+5 -4

docs/TEST_AUDIT.md

reviewed

··· 13 13 The current baseline for saying "the audited suite is green" is: 14 14 15 15 - `prove -lr t` 16 16 - - latest full green result in the realigned Meridian worktree: `Files=60, Tests=3061` 16 16 + - latest full green result in the realigned Meridian worktree: `Files=61, Tests=3069` 17 17 - `prove -lv t/server-auth.t` 18 18 - `perl -c script/differential-validate` 19 19 - `PERLSKY_RUN_REFERENCE_DIFF=1 prove -lv t/reference-differential.t` ··· 116 116 Current suite counts by bucket: 117 117 118 118 - `direct reference differential`: `5` 119 119 - - `audited local regression`: `42` 119 119 + - `audited local regression`: `43` 120 120 - `local correctness/infrastructure`: `13` 121 121 122 122 | Test file | Bucket | Current note | ··· 145 145 | `t/event-stream.t` | audited local regression | wire-format, malformed frame, and event decoding coverage | 146 146 | `t/applywrites-surfaces.t` | audited local regression | focused `applyWrites` happy-path and missing-delete behavior after the self-service invite, identity/email, label, and blob/sync happy paths were split out | 147 147 | `t/external-handle-update.t` | audited local regression | external-handle update semantics, including DID-resolution checks and empty-body success for external handle adoption | 148 148 - | `t/external-surface.t` | audited local regression | focused external-surface coverage for repo/blob export and missing-blob behavior after splitting discovery, label RPC, and account-status checks into dedicated suites | 148 148 + | `t/external-surface.t` | audited local regression | focused external-surface coverage for repo/blob export after splitting discovery, label RPC, account-status, and missing-blob checks into dedicated suites | 149 149 | `t/firehose.t` | audited local regression | repo subscription lifecycle, cursor, and CAR behavior | 150 150 | `t/identity.t` | local correctness/infrastructure | lower-level handle and DID helper coverage, including DNS-over-well-known preference and malformed-handle rejection | 151 151 | `t/import-repo.t` | audited local regression | focused `importRepo` snapshot-restore and rollback behavior, now cleaner after splitting the disabled-import policy gate into its own suite | ··· 158 158 | `t/labels.t` | audited local regression | label persistence, replay, negation, and cursor behavior | 159 159 | `t/local-service-surfaces.t` | audited local regression | isolated local-only coverage for reserved handles and crawler host tracking surfaces | 160 160 | `t/metrics.t` | audited local regression | metrics endpoint, token-gating smoke, and instrumentation contract for local appview behavior | 161 161 + | `t/missing-blob-surfaces.t` | audited local regression | isolated `listMissingBlobs` pagination and record-ownership coverage for direct and nested blob references | 161 162 | `t/moderation.t` | audited local regression | takedown visibility and moderation behavior | 162 163 | `t/oauth-include.t` | audited local regression | permission-set scope expansion and least-privilege enforcement from `include:<nsid>` scopes | 163 164 | `t/oauth-permissions.t` | audited local regression | granular OAuth permission enforcement across account/email, identity, repo, blob, and rpc scope families | ··· 188 189 - `t/applywrites-surfaces.t` 189 190 Carries real conformance value for `applyWrites`, but it is now much narrower and mostly acts as a focused repo-write regression suite. 190 191 - `t/external-surface.t` 191 191 - Carries strong external-surface coverage for repo/blob export and missing-blob listing. It is cleaner after moving discovery, label-RPC, and account-status checks into dedicated suites, but still remains broader than a single-endpoint conformance file. 192 192 + Carries strong external-surface coverage for repo/blob export. It is much cleaner after moving discovery, label-RPC, account-status, and missing-blob checks into dedicated suites, but still remains broader than a single-endpoint conformance file. 192 193 193 194 ## What This Audit Does Not Yet Claim 194 195

