@bongos/core 1.19.1026 → 1.19.1028

package/tests/terms_acceptance.mjs

@@ -1,10 +1,12 @@
 // tests/terms_acceptance.mjs
 //
-// THE PLATFORM T&C ACCEPTANCE RECORD — "the hub's own sign-in is the only thing
-// that can say a human accepted the platform terms, it says so once, and nothing
-// publishes without it" (ADR 0213, task 1002913; the artifact ADR 0141 §4
-// deferred cross-project-aggregation consent to and ADR 0171 D3 reserved a place
-// for).
+// THE PLATFORM T&C ACCEPTANCE RECORD — "a sign-in the hub itself witnessed is the
+// only thing that can say a human accepted the platform terms, it says so once,
+// and nothing publishes without it" (ADR 0213, task 1002913; the artifact ADR
+// 0141 §4 deferred cross-project-aggregation consent to and ADR 0171 D3 reserved
+// a place for). That sign-in is GET /sso/authorize — a builder using their
+// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
+// nothing yet (blocker 1000124); task 1003361 adds it as a second capture point.
 //
 // WHY THIS EXISTS. An acceptance record is only worth the evidence behind it. If
 // a caller can assert one — a body field, a query param, a header — then the
@@ -111,24 +113,44 @@ t('the terms page states what crosses between projects', () => {
 t('the acceptance the page promises is the one the code actually keeps', () => {
   assert.match(termsHtml, /stores the date you accepted these terms/i,
     'the page must tell the reader an acceptance record is kept');
-  assert.match(termsHtml, /signing in again does not change the original date/i,
+  assert.match(termsHtml, /signing in again does not change the date you accepted/i,
     'and that it is written once — the property the COALESCE below actually provides');
 });
 
+// The capture point is GET /sso/authorize — reached when a builder uses their
+// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
+// nothing (blocker 1000124, task 1003353), so the page must not say "here".
+// Task 1003361 adds the hub's own sign-in as a second capture point; when it
+// lands, this wording and §3 below change together.
+t('the page names the sign-in the code actually watches — a project sign-in, not "here" (blocker 1000124)', () => {
+  const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
+  assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
+    'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
+  assert.match(section, /Once you have signed in to a project with your platform account and accepted these terms/,
+    'what makes a profile public must name the moment the code captures');
+  assert.match(section, /never signed in to a project that way stays provisional/,
+    'and the provisional case must be the same moment, negated');
+  assert.match(section, /written when you sign in to a project with your platform account, and only once/,
+    'the acceptance paragraph must name the same capture point');
+});
+
 t('the page says which acceptances were given on a builder’s behalf, and that the record marks them (task 1003360)', () => {
   assert.match(termsHtml, /accepted it on your behalf/i,
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
-  assert.doesNotMatch(stripApexOnly(termsHtml), /grandfathered/i, 'a claim about the platform record survived into a child project page');
+  assert.doesNotMatch(stripApexOnly(termsHtml, false), /grandfathered/i, 'a claim about the platform record survived into a child project page');
 });
 
 t('the cross-project claim is apex-only — it never ships in a child project page', () => {
-  const stripped = stripApexOnly(termsHtml);
+  // The hub flag is passed explicitly: its default reads config/modules.json, so
+  // an implicit call passes or fails with whatever this checkout has enabled.
+  assert.equal(stripApexOnly(termsHtml, true), termsHtml, 'the hub keeps every apex-only passage');
+  const stripped = stripApexOnly(termsHtml, false);
   assert.doesNotMatch(stripped, /Your work across projects/,
     'a claim about THE PLATFORM survived into a child project page (task 1002748)');
   // ...and the stripper did not simply eat the page.
@@ -165,7 +187,9 @@ t('the conflict fragment keeps the first acceptance, and replaces only a grandfa
 t('the insert fragment writes NULL for a caller the hub did not witness, and marks a witnessed one as a sign-in', () => {
   const values = acceptanceInsertValues('$5', '$6');
   assert.match(values, /CASE WHEN \$5::boolean THEN now\(\) ELSE NULL END/,
-    'a check-in / device-poll account has no acceptance — fail-closed');
+    'an account no sign-in witnessed has no acceptance — fail-closed');
+  assert.match(values, /CASE WHEN \$5::boolean THEN \$6::text ELSE NULL END/,
+    'and no version either: the pair is written together or not at all');
   assert.match(values, /CASE WHEN \$5::boolean THEN 'signin' ELSE NULL END/,
     'an acceptance written at sign-in must say so (task 1003360) — an unmarked one is indistinguishable from a grandfather');
   assert.equal(acceptanceInsertColumns(), ', terms_accepted_at, terms_version, terms_accepted_source');
@@ -199,8 +223,12 @@ function splitTopLevel(s) {
 // permissive `.*?` match: every shape this understands is spelled out, and an
 // unrecognised one THROWS. A SET list matched loosely is how a deleted audit
 // trail passes a test that looks like it is checking one.
-function evalAcceptance(expr, { col, activate, existing, oldRow = {}, params, now }) {
+function evalAcceptance(expr, { col, existing, oldRow = {}, params, now }) {
   const self = `platform_identity_accounts.${col}`;
+  // A boolean placeholder resolves by its OWN number, exactly as `$N::text` does
+  // below — so a fragment gated on the wrong parameter reads as never activating,
+  // rather than scoring as correct because the interpreter assumed which one it was.
+  const on = (n) => params[Number(n) - 1] === true;
   const src = (tok) => {
     if (/^now\(\)$/i.test(tok)) return now;
     if (tok === "'signin'") return 'signin';
@@ -216,24 +244,24 @@ function evalAcceptance(expr, { col, activate, existing, oldRow = {}, params, no
   // right-hand side against the row before the update.
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean AND platform_identity_accounts\\.terms_accepted_source = 'grandfathered' THEN (.+?) WHEN \\$(\\d+)::boolean THEN COALESCE\\(${esc}, (.+?)\\) ELSE ${esc} END$`, 'i').exec(expr);
   if (m) {
-    if (!activate) return existing;
-    if (oldRow.terms_accepted_source === 'grandfathered') return src(m[2]);
-    return existing != null ? existing : src(m[4]);
+    if (on(m[1]) && oldRow.terms_accepted_source === 'grandfathered') return src(m[2]);
+    if (on(m[3])) return existing != null ? existing : src(m[4]);
+    return existing;
   }
 
