sync-static.test.ts

1// IV.7 — Static safety assertions for vault sync.2// These tests read source files to enforce structural invariants that3// are cheaper to verify statically than to exercise at runtime.45import { describe, expect, it } from "vitest";6import { readFileSync } from "node:fs";7import { resolve } from "node:path";89const here = __dirname;10const src = (rel: string) => readFileSync(resolve(here, rel), "utf8");1112describe("vault sync — static safety assertions", () => {13  it("no WebSocket server in any browser-extension sync source file", () => {14    const files = [15      "./sync-trigger.ts",16      "./sync-runner.ts",17      "./sync-coordinator.ts",18      "./sync-vault-adapter.ts",19      "../shared/sync-transport.ts",20    ];21    const forbidden = /WebSocketServer|wss\.listen|createServer|http\.listen|net\.listen/;22    for (const f of files) {23      expect(src(f), `${f} must not start a WebSocket server`).not.toMatch(forbidden);24    }25  });2627  it("applyMergedRemoteEntries does not call fireSyncTrigger or TRIGGER_SYNC", () => {28    const vaultSrc = src("./vault.ts");29    const fnStart = vaultSrc.indexOf("applyMergedRemoteEntries");30    expect(fnStart, "applyMergedRemoteEntries must exist in vault.ts").toBeGreaterThan(-1);31    // Grab a generous slice starting from the function — large enough to cover32    // the implementation but not so large that it bleeds into unrelated code.33    const fnBody = vaultSrc.slice(fnStart, fnStart + 4000);34    expect(fnBody).not.toMatch(/triggerSyncIfReachable|TRIGGER_SYNC|fireSyncTrigger/);35  });3637  it("device registry is stored in chrome.storage.local, not chrome.storage.sync", () => {38    const registrySrc = src("./paired-devices.ts");39    expect(registrySrc).toContain("storage.local");40    expect(registrySrc).not.toMatch(41      /storage\.sync[^;]*peach_paired_devices|peach_paired_devices[^;]*storage\.sync/,42    );43  });4445  it("setSyncRunner and productionSyncRunner are called in entry.ts", () => {46    const entrySrc = src("./entry.ts");47    expect(entrySrc).toContain("setSyncRunner");48    expect(entrySrc).toContain("productionSyncRunner");49  });5051  it("sync-trigger syncs both direct and user-confirmed vouched hosts", () => {52    const triggerSrc = src("./sync-trigger.ts");53    expect(triggerSrc).toMatch(/trustSource === "direct"/);54    // Mesh introduction is pointless if a device the user confirmed out of the55    // MV-7 pending queue is then never dialled.56    expect(triggerSrc).toMatch(/trustSource === "vouched"/);57  });5859  it("pairing stays relay-only with no local server or audio-chirp module", () => {60    const appSrc = src("../popup/App.tsx");61    expect(appSrc).not.toContain("openPairingServer");62    expect(appSrc).not.toContain("chirp-pair-capacitor");63    // Onboarding adoption now has the browser source a pairing-request QR64    // (the phone scans it). The browser still doesn't dial — the phone does.65    // The relay socket that holds the rendezvous is opened in the background66    // via START_ADOPTION_RECEIVER, not in the popup itself.67    expect(appSrc).not.toContain("dialRelayPairingChannel");68    const sharedTypes = src("../shared/types.ts");69    expect(sharedTypes).toContain("START_ADOPTION_RECEIVER");70    expect(appSrc).not.toContain("openPairingSocket");71  });7273  it("vault_id uses the full 64-char BLAKE3 hex digest", () => {74    const identitySrc = src("../shared/sync-identity.ts");75    expect(identitySrc).toContain("VAULT_ID_HEX_LENGTH = 64");76    expect(identitySrc).not.toContain("VAULT_ID_HEX_LENGTH = 16");77  });7879  it("per-entry key derivation uses entryId as part of HKDF info", () => {80    const adapterSrc = src("./sync-vault-adapter.ts");81    expect(adapterSrc).toContain("ENTRY_KEY_INFO_SUFFIX");82    expect(adapterSrc).toContain("sync-entry-v1");83    // The info must be derived from entryId — look for the concat pattern.84    expect(adapterSrc).toMatch(/entryId.*ENTRY_KEY_INFO_SUFFIX|ENTRY_KEY_INFO_SUFFIX.*entryId/);85  });86});