@bongos/core 1.18.0 → 1.18.18

package/modules/platform-identity/routes/my-projects.js

@@ -0,0 +1,140 @@
+// modules/platform-identity/routes/my-projects.js — the signed-in builder's cross-
+// project "My Projects" view + self-service join / leave (ADR 0141 §3, task #1002112).
+//
+//   GET  /my-projects              — projects this account builds on, owned grouped apart
+//   POST /my-projects/join         — request to join a project (executed by the project)
+//   POST /my-projects/:clientId/leave — self-service offboard (reflected to the hub)
+//
+// All gated on a live HUB session (requireBuilder). Authority stays LOCAL: JOIN only
+// RELAYS an admission request to the target project (which enforces its own gate);
+// the hub never admits anyone on its own. Reaches core only via the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, requireBuilder, validateOrRespond, userAgent } = api;
+
+module.exports = function myProjectsRoutes() {
+  const router = express.Router();
+
+  // rank: any-builder — the caller's OWN cross-project memberships (own data).
+  router.get('/my-projects', requireBuilder, async (req, res) => {
+    try {
+      const rows = await pi.listMembershipsForAccount(req.builder.github_id, { pool });
+      const owned = [];
+      const building = [];
+      for (const m of rows) {
+        (m.role === 'owner' ? owned : building).push({
+          client_id: m.client_id,
+          name: m.project_name || m.project_origin || m.client_id,
+          origin: m.project_origin || null,
+          role: m.role,
+          joined_at: m.joined_at,
+          last_active: m.last_active,
+        });
+      }
+      res.json({ owned, building });
+    } catch (err) {
+      console.error('[platform-identity] GET /my-projects', err);
+      res.fail('my_projects_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — request to join a project. The hub RELAYS the request to the
+  // target project's own admission surface (it does NOT admit locally — authority
+  // stays local). SSRF guard: only relay to an origin that is a REGISTERED, active
+  // client — never an arbitrary builder-supplied URL.
+  router.post('/my-projects/join', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { origin: { required: true, type: 'string', maxLength: 512 } })) return;
+    try {
+      const client = await pi.getClientByOrigin(req.body.origin, { pool });
+      if (!client || client.status !== 'active' || !client.origin) {
+        return res.fail('unknown_project', 404);
+      }
+      // Relay an access request to the project's OWN (public) admission endpoint —
+      // the project decides (open-join, or request/invite per ADR 0112). We post to
+      // the registry-trusted origin, never the caller's raw input.
+      let relayed = false;
+      let alreadyMember = false;
+      try {
+        const r = await fetch(`${client.origin}/api/gds/access-requests`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+          body: JSON.stringify({ github_login: req.builder.github_login, note: 'via platform My Projects' }),
+        });
+        alreadyMember = r.status === 409;
+        relayed = r.ok || r.status === 200 || r.status === 201 || alreadyMember;
+      } catch (e) {
+        console.log('[platform-identity] join relay failed (non-fatal):', e.message);
+      }
+      if (!relayed) return res.fail('join_relay_failed', { status: 502, message: 'the project could not be reached to request access' });
+      res.json({
+        ok: true,
+        status: alreadyMember ? 'already_member' : 'requested',
+        project: { name: client.name, origin: client.origin },
+        message: alreadyMember
+          ? 'You already build on this project — sign in to it to see it here.'
+          : 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
+      });
+    } catch (err) {
+      console.error('[platform-identity] POST /my-projects/join', err);
+      res.fail('join_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — the caller's OWN pending invitations (ADR 0141 §5).
+  router.get('/my-projects/invites', requireBuilder, async (req, res) => {
+    try {
+      const invites = await pi.listPendingInvitesForAccount(req.builder.github_id, { pool });
+      res.json({ invites: invites.map((i) => ({ client_id: i.client_id, name: i.project_name || i.project_origin || i.client_id, origin: i.project_origin || null, invited_at: i.invited_at })) });
+    } catch (err) {
+      console.error('[platform-identity] GET /my-projects/invites', err);
+      res.fail('invites_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — accept an invite (pending → builder) for the caller's OWN account.
+  router.post('/my-projects/invites/:clientId/accept', requireBuilder, async (req, res) => {
+    const clientId = String(req.params.clientId || '');
+    if (!clientId) return res.fail('bad_client_id', 400);
+    try {
+      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: true }, { pool });
+      if (!out.resolved) return res.fail('no_pending_invite', 404);
+      res.json({ ok: true, accepted: true });
+    } catch (err) {
+      console.error('[platform-identity] accept invite', err);
+      res.fail('accept_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — decline an invite (delete the pending row) for the caller's OWN account.
+  router.post('/my-projects/invites/:clientId/decline', requireBuilder, async (req, res) => {
+    const clientId = String(req.params.clientId || '');
+    if (!clientId) return res.fail('bad_client_id', 400);
+    try {
+      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: false }, { pool });
+      if (!out.resolved) return res.fail('no_pending_invite', 404);
+      res.json({ ok: true, accepted: false });
+    } catch (err) {
+      console.error('[platform-identity] decline invite', err);
+      res.fail('decline_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — leave a project from the caller's OWN membership list.
+  router.post('/my-projects/:clientId/leave', requireBuilder, async (req, res) => {
+    const clientId = String(req.params.clientId || '');
+    if (!clientId) return res.fail('bad_client_id', 400);
+    try {
+      const removed = await pi.removeMembership(clientId, req.builder.github_id, { pool });
+      res.json({ ok: true, left: removed > 0 });
+    } catch (err) {
+      console.error('[platform-identity] POST /my-projects/:clientId/leave', err);
+      res.fail('leave_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/routes/projects.js

