test: clone session at DropInStorage boundaries; clarify isTrustedIdentity TOFU

Author: jlucaso1

test/helpers/dropin_storage.ts

@@ -21,11 +21,15 @@ export class DropInStorage {
     this.ourIdentityKeyPair = identity ?? generateIdentityKeyPair();
     this.ourRegistrationId = regId ?? generateRegistrationId();
   }
+  // Clone on both boundaries so the in-memory map behaves like real on-disk
+  // (serialized) persistence: a caller can't mutate stored state without an
+  // explicit store, and a stored object can't be changed after the fact.
   async loadSession(address: string) {
-    return this.sessions.get(address); // the libsignal-node JSON object, as stored
+    const s = this.sessions.get(address); // the libsignal-node JSON object, as stored
+    return s === undefined ? undefined : structuredClone(s);
   }
   async storeSession(address: string, session: any) {
-    this.sessions.set(address, session);
+    this.sessions.set(address, structuredClone(session));
   }
   // intentionally no storeSessionRaw → drop-in (JSON) mode for sessions + sender keys
   async loadSenderKey(id: string) {
@@ -40,6 +44,9 @@ export class DropInStorage {
   async getOurRegistrationId() {
     return this.ourRegistrationId;
   }
+  // libsignal `SignalStorage` interface method (the bridge's SessionCipher calls
+  // it). TOFU: registers the identity on first sight (an intentional setup side
+  // effect), then verifies equality thereafter.
   async isTrustedIdentity(id: string, key: Uint8Array) {
     const e = this.identities.get(id);
     if (!e) {

test/helpers/libsignal_store.ts

@@ -34,6 +34,9 @@ export class LibsignalStore implements SignalStorage {
   getOurRegistrationId() {
     return this.ourRegistrationId;
   }
+  // libsignal `SignalStorage` interface method. TOFU: registers the identity on
+  // first sight (intentional — also used to pre-trust a peer in test setup), then
+  // verifies equality. Name is fixed by the interface, so it can't be renamed.
   isTrustedIdentity(id: string, key: Uint8Array) {
     const k = Buffer.from(key);
     const e = this.identities.get(id);