@bongos/core 1.17.0

package/src/bongos/routes/public.js

@@ -0,0 +1,476 @@
+// Read-only public surface for status.amazonprimea.com. No auth.
+
+const express = require('express');
+const db = require('../db');
+const { pool } = require('../pool');
+// grading carved to modules/grading/ (BV1.R73 / ADR 0091 §4): read the rubric
+// metadata through the `grade` kernel PORT, never a direct grader import.
+// The lifecycle (tasks · claims · versions · ship) carved to modules/lifecycle/
+// (BV1.R86 / ADR 0093 §3): the version/ship feed + grade-trend reads resolve the
+// `lifecycle` kernel PORT (lc()), never a direct module import.
+const seams = require('../../module-seams');
+const lc = () => seams.resolveOptional('lifecycle');
+// security (red-team reports + bounty) carved to modules/security/ (BV1.R79 /
+// ADR 0093 §1): read the bounty payout schedule through the `security` kernel
+// PORT, never a direct module import (the boundary rule — core never requires a
+// module). security-the-PROPERTY stays kernel (02-module-map §5).
+const { loadRepoInfo } = require('../repo-info');
+const { clientBranding, branding } = require('../../branding');
+const { clientModules } = require('../../modules');
+const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
+const { parseId, corsPublicGet, parsePagination, pageMeta } = require('./_helpers');
+
+// Pure projection for the single-task resolver. Exported for unit tests.
+// Privacy gate: a full title/value_summary is exposed ONLY for already-public
+// work (status shipped|confirmed — the same surface as /public/recent-shipped).
+// In-flight tasks (backlog/ready/active/completed) return status + version with
+// the title WITHHELD, so unshipped or security-sensitive task names never leak
+// to the open web. `kind`/`priority` are non-sensitive and always returned.
+function projectPublicTask(task) {
+  const titleIsPublic = task.status === 'shipped' || task.status === 'confirmed';
+  const payload = {
+    id: Number(task.id),
+    status: task.status,
+    version_id: task.version_id,
+    kind: task.kind,
+    priority: task.priority,
+    public: titleIsPublic,
+  };
+  if (titleIsPublic) {
+    payload.title = task.title;
+    payload.value_summary = task.value_summary ?? null;
+    payload.shipped_at = task.shipped_at ?? null;
+  }
+  return payload;
+}
+
+// Pure minimal projections for the PUBLIC idea/blocker resolvers (#654). The open
+// web gets ONLY id + status + type — NEVER the title or body, which are internal
+// (an idea/blocker title can name unshipped work or a live security gap). The
+// hall's AUTHENTICATED /inbox/:id + /blockers/:id are where a signed-in builder
+// sees full detail; this is the unauthenticated, leak-proof counterpart. Exported
+// for unit tests. Unlike projectPublicTask there is NO "public" branch — an
+// idea/blocker title is never exposed on this surface, for any status.
+// Pure: map a `?days=` query value to the (days, limit) pair for
+// /public/recent-shipped. Exported for unit tests (#1033).
+//   numeric N>0     → { days:N,    limit:200 }  explicit window: every row in range
+//   'all'           → { days:null, limit:200 }  explicit all-time: every row, bounded
+//   missing/garbage → { days:null, limit:30  }  historical 30-row "recent" feed
+// The bug (#1033): 'all' shared the null-days path with the no-query default, so
+// it inherited the 30-row cap — making "All time" show FEWER rows than "Last 90
+// days". isAll now lifts the limit independently of `days`.
+function recentShippedWindow(rawDays) {
+  const raw = (rawDays || '').toString().trim().toLowerCase();
+  const isAll = raw === 'all';
+  let days = null;
+  if (raw && !isAll) {
+    const parsed = parseInt(raw, 10);
+    if (Number.isFinite(parsed) && parsed > 0) days = parsed;
+  }
+  const limit = (days || isAll) ? 200 : 30;
+  return { raw, days, limit };
+}
+
+function projectPublicIdea(idea) {
+  return { id: Number(idea.id), status: idea.status, kind: idea.kind ?? null };
+}
+function projectPublicBlocker(blocker) {
+  // Blockers have no non-sensitive "type" column (title/body/resolution_note are
+  // all internal) — so id + status is the whole public projection.
+  return { id: Number(blocker.id), status: blocker.status };
+}
+
+module.exports = function buildPublicRouter() {
+  const router = express.Router();
+
+  // CORS for the public surface (ADR 0029 / #566): the off-box status page reads
+  // these cross-origin. Read-only, no-auth, no-secret routes, so a static '*' is
+  // safe; scoped to '/public' so it can't leak onto the authenticated routes on
+  // the same /api/gds base. No Vary:Origin — the ACAO never varies by origin.
