atproto-bridge / pds / test / sync-get-record.test.js

// com.atproto.sync.getRecord — the proof-carrying single-record read the membrane was missing.
//
// The membrane served getRepo (whole repo) and repo.getRecord (hydrated JSON, unverifiable) but not the
// verifiable middle, so no client could check ONE of our records without pulling the entire repo. Found
// by pointing our own inbound verifier at our own PDS and getting a 404.
//
// The assertion that matters is the ROUND TRIP: a consumer must be able to verify the CAR we emit
// exactly as it would verify any other PDS's — signature over the commit, MST inclusion at
// <collection>/<rkey>, record bytes hashing to the proven CID. Anything less is a proof in name only.
import test from 'brittle'
import { createRepo, readCar, loadCommit, getBlock } from 'atproto-repo/lib/repo.js'
import { verifyCommit } from 'atproto-repo/lib/commit.js'
import { cidForBytesSync } from 'atproto-repo/lib/cid.js'
import { nodeStoreFromBlocks, findRpathProof } from 'atproto-repo/lib/mst.js'
import { keyFromPrivate } from 'atproto-identity/lib/atproto-identity.js'
import { buildRecordProofCar } from '../lib/sync-get-record.js'

const KEY = keyFromPrivate(Buffer.alloc(32, 11))
const DID = 'did:plc:proofsubject0000000000'

async function repoWith (n = 6) {
  return createRepo({
    did: DID,
    rev: '3lddd',
    privateKey: KEY.privateKey,
    records: Array.from({ length: n }, (_, i) => ({
      collection: 'app.bsky.feed.post',
      rkey: `rk${i}`,
      record: { $type: 'app.bsky.feed.post', text: `post ${i}`, createdAt: '2026-07-30T00:00:00Z' }
    }))
  })
}

test('the emitted CAR verifies end-to-end, exactly as a consumer would check it', async (t) => {
  const repo = await repoWith(6)
  const { carBytes, found } = await buildRecordProofCar(repo.carBytes, 'app.bsky.feed.post', 'rk3')
  t.ok(found, 'the record is reported present')

  const car = await readCar(carBytes)
  const commit = loadCommit(car)

  t.is(commit.value.did, DID, 'the signed commit is the root, so everything else hangs off something signed')
  t.ok(verifyCommit(commit.value, KEY.pubkey ?? KEY.publicKey), 'the commit signature verifies against the repo key')

  const ns = nodeStoreFromBlocks(car.blocks)
  const { value: recordCid } = findRpathProof(ns, commit.value.data, 'app.bsky.feed.post/rk3')
  t.ok(recordCid, 'the covering path is complete enough to reach the key from the signed root')

  const block = getBlock(car, recordCid)
  t.is(cidForBytesSync(block.bytes).toString(), recordCid.toString(), 'and the record bytes hash to the CID the proof arrives at')
})

test('the proof is a SLICE, not the whole repo — that is the entire point', async (t) => {
  const repo = await repoWith(24)
  const { carBytes } = await buildRecordProofCar(repo.carBytes, 'app.bsky.feed.post', 'rk7')
  const full = await readCar(repo.carBytes)
  const slice = await readCar(carBytes)
  t.ok(slice.blocks.size < full.blocks.size,
    `slice ${slice.blocks.size} blocks < full ${full.blocks.size} — otherwise a consumer may as well call getRepo`)
})

test('an ABSENT record proves non-existence, it does not 404', async (t) => {
  const repo = await repoWith(6)
  const { carBytes, found } = await buildRecordProofCar(repo.carBytes, 'app.bsky.feed.post', 'nosuchrkey')
  t.absent(found, 'reported as not found')

  const car = await readCar(carBytes)
  const commit = loadCommit(car)
  t.ok(verifyCommit(commit.value, KEY.pubkey ?? KEY.publicKey),
    'but the signed commit is still returned — an exclusion proof is a real answer, and a 404 would be indistinguishable from "repo not here"')

  const ns = nodeStoreFromBlocks(car.blocks)
  const { value } = findRpathProof(ns, commit.value.data, 'app.bsky.feed.post/nosuchrkey')
  t.absent(value, 'and the path demonstrably terminates without the key')
})

test('a consumer cannot be fooled by the slice: a DIFFERENT key is not provable from it', async (t) => {
  const repo = await repoWith(24)
  const { carBytes } = await buildRecordProofCar(repo.carBytes, 'app.bsky.feed.post', 'rk7')
  const car = await readCar(carBytes)
  const commit = loadCommit(car)
  const ns = nodeStoreFromBlocks(car.blocks)
  // rk19 exists in the real repo but is NOT on rk7's covering path, so it must not be resolvable here.
  let resolved = null
  try { resolved = findRpathProof(ns, commit.value.data, 'app.bsky.feed.post/rk19').value } catch { resolved = null }
  t.absent(resolved, 'a record outside the requested path cannot be proven from this slice')
})

test('an unparseable repo CAR throws rather than emitting a bogus proof', async (t) => {
  let threw = false
  try {
    await buildRecordProofCar(new Uint8Array([1, 2, 3]), 'app.bsky.feed.post', 'rk0')
  } catch {
    threw = true
  }
  t.ok(threw, 'garbage in is an error, never a CAR a consumer would trust (the handler turns this into a 500)')
})