@bongos/core 1.17.0

package/tests/provisioning_github_app_routes.mjs

@@ -0,0 +1,98 @@
+// tests/provisioning_github_app_routes.mjs
+//
+// Route-level test for the GitHub App Manifest onboarding endpoints (task 2080, ADR
+// 0133) — it MOUNTS the real provisioning router and drives it over an ephemeral HTTP
+// server, so the actual handler code (validation, state minting, the manifest JSON, the
+// public callback's HTML + single-use/expiry guard, and the parseId contract) is
+// exercised. DB-free: the provisioning data-access fns are stubbed on the cached module
+// object, so the real pool is never touched; pure builders stay real. No network.
+//
+// Run:  node tests/provisioning_github_app_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const ROOT = new URL('..', import.meta.url).pathname;
+
+// Stub the data-access fns BEFORE the route factory captures the module object.
+const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
+let stored = null;
+provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 7, slug: 'mercury', domain: 'mercury.example.com', target_ref: 'acme/mercury', status: 'requested' });
+provisioning.createOAuthManifest = async (_db, row) => { stored = row; return { id: 99, ...row }; };
+provisioning.recordEvent = async () => {};
+provisioning.getOAuthManifestByState = async (_db, state) => (state === 'GOODSTATE'
+  ? { id: 99, instance_id: 42, requested_by: 7, status: 'pending', expires_at: new Date(Date.now() + 600000).toISOString() }
+  : null);
+provisioning.attachManifestCode = async (_db, id, code) => ({ id, status: 'code_received', github_code: code });
+
+// A branding with a known publicOrigin so mothershipOrigin() resolves deterministically.
+const branding = require(`${ROOT}/src/branding.js`);
+const realBranding = branding.branding;
+branding.branding = () => ({ ...realBranding(), domains: { publicOrigin: 'https://cloudbongos.com' } });
+
+// Inject the signed-in owner (the real requireBuilder needs a session).
+const api = require(`${ROOT}/src/module-api.js`);
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require(`${ROOT}/modules/provisioning/routes/provisioning.js`);
+const app = express();
+app.use(express.json());
+// res.fail is mounted globally by the core error middleware in production; add a minimal
+// equivalent for this harness so the handlers' res.fail(...) calls work.
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+let passed = 0, failed = 0;
+function t(name, cond, extra = '') { if (cond) { passed++; console.log(`  PASS  ${name}`); } else { failed++; console.log(`  FAIL  ${name}  ${extra}`); } }
+
+console.log('POST /provisioning/instances/:id/github-app (mint the one-click link):');
+{
+  const res = await fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  const j = await res.json();
+  t('200 + a 256-bit one-time state', res.status === 200 && typeof j.state === 'string' && j.state.length >= 32, `status=${res.status}`);
+  t('post_url targets GitHub personal apps/new carrying the state', j.post_url === `https://github.com/settings/apps/new?state=${j.state}`, j.post_url);
+  t('manifest.redirect_url is the MOTHERSHIP callback', j.manifest && j.manifest.redirect_url === 'https://cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);
+  t('manifest.callback_urls are the INSTANCE sign-in (both prefixes)', j.manifest && j.manifest.callback_urls[0] === 'https://mercury.example.com/api/gds/auth/web/callback' && j.manifest.callback_urls[1] === 'https://mercury.example.com/api/bongos/auth/web/callback');
+  t('org_url derived from the target_ref owner (acme)', j.org_url === `https://github.com/organizations/acme/settings/apps/new?state=${j.state}`, j.org_url);
+  t('the attempt row was persisted with the minted state', !!(stored && stored.instanceId === 42 && stored.state === j.state && stored.requestedBy === 7));
+}
+
+console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect):');
+{
+  const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);
