+22

.changeset/itchy-rice-kick.md

Reviewed

··· 1 1 + --- 2 2 + "@atmo-dev/contrail-community": minor 3 3 + "@atmo-dev/contrail": minor 4 4 + --- 5 5 + 6 6 + A third community-creation mode: **provision**. alongside the existing `adopt` (caller already has a `did:plc`) and `mint` (caller wants a DID but brings their own PDS) modes, contrail can now provision a community on a stock `@atproto/pds` end-to-end — minting the `did:plc`, creating and activating the PDS account, generating an app password, and persisting credentials so the existing `community.putRecord` / `.deleteRecord` publish path keeps working. contrail never holds PDS admin credentials. 7 7 + 8 8 + **`xrpc/{ns}.community.provision`** runs the five-step PLC + PDS dance (key generation → PLC genesis → `createAccount` → `getRecommendedDidCredentials` + signed PLC update op → `activateAccount`), persists each step in a new `provision_attempts` table so a partially-failed attempt can be resumed, mints an app password, and seeds the session cache. 9 9 + 10 10 + **`contrail-community reap [--all-stuck] [--older-than <minutes>] [--db <url>] [--dry-run]`** new CLI (a bin shipped by `@atmo-dev/contrail-community`) that cleans up provision attempts which didn't reach `status='activated'` by tombstoning their PLC entries. `--dry-run` is the default; per-row confirmation is required for live reaping unless `--all-stuck` is given. `--all-stuck` only acts on rows idle at least `--older-than` minutes (default 30) so a bulk run can't tombstone an in-flight provision. Runs against the Cloudflare D1 binding by default, or against the decoupled Postgres index when `--db`/`DATABASE_URL` is set. It ships as a contrail-community bin because the PR #30 package split removed contrail's edge into community code: under pnpm's isolated `node_modules` the core `contrail` CLI can't resolve `@atmo-dev/contrail-community`, so `contrail reap` only registers in hoisted installs where both packages sit together. 11 11 + 12 12 + custody model: the caller supplies a `rotationKey` and that key sits at `rotationKeys[0]` — the highest-priority rotation slot on the resulting DID. contrail generates a subordinate keypair and persists it (AES-GCM-encrypted under `masterKey`) at `rotationKeys[1]`, so it can submit later PLC ops on the community's behalf — most importantly the post-activation PLC update during provision, and the tombstone op that `reap` issues to clean up stuck DIDs. 13 13 + 14 14 + the caller's key dominates: PLC's 72-hour nullification window means any op contrail signs with its subordinate key can be overridden within 72h by an op signed with the caller's key. with this caveat: a tombstone is irrevocable. a malicious or compromised contrail instance could tombstone any DID it provisioned. there is no managed code path, no shared rotation, and `rootCredentials` are returned to the caller in the response so they can also be persisted out-of-band. 15 15 + 16 16 + what you need to configure / know: 17 17 + 18 18 + - new `community` config block: `masterKey` (32-byte AES-GCM envelope key for the encrypted credential columns), `allowedProvisionPdsEndpoints` (URL-origin matching, collapses scheme case / default ports / trailing slash / IDN), optional `plcDirectory` override. 19 19 + 20 20 + - **provisioning fails closed.** When `allowProvisioning` is true, `allowedProvisionPdsEndpoints` MUST be non-empty — a missing/empty allowlist no longer means "accept any PDS" (that was a fail-open hole: any caller could have a PLC genesis op signed by Contrail's rotation key against an attacker-chosen PDS). To deliberately accept any endpoint, set the separate, loud `allowAnyProvisionPdsEndpoint: true`. The field was renamed from `allowedPdsEndpoints` to make clear it gates *provisioning* only, not which PDSes Contrail reads/indexes. 21 21 + 22 22 + - new tables `provision_attempts` and `community_credentials`. credentials are stored AES-GCM-encrypted under that key; lose the key, lose the ability to mint sessions for previously-provisioned communities.

+1

.gitignore

Reviewed

··· 1 1 node_modules 2 2 .wrangler 3 3 dist 4 4 + *.tsbuildinfo 4 5 5 6 # Turbo 6 7 .turbo

+402

apps/contrail-e2e/tests/community-provision-walkthrough.test.ts

Reviewed

··· 1 1 + /** 2 2 + * Provisioned-community lifecycle walkthrough — the "happy day" the PR was 3 3 + * built for, end-to-end on the same handler. 4 4 + * 5 5 + * Each previous test pins one slice (provision-only, publishing-only, 6 6 + * ACL-only, ingest-only). This one chains them so a regression on any seam 7 7 + * between modules — provision → ACL → proxy publish → ingest of a RSVP from 8 8 + * a separate PDS repo — surfaces here even when each unit test still passes. 9 9 + * 10 10 + * Flow (each step is also asserted, so the test reads top-to-bottom as docs): 11 11 + * 12 12 + * 1. PROVISION — Alice calls `community.provision` with a caller-held 13 13 + * P-256 rotation key (sovereign mode). Asserts: status=activated, 14 14 + * DID well-formed, PLC log shows the caller's did:key at 15 15 + * rotationKeys[0] (the sovereignty invariant). 16 16 + * 17 17 + * 2. GRANT — Alice grants Bob `member` on the community's `$publishers` 18 18 + * space via `community.space.grant`. Asserts: listMembers shows Bob 19 19 + * with accessLevel=member. 20 20 + * 21 21 + * 3. PUBLISH — Bob calls `community.putRecord` to write a public 22 22 + * `community.lexicon.calendar.event` against the community DID's repo 23 23 + * (proxied through Contrail's credential vault — Bob never holds the 24 24 + * community's app password). Asserts: returned URI is rooted at the 25 25 + * community DID; the record is visible via `com.atproto.repo.listRecords` 26 26 + * against the community's PDS (proves the proxy actually wrote to the 27 27 + * community repo, not a local index). 28 28 + * 29 29 + * 4. RSVP — Carol, a totally separate PDS account with no relationship 30 30 + * to the community, writes a `community.lexicon.calendar.rsvp` to her 31 31 + * own repo with `subject.uri = at://<communityDid>/.../<rkey>`. 32 32 + * Anyone can RSVP — no grant required, that's the lexicon contract. 33 33 + * 34 34 + * 5. INDEX — The in-process ingester (Jetstream → Postgres) picks up both 35 35 + * Bob's event and Carol's RSVP. Asserts: querying the event by URI 36 36 + * shows rsvpsGoingCount=1, with the indexed event `did` being the 37 37 + * community's DID (not Bob's, not Alice's). 38 38 + * 39 39 + * Prereqs: `pnpm stack:up` (devnet PDS+PLC + postgres reachable). 40 40 + */ 41 41 + import { describe, it, expect, beforeAll, afterAll } from "vitest"; 42 42 + import pg from "pg"; 43 43 + import type { Client } from "@atcute/client"; 44 44 + import "@atcute/atproto"; 45 45 + import { 46 46 + Contrail, 47 47 + generateKeyPair, 48 48 + runPersistent, 49 49 + } from "@atmo-dev/contrail"; 50 50 + import { createHandler } from "@atmo-dev/contrail/server"; 51 51 + import { createPostgresDatabase } from "@atmo-dev/contrail/postgres"; 52 52 + import { config as baseConfig } from "../config"; 53 53 + import { 54 54 + CONTRAIL_SERVICE_DID, 55 55 + HANDLE_DOMAIN, 56 56 + PDS_ADMIN_PASSWORD, 57 57 + PDS_URL, 58 58 + PLC_URL, 59 59 + createCaller, 60 60 + createDevnetResolver, 61 61 + createIsolatedSchema, 62 62 + createTestAccount, 63 63 + devnetRewriteFetch, 64 64 + getRecordFromPds, 65 65 + jsonOr, 66 66 + login, 67 67 + waitFor, 68 68 + type CallAs, 69 69 + type TestAccount, 70 70 + } from "./helpers"; 71 71 + 72 72 + const NS = `${baseConfig.namespace}.community`; 73 73 + const SPACE_TYPE = "rsvp.atmo.event.space"; 74 74 + const EVENT_NSID = "community.lexicon.calendar.event"; 75 75 + const RSVP_NSID = "community.lexicon.calendar.rsvp"; 76 76 + const TEST_MASTER_KEY = new Uint8Array(32).fill(7); 77 77 + 78 78 + describe("community provision → grant → publish → RSVP walkthrough", () => { 79 79 + // Alice provisions the community (becomes owner of $admin and $publishers). 80 80 + // Bob is granted member on $publishers and publishes the event on behalf 81 81 + // of the community via the proxy. Carol is an arm's-length user on the 82 82 + // same PDS who RSVPs from her own repo — she has no grants on the 83 83 + // community, which is exactly the open-RSVP contract we want to pin. 84 84 + let alice: TestAccount; 85 85 + let bob: TestAccount; 86 86 + let carol: TestAccount; 87 87 + 88 88 + let aliceClient: Client; 89 89 + let bobClient: Client; 90 90 + let carolClient: Client; 91 91 + 92 92 + let pool: pg.Pool; 93 93 + let cleanupSchema: () => Promise<void>; 94 94 + let pdsDid: string; 95 95 + let handle: (req: Request) => Promise<Response>; 96 96 + let callAs: CallAs; 97 97 + 98 98 + let ingestController: AbortController; 99 99 + let ingestPromise: Promise<void>; 100 100 + 101 101 + // Keypair held only by this test process; the public did:key is what we 102 102 + // pass to provision. The private JWK never leaves the test — that's the 103 103 + // sovereignty invariant we assert against the PLC log in step 1. 104 104 + let callerRotation: Awaited<ReturnType<typeof generateKeyPair>>; 105 105 + 106 106 + // Carried between tests in declaration order. 107 107 + let communityDid: string; 108 108 + let publishersUri: string; 109 109 + let eventUri: string; 110 110 + let eventCid: string; 111 111 + let eventRkey: string; 112 112 + 113 113 + beforeAll(async () => { 114 114 + // Discover the live PDS's DID — the orchestrator uses this as the `aud` 115 115 + // claim of the service-auth JWT it mints for createAccount, and the 116 116 + // devnet PDS validates `aud` against its own DID. 117 117 + const dres = await fetch(`${PDS_URL}/xrpc/com.atproto.server.describeServer`); 118 118 + if (!dres.ok) { 119 119 + throw new Error( 120 120 + `devnet PDS unreachable at ${PDS_URL}: ${dres.status} ${await dres.text()}`, 121 121 + ); 122 122 + } 123 123 + pdsDid = ((await dres.json()) as { did?: string }).did!; 124 124 + 125 125 + [alice, bob, carol] = await Promise.all([ 126 126 + createTestAccount(), 127 127 + createTestAccount(), 128 128 + createTestAccount(), 129 129 + ]); 130 130 + 131 131 + aliceClient = await login(alice); 132 132 + bobClient = await login(bob); 133 133 + carolClient = await login(carol); 134 134 + 135 135 + callerRotation = await generateKeyPair(); 136 136 + 137 137 + const iso = await createIsolatedSchema("test_provision_walkthrough"); 138 138 + pool = iso.pool; 139 139 + cleanupSchema = iso.cleanup; 140 140 + const db = createPostgresDatabase(pool); 141 141 + 142 142 + const contrail = new Contrail({ 143 143 + ...baseConfig, 144 144 + db, 145 145 + spaces: { 146 146 + type: SPACE_TYPE, 147 147 + serviceDid: CONTRAIL_SERVICE_DID, 148 148 + resolver: createDevnetResolver(), 149 149 + }, 150 150 + community: { 151 151 + // Provision uses serviceDid as the `aud` of its createAccount 152 152 + // service-auth JWT — must be the live PDS's DID, not the Contrail 153 153 + // service DID we use for inbound auth verification. 154 154 + serviceDid: pdsDid, 155 155 + masterKey: TEST_MASTER_KEY, 156 156 + plcDirectory: PLC_URL, 157 157 + resolver: createDevnetResolver(), 158 158 + // Devnet PDSes publish https://devnet.test in their DID document's 159 159 + // atproto_pds entry. Rewrite outgoing requests so the proxied 160 160 + // publish lands on the host-mapped port. 161 161 + fetch: devnetRewriteFetch, 162 162 + allowProvisioning: true, 163 163 + }, 164 164 + }); 165 165 + await contrail.init(); 166 166 + handle = createHandler(contrail); 167 167 + callAs = createCaller(handle); 168 168 + 169 169 + // Run the ingester in-process so step 5 can see Carol's RSVP land in 170 170 + // the local index after she writes it directly to her PDS repo. 171 171 + ingestController = new AbortController(); 172 172 + ingestPromise = runPersistent(db, baseConfig, { 173 173 + batchSize: 50, 174 174 + flushIntervalMs: 500, 175 175 + signal: ingestController.signal, 176 176 + }); 177 177 + }, 30_000); 178 178 + 179 179 + afterAll(async () => { 180 180 + ingestController?.abort(); 181 181 + await ingestPromise?.catch(() => {}); 182 182 + await cleanupSchema?.(); 183 183 + }); 184 184 + 185 185 + // ----- helpers -------------------------------------------------------------- 186 186 + 187 187 + async function getIndexedRecord(uri: string): Promise<any | undefined> { 188 188 + const url = 189 189 + `http://test/xrpc/${baseConfig.namespace}.event.getRecord?uri=${encodeURIComponent(uri)}`; 190 190 + const res = await handle(new Request(url)); 191 191 + if (res.status === 404) return undefined; 192 192 + if (!res.ok) throw new Error(`getRecord ${uri} → ${res.status}: ${await res.text()}`); 193 193 + return await res.json(); 194 194 + } 195 195 + 196 196 + async function mintPdsInvite(): Promise<string> { 197 197 + const res = await fetch(`${PDS_URL}/xrpc/com.atproto.server.createInviteCode`, { 198 198 + method: "POST", 199 199 + headers: { 200 200 + "content-type": "application/json", 201 201 + authorization: `Basic ${Buffer.from( 202 202 + `admin:${PDS_ADMIN_PASSWORD}`, 203 203 + ).toString("base64")}`, 204 204 + }, 205 205 + body: JSON.stringify({ useCount: 1 }), 206 206 + }); 207 207 + if (!res.ok) { 208 208 + throw new Error(`createInviteCode → ${res.status}: ${await res.text()}`); 209 209 + } 210 210 + return ((await res.json()) as { code: string }).code; 211 211 + } 212 212 + 213 213 + // ----- step 1: PROVISION --------------------------------------------------- 214 214 + // Sovereign provision: the caller passes the public did:key of a rotation 215 215 + // key they hold. Contrail mints a subordinate rotation key, lays down a 216 216 + // genesis op with [callerKey, contrailKey] in that order, then runs an 217 217 + // update op to install the PDS-recommended verification methods. The PLC 218 218 + // log must end with the caller's key still at rotationKeys[0] — without 219 219 + // that, recovery authority silently moved to Contrail. 220 220 + 221 221 + it("step 1 — provisions a sovereign community via XRPC and the PLC log shows the caller's rotation key first", async () => { 222 222 + const inviteCode = await mintPdsInvite(); 223 223 + 224 224 + // Devnet PDS caps the local handle label at 18 chars. `pw-` prefix + 225 225 + // 8-char suffix keeps the full label well under that. 226 226 + const suffix = `${Date.now().toString(36).slice(-6)}${Math.random() 227 227 + .toString(36) 228 228 + .slice(2, 4)}`; 229 229 + const newHandle = `pw-${suffix}${HANDLE_DOMAIN}`; 230 230 + const email = `${suffix}@devnet.test`; 231 231 + const password = `pw-${suffix}`; 232 232 + 233 233 + const res = await callAs(aliceClient, "POST", `${NS}.provision`, { 234 234 + body: { 235 235 + handle: newHandle, 236 236 + email, 237 237 + password, 238 238 + inviteCode, 239 239 + pdsEndpoint: PDS_URL, 240 240 + rotationKey: callerRotation.publicDidKey, 241 241 + }, 242 242 + }); 243 243 + expect(res.status, await res.clone().text()).toBe(200); 244 244 + const body = (await res.json()) as { communityDid: string; status: string }; 245 245 + expect(body.status).toBe("activated"); 246 246 + expect(body.communityDid).toMatch(/^did:plc:[a-z2-7]{24}$/); 247 247 + communityDid = body.communityDid; 248 248 + 249 249 + // PLC sovereignty check: latest op (the post-activation update op) keeps 250 250 + // the caller's did:key at rotationKeys[0]. If this regresses, Contrail's 251 251 + // subordinate key would silently take rotation priority. 252 252 + const logRes = await fetch(`${PLC_URL}/${communityDid}/log`); 253 253 + expect(logRes.ok).toBe(true); 254 254 + const log = (await logRes.json()) as Array<{ rotationKeys: string[] }>; 255 255 + expect(log.length).toBeGreaterThanOrEqual(2); 256 256 + expect(log[log.length - 1]!.rotationKeys[0]).toBe(callerRotation.publicDidKey); 257 257 + 258 258 + publishersUri = `ats://${communityDid}/${SPACE_TYPE}/$publishers`; 259 259 + }, 30_000); 260 260 + 261 261 + // ----- step 2: GRANT ------------------------------------------------------- 262 262 + // bootstrapReservedSpaces seeded $publishers with Alice as owner. To let 263 263 + // Bob publish on behalf of the community, Alice grants him `member` on 264 264 + // $publishers — the minimum level the putRecord guard accepts. 265 265 + 266 266 + it("step 2 — Alice grants Bob `member` on $publishers and listMembers reflects it", async () => { 267 267 + expect(communityDid, "step 1 must have provisioned the community").toBeTruthy(); 268 268 + 269 269 + const res = await callAs(aliceClient, "POST", `${NS}.space.grant`, { 270 270 + body: { 271 271 + spaceUri: publishersUri, 272 272 + subject: { did: bob.did }, 273 273 + accessLevel: "member", 274 274 + }, 275 275 + }); 276 276 + expect(res.status, await res.clone().text()).toBe(200); 277 277 + 278 278 + const list = await callAs(aliceClient, "GET", `${NS}.space.listMembers`, { 279 279 + query: { spaceUri: publishersUri }, 280 280 + }); 281 281 + expect(list.status).toBe(200); 282 282 + const { rows } = (await jsonOr(list)) as { 283 283 + rows: Array<{ subject: { did?: string }; accessLevel: string }>; 284 284 + }; 285 285 + const byDid = Object.fromEntries( 286 286 + rows.filter((r) => r.subject.did).map((r) => [r.subject.did, r.accessLevel]), 287 287 + ); 288 288 + expect(byDid[alice.did]).toBe("owner"); 289 289 + expect(byDid[bob.did]).toBe("member"); 290 290 + }); 291 291 + 292 292 + // ----- step 3: PUBLISH ----------------------------------------------------- 293 293 + // Bob calls community.putRecord. The router checks his level on 294 294 + // $publishers (member ≥ member, OK), pulls the community's encrypted 295 295 + // app password from the credential vault, opens a PDS session as the 296 296 + // community DID, and proxies a com.atproto.repo.createRecord. The 297 297 + // returned URI is rooted at the community DID — Bob never holds those 298 298 + // credentials, and his own DID doesn't appear anywhere in the record. 299 299 + 300 300 + it("step 3 — Bob (a $publishers member) publishes a public event as the community via proxy", async () => { 301 301 + expect(publishersUri, "step 2 must have granted bob").toBeTruthy(); 302 302 + 303 303 + const eventName = `walkthrough-event ${Date.now()}`; 304 304 + const startsAt = new Date(Date.now() + 60 * 60_000).toISOString(); 305 305 + 306 306 + const res = await callAs(bobClient, "POST", `${NS}.putRecord`, { 307 307 + body: { 308 308 + communityDid, 309 309 + collection: EVENT_NSID, 310 310 + record: { 311 311 + $type: EVENT_NSID, 312 312 + name: eventName, 313 313 + createdAt: new Date().toISOString(), 314 314 + startsAt, 315 315 + mode: `${EVENT_NSID}#inperson`, 316 316 + status: `${EVENT_NSID}#scheduled`, 317 317 + }, 318 318 + }, 319 319 + }); 320 320 + expect(res.status, await res.clone().text()).toBe(200); 321 321 + const out = (await res.json()) as { uri: string; cid: string }; 322 322 + eventUri = out.uri; 323 323 + eventCid = out.cid; 324 324 + eventRkey = out.uri.split("/").pop()!; 325 325 + 326 326 + // URI is rooted at the community DID, not Bob's. 327 327 + expect(eventUri).toMatch(new RegExp(`^at://${communityDid}/${EVENT_NSID}/`)); 328 328 + 329 329 + // The record is visible via the community PDS's listRecords — proves 330 330 + // the proxy actually wrote to the community repo, not just Contrail's 331 331 + // local index. listRecords is the lexicon endpoint the prompt named; 332 332 + // we round it out with a getRecord on the same rkey to confirm payload. 333 333 + const listUrl = 334 334 + `${PDS_URL}/xrpc/com.atproto.repo.listRecords` + 335 335 + `?repo=${encodeURIComponent(communityDid)}` + 336 336 + `&collection=${encodeURIComponent(EVENT_NSID)}` + 337 337 + `&limit=10`; 338 338 + const listRes = await fetch(listUrl); 339 339 + expect(listRes.ok, `listRecords ${listRes.status}`).toBe(true); 340 340 + const listed = (await listRes.json()) as { 341 341 + records: Array<{ uri: string; cid: string; value: { name?: string } }>; 342 342 + }; 343 343 + const found = listed.records.find((r) => r.uri === eventUri); 344 344 + expect(found, `event ${eventUri} not in PDS listRecords`).toBeDefined(); 345 345 + expect(found!.value.name).toBe(eventName); 346 346 + 347 347 + const onPds = await getRecordFromPds(communityDid, EVENT_NSID, eventRkey); 348 348 + expect(onPds.status).toBe(200); 349 349 + expect(onPds.record.name).toBe(eventName); 350 350 + }, 30_000); 351 351 + 352 352 + // ----- step 4: RSVP -------------------------------------------------------- 353 353 + // Carol writes a community.lexicon.calendar.rsvp to her OWN repo on the 354 354 + // shared devnet PDS, with subject.uri pointing at the community's event. 355 355 + // She has zero relationship to the community — that's the open-RSVP 356 356 + // contract: anyone can RSVP, the record lives in the responder's repo. 357 357 + 358 358 + it("step 4 — Carol RSVPs from a separate PDS account by writing to her own repo", async () => { 359 359 + expect(eventUri, "step 3 must have published the event").toBeTruthy(); 360 360 + 361 361 + const rsvpRes = await carolClient.post("com.atproto.repo.createRecord", { 362 362 + input: { 363 363 + repo: carol.did, 364 364 + collection: RSVP_NSID, 365 365 + record: { 366 366 + $type: RSVP_NSID, 367 367 + subject: { uri: eventUri, cid: eventCid }, 368 368 + status: `${RSVP_NSID}#going`, 369 369 + createdAt: new Date().toISOString(), 370 370 + }, 371 371 + }, 372 372 + }); 373 373 + expect(rsvpRes.ok, `RSVP createRecord: ${JSON.stringify(rsvpRes.data)}`).toBe(true); 374 374 + if (!rsvpRes.ok) throw new Error("unreachable"); 375 375 + expect(rsvpRes.data.uri).toMatch(new RegExp(`^at://${carol.did}/${RSVP_NSID}/`)); 376 376 + }); 377 377 + 378 378 + // ----- step 5: INDEX ------------------------------------------------------- 379 379 + // Both records hit Jetstream and the in-process ingester. Querying the 380 380 + // event by URI from the local handler should hydrate rsvpsGoingCount=1 381 381 + // (Carol's RSVP referencing it), and the indexed `did` must be the 382 382 + // community's, not Bob's — proves end-to-end attribution works. 383 383 + 384 384 + it("step 5 — the indexer surfaces the event under the community DID with Carol's RSVP counted", async () => { 385 385 + expect(eventUri, "step 3 must have published the event").toBeTruthy(); 386 386 + 387 387 + const indexed = await waitFor( 388 388 + async () => { 389 389 + const r = await getIndexedRecord(eventUri); 390 390 + return r && r.rsvpsGoingCount >= 1 ? r : undefined; 391 391 + }, 392 392 + { label: `indexed ${eventUri} with rsvpsGoingCount>=1`, timeoutMs: 20_000 }, 393 393 + ); 394 394 + 395 395 + expect(indexed.uri).toBe(eventUri); 396 396 + // Attribution: the event belongs to the community, not the publisher. 397 397 + expect(indexed.did).toBe(communityDid); 398 398 + expect(indexed.did).not.toBe(bob.did); 399 399 + expect(indexed.did).not.toBe(alice.did); 400 400 + expect(indexed.rsvpsGoingCount).toBe(1); 401 401 + }, 30_000); 402 402 + });

+490

apps/contrail-e2e/tests/provision.test.ts

Reviewed

··· 1 1 + /** 2 2 + * End-to-end test exercising the full ProvisionOrchestrator flow against the 3 3 + * live devnet stack (PDS on :4000, PLC on :2582). Validates the 5-RPC sequence 4 4 + * genesis op → createAccount → getRecommendedDidCredentials 5 5 + * → PLC update op → activateAccount 6 6 + * lands an activated account. 7 7 + * 8 8 + * Catches integration bugs that mocks can't: 9 9 + * - hand-rolled ES256 service-auth JWT vs real atproto verifier 10 10 + * - hand-rolled DAG-CBOR encoder output vs real PLC parser 11 11 + * - genesis-op DID computation matches what PLC expects 12 12 + * - cidForOp output accepted by PLC as `prev` for the update op 13 13 + * - low-S signature normalization 14 14 + * 15 15 + * Prereqs: `pnpm stack:up` (devnet PDS+PLC + postgres reachable). 16 16 + */ 17 17 + import { describe, it, expect, beforeAll, afterAll } from "vitest"; 18 18 + import { randomUUID } from "node:crypto"; 19 19 + import pg from "pg"; 20 20 + import type { Client } from "@atcute/client"; 21 21 + import { 22 22 + CommunityAdapter, 23 23 + CredentialCipher, 24 24 + Contrail, 25 25 + ProvisionOrchestrator, 26 26 + initCommunitySchema, 27 27 + pdsCreateAccount, 28 28 + pdsGetRecommendedDidCredentials, 29 29 + pdsActivateAccount, 30 30 + pdsCreateAppPassword, 31 31 + generateKeyPair, 32 32 + createPdsSession, 33 33 + submitGenesisOp, 34 34 + type PdsClient, 35 35 + type PlcClient, 36 36 + } from "@atmo-dev/contrail"; 37 37 + import { createHandler } from "@atmo-dev/contrail/server"; 38 38 + import { createPostgresDatabase } from "@atmo-dev/contrail/postgres"; 39 39 + import { 40 40 + PDS_URL, 41 41 + PLC_URL, 42 42 + HANDLE_DOMAIN, 43 43 + PDS_ADMIN_PASSWORD, 44 44 + CONTRAIL_SERVICE_DID, 45 45 + createCaller, 46 46 + createDevnetResolver, 47 47 + createIsolatedSchema, 48 48 + createTestAccount, 49 49 + login, 50 50 + type CallAs, 51 51 + type TestAccount, 52 52 + } from "./helpers"; 53 53 + 54 54 + describe("ProvisionOrchestrator devnet e2e", () => { 55 55 + let pool: pg.Pool; 56 56 + let cleanupSchema: () => Promise<void>; 57 57 + let adapter: CommunityAdapter; 58 58 + let cipher: CredentialCipher; 59 59 + let pdsDid: string; 60 60 + 61 61 + beforeAll(async () => { 62 62 + // Discover the live PDS's DID via describeServer — used as the `aud` 63 63 + // claim in the service-auth JWT we mint for createAccount. 64 64 + const res = await fetch(`${PDS_URL}/xrpc/com.atproto.server.describeServer`); 65 65 + if (!res.ok) { 66 66 + throw new Error( 67 67 + `devnet PDS unreachable at ${PDS_URL}: ${res.status} ${await res.text()}`, 68 68 + ); 69 69 + } 70 70 + const body = (await res.json()) as { did?: string }; 71 71 + if (!body.did) { 72 72 + throw new Error(`describeServer response missing did: ${JSON.stringify(body)}`); 73 73 + } 74 74 + pdsDid = body.did; 75 75 + 76 76 + const iso = await createIsolatedSchema("test_provision_e2e"); 77 77 + pool = iso.pool; 78 78 + cleanupSchema = iso.cleanup; 79 79 + const db = createPostgresDatabase(pool); 80 80 + await initCommunitySchema(db); 81 81 + adapter = new CommunityAdapter(db); 82 82 + cipher = new CredentialCipher(new Uint8Array(32).fill(7)); 83 83 + }, 15_000); 84 84 + 85 85 + afterAll(async () => { 86 86 + await cleanupSchema?.(); 87 87 + }); 88 88 + 89 89 + // Adapt our bare module-level functions to the orchestrator's wrapper 90 90 + // interfaces. Shared by the managed and self-sovereign tests so they hit 91 91 + // the same live PDS surface (Task 16 added createAppPassword to PdsClient). 92 92 + const pdsClient: PdsClient = { 93 93 + createAccount: ({ pdsUrl, serviceAuthJwt, body }) => 94 94 + pdsCreateAccount(pdsUrl, serviceAuthJwt, body), 95 95 + getRecommendedDidCredentials: ({ pdsUrl, accessJwt }) => 96 96 + pdsGetRecommendedDidCredentials(pdsUrl, accessJwt), 97 97 + activateAccount: ({ pdsUrl, accessJwt }) => 98 98 + pdsActivateAccount(pdsUrl, accessJwt), 99 99 + createAppPassword: ({ pdsUrl, accessJwt, name }) => 100 100 + pdsCreateAppPassword(pdsUrl, accessJwt, name), 101 101 + }; 102 102 + 103 103 + const plcClient: PlcClient = { 104 104 + submit: (did, op) => submitGenesisOp(PLC_URL, did, op as any), 105 105 + }; 106 106 + 107 107 + /** Mint a single-use invite via the PDS admin API. Shared helper for both 108 108 + * the managed and self-sovereign tests. */ 109 109 + async function mintInvite(): Promise<string> { 110 110 + const inviteRes = await fetch( 111 111 + `${PDS_URL}/xrpc/com.atproto.server.createInviteCode`, 112 112 + { 113 113 + method: "POST", 114 114 + headers: { 115 115 + "content-type": "application/json", 116 116 + authorization: `Basic ${Buffer.from( 117 117 + `admin:${PDS_ADMIN_PASSWORD}`, 118 118 + ).toString("base64")}`, 119 119 + }, 120 120 + body: JSON.stringify({ useCount: 1 }), 121 121 + }, 122 122 + ); 123 123 + if (!inviteRes.ok) { 124 124 + throw new Error( 125 125 + `createInviteCode failed (${inviteRes.status}): ${await inviteRes.text()}`, 126 126 + ); 127 127 + } 128 128 + return ((await inviteRes.json()) as { code: string }).code; 129 129 + } 130 130 + 131 131 + it( 132 132 + "provisions a self-sovereign community: caller holds rotation key, contrail mints app password", 133 133 + async () => { 134 134 + // Caller-held rotation keypair. The private JWK never leaves this test — 135 135 + // only callerRotation.publicDidKey is passed to the orchestrator. That's 136 136 + // the negative invariant we assert below: no encrypted_* column on the 137 137 + // persisted row contains the caller's did:key after decrypt. 138 138 + const callerRotation = await generateKeyPair(); 139 139 + 140 140 + const inviteCode = await mintInvite(); 141 141 + 142 142 + // Keep handle short — devnet caps the local label at 18 chars. 143 143 + // `ss-` (3) + 8-char suffix = 11 chars on the local label. 144 144 + const suffix = `${Date.now().toString(36).slice(-5)}${Math.random() 145 145 + .toString(36) 146 146 + .slice(2, 5)}`; 147 147 + const handle = `ss-${suffix}${HANDLE_DOMAIN}`; 148 148 + const email = `${suffix}@devnet.test`; 149 149 + const password = `pw-${suffix}`; 150 150 + const attemptId = randomUUID(); 151 151 + 152 152 + const orch = new ProvisionOrchestrator({ 153 153 + adapter, 154 154 + cipher, 155 155 + plc: plcClient, 156 156 + pds: pdsClient, 157 157 + pdsDid, 158 158 + }); 159 159 + 160 160 + const result = await orch.provision({ 161 161 + attemptId, 162 162 + pdsEndpoint: PDS_URL, 163 163 + handle, 164 164 + email, 165 165 + password, 166 166 + inviteCode, 167 167 + rotationKey: callerRotation.publicDidKey, 168 168 + }); 169 169 + 170 170 + // Result-shape assertions: status activated; rootCredentials returned 171 171 + // with the user's *root* password, not the minted app password. 172 172 + expect(result.attemptId).toBe(attemptId); 173 173 + expect(result.did).toMatch(/^did:plc:[a-z2-7]{24}$/); 174 174 + expect(result.status).toBe("activated"); 175 175 + expect(result.rootCredentials).toBeDefined(); 176 176 + expect(result.rootCredentials!.handle).toBe(handle); 177 177 + expect(result.rootCredentials!.password).toBe(password); 178 178 + expect(typeof result.rootCredentials!.recoveryHint).toBe("string"); 179 179 + expect(result.rootCredentials!.recoveryHint.length).toBeGreaterThan(0); 180 180 + 181 181 + // Persisted-row assertions: self-sovereign mode persists an *encrypted 182 182 + // app password* — never the user's root password. Contrail's rotation 183 183 + // key is the SUBORDINATE (rotationKeys[1]); the caller's did:key is 184 184 + // rotationKeys[0] in the genesis op and lives only in PLC, never in 185 185 + // any encrypted_* column. 186 186 + const row = await adapter.getProvisionAttempt(attemptId); 187 187 + expect(row).not.toBeNull(); 188 188 + expect(row!.status).toBe("activated"); 189 189 + expect(row!.did).toBe(result.did); 190 190 + expect(row!.handle).toBe(handle); 191 191 + expect(row!.encryptedSigningKey).toBeTruthy(); 192 192 + expect(row!.encryptedRotationKey).toBeTruthy(); 193 193 + expect(row!.encryptedPassword).toBeTruthy(); 194 194 + expect(row!.activatedAt).toBeTruthy(); 195 195 + expect(row!.lastError).toBeNull(); 196 196 + 197 197 + // Decrypt the persisted password — it must be the *minted app password*, 198 198 + // distinct from the user's root password we supplied. 199 199 + const decryptedAppPassword = await cipher.decryptString( 200 200 + row!.encryptedPassword!, 201 201 + ); 202 202 + expect(decryptedAppPassword).not.toBe(password); 203 203 + expect(decryptedAppPassword.length).toBeGreaterThan(0); 204 204 + 205 205 + // Decrypt the persisted rotation JWK — it must be Contrail's subordinate 206 206 + // key (a fresh P-256 keypair), NOT the caller's. We assert NOT-equal on 207 207 + // the JWK shape, including the `d` (private) coordinate which the caller 208 208 + // never sent. 209 209 + const decryptedRotationJwk = JSON.parse( 210 210 + await cipher.decryptString(row!.encryptedRotationKey!), 211 211 + ) as { kty?: string; crv?: string; x?: string; y?: string; d?: string }; 212 212 + expect(decryptedRotationJwk.kty).toBe("EC"); 213 213 + expect(decryptedRotationJwk.crv).toBe("P-256"); 214 214 + // The caller's private `d` coordinate must never appear in Contrail's 215 215 + // persistence — the strongest single-bit invariant of self-sovereign mode. 216 216 + expect(decryptedRotationJwk.d).not.toBe(callerRotation.privateJwk.d); 217 217 + // The public x/y must also differ — the persisted rotation key is a 218 218 + // subordinate Contrail-generated key, not a re-derivation of the caller's. 219 219 + expect(decryptedRotationJwk.x).not.toBe(callerRotation.privateJwk.x); 220 220 + expect(decryptedRotationJwk.y).not.toBe(callerRotation.privateJwk.y); 221 221 + 222 222 + // Negative invariant: the caller's public did:key string must NOT appear 223 223 + // inside ANY encrypted column after decryption. Encrypted_signing_key 224 224 + // is a JWK; encrypted_rotation_key is the subordinate JWK; the password 225 225 + // is opaque — none of them should contain the caller's did:key. 226 226 + const decryptedSigningKey = await cipher.decryptString( 227 227 + row!.encryptedSigningKey!, 228 228 + ); 229 229 + const callerDidKey = callerRotation.publicDidKey; 230 230 + expect(decryptedSigningKey.indexOf(callerDidKey)).toBe(-1); 231 231 + expect( 232 232 + await cipher 233 233 + .decryptString(row!.encryptedRotationKey!) 234 234 + .then((s) => s.indexOf(callerDidKey)), 235 235 + ).toBe(-1); 236 236 + expect(decryptedAppPassword.indexOf(callerDidKey)).toBe(-1); 237 237 + 238 238 + // Prove the *minted* app password works against the live PDS. 239 239 + // createPdsSession throws if the PDS rejects. 240 240 + const appSession = await createPdsSession( 241 241 + PDS_URL, 242 242 + handle, 243 243 + decryptedAppPassword, 244 244 + ); 245 245 + expect(appSession.did).toBe(result.did); 246 246 + expect(appSession.accessJwt).toBeTruthy(); 247 247 + 248 248 + // And the user's root password also still works — PDS supports multiple 249 249 + // credentials per account, so the caller's root creds remain valid. 250 250 + const rootSession = await createPdsSession(PDS_URL, handle, password); 251 251 + expect(rootSession.did).toBe(result.did); 252 252 + expect(rootSession.accessJwt).toBeTruthy(); 253 253 + 254 254 + // PLC-log assertion (H2): the post-activation update op must keep the 255 255 + // caller's did:key at rotationKeys[0]. Without this, contrail's 256 256 + // subordinate would silently take rotation priority and the caller 257 257 + // would lose self-sovereign recovery authority. 258 258 + const logRes = await fetch(`${PLC_URL}/${result.did}/log`); 259 259 + expect(logRes.ok).toBe(true); 260 260 + const log = (await logRes.json()) as Array<{ 261 261 + rotationKeys: string[]; 262 262 + }>; 263 263 + expect(log.length).toBeGreaterThanOrEqual(2); 264 264 + const lastOp = log[log.length - 1]!; 265 265 + expect(lastOp.rotationKeys[0]).toBe(callerRotation.publicDidKey); 266 266 + }, 267 267 + 30_000, 268 268 + ); 269 269 + }); 270 270 + 271 271 + /** 272 272 + * Routed end-to-end coverage for the XRPC surface of the provision flow: 273 273 + * `${NS}.community.provision` then `${NS}.community.putRecord` against the 274 274 + * same provisioned community. Differs from the orchestrator-only test above 275 275 + * by exercising the full Hono app — auth middleware, DB persistence, 276 276 + * bootstrapReservedSpaces, and the credential-proxy publish path that 277 277 + * Tasks 13/14 added. 278 278 + * 279 279 + * Also pins the Task 14 session-cache behavior: two sequential putRecords 280 280 + * should perform exactly **one** `com.atproto.server.createSession` call to 281 281 + * the PDS — the second hits the cached session. 282 282 + */ 283 283 + describe("community.provision + putRecord via XRPC route (devnet)", () => { 284 284 + const NS = "rsvp.atmo.community"; 285 285 + const SPACE_TYPE = "rsvp.atmo.event.space"; 286 286 + const POST_NSID = "app.bsky.feed.post"; 287 287 + const TEST_MASTER_KEY = new Uint8Array(32).fill(7); 288 288 + 289 289 + let pool: pg.Pool; 290 290 + let cleanupSchema: () => Promise<void>; 291 291 + let pdsDid: string; 292 292 + let alice: TestAccount; 293 293 + let aliceClient: Client; 294 294 + let handle: (req: Request) => Promise<Response>; 295 295 + let callAs: CallAs; 296 296 + 297 297 + // Counts createSession calls to the live PDS so we can assert that the 298 298 + // session cache is reused across publishes (Task 14). 299 299 + let createSessionCount = 0; 300 300 + 301 301 + beforeAll(async () => { 302 302 + // Discover the live PDS's DID — needed as `aud` in the orchestrator's 303 303 + // service-auth JWT for createAccount. 304 304 + const res = await fetch(`${PDS_URL}/xrpc/com.atproto.server.describeServer`); 305 305 + if (!res.ok) { 306 306 + throw new Error( 307 307 + `devnet PDS unreachable at ${PDS_URL}: ${res.status} ${await res.text()}`, 308 308 + ); 309 309 + } 310 310 + pdsDid = ((await res.json()) as { did?: string }).did!; 311 311 + 312 312 + const iso = await createIsolatedSchema("test_provision_router_e2e"); 313 313 + pool = iso.pool; 314 314 + cleanupSchema = iso.cleanup; 315 315 + const db = createPostgresDatabase(pool); 316 316 + 317 317 + // Wrap fetch to count createSession calls. Everything else passes 318 318 + // through unchanged so the orchestrator + publish paths hit real devnet. 319 319 + const countingFetch: typeof fetch = (input, init) => { 320 320 + const url = typeof input === "string" ? input : input.toString(); 321 321 + if (url.includes("/xrpc/com.atproto.server.createSession")) { 322 322 + createSessionCount++; 323 323 + } 324 324 + return fetch(input as any, init); 325 325 + }; 326 326 + 327 327 + const contrail = new Contrail({ 328 328 + ...{ 329 329 + namespace: "rsvp.atmo", 330 330 + collections: { 331 331 + // Minimal collection set — we only need community routes registered; 332 332 + // no Jetstream ingestion is required for this test. 333 333 + post: { collection: POST_NSID }, 334 334 + }, 335 335 + }, 336 336 + db, 337 337 + spaces: { 338 338 + type: SPACE_TYPE, 339 339 + serviceDid: CONTRAIL_SERVICE_DID, 340 340 + resolver: createDevnetResolver(), 341 341 + }, 342 342 + community: { 343 343 + // The orchestrator uses cfg.serviceDid as the `aud` of the 344 344 + // createAccount service-auth JWT. The live devnet PDS validates 345 345 + // `aud` against its own DID, so this must be the PDS's DID — not 346 346 + // the Contrail service DID used for inbound JWT verification. 347 347 + serviceDid: pdsDid, 348 348 + masterKey: TEST_MASTER_KEY, 349 349 + plcDirectory: PLC_URL, 350 350 + resolver: createDevnetResolver(), 351 351 + fetch: countingFetch, 352 352 + allowProvisioning: true, 353 353 + }, 354 354 + }); 355 355 + await contrail.init(); 356 356 + handle = createHandler(contrail); 357 357 + callAs = createCaller(handle); 358 358 + 359 359 + // Alice acts as the provisioning caller — she becomes owner of the new 360 360 + // community's $admin and $publishers spaces, which lets her publish. 361 361 + alice = await createTestAccount(); 362 362 + aliceClient = await login(alice); 363 363 + }, 30_000); 364 364 + 365 365 + afterAll(async () => { 366 366 + await cleanupSchema?.(); 367 367 + }); 368 368 + 369 369 + it( 370 370 + "provisions via the XRPC route and publishes a record (one cached session across two putRecords)", 371 371 + async () => { 372 372 + // Mint an invite code via the PDS admin API — same pattern as the 373 373 + // orchestrator-only test above. 374 374 + const inviteRes = await fetch( 375 375 + `${PDS_URL}/xrpc/com.atproto.server.createInviteCode`, 376 376 + { 377 377 + method: "POST", 378 378 + headers: { 379 379 + "content-type": "application/json", 380 380 + authorization: `Basic ${Buffer.from( 381 381 + `admin:${PDS_ADMIN_PASSWORD}`, 382 382 + ).toString("base64")}`, 383 383 + }, 384 384 + body: JSON.stringify({ useCount: 1 }), 385 385 + }, 386 386 + ); 387 387 + if (!inviteRes.ok) { 388 388 + throw new Error( 389 389 + `createInviteCode failed (${inviteRes.status}): ${await inviteRes.text()}`, 390 390 + ); 391 391 + } 392 392 + const { code: inviteCode } = (await inviteRes.json()) as { code: string }; 393 393 + 394 394 + // Keep total label under PDS's 18-char limit: `r-` (2) + 8-char suffix 395 395 + // = 10 chars, well under the cap. 396 396 + const suffix = `${Date.now().toString(36).slice(-6)}${Math.random() 397 397 + .toString(36) 398 398 + .slice(2, 4)}`; 399 399 + const newHandle = `r-${suffix}${HANDLE_DOMAIN}`; 400 400 + const email = `${suffix}@devnet.test`; 401 401 + const password = `pw-${suffix}`; 402 402 + 403 403 + const callerRotation = await generateKeyPair(); 404 404 + 405 405 + const baselineCreateSessionCount = createSessionCount; 406 406 + 407 407 + // ---- POST /xrpc/${NS}.provision ----------------------------------- 408 408 + const provRes = await callAs(aliceClient, "POST", `${NS}.provision`, { 409 409 + body: { 410 410 + handle: newHandle, 411 411 + email, 412 412 + password, 413 413 + inviteCode, 414 414 + pdsEndpoint: PDS_URL, 415 415 + rotationKey: callerRotation.publicDidKey, 416 416 + }, 417 417 + }); 418 418 + const provText = await provRes.clone().text(); 419 419 + expect(provRes.status, provText).toBe(200); 420 420 + const provBody = (await provRes.json()) as { 421 421 + communityDid: string; 422 422 + status: string; 423 423 + }; 424 424 + expect(provBody.status).toBe("activated"); 425 425 + expect(provBody.communityDid).toMatch(/^did:plc:[a-z2-7]{24}$/); 426 426 + const communityDid = provBody.communityDid; 427 427 + 428 428 + // The orchestrator never calls createSession during provision — it 429 429 + // gets accessJwt + refreshJwt directly from the createAccount response 430 430 + // and seeds the community_sessions cache before returning, so the first 431 431 + // publish hits a warm cache. 432 432 + const provisionCreateSessionCount = 433 433 + createSessionCount - baselineCreateSessionCount; 434 434 + expect(provisionCreateSessionCount).toBe(0); 435 435 + 436 436 + // ---- First putRecord: cache miss → createSession ------------------ 437 437 + const firstRecord = { 438 438 + $type: POST_NSID, 439 439 + text: `routed-e2e first ${suffix}`, 440 440 + createdAt: new Date().toISOString(), 441 441 + }; 442 442 + const put1 = await callAs(aliceClient, "POST", `${NS}.putRecord`, { 443 443 + body: { 444 444 + communityDid, 445 445 + collection: POST_NSID, 446 446 + record: firstRecord, 447 447 + }, 448 448 + }); 449 449 + const put1Text = await put1.clone().text(); 450 450 + expect(put1.status, put1Text).toBe(200); 451 451 + const put1Body = (await put1.json()) as { uri: string; cid: string }; 452 452 + expect(put1Body.uri).toMatch( 453 453 + new RegExp(`^at://${communityDid}/${POST_NSID}/`), 454 454 + ); 455 455 + expect(put1Body.cid).toBeTruthy(); 456 456 + 457 457 + // ---- Second putRecord: cache hit → no createSession --------------- 458 458 + const secondRecord = { 459 459 + $type: POST_NSID, 460 460 + text: `routed-e2e second ${suffix}`, 461 461 + createdAt: new Date().toISOString(), 462 462 + }; 463 463 + const put2 = await callAs(aliceClient, "POST", `${NS}.putRecord`, { 464 464 + body: { 465 465 + communityDid, 466 466 + collection: POST_NSID, 467 467 + record: secondRecord, 468 468 + }, 469 469 + }); 470 470 + const put2Text = await put2.clone().text(); 471 471 + expect(put2.status, put2Text).toBe(200); 472 472 + const put2Body = (await put2.json()) as { uri: string; cid: string }; 473 473 + expect(put2Body.uri).toMatch( 474 474 + new RegExp(`^at://${communityDid}/${POST_NSID}/`), 475 475 + ); 476 476 + 477 477 + // Zero createSession across the whole flow: provision pre-warms the 478 478 + // cache, then both publishes hit the 30s-skew cache. 479 479 + const publishesCreateSessionCount = 480 480 + createSessionCount - baselineCreateSessionCount; 481 481 + expect(publishesCreateSessionCount).toBe(0); 482 482 + }, 483 483 + 60_000, 484 484 + ); 485 485 + 486 486 + // TODO: cover stale-session auto-recovery (provision Task 14, ensureSession 487 487 + // refresh path). Hard to exercise deterministically against live devnet 488 488 + // without aging out a real `accessExp` past the 30s skew; covered by unit 489 489 + // tests in packages/contrail/tests/community-publishing.test.ts. 490 490 + });

