@bongos/core 1.17.0

package/tests/goal_membership_requests.mjs

@@ -0,0 +1,332 @@
+// tests/goal_membership_requests.mjs — private goals: the visibility flag + the
+// invite / join-request queue db layer (task 1951 / ADR 0112). DB-free: the
+// SQL-aware fake pool (the goal_member_roles.mjs precedent) pins each helper's
+// SQL contract + return shaping. The route authorization gates are task 1952's
+// tests; this file pins the query layer under them.
+//
+// Coverage:
+//   • setGoalVisibility — UPDATE goals SET visibility, param + return shape.
+//   • createMembershipRequest — INSERT params; the 23505 → PENDING_EXISTS map.
+//   • getMembershipRequest — SELECT by id; null on miss.
+//   • resolveMembershipRequest — the atomic WHERE status='pending' guard; null
+//     on a lost race (no double-add off a re-submitted resolve).
+//   • listInboxFor — the three buckets, and that joinRequests gates on
+//     owner (goals.created_by) OR manager (goal_members 'lead').
+//   • listPendingRequestsForGoal — pending both-kinds for one goal.
+//   • the migration is additive + private-safe (default 'public', partial unique).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const {
+  setGoalVisibility,
+  createMembershipRequest,
+  getMembershipRequest,
+  resolveMembershipRequest,
+  acceptMembershipRequestAndAddMember,
+  listInboxFor,
+  listPendingRequestsForGoal,
+} = require('../modules/lifecycle/db.js');
+// task 1952: the pure route gates for the invite/join-request flow (DB-free).
+const {
+  protectedScopeAdmissionBlock,
+  authorizeCreateJoinRequest,
+  authorizeInvitationResponse,
+  authorizeJoinRequestResponse,
+} = require('../modules/lifecycle/routes/goals.js');
+const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const norm = (sql) => String(sql).replace(/\s+/g, ' ').trim();
+const find = (queries, re) => queries.find((q) => re.test(norm(q.sql)));
+
+const REQUEST_ROW = { id: 10, goal_id: 1, builder_id: 2, kind: 'request', status: 'pending' };
+
+// =========================================================================
+// setGoalVisibility
+// =========================================================================
+
+await test('setGoalVisibility: writes visibility + returns the goal row', async () => {
+  const GOAL = { id: 7, visibility: 'private' };
+  const pool = fakePool((s) => (/UPDATE goals SET visibility = \$2/.test(s) ? { rows: [GOAL] } : null));
+  const g = await setGoalVisibility({ goalId: 7, visibility: 'private' }, { pool });
+  assert.deepEqual(g, GOAL);
+  const q = find(pool.queries, /UPDATE goals SET visibility/);
+  assert.deepEqual(q.params, [7, 'private']);
+});
+
+await test('setGoalVisibility: unknown goal → null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalVisibility({ goalId: 999, visibility: 'public' }, { pool }), null);
+});
+
+// =========================================================================
+// createMembershipRequest
+// =========================================================================
+
+await test('createMembershipRequest: inserts with (goal, builder, kind, createdBy, note)', async () => {
+  const pool = fakePool((s) => (/INSERT INTO goal_membership_requests/.test(s) ? { rows: [REQUEST_ROW] } : null));
+  const row = await createMembershipRequest(
+    { goalId: 1, builderId: 2, kind: 'request', createdBy: 2, note: 'let me in' }, { pool });
+  assert.deepEqual(row, REQUEST_ROW);
+  const q = find(pool.queries, /INSERT INTO goal_membership_requests/);
+  assert.deepEqual(q.params, [1, 2, 'request', 2, 'let me in']);
+});
+
+await test('createMembershipRequest: a duplicate pending row (23505) → typed PENDING_EXISTS', async () => {
+  const pool = fakePool(() => { const e = new Error('dup key'); e.code = '23505'; throw e; });
+  await assert.rejects(
+    () => createMembershipRequest({ goalId: 1, builderId: 2, kind: 'invite', createdBy: 9 }, { pool }),
+    (e) => e.code === 'PENDING_EXISTS');
+});
+
+await test('createMembershipRequest: a non-unique DB error propagates untouched', async () => {
+  const pool = fakePool(() => { const e = new Error('boom'); e.code = '55000'; throw e; });
+  await assert.rejects(
+    () => createMembershipRequest({ goalId: 1, builderId: 2, kind: 'invite' }, { pool }),
+    (e) => e.code === '55000');
+});
+
+// =========================================================================
+// getMembershipRequest / resolveMembershipRequest
