@bongos/core 1.19.1017 → 1.19.1019

package/tests/offboarding_secret_scrub.mjs

@@ -0,0 +1,115 @@
+// tests/offboarding_secret_scrub.mjs — deactivateBuilder scrubs stored secrets
+// (task 1003338 / ADR 0332).
+//
+// DB-free, mirroring the withTx-stub pattern in tests/government_rank_sync.mjs:
+// kernel.withTx is stubbed to hand deactivateBuilder/reactivateBuilder a single
+// recording fake client BEFORE src/bongos/db.js is required (it destructures
+// withTx at load time). No government seam is registered, so
+// syncGovernanceRankRole's optional port resolves to nothing and no-ops —
+// out of scope for this file.
+//
+// Two secrets, two different guarantees under test:
+//   1. github_oauth_tokens (core-owned) — deleteGithubToken must be called
+//      INSIDE deactivateBuilder's transaction (a real DELETE, not an event).
+//   2. the module-owned Gemini BYOK key — core never touches those columns;
+//      it emits builder.secrets-scrub-needed and a listening module (not
+//      vendored in this checkout) clears its own store. Asserted here by
+//      registering a stub listener and checking the payload.
+// reactivateBuilder must do neither — restoring a stored secret on return is
+// exactly the behaviour ADR 0332 rules out.
+//
+// Run:  node --test tests/offboarding_secret_scrub.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const kernel = require(path.join(ROOT, 'src/bongos/db-kernel.js'));
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+
+// A minimal recording client: answers just enough of deactivateBuilder's /
+// reactivateBuilder's queries to run to completion, and records every call so
+// tests can assert on what was (or wasn't) issued.
+function exitTxClient({ builderId, rank, status, newRank, newStatus }) {
+  const calls = [];
+  return {
+    calls,
+    find: (re) => calls.find((c) => re.test(c.sql)),
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/FROM builders WHERE id = \$1 FOR UPDATE/.test(sql)) {
+        return { rows: [{ id: builderId, rank, status }] };
+      }
+      if (/FROM claims/.test(sql)) return { rows: [] };
+      if (/UPDATE builders/.test(sql)) {
+        return { rows: [{ id: builderId, rank: newRank, status: newStatus }] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+let txClient = null;
+kernel.withTx = async (fn) => fn(txClient);
+const coreDb = require(path.join(ROOT, 'src/bongos/db.js'));
+
+test('deactivateBuilder deletes the github_oauth_tokens row inside its transaction', async () => {
+  txClient = exitTxClient({
+    builderId: 9001, rank: 'metic', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 9001, reason: 'left the team', actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM github_oauth_tokens/);
+  assert.ok(del, 'deactivateBuilder must delete the stored GitHub token in-transaction');
+  assert.deepEqual(del.params, [9001]);
+
+  const sessionRevokeIdx = txClient.calls.findIndex((c) => /UPDATE builder_sessions SET revoked_at/.test(c.sql));
+  const tokenDeleteIdx = txClient.calls.findIndex((c) => /DELETE FROM github_oauth_tokens/.test(c.sql));
+  assert.ok(tokenDeleteIdx > sessionRevokeIdx, 'the token delete must be inside the same transaction, after the session revoke');
+});
+
+test('deactivateBuilder emits builder.secrets-scrub-needed with { builderId, actor }', async () => {
+  txClient = exitTxClient({
+    builderId: 9002, rank: 'metic', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  let received = null;
+  const off = seams.on('builder.secrets-scrub-needed', async (payload) => { received = payload; });
+  try {
+    await coreDb.deactivateBuilder({ builderId: 9002, reason: null, actorBuilderId: 5 });
+  } finally {
+    off();
+  }
+  assert.ok(received, 'the module teardown event must fire post-commit');
+  assert.equal(received.builderId, 9002);
+  assert.equal(received.actor, 'builder-exit:builder#5');
+});
+
+test('a listener-free instance (no module installed) still completes deactivation cleanly', async () => {
+  // No seams.on registered here — mirrors a vanilla instance with art-pipeline off.
+  txClient = exitTxClient({
+    builderId: 9003, rank: 'xenos', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  const result = await coreDb.deactivateBuilder({ builderId: 9003, reason: null, actorBuilderId: 3 });
+  assert.equal(result.builder.status, 'inactive');
+  assert.ok(txClient.find(/DELETE FROM github_oauth_tokens/), 'the core-owned delete still runs with no module listening');
+});
+
+test('reactivateBuilder does not delete the github token row or emit the scrub event', async () => {
+  txClient = exitTxClient({
+    builderId: 9004, rank: 'xenos', status: 'inactive', newRank: 'xenos', newStatus: 'active',
+  });
+  let scrubFired = false;
+  const off = seams.on('builder.secrets-scrub-needed', async () => { scrubFired = true; });
+  try {
+    await coreDb.reactivateBuilder({ builderId: 9004, actorBuilderId: 3 });
+  } finally {
+    off();
+  }
+  assert.ok(!txClient.find(/DELETE FROM github_oauth_tokens/), 'reactivation must not touch the token table');
+  assert.ok(!scrubFired, 'reactivation must not re-trigger the secrets scrub');
+});