Files
bitchat/bitchatTests/Services/BridgeDropDedupStoreTests.swift
T
f8ab0a7dc0 Fix restore-path main↔bleQueue deadlock and courier drop amplification (#1425)
* Fix restore-path main↔bleQueue deadlock and courier drop amplification

A device froze permanently in a two-phone test. Debugger stacks showed an
ABBA deadlock: the main actor was in bleQueue.sync (delivery-ack send →
broadcastPacket → readLinkState) while bleQueue was in main.sync
(captureBluetoothStatus reading backgroundTimeRemaining). The load that
lined the two edges up came from a courier-drop amplification storm:
drop dedup was in-memory only while the outbox driving 120s re-deposits
is persisted, so every relaunch republished the same undelivered DM as a
fresh 24h relay drop and every gateway relaunch re-fetched the whole
backlog — ~20 copies of one DM delivered in 40ms, each triggering
decrypt + delivery + ack + handshake work.

Fixes, in rank order:
- Edge B (P0): captureBluetoothStatus no longer main.syncs from bleQueue;
  backgroundTimeRemaining is sampled on main and cached behind a lock.
  Invariant documented: bleQueue must NEVER sync-dispatch to main.
- Edge A (P0, defense in depth): sendDeliveryAck / sendReadReceipt /
  sendPrivateMessage / sendNoisePayload / triggerHandshake hop to
  messageQueue like sendMessage, so no main-actor call path reaches
  readLinkState's bleQueue.sync.
- Drop dedup (P1): publishedDropKeys and seenDropEventIDs persist across
  relaunches (new BridgeDropDedupStore, entries expire with the 24h
  NIP-40 drop window; wiped on panic) — one drop per message ID per 24h
  regardless of relaunch count.
- Receiver dedup (P1): openCourierEnvelope dedups on the inner private
  message ID before delivery, so a duplicate copy costs one decrypt and
  never re-delivers, re-acks, or re-triggers a handshake.
- Handshake gating (P2): queued acks initiate a Noise handshake only for
  reachable peers; mail from absent/rotated identities no longer turns
  each copy into a mesh-wide handshake flood (the ack stays queued and
  flushes when a session eventually establishes).
- Outbox (P3): re-enqueueing a queued message ID carries over its
  depositedCourierKeys so resends stop re-burning the same courier slots.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Review fixes: offline-drop durability, gateway handoff retry, restore-log freshness, coalesced persist

Adversarial review of the storm/deadlock PR surfaced four issues:

- Offline blackhole (must-fix): a deposit made while relays were down
  persisted its dedup key even though the drop only sat in the in-memory
  pending queue — app killed before reconnect meant the relaunch lost the
  drop but the persisted key blocked every re-deposit for 24h. The
  persisted snapshot now excludes keys still pending; they become durable
  only when flushPendingDrops actually publishes them.
- Gateway handoff: seen-event IDs were consumed before the deliverToPeer
  handoff; a failed handoff (peer walked away) permanently dropped the
  event for a single-gateway island. deliverToPeer now reports whether
  the handoff was attempted, and a failure releases the seen slot so a
  relaunch or backlog redelivery retries.
- Restore-path logs: central/peripheral-restore captures logged the init
  sentinel bgRemaining=∞. The cache is now seeded in init's main-thread
  branch and restore captures route through the sampler, which refreshes
  the cached budget before logging.
- Persist cost: the dedup record was a full JSON encode + atomic write on
  the main actor per mutation (once per event during a backlog re-fetch).
  Writes now coalesce behind a 1s window, flushed immediately on
  background/terminate; panic wipe stays immediate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Remove BoundedIDSet.remove, orphaned by the ExpiringIDSet migration

The drop-dedup sets that needed slot release moved to ExpiringIDSet;
remaining BoundedIDSet users only insert and check. Periphery caught it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-09 18:23:46 +02:00