+  const html = await res.text();
+  t('good state → 200 text/html finishing-setup page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub App created/.test(html) && /no secret/i.test(html), `status=${res.status}`);
+  t('the page names the instance host', /mercury\.example\.com/.test(html));
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);
+  const html = await res.text();
+  t('unknown state → 400 expired page (no oracle, no crash)', res.status === 400 && /expired/i.test(html), `status=${res.status}`);
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/callback`);
+  t('missing code/state → 400', res.status === 400, `status=${res.status}`);
+}
+
+console.log('\nparseId contract (the (req,res) signature — a bad id is a clean 400, not a 500):');
+{
+  const res = await fetch(`${base}/provisioning/instances/not-a-number/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  t('non-numeric :id → 400 bad_id (never a 500)', res.status === 400, `status=${res.status}`);
+}
+
+server.close();
+console.log(`\nprovisioning github-app routes: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/public_mirror_export.mjs

@@ -0,0 +1,124 @@
+// tests/public_mirror_export.mjs
+//
+// GDS-V4 R72 (task 1211) — locks the PURE decision helpers of the delayed-export pipeline
+// (scripts/public-mirror-export.js, ADR 0098). The git/push I/O is exercised by a manual
+// dry run; these are the DB-free, network-free units the CI gate can run:
+//   • pickSnapshotCommit — the ~180-day age boundary (the "time-delayed" guarantee)
+//   • parseLsTree        — tree enumeration parsing
+//   • isBinary           — binary sniff (binaries are kept verbatim but still leak-scanned)
+//   • redactBlob         — text redacted + clean; binary kept + leak-scanned; secret trips
+//   • buildProvenance    — the lineage anchor R73 reads
+//
+// Uses a SYNTHETIC instance for fixtures so this published test carries no real literal.
+//
+// Run:  node tests/public_mirror_export.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const X = require('../scripts/public-mirror-export.js');
+const { pickSnapshotCommit, parseLsTree, isBinary, redactBlob, buildProvenance } = X;
+const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/gds/mirror-redact.js');
+
+const BRANDING = { domains: { publicOrigin: 'https://widgetco.com' }, repo: { owner: 'zoltan', name: 'widgetco' } };
+const rules = buildRedactionRules(BRANDING);
+const sensitiveLiterals = collectSensitiveLiterals(BRANDING);
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const DAY = 86400 * 1000;
+const NOW = 1_800_000_000_000; // fixed reference instant (no Date.now — deterministic)
+
+// ── pickSnapshotCommit: the 180-day boundary ─────────────────────────────────────────
+t('picks the NEWEST commit at least lagDays old', () => {
+  const commits = [
+    { sha: 'young', epoch: (NOW - 10 * DAY) / 1000 },
+    { sha: 'edge-just-over', epoch: (NOW - 181 * DAY) / 1000 },
+    { sha: 'older', epoch: (NOW - 400 * DAY) / 1000 },
+  ];
+  assert.equal(pickSnapshotCommit(commits, NOW, 180).sha, 'edge-just-over');
+});
+t('returns null when the whole history is younger than the lag', () => {
+  const commits = [
+    { sha: 'a', epoch: (NOW - 5 * DAY) / 1000 },
+    { sha: 'b', epoch: (NOW - 100 * DAY) / 1000 },
+  ];
+  assert.equal(pickSnapshotCommit(commits, NOW, 180), null);
+});
+t('boundary is inclusive at exactly lagDays', () => {
+  const commits = [{ sha: 'exact', epoch: (NOW - 180 * DAY) / 1000 }];
+  assert.equal(pickSnapshotCommit(commits, NOW, 180).sha, 'exact');
+});
+t('empty history → null', () => {
+  assert.equal(pickSnapshotCommit([], NOW, 180), null);
+});
+
+// ── parseLsTree ──────────────────────────────────────────────────────────────────────
+t('parseLsTree parses mode/type/sha/path incl. paths with spaces', () => {
+  const out = [
+    '100644 blob aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\tsrc/bongos/auth.js',
+    '100755 blob bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\tscripts/migrate.sh',