+22 -67

t/external-surface.t

reviewed

··· 112 112 rkey => 'missing-blob-ref', 113 113 record => { 114 114 '$type' => 'com.example.record', 115 115 - note => 'blob reference for missing-blob listing', 115 115 + note => 'blob reference for sync/blob surface listing', 116 116 image => $blob, 117 117 }, 118 118 })->status_is(200); ··· 156 156 } => 'blob-two')->status_is(200); 157 157 158 158 my $blob_two_cid = $t->tx->res->json->{blob}{ref}{'$link'}; 159 159 - my @sorted_blob_cids = sort ($blob_cid); 159 159 + my @sorted_blob_cids = sort ($blob_cid, $blob_two_cid); 160 160 + 161 161 + $t->post_ok('/xrpc/com.atproto.repo.createRecord' => { 162 162 + Authorization => "Bearer $access", 163 163 + } => json => { 164 164 + repo => $did, 165 165 + collection => 'com.example.record', 166 166 + rkey => 'second-sync-blob-ref', 167 167 + record => { 168 168 + '$type' => 'com.example.record', 169 169 + note => 'second blob reference for sync/blob surface listing', 170 170 + image => { 171 171 + '$type' => 'blob', 172 172 + ref => { '$link' => $blob_two_cid }, 173 173 + mimeType => 'text/plain', 174 174 + size => length('blob-two'), 175 175 + }, 176 176 + }, 177 177 + })->status_is(200); 160 178 161 179 $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.sync.listBlobs')->query( 162 180 did => $did, ··· 170 188 limit => 1, 171 189 cursor => $sorted_blob_cids[0], 172 190 ))->status_is(200) 173 173 - ->json_is('/cids' => []); 191 191 + ->json_is('/cids/0' => $sorted_blob_cids[1]); 174 192 175 193 $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.sync.getBlob')->query( 176 194 did => $second_did, ··· 182 200 ->content_type_is('text/plain') 183 201 ->content_is('blob-bytes'); 184 202 185 185 - $t->post_ok('/xrpc/com.atproto.repo.uploadBlob' => { 186 186 - Authorization => "Bearer $access", 187 187 - 'Content-Type' => 'text/plain', 188 188 - } => 'nested-blob-bytes')->status_is(200); 189 189 - 190 190 - my $nested_blob = $t->tx->res->json->{blob}; 191 191 - my $nested_blob_cid = $nested_blob->{ref}{'$link'}; 192 192 - 193 193 - $t->post_ok('/xrpc/com.atproto.repo.createRecord' => { 194 194 - Authorization => "Bearer $access", 195 195 - } => json => { 196 196 - repo => $did, 197 197 - collection => 'com.example.record', 198 198 - rkey => 'nested-missing-blob-ref', 199 199 - record => { 200 200 - '$type' => 'com.example.record', 201 201 - note => 'nested blob reference for missing-blob listing', 202 202 - attachments => [{ 203 203 - kind => 'image', 204 204 - image => $nested_blob, 205 205 - }], 206 206 - }, 207 207 - })->status_is(200); 208 208 - 209 209 - my $nested_record_uri = $t->tx->res->json->{uri}; 210 210 - my @since_sorted_blob_cids = sort ($blob_cid, $nested_blob_cid); 203 203 + my @since_sorted_blob_cids = sort ($blob_cid, $blob_two_cid); 211 204 212 205 $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.sync.listBlobs')->query( 213 206 did => $did, ··· 215 208 ))->status_is(200) 216 209 ->json_is('/cids/0' => $since_sorted_blob_cids[0]) 217 210 ->json_is('/cids/1' => $since_sorted_blob_cids[1]); 218 218 - 219 219 - for my $cid ($blob_cid, $nested_blob_cid) { 220 220 - $app->store->dbh->do( 221 221 - q{DELETE FROM blob_owners WHERE cid = ?}, 222 222 - undef, 223 223 - $cid, 224 224 - ); 225 225 - $app->store->dbh->do( 226 226 - q{DELETE FROM blobs WHERE cid = ?}, 227 227 - undef, 228 228 - $cid, 229 229 - ); 230 230 - } 231 231 - 232 232 - my %expected_missing = ( 233 233 - $blob_cid => "at://$did/com.example.record/missing-blob-ref", 234 234 - $nested_blob_cid => $nested_record_uri, 235 235 - ); 236 236 - my @missing_cids = sort keys %expected_missing; 237 237 - 238 238 - $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.repo.listMissingBlobs')->query( 239 239 - limit => 1, 240 240 - ), { 241 241 - Authorization => "Bearer $access", 242 242 - })->status_is(200) 243 243 - ->json_is('/blobs/0/cid' => $missing_cids[0]) 244 244 - ->json_is('/blobs/0/recordUri' => $expected_missing{$missing_cids[0]}) 245 245 - ->json_is('/cursor' => $missing_cids[0]); 246 246 - 247 247 - $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.repo.listMissingBlobs')->query( 248 248 - limit => 1, 249 249 - cursor => $missing_cids[0], 250 250 - ), { 251 251 - Authorization => "Bearer $access", 252 252 - })->status_is(200) 253 253 - ->json_is('/blobs/0/cid' => $missing_cids[1]) 254 254 - ->json_is('/blobs/0/recordUri' => $expected_missing{$missing_cids[1]}) 255 255 - ->json_is('/cursor' => $missing_cids[1]); 256 211 257 212 done_testing;

