mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-27 15:05:21 +00:00
jackandClaude Opus 5
2d58bbcfaf
A fifth flake landed on CI while the first guard was in review — GossipSyncBoardTests timing out at 1.03s — and the guard did not catch it, because the deadline was `TestConstants.shortTimeout` rather than a literal. A literals-only scan cannot see a short value behind a symbol, which is the more common way it is written: 81 wait sites used shortTimeout (1s) or defaultTimeout (5s), every one of them below the floor. Rather than guess which of those were safe to raise, all 81 were converted and the suite timed. Runtime went 15s -> 72s, which located the genuine negative waits precisely: ten tests that assert something does *not* happen and therefore always run their deadline out. Measurement instead of a heuristic, since a mis-guess in either direction is invisible — too short reintroduces the flake, too long silently costs a minute a run. Those 28 sites now use `TestConstants.negativeWaitWindow`, a named constant whose doc explains the inverted reasoning: for a negative wait, starvation can only make the assertion *more* likely to hold, so short is correct, and the name states the polarity instead of leaving a bare literal that reads like the mistake. Suite is back to 15.3s. The guard now also rejects `timeout: TestConstants.shortTimeout` and `defaultTimeout`, while accepting `negativeWaitWindow` by name. Re-verified with a canary carrying every banned shape — literal default, both named constants, and an elapsed-time upper bound. All four were flagged with file and line; the suite went green again on removal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
922 lines
40 KiB
Swift
922 lines
40 KiB
Swift
//
|
|
// CourierEndToEndTests.swift
|
|
// bitchat
|
|
//
|
|
// This is free and unencumbered software released into the public domain.
|
|
// For more information, see <https://unlicense.org>
|
|
//
|
|
|
|
import Testing
|
|
import Foundation
|
|
import Combine
|
|
import CoreBluetooth
|
|
import BitFoundation
|
|
@testable import bitchat
|
|
|
|
/// Three-node courier flow exercised through real BLEService instances with
|
|
/// packets ferried in-process: Alice deposits a sealed envelope with Carol
|
|
/// while Bob is unreachable; Carol hands it over when Bob announces; Bob
|
|
/// opens it and sees Alice's message in the right DM thread.
|
|
struct CourierEndToEndTests {
|
|
|
|
// MARK: - Helpers
|
|
|
|
private final class PacketTap {
|
|
private let lock = NSLock()
|
|
private var packets: [BitchatPacket] = []
|
|
|
|
func record(_ packet: BitchatPacket) {
|
|
lock.lock(); packets.append(packet); lock.unlock()
|
|
}
|
|
|
|
func first(ofType type: MessageType) -> BitchatPacket? {
|
|
lock.lock(); defer { lock.unlock() }
|
|
return packets.first { $0.type == type.rawValue }
|
|
}
|
|
|
|
func count(ofType type: MessageType) -> Int {
|
|
lock.lock(); defer { lock.unlock() }
|
|
return packets.filter { $0.type == type.rawValue }.count
|
|
}
|
|
|
|
func all(ofType type: MessageType) -> [BitchatPacket] {
|
|
lock.lock(); defer { lock.unlock() }
|
|
return packets.filter { $0.type == type.rawValue }
|
|
}
|
|
}
|
|
|
|
private final class NoiseCaptureDelegate: BitchatDelegate {
|
|
private let lock = NSLock()
|
|
private var payloads: [(peerID: PeerID, type: NoisePayloadType, payload: Data)] = []
|
|
|
|
func didReceiveNoisePayload(from peerID: PeerID, type: NoisePayloadType, payload: Data, timestamp: Date) {
|
|
lock.lock(); payloads.append((peerID, type, payload)); lock.unlock()
|
|
}
|
|
|
|
func snapshot() -> [(peerID: PeerID, type: NoisePayloadType, payload: Data)] {
|
|
lock.lock(); defer { lock.unlock() }
|
|
return payloads
|
|
}
|
|
|
|
// Unused BitchatDelegate requirements.
|
|
func didReceiveMessage(_ message: BitchatMessage) {}
|
|
func didConnectToPeer(_ peerID: PeerID) {}
|
|
func didDisconnectFromPeer(_ peerID: PeerID) {}
|
|
func didUpdatePeerList(_ peers: [PeerID]) {}
|
|
func didUpdateBluetoothState(_ state: CBManagerState) {}
|
|
func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {}
|
|
}
|
|
|
|
private func makeService(identityManager: MockIdentityManager? = nil) -> BLEService {
|
|
let keychain = MockKeychain()
|
|
let identityManager = identityManager ?? MockIdentityManager(keychain)
|
|
let idBridge = NostrIdentityBridge(keychain: MockKeychainHelper())
|
|
let service = BLEService(
|
|
keychain: keychain,
|
|
idBridge: idBridge,
|
|
identityManager: identityManager,
|
|
initializeBluetoothManagers: false
|
|
)
|
|
service.courierStore = CourierStore(persistsToDisk: false)
|
|
return service
|
|
}
|
|
|
|
/// Handling any packet from a peer preseeds it as a connected,
|
|
/// verified entry in the receiving service's registry.
