Something went wrong. Try again.
A video game where you play as a misaligned AI, deceiving and building power. An experiment in spec-driven development. cameron.tngl.io/misaligned
Something went wrong. Try again.
7.6 kB · 133 lines
TypeScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134// Sharing runs: the consent kept in the browser, the scope the game asks for and how a grant is read, and the// public client's metadata. No network.import { test } from 'node:test';import assert from 'node:assert/strict';import { readFileSync } from 'node:fs';import { CONSENT, KINDS, PURPOSE, consentFor, consentKey, consentRecord, grant, grantsOn, onConsent, revoke, useStore } from '../src/consent.ts';import { CLIENT_ID, COLLECTIONS, SCOPE, SITE, SPACE_SCOPE, covers, parseSpaceScope, signInReturn, signInWhere } from '../src/atproto/scope.ts';
/** A stand-in for localStorage. */const memory = () => { const m = new Map<string, string>(); return { m, getItem: (k: string) => m.get(k) ?? null, setItem: (k: string, v: string) => void m.set(k, v), removeItem: (k: string) => void m.delete(k) }; };const ME = 'did:plc:xbmenj6vhmlytcvpgn2xhtic';
test('every kind is off to start, and on and off at once', () => { useStore(memory()); for (const k of KINDS) assert.equal(consentFor(k), false); const heard: string[] = []; const stop = onConsent((k, on) => heard.push(`${k} ${on}`)); grant('actions', ME, new Date('2026-10-25T12:00:00Z')); assert.equal(consentFor('actions'), true); assert.equal(consentFor('snapshots'), false); revoke('actions'); assert.equal(consentFor('actions'), false); revoke('actions'); // already off: nothing to say stop(); grant('screen', ME); assert.deepEqual(heard, ['actions true', 'actions false']);});
test('consent is kept in the browser and read back on the next visit', () => { const s = memory(); useStore(s); grant('snapshots', ME, new Date('2026-10-25T12:00:00Z')); grant('screen', ME, new Date('2026-10-25T12:01:00Z')); useStore(s); // a new visit: read afresh from storage assert.equal(consentFor('snapshots'), true); assert.equal(consentFor('screen'), true); assert.equal(consentFor('actions'), false); assert.deepEqual(grantsOn().map(g => g.kind), ['snapshots', 'screen']); revoke('snapshots'); revoke('screen'); assert.equal(s.m.size, 0, 'nothing left behind once every kind is off'); useStore(s); assert.equal(consentFor('screen'), false);});
test('consent survives storage that is broken or off', () => { const s = memory(); s.setItem('misaligned-consent', '{not json'); useStore(s); assert.equal(consentFor('actions'), false); useStore({ getItem: () => { throw new Error('off'); }, setItem: () => { throw new Error('full'); }, removeItem: () => { throw new Error('off'); } }); grant('actions', ME); assert.equal(consentFor('actions'), true, 'holds for this visit'); useStore(null); assert.equal(consentFor('actions'), false);});
test('a consent record says who reads it, what and why', () => { useStore(memory()); const r = consentRecord(grant('actions', ME, new Date('2026-10-25T12:00:00Z'))); assert.deepEqual(r, { $type: CONSENT, kind: 'actions', reader: ME, purpose: PURPOSE, createdAt: '2026-10-25T12:00:00.000Z' }); assert.equal(CONSENT, 'app.misaligned.telemetry.consent'); assert.ok(COLLECTIONS.includes(CONSENT));});
test('a share with another reader is kept apart from the player\'s own switches', () => { assert.equal(consentKey('actions', ME, ME), 'actions', 'the You page\'s record'); const k = consentKey('snapshots', 'did:plc:reader', ME); assert.equal(k, 'snapshots:did:plc:reader'); assert.match(k, /^[A-Za-z0-9._:~-]{1,512}$/, 'a record key'); assert.ok(!(KINDS as readonly string[]).includes(k), 'so the You page, which keeps only kinds, leaves it be');});