+137

t/missing-blob-surfaces.t

reviewed

··· 1 1 + use v5.34; 2 2 + use warnings; 3 3 + 4 4 + use Config (); 5 5 + use File::Spec; 6 6 + use File::Temp qw(tempdir); 7 7 + use FindBin qw($Bin); 8 8 + use Test::More; 9 9 + 10 10 + BEGIN { 11 11 + require lib; 12 12 + my $root = File::Spec->rel2abs(File::Spec->catdir($Bin, '..')); 13 13 + lib->import( 14 14 + File::Spec->catdir($root, 'lib'), 15 15 + File::Spec->catdir($root, 'local', 'lib', 'perl5'), 16 16 + File::Spec->catdir($root, 'local', 'lib', 'perl5', $Config::Config{archname}), 17 17 + ); 18 18 + } 19 19 + 20 20 + use Test::Mojo; 21 21 + use Mojo::URL; 22 22 + use ATProto::PDS; 23 23 + 24 24 + my $root = File::Spec->rel2abs(File::Spec->catdir($Bin, '..')); 25 25 + my $tmp = tempdir(CLEANUP => 1); 26 26 + 27 27 + my $app = ATProto::PDS->new( 28 28 + project_root => $root, 29 29 + settings => { 30 30 + base_url => 'http://127.0.0.1:7755', 31 31 + service_handle_domain => 'example.test', 32 32 + service_did_method => 'did:web', 33 33 + jwt_secret => 'missing-blob-secret', 34 34 + admin_password => 'admin-secret', 35 35 + data_dir => File::Spec->catdir($tmp, 'data'), 36 36 + db_path => File::Spec->catfile($tmp, 'perlsky.sqlite'), 37 37 + }, 38 38 + ); 39 39 + 40 40 + my $t = Test::Mojo->new($app); 41 41 + 42 42 + $t->post_ok('/xrpc/com.atproto.server.createAccount' => json => { 43 43 + handle => 'alice.example.test', 44 44 + email => 'alice@example.test', 45 45 + password => 'hunter22', 46 46 + })->status_is(200); 47 47 + 48 48 + my $session = $t->tx->res->json; 49 49 + my $did = $session->{did}; 50 50 + my $access = $session->{accessJwt}; 51 51 + 52 52 + $t->post_ok('/xrpc/com.atproto.repo.uploadBlob' => { 53 53 + Authorization => "Bearer $access", 54 54 + 'Content-Type' => 'text/plain', 55 55 + } => 'blob-bytes')->status_is(200); 56 56 + 57 57 + my $blob = $t->tx->res->json->{blob}; 58 58 + my $blob_cid = $blob->{ref}{'$link'}; 59 59 + 60 60 + $t->post_ok('/xrpc/com.atproto.repo.createRecord' => { 61 61 + Authorization => "Bearer $access", 62 62 + } => json => { 63 63 + repo => $did, 64 64 + collection => 'com.example.record', 65 65 + rkey => 'missing-blob-ref', 66 66 + record => { 67 67 + '$type' => 'com.example.record', 68 68 + note => 'blob reference for missing-blob listing', 69 69 + image => $blob, 70 70 + }, 71 71 + })->status_is(200); 