""" Two wire contracts in transport.js that fail quietly when broken. Neither can be reached from Python, and `QE/deploy/e2e.py` is a second implementation of the client rather than a test of this one, so these read the source. That is weak evidence in general, and the right kind here: both defects below produce a plausible screen rather than an error. - History paged forward from the oldest message, so a group with more than 200 of them opened on its first screen and the recent conversation could not be reached. Nothing threw; the wrong messages were simply shown. - A reply that is not routed falls through to "resolve the oldest pending request". Adding a ping made that dangerous: a pong handed to a waiting history request satisfies it with a message that has no `messages` field, and the conversation renders empty. """ import re from pathlib import Path import pytest STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static" TRANSPORT = STATIC / "transport.js" APP = STATIC / "app.js" # Chat's history paging/scroll-anchoring logic and GroupPage's own connect() # effect moved out of app.js in the group-page refactor. CHAT_APP = STATIC / "chat-app.js" GROUP_PAGE = STATIC / "group-page.js" CREATE_GROUP = STATIC / "create-group-page.js" SPLIT_FILES = [APP, GROUP_PAGE, CHAT_APP, STATIC / "files-app.js", STATIC / "video-player.js", STATIC / "video-app.js", STATIC / "music-app.js", STATIC / "music-player.js", STATIC / "photos-app.js", STATIC / "pager.js", STATIC / "group-settings.js", # Same reason as test_hook_ordering's STATIC_FILES: these are # reached through the registry, so leaving one out here means it # is simply never checked. STATIC / "settings-ui.js", STATIC / "folder-tree.js", STATIC / "chat-app-settings.js", STATIC / "video-app-settings.js", STATIC / "music-app-settings.js", STATIC / "photos-app-settings.js", STATIC / "helloworld-app.js", STATIC / "helloworld-app-settings.js", STATIC / "menu.js", STATIC / "playlist-menu.js", STATIC / "auth-page.js", STATIC / "explore-page.js", CREATE_GROUP] pytestmark = pytest.mark.skipif( not TRANSPORT.exists(), reason="the SPA sources are not available") @pytest.fixture(scope="module") def transport(): return TRANSPORT.read_text() @pytest.fixture(scope="module") def app(): return APP.read_text() @pytest.fixture(scope="module") def chat(): return CHAT_APP.read_text() @pytest.fixture(scope="module") def group_page(): return GROUP_PAGE.read_text() @pytest.fixture(scope="module") def create_group(): return CREATE_GROUP.read_text() def test_chat_history_pages_backwards(transport): body = transport[transport.index("async fetchChatHistory"):] body = body[:body.index("\n }")] assert "before" in body, "the request must carry a backward cursor" assert "since" not in body, ( "`since` pages forward from the oldest message — that was the bug") def test_chat_history_reports_whether_more_exists(transport): body = transport[transport.index("async fetchChatHistory"):] body = body[:body.index("\n }")] assert "has_more" in body, ( "without it the 'load older' control cannot know when to stop offering") def test_the_browser_asks_for_the_newest_page_first(chat): """A group opens on the newest messages, not the oldest.""" assert "fetchChatHistory({ limit: CHAT_PAGE })" in chat assert re.search(r"const CHAT_PAGE\s*=\s*100", chat) assert re.search(r"const CHAT_OLDER_PAGE\s*=\s*50", chat) def test_older_pages_are_requested_with_a_cursor_not_an_offset(chat): assert "before: messages[0].id" in chat, ( "paging by offset repeats or skips messages when one arrives mid-scroll") def test_pong_is_routed_by_its_echoed_token(transport): """Not left to the oldest-pending fallback, which would empty a chat.""" assert "if (msg.type === 'pong')" in transport routing = transport[transport.index("if (msg.type === 'pong')"):] routing = routing[:routing.index("const oldest")] assert "handler._key === key" in routing assert "return;" in routing, ( "a pong for a timed-out probe must stop here, not fall through") def test_ping_requests_are_keyed(transport): assert "`ping:${obj.token}`" in transport, ( "an unkeyed ping cannot be matched to its pong") def test_ping_can_time_out_sooner_than_a_transfer(transport): """30 s is right for a chunk and useless for a liveness probe.""" assert "_sendAndWait(obj, timeoutMs = 30000)" in transport body = transport[transport.index(" async ping("):] body = body[:body.index("\n }")] assert "timeoutMs" in body def test_scroll_position_is_anchored_when_older_messages_are_prepended(chat): """Everything above the viewport grows, so scrollTop alone is not enough.""" assert "scrollHeight - list.scrollTop" in chat, "the anchor is measured from the bottom" assert "list.scrollTop = list.scrollHeight - anchorRef.current" in chat assert "useLayoutEffect" in chat, ( "correcting after paint shows the jump it is meant to prevent") def test_the_view_only_follows_new_messages_when_already_at_the_bottom(chat): assert "if (atBottomRef.current) list.scrollTop = list.scrollHeight" in chat, ( "scrolling unconditionally fights someone reading back through history") def test_every_authorize_admin_op_call_is_registered_in_admin_op_types(transport): """ Found live (docs/MESHBAY_DESIGN.md §9.9's photo_roots): `setPhotoRoots` called `_authorizeAdminOp(msg, 'photo_roots', ...)` like every other admin op, but `photo_roots` was never added to `ADMIN_OP_TYPES` — so its initial request was never keyed `admin:photo_roots`, the node's `admin_challenge` reply matched no pending request (_dispatch's own keyed block, which `return`s unconditionally whether or not it found a match), and the request sat until its 30 s timeout with no error and no admin prompt. `ADMIN_OP_TYPES`'s own comment already narrates this exact bug once, for `audio_root`/`apps_enabled` — this pins it so a third op cannot reintroduce it silently. """ set_body = transport[transport.index("const ADMIN_OP_TYPES = new Set(["):] set_body = set_body[:set_body.index("]);")] registered = set(re.findall(r"'([a-z_]+)'", set_body)) called = set(re.findall(r"_authorizeAdminOp\(\s*\w+,\s*'([a-z_]+)'", transport)) assert called, "the extraction pattern itself found nothing — check it against transport.js" missing = called - registered assert not missing, ( f"{sorted(missing)} call _authorizeAdminOp but are missing from ADMIN_OP_TYPES — " "their admin_challenge will silently time out instead of ever reaching the user") def test_the_bottom_is_reached_by_scrollTop_not_a_sentinel(chat): """scrollIntoView on a zero-height marker stops short of the true bottom. The list has padding and a flex gap below the last bubble, so aligning an empty div to the viewport bottom left the bar a few pixels from the end — visible on opening a group and again after sending a message. """ # The call, not the word: a comment explaining why it is gone should not # be able to fail this. assert ".scrollIntoView(" not in chat assert "list.scrollTo({ top: list.scrollHeight" in chat, ( "jumping to the latest should also land on the real bottom") def test_messages_are_keyed_by_id_not_index(chat): """Index keys plus prepending makes Preact reuse the wrong bubbles.""" assert "key=${m.id}" in chat assert "key=${i}" not in chat.split("function ChatPanel")[1].split("\n}")[0] def test_presence_has_three_states_and_a_label_for_each(app): for state in ("online", "offline", "unknown"): assert f"presence-{state}" in (STATIC / "style.css").read_text() assert "t('presence.' + state)" in app, ( "red and green are the pair colour-blind readers cannot separate, so " "the dot needs a title and an aria-label, not just a colour") def _string(source: str, key: str) -> str: """One locale entry's text, whether it is written on one line or spliced across several with `+`.""" start = source.index(f"'{key}':") + len(f"'{key}':") end = source.index("\n '", start) return source[start:end] def test_a_refusal_from_the_node_counts_as_present(group_page): """The node answering "no" proves it is up; only silence proves nothing.""" assert "err.reason ? 'online' : 'offline'" in group_page # ── The create-group form ───────────────────────────────────────────────────── def test_the_form_asks_one_question_not_two(create_group): """ Visibility and admission were separate selectors that could only ever be set together, and the form knew it — picking Public reached over and set the policy. Two of the four combinations were impossible: the API refused public+invite with a 422, and private+open is a directory listing nobody can find, joining being through the node rather than a link. So there is one selector. "Open" is what makes a group listed, and the request derives the rest. """ form = create_group[create_group.index("function CreateGroupFormSimple"):] form = form[:form.index("\n}\n")] assert "setVisibility(" not in form, "the visibility selector is back" assert "t('create_group.join_policy')" in form assert "joinPolicy === 'open' ? 