// THE CONTRACT — what every engine binding must satisfy, identically.
//
// It lives in the core because the core owns the behaviour: hyper-identity (autobase) and
// hyper-identity2 (autobee) share one registry, one apply and one op vocabulary, so there is
// exactly one right answer and both must give it. A contract kept in one binding would become
// that binding's opinion.
//
// It takes a ready registry and asserts BEHAVIOUR, never view bytes — the two engines store
// different bytes by construction, and even within autobase alone bytes are not an oracle for ops
// written before `timestamp` existed.
//
// Not a test file: no `test()` calls, so each binding registers it in its own suite.
/**
* The contract. Every assertion here must hold identically on both engines.
*
* Kept as one function rather than one test per behaviour so the two arms cannot drift: adding an
* assertion for one engine adds it for the other, structurally.
*/
export async function contract (t, registry) {
// ── a record round-trips through the view's encoding ────────────────────────────────────────
//
// The name carries non-ASCII and the picture is a long opaque string, because the autobee view is
// raw Buffers where the autobase view had keyEncoding:'utf-8'/valueEncoding:'json'. A shim that
// got the encoding subtly wrong passes for 'Alice' and fails here.
const alice = await registry.createUser({ name: 'Ada Lovelace — éè你好' })
t.ok(alice.userId, 'createUser returns a userId')
t.is(alice.name, 'Ada Lovelace — éè你好', 'unicode survives the view encoding')
t.ok(alice.globalPermissions.includes('admin'), 'the first user is promoted to admin, in apply')
const fetched = await registry.getUser(alice.userId)
t.is(fetched.userId, alice.userId, 'and reads back by key')
t.is(fetched.name, alice.name)
// ── a secondary index ───────────────────────────────────────────────────────────────────────
await registry.registerIdentity({
identityId: 'ident-1', method: 'web-identity', publicKey: 'pk-ada'
})
const ident = await registry.getIdentityByPublicKey('pk-ada')
t.ok(ident, 'an identity resolves by public key, not just by id')
t.is(ident.method, 'web-identity')
await registry.linkIdentityToUser('ident-1', alice.userId, { verified: true })
// ⚠ Keyed on the identityId, NOT the public key — `user-identity:<identityId>`
// (identity-registry.js:214). They coincide in pgv3, where registerIdentity passes the root
// pubkey as both, which is exactly why passing the wrong one reads as a library bug.
const byIdent = await registry.getUserByIdentity('ident-1')
t.is(byIdent && byIdent.userId, alice.userId, 'and the link resolves back to the user')
// ── a uniqueness conflict ───────────────────────────────────────────────────────────────────
//
// The conflict path reads the index INSIDE the write, so it exercises read-after-write within one
// logical operation — the thing a batching shim is most likely to break.
await registry.setUsername(alice.userId, 'ada')
const byName = await registry.getUserByUsername('ada')
t.is(byName && byName.userId, alice.userId, 'username resolves')
const bob = await registry.createUser({ name: 'Grace' })
await t.exception(registry.setUsername(bob.userId, 'ada'), /taken/i, 'a taken username is refused')
t.is((await registry.getUserByUsername('ada')).userId, alice.userId, 'and the incumbent is untouched')
// ── the profile — the reason favela-peer wants this layer at all ────────────────────────────
await registry.updateUserProfile(alice.userId, { name: 'Ada L.', profilePicture: 'a'.repeat(64) })
const profiled = await registry.getUser(alice.userId)
t.is(profiled.name, 'Ada L.', 'the display name updates')
t.is(profiled.profilePicture, 'a'.repeat(64), 'and the picture is stored verbatim — an overlay oid')
// ── a range scan ────────────────────────────────────────────────────────────────────────────
//
// createReadStream over a prefix. hyperbee2 has no keyEncoding, so a shim must rebuild the range
// bounds itself; getting that wrong typically returns everything or nothing rather than erroring.
const users = await registry.listUsers()
const ids = users.map((u) => u.userId).sort()
t.is(ids.length, 2, 'the scan finds exactly the users written')
t.alike(ids, [alice.userId, bob.userId].sort(), 'and finds the right ones')
// ── a tombstone ─────────────────────────────────────────────────────────────────────────────
t.absent(await registry.isRevoked('pk-ada'), 'not revoked to begin with')
await registry.revokeIdentity('pk-ada')
t.ok(await registry.isRevoked('pk-ada'), 'revocation reads through')
}
// An engine that cannot be constructed must FAIL, not abort.
//
// A throw out of `open()` kills the whole file, so every test after it silently never runs — the
// report says nothing about them, which reads like coverage that does not exist. This turns an
// unbuildable engine into one red line and lets the rest of the suite report.
async function openOrFail (t, engine) {
try {
return await open(engine)
} catch (err) {
t.fail('cannot open the ' + engine + ' engine: ' + err.message)
return null
}
}