jinaga-server 3.5.4 → 3.6.0

package/test/authorization/subscriptionIntersectionSpec.ts

@@ -0,0 +1,208 @@
+import {
+    AuthorizationRules,
+    buildModel,
+    dehydrateFact,
+    DistributionRules,
+    FactManager,
+    MemoryStore,
+    NetworkNoOp,
+    ObservableSource,
+    PassThroughFork,
+    ReferencesByName,
+    User
+} from "jinaga";
+
+import { AuthorizationKeystore } from "../../src/authorization/authorization-keystore";
+import { MemoryKeystore } from "../../src/memory/memory-keystore";
+
+class Company {
+    public static Type = "Company" as const;
+    public type = Company.Type;
+    constructor(public creator: User, public name: string) { }
+}
+
+class Office {
+    public static Type = "Office" as const;
+    public type = Office.Type;
+    constructor(public company: Company, public name: string) { }
+}
+
+class Administrator {
+    public static Type = "Administrator" as const;
+    public type = Administrator.Type;
+    constructor(public company: Company, public user: User, public createdAt: Date | string) { }
+}
+
+const model = buildModel(b => b
+    .type(User)
+    .type(Company, m => m.predecessor("creator", User))
+    .type(Office, m => m.predecessor("company", Company))
+    .type(Administrator, m => m
+        .predecessor("company", Company)
+        .predecessor("user", User))
+);
+
+const subscriberIdentity = { provider: "mock", id: "subscriber" };
+const creatorIdentity = { provider: "mock", id: "creator" };
+
+describe("AuthorizationKeystore.verifyDistributionOrIntersect", () => {
+    it("returns the original spec when the user is already authorized", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            const admin = new Administrator(company, subscriber, new Date("2026-05-26"));
+            return { company, admin };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches).toHaveLength(1);
+        expect(result.branches[0].specification).toBe(officeSpec);
+        expect(result.branches[0].start).toEqual([companyRef]);
+    });
+
+    it("returns intersected branches when the user is not yet authorized", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            // No Administrator yet — subscriber is not authorized.
+            return { company };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        // Intersection produced an alternate branch that lifts the rule's
+        // user-spec into the subscription. The intersected spec has an
+        // additional synthetic given and a different shape than the original.
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches.length).toBeGreaterThanOrEqual(1);
+        expect(result.branches[0].specification).not.toBe(officeSpec);
+        expect(result.branches[0].specification.given.length).toBe(2);
+        // The synthetic given is bound to the subscriber's user fact.
+        expect(result.branches[0].start[1]).toEqual({
+            type: setup.subscriberFact.type,
+            hash: setup.subscriberFact.hash
+        });
+    });
+
+    it("returns denied when no distribution rule applies to the spec", async () => {
+        const setup = await givenAuthorizationWithDistribution(true, async (_subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            return { company };
+        });
+
+        // A spec the rule doesn't cover at all (different fact type).
+        const unrelatedSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Administrator).join(a => a.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [unrelatedSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, unrelatedSpec, namedStart);
+
+        expect(result.type).toBe("denied");
+        if (result.type !== "denied") return;
+        expect(result.reason).toBeTruthy();
+    });
+
+    it("returns a passthrough branch when there are no distribution rules at all", async () => {
+        const setup = await givenAuthorizationWithDistribution(false, async (_subscriber, creator) => {
+            const company = new Company(creator, "Acme");
+            return { company };
+        });
+
+        const officeSpec = model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ).specification;
+        const companyRef = dehydrateFact(setup.seeded.company)
+            .find(f => f.type === Company.Type)!;
+        const namedStart: ReferencesByName = { [officeSpec.given[0].label.name]: companyRef };
+
+        const result = await setup.authorization.verifyDistributionOrIntersect(
+            subscriberIdentity, officeSpec, namedStart);
+
+        expect(result.type).toBe("success");
+        if (result.type !== "success") return;
+        expect(result.branches).toHaveLength(1);
+        expect(result.branches[0].specification).toBe(officeSpec);
+    });
+});
+
+async function givenAuthorizationWithDistribution<T extends Record<string, any>>(
+    withDistributionRules: boolean,
+    buildFacts: (subscriber: User, creator: User) => Promise<T>
+) {
+    const storage = new MemoryStore();
+    const keystore = new MemoryKeystore();
+
+    const subscriberFact = await keystore.getOrCreateUserFact(subscriberIdentity);
+    const creatorFact = await keystore.getOrCreateUserFact(creatorIdentity);
+    const subscriber = new User(subscriberFact.fields.publicKey);
+    const creator = new User(creatorFact.fields.publicKey);
+
+    const seeded = await buildFacts(subscriber, creator);
+    const facts = [
+        ...dehydrateFact(subscriber),
+        ...dehydrateFact(creator),
+        ...Object.values(seeded).flatMap(v => dehydrateFact(v))
+    ];
+    // Dedupe by hash+type to avoid double-saving the shared predecessors.