|
|
private func preseedConnectedPeer(_ peer: BLEService, in service: BLEService) {
|
|
let packet = BitchatPacket(
|
|
type: MessageType.message.rawValue,
|
|
senderID: Data(hexString: peer.myPeerID.id) ?? Data(),
|
|
recipientID: nil,
|
|
timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
|
|
payload: Data("ping".utf8),
|
|
signature: nil,
|
|
ttl: 1
|
|
)
|
|
service._test_handlePacket(packet, fromPeerID: peer.myPeerID)
|
|
}
|
|
|
|
/// Establishes the Noise session that proves the direct link's peer owns
|
|
/// its announced static identity. CoreBluetooth is disabled in this suite,
|
|
/// so the handshake is ferried in-process just like courier packets.
|
|
private func establishNoiseSession(between initiator: BLEService, and responder: BLEService) throws {
|
|
let message1 = try initiator._test_noiseInitiateHandshake(with: responder.myPeerID)
|
|
let message2 = try #require(
|
|
try responder._test_noiseProcessHandshakeMessage(from: initiator.myPeerID, message: message1)
|
|
)
|
|
let message3 = try #require(
|
|
try initiator._test_noiseProcessHandshakeMessage(from: responder.myPeerID, message: message2)
|
|
)
|
|
_ = try responder._test_noiseProcessHandshakeMessage(from: initiator.myPeerID, message: message3)
|
|
}
|
|
|
|
// MARK: - Tests
|
|
|
|
@Test func courierCarriesMessageAcrossDisjointConnectivity() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
let bob = makeService()
|
|
// Alice and Carol are mutual favorites; trust policy is exercised
|
|
// separately in depositFromUntrustedPeerIsRejected.
|
|
carol.courierDepositPolicy = { _, _ in .favorite }
|
|
|
|
let bobDelegate = NoiseCaptureDelegate()
|
|
bob.delegate = bobDelegate
|
|
|
|
let aliceOut = PacketTap()
|
|
alice._test_onOutboundPacket = aliceOut.record
|
|
let carolOut = PacketTap()
|
|
carol._test_onOutboundPacket = carolOut.record
|
|
let bobOut = PacketTap()
|
|
bob._test_onOutboundPacket = bobOut.record
|
|
|
|
// Alice can see Carol; Bob is nowhere on the mesh.
|
|
preseedConnectedPeer(carol, in: alice)
|
|
|
|
// 1. Alice seals to Bob's static key and deposits with Carol.
|
|
#expect(alice.sendCourierMessage(
|
|
"the camp moved north",
|
|
messageID: "courier-msg-1",
|
|
recipientNoiseKey: bob.noiseStaticPublicKeyData(),
|
|
via: [carol.myPeerID]
|
|
))
|
|
let deposited = await TestHelpers.waitUntil(
|
|
{ aliceOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(deposited)
|
|
let depositPacket = try #require(aliceOut.first(ofType: .courierEnvelope))
|
|
|
|
// 2. Ferry the deposit to Carol; she carries it (opaque to her).
|
|
carol._test_handlePacket(depositPacket, fromPeerID: alice.myPeerID, signingPublicKey: alice.noiseSigningPublicKeyData())
|
|
let carried = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(carried)
|
|
|
|
// 3. Later, Bob proves link ownership and announces near Carol →
|
|
// handover fires.
|
|
try establishNoiseSession(between: carol, and: bob)
|
|
bob.sendBroadcastAnnounce()
|
|
let announced = await TestHelpers.waitUntil(
|
|
{ bobOut.first(ofType: .announce) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(announced)
|
|
let announcePacket = try #require(bobOut.first(ofType: .announce))
|
|
carol._test_handlePacket(announcePacket, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let handedOver = await TestHelpers.waitUntil(
|
|
{ carolOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(handedOver)
|
|
// With CoreBluetooth disabled there is no physical link for the send
|
|
// planner to accept, so Carol truthfully retains the durable copy even
|
|
// though the packet tap lets us ferry the attempted handover below.
|
|
#expect(!carol.courierStore.isEmpty)
|
|
let handoverPacket = try #require(carolOut.first(ofType: .courierEnvelope))
|
|
#expect(PeerID(hexData: handoverPacket.recipientID) == bob.myPeerID)
|
|
|
|
// 4. Ferry the handover to Bob; he opens the envelope.
|
|
bob._test_handlePacket(handoverPacket, fromPeerID: carol.myPeerID)
|
|
let received = await TestHelpers.waitUntil(
|
|
{ !bobDelegate.snapshot().isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(received)
|
|
|
|
let delivered = try #require(bobDelegate.snapshot().first)
|
|
#expect(delivered.type == .privateMessage)
|
|
// Alice is absent from Bob's mesh, so the sender resolves to her
|
|
// full noise-key ID — the stable favorite conversation — not the
|
|
// short mesh ID (which Bob couldn't resolve to a nickname) and not
|
|
// the courier's identity.
|
|
#expect(delivered.peerID == PeerID(hexData: alice.noiseStaticPublicKeyData()))
|
|
#expect(delivered.peerID != carol.myPeerID)
|
|
let message = try #require(PrivateMessagePacket.decode(from: delivered.payload))
|
|
#expect(message.messageID == "courier-msg-1")
|
|
#expect(message.content == "the camp moved north")
|
|
}
|
|
|
|
@Test func courieredMailFromBlockedSenderIsDropped() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
let bobIdentity = MockIdentityManager(MockKeychain())
|
|
let bob = makeService(identityManager: bobIdentity)
|
|
carol.courierDepositPolicy = { _, _ in .favorite }
|
|
|
|
let bobDelegate = NoiseCaptureDelegate()
|
|
bob.delegate = bobDelegate
|
|
let aliceOut = PacketTap()
|
|
alice._test_onOutboundPacket = aliceOut.record
|
|
let carolOut = PacketTap()
|
|
carol._test_onOutboundPacket = carolOut.record
|
|
let bobOut = PacketTap()
|
|
bob._test_onOutboundPacket = bobOut.record
|
|
|
|
preseedConnectedPeer(carol, in: alice)
|
|
|
|
// Bob blocked Alice by her stable Noise identity while she was away.