+  // Shared middleware: corsPublicGet (_helpers.js) — byte-identical to analytics.js.
+  router.use('/public', corsPublicGet('/public'));
+
+  // Per-IP read rate limit on the public surface (red-team #604 / task 1035).
+  // The global limiter (routes.js) bypasses reads by design, leaving these ~13
+  // unauthenticated GETs uncapped; /public/uptime + /public/repo-health run
+  // multi-row 90-day aggregates per uncached call, so the surface is a DoS /
+  // cost-amplification target. Mounted AFTER the CORS block on purpose: OPTIONS
+  // preflights are answered above and never metered, and the ACAO header is
+  // already set on res, so a 429 stays readable by the cross-origin dashboard.
+  router.use('/public', publicReadRateLimitMiddleware);
+
+  // rank: public — GitHub URL bases for the deployed checkout (V3.R13-followup-2
+  // #411). Derived from `git remote get-url origin` at server boot, cached. Used
+  // by /builders/primer to rewrite repo-relative markdown links to GitHub
+  // blob/tree URLs without hardcoding the repo identity in implementation code
+  // (V3.R12 #236 rule). When ownership transfers, the deploy's git remote
+  // changes and the served links follow with no code edits.
+  router.get('/public/repo-info', (_req, res) => {
+    const info = loadRepoInfo();
+    if (info.error) {
+      return res.fail(info.error, 503, { detail: info.detail });
+    }
+    res.set('Cache-Control', 'public, max-age=3600');
+    res.json({
+      blob_base: info.blob_base,
+      tree_base: info.tree_base,
+      branch: info.branch,
+    });
+  });
+
+  // rank: public — the client-safe branding projection (R56 task 1195, ADR 0062
+  // §3). Lets the hall + the OFF-BOX status page (served from GitHub Pages, so it
+  // can only read branding cross-origin — it can't be server-injected) resolve
+  // instance strings from config instead of hard-coding them. R56 exposes the
+  // configurable currency label; R57 (task 1196) extends clientBranding() with
+  // identity + theme + copy. Long cache: the pack is committed config, not live
+  // state, and the resolver is a boot-time singleton.
+  router.get('/public/branding', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=3600');
+    res.json(clientBranding());
+  });
+
+  // rank: public — the client-safe feature-module set (R54 task 1193, ADR 0062
+  // §4). Lets the off-box status page (served from GitHub Pages, cross-origin)
+  // hide UI sections for disabled modules, the same way /public/branding feeds
+  // it instance strings. Module flags are booleans — nothing secret. Long cache:
+  // committed config, resolved as a boot-time singleton.
+  router.get('/public/modules', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=3600');
+    res.json(clientModules());
+  });
+
+  // rank: public — read-only surface for status.amazonprimea.com.
+  router.get('/public/versions', async (req, res) => {
+    // R14 (#2001 / ADR 0119): adopt the shared pagination contract (was unbounded).
+    // Small list → fetch + slice; `page` is additive (readers of .versions unchanged).
+    const { limit, offset } = parsePagination(req);
+    const all = await lc().listVersions();
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({ versions: all.slice(offset, offset + limit), page: pageMeta(limit, offset, all.length) });
+  });
+
+  // rank: public — version progress aggregate.
+  router.get('/public/progress', async (_req, res) => {
+    const progress = await lc().versionProgress();
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({ progress });
+  });
+
+  // GDS #118: `daily` + `daily_credits` are guaranteed gap-free (one row
+  // per day from the earliest event through CURRENT_DATE, server timezone)
+  // so the treasury chart's cumulative line carries forward on idle days
+  // and always reaches today. The gap-fill is implemented inside
+  // db.costSummary() via generate_series + LEFT JOIN.
+  // System 1 / task 1345: the same payload now also carries additive
+  // by_source / by_tier / savings blocks (existing keys keep their shape) — a
+  // pure passthrough; the shaping + the savings-table guard live in costSummary().
+  // rank: public — treasury chart feed.
+  router.get('/public/cost-summary', async (req, res) => {
+    // costSummary carved to modules/economy/ (BV1.R77 / ADR 0093 §1-2): resolve
+    // the `reward` kernel port (economy is default-on).
+    // task 1466: optional treasury filters — ?source=&category=&days= scope the
+    // breakdown (see costSummary). `days` is a small trailing-window int
+    // (absent/'all'/invalid ⇒ no time filter); source/category flow into
+    // parameterized queries (no injection risk) and are length-bounded.
