ConusAI vendor v0.1.0-dev.20261027+9b1131fb

2026-10-27 18:05:17 +00:00
commit 3102273ec7
538 changed files with 80203 additions and 0 deletions
@@ -0,0 +1,248 @@
+// The account page's platform analytics erasure and export (ADR-049) over a fake privacy port: the
+// subject is always the signed-in user, a repeated request answers the open job, a ticket reaches
+// only its own user's job, the export downloads when completed, and nothing runs for an API
+// credential or without the platform service.
+
+import { AppError } from "@conusai-kit/core"
+import { describe, expect, it } from "vitest"
+import { requestIdOf, TICKET_KEY_INFO, TICKET_LIFETIME_MS, TICKET_VERSION, ticketFor } from "../core/analytics.js"
+import type { AccountPrivacy, AccountPrivacyRequest, AnalyticsView } from "../index.js"
+import { makeApp, type Person } from "./harness.js"
+
+/** A privacy service like the platform's: one open job per kind and user, settled by `finish`. */
+function fakePrivacy() {
+  const jobs = new Map<string, AccountPrivacyRequest & { userId: string }>()
+  const calls: { op: string; userId?: string; id?: string }[] = []
+  let next = 1
+  const open = (kind: "erase" | "export", userId: string) => {
+    calls.push({ op: kind, userId })
+    for (const job of jobs.values()) {
+      if (job.kind === kind && job.userId === userId && (job.status === "pending" || job.status === "running")) {
+        return { request: job, created: false }
+      }
+    }
+    const id = `00000000-0000-4000-8000-${String(next++).padStart(12, "0")}`
+    const job = { id, kind, userId, status: "pending" as const, stores: {}, created_at: "2026-10-26T08:00:00Z" }
+    jobs.set(id, job)
+    return { request: job, created: true }
+  }
+  const privacy: AccountPrivacy = {
+    ticketKey: "dt_fixture_secret",
+    eraseSubject: async ({ userId }) => open("erase", userId),
+    exportSubject: async ({ userId }) => open("export", userId),
+    getRequest: async (id) => {
+      calls.push({ op: "get", id })
+      const job = jobs.get(id)
+      if (!job) throw Object.assign(new Error("not found"), { status: 404 })
+      return job
+    },
+    downloadExport: async (id) => {
+      calls.push({ op: "download", id })
+      const job = jobs.get(id)
+      if (!job) throw Object.assign(new Error("not found"), { status: 404 })
+      if (job.kind !== "export" || job.status !== "completed")
+        throw Object.assign(new Error("not ready"), { status: 409 })
+      return { request_id: id, stores: { analytics: { events: [] } } }
+    },
+  }
+  const finish = (id: string) => {
+    const job = jobs.get(id)
+    if (!job) throw new Error("no such job")
+    jobs.set(id, {
+      ...job,
+      status: "completed",
+      finished_at: "2026-10-26T08:05:00Z",
+      stores: { analytics: { status: "completed", deleted: 2, anonymized: 40 }, logs: { status: "not_keyed" } },
+    })
+  }
+  return { privacy, calls, finish, jobs }
+}
+
+const requestAs = (person: Person, kind: "erase" | "export") =>
+  person.call().callByName("account.analytics.request", { kind }) as Promise<AnalyticsView>
+const statusAs = (person: Person, ticket: string) =>
+  person.call().callByName("account.analytics.status", { ticket }) as Promise<AnalyticsView>
+const exportAs = (person: Person, ticket: string) =>
+  person.call().callByName("account.analytics.export", { ticket }) as Promise<{ document: Record<string, unknown> }>
+
+const problemOf = async (run: Promise<unknown>) => {
+  const error = await run.then(
+    () => undefined,
+    (thrown: unknown) => thrown,
+  )
+  expect(error).toBeInstanceOf(AppError)
+  return (error as AppError).problem
+}
+
+/** The id of the one job the fake platform holds; fails the test when there is none. */
+function onlyJob(fake: { jobs: Map<string, unknown> }): string {
+  const [id] = fake.jobs.keys()
+  if (id === undefined) throw new Error("the fake platform holds no job")
+  return id
+}
+
+describe("account.analytics tickets", () => {
+  const T0 = Date.parse("2026-10-26T08:00:00Z")
+  const notFound = { problem: { status: 404 } }
+
+  it("name the request for one user only, and refuse a forged or swapped one", async () => {
+    const ticket = await ticketFor("key", "user-a", "req-1", T0)
+    await expect(requestIdOf("key", "user-a", ticket, T0)).resolves.toBe("req-1")
+    await expect(requestIdOf("key", "user-b", ticket, T0)).rejects.toMatchObject(notFound)
+    await expect(requestIdOf("key", "user-a", ticket.replace(".req-1.", ".req-2."), T0)).rejects.toMatchObject(notFound)
+    await expect(requestIdOf("key", "user-a", "no-dot", T0)).rejects.toMatchObject(notFound)
+    // A flipped MAC digit, and a ticket of the old `<id>.<mac>` shape, are forgeries too.