+// =========================================================================
+
+await test('getMembershipRequest: returns the row, or null on miss', async () => {
+  const pool = fakePool((s) => (/FROM goal_membership_requests WHERE id = \$1/.test(s) ? { rows: [REQUEST_ROW] } : null));
+  assert.deepEqual(await getMembershipRequest(10, { pool }), REQUEST_ROW);
+  const empty = fakePool(() => ({ rows: [] }));
+  assert.equal(await getMembershipRequest(999, { pool: empty }), null);
+});
+
+await test('resolveMembershipRequest: guards on status=pending + returns the resolved row', async () => {
+  const pool = fakePool((s) => (/UPDATE goal_membership_requests/.test(s) ? { rows: [{ ...REQUEST_ROW, status: 'accepted' }] } : null));
+  const r = await resolveMembershipRequest({ id: 10, status: 'accepted', resolvedBy: 5 }, { pool });
+  assert.equal(r.status, 'accepted');
+  const q = find(pool.queries, /UPDATE goal_membership_requests/);
+  assert.ok(/WHERE id = \$1 AND status = 'pending'/.test(norm(q.sql)),
+    'resolve must be atomic on status=pending (no double-add off a re-submit)');
+  assert.deepEqual(q.params, [10, 'accepted', 5]);
+});
+
+await test('resolveMembershipRequest: a lost race (nothing pending) → null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await resolveMembershipRequest({ id: 10, status: 'rejected', resolvedBy: 5 }, { pool }), null);
+});
+
+// acceptMembershipRequestAndAddMember — the atomic accept/approve (review fix):
+// resolve + add member in ONE statement, so there's never an accepted request
+// without a membership.
+await test('acceptMembershipRequestAndAddMember: one atomic CTE; returns { request, member }', async () => {
+  const REQ = { ...REQUEST_ROW, status: 'accepted' };
+  const MEMBER = { goal_id: 1, builder_id: 2, role: 'member', joined_at: 'T2' };
+  const pool = fakePool((s) => (/WITH resolved AS/.test(s) ? { rows: [{ request: REQ, member: MEMBER }] } : null));
+  const out = await acceptMembershipRequestAndAddMember({ id: 10, resolvedBy: 5 }, { pool });
+  assert.deepEqual(out, { request: REQ, member: MEMBER });
+  const q = find(pool.queries, /WITH resolved AS/);
+  // The member INSERT feeds off the SAME resolving UPDATE — the atomicity guarantee.
+  assert.ok(/UPDATE goal_membership_requests[\s\S]*WHERE id = \$1 AND status = 'pending'/.test(norm(q.sql)));
+  assert.ok(/INSERT INTO goal_members[\s\S]*SELECT goal_id, builder_id, 'member' FROM resolved/.test(norm(q.sql)),
+    'the member add reads its goal/builder from the resolved request (one statement)');
+  assert.deepEqual(q.params, [10, 5]);
+});
+
+await test('acceptMembershipRequestAndAddMember: nothing pending (request null) → null, no member', async () => {
+  const pool = fakePool((s) => (/WITH resolved AS/.test(s) ? { rows: [{ request: null, member: null }] } : null));
+  assert.equal(await acceptMembershipRequestAndAddMember({ id: 10, resolvedBy: 5 }, { pool }), null);
+});
+
+// =========================================================================
+// listInboxFor — the home-page inbox, three buckets
+// =========================================================================
+
+await test('listInboxFor: shapes {invitations, joinRequests, myPendingRequests}', async () => {
+  const INVITE = { id: 1, goal_id: 3, kind: 'invite', goal_title: 'Payments' };
+  const JOINREQ = { id: 2, goal_id: 5, builder_id: 42, kind: 'request', goal_title: 'World' };
+  const MYREQ = { id: 3, goal_id: 8, goal_title: 'Art' };
+  const pool = fakePool((s) => {
+    if (/r\.kind = 'invite'/.test(s)) return { rows: [INVITE] };
+    if (/g\.created_by = \$1/.test(s)) return { rows: [JOINREQ] };   // the owner|manager bucket
+    if (/r\.kind = 'request'/.test(s)) return { rows: [MYREQ] };     // my own outgoing requests
+    return { rows: [] };
+  });
+  const inbox = await listInboxFor(95, { pool });
+  assert.deepEqual(inbox.invitations, [INVITE]);
+  assert.deepEqual(inbox.joinRequests, [JOINREQ]);
+  assert.deepEqual(inbox.myPendingRequests, [MYREQ]);
+});
+
+await test('listInboxFor: joinRequests gates on owner (created_by) OR manager (lead)', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await listInboxFor(95, { pool });
+  const jq = find(pool.queries, /r\.kind = 'request'.*g\.created_by = \$1.*role = 'lead'/);
+  assert.ok(jq, 'a join-request only reaches an owner or a manager of the goal');
+  // and it must not leak: the same $1 builder id feeds every bucket.
