jinaga-server 3.6.0 → 3.7.0

package/test/http/lateAuthRecoverySpec.ts

@@ -8,13 +8,16 @@ import {
     FeedResponse,
     MemoryStore,
     NetworkNoOp,
+    NoOpTracer,
     ObservableSource,
     PassThroughFork,
+    Trace,
+    Tracer,
     User
 } from "jinaga";
 
 import { AuthorizationKeystore } from "../../src/authorization/authorization-keystore";
-import { HttpRouter, RequestUser } from "../../src/http/router";
+import { FeedNotFound, HttpRouter, RequestUser } from "../../src/http/router";
 import { Stream } from "../../src/http/stream";
 import { MemoryKeystore } from "../../src/memory/memory-keystore";
 
@@ -99,6 +102,25 @@ async function drainMicrotasks() {
     }
 }
 
+// Records Trace.metric calls so tests can assert the structured distribution
+// signal (issue #168 S3) without grepping logs. Everything else is a no-op,
+// and dependency() still runs its operation so feeds() works unchanged.
+class CapturingTracer extends NoOpTracer implements Tracer {
+    public readonly metrics: { message: string; measurements: { [key: string]: number } }[] = [];
+    metric(message: string, measurements: { [key: string]: number }): void {
+        this.metrics.push({ message, measurements });
+    }
+}
+
+async function withTracer<T>(tracer: Tracer, action: () => Promise<T>): Promise<T> {
+    Trace.configure(tracer);
+    try {
+        return await action();
+    } finally {
+        Trace.configure(new NoOpTracer());
+    }
+}
+
 describe("late-auth subscription recovery", () => {
     it("subscribes empty when not authorized and activates when the auth fact arrives", async () => {
         const h = await makeHarness();
@@ -125,6 +147,19 @@ describe("late-auth subscription recovery", () => {
         expect(feedsResponse.feeds.length).toBeGreaterThan(0);
         const feedHash: string = feedsResponse.feeds[0];
 
+        // S1: the response reports a per-feed decision. This is the reactive
+        // (authorized-via-intersection) case — denied for the subscriber now,
+        // self-heals when the Administrator fact arrives — reported without
+        // any change to registration or keep-alive behavior.
+        expect(feedsResponse.decisions).toHaveLength(feedsResponse.feeds.length);
+        expect(feedsResponse.decisions.map((d: any) => d.feed).sort())
+            .toEqual([...feedsResponse.feeds].sort());
+        for (const d of feedsResponse.decisions) {
+            expect(d.decision).toBe("reactive");
+            expect(d.code).toBe("principal-excluded");
+            expect(d.reason).toBeTruthy();
+        }
+
         const stream: Stream<FeedResponse> = await (h.router as any).streamFeed(
             h.requestUser, { hash: feedHash }, {});
         expect(stream).not.toBeNull();
@@ -153,6 +188,38 @@ describe("late-auth subscription recovery", () => {
             .toContain(dehydrateFact(existingOffice).find(f => f.type === Office.Type)!.hash);
     });
 
+    it("reports an authorized pass-through decision when the user is already permitted", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        await h.factManager.save(dehydrateFact(company).map(f => ({ fact: f, signatures: [] })));
+
+        // Grant the subscriber the Administrator role *before* subscribing, so
+        // the distribution rule authorizes the spec as-is — pass-through, no
+        // intersection.
+        const admin = new Administrator(company, h.subscriber, new Date("2026-05-27"));
+        await h.factManager.save(dehydrateFact(admin).map(f => ({ fact: f, signatures: [] })));
+
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    o: ${Office.Type} [\n` +
+            `        o->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => o`;
+
+        const feedsResponse = await (h.router as any).feeds(h.requestUser, input);
+        expect(feedsResponse.feeds.length).toBeGreaterThan(0);
+
+        // S1: authorized decisions carry no denial code.
+        expect(feedsResponse.decisions).toHaveLength(feedsResponse.feeds.length);
+        for (const d of feedsResponse.decisions) {
+            expect(d.decision).toBe("authorized");
+            expect(d.code).toBeUndefined();
+            expect(d.reason).toBeTruthy();
+        }
+    });
+
     it("does not let another authenticated user reuse an intersected feed hash", async () => {
         const h = await makeHarness();
         const company = new Company(h.creator, "Acme");
@@ -236,10 +303,133 @@ describe("late-auth subscription recovery", () => {
         const feedsResponse = await (h.router as any).feeds(h.requestUser, input);
         expect(feedsResponse.feeds.length).toBeGreaterThan(0);
 