+    const q = req.query || {};
+    const filters = {};
+    if (typeof q.source === 'string' && q.source && q.source.length <= 64) filters.source = q.source;
+    if (typeof q.category === 'string' && q.category && q.category.length <= 64) filters.category = q.category;
+    const d = Number.parseInt(q.days, 10);
+    if (Number.isFinite(d) && d > 0) filters.days = Math.min(d, 3650);
+    const summary = await seams.resolveOptional('reward').costSummary(filters);
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(summary);
+  });
+
+  // GDS #191: `?days=7|30|90` restricts to that trailing window; `?days=all`
+  // or omitted with no query returns the historical 30-row "recent" feed. Any
+  // other value falls back to all-time (still capped by the row limit) so a
+  // malformed query never produces an empty list.
+  // rank: public — recent shipped tasks (windowed).
+  router.get('/public/recent-shipped', async (req, res) => {
+    const { raw, days, limit } = recentShippedWindow(req.query.days);
+    const tasks = await lc().recentShippedTasks(limit, { days });
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({ tasks, days: days, range: raw || 'recent' });
+  });
+
+  // PMS-V2 #188: each row now carries an `achievements` string[] (top 5
+  // unlocked IDs by sort_order) so the dashboard can render inline emoji
+  // rows without a follow-up API call. Single SQL query — no N+1.
+  // rank: public — leaderboard with achievements; dashboard render.
+  router.get('/public/leaderboard', async (req, res) => {
+    // task 1750: top 100 to match the authed /leaderboard ceiling.
+    // R14 (#2001 / ADR 0119): honor ?limit=&offset= via the shared helper; default
+    // 100 preserves the prior ceiling. `page` is additive (readers of .leaderboard
+    // unchanged). Mirrors the authed /leaderboard.
+    const { limit, offset } = parsePagination(req, { defaultLimit: 100, maxLimit: 200 });
+    const rows = await seams.resolveOptional('reward').getLeaderboardWithAchievements(offset + limit, 5);
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({ leaderboard: rows.slice(offset, offset + limit), page: pageMeta(limit, offset) });
+  });
+
+  // rank: public — est-vs-actual aggregate.
+  router.get('/public/estimation-drift', async (_req, res) => {
+    const drift = await lc().estimationDriftSummary();
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(drift);
+  });
+
+  // Uptime: current status + 90-day history bucketed by hour.
+  // Returns per-service: current_status, uptime_pct_90d, history (array of
+  // { hour: ISO string, up: n, total: n } for the last 90*24 hours).
+  // rank: public — uptime feed (90-day hourly history).
+  router.get('/public/uptime', async (_req, res) => {
+    try {
+      const services = ['game_server', 'api', 'database'];
+
+      // Latest check per service
+      const latestRows = await pool.query(`
+        SELECT DISTINCT ON (service)
+          service, status, latency_ms, checked_at
+        FROM uptime_checks
+        ORDER BY service, checked_at DESC
+      `);
+      const latest = {};
+      for (const r of latestRows.rows) latest[r.service] = r;
+
+      // 90-day uptime % per service
+      const pctRows = await pool.query(`
+        SELECT service,
+          ROUND(100.0 * SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) / COUNT(*), 2) AS uptime_pct
+        FROM uptime_checks
+        WHERE checked_at > now() - interval '90 days'
+        GROUP BY service
+      `);
+      const pct = {};
+      for (const r of pctRows.rows) pct[r.service] = Number(r.uptime_pct);
+
+      // Hourly buckets for the last 90 days (for the bar history UI)
+      const histRows = await pool.query(`
+        SELECT service,
+          date_trunc('hour', checked_at) AS hour,
+          SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) AS up,
+          COUNT(*) AS total
+        FROM uptime_checks
+        WHERE checked_at > now() - interval '90 days'
+        GROUP BY service, hour
+        ORDER BY service, hour
+      `);
+      const history = {};
+      for (const svc of services) history[svc] = [];
+      for (const r of histRows.rows) {
+        if (history[r.service]) {
+          history[r.service].push({
+            hour: r.hour,
+            up: Number(r.up),
+            total: Number(r.total),
+          });
+        }
+      }
+
+      const result = services.map((svc) => ({
+        service: svc,
+        current_status: latest[svc]?.status ?? 'unknown',
+        current_latency_ms: latest[svc]?.latency_ms ?? null,
+        last_checked_at: latest[svc]?.checked_at ?? null,
+        uptime_pct_90d: pct[svc] ?? null,
+        history: history[svc],
+      }));
+
+      res.set('Cache-Control', 'public, max-age=30');
+      res.json({ services: result });
+    } catch (err) {
+      console.error('[gds] GET /public/uptime', err);
+      res.fail('uptime_failed', 500);
+    }
+  });
+
+  // PMS-V2 #197: rolling 7d quality-grade tile + 30d trend for the dashboard.