   // The ADR 0213 shape: activate ? (existing ?? src) : existing. Recognised so a
   // regression to it is caught by behaviour (a grandfather that never gives way).
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN COALESCE\\(${esc}, (.+?)\\) ELSE ${esc} END$`, 'i').exec(expr);
-  if (m) return activate ? (existing != null ? existing : src(m[2])) : existing;
+  if (m) return on(m[1]) ? (existing != null ? existing : src(m[2])) : existing;
 
   // The overwriting shape — a real possibility, and the one the idempotence
   // assertion below must be able to tell apart from the shipped one.
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN (.+?) ELSE ${esc} END$`, 'i').exec(expr);
-  if (m) return activate ? src(m[2]) : existing;
+  if (m) return on(m[1]) ? src(m[2]) : existing;
 
   // The INSERT-branch shape: activate ? src : NULL
   m = /^CASE WHEN \$(\d+)::boolean THEN (.+?) ELSE NULL END$/i.exec(expr);
-  if (m) return activate ? src(m[2]) : null;
+  if (m) return on(m[1]) ? src(m[2]) : null;
 
   // Unconditional — a caller-independent write. Recognised so the "non-activating
   // paths never stamp" assertion can catch it rather than erroring out.
@@ -272,16 +300,28 @@ function makePool() {
         const id = String(params[0]);
         const existing = accounts.get(id);
 
-        if (/ON CONFLICT \(github_id\) DO NOTHING/i.test(sql)) {
-          if (!existing) accounts.set(id, { github_id: id, github_login: params[1], profile_state: 'provisional', terms_accepted_at: null, terms_version: null, terms_accepted_source: null, account_visibility: 'public', hide_stats: false, handle: 'h' });
-          return { rows: [], rowCount: existing ? 0 : 1 };
-        }
-
         const valuesRaw = /VALUES \((.+?)\) ON CONFLICT/i.exec(sql);
         assert.ok(valuesRaw, `the upsert changed shape — update the interpreter, do not bypass it: ${sql.slice(0, 200)}`);
         const values = splitTopLevel(valuesRaw[1]);
         assert.equal(values.length, cols.length, 'the INSERT column list and VALUES list must line up');
 