119 lines
4.0 KiB
Swift

//
// BridgeDropDedupStoreTests.swift
// bitchat
//
// This is free and unencumbered software released into the public domain.
// For more information, see <https://unlicense.org>
//
import Foundation
import Testing
@testable import bitchat
@Suite("Bridge drop dedup persistence")
struct BridgeDropDedupStoreTests {
// MARK: - ExpiringIDSet
@Test func entriesExpireAfterLifetime() {
let start = Date(timeIntervalSince1970: 1_700_000_000)
var set = ExpiringIDSet(capacity: 8, lifetime: 60)
let inserted = set.insert("a", now: start)
#expect(inserted)
#expect(set.contains("a", now: start))
let duplicate = set.insert("a", now: start.addingTimeInterval(30))
#expect(!duplicate)
// Past the lifetime the slot is free again.
let later = start.addingTimeInterval(61)
#expect(!set.contains("a", now: later))
let reinserted = set.insert("a", now: later)
#expect(reinserted)
}
@Test func capacityEvictsOldestFirst() {
let start = Date(timeIntervalSince1970: 1_700_000_000)
var set = ExpiringIDSet(capacity: 2, lifetime: 3600)
set.insert("oldest", now: start)
set.insert("middle", now: start.addingTimeInterval(1))
set.insert("newest", now: start.addingTimeInterval(2))
let check = start.addingTimeInterval(3)
#expect(!set.contains("oldest", now: check))
#expect(set.contains("middle", now: check))
#expect(set.contains("newest", now: check))
}
@Test func removeReleasesSlot() {
let now = Date()
var set = ExpiringIDSet(capacity: 8, lifetime: 3600)
set.insert("a", now: now)
set.remove("a")
#expect(!set.contains("a", now: now))
let reinserted = set.insert("a", now: now)
#expect(reinserted)
}
@Test func initPrunesExpiredPersistedEntries() {
let now = Date()
let set = ExpiringIDSet(
capacity: 8,
lifetime: 3600,
entries: [
"stale": now.addingTimeInterval(-7200),
"fresh": now.addingTimeInterval(-60),
],
now: now
)
#expect(!set.contains("stale", now: now))
#expect(set.contains("fresh", now: now))
}
// MARK: - Store round trip
@Test func snapshotRoundTripsThroughDisk() {
let fileURL = FileManager.default.temporaryDirectory
.appendingPathComponent("bridge-dedup-store-\(UUID().uuidString).json")
defer { try? FileManager.default.removeItem(at: fileURL) }
let recorded = Date(timeIntervalSince1970: 1_700_000_000)
let store = BridgeDropDedupStore(fileURL: fileURL)
store.save(BridgeDropDedupStore.Snapshot(
publishedDropKeys: ["msg-1": recorded],
seenDropEventIDs: ["event-1": recorded]
))
let reloaded = BridgeDropDedupStore(fileURL: fileURL).load()
#expect(reloaded.publishedDropKeys["msg-1"] == recorded)
#expect(reloaded.seenDropEventIDs["event-1"] == recorded)
}
@Test func wipeRemovesTheRecord() {
let fileURL = FileManager.default.temporaryDirectory
.appendingPathComponent("bridge-dedup-store-\(UUID().uuidString).json")
defer { try? FileManager.default.removeItem(at: fileURL) }
let store = BridgeDropDedupStore(fileURL: fileURL)
store.save(BridgeDropDedupStore.Snapshot(
publishedDropKeys: ["msg-1": Date()],
seenDropEventIDs: [:]
))
store.wipe()
let reloaded = BridgeDropDedupStore(fileURL: fileURL).load()
#expect(reloaded.publishedDropKeys.isEmpty)
#expect(reloaded.seenDropEventIDs.isEmpty)
}
@Test func nonPersistingStoreStaysEmpty() {
let store = BridgeDropDedupStore(persistsToDisk: false)
store.save(BridgeDropDedupStore.Snapshot(
publishedDropKeys: ["msg-1": Date()],
seenDropEventIDs: [:]
))
#expect(store.load().publishedDropKeys.isEmpty)
}
}