+        // S1: no rule covers this spec, so the decision is `denied` with the
+        // structured `no-matching-rule` code. The feed is still registered and
+        // served (empty), exactly as before — this only reports the decision.
+        expect(feedsResponse.decisions).toHaveLength(feedsResponse.feeds.length);
+        for (const d of feedsResponse.decisions) {
+            expect(d.decision).toBe("denied");
+            expect(d.code).toBe("no-matching-rule");
+            expect(d.reason).toBeTruthy();
+        }
+
         // Polling the cached feed must also stay live (empty page, not 403).
         const feedHash: string = feedsResponse.feeds[0];
         const page = await (h.router as any).feed(h.requestUser, { hash: feedHash }, {});
         expect(page).not.toBeNull();
         expect(page.references).toEqual([]);
     });
+
+    it("S2: recomputes the per-user decision on a repeated POST /feeds", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        const office = new Office(company, "HQ");
+        await h.factManager.save(dehydrateFact(office).map(f => ({ fact: f, signatures: [] })));
+
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    o: ${Office.Type} [\n` +
+            `        o->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => o`;
+
+        // First registration: subscriber is not yet an Administrator, so the
+        // decision is reactive (authorized via intersection).
+        const first = await (h.router as any).feeds(h.requestUser, input);
+        expect(first.decisions.every((d: any) => d.decision === "reactive")).toBe(true);
+
+        // The authorizing fact arrives.
+        const admin = new Administrator(company, h.subscriber, new Date("2026-05-27"));
+        await h.factManager.save(dehydrateFact(admin).map(f => ({ fact: f, signatures: [] })));
+
+        // A repeated POST /feeds for the same spec now returns `authorized` —
+        // the decision self-healed rather than returning a stale cached value.
+        const second = await (h.router as any).feeds(h.requestUser, input);
+        expect(second.decisions.length).toBeGreaterThan(0);
+        for (const d of second.decisions) {
+            expect(d.decision).toBe("authorized");
+            expect(d.code).toBeUndefined();
+        }
+    });
+
+    it("S2: returns different per-user decisions for the same spec", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        await h.factManager.save(dehydrateFact(company).map(f => ({ fact: f, signatures: [] })));
+
+        // Authorize the subscriber but not Mallory.
+        const admin = new Administrator(company, h.subscriber, new Date("2026-05-27"));
+        await h.factManager.save(dehydrateFact(admin).map(f => ({ fact: f, signatures: [] })));
+
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    o: ${Office.Type} [\n` +
+            `        o->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => o`;
+
+        const subscriberResponse = await (h.router as any).feeds(h.requestUser, input);
+        expect(subscriberResponse.decisions.every((d: any) => d.decision === "authorized")).toBe(true);
+
+        // Mallory is a different authenticated user with no Administrator fact.
+        const malloryRequest: RequestUser = {
+            provider: "mock", id: "mallory", profile: {} as any
+        };
+        await (h.router as any).login(malloryRequest);
+        const malloryResponse = await (h.router as any).feeds(malloryRequest, input);
+
+        // Same spec, different user: the decision is computed for Mallory, not
+        // reused from the subscriber. Mallory is not authorized, so the spec is
+        // rewritten via intersection into a reactive, user-specific feed.
+        expect(malloryResponse.decisions.every((d: any) => d.decision === "reactive")).toBe(true);
+        // The reactive rewrite yields a distinct, owner-bound hash — never the
+        // subscriber's authorized pass-through hash.
+        expect(malloryResponse.feeds).not.toEqual(subscriberResponse.feeds);
+    });
+
+    it("S3: emits a structured distribution.unmatched metric tagged by code on denial", async () => {
+        const h = await makeHarness();
+        const company = new Company(h.creator, "Acme");
+        const companyRef = dehydrateFact(company).find(f => f.type === Company.Type)!;
+        await h.factManager.save(dehydrateFact(company).map(f => ({ fact: f, signatures: [] })));
+
+        // A spec no distribution rule covers → denied · no-matching-rule.
+        const input =
+            `let p1: ${Company.Type} = #${companyRef.hash}\n` +
+            `(p1: ${Company.Type}) {\n` +
+            `    a: ${Administrator.Type} [\n` +
+            `        a->company: ${Company.Type} = p1\n` +
+            `    ]\n` +
+            `} => a`;
+
+        const tracer = new CapturingTracer();
+        await withTracer(tracer, () => (h.router as any).feeds(h.requestUser, input));
+
+        const unmatched = tracer.metrics.filter(m => m.message === "distribution.unmatched");
+        expect(unmatched).toHaveLength(1);
+        // Stable metric name, denial code as the (bounded) measurement key.
+        expect(unmatched[0].measurements).toEqual({ "no-matching-rule": 1 });
+    });
+
+    it("S4: throws FeedNotFound for an unknown feed hash, but not for a missing hash", async () => {
+        const h = await makeHarness();
+
+        // A known route with an unknown/expired hash is a distinct condition
+        // from a route miss: the method throws FeedNotFound (handleError maps
+        // it to a 404 with a `feed_not_found` body), rather than returning the
+        // generic null → "Not Found".
+        await expect((h.router as any).feed(h.requestUser, { hash: "deadbeef" }, {}))
+            .rejects.toBeInstanceOf(FeedNotFound);
+        await expect((h.router as any).streamFeed(h.requestUser, { hash: "deadbeef" }, {}))
+            .rejects.toBeInstanceOf(FeedNotFound);
+
+        // A missing hash param (wrong URL) still collapses to the generic 404
+        // path — the method returns null, unchanged.
+        const missing = await (h.router as any).feed(h.requestUser, {}, {});
+        expect(missing).toBeNull();
+    });
 });

package/test/http/streamFeedAnchorSpec.ts

@@ -102,7 +102,9 @@ describe("HttpRouter streamFeed anchor handling", () => {
         stream.next(r => { received.push(r); });
 
         await waitForMicrotasks();
-        expect(received).toEqual([]);
+        // The session catches up immediately (no tuples, empty waitlist) and
+        // emits a SYNC frame with empty references. No post has arrived yet.
+        expect(received.flatMap(r => r.references)).toEqual([]);
 
         // Save the author + a post that joins to it.
         const post = new Post(h.author, "first");