+    '100644 blob cccccccccccccccccccccccccccccccccccccccc\tdocs/a file with spaces.md',
+    '160000 commit dddddddddddddddddddddddddddddddddddddddd\tsome/submodule',
+  ].join('\n');
+  const entries = parseLsTree(out);
+  assert.equal(entries.length, 4);
+  assert.equal(entries[0].mode, '100644');
+  assert.equal(entries[1].mode, '100755');
+  assert.equal(entries[2].path, 'docs/a file with spaces.md');
+  assert.equal(entries[3].type, 'commit'); // submodule — caller filters to blobs
+});
+t('parseLsTree ignores blank lines', () => {
+  assert.equal(parseLsTree('\n\n').length, 0);
+});
+
+// ── isBinary ───────────────────────────────────────────────────────────────────────
+t('isBinary: NUL byte → binary; utf8 text → not', () => {
+  assert.equal(isBinary(Buffer.from('hello\x00world')), true);
+  assert.equal(isBinary(Buffer.from('plain text file\nwith lines')), false);
+  assert.equal(isBinary(Buffer.from('')), false);
+});
+
+// ── redactBlob ───────────────────────────────────────────────────────────────────────
+t('redactBlob redacts a text blob and reports zero leaks', () => {
+  const r = redactBlob({ buf: Buffer.from('serve https://widgetco.com to zoltan at 8.8.8.8'), rules, sensitiveLiterals, envSecrets: [] });
+  const text = r.buf.toString('utf8');
+  assert.ok(!/widgetco|zoltan|8\.8\.8\.8/i.test(text), text);
+  assert.deepEqual(r.leaks, []);
+  assert.equal(r.secret, false);
+});
+t('redactBlob keeps a binary blob verbatim but still leak-scans it', () => {
+  const bin = Buffer.concat([Buffer.from('PNG\x00'), Buffer.from('widgetco'), Buffer.from('\x00')]);
+  const r = redactBlob({ buf: bin, rules, sensitiveLiterals, envSecrets: [] });
+  assert.ok(r.buf.equals(bin), 'binary must be byte-identical (not corrupted by text redaction)');
+  assert.ok(r.leaks.length > 0, 'a literal embedded in a binary must still trip the gate');
+});
+t('redactBlob SCRUBS a secret shape from a text blob (handled, not leaked)', () => {
+  const r = redactBlob({ buf: Buffer.from('key AKIA' + 'ABCDEFGHIJKLMNOP here'), rules, sensitiveLiterals, envSecrets: [] });
+  assert.ok(!r.buf.toString('utf8').includes('AKIAABCDEFGHIJKLMNOP'), 'the secret must be scrubbed from the published text');
+  assert.equal(r.secret, false, 'a scrubbed text secret is handled, so it is not a residual leak');
+});
+t('redactBlob FAILS CLOSED on a secret inside a BINARY blob (cannot safely rewrite it)', () => {
+  const bin = Buffer.concat([Buffer.from('BIN\x00'), Buffer.from('AKIA' + 'ABCDEFGHIJKLMNOP')]);
+  const r = redactBlob({ buf: bin, rules, sensitiveLiterals, envSecrets: [] });
+  assert.ok(r.buf.equals(bin), 'binary kept verbatim');
+  assert.equal(r.secret, true, 'a secret in a binary must trip the gate (the export then publishes nothing)');
+});
+
+// ── buildProvenance ────────────────────────────────────────────────────────────────
+t('buildProvenance carries the lineage anchor fields', () => {
+  const p = buildProvenance({ sourceCommit: 'abc123', committedAtIso: '2026-01-01T00:00:00.000Z', lagDays: 180, fileCount: 297, nowIso: '2026-07-01T00:00:00.000Z' });
+  assert.equal(p.source_commit, 'abc123');
+  assert.equal(p.lag_days, 180);
+  assert.equal(p.exported_files, 297);
+  assert.equal(p.generator, 'scripts/public-mirror-export.js');
+  assert.ok(typeof p.source_committed_at === 'string' && typeof p.exported_at === 'string');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/public_task_resolver.mjs

@@ -0,0 +1,112 @@
+// tests/public_task_resolver.mjs
+//
+// #604 — the GET /api/gds/public/tasks/:id resolver exposes task metadata to
+// the OPEN INTERNET (no auth), so the privacy gate is load-bearing: a full
+// title/value_summary may be returned ONLY for already-public work
+// (status shipped|confirmed). In-flight tasks must withhold the title so an
+// unshipped — or security-sensitive — task name never leaks.
+//
+// Tests the pure projectPublicTask() projection (exported from the route).
