Files
OwnCord/Client/tauri-client/tests/unit/voice-callbacks.test.ts
T
J3vbandClaude 5202e3fe1e fix: correctness fixes from the 2026-08-20 bug hunt (#1398)
* fix(identity): 2 defect(s) (OC-0192, OC-0197)

OC-0192: bound raw display_name/about/avatar bytes before the quadratic
fixpoint sanitizer runs, in both the REST handler and UserService.UpdateProfile.

OC-0197: sanitize display_name before validateDisplayName so an
HTML-entity-encoded bidi override (e.g. "‮") can no longer pass
validation as ASCII and be decoded into the real character on the way to
storage.

* fix(ws): 1 defect(s) (OC-0196)

A transient DB error during WebSocket auth (session or user lookup) was
collapsed into the terminal auth_error frame, which the client treats as
non-recoverable: it stops reconnecting and clears stored credentials. A
sub-second SQLite hiccup therefore force-logged-out every reconnecting
client with a perfectly valid session. Send a non-terminal INTERNAL error
frame instead so normal backoff/reconnect retries.

* fix(api): 1 defect(s) (OC-0198)

* fix(ws): 1 defect(s) (OC-0200)

normalizeHostForCertCompare now unwraps a bracketed IPv6 literal after the
trailing-":443" strip and before lowercasing, matching tofu::cert_store_key's
normalization order. Without the unwrap, every cert-tofu host equality guard
took the "unrelated host" branch for bracketed-IPv6 servers.

* fix(api): 1 defect(s) (OC-0202)

* fix(admin): 1 defect(s) (OC-0203)

Channel permission override handlers applied requireGrantableOverride only
to the bits being written, so an all-zero PUT or a DELETE could clear a
deny bit the actor's own role does not hold — EffectivePerms =
(rolePerm &^ deny) | allow makes removing a deny an escalation. Both the
role-layer and per-user handlers now check the guard against the bits
already on the row.

* fix(client): 1 defect(s) (OC-0205)

* fix(client): 3 defect(s) (OC-0207, OC-0227, OC-0235)

* fix(client): 1 defect(s) (OC-0208)

* fix(voice): 3 defect(s) (OC-0209, OC-0212, OC-0213)

OC-0209: reject a replayed retired-key announce before verifyPeerAnnounce
runs, so the replay cannot overwrite the peer's displayed verification
status/session fingerprint with the retired key's before being rejected.

OC-0212: buffer an announce blocked as a TOFU pin mismatch and replay it
after a successful rePinPeerIdentity, so re-pinning actually restores the
peer for the live call instead of clearing the badge and leaving them
un-keyed (a mid-call peer never re-announces on its own).

OC-0213: skip retiring a departing peer's key when the local voice roster
still lists them as present — a rejoin announce published straight into
the send queue can overtake the buffered, stale voice_leave, and retiring
a still-live key would reject every later genuine re-announce as a replay.

* fix(ws): 1 defect(s) (OC-0211)

* fix(identity): 1 defect(s) (OC-0214)

The delete-account admin guard counted remaining admins with a raw
`banned = 0` filter, so an admin whose temporary ban had already lapsed
was treated as unusable. Use the shared notBannedClause, appended outside
the Sprintf format string because its strftime verbs (%Y, %H) would
otherwise be parsed as fmt directives.

* fix(client): 1 defect(s) (OC-0215)

* fix(voice): 1 defect(s) (OC-0216)

* fix(client): 1 defect(s) (OC-0217)

* fix(voice): 1 defect(s) (OC-0219)

rollbackVoiceJoin cleared the client's in-memory voiceChID but left its
VoiceTopic subscription in place, so a socket whose join failed after
voiceJoinComplete's Subscribe kept receiving that room's E2EE relays for
the rest of the connection. Use clearVoiceAndUnsubscribe instead, matching
every other path that takes a client out of voice while its WS stays up.

* fix(client): 2 defect(s) (OC-0220, OC-0224)

dmDisplayName: a group DM whose other members have all left keeps a live
is_group row, but the server leaves `recipient` zero-valued, so the empty
username fell through as a blank label. Fall back to a non-empty placeholder.

updateDmLastMessage: a queued chat_message redelivered for an id already
reflected in the `ready` snapshot double-counted the unread badge. Only
increment when the message id advances past lastMessageId.

* fix(client): 1 defect(s) (OC-0221)

Cap queued attachments at the server's 10-attachment limit in the message
composer. Past that the server rejects the whole chat_send frame as a
generic parse error, orphaning already-uploaded attachments; refusing
before the upload starts keeps composer state and the send in sync.

