@bongos/core 1.17.0

package/modules/discord/discord-inbound.js

@@ -0,0 +1,147 @@
+'use strict';
+
+// Discord inbound → idea_inbox — Phase 3 F6, part 1 (ADR 0033 §5).
+//
+// The bot files a message posted in the designated #ideas channel into the GDS
+// idea_inbox via the SAME path the web/CLI use (inbox.captureIdea), attributed
+// to the linked builder when the author has linked their Discord (else captured
+// unattributed — captured_by NULL, which idea_inbox already allows). This is the
+// inbound surface that will RETIRE the Google Chat inbound machinery — but that
+// removal is a DELIBERATELY SEPARATE follow-up, gated on this path being
+// verified live (never delete the working inbound before the replacement works).
+//
+// TRUST BOUNDARY: filing an idea is the open-to-all path (POST /inbox is
+// any-authenticated-builder; an unlinked Discord user is strictly LESS privileged
+// — their idea is captured unattributed). The bot asserts only WHO posted; it
+// grants nothing. Every filing is audited with surface='discord_bot'. No rank is
+// involved, so there is nothing to escalate. (kind='criterion-proposal' — the
+// one rank-gated idea kind — is never produced here; the auto-classifier can't
+// emit it, and we don't pass it.)
+//
+// Requires (go-live): the Message Content PRIVILEGED intent (to read message
+// text) + DISCORD_IDEAS_CHANNEL_ID. Inert until both are set.
+
+// captureIdea is no longer a doorway export (retired at BV1.R78 / ADR 0093 §5).
+// We resolve the `ideas.capture` kernel PORT the ideas module registers — the
+// codebase's first module→module port (declared in this module's `consumes`).
+const api = require('../../src/module-api');
+const db = require('./db');
+const { auditDiscordBot } = require('./discord-audit');
+const auth = require('./auth');
+const attachments = require('./bug-attachments');
+const { createMessageAggregator } = require('./discord-message-buffer');
+const { LIMITS } = api;
+
+// Auto-pairing window for #ideas (task #979) — same default as #bugs. Env
+// DISCORD_IDEAS_PAIR_WINDOW_MS overrides.
+const DEFAULT_PAIR_WINDOW_MS = 45 * 1000;
+
+// Title for an idea that arrives as image(s) with no usable text.
+const IMAGE_ONLY_TITLE = 'Idea (image)';
+
+function pairWindowMs(env = process.env) {
+  const n = Number(env.DISCORD_IDEAS_PAIR_WINDOW_MS);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_PAIR_WINDOW_MS;
+}
+
+// PURE — turn a raw message into { title, bodyMd }, or null when there's nothing
+// to file (blank text AND no images). Title = first non-empty line (capped) or,
+// for an image-only message, a default; body = the full message text (capped,
+// possibly empty). Unit-tested.
+function deriveIdea(content, { hasImages = false } = {}) {
+  const trimmed = typeof content === 'string' ? content.trim() : '';
+  if (!trimmed && !hasImages) return null;
+  const cap = LIMITS.TITLE;
+  let title;
+  if (trimmed) {
+    const firstLine = (trimmed.split('\n').find((l) => l.trim()) || trimmed).trim();
+    title = firstLine.length > cap ? `${firstLine.slice(0, cap - 1)}…` : firstLine;
+  } else {
+    title = IMAGE_ONLY_TITLE;
+  }
+  const bodyMd = trimmed.length > LIMITS.DESCRIPTION ? trimmed.slice(0, LIMITS.DESCRIPTION) : trimmed;
+  return { title, bodyMd };
+}
+
+const realDeps = {
+  getBuilderByDiscordUserId: db.getBuilderByDiscordUserId,
+  // Lazy: resolve the `ideas.capture` port at CALL time, so the ideas module's
+  // registration (at its route-factory mount) need not precede this module's load.
