co-authored-labeler.test.js

// Co-authored labeler e2e over REAL StateBaseV3 (testnet): TWO attested moderators are equal writers
// of one shared room; each appends a label INTENT (mod B via the admission doorbell); the LEASE-holder
// (mod A) signs both into the shared __label__ log; that log replicates to both, and every label is
// signed under ONE labeler DID (secp256k1 #atproto_label key) and verifies. This exercises LabelRoom
// over the real autobase substrate — the injection, multi-writer intents, lease, and shared-log
// replication that the mock test can't. (The projection of __label__ -> a served feed reuses
// serve-membrane; the favela consumer + verify is already covered by labeler.test / the live e2e.)
import '../lib/bare-globals.js'
import test from 'brittle'
import crypto from 'hypercore-crypto'
import fs from 'bare-fs'
import b4a from 'b4a'
import createTestnet from '@hyperswarm/testnet'
import { StateBaseV3 } from '../lib/state-base.js'
import { makeAttest, makeVerifyAttest, attestDeviceChain, deviceKeetKeyPair, rootIdentityPublicKey } from '../lib/membership.js'
import { keyFromPrivate } from 'atproto-identity/lib/atproto-identity.js'
import { verifyLabel } from 'atproto-identity/lib/labels.js'
import { LabelRoom } from '../lib/label-room.js'

const ROOT = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
const DEVA = 'legal winner thank year wave sausage worth useful legal winner thank yellow'
const DEVB = 'zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong'
const tmp = () => { const d = '/tmp/hpp-colabeler-' + Math.floor(Math.random() * 1e9); fs.mkdirSync(d, { recursive: true }); return d }
const sleep = (ms) => new Promise((r) => setTimeout(r, ms))

const labeler = keyFromPrivate(new Uint8Array(32).fill(44)) // the ONE labeler identity (shared #atproto_label key)
const SRC = 'did:plc:communitylabeler'

async function setup (testnet) {
  const rootPub = await rootIdentityPublicKey(ROOT)
  let da = await deviceKeetKeyPair(DEVA); const pa = await attestDeviceChain({ rootMnemonic: ROOT, devicePublicKey: da.publicKey })
  let db = await deviceKeetKeyPair(DEVB); const pb = await attestDeviceChain({ rootMnemonic: ROOT, devicePublicKey: db.publicKey })
  let A = { dev: da, proof: pa }; let B = { dev: db, proof: pb }
  if (b4a.compare(A.dev.publicKey, B.dev.publicKey) > 0) { const t = A; A = B; B = t } // creator = lowest key
  const members = [
    { key: b4a.toString(A.dev.publicKey, 'hex'), role: 1 },
    { key: b4a.toString(B.dev.publicKey, 'hex'), role: 1 }
  ]
  const roomSeed = crypto.randomBytes(32); const roomKey = crypto.randomBytes(32); const encryptionKey = crypto.randomBytes(32)
  const mk = (dev, proof) => new StateBaseV3(tmp(), roomKey, {
    roomSeed, encryptionKey, swarmOpts: { bootstrap: testnet.bootstrap },
    selfKey: dev.publicKey, attest: makeAttest(dev, proof), verifyAttest: makeVerifyAttest(rootPub),
    getMembers: async () => members
  })
  return { A, B, members, mk }
}

test('two mods co-author one signed label feed over real StateBase', { timeout: 120000 }, async (t) => {
  const testnet = await createTestnet(3)
  const { members, mk, A, B } = await setup(testnet)
  const sbA = mk(A.dev, A.proof); await sbA.ready(); await sbA.projectMembers(members)
  const sbB = mk(B.dev, B.proof); await sbB.ready()
  t.teardown(async () => { try { await sbA.close(); await sbB.close() } catch {} ; await testnet.destroy() })

  const roomA = new LabelRoom(sbA, { src: SRC, privateKey: labeler.privateKey, self: 'mod-a' })
  const roomB = new LabelRoom(sbB, { src: SRC, privateKey: labeler.privateKey, self: 'mod-b' })

  // TWO different mods each record a label intent. Mod B is not yet admitted -> its first write drives
  // the admission doorbell and blocks until it's a genuine writer.
  await roomA.label('at://did:plc:x/app.bsky.feed.post/1', 'spam', { cts: '2026-07-01T00:00:00.000Z' })
  await roomB.label('at://did:plc:x/app.bsky.feed.post/2', 'nsfw', { cts: '2026-07-02T00:00:00.000Z' })
  t.ok(sbB.base.writable, 'mod B was admitted (doorbell) and can co-author')

  // let both intents replicate into the shared linearized view
  for (let i = 0; i < 15; i++) { await sbA.base.update().catch(() => {}); await sbB.base.update().catch(() => {}); await sleep(300) }

  // the lease-holder (mod A, the creator/indexer) signs both intents into the SHARED __label__ log
  const signed = await roomA.tick()
  t.ok(signed >= 1, 'lease-holder signed the co-authored intents into the shared log')

  // the shared signed log replicates to both mods
  for (let i = 0; i < 15; i++) { await sbA.base.update().catch(() => {}); await sbB.base.update().catch(() => {}); await sleep(300) }

  const logA = await roomA.signedLog()
  const logB = await roomB.signedLog()
  t.is(logA.length, 2, 'shared __label__ log has both co-authored labels (mod A view)')
  t.is(logB.length, 2, 'shared __label__ log replicated to mod B')
  t.ok(logA.every((l) => l.src === SRC), 'every label carries the ONE labeler DID (src)')
  t.ok(logA.every((l) => verifyLabel(l, labeler.didKey)), 'every label verifies against the ONE #atproto_label key')
  const uris = logA.map((l) => l.uri).sort()
  t.ok(uris[0].endsWith('/1') && uris[1].endsWith('/2'), "both mods' labels are present (post/1 from A, post/2 from B)")
})
atproto-room / test / co-authored-labeler.test.js
