crossmate

PushCredentialRotationTests.swift (7783B)

---

 import CloudKit
 import CoreData
 import Foundation
 import Testing
 
 @testable import Crossmate
 
 /// H4 coverage: rotating a game's push credentials when a participant departs,
 /// and the generation guard that stops a stale device's Game-record re-push
 /// from resurrecting the superseded credential.
 @Suite("Push credential rotation", .isolatedNotificationState)
 @MainActor
 struct PushCredentialRotationTests {
 
     private let gameID = UUID(uuidString: "AABBCCDD-1111-0000-0000-111122223333")!
 
     private var zoneID: CKRecordZone.ID {
         RecordSerializer.zoneID(for: gameID, ownerName: CKCurrentUserDefaultName)
     }
 
     private func credentialBlob(gen: Int64?) throws -> String {
         var creds = try GamePushCredentials.fresh()
         creds.gen = gen
         return try creds.encoded()
     }
 
     private func gameRecord(blob: String?) -> CKRecord {
         let record = CKRecord(
             recordType: "Game",
             recordID: CKRecord.ID(recordName: "game-\(gameID.uuidString)", zoneID: zoneID)
         )
         record["title"] = "Test"
         if let blob {
             record["pushCredential"] = blob.data(using: .utf8)
         }
         return record
     }
 
     // MARK: - GamePushCredentials generation
 
     @Test("a legacy blob without a generation reports generation 1")
     func legacyBlobGeneration() throws {
         let legacy = """
         {"ver":1,"credID":"11111111-2222-3333-4444-555555555555","secret":"abc"}
         """
         let decoded = try #require(GamePushCredentials.decode(legacy))
         #expect(decoded.generation == 1)
     }
 
     @Test("rotation replaces every field and bumps the generation")
     func rotationReplacesEverything() throws {
         let original = try GamePushCredentials.fresh()
         #expect(original.generation == 1)
 
         let rotated = try GamePushCredentials.rotated(after: original)
         #expect(rotated.generation == 2)
         #expect(rotated.credID != original.credID)
         #expect(rotated.secret != original.secret)
         #expect(rotated.contentKey != nil)
         #expect(rotated.contentKey != original.contentKey)
 
         let roundTripped = GamePushCredentials.decode(try rotated.encoded())
         #expect(roundTripped == rotated)
     }
 
     // MARK: - Inbound generation guard
 
     @Test("an inbound record at a higher generation is adopted")
     func higherGenerationAdopted() throws {
         let ctx = makeTestPersistence().container.viewContext
         let gen2 = try credentialBlob(gen: 2)
         let gen3 = try credentialBlob(gen: 3)
 
         var contentKeyChanges = 0
         let entity = RecordSerializer.applyGameRecord(
             gameRecord(blob: gen2),
             to: ctx,
             onContentKeyChange: { _ in contentKeyChanges += 1 }
         )
         #expect(entity.notification == gen2)
         #expect(contentKeyChanges == 1)
 
         _ = RecordSerializer.applyGameRecord(
             gameRecord(blob: gen3),
             to: ctx,
             onContentKeyChange: { _ in contentKeyChanges += 1 }
         )
         #expect(entity.notification == gen3)
         #expect(contentKeyChanges == 2)
         #expect(!entity.hasPendingSave)
     }
 
     @Test("an inbound record at a lower generation is kept out and healed")
     func lowerGenerationKeptOut() throws {
         let ctx = makeTestPersistence().container.viewContext
         let gen2 = try credentialBlob(gen: 2)
         let gen1 = try credentialBlob(gen: 1)
 
         let entity = RecordSerializer.applyGameRecord(gameRecord(blob: gen2), to: ctx)
 
         var staleRecords: [String] = []
         var contentKeyChanges = 0
         _ = RecordSerializer.applyGameRecord(
             gameRecord(blob: gen1),
             to: ctx,
             onContentKeyChange: { _ in contentKeyChanges += 1 },
             onStaleCredentials: { staleRecords.append($0) }
         )
         #expect(entity.notification == gen2)
         #expect(contentKeyChanges == 0)
         #expect(staleRecords == ["game-\(gameID.uuidString)"])
         #expect(entity.hasPendingSave, "the kept-newer credential must re-push to heal the server")
     }
 
