replace tests to use grasp-audit lib as much as possible

1 files changed, 97 insertions, 483 deletions

diff --git a/tests/nip34_announcements.rs b/tests/nip34_announcements.rs
index 535425d..f1cbd05 100644
--- a/tests/nip34_announcements.rs
+++ b/tests/nip34_announcements.rs
@@ -1,24 +1,22 @@
-//! NIP-34 Repository Announcements Integration Tests (GRASP-01)
+//! GRASP-01 Repository Event Acceptance Integration Tests
 //!
-//! Tests the acceptance and validation of repository announcements (kind 30617)
-//! and repository state announcements (kind 30618) according to GRASP-01.
-//!
-//! Reference: GRASP-01, Lines 9-20
+//! Tests ngit-grasp relay's implementation of GRASP-01 repository event acceptance policy.
+//! Uses grasp-audit library to avoid code duplication.
 //!
 //! # Test Strategy
 //!
-//! - Uses TestRelay fixture for automatic relay lifecycle management
-//! - Pure Rust, no shell scripts
-//! - Tests run in parallel with isolated relay instances
+//! - Uses TestRelay fixture for ngit-grasp relay lifecycle management
+//! - Uses grasp-audit's EventAcceptancePolicyTests for actual test logic
+//! - Minimal duplication - single source of truth in grasp-audit
 //!
 //! # Running Tests
 //!
 //! ```bash
-//! # Run all NIP-34 announcement tests
+//! # Run all GRASP-01 tests
 //! cargo test --test nip34_announcements
 //!
 //! # Run specific test
-//! cargo test --test nip34_announcements test_accepts_valid_announcement
+//! cargo test --test nip34_announcements test_grasp01_event_acceptance
 //!
 //! # With output
 //! cargo test --test nip34_announcements -- --nocapture
@@ -27,510 +25,126 @@
 mod common;
 
 use common::TestRelay;
-use futures_util::{SinkExt, StreamExt};
-use nostr_sdk::{EventBuilder, Keys, Kind, Tag, TagKind};
-use serde_json::{json, Value};
-use tokio_tungstenite::{connect_async, tungstenite::Message};
-
-const KIND_REPOSITORY_ANNOUNCEMENT: u16 = 30617;
-const KIND_REPOSITORY_STATE: u16 = 30618;
-
-/// Helper to connect to a test relay
-async fn connect_to_relay(
-    url: &str,
-) -> tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>> {
-    let (ws, _) = connect_async(url)
-        .await
-        .expect("Failed to connect to relay");
-    ws
-}
-
-/// Helper to create a repository announcement event
-fn create_announcement(
-    keys: &Keys,
-    _domain: &str,
-    identifier: &str,
-    clone_urls: Vec<String>,
-    relays: Vec<String>,
-) -> nostr_sdk::Event {
-    let mut tags = vec![Tag::custom(TagKind::d(), vec![identifier.to_string()])];
-
-    for url in clone_urls {
-        tags.push(Tag::custom(TagKind::Clone, vec![url]));
-    }
-
-    for relay in relays {
-        tags.push(Tag::custom(TagKind::Relays, vec![relay]));
-    }
-
-    EventBuilder::new(
-        Kind::from(KIND_REPOSITORY_ANNOUNCEMENT),
-        "Test repository description",
-    )
-    .tags(tags)
-    .sign_with_keys(keys)
-    .expect("Failed to sign event")
-}
-
-/// Helper to create a repository state event
-fn create_state(keys: &Keys, identifier: &str, branches: Vec<(&str, &str)>) -> nostr_sdk::Event {
-    let mut tags = vec![Tag::custom(TagKind::d(), vec![identifier.to_string()])];
-
-    for (branch, commit) in branches {
-        tags.push(Tag::custom(
-            TagKind::Custom("ref".into()),
-            vec![format!("refs/heads/{}", branch), commit.to_string()],
-        ));
-    }
-
-    EventBuilder::new(Kind::from(KIND_REPOSITORY_STATE), "")
-        .tags(tags)
-        .sign_with_keys(keys)
-        .expect("Failed to sign event")
-}
-
-/// GRASP-01, Line 9-10: MUST serve a NIP-01 compliant nostr relay at `/`
+use grasp_audit::*;
+
+/// Test GRASP-01 event acceptance policy against ngit-grasp relay
+///
+/// This test runs all GRASP-01 event acceptance policy tests from grasp-audit
+/// against the ngit-grasp relay implementation.
+///
+/// Tests cover:
+/// - Repository announcement acceptance/rejection
+/// - Repository state announcement acceptance
+/// - Events tagging accepted repositories
+/// - Transitive event acceptance (events tagging accepted events)
+/// - Forward reference acceptance (events tagged by accepted events)
+/// - Rejection of unrelated events
 #[tokio::test]
-async fn test_relay_accepts_connection() {
+async fn test_grasp01_event_acceptance() {
+    // Start test relay
     let relay = TestRelay::start().await;
 