* fix(ws): 1 defect(s) (OC-0222)

handleReconnect built the resume auth_ok before applyConnectStatus settled
c.user.Status, so a resumed client was told its disconnect-time status
(routinely "offline") instead of the status it was coming online as.
Move applyConnectStatus ahead of reconnectWriteReplay, matching
handleFreshConnect's ordering.

* fix(mentions): 1 defect(s) (OC-0223)

* fix(admin): 1 defect(s) (OC-0225)

* fix(client): 1 defect(s) (OC-0226)

* fix(client): 1 defect(s) (OC-0228)

* fix(client): 1 defect(s) (OC-0230)

Route the Logs tab entry counter through renderLogEntries so every render path (filter change, Clear, Refresh, live entry) keeps the count in sync with the list.

* fix(voice): 1 defect(s) (OC-0231)

* fix(client): 1 defect(s) (OC-0232)

Reduce Motion toggle wrote the reduced-motion class directly, fighting the
OS-sync media-query listener that owns it when Sync with OS is on. Route the
side effect through syncOsMotionListener so whichever source owns the class
re-derives it.

* fix(client): 1 defect(s) (OC-0233)

notifyIncomingMessage titled the desktop notification with the raw
payload username, so the popup named the sender differently from the
message row it points at. Resolve the author the same way the message
list does (resolveAuthor over the live membersStore, then
resolveDisplayName).

* fix(client): 1 defect(s) (OC-0234)

* fix(client): 1 defect(s) (OC-0236)

* fix(ws): 1 defect(s) (OC-0237)

* fix(client): 4 defect(s) (OC-0193, OC-0201, OC-0204, OC-0218)

* fix(identity): 1 defect(s) (OC-0195)

Bound free-text profile fields by raw byte length before cleanText's
quadratic sanitizeToFixpoint pass runs, generalizing OC-0192's guard into
cleanTextBounded and applying it to HandlePresenceUpdate's custom_status,
SetCustomStatus, and group DM names.

* fix(dm): 1 defect(s) (OC-0199)

handleCreateDM now broadcasts dm_channel_open to the recipient when a 1:1 DM is newly created, matching handleCreateGroupDM. GetOrCreateDMChannel pre-seeds dm_open_state for both users, so the recipient's later OpenDM reported opened=false and nothing ever told them the DM existed.

* fix(voice): 1 defect(s) (OC-0206)

vad-worklet.js gate timing constants were copied from the setTimeout
fallback's ~16ms poll cadence, but AudioWorkletProcessor.process() runs
once per 128-sample render quantum (~2.667ms at the 48kHz AudioContext).
The mic gate therefore closed ~6x faster than intended (~32ms of silence
instead of ~200ms), with the startup grace and RMS post interval off by
the same factor. Scale the frame counts to render quanta.

* fix(client): 1 defect(s) (OC-0229)

* test(client): assert the real TOFU re-pin outcome and make the pin mock faithful

The e2e journey test asserted that "Trust New Key" makes the peer's verify
badge disappear. That is the behaviour OC-0212 identifies as the defect: a
mid-call peer never re-announces, so clearing the badge left the peer
un-keyed for the rest of the call with nothing on screen. Re-pinning now
replays the announce that was blocked as a mismatch and re-verifies it
against the pin just stored, so assert the peer actually lands verified.

The mock's store_identity_pin was a no-op recorder while get_identity_pin
served a static seed map, so the replayed announce re-read the stale pin and
re-failed — a mismatch the real keyring never produces. Back the pins with a
mutable map so a write is visible to the next read. The unreadable-store
(DC-08) and reject-keeps-blocked paths are unchanged and still pass.

* fix(dm): 1 defect(s) (OC-0194)

Add regression tests pinning the raw-byte bound on group DM names, for
both CreateGroupDM and RenameGroupDM.

The Server/service/dm.go source fix for OC-0194 already landed in
bdbd5ac (fix(identity): 1 defect(s) (OC-0195)), which generalized the
guard into cleanTextBounded and applied it to the group DM name paths
alongside the profile fields. This commit therefore carries the OC-0194
tests only; dm.go is unchanged.

Revert-proof: with dm.go restored to bdbd5ac^ (cleanText before the
rune-count check) both new tests fail — CreateGroupDM returns "recipient
not found" after 222ms and RenameGroupDM accepts the name after 251ms,
against a 150ms budget. With the fix in place both pass in 0.03s.