'public' : 'private'" in form, ( "the request must derive visibility rather than leave it unset") def test_the_form_says_what_each_choice_means_for_finding_the_group(app): """Dropping the visibility box removes the words "public" and "private" from the page. If the descriptions do not say it, nothing does — and somebody publishes a group without meaning to.""" en = (STATIC / "locales" / "en.js").read_text(encoding="utf-8") invite = _string(en, "create_group.invite_desc") open_ = _string(en, "create_group.open_desc") assert "not listed" in invite.lower() assert "listed" in open_.lower() and "anyone" in open_.lower() def test_the_strings_the_visibility_box_used_are_gone(app): """A key nobody reads is a key that rots, and ten locales carry each one.""" for locale in (STATIC / "locales").glob("*.js"): text = locale.read_text(encoding="utf-8") for key in ("create_group.visibility", "create_group.private", "create_group.public_is_open", "create_group.public_desc"): assert f"'{key}'" not in text, f"{locale.name} still carries {key}" def test_the_form_starts_on_a_combination_the_api_accepts(create_group): form = create_group[create_group.index("function CreateGroupFormSimple"):] assert "useState('invite')" in form[:form.index("return html")] # ── Dead references in the SPA ──────────────────────────────────────────────── def test_no_setter_survives_the_state_it_belonged_to(): """A removed useState leaves its setter behind, and nothing complains. `setActionsOpen` outlived `actionsOpen` when the Actions dropdown became a row of buttons, and shipped: every action in the Files panel threw ReferenceError on click. No Python test could see it and e2e.py does not drive the SPA, so the shape is checked here instead. A grep for the state name does not find it — `setActionsOpen` does not contain `actionsOpen`, the capital breaks the match. That is exactly how it got through. Checked per file rather than on one concatenated blob: the group-page refactor split what used to be one app.js into several, and a setter defined in one (e.g. `setAuth`, imported from hub-client.js) must not be mistaken for covering an orphan call of the same name in another. Lifting state to the shared shell and passing its setter down as a prop is the same idea one level lower — `FilesPanel`'s `setEntries` is real, just declared in group-page.js's own `useState` rather than here — so a setter named in a component's own destructured props is treated as defined too. """ import re for path in SPLIT_FILES: app = path.read_text() declared = set(re.findall(r"const \[\s*\w+\s*,\s*(set\w+)\s*\]\s*=\s*useState", app)) # Names brought in from another module are defined, just not here. imported = set() for names in re.findall(r"import\s*\{([^}]*)\}\s*from", app): imported.update(n.strip().split(" as ")[-1].strip() for n in names.split(",")) # A bare call only: `downloads.setMode(...)` and `view.setUint32(...)` # belong to their object, not to this component. called = set(re.findall(r"(?= 2, "the probe and the chunks are both sent from here" for sent in sends: assert "filename" not in sent, "the filename is on the message in clear" assert "data" not in sent, "the bytes are on the message in clear" assert "dir" not in sent and "root" not in sent, ( "the destination is on the message in clear") assert "...sealed," in sent or "...probeSealed," in sent, ( "the message must carry the sealed pair") # And no branch that sends anything else: an upload is sealed or it is not # sent. A fallback here is a fallback the node would have to keep opening. assert "filename: file.name" not in body.replace( "msgpack_encode({ filename: file.name", ""), ( "a filename reaches the message outside the seal") # ── MNP 1.0: the sealed handshake ack ──────────────────────────────────────── # # The index half is measured for real in `test_index_seal_client.py`. The ack is # opened inside `connect()`, three messages into a WebRTC negotiation, so these # read the source — and the ordering they pin is the whole security argument, not # an implementation detail. def _handshake_block(transport: str) -> str: start = transport.index("if (reply.type === 'handshake_challenge') {") return transport[start:transport.index(" return ack;", start)] def test_the_ack_is_verified_before_it_is_decrypted(transport): """ Verify, then