-    // Try to connect
-    let ws = connect_to_relay(relay.url()).await;
-
-    drop(ws); // Clean disconnect
-}
-
-/// GRASP-01, Line 11: MUST accept repository announcements (kind 30617)
-#[tokio::test]
-async fn test_accepts_valid_announcement() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let mut ws = connect_to_relay(relay.url()).await;
-
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "test-repo",
-        vec![format!("https://{}/alice/test-repo.git", relay.domain())],
-        vec![format!("wss://{}", relay.domain())],
-    );
-
-    // Send event
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
+    // Create audit client in CI mode (isolated testing)
+    let config = AuditConfig::ci();
+    let client = AuditClient::new(relay.url(), config)
         .await
-        .expect("Failed to send event");
+        .expect("Failed to create audit client");
 
-    // Read response
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse response");
+    // Run all GRASP-01 event acceptance policy tests
+    let results = specs::EventAcceptancePolicyTests::run_all(&client).await;
 
-        // Should be ["OK", event_id, true, ""]
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        if response[2] != true {
-            eprintln!("Event rejected: {}", response[3]);
-        }
-        assert_eq!(response[2], true, "Event should be accepted");
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// GRASP-01, Line 12-13: MUST reject announcements that do not list the service
-/// in both `clone` and `relays` tags
-#[tokio::test]
-async fn test_rejects_announcement_without_clone() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
+    // Print detailed report
+    results.print_report();
 
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
+    // Stop relay
+    relay.stop().await;
 
-    // Missing clone tag
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "test-repo",
-        vec![], // No clone URLs
-        vec![format!("wss://{}", relay.domain())],
+    // Assert all tests passed
+    assert!(
+        results.all_passed(),
+        "GRASP-01 event acceptance tests failed: {}/{} passed",
+        results.passed_count(),
+        results.total_count()
     );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        // Should be rejected
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        assert_eq!(response[2], false, "Event should be rejected");
-
-        let message = response[3].as_str().unwrap();
-        assert!(
-            message.contains("clone") || message.contains("invalid"),
-            "Error message should mention clone requirement: {}",
-            message
-        );
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// GRASP-01, Line 12-13: MUST reject announcements that do not list the service
-/// in both `clone` and `relays` tags
-#[tokio::test]
-async fn test_rejects_announcement_without_relay() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    // Missing relay tag
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "test-repo",
-        vec![format!("https://{}/alice/test-repo.git", relay.domain())],
-        vec![], // No relays
-    );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        // Should be rejected
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        assert_eq!(response[2], false, "Event should be rejected");
-
-        let message = response[3].as_str().unwrap();
-        assert!(
-            message.contains("relays") || message.contains("invalid"),
-            "Error message should mention relay requirement: {}",
-            message
-        );
-    } else {
-        panic!("No response received");
-    }
 }
 
