@bongos/core 1.19.1023 → 1.19.1025

package/tests/terms_grandfather_db.mjs

@@ -0,0 +1,144 @@
+// tests/terms_grandfather_db.mjs — task 1003360 (owner decision on blocker
+// 1000123; ADR 0217 D3, amending ADR 0213 D4). Real DB.
+//
+// Proves migration platform_identity_024 against real SQL: an account the hub
+// had already witnessed is published immediately after the migration, without
+// signing in again; its acceptance is queryably distinct from a real sign-in;
+// the grandfather runs once; and the owner's next hub sign-in replaces it.
+// tests/terms_acceptance.mjs pins the same rules DB-free (the statement shapes
+// and the executed conflict branch); only a transaction engine can run the
+// migration's DO block and its UPDATEs.
+//
+// It builds its own tables in a throwaway schema, so it cannot see or disturb a
+// shared database's rows, and the migration's one-shot guard (keyed on the
+// column existing) starts from a genuinely fresh table every run.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/terms_grandfather_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { accountActiveSql } = require('../modules/platform-identity/account-visibility.js');
+const { TERMS_VERSION } = require('../modules/platform-identity/terms-acceptance.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try {
+  client = await pool.connect();
+} catch (e) {
+  console.log(`terms_grandfather_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const SCHEMA = `t1003360_${process.pid}`;
+const LEGACY = 90336001, SIGNED = 90336002, PROV = 90336003, LATE = 90336004;
+const q = (sql, params) => client.query(sql, params);
+const row = async (id) => (await q(
+  'SELECT profile_state, terms_accepted_at, terms_version, terms_accepted_source FROM platform_identity_accounts WHERE github_id = $1', [id],
+)).rows[0];
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  await q(`CREATE SCHEMA ${SCHEMA}`);
+  await q(`SET search_path TO ${SCHEMA}`);
+  // The columns upsertAccount writes and reads: 001 the table, 007 consent, 008
+  // the handle, 009 display_name_source, 019 the acceptance pair.
+  for (const f of ['001_tables', '007_profile_consent', '008_handle', '009_profile_fields', '019_terms_acceptance']) {
+    await q(migrationSql(`platform_identity_${f}.sql`));
+  }
+
+  // The world 024 lands on: a legacy account the hub witnessed before the terms
+  // existed, one that accepted by a real sign-in since, and one never witnessed.
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, handle, profile_state, terms_accepted_at, terms_version)
+     VALUES ($1, 'legacy-b', 'legacy-b', 'active', NULL, NULL),
+            ($2, 'signed-b', 'signed-b', 'active', '2026-09-01T10:00:00Z', '2026-08-29'),
+            ($3, 'prov-b',   'prov-b',   'provisional', NULL, NULL)`,
+    [LEGACY, SIGNED, PROV],
+  );
+  const published = async () => (await q(
+    `SELECT github_id::text FROM platform_identity_accounts WHERE ${accountActiveSql()} ORDER BY github_id`,
+  )).rows.map((r) => Number(r.github_id));
+  ok((await published()).join() === String(SIGNED), 'before 024: the legacy account is dark (ADR 0213 D4, the state the owner chose against)');
+
+  await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
+
+  // Done-when 1: visible immediately, without signing in again.
+  ok((await published()).join() === [LEGACY, SIGNED].join(), 'after 024: the legacy account is published again, and nobody else newly is');
+
+  // Done-when 2: queryably distinct from a real sign-in.
+  const legacy = await row(LEGACY);
+  ok(legacy.terms_accepted_source === 'grandfathered', 'the legacy acceptance is marked grandfathered');
+  ok(legacy.terms_version === '2026-08-29' && legacy.terms_accepted_at !== null, 'and names the text and moment it was recorded under');
+  const signed = await row(SIGNED);
+  ok(signed.terms_accepted_source === 'signin', 'an acceptance a real sign-in wrote is marked signin');
+  ok(signed.terms_accepted_at.toISOString() === '2026-09-01T10:00:00.000Z', 'and its date is left exactly as the builder gave it');
+  const prov = await row(PROV);
+  ok(prov.profile_state === 'provisional' && prov.terms_accepted_at === null && prov.terms_accepted_source === null,
+    'a never-witnessed account is neither activated nor grandfathered — it was never public');
+  const counts = (await q(
+    `SELECT terms_accepted_source AS s, count(*)::int AS n FROM platform_identity_accounts
+      WHERE terms_accepted_source IS NOT NULL GROUP BY 1 ORDER BY 1`,
+  )).rows.map((r) => `${r.s}:${r.n}`).join();
+  ok(counts === 'grandfathered:1,signin:1', `an audit can count the two kinds apart (${counts})`);
+
+  // One-shot: an account that turns up legacy-shaped later is not grandfathered by a replay.
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, handle, profile_state) VALUES ($1, 'late-b', 'late-b', 'active')`,
+    [LATE],
+  );
+  await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
+  ok((await row(LATE)).terms_accepted_at === null, 'replaying 024 grandfathers nobody new — the grandfather was an event, not a rule');
+
+  // The owner's next hub sign-in replaces the grandfather with their own acceptance.
+  await pi.upsertAccount({ githubId: LEGACY, githubLogin: 'legacy-b', activate: true }, { pool: client });
+  const after = await row(LEGACY);
+  ok(after.terms_accepted_source === 'signin', 'the next sign-in replaces the grandfather with a signin');
+  ok(after.terms_accepted_at > legacy.terms_accepted_at && after.terms_version === TERMS_VERSION,
+    'dated when they signed in, under the text served then');
+  await pi.upsertAccount({ githubId: LEGACY, githubLogin: 'legacy-b', activate: true }, { pool: client });
+  ok((await row(LEGACY)).terms_accepted_at.getTime() === after.terms_accepted_at.getTime(), 'and a second sign-in does not restamp it');
+
+  await pi.upsertAccount({ githubId: SIGNED, githubLogin: 'signed-b', activate: true }, { pool: client });
+  ok((await row(SIGNED)).terms_accepted_at.toISOString() === '2026-09-01T10:00:00.000Z', 'an existing signin is never restamped either');
+
+  await pi.upsertAccount({ githubId: PROV, githubLogin: 'prov-b' }, { pool: client });
+  ok((await row(PROV)).terms_accepted_source === null, 'a non-activating upsert records no acceptance');
+
+  // The deploy window: 024 has committed but the old server wrote this sign-in,
+  // with no source. It is a real acceptance, so the next sign-in keeps its date.
+  await q(`UPDATE platform_identity_accounts SET terms_accepted_at = '2026-09-02T08:00:00Z', terms_version = '2026-08-29' WHERE github_id = $1`, [LATE]);
+  await pi.upsertAccount({ githubId: LATE, githubLogin: 'late-b', activate: true }, { pool: client });
+  const late = await row(LATE);
+  ok(late.terms_accepted_at.toISOString() === '2026-09-02T08:00:00.000Z' && late.terms_accepted_source === 'signin',
+    'an acceptance written without a source keeps its date and is marked signin');
+
+  // Last, and unparameterised: nothing after an erroring statement depends on how the session recovers.
+  await assert.rejects(
+    q(`UPDATE platform_identity_accounts SET terms_accepted_source = 'implied' WHERE github_id = ${LEGACY}`),
+    /check constraint/i,
+  );
+  ok(true, 'the source column refuses a third kind of acceptance');
+
+  console.log(`\nterms_grandfather_db.mjs: ${pass} passed`);
+} finally {
+  await q(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pool.end().catch(() => {});
+}