* fix(ws): 1 defect(s) (OC-0210)

* chore(findings): record the 2026-08-20 hunt's 46 findings as fixed

Appends OC-0192..OC-0237 from the 2026-08-20 converging hunt and marks each
fixed with its commit and the test that pins it. Pre-existing records are
byte-identical; nextId moves 192 -> 238 so the next hunt cannot collide with
these ids.

Every fix was independently revert-proofed: the commit's own source diff is
reverse-applied, its test must go red, and must return green once restored.
43 of 46 carry revertProof "pass" from that mechanical run. Three could not be
checked at file level and were proved by hand at hunk level instead, recorded
as "pass (hand-proved)": OC-0200, whose ws.ts edit no longer reverse-applies
because the merge kept main's equivalent implementation; OC-0215, whose Rust
tests live in-file under #[cfg(test)]; and OC-0194, which stacks on a helper
introduced by an earlier commit. No fix was found to rest on a vacuous test.

OC-0200 additionally carries a note: main fixed that same normalizer
independently while this branch was in flight, so the branch is no longer the
only thing closing it.

* docs: record the dm_channel_open emission on 1:1 DM creation

POST /api/v1/dms now emits dm_channel_open to the recipient when it creates a
channel (it previously emitted nothing on that path), so api.md states it the
way the sibling DM endpoints already state theirs.

The channels/members/DMs UX spec claimed the server broadcast the event "to
both parties" on this flow. That was never true — nothing was broadcast before,
and now only the recipient is sent it; the creator learns the channel from the
response body. This doc lists dispatcher.ts, dm.store.ts, ChannelSidebar.ts,
service/channel.go and dm.go among its sources of truth, all touched here, so
it is corrected in the same change per its maintenance rule.

