add test

plans/2026-09-04-badge-binding-and-file-limits.md

@@ -589,13 +589,14 @@ In the down migration, member rows are deleted before `file_id` is `NOT NULL` ag
 - Only rows with a group link are matched by `getGroupViaPublicGroupId`.
 - Both claims are overwritten from the link data by `updateRelayGroupKeys`.
 
-**13. Tests** — `ChatTests/Profiles.hs`, `ChatTests/ChatRelays.hs`
+**13. Tests** — `ChatTests/Profiles.hs`, `ChatTests/ChatRelays.hs`, `ChatTests/Groups.hs`
 
 - Direct: the badge is shown after a request to an address with and without ratchet keys, after accepting, after joining a one-time link, after a retried join, and after a profile update.
 - A proof bound to another chat is ignored, and the stored badge is kept.
 - P2p group: the joiner's badge is shown at the host at the request and after `INFO`; an introduced member's badge is shown after the handshake, and not from the introduction; the badge is shown on both sides of an invitation via contact.
 - Invitation via contact: the invitee's badge is stored on the membership at the host, and a later member receives the introduction without it.
 - Channel: the owner's badge is shown at a subscriber and the subscriber's badge at the owner, forwarded by the relay (`testChannelMemberBadges`).
+- Channel: a relay invitation with an owner key that differs from the link data is failed by the relay, and the relay stays invited (`testChannelAddRelayOwnerKeyMismatch`).
 - Link data: the badge is shown from an invitation link under `PHLink`, an address, and an address that gets its first short link.
 
 `PHTest` is still sent by released clients and, through `sndPresHeader`, on a retry of a connection prepared before this change.

tests/ChatTests/Groups.hs

@@ -304,6 +304,7 @@ chatGroupTests = do
       it "should report relay results when one relay deleted its address" testChannelCreateDeletedRelay
       it "should deliver support scope messages via relay" testChannelSupportScope
       it "should add relay to existing channel" testChannelAddRelay
+      it "should not add relay when the invitation owner key differs from link data" testChannelAddRelayOwnerKeyMismatch
       it "should remove relay from channel" testChannelRemoveRelay
       it "should remove left relay from channel" testChannelRemoveLeftRelay
       describe "relay rejection" $ do
@@ -11188,6 +11189,26 @@ testChannelAddRelay ps =
             [bob, cath] *<# "#team> hello"
             [dan, eve] *<# "#team> hello [>>]"
 
+testChannelAddRelayOwnerKeyMismatch :: HasCallStack => TestParams -> IO ()
+testChannelAddRelayOwnerKeyMismatch ps =
+  withNewTestChat ps "alice" aliceProfile $ \alice ->
+    withNewTestChatOpts ps relayTestOpts "bob" bobProfile $ \bob ->
+      withNewTestChatOpts ps relayTestOpts "cath" cathProfile $ \cath -> do
+        _ <- prepareChannel1Relay "team" alice bob
+        cath ##> "/ad"
+        (cathSLink, _cLink) <- getContactLinks cath True
+        alice ##> ("/relays name=cath " <> cathSLink)
+        alice <## "ok"
+        (otherKey :: C.PublicKeyEd25519, _) <- atomically . C.generateKeyPair =<< C.newRandom
+        withCCTransaction alice $ \db ->
+          DB.execute db "UPDATE group_members SET member_pub_key = ? WHERE member_category = 'user'" (Only otherKey)
+        alice ##> "/_add relays #1 2"
+        alice <## "#team: group relays:"
+        alice <## "  - relay id 1: active"
+        alice <## "  - relay id 2: invited"
+        cath <## "exception: getLinkDataCreateRelayLink: owner key of invitation does not match link data"
+        queryRelayOwnStatus cath 1 `shouldReturn` Just "invited"
+
 testChannelAddRelayWithRoster :: HasCallStack => TestParams -> IO ()
 testChannelAddRelayWithRoster ps =
   withNewTestChat ps "alice" aliceProfile $ \alice ->