testLibraryAttestations

tcmts.cli.test.e2e.libraries.testLibraryAttestations · #5dtfmmpw · term

attestations: anyone reviews or writes an advisory about a release, signed in their own repository; only its author yanks it. tcm lib add and tcm lib show what its author says, and what the people the codebase trusts say (tcm lib trust, kept in its history).

import { startFakeAtproto } from "#codebase/tcmts/cli/test/e2e/examples";
import { withChildren } from "#codebase/tcmts/cli/test/e2e/harness";
import { codebase, onFakeNetwork } from "#codebase/tcmts/cli/test/e2e/releases";
import { startServerInfo } from "#codebase/tcmts/cli/test/e2e/sync";
import assert from "node:assert/strict";

export const testLibraryAttestations = () =>
  withChildren(async (keep) => {
    const alice = {
      did: "did:plc:alice000000000000000000",
      handle: "alice.test",
      password: "a-pass",
    };
    const maya = {
      did: "did:plc:maya0000000000000000000",
      handle: "maya.test",
      password: "m-pass",
    };
    const net = await startFakeAtproto(keep, [alice, maya]);
    const { ok, run } = onFakeNetwork(keep, net);
    const geo = codebase("attest geo");
    geo.save(
      `// tcm: namespace geo\nexport const manifest = { name: "geo" };\nexport const area = (side: number) => side * side;\n`,
      "add",
    );
    const source = (await startServerInfo(keep, geo.dir, "tok", "--public")).url;
    await ok(
      geo.dir,
      "release",
      "geo@1.0.0",
      "--announce",
      "--as",
      "alice.test",
      "--source",
      source,
    );
    const me = codebase("attest me");
    me.save(`// tcm: namespace app\nexport const x = 1;\n`, "add");

    // anyone reviews; an advisory says how bad; only the author yanks
    const reviewed = await ok(
      me.dir,
      "lib",
      "attest",
      "@alice.test/geo@1.0.0",
      "review",
      "-m",
      "Read all of area.",
      "--as",
      "maya.test",
    );
    assert.match(
      reviewed,
      /reviewed geo@1\.0\.0 \(#\w+\) as @maya\.test: at:\/\/did:plc:maya0+\/codes\.tcm\.review\/\w+/,
    );
    assert.ok(
      [...net.records.keys()].some((u) => u.startsWith(`at://${maya.did}/codes.tcm.review/`)),
    );
    assert.match(
      (
        await run(
          me.dir,
          "lib",
          "attest",
          "@alice.test/geo@1.0.0",
          "yank",
          "-m",
          "no",
          "--as",
          "maya.test",
        )
      ).out,
      /only its author can yank geo@1\.0\.0/,
    );
    assert.match(
      (await run(me.dir, "lib", "attest", "@alice.test/geo@1.0.0", "advisory", "-m", "x")).out,
      /an advisory says how bad it is: --severity low\|moderate\|high\|critical/,
    );
    await ok(
      me.dir,
      "lib",
      "attest",
      "@alice.test/geo@1.0.0",
      "advisory",
      "--severity",
      "high",
      "--fixed-in",
      "1.0.1",
      "-m",
      "area is wrong for negative sides",
      "--as",
      "alice.test",
    );
    // (its author yanks it from their own codebase, by the release's name there)
    assert.match(
      await ok(
        geo.dir,
        "lib",
        "attest",
        "geo@1.0.0",
        "yank",
        "-m",
        "use 1.0.1",
        "--as",
        "alice.test",
      ),
      /yanked geo@1\.0\.0/,
    );

    // adding it says what its author says; a review from someone not trusted isn't shown
    const added = await ok(me.dir, "lib", "add", "@alice.test/geo@1.0.0");
    assert.match(added, /yanked by its author @alice\.test: use 1\.0\.1/);
    assert.match(
      added,
      /advisory \(high\) from @alice\.test: area is wrong for negative sides \(fixed in 1\.0\.1\)/,
    );
    assert.doesNotMatch(added, /reviewed by/);

    // trusted, kept in history: her review shows too
    assert.match(
      await ok(me.dir, "lib", "trust", "--add", "maya.test"),
      /trusted, besides each library's author: @maya\.test/,
    );
    assert.match(me.tcm("view", "app.lib.trust"), new RegExp(maya.did));
    const listed = await ok(me.dir, "lib");
    assert.match(
      listed,
      /yanked by its author @alice\.test[\s\S]*advisory \(high\)[\s\S]*reviewed by @maya\.test: Read all of area\./,
    );
    assert.match(await ok(me.dir, "lib", "trust", "--rm", "maya.test"), /no one trusted yet/);
    assert.doesNotMatch(await ok(me.dir, "lib"), /reviewed by/);
  })

uses