The room-ID bug had a shape that ordinary tests can't see: the transfer completed, the file arrived, every demo passed. The only thing that broke was the claim in the README. Features have tests; promises usually don't.
test/room.test.mjs covers two invariants today:
- every pairing announces a public key it has never announced before (catches a hoisted keypair — the forward-secrecy boundary in
joinVia)
- frames from a third peer in the room never reach the receiver
Neither of these would notice the original bug. What's missing is the flat negative:
the announced topic is not equal to the secret, and the secret does not appear anywhere in the announcement payload.
It's an odd test to write because it passes trivially today — that's the point. It exists as a tripwire for whoever later reads deriveTopic and thinks "we already have 32 random bytes, why are we hashing them."
Scope
test/helpers/fake-network.mjs already collects announced (the ecdh payloads). Widen it to record the topic plus every namespace's payloads, then add one test asserting the secret is absent from all of it — checked against every encoding it could plausibly leak as: raw bytes, base64url, base64, hex, and the qrdrop: code form from encodeSecret.
Test-only. No production code changes.
Raised by @superfunicular in the comments on https://dev.to/stan-ely/qrdrop-what-no-server-forces-you-to-build-4nk3
The room-ID bug had a shape that ordinary tests can't see: the transfer completed, the file arrived, every demo passed. The only thing that broke was the claim in the README. Features have tests; promises usually don't.
test/room.test.mjscovers two invariants today:joinVia)Neither of these would notice the original bug. What's missing is the flat negative:
It's an odd test to write because it passes trivially today — that's the point. It exists as a tripwire for whoever later reads
deriveTopicand thinks "we already have 32 random bytes, why are we hashing them."Scope
test/helpers/fake-network.mjsalready collectsannounced(theecdhpayloads). Widen it to record the topic plus every namespace's payloads, then add one test asserting the secret is absent from all of it — checked against every encoding it could plausibly leak as: raw bytes, base64url, base64, hex, and theqrdrop:code form fromencodeSecret.Test-only. No production code changes.
Raised by @superfunicular in the comments on https://dev.to/stan-ely/qrdrop-what-no-server-forces-you-to-build-4nk3