+    const seenKeys = new Set<string>();
+    const uniqueFacts = facts.filter(f => {
+        const k = `${f.type}|${f.hash}`;
+        if (seenKeys.has(k)) return false;
+        seenKeys.add(k);
+        return true;
+    });
+    await storage.save(uniqueFacts.map(f => ({ fact: f, signatures: [] })));
+
+    const fork = new PassThroughFork(storage);
+    const observable = new ObservableSource(storage);
+    const network = new NetworkNoOp();
+    const factManager = new FactManager(fork, observable, storage, network, []);
+
+    const authorizationRules = new AuthorizationRules(model)
+        .no(User)
+        .any(Company)
+        .any(Office)
+        .any(Administrator);
+
+    const distributionRules = withDistributionRules
+        ? new DistributionRules([])
+            .share(model.given(Company).match((c, facts) =>
+                facts.ofType(Office).join(o => o.company, c)
+            ))
+            .with(model.given(Company).match((c, facts) =>
+                facts.ofType(Administrator)
+                    .join(a => a.company, c)
+                    .selectMany(a => facts.ofType(User).join(u => u, a.user))
+            ))
+        : null;
+
+    const authorization = new AuthorizationKeystore(
+        factManager, storage, keystore, authorizationRules, distributionRules);
+    return {
+        authorization,
+        subscriberFact,
+        seeded: seeded as T & { company: Company }
+    };
+}

package/test/http/anchorListenerSpec.ts

@@ -0,0 +1,117 @@
+import {
+    buildModel,
+    dehydrateFact,
+    FactManager,
+    MemoryStore,
+    NetworkNoOp,
+    ObservableSource,
+    PassThroughFork,
+    Specification,
+    User
+} from "jinaga";
+
+// Validates the same listener pattern HttpRouter.streamFeed uses to wake
+// subscriptions when an anchor (given) fact finally arrives at the
+// server. The pattern is: register a SpecificationListener on a spec
+// whose only given matches the anchor's type and whose matches array is
+// empty, then filter the projected results by the anchor hash.
