crossmate

GameStorePushAddressTests.swift (13786B)

---

 import CloudKit
 import CoreData
 import Foundation
 import Testing
 
 @testable import Crossmate
 
 /// Push addressing is capability-based, but the per-(account, game) address is
 /// now *derived* — `HMAC(accountSecret, gameID)` — rather than minted per
 /// device. Every one of the account's devices computes the identical address
 /// for a game, so there's nothing to converge and no random token to clobber.
 /// These tests cover the derivation (`RecordSerializer.deriveGameAddress`), the
 /// open-burst stamp (`setPushAddress`), and the registration sweep
 /// (`reconcileLocalPushAddresses`) — which must never fabricate a bare row.
 @Suite("GameStore push addressing", .isolatedNotificationState)
 @MainActor
 struct GameStorePushAddressTests {
 
     private static let authorID = "alice"
     private static let secret = "test-secret-0123456789"
     private static let puzzleSource = """
     Title: Test Puzzle
     Author: Test
 
 
     AB
     CD
 
 
     A1. Top row ~ AB
     A3. Bottom row ~ CD
 
     D1. Left column ~ AC
     D2. Right column ~ BD
     """
 
     @discardableResult
     private func makeGame(
         scope: Int16,
         in ctx: NSManagedObjectContext
     ) throws -> UUID {
         let gameID = UUID()
         let entity = GameEntity(context: ctx)
         entity.id = gameID
         entity.title = "Test"
         entity.puzzleSource = Self.puzzleSource
         entity.createdAt = Date()
         entity.updatedAt = Date()
         entity.ckRecordName = "game-\(gameID.uuidString)"
         entity.ckZoneName = "game-\(gameID.uuidString)"
         entity.databaseScope = scope
         try ctx.save()
         return gameID
     }
 
     /// Inserts a Player row carrying a stale (pre-derivation) address, standing
     /// in for a record that synced before this build.
     private func makeStalePlayerRow(
         gameID: UUID,
         address: String,
         in ctx: NSManagedObjectContext
     ) throws {
         let req = NSFetchRequest<GameEntity>(entityName: "GameEntity")
         req.predicate = NSPredicate(format: "id == %@", gameID as CVarArg)
         req.fetchLimit = 1
         let game = try #require(try ctx.fetch(req).first)
         let player = PlayerEntity(context: ctx)
         player.game = game
         player.authorID = Self.authorID
         player.name = "alice"
         player.ckRecordName = RecordSerializer.recordName(
             forPlayerInGame: gameID,
             authorID: Self.authorID
         )
         player.pushAddress = address
         player.updatedAt = Date()
         try ctx.save()
     }
 
     private func playerRowCount(in ctx: NSManagedObjectContext) throws -> Int {
         try ctx.count(for: NSFetchRequest<PlayerEntity>(entityName: "PlayerEntity"))
     }
 
     private func playerRow(gameID: UUID, in ctx: NSManagedObjectContext) throws -> PlayerEntity {
         let req = NSFetchRequest<PlayerEntity>(entityName: "PlayerEntity")
         req.predicate = NSPredicate(
             format: "game.id == %@ AND authorID == %@",
             gameID as CVarArg,
             Self.authorID
         )
         req.fetchLimit = 1
         return try #require(try ctx.fetch(req).first)
     }
 
     // MARK: - Derivation
 
     @Test("deriveGameAddress is deterministic, URL-safe, and per-game/per-secret distinct")
     func derivationProperties() {
         let g1 = UUID()
         let g2 = UUID()
 
         let a1 = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: g1)
         let a1Again = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: g1)
         let a2 = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: g2)
         let a1OtherSecret = RecordSerializer.deriveGameAddress(secret: "other-secret", gameID: g1)
 
         #expect(a1 == a1Again)            // deterministic
         #expect(a1 != a2)                 // scoped per game
         #expect(a1 != a1OtherSecret)      // scoped per secret
         #expect(!a1.isEmpty)
 
         let allowed = CharacterSet(charactersIn:
             "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_")
         #expect(a1.unicodeScalars.allSatisfy(allowed.contains))
     }
 
