would let the test pass on visually-different output.
+    assert.match(content, / ;/, `output must contain at least one " ;" terminator (space-prefixed), got:\n${content}`);
+    assert.match(content, / \.(?:\s|$)/, `output must contain at least one " ." terminator (space-prefixed), got:\n${content}`);
+    // Every `;` must be preceded by a literal space. Same for `.`
+    // at end-of-statement. Reject anything else (newline, tab,
+    // packed-against-token).
+    const offendingSemi = /[^ ];/.test(content);
+    const offendingDot = /[^ ]\.\s*$/m.test(content) || /[^ ]\.\n/.test(content);
+    assert.ok(!offendingSemi, `every ; must be preceded by a single space, got:\n${content}`);
+    assert.ok(!offendingDot, `every . at line/doc end must be preceded by a single space, got:\n${content}`);
+  });
+
+  it('does NOT add a space inside literals containing `;` or `.` (#419 safety)', async () => {
+    // Critical correctness test: the post-pass must NOT corrupt
+    // literal values. A literal "foo;bar" with the post-pass naïvely
+    // applied would become "foo ;bar" — silent data corruption.
+    //
+    // Assert by VALUE, not by lexical form. A quote-agnostic parser
+    // round-trip survives any future N3 writer style change
+    // (single vs double quotes, long-string `"""..."""`, etc.).
+    const doc = {
+      '@context': { 'ex': 'https://example.test/ns#' },
+      '@id': 'https://example.test/s',
+      'ex:semicolonInside': 'foo;bar',
+      'ex:dotInside': 'has.dot',
+      'ex:both': 'a;b.c',
+    };
+    const { content } = await fromJsonLd(doc, 'text/turtle', 'https://example.test/', true);
+    // Round-trip: parse the emitted Turtle, walk the quads, assert
+    // the literal values came back exactly as authored.
+    const { Parser } = await import('n3');
+    const parser = new Parser({ baseIRI: 'https://example.test/' });
+    const quads = parser.parse(content);
+    const objectsByPredicate = new Map();
+    for (const q of quads) {
+      if (q.object.termType !== 'Literal') continue;
+      objectsByPredicate.set(q.predicate.value, q.object.value);
+    }
+    assert.strictEqual(objectsByPredicate.get('https://example.test/ns#semicolonInside'), 'foo;bar',
+      `literal value for ex:semicolonInside must be "foo;bar"`);
+    assert.strictEqual(objectsByPredicate.get('https://example.test/ns#dotInside'), 'has.dot',
+      `literal value for ex:dotInside must be "has.dot"`);
+    assert.strictEqual(objectsByPredicate.get('https://example.test/ns#both'), 'a;b.c',
+      `literal value for ex:both must be "a;b.c"`);
+  });
+
+  it('does NOT add a space inside an IRI containing `;` (#419 safety)', async () => {
+    // An IRI's content is bracketed by `<...>` — the post-pass
+    // shouldn't touch what's inside. Assert by value via parser
+    // round-trip so we don't depend on N3 writer formatting.
+    const doc = {
+      '@context': { 'ex': 'https://example.test/ns#' },
+      '@id': 'https://example.test/s',
+      'ex:rel': { '@id': 'https://example.test/path;with;semis' },
+    };
+    const { content } = await fromJsonLd(doc, 'text/turtle', 'https://example.test/', true);
+    const { Parser } = await import('n3');
+    const parser = new Parser({ baseIRI: 'https://example.test/' });
+    const quads = parser.parse(content);
+    const rels = quads
+      .filter(q => q.predicate.value === 'https://example.test/ns#rel')
+      .map(q => q.object.value);
+    assert.deepStrictEqual(rels, ['https://example.test/path;with;semis'],
+      `IRI value must round-trip with internal ; intact`);
+  });
+
   it('cyclical nested node reference does not hang', async () => {
     // Two nested nodes reference each other. BFS must not loop.
     const a = { '@id': 'https://example.test/a', 'ex:knows': null };

package/test/webid.test.js

@@ -87,6 +87,30 @@ describe('WebID Profile', () => {
       assert.strictEqual(ctx.publicKeyJwk['@type'], '@json');
     });
 