+178

apps/contrail-e2e/tests/reap-tombstone.test.ts

Reviewed

··· 1 1 + /** 2 2 + * Devnet e2e for the tombstone CID derivation used by `contrail reap` (M6). 3 3 + * 4 4 + * `cli/commands/reap.ts:146` calls `cidForOp(signed as never)` because the 5 5 + * helper's declared signed-op union covers genesis/update — not tombstone. 6 6 + * The DAG-CBOR encoder accepts the smaller tombstone shape, but no other 7 7 + * test submits a *real* tombstone to live PLC and verifies the CID we 8 8 + * computed locally matches the one PLC returns from `log/last`. This test 9 9 + * closes that gap. 10 10 + * 11 11 + * The test uses managed-mode provisioning to land a real DID on devnet PLC 12 12 + * with the rotation key encrypted on the persisted row, then drives the 13 13 + * tombstone flow (build → sign → cidForOp → submit) with the same helpers 14 14 + * runReap uses, and asserts the post-submit `log/last` matches. 15 15 + * 16 16 + * Tombstones are irrevocable on PLC. This test always operates on a freshly- 17 17 + * provisioned devnet DID never seen by any other test or user. 18 18 + * 19 19 + * Prereqs: `pnpm stack:up` (devnet PDS+PLC + postgres reachable). 20 20 + */ 21 21 + import { describe, it, expect, beforeAll, afterAll } from "vitest"; 22 22 + import { randomUUID } from "node:crypto"; 23 23 + import pg from "pg"; 24 24 + import { 25 25 + CommunityAdapter, 26 26 + CredentialCipher, 27 27 + ProvisionOrchestrator, 28 28 + generateKeyPair, 29 29 + initCommunitySchema, 30 30 + pdsCreateAccount, 31 31 + pdsGetRecommendedDidCredentials, 32 32 + pdsActivateAccount, 33 33 + pdsCreateAppPassword, 34 34 + submitGenesisOp, 35 35 + getLastOpCid, 36 36 + buildTombstoneOp, 37 37 + signTombstoneOp, 38 38 + submitTombstoneOp, 39 39 + cidForOp, 40 40 + type PdsClient, 41 41 + type PlcClient, 42 42 + } from "@atmo-dev/contrail"; 43 43 + import { createPostgresDatabase } from "@atmo-dev/contrail/postgres"; 44 44 + import { 45 45 + PDS_URL, 46 46 + PLC_URL, 47 47 + HANDLE_DOMAIN, 48 48 + PDS_ADMIN_PASSWORD, 49 49 + createIsolatedSchema, 50 50 + } from "./helpers"; 51 51 + 52 52 + describe("reap tombstone CID matches live PLC log/last (M6)", () => { 53 53 + let pool: pg.Pool; 54 54 + let cleanupSchema: () => Promise<void>; 55 55 + let adapter: CommunityAdapter; 56 56 + let cipher: CredentialCipher; 57 57 + let pdsDid: string; 58 58 + 59 59 + beforeAll(async () => { 60 60 + const res = await fetch(`${PDS_URL}/xrpc/com.atproto.server.describeServer`); 61 61 + if (!res.ok) { 62 62 + throw new Error( 63 63 + `devnet PDS unreachable at ${PDS_URL}: ${res.status} ${await res.text()}`, 64 64 + ); 65 65 + } 66 66 + pdsDid = ((await res.json()) as { did: string }).did; 67 67 + 68 68 + const iso = await createIsolatedSchema("test_reap_tombstone_e2e"); 69 69 + pool = iso.pool; 70 70 + cleanupSchema = iso.cleanup; 71 71 + const db = createPostgresDatabase(pool); 72 72 + await initCommunitySchema(db); 73 73 + adapter = new CommunityAdapter(db); 74 74 + cipher = new CredentialCipher(new Uint8Array(32).fill(7)); 75 75 + }, 15_000); 76 76 + 77 77 + afterAll(async () => { 78 78 + await cleanupSchema?.(); 79 79 + }); 80 80 + 81 81 + const pdsClient: PdsClient = { 82 82 + createAccount: ({ pdsUrl, serviceAuthJwt, body }) => 83 83 + pdsCreateAccount(pdsUrl, serviceAuthJwt, body), 84 84 + getRecommendedDidCredentials: ({ pdsUrl, accessJwt }) => 85 85 + pdsGetRecommendedDidCredentials(pdsUrl, accessJwt), 86 86 + activateAccount: ({ pdsUrl, accessJwt }) => pdsActivateAccount(pdsUrl, accessJwt), 87 87 + createAppPassword: ({ pdsUrl, accessJwt, name }) => 88 88 + pdsCreateAppPassword(pdsUrl, accessJwt, name), 89 89 + }; 90 90 + 91 91 + const plcClient: PlcClient = { 92 92 + submit: (did, op) => submitGenesisOp(PLC_URL, did, op as any), 93 93 + }; 94 94 + 95 95 + async function mintInvite(): Promise<string> { 96 96 + const inviteRes = await fetch( 97 97 + `${PDS_URL}/xrpc/com.atproto.server.createInviteCode`, 98 98 + { 99 99 + method: "POST", 100 100 + headers: { 101 101 + "content-type": "application/json", 102 102 + authorization: `Basic ${Buffer.from( 103 103 + `admin:${PDS_ADMIN_PASSWORD}`, 104 104 + ).toString("base64")}`, 105 105 + }, 106 106 + body: JSON.stringify({ useCount: 1 }), 107 107 + }, 108 108 + ); 109 109 + if (!inviteRes.ok) { 110 110 + throw new Error( 111 111 + `createInviteCode failed (${inviteRes.status}): ${await inviteRes.text()}`, 112 112 + ); 113 113 + } 114 114 + return ((await inviteRes.json()) as { code: string }).code; 115 115 + } 116 116 + 117 117 + it( 118 118 + "tombstone op submitted to PLC has the CID we computed locally via cidForOp", 119 119 + async () => { 120 120 + // Provision a fresh community to land a real DID on devnet PLC. 121 121 + const inviteCode = await mintInvite(); 122 122 + const suffix = `${Date.now().toString(36)}${Math.random() 123 123 + .toString(36) 124 124 + .slice(2, 6)}`; 125 125 + const handle = `tomb-${suffix}${HANDLE_DOMAIN}`; 126 126 + const email = `${suffix}@devnet.test`; 127 127 + const password = `pw-${suffix}`; 128 128 + const attemptId = randomUUID(); 129 129 + 130 130 + const callerRotation = await generateKeyPair(); 131 131 + 132 132 + const orch = new ProvisionOrchestrator({ 133 133 + adapter, 134 134 + cipher, 135 135 + plc: plcClient, 136 136 + pds: pdsClient, 137 137 + pdsDid, 138 138 + }); 139 139 + const result = await orch.provision({ 140 140 + attemptId, 141 141 + pdsEndpoint: PDS_URL, 142 142 + handle, 143 143 + email, 144 144 + password, 145 145 + inviteCode, 146 146 + rotationKey: callerRotation.publicDidKey, 147 147 + }); 148 148 + expect(result.status).toBe("activated"); 149 149 + const did = result.did; 150 150 + 151 151 + // Pull the encrypted rotation key off the persisted row — same path 152 152 + // runReap takes. 153 153 + const row = await adapter.getProvisionAttempt(attemptId); 154 154 + expect(row).not.toBeNull(); 155 155 + expect(row!.encryptedRotationKey).toBeTruthy(); 156 156 + const rotationJwk = JSON.parse( 157 157 + await cipher.decryptString(row!.encryptedRotationKey!), 158 158 + ) as { kty: string; crv: string; x: string; y: string; d: string }; 159 159 + 160 160 + // Drive the tombstone path the same way reap.ts does, but inline so 161 161 + // the test pins the cidForOp CID independent of runReap's archival 162 162 + // bookkeeping. 163 163 + const prev = await getLastOpCid(PLC_URL, did); 164 164 + const unsigned = buildTombstoneOp(prev); 165 165 + const signed = await signTombstoneOp(unsigned, rotationJwk); 166 166 + const expectedCid = await cidForOp(signed as never); 167 167 + 168 168 + await submitTombstoneOp(PLC_URL, did, signed); 169 169 + 170 170 + // PLC's log/last for the DID must now report the same CID we computed. 171 171 + // If cidForOp's tombstone encoding ever drifts from PLC's, this is the 172 172 + // failure mode that catches it. 173 173 + const lastCid = await getLastOpCid(PLC_URL, did); 174 174 + expect(lastCid).toBe(expectedCid); 175 175 + }, 176 176 + 45_000, 177 177 + ); 178 178 + });

+21 -4

docs/07-communities.md

Reviewed

··· 56 56 57 57 When you want atproto records published under a *shared* identity — a team, a project, a channel — not a single user. Think: a group's published calendar events, a community's published posts. 58 58 59 59 - ## Two modes 59 59 + ## Three modes 60 60 61 61 - **Minted** — contrail creates a fresh `did:plc` for the community, holds the signing key plus one rotation key (a second rotation key is returned to the creator once for recovery), and publishes from it. 62 62 - **Adopted** — contrail takes over an existing account by holding an **app password** issued from its PDS. The owner's identity, signing key, and rotation keys are unchanged; contrail just gets PDS write access via the app password. 63 63 + - **Provisioned** — contrail creates a fresh `did:plc` and a new PDS account. The caller supplies the rotation key; that key is set as the DID's rotation key in PLC. Contrail receives an app password from the new account and publishes through it. 64 64 + 65 65 + Whichever the mode, the result is the same shape: a DID that multiple members can act through, gated by access levels. 66 66 + 67 67 + ## Choosing a mode 63 68 64 64 - Either way, the result is the same: a DID that multiple members can act through, gated by access levels. 69 69 + Two questions typically determine the mode: 70 70 + 71 71 + 1. **Does the community already have a DID?** Yes → **adopt**. No → continue. 72 72 + 2. **How should records be published?** Contrail signs them directly → **mint**. Contrail uses an app password against a PDS account → **provision**. 73 73 + 74 74 + The rotation key holder follows from the choice: contrail in mint mode, caller in adopt and provision modes. 65 75 66 76 ## Access levels 67 77 ··· 84 94 85 95 ## XRPCs 86 96 87 87 - - `<ns>.community.mint | adopt | list | delete` 97 97 + - `<ns>.community.mint | adopt | provision | list | delete` 88 98 - `<ns>.community.invite.create | redeem | revoke | list` 89 99 - `<ns>.community.setAccessLevel | revoke | listMembers` 90 100 - `<ns>.community.space.create | grant | revoke | ...` — community-owned spaces 91 101 - `<ns>.community.putRecord | deleteRecord` — publish records as the community DID 92 102 103 103 + The `contrail-community reap` CLI tombstones provisioned DIDs in PLC when provisioning fails partway and orphan rows accumulate. It ships as a bin in the `@atmo-dev/contrail-community` package (`npx contrail-community reap`); under pnpm's isolated `node_modules` the core `contrail` CLI cannot resolve the community package, so `contrail reap` only works in hoisted installs where both packages sit together. 104 104 + 105 105 + - Default is dry-run; pass `--no-dry-run` to actually submit (irrevocable) tombstones. 106 106 + - `--all-stuck` only reaps rows idle at least `--older-than <minutes>` (default 30), so a bulk run can't tombstone an in-flight provision that is mid-state-machine. `--attempt-id <uuid>` targets a single known row and ignores the age floor. 107 107 + - **D1 and Postgres:** by default reap acquires the Cloudflare D1 binding via `wrangler getPlatformProxy()`. For the decoupled external (Postgres) index, pass `--db <connection-string>` or set `DATABASE_URL` and reap runs against Postgres instead (`--db` wins over the env var). The orchestrator and adapter SQL are dialect-agnostic, so both paths share the same reap logic. 108 108 + 93 109 ## What's not here 94 110 95 111 - No per-record per-level ACLs. Model as spaces. 96 112 - No auto-rotation on key compromise yet. 97 97 - - Adoption can be revoked unilaterally by the owner — they revoke the app password on their PDS and contrail loses write access. (Mint mode is the irreversible one: the creator's recovery rotation key, returned once at mint time, is the only path back if contrail's signing/rotation key is compromised.) 113 113 + - Adopted and provisioned modes: contrail's write access depends on an app password issued from the PDS, which the rotation-key holder can revoke at any time. 114 114 + - Minted mode: contrail holds the signing key and one rotation key. The creator's recovery rotation key, returned once at mint time, is the only key not held by contrail. 98 115 99 116 The design follows zicklag's [Arbiter design sketch](https://zicklag.leaflet.pub/3mjrvb5pul224) for group management on atproto. The post is an early design note; our implementation will track it as the spec firms up.

+19

packages/contrail-community/package.json

Reviewed

··· 16 16 "import": "./dist/index.js" 17 17 } 18 18 }, 19 19 + "bin": { 20 20 + "contrail-community": "./dist/cli/index.js" 21 21 + }, 19 22 "repository": { 20 23 "type": "git", 21 24 "url": "https://github.com/flo-bit/contrail.git", ··· 42 45 "@atcute/xrpc-server": "^0.1.12", 43 46 "@atmo-dev/contrail": "workspace:*", 44 47 "@atmo-dev/contrail-base": "workspace:*", 48 48 + "cac": "^7.0.0", 45 49 "hono": "^4.12.8" 46 50 }, 51 51 + "peerDependencies": { 52 52 + "pg": "^8.0.0", 53 53 + "wrangler": "^4.0.0" 54 54 + }, 55 55 + "peerDependenciesMeta": { 56 56 + "pg": { 57 57 + "optional": true 58 58 + }, 59 59 + "wrangler": { 60 60 + "optional": true 61 61 + } 62 62 + }, 47 63 "devDependencies": { 64 64 + "@types/node": "^25.5.0", 65 65 + "@types/pg": "^8.20.0", 66 66 + "pg": "^8.20.0", 48 67 "tsup": "^8.5.0", 49 68 "typescript": "^5.7.3", 50 69 "vitest": "^4.1.0"

+254

packages/contrail-community/src/adapter.ts

Reviewed

··· 6 6 CommunityMode, 7 7 CommunityRow, 8 8 CreateCommunityInviteInput, 9 9 + CreateProvisionAttemptInput, 10 10 + ProvisionAttemptRow, 11 11 + ProvisionStatus, 9 12 } from "./types"; 10 13 11 14 function toNum(v: unknown): number { ··· 51 54 createdBy: string; 52 55 } 53 56 57 57 + export interface CreateProvisionedCommunityInput { 58 58 + did: string; 59 59 + pdsEndpoint: string; 60 60 + handle: string; 61 61 + /** Encrypted PDS app password — already-encrypted base64 envelope. The 62 62 + * orchestrator persisted this on the provision_attempts row after a 63 63 + * post-activation `createAppPassword` call; the route handler hands it 64 64 + * through so we keep one source of truth for the credential and avoid 65 65 + * round-tripping the plaintext password through the adapter. */ 66 66 + appPasswordEncrypted: string; 67 67 + createdBy: string; 68 68 + } 69 69 + 54 70 export interface GrantInput { 55 71 spaceUri: string; 56 72 subjectDid?: string; ··· 85 101 mode: "adopt", 86 102 pdsEndpoint: input.pdsEndpoint, 87 103 identifier: input.identifier, 104 104 + createdBy: input.createdBy, 105 105 + createdAt: now, 106 106 + deletedAt: null, 107 107 + }; 108 108 + } 109 109 + 110 110 + async createFromProvisioned( 111 111 + input: CreateProvisionedCommunityInput 112 112 + ): Promise<CommunityRow> { 113 113 + const now = Date.now(); 114 114 + await this.db 115 115 + .prepare( 116 116 + `INSERT INTO communities (did, mode, pds_endpoint, app_password_encrypted, identifier, created_by, created_at) 117 117 + VALUES (?, 'provision', ?, ?, ?, ?, ?)` 118 118 + ) 119 119 + .bind( 120 120 + input.did, 121 121 + input.pdsEndpoint, 122 122 + input.appPasswordEncrypted, 123 123 + input.handle, 124 124 + input.createdBy, 125 125 + now 126 126 + ) 127 127 + .run(); 128 128 + return { 129 129 + did: input.did, 130 130 + mode: "provision", 131 131 + pdsEndpoint: input.pdsEndpoint, 132 132 + identifier: input.handle, 88 133 createdBy: input.createdBy, 89 134 createdAt: now, 90 135 deletedAt: null, ··· 384 429 .first<any>(); 385 430 return row ? mapCommunityInviteRow(row) : null; 386 431 } 432 432 + 433 433 + // ---- Provision attempts ------------------------------------------------ 434 434 + 435 435 + async createProvisionAttempt(input: CreateProvisionAttemptInput): Promise<void> { 436 436 + const now = Date.now(); 437 437 + await this.db 438 438 + .prepare( 439 439 + `INSERT INTO provision_attempts ( 440 440 + attempt_id, did, status, pds_endpoint, handle, email, invite_code, 441 441 + encrypted_signing_key, encrypted_rotation_key, 442 442 + created_at, updated_at 443 443 + ) VALUES (?, ?, 'keys_generated', ?, ?, ?, ?, ?, ?, ?, ?)` 444 444 + ) 445 445 + .bind( 446 446 + input.attemptId, 447 447 + input.did, 448 448 + input.pdsEndpoint, 449 449 + input.handle, 450 450 + input.email, 451 451 + input.inviteCode ?? null, 452 452 + input.encryptedSigningKey, 453 453 + input.encryptedRotationKey, 454 454 + now, 455 455 + now 456 456 + ) 457 457 + .run(); 458 458 + } 459 459 + 460 460 + async getProvisionAttempt(attemptId: string): Promise<ProvisionAttemptRow | null> { 461 461 + const row = await this.db 462 462 + .prepare(`SELECT * FROM provision_attempts WHERE attempt_id = ?`) 463 463 + .bind(attemptId) 464 464 + .first<Record<string, any>>(); 465 465 + return row ? rowToProvisionAttempt(row) : null; 466 466 + } 467 467 + 468 468 + async updateProvisionStatus( 469 469 + attemptId: string, 470 470 + status: ProvisionStatus, 471 471 + opts: { lastError?: string; encryptedPassword?: string } = {} 472 472 + ): Promise<void> { 473 473 + const now = Date.now(); 474 474 + const stampCol = ({ 475 475 + genesis_submitted: "genesis_submitted_at", 476 476 + account_created: "account_created_at", 477 477 + did_doc_updated: "did_doc_updated_at", 478 478 + activated: "activated_at", 479 479 + } as Record<string, string | undefined>)[status]; 480 480 + 481 481 + const sets: string[] = [`status = ?`, `updated_at = ?`]; 482 482 + const args: any[] = [status, now]; 483 483 + if (stampCol) { 484 484 + sets.push(`${stampCol} = ?`); 485 485 + args.push(now); 486 486 + } 487 487 + if (opts.lastError !== undefined) { 488 488 + sets.push(`last_error = ?`); 489 489 + args.push(opts.lastError); 490 490 + } 491 491 + if (opts.encryptedPassword !== undefined) { 492 492 + sets.push(`encrypted_password = ?`); 493 493 + args.push(opts.encryptedPassword); 494 494 + } 495 495 + args.push(attemptId); 496 496 + 497 497 + await this.db 498 498 + .prepare(`UPDATE provision_attempts SET ${sets.join(", ")} WHERE attempt_id = ?`) 499 499 + .bind(...args) 500 500 + .run(); 501 501 + } 502 502 + 503 503 + /** List provision attempts that did NOT reach `activated` AND have been 504 504 + * idle for at least `olderThanMs` (no update within that window). These are 505 505 + * the rows reap can act on: a non-terminal status means the flow stopped 506 506 + * partway, leaving (typically) a dangling DID in PLC that needs 507 507 + * tombstoning. The age floor is mandatory and exists so a bulk reap can 508 508 + * never select an in-flight attempt that is mid-state-machine (seconds old) 509 509 + * and tombstone a DID that was about to activate. Pass `0` to disable the 510 510 + * floor (e.g. a test, or an operator who has confirmed nothing is running). */ 511 511 + async listStuckAttempts(olderThanMs: number): Promise<ProvisionAttemptRow[]> { 512 512 + const cutoff = Date.now() - olderThanMs; 513 513 + const rows = await this.db 514 514 + .prepare( 515 515 + `SELECT * FROM provision_attempts 516 516 + WHERE status != 'activated' AND updated_at <= ? 517 517 + ORDER BY updated_at ASC` 518 518 + ) 519 519 + .bind(cutoff) 520 520 + .all<Record<string, any>>(); 521 521 + return rows.results.map(rowToProvisionAttempt); 522 522 + } 523 523 + 524 524 + /** Move a stuck provision_attempts row into the archive table after reap 525 525 + * has tombstoned its DID in PLC. Insert + delete run as a single 526 526 + * `db.batch()`, which is atomic on Postgres (BEGIN/COMMIT) and D1; on the 527 527 + * plain sqlite adapter it is not, so the archive INSERT is also idempotent 528 528 + * (`ON CONFLICT (attempt_id) DO NOTHING`). Together that makes a 529 529 + * retry-after-partial-failure safe: if a prior run's INSERT landed but its 530 530 + * DELETE did not, the row is stranded in both tables; re-running archives 531 531 + * cleanly (the INSERT is a no-op, the DELETE removes the live row) instead 532 532 + * of dying on a PRIMARY KEY conflict. */ 533 533 + async archiveStuckAttempt( 534 534 + attemptId: string, 535 535 + opts: { tombstoneOpCid?: string | null; notes?: string | null } = {} 536 536 + ): Promise<void> { 537 537 + const row = await this.db 538 538 + .prepare(`SELECT * FROM provision_attempts WHERE attempt_id = ?`) 539 539 + .bind(attemptId) 540 540 + .first<Record<string, any>>(); 541 541 + if (!row) { 542 542 + throw new Error(`provision_attempt not found: ${attemptId}`); 543 543 + } 544 544 + const now = Date.now(); 545 545 + const insert = this.db 546 546 + .prepare( 547 547 + `INSERT INTO provision_attempts_archive ( 548 548 + attempt_id, did, pds_endpoint, handle, email, invite_code, 549 549 + last_status, last_error, 550 550 + archived_at, tombstone_op_cid, notes 551 551 + ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 552 552 + ON CONFLICT (attempt_id) DO NOTHING` 553 553 + ) 554 554 + .bind( 555 555 + row.attempt_id, 556 556 + row.did, 557 557 + row.pds_endpoint, 558 558 + row.handle, 559 559 + row.email, 560 560 + row.invite_code ?? null, 561 561 + row.status, 562 562 + row.last_error ?? null, 563 563 + now, 564 564 + opts.tombstoneOpCid ?? null, 565 565 + opts.notes ?? null 566 566 + ); 567 567 + const del = this.db 568 568 + .prepare(`DELETE FROM provision_attempts WHERE attempt_id = ?`) 569 569 + .bind(attemptId); 570 570 + await this.db.batch([insert, del]); 571 571 + } 572 572 + 573 573 + // ---- Community sessions cache ----------------------------------------- 574 574 + 575 575 + async getSession(communityDid: string): Promise<{ 576 576 + accessJwt: string; 577 577 + refreshJwt: string; 578 578 + accessExp: number; 579 579 + } | null> { 580 580 + const r = await this.db 581 581 + .prepare( 582 582 + `SELECT access_jwt, refresh_jwt, access_exp FROM community_sessions WHERE community_did = ?` 583 583 + ) 584 584 + .bind(communityDid) 585 585 + .first<{ access_jwt: string; refresh_jwt: string; access_exp: number }>(); 586 586 + if (!r) return null; 587 587 + return { 588 588 + accessJwt: r.access_jwt, 589 589 + refreshJwt: r.refresh_jwt, 590 590 + accessExp: Number(r.access_exp), 591 591 + }; 592 592 + } 593 593 + 594 594 + async upsertSession( 595 595 + communityDid: string, 596 596 + s: { accessJwt: string; refreshJwt: string; accessExp: number } 597 597 + ): Promise<void> { 598 598 + const now = Date.now(); 599 599 + await this.db 600 600 + .prepare( 601 601 + `INSERT INTO community_sessions (community_did, access_jwt, refresh_jwt, access_exp, updated_at) 602 602 + VALUES (?, ?, ?, ?, ?) 603 603 + ON CONFLICT (community_did) DO UPDATE SET 604 604 + access_jwt = excluded.access_jwt, 605 605 + refresh_jwt = excluded.refresh_jwt, 606 606 + access_exp = excluded.access_exp, 607 607 + updated_at = excluded.updated_at` 608 608 + ) 609 609 + .bind(communityDid, s.accessJwt, s.refreshJwt, s.accessExp, now) 610 610 + .run(); 611 611 + } 612 612 + 613 613 + async clearSession(communityDid: string): Promise<void> { 614 614 + await this.db 615 615 + .prepare(`DELETE FROM community_sessions WHERE community_did = ?`) 616 616 + .bind(communityDid) 617 617 + .run(); 618 618 + } 619 619 + } 620 620 + 621 621 + function rowToProvisionAttempt(r: Record<string, any>): ProvisionAttemptRow { 622 622 + return { 623 623 + attemptId: r.attempt_id, 624 624 + did: r.did, 625 625 + status: r.status as ProvisionStatus, 626 626 + pdsEndpoint: r.pds_endpoint, 627 627 + handle: r.handle, 628 628 + email: r.email, 629 629 + inviteCode: r.invite_code ?? null, 630 630 + encryptedSigningKey: r.encrypted_signing_key ?? null, 631 631 + encryptedRotationKey: r.encrypted_rotation_key ?? null, 632 632 + encryptedPassword: r.encrypted_password ?? null, 633 633 + genesisSubmittedAt: r.genesis_submitted_at == null ? null : Number(r.genesis_submitted_at), 634 634 + accountCreatedAt: r.account_created_at == null ? null : Number(r.account_created_at), 635 635 + didDocUpdatedAt: r.did_doc_updated_at == null ? null : Number(r.did_doc_updated_at), 636 636 + activatedAt: r.activated_at == null ? null : Number(r.activated_at), 637 637 + lastError: r.last_error ?? null, 638 638 + createdAt: Number(r.created_at), 639 639 + updatedAt: Number(r.updated_at), 640 640 + }; 387 641 } 388 642 389 643 function mapCommunityInviteRow(row: any): CommunityInviteRow {

+49

packages/contrail-community/src/cli/index.ts

Reviewed

··· 1 1 + #!/usr/bin/env node 2 2 + /** 3 3 + * contrail-community — CLI entrypoint. 4 4 + * 5 5 + * Exposes `reap` (tombstone stuck provision_attempts in PLC). This lives here, 6 6 + * as contrail-community's own bin, rather than only as a dynamically-imported 7 7 + * subcommand of `contrail`: the PR #30 package split removed contrail's 8 8 + * dependency edge into community code, so under pnpm's isolated node_modules 9 9 + * `contrail` cannot resolve `@atmo-dev/contrail-community` and the dynamic 10 10 + * import there silently no-ops. Shipping the bin here guarantees `reap` is 11 11 + * always reachable wherever contrail-community is installed. 12 12 + * 13 13 + * Config loading is reconstructed from contrail's public `./cli-config` 14 14 + * helpers so contrail-community needs no copy of contrail's CLI plumbing and 15 15 + * no new dependency edge (it already depends on `@atmo-dev/contrail`). 16 16 + */ 17 17 + import { cac } from "cac"; 18 18 + import { 19 19 + findConfigFile, 20 20 + loadConfig, 21 21 + CONFIG_CANDIDATES_MESSAGE, 22 22 + } from "@atmo-dev/contrail/cli-config"; 23 23 + import { registerReap } from "./reap.js"; 24 24 + 25 25 + const cli = cac("contrail-community"); 26 26 + 27 27 + registerReap(cli, { 28 28 + resolveAndLoadConfig: async (opts) => { 29 29 + const root = opts.root ?? process.cwd(); 30 30 + const path = findConfigFile(root, opts.config); 31 31 + if (!path) { 32 32 + console.error( 33 33 + "Could not find a Contrail config. Pass --config <path> or place one at\n" + 34 34 + ` ${CONFIG_CANDIDATES_MESSAGE}` 35 35 + ); 36 36 + process.exit(1); 37 37 + } 38 38 + return loadConfig(path); 39 39 + }, 40 40 + }); 41 41 + 42 42 + cli.help(); 43 43 + 44 44 + try { 45 45 + cli.parse(); 46 46 + } catch (err) { 47 47 + console.error(err); 48 48 + process.exit(1); 49 49 + }