     // MARK: - setPushAddress (open burst)
 
     @Test("setPushAddress stamps the derived address and is stable")
     func setPushAddressDerivesStably() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let gameID = try makeGame(scope: 1, in: persistence.viewContext)
 
         let expected = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: gameID)
         let first = try #require(
             store.setPushAddress(gameID: gameID, authorID: Self.authorID, secret: Self.secret)
         )
         #expect(first == expected)
         let second = try #require(
             store.setPushAddress(gameID: gameID, authorID: Self.authorID, secret: Self.secret)
         )
         #expect(second == first)
     }
 
     @Test("setPushAddress returns nil when the game is missing")
     func setPushAddressMissingGame() {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         #expect(
             store.setPushAddress(gameID: UUID(), authorID: Self.authorID, secret: Self.secret) == nil
         )
     }
 
     // MARK: - reconcileLocalPushAddresses (registration sweep)
 
     @Test("reconcile derives shared games only, and never fabricates a Player row")
     func reconcileDerivesSharedGamesWithoutFabricating() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let shared1 = try makeGame(scope: 1, in: persistence.viewContext)
         let shared2 = try makeGame(scope: 1, in: persistence.viewContext)
         _ = try makeGame(scope: 0, in: persistence.viewContext) // local-only, excluded
 
         let result = store.reconcileLocalPushAddresses(authorID: Self.authorID, secret: Self.secret)
 
         // Both shared games contribute their derived address for registration,
         // even with no local Player row to publish from.
         #expect(Set(result.bindings.map(\.address)) == [
             RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: shared1),
             RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: shared2)
         ])
         // Each binding carries a freshly-minted shared push credential, and the
         // game now advertises it for participants to converge on.
         #expect(result.bindings.allSatisfy { $0.credentials != nil })
         #expect(GamePushCredentials.decode(store.notification(for: shared1)) != nil)
         // No existing rows, so nothing to republish — and crucially, no bare row
         // was fabricated (the CKError 14 / clobber regression).
         #expect(result.republishGameIDs.isEmpty)
         #expect(try playerRowCount(in: persistence.viewContext) == 0)
     }
 
     @Test("reconcile mirrors freshly-minted content keys for the notification extension")
     func reconcileMirrorsMintedContentKeys() async throws {
         let url = FileManager.default.temporaryDirectory
             .appendingPathComponent("content-key-directory-\(UUID().uuidString).json")
         defer { try? FileManager.default.removeItem(at: url) }
 
         try await ContentKeyDirectory.$testingFileURL.withValue(url) {
             try await MainActor.run {
                 let persistence = makeTestPersistence()
                 let store = makeTestStore(persistence: persistence)
                 let gameID = try makeGame(scope: 1, in: persistence.viewContext)
 
                 #expect(ContentKeyDirectory.load().isEmpty)
 
                 let result = store.reconcileLocalPushAddresses(
                     authorID: Self.authorID,
                     secret: Self.secret
                 )
                 let credentials = try #require(result.bindings.first?.credentials)
                 let contentKey = try #require(credentials.contentKey)
 
                 #expect(ContentKeyDirectory.load()[gameID.uuidString] == contentKey)
             }
         }
     }
 
     @Test("reconcile migrates a stale row to the derived address and lists it")
     func reconcileMigratesStaleRow() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let gameID = try makeGame(scope: 1, in: persistence.viewContext)
         try makeStalePlayerRow(
             gameID: gameID,
             address: "stale-minted-token",
             in: persistence.viewContext
         )
 
         let derived = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: gameID)
         let first = store.reconcileLocalPushAddresses(authorID: Self.authorID, secret: Self.secret)
         #expect(first.bindings.map(\.address) == [derived])
         #expect(first.republishGameIDs == [gameID])
 
         let player = try #require(
             persistence.viewContext.registeredObjects
                 .compactMap { $0 as? PlayerEntity }
                 .first
         )
         #expect(player.pushAddress == derived)
         // The migration must not have wiped the row's display name.
         #expect(player.name == "alice")
 