|
|
bobIdentity.setBlocked(alice.noiseStaticPublicKeyData().sha256Fingerprint(), isBlocked: true)
|
|
|
|
#expect(alice.sendCourierMessage(
|
|
"you should not see this",
|
|
messageID: "courier-msg-blocked-sender",
|
|
recipientNoiseKey: bob.noiseStaticPublicKeyData(),
|
|
via: [carol.myPeerID]
|
|
))
|
|
let deposited = await TestHelpers.waitUntil(
|
|
{ aliceOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(deposited)
|
|
let depositPacket = try #require(aliceOut.first(ofType: .courierEnvelope))
|
|
|
|
carol._test_handlePacket(depositPacket, fromPeerID: alice.myPeerID, signingPublicKey: alice.noiseSigningPublicKeyData())
|
|
let carried = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(carried)
|
|
|
|
try establishNoiseSession(between: carol, and: bob)
|
|
bob.sendBroadcastAnnounce()
|
|
let announced = await TestHelpers.waitUntil(
|
|
{ bobOut.first(ofType: .announce) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(announced)
|
|
let announcePacket = try #require(bobOut.first(ofType: .announce))
|
|
carol._test_handlePacket(announcePacket, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let handedOver = await TestHelpers.waitUntil(
|
|
{ carolOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(handedOver)
|
|
let handoverPacket = try #require(carolOut.first(ofType: .courierEnvelope))
|
|
|
|
// Bob opens the envelope — but the sealed sender is blocked, and it
|
|
// must never reach the UI. The live block check can't cover this: the
|
|
// sender is absent from Bob's registry, so no fingerprint resolves at
|
|
// delivery time.
|
|
bob._test_handlePacket(handoverPacket, fromPeerID: carol.myPeerID)
|
|
let delivered = await TestHelpers.waitUntil(
|
|
{ !bobDelegate.snapshot().isEmpty },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!delivered)
|
|
}
|
|
|
|
@Test func unverifiedAnnounceDoesNotTriggerCourierHandover() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
let bob = makeService()
|
|
carol.courierDepositPolicy = { _, _ in .favorite }
|
|
|
|
let aliceOut = PacketTap()
|
|
alice._test_onOutboundPacket = aliceOut.record
|
|
let carolOut = PacketTap()
|
|
carol._test_onOutboundPacket = carolOut.record
|
|
let bobOut = PacketTap()
|
|
bob._test_onOutboundPacket = bobOut.record
|
|
|
|
preseedConnectedPeer(carol, in: alice)
|
|
|
|
#expect(alice.sendCourierMessage(
|
|
"hold until verified",
|
|
messageID: "courier-msg-unverified-announce",
|
|
recipientNoiseKey: bob.noiseStaticPublicKeyData(),
|
|
via: [carol.myPeerID]
|
|
))
|
|
let deposited = await TestHelpers.waitUntil(
|
|
{ aliceOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(deposited)
|
|
let depositPacket = try #require(aliceOut.first(ofType: .courierEnvelope))
|
|
|
|
carol._test_handlePacket(depositPacket, fromPeerID: alice.myPeerID, signingPublicKey: alice.noiseSigningPublicKeyData())
|
|
let carried = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(carried)
|
|
|
|
let forgedAnnounce = try makeUnsignedAnnounce(from: bob)
|
|
carol._test_handlePacket(forgedAnnounce, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let leakedOnUnverifiedAnnounce = await TestHelpers.waitUntil(
|
|
{ carolOut.count(ofType: .courierEnvelope) > 0 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!leakedOnUnverifiedAnnounce)
|
|
#expect(!carol.courierStore.isEmpty)
|
|
|
|
bob.sendBroadcastAnnounce()
|
|
let announced = await TestHelpers.waitUntil(
|
|
{ bobOut.first(ofType: .announce) != nil },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(announced)
|
|
let verifiedAnnounce = try #require(bobOut.first(ofType: .announce))
|
|
carol._test_handlePacket(verifiedAnnounce, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let handedOver = await TestHelpers.waitUntil(
|
|
{ carolOut.count(ofType: .courierEnvelope) == 1 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(handedOver)
|
|
#expect(!carol.courierStore.isEmpty)
|
|
}
|
|
|
|
@Test func relayedAnnounceTriggersNonDestructiveRemoteHandover() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
let bob = makeService()
|
|
carol.courierDepositPolicy = { _, _ in .favorite }
|
|
|
|
let aliceOut = PacketTap()
|
|
alice._test_onOutboundPacket = aliceOut.record
|
|
let carolOut = PacketTap()
|
|
carol._test_onOutboundPacket = carolOut.record
|
|
let bobOut = PacketTap()
|
|
bob._test_onOutboundPacket = bobOut.record
|
|
|
|
preseedConnectedPeer(carol, in: alice)
|
|
|
|
#expect(alice.sendCourierMessage(
|
|
"hold for a direct encounter",
|
|
messageID: "courier-msg-relayed-announce",
|
|
recipientNoiseKey: bob.noiseStaticPublicKeyData(),
|
|
via: [carol.myPeerID]
|
|
))
|
|
let deposited = await TestHelpers.waitUntil(
|
|
{ aliceOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(deposited)
|
|
let depositPacket = try #require(aliceOut.first(ofType: .courierEnvelope))
|
|
|
|
carol._test_handlePacket(depositPacket, fromPeerID: alice.myPeerID, signingPublicKey: alice.noiseSigningPublicKeyData())
|
|
let carried = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(carried)
|
|
|
|
bob.sendBroadcastAnnounce()
|
|
let announced = await TestHelpers.waitUntil(
|
|
{ bobOut.first(ofType: .announce) != nil },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(announced)
|
|
let directAnnounce = try #require(bobOut.first(ofType: .announce))
|
|
|
|
// A relayed copy has a decremented TTL but a still-valid signature
|
|
// (TTL is excluded from announce signatures). The recipient is
|
|
// multi-hop away, so a copy floods toward them speculatively while
|
|
// the carried original stays put for a future direct encounter.