+  // rank: public — rolling quality-grade tile + 30d trend.
+  router.get('/public/grades', async (req, res) => {
+    const rawDays = parseInt(req.query.days, 10);
+    const days = Number.isFinite(rawDays) && rawDays > 0 && rawDays <= 90 ? rawDays : 7;
+    const trendDays = days >= 30 ? days : 30;
+    const [rolling, trend] = await Promise.all([
+      lc().rollingAvgGrade(days),
+      lc().gradeTrendByDay(trendDays),
+    ]);
+    // Rubric meta via the `grade` kernel PORT (BV1.R73). resolveOptional → null
+    // when grading is disabled, so the tile still renders (threshold/version null)
+    // on a grading-less instance; on OTB grading is default-on → identical values.
+    const grading = seams.resolveOptional('grade');
+    const rubric = grading && grading.RUBRIC ? grading.RUBRIC : null;
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({
+      window_days: days,
+      rolling,
+      trend,
+      threshold: rubric ? rubric.threshold : null, // single source of truth — grader-rubric.json
+      grader_version: rubric ? rubric.version : null,
+    });
+  });
+
+  // V3.R91 #352: repo-health substrate. Latest daily snapshot from
+  // repo_health_snapshots (written by scripts/gds/repo-metrics.js) + a small
+  // trailing trend so the status page can draw LOC / dead-exports / stale-
+  // branch lines over time. Same auth-free + cached + JSON-shape contract as
+  // the other public surfaces above. `?days=N` (1..90, default 30) sizes the
+  // trend window.
+  // rank: public — repo-health substrate (LOC, dead exports, stale branches).
+  router.get('/public/repo-health', async (req, res) => {
+    try {
+      const rawDays = parseInt(req.query.days, 10);
+      const days = Number.isFinite(rawDays) && rawDays > 0 && rawDays <= 90 ? rawDays : 30;
+
+      const latestRows = await pool.query(`
+        SELECT snapshot_date, total_loc, loc_by_dir, largest_files,
+               dead_exports, dead_files, stale_branches, max_branch_age_days,
+               confirmed_unshipped, raw, created_at
+          FROM repo_health_snapshots
+         ORDER BY snapshot_date DESC
+         LIMIT 1
+      `);
+
+      // Trailing trend, oldest→newest so the dashboard can plot left→right.
+      // Only the fields the trend tile lines need (keeps the payload small).
+      const trendRows = await pool.query(
+        `SELECT snapshot_date, total_loc, dead_exports, stale_branches,
+                confirmed_unshipped
+           FROM repo_health_snapshots
+          WHERE snapshot_date > CURRENT_DATE - ($1::int)
+          ORDER BY snapshot_date ASC`,
+        [days]
+      );
+
+      res.set('Cache-Control', 'public, max-age=60');
+      res.json({
+        window_days: days,
+        latest: latestRows.rows[0] ?? null,
+        trend: trendRows.rows,
+      });
+    } catch (err) {
+      console.error('[gds] GET /public/repo-health', err);
+      res.fail('repo_health_failed', 500);
+    }
+  });
+
+  // V3.R65 #284: red-team bounty payout table by severity. Single source of
+  // truth is modules/security/security.js (defaults + env overrides), carved to
+  // the `security` kernel PORT (BV1.R79 / ADR 0093 §1); the /builders hall
+  // renders this under "Red-team rewards". Same port-resolve pattern as
+  // /public/cost-summary resolving the `reward` port. No auth — it's just the
+  // public reward schedule (security is default-on).
+  // rank: public — red-team bounty payout table (reward schedule).
+  router.get('/public/bounty-table', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json({
+      table: seams.resolveOptional('security').bountyTableDetailed(),
+      currency: branding().currency.label,
+    });
+  });
+
+  // Single-task resolver for "#NNN" deep links. Our docs reference GDS task IDs
+  // as bare "#NNN"; read on github.com those collide with GitHub's own PR/issue
+  // autolinker (a separate number space) and mis-link, so they are rewritten to
+  // status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve
+  // here. Privacy gate: a full title/summary is exposed ONLY for
+  // already-public work (status shipped|confirmed — same surface as
+  // /public/recent-shipped). In-flight tasks return status + version with the
+  // title WITHHELD, so unshipped or security-sensitive task names never leak to
+  // the open web. `kind`/`priority` are non-sensitive and always returned.