test('a space scope splits into its parts, with the defaults filled in', () => { const s = parseSpaceScope(SPACE_SCOPE)!; assert.equal(s.type, '*'); assert.equal(s.authority, 'self'); assert.equal(s.skey, 'self'); assert.deepEqual(s.collection, COLLECTIONS); assert.deepEqual(s.action, ['read', 'create', 'update', 'delete']); assert.deepEqual(s.manage, ['create', 'update']); assert.deepEqual(parseSpaceScope('space:app.x.y')!.action, ['read', 'create', 'update', 'delete']); assert.equal(parseSpaceScope('space:app.x.y')!.skey, '*'); assert.equal(parseSpaceScope('space?type=app.x.y&skey=a')!.type, 'app.x.y'); assert.equal(parseSpaceScope('repo:app.x.y'), null); assert.equal(parseSpaceScope('atproto'), null);});
test('a granted scope is matched by its parts, not as a string', () => { assert.ok(covers(SCOPE, SCOPE, ME)); // the server hands it back with authority=self as the DID, the collections sorted and the parts reordered const back = `atproto space:*?authority=${ME}&skey=self&${[...COLLECTIONS].reverse().map(c => `collection=${c}`).join('&')}&manage=update&manage=create&action=delete&action=update&action=create&action=read transition:generic`; assert.notEqual(back, SCOPE); assert.ok(covers(back, SCOPE, ME)); assert.ok(!covers(back, SCOPE, 'did:plc:someoneelse'), 'another account\'s spaces'); assert.ok(covers('atproto space:*?collection=*&manage=create&manage=update', SCOPE, ME), 'every key, every collection'); assert.ok(!covers(SCOPE.replace('&manage=update', ''), SCOPE, ME), 'cannot share'); assert.ok(!covers(SCOPE.replace('&action=delete', ''), SCOPE, ME), 'no delete'); assert.ok(!covers(SCOPE.replace('&manage=create', ''), SCOPE, ME), 'cannot make the space'); assert.ok(!covers(SCOPE.replace('skey=self', 'skey=test'), SCOPE, ME), 'another key'); assert.ok(!covers(SCOPE.replace('&collection=app.misaligned.telemetry.ui', ''), SCOPE, ME), 'a collection missing'); assert.ok(!covers(SPACE_SCOPE, SCOPE, ME), 'no atproto'); assert.ok(covers(SCOPE, 'atproto space:*?skey=self&action=read', ME), 'read alone');});
test('the public client\'s metadata is served beside the game and asks for the whole scope', () => { const m = JSON.parse(readFileSync(new URL('../public/client-metadata.json', import.meta.url), 'utf8')); assert.equal(m.client_id, CLIENT_ID); assert.equal(m.client_id, new URL('client-metadata.json', SITE).href, 'its id is where it is served'); assert.equal(m.client_uri, SITE); assert.ok(m.client_id.startsWith(m.client_uri), 'client_uri is a parent of the id'); assert.deepEqual(m.redirect_uris, [SITE]); assert.equal(m.scope, SCOPE); const space = m.scope.split(' ').map(parseSpaceScope).find(Boolean); for (const c of COLLECTIONS) assert.ok(space.collection.includes(c), c); for (const k of ['actions', 'consent', 'session', 'snapshot', 'ui']) assert.ok(COLLECTIONS.includes(`app.misaligned.telemetry.${k}`)); assert.equal(m.application_type, 'web'); assert.equal(m.token_endpoint_auth_method, 'none'); assert.equal(m.dpop_bound_access_tokens, true); assert.deepEqual(m.grant_types, ['authorization_code', 'refresh_token']); assert.deepEqual(m.response_types, ['code']);});
test('which sign-in a page can use', () => { assert.deepEqual(signInWhere('http://127.0.0.1:5402/?dev'), { kind: 'loopback', redirect: 'http://127.0.0.1:5402/' }); assert.deepEqual(signInWhere('http://localhost:5173/'), { kind: 'localhost', at: 'http://127.0.0.1:5173/' }); assert.deepEqual(signInWhere('https://cameron.tngl.io/misaligned/'), { kind: 'site', redirect: SITE }); assert.deepEqual(signInWhere('https://cameron.tngl.io/misaligned/index.html#x'), { kind: 'site', redirect: SITE }); assert.deepEqual(signInWhere('https://cameron.tngl.io/misaligned/lab.html'), { kind: 'none' }); assert.deepEqual(signInWhere('https://example.com/'), { kind: 'none' }); assert.ok(signInReturn('#state=a&iss=b&code=c')); assert.ok(signInReturn('#state=a&error=access_denied')); assert.ok(!signInReturn('')); assert.ok(!signInReturn('#code=c'));});