testRegistryChecksAttestations

tcmts.registry.test.testRegistryChecksAttestations · #tzv274po · term

The registry takes reviews, advisories and yanks from Jetstream, and shows one only once it checks against its writer's signed repository: a forged one, or one no repository holds, fails; a yank counts only from the release's author, as the releases the registry checked say it (someone announcing her namespace as theirs, which fails, takes nothing over); a deleted one goes. What's shown is what the signed record says: an event that lies about one changes nothing.

import { startFakeAtproto } from "#codebase/tcmts/cli/test/e2e/examples";
import { tempDir, withChildren } from "#codebase/tcmts/cli/test/e2e/harness";
import { attestations, readJetstream, releases, shownAttestations, takeEvent } from "#codebase/tcmts/registry";
import type { RegistryRelease } from "#codebase/tcmts/registry";
import { readFromTheStart, withEnv } from "#codebase/tcmts/registry/test";
import { runJobs } from "#codebase/tcmts/server";
import type { RawEvent } from "@bsky/jetstream";
import assert from "node:assert/strict";

export const testRegistryChecksAttestations = () =>
  withChildren(async (keep) => {
    const alice = {
      did: "did:plc:alice000000000000000000",
      handle: "alice.test",
      password: "a-pass",
    };
    const maya = {
      did: "did:plc:maya0000000000000000000",
      handle: "maya.test",
      password: "m-pass",
    };
    const net = await startFakeAtproto(keep, [alice, maya]);
    const subject = { namespace: "geons", release: "geo@1.0.0", author: alice.did };
    const at = new Date().toISOString();
    net.seed(maya.did, "codes.tcm.review", "r1", {
      subject,
      body: "Read all of it.",
      createdAt: at,
    });
    net.seed(maya.did, "codes.tcm.advisory", "a1", {
      subject,
      body: "Wrong for negatives.",
      severity: "high",
      fixedIn: "1.0.1",
      createdAt: at,
    });
    net.seed(maya.did, "codes.tcm.yank", "y1", {
      subject,
      body: "not hers to yank",
      createdAt: at,
    });
    net.seed(alice.did, "codes.tcm.yank", "y2", { subject, body: "use 1.0.1", createdAt: at });
    // (maya claims alice's namespace as a release of hers, which fails, and yanks it as hers)
    net.seed(maya.did, "codes.tcm.yank", "y3", {
      subject: { ...subject, author: maya.did },
      body: "maya's, not alice's",
      createdAt: at,
    });
    net.seed(maya.did, "codes.tcm.review", "r2", { subject, body: "forged", createdAt: at });
    net.forge(`at://${maya.did}/codes.tcm.review/r2`);
    net.unsigned(maya.did, "codes.tcm.review", "r3", {
      subject,
      body: "in no repository",
      createdAt: at,
    });
    await withEnv(
      {
        TCM_ATPROTO_DIRECTORY: net.url,
        TCM_ATPROTO_LOCAL: "1",
        TCM_JETSTREAM: net.url,
        TCM_RELAY: net.url,
        TCM_REGISTRY_CODEBASE: tempDir("registry attest"),
        JETSTREAM_API_KEY: "",
      },
      async () => {
        await readFromTheStart();
        await readJetstream({ idleMs: 500 });
        await runJobs({ all: true });
        // the releases of that namespace, as the registry has them: alice's checked, maya's claim of it failed (after)
        const release = (did: string, state: RegistryRelease["state"]): RegistryRelease => ({
          uri: `at://${did}/codes.tcm.release/geo:1.0.0`,
          did,
          rkey: "geo:1.0.0",
          cid: "c",
          package: "geo",
          version: "1.0.0",
          namespace: "geons",
          entry: "x",
          notes: "",
          sources: [],
          createdAt: at,
          seq: 0,
          state,
          ...(state === "mirrored" ? { verifiedAt: new Date() } : { reason: "not hers" }),
        });
        const made = [
          await releases.insert(release(alice.did, "mirrored")),
          await releases.insert(release(maya.did, "failed")),
        ];
        const state = async (did: string, kind: string, rkey: string) =>
          (await attestations.findOne({ uri: `at://${did}/codes.tcm.${kind}/${rkey}` }))?.value
            .state;
        assert.equal(await state(maya.did, "review", "r1"), "verified");
        assert.equal(await state(maya.did, "advisory", "a1"), "verified");
        assert.equal(await state(maya.did, "review", "r2"), "failed");
        assert.equal(await state(maya.did, "review", "r3"), "failed");
        const shown = await shownAttestations();
        assert.deepEqual(shown.map((a) => `${a.kind} ${a.body}`).sort(), [
          "advisory Wrong for negatives.",
          "review Read all of it.",
          "yank use 1.0.1",
        ]);
        // (an event saying the advisory says something else, or that a review was deleted: checked, and not so)
        const lie = (
          operation: string,
          collection: string,
          rkey: string,
          record?: Record<string, unknown>,
        ) =>
          takeEvent({
            kind: "commit",
            did: maya.did,
            seq: 0,
            time: at,
            commit: {
              operation,
              collection,
              rkey,
              rev: "",
              cid: "c",
              ...(record ? { record } : {}),
            },
          } as unknown as RawEvent);
        await lie("update", "codes.tcm.advisory", "a1", {
          $type: "codes.tcm.advisory",
          subject,
          body: "Nothing wrong.",
          severity: "low",
          createdAt: at,
        });
        await lie("delete", "codes.tcm.review", "r1");
        await runJobs({ all: true });
        assert.deepEqual(
          (await shownAttestations()).map((a) => `${a.kind} ${a.severity ?? ""} ${a.body}`).sort(),
          ["advisory high Wrong for negatives.", "review  Read all of it.", "yank  use 1.0.1"],
        );
        for (const id of made) await releases.delete(id);
        const del = await fetch(`${net.url}/xrpc/com.atproto.repo.deleteRecord`, {
          method: "POST",
          headers: { authorization: `Bearer acc-${maya.did}`, "content-type": "application/json" },
          body: JSON.stringify({ repo: maya.did, collection: "codes.tcm.review", rkey: "r1" }),
        });
        assert.equal(del.status, 200);
        await readJetstream({ idleMs: 500 });
        await runJobs({ all: true });
        assert.equal(await state(maya.did, "review", "r1"), undefined);
      },
    );
  })

uses