+  // rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).
+  router.get('/public/tasks/:id', async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const task = await lc().getTask(id);
+      if (!task) return res.fail('task_not_found', 404);
+      res.set('Cache-Control', 'public, max-age=60');
+      res.json({ task: projectPublicTask(task) });
+    } catch (err) {
+      console.error('[gds] GET /public/tasks/:id', err);
+      res.fail('task_resolve_failed', 500);
+    }
+  });
+
+  // Public idea resolver (#654) — the open-web counterpart to the hall's
+  // authenticated /inbox/:id. Minimal projection ONLY (id, status, kind): an
+  // idea's title/body is internal and may name unshipped work, so it is NEVER
+  // returned here. The status dashboard renders this as a minimal card + an
+  // "open in Builders' Hall" link (where a signed-in builder sees the full
+  // record). SELECT only the non-sensitive columns so the title never even
+  // leaves the DB. rank: public — id/status/type only.
+  router.get('/public/ideas/:id', async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_idea_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const { rows } = await pool.query('SELECT id, status, kind FROM idea_inbox WHERE id = $1', [id]);
+      if (!rows.length) return res.fail('idea_not_found', 404);
+      res.set('Cache-Control', 'public, max-age=60');
+      res.json({ idea: projectPublicIdea(rows[0]) });
+    } catch (err) {
+      console.error('[gds] GET /public/ideas/:id', err);
+      res.fail('idea_resolve_failed', 500);
+    }
+  });
+
+  // Public blocker resolver (#654) — same minimal-projection posture as the idea
+  // resolver. id + status ONLY (title/body/resolution_note are all internal).
+  // rank: public — id/status only.
+  router.get('/public/blockers/:id', async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_blocker_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const { rows } = await pool.query('SELECT id, status FROM blockers WHERE id = $1', [id]);
+      if (!rows.length) return res.fail('blocker_not_found', 404);
+      res.set('Cache-Control', 'public, max-age=60');
+      res.json({ blocker: projectPublicBlocker(rows[0]) });
+    } catch (err) {
+      console.error('[gds] GET /public/blockers/:id', err);
+      res.fail('blocker_resolve_failed', 500);
+    }
+  });
+
+  // The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and
+  // its CI gate consult to decide which bare "#NNN" are real references worth
+  // rewriting — and to WHICH resolver (#629: task vs idea vs blocker, since the
+  // hall resolves /#/task/N, /#/idea/N, /#/blocker/N). IDs only — no titles or
+  // bodies — so it exposes nothing beyond what a number already implies, and it
+  // needs no builder token (so CI can call it). Cached longer than the live
+  // feeds: the id sets grow slowly and a few minutes of staleness only delays
+  // linkifying a brand-new reference. `tasks` stays the first key for
+  // back-compat with the pre-#629 linkifier shape.
+  // rank: public — task/idea/blocker id allow-lists for the linkifier + CI gate.
+  router.get('/public/ref-ids', async (_req, res) => {
+    try {
+      const [tasks, ideas, blockers] = await Promise.all([
+        pool.query('SELECT id FROM tasks ORDER BY id'),
+        pool.query('SELECT id FROM idea_inbox ORDER BY id'),
+        pool.query('SELECT id FROM blockers ORDER BY id'),
+      ]);
+      res.set('Cache-Control', 'public, max-age=300');
+      res.json({
+        tasks: tasks.rows.map((r) => Number(r.id)),
+        ideas: ideas.rows.map((r) => Number(r.id)),
+        blockers: blockers.rows.map((r) => Number(r.id)),
+      });
+    } catch (err) {
+      console.error('[gds] GET /public/ref-ids', err);
+      res.fail('ref_ids_failed', 500);
+    }
+  });
+
+  return router;
+};
+
+// Exported for unit tests (tests/public_task_resolver.mjs).
+module.exports.projectPublicTask = projectPublicTask;
+// #1033: the recent-shipped window/limit decision — exported so the "All time"
+// (?days=all) vs numeric-window vs default-feed row caps are pinned.
+module.exports.recentShippedWindow = recentShippedWindow;
+// #654: minimal idea/blocker projections — exported so the test proves no title
+// or body is ever present on the public surface.
+module.exports.projectPublicIdea = projectPublicIdea;
+module.exports.projectPublicBlocker = projectPublicBlocker;