72 72 + 73 73 + $t->post_ok('/xrpc/com.atproto.repo.uploadBlob' => { 74 74 + Authorization => "Bearer $access", 75 75 + 'Content-Type' => 'text/plain', 76 76 + } => 'nested-blob-bytes')->status_is(200); 77 77 + 78 78 + my $nested_blob = $t->tx->res->json->{blob}; 79 79 + my $nested_blob_cid = $nested_blob->{ref}{'$link'}; 80 80 + 81 81 + $t->post_ok('/xrpc/com.atproto.repo.createRecord' => { 82 82 + Authorization => "Bearer $access", 83 83 + } => json => { 84 84 + repo => $did, 85 85 + collection => 'com.example.record', 86 86 + rkey => 'nested-missing-blob-ref', 87 87 + record => { 88 88 + '$type' => 'com.example.record', 89 89 + note => 'nested blob reference for missing-blob listing', 90 90 + attachments => [{ 91 91 + kind => 'image', 92 92 + image => $nested_blob, 93 93 + }], 94 94 + }, 95 95 + })->status_is(200); 96 96 + 97 97 + my $nested_record_uri = $t->tx->res->json->{uri}; 98 98 + 99 99 + for my $cid ($blob_cid, $nested_blob_cid) { 100 100 + $app->store->dbh->do( 101 101 + q{DELETE FROM blob_owners WHERE cid = ?}, 102 102 + undef, 103 103 + $cid, 104 104 + ); 105 105 + $app->store->dbh->do( 106 106 + q{DELETE FROM blobs WHERE cid = ?}, 107 107 + undef, 108 108 + $cid, 109 109 + ); 110 110 + } 111 111 + 112 112 + my %expected_missing = ( 113 113 + $blob_cid => "at://$did/com.example.record/missing-blob-ref", 114 114 + $nested_blob_cid => $nested_record_uri, 115 115 + ); 116 116 + my @missing_cids = sort keys %expected_missing; 117 117 + 118 118 + $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.repo.listMissingBlobs')->query( 119 119 + limit => 1, 120 120 + ), { 121 121 + Authorization => "Bearer $access", 122 122 + })->status_is(200) 123 123 + ->json_is('/blobs/0/cid' => $missing_cids[0]) 124 124 + ->json_is('/blobs/0/recordUri' => $expected_missing{$missing_cids[0]}) 125 125 + ->json_is('/cursor' => $missing_cids[0]); 126 126 + 127 127 + $t->get_ok(Mojo::URL->new('/xrpc/com.atproto.repo.listMissingBlobs')->query( 128 128 + limit => 1, 129 129 + cursor => $missing_cids[0], 130 130 + ), { 131 131 + Authorization => "Bearer $access", 132 132 + })->status_is(200) 133 133 + ->json_is('/blobs/0/cid' => $missing_cids[1]) 134 134 + ->json_is('/blobs/0/recordUri' => $expected_missing{$missing_cids[1]}) 135 135 + ->json_is('/cursor' => $missing_cids[1]); 136 136 + 137 137 + done_testing;