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-08-20 20:45:30 +02:00

391 lines
13 KiB
TypeScript

import { describe, it, expect, vi, beforeEach } from "vitest";
// ---------------------------------------------------------------------------
// Mocks
// ---------------------------------------------------------------------------
const {
mockVoiceStoreGetState,
mockJoinVoiceChannel,
mockLeaveVoiceChannel,
mockVoiceSessionLeave,
mockSetMuted,
mockSetDeafened,
mockEnableCamera,
mockDisableCamera,
mockEnableScreenshare,
mockDisableScreenshare,
mockUiGetState,
} = vi.hoisted(() => ({
mockVoiceStoreGetState: vi.fn(),
mockJoinVoiceChannel: vi.fn(),
mockLeaveVoiceChannel: vi.fn(),
mockVoiceSessionLeave: vi.fn(),
mockSetMuted: vi.fn(),
mockSetDeafened: vi.fn(),
mockEnableCamera: vi.fn(() => Promise.resolve()),
mockDisableCamera: vi.fn(() => Promise.resolve()),
mockEnableScreenshare: vi.fn(() => Promise.resolve()),
mockDisableScreenshare: vi.fn(() => Promise.resolve()),
mockUiGetState: vi.fn(() => ({ connectionStatus: "connected" })),
}));
vi.mock("@lib/logger", () => ({
createLogger: () => ({
debug: vi.fn(),
info: vi.fn(),
warn: vi.fn(),
error: vi.fn(),
}),
}));
vi.mock("@stores/voice.store", () => ({
voiceStore: { getState: mockVoiceStoreGetState },
joinVoiceChannel: mockJoinVoiceChannel,
leaveVoiceChannel: mockLeaveVoiceChannel,
}));
vi.mock("@stores/ui.store", () => ({
uiStore: { getState: mockUiGetState },
}));
vi.mock("@lib/livekitSession", () => ({
leaveVoice: mockVoiceSessionLeave,
setMuted: mockSetMuted,
setDeafened: mockSetDeafened,
enableCamera: mockEnableCamera,
disableCamera: mockDisableCamera,
enableScreenshare: mockEnableScreenshare,
disableScreenshare: mockDisableScreenshare,
}));
// ---------------------------------------------------------------------------
// Imports
// ---------------------------------------------------------------------------
import {
createVoiceWidgetCallbacks,
createSidebarVoiceCallbacks,
} from "../../src/pages/main-page/VoiceCallbacks";
import type { WsClient } from "../../src/lib/ws";
// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
function makeWs(): WsClient {
return { send: vi.fn() } as unknown as WsClient;
}
function makeLimiters(voiceAllowed = true, videoAllowed = true) {
return {
voice: { tryConsume: vi.fn(() => voiceAllowed) },
voiceVideo: { tryConsume: vi.fn(() => videoAllowed) },
};
}
interface VoiceStateStub {
currentChannelId: number | null;
localMuted: boolean;
localDeafened: boolean;
localCamera: boolean;
localScreenshare: boolean;
localServerMuted: boolean;
localServerDeafened: boolean;
}
function makeVoiceState(overrides: Partial<VoiceStateStub> = {}): VoiceStateStub {
return {
currentChannelId: 10,
localMuted: false,
localDeafened: false,
localCamera: false,
localScreenshare: false,
localServerMuted: false,
localServerDeafened: false,
...overrides,
};
}
// ---------------------------------------------------------------------------
// Voice Widget Callbacks
// ---------------------------------------------------------------------------
describe("createVoiceWidgetCallbacks", () => {
beforeEach(() => {
vi.clearAllMocks();
mockVoiceStoreGetState.mockReturnValue(makeVoiceState());
mockUiGetState.mockReturnValue({ connectionStatus: "connected" });
});
describe("onDisconnect", () => {
it("sends voice_leave and cleans up", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDisconnect();
expect(mockVoiceSessionLeave).toHaveBeenCalledWith(false);
expect(mockLeaveVoiceChannel).toHaveBeenCalled();
expect(ws.send).toHaveBeenCalledWith({ type: "voice_leave", payload: {} });
});
it("does nothing when not in a voice channel", () => {
mockVoiceStoreGetState.mockReturnValue(makeVoiceState({ currentChannelId: null }));
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDisconnect();
expect(ws.send).not.toHaveBeenCalled();
});
it("does not send over a down socket while reconnecting", () => {
mockUiGetState.mockReturnValue({ connectionStatus: "reconnecting" });
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDisconnect();
expect(mockVoiceSessionLeave).not.toHaveBeenCalled();
expect(ws.send).not.toHaveBeenCalled();
});
});
describe("onMuteToggle", () => {
it("mutes when unmuted", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onMuteToggle();
expect(mockSetMuted).toHaveBeenCalledWith(true);
expect(ws.send).toHaveBeenCalledWith({ type: "voice_mute", payload: { muted: true } });
});
it("unmutes and undeafens when muted+deafened", () => {
mockVoiceStoreGetState.mockReturnValue(
makeVoiceState({ localMuted: true, localDeafened: true }),
);
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onMuteToggle();
expect(mockSetMuted).toHaveBeenCalledWith(false);
expect(mockSetDeafened).toHaveBeenCalledWith(false);
expect(ws.send).toHaveBeenCalledWith({ type: "voice_deafen", payload: { deafened: false } });
expect(ws.send).toHaveBeenCalledWith({ type: "voice_mute", payload: { muted: false } });
});
it("respects rate limiter", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters(false));
cbs.onMuteToggle();
expect(mockSetMuted).not.toHaveBeenCalled();
});
it("does not send voice_deafen{deafened:false} on unmute while server-deafened (OC-0216)", () => {
// Mirrors onDeafenToggle's localServerMuted guard (OC-0179): a
// moderator-imposed deafen is not ours to lift, so unmuting must not
// spend a doomed voice_deafen round-trip that the server will refuse
// with SERVER_DEAFENED.
mockVoiceStoreGetState.mockReturnValue(
makeVoiceState({ localMuted: true, localDeafened: true, localServerDeafened: true }),
);