+397

packages/contrail-community/src/cli/reap.ts

Reviewed

··· 1 1 + import type { CAC } from "cac"; 2 2 + import { createInterface } from "node:readline/promises"; 3 3 + import { stdin as input, stdout as output } from "node:process"; 4 4 + import type { Database } from "@atmo-dev/contrail-base"; 5 5 + import { CommunityAdapter } from "../adapter.js"; 6 6 + import { CredentialCipher } from "../credentials.js"; 7 7 + import { 8 8 + buildTombstoneOp, 9 9 + cidForOp, 10 10 + getLastOpCid, 11 11 + signTombstoneOp, 12 12 + submitTombstoneOp, 13 13 + } from "../plc.js"; 14 14 + 15 15 + interface ReapOpts { 16 16 + config?: string; 17 17 + root?: string; 18 18 + remote?: boolean; 19 19 + binding: string; 20 20 + attemptId?: string; 21 21 + allStuck?: boolean; 22 22 + dryRun?: boolean; 23 23 + yes?: boolean; 24 24 + olderThan?: number; 25 25 + db?: string; 26 26 + } 27 27 + 28 28 + /** Minimal logger interface so `runReap` can be invoked from tests with 29 29 + * silent stubs and from the CLI shim with `console`. */ 30 30 + export interface ReapLogger { 31 31 + log(...args: unknown[]): void; 32 32 + error(...args: unknown[]): void; 33 33 + } 34 34 + 35 35 + /** Default idle window for `--all-stuck`: a row must have gone untouched this 36 36 + * long before bulk reap will consider tombstoning it. Provisioning is a 37 37 + * fast (seconds) state machine, so 30 minutes is a wide safety margin that 38 38 + * still reaps genuinely-abandoned rows. Operators can override via 39 39 + * `--older-than <minutes>`. */ 40 40 + export const DEFAULT_REAP_AGE_FLOOR_MS = 30 * 60 * 1000; 41 41 + 42 42 + /** Where reap should read its provision_attempts rows from. Postgres (the 43 43 + * decoupled external index) is selected by an explicit `--db <url>` or, as a 44 44 + * convenience matching the apps/postgres deployment, a `DATABASE_URL` in the 45 45 + * environment. Otherwise reap uses the Cloudflare D1 binding via wrangler. 46 46 + * An explicit `--db` always wins over the env var. */ 47 47 + export type ReapDbSource = 48 48 + | { kind: "postgres"; url: string } 49 49 + | { kind: "d1" }; 50 50 + 51 51 + export function chooseReapDbSource(opts: { 52 52 + db?: string; 53 53 + databaseUrl?: string; 54 54 + }): ReapDbSource { 55 55 + const url = opts.db ?? opts.databaseUrl; 56 56 + return url ? { kind: "postgres", url } : { kind: "d1" }; 57 57 + } 58 58 + 59 59 + export interface RunReapOptions { 60 60 + adapter: CommunityAdapter; 61 61 + cipher: CredentialCipher; 62 62 + plcDirectory: string; 63 63 + fetch?: typeof fetch; 64 64 + logger: ReapLogger; 65 65 + /** Skip confirmation prompts. The CLI passes this when the user supplied 66 66 + * --yes; tests always pass true since they don't have a TTY. */ 67 67 + yes: boolean; 68 68 + attemptId?: string; 69 69 + allStuck?: boolean; 70 70 + dryRun?: boolean; 71 71 + /** Idle-age floor for `--all-stuck` (milliseconds). Rows updated more 72 72 + * recently than this are left alone so a bulk reap can't tombstone an 73 73 + * in-flight provision. Ignored for the single `--attempt-id` path, which 74 74 + * is an explicit operator action on a known row. Defaults to 75 75 + * DEFAULT_REAP_AGE_FLOOR_MS. */ 76 76 + olderThanMs?: number; 77 77 + } 78 78 + 79 79 + export interface RunReapResult { 80 80 + ok: boolean; 81 81 + /** Validation/precondition error, present when ok=false. */ 82 82 + error?: string; 83 83 + /** Number of rows successfully reaped (PLC tombstone submitted + archived). */ 84 84 + reaped: number; 85 85 + /** Number of rows skipped because of --dry-run. */ 86 86 + dryRunSkipped: number; 87 87 + /** Number of rows that errored out during reap (activated row, PLC error, etc.). */ 88 88 + errors: number; 89 89 + } 90 90 + 91 91 + /** Yes/no prompt that respects --yes (auto-accept) and falls back to the 92 92 + * provided default in non-TTY environments — the user isn't there to answer. */ 93 93 + async function promptYesNo( 94 94 + question: string, 95 95 + defaultYes: boolean, 96 96 + autoYes: boolean 97 97 + ): Promise<boolean> { 98 98 + if (autoYes) return true; 99 99 + if (!input.isTTY) return false; 100 100 + const rl = createInterface({ input, output }); 101 101 + try { 102 102 + const hint = defaultYes ? "[Y/n]" : "[y/N]"; 103 103 + const ans = (await rl.question(`${question} ${hint} `)).trim().toLowerCase(); 104 104 + if (ans === "") return defaultYes; 105 105 + return ans === "y" || ans === "yes"; 106 106 + } finally { 107 107 + rl.close(); 108 108 + } 109 109 + } 110 110 + 111 111 + /** Core reap logic, decoupled from the CAC plumbing so tests can drive it 112 112 + * without going through `getPlatformProxy()`. */ 113 113 + export async function runReap(opts: RunReapOptions): Promise<RunReapResult> { 114 114 + const result: RunReapResult = { 115 115 + ok: true, 116 116 + reaped: 0, 117 117 + dryRunSkipped: 0, 118 118 + errors: 0, 119 119 + }; 120 120 + 121 121 + // Safety default: an operator who omits the flag must NOT trigger 122 122 + // irrevocable PLC tombstones. Real action requires an explicit 123 123 + // `dryRun: false` (CLI: `--no-dry-run`). 124 124 + const dryRun = opts.dryRun ?? true; 125 125 + 126 126 + const hasAttemptId = !!opts.attemptId; 127 127 + const hasAllStuck = !!opts.allStuck; 128 128 + if (!hasAttemptId && !hasAllStuck) { 129 129 + return { 130 130 + ...result, 131 131 + ok: false, 132 132 + error: "Specify exactly one of --attempt-id <uuid> or --all-stuck.", 133 133 + }; 134 134 + } 135 135 + if (hasAttemptId && hasAllStuck) { 136 136 + return { 137 137 + ...result, 138 138 + ok: false, 139 139 + error: 140 140 + "--attempt-id and --all-stuck are mutually exclusive; pass exactly one.", 141 141 + }; 142 142 + } 143 143 + 144 144 + const olderThanMs = opts.olderThanMs ?? DEFAULT_REAP_AGE_FLOOR_MS; 145 145 + const rows = hasAttemptId 146 146 + ? await loadSingle(opts.adapter, opts.attemptId!) 147 147 + : await opts.adapter.listStuckAttempts(olderThanMs); 148 148 + 149 149 + if (rows.length === 0) { 150 150 + opts.logger.log("No stuck provision_attempts to reap."); 151 151 + return result; 152 152 + } 153 153 + 154 154 + for (const row of rows) { 155 155 + if (row.status === "activated") { 156 156 + opts.logger.error( 157 157 + `Refusing to reap ${row.attemptId}: status is "activated"; reap will not tombstone live communities.` 158 158 + ); 159 159 + result.errors += 1; 160 160 + continue; 161 161 + } 162 162 + 163 163 + opts.logger.log( 164 164 + `Reaping ${row.attemptId} (did=${row.did}, status=${row.status})` 165 165 + ); 166 166 + 167 167 + if (!row.encryptedRotationKey) { 168 168 + opts.logger.error( 169 169 + ` no encrypted_rotation_key on ${row.attemptId}; cannot sign tombstone` 170 170 + ); 171 171 + result.errors += 1; 172 172 + continue; 173 173 + } 174 174 + 175 175 + let rotationJwk: JsonWebKey; 176 176 + try { 177 177 + const decoded = await opts.cipher.decryptString(row.encryptedRotationKey); 178 178 + rotationJwk = JSON.parse(decoded) as JsonWebKey; 179 179 + } catch (err) { 180 180 + opts.logger.error( 181 181 + ` failed to decrypt rotation key for ${row.attemptId}: ${err instanceof Error ? err.message : err}` 182 182 + ); 183 183 + result.errors += 1; 184 184 + continue; 185 185 + } 186 186 + 187 187 + let prev: string; 188 188 + try { 189 189 + prev = await getLastOpCid(opts.plcDirectory, row.did, { 190 190 + fetch: opts.fetch, 191 191 + }); 192 192 + } catch (err) { 193 193 + opts.logger.error( 194 194 + ` failed to fetch last PLC op cid for ${row.did}: ${err instanceof Error ? err.message : err}` 195 195 + ); 196 196 + result.errors += 1; 197 197 + continue; 198 198 + } 199 199 + 200 200 + const unsigned = buildTombstoneOp(prev); 201 201 + const signed = await signTombstoneOp(unsigned, rotationJwk); 202 202 + const opCid = await cidForOp(signed); 203 203 + 204 204 + if (dryRun) { 205 205 + opts.logger.log( 206 206 + ` [dry-run] would submit tombstone (op cid=${opCid}, prev=${prev})` 207 207 + ); 208 208 + result.dryRunSkipped += 1; 209 209 + continue; 210 210 + } 211 211 + 212 212 + if (!opts.yes) { 213 213 + const confirmed = await promptYesNo( 214 214 + `submit PLC tombstone for ${row.did}?`, 215 215 + false, 216 216 + false 217 217 + ); 218 218 + if (!confirmed) { 219 219 + opts.logger.log(` skipped ${row.attemptId} (not confirmed)`); 220 220 + continue; 221 221 + } 222 222 + } 223 223 + 224 224 + try { 225 225 + await submitTombstoneOp(opts.plcDirectory, row.did, signed, { 226 226 + fetch: opts.fetch, 227 227 + }); 228 228 + } catch (err) { 229 229 + opts.logger.error( 230 230 + ` PLC tombstone submit failed for ${row.did}: ${err instanceof Error ? err.message : err}` 231 231 + ); 232 232 + result.errors += 1; 233 233 + continue; 234 234 + } 235 235 + 236 236 + try { 237 237 + await opts.adapter.archiveStuckAttempt(row.attemptId, { 238 238 + tombstoneOpCid: opCid, 239 239 + }); 240 240 + } catch (err) { 241 241 + opts.logger.error( 242 242 + ` archive failed for ${row.attemptId} after tombstone submit: ${err instanceof Error ? err.message : err}` 243 243 + ); 244 244 + result.errors += 1; 245 245 + continue; 246 246 + } 247 247 + 248 248 + result.reaped += 1; 249 249 + } 250 250 + 251 251 + opts.logger.log( 252 252 + `Reaped ${result.reaped} attempts (${result.dryRunSkipped} dry-run skipped, ${result.errors} errors).` 253 253 + ); 254 254 + return result; 255 255 + } 256 256 + 257 257 + async function loadSingle( 258 258 + adapter: CommunityAdapter, 259 259 + attemptId: string 260 260 + ): Promise<Awaited<ReturnType<CommunityAdapter["listStuckAttempts"]>>> { 261 261 + const row = await adapter.getProvisionAttempt(attemptId); 262 262 + return row ? [row] : []; 263 263 + } 264 264 + 265 265 + /** Dependency-injection shape: host CLI (contrail) loads its own config and 266 266 + * passes the result, so contrail-community doesn't depend on contrail's 267 267 + * cli-config infrastructure. */ 268 268 + export interface ReapHostDeps { 269 269 + /** Returns a contrail config; host is expected to exit(1) on its own if 270 270 + * no config is found. The shape is opaque to reap. */ 271 271 + resolveAndLoadConfig: (opts: { config?: string; root?: string }) => Promise<{ 272 272 + community?: { 273 273 + plcDirectory?: string; 274 274 + masterKey: Uint8Array; 275 275 + }; 276 276 + }>; 277 277 + } 278 278 + 279 279 + export function registerReap(cli: CAC, host: ReapHostDeps): void { 280 280 + cli 281 281 + .command( 282 282 + "reap", 283 283 + "Tombstone stuck provision_attempts rows in PLC and archive them" 284 284 + ) 285 285 + .option("--config <path>", "Path to Contrail config file") 286 286 + .option("--root <path>", "Project root for auto-detection (default: CWD)") 287 287 + .option("--remote", "Use production D1 bindings") 288 288 + .option("--binding <name>", "D1 binding name in wrangler.jsonc", { 289 289 + default: "DB", 290 290 + }) 291 291 + .option( 292 292 + "--db <url>", 293 293 + "Postgres connection string for the decoupled external index. When set (or DATABASE_URL is in the env), reap runs against Postgres instead of the D1 binding." 294 294 + ) 295 295 + .option("--attempt-id <uuid>", "Reap a single attempt by ID") 296 296 + .option( 297 297 + "--all-stuck", 298 298 + "Reap every provision_attempts row that did not reach status=activated and has been idle past --older-than" 299 299 + ) 300 300 + .option( 301 301 + "--older-than <minutes>", 302 302 + "With --all-stuck, only reap rows idle at least this many minutes (guards in-flight provisions)", 303 303 + { default: DEFAULT_REAP_AGE_FLOOR_MS / 60_000 } 304 304 + ) 305 305 + .option( 306 306 + "--dry-run", 307 307 + "Print what would be tombstoned without submitting to PLC (DEFAULT)" 308 308 + ) 309 309 + .option( 310 310 + "--no-dry-run", 311 311 + "Actually submit tombstones to PLC. Irrevocable. Required for real runs." 312 312 + ) 313 313 + .option("--yes", "Auto-confirm prompts") 314 314 + .action(async (options: ReapOpts) => { 315 315 + // Flag validation (exactly one of --attempt-id / --all-stuck) lives in 316 316 + // runReap, the testable core; the `!result.ok` branch below surfaces its 317 317 + // error and exits non-zero, so there's no second copy of it here. 318 318 + const config = await host.resolveAndLoadConfig(options); 319 319 + const community = config.community; 320 320 + if (!community) { 321 321 + console.error( 322 322 + "config.community is not set; reap requires a configured community module." 323 323 + ); 324 324 + process.exit(1); 325 325 + } 326 326 + if (!community.plcDirectory) { 327 327 + console.error( 328 328 + "config.community.plcDirectory is required for `reap`." 329 329 + ); 330 330 + process.exit(1); 331 331 + } 332 332 + 333 333 + // Run reap against the acquired db, then exit non-zero on any failure. 334 334 + const reapAndExit = async (db: Database): Promise<void> => { 335 335 + const result = await runReap({ 336 336 + adapter: new CommunityAdapter(db), 337 337 + cipher: new CredentialCipher(community.masterKey), 338 338 + plcDirectory: community.plcDirectory!, 339 339 + logger: console, 340 340 + yes: !!options.yes, 341 341 + attemptId: options.attemptId, 342 342 + allStuck: options.allStuck, 343 343 + dryRun: options.dryRun, 344 344 + olderThanMs: 345 345 + options.olderThan !== undefined 346 346 + ? Number(options.olderThan) * 60_000 347 347 + : undefined, 348 348 + }); 349 349 + if (!result.ok) { 350 350 + console.error(result.error); 351 351 + process.exit(1); 352 352 + } 353 353 + if (result.errors > 0) { 354 354 + process.exit(1); 355 355 + } 356 356 + }; 357 357 + 358 358 + const source = chooseReapDbSource({ 359 359 + db: options.db, 360 360 + databaseUrl: process.env.DATABASE_URL, 361 361 + }); 362 362 + 363 363 + if (source.kind === "postgres") { 364 364 + // Decoupled external index. Build a pool, run, then close it. 365 365 + const pg = (await import("pg")).default; 366 366 + const { createPostgresDatabase } = await import( 367 367 + "@atmo-dev/contrail/postgres" as string 368 368 + ); 369 369 + console.log("reap: using Postgres index"); 370 370 + const pool = new pg.Pool({ connectionString: source.url }); 371 371 + try { 372 372 + await reapAndExit(createPostgresDatabase(pool)); 373 373 + } finally { 374 374 + await pool.end(); 375 375 + } 376 376 + return; 377 377 + } 378 378 + 379 379 + // D1 via wrangler. 380 380 + const { getPlatformProxy } = await import("wrangler"); 381 381 + const { env, dispose } = await getPlatformProxy(); 382 382 + try { 383 383 + const db = (env as Record<string, unknown>)[options.binding] as 384 384 + | Database 385 385 + | undefined; 386 386 + if (!db) { 387 387 + console.error( 388 388 + `D1 binding "${options.binding}" not found in wrangler env.` 389 389 + ); 390 390 + process.exit(1); 391 391 + } 392 392 + await reapAndExit(db); 393 393 + } finally { 394 394 + await dispose(); 395 395 + } 396 396 + }); 397 397 + }

+48 -2

packages/contrail-community/src/index.ts

Reviewed

··· 24 24 export { createCommunityInviteHandler } from "./invite-handler"; 25 25 export { createCommunityWhoamiExtension } from "./whoami"; 26 26 export { initCommunitySchema, buildCommunitySchema } from "./schema"; 27 27 - export { resolveIdentity, createPdsSession } from "./pds"; 27 27 + export { 28 28 + resolveIdentity, 29 29 + createPdsSession, 30 30 + pdsCreateAccount, 31 31 + pdsGetRecommendedDidCredentials, 32 32 + pdsActivateAccount, 33 33 + pdsCreateAppPassword, 34 34 + } from "./pds"; 35 35 + export type { 36 36 + PdsCreateAccountBody, 37 37 + PdsCreateAccountResult, 38 38 + RecommendedDidCredentials, 39 39 + } from "./pds"; 28 40 export { 29 41 generateKeyPair, 30 42 buildGenesisOp, ··· 33 45 submitGenesisOp, 34 46 encodeDagCbor, 35 47 jwkToDidKey, 48 48 + buildUpdateOp, 49 49 + signUpdateOp, 50 50 + cidForOp, 51 51 + getLastOpCid, 52 52 + buildTombstoneOp, 53 53 + signTombstoneOp, 54 54 + submitTombstoneOp, 36 55 } from "./plc"; 37 37 - export type { KeyPair, GenesisOpInput, UnsignedGenesisOp, SignedGenesisOp } from "./plc"; 56 56 + export type { 57 57 + KeyPair, 58 58 + GenesisOpInput, 59 59 + UnsignedGenesisOp, 60 60 + SignedGenesisOp, 61 61 + UpdateOpInput, 62 62 + UnsignedUpdateOp, 63 63 + SignedUpdateOp, 64 64 + UnsignedTombstoneOp, 65 65 + SignedTombstoneOp, 66 66 + } from "./plc"; 38 67 39 68 // The headline export — wire community into a contrail app via: 40 69 // const community = createCommunityIntegration({ db, config }); 41 70 // const app = createApp(db, config, { community }); 42 71 export { createCommunityIntegration } from "./integration"; 43 72 export type { CommunityIntegrationOptions } from "./integration"; 73 73 + 74 74 + export { ProvisionOrchestrator } from "./provision"; 75 75 + export type { 76 76 + PdsClient, 77 77 + PlcClient, 78 78 + ProvisionInput, 79 79 + ProvisionResult, 80 80 + ProvisionOrchestratorDeps, 81 81 + } from "./provision"; 82 82 + 83 83 + export { registerReap, runReap } from "./cli/reap"; 84 84 + export type { 85 85 + ReapLogger, 86 86 + ReapHostDeps, 87 87 + RunReapOptions, 88 88 + RunReapResult, 89 89 + } from "./cli/reap";

+207

packages/contrail-community/src/pds.ts

Reviewed

··· 8 8 type DidDocumentResolver, 9 9 } from "@atcute/identity-resolver"; 10 10 11 11 + /** Canonicalize a PDS endpoint URL so allowlist comparisons aren't bypassed by 12 12 + * trailing slash, default port, scheme case, or IDN encoding differences. 13 13 + * Returns the URL's `origin` — scheme + host + (non-default) port — which 14 14 + * collapses every variant of a single PDS to one string. Throws if the input 15 15 + * is not a parseable URL; callers in request paths should catch and respond 16 16 + * with a 400. */ 17 17 + export function normalizePdsEndpoint(url: string): string { 18 18 + return new URL(url).origin; 19 19 + } 20 20 + 11 21 export interface ResolvedIdentity { 12 22 did: string; 13 23 handle: string | null; ··· 102 112 throw new Error(`could not resolve handle ${handle}`); 103 113 } 104 114 115 115 + /** Decode the `exp` claim from a JWT's payload (in seconds since epoch). Used 116 116 + * by the session cache to decide if a cached access token is still usable. 117 117 + * Returns 0 if the claim is missing or the token is malformed — callers should 118 118 + * treat 0 as "expired, refresh now". Avoids `Buffer` so it works in Workers. */ 119 119 + export function decodeJwtExp(jwt: string): number { 120 120 + const parts = jwt.split("."); 121 121 + if (parts.length < 2) return 0; 122 122 + const payload = parts[1]!; 123 123 + const padded = payload.replace(/-/g, "+").replace(/_/g, "/"); 124 124 + const padding = "=".repeat((4 - (padded.length % 4)) % 4); 125 125 + try { 126 126 + const json = atob(padded + padding); 127 127 + const claims = JSON.parse(json) as { exp?: number }; 128 128 + return Number(claims.exp ?? 0); 129 129 + } catch { 130 130 + return 0; 131 131 + } 132 132 + } 133 133 + 134 134 + /** POST com.atproto.server.refreshSession with the refresh JWT in Authorization. 135 135 + * Returns null on any non-200 — callers fall back to `createPdsSession`. */ 136 136 + export async function tryRefreshSession(input: { 137 137 + pdsUrl: string; 138 138 + refreshJwt: string; 139 139 + fetch?: typeof fetch; 140 140 + }): Promise<{ accessJwt: string; refreshJwt: string; accessExp: number } | null> { 141 141 + const f = input.fetch ?? fetch; 142 142 + const url = `${input.pdsUrl.replace(/\/$/, "")}/xrpc/com.atproto.server.refreshSession`; 143 143 + const res = await f(url, { 144 144 + method: "POST", 145 145 + headers: { authorization: `Bearer ${input.refreshJwt}` }, 146 146 + }); 147 147 + if (res.status !== 200) return null; 148 148 + const body = (await res.json().catch(() => null)) as 149 149 + | { accessJwt?: string; refreshJwt?: string } 150 150 + | null; 151 151 + if (!body?.accessJwt || !body.refreshJwt) return null; 152 152 + return { 153 153 + accessJwt: body.accessJwt, 154 154 + refreshJwt: body.refreshJwt, 155 155 + accessExp: decodeJwtExp(body.accessJwt), 156 156 + }; 157 157 + } 158 158 + 105 159 /** Create an atproto session on the given PDS using identifier + app password. 106 160 * Returns the access/refresh JWTs and the session's DID. */ 107 161 export async function createPdsSession( ··· 135 189 did: body.did, 136 190 }; 137 191 } 192 192 + 193 193 + export interface PdsDescribeServerResult { 194 194 + did: string; 195 195 + /** Other fields (availableUserDomains, contact, links, inviteCodeRequired) 196 196 + * are returned by the PDS but unused by Contrail's provisioning flow. */ 197 197 + [key: string]: unknown; 198 198 + } 199 199 + 200 200 + /** Calls `com.atproto.server.describeServer` on the target PDS to discover 201 201 + * the DID it publishes for itself. Used as `aud` in the service-auth JWT for 202 202 + * `createAccount`; the PDS verifies the audience matches its own DID and 203 203 + * rejects with `BadJwtAudience` otherwise. Resolving dynamically (instead of 204 204 + * hardcoding to a config value) is what allows a single Contrail instance 205 205 + * to mint communities on multiple PDSes. */ 206 206 + export async function pdsDescribeServer( 207 207 + pdsEndpoint: string, 208 208 + opts: { fetch?: typeof fetch } = {} 209 209 + ): Promise<PdsDescribeServerResult> { 210 210 + const f = opts.fetch ?? fetch; 211 211 + const url = `${pdsEndpoint.replace(/\/$/, "")}/xrpc/com.atproto.server.describeServer`; 212 212 + const res = await f(url); 213 213 + if (!res.ok) { 214 214 + const text = await res.text().catch(() => ""); 215 215 + throw new Error(`describeServer failed (${res.status}): ${text}`); 216 216 + } 217 217 + const body = (await res.json()) as PdsDescribeServerResult; 218 218 + if (!body?.did || typeof body.did !== "string") { 219 219 + throw new Error("describeServer response missing required `did` field"); 220 220 + } 221 221 + return body; 222 222 + } 223 223 + 224 224 + export interface PdsCreateAccountBody { 225 225 + handle: string; 226 226 + did: string; 227 227 + email: string; 228 228 + password: string; 229 229 + inviteCode?: string; 230 230 + } 231 231 + 232 232 + export interface PdsCreateAccountResult { 233 233 + did: string; 234 234 + handle: string; 235 235 + accessJwt: string; 236 236 + refreshJwt: string; 237 237 + } 238 238 + 239 239 + /** Calls `com.atproto.server.createAccount` on the target PDS using a 240 240 + * service-auth JWT (signed by the iss DID's verificationMethod). The PDS 241 241 + * verifies `requester === did` against the published DID-doc, validates the 242 242 + * invite, and creates the account in deactivated state. */ 243 243 + export async function pdsCreateAccount( 244 244 + pdsEndpoint: string, 245 245 + serviceAuthJwt: string, 246 246 + body: PdsCreateAccountBody, 247 247 + opts: { fetch?: typeof fetch } = {} 248 248 + ): Promise<PdsCreateAccountResult> { 249 249 + const f = opts.fetch ?? fetch; 250 250 + const url = `${pdsEndpoint.replace(/\/$/, "")}/xrpc/com.atproto.server.createAccount`; 251 251 + const res = await f(url, { 252 252 + method: "POST", 253 253 + headers: { 254 254 + "content-type": "application/json", 255 255 + authorization: `Bearer ${serviceAuthJwt}`, 256 256 + }, 257 257 + body: JSON.stringify(body), 258 258 + }); 259 259 + if (!res.ok) { 260 260 + const text = await res.text().catch(() => ""); 261 261 + throw new Error(`createAccount failed (${res.status}): ${text}`); 262 262 + } 263 263 + return (await res.json()) as PdsCreateAccountResult; 264 264 + } 265 265 + 266 266 + export interface RecommendedDidCredentials { 267 267 + rotationKeys: string[]; 268 268 + verificationMethods: { atproto: string }; 269 269 + alsoKnownAs: string[]; 270 270 + services: Record<string, { type: string; endpoint: string }>; 271 271 + } 272 272 + 273 273 + /** Calls `com.atproto.identity.getRecommendedDidCredentials` on the target PDS 274 274 + * using the session's accessJwt (returned by `pdsCreateAccount`, NOT a 275 275 + * service-auth JWT). Returns the DID-doc fields the PDS would self-publish. */ 276 276 + export async function pdsGetRecommendedDidCredentials( 277 277 + pdsEndpoint: string, 278 278 + accessJwt: string, 279 279 + opts: { fetch?: typeof fetch } = {} 280 280 + ): Promise<RecommendedDidCredentials> { 281 281 + const f = opts.fetch ?? fetch; 282 282 + const url = `${pdsEndpoint.replace(/\/$/, "")}/xrpc/com.atproto.identity.getRecommendedDidCredentials`; 283 283 + const res = await f(url, { 284 284 + headers: { authorization: `Bearer ${accessJwt}` }, 285 285 + }); 286 286 + if (!res.ok) { 287 287 + const text = await res.text().catch(() => ""); 288 288 + throw new Error(`getRecommendedDidCredentials failed (${res.status}): ${text}`); 289 289 + } 290 290 + return (await res.json()) as RecommendedDidCredentials; 291 291 + } 292 292 + 293 293 + /** Calls `com.atproto.server.activateAccount` on the target PDS using the 294 294 + * session's accessJwt (returned by `pdsCreateAccount`, NOT a service-auth 295 295 + * JWT). Resolves on success; throws otherwise. */ 296 296 + export async function pdsActivateAccount( 297 297 + pdsEndpoint: string, 298 298 + accessJwt: string, 299 299 + opts: { fetch?: typeof fetch } = {} 300 300 + ): Promise<void> { 301 301 + const f = opts.fetch ?? fetch; 302 302 + const url = `${pdsEndpoint.replace(/\/$/, "")}/xrpc/com.atproto.server.activateAccount`; 303 303 + const res = await f(url, { 304 304 + method: "POST", 305 305 + headers: { authorization: `Bearer ${accessJwt}` }, 306 306 + }); 307 307 + if (!res.ok) { 308 308 + const text = await res.text().catch(() => ""); 309 309 + throw new Error(`activateAccount failed (${res.status}): ${text}`); 310 310 + } 311 311 + } 312 312 + 313 313 + export interface PdsCreateAppPasswordResult { 314 314 + name: string; 315 315 + password: string; 316 316 + createdAt: string; 317 317 + } 318 318 + 319 319 + /** Calls `com.atproto.server.createAppPassword` on the target PDS using the 320 320 + * session's accessJwt. Returns the freshly minted app password. We always 321 321 + * send `privileged: false` so the credential can be revoked without 322 322 + * affecting the root account. */ 323 323 + export async function pdsCreateAppPassword( 324 324 + pdsEndpoint: string, 325 325 + accessJwt: string, 326 326 + name: string, 327 327 + opts: { fetch?: typeof fetch } = {} 328 328 + ): Promise<PdsCreateAppPasswordResult> { 329 329 + const f = opts.fetch ?? fetch; 330 330 + const url = `${pdsEndpoint.replace(/\/$/, "")}/xrpc/com.atproto.server.createAppPassword`; 331 331 + const res = await f(url, { 332 332 + method: "POST", 333 333 + headers: { 334 334 + "content-type": "application/json", 335 335 + authorization: `Bearer ${accessJwt}`, 336 336 + }, 337 337 + body: JSON.stringify({ name, privileged: false }), 338 338 + }); 339 339 + if (!res.ok) { 340 340 + const text = await res.text().catch(() => ""); 341 341 + throw new Error(`createAppPassword failed (${res.status}): ${text}`); 342 342 + } 343 343 + return (await res.json()) as PdsCreateAppPasswordResult; 344 344 + }

+150 -2

packages/contrail-community/src/plc.ts

Reviewed

··· 54 54 ); 55 55 const P256_N_HALF = P256_N >> 1n; 56 56 57 57 - async function signBytes(privateJwk: JsonWebKey, bytes: Uint8Array): Promise<Uint8Array> { 57 57 + export async function signBytes(privateJwk: JsonWebKey, bytes: Uint8Array): Promise<Uint8Array> { 58 58 const key = await crypto.subtle.importKey( 59 59 "jwk", 60 60 privateJwk, ··· 155 155 return "did:plc:" + base32Lower(hash).slice(0, 24); 156 156 } 157 157 158 158 + // ============================================================================ 159 159 + // Update op construction (subsequent ops chain via `prev`) 160 160 + // ============================================================================ 161 161 + 162 162 + export interface UpdateOpInput { 163 163 + prev: string; // CID string of the previous op in the chain 164 164 + rotationKeys: string[]; 165 165 + verificationMethodAtproto: string; 166 166 + alsoKnownAs: string[]; 167 167 + services: Record<string, { type: string; endpoint: string }>; 168 168 + } 169 169 + 170 170 + export interface UnsignedUpdateOp { 171 171 + type: "plc_operation"; 172 172 + prev: string; 173 173 + rotationKeys: string[]; 174 174 + verificationMethods: { atproto: string }; 175 175 + alsoKnownAs: string[]; 176 176 + services: Record<string, { type: string; endpoint: string }>; 177 177 + } 178 178 + 179 179 + export interface SignedUpdateOp extends UnsignedUpdateOp { 180 180 + sig: string; // base64url, unpadded 181 181 + } 182 182 + 183 183 + export function buildUpdateOp(input: UpdateOpInput): UnsignedUpdateOp { 184 184 + return { 185 185 + type: "plc_operation", 186 186 + prev: input.prev, 187 187 + rotationKeys: input.rotationKeys, 188 188 + verificationMethods: { atproto: input.verificationMethodAtproto }, 189 189 + alsoKnownAs: input.alsoKnownAs, 190 190 + services: input.services, 191 191 + }; 192 192 + } 193 193 + 194 194 + /** Sign an update op with a rotation key's private JWK. */ 195 195 + export async function signUpdateOp( 196 196 + unsigned: UnsignedUpdateOp, 197 197 + signerPrivateJwk: JsonWebKey 198 198 + ): Promise<SignedUpdateOp> { 199 199 + const encoded = encodeDagCbor(unsigned); 200 200 + const sigBytes = await signBytes(signerPrivateJwk, encoded); 201 201 + return { ...unsigned, sig: bytesToB64url(sigBytes) }; 202 202 + } 203 203 + 204 204 + /** Compute the CIDv1 for a signed op (genesis, update, or tombstone). 205 205 + * CIDv1 (0x01) + dag-cbor codec (0x71) + sha2-256 (0x12 0x20) + hash, 206 206 + * base32-lower with multibase "b" prefix. 207 207 + * 208 208 + * The tombstone shape ({type, prev, sig}) is a strict subset of update — 209 209 + * the DAG-CBOR encoder accepts all three uniformly, and PLC computes its 210 210 + * stored CID from the same canonical encoding. */ 211 211 + export async function cidForOp( 212 212 + signedOp: SignedGenesisOp | SignedUpdateOp | SignedTombstoneOp 213 213 + ): Promise<string> { 214 214 + const encoded = encodeDagCbor(signedOp); 215 215 + const hash = new Uint8Array( 216 216 + await crypto.subtle.digest("SHA-256", encoded as BufferSource) 217 217 + ); 218 218 + const cidBytes = new Uint8Array(4 + hash.length); 219 219 + cidBytes[0] = 0x01; 220 220 + cidBytes[1] = 0x71; 221 221 + cidBytes[2] = 0x12; 222 222 + cidBytes[3] = 0x20; 223 223 + cidBytes.set(hash, 4); 224 224 + return "b" + base32Lower(cidBytes); 225 225 + } 226 226 + 227 227 + /** Fetch the CID of the most recent op in a DID's PLC log. Used during 228 228 + * provision recovery to obtain the genesis op's CID at resume time (we can't 229 229 + * recompute it locally because ECDSA signatures are randomized) and by the 230 230 + * reap CLI to chain a tombstone onto the latest op. 231 231 + * 232 232 + * PLC's `/log/last` endpoint returns the bare signed op object — no envelope, 233 233 + * no `cid` field. We compute the CID locally with the same DAG-CBOR encoder 234 234 + * cidForOp uses; PLC computes its stored CID identically, so the result 235 235 + * matches the entry's CID in `/log/audit`. */ 236 236 + export async function getLastOpCid( 237 237 + plcDirectory: string, 238 238 + did: string, 239 239 + opts: { fetch?: typeof fetch } = {} 240 240 + ): Promise<string> { 241 241 + const f = opts.fetch ?? fetch; 242 242 + const url = `${plcDirectory.replace(/\/$/, "")}/${did}/log/last`; 243 243 + const res = await f(url); 244 244 + if (!res.ok) { 245 245 + const text = await res.text().catch(() => ""); 246 246 + throw new Error(`PLC log/last failed (${res.status}): ${text}`); 247 247 + } 248 248 + const op = (await res.json()) as 249 249 + | SignedGenesisOp 250 250 + | SignedUpdateOp 251 251 + | SignedTombstoneOp; 252 252 + return cidForOp(op); 253 253 + } 254 254 + 255 255 + // ============================================================================ 256 256 + // Tombstone op construction 257 257 + // A tombstone op marks a DID's PLC log as terminated — no further ops will be 258 258 + // accepted. Used by `contrail reap` to clean up DIDs whose PDS account is 259 259 + // permanently unrecoverable. 260 260 + // ============================================================================ 261 261 + 262 262 + export interface UnsignedTombstoneOp { 263 263 + type: "plc_tombstone"; 264 264 + prev: string; 265 265 + } 266 266 + 267 267 + export interface SignedTombstoneOp extends UnsignedTombstoneOp { 268 268 + sig: string; // base64url, unpadded 269 269 + } 270 270 + 271 271 + export function buildTombstoneOp(prev: string): UnsignedTombstoneOp { 272 272 + return { type: "plc_tombstone", prev }; 273 273 + } 274 274 + 275 275 + /** Sign a tombstone op with a rotation key's private JWK. */ 276 276 + export async function signTombstoneOp( 277 277 + op: UnsignedTombstoneOp, 278 278 + signerPrivateJwk: JsonWebKey 279 279 + ): Promise<SignedTombstoneOp> { 280 280 + const encoded = encodeDagCbor(op); 281 281 + const sigBytes = await signBytes(signerPrivateJwk, encoded); 282 282 + return { ...op, sig: bytesToB64url(sigBytes) }; 283 283 + } 284 284 + 285 285 + /** Submit a signed tombstone op to the PLC directory. PLC accepts genesis, 286 286 + * update, and tombstone ops at the same `${plcDirectory}/${did}` endpoint. */ 287 287 + export async function submitTombstoneOp( 288 288 + plcDirectory: string, 289 289 + did: string, 290 290 + signedOp: SignedTombstoneOp, 291 291 + opts: { fetch?: typeof fetch } = {} 292 292 + ): Promise<void> { 293 293 + const f = opts.fetch ?? fetch; 294 294 + const url = `${plcDirectory.replace(/\/$/, "")}/${did}`; 295 295 + const res = await f(url, { 296 296 + method: "POST", 297 297 + headers: { "content-type": "application/json" }, 298 298 + body: JSON.stringify(signedOp), 299 299 + }); 300 300 + if (!res.ok) { 301 301 + const text = await res.text().catch(() => ""); 302 302 + throw new Error(`PLC tombstone submit failed (${res.status}): ${text}`); 303 303 + } 304 304 + } 305 305 + 158 306 /** Submit a signed genesis op to the PLC directory. */ 159 307 export async function submitGenesisOp( 160 308 plcDirectory: string, ··· 334 482 return out; 335 483 } 336 484 337 337 - function bytesToB64url(bytes: Uint8Array): string { 485 485 + export function bytesToB64url(bytes: Uint8Array): string { 338 486 let bin = ""; 339 487 for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]!); 340 488 return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