+    const last = ticket.at(-1) === "0" ? "1" : "0"
+    await expect(requestIdOf("key", "user-a", `${ticket.slice(0, -1)}${last}`, T0)).rejects.toMatchObject(notFound)
+    await expect(requestIdOf("key", "user-a", `req-1.${ticket.split(".").at(-1)}`, T0)).rejects.toMatchObject(notFound)
+  })
+
+  it("carry the version and an expiry inside the signed payload", async () => {
+    const ticket = await ticketFor("key", "user-a", "req-1", T0)
+    const [version, requestId, expiresAt, mac] = ticket.split(".")
+    expect(version).toBe(TICKET_VERSION)
+    expect(requestId).toBe("req-1")
+    expect(Number(expiresAt)).toBe(T0 + TICKET_LIFETIME_MS)
+    expect(mac).toMatch(/^[0-9a-f]{64}$/)
+    // Extending the expiry, or claiming another version, breaks the MAC.
+    const extended = [version, requestId, String(T0 + 10 * TICKET_LIFETIME_MS), mac].join(".")
+    await expect(requestIdOf("key", "user-a", extended, T0)).rejects.toMatchObject(notFound)
+    const otherVersion = ["v2", requestId, expiresAt, mac].join(".")
+    await expect(requestIdOf("key", "user-a", otherVersion, T0)).rejects.toMatchObject(notFound)
+  })
+
+  it("expire after a day, with the same NotFound as a forged ticket", async () => {
+    const ticket = await ticketFor("key", "user-a", "req-1", T0)
+    await expect(requestIdOf("key", "user-a", ticket, T0 + TICKET_LIFETIME_MS - 1)).resolves.toBe("req-1")
+    const expired = await problemOf(requestIdOf("key", "user-a", ticket, T0 + TICKET_LIFETIME_MS))
+    const forged = await problemOf(requestIdOf("key", "user-a", `${ticket.slice(0, -4)}beef`, T0))
+    expect(expired).toEqual(forged)
+    expect(expired.status).toBe(404)
+  })
+
+  it("are MAC'd under a key derived from the secret, never under the secret itself", async () => {
+    const ticket = await ticketFor("key", "user-a", "req-1", T0)
+    const [version, requestId, expiresAt, mac] = ticket.split(".") as [string, string, string, string]
+    const payload = `${version}|${expiresAt}|${"user-a".length}:user-a|${requestId}`
+    const sign = async (raw: Uint8Array<ArrayBuffer>) => {
+      const key = await crypto.subtle.importKey("raw", raw, { name: "HMAC", hash: "SHA-256" }, false, ["sign"])
+      const bytes = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload)))
+      return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("")
+    }
+    expect(mac).not.toBe(await sign(new TextEncoder().encode("key")))
+    const ikm = await crypto.subtle.importKey("raw", new TextEncoder().encode("key"), "HKDF", false, ["deriveBits"])
+    const derived = await crypto.subtle.deriveBits(
+      { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: new TextEncoder().encode(TICKET_KEY_INFO) },
+      ikm,
+      256,
+    )
+    expect(TICKET_KEY_INFO).toBe("conusai-template/account-privacy-ticket/v1")
+    expect(mac).toBe(await sign(new Uint8Array(derived)))
+  })
+
+  it("stop verifying when the deployment token rotates; asking again answers the open job with a fresh ticket", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+    const before = await requestAs(ada, "export")
+
+    // Rotation (documented in core/analytics.ts): the old ticket is NotFound, nothing breaks.