+class Note {
+    public static Type = "anchor.Note" as const;
+    public type = Note.Type;
+    constructor(public author: User, public body: string) { }
+}
+
+const model = buildModel(b => b
+    .type(User)
+    .type(Note, m => m.predecessor("author", User))
+);
+
+function makeFactManager() {
+    const storage = new MemoryStore();
+    const fork = new PassThroughFork(storage);
+    const observable = new ObservableSource(storage);
+    const network = new NetworkNoOp();
+    const factManager = new FactManager(fork, observable, storage, network, []);
+    return { storage, factManager };
+}
+
+describe("anchor listener pattern", () => {
+    it("fires when a fact matching the anchor's (type, hash) is saved", async () => {
+        const { factManager } = makeFactManager();
+
+        const author = new User("anchor-author-key");
+        const authorRef = dehydrateFact(author)[0];
+
+        let firedFor: string | null = null;
+        const anchorSpec: Specification = {
+            given: [{ label: { name: "x", type: authorRef.type }, conditions: [] }],
+            matches: [],
+            projection: { type: "fact", label: "x" }
+        };
+        const listener = factManager.addSpecificationListener(anchorSpec, async (results) => {
+            for (const r of results) {
+                const ref = (r.tuple as any).x;
+                if (ref && ref.type === authorRef.type && ref.hash === authorRef.hash) {
+                    firedFor = ref.hash;
+                }
+            }
+        });
+
+        await factManager.save(dehydrateFact(author).map(f => ({ fact: f, signatures: [] })));
+
+        factManager.removeSpecificationListener(listener);
+        expect(firedFor).toBe(authorRef.hash);
+    });
+
+    it("does not fire for facts of an unrelated type", async () => {
+        const { factManager } = makeFactManager();
+
+        const author = new User("anchor-author-key");
+        const note = new Note(author, "hi");
+        const noteRef = dehydrateFact(note).find(f => f.type === Note.Type)!;
+
+        let fired = false;
+        const anchorSpec: Specification = {
+            given: [{ label: { name: "x", type: noteRef.type }, conditions: [] }],
+            matches: [],
+            projection: { type: "fact", label: "x" }
+        };
+        const listener = factManager.addSpecificationListener(anchorSpec, async () => {
+            fired = true;
+        });
+
+        // Save a fact of a different type only.
+        await factManager.save(dehydrateFact(author).map(f => ({ fact: f, signatures: [] })));
+
+        factManager.removeSpecificationListener(listener);
+        expect(fired).toBe(false);
+    });
+
+    it("does not fire for facts of the right type but a different hash", async () => {
+        const { factManager } = makeFactManager();
+
+        const expected = new User("expected-key");
+        const expectedRef = dehydrateFact(expected)[0];
+        const other = new User("other-key");
+
+        let matched = false;
+        const anchorSpec: Specification = {
+            given: [{ label: { name: "x", type: expectedRef.type }, conditions: [] }],
+            matches: [],
+            projection: { type: "fact", label: "x" }
+        };
+        const listener = factManager.addSpecificationListener(anchorSpec, async (results) => {
+            for (const r of results) {
+                const ref = (r.tuple as any).x;
+                if (ref && ref.type === expectedRef.type && ref.hash === expectedRef.hash) {
+                    matched = true;
+                }
+            }
+        });
+
+        await factManager.save(dehydrateFact(other).map(f => ({ fact: f, signatures: [] })));
+
+        factManager.removeSpecificationListener(listener);
+        expect(matched).toBe(false);
+    });
+});

package/test/http/lateAuthRecoverySpec.ts

@@ -0,0 +1,245 @@
+import {
+    AuthorizationRules,
+    buildModel,
+    dehydrateFact,
+    DistributionRules,
+    FactManager,
+    FeedCache,
+    FeedResponse,
+    MemoryStore,
+    NetworkNoOp,
+    ObservableSource,
+    PassThroughFork,
+    User
+} from "jinaga";
+
+import { AuthorizationKeystore } from "../../src/authorization/authorization-keystore";
+import { HttpRouter, RequestUser } from "../../src/http/router";
+import { Stream } from "../../src/http/stream";
+import { MemoryKeystore } from "../../src/memory/memory-keystore";
+
+// Mirrors the jinaga.js #130 contract: a client who cannot yet read a
+// feed must still be able to subscribe, receive an empty initial result,
+// and start receiving rows the moment an authorizing fact arrives — all
+// without the connection dying on a Forbidden.
