hyper-proto-peer / test / fresh-account-initial-commit.test.js

// Fresh-account bootstrap (2026-07-06): a brand-new swarm account (no adopt, no prior state) must
// boot with ONE signed commit so it is immediately frontable. A bridge authenticates a peer by
// replaying its signed commit against the DID key and REFUSES to front an empty repo — and a fresh
// account can't post its way out, because the composer posts THROUGH the bridge. The single-tenant
// path (index.js) has always authored an initial commit; the swarm path (bootSwarmDevice) did not,
// so every fresh multi-device account (e.g. ashatron.7rnx.net) came up empty and unfrontable. This
// guards that bootSwarmDevice now authors + signs an initial commit for a fresh account. network:false.

import '../lib/bare-globals.js'
import test from 'brittle'
import fs from 'bare-fs'
import b4a from 'b4a'
import { bootSwarmDevice, provisionAdoptedDevice } from '../lib/device-node.js'
import { deviceKeetKeyPair } from 'atproto-room/lib/membership.js'
import { deriveAtprotoKey } from 'atproto-identity'
import { decodeDidKey } from 'atproto-identity/lib/did-key.js'

const SIGN_SRC = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
const KEET_ROOT = 'legal winner thank year wave sausage worth useful legal winner thank yellow'
const DEV = 'zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong'
const DID = 'did:plc:freshacct222222222222222'
const tmp = () => { const d = '/tmp/hpp-fresh-' + Math.floor(Math.random() * 1e9); fs.mkdirSync(d, { recursive: true }); return d }

test('fresh empty swarm account: bootSwarmDevice authors an initial signed commit (frontable)', async (t) => {
  const signKey = deriveAtprotoKey(SIGN_SRC)
  const dev = await deviceKeetKeyPair(DEV)
  const bundle = await provisionAdoptedDevice({
    did: DID, signingKey: b4a.toString(signKey.privateKey, 'hex'), keetRootMnemonic: KEET_ROOT, devicePublicKey: dev.publicKey
  })

  const node = await bootSwarmDevice({
    storage: tmp(), deviceMnemonic: DEV, did: DID, ...bundle,
    handle: 'fresh.7rnx.net', swarm: false, control: false, signIntervalMs: 0
  })
  t.teardown(async () => { try { await node.close() } catch {} })

  const log = await node.device.firehoseLog()
  t.is(log.length, 1, 'a fresh empty account boots with exactly ONE signed #commit (not empty)')
  t.is(log[0].ops.length, 1, 'the initial commit carries the bootstrap record')

  // the signed commit MUST verify against the DID signing key — exactly the check the bridge runs
  // before it will front the peer (PeerFront.discover). An empty/unverifiable repo is refused.
  const { verifyCommit } = await import('atproto-repo/lib/commit.js')
  const head = node.device.head
  t.ok(head && head.signedCommit, 'sign() produced a signed head')
  const { pubkey } = decodeDidKey(signKey.didKey)
  t.ok(verifyCommit(head.signedCommit, pubkey), 'the initial commit verifies against the DID key — the peer is frontable')
})