+403

packages/contrail-community/src/provision.ts

Reviewed

··· 1 1 + /** Provision orchestrator: runs the 5-RPC flow (genesis → createAccount → 2 2 + * recommendedCreds → PLC update → activate), persisting status after each 3 3 + * step so a stuck attempt is recognizable to the reap CLI. 4 4 + * 5 5 + * Steps and persisted statuses: 6 6 + * Step 0 generate keys + persist row → keys_generated 7 7 + * Step 1 PLC genesis op → genesis_submitted 8 8 + * Step 2 PDS createAccount (service-auth JWT) → account_created 9 9 + * Step 3 fetch recommended DID credentials (no status change) 10 10 + * Step 4 PLC update op merging recommended credentials → did_doc_updated 11 11 + * Step 5 PDS activateAccount → activated 12 12 + */ 13 13 + 14 14 + import { 15 15 + generateKeyPair, 16 16 + buildGenesisOp, 17 17 + signGenesisOp, 18 18 + computeDidPlc, 19 19 + buildUpdateOp, 20 20 + signUpdateOp, 21 21 + cidForOp, 22 22 + } from "./plc"; 23 23 + import type { RecommendedDidCredentials } from "./pds"; 24 24 + import { decodeJwtExp } from "./pds"; 25 25 + import { mintServiceAuthJwt } from "./service-auth"; 26 26 + import type { CommunityAdapter } from "./adapter"; 27 27 + import type { CredentialCipher } from "./credentials"; 28 28 + 29 29 + export interface PlcClient { 30 30 + submit(did: string, op: any): Promise<unknown>; 31 31 + } 32 32 + 33 33 + export interface PdsClient { 34 34 + createAccount(input: { 35 35 + pdsUrl: string; 36 36 + serviceAuthJwt: string; 37 37 + body: { 38 38 + handle: string; 39 39 + did: string; 40 40 + email: string; 41 41 + password: string; 42 42 + inviteCode?: string; 43 43 + }; 44 44 + }): Promise<{ 45 45 + did: string; 46 46 + handle: string; 47 47 + accessJwt: string; 48 48 + refreshJwt: string; 49 49 + }>; 50 50 + getRecommendedDidCredentials(input: { 51 51 + pdsUrl: string; 52 52 + accessJwt: string; 53 53 + }): Promise<RecommendedDidCredentials>; 54 54 + activateAccount(input: { pdsUrl: string; accessJwt: string }): Promise<void>; 55 55 + /** Mints a revocable app password on the freshly-activated account. Used by 56 56 + * the self-sovereign custody mode so Contrail keeps publishing authority 57 57 + * without holding the account's root password. */ 58 58 + createAppPassword(input: { 59 59 + pdsUrl: string; 60 60 + accessJwt: string; 61 61 + name: string; 62 62 + }): Promise<{ password: string }>; 63 63 + /** Used only by the C3 retry path: when a provision call failed at 64 64 + * createAppPassword, retrying with the same attemptId needs a fresh 65 65 + * accessJwt. The session-cache JWT from the failed attempt may have 66 66 + * expired by the time the caller retries. Optional — non-retry callers 67 67 + * never invoke this. */ 68 68 + createSession?(input: { 69 69 + pdsUrl: string; 70 70 + identifier: string; 71 71 + password: string; 72 72 + }): Promise<{ accessJwt: string; refreshJwt: string; did: string }>; 73 73 + } 74 74 + 75 75 + export interface ProvisionOrchestratorDeps { 76 76 + adapter: CommunityAdapter; 77 77 + cipher: CredentialCipher; 78 78 + plc: PlcClient; 79 79 + pds: PdsClient; 80 80 + /** DID of the target PDS; used as `aud` in the service-auth JWT. */ 81 81 + pdsDid: string; 82 82 + } 83 83 + 84 84 + export interface ProvisionInput { 85 85 + attemptId: string; 86 86 + pdsEndpoint: string; 87 87 + handle: string; 88 88 + email: string; 89 89 + password: string; 90 90 + inviteCode?: string; 91 91 + /** Caller-supplied rotation public key (did:key:z…). Sits at rotationKeys[0] 92 92 + * in the genesis op; Contrail's generated key is the subordinate at [1]. 93 93 + * After activation Contrail mints a revocable app password (via 94 94 + * createAppPassword) for ongoing publishing — the user's account password 95 95 + * is never persisted. */ 96 96 + rotationKey: string; 97 97 + } 98 98 + 99 99 + export interface ProvisionResult { 100 100 + attemptId: string; 101 101 + did: string; 102 102 + status: "activated"; 103 103 + /** The caller is expected to store these — Contrail does NOT retain the 104 104 + * user's root password once the app password has been minted. */ 105 105 + rootCredentials: { 106 106 + handle: string; 107 107 + password: string; 108 108 + recoveryHint: string; 109 109 + }; 110 110 + } 111 111 + 112 112 + export class ProvisionOrchestrator { 113 113 + constructor(private deps: ProvisionOrchestratorDeps) {} 114 114 + 115 115 + async provision(input: ProvisionInput): Promise<ProvisionResult> { 116 116 + const { adapter, cipher, plc, pds, pdsDid } = this.deps; 117 117 + 118 118 + if (!isDidKeyZ(input.rotationKey)) { 119 119 + throw new Error( 120 120 + `rotationKey must be a did:key:z… string (got: ${input.rotationKey.slice(0, 24)}…)` 121 121 + ); 122 122 + } 123 123 + 124 124 + // Idempotent retry: a caller that gets a 5xx with an attemptId can 125 125 + // re-invoke provision with the SAME attemptId and the orchestrator picks 126 126 + // up where it left off. Two recoverable shapes: 127 127 + // 1. status='activated', encryptedPassword present — the orchestrator 128 128 + // itself completed successfully but a downstream graduation step 129 129 + // (e.g. the route's createFromProvisioned, bootstrap of reserved 130 130 + // spaces) failed. We return success without re-running any PLC/PDS 131 131 + // work so the caller — or the route — can resume the post-orch path. 132 132 + // 2. status='activated', no encryptedPassword — activation succeeded 133 133 + // but the post-activation createAppPassword failed. retryAppPasswordOnly 134 134 + // re-runs only that final step. 135 135 + // Other partial states are not resumable through this entry point. 136 136 + const existing = await adapter.getProvisionAttempt(input.attemptId); 137 137 + if (existing) { 138 138 + if (existing.status === "activated" && existing.encryptedPassword) { 139 139 + return { 140 140 + attemptId: input.attemptId, 141 141 + did: existing.did, 142 142 + status: "activated", 143 143 + rootCredentials: { 144 144 + handle: input.handle, 145 145 + password: input.password, 146 146 + recoveryHint: "store this — Contrail does not retain it", 147 147 + }, 148 148 + }; 149 149 + } 150 150 + if (existing.status === "activated" && !existing.encryptedPassword) { 151 151 + return this.retryAppPasswordOnly(input, existing); 152 152 + } 153 153 + throw new Error( 154 154 + `provision attempt ${input.attemptId} already exists at status="${existing.status}"; ` + 155 155 + `retry is only supported for attempts that failed at createAppPassword` 156 156 + ); 157 157 + } 158 158 + 159 159 + // Step 0: keys + persist. Contrail generates a SUBORDINATE rotation key 160 160 + // (rotationKeys[1]) so it retains a path to submit subsequent PLC ops; 161 161 + // the caller's key sits at rotationKeys[0]. 162 162 + const signingKey = await generateKeyPair(); 163 163 + const contrailRotation = await generateKeyPair(); 164 164 + const encryptedSigning = await cipher.encrypt( 165 165 + JSON.stringify(signingKey.privateJwk) 166 166 + ); 167 167 + const encryptedRotation = await cipher.encrypt( 168 168 + JSON.stringify(contrailRotation.privateJwk) 169 169 + ); 170 170 + 171 171 + const unsigned = buildGenesisOp({ 172 172 + rotationKeys: [input.rotationKey, contrailRotation.publicDidKey], 173 173 + verificationMethodAtproto: signingKey.publicDidKey, 174 174 + alsoKnownAs: [`at://${input.handle}`], 175 175 + services: { 176 176 + atproto_pds: { 177 177 + type: "AtprotoPersonalDataServer", 178 178 + endpoint: input.pdsEndpoint, 179 179 + }, 180 180 + }, 181 181 + }); 182 182 + // Genesis is signed with Contrail's subordinate rotation key — it's listed 183 183 + // at rotationKeys[1] so PLC accepts the signature. 184 184 + const signedGenesis = await signGenesisOp(unsigned, contrailRotation.privateJwk); 185 185 + const did = await computeDidPlc(signedGenesis); 186 186 + 187 187 + await adapter.createProvisionAttempt({ 188 188 + attemptId: input.attemptId, 189 189 + did, 190 190 + pdsEndpoint: input.pdsEndpoint, 191 191 + handle: input.handle, 192 192 + email: input.email, 193 193 + inviteCode: input.inviteCode ?? null, 194 194 + encryptedSigningKey: encryptedSigning, 195 195 + encryptedRotationKey: encryptedRotation, 196 196 + }); 197 197 + 198 198 + // Step 1: PLC genesis 199 199 + try { 200 200 + await plc.submit(did, signedGenesis); 201 201 + await adapter.updateProvisionStatus(input.attemptId, "genesis_submitted"); 202 202 + } catch (err: any) { 203 203 + await adapter.updateProvisionStatus(input.attemptId, "keys_generated", { 204 204 + lastError: `plc-genesis: ${err.message}`, 205 205 + }); 206 206 + throw err; 207 207 + } 208 208 + 209 209 + // Step 2: createAccount 210 210 + let session: { 211 211 + did: string; 212 212 + handle: string; 213 213 + accessJwt: string; 214 214 + refreshJwt: string; 215 215 + }; 216 216 + try { 217 217 + const serviceAuthJwt = await mintServiceAuthJwt({ 218 218 + privateJwk: signingKey.privateJwk, 219 219 + iss: did, 220 220 + aud: pdsDid, 221 221 + lxm: "com.atproto.server.createAccount", 222 222 + ttlSec: 60, 223 223 + }); 224 224 + session = await pds.createAccount({ 225 225 + pdsUrl: input.pdsEndpoint, 226 226 + serviceAuthJwt, 227 227 + body: { 228 228 + handle: input.handle, 229 229 + did, 230 230 + email: input.email, 231 231 + password: input.password, 232 232 + inviteCode: input.inviteCode, 233 233 + }, 234 234 + }); 235 235 + await adapter.updateProvisionStatus(input.attemptId, "account_created"); 236 236 + } catch (err: any) { 237 237 + await adapter.updateProvisionStatus(input.attemptId, "genesis_submitted", { 238 238 + lastError: `createAccount: ${err.message}`, 239 239 + }); 240 240 + throw err; 241 241 + } 242 242 + 243 243 + // Step 3 + 4: getRecommendedDidCredentials + PLC update op 244 244 + try { 245 245 + const recommended = await pds.getRecommendedDidCredentials({ 246 246 + pdsUrl: input.pdsEndpoint, 247 247 + accessJwt: session.accessJwt, 248 248 + }); 249 249 + const baseRotationKeys = [input.rotationKey, contrailRotation.publicDidKey]; 250 250 + const updatedRotationKeys = [ 251 251 + ...baseRotationKeys, 252 252 + ...recommended.rotationKeys.filter((k) => !baseRotationKeys.includes(k)), 253 253 + ]; 254 254 + const unsignedUpdate = buildUpdateOp({ 255 255 + prev: await cidForOp(signedGenesis), 256 256 + rotationKeys: updatedRotationKeys, 257 257 + verificationMethodAtproto: recommended.verificationMethods.atproto, 258 258 + alsoKnownAs: recommended.alsoKnownAs, 259 259 + services: recommended.services, 260 260 + }); 261 261 + const signedUpdate = await signUpdateOp( 262 262 + unsignedUpdate, 263 263 + contrailRotation.privateJwk 264 264 + ); 265 265 + await plc.submit(did, signedUpdate); 266 266 + await adapter.updateProvisionStatus(input.attemptId, "did_doc_updated"); 267 267 + } catch (err: any) { 268 268 + await adapter.updateProvisionStatus(input.attemptId, "account_created", { 269 269 + lastError: `did-doc-update: ${err.message}`, 270 270 + }); 271 271 + throw err; 272 272 + } 273 273 + 274 274 + // Step 5: activateAccount 275 275 + try { 276 276 + await pds.activateAccount({ 277 277 + pdsUrl: input.pdsEndpoint, 278 278 + accessJwt: session.accessJwt, 279 279 + }); 280 280 + await adapter.updateProvisionStatus(input.attemptId, "activated"); 281 281 + } catch (err: any) { 282 282 + await adapter.updateProvisionStatus(input.attemptId, "did_doc_updated", { 283 283 + lastError: `activateAccount: ${err.message}`, 284 284 + }); 285 285 + throw err; 286 286 + } 287 287 + 288 288 + // Seed the session cache with the JWTs createAccount returned, so the 289 289 + // first publish doesn't waste a createSession round-trip. ensureSession 290 290 + // refreshes or falls back to the stored password as the JWTs age out. 291 291 + await adapter.upsertSession(did, { 292 292 + accessJwt: session.accessJwt, 293 293 + refreshJwt: session.refreshJwt, 294 294 + accessExp: decodeJwtExp(session.accessJwt), 295 295 + }); 296 296 + 297 297 + // Mint a revocable app password so we can publish without holding the 298 298 + // user's root password. Failure here leaves the row at status=activated 299 299 + // (the account IS activated upstream) with a last_error breadcrumb; the 300 300 + // caller can retry with the same attemptId and it will pick up at 301 301 + // createAppPassword only (see retryAppPasswordOnly). 302 302 + try { 303 303 + const minted = await pds.createAppPassword({ 304 304 + pdsUrl: input.pdsEndpoint, 305 305 + accessJwt: session.accessJwt, 306 306 + name: `contrail-${input.attemptId}`, 307 307 + }); 308 308 + const encryptedPassword = await cipher.encrypt(minted.password); 309 309 + await adapter.updateProvisionStatus(input.attemptId, "activated", { 310 310 + encryptedPassword, 311 311 + }); 312 312 + } catch (err: any) { 313 313 + await adapter.updateProvisionStatus(input.attemptId, "activated", { 314 314 + lastError: `createAppPassword: ${err.message}`, 315 315 + }); 316 316 + // Wrap the error so the route handler / log readers see immediately 317 317 + // that this is the recoverable retry case, not a generic PDS failure. 318 318 + throw new Error(`createAppPassword: ${err.message}`); 319 319 + } 320 320 + 321 321 + return { 322 322 + attemptId: input.attemptId, 323 323 + did, 324 324 + status: "activated", 325 325 + rootCredentials: { 326 326 + handle: input.handle, 327 327 + password: input.password, 328 328 + recoveryHint: "store this — Contrail does not retain it", 329 329 + }, 330 330 + }; 331 331 + } 332 332 + 333 333 + /** C3 retry path. Triggered when provision() is called with an attemptId 334 334 + * whose row is at status='activated' + no encrypted_password. The DID is 335 335 + * already on PLC; the PDS account is already created and activated; only 336 336 + * the post-activation app-password mint failed. We need a fresh accessJwt 337 337 + * (the cached one may have expired by the time the caller retries), then 338 338 + * re-run createAppPassword. */ 339 339 + private async retryAppPasswordOnly( 340 340 + input: ProvisionInput, 341 341 + existing: NonNullable<Awaited<ReturnType<CommunityAdapter["getProvisionAttempt"]>>> 342 342 + ): Promise<ProvisionResult> { 343 343 + const { adapter, cipher, pds } = this.deps; 344 344 + if (!pds.createSession) { 345 345 + throw new Error( 346 346 + "retry path requires PdsClient.createSession to be wired (production buildOrchestrator does this; tests must stub it)" 347 347 + ); 348 348 + } 349 349 + 350 350 + const session = await pds.createSession({ 351 351 + pdsUrl: existing.pdsEndpoint, 352 352 + identifier: input.handle, 353 353 + password: input.password, 354 354 + }); 355 355 + 356 356 + let mintedPassword: string; 357 357 + try { 358 358 + const minted = await pds.createAppPassword({ 359 359 + pdsUrl: existing.pdsEndpoint, 360 360 + accessJwt: session.accessJwt, 361 361 + name: `contrail-${input.attemptId}`, 362 362 + }); 363 363 + mintedPassword = minted.password; 364 364 + } catch (err: any) { 365 365 + await adapter.updateProvisionStatus(input.attemptId, "activated", { 366 366 + lastError: `createAppPassword (retry): ${err.message}`, 367 367 + }); 368 368 + throw new Error(`createAppPassword (retry): ${err.message}`); 369 369 + } 370 370 + 371 371 + const encryptedPassword = await cipher.encrypt(mintedPassword); 372 372 + await adapter.updateProvisionStatus(input.attemptId, "activated", { 373 373 + encryptedPassword, 374 374 + }); 375 375 + // Refresh the session cache with the JWTs we just obtained, so the 376 376 + // first publish for this community doesn't need another createSession. 377 377 + await adapter.upsertSession(existing.did, { 378 378 + accessJwt: session.accessJwt, 379 379 + refreshJwt: session.refreshJwt, 380 380 + accessExp: decodeJwtExp(session.accessJwt), 381 381 + }); 382 382 + 383 383 + return { 384 384 + attemptId: input.attemptId, 385 385 + did: existing.did, 386 386 + status: "activated", 387 387 + rootCredentials: { 388 388 + handle: input.handle, 389 389 + password: input.password, 390 390 + recoveryHint: "store this — Contrail does not retain it", 391 391 + }, 392 392 + }; 393 393 + } 394 394 + 395 395 + } 396 396 + 397 397 + /** Cheap structural check for did:key:z multibase identifiers. The orchestrator 398 398 + * trusts the caller's submitted rotation key beyond this; PLC will reject any 399 399 + * malformed key when the genesis op is submitted. */ 400 400 + function isDidKeyZ(s: string): boolean { 401 401 + return typeof s === "string" && s.startsWith("did:key:z") && s.length > 12; 402 402 + } 403 403 +

+332 -5

packages/contrail-community/src/router.ts

Reviewed

··· 8 8 import { buildSpaceUri, HostedAdapter } from "@atmo-dev/contrail"; 9 9 import { CommunityAdapter } from "./adapter"; 10 10 import { CredentialCipher } from "./credentials"; 11 11 - import { resolveIdentity, createPdsSession } from "./pds"; 11 11 + import { 12 12 + resolveIdentity, 13 13 + createPdsSession, 14 14 + decodeJwtExp, 15 15 + tryRefreshSession, 16 16 + normalizePdsEndpoint, 17 17 + } from "./pds"; 12 18 import { 13 19 generateKeyPair, 14 20 buildGenesisOp, ··· 16 22 computeDidPlc, 17 23 submitGenesisOp, 18 24 } from "./plc"; 25 25 + import { 26 26 + pdsCreateAccount, 27 27 + pdsGetRecommendedDidCredentials, 28 28 + pdsActivateAccount, 29 29 + pdsCreateAppPassword, 30 30 + pdsDescribeServer, 31 31 + } from "./pds"; 32 32 + import { 33 33 + ProvisionOrchestrator, 34 34 + type PdsClient, 35 35 + type PlcClient, 36 36 + } from "./provision"; 19 37 import { resolveEffectiveLevel, resolveReachableSpaces, wouldCycle } from "./acl"; 20 38 import { reconcile } from "./reconcile"; 21 39 import type { AccessLevel } from "./types"; ··· 212 230 }); 213 231 }); 214 232 233 233 + app.post(`/xrpc/${NS}.provision`, auth, async (c) => { 234 234 + // Default-deny gate. Every successful call burns an invite code on the 235 235 + // target PDS and adds a permanent entry to PLC, so the route refuses 236 236 + // unless the operator has explicitly opted in via cfg.allowProvisioning. 237 237 + // Checked BEFORE auth-issued state inspection so an unauthorized op 238 238 + // doesn't even surface that the route exists in a usable form. 239 239 + if (!cfg.allowProvisioning) { 240 240 + return c.json( 241 241 + { 242 242 + error: "ProvisioningDisabled", 243 243 + message: "community.provision is disabled on this Contrail deployment", 244 244 + }, 245 245 + 403 246 246 + ); 247 247 + } 248 248 + const sa = getAuth(c); 249 249 + const body = (await c.req.json().catch(() => null)) as 250 250 + | { 251 251 + attemptId?: string; 252 252 + handle?: string; 253 253 + email?: string; 254 254 + password?: string; 255 255 + inviteCode?: string; 256 256 + pdsEndpoint?: string; 257 257 + rotationKey?: string; 258 258 + } 259 259 + | null; 260 260 + if ( 261 261 + !body?.handle || 262 262 + !body.email || 263 263 + !body.password || 264 264 + !body.pdsEndpoint || 265 265 + !body.rotationKey 266 266 + ) { 267 267 + return c.json( 268 268 + { 269 269 + error: "InvalidRequest", 270 270 + message: "handle, email, password, pdsEndpoint, rotationKey required", 271 271 + }, 272 272 + 400 273 273 + ); 274 274 + } 275 275 + if ( 276 276 + !(typeof body.rotationKey === "string" && body.rotationKey.startsWith("did:key:z")) 277 277 + ) { 278 278 + return c.json( 279 279 + { 280 280 + error: "InvalidRequest", 281 281 + message: "rotationKey must be a did:key:z…", 282 282 + }, 283 283 + 400 284 284 + ); 285 285 + } 286 286 + 287 287 + let normalizedPdsEndpoint: string; 288 288 + try { 289 289 + normalizedPdsEndpoint = normalizePdsEndpoint(body.pdsEndpoint); 290 290 + } catch { 291 291 + return c.json( 292 292 + { 293 293 + error: "InvalidRequest", 294 294 + message: "pdsEndpoint must be a parseable URL", 295 295 + }, 296 296 + 400 297 297 + ); 298 298 + } 299 299 + 300 300 + const allowed = cfg.allowedProvisionPdsEndpoints; 301 301 + if (allowed && allowed.length > 0) { 302 302 + const allowedNormalized = allowed.map((e) => { 303 303 + try { 304 304 + return normalizePdsEndpoint(e); 305 305 + } catch { 306 306 + // An unparseable allowlist entry can never match; treat as the 307 307 + // original string so an obvious config typo at least produces a 308 308 + // reject for the caller rather than a server crash. 309 309 + return e; 310 310 + } 311 311 + }); 312 312 + if (!allowedNormalized.includes(normalizedPdsEndpoint)) { 313 313 + return c.json( 314 314 + { 315 315 + error: "InvalidRequest", 316 316 + message: `pdsEndpoint not in allowlist`, 317 317 + }, 318 318 + 400 319 319 + ); 320 320 + } 321 321 + } else if (!cfg.allowAnyProvisionPdsEndpoint) { 322 322 + // Fail closed: provisioning is enabled but no allowlist is configured. 323 323 + // An empty/undefined allowlist must NOT mean "sign a genesis op for any 324 324 + // caller-supplied PDS" — that's the exact attack the allowlist prevents. 325 325 + // Refuse unless the operator has explicitly opted into the dangerous 326 326 + // accept-any mode via allowAnyProvisionPdsEndpoint. 327 327 + // 328 328 + // SSRF note: allowAnyProvisionPdsEndpoint also bypasses any endpoint 329 329 + // guard — the caller-supplied pdsEndpoint flows straight to 330 330 + // describeServer + the createAccount fetches below with no private-IP / 331 331 + // link-local / cloud-metadata protection. Only enable it behind trusted 332 332 + // auth, and pair it with an egress network policy (block 169.254.0.0/16) 333 333 + // + IMDSv2 on the host. The allowlist path above contains this by 334 334 + // construction. 335 335 + return c.json( 336 336 + { 337 337 + error: "ProvisioningMisconfigured", 338 338 + message: 339 339 + "community.provision requires a non-empty allowedProvisionPdsEndpoints allowlist; " + 340 340 + "set the allowlist, or set allowAnyProvisionPdsEndpoint:true to deliberately accept any PDS", 341 341 + }, 342 342 + 403 343 343 + ); 344 344 + } 345 345 + body.pdsEndpoint = normalizedPdsEndpoint; 346 346 + 347 347 + // Resolve the target PDS's DID dynamically. The service-auth JWT's `aud` 348 348 + // must match what the PDS publishes for itself via describeServer; the 349 349 + // PDS rejects with BadJwtAudience otherwise. This is what allows a 350 350 + // single Contrail to mint communities on multiple PDSes — using a 351 351 + // cfg-pinned value would force a 1:1 Contrail-to-PDS deployment. 352 352 + let pdsDid: string; 353 353 + try { 354 354 + const described = await pdsDescribeServer(body.pdsEndpoint, { 355 355 + fetch: cfg.fetch, 356 356 + }); 357 357 + pdsDid = described.did; 358 358 + } catch (err: any) { 359 359 + return c.json( 360 360 + { 361 361 + error: "PdsUnreachable", 362 362 + message: `describeServer failed for ${body.pdsEndpoint}: ${err.message}`, 363 363 + }, 364 364 + 502 365 365 + ); 366 366 + } 367 367 + const orchestrator = buildOrchestrator(cfg, community, cipher, pdsDid); 368 368 + 369 369 + const attemptId = body.attemptId ?? crypto.randomUUID(); 370 370 + let result; 371 371 + try { 372 372 + result = await orchestrator.provision({ 373 373 + attemptId, 374 374 + pdsEndpoint: body.pdsEndpoint, 375 375 + handle: body.handle, 376 376 + email: body.email, 377 377 + password: body.password, 378 378 + inviteCode: body.inviteCode, 379 379 + rotationKey: body.rotationKey, 380 380 + }); 381 381 + } catch (err: any) { 382 382 + // attemptId must always come back to the caller so they can retry 383 383 + // idempotently (see the C3 retry path in ProvisionOrchestrator). 384 384 + return c.json( 385 385 + { error: "ProvisioningFailed", message: err.message, attemptId }, 386 386 + 502 387 387 + ); 388 388 + } 389 389 + 390 390 + // Idempotent graduation: if the community row already exists, the first 391 391 + // call already wrote both the row and the reserved spaces. A retry with 392 392 + // the same attemptId should return success without double-creating. 393 393 + const alreadyGraduated = (await community.getCommunity(result.did)) != null; 394 394 + if (!alreadyGraduated) { 395 395 + // Hand the already-encrypted password from the provision_attempts row 396 396 + // to the communities row, keeping a single source of truth for the 397 397 + // credential. 398 398 + const attempt = await community.getProvisionAttempt(attemptId); 399 399 + if (!attempt?.encryptedPassword) { 400 400 + return c.json( 401 401 + { 402 402 + error: "ProvisioningFailed", 403 403 + message: "provision attempt missing encryptedPassword after activation", 404 404 + }, 405 405 + 502 406 406 + ); 407 407 + } 408 408 + 409 409 + await community.createFromProvisioned({ 410 410 + did: result.did, 411 411 + pdsEndpoint: body.pdsEndpoint, 412 412 + handle: body.handle, 413 413 + appPasswordEncrypted: attempt.encryptedPassword, 414 414 + createdBy: sa.issuer, 415 415 + }); 416 416 + 417 417 + await bootstrapReservedSpaces({ 418 418 + communityDid: result.did, 419 419 + creatorDid: sa.issuer, 420 420 + spaces, 421 421 + community, 422 422 + type: spaceType, 423 423 + serviceDid: spaceServiceDid, 424 424 + }); 425 425 + } 426 426 + 427 427 + const responseBody: { 428 428 + communityDid: string; 429 429 + status: string; 430 430 + rootCredentials?: { handle: string; password: string; recoveryHint: string }; 431 431 + } = { communityDid: result.did, status: result.status }; 432 432 + if (result.rootCredentials) { 433 433 + responseBody.rootCredentials = result.rootCredentials; 434 434 + } 435 435 + return c.json(responseBody); 436 436 + }); 437 437 + 215 438 app.post(`/xrpc/${NS}.delete`, auth, async (c) => { 216 439 const sa = getAuth(c); 217 440 const body = (await c.req.json().catch(() => null)) as ··· 672 895 400 673 896 ); 674 897 } 898 898 + // adopt + provision modes both share the credential-proxy publishing path: 899 899 + // both store {pds_endpoint, identifier, app_password_encrypted}. Falls through. 675 900 676 901 // Caller must be member+ in $publishers. 677 902 const publishersUri = buildSpaceUri({ ··· 695 920 let session; 696 921 try { 697 922 const appPassword = await cipher.decryptString(raw.appPasswordEncrypted); 698 698 - session = await createPdsSession(raw.pdsEndpoint, raw.identifier, appPassword, { 923 923 + session = await ensureSession({ 924 924 + community, 925 925 + did: body.communityDid, 926 926 + pdsEndpoint: raw.pdsEndpoint, 927 927 + identifier: raw.identifier, 928 928 + password: appPassword, 699 929 fetch: cfg.fetch, 700 930 }); 701 931 } catch (err: any) { ··· 724 954 }), 725 955 } 726 956 ); 957 957 + if (res.status === 401) { 958 958 + // Stale or revoked session: drop the cache so the next request goes 959 959 + // cold through ensureSession. 960 960 + await community.clearSession(body.communityDid); 961 961 + } 727 962 if (!res.ok) { 728 963 const text = await res.text().catch(() => ""); 729 964 return c.json( ··· 751 986 if (row.mode === "mint") { 752 987 return c.json({ error: "NotSupported" }, 400); 753 988 } 989 989 + // adopt + provision: same credential-proxy path; falls through. 754 990 755 991 const publishersUri = buildSpaceUri({ 756 992 ownerDid: body.communityDid, ··· 769 1005 let session; 770 1006 try { 771 1007 const appPassword = await cipher.decryptString(raw.appPasswordEncrypted); 772 772 - session = await createPdsSession(raw.pdsEndpoint, raw.identifier, appPassword, { 1008 1008 + session = await ensureSession({ 1009 1009 + community, 1010 1010 + did: body.communityDid, 1011 1011 + pdsEndpoint: raw.pdsEndpoint, 1012 1012 + identifier: raw.identifier, 1013 1013 + password: appPassword, 773 1014 fetch: cfg.fetch, 774 1015 }); 775 1016 } catch (err: any) { ··· 795 1036 }), 796 1037 } 797 1038 ); 1039 1039 + if (res.status === 401) { 1040 1040 + await community.clearSession(body.communityDid); 1041 1041 + } 798 1042 if (!res.ok) { 799 1043 const text = await res.text().catch(() => ""); 800 1044 return c.json( ··· 906 1150 } 907 1151 } 908 1152 909 909 - // Adopted: attempt a session creation. 1153 1153 + // Adopted + provisioned: both store an app password against an external PDS. 1154 1154 + // Health = we can still create a session with the stored credentials. 910 1155 const raw = await community.getRawCredentials(communityDid); 911 1156 if (!raw?.appPasswordEncrypted || !raw.pdsEndpoint || !raw.identifier) { 912 1157 return c.json({ status: "expired" }); 913 1158 } 914 1159 try { 915 1160 const appPassword = await cipher.decryptString(raw.appPasswordEncrypted); 916 916 - await createPdsSession(raw.pdsEndpoint, raw.identifier, appPassword, { 1161 1161 + await ensureSession({ 1162 1162 + community, 1163 1163 + did: communityDid, 1164 1164 + pdsEndpoint: raw.pdsEndpoint, 1165 1165 + identifier: raw.identifier, 1166 1166 + password: appPassword, 917 1167 fetch: cfg.fetch, 918 1168 }); 919 1169 return c.json({ status: "healthy" }); ··· 1008 1258 let out = ""; 1009 1259 for (let i = 0; i < 13; i++) out += chars[bytes[i]! % 32]; 1010 1260 return out; 1261 1261 + } 1262 1262 + 1263 1263 + /** Build a ProvisionOrchestrator wired with real PDS/PLC clients backed by 1264 1264 + * `cfg.fetch` (so tests can stub the network the same way they do for the 1265 1265 + * mint/adopt routes). Mirrors the ad-hoc wrapper used in the live e2e test 1266 1266 + * at apps/contrail-e2e/tests/provision.test.ts. */ 1267 1267 + function buildOrchestrator( 1268 1268 + cfg: import("./types").CommunityConfig, 1269 1269 + adapter: CommunityAdapter, 1270 1270 + cipher: CredentialCipher, 1271 1271 + pdsDid: string 1272 1272 + ): ProvisionOrchestrator { 1273 1273 + const plcDirectory = cfg.plcDirectory ?? "https://plc.directory"; 1274 1274 + const fetchOpts = { fetch: cfg.fetch }; 1275 1275 + 1276 1276 + const plc: PlcClient = { 1277 1277 + submit: (did, op) => submitGenesisOp(plcDirectory, did, op as any, fetchOpts), 1278 1278 + }; 1279 1279 + 1280 1280 + const pds: PdsClient = { 1281 1281 + createAccount: ({ pdsUrl, serviceAuthJwt, body }) => 1282 1282 + pdsCreateAccount(pdsUrl, serviceAuthJwt, body, fetchOpts), 1283 1283 + getRecommendedDidCredentials: ({ pdsUrl, accessJwt }) => 1284 1284 + pdsGetRecommendedDidCredentials(pdsUrl, accessJwt, fetchOpts), 1285 1285 + activateAccount: ({ pdsUrl, accessJwt }) => 1286 1286 + pdsActivateAccount(pdsUrl, accessJwt, fetchOpts), 1287 1287 + createAppPassword: async ({ pdsUrl, accessJwt, name }) => { 1288 1288 + const r = await pdsCreateAppPassword(pdsUrl, accessJwt, name, fetchOpts); 1289 1289 + return { password: r.password }; 1290 1290 + }, 1291 1291 + createSession: ({ pdsUrl, identifier, password }) => 1292 1292 + createPdsSession(pdsUrl, identifier, password, fetchOpts), 1293 1293 + }; 1294 1294 + 1295 1295 + return new ProvisionOrchestrator({ adapter, cipher, plc, pds, pdsDid }); 1011 1296 } 1012 1297 1013 1298 async function bootstrapReservedSpaces(args: { ··· 1043 1328 await args.spaces.applyMembershipDiff(uri, [args.creatorDid], [], args.creatorDid); 1044 1329 } 1045 1330 } 1331 1331 + 1332 1332 + /** Ensure a usable PDS session for the given community DID. Tries the cached 1333 1333 + * session first (with a 30s skew); if expired, tries refresh; if refresh fails 1334 1334 + * (or there's no cache), falls back to creating a fresh session with the 1335 1335 + * stored app password. The result is always written back to the cache. */ 1336 1336 + async function ensureSession(args: { 1337 1337 + community: CommunityAdapter; 1338 1338 + did: string; 1339 1339 + pdsEndpoint: string; 1340 1340 + identifier: string; 1341 1341 + password: string; 1342 1342 + fetch?: typeof fetch; 1343 1343 + }): Promise<{ accessJwt: string; refreshJwt: string }> { 1344 1344 + const now = Math.floor(Date.now() / 1000); 1345 1345 + const cached = await args.community.getSession(args.did); 1346 1346 + if (cached && cached.accessExp > now + 30) { 1347 1347 + return { accessJwt: cached.accessJwt, refreshJwt: cached.refreshJwt }; 1348 1348 + } 1349 1349 + if (cached) { 1350 1350 + const refreshed = await tryRefreshSession({ 1351 1351 + pdsUrl: args.pdsEndpoint, 1352 1352 + refreshJwt: cached.refreshJwt, 1353 1353 + fetch: args.fetch, 1354 1354 + }); 1355 1355 + if (refreshed) { 1356 1356 + await args.community.upsertSession(args.did, refreshed); 1357 1357 + return { accessJwt: refreshed.accessJwt, refreshJwt: refreshed.refreshJwt }; 1358 1358 + } 1359 1359 + } 1360 1360 + const session = await createPdsSession( 1361 1361 + args.pdsEndpoint, 1362 1362 + args.identifier, 1363 1363 + args.password, 1364 1364 + { fetch: args.fetch } 1365 1365 + ); 1366 1366 + await args.community.upsertSession(args.did, { 1367 1367 + accessJwt: session.accessJwt, 1368 1368 + refreshJwt: session.refreshJwt, 1369 1369 + accessExp: decodeJwtExp(session.accessJwt), 1370 1370 + }); 1371 1371 + return { accessJwt: session.accessJwt, refreshJwt: session.refreshJwt }; 1372 1372 + }

+51

packages/contrail-community/src/schema.ts

Reviewed

··· 43 43 note TEXT 44 44 )`, 45 45 `CREATE INDEX IF NOT EXISTS idx_community_invites_space ON community_invites(space_uri, created_at DESC)`, 46 46 + 47 47 + `CREATE TABLE IF NOT EXISTS provision_attempts ( 48 48 + attempt_id TEXT PRIMARY KEY NOT NULL, 49 49 + did TEXT NOT NULL, 50 50 + status TEXT NOT NULL CHECK (status IN ( 51 51 + 'keys_generated', 52 52 + 'genesis_submitted', 53 53 + 'account_created', 54 54 + 'did_doc_updated', 55 55 + 'activated' 56 56 + )), 57 57 + pds_endpoint TEXT NOT NULL, 58 58 + handle TEXT NOT NULL, 59 59 + email TEXT NOT NULL, 60 60 + invite_code TEXT, 61 61 + encrypted_signing_key TEXT, 62 62 + encrypted_rotation_key TEXT, 63 63 + encrypted_password TEXT, 64 64 + genesis_submitted_at ${dialect.bigintType}, 65 65 + account_created_at ${dialect.bigintType}, 66 66 + did_doc_updated_at ${dialect.bigintType}, 67 67 + activated_at ${dialect.bigintType}, 68 68 + last_error TEXT, 69 69 + created_at ${dialect.bigintType} NOT NULL, 70 70 + updated_at ${dialect.bigintType} NOT NULL 71 71 + )`, 72 72 + `CREATE INDEX IF NOT EXISTS idx_provision_attempts_status ON provision_attempts(status, updated_at DESC)`, 73 73 + `CREATE UNIQUE INDEX IF NOT EXISTS idx_provision_attempts_did ON provision_attempts(did)`, 74 74 + 75 75 + `CREATE TABLE IF NOT EXISTS provision_attempts_archive ( 76 76 + attempt_id TEXT PRIMARY KEY NOT NULL, 77 77 + did TEXT NOT NULL, 78 78 + pds_endpoint TEXT NOT NULL, 79 79 + handle TEXT NOT NULL, 80 80 + email TEXT NOT NULL, 81 81 + invite_code TEXT, 82 82 + last_status TEXT, 83 83 + last_error TEXT, 84 84 + archived_at ${dialect.bigintType} NOT NULL, 85 85 + tombstone_op_cid TEXT, 86 86 + notes TEXT 87 87 + )`, 88 88 + `CREATE INDEX IF NOT EXISTS idx_provision_attempts_archive_archived_at ON provision_attempts_archive(archived_at DESC)`, 89 89 + 90 90 + `CREATE TABLE IF NOT EXISTS community_sessions ( 91 91 + community_did TEXT PRIMARY KEY NOT NULL, 92 92 + access_jwt TEXT NOT NULL, 93 93 + refresh_jwt TEXT NOT NULL, 94 94 + access_exp ${dialect.bigintType} NOT NULL, 95 95 + updated_at ${dialect.bigintType} NOT NULL 96 96 + )`, 46 97 ]; 47 98 } 48 99