+
+class Office {
+    public static Type = "late.Office" as const;
+    public type = Office.Type;
+    constructor(public company: Company, public name: string) { }
+}
+
+class Company {
+    public static Type = "late.Company" as const;
+    public type = Company.Type;
+    constructor(public creator: User, public identifier: string) { }
+}
+
+class Administrator {
+    public static Type = "late.Administrator" as const;
+    public type = Administrator.Type;
+    constructor(public company: Company, public user: User, public date: Date | string) { }
+}
+
+const model = buildModel(b => b
+    .type(User)
+    .type(Company, m => m.predecessor("creator", User))
+    .type(Office, m => m.predecessor("company", Company))
+    .type(Administrator, m => m
+        .predecessor("company", Company)
+        .predecessor("user", User))
+);
+
+const subscriberIdentity = { provider: "mock", id: "subscriber" };
+const creatorIdentity = { provider: "mock", id: "creator" };
+
+async function makeHarness() {
+    const storage = new MemoryStore();
+    const keystore = new MemoryKeystore();
+    const subscriberFact = await keystore.getOrCreateUserFact(subscriberIdentity);
+    const creatorFact = await keystore.getOrCreateUserFact(creatorIdentity);
+    const subscriber = new User(subscriberFact.fields.publicKey);
+    const creator = new User(creatorFact.fields.publicKey);
+
+    const fork = new PassThroughFork(storage);
+    const observable = new ObservableSource(storage);
+    const network = new NetworkNoOp();
+    const factManager = new FactManager(fork, observable, storage, network, []);
+
+    const authorizationRules = new AuthorizationRules(model)
+        .any(User)
+        .any(Company)
+        .any(Office)
+        .any(Administrator);
+    const distributionRules = new DistributionRules([])
+        .share(model.given(Company).match((c, facts) =>
+            facts.ofType(Office).join(o => o.company, c)
+        ))
+        .with(model.given(Company).match((c, facts) =>
+            facts.ofType(Administrator)
+                .join(a => a.company, c)
+                .selectMany(a => facts.ofType(User).join(u => u, a.user))
+        ));
+    const authorization = new AuthorizationKeystore(
+        factManager, storage, keystore, authorizationRules, distributionRules);
+    const feedCache = new FeedCache();
+    const router = new HttpRouter(factManager, authorization, feedCache, "*");
+
+    const requestUser: RequestUser = {
+        provider: subscriberIdentity.provider,
+        id: subscriberIdentity.id,
+        profile: {} as any
+    };
+    return { router, factManager, subscriber, creator, storage, requestUser };
+}
+
+async function drainMicrotasks() {
+    for (let i = 0; i < 8; i++) {
+        await new Promise<void>(resolve => setImmediate(resolve));
+    }
+}
+
+describe("late-auth subscription recovery", () => {
+    it("subscribes empty when not authorized and activates when the auth fact arrives", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        // Seed the Company and an existing Office. The subscriber is not
+        // yet an Administrator, so the rule denies them today.
+        const existingOffice = new Office(company, "HQ");
+        await h.factManager.save(dehydrateFact(existingOffice).map(f => ({ fact: f, signatures: [] })));
+
+        // Use the same given label name the rule's specs produce
+        // (`p1`, from `model.given(Company)`), so intersection can lift
+        // the rule's path conditions onto the subscription's given.
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    o: ${Office.Type} [\n` +
+            `        o->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => o`;
+
+        // POST /feeds must NOT throw Forbidden — the client is subscribing.
+        const feedsResponse = await (h.router as any).feeds(h.requestUser, input);
+        expect(feedsResponse.feeds.length).toBeGreaterThan(0);
+        const feedHash: string = feedsResponse.feeds[0];
+
+        const stream: Stream<FeedResponse> = await (h.router as any).streamFeed(
+            h.requestUser, { hash: feedHash }, {});
+        expect(stream).not.toBeNull();
+
+        const received: FeedResponse[] = [];
+        stream.next(r => { received.push(r); });
+        await drainMicrotasks();
+
+        // Initial query is empty even though Office exists — the lifted
+        // auth condition (Administrator → subscriber) is not satisfied.
+        const initialOffices = received.flatMap(r => r.references)
+            .filter(r => r.type === Office.Type);
+        expect(initialOffices).toHaveLength(0);
+
+        // The authorizing fact arrives: subscriber is granted Admin.
+        const admin = new Administrator(company, h.subscriber, new Date("2026-05-27"));
+        await h.factManager.save(dehydrateFact(admin).map(f => ({ fact: f, signatures: [] })));
+        await drainMicrotasks();
+
+        stream.close();
+
+        // The pre-existing office surfaces as soon as the auth fact lands.