     @Test("an inbound record missing the credential never clears a local one")
     func absentCredentialKeptOut() throws {
         let ctx = makeTestPersistence().container.viewContext
         let gen1 = try credentialBlob(gen: 1)
 
         let entity = RecordSerializer.applyGameRecord(gameRecord(blob: gen1), to: ctx)
 
         var staleRecords: [String] = []
         _ = RecordSerializer.applyGameRecord(
             gameRecord(blob: nil),
             to: ctx,
             onStaleCredentials: { staleRecords.append($0) }
         )
         #expect(entity.notification == gen1)
         #expect(staleRecords == ["game-\(gameID.uuidString)"])
     }
 
     // MARK: - Share roster departure detection
 
     @Test("a roster shrink is detected once; baselines and growth never fire")
     func shareRosterShrinkDetection() throws {
         let ctx = makeTestPersistence().container.viewContext
         _ = RecordSerializer.applyGameRecord(gameRecord(blob: nil), to: ctx)
 
         func apply(_ accepted: [String]) -> Bool {
             SyncEngine.applyShareRoster(
                 gameID: gameID,
                 zoneID: zoneID,
                 acceptedParticipants: accepted,
                 databaseScope: .private,
                 in: ctx
             )
         }
 
         // First sighting seeds the baseline silently (an app update must not
         // rotate every shared game).
         #expect(!apply(["alice", "bob"]))
         // Unchanged roster: nothing.
         #expect(!apply(["alice", "bob"]))
         // Bob left or was removed.
         #expect(apply(["alice"]))
         // Re-observing the shrunken roster is idempotent.
         #expect(!apply(["alice"]))
         // Growth (Carol accepted) is not a departure.
         #expect(!apply(["alice", "carol"]))
         // Alice's departure from the grown roster fires again.
         #expect(apply(["carol"]))
     }
 
     @Test("a share for an unknown game records nothing and never fires")
     func shareRosterUnknownGame() throws {
         let ctx = makeTestPersistence().container.viewContext
         #expect(!SyncEngine.applyShareRoster(
             gameID: gameID,
             zoneID: zoneID,
             acceptedParticipants: ["alice"],
             databaseScope: .private,
             in: ctx
         ))
     }
 
     // MARK: - Store rotation
 
     @Test("rotating replaces the stored credential; a game without one is a no-op")
     func storeRotation() throws {
         let persistence = makeTestPersistence()
         let store = makeTestStore(persistence: persistence, authorIDProvider: { "alice" })
         let ctx = persistence.container.viewContext
 
         let gameID = UUID()
         let entity = GameEntity(context: ctx)
         entity.id = gameID
         entity.title = "Test"
         entity.puzzleSource = "x"
         entity.createdAt = Date()
         entity.updatedAt = Date()
         entity.ckRecordName = "game-\(gameID.uuidString)"
         entity.ckZoneName = "game-\(gameID.uuidString)"
         entity.databaseScope = 1
         try ctx.save()
 
         // Nothing minted yet — nothing a departed device could hold.
         #expect(store.rotatePushCredentials(for: gameID) == nil)
 
         let original = try #require(store.ensurePushCredentials(for: gameID))
         let rotated = try #require(store.rotatePushCredentials(for: gameID))
         #expect(rotated.generation == original.generation + 1)
         #expect(rotated.credID != original.credID)
         #expect(rotated.secret != original.secret)
         #expect(rotated.contentKey != nil)
         #expect(rotated.contentKey != original.contentKey)
 
         let persisted = GamePushCredentials.decode(store.notification(for: gameID))
         #expect(persisted == rotated)
     }
 }