+  for (const q of pool.queries) assert.deepEqual(q.params, [95]);
+});
+
+// =========================================================================
+// listPendingRequestsForGoal — the goals-page manager view
+// =========================================================================
+
+await test('listPendingRequestsForGoal: pending both-kinds for one goal', async () => {
+  const ROWS = [{ id: 1, kind: 'invite' }, { id: 2, kind: 'request' }];
+  const pool = fakePool((s) => (/WHERE r\.goal_id = \$1 AND r\.status = 'pending'/.test(s) ? { rows: ROWS } : null));
+  const rows = await listPendingRequestsForGoal(5, { pool });
+  assert.deepEqual(rows, ROWS);
+  assert.deepEqual(find(pool.queries, /goal_membership_requests/).params, [5]);
+});
+
+// =========================================================================
+// The migration is additive + private-safe
+// =========================================================================
+
+await test('migration core_188: additive, defaults public, partial-unique pending', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_188_goal_visibility_and_membership_requests.sql'), 'utf8');
+  assert.ok(/ADD COLUMN IF NOT EXISTS visibility text NOT NULL DEFAULT 'public'/.test(sql),
+    'visibility defaults public so existing goals keep open-join');
+  assert.ok(/CHECK \(visibility IN \('public', 'private'\)\)/.test(sql));
+  assert.ok(/CREATE TABLE IF NOT EXISTS goal_membership_requests/.test(sql));
+  assert.ok(/CREATE UNIQUE INDEX IF NOT EXISTS uniq_goal_membership_requests_pending[\s\S]*WHERE status = 'pending'/.test(sql),
+    'at most one pending ask per (goal, builder)');
+  // Additive = no destructive DDL. `ON DELETE CASCADE` is a constraint clause, not
+  // a DELETE statement, so match the real destructive forms specifically.
+  assert.ok(!/\bDROP\s+(TABLE|COLUMN|INDEX)\b|\bDELETE\s+FROM\b|\bTRUNCATE\b/i.test(sql),
+    'migration is purely additive');
+});
+
+// =========================================================================
+// The pure route gates (task 1952) — DB-free, ordering included.
+// =========================================================================
+
+// protectedScopeAdmissionBlock — the single protected-scope admission rule.
+await test('protectedScopeAdmissionBlock: non-protected → null (proceed)', () => {
+  assert.equal(protectedScopeAdmissionBlock({ scopeProtected: false, actorRank: 'thetes', targetRank: 'thetes' }), null);
+});
+await test('protectedScopeAdmissionBlock: protected + non-Archon actor → 403 archon_required', () => {
+  const b = protectedScopeAdmissionBlock({ scopeProtected: true, actorRank: 'metic', targetRank: 'metic' });
+  assert.equal(b.status, 403);
+  assert.equal(b.body.error, 'archon_required_for_protected_scope');
+});
+await test('protectedScopeAdmissionBlock: protected + Archon + sub-Metic target → 403 metic_required', () => {
+  const b = protectedScopeAdmissionBlock({ scopeProtected: true, actorRank: 'archon', targetRank: 'thetes' });
+  assert.equal(b.status, 403);
+  assert.equal(b.body.error, 'metic_required_for_protected_scope');
+});
+await test('protectedScopeAdmissionBlock: protected + Archon + Metic target → null (proceed)', () => {
+  assert.equal(protectedScopeAdmissionBlock({ scopeProtected: true, actorRank: 'archon', targetRank: 'metic' }), null);
+});
+
+// authorizeCreateJoinRequest — a builder asks to join.