+  captureIdea: (...a) => api.resolve('ideas.capture')(...a),
+  insertAuditLog: db.insertAuditLog,
+  persistImages: attachments.persistImages,
+};
+
+// File one inbound message as an idea. NEVER throws (the caller is a gateway
+// event handler). Returns a small status object for logging/tests.
+async function recordInboundIdea({ discordUserId, content, imageUrls = [], messageId }, deps = realDeps) {
+  if (!auth.isValidDiscordUserId(discordUserId)) {
+    return { outcome: 'ignored', reason: 'bad_discord_user_id' };
+  }
+  const hasImages = Array.isArray(imageUrls) && imageUrls.length > 0;
+  const derived = deriveIdea(content, { hasImages });
+  if (!derived) return { outcome: 'ignored', reason: 'empty' };
+
+  try {
+    const builder = await deps.getBuilderByDiscordUserId(discordUserId);
+
+    // Re-host any images on our server (durable — Discord CDN links expire, and
+    // an idea can sit in the inbox even longer than a bug before triage). We
+    // re-host for linked AND unlinked authors: the byte-level guards in
+    // bug-attachments.persistImages (host allowlist + content-type + magic-byte
+    // sniff + size/count caps) are the protection, not author identity. A
+    // persist failure must not lose the idea.
+    let stored = [];
+    if (hasImages) {
+      try {
+        stored = await deps.persistImages(imageUrls, { messageId });
+      } catch (e) {
+        console.error('[discord-bot] idea image persist failed (filing without images):', e.message);
+      }
+    }
+
+    // Provenance footer so triage knows where the idea came from. The author's
+    // raw Discord snowflake is NOT embedded (it's recorded in the Archon-only
+    // audit_log instead); only the builder login when linked. Then the durable
+    // attachment links.
+    const origin = builder
+      ? `\n\n— filed from Discord #ideas by ${builder.github_login}`
+      : '\n\n— filed from Discord #ideas (unlinked author)';
+    let bodyMd = `${derived.bodyMd}${origin}`;
+    if (stored.length > 0) {
+      const imgs = stored.map((s, i) => `![attachment ${i + 1}](${s.url})`).join('\n');
+      bodyMd += `\n\nAttachments (${stored.length}):\n${imgs}`;
+    }
+    bodyMd = bodyMd.slice(0, LIMITS.DESCRIPTION);
+
+    const idea = await deps.captureIdea({
+      title: derived.title,
+      bodyMd,
+      capturedBy: builder ? builder.id : null,
+      // kind left null → inbox.captureIdea auto-classifies. We never pass
+      // 'criterion-proposal' (the rank-gated kind) from this path.
+    });
+
+    await auditDiscordBot(deps, {
+      builderId: builder ? builder.id : null,
+      route: 'discord:inbound',
+      requestBodyRedacted: { discord_user_id: discordUserId, message_id: messageId, idea_id: idea.id, images: stored.length },
+      responseStatus: 201,
+      logLabel: 'inbound audit-log write failed',
+    });
+
+    return { outcome: 'filed', ideaId: idea.id, capturedBy: builder ? builder.id : null, images: stored.length };
+  } catch (err) {
+    console.error('[discord-bot] recordInboundIdea failed:', err.message);
+    return { outcome: 'error', error: err.message };
+  }
+}
+
+// Auto-pairing aggregator for #ideas — a thin wrapper over the shared per-author
+// burst aggregator (discord-message-buffer.js) that supplies the #ideas default
+// window. onFlush files the combined burst as ONE idea.
+function createIdeaAggregator({ onFlush, windowMs = pairWindowMs(), timers = global } = {}) {
+  return createMessageAggregator({ onFlush, windowMs, timers });
+}
+
+module.exports = { deriveIdea, recordInboundIdea, createIdeaAggregator, pairWindowMs, realDeps };

package/modules/discord/discord-message-buffer.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// Generic per-author message-burst aggregator — shared by the #bugs
+// (discord-bugs.js) and #ideas (discord-inbound.js) intakes (task #979,
+// extracted from the #936 bug aggregator).