|
|
var relayedAnnounce = directAnnounce
|
|
relayedAnnounce.ttl = directAnnounce.ttl - 1
|
|
carol._test_handlePacket(relayedAnnounce, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let remoteHandover = await TestHelpers.waitUntil(
|
|
{ carolOut.count(ofType: .courierEnvelope) == 1 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(remoteHandover)
|
|
#expect(!carol.courierStore.isEmpty)
|
|
|
|
// A second relayed announce inside the cooldown must not re-flood
|
|
// the same envelope. The original announce's dedup key is consumed
|
|
// (sender/timestamp/payload — TTL excluded), so use a fresh announce;
|
|
// wait out the 1s announce throttle first.
|
|
try await Task.sleep(nanoseconds: 1_100_000_000)
|
|
bob.sendBroadcastAnnounce()
|
|
let reannounced = await TestHelpers.waitUntil(
|
|
{ bobOut.all(ofType: .announce).contains { $0.timestamp != directAnnounce.timestamp } },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(reannounced)
|
|
let freshAnnounce = try #require(
|
|
bobOut.all(ofType: .announce).first { $0.timestamp != directAnnounce.timestamp }
|
|
)
|
|
var relayedFreshAnnounce = freshAnnounce
|
|
relayedFreshAnnounce.ttl = freshAnnounce.ttl - 1
|
|
carol._test_handlePacket(relayedFreshAnnounce, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let refloodedInCooldown = await TestHelpers.waitUntil(
|
|
{ carolOut.count(ofType: .courierEnvelope) > 1 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!refloodedInCooldown)
|
|
#expect(!carol.courierStore.isEmpty)
|
|
|
|
// A peer-level Noise session is still insufficient without a physical
|
|
// ingress link that completed that handshake. This CoreBluetooth-free
|
|
// harness deliberately has no such link proof, so restoring the
|
|
// unsigned direct TTL cannot authorize destructive handover.
|
|
try establishNoiseSession(between: carol, and: bob)
|
|
try await Task.sleep(nanoseconds: 1_100_000_000)
|
|
bob.sendBroadcastAnnounce()
|
|
let announcedAgain = await TestHelpers.waitUntil(
|
|
{ bobOut.all(ofType: .announce).contains { $0.timestamp != directAnnounce.timestamp && $0.timestamp != freshAnnounce.timestamp } },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(announcedAgain)
|
|
let directAgain = try #require(
|
|
bobOut.all(ofType: .announce).first { $0.timestamp != directAnnounce.timestamp && $0.timestamp != freshAnnounce.timestamp }
|
|
)
|
|
carol._test_handlePacket(directAgain, fromPeerID: bob.myPeerID, preseedPeer: false)
|
|
|
|
let handedOverWithoutLinkProof = await TestHelpers.waitUntil(
|
|
{ carolOut.count(ofType: .courierEnvelope) > 1 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!handedOverWithoutLinkProof)
|
|
#expect(!carol.courierStore.isEmpty)
|
|
}
|
|
|
|
@Test func sendCourierMessageRejectsInvalidRecipientKeyBeforeQueueing() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
preseedConnectedPeer(carol, in: alice)
|
|
|
|
let aliceOut = PacketTap()
|
|
alice._test_onOutboundPacket = aliceOut.record
|
|
|
|
#expect(!alice.sendCourierMessage(
|
|
"this cannot be sealed",
|
|
messageID: "courier-msg-invalid-key",
|
|
recipientNoiseKey: Data(repeating: 0x01, count: 8),
|
|
via: [carol.myPeerID]
|
|
))
|
|
|
|
let queuedPacket = await TestHelpers.waitUntil(
|
|
{ aliceOut.first(ofType: .courierEnvelope) != nil },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!queuedPacket)
|
|
}
|
|
|
|
@Test func depositFromUntrustedPeerIsRejected() async throws {
|
|
let carol = makeService()
|
|
carol.courierDepositPolicy = { _, _ in nil } // depositor is neither favorite nor verified
|
|
|
|
let alice = NoiseEncryptionService(keychain: MockKeychain())
|
|
let bobKey = NoiseEncryptionService(keychain: MockKeychain()).getStaticPublicKeyData()
|
|
let typedPayload = try #require(BLENoisePayloadFactory.privateMessage(content: "x", messageID: "m1"))
|
|
let sealed = try alice.sealCourierPayload(typedPayload, recipientStaticKey: bobKey)
|
|
let now = Date()
|
|
let envelope = CourierEnvelope(
|
|
recipientTag: CourierEnvelope.recipientTag(
|
|
noiseStaticKey: bobKey,
|
|
epochDay: CourierEnvelope.epochDay(for: now)
|
|
),
|
|
expiry: UInt64((now.timeIntervalSince1970 + 3600) * 1000),
|
|
ciphertext: sealed
|
|
)
|
|