+    it('declares CID v1 class names (Multikey, JsonWebKey) as flat aliases (#417)', async () => {
+      // Without these mappings, an app PATCHing in a VM with the
+      // spec-example shape `{type: "Multikey", ...}` produces a bare
+      // relative-IRI `<Multikey>` in the Turtle conneg output, which
+      // resolves to a fictional class on the pod's own host (e.g.
+      // `<pod>/profile/Multikey` instead of `cid:Multikey`).
+      //
+      // The flat-alias shape (`"Multikey": "cid:Multikey"`) makes
+      // bare-term emission work correctly through both JSON-LD
+      // expansion AND our Turtle conneg layer — and matches the
+      // "JSON-LD with flat context aliases" pattern consumers like
+      // LOSOS / LION rely on.
+      const res = await request(profilePath);
+      const jsonLd = await res.json();
+      const ctx = jsonLd['@context'];
+      for (const cls of ['Multikey', 'JsonWebKey']) {
+        const mapping = ctx[cls];
+        assert.ok(mapping, `@context must define class alias \`${cls}\``);
+        const id = typeof mapping === 'string' ? mapping : mapping['@id'];
+        assert.match(id, new RegExp(`^(cid:${cls}|https://www\\.w3\\.org/ns/cid/v1#${cls})$`),
+          `${cls} must map to the CID v1 namespace`);
+      }
+    });
+
     it('declares self-control via controller === @id (#386 Phase A)', async () => {
       const res = await request(profilePath);
       const jsonLd = await res.json();
@@ -216,6 +240,59 @@ describe('WebID Profile — Turtle conneg (#320)', () => {
     await stopTestServer();
   });
 
+  it('Turtle conneg: generated profile @context expands bare Multikey/JsonWebKey terms (#417)', async () => {
+    // Combine the production profile generator's @context with a
+    // synthetic VM (the spec-example shape `{type: "Multikey", ...}`)
+    // and run it through the same conneg path the live profile
+    // would. Asserts: the bare-term type expands to the CID v1
+    // namespace, not to a relative IRI that resolves to a fake
+    // class on the pod's host.
+    const { generateProfile } = await import('../src/webid/profile.js');
+    const { fromJsonLd } = await import('../src/rdf/conneg.js');
+    const webId = 'https://example.test/profile/card.jsonld#me';
+    const profile = generateProfile({
+      webId,
+      name: 'mk-test',
+      podUri: 'https://example.test/',
+      issuer: 'https://example.test/',
+    });
+    // Inject a Multikey VM authored with the spec-example bare-term
+    // type — this is the shape the bug surfaces on.
+    const vmId = webId.replace('#me', '#nostr-key-1');
+    profile.verificationMethod = [{
+      id: vmId,
+      type: 'Multikey',
+      controller: webId,
+      publicKeyMultibase: 'fe70102de7ec0123456789abcdef0123456789abcdef0123456789abcdef0123456789ab',
+    }];
+    profile.authentication = [vmId];
+
+    const { content: ttl } = await fromJsonLd(profile, 'text/turtle', 'https://example.test/', true);
+
+    // Pre-#417: would emit `a <Multikey>` (relative — resolves to
+    // `https://example.test/profile/Multikey`).
+    // After #417: the @context maps `Multikey -> cid:Multikey`, so
+    // the converter expands the bare term to the CID v1 IRI.
+    assert.ok(
+      ttl.includes('cid:Multikey') || ttl.includes('cid/v1#Multikey'),
+      `Turtle must emit a CID-namespaced Multikey class, got:\n${ttl}`,
+    );
+    assert.ok(
+      !/\ba\s+<Multikey>\s*[;.]/.test(ttl),
+      `Turtle must NOT emit bare <Multikey> (resolves to fictional class), got:\n${ttl}`,
+    );
+    // Don't regress #416: the VM block + publicKeyMultibase must
+    // still survive the conversion.
+    assert.ok(
+      ttl.includes('publicKeyMultibase') || ttl.includes('cid/v1#publicKeyMultibase'),
+      `Turtle must include cid:publicKeyMultibase, got:\n${ttl}`,
+    );
+    assert.ok(
+      ttl.includes('fe70102de7ec'),
+      `Turtle must include the publicKeyMultibase value, got:\n${ttl}`,
+    );
+  });
+
   it('Turtle variant includes cid:service with lws:OpenIdProvider and serviceEndpoint', async () => {
     const res = await request('/webidturtletest/profile/card.jsonld', {
       headers: { Accept: 'text/turtle' }