-/// GRASP-01, Line 12-13: MUST reject announcements listing other services
+/// Test that relay accepts valid repository announcements
+///
+/// Demonstrates running individual test categories from the suite
 #[tokio::test]
-async fn test_rejects_announcement_for_other_service() {
+async fn test_accepts_repository_announcements() {
     let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    // Lists different service
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "test-repo",
-        vec!["https://other-service.com/alice/test-repo.git".to_string()],
-        vec!["wss://other-service.com".to_string()],
-    );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
+    let config = AuditConfig::ci();
+    let client = AuditClient::new(relay.url(), config)
         .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        // Should be rejected
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        assert_eq!(response[2], false, "Event should be rejected");
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// GRASP-01, Line 11: MUST accept repository state announcements (kind 30618)
-#[tokio::test]
-async fn test_accepts_valid_state() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    let event = create_state(
-        &keys,
-        "test-repo",
-        vec![("main", "a1b2c3d4e5f6789012345678901234567890abcd")],
+        .expect("Failed to create audit client");
+
+    // Run all tests
+    let results = specs::EventAcceptancePolicyTests::run_all(&client).await;
+
+    relay.stop().await;
+
+    // Filter to only repository announcement tests
+    let announcement_tests: Vec<_> = results
+        .results
+        .iter()
+        .filter(|t| {
+            t.spec_ref.contains("repo") || t.name.contains("announcement") || t.name.contains("state")
+        })
+        .collect();
+
+    // Verify we have announcement tests
+    assert!(
+        !announcement_tests.is_empty(),
+        "No repository announcement tests found"
     );
 
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        // Should be accepted
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        assert_eq!(response[2], true, "State event should be accepted");
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// Test state event with multiple branches
-#[tokio::test]
-async fn test_accepts_state_with_multiple_branches() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    let event = create_state(
-        &keys,
-        "test-repo",
-        vec![
-            ("main", "a1b2c3d4e5f6789012345678901234567890abcd"),
-            ("develop", "b2c3d4e5f6789012345678901234567890abcde"),
-            ("feature-x", "c3d4e5f6789012345678901234567890abcdef1"),
-        ],
-    );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[2], true, "State event should be accepted");
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// Test state event without identifier should be rejected
-#[tokio::test]
-async fn test_rejects_state_without_identifier() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    // Create state without identifier
-    let event = EventBuilder::new(Kind::from(KIND_REPOSITORY_STATE), "")
-        .sign_with_keys(&keys)
-        .expect("Failed to sign event");
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-        // Should be rejected
-        assert_eq!(response[0], "OK");
-        assert_eq!(response[1], event.id.to_hex());
-        assert_eq!(response[2], false, "Event should be rejected");
-
-        let message = response[3].as_str().unwrap();
+    // All should pass
+    for test in announcement_tests {
         assert!(
-            message.contains("identifier") || message.contains("invalid"),
-            "Error message should mention identifier requirement: {}",
-            message
+            test.passed,
+            "Repository test failed: {} - {}",
+            test.name,
+            test.error.as_deref().unwrap_or("unknown error")
         );
-    } else {
-        panic!("No response received");
-    }
-}
-
-/// Test querying for announcements
-#[tokio::test]
-async fn test_query_announcements() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    // Send an announcement
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "query-test-repo",
-        vec![format!(
-            "https://{}/alice/query-test-repo.git",
-            relay.domain()
-        )],
-        vec![format!("wss://{}", relay.domain())],
-    );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    // Wait for OK response
-    if let Some(Ok(Message::Text(_))) = ws.next().await {
-        // Got OK response
     }
-
-    // Query for announcements
-    let req = json!([
-        "REQ",
-        "test-sub",
-        {
-            "kinds": [KIND_REPOSITORY_ANNOUNCEMENT],
-            "authors": [keys.public_key().to_hex()]
-        }
-    ]);
-
-    ws.send(Message::Text(req.to_string().into()))
-        .await
-        .expect("Failed to send REQ");
-
-    // Read responses
-    let mut found_event = false;
-    let mut got_eose = false;
-
-    for _ in 0..10 {
-        if let Some(Ok(Message::Text(text))) = ws.next().await {
-            let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-            if response[0] == "EVENT" {
-                assert_eq!(response[1], "test-sub");
-                found_event = true;
-            } else if response[0] == "EOSE" {
-                assert_eq!(response[1], "test-sub");
-                got_eose = true;
-                break;
-            }
-        }
-    }
-
-    assert!(found_event, "Should have received the announcement");
-    assert!(got_eose, "Should have received EOSE");
 }
 