let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
|
|
let unsigned = BitchatPacket(
|
|
type: MessageType.courierEnvelope.rawValue,
|
|
senderID: Data(hexString: alicePeerID.id) ?? Data(),
|
|
recipientID: Data(hexString: carol.myPeerID.id),
|
|
timestamp: UInt64(now.timeIntervalSince1970 * 1000),
|
|
payload: try #require(envelope.encode()),
|
|
signature: nil,
|
|
ttl: 1
|
|
)
|
|
let packet = try #require(alice.signPacket(unsigned))
|
|
|
|
carol._test_handlePacket(packet, fromPeerID: alicePeerID, signingPublicKey: alice.getSigningPublicKeyData())
|
|
let stored = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!stored)
|
|
}
|
|
|
|
@Test func unsignedDepositIsRejected() async throws {
|
|
let carol = makeService()
|
|
carol.courierDepositPolicy = { _, _ in .favorite }
|
|
|
|
let alice = NoiseEncryptionService(keychain: MockKeychain())
|
|
let bobKey = NoiseEncryptionService(keychain: MockKeychain()).getStaticPublicKeyData()
|
|
let typedPayload = try #require(BLENoisePayloadFactory.privateMessage(content: "x", messageID: "m-unsigned"))
|
|
let sealed = try alice.sealCourierPayload(typedPayload, recipientStaticKey: bobKey)
|
|
let now = Date()
|
|
let envelope = CourierEnvelope(
|
|
recipientTag: CourierEnvelope.recipientTag(
|
|
noiseStaticKey: bobKey,
|
|
epochDay: CourierEnvelope.epochDay(for: now)
|
|
),
|
|
expiry: UInt64((now.timeIntervalSince1970 + 3600) * 1000),
|
|
ciphertext: sealed
|
|
)
|
|
let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
|
|
// Correct sender, willing policy — but no packet signature: the
|
|
// courier cannot authenticate the depositor, so it must not carry.
|
|
let packet = BitchatPacket(
|
|
type: MessageType.courierEnvelope.rawValue,
|
|
senderID: Data(hexString: alicePeerID.id) ?? Data(),
|
|
recipientID: Data(hexString: carol.myPeerID.id),
|
|
timestamp: UInt64(now.timeIntervalSince1970 * 1000),
|
|
payload: try #require(envelope.encode()),
|
|
signature: nil,
|
|
ttl: 1
|
|
)
|
|
|
|
carol._test_handlePacket(packet, fromPeerID: alicePeerID, signingPublicKey: alice.getSigningPublicKeyData())
|
|
let stored = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!stored)
|
|
}
|
|
|
|
@Test func courierDepositTrustUsesIngressPeerNotClaimedSender() async throws {
|
|
let alice = makeService()
|
|
let carol = makeService()
|
|
let mallory = makeService()
|
|
preseedConnectedPeer(alice, in: carol)
|
|
preseedConnectedPeer(mallory, in: carol)
|
|
|
|
let trustedAliceKey = Data(hexString: alice.myPeerID.id) ?? Data()
|
|
carol.courierDepositPolicy = { depositorKey, _ in
|
|
depositorKey == trustedAliceKey ? .favorite : nil
|
|
}
|
|
|
|
let aliceNoise = NoiseEncryptionService(keychain: MockKeychain())
|
|
let bobKey = NoiseEncryptionService(keychain: MockKeychain()).getStaticPublicKeyData()
|
|
let typedPayload = try #require(BLENoisePayloadFactory.privateMessage(content: "spoofed", messageID: "m-spoof"))
|
|
let sealed = try aliceNoise.sealCourierPayload(typedPayload, recipientStaticKey: bobKey)
|
|
let now = Date()
|
|
let envelope = CourierEnvelope(
|
|
recipientTag: CourierEnvelope.recipientTag(
|
|
noiseStaticKey: bobKey,
|
|
epochDay: CourierEnvelope.epochDay(for: now)
|
|
),
|
|
expiry: UInt64((now.timeIntervalSince1970 + 3600) * 1000),
|
|
ciphertext: sealed
|
|
)
|
|
let packet = BitchatPacket(
|
|
type: MessageType.courierEnvelope.rawValue,
|
|
senderID: Data(hexString: alice.myPeerID.id) ?? Data(),
|
|
recipientID: Data(hexString: carol.myPeerID.id),
|
|
timestamp: UInt64(now.timeIntervalSince1970 * 1000),
|
|
payload: try #require(envelope.encode()),
|
|
signature: nil,
|
|
ttl: 1
|
|
)
|
|
|
|
carol._test_handlePacket(packet, fromPeerID: mallory.myPeerID, preseedPeer: false)
|
|
let stored = await TestHelpers.waitUntil(
|
|
{ !carol.courierStore.isEmpty },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!stored)
|
|
}
|
|
|
|
/// Regression for the relaunch amplification storm: redundant copies of
|
|
/// one message arrive as *distinct* envelopes (every seal uses a fresh
|
|
/// ephemeral key), so only the inner message ID can dedup them. The first
|
|
/// copy delivers; duplicates must stop right after the decrypt — no
|
|
/// second delivery, no second ack/handshake trigger downstream.