+//
+// A bug or idea is often split across two quick messages — a screenshot and
+// then "here's what I mean", in either order. This buffers each author's
+// messages in a channel and, once they go quiet for `windowMs`, fires onFlush
+// ONCE with the combined burst (text joined, image URLs concatenated, anchored
+// on the first message's id).
+//
+// In-memory + best-effort by design: a bot restart drops any un-flushed buffer
+// (the author just re-posts) — the same trade-off ADR 0033 takes for the
+// reaction/inbound paths. Timers are injectable so tests run deterministically.
+
+// PURE — fold a burst of messages from one author into one record. Text parts
+// are joined (blank-line separated, in arrival order); image URLs are
+// concatenated; the record is keyed on the FIRST message's id (its anchor).
+function combineParts(parts) {
+  const texts = parts.map((p) => (typeof p.content === 'string' ? p.content.trim() : '')).filter(Boolean);
+  const imageUrls = parts.flatMap((p) => (Array.isArray(p.imageUrls) ? p.imageUrls : []));
+  return { content: texts.join('\n\n'), imageUrls, messageId: parts[0] ? parts[0].messageId : undefined };
+}
+
+function createMessageAggregator({ onFlush, windowMs, timers = global } = {}) {
+  const pending = new Map(); // authorId -> { parts:[], discordUserId, timer }
+
+  function flush(authorId) {
+    const e = pending.get(authorId);
+    if (!e) return;
+    pending.delete(authorId);
+    if (e.timer) timers.clearTimeout(e.timer);
+    const combined = combineParts(e.parts);
+    Promise.resolve()
+      .then(() => onFlush({ discordUserId: e.discordUserId, ...combined }))
+      .catch((err) => console.error('[discord-bot] message aggregator flush failed:', err.message));
+  }
+
+  function enqueue({ discordUserId, content, imageUrls = [], messageId }) {
+    let e = pending.get(discordUserId);
+    if (!e) { e = { parts: [], discordUserId, timer: null }; pending.set(discordUserId, e); }
+    e.parts.push({ content, imageUrls, messageId });
+    if (e.timer) timers.clearTimeout(e.timer);
+    e.timer = timers.setTimeout(() => flush(discordUserId), windowMs);
+    if (e.timer && e.timer.unref) e.timer.unref(); // don't keep the process alive
+  }
+
+  function flushAll() { for (const k of [...pending.keys()]) flush(k); }
+
+  return { enqueue, flush, flushAll, _pending: pending };
+}
+
+module.exports = { combineParts, createMessageAggregator };

package/modules/discord/discord-reaction.js

@@ -0,0 +1,186 @@
+'use strict';
+
+// Discord reaction → upvote/applause — Phase 3 F4 (ADR 0033 §3).
+//
+// A 👍 on a shipped item in #ship-feed becomes EITHER a real peer-vote OR a
+// cosmetic applause, decided entirely server-side. This module is the single
+// enforcement point.
+//
+// TRUST BOUNDARY (ADR 0016 / 0033 §1) — the one invariant to defend:
+//   "every bot-triggered write re-checks the LINKED builder's LIVE rank."
+// The Discord bot is a service principal trusted ONLY to assert "this Discord
+// user, who reacted, is linked builder X." It is NEVER trusted to decide what X
+// may do. We resolve X via the F1 link table (which reads rank FRESH from
+// builders), then branch on that live rank — the bot cannot escalate. The worst
+// a compromised bot could do is mis-report WHICH linked user reacted, yielding
+// at most one spurious Metic+ upvote, bounded by the anti-self guard, the 7-day
+// karma lag, and the audit_log (surface='discord_bot').
+//
+// WHY A FUNCTION, NOT AN HTTP ENDPOINT: F3 put the bot IN-PROCESS (same Node
+// server as the GDS). The in-process bot calls this function directly — no
+// localhost self-HTTP, no minted bot session token to store/leak. The F1
+// `requireDiscordBot` gate remains for any FUTURE external caller, but F4
+// doesn't need it. Calling the function directly is both simpler and strictly
+// less attack surface than exposing a network endpoint.