decrypt. Opening the payload first would mean acting on data from a peer we have not yet authenticated — which is the exact shape of C3, where `node_pk` was never checked and a peer that had hijacked signaling could serve a forged index and a forged `is_node_admin`. """ block = _handshake_block(transport) proof = block.index("Node failed to prove GEK possession") signature = block.index("Node signature invalid") pinned = block.index("_checkNodePin(") opened = block.index("openGroup(") assert proof < opened, "the payload is opened before the GEK proof is checked" assert signature < opened, "the payload is opened before the signature is checked" assert pinned < opened, "the payload is opened before the node is pinned" def test_an_ack_that_does_not_open_refuses_the_connection(transport): """ Never a default. An `enabled_apps` that failed to open would otherwise reach the client's documented fallback — show every registered app — which is a confident wrong answer, indistinguishable from an operator's real choice. """ block = _handshake_block(transport) opened = block[block.index("let config;"):block.index("return ack;") if "return ack;" in block else len(block)] assert "throw new Error(" in opened, "a failed decrypt is swallowed" assert "handshake_ack" in opened, "the failure does not name the message" for fallback in ("|| {}", "?? {}", "catch { }", "config = {}"): assert fallback not in opened, ( f"the ack falls back to {fallback} instead of refusing") def test_the_handshake_declares_a_version_range(transport): """ L2: `v` used to be written by everyone and read by nobody, so a mismatch surfaced as a missing field rather than a refusal. Both halves of the range ride the handshake, and the node's half is checked before anything below it in `connect()` runs. """ block = transport[transport.index("type: 'handshake',"):] block = block[:block.index("});")] assert "v: MNP_V," in block and "v_min: MNP_V_MIN," in block challenge = _handshake_block(transport) assert challenge.index("_checkNodeVersion(") < challenge.index("openGroup("), ( "the node's version is checked after its messages are relied on") def test_the_index_is_never_reported_from_a_failed_decrypt(transport): """ The consumer callbacks may only be reached from inside the opened path — a `catch` that called `_onIndexSync` with an empty message would show "this group has no files", which is a state a real group can be in. """ body = transport[transport.index("async _applyIndexMessage("):] body = body[:body.index("\n /**", 1)] assert "openGroup(" in body assert "catch" not in body, ( "_applyIndexMessage swallows its own failure instead of letting " "_queueIndexMessage end the session") # ── One node refusing must not take a group down (2026-09-11) ──────────────── # # `/v1/groups/{id}/nodes` returns every node registered for the group, in hub # registration order. GroupPage took `nodesData.nodes[0]` and stopped there, so # a node that could not serve the group — refusing the handshake with "Group # not hosted on this node" — made the group unopenable while the node that # *did* host it sat second in the same list. # # These strip comments first. The lesson this repeats otherwise is the CSP read # out of the comment above the meta tag, and the packaging unit whose test # matched the comment explaining why `User=` was absent: a source-level check # that can match prose is not a check. def _code_only(src: str) -> str: """Source with // and /* */ comments removed. Crude, and enough here: no string literal in these files carries a comment marker.""" src = re.sub(r"/\*.*?\*/", "", src, flags=re.S) return re.sub(r"^\s*//.*$", "", src, flags=re.M) def test_the_group_page_tries_every_node_the_hub_offers(group_page): code = _code_only(group_page) assert "for (const n of nodesData.nodes)" in code, ( "the connect effect must walk the list, not index into it") assert "nodesData.nodes[0]" not in code, ( "taking the head and stopping is the defect — one wrongly registered " "node captured the whole group's traffic") def test_a_not_hosted_refusal_moves_on_to_the_next_node(group_page): code = _code_only(group_page) body = code[code.index("for (const n of nodesData.nodes)"):] body = body[:body.index("if (!transport)")] assert "not_hosted" in body, ( "without the code, a refusal this browser cannot act on is " "indistinguishable from one it must stop for") assert "throw e" in body, ( "a refusal naming