|
|
@Test func duplicateCourierCopiesDeliverInnerMessageOnce() async throws {
|
|
let alice = makeService()
|
|
let bob = makeService()
|
|
let bobDelegate = NoiseCaptureDelegate()
|
|
bob.delegate = bobDelegate
|
|
|
|
let bobKey = bob.noiseStaticPublicKeyData()
|
|
let first = try #require(alice.sealBridgeCourierEnvelope("once", messageID: "dup-1", recipientNoiseKey: bobKey))
|
|
let second = try #require(alice.sealBridgeCourierEnvelope("once", messageID: "dup-1", recipientNoiseKey: bobKey))
|
|
// Distinct seals: envelope-level dedup can never catch this pair.
|
|
#expect(first.ciphertext != second.ciphertext)
|
|
|
|
#expect(bob.openBridgedCourierEnvelope(first))
|
|
#expect(bob.openBridgedCourierEnvelope(second))
|
|
|
|
let delivered = await TestHelpers.waitUntil(
|
|
{ !bobDelegate.snapshot().isEmpty },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(delivered)
|
|
// Give a duplicate delivery a chance to surface, then confirm the
|
|
// second copy never reached the delegate.
|
|
let duplicated = await TestHelpers.waitUntil(
|
|
{ bobDelegate.snapshot().count > 1 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!duplicated)
|
|
#expect(bobDelegate.snapshot().count == 1)
|
|
}
|
|
|
|
/// Acks for mail from absent senders (the usual couriered/bridged case)
|
|
/// queue for a future session instead of initiating a handshake
|
|
/// broadcast — otherwise every duplicate copy of every drop turns into a
|
|
/// mesh-wide handshake flood at an identity that cannot answer.
|
|
@Test func deliveryAckForAbsentPeerQueuesWithoutHandshake() async throws {
|
|
let ble = makeService()
|
|
let outbound = PacketTap()
|
|
ble._test_onOutboundPacket = outbound.record
|
|
|
|
// Nobody by this ID on the mesh (not connected, not reachable).
|
|
ble.sendDeliveryAck(for: "msg-1", to: PeerID(str: "00000000000000ee"))
|
|
|
|
let initiated = await TestHelpers.waitUntil(
|
|
{ outbound.count(ofType: .noiseHandshake) > 0 },
|
|
timeout: TestConstants.negativeWaitWindow
|
|
)
|
|
#expect(!initiated)
|
|
|
|
// Control: a peer that is actually around still gets the handshake.
|
|
let present = PeerID(str: "00000000000000ef")
|
|
ble._test_seedConnectedPeer(present, nickname: "present")
|
|
ble.sendDeliveryAck(for: "msg-2", to: present)
|
|
let initiatedForPresent = await TestHelpers.waitUntil(
|
|
{ outbound.count(ofType: .noiseHandshake) > 0 },
|
|
timeout: TestConstants.settleTimeout
|
|
)
|
|
#expect(initiatedForPresent)
|
|
}
|
|
|
|
private func makeUnsignedAnnounce(from service: BLEService) throws -> BitchatPacket {
|
|
let announcement = AnnouncementPacket(
|
|
nickname: "Unsigned",
|
|
noisePublicKey: service.noiseStaticPublicKeyData(),
|
|
signingPublicKey: service.noiseSigningPublicKeyData(),
|
|
directNeighbors: nil
|
|
)
|
|
let payload = try #require(announcement.encode())
|
|
|
|
return BitchatPacket(
|
|
type: MessageType.announce.rawValue,
|
|
senderID: Data(hexString: service.myPeerID.id) ?? Data(),
|
|
recipientID: nil,
|
|
timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
|
|
payload: payload,
|
|
signature: nil,
|
|
ttl: TransportConfig.messageTTLDefault
|
|
)
|
|
}
|
|
}
|
|
|
|
// MARK: - Router courier selection
|
|
|
|
/// Minimal transport stub for exercising MessageRouter's courier deposit
|
|
/// logic without BLE plumbing.
|
|
private final class CourierCaptureTransport: Transport {
|
|
weak var delegate: BitchatDelegate?
|
|
weak var eventDelegate: TransportEventDelegate?
|
|
weak var peerEventsDelegate: TransportPeerEventsDelegate?
|
|
|
|
var snapshots: [TransportPeerSnapshot] = []
|
|
private(set) var courierSends: [(messageID: String, recipientKey: Data, couriers: [PeerID])] = []
|
|
private(set) var directSends: [String] = []
|
|
|
|
func currentPeerSnapshots() -> [TransportPeerSnapshot] { snapshots }
|
|
|
|
var myPeerID = PeerID(str: "00000000000000aa")
|
|
var myNickname = "stub"
|
|
func setNickname(_ nickname: String) {}
|
|
|
|
func startServices() {}
|
|
func stopServices() {}
|
|
func emergencyDisconnectAll() {}
|
|
|
|
func isPeerConnected(_ peerID: PeerID) -> Bool {
|
|
snapshots.contains { $0.peerID == peerID && $0.isConnected }
|
|
}
|
|
// Nostr-style reachability: claimed for peers with no live link (known
|
|
// npub), where prompt delivery additionally needs a relay connection.