+51

packages/contrail-community/src/service-auth.ts

Reviewed

··· 1 1 + /** Mint an ES256 service-auth JWT for PDS XRPC calls. 2 2 + * See com.atproto.server.createAccount handler: PDS verifies 3 3 + * iss === did, aud === pds-did, lxm === lexicon-method, exp not in past. 4 4 + * Signature is verified against the iss DID's atproto verificationMethod. */ 5 5 + 6 6 + import { signBytes, bytesToB64url } from "./plc"; 7 7 + 8 8 + function b64url(input: Uint8Array | string): string { 9 9 + const b = typeof input === "string" ? new TextEncoder().encode(input) : input; 10 10 + return bytesToB64url(b); 11 11 + } 12 12 + 13 13 + function b64urlJson(obj: unknown): string { 14 14 + return b64url(JSON.stringify(obj)); 15 15 + } 16 16 + 17 17 + export interface MintServiceAuthInput { 18 18 + /** Private JWK for the signing key (atproto verificationMethod). */ 19 19 + privateJwk: JsonWebKey; 20 20 + /** Issuer DID (the account's did:plc). */ 21 21 + iss: string; 22 22 + /** Audience DID (the target PDS, e.g. did:web:pds.example). */ 23 23 + aud: string; 24 24 + /** Lexicon method being authorized, e.g. com.atproto.server.createAccount. */ 25 25 + lxm: string; 26 26 + /** Token TTL in seconds. Defaults to 60. */ 27 27 + ttlSec?: number; 28 28 + /** Override "now" for deterministic tests; epoch milliseconds. */ 29 29 + now?: number; 30 30 + } 31 31 + 32 32 + export async function mintServiceAuthJwt(input: MintServiceAuthInput): Promise<string> { 33 33 + const iat = Math.floor((input.now ?? Date.now()) / 1000); 34 34 + const ttl = input.ttlSec ?? 60; 35 35 + // Header: alg+typ only — atproto's service-auth verification doesn't use kid; 36 36 + // the signing key is resolved from the iss DID's verificationMethod. 37 37 + const header = { alg: "ES256", typ: "JWT" }; 38 38 + const payload = { 39 39 + iat, 40 40 + iss: input.iss, 41 41 + aud: input.aud, 42 42 + exp: iat + ttl, 43 43 + lxm: input.lxm, 44 44 + jti: crypto.randomUUID(), 45 45 + }; 46 46 + const signingInput = `${b64urlJson(header)}.${b64urlJson(payload)}`; 47 47 + // signBytes returns IEEE P1363 r||s (64 bytes), low-S normalized. 48 48 + // JWT ES256 mandates raw r||s, NOT DER. atproto enforces low-S as well. 49 49 + const sig = await signBytes(input.privateJwk, new TextEncoder().encode(signingInput)); 50 50 + return `${signingInput}.${b64url(sig)}`; 51 51 + }

+72 -1

packages/contrail-community/src/types.ts

Reviewed

··· 21 21 return typeof v === "string" && ACCESS_LEVELS.includes(v as AccessLevel); 22 22 } 23 23 24 24 - export type CommunityMode = "adopt" | "mint"; 24 24 + export type CommunityMode = "adopt" | "mint" | "provision"; 25 25 + 26 26 + export const PROVISION_STATUSES = [ 27 27 + "keys_generated", 28 28 + "genesis_submitted", 29 29 + "account_created", 30 30 + "did_doc_updated", 31 31 + "activated", 32 32 + ] as const; 33 33 + export type ProvisionStatus = (typeof PROVISION_STATUSES)[number]; 34 34 + 35 35 + export interface ProvisionAttemptRow { 36 36 + attemptId: string; 37 37 + did: string; 38 38 + status: ProvisionStatus; 39 39 + pdsEndpoint: string; 40 40 + handle: string; 41 41 + email: string; 42 42 + inviteCode: string | null; 43 43 + encryptedSigningKey: string | null; 44 44 + encryptedRotationKey: string | null; 45 45 + encryptedPassword: string | null; 46 46 + genesisSubmittedAt: number | null; 47 47 + accountCreatedAt: number | null; 48 48 + didDocUpdatedAt: number | null; 49 49 + activatedAt: number | null; 50 50 + lastError: string | null; 51 51 + createdAt: number; 52 52 + updatedAt: number; 53 53 + } 54 54 + 55 55 + export interface CreateProvisionAttemptInput { 56 56 + attemptId: string; 57 57 + did: string; 58 58 + pdsEndpoint: string; 59 59 + handle: string; 60 60 + email: string; 61 61 + inviteCode?: string | null; 62 62 + encryptedSigningKey: string; 63 63 + encryptedRotationKey: string; 64 64 + } 25 65 26 66 export interface CommunityConfig { 27 67 /** Service DID for JWT verification. Falls back to spaces.serviceDid when both modules are enabled. */ ··· 35 75 resolver?: DidDocumentResolver; 36 76 /** Optional override for the fetch implementation (useful for tests). */ 37 77 fetch?: typeof fetch; 78 78 + /** Allowlist of PDS endpoints `community.provision` may create a community 79 79 + * account on. Callers must supply a `pdsEndpoint` that matches one of these 80 80 + * entries (after normalization); other values are rejected before any PLC 81 81 + * op is signed. This gates ONLY provisioning — Contrail still reads/indexes 82 82 + * records from every PDS on the network; this is not a global PDS filter. 83 83 + * 84 84 + * Fail-closed: when `allowProvisioning` is true this list MUST be non-empty, 85 85 + * otherwise `community.provision` is refused. An empty/undefined allowlist 86 86 + * no longer means "any PDS" — to genuinely accept any caller-supplied 87 87 + * endpoint, set `allowAnyProvisionPdsEndpoint: true` (a separate, loud 88 88 + * opt-in). Operators running a public/multi-tenant Contrail MUST keep a 89 89 + * real allowlist here so callers can't mint PLC entries pointing at 90 90 + * attacker-controlled PDSes signed by Contrail's rotation key. */ 91 91 + allowedProvisionPdsEndpoints?: string[]; 92 92 + /** Explicit, loud opt-in to accept ANY caller-supplied `pdsEndpoint` when 93 93 + * provisioning is enabled. Only honored when `allowProvisioning` is true. 94 94 + * This is the dangerous mode the allowlist exists to prevent: every 95 95 + * successful call signs a permanent PLC genesis op pointing at a 96 96 + * caller-controlled endpoint with Contrail's rotation key. Leave unset 97 97 + * (or false) on any public/multi-tenant deployment and use 98 98 + * `allowedProvisionPdsEndpoints` instead. */ 99 99 + allowAnyProvisionPdsEndpoint?: boolean; 100 100 + /** Top-level switch for the `community.provision` route. Default-deny: a 101 101 + * call with the route present but this flag unset (or false) returns 403 102 102 + * ProvisioningDisabled BEFORE any PLC/PDS work runs. Set to `true` only 103 103 + * when the operator has confirmed the upstream auth middleware restricts 104 104 + * this route to authorized callers — every successful call burns a real 105 105 + * invite code on the target PDS and adds a permanent entry to PLC. 106 106 + * `mint` and `adopt` are not gated by this flag; they don't burn external 107 107 + * resources. */ 108 108 + allowProvisioning?: boolean; 38 109 } 39 110 40 111 /** Public view of a community row. Encrypted credentials are not included here

+388

packages/contrail-community/tests/cli-reap.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeEach } from "vitest"; 2 2 + import type { Database } from "@atmo-dev/contrail-base"; 3 3 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 4 4 + import { initCommunitySchema } from "../src/schema"; 5 5 + import { CommunityAdapter } from "../src/adapter"; 6 6 + import { CredentialCipher } from "../src/credentials"; 7 7 + import { 8 8 + generateKeyPair, 9 9 + buildTombstoneOp, 10 10 + signTombstoneOp, 11 11 + submitTombstoneOp, 12 12 + cidForOp, 13 13 + type SignedGenesisOp, 14 14 + } from "../src/plc"; 15 15 + import { runReap, chooseReapDbSource } from "../src/cli/reap"; 16 16 + 17 17 + type SeedStatus = 18 18 + | "keys_generated" 19 19 + | "genesis_submitted" 20 20 + | "account_created" 21 21 + | "did_doc_updated" 22 22 + | "activated"; 23 23 + 24 24 + interface SeedAttemptOpts { 25 25 + attemptId: string; 26 26 + did: string; 27 27 + status: SeedStatus; 28 28 + } 29 29 + 30 30 + async function seedAttempt( 31 31 + adapter: CommunityAdapter, 32 32 + cipher: CredentialCipher, 33 33 + opts: SeedAttemptOpts 34 34 + ): Promise<{ rotationJwk: JsonWebKey }> { 35 35 + const kp = await generateKeyPair(); 36 36 + const encryptedRotation = await cipher.encrypt(JSON.stringify(kp.privateJwk)); 37 37 + await adapter.createProvisionAttempt({ 38 38 + attemptId: opts.attemptId, 39 39 + did: opts.did, 40 40 + pdsEndpoint: "https://pds.test", 41 41 + handle: `${opts.attemptId}.pds.test`, 42 42 + email: `${opts.attemptId}@x.test`, 43 43 + encryptedSigningKey: await cipher.encrypt("{}"), 44 44 + encryptedRotationKey: encryptedRotation, 45 45 + }); 46 46 + // Walk the row forward to its target status. The row starts at 47 47 + // keys_generated after createProvisionAttempt. 48 48 + const path: SeedStatus[] = [ 49 49 + "genesis_submitted", 50 50 + "account_created", 51 51 + "did_doc_updated", 52 52 + "activated", 53 53 + ]; 54 54 + for (const next of path) { 55 55 + if (opts.status === "keys_generated") break; 56 56 + await adapter.updateProvisionStatus(opts.attemptId, next); 57 57 + if (next === opts.status) break; 58 58 + } 59 59 + return { rotationJwk: kp.privateJwk }; 60 60 + } 61 61 + 62 62 + interface PlcCall { 63 63 + url: string; 64 64 + method: string; 65 65 + body: any; 66 66 + } 67 67 + 68 68 + /** Stand-in for what PLC's `/log/last` actually returns: the bare signed op 69 69 + * object, no envelope. `getLastOpCid` computes the CID locally via cidForOp. */ 70 70 + const FAKE_LAST_OP: SignedGenesisOp = { 71 71 + type: "plc_operation", 72 72 + prev: null, 73 73 + rotationKeys: ["did:key:zQ3shfakerotation00000000000000000000000000000000000"], 74 74 + verificationMethods: { atproto: "did:key:zQ3shfakeverif00000000000000000000000000000000000000" }, 75 75 + alsoKnownAs: ["at://fixture.pds.test"], 76 76 + services: { 77 77 + atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://pds.test" }, 78 78 + }, 79 79 + sig: "fakesigfakesigfakesigfakesigfakesigfakesigfakesigfakesigfakesigfakesigfakesigfakesigfak", 80 80 + }; 81 81 + 82 82 + function makeFakeFetch(calls: PlcCall[]): typeof fetch { 83 83 + return (async (input: RequestInfo | URL, init?: RequestInit) => { 84 84 + const url = String(input); 85 85 + if (url.endsWith("/log/last")) { 86 86 + return new Response(JSON.stringify(FAKE_LAST_OP), { 87 87 + status: 200, 88 88 + headers: { "content-type": "application/json" }, 89 89 + }); 90 90 + } 91 91 + calls.push({ 92 92 + url, 93 93 + method: init?.method ?? "GET", 94 94 + body: init?.body ? JSON.parse(String(init.body)) : null, 95 95 + }); 96 96 + return new Response("", { status: 200 }); 97 97 + }) as typeof fetch; 98 98 + } 99 99 + 100 100 + describe("runReap (cli reap)", () => { 101 101 + let db: Database; 102 102 + let adapter: CommunityAdapter; 103 103 + let cipher: CredentialCipher; 104 104 + 105 105 + beforeEach(async () => { 106 106 + db = createSqliteDatabase(":memory:"); 107 107 + await initCommunitySchema(db); 108 108 + cipher = new CredentialCipher(new Uint8Array(32).fill(7)); 109 109 + adapter = new CommunityAdapter(db); 110 110 + }); 111 111 + 112 112 + it("rejects when neither --attempt-id nor --all-stuck is set", async () => { 113 113 + const result = await runReap({ 114 114 + adapter, 115 115 + cipher, 116 116 + plcDirectory: "https://plc.test", 117 117 + fetch: makeFakeFetch([]), 118 118 + logger: { log: () => {}, error: () => {} }, 119 119 + yes: true, 120 120 + }); 121 121 + expect(result.ok).toBe(false); 122 122 + expect(result.error).toMatch(/--attempt-id|--all-stuck/i); 123 123 + }); 124 124 + 125 125 + it("rejects when both --attempt-id and --all-stuck are set", async () => { 126 126 + const result = await runReap({ 127 127 + adapter, 128 128 + cipher, 129 129 + plcDirectory: "https://plc.test", 130 130 + fetch: makeFakeFetch([]), 131 131 + logger: { log: () => {}, error: () => {} }, 132 132 + yes: true, 133 133 + attemptId: "a1", 134 134 + allStuck: true, 135 135 + }); 136 136 + expect(result.ok).toBe(false); 137 137 + expect(result.error).toMatch(/mutually exclusive|both|exactly one/i); 138 138 + }); 139 139 + 140 140 + it("real run with --attempt-id submits a tombstone and archives the row", async () => { 141 141 + await seedAttempt(adapter, cipher, { 142 142 + attemptId: "a-stuck", 143 143 + did: "did:plc:stuck", 144 144 + status: "genesis_submitted", 145 145 + }); 146 146 + 147 147 + const calls: PlcCall[] = []; 148 148 + const result = await runReap({ 149 149 + adapter, 150 150 + cipher, 151 151 + plcDirectory: "https://plc.test", 152 152 + fetch: makeFakeFetch(calls), 153 153 + logger: { log: () => {}, error: () => {} }, 154 154 + yes: true, 155 155 + attemptId: "a-stuck", 156 156 + dryRun: false, 157 157 + }); 158 158 + 159 159 + expect(result.ok).toBe(true); 160 160 + expect(result.reaped).toBe(1); 161 161 + expect(result.errors).toBe(0); 162 162 + expect(calls.length).toBe(1); 163 163 + expect(calls[0]!.url).toBe("https://plc.test/did:plc:stuck"); 164 164 + expect(calls[0]!.body.type).toBe("plc_tombstone"); 165 165 + expect(calls[0]!.body.prev).toBe(await cidForOp(FAKE_LAST_OP)); 166 166 + 167 167 + // Original row removed from provision_attempts. 168 168 + expect(await adapter.getProvisionAttempt("a-stuck")).toBeNull(); 169 169 + // Archive row populated with the row's last live status. 170 170 + const archive = await db 171 171 + .prepare( 172 172 + "SELECT * FROM provision_attempts_archive WHERE attempt_id = ?" 173 173 + ) 174 174 + .bind("a-stuck") 175 175 + .first<Record<string, any>>(); 176 176 + expect(archive).not.toBeNull(); 177 177 + expect(archive!.did).toBe("did:plc:stuck"); 178 178 + expect(archive!.last_status).toBe("genesis_submitted"); 179 179 + expect(archive!.tombstone_op_cid).toBeTruthy(); 180 180 + }); 181 181 + 182 182 + it("defaults to dry-run when dryRun is unspecified (safety default)", async () => { 183 183 + await seedAttempt(adapter, cipher, { 184 184 + attemptId: "a-stuck", 185 185 + did: "did:plc:stuck", 186 186 + status: "did_doc_updated", 187 187 + }); 188 188 + 189 189 + const calls: PlcCall[] = []; 190 190 + const result = await runReap({ 191 191 + adapter, 192 192 + cipher, 193 193 + plcDirectory: "https://plc.test", 194 194 + fetch: makeFakeFetch(calls), 195 195 + logger: { log: () => {}, error: () => {} }, 196 196 + yes: true, 197 197 + attemptId: "a-stuck", 198 198 + // dryRun INTENTIONALLY OMITTED — must default to dry-run. 199 199 + }); 200 200 + 201 201 + expect(result.ok).toBe(true); 202 202 + expect(result.reaped).toBe(0); 203 203 + expect(result.dryRunSkipped).toBe(1); 204 204 + expect(calls.length).toBe(0); 205 205 + const row = await adapter.getProvisionAttempt("a-stuck"); 206 206 + expect(row?.status).toBe("did_doc_updated"); 207 207 + }); 208 208 + 209 209 + it("with --all-stuck reaps every non-activated row, regardless of status", async () => { 210 210 + await seedAttempt(adapter, cipher, { 211 211 + attemptId: "s1", 212 212 + did: "did:plc:s1", 213 213 + status: "keys_generated", 214 214 + }); 215 215 + await seedAttempt(adapter, cipher, { 216 216 + attemptId: "s2", 217 217 + did: "did:plc:s2", 218 218 + status: "genesis_submitted", 219 219 + }); 220 220 + await seedAttempt(adapter, cipher, { 221 221 + attemptId: "s3", 222 222 + did: "did:plc:s3", 223 223 + status: "did_doc_updated", 224 224 + }); 225 225 + // An activated row must NOT be reaped. 226 226 + await seedAttempt(adapter, cipher, { 227 227 + attemptId: "live", 228 228 + did: "did:plc:live", 229 229 + status: "activated", 230 230 + }); 231 231 + 232 232 + const calls: PlcCall[] = []; 233 233 + const result = await runReap({ 234 234 + adapter, 235 235 + cipher, 236 236 + plcDirectory: "https://plc.test", 237 237 + fetch: makeFakeFetch(calls), 238 238 + logger: { log: () => {}, error: () => {} }, 239 239 + yes: true, 240 240 + allStuck: true, 241 241 + dryRun: false, 242 242 + olderThanMs: 0, // these rows are freshly seeded; disable the age floor 243 243 + }); 244 244 + 245 245 + expect(result.ok).toBe(true); 246 246 + expect(result.reaped).toBe(3); 247 247 + expect(calls.map((c) => c.url).sort()).toEqual([ 248 248 + "https://plc.test/did:plc:s1", 249 249 + "https://plc.test/did:plc:s2", 250 250 + "https://plc.test/did:plc:s3", 251 251 + ]); 252 252 + // The activated row is untouched. 253 253 + const live = await adapter.getProvisionAttempt("live"); 254 254 + expect(live?.status).toBe("activated"); 255 255 + }); 256 256 + 257 257 + it("--all-stuck skips freshly-updated in-flight rows under the default age floor", async () => { 258 258 + // A row mid-state-machine (updated_at ~ now) must survive a default 259 259 + // --all-stuck run so reap can't tombstone a DID about to activate. 260 260 + await seedAttempt(adapter, cipher, { 261 261 + attemptId: "in-flight", 262 262 + did: "did:plc:inflight", 263 263 + status: "genesis_submitted", 264 264 + }); 265 265 + 266 266 + const calls: PlcCall[] = []; 267 267 + const result = await runReap({ 268 268 + adapter, 269 269 + cipher, 270 270 + plcDirectory: "https://plc.test", 271 271 + fetch: makeFakeFetch(calls), 272 272 + logger: { log: () => {}, error: () => {} }, 273 273 + yes: true, 274 274 + allStuck: true, 275 275 + dryRun: false, 276 276 + // olderThanMs OMITTED — must apply the default 30-min floor. 277 277 + }); 278 278 + 279 279 + expect(result.ok).toBe(true); 280 280 + expect(result.reaped).toBe(0); 281 281 + expect(calls.length).toBe(0); 282 282 + // The in-flight row is untouched. 283 283 + expect((await adapter.getProvisionAttempt("in-flight"))?.status).toBe( 284 284 + "genesis_submitted" 285 285 + ); 286 286 + }); 287 287 + 288 288 + it("refuses to reap an activated row passed via --attempt-id", async () => { 289 289 + await seedAttempt(adapter, cipher, { 290 290 + attemptId: "live", 291 291 + did: "did:plc:live", 292 292 + status: "activated", 293 293 + }); 294 294 + 295 295 + const calls: PlcCall[] = []; 296 296 + const result = await runReap({ 297 297 + adapter, 298 298 + cipher, 299 299 + plcDirectory: "https://plc.test", 300 300 + fetch: makeFakeFetch(calls), 301 301 + logger: { log: () => {}, error: () => {} }, 302 302 + yes: true, 303 303 + attemptId: "live", 304 304 + dryRun: false, 305 305 + }); 306 306 + 307 307 + expect(calls.length).toBe(0); 308 308 + expect(result.errors).toBeGreaterThanOrEqual(1); 309 309 + const live = await adapter.getProvisionAttempt("live"); 310 310 + expect(live?.status).toBe("activated"); 311 311 + }); 312 312 + }); 313 313 + 314 314 + describe("chooseReapDbSource", () => { 315 315 + it("selects Postgres when --db is given", () => { 316 316 + expect( 317 317 + chooseReapDbSource({ db: "postgres://x", databaseUrl: undefined }) 318 318 + ).toEqual({ kind: "postgres", url: "postgres://x" }); 319 319 + }); 320 320 + 321 321 + it("selects Postgres from DATABASE_URL when --db is absent", () => { 322 322 + expect( 323 323 + chooseReapDbSource({ db: undefined, databaseUrl: "postgres://env" }) 324 324 + ).toEqual({ kind: "postgres", url: "postgres://env" }); 325 325 + }); 326 326 + 327 327 + it("prefers an explicit --db over DATABASE_URL", () => { 328 328 + expect( 329 329 + chooseReapDbSource({ db: "postgres://flag", databaseUrl: "postgres://env" }) 330 330 + ).toEqual({ kind: "postgres", url: "postgres://flag" }); 331 331 + }); 332 332 + 333 333 + it("falls back to the D1 binding when neither is set", () => { 334 334 + expect(chooseReapDbSource({ db: undefined, databaseUrl: undefined })).toEqual({ 335 335 + kind: "d1", 336 336 + }); 337 337 + }); 338 338 + }); 339 339 + 340 340 + describe("plc tombstone helpers", () => { 341 341 + it("signTombstoneOp adds a base64url sig", async () => { 342 342 + const kp = await generateKeyPair(); 343 343 + const op = buildTombstoneOp("bafyreigenesis"); 344 344 + const signed = await signTombstoneOp(op, kp.privateJwk); 345 345 + expect(signed.type).toBe("plc_tombstone"); 346 346 + expect(signed.prev).toBe("bafyreigenesis"); 347 347 + expect(signed.sig).toMatch(/^[A-Za-z0-9_-]+$/); 348 348 + }); 349 349 + 350 350 + it("submitTombstoneOp POSTs to the PLC directory at the DID URL", async () => { 351 351 + const kp = await generateKeyPair(); 352 352 + const signed = await signTombstoneOp( 353 353 + buildTombstoneOp("bafyreigenesis"), 354 354 + kp.privateJwk 355 355 + ); 356 356 + 357 357 + let calledUrl = ""; 358 358 + let calledBody: any = null; 359 359 + const fakeFetch: typeof fetch = (async (input: RequestInfo | URL, init?: RequestInit) => { 360 360 + calledUrl = String(input); 361 361 + calledBody = init?.body ? JSON.parse(String(init.body)) : null; 362 362 + return new Response("", { status: 200 }); 363 363 + }) as typeof fetch; 364 364 + 365 365 + await submitTombstoneOp("https://plc.test", "did:plc:abc", signed, { 366 366 + fetch: fakeFetch, 367 367 + }); 368 368 + expect(calledUrl).toBe("https://plc.test/did:plc:abc"); 369 369 + expect(calledBody.type).toBe("plc_tombstone"); 370 370 + expect(calledBody.prev).toBe("bafyreigenesis"); 371 371 + expect(calledBody.sig).toBe(signed.sig); 372 372 + }); 373 373 + 374 374 + it("submitTombstoneOp throws on non-2xx", async () => { 375 375 + const kp = await generateKeyPair(); 376 376 + const signed = await signTombstoneOp( 377 377 + buildTombstoneOp("bafyreigenesis"), 378 378 + kp.privateJwk 379 379 + ); 380 380 + const fakeFetch: typeof fetch = (async () => 381 381 + new Response("denied", { status: 400 })) as typeof fetch; 382 382 + await expect( 383 383 + submitTombstoneOp("https://plc.test", "did:plc:abc", signed, { 384 384 + fetch: fakeFetch, 385 385 + }) 386 386 + ).rejects.toThrow(/400.*denied/); 387 387 + }); 388 388 + });

+247

packages/contrail-community/tests/community-provision-attempts.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeEach } from "vitest"; 2 2 + import type { Database } from "@atmo-dev/contrail-base"; 3 3 + import { initCommunitySchema } from "../src/schema"; 4 4 + import { CommunityAdapter } from "../src/adapter"; 5 5 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 6 6 + 7 7 + describe("provision_attempts adapter", () => { 8 8 + let db: Database; 9 9 + let adapter: CommunityAdapter; 10 10 + 11 11 + beforeEach(async () => { 12 12 + db = createSqliteDatabase(":memory:"); 13 13 + await initCommunitySchema(db); 14 14 + adapter = new CommunityAdapter(db); 15 15 + }); 16 16 + 17 17 + it("creates and reads a provision attempt", async () => { 18 18 + const before = Date.now(); 19 19 + await adapter.createProvisionAttempt({ 20 20 + attemptId: "a1", 21 21 + did: "did:plc:abc", 22 22 + pdsEndpoint: "https://pds.test", 23 23 + handle: "abc.pds.test", 24 24 + email: "abc@x.test", 25 25 + inviteCode: "code-1", 26 26 + encryptedSigningKey: "sk-enc", 27 27 + encryptedRotationKey: "rk-enc", 28 28 + }); 29 29 + 30 30 + const row = await adapter.getProvisionAttempt("a1"); 31 31 + expect(row).not.toBeNull(); 32 32 + expect(row?.attemptId).toBe("a1"); 33 33 + expect(row?.did).toBe("did:plc:abc"); 34 34 + expect(row?.status).toBe("keys_generated"); 35 35 + expect(row?.pdsEndpoint).toBe("https://pds.test"); 36 36 + expect(row?.handle).toBe("abc.pds.test"); 37 37 + expect(row?.email).toBe("abc@x.test"); 38 38 + expect(row?.inviteCode).toBe("code-1"); 39 39 + expect(row?.encryptedSigningKey).toBe("sk-enc"); 40 40 + expect(row?.encryptedRotationKey).toBe("rk-enc"); 41 41 + expect(row?.encryptedPassword).toBeNull(); 42 42 + expect(row?.lastError).toBeNull(); 43 43 + expect(row?.genesisSubmittedAt).toBeNull(); 44 44 + expect(row?.accountCreatedAt).toBeNull(); 45 45 + expect(row?.didDocUpdatedAt).toBeNull(); 46 46 + expect(row?.activatedAt).toBeNull(); 47 47 + expect(row?.createdAt).toBeGreaterThanOrEqual(before); 48 48 + expect(row?.updatedAt).toBeGreaterThanOrEqual(before); 49 49 + }); 50 50 + 51 51 + it("getProvisionAttempt returns null for unknown attempt", async () => { 52 52 + const row = await adapter.getProvisionAttempt("no-such-attempt"); 53 53 + expect(row).toBeNull(); 54 54 + }); 55 55 + 56 56 + it("treats missing inviteCode as null", async () => { 57 57 + await adapter.createProvisionAttempt({ 58 58 + attemptId: "a-no-invite", 59 59 + did: "did:plc:noinv", 60 60 + pdsEndpoint: "https://pds.test", 61 61 + handle: "noinv.pds.test", 62 62 + email: "noinv@x.test", 63 63 + encryptedSigningKey: "sk", 64 64 + encryptedRotationKey: "rk", 65 65 + }); 66 66 + const row = await adapter.getProvisionAttempt("a-no-invite"); 67 67 + expect(row?.inviteCode).toBeNull(); 68 68 + }); 69 69 + 70 70 + it("advances status, stamps the matching timestamp, and persists last_error", async () => { 71 71 + await adapter.createProvisionAttempt({ 72 72 + attemptId: "a1", 73 73 + did: "did:plc:abc", 74 74 + pdsEndpoint: "https://pds.test", 75 75 + handle: "abc.pds.test", 76 76 + email: "abc@x.test", 77 77 + encryptedSigningKey: "sk-enc", 78 78 + encryptedRotationKey: "rk-enc", 79 79 + }); 80 80 + 81 81 + const initial = await adapter.getProvisionAttempt("a1"); 82 82 + const initialUpdated = initial!.updatedAt; 83 83 + 84 84 + // Small wait so updated_at can advance on millisecond clocks. 85 85 + await new Promise((r) => setTimeout(r, 2)); 86 86 + 87 87 + await adapter.updateProvisionStatus("a1", "genesis_submitted"); 88 88 + let row = await adapter.getProvisionAttempt("a1"); 89 89 + expect(row?.status).toBe("genesis_submitted"); 90 90 + expect(row?.genesisSubmittedAt).toBeTruthy(); 91 91 + expect(row?.accountCreatedAt).toBeNull(); 92 92 + expect(row?.didDocUpdatedAt).toBeNull(); 93 93 + expect(row?.activatedAt).toBeNull(); 94 94 + expect(row?.updatedAt).toBeGreaterThanOrEqual(initialUpdated); 95 95 + 96 96 + await adapter.updateProvisionStatus("a1", "account_created"); 97 97 + row = await adapter.getProvisionAttempt("a1"); 98 98 + expect(row?.status).toBe("account_created"); 99 99 + expect(row?.accountCreatedAt).toBeTruthy(); 100 100 + // Earlier stamp must be preserved on subsequent updates. 101 101 + expect(row?.genesisSubmittedAt).toBeTruthy(); 102 102 + 103 103 + await adapter.updateProvisionStatus("a1", "did_doc_updated", { lastError: "transient PLC error" }); 104 104 + row = await adapter.getProvisionAttempt("a1"); 105 105 + expect(row?.status).toBe("did_doc_updated"); 106 106 + expect(row?.lastError).toBe("transient PLC error"); 107 107 + // Earlier stamps still preserved. 108 108 + expect(row?.genesisSubmittedAt).toBeTruthy(); 109 109 + expect(row?.accountCreatedAt).toBeTruthy(); 110 110 + }); 111 111 + 112 112 + it("persists encryptedPassword via updateProvisionStatus", async () => { 113 113 + await adapter.createProvisionAttempt({ 114 114 + attemptId: "a-pwd", 115 115 + did: "did:plc:pwd", 116 116 + pdsEndpoint: "https://pds.test", 117 117 + handle: "pwd.pds.test", 118 118 + email: "pwd@x.test", 119 119 + encryptedSigningKey: "sk", 120 120 + encryptedRotationKey: "rk", 121 121 + }); 122 122 + expect((await adapter.getProvisionAttempt("a-pwd"))?.encryptedPassword).toBeNull(); 123 123 + 124 124 + await adapter.updateProvisionStatus("a-pwd", "account_created", { 125 125 + encryptedPassword: "pwd-enc", 126 126 + }); 127 127 + const row = await adapter.getProvisionAttempt("a-pwd"); 128 128 + expect(row?.encryptedPassword).toBe("pwd-enc"); 129 129 + expect(row?.accountCreatedAt).toBeTruthy(); 130 130 + }); 131 131 + 132 132 + describe("listStuckAttempts age threshold", () => { 133 133 + async function seedStuck(attemptId: string, did: string): Promise<void> { 134 134 + await adapter.createProvisionAttempt({ 135 135 + attemptId, 136 136 + did, 137 137 + pdsEndpoint: "https://pds.test", 138 138 + handle: `${attemptId}.pds.test`, 139 139 + email: `${attemptId}@x.test`, 140 140 + encryptedSigningKey: "sk", 141 141 + encryptedRotationKey: "rk", 142 142 + }); 143 143 + } 144 144 + /** Backdate a row's updated_at so it looks old to the age filter. */ 145 145 + async function ageRow(attemptId: string, ageMs: number): Promise<void> { 146 146 + await db 147 147 + .prepare(`UPDATE provision_attempts SET updated_at = ? WHERE attempt_id = ?`) 148 148 + .bind(Date.now() - ageMs, attemptId) 149 149 + .run(); 150 150 + } 151 151 + 152 152 + it("excludes a freshly-updated (in-flight) non-activated row", async () => { 153 153 + await seedStuck("fresh", "did:plc:fresh"); 154 154 + // updated_at is ~now; a 30-minute floor must not select it. 155 155 + const rows = await adapter.listStuckAttempts(30 * 60 * 1000); 156 156 + expect(rows.map((r) => r.attemptId)).not.toContain("fresh"); 157 157 + }); 158 158 + 159 159 + it("includes a row older than the threshold", async () => { 160 160 + await seedStuck("old", "did:plc:old"); 161 161 + await ageRow("old", 2 * 60 * 60 * 1000); // 2 hours ago 162 162 + const rows = await adapter.listStuckAttempts(30 * 60 * 1000); 163 163 + expect(rows.map((r) => r.attemptId)).toContain("old"); 164 164 + }); 165 165 + 166 166 + it("with a zero threshold returns every non-activated row", async () => { 167 167 + await seedStuck("a", "did:plc:a"); 168 168 + await seedStuck("b", "did:plc:b"); 169 169 + const rows = await adapter.listStuckAttempts(0); 170 170 + expect(rows.map((r) => r.attemptId).sort()).toEqual(["a", "b"]); 171 171 + }); 172 172 + }); 173 173 + 174 174 + describe("archiveStuckAttempt idempotency", () => { 175 175 + it("retry after a partial failure (archive row already present, live row stranded) does not throw and finishes the move", async () => { 176 176 + await adapter.createProvisionAttempt({ 177 177 + attemptId: "partial", 178 178 + did: "did:plc:partial", 179 179 + pdsEndpoint: "https://pds.test", 180 180 + handle: "partial.pds.test", 181 181 + email: "partial@x.test", 182 182 + encryptedSigningKey: "sk", 183 183 + encryptedRotationKey: "rk", 184 184 + }); 185 185 + // Simulate the first reap: its archive INSERT landed, but the live-row 186 186 + // DELETE failed, leaving the row in BOTH tables. 187 187 + await db 188 188 + .prepare( 189 189 + `INSERT INTO provision_attempts_archive 190 190 + (attempt_id, did, pds_endpoint, handle, email, invite_code, 191 191 + last_status, last_error, archived_at, tombstone_op_cid, notes) 192 192 + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)` 193 193 + ) 194 194 + .bind( 195 195 + "partial", 196 196 + "did:plc:partial", 197 197 + "https://pds.test", 198 198 + "partial.pds.test", 199 199 + "partial@x.test", 200 200 + null, 201 201 + "genesis_submitted", 202 202 + null, 203 203 + Date.now(), 204 204 + "cid-first", 205 205 + null 206 206 + ) 207 207 + .run(); 208 208 + 209 209 + // The retry must not hit a PRIMARY KEY conflict on the archive INSERT. 210 210 + await expect( 211 211 + adapter.archiveStuckAttempt("partial", { tombstoneOpCid: "cid-retry" }) 212 212 + ).resolves.toBeUndefined(); 213 213 + 214 214 + // Live row is now gone; the archive row remains (the original landed copy). 215 215 + expect(await adapter.getProvisionAttempt("partial")).toBeNull(); 216 216 + const archive = await db 217 217 + .prepare("SELECT * FROM provision_attempts_archive WHERE attempt_id = ?") 218 218 + .bind("partial") 219 219 + .first<Record<string, any>>(); 220 220 + expect(archive).not.toBeNull(); 221 221 + expect(archive!.tombstone_op_cid).toBe("cid-first"); 222 222 + }); 223 223 + }); 224 224 + 225 225 + it("enforces did uniqueness across attempts", async () => { 226 226 + await adapter.createProvisionAttempt({ 227 227 + attemptId: "first", 228 228 + did: "did:plc:dupe", 229 229 + pdsEndpoint: "https://pds.test", 230 230 + handle: "first.pds.test", 231 231 + email: "first@x.test", 232 232 + encryptedSigningKey: "sk", 233 233 + encryptedRotationKey: "rk", 234 234 + }); 235 235 + await expect( 236 236 + adapter.createProvisionAttempt({ 237 237 + attemptId: "second", 238 238 + did: "did:plc:dupe", 239 239 + pdsEndpoint: "https://pds.test", 240 240 + handle: "second.pds.test", 241 241 + email: "second@x.test", 242 242 + encryptedSigningKey: "sk", 243 243 + encryptedRotationKey: "rk", 244 244 + }) 245 245 + ).rejects.toThrow(); 246 246 + }); 247 247 + });