+await test('authorizeCreateJoinRequest: unknown goal → 404', () => {
+  const d = authorizeCreateJoinRequest({ goal: null, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'goal_not_found');
+});
+await test('authorizeCreateJoinRequest: closed goal → 409 goal_not_open', () => {
+  const d = authorizeCreateJoinRequest({ goal: { status: 'archived', visibility: 'private' }, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'goal_not_open');
+});
+await test('authorizeCreateJoinRequest: already a member → 409 already_a_member', () => {
+  const d = authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'private' }, isMember: true, scopeProtected: false });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'already_a_member');
+});
+await test('authorizeCreateJoinRequest: public + unprotected → 409 goal_is_open (just join)', () => {
+  const d = authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public' }, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'goal_is_open');
+});
+await test('authorizeCreateJoinRequest: private goal → ALLOW', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'private' }, isMember: false, scopeProtected: false }), { ok: true });
+});
+await test('authorizeCreateJoinRequest: public but PROTECTED scope → ALLOW (not open-join)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public' }, isMember: false, scopeProtected: true }), { ok: true });
+});
+
+// authorizeInvitationResponse — only the invitee resolves their own pending invite.
+const INVITE = { id: 9, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
+await test('authorizeInvitationResponse: unknown request → 404', () => {
+  const d = authorizeInvitationResponse({ request: null, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeInvitationResponse: request on a different goal → 404 (containment)', () => {
+  const d = authorizeInvitationResponse({ request: { ...INVITE, goal_id: '99' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404);
+});
+await test('authorizeInvitationResponse: row is a join-request, not an invite → 400', () => {
+  const d = authorizeInvitationResponse({ request: { ...INVITE, kind: 'request' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_an_invitation');
+});
+await test('authorizeInvitationResponse: already resolved → 409 not_pending', () => {
+  const d = authorizeInvitationResponse({ request: { ...INVITE, status: 'accepted' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending');
+});
+await test('authorizeInvitationResponse: someone else resolving my invite → 403 not_your_invitation', () => {
+  const d = authorizeInvitationResponse({ request: INVITE, goalId: 5, actorId: 7 });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_your_invitation');
+});
+await test('authorizeInvitationResponse: the invitee (string vs number id) → ALLOW', () => {
+  assert.deepEqual(authorizeInvitationResponse({ request: INVITE, goalId: '5', actorId: 2 }), { ok: true });
+});
+
+// authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
+const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
+const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };
+const mgr = (bid) => ({ goal_id: 5, builder_id: bid, role: 'lead' });
+await test('authorizeJoinRequestResponse: non-authority actor → 403 (before any request lookup — no leak)', () => {
+  const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 7, actorRank: 'metic', actorMembership: null, request: REQUEST, goalId: 5 });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+});
+await test('authorizeJoinRequestResponse: owner + unknown request → 404', () => {
+  const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 1, actorRank: 'metic', actorMembership: mgr(1), request: null, goalId: 5 });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeJoinRequestResponse: request on a different goal → 404 (containment)', () => {
+  const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 1, actorRank: 'metic', actorMembership: mgr(1), request: { ...REQUEST, goal_id: '77' }, goalId: 5 });
+  assert.equal(d.status, 404);
+});
+await test('authorizeJoinRequestResponse: row is an invitation, not a request → 400', () => {
+  const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 1, actorRank: 'metic', actorMembership: mgr(1), request: { ...REQUEST, kind: 'invite' }, goalId: 5 });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_a_join_request');
+});
+await test('authorizeJoinRequestResponse: already resolved → 409 not_pending', () => {
+  const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 1, actorRank: 'metic', actorMembership: mgr(1), request: { ...REQUEST, status: 'rejected' }, goalId: 5 });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending');
+});
+await test('authorizeJoinRequestResponse: a manager (lead) resolves → ALLOW', () => {
+  assert.deepEqual(authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 3, actorRank: 'thetes', actorMembership: mgr(3), request: REQUEST, goalId: 5 }), { ok: true });
+});
+await test('authorizeJoinRequestResponse: an Archon (non-member) resolves → ALLOW', () => {
+  assert.deepEqual(authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 42, actorRank: 'archon', actorMembership: null, request: REQUEST, goalId: 5 }), { ok: true });
+});
+
+// =========================================================================
+// route-rank pins (task 1952) — the walls are in-handler, so the routes stay
+// 'any-builder'; an accidental requireRank re-gate must be a red build.
