hyper-proto-peer / test / peer-serves.test.js

// Model B, P2P backhaul: a peer SERVES its repo + signed firehose over Hyperswarm and a
// consumer (standing in for atproto-bridge) replicates them — no HTTP, and the peer NEVER
// sends its signing key. Records replicate byte-exact; the consumer reads the SIGNED commit
// from the replicated firehose and verifies it against the peer's did:key KEYLESSLY (closing
// the gap that getRepo re-signs on read — the signature travels in the firehose, not the key).

import test from 'brittle'
import { mkdtempSync, rmSync } from 'bare-fs'
import { tmpdir } from 'bare-os'
import { join } from 'bare-path'
import b4a from 'b4a'
import Hyperswarm from 'hyperswarm'
import createTestnet from '@hyperswarm/testnet'
import { openCorestore } from 'atproto-store/lib/corestore.js'
import { RepoStore } from 'atproto-store/lib/repo-store.js'
import { getRepoFromCommit } from 'atproto-store/lib/read-view.js'
import { decodeCommitFrame } from 'atproto-store/lib/firehose.js'
import { readCar, loadCommit } from 'atproto-repo/lib/repo.js'
import { verifyCommit } from 'atproto-repo/lib/commit.js'
import { decodeDidKey } from 'atproto-identity/lib/did-key.js'
import { Peer } from '../lib/peer.js'

const MNEMONIC = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'

async function waitFor (fn, timeout = 12000) {
  const end = Date.now() + timeout
  while (Date.now() < end) { if (await fn()) return true; await new Promise(r => setTimeout(r, 100)) }
  return false
}

test('peer serves its signed repo over Hyperswarm; consumer pulls byte-exact (no key transfer)', async (t) => {
  const testnet = await createTestnet(3)
  const peerDir = mkdtempSync(join(tmpdir(), 'peer-home-'))
  const consumerDir = mkdtempSync(join(tmpdir(), 'peer-cons-'))

  const peer = await Peer.fromMnemonic({ storage: peerDir, mnemonic: MNEMONIC, handle: 'alice.7rnx.net', pdsUrl: 'https://pds.7rnx.net' })
  await peer.write({ collection: 'app.bsky.feed.post', rkey: '3aaa', record: { $type: 'app.bsky.feed.post', text: 'served over the swarm', createdAt: '2026-07-03T00:00:00.000Z' } })

  const peerSwarm = new Hyperswarm({ bootstrap: testnet.bootstrap })
  const consumerSwarm = new Hyperswarm({ bootstrap: testnet.bootstrap })
  const consumerStore = openCorestore(consumerDir)

  const serving = peer.serve(peerSwarm)
  await serving.ready()

  // consumer (a stand-in bridge): join the peer's topic and replicate its Corestore
  consumerSwarm.on('connection', (conn) => consumerStore.replicate(conn))
  consumerSwarm.join(b4a.from(serving.serverKey, 'hex'), { client: true, server: false })
  await consumerSwarm.flush()

  // open the peer's repo core BY KEY (read-only replica) — the consumer never has the key
  const consumerRepo = await new RepoStore(consumerStore, { key: peer.repoKey }).ready()

  t.teardown(async () => {
    serving.close()
    await peerSwarm.destroy(); await consumerSwarm.destroy()
    await consumerRepo.close(); await peer.close()
    await consumerStore.close()
    await testnet.destroy()
    rmSync(peerDir, { recursive: true, force: true }); rmSync(consumerDir, { recursive: true, force: true })
  })

  t.ok(await waitFor(async () => (await consumerRepo.records()).length === 1), 'consumer replicated the record over the swarm')

  // byte-exact: the consumer holds the peer's actual record bytes — content served P2P, no
  // key transfer (the peer only ever replicated cores; the consumer never saw privateKey).
  const peerRecs = await peer.store.records()
  const consRecs = await consumerRepo.records()
  t.is(b4a.toString(consRecs[0].bytes, 'hex'), b4a.toString(peerRecs[0].bytes, 'hex'), 'record bytes identical — signed content served P2P')

  // KEYLESS signed commit: the consumer opens the peer's firehose core BY KEY (replicated in
  // the same Corestore), reads the latest #commit frame, extracts the SIGNED commit, and
  // verifies it against the peer's did:key — WITHOUT the private key. The signature travels in
  // the firehose; the bridge can serve a signed CAR it could never have re-signed.
  const fcore = consumerStore.get({ key: peer.firehoseKey })
  await fcore.ready()
  t.ok(await waitFor(async () => { await fcore.update(); return fcore.length >= 1 }), 'consumer replicated the firehose')
  const { body } = decodeCommitFrame(await fcore.get(fcore.length - 1))
  const signed = loadCommit(await readCar(body.blocks)).value
  const { pubkey } = decodeDidKey(peer.didKey)
  t.ok(verifyCommit(signed, pubkey), 'consumer verifies the SIGNED commit from the replicated firehose — KEYLESS')
  t.is(signed.did, peer.did, 'firehose commit authored under the peer DID')

  // full keyless getRepo: the consumer assembles the ENTIRE signed repo CAR from the
  // replicated records + the firehose's signed commit — no private key. This is exactly what
  // the bridge serves for com.atproto.sync.getRepo on behalf of a remote peer.
  const { carBytes } = await getRepoFromCommit(consumerRepo, signed)
  const carCommit = loadCommit(await readCar(carBytes)).value
  t.ok(verifyCommit(carCommit, pubkey), 'consumer assembled the full signed repo CAR KEYLESSLY (repo records + firehose commit)')

  // live append propagates over the swarm
  await peer.write({ collection: 'app.bsky.feed.post', rkey: '3bbb', record: { $type: 'app.bsky.feed.post', text: 'second', createdAt: '2026-07-03T00:00:01.000Z' } })
  t.ok(await waitFor(async () => (await consumerRepo.records()).length === 2), 'live append propagated to the consumer')
})