+//
+// Run:  node tests/public_task_resolver.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { projectPublicTask, projectPublicIdea, projectPublicBlocker } = require('../src/bongos/routes/public.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const sensitive = {
+  id: '526',
+  title: 'SECRET: SQL injection in /api/gds/foo via unparameterized id',
+  value_summary: 'patched the hole',
+  status: 'backlog',
+  version_id: 'GDS-V3',
+  kind: 'bug',
+  priority: 1,
+  shipped_at: null,
+};
+
+t('shipped task exposes the title + summary', () => {
+  const p = projectPublicTask({ ...sensitive, status: 'shipped', shipped_at: '2026-06-01T00:00:00Z' });
+  assert.equal(p.public, true);
+  assert.equal(p.title, sensitive.title);
+  assert.equal(p.value_summary, 'patched the hole');
+  assert.equal(p.shipped_at, '2026-06-01T00:00:00Z');
+});
+
+t('confirmed task exposes the title (credits have landed; effectively done)', () => {
+  const p = projectPublicTask({ ...sensitive, status: 'confirmed' });
+  assert.equal(p.public, true);
+  assert.equal(p.title, sensitive.title);
+});
+
+for (const status of ['backlog', 'ready', 'active', 'completed']) {
+  t(`in-flight task (${status}) WITHHOLDS the title and summary`, () => {
+    const p = projectPublicTask({ ...sensitive, status });
+    assert.equal(p.public, false, 'public flag must be false');
+    assert.equal(p.title, undefined, 'title must not be present');
+    assert.equal(p.value_summary, undefined, 'value_summary must not be present');
+    assert.equal(p.shipped_at, undefined, 'shipped_at must not be present');
+    // Non-sensitive identifiers are still returned so the card can render.
+    assert.equal(p.status, status);
+    assert.equal(p.version_id, 'GDS-V3');
+    assert.equal(p.kind, 'bug');
+    assert.equal(p.priority, 1);
+  });
+}
+
+t('id is coerced to a number (bigint comes back as a string from pg)', () => {
+  const p = projectPublicTask({ ...sensitive, status: 'shipped', id: '604' });
+  assert.strictEqual(p.id, 604);
+});
+
+t('a shipped task with no value_summary returns null, not undefined', () => {
+  const p = projectPublicTask({ ...sensitive, status: 'shipped', value_summary: undefined });
+  assert.equal(p.public, true);
+  assert.strictEqual(p.value_summary, null);
+});
+
+// ---- #654: idea/blocker public projections NEVER carry a title/body ----
+// These resolve on the OPEN web (status dashboard #/idea/N, #/blocker/N), and an
+// idea/blocker title can name unshipped work or a live security gap — so unlike a
+// task there is NO "public" branch: the title/body are never exposed for any status.
+
+const ideaRow = {
+  id: '173', status: 'open', kind: 'feature',
+  title: 'SECRET unshipped feature name', body_md: 'internal detail', captured_by: 7,
+};
+t('projectPublicIdea returns ONLY id/status/kind — never title or body', () => {
+  const p = projectPublicIdea(ideaRow);
+  assert.deepEqual(p, { id: 173, status: 'open', kind: 'feature' });
+  assert.equal(p.title, undefined, 'idea title must never be exposed');
+  assert.equal(p.body_md, undefined, 'idea body must never be exposed');
+  assert.strictEqual(p.id, 173, 'id coerced to a number');
+});
+
+t('projectPublicIdea tolerates a null kind', () => {
+  assert.deepEqual(projectPublicIdea({ id: 9, status: 'discarded', kind: null }), { id: 9, status: 'discarded', kind: null });
+});
+
+const blockerRow = {
+  id: '5', status: 'resolved',
+  title: 'SECRET blocker name', body_md: 'internal', resolution_note: 'fixed', resolved_by: 3,
+};
+t('projectPublicBlocker returns ONLY id/status — never title/body/resolution_note', () => {
+  const p = projectPublicBlocker(blockerRow);
+  assert.deepEqual(p, { id: 5, status: 'resolved' });
+  assert.equal(p.title, undefined, 'blocker title must never be exposed');
+  assert.equal(p.body_md, undefined);
+  assert.equal(p.resolution_note, undefined);
+  assert.strictEqual(p.id, 5, 'id coerced to a number');
+});
+
+console.log(`\npublic_task_resolver: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);