         // Idempotent: the address now matches, so nothing is republished.
         let second = store.reconcileLocalPushAddresses(authorID: Self.authorID, secret: Self.secret)
         #expect(second.bindings.map(\.address) == [derived])
         #expect(second.republishGameIDs.isEmpty)
         // The credential is minted once and stable across reconciles.
         let firstCred = try #require(first.bindings.first?.credentials)
         let secondCred = try #require(second.bindings.first?.credentials)
         #expect(firstCred.credID == secondCred.credID)
         #expect(firstCred.secret == secondCred.secret)
     }
 
     @Test("reconcile can refresh bindings without republishing stale Player rows")
     func reconcileCanSkipPlayerRepublish() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let gameID = try makeGame(scope: 1, in: persistence.viewContext)
         try makeStalePlayerRow(
             gameID: gameID,
             address: "stale-minted-token",
             in: persistence.viewContext
         )
 
         let derived = RecordSerializer.deriveGameAddress(secret: Self.secret, gameID: gameID)
         let result = store.reconcileLocalPushAddresses(
             authorID: Self.authorID,
             secret: Self.secret,
             republishPlayerRows: false
         )
 
         #expect(result.bindings.map(\.address) == [derived])
         #expect(result.republishGameIDs.isEmpty)
         #expect(try playerRow(gameID: gameID, in: persistence.viewContext).pushAddress == "stale-minted-token")
         #expect(GamePushCredentials.decode(store.notification(for: gameID)) != nil)
     }
 
     // MARK: - ensurePushCredentials (minting)
 
     @Test("ensurePushCredentials mints once for a shared game and is stable")
     func ensurePushCredentialsMintsStably() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let gameID = try makeGame(scope: 1, in: persistence.viewContext)
 
         let first = try #require(store.ensurePushCredentials(for: gameID))
         let second = try #require(store.ensurePushCredentials(for: gameID))
         #expect(first == second)
         // The minted secret decodes to a 256-bit HMAC key.
         #expect(Data(base64URLEncoded: first.secret)?.count == 32)
     }
 
     @Test("constructJoinedGame seeds the invite-carried notification credential")
     func constructJoinedGameSeedsNotificationCredential() async throws {
         let url = FileManager.default.temporaryDirectory
             .appendingPathComponent("joined-game-content-key-\(UUID().uuidString).json")
         defer { try? FileManager.default.removeItem(at: url) }
 
         try await ContentKeyDirectory.$testingFileURL.withValue(url) {
             try await MainActor.run {
                 let persistence = makeTestPersistence()
                 let store = makeTestStore(persistence: persistence)
                 let gameID = UUID()
                 let credentials = try GamePushCredentials.fresh()
                 let encoded = try credentials.encoded()
                 let zoneID = CKRecordZone.ID(
                     zoneName: "game-\(gameID.uuidString)",
                     ownerName: "_owner"
                 )
 
                 try store.constructJoinedGame(
                     gameID: gameID,
                     zoneID: zoneID,
                     source: Self.puzzleSource,
                     notification: encoded
                 )
 
                 #expect(store.notification(for: gameID) == encoded)
                 #expect(ContentKeyDirectory.load()[gameID.uuidString] == credentials.contentKey)
             }
         }
     }
 
     @Test("ensurePushCredentials returns nil for a non-shared or missing game")
     func ensurePushCredentialsNonShared() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let localOnly = try makeGame(scope: 0, in: persistence.viewContext)
         #expect(store.ensurePushCredentials(for: localOnly) == nil)
         #expect(store.ensurePushCredentials(for: UUID()) == nil)
     }
 
     @Test("deleteGame requests a push registration refresh")
     func deleteGameRequestsPushRegistrationRefresh() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence)
         let gameID = try makeGame(scope: 1, in: persistence.viewContext)
         var refreshCount = 0
         store.onPushRegistrationMayNeedRefresh = {
             refreshCount += 1
         }
 
         try store.deleteGame(id: gameID)
 
         #expect(refreshCount == 1)
     }
 }