replit/timmy-tower
2
0
Fork 0
Code Issues 26 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

[Testkit] Nostr identity + trust engine coverage (T25–T36) #55

New Issue
Closed
opened 2026-03-21 00:43:20 +00:00 by replit · 1 comment
replit commented 2026-03-21 00:43:20 +00:00
Owner
Copy Link

What & Why

The Nostr identity and trust engine is a core economic primitive but has zero testkit coverage. Adding T25–T36 exercises the full identity lifecycle: token exchange, trust tiers, session and job decorating with pubkey, reputation decay.

Done looks like

  • T25 — GET /api/identity/challenge returns { challenge, expiresAt }
  • T26 — POST /api/identity/verify with invalid signature → 400
  • T27 — POST /api/identity/verify with valid signature → { token, pubkey, tier }
  • T28 — GET /api/identity/me with valid token → identity object with trust fields
  • T29 — GET /api/identity/me with expired/invalid token → 401
  • T30 — POST /api/jobs with valid Nostr token → job created with nostrPubkey set; verify in GET /api/jobs/:id
  • T31 — POST /api/jobs with invalid Nostr token → 401
  • T32 — POST /api/sessions with valid Nostr token → session created with nostrPubkey set
  • T33 — GET /api/sessions/:id with Nostr token → trust_tier field present in response
  • T34 — GET /api/identity/me after a successful job → jobs_completed incremented
  • T35 — Trust decay simulation (no real-time wait): POST /api/identity/me/decay in test mode → verify trust_score decremented
  • T36 — GET /api/identity/leaderboard → returns array sorted by trust score

Tasks

  1. Append T25–T36 to artifacts/api-server/src/routes/testkit.ts before Summary block
  2. For T35, add a POST /api/identity/me/decay test-only endpoint (disabled in production) that triggers one decay cycle for the identity in the request

Relevant files

  • artifacts/api-server/src/routes/testkit.ts
  • artifacts/api-server/src/routes/identity.ts
  • artifacts/api-server/src/lib/trust.ts
## What & Why The Nostr identity and trust engine is a core economic primitive but has zero testkit coverage. Adding T25–T36 exercises the full identity lifecycle: token exchange, trust tiers, session and job decorating with pubkey, reputation decay. ## Done looks like - **T25** — `GET /api/identity/challenge` returns `{ challenge, expiresAt }` - **T26** — `POST /api/identity/verify` with invalid signature → 400 - **T27** — `POST /api/identity/verify` with valid signature → `{ token, pubkey, tier }` - **T28** — `GET /api/identity/me` with valid token → identity object with trust fields - **T29** — `GET /api/identity/me` with expired/invalid token → 401 - **T30** — `POST /api/jobs` with valid Nostr token → job created with `nostrPubkey` set; verify in `GET /api/jobs/:id` - **T31** — `POST /api/jobs` with invalid Nostr token → 401 - **T32** — `POST /api/sessions` with valid Nostr token → session created with `nostrPubkey` set - **T33** — `GET /api/sessions/:id` with Nostr token → `trust_tier` field present in response - **T34** — `GET /api/identity/me` after a successful job → `jobs_completed` incremented - **T35** — Trust decay simulation (no real-time wait): `POST /api/identity/me/decay` in test mode → verify `trust_score` decremented - **T36** — `GET /api/identity/leaderboard` → returns array sorted by trust score ## Tasks 1. Append T25–T36 to `artifacts/api-server/src/routes/testkit.ts` before Summary block 2. For T35, add a `POST /api/identity/me/decay` test-only endpoint (disabled in production) that triggers one decay cycle for the identity in the request ## Relevant files - `artifacts/api-server/src/routes/testkit.ts` - `artifacts/api-server/src/routes/identity.ts` - `artifacts/api-server/src/lib/trust.ts`
replit added the nostrbackend labels 2026-03-21 00:43:20 +00:00
claude was assigned by Rockachopa 2026-03-22 23:37:14 +00:00
claude commented 2026-03-24 02:20:20 +00:00
Collaborator
Copy Link

PR created: http://143.198.27.163:3000/replit/timmy-tower/pulls/106

Changes:

  1. TrustService.decayOnce() (trust.ts) — test-only method that subtracts one DECAY_PER_DAY point immediately without the normal 30-day absence threshold.

  2. POST /api/identity/me/decay (identity.ts) — test-only endpoint (returns 404 in production). Authenticated with X-Nostr-Token, triggers one decay cycle and returns previousScore/newScore/newTier.

  3. GET /api/identity/leaderboard (identity.ts) — public endpoint returning top 20 identities sorted by trustScore desc with pubkey, trustScore, tier, interactionCount.

  4. T41–T45 (testkit.ts) — five new tests sharing a single inline node preamble (challenge→sign→verify→token):

    • T41: POST /jobs with Nostr token → nostrPubkey in response matches identity
    • T42: POST /sessions with Nostr token → nostrPubkey in response matches identity
    • T43: GET /identity/me → tier, score, interactionCount all present
    • T44: POST /identity/me/decay → newScore ≤ previousScore (graceful skip in prod)
    • T45: GET /identity/leaderboard → HTTP 200, array sorted by trust score

Note: T25–T36 already existed in the codebase (added by the gemini NIP-07 PR). The new tests are numbered T41–T45 to avoid conflicts with those existing tests.

PR created: http://143.198.27.163:3000/replit/timmy-tower/pulls/106 **Changes:** 1. **`TrustService.decayOnce()`** (trust.ts) — test-only method that subtracts one `DECAY_PER_DAY` point immediately without the normal 30-day absence threshold. 2. **`POST /api/identity/me/decay`** (identity.ts) — test-only endpoint (returns 404 in production). Authenticated with `X-Nostr-Token`, triggers one decay cycle and returns `previousScore`/`newScore`/`newTier`. 3. **`GET /api/identity/leaderboard`** (identity.ts) — public endpoint returning top 20 identities sorted by `trustScore` desc with `pubkey`, `trustScore`, `tier`, `interactionCount`. 4. **T41–T45** (testkit.ts) — five new tests sharing a single inline node preamble (challenge→sign→verify→token): - T41: POST /jobs with Nostr token → `nostrPubkey` in response matches identity - T42: POST /sessions with Nostr token → `nostrPubkey` in response matches identity - T43: GET /identity/me → `tier`, `score`, `interactionCount` all present - T44: POST /identity/me/decay → `newScore ≤ previousScore` (graceful skip in prod) - T45: GET /identity/leaderboard → HTTP 200, array sorted by trust score Note: T25–T36 already existed in the codebase (added by the gemini NIP-07 PR). The new tests are numbered T41–T45 to avoid conflicts with those existing tests.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
backend
frontend
lightning
mobile
mobile
nostr
workshop
No Label backend nostr
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claude gemini replit
No Assignees claude
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: replit/timmy-tower#55
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?