+        const officesAfterAuth = received.flatMap(r => r.references)
+            .filter(r => r.type === Office.Type);
+        expect(officesAfterAuth.map(r => r.hash))
+            .toContain(dehydrateFact(existingOffice).find(f => f.type === Office.Type)!.hash);
+    });
+
+    it("does not let another authenticated user reuse an intersected feed hash", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+
+        // Alice (the subscriber) gets an authorizing Administrator and an
+        // existing Office. Without intersection she would already be
+        // authorized — but we want the *cached* intersected hash, so we
+        // build it before saving the Administrator.
+        const office = new Office(company, "HQ");
+        await h.factManager.save(dehydrateFact(office).map(f => ({ fact: f, signatures: [] })));
+
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    o: ${Office.Type} [\n` +
+            `        o->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => o`;
+
+        const aliceResponse = await (h.router as any).feeds(h.requestUser, input);
+        const intersectedHash: string = aliceResponse.feeds[0];
+
+        // Now grant Alice the Administrator role so the lifted spec
+        // actually produces rows when queried as Alice.
+        const admin = new Administrator(company, h.subscriber, new Date("2026-05-27"));
+        await h.factManager.save(dehydrateFact(admin).map(f => ({ fact: f, signatures: [] })));
+
+        // Alice can read her own intersected feed and sees the office.
+        const alicePage = await (h.router as any).feed(h.requestUser, { hash: intersectedHash }, {});
+        expect(alicePage.references.some((r: any) => r.type === Office.Type)).toBe(true);
+
+        // Mallory authenticates as a different user, then attempts to
+        // reuse the hash she obtained out of band. She must not be able
+        // to read Alice's data: the cached spec carries Alice's user
+        // fact, so allowing feedPreVerified would leak across users.
+        const malloryIdentity = { provider: "mock", id: "mallory" };
+        // Register Mallory with the keystore so getUserFact succeeds.
+        const malloryKeystore = (h.factManager as any); // unused; just to satisfy types
+        void malloryKeystore;
+        // The harness keystore is private; the lookup happens via the
+        // authorization keystore which the router holds. Re-using the
+        // harness keystore: get a fact for Mallory directly.
+        // (We rely on the keystore being shared with authorization.)
+        const malloryRequest: RequestUser = {
+            provider: malloryIdentity.provider,
+            id: malloryIdentity.id,
+            profile: {} as any
+        };
+
+        // First make Mallory exist in the keystore via a login-style call.
+        await (h.router as any).login(malloryRequest);
+
+        const malloryPage = await (h.router as any).feed(malloryRequest, { hash: intersectedHash }, {});
+        // The router must NOT have served Alice's data to Mallory. With
+        // the bind-to-owner fix in place, queryFeed routes Mallory
+        // through the normal distribution check, which fails, and the
+        // polling path returns an empty page.
+        expect(malloryPage.references.filter((r: any) => r.type === Office.Type)).toHaveLength(0);
+    });
+
+    it("does not return a 403 from /feeds when no rule applies — connection stays available", async () => {
+        const h = await makeHarness();
+
+        // A spec the distribution rules do not cover at all. Step 1's
+        // strict semantics would have thrown Forbidden here, but the
+        // subscribe contract is to keep the connection live so the
+        // client can wait for results (e.g., a future rule change).
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        await h.factManager.save(dehydrateFact(company).map(f => ({ fact: f, signatures: [] })));
+
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    a: ${Administrator.Type} [\n` +
+            `        a->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => a`;
+
+        const feedsResponse = await (h.router as any).feeds(h.requestUser, input);
+        expect(feedsResponse.feeds.length).toBeGreaterThan(0);
+
+        // Polling the cached feed must also stay live (empty page, not 403).
+        const feedHash: string = feedsResponse.feeds[0];
+        const page = await (h.router as any).feed(h.requestUser, { hash: feedHash }, {});
+        expect(page).not.toBeNull();
+        expect(page.references).toEqual([]);
+    });
+});