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onMuteToggle();
// The unmute itself still goes through...
expect(mockSetMuted).toHaveBeenCalledWith(false);
expect(ws.send).toHaveBeenCalledWith({ type: "voice_mute", payload: { muted: false } });
// ...but the undeafen must be suppressed while the server deafen stands.
expect(mockSetDeafened).not.toHaveBeenCalled();
expect(ws.send).not.toHaveBeenCalledWith(expect.objectContaining({ type: "voice_deafen" }));
});
});
describe("onDeafenToggle", () => {
it("deafens and mutes when undeafened", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDeafenToggle();
expect(mockSetDeafened).toHaveBeenCalledWith(true);
expect(mockSetMuted).toHaveBeenCalledWith(true);
});
it("undeafens and unmutes when deafened", () => {
mockVoiceStoreGetState.mockReturnValue(
makeVoiceState({ localDeafened: true, localMuted: true }),
);
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDeafenToggle();
expect(mockSetDeafened).toHaveBeenCalledWith(false);
expect(mockSetMuted).toHaveBeenCalledWith(false);
});
it("does not double-mute when already muted", () => {
mockVoiceStoreGetState.mockReturnValue(makeVoiceState({ localMuted: true }));
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDeafenToggle();
// Should deafen but not send another mute since already muted
expect(mockSetDeafened).toHaveBeenCalledWith(true);
expect(mockSetMuted).not.toHaveBeenCalled();
expect(ws.send).toHaveBeenCalledWith({ type: "voice_deafen", payload: { deafened: true } });
expect(ws.send).not.toHaveBeenCalledWith(expect.objectContaining({ type: "voice_mute" }));
});
it("does not send voice_mute{muted:false} on undeafen while server-muted (OC-0179)", () => {
// Mirrors onMuteToggle's localServerMuted guard: a moderator-imposed
// mute is not ours to lift, so undeafening must not spend a doomed
// voice_mute round-trip that the server will refuse with SERVER_MUTED.
mockVoiceStoreGetState.mockReturnValue(
makeVoiceState({ localDeafened: true, localMuted: true, localServerMuted: true }),
);
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onDeafenToggle();
// The deafen clear itself still goes through...
expect(mockSetDeafened).toHaveBeenCalledWith(false);
expect(ws.send).toHaveBeenCalledWith({ type: "voice_deafen", payload: { deafened: false } });
// ...but the unmute must be suppressed while the server mute stands.
expect(mockSetMuted).not.toHaveBeenCalled();
expect(ws.send).not.toHaveBeenCalledWith(expect.objectContaining({ type: "voice_mute" }));
});
});
describe("onCameraToggle", () => {
it("enables camera when off", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onCameraToggle();
expect(mockEnableCamera).toHaveBeenCalled();
});
it("disables camera when on", () => {
mockVoiceStoreGetState.mockReturnValue(makeVoiceState({ localCamera: true }));
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onCameraToggle();
expect(mockDisableCamera).toHaveBeenCalled();
});
it("respects video rate limiter", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters(true, false));
cbs.onCameraToggle();
expect(mockEnableCamera).not.toHaveBeenCalled();
});
});
describe("onScreenshareToggle", () => {
it("enables screenshare when off", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onScreenshareToggle();
expect(mockEnableScreenshare).toHaveBeenCalled();
expect(mockDisableScreenshare).not.toHaveBeenCalled();
});
it("disables screenshare when on", () => {
mockVoiceStoreGetState.mockReturnValue(makeVoiceState({ localScreenshare: true }));
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters());
cbs.onScreenshareToggle();
expect(mockDisableScreenshare).toHaveBeenCalled();
expect(mockEnableScreenshare).not.toHaveBeenCalled();
});
it("respects video rate limiter", () => {
const ws = makeWs();
const cbs = createVoiceWidgetCallbacks(ws, makeLimiters(true, false));
cbs.onScreenshareToggle();
expect(mockEnableScreenshare).not.toHaveBeenCalled();
expect(mockDisableScreenshare).not.toHaveBeenCalled();
});
});
});
// ---------------------------------------------------------------------------
// Sidebar Voice Callbacks
// ---------------------------------------------------------------------------
describe("createSidebarVoiceCallbacks", () => {
beforeEach(() => {
vi.clearAllMocks();
mockUiGetState.mockReturnValue({ connectionStatus: "connected" });
});
it("onVoiceJoin sends voice_join and updates store", () => {
const ws = makeWs();
const cbs = createSidebarVoiceCallbacks(ws);
cbs.onVoiceJoin(42);
expect(mockJoinVoiceChannel).toHaveBeenCalledWith(42);
expect(ws.send).toHaveBeenCalledWith({
type: "voice_join",
payload: { channel_id: 42 },
});
});
it("onVoiceLeave sends voice_leave and cleans up", () => {
const ws = makeWs();
const cbs = createSidebarVoiceCallbacks(ws);
cbs.onVoiceLeave();
expect(mockVoiceSessionLeave).toHaveBeenCalledWith(false);
expect(mockLeaveVoiceChannel).toHaveBeenCalled();
expect(ws.send).toHaveBeenCalledWith({ type: "voice_leave", payload: {} });
});
it("onVoiceJoin does not send over a down socket", () => {
mockUiGetState.mockReturnValue({ connectionStatus: "disconnected" });
const ws = makeWs();
const cbs = createSidebarVoiceCallbacks(ws);
cbs.onVoiceJoin(42);
expect(mockJoinVoiceChannel).not.toHaveBeenCalled();
expect(ws.send).not.toHaveBeenCalled();
});
it("onVoiceLeave does not send over a down socket", () => {
mockUiGetState.mockReturnValue({ connectionStatus: "reconnecting" });
const ws = makeWs();
const cbs = createSidebarVoiceCallbacks(ws);
cbs.onVoiceLeave();
expect(mockVoiceSessionLeave).not.toHaveBeenCalled();
expect(ws.send).not.toHaveBeenCalled();
});
});