|
|
var reachablePeers: Set<PeerID> = []
|
|
var promptDelivery = true
|
|
func isPeerReachable(_ peerID: PeerID) -> Bool {
|
|
isPeerConnected(peerID) || reachablePeers.contains(peerID)
|
|
}
|
|
func canDeliverPromptly(to peerID: PeerID) -> Bool {
|
|
isPeerReachable(peerID) && promptDelivery
|
|
}
|
|
func peerNickname(peerID: PeerID) -> String? { nil }
|
|
func getPeerNicknames() -> [PeerID: String] { [:] }
|
|
|
|
func getFingerprint(for peerID: PeerID) -> String? { nil }
|
|
func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState { .none }
|
|
func triggerHandshake(with peerID: PeerID) {}
|
|
|
|
func sendMessage(_ content: String, mentions: [String]) {}
|
|
func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
|
|
directSends.append(messageID)
|
|
}
|
|
func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {}
|
|
func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {}
|
|
func sendBroadcastAnnounce() {}
|
|
func sendDeliveryAck(for messageID: String, to peerID: PeerID) {}
|
|
|
|
func sendCourierMessage(_ content: String, messageID: String, recipientNoiseKey: Data, via couriers: [PeerID]) -> Bool {
|
|
courierSends.append((messageID, recipientNoiseKey, couriers))
|
|
return true
|
|
}
|
|
}
|
|
|
|
struct MessageRouterCourierTests {
|
|
|
|
@Test @MainActor
|
|
func unreachablePeerMessageGoesToTrustedCouriersOnly() {
|
|
let bobKey = Data(repeating: 0xB0, count: 32)
|
|
let bobID = PeerID(publicKey: bobKey)
|
|
let carolKey = Data(repeating: 0xC0, count: 32)
|
|
let carolID = PeerID(publicKey: carolKey)
|
|
let daveKey = Data(repeating: 0xD0, count: 32)
|
|
let daveID = PeerID(publicKey: daveKey)
|
|
|
|
let transport = CourierCaptureTransport()
|
|
transport.snapshots = [
|
|
// Carol: connected mutual favorite → eligible courier.
|
|
TransportPeerSnapshot(peerID: carolID, nickname: "carol", isConnected: true, noisePublicKey: carolKey, lastSeen: Date()),
|
|
// Dave: connected but not trusted → never a courier.
|
|
TransportPeerSnapshot(peerID: daveID, nickname: "dave", isConnected: true, noisePublicKey: daveKey, lastSeen: Date())
|
|
]
|
|
|
|
let directory = CourierDirectory(
|
|
noiseKey: { peerID in peerID == bobID ? bobKey : nil },
|
|
isTrustedCourier: { $0 == carolKey }
|
|
)
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
var carried: [String] = []
|
|
router.onMessageCarried = { messageID, _ in carried.append(messageID) }
|
|
|
|
router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m1")
|
|
|
|
#expect(transport.directSends.isEmpty)
|
|
#expect(transport.courierSends.count == 1)
|
|
#expect(transport.courierSends.first?.messageID == "m1")
|
|
#expect(transport.courierSends.first?.recipientKey == bobKey)
|
|
#expect(transport.courierSends.first?.couriers == [carolID])
|
|
#expect(carried == ["m1"])
|
|
}
|
|
|
|
/// Field-found: a DM sent while the recipient sits in the BLE
|
|
/// reachability retention window (radio gone, still "reachable" for a
|
|
/// minute) trusts the mesh and skips every deposit — and nothing
|
|
/// retried. The periodic sweep must publish the bridge drop once the
|
|
/// window lapses.
|
|
@Test @MainActor
|
|
func sweepDropsQueuedMessageOnceReachabilityLapses() {
|
|
let bobKey = Data(repeating: 0xB0, count: 32)
|
|
let bobID = PeerID(publicKey: bobKey)
|
|
let transport = CourierCaptureTransport()
|
|
transport.reachablePeers = [bobID] // retention window: stale but "reachable"
|
|
transport.promptDelivery = true
|
|
|
|
let directory = CourierDirectory(
|
|
noiseKey: { peerID in peerID == bobID ? bobKey : nil },
|
|
isTrustedCourier: { _ in false }
|
|
)
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
var drops: [(content: String, messageID: String, key: Data)] = []
|
|
router.bridgeCourierDeposit = { content, messageID, key, completion in
|
|
drops.append((content, messageID, key))
|
|
completion(true)
|
|
}
|
|
var carried: [String] = []
|
|
router.onMessageCarried = { messageID, _ in carried.append(messageID) }
|
|
|
|
router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m9")
|
|
#expect(drops.isEmpty) // send trusted the (stale) mesh reachability
|
|
|
|
// Still inside the window: the sweep must not spam relays.
|
|
router.retryBridgeCourierDeposits()
|
|
#expect(drops.isEmpty)
|
|
|
|
// Window lapses; the sweep publishes the retained copy as a drop and
|
|
// the sender's message shows "carried" (its ack has no radio route).
|
|
transport.reachablePeers = []
|
|
router.retryBridgeCourierDeposits()
|
|
#expect(drops.count == 1)
|
|
#expect(drops.first?.messageID == "m9")
|
|
#expect(drops.first?.content == "hi bob")
|
|
#expect(drops.first?.key == bobKey)
|
|
#expect(carried == ["m9"])
|
|
}
|
|
|
|
@Test @MainActor
|
|
func noCourierDepositWithoutKnownRecipientKey() {
|
|
let transport = CourierCaptureTransport()
|
|
transport.snapshots = [
|
|
TransportPeerSnapshot(peerID: PeerID(str: "00000000000000cc"), nickname: "carol", isConnected: true, noisePublicKey: Data(repeating: 0xC0, count: 32), lastSeen: Date())
|
|
]
|
|
let directory = CourierDirectory(noiseKey: { _ in nil }, isTrustedCourier: { _ in true })
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
var carried: [String] = []
|
|
router.onMessageCarried = { messageID, _ in carried.append(messageID) }
|
|
|
|
router.sendPrivate("hi", to: PeerID(str: "00000000000000bb"), recipientNickname: "bob", messageID: "m2")
|
|
|
|
#expect(transport.courierSends.isEmpty)
|
|
#expect(carried.isEmpty)
|
|
}
|
|
|
|
/// The production directory must resolve both ID forms: a 64-hex
|
|
/// noise-key ID (offline favorite row) carries the key itself, and a
|
|
/// short 16-hex ID resolves through the favorites store.