+// =========================================================================
+
+await test('route-rank pins: the six new routes are pinned any-builder', () => {
+  const pins = MODULE_EXPECTED_RANKS.lifecycle;
+  for (const r of [
+    'GET /goals/inbox',
+    'PATCH /goals/:id/visibility',
+    'POST /goals/:id/requests',
+    'POST /goals/:id/requests/:reqId/respond',
+    'POST /goals/:id/invitations',
+    'POST /goals/:id/invitations/:reqId/respond',
+  ]) {
+    assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
+  }
+});
+
+summary();

package/tests/goal_routes.mjs

@@ -0,0 +1,203 @@
+// tests/goal_routes.mjs
+//
+// Unit tests for the no-DB pieces of the Goal-tier routes (ADR 0086 §3, BV1.R57):
+// routes/goals.js — the router BUILDS (imports auth/db/module-scope-map/_helpers
+// cleanly) and its request-validation contracts are pinned. The SQL + the rank/scope
+// behaviour are verified against a live Postgres (see the session log), the way the
+// other write paths are. We also cover the one new db helper that carries a deps.pool
+// seam (listCriteriaForGoal).
+//
+// The bounded-authoring GATE (authorizeGoalTaskCreate) and its ABUSE MATRIX — the
+// goal wall's threat model — moved to tests/goal_abuse_matrix.mjs (BV1.R61), the
+// single documented home. This file keeps the router-build smoke + the
+// request-validation schemas.
+//
+// Run:  node tests/goal_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const { validate, LIMITS } = require('../src/bongos/routes/_helpers.js');
+const buildGoalsRouter = require('../modules/lifecycle/routes/goals.js');
+const { listCriteriaForGoal } = require('../modules/lifecycle/db.js');
+const { TASK_FIELD_BOUNDS } = require('../modules/lifecycle/task-classifier.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+// The EXACT schemas declared in goals.js — keep in sync if the routes change.
+const POST_GOALS_SCHEMA = {
+  version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
+  title: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
+  description: { type: 'string', maxLength: LIMITS.DESCRIPTION },
+  scope_modules: { type: 'array', maxItems: 64, itemsType: 'string' },
+  succeeds_goal_id: { type: 'integer', min: 1 }, // BV1.R64 rescope carry-forward
+};
+// /members validates only `role` declaratively; builder_id is coerced in-handler
+// (accepts a number OR a numeric string — ids round-trip through JSON as strings).
+const POST_MEMBERS_SCHEMA = {
+  role: { type: 'string' },
+};
+// POST /goals/:id/scope (BV1.R64 ask-to-widen) — `add` is the module list; the
+// empty-array, unknown-key, and protected-module checks are in-handler.
+const POST_SCOPE_SCHEMA = {
+  add: { required: true, type: 'array', maxItems: 64, itemsType: 'string' },
+};
+// POST /goals/reorder (task 1760, Archon-only) — the emptiness + positive-int
+// checks on ordered_ids are in-handler (the validator has no minItems/array-min).
