97a51f2 · favela-android

Changed files (3) +50 -4

lib/node.js +7 -3

…	…	@@ -209,10 +209,14 @@ async function boot () {
209	209	// the kind of quiet degradation this port exists to remove, so it is logged either way.
210	210	//
211	211	// Non-fatal: a phone that cannot sign in still reads (anonymously). Reporting beats guessing.
212		const node = state.hpp && state.hpp.nodes && state.hpp.nodes[0]
213		if (node) {
	212	const entry = state.hpp && state.hpp.nodes && state.hpp.nodes[0]
	213	if (entry) {
214	214	try {
215		const { loadOrCreateSubKey, establishSession } = await import('./session.js')
	215	const { loadOrCreateSubKey, establishSession, sessionNodeOf } = await import('./session.js')
	216	// hpp hands back a WRAPPER, not the SwarmDevice — see sessionNodeOf. Passing `entry` straight
	217	// through is what made every boot sign-in fail with "an hpp node with delegate() required".
	218	const node = sessionNodeOf(entry)
	219	if (!node) throw new Error('hpp entry exposes no delegate() — cannot sign in')
216	220	const key = loadOrCreateSubKey(path.join(dirs.root, 'ui-subkey.json'), fs, path.dirname)
217	221	if (key.created) log('minted a UI sub-key for this device (delegated by our own DID)')
218	222	const s = await establishSession({

lib/session.js +19 -0

…	…	@@ -105,6 +105,25 @@ export function tokenFromSetCookie (setCookie) {
105	105	return m ? m[1] : null
106	106	}
107	107
	108	/**
	109	* Pick the SwarmDevice out of whatever hpp handed us.
	110	*
	111	* ⛔ THE SHAPE IS NOT WHAT IT LOOKS LIKE. `bootMultiDevice().nodes[i]` is NOT a SwarmDevice — it is the
	112	* WRAPPER `bootSwarmDevice` returns: `{ device, sb, did, self, blobs, control, membrane, overlay, … }`
	113	* (hyper-proto-peer/lib/device-node.js:595). `delegate()` lives on the SwarmDevice INSIDE it
	114	* (swarm-device.js:699). The wrapper DOES carry `.did`, which is exactly why this survived review and
	115	* every test: it reads like a node right up until the delegate() guard rejects it — on a handset, at
	116	* boot, with the UI silently downgraded to anonymous reads.
	117	*
	118	* Accept either shape, and refuse rather than guess when neither has delegate().
	119	*/
	120	export function sessionNodeOf (entry) {
	121	if (!entry) return null
	122	if (typeof entry.delegate === 'function') return entry // already a SwarmDevice
	123	if (entry.device && typeof entry.device.delegate === 'function') return entry.device // hpp's wrapper
	124	return null
	125	}
	126
108	127	/**
109	128	* Establish a session against the in-process favela-web.
110	129	*

test/session.test.mjs +24 -1

…	…	@@ -19,7 +19,7 @@ import pathm from 'bare-path'
19	19	import { keyFromPrivate } from 'atproto-identity/lib/atproto-identity.js'
20	20	import { signAssertion } from 'atproto-identity/lib/auth.js'
21	21	import { makeAtprotoWebVerify, verifyChallengeSig } from 'atproto-identity/lib/web-auth.js'
22		import { loadOrCreateSubKey, signChallenge, tokenFromSetCookie, establishSession, mintSubKey } from '../lib/session.js'
	22	import { loadOrCreateSubKey, signChallenge, tokenFromSetCookie, establishSession, mintSubKey, sessionNodeOf } from '../lib/session.js'
23	23
24	24	const assert = (c, m) => { if (!c) { console.error('FAIL:', m); process.exit(1) } console.log(' ok -', m) }
25	25	const toHex = (b) => Array.from(b).map((x) => x.toString(16).padStart(2, '0')).join('')
…	…	@@ -136,4 +136,27 @@ for (const [args, why] of [
136	136	assert(e !== null, 'refuses without ' + why)
137	137	}
138	138
	139	// ── 7. the SHAPE hpp actually hands us ──────────────────────────────────────────────────────────────
	140	// THE BUG THIS EXISTS FOR (found on a handset, 2026-08-11): every fixture above is a hand-written object
	141	// with a delegate() on it, so the suite only ever proved establishSession against a node shaped the way
	142	// the test author imagined. hpp does not hand us that. `bootSwarmDevice` returns a WRAPPER —
	143	// { device, sb, did, self, blobs, control, … } (hyper-proto-peer/lib/device-node.js:595) — and delegate()
	144	// lives on the SwarmDevice INSIDE it (swarm-device.js:699). The wrapper carries `.did`, so it passes a
	145	// casual "looks like a node" reading and then trips the delegate() guard at runtime, on the phone, with
	146	// the UI silently downgraded to anonymous. A mock that cannot reproduce the caller's shape cannot catch
	147	// a caller-shape bug, so this asserts the REAL shape.
	148	console.log('hpp wrapper shape')
	149	const wrapper = { did: DID, device: fakeNode, sb: {}, blobs: {}, control: null } // as device-node.js:595 returns
	150	assert(typeof wrapper.delegate !== 'function', 'the wrapper itself has NO delegate — this is the bug')
	151	assert(sessionNodeOf(wrapper) === fakeNode, 'unwraps the SwarmDevice out of the hpp wrapper')
	152	assert(sessionNodeOf(fakeNode) === fakeNode, 'passes a bare SwarmDevice through unchanged')
	153	assert(sessionNodeOf(null) === null, 'null in, null out')
	154	assert(sessionNodeOf({ did: DID, sb: {} }) === null, 'an entry with no delegate anywhere is refused, not guessed at')
	155
	156	// and end-to-end: the wrapper, unwrapped, signs in for real
	157	const wrapped = await establishSession({
	158	favelaUrl: 'http://127.0.0.1:4041', node: sessionNodeOf(wrapper), privHex: k1.privHex, pubHex: k1.pubHex, fetchImpl: fakeFetch
	159	})
	160	assert(wrapped.token && wrapped.did === DID, 'a session is established from the shape hpp really returns')
	161
139	162	console.log('\nall session tests passed')

favela-android commits / 97a51f2

Changed files (3) +50 -4