@bongos/core 1.19.101 → 1.19.103

package/tests/project_stats.mjs

@@ -0,0 +1,206 @@
+// tests/project_stats.mjs — the hub's cross-instance stats fetcher (task 1002771).
+//
+// The hub reads Builders + Runs from each project's OWN public API, because the
+// apex catalog does not know them and the membership tables would report zero for
+// every hand-wired project (task 1002760). The risk in that design is not the
+// happy path — it is the failure modes: a dead project must cost a dash, not the
+// page; a machine account must not be counted as a person; and "we could not ask"
+// must never be rendered as "the answer is none".
+//
+// Run:  node --test tests/project_stats.mjs
+//
+// Fixture origins are literal PUBLIC IPs on purpose: net.isIP() short-circuits
+// the SSRF guard's DNS lookup, so these exercise the fetch/cache/filter logic
+// without a resolver in the loop. The guard itself is tested separately below.
+
+import test, { beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const stats = require('../modules/platform-identity/project-stats.js');
+
+const realFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = realFetch; });
+beforeEach(() => { stats._reset(); });
+
+function json(body) {
+  return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(body) });
+}
+// route a fake instance: { leaderboard: [...], enabled: {...} }
+function stub(map) {
+  globalThis.fetch = (url) => {
+    const u = new URL(url);
+    const site = map[u.origin];
+    if (!site) return Promise.reject(new Error('unreachable'));
+    if (u.pathname.endsWith('/leaderboard')) {
+      return site.leaderboard ? json({ leaderboard: site.leaderboard }) : Promise.reject(new Error('down'));
+    }
+    if (u.pathname.endsWith('/modules')) {
+      return site.enabled ? json({ enabled: site.enabled }) : Promise.reject(new Error('down'));
+    }
+    return Promise.reject(new Error('404'));
+  };
+}
+
+test('system accounts are excluded — they are machines, not builders', async () => {
+  // measured live: raw leaderboards read 13/3/3 against real 11/1/1
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'ada' }, { github_login: 'grace' },
+        { github_login: 'bfg-system' }, { github_login: 'discord-bot-system' },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, 2, 'four rows, two of them machines');
+});
+
+test('a tag is a NON-core module — core modules carry no information', async () => {
+  // every instance runs the core set, so including it would print the same
+  // fifteen tags on every row
+  const core = [...stats.coreModules()];
+  assert.ok(core.includes('grading'), 'the core set is read from the repo, not hardcoded');
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [],
+      enabled: { grading: true, lifecycle: true, game: true, 'art-pipeline': true },
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline', 'game']);
+});
+
+test('a disabled module is not a tag', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [], enabled: { game: false, 'art-pipeline': true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline']);
+});
+
+test('an unreachable project yields nulls — never zero, never a throw', async () => {
+  // 0 would be the claim "nobody builds here". null is "we could not ask".
+  stub({});   // nothing resolves
+  const out = await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+  assert.equal(out['https://9.9.9.9'].tags, null);
+});
+
+test('one dead half does not discard the half that answered', async () => {
+  // a project whose leaderboard is down can still report its modules
+  stub({ 'https://8.8.8.8': { leaderboard: null, enabled: { game: true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, null, 'the dead half is unknown');
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['game'], 'the live half still answers');
+});
+
+test('a dead project does not take the healthy ones down with it', async () => {
+  stub({ 'https://1.1.1.1': { leaderboard: [{ github_login: 'a' }], enabled: {} } });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://9.9.9.9']);
+  assert.equal(out['https://1.1.1.1'].builders, 1);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+});
+
+test('results are cached — a warm origin is not re-fetched', async () => {