+    ;(fake.privacy as { ticketKey: string }).ticketKey = "dt_rotated_secret"
+    expect((await problemOf(statusAs(ada, before.ticket))).status).toBe(404)
+    const again = await requestAs(ada, "export")
+
+    expect(again.created).toBe(false)
+    expect(fake.jobs.size).toBe(1)
+    expect((await statusAs(ada, again.ticket)).status).toBe("pending")
+  })
+})
+
+describe("account.analytics.request", () => {
+  it("erases the signed-in user's data by their user id, and a repeated click answers the open job", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+
+    const first = await requestAs(ada, "erase")
+    const again = await requestAs(ada, "erase")
+
+    expect(first).toMatchObject({ kind: "erase", status: "pending", created: true })
+    expect(again.created).toBe(false)
+    // The same job; each answer carries its own freshly dated ticket for it.
+    const key = fake.privacy.ticketKey
+    const [firstId, againId] = await Promise.all(
+      [first, again].map((view) => requestIdOf(key, ada.actor.userId, view.ticket, Date.now())),
+    )
+    expect(againId).toBe(firstId)
+    expect(fake.calls.filter((call) => call.op === "erase")).toEqual([
+      { op: "erase", userId: ada.actor.userId },
+      { op: "erase", userId: ada.actor.userId },
+    ])
+    expect(fake.jobs.size).toBe(1)
+  })
+
+  it("follows the job to completed with its per-store counts", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+    const started = await requestAs(ada, "erase")
+    fake.finish(onlyJob(fake))
+
+    const done = await statusAs(ada, started.ticket)
+
+    expect(done.status).toBe("completed")
+    expect(done.stores.analytics).toEqual({ status: "completed", deleted: 2, anonymized: 40, exported: 0 })
+    expect(done.stores.logs?.status).toBe("not_keyed")
+  })
+
+  it("is refused to an API credential acting as the person", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+
+    const problem = await problemOf(
+      ada.call({ interactive: false }).callByName("account.analytics.request", { kind: "erase" }),
+    )
+
+    expect(problem.status).toBe(403)
+    expect(fake.calls).toEqual([])
+  })
+
+  it("answers unavailable when the deployment has no privacy service (the fake platform)", async () => {
+    const app = makeApp()
+    const ada = await app.signUp("ada@example.test")
+
+    const problem = await problemOf(requestAs(ada, "export"))
+
+    expect(problem.status).toBe(503)
+  })
+})
+
+describe("account.analytics.export", () => {
+  it("is a conflict until the export completed, then the document", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+    const started = await requestAs(ada, "export")
+
+    expect((await problemOf(exportAs(ada, started.ticket))).status).toBe(409)
+    fake.finish(onlyJob(fake))
+    const downloaded = await exportAs(ada, started.ticket)
+
+    expect(downloaded.document).toMatchObject({ stores: { analytics: { events: [] } } })
+  })
+
+  it("never reaches another person's export: their ticket is NotFound and no platform call is made", async () => {
+    const fake = fakePrivacy()
+    const app = makeApp({ privacy: fake.privacy })
+    const ada = await app.signUp("ada@example.test")
+    const bob = await app.signUp("bob@example.test")
+    const started = await requestAs(ada, "export")
+    fake.finish(onlyJob(fake))
+    const before = fake.calls.length
+
+    expect((await problemOf(exportAs(bob, started.ticket))).status).toBe(404)
+    expect((await problemOf(statusAs(bob, started.ticket))).status).toBe(404)
+    expect(fake.calls.length).toBe(before)
+  })
+})