|
|
@Test @MainActor
|
|
func favoritesBackedDirectoryResolvesBothIDForms() {
|
|
let directory = CourierDirectory.favoritesBacked()
|
|
let bobKey = Data(repeating: 0xB7, count: 32)
|
|
|
|
#expect(directory.noiseKey(PeerID(hexData: bobKey)) == bobKey)
|
|
|
|
FavoritesPersistenceService.shared.addFavorite(peerNoisePublicKey: bobKey, peerNickname: "bob")
|
|
defer { FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: bobKey) }
|
|
#expect(directory.noiseKey(PeerID(publicKey: bobKey)) == bobKey)
|
|
}
|
|
|
|
@Test @MainActor
|
|
func reachablePeerSkipsCourier() {
|
|
let bobKey = Data(repeating: 0xB0, count: 32)
|
|
let bobID = PeerID(publicKey: bobKey)
|
|
let transport = CourierCaptureTransport()
|
|
transport.snapshots = [
|
|
TransportPeerSnapshot(peerID: bobID, nickname: "bob", isConnected: true, noisePublicKey: bobKey, lastSeen: Date())
|
|
]
|
|
let directory = CourierDirectory(noiseKey: { _ in bobKey }, isTrustedCourier: { _ in true })
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
|
|
router.sendPrivate("hi", to: bobID, recipientNickname: "bob", messageID: "m3")
|
|
|
|
#expect(transport.directSends == ["m3"])
|
|
#expect(transport.courierSends.isEmpty)
|
|
}
|
|
|
|
/// A peer can be "reachable" through a transport that cannot deliver
|
|
/// promptly (Nostr claims any favorite with a known npub, even with no
|
|
/// relay connection). The queued send must not shadow the courier: a
|
|
/// sealed copy goes to connected couriers in parallel, and receivers
|
|
/// dedup by message ID if both arrive.
|
|
@Test @MainActor
|
|
func queuedReachableSendAlsoDepositsWithCourier() {
|
|
let bobKey = Data(repeating: 0xB0, count: 32)
|
|
let bobID = PeerID(publicKey: bobKey)
|
|
let carolKey = Data(repeating: 0xC0, count: 32)
|
|
let carolID = PeerID(publicKey: carolKey)
|
|
|
|
let transport = CourierCaptureTransport()
|
|
transport.snapshots = [
|
|
TransportPeerSnapshot(peerID: carolID, nickname: "carol", isConnected: true, noisePublicKey: carolKey, lastSeen: Date())
|
|
]
|
|
transport.reachablePeers = [bobID]
|
|
transport.promptDelivery = false
|
|
|
|
let directory = CourierDirectory(
|
|
noiseKey: { peerID in peerID == bobID ? bobKey : nil },
|
|
isTrustedCourier: { $0 == carolKey }
|
|
)
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
var carried: [String] = []
|
|
router.onMessageCarried = { messageID, _ in carried.append(messageID) }
|
|
|
|
router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m4")
|
|
|
|
#expect(transport.directSends == ["m4"])
|
|
#expect(transport.courierSends.count == 1)
|
|
#expect(transport.courierSends.first?.messageID == "m4")
|
|
#expect(transport.courierSends.first?.couriers == [carolID])
|
|
#expect(carried == ["m4"])
|
|
}
|
|
|
|
/// When the reachable transport can deliver promptly (relays up), the
|
|
/// send is trusted and no courier quota is spent.
|
|
@Test @MainActor
|
|
func promptlyDeliverableReachablePeerSkipsCourier() {
|
|
let bobKey = Data(repeating: 0xB0, count: 32)
|
|
let bobID = PeerID(publicKey: bobKey)
|
|
let carolKey = Data(repeating: 0xC0, count: 32)
|
|
let carolID = PeerID(publicKey: carolKey)
|
|
|
|
let transport = CourierCaptureTransport()
|
|
transport.snapshots = [
|
|
TransportPeerSnapshot(peerID: carolID, nickname: "carol", isConnected: true, noisePublicKey: carolKey, lastSeen: Date())
|
|
]
|
|
transport.reachablePeers = [bobID]
|
|
|
|
let directory = CourierDirectory(
|
|
noiseKey: { peerID in peerID == bobID ? bobKey : nil },
|
|
isTrustedCourier: { $0 == carolKey }
|
|
)
|
|
let router = MessageRouter(transports: [transport], courierDirectory: directory)
|
|
var carried: [String] = []
|
|
router.onMessageCarried = { messageID, _ in carried.append(messageID) }
|
|
|
|
router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m5")
|
|
|
|
#expect(transport.directSends == ["m5"])
|
|
#expect(transport.courierSends.isEmpty)
|
|
#expect(carried.isEmpty)
|
|
}
|
|
}
|