+  let calls = 0;
+  const site = { leaderboard: [{ github_login: 'a' }], enabled: {} };
+  stub({ 'https://8.8.8.8': site });
+  const counting = globalThis.fetch;
+  globalThis.fetch = (u) => { calls++; return counting(u); };
+
+  await stats.getProjectStats(['https://8.8.8.8']);
+  const first = calls;
+  assert.ok(first > 0, 'the cold call must actually fetch');
+  await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(calls, first, 'the second call must be served from cache');
+});
+
+test('a FAILURE is cached too, or one dead project pays its timeout on every request', async () => {
+  let calls = 0;
+  globalThis.fetch = () => { calls++; return Promise.reject(new Error('down')); };
+  await stats.getProjectStats(['https://9.9.9.9']);
+  const first = calls;
+  await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(calls, first, 'a known-dead origin must not be retried on the next page load');
+});
+
+test('concurrent requests for the same origin collapse into one fetch', async () => {
+  let calls = 0;
+  globalThis.fetch = (url) => {
+    calls++;
+    return new Promise((r) => setTimeout(() => r({
+      ok: true, status: 200, json: () => Promise.resolve({ leaderboard: [], enabled: {} }),
+    }), 10));
+  };
+  await Promise.all([
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+  ]);
+  assert.equal(calls, 2, 'two endpoints for one origin, not six for three callers');
+});
+
+test('a non-http origin is refused rather than fetched', async () => {
+  globalThis.fetch = () => { throw new Error('must not be called'); };
+  const out = await stats.getProjectStats(['file:///etc/passwd']);
+  assert.equal(out['file:///etc/passwd'].builders, null);
+});
+
+test('the cache TTL is the owner-chosen ten minutes', () => {
+  assert.equal(stats.TTL_MS, 10 * 60 * 1000);
+});
+
+/* ── SSRF guard (grader finding, task 1002771 round 2) ──────────────────────
+   This is the one place the server dials an address that came out of the
+   database, so it is the one place that must treat the address as hostile.
+   "The catalog is Archon-curated" covers the ORIGIN but not a REDIRECT TARGET —
+   following redirects hands the final address back to the remote server, which
+   is the SSRF primitive itself. ── */
+
+test('loopback, private, link-local and metadata addresses are refused', () => {
+  const blocked = {
+    '127.0.0.1': 'loopback',
+    '169.254.169.254': 'cloud metadata',      // the one that matters
+    '10.0.0.5': 'private',
+    '192.168.1.1': 'private',
+    '172.16.0.1': 'private',
+    '172.31.255.255': 'private (upper bound)',
+    '100.64.0.1': 'CGNAT',
+    '0.0.0.0': 'unspecified',
+    '::1': 'IPv6 loopback',
+    'fd00::1': 'IPv6 unique-local',
+    'fe80::1': 'IPv6 link-local',
+    '::ffff:127.0.0.1': 'IPv4-mapped loopback',
+  };
+  for (const [addr, why] of Object.entries(blocked)) {
+    assert.ok(stats.blockedReason(addr), `${addr} (${why}) must be refused`);
+  }
+});
+
+test('ordinary public addresses are allowed', () => {
+  for (const addr of ['8.8.8.8', '104.21.64.15', '172.15.0.1', '172.32.0.1', '2606:4700::1']) {
+    assert.equal(stats.blockedReason(addr), null, `${addr} is public and must be allowed`);
+  }
+});
+
+test('a literal private IP as the origin host is refused before any fetch', async () => {
+  globalThis.fetch = () => { throw new Error('fetch must not be reached'); };
+  const out = await stats.getProjectStats(['http://169.254.169.254']);
+  assert.equal(out['http://169.254.169.254'].builders, null);
+});
+
+test('redirects are refused, never followed', async () => {
+  // following would let a curated origin choose our final address
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /redirect:\s*'error'/, 'the remote must not choose where we end up');
+  assert.doesNotMatch(src, /redirect:\s*'follow'/);
+});
+
+test('an origin named __proto__ cannot retarget the result prototype', async () => {
+  globalThis.fetch = () => Promise.reject(new Error('down'));
+  const out = await stats.getProjectStats(['__proto__']);
+  assert.equal(Object.getPrototypeOf(out), null, 'the result map is null-prototype');
+  assert.equal(({}).builders, undefined, 'Object.prototype is untouched');
+});