+301

packages/contrail-community/tests/community-provision-pds-allowlist.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { Hono } from "hono"; 3 3 + import type { MiddlewareHandler } from "hono"; 4 4 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 5 5 + import { initSchema } from "@atmo-dev/contrail"; 6 6 + import { createApp } from "@atmo-dev/contrail"; 7 7 + import { resolveConfig } from "@atmo-dev/contrail"; 8 8 + import type { ContrailConfig } from "@atmo-dev/contrail"; 9 9 + import { createCommunityIntegration } from "../src/integration"; 10 10 + import { normalizePdsEndpoint } from "../src/pds"; 11 11 + 12 12 + const ALICE = "did:plc:alice"; 13 13 + const MASTER_KEY = new Uint8Array(32).fill(99); 14 14 + const ALLOWED_PDS = "https://allowed.pds.test"; 15 15 + const ATTACKER_PDS = "https://attacker.pds.test"; 16 16 + const PLC_DIRECTORY = "https://plc.test"; 17 17 + 18 18 + const FAKE_ACCESS_JWT = "head.body.sig"; 19 19 + 20 20 + async function mockFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> { 21 21 + const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url; 22 22 + const method = init?.method ?? "GET"; 23 23 + const body = init?.body ? JSON.parse(init.body as string) : {}; 24 24 + 25 25 + if (url === `${ALLOWED_PDS}/xrpc/com.atproto.server.describeServer`) { 26 26 + return new Response(JSON.stringify({ did: "did:web:allowed.pds.test" }), { 27 27 + status: 200, 28 28 + headers: { "content-type": "application/json" }, 29 29 + }); 30 30 + } 31 31 + if (url.startsWith(`${PLC_DIRECTORY}/`) && !url.endsWith("/log/last") && method === "POST") { 32 32 + return new Response("{}", { status: 200, headers: { "content-type": "application/json" } }); 33 33 + } 34 34 + if (url.endsWith("/log/last") && method === "GET") { 35 35 + return new Response(JSON.stringify({ cid: "bafyreitestcid" }), { 36 36 + status: 200, 37 37 + headers: { "content-type": "application/json" }, 38 38 + }); 39 39 + } 40 40 + if (url === `${ALLOWED_PDS}/xrpc/com.atproto.server.createAccount` && method === "POST") { 41 41 + return new Response( 42 42 + JSON.stringify({ 43 43 + did: body.did, 44 44 + handle: body.handle, 45 45 + accessJwt: FAKE_ACCESS_JWT, 46 46 + refreshJwt: "RT", 47 47 + }), 48 48 + { status: 200, headers: { "content-type": "application/json" } } 49 49 + ); 50 50 + } 51 51 + if (url === `${ALLOWED_PDS}/xrpc/com.atproto.identity.getRecommendedDidCredentials`) { 52 52 + return new Response( 53 53 + JSON.stringify({ 54 54 + rotationKeys: [], 55 55 + verificationMethods: { atproto: "did:key:zPdsSig" }, 56 56 + alsoKnownAs: ["at://newcomm.allowed.pds.test"], 57 57 + services: { 58 58 + atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: ALLOWED_PDS }, 59 59 + }, 60 60 + }), 61 61 + { status: 200, headers: { "content-type": "application/json" } } 62 62 + ); 63 63 + } 64 64 + if (url === `${ALLOWED_PDS}/xrpc/com.atproto.server.activateAccount` && method === "POST") { 65 65 + return new Response("{}", { status: 200, headers: { "content-type": "application/json" } }); 66 66 + } 67 67 + if (url === `${ALLOWED_PDS}/xrpc/com.atproto.server.createAppPassword` && method === "POST") { 68 68 + return new Response( 69 69 + JSON.stringify({ name: body.name, password: "minted-app-pw" }), 70 70 + { status: 200, headers: { "content-type": "application/json" } } 71 71 + ); 72 72 + } 73 73 + return new Response(`unmocked: ${method} ${url}`, { status: 404 }); 74 74 + } 75 75 + 76 76 + function buildConfig( 77 77 + allowedProvisionPdsEndpoints: string[] | undefined, 78 78 + extra: { allowAnyProvisionPdsEndpoint?: boolean } = {} 79 79 + ): ContrailConfig { 80 80 + return { 81 81 + namespace: "test.comm", 82 82 + collections: { message: { collection: "app.event.message" } }, 83 83 + spaces: { 84 84 + authority: { 85 85 + type: "tools.atmo.event.space", 86 86 + serviceDid: "did:web:test.example#svc", 87 87 + }, 88 88 + recordHost: {}, 89 89 + }, 90 90 + community: { 91 91 + masterKey: MASTER_KEY, 92 92 + plcDirectory: PLC_DIRECTORY, 93 93 + fetch: mockFetch, 94 94 + allowedProvisionPdsEndpoints, 95 95 + allowProvisioning: true, 96 96 + allowAnyProvisionPdsEndpoint: extra.allowAnyProvisionPdsEndpoint, 97 97 + }, 98 98 + }; 99 99 + } 100 100 + 101 101 + function fakeAuth(): MiddlewareHandler { 102 102 + return async (c, next) => { 103 103 + const did = c.req.header("X-Test-Did"); 104 104 + if (!did) return c.json({ error: "AuthRequired" }, 401); 105 105 + c.set("serviceAuth", { issuer: did, audience: "did:web:test.example#svc", lxm: undefined }); 106 106 + await next(); 107 107 + }; 108 108 + } 109 109 + 110 110 + async function makeApp( 111 111 + allowedProvisionPdsEndpoints: string[] | undefined, 112 112 + extra: { allowAnyProvisionPdsEndpoint?: boolean } = {} 113 113 + ): Promise<Hono> { 114 114 + const db = createSqliteDatabase(":memory:"); 115 115 + const cfg = buildConfig(allowedProvisionPdsEndpoints, extra); 116 116 + const resolved = resolveConfig(cfg); 117 117 + const community = createCommunityIntegration({ db, config: resolved }); 118 118 + await initSchema(db, resolved, { extraSchemas: [community.applySchema] }); 119 119 + return createApp(db, resolved, { spaces: { authMiddleware: fakeAuth() }, community }); 120 120 + } 121 121 + 122 122 + async function call(app: Hono, body: any): Promise<Response> { 123 123 + return await app.fetch( 124 124 + new Request(`http://localhost/xrpc/test.comm.community.provision`, { 125 125 + method: "POST", 126 126 + headers: { "X-Test-Did": ALICE, "Content-Type": "application/json" }, 127 127 + body: JSON.stringify(body), 128 128 + }) 129 129 + ); 130 130 + } 131 131 + 132 132 + describe("provision pdsEndpoint allowlist (M3)", () => { 133 133 + it("rejects pdsEndpoint not in allowedProvisionPdsEndpoints", async () => { 134 134 + const app = await makeApp([ALLOWED_PDS]); 135 135 + const res = await call(app, { 136 136 + handle: "newcomm.attacker.pds.test", 137 137 + email: "x@x.test", 138 138 + password: "secret", 139 139 + pdsEndpoint: ATTACKER_PDS, 140 140 + rotationKey: "did:key:zStubCallerRotationKey", 141 141 + }); 142 142 + expect(res.status).toBe(400); 143 143 + const j = (await res.json()) as { error: string; message: string }; 144 144 + expect(j.error).toBe("InvalidRequest"); 145 145 + expect(j.message).toMatch(/pdsEndpoint/i); 146 146 + }); 147 147 + 148 148 + it("accepts pdsEndpoint that is in allowedProvisionPdsEndpoints", async () => { 149 149 + const app = await makeApp([ALLOWED_PDS]); 150 150 + const res = await call(app, { 151 151 + handle: "newcomm.allowed.pds.test", 152 152 + email: "x@x.test", 153 153 + password: "secret", 154 154 + inviteCode: "code-x", 155 155 + pdsEndpoint: ALLOWED_PDS, 156 156 + rotationKey: "did:key:zStubCallerRotationKey", 157 157 + }); 158 158 + expect(res.status).toBe(200); 159 159 + }); 160 160 + 161 161 + it("fails closed: provisioning enabled + undefined allowlist → rejected", async () => { 162 162 + const app = await makeApp(undefined); 163 163 + const res = await call(app, { 164 164 + handle: "newcomm.allowed.pds.test", 165 165 + email: "x@x.test", 166 166 + password: "secret", 167 167 + inviteCode: "code-x", 168 168 + pdsEndpoint: ALLOWED_PDS, 169 169 + rotationKey: "did:key:zStubCallerRotationKey", 170 170 + }); 171 171 + expect(res.status).toBe(403); 172 172 + const j = (await res.json()) as { error: string; message: string }; 173 173 + expect(j.error).toBe("ProvisioningMisconfigured"); 174 174 + expect(j.message).toMatch( 175 175 + /allowlist|allowedProvisionPdsEndpoints|allowAnyProvisionPdsEndpoint/i 176 176 + ); 177 177 + }); 178 178 + 179 179 + it("fails closed: provisioning enabled + empty allowlist → rejected", async () => { 180 180 + const app = await makeApp([]); 181 181 + const res = await call(app, { 182 182 + handle: "newcomm.allowed.pds.test", 183 183 + email: "x@x.test", 184 184 + password: "secret", 185 185 + inviteCode: "code-x", 186 186 + pdsEndpoint: ALLOWED_PDS, 187 187 + rotationKey: "did:key:zStubCallerRotationKey", 188 188 + }); 189 189 + expect(res.status).toBe(403); 190 190 + const j = (await res.json()) as { error: string; message: string }; 191 191 + expect(j.error).toBe("ProvisioningMisconfigured"); 192 192 + }); 193 193 + 194 194 + it("allowAnyProvisionPdsEndpoint=true is a loud opt-in: empty allowlist accepts any pdsEndpoint", async () => { 195 195 + const app = await makeApp([], { allowAnyProvisionPdsEndpoint: true }); 196 196 + const res = await call(app, { 197 197 + handle: "newcomm.allowed.pds.test", 198 198 + email: "x@x.test", 199 199 + password: "secret", 200 200 + inviteCode: "code-x", 201 201 + pdsEndpoint: ALLOWED_PDS, 202 202 + rotationKey: "did:key:zStubCallerRotationKey", 203 203 + }); 204 204 + expect(res.status).toBe(200); 205 205 + }); 206 206 + 207 207 + it("matches when caller adds a trailing slash to a slash-less allowlist entry", async () => { 208 208 + const app = await makeApp([ALLOWED_PDS]); 209 209 + const res = await call(app, { 210 210 + handle: "newcomm.allowed.pds.test", 211 211 + email: "x@x.test", 212 212 + password: "secret", 213 213 + inviteCode: "code-x", 214 214 + pdsEndpoint: `${ALLOWED_PDS}/`, 215 215 + rotationKey: "did:key:zStubCallerRotationKey", 216 216 + }); 217 217 + expect(res.status).toBe(200); 218 218 + }); 219 219 + 220 220 + it("matches when caller uppercases the scheme on an allowlisted endpoint", async () => { 221 221 + const app = await makeApp([ALLOWED_PDS]); 222 222 + const res = await call(app, { 223 223 + handle: "newcomm.allowed.pds.test", 224 224 + email: "x@x.test", 225 225 + password: "secret", 226 226 + inviteCode: "code-x", 227 227 + pdsEndpoint: ALLOWED_PDS.replace(/^https/, "HTTPS"), 228 228 + rotationKey: "did:key:zStubCallerRotationKey", 229 229 + }); 230 230 + expect(res.status).toBe(200); 231 231 + }); 232 232 + 233 233 + it("matches when caller appends the default :443 port", async () => { 234 234 + const app = await makeApp([ALLOWED_PDS]); 235 235 + const res = await call(app, { 236 236 + handle: "newcomm.allowed.pds.test", 237 237 + email: "x@x.test", 238 238 + password: "secret", 239 239 + inviteCode: "code-x", 240 240 + pdsEndpoint: ALLOWED_PDS.replace(/^https:\/\/([^/]+)/, "https://$1:443"), 241 241 + rotationKey: "did:key:zStubCallerRotationKey", 242 242 + }); 243 243 + expect(res.status).toBe(200); 244 244 + }); 245 245 + 246 246 + it("rejects pdsEndpoint that is not a parseable URL", async () => { 247 247 + const app = await makeApp([ALLOWED_PDS]); 248 248 + const res = await call(app, { 249 249 + handle: "newcomm.allowed.pds.test", 250 250 + email: "x@x.test", 251 251 + password: "secret", 252 252 + pdsEndpoint: "not a url", 253 253 + rotationKey: "did:key:zStubCallerRotationKey", 254 254 + }); 255 255 + expect(res.status).toBe(400); 256 256 + const j = (await res.json()) as { error: string; message: string }; 257 257 + expect(j.error).toBe("InvalidRequest"); 258 258 + expect(j.message).toMatch(/parseable|url/i); 259 259 + }); 260 260 + }); 261 261 + 262 262 + describe("normalizePdsEndpoint", () => { 263 263 + it("collapses scheme case", () => { 264 264 + expect(normalizePdsEndpoint("HTTPS://pds.example.com")).toBe( 265 265 + "https://pds.example.com" 266 266 + ); 267 267 + }); 268 268 + it("collapses host case", () => { 269 269 + expect(normalizePdsEndpoint("https://PDS.Example.com")).toBe( 270 270 + "https://pds.example.com" 271 271 + ); 272 272 + }); 273 273 + it("strips trailing slash", () => { 274 274 + expect(normalizePdsEndpoint("https://pds.example.com/")).toBe( 275 275 + "https://pds.example.com" 276 276 + ); 277 277 + }); 278 278 + it("strips default :443 for https", () => { 279 279 + expect(normalizePdsEndpoint("https://pds.example.com:443")).toBe( 280 280 + "https://pds.example.com" 281 281 + ); 282 282 + }); 283 283 + it("strips default :80 for http", () => { 284 284 + expect(normalizePdsEndpoint("http://pds.example.com:80")).toBe( 285 285 + "http://pds.example.com" 286 286 + ); 287 287 + }); 288 288 + it("preserves a non-default port", () => { 289 289 + expect(normalizePdsEndpoint("https://pds.example.com:8443")).toBe( 290 290 + "https://pds.example.com:8443" 291 291 + ); 292 292 + }); 293 293 + it("converts an IDN hostname to its punycode form", () => { 294 294 + expect(normalizePdsEndpoint("https://exämple.com")).toBe( 295 295 + "https://xn--exmple-cua.com" 296 296 + ); 297 297 + }); 298 298 + it("throws on an unparseable URL", () => { 299 299 + expect(() => normalizePdsEndpoint("not a url")).toThrow(); 300 300 + }); 301 301 + });

+336

packages/contrail-community/tests/community-provision-router.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeAll } from "vitest"; 2 2 + import { Hono } from "hono"; 3 3 + import type { MiddlewareHandler } from "hono"; 4 4 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 5 5 + import { initSchema } from "@atmo-dev/contrail"; 6 6 + import { createApp } from "@atmo-dev/contrail"; 7 7 + import { createCommunityIntegration } from "../src/integration"; 8 8 + import { resolveConfig } from "@atmo-dev/contrail"; 9 9 + import type { ContrailConfig } from "@atmo-dev/contrail"; 10 10 + 11 11 + const ALICE = "did:plc:alice"; 12 12 + const MASTER_KEY = new Uint8Array(32).fill(99); 13 13 + const PDS_ENDPOINT = "https://pds.test"; 14 14 + const PLC_DIRECTORY = "https://plc.test"; 15 15 + /** The DID describeServer claims for this PDS. INTENTIONALLY DIFFERENT from 16 16 + * CONFIG.spaces.serviceDid so tests can detect a regression where the route 17 17 + * falls back to the spaces DID instead of resolving the PDS DID dynamically. */ 18 18 + const PDS_DESCRIBE_DID = "did:web:pds.test"; 19 19 + 20 20 + /** Captures upstream calls so we can assert the right RPCs ran. */ 21 21 + const upstreamCalls: Array<{ url: string; method: string; body: any; authorization?: string }> = []; 22 22 + 23 23 + // Placeholder JWT — the orchestrator passes accessJwt through to PDS calls 24 24 + // untouched; nothing in the contrail flow parses its claims. 25 25 + const FAKE_ACCESS_JWT = "head.body.sig"; 26 26 + 27 27 + async function mockFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> { 28 28 + const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url; 29 29 + const method = init?.method ?? "GET"; 30 30 + const body = init?.body ? JSON.parse(init.body as string) : {}; 31 31 + const headers = new Headers(init?.headers ?? {}); 32 32 + upstreamCalls.push({ 33 33 + url, 34 34 + method, 35 35 + body, 36 36 + authorization: headers.get("authorization") ?? undefined, 37 37 + }); 38 38 + 39 39 + // PDS describeServer — used by the route to resolve the target PDS's DID 40 40 + // for service-auth JWT `aud`. 41 41 + if (url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.describeServer`) { 42 42 + return new Response(JSON.stringify({ did: PDS_DESCRIBE_DID }), { 43 43 + status: 200, 44 44 + headers: { "content-type": "application/json" }, 45 45 + }); 46 46 + } 47 47 + // PLC submit: POST {plcDirectory}/{did} (genesis + update share the URL). 48 48 + if (url.startsWith(`${PLC_DIRECTORY}/`) && url.endsWith("/log/last") === false && method === "POST") { 49 49 + return new Response("{}", { status: 200, headers: { "content-type": "application/json" } }); 50 50 + } 51 51 + // PLC log/last: not used in the happy path but be defensive. 52 52 + if (url.endsWith("/log/last") && method === "GET") { 53 53 + return new Response(JSON.stringify({ cid: "bafyreitestcid" }), { 54 54 + status: 200, 55 55 + headers: { "content-type": "application/json" }, 56 56 + }); 57 57 + } 58 58 + // PDS createAccount. 59 59 + if (url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.createAccount` && method === "POST") { 60 60 + return new Response( 61 61 + JSON.stringify({ 62 62 + did: body.did, 63 63 + handle: body.handle, 64 64 + accessJwt: FAKE_ACCESS_JWT, 65 65 + refreshJwt: "RT", 66 66 + }), 67 67 + { status: 200, headers: { "content-type": "application/json" } } 68 68 + ); 69 69 + } 70 70 + // PDS getRecommendedDidCredentials. 71 71 + if ( 72 72 + url === `${PDS_ENDPOINT}/xrpc/com.atproto.identity.getRecommendedDidCredentials` 73 73 + ) { 74 74 + return new Response( 75 75 + JSON.stringify({ 76 76 + rotationKeys: [], 77 77 + verificationMethods: { atproto: "did:key:zPdsSig" }, 78 78 + alsoKnownAs: ["at://newcomm.pds.test"], 79 79 + services: { 80 80 + atproto_pds: { 81 81 + type: "AtprotoPersonalDataServer", 82 82 + endpoint: PDS_ENDPOINT, 83 83 + }, 84 84 + }, 85 85 + }), 86 86 + { status: 200, headers: { "content-type": "application/json" } } 87 87 + ); 88 88 + } 89 89 + // PDS activateAccount. 90 90 + if (url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.activateAccount` && method === "POST") { 91 91 + return new Response("{}", { status: 200, headers: { "content-type": "application/json" } }); 92 92 + } 93 93 + // PDS createAppPassword (post-activation, mints publishing credential). 94 94 + if (url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.createAppPassword` && method === "POST") { 95 95 + return new Response( 96 96 + JSON.stringify({ name: body.name, password: "minted-app-pw" }), 97 97 + { status: 200, headers: { "content-type": "application/json" } } 98 98 + ); 99 99 + } 100 100 + 101 101 + return new Response(`unmocked: ${method} ${url}`, { status: 404 }); 102 102 + } 103 103 + 104 104 + const CONFIG: ContrailConfig = { 105 105 + namespace: "test.comm", 106 106 + collections: { message: { collection: "app.event.message" } }, 107 107 + spaces: { 108 108 + authority: { 109 109 + type: "tools.atmo.event.space", 110 110 + serviceDid: "did:web:test.example#svc", 111 111 + }, 112 112 + recordHost: {}, 113 113 + }, 114 114 + community: { 115 115 + masterKey: MASTER_KEY, 116 116 + plcDirectory: PLC_DIRECTORY, 117 117 + fetch: mockFetch, 118 118 + allowProvisioning: true, 119 119 + // Fail-closed requires a non-empty allowlist when provisioning is enabled. 120 120 + allowedProvisionPdsEndpoints: [PDS_ENDPOINT], 121 121 + }, 122 122 + }; 123 123 + 124 124 + function fakeAuth(): MiddlewareHandler { 125 125 + return async (c, next) => { 126 126 + const did = c.req.header("X-Test-Did"); 127 127 + if (!did) return c.json({ error: "AuthRequired" }, 401); 128 128 + c.set("serviceAuth", { issuer: did, audience: CONFIG.spaces!.authority!.serviceDid, lxm: undefined }); 129 129 + await next(); 130 130 + }; 131 131 + } 132 132 + 133 133 + async function makeApp(): Promise<Hono> { 134 134 + const db = createSqliteDatabase(":memory:"); 135 135 + const resolved = resolveConfig(CONFIG); 136 136 + const community = createCommunityIntegration({ db, config: resolved }); 137 137 + await initSchema(db, resolved, { extraSchemas: [community.applySchema] }); 138 138 + return createApp(db, resolved, { spaces: { authMiddleware: fakeAuth() }, community }); 139 139 + } 140 140 + 141 141 + async function call( 142 142 + app: Hono, 143 143 + method: string, 144 144 + path: string, 145 145 + did: string | null, 146 146 + body?: any 147 147 + ): Promise<Response> { 148 148 + const headers: Record<string, string> = {}; 149 149 + if (did !== null) headers["X-Test-Did"] = did; 150 150 + if (body !== undefined) headers["Content-Type"] = "application/json"; 151 151 + return await app.fetch( 152 152 + new Request(`http://localhost${path}`, { 153 153 + method, 154 154 + headers, 155 155 + body: body !== undefined ? JSON.stringify(body) : undefined, 156 156 + }) 157 157 + ); 158 158 + } 159 159 + 160 160 + describe("POST /xrpc/{ns}.community.provision (allowProvisioning gate)", () => { 161 161 + // Builds an app whose community config OMITS allowProvisioning. The route 162 162 + // is expected to refuse with 403 ProvisioningDisabled — operators must 163 163 + // explicitly opt in. The default-deny posture protects deployments where 164 164 + // the auth middleware allows broader audiences than "operator only" from 165 165 + // having any authenticated caller mint communities + burn invite codes. 166 166 + async function makeAppWithoutAllowProvisioning(): Promise<Hono> { 167 167 + const db = createSqliteDatabase(":memory:"); 168 168 + const configWithoutFlag: ContrailConfig = { 169 169 + ...CONFIG, 170 170 + community: { ...CONFIG.community!, allowProvisioning: undefined } as any, 171 171 + }; 172 172 + const resolved = resolveConfig(configWithoutFlag); 173 173 + const community = createCommunityIntegration({ db, config: resolved }); 174 174 + await initSchema(db, resolved, { extraSchemas: [community.applySchema] }); 175 175 + return createApp(db, resolved, { spaces: { authMiddleware: fakeAuth() }, community }); 176 176 + } 177 177 + 178 178 + it("returns 403 ProvisioningDisabled when allowProvisioning is not set", async () => { 179 179 + const app = await makeAppWithoutAllowProvisioning(); 180 180 + const res = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, { 181 181 + handle: "newcomm.pds.test", 182 182 + email: "newcomm@x.test", 183 183 + password: "secret", 184 184 + pdsEndpoint: PDS_ENDPOINT, 185 185 + rotationKey: "did:key:zStubCallerRotationKey", 186 186 + }); 187 187 + expect(res.status).toBe(403); 188 188 + const body = (await res.json()) as { error: string }; 189 189 + expect(body.error).toBe("ProvisioningDisabled"); 190 190 + }); 191 191 + }); 192 192 + 193 193 + describe("POST /xrpc/{ns}.community.provision", () => { 194 194 + let app: Hono; 195 195 + 196 196 + beforeAll(async () => { 197 197 + app = await makeApp(); 198 198 + }); 199 199 + 200 200 + it("requires auth", async () => { 201 201 + const res = await call(app, "POST", "/xrpc/test.comm.community.provision", null, { 202 202 + handle: "x.pds.test", 203 203 + email: "x@x.test", 204 204 + password: "p", 205 205 + pdsEndpoint: PDS_ENDPOINT, 206 206 + rotationKey: "did:key:zStubCallerRotationKey", 207 207 + }); 208 208 + expect(res.status).toBe(401); 209 209 + }); 210 210 + 211 211 + it("rejects missing required fields", async () => { 212 212 + const res = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, {}); 213 213 + expect(res.status).toBe(400); 214 214 + const j = (await res.json()) as { error: string }; 215 215 + expect(j.error).toBe("InvalidRequest"); 216 216 + }); 217 217 + 218 218 + it("provisions a community and returns did + status=activated", async () => { 219 219 + const before = upstreamCalls.length; 220 220 + const res = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, { 221 221 + handle: "newcomm.pds.test", 222 222 + email: "newcomm@x.test", 223 223 + password: "secret", 224 224 + inviteCode: "code-x", 225 225 + pdsEndpoint: PDS_ENDPOINT, 226 226 + rotationKey: "did:key:zStubCallerRotationKey", 227 227 + }); 228 228 + expect(res.status).toBe(200); 229 229 + const body = (await res.json()) as { communityDid: string; status: string }; 230 230 + 231 231 + expect(body.communityDid).toMatch(/^did:plc:[a-z2-7]{24}$/); 232 232 + expect(body.status).toBe("activated"); 233 233 + 234 234 + // Verify the row was inserted into communities with mode='provision'. 235 235 + // We round-trip via the GET list endpoint so we don't have to reach into 236 236 + // the adapter — the route bootstrapped reserved spaces with the caller as 237 237 + // owner, which makes the community reachable. 238 238 + const listRes = await call(app, "GET", "/xrpc/test.comm.community.list", ALICE); 239 239 + expect(listRes.status).toBe(200); 240 240 + const list = (await listRes.json()) as { 241 241 + communities: Array<{ did: string; mode: string }>; 242 242 + }; 243 243 + const row = list.communities.find((r) => r.did === body.communityDid); 244 244 + expect(row).toBeDefined(); 245 245 + expect(row!.mode).toBe("provision"); 246 246 + 247 247 + // Confirm we touched all five upstream RPCs: 2 PLC posts (genesis + update), 248 248 + // createAccount, getRecommendedDidCredentials, activateAccount. 249 249 + const ourCalls = upstreamCalls.slice(before); 250 250 + const plcPosts = ourCalls.filter( 251 251 + (c) => c.url.startsWith(`${PLC_DIRECTORY}/`) && c.method === "POST" 252 252 + ); 253 253 + expect(plcPosts.length).toBe(2); 254 254 + expect( 255 255 + ourCalls.some((c) => 256 256 + c.url.endsWith("/xrpc/com.atproto.server.createAccount") 257 257 + ) 258 258 + ).toBe(true); 259 259 + expect( 260 260 + ourCalls.some((c) => 261 261 + c.url.endsWith("/xrpc/com.atproto.identity.getRecommendedDidCredentials") 262 262 + ) 263 263 + ).toBe(true); 264 264 + expect( 265 265 + ourCalls.some((c) => 266 266 + c.url.endsWith("/xrpc/com.atproto.server.activateAccount") 267 267 + ) 268 268 + ).toBe(true); 269 269 + }); 270 270 + 271 271 + it("is idempotent on retry with the same attemptId after a fully-completed first call", async () => { 272 272 + // The route already returns attemptId on every error response so a 273 273 + // caller can retry. This guards the case where the first call 274 274 + // succeeded end-to-end (orchestrator + graduation + reserved spaces) 275 275 + // but the caller didn't receive the 200 (e.g. lost connection): a 276 276 + // resent request with the same attemptId must still 200, return the 277 277 + // same DID, and not double-create rows. 278 278 + const attemptId = "retry-idem-1"; 279 279 + const body = { 280 280 + attemptId, 281 281 + handle: "retryidem.pds.test", 282 282 + email: "retryidem@x.test", 283 283 + password: "secret", 284 284 + pdsEndpoint: PDS_ENDPOINT, 285 285 + rotationKey: "did:key:zStubCallerRotationKey", 286 286 + }; 287 287 + 288 288 + const first = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, body); 289 289 + expect(first.status).toBe(200); 290 290 + const firstJson = (await first.json()) as { communityDid: string }; 291 291 + 292 292 + const second = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, body); 293 293 + expect(second.status).toBe(200); 294 294 + const secondJson = (await second.json()) as { communityDid: string }; 295 295 + 296 296 + expect(secondJson.communityDid).toBe(firstJson.communityDid); 297 297 + }); 298 298 + 299 299 + it("uses the describeServer-returned DID as the service-auth JWT audience (not cfg.serviceDid)", async () => { 300 300 + const before = upstreamCalls.length; 301 301 + const res = await call(app, "POST", "/xrpc/test.comm.community.provision", ALICE, { 302 302 + handle: "audtest.pds.test", 303 303 + email: "audtest@x.test", 304 304 + password: "secret", 305 305 + pdsEndpoint: PDS_ENDPOINT, 306 306 + rotationKey: "did:key:zStubCallerRotationKey", 307 307 + }); 308 308 + expect(res.status).toBe(200); 309 309 + 310 310 + const ourCalls = upstreamCalls.slice(before); 311 311 + 312 312 + // 1. The route must call describeServer on the target PDS. 313 313 + const describeCall = ourCalls.find( 314 314 + (c) => c.url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.describeServer` 315 315 + ); 316 316 + expect(describeCall).toBeDefined(); 317 317 + 318 318 + // 2. The createAccount call's Authorization Bearer JWT must have 319 319 + // `aud` === the describeServer-returned DID, NOT cfg.serviceDid. 320 320 + const createAccountCall = ourCalls.find( 321 321 + (c) => c.url === `${PDS_ENDPOINT}/xrpc/com.atproto.server.createAccount` 322 322 + ); 323 323 + expect(createAccountCall).toBeDefined(); 324 324 + expect(createAccountCall!.authorization).toMatch(/^Bearer /); 325 325 + 326 326 + const jwt = createAccountCall!.authorization!.replace(/^Bearer /, ""); 327 327 + const payloadSeg = jwt.split(".")[1]!; 328 328 + const padded = payloadSeg.replace(/-/g, "+").replace(/_/g, "/"); 329 329 + const padding = "=".repeat((4 - (padded.length % 4)) % 4); 330 330 + const claims = JSON.parse(atob(padded + padding)) as { aud?: string }; 331 331 + 332 332 + expect(claims.aud).toBe(PDS_DESCRIBE_DID); 333 333 + // Sanity: it is NOT the spaces serviceDid (the previous hardcoded value). 334 334 + expect(claims.aud).not.toBe(CONFIG.spaces!.authority!.serviceDid); 335 335 + }); 336 336 + });

+150

packages/contrail-community/tests/community-publish-401-clears-session.test.ts

Reviewed

··· 1 1 + /** L6: A 401 from the publish path used to leave the bad session in the 2 2 + * cache, so every subsequent publish hit the same 401 permanently. The fix 3 3 + * is small: on 401, drop the cached session row. The next request goes cold 4 4 + * through ensureSession, which mints a fresh session from the stored app 5 5 + * password (or fails permanently if the app password itself was revoked). */ 6 6 + 7 7 + import { describe, it, expect, beforeEach } from "vitest"; 8 8 + import { Hono } from "hono"; 9 9 + import type { MiddlewareHandler } from "hono"; 10 10 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 11 11 + import { initSchema } from "@atmo-dev/contrail"; 12 12 + import { createApp } from "@atmo-dev/contrail"; 13 13 + import { createCommunityIntegration } from "../src/integration"; 14 14 + import { resolveConfig } from "@atmo-dev/contrail"; 15 15 + import type { ContrailConfig } from "@atmo-dev/contrail"; 16 16 + import { 17 17 + CommunityAdapter, 18 18 + CredentialCipher, 19 19 + RESERVED_KEYS, 20 20 + } from "../src"; 21 21 + import { HostedAdapter } from "@atmo-dev/contrail"; 22 22 + import { buildSpaceUri } from "@atmo-dev/contrail"; 23 23 + 24 24 + const ALICE = "did:plc:alice"; 25 25 + const COMMUNITY_DID = "did:plc:l6comm"; 26 26 + const HANDLE = "l6.pds.test"; 27 27 + const PDS = "https://pds.example"; 28 28 + const MASTER_KEY = new Uint8Array(32).fill(13); 29 29 + const APP_PASSWORD = "correct-pw"; 30 30 + 31 31 + function fakeAuth(spaceServiceDid: string): MiddlewareHandler { 32 32 + return async (c, next) => { 33 33 + const did = c.req.header("X-Test-Did"); 34 34 + if (!did) return c.json({ error: "AuthRequired" }, 401); 35 35 + c.set("serviceAuth", { 36 36 + issuer: did, 37 37 + audience: spaceServiceDid, 38 38 + lxm: undefined, 39 39 + }); 40 40 + await next(); 41 41 + }; 42 42 + } 43 43 + 44 44 + async function build(): Promise<{ app: Hono; adapter: CommunityAdapter }> { 45 45 + const fetchImpl: typeof fetch = (async (input: RequestInfo | URL) => { 46 46 + const url = 47 47 + typeof input === "string" 48 48 + ? input 49 49 + : input instanceof URL 50 50 + ? input.href 51 51 + : input.url; 52 52 + if (url.endsWith("/xrpc/com.atproto.repo.createRecord")) { 53 53 + return new Response(JSON.stringify({ error: "AuthRequired" }), { 54 54 + status: 401, 55 55 + }); 56 56 + } 57 57 + return new Response("not found", { status: 404 }); 58 58 + }) as typeof fetch; 59 59 + 60 60 + const config: ContrailConfig = { 61 61 + namespace: "test.comm", 62 62 + collections: { message: { collection: "app.event.message" } }, 63 63 + spaces: { 64 64 + authority: { 65 65 + type: "tools.atmo.event.space", 66 66 + serviceDid: "did:web:test.example#svc", 67 67 + }, 68 68 + recordHost: {}, 69 69 + }, 70 70 + community: { masterKey: MASTER_KEY, fetch: fetchImpl }, 71 71 + }; 72 72 + const db = createSqliteDatabase(":memory:"); 73 73 + const resolved = resolveConfig(config); 74 74 + const communityIntegration = createCommunityIntegration({ db, config: resolved }); 75 75 + await initSchema(db, resolved, { extraSchemas: [communityIntegration.applySchema] }); 76 76 + const app = createApp(db, resolved, { 77 77 + spaces: { authMiddleware: fakeAuth(config.spaces!.authority!.serviceDid) }, 78 78 + community: communityIntegration, 79 79 + }); 80 80 + 81 81 + const cipher = new CredentialCipher(MASTER_KEY); 82 82 + const community = new CommunityAdapter(db); 83 83 + const spaces = new HostedAdapter(db, resolved); 84 84 + await community.createFromProvisioned({ 85 85 + did: COMMUNITY_DID, 86 86 + pdsEndpoint: PDS, 87 87 + handle: HANDLE, 88 88 + appPasswordEncrypted: await cipher.encrypt(APP_PASSWORD), 89 89 + createdBy: ALICE, 90 90 + }); 91 91 + for (const key of RESERVED_KEYS) { 92 92 + const uri = buildSpaceUri({ 93 93 + ownerDid: COMMUNITY_DID, 94 94 + type: config.spaces!.authority!.type, 95 95 + key, 96 96 + }); 97 97 + await spaces.createSpace({ 98 98 + uri, 99 99 + ownerDid: COMMUNITY_DID, 100 100 + type: config.spaces!.authority!.type, 101 101 + key, 102 102 + serviceDid: config.spaces!.authority!.serviceDid, 103 103 + appPolicyRef: null, 104 104 + appPolicy: null, 105 105 + }); 106 106 + await community.grant({ 107 107 + spaceUri: uri, 108 108 + subjectDid: ALICE, 109 109 + accessLevel: "owner", 110 110 + grantedBy: ALICE, 111 111 + }); 112 112 + await spaces.applyMembershipDiff(uri, [ALICE], [], ALICE); 113 113 + } 114 114 + return { app, adapter: community }; 115 115 + } 116 116 + 117 117 + describe("publish path: 401 clears the session cache (L6)", () => { 118 118 + let app: Hono; 119 119 + let adapter: CommunityAdapter; 120 120 + 121 121 + beforeEach(async () => { 122 122 + ({ app, adapter } = await build()); 123 123 + }); 124 124 + 125 125 + it("removes the cached session row when createRecord returns 401", async () => { 126 126 + // Seed a cached session that will be used (and rejected) by createRecord. 127 127 + await adapter.upsertSession(COMMUNITY_DID, { 128 128 + accessJwt: "stale-access", 129 129 + refreshJwt: "stale-refresh", 130 130 + accessExp: Math.floor(Date.now() / 1000) + 3600, 131 131 + }); 132 132 + expect(await adapter.getSession(COMMUNITY_DID)).not.toBeNull(); 133 133 + 134 134 + const res = await app.fetch( 135 135 + new Request("http://localhost/xrpc/test.comm.community.putRecord", { 136 136 + method: "POST", 137 137 + headers: { "X-Test-Did": ALICE, "Content-Type": "application/json" }, 138 138 + body: JSON.stringify({ 139 139 + communityDid: COMMUNITY_DID, 140 140 + collection: "app.event.message", 141 141 + record: { text: "hello" }, 142 142 + }), 143 143 + }) 144 144 + ); 145 145 + expect(res.status).toBe(502); 146 146 + 147 147 + // The stale session must be gone, so the next attempt mints a fresh one. 148 148 + expect(await adapter.getSession(COMMUNITY_DID)).toBeNull(); 149 149 + }); 150 150 + });