+//
+// BOTH MODES ARE DISJOINT BY CONSTRUCTION (ADR 0033 §3): a real peer-vote folds
+// into karma (rank-gated, via the existing peer_votes path); applause lands in
+// discord_applause and NEVER touches karma_log. Unranked enthusiasm cannot mint
+// reputation.
+
+const { pool } = require('../../src/module-api');
+const db = require('./db');
+const { auditDiscordBot } = require('./discord-audit');
+const auth = require('./auth');
+const api = require('../../src/module-api');
+// VOTABLE_TASK_STATUSES is the lifecycle module's votable-status set, resolved via
+// the `lifecycle` kernel PORT (the doorway leak retired at BV1.R86) — a vote only
+// lands on confirmed/shipped work. Resolved at call time (this file runs under the
+// discord bot poller, well after the lifecycle port registers at boot). A
+// #ship-feed message is always about a shipped task, but we re-check rather than
+// trust the channel.
+const votableStatuses = () => api.resolveOptional('lifecycle')?.VOTABLE_TASK_STATUSES || new Set();
+const VOTING_RANKS = new Set(['metic', 'archon']);
+
+// PURE — extract the GDS task id from a #ship-feed message. The producer
+// (ship.js) prefixes each feed line with the task ref, so we anchor to the
+// LEADING `#<digits>` token. Anchoring to the start (not anywhere) means a
+// summary that itself mentions another "#662" can't hijack the mapping. Returns
+// a positive integer, or null if the line carries no leading marker.
+function parseShipMarker(content) {
+  if (typeof content !== 'string') return null;
+  const m = /^\s*#(\d{1,12})\b/.exec(content);
+  if (!m) return null;
+  const id = Number(m[1]);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+// PURE — the vote-vs-applause decision. This is the heart of §3 and is unit-
+// tested exhaustively. A reaction earns a REAL peer-vote only when EVERY guard
+// the web/CLI vote path enforces is met against the linked builder's LIVE rank:
+//   - the Discord user is linked to a builder at all, AND
+//   - that builder's current rank is Metic or Archon (Xenos/players can't vote),
+//   - the task is votable (confirmed/shipped) and has a shipping builder, AND
+//   - the voter is NOT the author (no self-votes).
+// Anything else → cosmetic applause. (Identical authorization to
+// POST /tasks/:id/vote; intentionally no status/active check the web path lacks,
+// because a deactivated builder is already dropped to Xenos and fails the rank
+// gate — keeping the two paths byte-for-byte equivalent on authorization.)
+function classifyReaction({ builder, task }) {
+  if (!task || !votableStatuses().has(task.status)) return 'applause';
+  if (task.shipped_by == null) return 'applause';
+  if (!builder) return 'applause';                              // unlinked
+  if (!VOTING_RANKS.has(builder.rank)) return 'applause';       // player / Xenos
+  if (Number(task.shipped_by) === Number(builder.id)) return 'applause'; // self
+  return 'peer_vote';
+}
+
+// DB — cast/refresh a +1 peer-vote with the SAME tallied-freeze guard as the
+// web path (POST /tasks/:id/vote, src/bongos/routes/tasks.js). The conditional
+// ON CONFLICT … WHERE peer_votes.tallied_at IS NULL means a vote already folded
+// into karma is frozen: the update is filtered out and RETURNING is empty.
+// Reactions only ever cast +1 (a 👍); the bot never down-votes or clears here.
+async function castBotUpvote({ voterBuilderId, taskId }) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO peer_votes (voter_builder_id, target_task_id, vote)
+     VALUES ($1, $2, 1)
+     ON CONFLICT (voter_builder_id, target_task_id)
+       DO UPDATE SET vote = 1
+         WHERE peer_votes.tallied_at IS NULL
+     RETURNING id`,
+    [voterBuilderId, taskId]
+  );
+  // counted=false ⟺ the existing vote was already tallied (frozen) — left as-is.