+const POST_REORDER_SCHEMA = {
+  version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
+  ordered_ids: { required: true, type: 'array', maxItems: 500, itemsType: 'integer' },
+};
+
+// ---- the router builds (smoke: imports resolve cleanly) ----
+await test('buildGoalsRouter is a factory that returns a router', () => {
+  assert.equal(typeof buildGoalsRouter, 'function');
+  assert.equal(typeof buildGoalsRouter(), 'function'); // express.Router() is a function
+});
+
+// ---- POST /goals schema ----
+await test('POST /goals: minimal (version_id + title) passes', () => {
+  assert.equal(validate({ version_id: 'BONGOS-V1', title: 'Goal hierarchy' }, POST_GOALS_SCHEMA), null);
+});
+
+await test('POST /goals: scope_modules array of strings passes', () => {
+  assert.equal(validate({ version_id: 'V1', title: 'x', scope_modules: ['gds-core', 'art-pipeline'] }, POST_GOALS_SCHEMA), null);
+});
+
+await test('POST /goals: missing title → validation_failed (missing)', () => {
+  const r = validate({ version_id: 'V1' }, POST_GOALS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'title' && d.reason === 'missing'));
+});
+
+await test('POST /goals: non-array scope_modules → wrong_type', () => {
+  const r = validate({ version_id: 'V1', title: 'x', scope_modules: 'gds-core' }, POST_GOALS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'scope_modules' && d.reason === 'wrong_type'));
+});
+
+await test('POST /goals: a non-string scope_modules item is rejected', () => {
+  const r = validate({ version_id: 'V1', title: 'x', scope_modules: ['ok', 42] }, POST_GOALS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'scope_modules[1]'));
+});
+
+// ---- POST /goals carry-forward (BV1.R64) ----
+await test('POST /goals: succeeds_goal_id integer passes (rescope carry-forward)', () => {
+  assert.equal(validate({ version_id: 'BONGOS-V2', title: 'g', succeeds_goal_id: 7 }, POST_GOALS_SCHEMA), null);
+});
+
+await test('POST /goals: non-integer succeeds_goal_id → wrong_type', () => {
+  const r = validate({ version_id: 'V2', title: 'g', succeeds_goal_id: 'seven' }, POST_GOALS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'succeeds_goal_id' && d.reason === 'wrong_type'));
+});
+
+// ---- POST /goals/:id/scope schema (BV1.R64 ask-to-widen) ----
+await test('POST /goals/:id/scope: add array of module strings passes', () => {
+  assert.equal(validate({ add: ['gds-core', 'art-pipeline'] }, POST_SCOPE_SCHEMA), null);
+});
+
+await test('POST /goals/:id/scope: missing add → validation_failed (missing)', () => {
+  const r = validate({}, POST_SCOPE_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'add' && d.reason === 'missing'));
+});
+
+await test('POST /goals/:id/scope: non-array add → wrong_type', () => {
+  const r = validate({ add: 'gds-core' }, POST_SCOPE_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'add' && d.reason === 'wrong_type'));
+});
+
+await test('POST /goals/:id/scope: a non-string add item is rejected', () => {
+  const r = validate({ add: ['ok', 7] }, POST_SCOPE_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'add[1]'));
+});
+
+// ---- POST /goals/:id/members schema ----
+// builder_id is coerced via Number() + Number.isInteger in-handler (a number or a
+// numeric string passes; a non-numeric string → 400 bad_builder_id), verified
+// live against Postgres. Here we pin the declarative half (role).