+366 -9

packages/contrail-community/tests/community-publishing.test.ts

Reviewed

··· 5 5 import { initSchema } from "@atmo-dev/contrail"; 6 6 import { createApp } from "@atmo-dev/contrail"; 7 7 import { resolveConfig } from "@atmo-dev/contrail"; 8 8 - import type { ContrailConfig } from "@atmo-dev/contrail"; 8 8 + import type { ContrailConfig, Database } from "@atmo-dev/contrail"; 9 9 import { createCommunityIntegration } from "../src/integration"; 10 10 + import { CommunityAdapter, CredentialCipher, RESERVED_KEYS } from "../src"; 11 11 + import { HostedAdapter } from "@atmo-dev/contrail"; 12 12 + import { buildSpaceUri } from "@atmo-dev/contrail"; 10 13 11 14 const ALICE = "did:plc:alice"; 12 15 const BOB = "did:plc:bob"; 13 16 const CHARLIE = "did:plc:charlie"; 14 17 const COMMUNITY_DID = "did:plc:pubcomm"; 18 18 + const PROVISION_COMMUNITY_DID = "did:plc:provcomm"; 19 19 + const PROVISION_HANDLE = "provcomm.pds.test"; 15 20 const PDS_ENDPOINT = "https://pds.example"; 16 21 17 22 const MASTER_KEY = new Uint8Array(32).fill(42); ··· 39 44 function mockResolver(): any { 40 45 return { 41 46 resolve: async (did: string) => { 42 42 - if (did !== COMMUNITY_DID) throw new Error("unknown did"); 47 47 + if (did !== COMMUNITY_DID && did !== PROVISION_COMMUNITY_DID) { 48 48 + throw new Error("unknown did"); 49 49 + } 43 50 return { 44 51 id: did, 45 52 service: [ ··· 60 67 pdsCalls.push({ url, body }); 61 68 if (url.endsWith("/xrpc/com.atproto.server.createSession")) { 62 69 if (body.password === "correct-pw" || body.password === "new-correct-pw") { 70 70 + // Echo back a DID that matches the identifier so adopt and provision flows 71 71 + // both look right to any caller checking session.did. 72 72 + const did = 73 73 + body.identifier === PROVISION_HANDLE ? PROVISION_COMMUNITY_DID : COMMUNITY_DID; 63 74 return new Response( 64 64 - JSON.stringify({ accessJwt: "a.b.c", refreshJwt: "r.r.r", did: COMMUNITY_DID }), 75 75 + JSON.stringify({ accessJwt: "a.b.c", refreshJwt: "r.r.r", did }), 65 76 { status: 200, headers: { "content-type": "application/json" } } 66 77 ); 67 78 } ··· 70 81 if (url.endsWith("/xrpc/com.atproto.repo.createRecord")) { 71 82 return new Response( 72 83 JSON.stringify({ 73 73 - uri: `at://${COMMUNITY_DID}/${body.collection}/fakerkey`, 84 84 + uri: `at://${body.repo}/${body.collection}/fakerkey`, 74 85 cid: "bafyfake", 75 86 }), 76 87 { status: 200, headers: { "content-type": "application/json" } } ··· 91 102 }; 92 103 } 93 104 94 94 - async function makeApp(): Promise<Hono> { 105 105 + async function makeApp(): Promise<{ app: Hono; db: Database }> { 95 106 const db = createSqliteDatabase(":memory:"); 96 107 const resolved = resolveConfig(CONFIG); 97 108 const community = createCommunityIntegration({ db, config: resolved }); 98 109 await initSchema(db, resolved, { extraSchemas: [community.applySchema] }); 99 99 - return createApp(db, resolved, { 110 110 + const app = createApp(db, resolved, { 100 111 spaces: { authMiddleware: fakeAuth() }, 101 112 community, 102 113 }); 114 114 + return { app, db }; 103 115 } 104 116 105 105 - function call( 117 117 + /** Seed a provision-mode community + its reserved spaces with `creator` as 118 118 + * owner. Mirrors what the adopt/provision routes do via `bootstrapReservedSpaces`, 119 119 + * but skips the route so we don't have to mock PLC + 5 PDS RPCs. */ 120 120 + async function seedProvisionCommunity( 121 121 + db: Database, 122 122 + creator: string, 123 123 + password: string 124 124 + ): Promise<void> { 125 125 + const cipher = new CredentialCipher(MASTER_KEY); 126 126 + const encrypted = await cipher.encrypt(password); 127 127 + const community = new CommunityAdapter(db); 128 128 + const spaces = new HostedAdapter(db, resolveConfig(CONFIG)); 129 129 + await community.createFromProvisioned({ 130 130 + did: PROVISION_COMMUNITY_DID, 131 131 + pdsEndpoint: PDS_ENDPOINT, 132 132 + handle: PROVISION_HANDLE, 133 133 + appPasswordEncrypted: encrypted, 134 134 + createdBy: creator, 135 135 + }); 136 136 + for (const key of RESERVED_KEYS) { 137 137 + const uri = buildSpaceUri({ 138 138 + ownerDid: PROVISION_COMMUNITY_DID, 139 139 + type: CONFIG.spaces!.authority!.type, 140 140 + key, 141 141 + }); 142 142 + await spaces.createSpace({ 143 143 + uri, 144 144 + ownerDid: PROVISION_COMMUNITY_DID, 145 145 + type: CONFIG.spaces!.authority!.type, 146 146 + key, 147 147 + serviceDid: CONFIG.spaces!.authority!.serviceDid, 148 148 + appPolicyRef: null, 149 149 + appPolicy: null, 150 150 + }); 151 151 + await community.grant({ 152 152 + spaceUri: uri, 153 153 + subjectDid: creator, 154 154 + accessLevel: "owner", 155 155 + grantedBy: creator, 156 156 + }); 157 157 + await spaces.applyMembershipDiff(uri, [creator], [], creator); 158 158 + } 159 159 + } 160 160 + 161 161 + async function call( 106 162 app: Hono, 107 163 method: string, 108 164 path: string, ··· 111 167 ): Promise<Response> { 112 168 const headers: Record<string, string> = { "X-Test-Did": did }; 113 169 if (body !== undefined) headers["Content-Type"] = "application/json"; 114 114 - return app.fetch( 170 170 + return await app.fetch( 115 171 new Request(`http://localhost${path}`, { 116 172 method, 117 173 headers, ··· 144 200 const admin = `ats://${COMMUNITY_DID}/tools.atmo.event.space/$admin`; 145 201 146 202 beforeAll(async () => { 147 147 - app = await makeApp(); 203 203 + ({ app } = await makeApp()); 148 204 await adopt(app, ALICE, "correct-pw"); 149 205 }); 150 206 ··· 273 329 expect(res.status).toBe(401); 274 330 }); 275 331 }); 332 332 + 333 333 + // Build a small base64url-encoded JWT with a given exp claim. The publishing 334 334 + // path decodes payload.exp to decide whether to reuse a cached session. 335 335 + function jwtWithExp(expSeconds: number): string { 336 336 + // base64url("{}") padding stripped — header content irrelevant to our tests. 337 337 + const header = "eyJhbGciOiJIUzI1NiJ9"; 338 338 + const payloadJson = JSON.stringify({ exp: expSeconds }); 339 339 + const payload = btoa(payloadJson) 340 340 + .replace(/\+/g, "-") 341 341 + .replace(/\//g, "_") 342 342 + .replace(/=+$/, ""); 343 343 + return `${header}.${payload}.sig`; 344 344 + } 345 345 + 346 346 + /** Build an isolated app with a per-test scenario fetch + a fresh provision 347 347 + * community. The scenario fetch records every call with its url + body + 348 348 + * authorization header so individual tests can assert exact behavior. */ 349 349 + async function makeScenarioApp(scenario: { 350 350 + /** Override response for createSession. Default: success with default JWT. */ 351 351 + onCreateSession?: () => Response; 352 352 + /** Override response for refreshSession. Default: 400 (no refresh). */ 353 353 + onRefreshSession?: () => Response; 354 354 + }): Promise<{ 355 355 + app: Hono; 356 356 + db: Database; 357 357 + calls: Array<{ url: string; body: any; authorization: string | null }>; 358 358 + }> { 359 359 + const calls: Array<{ url: string; body: any; authorization: string | null }> = []; 360 360 + const scenarioFetch = async ( 361 361 + input: RequestInfo | URL, 362 362 + init?: RequestInit 363 363 + ): Promise<Response> => { 364 364 + const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url; 365 365 + const body = init?.body ? JSON.parse(init.body as string) : {}; 366 366 + const headers = new Headers((init?.headers as HeadersInit) ?? {}); 367 367 + const authorization = headers.get("authorization"); 368 368 + calls.push({ url, body, authorization }); 369 369 + if (url.endsWith("/xrpc/com.atproto.server.createSession")) { 370 370 + if (scenario.onCreateSession) return scenario.onCreateSession(); 371 371 + return new Response( 372 372 + JSON.stringify({ 373 373 + accessJwt: jwtWithExp(Math.floor(Date.now() / 1000) + 3600), 374 374 + refreshJwt: "r.r.r", 375 375 + did: PROVISION_COMMUNITY_DID, 376 376 + }), 377 377 + { status: 200, headers: { "content-type": "application/json" } } 378 378 + ); 379 379 + } 380 380 + if (url.endsWith("/xrpc/com.atproto.server.refreshSession")) { 381 381 + if (scenario.onRefreshSession) return scenario.onRefreshSession(); 382 382 + return new Response(JSON.stringify({ error: "ExpiredToken" }), { status: 400 }); 383 383 + } 384 384 + if (url.endsWith("/xrpc/com.atproto.repo.createRecord")) { 385 385 + return new Response( 386 386 + JSON.stringify({ 387 387 + uri: `at://${body.repo}/${body.collection}/scenkey`, 388 388 + cid: "bafyfake", 389 389 + }), 390 390 + { status: 200, headers: { "content-type": "application/json" } } 391 391 + ); 392 392 + } 393 393 + if (url.endsWith("/xrpc/com.atproto.repo.deleteRecord")) { 394 394 + return new Response("{}", { 395 395 + status: 200, 396 396 + headers: { "content-type": "application/json" }, 397 397 + }); 398 398 + } 399 399 + return new Response("not found", { status: 404 }); 400 400 + }; 401 401 + 402 402 + const cfg: ContrailConfig = { 403 403 + ...CONFIG, 404 404 + community: { ...CONFIG.community!, fetch: scenarioFetch }, 405 405 + }; 406 406 + const db = createSqliteDatabase(":memory:"); 407 407 + const resolved = resolveConfig(cfg); 408 408 + const communityIntegration = createCommunityIntegration({ db, config: resolved }); 409 409 + await initSchema(db, resolved, { extraSchemas: [communityIntegration.applySchema] }); 410 410 + const app = createApp(db, resolved, { 411 411 + spaces: { authMiddleware: fakeAuth() }, 412 412 + community: communityIntegration, 413 413 + }); 414 414 + // Seed provision community + Alice as owner of $publishers. 415 415 + const cipher = new CredentialCipher(MASTER_KEY); 416 416 + const encrypted = await cipher.encrypt("correct-pw"); 417 417 + const community = new CommunityAdapter(db); 418 418 + const spacesAdp = new HostedAdapter(db, resolved); 419 419 + await community.createFromProvisioned({ 420 420 + did: PROVISION_COMMUNITY_DID, 421 421 + pdsEndpoint: PDS_ENDPOINT, 422 422 + handle: PROVISION_HANDLE, 423 423 + appPasswordEncrypted: encrypted, 424 424 + createdBy: ALICE, 425 425 + }); 426 426 + for (const key of RESERVED_KEYS) { 427 427 + const uri = buildSpaceUri({ 428 428 + ownerDid: PROVISION_COMMUNITY_DID, 429 429 + type: CONFIG.spaces!.authority!.type, 430 430 + key, 431 431 + }); 432 432 + await spacesAdp.createSpace({ 433 433 + uri, 434 434 + ownerDid: PROVISION_COMMUNITY_DID, 435 435 + type: CONFIG.spaces!.authority!.type, 436 436 + key, 437 437 + serviceDid: CONFIG.spaces!.authority!.serviceDid, 438 438 + appPolicyRef: null, 439 439 + appPolicy: null, 440 440 + }); 441 441 + await community.grant({ 442 442 + spaceUri: uri, 443 443 + subjectDid: ALICE, 444 444 + accessLevel: "owner", 445 445 + grantedBy: ALICE, 446 446 + }); 447 447 + await spacesAdp.applyMembershipDiff(uri, [ALICE], [], ALICE); 448 448 + } 449 449 + return { app, db, calls }; 450 450 + } 451 451 + 452 452 + describe("community publishing — session caching (Task 14)", () => { 453 453 + it("caches PDS sessions across putRecord calls", async () => { 454 454 + const { app, calls } = await makeScenarioApp({}); 455 455 + 456 456 + for (let i = 0; i < 3; i++) { 457 457 + const res = await call(app, "POST", "/xrpc/test.comm.community.putRecord", ALICE, { 458 458 + communityDid: PROVISION_COMMUNITY_DID, 459 459 + collection: "app.event.message", 460 460 + record: { text: `msg ${i}` }, 461 461 + }); 462 462 + expect(res.status).toBe(200); 463 463 + } 464 464 + 465 465 + const createSessionCalls = calls.filter((c) => 466 466 + c.url.endsWith("/xrpc/com.atproto.server.createSession") 467 467 + ).length; 468 468 + const createRecordCalls = calls.filter((c) => 469 469 + c.url.endsWith("/xrpc/com.atproto.repo.createRecord") 470 470 + ).length; 471 471 + expect(createSessionCalls).toBe(1); 472 472 + expect(createRecordCalls).toBe(3); 473 473 + }); 474 474 + 475 475 + it("considers a session valid when accessExp is in the future", async () => { 476 476 + const { app, db, calls } = await makeScenarioApp({}); 477 477 + // Pre-seed cache with a clearly-future expiry. 478 478 + const community = new CommunityAdapter(db); 479 479 + const cachedAccess = jwtWithExp(Math.floor(Date.now() / 1000) + 3600); 480 480 + await community.upsertSession(PROVISION_COMMUNITY_DID, { 481 481 + accessJwt: cachedAccess, 482 482 + refreshJwt: "cached-refresh", 483 483 + accessExp: Math.floor(Date.now() / 1000) + 3600, 484 484 + }); 485 485 + 486 486 + const res = await call(app, "POST", "/xrpc/test.comm.community.putRecord", ALICE, { 487 487 + communityDid: PROVISION_COMMUNITY_DID, 488 488 + collection: "app.event.message", 489 489 + record: { text: "uses cached session" }, 490 490 + }); 491 491 + expect(res.status).toBe(200); 492 492 + 493 493 + const createSessionCalls = calls.filter((c) => 494 494 + c.url.endsWith("/xrpc/com.atproto.server.createSession") 495 495 + ).length; 496 496 + expect(createSessionCalls).toBe(0); 497 497 + // The createRecord call must have used the cached accessJwt. 498 498 + const cr = calls.find((c) => c.url.endsWith("/xrpc/com.atproto.repo.createRecord")); 499 499 + expect(cr).toBeDefined(); 500 500 + expect(cr!.authorization).toBe(`Bearer ${cachedAccess}`); 501 501 + }); 502 502 + 503 503 + it("refreshes a near-expired session via refreshSession", async () => { 504 504 + const refreshedAccess = jwtWithExp(Math.floor(Date.now() / 1000) + 3600); 505 505 + const { app, db, calls } = await makeScenarioApp({ 506 506 + onRefreshSession: () => 507 507 + new Response( 508 508 + JSON.stringify({ accessJwt: refreshedAccess, refreshJwt: "new-refresh" }), 509 509 + { status: 200, headers: { "content-type": "application/json" } } 510 510 + ), 511 511 + }); 512 512 + const community = new CommunityAdapter(db); 513 513 + await community.upsertSession(PROVISION_COMMUNITY_DID, { 514 514 + accessJwt: jwtWithExp(Math.floor(Date.now() / 1000) - 60), 515 515 + refreshJwt: "old-refresh", 516 516 + accessExp: Math.floor(Date.now() / 1000) - 60, 517 517 + }); 518 518 + 519 519 + const res = await call(app, "POST", "/xrpc/test.comm.community.putRecord", ALICE, { 520 520 + communityDid: PROVISION_COMMUNITY_DID, 521 521 + collection: "app.event.message", 522 522 + record: { text: "after refresh" }, 523 523 + }); 524 524 + expect(res.status).toBe(200); 525 525 + 526 526 + const createSessionCalls = calls.filter((c) => 527 527 + c.url.endsWith("/xrpc/com.atproto.server.createSession") 528 528 + ).length; 529 529 + const refreshSessionCalls = calls.filter((c) => 530 530 + c.url.endsWith("/xrpc/com.atproto.server.refreshSession") 531 531 + ).length; 532 532 + expect(createSessionCalls).toBe(0); 533 533 + expect(refreshSessionCalls).toBe(1); 534 534 + // createRecord must use the refreshed access JWT. 535 535 + const cr = calls.find((c) => c.url.endsWith("/xrpc/com.atproto.repo.createRecord")); 536 536 + expect(cr!.authorization).toBe(`Bearer ${refreshedAccess}`); 537 537 + }); 538 538 + 539 539 + it("falls back to createSession when refresh fails", async () => { 540 540 + const { app, db, calls } = await makeScenarioApp({ 541 541 + onRefreshSession: () => 542 542 + new Response(JSON.stringify({ error: "ExpiredToken" }), { status: 400 }), 543 543 + }); 544 544 + const community = new CommunityAdapter(db); 545 545 + await community.upsertSession(PROVISION_COMMUNITY_DID, { 546 546 + accessJwt: jwtWithExp(Math.floor(Date.now() / 1000) - 60), 547 547 + refreshJwt: "stale-refresh", 548 548 + accessExp: Math.floor(Date.now() / 1000) - 60, 549 549 + }); 550 550 + 551 551 + const res = await call(app, "POST", "/xrpc/test.comm.community.putRecord", ALICE, { 552 552 + communityDid: PROVISION_COMMUNITY_DID, 553 553 + collection: "app.event.message", 554 554 + record: { text: "fallback to create" }, 555 555 + }); 556 556 + expect(res.status).toBe(200); 557 557 + 558 558 + const createSessionCalls = calls.filter((c) => 559 559 + c.url.endsWith("/xrpc/com.atproto.server.createSession") 560 560 + ).length; 561 561 + const refreshSessionCalls = calls.filter((c) => 562 562 + c.url.endsWith("/xrpc/com.atproto.server.refreshSession") 563 563 + ).length; 564 564 + expect(refreshSessionCalls).toBe(1); 565 565 + expect(createSessionCalls).toBe(1); 566 566 + }); 567 567 + }); 568 568 + 569 569 + describe("community publishing — provision mode", () => { 570 570 + let app: Hono; 571 571 + 572 572 + beforeAll(async () => { 573 573 + const built = await makeApp(); 574 574 + app = built.app; 575 575 + await seedProvisionCommunity(built.db, ALICE, "correct-pw"); 576 576 + }); 577 577 + 578 578 + it("publishes a record under a provision-mode community", async () => { 579 579 + const before = pdsCalls.length; 580 580 + const res = await call(app, "POST", "/xrpc/test.comm.community.putRecord", ALICE, { 581 581 + communityDid: PROVISION_COMMUNITY_DID, 582 582 + collection: "app.event.message", 583 583 + record: { text: "hello from a provisioned community" }, 584 584 + }); 585 585 + expect(res.status).toBe(200); 586 586 + const body = (await res.json()) as any; 587 587 + expect(body.uri).toBe(`at://${PROVISION_COMMUNITY_DID}/app.event.message/fakerkey`); 588 588 + 589 589 + const newCalls = pdsCalls.slice(before); 590 590 + expect( 591 591 + newCalls.some( 592 592 + (c) => 593 593 + c.url.endsWith("/xrpc/com.atproto.server.createSession") && 594 594 + c.body.identifier === PROVISION_HANDLE 595 595 + ) 596 596 + ).toBe(true); 597 597 + expect( 598 598 + newCalls.some( 599 599 + (c) => 600 600 + c.url.endsWith("/xrpc/com.atproto.repo.createRecord") && 601 601 + c.body.repo === PROVISION_COMMUNITY_DID 602 602 + ) 603 603 + ).toBe(true); 604 604 + }); 605 605 + 606 606 + it("deletes a record under a provision-mode community", async () => { 607 607 + const before = pdsCalls.length; 608 608 + const res = await call(app, "POST", "/xrpc/test.comm.community.deleteRecord", ALICE, { 609 609 + communityDid: PROVISION_COMMUNITY_DID, 610 610 + collection: "app.event.message", 611 611 + rkey: "fakerkey", 612 612 + }); 613 613 + expect(res.status).toBe(200); 614 614 + expect(((await res.json()) as any).ok).toBe(true); 615 615 + 616 616 + const newCalls = pdsCalls.slice(before); 617 617 + expect( 618 618 + newCalls.some((c) => c.url.endsWith("/xrpc/com.atproto.repo.deleteRecord")) 619 619 + ).toBe(true); 620 620 + }); 621 621 + 622 622 + it("reports healthy for a provision-mode community", async () => { 623 623 + const res = await call( 624 624 + app, 625 625 + "GET", 626 626 + `/xrpc/test.comm.community.getHealth?communityDid=${PROVISION_COMMUNITY_DID}`, 627 627 + ALICE 628 628 + ); 629 629 + expect(res.status).toBe(200); 630 630 + expect(((await res.json()) as any).status).toBe("healthy"); 631 631 + }); 632 632 + });

+85

packages/contrail-community/tests/community-sessions-cache.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeEach } from "vitest"; 2 2 + import { initCommunitySchema } from "../src/schema"; 3 3 + import { CommunityAdapter } from "../src/adapter"; 4 4 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 5 5 + 6 6 + describe("community_sessions cache", () => { 7 7 + let adapter: CommunityAdapter; 8 8 + 9 9 + beforeEach(async () => { 10 10 + const db = createSqliteDatabase(":memory:"); 11 11 + await initCommunitySchema(db); 12 12 + adapter = new CommunityAdapter(db); 13 13 + }); 14 14 + 15 15 + it("upserts and reads a cached session", async () => { 16 16 + await adapter.upsertSession("did:plc:x", { 17 17 + accessJwt: "atok", 18 18 + refreshJwt: "rtok", 19 19 + accessExp: 1234, 20 20 + }); 21 21 + const got = await adapter.getSession("did:plc:x"); 22 22 + expect(got).toEqual({ accessJwt: "atok", refreshJwt: "rtok", accessExp: 1234 }); 23 23 + }); 24 24 + 25 25 + it("returns null for missing did", async () => { 26 26 + const got = await adapter.getSession("did:plc:nope"); 27 27 + expect(got).toBeNull(); 28 28 + }); 29 29 + 30 30 + it("clears a session", async () => { 31 31 + await adapter.upsertSession("did:plc:x", { 32 32 + accessJwt: "a", 33 33 + refreshJwt: "r", 34 34 + accessExp: 1, 35 35 + }); 36 36 + await adapter.clearSession("did:plc:x"); 37 37 + expect(await adapter.getSession("did:plc:x")).toBeNull(); 38 38 + }); 39 39 + 40 40 + it("upsert overwrites existing session for the same did", async () => { 41 41 + await adapter.upsertSession("did:plc:x", { 42 42 + accessJwt: "old-a", 43 43 + refreshJwt: "old-r", 44 44 + accessExp: 100, 45 45 + }); 46 46 + await adapter.upsertSession("did:plc:x", { 47 47 + accessJwt: "new-a", 48 48 + refreshJwt: "new-r", 49 49 + accessExp: 200, 50 50 + }); 51 51 + const got = await adapter.getSession("did:plc:x"); 52 52 + expect(got).toEqual({ accessJwt: "new-a", refreshJwt: "new-r", accessExp: 200 }); 53 53 + }); 54 54 + 55 55 + it("isolates sessions across communities", async () => { 56 56 + await adapter.upsertSession("did:plc:a", { 57 57 + accessJwt: "a-tok", 58 58 + refreshJwt: "a-rtok", 59 59 + accessExp: 1, 60 60 + }); 61 61 + await adapter.upsertSession("did:plc:b", { 62 62 + accessJwt: "b-tok", 63 63 + refreshJwt: "b-rtok", 64 64 + accessExp: 2, 65 65 + }); 66 66 + expect(await adapter.getSession("did:plc:a")).toEqual({ 67 67 + accessJwt: "a-tok", 68 68 + refreshJwt: "a-rtok", 69 69 + accessExp: 1, 70 70 + }); 71 71 + expect(await adapter.getSession("did:plc:b")).toEqual({ 72 72 + accessJwt: "b-tok", 73 73 + refreshJwt: "b-rtok", 74 74 + accessExp: 2, 75 75 + }); 76 76 + await adapter.clearSession("did:plc:a"); 77 77 + expect(await adapter.getSession("did:plc:a")).toBeNull(); 78 78 + // Clearing one DID must not affect the other. 79 79 + expect(await adapter.getSession("did:plc:b")).toEqual({ 80 80 + accessJwt: "b-tok", 81 81 + refreshJwt: "b-rtok", 82 82 + accessExp: 2, 83 83 + }); 84 84 + }); 85 85 + });

+81

packages/contrail-community/tests/pds-account-ops.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { 3 3 + pdsGetRecommendedDidCredentials, 4 4 + pdsActivateAccount, 5 5 + } from "../src/pds"; 6 6 + 7 7 + describe("pdsGetRecommendedDidCredentials", () => { 8 8 + it("issues GET to the identity endpoint with bearer accessJwt and parses response", async () => { 9 9 + let received: { url: string; init: any } | null = null; 10 10 + const fetch = (async (url: string, init: any) => { 11 11 + received = { url, init }; 12 12 + return new Response( 13 13 + JSON.stringify({ 14 14 + rotationKeys: ["did:key:zRot"], 15 15 + verificationMethods: { atproto: "did:key:zSig" }, 16 16 + alsoKnownAs: ["at://h.test"], 17 17 + services: { 18 18 + atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://pds.test" }, 19 19 + }, 20 20 + }), 21 21 + { status: 200, headers: { "content-type": "application/json" } } 22 22 + ); 23 23 + }) as unknown as typeof globalThis.fetch; 24 24 + 25 25 + const result = await pdsGetRecommendedDidCredentials( 26 26 + "https://pds.test", 27 27 + "AT", 28 28 + { fetch } 29 29 + ); 30 30 + 31 31 + expect(received!.url).toBe( 32 32 + "https://pds.test/xrpc/com.atproto.identity.getRecommendedDidCredentials" 33 33 + ); 34 34 + // Default fetch method is GET when none specified. 35 35 + expect(received!.init?.method ?? "GET").toBe("GET"); 36 36 + // Bearer is the session accessJwt, NOT a service-auth JWT. 37 37 + expect(received!.init.headers.authorization).toBe("Bearer AT"); 38 38 + expect(result.rotationKeys).toEqual(["did:key:zRot"]); 39 39 + expect(result.verificationMethods).toEqual({ atproto: "did:key:zSig" }); 40 40 + expect(result.alsoKnownAs).toEqual(["at://h.test"]); 41 41 + expect(result.services).toEqual({ 42 42 + atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://pds.test" }, 43 43 + }); 44 44 + }); 45 45 + 46 46 + it("throws with status and body on non-2xx", async () => { 47 47 + const fetch = (async () => 48 48 + new Response("session expired", { status: 401 })) as any; 49 49 + await expect( 50 50 + pdsGetRecommendedDidCredentials("https://pds.test", "AT", { fetch }) 51 51 + ).rejects.toThrow(/getRecommendedDidCredentials failed.*401.*session expired/); 52 52 + }); 53 53 + }); 54 54 + 55 55 + describe("pdsActivateAccount", () => { 56 56 + it("issues POST to activateAccount with bearer accessJwt and resolves to undefined", async () => { 57 57 + let received: { url: string; init: any } | null = null; 58 58 + const fetch = (async (url: string, init: any) => { 59 59 + received = { url, init }; 60 60 + return new Response("", { status: 200 }); 61 61 + }) as unknown as typeof globalThis.fetch; 62 62 + 63 63 + const result = await pdsActivateAccount("https://pds.test", "AT", { fetch }); 64 64 + 65 65 + expect(received!.url).toBe( 66 66 + "https://pds.test/xrpc/com.atproto.server.activateAccount" 67 67 + ); 68 68 + expect(received!.init.method).toBe("POST"); 69 69 + // Bearer is the session accessJwt from pdsCreateAccount, NOT a service-auth JWT. 70 70 + expect(received!.init.headers.authorization).toBe("Bearer AT"); 71 71 + expect(result).toBeUndefined(); 72 72 + }); 73 73 + 74 74 + it("throws with status and body on non-2xx", async () => { 75 75 + const fetch = (async () => 76 76 + new Response("nope", { status: 400 })) as any; 77 77 + await expect( 78 78 + pdsActivateAccount("https://pds.test", "AT", { fetch }) 79 79 + ).rejects.toThrow(/activateAccount failed.*400.*nope/); 80 80 + }); 81 81 + });

+74

packages/contrail-community/tests/pds-create-account.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { pdsCreateAccount } from "../src/pds"; 3 3 + 4 4 + describe("pdsCreateAccount", () => { 5 5 + it("posts createAccount with bearer auth and returns session", async () => { 6 6 + let received: { url: string; init: any } | null = null; 7 7 + const fetch = (async (url: string, init: any) => { 8 8 + received = { url, init }; 9 9 + return new Response( 10 10 + JSON.stringify({ 11 11 + accessJwt: "AT", refreshJwt: "RT", handle: "h.test", did: "did:plc:x", 12 12 + }), 13 13 + { status: 200, headers: { "content-type": "application/json" } } 14 14 + ); 15 15 + }) as unknown as typeof globalThis.fetch; 16 16 + 17 17 + const result = await pdsCreateAccount( 18 18 + "https://pds.test", 19 19 + "JWT-VALUE", 20 20 + { 21 21 + handle: "h.test", 22 22 + did: "did:plc:x", 23 23 + email: "h@x.test", 24 24 + password: "p", 25 25 + inviteCode: "code", 26 26 + }, 27 27 + { fetch } 28 28 + ); 29 29 + 30 30 + expect(received!.url).toBe("https://pds.test/xrpc/com.atproto.server.createAccount"); 31 31 + expect(received!.init.method).toBe("POST"); 32 32 + expect(received!.init.headers.authorization).toBe("Bearer JWT-VALUE"); 33 33 + expect(JSON.parse(received!.init.body)).toEqual({ 34 34 + handle: "h.test", 35 35 + did: "did:plc:x", 36 36 + email: "h@x.test", 37 37 + password: "p", 38 38 + inviteCode: "code", 39 39 + }); 40 40 + expect(result.accessJwt).toBe("AT"); 41 41 + expect(result.did).toBe("did:plc:x"); 42 42 + }); 43 43 + 44 44 + it("strips trailing slash from pdsEndpoint", async () => { 45 45 + let receivedUrl = ""; 46 46 + const fetch = (async (url: string) => { 47 47 + receivedUrl = url; 48 48 + return new Response( 49 49 + JSON.stringify({ accessJwt: "AT", refreshJwt: "RT", handle: "h", did: "did:plc:x" }), 50 50 + { status: 200 } 51 51 + ); 52 52 + }) as any; 53 53 + await pdsCreateAccount( 54 54 + "https://pds.test/", 55 55 + "JWT", 56 56 + { handle: "h", did: "did:plc:x", email: "e", password: "p" }, 57 57 + { fetch } 58 58 + ); 59 59 + expect(receivedUrl).toBe("https://pds.test/xrpc/com.atproto.server.createAccount"); 60 60 + }); 61 61 + 62 62 + it("throws on non-2xx", async () => { 63 63 + const fetch = (async () => 64 64 + new Response(JSON.stringify({ error: "InvalidRequest", message: "bad" }), { status: 400 })) as any; 65 65 + await expect( 66 66 + pdsCreateAccount( 67 67 + "https://pds.test", 68 68 + "x", 69 69 + { handle: "h", did: "did:plc:x", email: "e", password: "p" }, 70 70 + { fetch } 71 71 + ) 72 72 + ).rejects.toThrow(/createAccount failed.*400.*InvalidRequest/); 73 73 + }); 74 74 + });

+81

packages/contrail-community/tests/plc-log-last.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { 3 3 + cidForOp, 4 4 + getLastOpCid, 5 5 + type SignedGenesisOp, 6 6 + type SignedTombstoneOp, 7 7 + } from "../src/plc"; 8 8 + 9 9 + const GENESIS_OP: SignedGenesisOp = { 10 10 + type: "plc_operation", 11 11 + prev: null, 12 12 + rotationKeys: ["did:key:zQ3shjNSBChNYuYsW41QDdm2D25zmQkdpfhgbaQBRG4ecg7sk"], 13 13 + verificationMethods: { 14 14 + atproto: "did:key:zQ3shmefuqey6KqP7M9cwFwywqTVuCZFXcCAGJ5JGktdAUdD2", 15 15 + }, 16 16 + alsoKnownAs: ["at://probe.devnet.test"], 17 17 + services: { 18 18 + atproto_pds: { 19 19 + type: "AtprotoPersonalDataServer", 20 20 + endpoint: "https://devnet.test", 21 21 + }, 22 22 + }, 23 23 + sig: "xEZ7BS7bXJ-7KqExTH158uJFNhcTi21khw-rCHjt70EwGVhftk29Xjf1IR9JGhSmDPE76Xqc01ydF9TmmPHr2w", 24 24 + }; 25 25 + 26 26 + const TOMBSTONE_OP: SignedTombstoneOp = { 27 27 + type: "plc_tombstone", 28 28 + prev: "bafyreiabmto3hekxoflemevicopvpud2k6ypf2fkp3v3g6iu36l4wxxfle", 29 29 + sig: "abc123", 30 30 + }; 31 31 + 32 32 + describe("getLastOpCid", () => { 33 33 + it("returns the CID computed locally from the PLC log/last op response", async () => { 34 34 + let calledUrl = ""; 35 35 + const fakeFetch: typeof fetch = async (input) => { 36 36 + calledUrl = String(input); 37 37 + return new Response(JSON.stringify(GENESIS_OP), { 38 38 + status: 200, 39 39 + headers: { "content-type": "application/json" }, 40 40 + }); 41 41 + }; 42 42 + const cid = await getLastOpCid("https://plc.test", "did:plc:abc", { 43 43 + fetch: fakeFetch, 44 44 + }); 45 45 + expect(calledUrl).toBe("https://plc.test/did:plc:abc/log/last"); 46 46 + // PLC returns the bare op (no envelope). The function must compute the 47 47 + // CID with the same DAG-CBOR encoder cidForOp uses so the value matches 48 48 + // the CID PLC stored when it accepted the op. 49 49 + expect(cid).toBe(await cidForOp(GENESIS_OP)); 50 50 + }); 51 51 + 52 52 + it("computes the CID from a tombstone op response too", async () => { 53 53 + const fakeFetch: typeof fetch = async () => 54 54 + new Response(JSON.stringify(TOMBSTONE_OP), { 55 55 + status: 200, 56 56 + headers: { "content-type": "application/json" }, 57 57 + }); 58 58 + const cid = await getLastOpCid("https://plc.test", "did:plc:abc", { 59 59 + fetch: fakeFetch, 60 60 + }); 61 61 + expect(cid).toBe(await cidForOp(TOMBSTONE_OP)); 62 62 + }); 63 63 + 64 64 + it("strips a trailing slash from the directory base", async () => { 65 65 + let calledUrl = ""; 66 66 + const fakeFetch: typeof fetch = async (input) => { 67 67 + calledUrl = String(input); 68 68 + return new Response(JSON.stringify(GENESIS_OP), { status: 200 }); 69 69 + }; 70 70 + await getLastOpCid("https://plc.test/", "did:plc:xyz", { fetch: fakeFetch }); 71 71 + expect(calledUrl).toBe("https://plc.test/did:plc:xyz/log/last"); 72 72 + }); 73 73 + 74 74 + it("throws on a non-200 response, including the status and body", async () => { 75 75 + const fakeFetch: typeof fetch = async () => 76 76 + new Response("not found", { status: 404 }); 77 77 + await expect( 78 78 + getLastOpCid("https://plc.test", "did:plc:missing", { fetch: fakeFetch }) 79 79 + ).rejects.toThrow(/404.*not found/); 80 80 + }); 81 81 + });

+50

packages/contrail-community/tests/plc-update-op.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { 3 3 + generateKeyPair, 4 4 + buildGenesisOp, 5 5 + signGenesisOp, 6 6 + buildUpdateOp, 7 7 + signUpdateOp, 8 8 + cidForOp, 9 9 + } from "../src/plc"; 10 10 + 11 11 + describe("cidForOp", () => { 12 12 + it("produces a CIDv1 dag-cbor sha256 base32-lower CID starting with bafyrei", async () => { 13 13 + const kp = await generateKeyPair(); 14 14 + const unsigned = buildGenesisOp({ 15 15 + rotationKeys: [kp.publicDidKey], 16 16 + verificationMethodAtproto: kp.publicDidKey, 17 17 + alsoKnownAs: ["at://x.test"], 18 18 + services: { atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://x.test" } }, 19 19 + }); 20 20 + const signed = await signGenesisOp(unsigned, kp.privateJwk); 21 21 + const cid = await cidForOp(signed); 22 22 + expect(cid).toMatch(/^bafyrei/); 23 23 + expect(cid.length).toBeGreaterThan(50); 24 24 + }); 25 25 + }); 26 26 + 27 27 + describe("buildUpdateOp + signUpdateOp", () => { 28 28 + it("produces a plc_operation with prev set and a sig segment", async () => { 29 29 + const kp = await generateKeyPair(); 30 30 + const genesis = buildGenesisOp({ 31 31 + rotationKeys: [kp.publicDidKey], 32 32 + verificationMethodAtproto: kp.publicDidKey, 33 33 + alsoKnownAs: ["at://x.test"], 34 34 + services: { atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://x.test" } }, 35 35 + }); 36 36 + const signedGenesis = await signGenesisOp(genesis, kp.privateJwk); 37 37 + const prev = await cidForOp(signedGenesis); 38 38 + 39 39 + const update = buildUpdateOp({ 40 40 + prev, 41 41 + rotationKeys: [kp.publicDidKey, "did:key:zPdsRot"], 42 42 + verificationMethodAtproto: "did:key:zPdsSig", 43 43 + alsoKnownAs: ["at://x.test"], 44 44 + services: { atproto_pds: { type: "AtprotoPersonalDataServer", endpoint: "https://x.test" } }, 45 45 + }); 46 46 + 47 47 + const signedUpdate = await signUpdateOp(update, kp.privateJwk); 48 48 + expect(signedUpdate.sig).toMatch(/^[A-Za-z0-9_-]+$/); 49 49 + }); 50 50 + });