@@ -0,0 +1,107 @@
+// modules/platform-identity/routes/projects.js — the hub projects catalog + the
+// curated public Explore showcase (ADR 0141 §5, task #1002110).
+//
+//   GET   /projects/featured   — PUBLIC Explore listing (featured + active only)
+//   GET   /projects            — Archon: full curation list (+ featured flags)
+//   POST  /projects            — Archon: create / update a catalog entry
+//   PATCH /projects/:id/featured — Archon: the feature / unfeature control
+//
+// Reaches core only through the doorway (ADR 0083). Archon routes declared first so
+// route-rank-check's look-ahead never misclassifies the trailing public GET.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, requireBuilder, requireRank, validateOrRespond, parseId, corsPublicGet } = api;
+
+module.exports = function projectsRoutes() {
+  const router = express.Router();
+
+  // rank: archon — the full curation list (includes unfeatured + owner attribution).
+  router.get('/projects', requireBuilder, requireRank('archon'), async (_req, res) => {
+    try {
+      res.json({ projects: await pi.listAllProjects({ pool }) });
+    } catch (err) {
+      console.error('[platform-identity] GET /projects', err);
+      res.fail('projects_list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: archon — create / update a catalog entry (manual seed for hand-wired
+  // instances; federated projects auto-catalogue at registration).
+  router.post('/projects', requireBuilder, requireRank('archon'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      origin: { required: true, type: 'string', maxLength: 512 },
+      name: { required: true, type: 'string', maxLength: 200 },
+      tagline: { type: 'string', maxLength: 400 },
+      art_url: { type: 'string', maxLength: 2048 },
+    })) return;
+    try {
+      const project = await pi.upsertProject({
+        origin: req.body.origin,
+        name: req.body.name,
+        tagline: req.body.tagline,
+        artUrl: req.body.art_url,
+      }, { pool });
+      res.status(201).json({ project });
+    } catch (err) {
+      console.error('[platform-identity] POST /projects', err);
+      res.fail('project_upsert_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: archon — invite a builder into a project (ADR 0141 §5, task #1002115).
+  // Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites
+  // by github_login and requires the invitee to already have a platform account (they
+  // build on some project); inviting someone entirely new to the platform (GitHub-id
+  // resolution) is a follow-up.
+  router.post('/projects/invite', requireBuilder, requireRank('archon'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      github_login: { required: true, type: 'string', maxLength: 200 },
+    })) return;
+    try {
+      const client = await pi.getClient(req.body.client_id, { pool });
+      if (!client || client.status !== 'active') return res.fail('unknown_project', 404);
+      const account = await pi.getAccountByLogin(req.body.github_login, { pool });
+      if (!account) return res.fail('account_not_found', { status: 404, message: 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.' });
+      const out = await pi.inviteToProject({ clientId: req.body.client_id, githubId: account.github_id }, { pool });
+      res.status(out.invited ? 201 : 200).json(out);
+    } catch (err) {
+      console.error('[platform-identity] POST /projects/invite', err);
+      res.fail('invite_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate).
+  router.patch('/projects/:id/featured', requireBuilder, requireRank('archon'), async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_project_id', positiveInt: true });
+    if (id === null) return;
+    if (validateOrRespond(req, res, { featured: { required: true, type: 'boolean' } })) return;
+    try {
+      const project = await pi.setProjectFeatured(id, req.body.featured, { pool });
+      if (!project) return res.fail('project_not_found', 404);
+      res.json({ project });
+    } catch (err) {
+      console.error('[platform-identity] PATCH /projects/:id/featured', err);
+      res.fail('feature_toggle_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The PUBLIC Explore showcase — featured + active projects only, public projection.
+  // CORS-enabled cross-origin read (a status page / the apex fetches it pre-auth).
+  router.use('/projects/featured', corsPublicGet('/projects/featured'));
+  // rank: public — a curated public showcase; no auth by design.
+  router.get('/projects/featured', async (_req, res) => {
+    try {
+      res.json({ projects: await pi.listFeaturedProjects({ pool }) });
+    } catch (err) {
+      console.error('[platform-identity] GET /projects/featured', err);
+      res.fail('explore_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/routes/scouting.js

@@ -0,0 +1,35 @@
+// modules/platform-identity/routes/scouting.js — the INTERNAL, Archon-only
+// cross-project scouting view (ADR 0141 §4, task #1002114). Ranks builders across
+// ALL hosted projects from platform_identity_builder_project_activity. It is a
+// talent tool for the platform operator — NOT shown to builders, and NOT authority
+// (the rollup is descriptive; authority stays local, ADR 0141 / ADR 0016). Consent
+// for cross-project aggregation is handled by the platform T&C (out of scope here).
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, requireBuilder, requireRank, parsePagination } = api;
+
+module.exports = function scoutingRoutes() {
+  const router = express.Router();
+
+  // rank: archon — the internal talent directory across every project. The Archon
+  // gate here is the load-bearing protection ("NOT shown to builders"): a non-Archon
+  // is 403'd before any cross-builder data is read.
+  router.get('/scouting', requireBuilder, requireRank('archon'), async (req, res) => {
+    const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
+    try {
+      const builders = await pi.listScoutingRollup({ limit, pool });
+      res.json({ builders });
+    } catch (err) {
+      console.error('[platform-identity] GET /scouting', err);
+      res.fail('scouting_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};