a state of this browser — a pairing code, a " "passphrase, a device — is the same from every node and must stop here") def test_the_last_refusal_is_what_the_reader_is_told(group_page): code = _code_only(group_page) assert "if (!transport) throw (lastErr" in code, ( "exhausting the list must report why, not fall through silently") def test_the_refusal_the_loop_keys_on_has_a_message(transport): """A code the page routes on, with nothing to show, is a blank error.""" refusals = transport[transport.index("const HANDSHAKE_REFUSALS"):] refusals = refusals[:refusals.index("};")] assert "not_hosted:" in refusals # Search had the same `nodes[0]` twice — once to read a group's index, once for # the pooled connection its thumbnails and playback use — and was not part of # the fix above, so a group with a second, working node counted as unreachable # there while it opened fine from the sidebar. SEARCH_PAGE = STATIC / "search-page.js" def test_search_tries_every_node_the_hub_offers(): code = _code_only(SEARCH_PAGE.read_text(encoding="utf-8")) assert "nodes[0]" not in code, "Search takes the head of the node list again" walk = code[code.index("for (const n of nodesData.nodes)"):] walk = walk[:walk.index("throw (lastErr")] assert "not_hosted" in walk and "throw e" in walk, ( "the walk must stop for a refusal about this browser and move on " "for one about this node") def test_search_connects_in_one_place(): """Two call sites with their own connect is how one of them kept `nodes[0]`, and how the sweep and the warm-up each negotiated the same group: every connection goes through the pool, and only the pool calls `connectToGroup`.""" code = _code_only(SEARCH_PAGE.read_text(encoding="utf-8")) assert code.count("transport.connect(") == 1 # The definition, and the pool's one call. assert code.count("connectToGroup(") == 2 pool = code[code.index("async _doConnect("):code.index("_evict() {")] index = code[code.index("async function fetchGroupIndex("): code.index("async function fetchAllIndexes(")] assert "connectToGroup(" in pool assert "pool.connect(" in index and "connectToGroup(" not in index # node:start only links an unlinked node key to the hub account when it is # given credentials to link it with (main.js's linkNodeKeyAndAwaitRunning on # Windows, the equivalent inline block on Linux -- both gate on `opts.token`). # create-group-page.js's own startNode() passes {hubUrl, username, token}; # the Node page's Start button, reachable independently of that wizard, # passed none. Reproduced live 2026-09-14 on a fresh non-service Windows # install signed in to the real hub: Start on a node that had never been # linked (the ordinary state for anyone who has not gone through Create # Group yet) polled for up to 105s and failed with "could not link" -- # cross-platform, since both mains share this same frontend call. NODE_PAGE = STATIC / "node-page.js" @pytest.fixture(scope="module") def node_page(): return NODE_PAGE.read_text(encoding="utf-8") def test_node_page_start_button_can_link_an_unlinked_node(node_page): fn = node_page[node_page.index("function NodeServicePanel("):] fn = fn[:fn.index("\nfunction ") if "\nfunction " in fn else len(fn)] start_call = fn[fn.index("act('start'"):] start_call = start_call[:start_call.index(")}>")] assert "hubUrl" in start_call and "HUB" in start_call, ( "the Start button must pass hubUrl (HUB) through to node:start, or " "an unlinked node can never link on Start alone") assert "username" in start_call and "token" in start_call, ( "the Start button must pass username and token through to " "node:start -- linkNodeKeyAndAwaitRunning needs both to PUT the key") assert "import { HUB" in node_page or "import {HUB" in node_page, ( "HUB must come from hub-client.js, the one file allowed to decide " "where the hub is" ) def test_node_page_receives_the_session_it_hands_to_start(): """app.js is what actually has to hand token/username down; a fixed node-page.js reading them off undefined props is the same bug moved up one file.""" app_src = APP.read_text(encoding="utf-8") marker = "route === '/node' && platform.capabilities.nodeAdmin" route = app_src[app_src.index(marker):] route = route[:route.index(";")] assert "LazyNodePage" in route assert "token=" in route and "username=" in route, ( "app.js renders the Node page without the session NodeServicePanel " "now expects, so its Start button's opts are undefined again")