update

crates/community/src/history.rs

@@ -4,8 +4,8 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex, MutexGuard};
 use std::time::{Duration, Instant};
 
-use anyhow::Result;
-use concord::cord01::KIND_WRAP_EPHEMERAL;
+use anyhow::{Result, bail};
+use concord::cord01::{KIND_WRAP_EPHEMERAL, OpenedStream};
 use concord::cord03::{self, ChatRumor};
 use concord::derive::channel_group_key;
 use concord::state::{ChannelCursor, HeldKey};
@@ -137,6 +137,8 @@ impl PageRegistry {
 pub struct WrapPage {
     pub opened: Vec<ChatRumor>,
     pub raw: usize,
+    /// Wraps that reached us under a held plane but that no held key could open.
+    pub unreadable: usize,
     pub newest_ms: Option<u64>,
     pub oldest_ms: Option<u64>,
     pub exhausted: bool,
@@ -210,15 +212,8 @@ pub async fn page(
                 continue;
             };
 
-            // A retired key reads only what was sealed before its rotation published.
-            if held
-                .retired_at
-                .is_some_and(|retired| wrap.created_at.as_secs() > retired)
-            {
-                continue;
-            }
-
-            let Ok((stream, rumor)) = cord03::open(&wrap, group, channel, held.epoch) else {
+            let Ok((stream, rumor)) = read_under(&wrap, held, group, channel) else {
+                walk.unreadable += 1;
                 continue;
             };
 
@@ -231,6 +226,23 @@ pub async fn page(
     Ok(walk.finish(opened))
 }
 
+/// Opens one wrap under a held key.
+fn read_under(
+    wrap: &Event,
+    held: &HeldKey,
+    group: &GroupKey,
+    channel: &ChannelId,
+) -> Result<(OpenedStream, ChatRumor)> {
+    if held
+        .retired_at
+        .is_some_and(|retired| wrap.created_at.as_secs() > retired)
+    {
+        bail!("sealed after the key that reads it was retired");
+    }
+
+    Ok(cord03::open(wrap, group, channel, held.epoch)?)
+}
+
 /// The one filter a page is asked for.
 fn wrap_filter(authors: &[PublicKey], window: Window, limit: usize) -> Filter {
     let mut filter = Filter::new()
@@ -369,6 +381,8 @@ struct Walk {
     oldest_ms: Option<u64>,
     raw: usize,
     errors: usize,
+    /// Wraps the caller could not read under any held key.
+    unreadable: usize,
     /// A short page ended the walk.
     bottom: bool,
 }
@@ -395,6 +409,7 @@ impl Walk {
             oldest_ms: None,
             raw: 0,
             errors: 0,
+            unreadable: 0,
             bottom: false,
         }
     }
@@ -458,6 +473,7 @@ impl Walk {
         WrapPage {
             opened,
             raw: self.raw,
+            unreadable: self.unreadable,
             newest_ms: self.newest_ms,
             oldest_ms: self.oldest_ms,
             exhausted: swept && self.raw > 0,
@@ -586,6 +602,48 @@ mod tests {
         assert_eq!(page.raw, 3);
     }
 
+    /// A wrap that reaches us and still will not open is history we cannot read,
+    /// not history that does not exist.
+    #[test]
+    fn a_wrap_no_held_key_can_open_reads_as_unreadable() {
+        let channel = ChannelId::from_bytes([0x9cu8; 32]);
+        let other = ChannelId::from_bytes([0x9du8; 32]);
+        let author = Keys::generate();
+        let group = channel_group_key(&SECRET, &channel, Epoch(0)).expect("derives");
+        let held = HeldKey {
+            epoch: Epoch(0),
+            key: SECRET,
+            retired_at: Some(1_000),
+        };
+
+        let wrap_at = |channel: &ChannelId, at_ms: u64| {
+            let rumor = build_message(
+                author.public_key(),
+                channel,
+                Epoch(0),
+                "sealed",
+                None,
+                at_ms,
+                None,
+            );
+            smol::block_on(seal_rumor(&rumor, &group, &author, false))
+                .expect("seals")
+                .0
+        };
+
+        // Sealed before the rotation superseded this key, so it still reads.
+        let before = wrap_at(&channel, 999_000);
+        assert!(read_under(&before, &held, &group, &channel).is_ok());
+
+        // Sealed after the cutoff the rotation set on that key.
+        let after = wrap_at(&channel, 1_001_000);
+        assert!(read_under(&after, &held, &group, &channel).is_err());
+
+        // Sealed to this plane but bound to another channel.
+        let misbound = wrap_at(&other, 999_000);
+        assert!(read_under(&misbound, &held, &group, &channel).is_err());
+    }
+
     #[test]
     fn an_empty_answer_never_seals_the_channel() {
         let database: BTreeSet<Event> = BTreeSet::new();