+259

packages/contrail-community/tests/provision-orchestrator.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeEach } from "vitest"; 2 2 + import { initCommunitySchema } from "../src/schema"; 3 3 + import { CommunityAdapter } from "../src/adapter"; 4 4 + import { CredentialCipher } from "../src/credentials"; 5 5 + import { ProvisionOrchestrator } from "../src/provision"; 6 6 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 7 7 + 8 8 + const STUB_ROTATION_KEY = "did:key:zStubCallerRotationKeyForTests"; 9 9 + 10 10 + function mockPlc() { 11 11 + const ops: any[] = []; 12 12 + return { 13 13 + ops, 14 14 + async submit(did: string, op: any) { 15 15 + ops.push({ did, op }); 16 16 + return { ok: true }; 17 17 + }, 18 18 + }; 19 19 + } 20 20 + 21 21 + function mockPds() { 22 22 + return { 23 23 + async createAccount() { 24 24 + return { 25 25 + did: "did:plc:x", 26 26 + handle: "h.test", 27 27 + accessJwt: "AT", 28 28 + refreshJwt: "RT", 29 29 + }; 30 30 + }, 31 31 + async getRecommendedDidCredentials() { 32 32 + return { 33 33 + rotationKeys: ["did:key:zPdsRot"], 34 34 + verificationMethods: { atproto: "did:key:zPdsSig" }, 35 35 + alsoKnownAs: ["at://h.test"], 36 36 + services: { 37 37 + atproto_pds: { 38 38 + type: "AtprotoPersonalDataServer", 39 39 + endpoint: "https://pds.test", 40 40 + }, 41 41 + }, 42 42 + }; 43 43 + }, 44 44 + async activateAccount() { 45 45 + return; 46 46 + }, 47 47 + async createAppPassword() { 48 48 + return { password: "minted-app-pw" }; 49 49 + }, 50 50 + }; 51 51 + } 52 52 + 53 53 + describe("ProvisionOrchestrator", () => { 54 54 + let adapter: CommunityAdapter; 55 55 + let cipher: CredentialCipher; 56 56 + beforeEach(async () => { 57 57 + const db = createSqliteDatabase(":memory:"); 58 58 + await initCommunitySchema(db); 59 59 + cipher = new CredentialCipher(new Uint8Array(32).fill(99)); 60 60 + adapter = new CommunityAdapter(db); 61 61 + }); 62 62 + 63 63 + it("runs end-to-end and lands at status=activated", async () => { 64 64 + const orch = new ProvisionOrchestrator({ 65 65 + adapter, 66 66 + cipher, 67 67 + plc: mockPlc(), 68 68 + pds: mockPds(), 69 69 + pdsDid: "did:web:pds.test", 70 70 + }); 71 71 + 72 72 + const result = await orch.provision({ 73 73 + attemptId: "a1", 74 74 + pdsEndpoint: "https://pds.test", 75 75 + handle: "h.test", 76 76 + email: "h@x.test", 77 77 + password: "p", 78 78 + inviteCode: "code", 79 79 + rotationKey: STUB_ROTATION_KEY, 80 80 + }); 81 81 + 82 82 + expect(result.did).toBeTruthy(); 83 83 + expect(result.status).toBe("activated"); 84 84 + const row = await adapter.getProvisionAttempt("a1"); 85 85 + expect(row?.status).toBe("activated"); 86 86 + expect(row?.encryptedSigningKey).toBeTruthy(); 87 87 + expect(row?.encryptedRotationKey).toBeTruthy(); 88 88 + expect(row?.encryptedPassword).toBeTruthy(); 89 89 + }); 90 90 + 91 91 + it("seeds the community_sessions cache with the createAccount JWTs after activation", async () => { 92 92 + const orch = new ProvisionOrchestrator({ 93 93 + adapter, 94 94 + cipher, 95 95 + plc: mockPlc(), 96 96 + pds: mockPds(), 97 97 + pdsDid: "did:web:pds.test", 98 98 + }); 99 99 + 100 100 + const result = await orch.provision({ 101 101 + attemptId: "a1", 102 102 + pdsEndpoint: "https://pds.test", 103 103 + handle: "h.test", 104 104 + email: "h@x.test", 105 105 + password: "p", 106 106 + inviteCode: "code", 107 107 + rotationKey: STUB_ROTATION_KEY, 108 108 + }); 109 109 + 110 110 + const cached = await adapter.getSession(result.did); 111 111 + expect(cached).not.toBeNull(); 112 112 + expect(cached?.accessJwt).toBe("AT"); 113 113 + expect(cached?.refreshJwt).toBe("RT"); 114 114 + }); 115 115 + 116 116 + it("persists status=genesis_submitted before createAccount runs", async () => { 117 117 + let createCalled = false; 118 118 + const pds = { 119 119 + async createAccount() { 120 120 + // Inspect state at this exact moment. 121 121 + const row = await adapter.getProvisionAttempt("a1"); 122 122 + expect(row?.status).toBe("genesis_submitted"); 123 123 + createCalled = true; 124 124 + return { 125 125 + did: "did:plc:x", 126 126 + handle: "h.test", 127 127 + accessJwt: "AT", 128 128 + refreshJwt: "RT", 129 129 + }; 130 130 + }, 131 131 + async getRecommendedDidCredentials() { 132 132 + return { 133 133 + rotationKeys: [], 134 134 + verificationMethods: { atproto: "did:key:zSig" }, 135 135 + alsoKnownAs: ["at://h.test"], 136 136 + services: { 137 137 + atproto_pds: { type: "x", endpoint: "https://pds.test" }, 138 138 + }, 139 139 + }; 140 140 + }, 141 141 + async activateAccount() {}, 142 142 + async createAppPassword() { 143 143 + return { password: "minted" }; 144 144 + }, 145 145 + }; 146 146 + 147 147 + const orch = new ProvisionOrchestrator({ 148 148 + adapter, 149 149 + cipher, 150 150 + plc: mockPlc(), 151 151 + pds, 152 152 + pdsDid: "did:web:pds.test", 153 153 + }); 154 154 + await orch.provision({ 155 155 + attemptId: "a1", 156 156 + pdsEndpoint: "https://pds.test", 157 157 + handle: "h.test", 158 158 + email: "h@x.test", 159 159 + password: "p", 160 160 + rotationKey: STUB_ROTATION_KEY, 161 161 + }); 162 162 + expect(createCalled).toBe(true); 163 163 + }); 164 164 + 165 165 + it("marks last_error and rethrows when createAccount fails", async () => { 166 166 + const pds = { 167 167 + ...mockPds(), 168 168 + async createAccount() { 169 169 + throw new Error("createAccount 400: bad invite"); 170 170 + }, 171 171 + } as any; 172 172 + 173 173 + const orch = new ProvisionOrchestrator({ 174 174 + adapter, 175 175 + cipher, 176 176 + plc: mockPlc(), 177 177 + pds, 178 178 + pdsDid: "did:web:pds.test", 179 179 + }); 180 180 + 181 181 + await expect( 182 182 + orch.provision({ 183 183 + attemptId: "a1", 184 184 + pdsEndpoint: "https://pds.test", 185 185 + handle: "h.test", 186 186 + email: "h@x.test", 187 187 + password: "p", 188 188 + rotationKey: STUB_ROTATION_KEY, 189 189 + }) 190 190 + ).rejects.toThrow(/bad invite/); 191 191 + const row = await adapter.getProvisionAttempt("a1"); 192 192 + expect(row?.status).toBe("genesis_submitted"); // last successful step 193 193 + expect(row?.lastError).toMatch(/bad invite/); 194 194 + }); 195 195 + 196 196 + it("re-invoking with the same attemptId on a fully-completed row returns success without redoing PLC/PDS work", async () => { 197 197 + // Scenario: the orchestrator finished cleanly (status=activated + 198 198 + // encryptedPassword set), but a *downstream* step (router's 199 199 + // createFromProvisioned or bootstrapReservedSpaces) failed and the 200 200 + // caller retries with the same attemptId. The orchestrator must not 201 201 + // throw "already exists" — it should report success so the route can 202 202 + // resume the graduation steps. 203 203 + const plc = mockPlc(); 204 204 + const pds: any = mockPds(); 205 205 + const orch = new ProvisionOrchestrator({ 206 206 + adapter, 207 207 + cipher, 208 208 + plc, 209 209 + pds, 210 210 + pdsDid: "did:web:pds.test", 211 211 + }); 212 212 + 213 213 + const first = await orch.provision({ 214 214 + attemptId: "a1", 215 215 + pdsEndpoint: "https://pds.test", 216 216 + handle: "h.test", 217 217 + email: "h@x.test", 218 218 + password: "p", 219 219 + inviteCode: "code", 220 220 + rotationKey: STUB_ROTATION_KEY, 221 221 + }); 222 222 + expect(first.status).toBe("activated"); 223 223 + const opsAfterFirst = plc.ops.length; 224 224 + 225 225 + // Wire a fresh PDS mock whose every method throws — if the retry path 226 226 + // calls any of them, the test fails loudly. createSession is allowed 227 227 + // because the C3 retry path is wired for the not-yet-completed case; 228 228 + // a fully-completed row should NOT hit it either. 229 229 + const explodingPds: any = { 230 230 + createAccount: () => { throw new Error("createAccount should not be called on a completed retry"); }, 231 231 + getRecommendedDidCredentials: () => { throw new Error("getRecommendedDidCredentials should not be called"); }, 232 232 + activateAccount: () => { throw new Error("activateAccount should not be called"); }, 233 233 + createAppPassword: () => { throw new Error("createAppPassword should not be called on a completed retry"); }, 234 234 + createSession: () => { throw new Error("createSession should not be called on a completed retry"); }, 235 235 + }; 236 236 + const retryOrch = new ProvisionOrchestrator({ 237 237 + adapter, 238 238 + cipher, 239 239 + plc: { submit: () => { throw new Error("plc.submit should not be called on a completed retry"); } }, 240 240 + pds: explodingPds, 241 241 + pdsDid: "did:web:pds.test", 242 242 + }); 243 243 + 244 244 + const second = await retryOrch.provision({ 245 245 + attemptId: "a1", 246 246 + pdsEndpoint: "https://pds.test", 247 247 + handle: "h.test", 248 248 + email: "h@x.test", 249 249 + password: "p", 250 250 + inviteCode: "code", 251 251 + rotationKey: STUB_ROTATION_KEY, 252 252 + }); 253 253 + expect(second.status).toBe("activated"); 254 254 + expect(second.did).toBe(first.did); 255 255 + expect(second.attemptId).toBe("a1"); 256 256 + expect(plc.ops.length).toBe(opsAfterFirst); 257 257 + }); 258 258 + 259 259 + });

+353

packages/contrail-community/tests/provision-self-sovereign.test.ts

Reviewed

··· 1 1 + import { describe, it, expect, beforeEach } from "vitest"; 2 2 + import { initCommunitySchema } from "../src/schema"; 3 3 + import { CommunityAdapter } from "../src/adapter"; 4 4 + import { CredentialCipher } from "../src/credentials"; 5 5 + import { ProvisionOrchestrator } from "../src/provision"; 6 6 + import { generateKeyPair } from "../src/plc"; 7 7 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 8 8 + 9 9 + /** Mock PLC client that records every submitted op so tests can inspect the 10 10 + * genesis op (in particular, its rotationKeys array). */ 11 11 + function mockPlc() { 12 12 + const ops: Array<{ did: string; op: any }> = []; 13 13 + return { 14 14 + ops, 15 15 + async submit(did: string, op: any) { 16 16 + ops.push({ did, op }); 17 17 + return { ok: true }; 18 18 + }, 19 19 + }; 20 20 + } 21 21 + 22 22 + /** Mock PDS client that records calls to createAppPassword so tests can assert 23 23 + * on its arguments (or its absence). The minted password is deterministic so 24 24 + * decryption assertions can compare. */ 25 25 + function mockPds(opts: { mintedPassword?: string } = {}) { 26 26 + const calls: { createAppPassword: Array<{ pdsUrl: string; accessJwt: string; name: string }> } = { 27 27 + createAppPassword: [], 28 28 + }; 29 29 + return { 30 30 + calls, 31 31 + async createAccount() { 32 32 + return { 33 33 + did: "did:plc:x", 34 34 + handle: "h.test", 35 35 + accessJwt: "AT", 36 36 + refreshJwt: "RT", 37 37 + }; 38 38 + }, 39 39 + async getRecommendedDidCredentials() { 40 40 + return { 41 41 + rotationKeys: ["did:key:zPdsRot"], 42 42 + verificationMethods: { atproto: "did:key:zPdsSig" }, 43 43 + alsoKnownAs: ["at://h.test"], 44 44 + services: { 45 45 + atproto_pds: { 46 46 + type: "AtprotoPersonalDataServer", 47 47 + endpoint: "https://pds.test", 48 48 + }, 49 49 + }, 50 50 + }; 51 51 + }, 52 52 + async activateAccount() { 53 53 + return; 54 54 + }, 55 55 + async createAppPassword(input: { pdsUrl: string; accessJwt: string; name: string }) { 56 56 + calls.createAppPassword.push(input); 57 57 + return { password: opts.mintedPassword ?? "minted-app-pass-XXXX" }; 58 58 + }, 59 59 + }; 60 60 + } 61 61 + 62 62 + describe("ProvisionOrchestrator — caller-supplied rotation key", () => { 63 63 + let adapter: CommunityAdapter; 64 64 + let cipher: CredentialCipher; 65 65 + beforeEach(async () => { 66 66 + const db = createSqliteDatabase(":memory:"); 67 67 + await initCommunitySchema(db); 68 68 + cipher = new CredentialCipher(new Uint8Array(32).fill(99)); 69 69 + adapter = new CommunityAdapter(db); 70 70 + }); 71 71 + 72 72 + it("genesis includes caller rotation key, mints app password, response carries rootCredentials", async () => { 73 73 + const callerKeyPair = await generateKeyPair(); 74 74 + const callerRotationDidKey = callerKeyPair.publicDidKey; 75 75 + const userPassword = "user-supplied-root-pw"; 76 76 + const mintedPassword = "minted-app-pw-1234"; 77 77 + 78 78 + const plc = mockPlc(); 79 79 + const pds = mockPds({ mintedPassword }); 80 80 + 81 81 + const orch = new ProvisionOrchestrator({ 82 82 + adapter, 83 83 + cipher, 84 84 + plc, 85 85 + pds, 86 86 + pdsDid: "did:web:pds.test", 87 87 + }); 88 88 + 89 89 + const result = await orch.provision({ 90 90 + attemptId: "ss1", 91 91 + pdsEndpoint: "https://pds.test", 92 92 + handle: "h.test", 93 93 + email: "h@x.test", 94 94 + password: userPassword, 95 95 + inviteCode: "code", 96 96 + rotationKey: callerRotationDidKey, 97 97 + }); 98 98 + 99 99 + // Status unchanged in shape. 100 100 + expect(result.status).toBe("activated"); 101 101 + expect(result.did).toBeTruthy(); 102 102 + 103 103 + // Response carries root credentials so the caller can keep their root password. 104 104 + expect(result.rootCredentials).toBeDefined(); 105 105 + expect(result.rootCredentials!.password).toBe(userPassword); 106 106 + expect(result.rootCredentials!.handle).toBe("h.test"); 107 107 + expect(typeof result.rootCredentials!.recoveryHint).toBe("string"); 108 108 + 109 109 + // Persisted attempt row reaches activated status. 110 110 + const row = await adapter.getProvisionAttempt("ss1"); 111 111 + expect(row).toBeTruthy(); 112 112 + expect(row!.status).toBe("activated"); 113 113 + 114 114 + // Genesis op submitted to PLC has BOTH rotation keys, with the caller's first. 115 115 + expect(plc.ops.length).toBeGreaterThanOrEqual(1); 116 116 + const genesis = plc.ops[0]!.op; 117 117 + expect(Array.isArray(genesis.rotationKeys)).toBe(true); 118 118 + expect(genesis.rotationKeys[0]).toBe(callerRotationDidKey); 119 119 + expect(genesis.rotationKeys.length).toBe(2); 120 120 + expect(genesis.rotationKeys[1]).toBeTruthy(); 121 121 + expect(genesis.rotationKeys[1]).not.toBe(callerRotationDidKey); 122 122 + 123 123 + // createAppPassword was invoked post-activation with the session's accessJwt. 124 124 + expect(pds.calls.createAppPassword.length).toBe(1); 125 125 + const apCall = pds.calls.createAppPassword[0]!; 126 126 + expect(apCall.pdsUrl).toBe("https://pds.test"); 127 127 + expect(apCall.accessJwt).toBe("AT"); 128 128 + expect(apCall.name).toContain("ss1"); 129 129 + 130 130 + // encrypted_password column re-decrypts to the MINTED app password, 131 131 + // not the user's supplied password. 132 132 + expect(row!.encryptedPassword).toBeTruthy(); 133 133 + const decryptedPw = await cipher.decryptString(row!.encryptedPassword!); 134 134 + expect(decryptedPw).toBe(mintedPassword); 135 135 + expect(decryptedPw).not.toBe(userPassword); 136 136 + 137 137 + // Subordinate rotation private JWK persisted in encrypted_rotation_key 138 138 + // must NOT decrypt to anything containing the caller's did:key fingerprint. 139 139 + expect(row!.encryptedRotationKey).toBeTruthy(); 140 140 + const decryptedRot = await cipher.decryptString(row!.encryptedRotationKey!); 141 141 + expect(decryptedRot).not.toContain(callerRotationDidKey); 142 142 + 143 143 + // Negative invariant: caller's did:key must not appear in any encrypted 144 144 + // column (after decryption). 145 145 + const encryptedSigning = row!.encryptedSigningKey; 146 146 + if (encryptedSigning) { 147 147 + const decryptedSig = await cipher.decryptString(encryptedSigning); 148 148 + expect(decryptedSig).not.toContain(callerRotationDidKey); 149 149 + } 150 150 + }); 151 151 + 152 152 + it("PLC update op preserves caller's rotation key at index 0", async () => { 153 153 + // H2 regression guard. The update op (plc.ops[1]) must keep the caller's 154 154 + // did:key as rotationKeys[0]. Without threading it through 155 155 + // runUpdateAndActivate, the caller's key is dropped and Contrail's 156 156 + // subordinate becomes the highest-priority rotation key — caller has 72h 157 157 + // to nullify before losing rotation authority on a DID they own. 158 158 + const callerKeyPair = await generateKeyPair(); 159 159 + const callerRotationDidKey = callerKeyPair.publicDidKey; 160 160 + 161 161 + const plc = mockPlc(); 162 162 + const pds = mockPds(); 163 163 + 164 164 + const orch = new ProvisionOrchestrator({ 165 165 + adapter, 166 166 + cipher, 167 167 + plc, 168 168 + pds, 169 169 + pdsDid: "did:web:pds.test", 170 170 + }); 171 171 + 172 172 + await orch.provision({ 173 173 + attemptId: "ss-update", 174 174 + pdsEndpoint: "https://pds.test", 175 175 + handle: "h.test", 176 176 + email: "h@x.test", 177 177 + password: "pw", 178 178 + inviteCode: "code", 179 179 + rotationKey: callerRotationDidKey, 180 180 + }); 181 181 + 182 182 + // Genesis op already asserted in the prior test; here we focus on the update op. 183 183 + expect(plc.ops.length).toBeGreaterThanOrEqual(2); 184 184 + const update = plc.ops[1]!.op; 185 185 + expect(Array.isArray(update.rotationKeys)).toBe(true); 186 186 + expect(update.rotationKeys[0]).toBe(callerRotationDidKey); 187 187 + // Contrail's subordinate must remain in the chain (we still need to sign 188 188 + // future update ops). 189 189 + expect(update.rotationKeys.length).toBeGreaterThanOrEqual(2); 190 190 + expect(update.rotationKeys.slice(1)).not.toContain(callerRotationDidKey); 191 191 + // PDS-recommended key is merged in after the contrail subordinate. 192 192 + expect(update.rotationKeys).toContain("did:key:zPdsRot"); 193 193 + }); 194 194 + 195 195 + it("createAppPassword failure persists last_error at status=activated and throws (no encryptedPassword)", async () => { 196 196 + const callerKeyPair = await generateKeyPair(); 197 197 + const plc = mockPlc(); 198 198 + const pds = { 199 199 + ...mockPds(), 200 200 + async createAppPassword(_: any) { 201 201 + throw new Error("PDS rejected: rate limited"); 202 202 + }, 203 203 + }; 204 204 + 205 205 + const orch = new ProvisionOrchestrator({ 206 206 + adapter, 207 207 + cipher, 208 208 + plc, 209 209 + pds: pds as any, 210 210 + pdsDid: "did:web:pds.test", 211 211 + }); 212 212 + 213 213 + await expect( 214 214 + orch.provision({ 215 215 + attemptId: "ss-fail", 216 216 + pdsEndpoint: "https://pds.test", 217 217 + handle: "h.test", 218 218 + email: "h@x.test", 219 219 + password: "pw", 220 220 + rotationKey: callerKeyPair.publicDidKey, 221 221 + }) 222 222 + ).rejects.toThrow(/createAppPassword/); 223 223 + 224 224 + const row = await adapter.getProvisionAttempt("ss-fail"); 225 225 + expect(row).toBeTruthy(); 226 226 + expect(row!.status).toBe("activated"); 227 227 + expect(row!.encryptedPassword).toBeFalsy(); 228 228 + expect(row!.lastError).toMatch(/createAppPassword/); 229 229 + }); 230 230 + 231 231 + it("retry with same attemptId after createAppPassword failure picks up at createAppPassword (no re-mint, no re-createAccount)", async () => { 232 232 + // Simulate the failure-then-retry shape: a first provision call got all 233 233 + // the way to createAppPassword and failed; the caller retries with the 234 234 + // same attemptId. The orchestrator must NOT re-submit PLC ops, NOT 235 235 + // re-call createAccount, only run createAppPassword. 236 236 + const callerKeyPair = await generateKeyPair(); 237 237 + const callerDidKey = callerKeyPair.publicDidKey; 238 238 + const mintedPassword = "minted-on-retry-99"; 239 239 + 240 240 + // First attempt: createAppPassword throws; everything else succeeds. 241 241 + const firstPds = { 242 242 + ...mockPds(), 243 243 + async createAppPassword(_: any) { 244 244 + throw new Error("PDS transient: 503"); 245 245 + }, 246 246 + }; 247 247 + const firstPlc = mockPlc(); 248 248 + const firstOrch = new ProvisionOrchestrator({ 249 249 + adapter, 250 250 + cipher, 251 251 + plc: firstPlc, 252 252 + pds: firstPlc && (firstPds as any), 253 253 + pdsDid: "did:web:pds.test", 254 254 + }); 255 255 + await expect( 256 256 + firstOrch.provision({ 257 257 + attemptId: "ss-retry", 258 258 + pdsEndpoint: "https://pds.test", 259 259 + handle: "h.test", 260 260 + email: "h@x.test", 261 261 + password: "user-root-pw", 262 262 + rotationKey: callerDidKey, 263 263 + }) 264 264 + ).rejects.toThrow(); 265 265 + 266 266 + // Sanity: row is in the failure state we expect. 267 267 + const failRow = await adapter.getProvisionAttempt("ss-retry"); 268 268 + expect(failRow!.status).toBe("activated"); 269 269 + expect(failRow!.encryptedPassword).toBeFalsy(); 270 270 + expect(firstPlc.ops.length).toBe(2); // genesis + update 271 271 + 272 272 + // Second attempt with the SAME attemptId. Use a fresh mock that would 273 273 + // EXPLODE if createAccount or any PLC op was re-issued. 274 274 + const retryPlc = { 275 275 + ops: [] as Array<{ did: string; op: any }>, 276 276 + async submit(_did: string, _op: any) { 277 277 + throw new Error("retry must not re-submit PLC ops"); 278 278 + }, 279 279 + }; 280 280 + const retryAppPasswordCalls: any[] = []; 281 281 + const retryPds = { 282 282 + async createAccount() { 283 283 + throw new Error("retry must not re-call createAccount"); 284 284 + }, 285 285 + async getRecommendedDidCredentials() { 286 286 + throw new Error("retry must not re-fetch recommended creds"); 287 287 + }, 288 288 + async activateAccount() { 289 289 + throw new Error("retry must not re-activate"); 290 290 + }, 291 291 + async createAppPassword(input: any) { 292 292 + retryAppPasswordCalls.push(input); 293 293 + return { password: mintedPassword }; 294 294 + }, 295 295 + async createSession(input: { pdsUrl: string; identifier: string; password: string }) { 296 296 + // Verify the retry uses the user's root password to obtain a fresh 297 297 + // accessJwt (the cached one from the failed attempt may have expired). 298 298 + expect(input.password).toBe("user-root-pw"); 299 299 + return { accessJwt: "AT-fresh", refreshJwt: "RT-fresh", did: "did:plc:x" }; 300 300 + }, 301 301 + }; 302 302 + const retryOrch = new ProvisionOrchestrator({ 303 303 + adapter, 304 304 + cipher, 305 305 + plc: retryPlc as any, 306 306 + pds: retryPds as any, 307 307 + pdsDid: "did:web:pds.test", 308 308 + }); 309 309 + 310 310 + const result = await retryOrch.provision({ 311 311 + attemptId: "ss-retry", 312 312 + pdsEndpoint: "https://pds.test", 313 313 + handle: "h.test", 314 314 + email: "h@x.test", 315 315 + password: "user-root-pw", 316 316 + rotationKey: callerDidKey, 317 317 + }); 318 318 + 319 319 + // Retry succeeded. 320 320 + expect(result.status).toBe("activated"); 321 321 + expect(result.did).toBe(failRow!.did); // SAME DID, not a new one 322 322 + expect(result.rootCredentials).toBeDefined(); 323 323 + expect(retryAppPasswordCalls.length).toBe(1); 324 324 + 325 325 + // Row now has the encrypted (minted) password. 326 326 + const finalRow = await adapter.getProvisionAttempt("ss-retry"); 327 327 + expect(finalRow!.status).toBe("activated"); 328 328 + expect(finalRow!.encryptedPassword).toBeTruthy(); 329 329 + const decrypted = await cipher.decryptString(finalRow!.encryptedPassword!); 330 330 + expect(decrypted).toBe(mintedPassword); 331 331 + }); 332 332 + 333 333 + it("rejects rotationKey that is not did:key:z…", async () => { 334 334 + const orch = new ProvisionOrchestrator({ 335 335 + adapter, 336 336 + cipher, 337 337 + plc: mockPlc(), 338 338 + pds: mockPds(), 339 339 + pdsDid: "did:web:pds.test", 340 340 + }); 341 341 + 342 342 + await expect( 343 343 + orch.provision({ 344 344 + attemptId: "bad1", 345 345 + pdsEndpoint: "https://pds.test", 346 346 + handle: "h.test", 347 347 + email: "h@x.test", 348 348 + password: "p", 349 349 + rotationKey: "not-a-did-key", 350 350 + }) 351 351 + ).rejects.toThrow(/rotationKey/); 352 352 + }); 353 353 + });

+18

packages/contrail-community/tests/schema.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite"; 3 3 + import { initCommunitySchema } from "../src/schema"; 4 4 + 5 5 + describe("provision_attempts schema", () => { 6 6 + it("enforces status enum", async () => { 7 7 + const db = createSqliteDatabase(":memory:"); 8 8 + await initCommunitySchema(db); 9 9 + await expect( 10 10 + db 11 11 + .prepare( 12 12 + "INSERT INTO provision_attempts (attempt_id, did, status, created_at, updated_at, pds_endpoint, handle, email) VALUES (?, ?, ?, ?, ?, ?, ?, ?)" 13 13 + ) 14 14 + .bind("a1", "did:plc:x", "bogus", 1, 1, "https://pds", "h.test", "x@x") 15 15 + .run() 16 16 + ).rejects.toThrow(); 17 17 + }); 18 18 + });

+135

packages/contrail-community/tests/service-auth.test.ts

Reviewed

··· 1 1 + import { describe, it, expect } from "vitest"; 2 2 + import { mintServiceAuthJwt } from "../src/service-auth"; 3 3 + import { generateKeyPair } from "../src/plc"; 4 4 + 5 5 + function b64urlDecode(s: string): Uint8Array { 6 6 + const normal = s.replace(/-/g, "+").replace(/_/g, "/"); 7 7 + const padded = normal + "=".repeat((4 - (normal.length % 4)) % 4); 8 8 + const bin = atob(padded); 9 9 + const out = new Uint8Array(bin.length); 10 10 + for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i); 11 11 + return out; 12 12 + } 13 13 + 14 14 + function decodeJwtJson(seg: string): Record<string, unknown> { 15 15 + return JSON.parse(new TextDecoder().decode(b64urlDecode(seg))); 16 16 + } 17 17 + 18 18 + /** P-256 curve order; used for low-S threshold. */ 19 19 + const P256_N = BigInt( 20 20 + "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551" 21 21 + ); 22 22 + const P256_N_HALF = P256_N >> 1n; 23 23 + 24 24 + function bytesToBigInt(b: Uint8Array): bigint { 25 25 + let v = 0n; 26 26 + for (const byte of b) v = (v << 8n) | BigInt(byte); 27 27 + return v; 28 28 + } 29 29 + 30 30 + describe("mintServiceAuthJwt", () => { 31 31 + it("round-trips: signature verifies against the keypair's public key (P1363, not DER)", async () => { 32 32 + // This is the canary: if the signer accidentally returns DER instead of raw r||s, 33 33 + // Web Crypto's verify with raw form will reject it — and so will atproto PDSes. 34 34 + const kp = await generateKeyPair(); 35 35 + const jwt = await mintServiceAuthJwt({ 36 36 + privateJwk: kp.privateJwk, 37 37 + iss: "did:plc:abc", 38 38 + aud: "did:web:pds.test", 39 39 + lxm: "com.atproto.server.createAccount", 40 40 + }); 41 41 + 42 42 + // Reconstruct the public JWK from the private JWK (drop d, key_ops, ext). 43 43 + const priv = kp.privateJwk as Record<string, unknown>; 44 44 + const publicJwk: JsonWebKey = { 45 45 + kty: priv.kty as string, 46 46 + crv: priv.crv as string, 47 47 + x: priv.x as string, 48 48 + y: priv.y as string, 49 49 + }; 50 50 + const publicKey = await crypto.subtle.importKey( 51 51 + "jwk", 52 52 + publicJwk, 53 53 + { name: "ECDSA", namedCurve: "P-256" }, 54 54 + false, 55 55 + ["verify"] 56 56 + ); 57 57 + 58 58 + const [h, p, s] = jwt.split("."); 59 59 + const signedBytes = new TextEncoder().encode(`${h}.${p}`); 60 60 + const sig = b64urlDecode(s!); 61 61 + 62 62 + // P1363 form is exactly 64 bytes for P-256. DER would be ~70-72 and start with 0x30. 63 63 + expect(sig.length).toBe(64); 64 64 + 65 65 + const ok = await crypto.subtle.verify( 66 66 + { name: "ECDSA", hash: "SHA-256" }, 67 67 + publicKey, 68 68 + sig as BufferSource, 69 69 + signedBytes as BufferSource 70 70 + ); 71 71 + expect(ok).toBe(true); 72 72 + }); 73 73 + 74 74 + it("emits low-S signatures across many independent signings", async () => { 75 75 + // Without normalization, ~50% of ECDSA signatures have s > n/2. 76 76 + // Across 12 fresh keypairs, the probability of *all* being naturally low-S is 77 77 + // ~1/4096. If the test ever sees a high-S signature, normalization is broken. 78 78 + const kp = await generateKeyPair(); 79 79 + for (let i = 0; i < 12; i++) { 80 80 + const jwt = await mintServiceAuthJwt({ 81 81 + privateJwk: kp.privateJwk, 82 82 + iss: "did:plc:abc", 83 83 + aud: "did:web:pds.test", 84 84 + lxm: "com.atproto.server.createAccount", 85 85 + // Force a fresh signature each iteration; ECDSA k is randomized per sign. 86 86 + }); 87 87 + const sig = b64urlDecode(jwt.split(".")[2]!); 88 88 + const s = bytesToBigInt(sig.slice(32)); 89 89 + expect(s).toBeLessThanOrEqual(P256_N_HALF); 90 90 + } 91 91 + }); 92 92 + 93 93 + it("encodes header and claims as base64url JSON with the expected shape", async () => { 94 94 + const kp = await generateKeyPair(); 95 95 + const fixedNow = 1_700_000_000_000; 96 96 + const jwt = await mintServiceAuthJwt({ 97 97 + privateJwk: kp.privateJwk, 98 98 + iss: "did:plc:abc", 99 99 + aud: "did:web:pds.test", 100 100 + lxm: "com.atproto.server.createAccount", 101 101 + ttlSec: 60, 102 102 + now: fixedNow, 103 103 + }); 104 104 + 105 105 + const [h, p] = jwt.split("."); 106 106 + const header = decodeJwtJson(h!); 107 107 + const payload = decodeJwtJson(p!); 108 108 + 109 109 + // Header MUST be exactly {alg,typ}; presence of kid would change the 110 110 + // signed bytes and break PDS verification (which doesn't use kid). 111 111 + expect(header).toEqual({ alg: "ES256", typ: "JWT" }); 112 112 + 113 113 + expect(payload.iss).toBe("did:plc:abc"); 114 114 + expect(payload.aud).toBe("did:web:pds.test"); 115 115 + expect(payload.lxm).toBe("com.atproto.server.createAccount"); 116 116 + expect(payload.iat).toBe(Math.floor(fixedNow / 1000)); 117 117 + expect(payload.exp).toBe(Math.floor(fixedNow / 1000) + 60); 118 118 + expect(typeof payload.jti).toBe("string"); 119 119 + expect((payload.jti as string).length).toBeGreaterThan(0); 120 120 + }); 121 121 + 122 122 + it("uses unique jti per call (replay-protection sanity)", async () => { 123 123 + const kp = await generateKeyPair(); 124 124 + const mk = () => 125 125 + mintServiceAuthJwt({ 126 126 + privateJwk: kp.privateJwk, 127 127 + iss: "did:plc:abc", 128 128 + aud: "did:web:pds.test", 129 129 + lxm: "com.atproto.server.createAccount", 130 130 + }); 131 131 + const a = decodeJwtJson((await mk()).split(".")[1]!); 132 132 + const b = decodeJwtJson((await mk()).split(".")[1]!); 133 133 + expect(a.jti).not.toBe(b.jti); 134 134 + }); 135 135 + });

+2 -2

packages/contrail-community/tsup.config.ts

Reviewed

··· 1 1 import { defineConfig } from "tsup"; 2 2 3 3 export default defineConfig({ 4 4 - entry: ["src/index.ts"], 4 4 + entry: ["src/index.ts", "src/cli/index.ts"], 5 5 format: ["esm"], 6 6 dts: true, 7 7 sourcemap: true, 8 8 clean: true, 9 9 tsconfig: "tsconfig.build.json", 10 10 - external: ["@atmo-dev/contrail"], 10 10 + external: ["@atmo-dev/contrail", "wrangler"], 11 11 });

+37

packages/contrail/src/cli.ts

Reviewed

··· 10 10 import { registerRefresh } from "./cli/commands/refresh.js"; 11 11 import { registerDev } from "./cli/commands/dev.js"; 12 12 import { registerAppendScheduled } from "./cli/commands/append-scheduled.js"; 13 13 + import { resolveAndLoadConfig } from "./cli/shared.js"; 13 14 14 15 const cli = cac("contrail"); 15 16 ··· 17 18 registerRefresh(cli); 18 19 registerDev(cli); 19 20 registerAppendScheduled(cli); 21 21 + 22 22 + // `reap` lives in @atmo-dev/contrail-community after the PR #30 package split. 23 23 + // Dynamically import so contrail has no compile-time edge into the community 24 24 + // package (contrail-community already depends on contrail; a static import 25 25 + // here would create a build cycle). contrail declares contrail-community as an 26 26 + // optional peer so a consumer that installs both gets `reap` wired up; when 27 27 + // it's genuinely absent the subcommand is simply omitted. 28 28 + try { 29 29 + const mod = await import("@atmo-dev/contrail-community" as string); 30 30 + if (typeof mod.registerReap === "function") { 31 31 + mod.registerReap(cli, { resolveAndLoadConfig }); 32 32 + } else { 33 33 + // Loaded, but the expected export is missing — a real packaging problem, 34 34 + // not "not installed". Surface it so a broken build is debuggable. 35 35 + console.warn( 36 36 + "[contrail] @atmo-dev/contrail-community loaded but does not export registerReap; `reap` unavailable." 37 37 + ); 38 38 + } 39 39 + } catch (err) { 40 40 + const code = (err as { code?: string })?.code; 41 41 + if (code === "ERR_MODULE_NOT_FOUND") { 42 42 + // Expected when contrail-community isn't installed alongside contrail. 43 43 + // Debug-level so it doesn't nag, but is visible under DEBUG diagnostics. 44 44 + if (process.env.DEBUG) { 45 45 + console.debug("[contrail] contrail-community not installed; `reap` unavailable."); 46 46 + } 47 47 + } else { 48 48 + // A different failure (broken export, missing transitive dep, syntax 49 49 + // error) — do NOT swallow it, or `reap` silently vanishes with no clue. 50 50 + console.warn( 51 51 + `[contrail] failed to load @atmo-dev/contrail-community for \`reap\`: ${ 52 52 + err instanceof Error ? err.message : String(err) 53 53 + }` 54 54 + ); 55 55 + } 56 56 + } 20 57 21 58 cli.help(); 22 59

+1 -1

packages/contrail/src/index.ts

Reviewed

··· 189 189 export { resolveLabelerEndpoint } from "./core/labels/resolve"; 190 190 191 191 // Community has moved to @atmo-dev/contrail-community. Import from there: 192 192 - // import { createCommunityIntegration, CommunityAdapter, ... } from "@atmo-dev/contrail-community"; 192 192 + // import { createCommunityIntegration, CommunityAdapter, ProvisionOrchestrator, ... } from "@atmo-dev/contrail-community"; 193 193 // const app = createApp(db, config, { community: createCommunityIntegration(...) });

+1

packages/contrail/tests/schema.test.ts

Reviewed

··· 55 55 await initSchema(db, TEST_CONFIG); 56 56 }); 57 57 }); 58 58 +

+15

pnpm-lock.yaml

Reviewed

··· 569 569 '@atmo-dev/contrail-base': 570 570 specifier: workspace:* 571 571 version: link:../contrail-base 572 572 + cac: 573 573 + specifier: ^7.0.0 574 574 + version: 7.0.0 572 575 hono: 573 576 specifier: ^4.12.8 574 577 version: 4.12.15 578 578 + wrangler: 579 579 + specifier: ^4.0.0 580 580 + version: 4.84.1(@cloudflare/workers-types@4.20260424.1) 575 581 devDependencies: 582 582 + '@types/node': 583 583 + specifier: ^25.5.0 584 584 + version: 25.6.0 585 585 + '@types/pg': 586 586 + specifier: ^8.20.0 587 587 + version: 8.20.0 588 588 + pg: 589 589 + specifier: ^8.20.0 590 590 + version: 8.20.0 576 591 tsup: 577 592 specifier: ^8.5.0 578 593 version: 8.5.1(jiti@2.6.1)(postcss@8.5.10)(tsx@4.21.0)(typescript@5.9.3)