package/tests/projects_hub.mjs

@@ -379,10 +379,14 @@ test('the row keeps its own Open link working underneath the card', () => {
 
 test('the table declares no column it has no source for', () => {
   const thead = (HUB.match(/<thead>([\s\S]*?)<\/thead>/) || [, ''])[1];
-  for (const dead of [/>Builders</, />Type</, />Tags</]) {
-    assert.doesNotMatch(thead, dead, `a permanently-empty column must not be advertised`);
-  }
-  assert.match(thead, />Project</, 'the name column is real');
+  // Type is still absent: the owner's call is that a project DECLARES its type
+  // at creation, so until that field exists the hub must not guess one.
+  assert.doesNotMatch(thead, />Type</, 'Type has no source until a project declares it');
+  // Builders and Runs came back in task 1002771 WITH a source behind them
+  assert.match(thead, />Builders</);
+  assert.match(thead, />Runs</);
+  assert.match(SCRIPT, /p\.builders/, 'the Builders cell must read real data');
+  assert.match(SCRIPT, /tagsHtml\(p\.tags\)/, 'the Runs cell must read real data');
 });
 
 test('header and body agree on the column count', () => {
@@ -395,9 +399,9 @@ test('header and body agree on the column count', () => {
 });
 
 test('no sort control is offered for a column that cannot sort', () => {
-  // `data-sort="builders"` was declared sortable while the comparator handled
-  // only 'name' — clicking it did nothing at all
-  assert.doesNotMatch(HUB, /data-sort="builders"/);
+  // `data-sort="builders"` was once declared sortable while the comparator
+  // handled only 'name' — clicking it did nothing at all. The column is back
+  // (task 1002771) and so is its comparator arm; this keeps the two in step.
   const sorts = [...HUB.matchAll(/data-sort="([^"]+)"/g)].map((m) => m[1]);
   const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
   for (const key of sorts) {
@@ -405,8 +409,47 @@ test('no sort control is offered for a column that cannot sort', () => {
   }
 });
 
-test('the CSS for the dropped columns went with them', () => {
-  for (const orphan of ['.colType', '.colTags', '.tbl .num', '.tbl .tags']) {
-    assert.ok(!COSMOS.includes(orphan), `${orphan} is dead once its column is gone`);
+test('Type left no styling behind, and the live columns kept theirs', () => {
+  assert.ok(!COSMOS.includes('.colType'), '.colType is dead — the column is gone');
+  for (const live of ['.tbl .num', '.tbl .tags', '.colTags']) {
+    assert.ok(COSMOS.includes(live), `${live} styles a column that now renders real data`);
   }
 });
+
+/* ── Real Builders + Runs (task 1002771) ────────────────────────────────────
+   The columns came back only once something could fill them: each project's
+   OWN public API. The distinction these pin is between "we could not ask"
+   (null → em dash) and "we asked, the answer is none" (0 / []). ── */
+
+test('unknown and zero are rendered as different things', () => {
+  // 0 builders is a real answer — "nobody has joined yet". null is not an
+  // answer at all. Collapsing them would restate the lie 1002764 removed.
+  assert.match(SCRIPT, /p\.builders == null \? '—'/,
+    'only null becomes a dash; 0 must render as 0');
+});
+
+test('a project that cannot be reached degrades to a dash, not to a wrong number', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'tagsHtml() must exist');
+  assert.match(fn, /Array\.isArray\(tags\)/, 'a non-array (null) must not be spread into the cell');
+  assert.match(fn, /return '—'/);
+});
+
+test('the tag list is capped, and the overflow is counted rather than hidden', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /TAG_CAP/, 'one heavily-moduled project must not blow the column open');
+  assert.match(fn, /\+' \+ \(tags\.length - TAG_CAP\)/, 'a silent truncation reads as "that is all of them"');
+});
+
+test('sorting by builders puts UNKNOWN last, never first', () => {
+  const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
+  assert.match(comparator, /x\.builders == null\) return 1/,
+    'null is not a low number — it must sink in both directions');
+  assert.match(comparator, /y\.builders == null\) return -1/);
+});
+
+test('the platform answers for itself by the same rule it applies to others', () => {
+  // the self row is synthesized, so the server-side enrichment never sees it
+  assert.match(SCRIPT, /function loadSelfStats/);
+  assert.match(SCRIPT, /-system\$/, 'machine accounts are excluded here too, or the platform inflates itself');
+});