-/// Test querying for state events
+/// Test that relay properly validates clone and relays tags
+///
+/// This is a critical security requirement for GRASP-01
 #[tokio::test]
-async fn test_query_states() {
+async fn test_validates_service_tags() {
     let relay = TestRelay::start().await;
-    let keys = Keys::generate();
-
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    // Send a state event
-    let event = create_state(
-        &keys,
-        "query-test-repo",
-        vec![("main", "a1b2c3d4e5f6789012345678901234567890abcd")],
-    );
-
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    // Wait for OK response
-    if let Some(Ok(Message::Text(_))) = ws.next().await {
-        // Got OK response
-    }
-
-    // Query for states
-    let req = json!([
-        "REQ",
-        "test-sub",
-        {
-            "kinds": [KIND_REPOSITORY_STATE],
-            "authors": [keys.public_key().to_hex()]
-        }
-    ]);
-
-    ws.send(Message::Text(req.to_string().into()))
+    let config = AuditConfig::ci();
+    let client = AuditClient::new(relay.url(), config)
         .await
-        .expect("Failed to send REQ");
+        .expect("Failed to create audit client");
 
-    // Read responses
-    let mut found_event = false;
-    let mut got_eose = false;
+    let results = specs::EventAcceptancePolicyTests::run_all(&client).await;
 
-    for _ in 0..10 {
-        if let Some(Ok(Message::Text(text))) = ws.next().await {
-            let response: Value = serde_json::from_str(&text).expect("Failed to parse");
-
-            if response[0] == "EVENT" {
-                assert_eq!(response[1], "test-sub");
-                found_event = true;
-            } else if response[0] == "EOSE" {
-                assert_eq!(response[1], "test-sub");
-                got_eose = true;
-                break;
-            }
-        }
-    }
+    relay.stop().await;
 
-    assert!(found_event, "Should have received the state event");
-    assert!(got_eose, "Should have received EOSE");
-}
-
-/// Test duplicate event handling
-#[tokio::test]
-async fn test_duplicate_announcement() {
-    let relay = TestRelay::start().await;
-    let keys = Keys::generate();
+    // Filter to rejection tests (these verify tag validation)
+    let rejection_tests: Vec<_> = results
+        .results
+        .iter()
+        .filter(|t| t.name.contains("reject"))
+        .collect();
 
-    let (mut ws, _) = connect_async(relay.url()).await.expect("Failed to connect");
-
-    let event = create_announcement(
-        &keys,
-        &relay.domain(),
-        "duplicate-test",
-        vec![format!(
-            "https://{}/alice/duplicate-test.git",
-            relay.domain()
-        )],
-        vec![format!("wss://{}", relay.domain())],
+    // Should have rejection tests
+    assert!(
+        !rejection_tests.is_empty(),
+        "No rejection tests found (these are critical for security)"
     );
 
-    // Send first time
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response1: Value = serde_json::from_str(&text).expect("Failed to parse");
-        assert_eq!(response1[2], true, "First send should succeed");
-    }
-
-    // Send second time (duplicate)
-    let event_msg = json!(["EVENT", event]);
-    ws.send(Message::Text(event_msg.to_string().into()))
-        .await
-        .expect("Failed to send event");
-
-    if let Some(Ok(Message::Text(text))) = ws.next().await {
-        let response2: Value = serde_json::from_str(&text).expect("Failed to parse");
-        assert_eq!(response2[2], true, "Duplicate should be acknowledged");
-
-        let message = response2[3].as_str().unwrap();
+    // All rejection tests should pass
+    for test in rejection_tests {
         assert!(
-            message.contains("duplicate") || message.is_empty(),
-            "Should indicate duplicate: {}",
-            message
+            test.passed,
+            "Rejection test failed: {} - {}\nThis is a security issue!",
+            test.name,
+            test.error.as_deref().unwrap_or("unknown error")
         );
     }
 }