+  return { counted: rowCount > 0 };
+}
+
+// DB — fetch the minimal task fields the decision needs, or null.
+async function getTask(taskId) {
+  const { rows } = await pool.query(
+    `SELECT id, status, shipped_by FROM tasks WHERE id = $1`,
+    [taskId]
+  );
+  return rows[0] || null;
+}
+
+// The real dependency set. Injected so recordDiscordReaction is unit-testable
+// against fakes with NO database (the pure decision is what matters; the DB
+// effects are thin wrappers over already-tested F1 helpers + the upsert above).
+const realDeps = {
+  getBuilderByDiscordUserId: db.getBuilderByDiscordUserId,
+  getTask,
+  castBotUpvote,
+  recordApplause: db.recordApplause,
+  insertAuditLog: db.insertAuditLog,
+};
+
+// Orchestrate one reaction. NEVER throws — the caller is a gateway event
+// handler that must not crash the bot; all failure is caught and returned as
+// { outcome: 'error' | 'ignored' }. Every successful write is audited with
+// surface='discord_bot' and the asserted Discord user id, so bot-originated
+// peer-votes are forensically distinguishable from direct web/CLI votes.
+async function recordDiscordReaction({ discordUserId, taskId }, deps = realDeps) {
+  // Validate the asserted identity + target BEFORE any DB work (F1 Hacker
+  // advisory): a malformed snowflake or bad task id never reaches the tables.
+  if (!auth.isValidDiscordUserId(discordUserId)) {
+    return { outcome: 'ignored', reason: 'bad_discord_user_id' };
+  }
+  if (!Number.isInteger(taskId) || taskId <= 0) {
+    return { outcome: 'ignored', reason: 'bad_task_id' };
+  }
+
+  try {
+    // Independent reads — run concurrently (one fewer Postgres round-trip per
+    // reaction; F4 efficiency finding).
+    const [builder, task] = await Promise.all([
+      deps.getBuilderByDiscordUserId(discordUserId),
+      deps.getTask(taskId),
+    ]);
+    if (!task) {
+      // No task to attach to — applause has a FK to tasks(id), so there is
+      // nothing to record. Ignore rather than error.
+      return { outcome: 'ignored', reason: 'task_not_found' };
+    }
+
+    const decision = classifyReaction({ builder, task });
+    let outcome;
+    if (decision === 'peer_vote') {
+      const { counted } = await deps.castBotUpvote({ voterBuilderId: builder.id, taskId });
+      // A frozen (already-tallied) vote is left untouched — still a peer-vote
+      // semantically, just a no-op write. Surface that distinctly for the log.
+      outcome = counted ? 'peer_vote' : 'peer_vote_frozen';
+    } else {
+      await deps.recordApplause({ targetTaskId: taskId, discordUserId });
+      outcome = 'applause';
+    }
+
+    // Audit every bot-triggered write (ADR 0033 §1). Best-effort: an audit
+    // failure must not undo the vote/applause, so it's caught separately.
+    await auditDiscordBot(deps, {
+      builderId: builder ? builder.id : null,
+      route: 'discord:reaction',
+      requestBodyRedacted: { discord_user_id: discordUserId, target_task_id: taskId, outcome },
+      responseStatus: 200,
+      logLabel: 'reaction audit-log write failed',
+    });
+
+    return { outcome, builderId: builder ? builder.id : null, taskId };
+  } catch (err) {
+    console.error('[discord-bot] recordDiscordReaction failed:', err.message);
+    return { outcome: 'error', error: err.message };
+  }
+}
+
+module.exports = {
+  // pure (unit-tested)
+  parseShipMarker,
+  classifyReaction,
+  // re-exposed via the lifecycle port (resolved live) for any consumer importing it here.
+  get VOTABLE_TASK_STATUSES() { return votableStatuses(); },
+  VOTING_RANKS,
+  // orchestration + DB
+  recordDiscordReaction,
+  castBotUpvote,
+  getTask,
+  realDeps,
+};