test(receipt): assert receipt bytes decode as an invocation

Locks in the invariant the receipt API rests on: a receipt is its own
Go type, but on the wire it is byte-identical to a /ucan/assert/receipt
invocation. TestWireFormatIsInvocation encodes a receipt and decodes
the same bytes via invocation.Decode, checking the command, issuer,
CID, signed bytes, and that Ran/Out are recoverable from the args. If
the receipt encoding ever drifts from the invocation encoding, this
fails.
- the invocation view re-encodes to byte-identical output
- the executor is issuer, subject, and audience (per ucan-wg/receipt#1)
- the bytes verify through invocation.VerifySignature, not just parse
- the Out value decodes back to the original, not just non-nil
- Adds TestNotAReceipt in the invocation package as the mirror: a plain
invocation with a non-receipt command must be rejected by
receipt.Decode. Together the two tests pin the discrimination boundary
in both directions.

Author: frrist

ucan/invocation/invocation_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/fil-forge/ucantone/ucan"
 	"github.com/fil-forge/ucantone/ucan/command"
 	"github.com/fil-forge/ucantone/ucan/invocation"
+	"github.com/fil-forge/ucantone/ucan/receipt"
 	"github.com/stretchr/testify/require"
 	cbg "github.com/whyrusleeping/cbor-gen"
 )
@@ -257,3 +258,30 @@ func TestInvokeRejectsNonMapArgs(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "args must encode as a CBOR map")
 }
+
+// TestNotAReceipt is the mirror of receipt.TestWireFormatIsInvocation. A
+// receipt is wire-identical to a /ucan/assert/receipt invocation, but the
+// discrimination must hold in the other direction too: a plain invocation
+// with any other command MUST NOT decode as a receipt. This pins the
+// boundary so receipt.Decode can't silently accept arbitrary invocations.
+func TestNotAReceipt(t *testing.T) {
+	issuer := testutil.RandomSigner(t)
+	subject := testutil.RandomDID(t)
+	command := testutil.Must(command.Parse("/test/invoke"))(t)
+
+	inv, err := invocation.Invoke(issuer, subject, command, datamodel.Map{})
+	require.NoError(t, err)
+
+	encoded, err := invocation.Encode(inv)
+	require.NoError(t, err)
+
+	// The invocation decodes fine as an invocation...
+	_, err = invocation.Decode(encoded)
+	require.NoError(t, err)
+
+	// ...but must be rejected as a receipt: its command isn't the receipt
+	// command, so there are no Ran/Out fields to recover.
+	_, err = receipt.Decode(encoded)
+	require.Error(t, err, "a non-receipt invocation must not decode as a receipt")
+	require.Contains(t, err.Error(), "invalid receipt command")
+}

ucan/receipt/receipt_test.go

@@ -9,7 +9,9 @@ import (
 
 	"github.com/fil-forge/ucantone/testutil"
 	"github.com/fil-forge/ucantone/ucan"
+	"github.com/fil-forge/ucantone/ucan/invocation"
 	"github.com/fil-forge/ucantone/ucan/receipt"
+	rdm "github.com/fil-forge/ucantone/ucan/receipt/datamodel"
 )
 
 func TestIssueOK(t *testing.T) {
@@ -126,3 +128,63 @@ func TestNotInvocation(t *testing.T) {
 	_, isInv := any(rcpt).(ucan.Invocation)
 	require.False(t, isInv, "Receipt must not be assignable to ucan.Invocation")
 }
+
+// TestWireFormatIsInvocation locks in the invariant the receipt API rests on:
+// although Receipt is its own Go type, on the wire a receipt is byte-identical
+// to a /ucan/assert/receipt invocation. The exact bytes produced by
+// receipt.Encode MUST decode cleanly via invocation.Decode, with Ran/Out
+// recoverable from the invocation's args. If the receipt encoding ever drifts
+// from the invocation encoding, this test fails.
+func TestWireFormatIsInvocation(t *testing.T) {
+	executor := testutil.RandomSigner(t)
+	ran := testutil.RandomCID(t)
+	ok := cbg.CborInt(42)
+
+	rcpt, err := receipt.IssueOK(executor, ran, &ok)
+	require.NoError(t, err)
+
+	encoded, err := receipt.Encode(rcpt)
+	require.NoError(t, err)
+
+	// The same bytes must decode as an invocation...
+	inv, err := invocation.Decode(encoded)
+	require.NoError(t, err, "receipt bytes must be a valid invocation on the wire")
+
+	// ...and the invocation view must re-encode to byte-identical output, so
+	// the two views are not just compatible but the same wire object.
+	reencoded, err := invocation.Encode(inv)
+	require.NoError(t, err)
+	require.Equal(t, encoded, reencoded, "invocation view must re-encode verbatim")
+
+	// It is the /ucan/assert/receipt invocation shape, with the executor as
+	// issuer, subject, and audience (per ucan-wg/receipt#1).
+	require.Equal(t, receipt.Command, inv.Command())
+	require.Equal(t, executor.DID(), inv.Issuer().DID())
+	require.Equal(t, executor.DID(), inv.Subject().DID())
+	require.NotNil(t, inv.Audience())
+	require.Equal(t, executor.DID(), inv.Audience().DID())
+
+	// The receipt and invocation views agree on identity and signed bytes.
+	require.Equal(t, rcpt.Link(), inv.Link(), "receipt and invocation views share one CID")
+	require.Equal(t, rcpt.SignedBytes(), inv.SignedBytes())
+
+	// The bytes verify as a signed invocation — not merely parse as one.
+	verified, err := invocation.VerifySignature(inv, executor.Verifier())
+	require.NoError(t, err)
+	require.True(t, verified, "receipt bytes must verify through the invocation path")
+
+	// Ran/Out are carried in the invocation's args, value intact.
+	var args rdm.ArgsModel
+	require.NoError(t, args.UnmarshalCBOR(bytes.NewReader(inv.ArgumentsBytes())))
+	require.Equal(t, ran, args.Ran)
+	require.NotNil(t, args.Out.Ok)
+	var gotOut cbg.CborInt
+	require.NoError(t, gotOut.UnmarshalCBOR(bytes.NewReader(args.Out.Ok.Bytes())))
+	require.Equal(t, cbg.CborInt(42), gotOut)
+
+	// And the receipt view round-trips back from those same bytes.
+	redecoded, err := receipt.Decode(encoded)
+	require.NoError(t, err)
+	require.Equal(t, rcpt.Link(), redecoded.Link())
+	require.Equal(t, rcpt.Ran(), redecoded.Ran())
+}