+await test('POST /members: role optional, valid when present', () => {
+  assert.equal(validate({}, POST_MEMBERS_SCHEMA), null);
+  assert.equal(validate({ role: 'lead' }, POST_MEMBERS_SCHEMA), null);
+});
+
+await test('POST /members: non-string role → wrong_type', () => {
+  const r = validate({ role: 42 }, POST_MEMBERS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'role' && d.reason === 'wrong_type'));
+});
+
+await test('builder_id coercion contract: Number() accepts int + numeric string, rejects junk', () => {
+  // mirrors the in-handler guard: Number.isInteger(Number(x)) && > 0
+  const ok = (x) => Number.isInteger(Number(x)) && Number(x) > 0;
+  assert.ok(ok(42) && ok('42'), 'number and numeric string accepted');
+  assert.ok(!ok('42 OR 1=1') && !ok('abc') && !ok(-1) && !ok(0), 'junk / non-positive rejected');
+});
+
+// ---- listCriteriaForGoal (db helper, deps.pool seam) ----
+await test('listCriteriaForGoal: SELECT by goal_id, ordered, returns rows', async () => {
+  const ROW = { id: 1, version_id: 'V1', criterion_id: 'c1', criterion_md: 'md', satisfied: false, sort_order: 6, goal_id: 3 };
+  const pool = fakePool((s) => (/FROM done_when_criteria WHERE goal_id = \$1/.test(s) ? { rows: [ROW] } : null));
+  const out = await listCriteriaForGoal(3, { pool });
+  assert.deepEqual(out, [ROW]);
+  const sel = find(pool.queries, /FROM done_when_criteria WHERE goal_id = \$1/);
+  assert.equal(sel.params[0], 3);
+  assert.match(sel.sql, /ORDER BY sort_order, id/);
+});
+
+// ---- POST /goals/:id/tasks — request-validation schema (the bounded-authoring
+// gate's DECISION logic + abuse matrix live in tests/goal_abuse_matrix.mjs) ----
+// The EXACT schema declared in goals.js's POST /goals/:id/tasks — keep in sync.
+const POST_GOAL_TASKS_SCHEMA = {
+  title: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
+  description: { type: 'string', maxLength: LIMITS.DESCRIPTION },
+  touches: { required: true, type: 'array', maxItems: 500, itemsType: 'string' },
+  est_minutes: { type: 'integer', min: 0, max: 100000 },
+  priority: { type: 'integer', min: TASK_FIELD_BOUNDS.priority.min, max: TASK_FIELD_BOUNDS.priority.max },
+  kind: { type: 'string', maxLength: 64 },
+  discipline: { type: 'string', maxLength: 64 },
+  value_summary: { type: 'string', maxLength: LIMITS.VALUE_SUMMARY },
+  parent_task_id: { type: 'integer', min: 1 },
+};
+
+await test('POST /goals/:id/tasks: minimal (title + touches) passes schema', () => {
+  assert.equal(validate({ title: 'wire the inbox', touches: ['modules/ideas/x.js'] }, POST_GOAL_TASKS_SCHEMA), null);
+});
+await test('POST /goals/:id/tasks: missing title → validation_failed (missing)', () => {
+  const r = validate({ touches: ['modules/ideas/x.js'] }, POST_GOAL_TASKS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'title' && d.reason === 'missing'));
+});
+await test('POST /goals/:id/tasks: missing touches → validation_failed (blast radius is required)', () => {
+  const r = validate({ title: 'x' }, POST_GOAL_TASKS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'touches' && d.reason === 'missing'));
+});
+await test('POST /goals/:id/tasks: non-array touches → wrong_type', () => {
+  const r = validate({ title: 'x', touches: 'src/bongos/db.js' }, POST_GOAL_TASKS_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'touches' && d.reason === 'wrong_type'));
+});
+
+// ---- POST /goals/reorder (task 1760) ----
+await test('POST /goals/reorder: version_id + ordered_ids of integers passes', () => {
+  const r = validate({ version_id: 'BONGOS-V1', ordered_ids: [9, 7, 8] }, POST_REORDER_SCHEMA);
+  assert.equal(r, null);
+});
+await test('POST /goals/reorder: missing version_id → validation_failed (missing)', () => {
+  const r = validate({ ordered_ids: [1] }, POST_REORDER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'version_id' && d.reason === 'missing'));
+});
+await test('POST /goals/reorder: missing ordered_ids → validation_failed (missing)', () => {
+  const r = validate({ version_id: 'BONGOS-V1' }, POST_REORDER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'ordered_ids' && d.reason === 'missing'));
+});
+await test('POST /goals/reorder: a non-integer ordered_ids item is rejected', () => {
+  const r = validate({ version_id: 'BONGOS-V1', ordered_ids: [9, 'seven'] }, POST_REORDER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'ordered_ids[1]' && d.reason === 'bad_item_type'));
+});
+
+summary();