+        // ensureAccount's insert-only write. Built from the statement's OWN column
+        // list, not a hardcoded row: were an acceptance column added to it, the
+        // row below would really carry it and the assertions would really fail.
+        if (/ON CONFLICT \(github_id\) DO NOTHING/i.test(sql)) {
+          if (existing) return { rows: [], rowCount: 0 };
+          const row = { github_id: id, github_login: params[1], account_visibility: 'public', hide_stats: false, handle: 'h' };
+          for (const col of ACCEPTANCE_COLUMNS) {
+            const i = cols.indexOf(col);
+            row[col] = i === -1 ? null : evalAcceptance(values[i], { col, existing: null, params, now: clock });
+          }
+          const ps = /^'(\w+)'$/.exec(values[cols.indexOf('profile_state')] || '');
+          assert.ok(ps, 'the insert-only write stopped stating its profile_state literally — update the interpreter');
+          row.profile_state = ps[1];
+          accounts.set(id, row);
+          return { rows: [], rowCount: 1 };
+        }
+
         const activate = params[4] === true;
         let row;
         if (!existing) {
@@ -289,7 +329,7 @@ function makePool() {
           for (const col of ACCEPTANCE_COLUMNS) {
             const i = cols.indexOf(col);
             assert.notEqual(i, -1, `the upsert stopped writing ${col} on insert`);
-            row[col] = evalAcceptance(values[i], { col, activate, existing: null, params, now: clock });
+            row[col] = evalAcceptance(values[i], { col, existing: null, params, now: clock });
           }
           row.profile_state = activate ? 'active' : 'provisional';
           accounts.set(id, row);
@@ -305,7 +345,7 @@ function makePool() {
           const oldRow = { ...row };
           for (const col of ACCEPTANCE_COLUMNS) {
             assert.ok(assigns.has(col), `the conflict branch stopped writing ${col} — an account that signs in again would never record its acceptance`);
-            row[col] = evalAcceptance(assigns.get(col), { col, activate, existing: oldRow[col], oldRow, params, now: clock });
+            row[col] = evalAcceptance(assigns.get(col), { col, existing: oldRow[col], oldRow, params, now: clock });
           }
           if (activate) row.profile_state = 'active';
         }
@@ -392,7 +432,7 @@ const authorize = (qs = '') => request(
 );
 
 // ===========================================================================
-// 3. The capture point — the hub's own sign-in, and nothing else
+// 3. The capture point — the project sign-in leg (/sso/authorize), and nothing else
 // ===========================================================================
 
 console.log('\nthe capture point (only the hub can say a human accepted):');
@@ -405,7 +445,7 @@ await ta('CONTROL: a hub-session authorize records the acceptance', async () =>
   assert.equal(res.status, 302, 'the authorize leg should hand back a code');
   const row = pool.accounts.get('4242');
   assert.ok(row, 'no account was written at all — the rest of this section would pass vacuously');
-  assert.equal(row.terms_accepted_at, NOW, 'the acceptance was not stamped by the hub sign-in');
+  assert.equal(row.terms_accepted_at, NOW, 'the acceptance was not stamped by the platform-account sign-in to a project');
   assert.equal(row.terms_version, TERMS_VERSION, 'the record must name WHICH text was accepted');
   assert.equal(row.terms_accepted_source, 'signin',
     'and HOW it was given — a sign-in, queryably distinct from a grandfather (task 1003360)');
@@ -494,13 +534,19 @@ await ta('a NON-activating write never touches an existing acceptance', async ()
   pool.setClock(NOW);
   await authorize();
 
-  // ensureAccount is the federated path (check-in / device-poll): it must not
-  // create, restamp, or clear an acceptance.
+  // Neither non-activating writer may create, restamp, or clear an acceptance:
+  // ensureAccount (the federated membership check-in, insert-only) and the
+  // non-activating upsertAccount (POST /sso/device/poll and PATCH /me/handle),
+  // whose conflict branch really runs here — its "leave it alone" ELSE half.
   const pi = require('../modules/platform-identity/platform-identity.js');
   pool.setClock(LATER);
   await pi.ensureAccount({ githubId: '4242', githubLogin: 'octo', displayName: 'x', avatarUrl: null }, { pool });
   assert.equal(pool.accounts.get('4242').terms_accepted_at, NOW,
     'a federated check-in changed the acceptance record');
+  await pi.upsertAccount({ githubId: '4242', githubLogin: 'octo', displayName: 'x', avatarUrl: null }, { pool });
+  const row = pool.accounts.get('4242');
+  assert.deepEqual([row.terms_accepted_at, row.terms_version, row.terms_accepted_source], [NOW, TERMS_VERSION, 'signin'],
+    'a non-activating upsert (device poll, handle change) changed the acceptance record');
 });
 
 await ta('a federated check-in creates an account with NO acceptance at all', async () => {

package/tests/terms_grandfather_db.mjs

@@ -4,7 +4,7 @@
 // Proves migration platform_identity_024 against real SQL: an account the hub
 // had already witnessed is published immediately after the migration, without
 // signing in again; its acceptance is queryably distinct from a real sign-in;
-// the grandfather runs once; and the owner's next hub sign-in replaces it.
+// the grandfather runs once; and the owner's next project sign-in replaces it.
 // tests/terms_acceptance.mjs pins the same rules DB-free (the statement shapes
 // and the executed conflict branch); only a transaction engine can run the
 // migration's DO block and its UPDATEs.
@@ -106,7 +106,7 @@ try {
   await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   ok((await row(LATE)).terms_accepted_at === null, 'replaying 024 grandfathers nobody new — the grandfather was an event, not a rule');
 
-  // The owner's next hub sign-in replaces the grandfather with their own acceptance.
+  // The owner's next project sign-in replaces the grandfather with their own acceptance.
   await pi.upsertAccount({ githubId: LEGACY, githubLogin: 'legacy-b', activate: true }, { pool: client });
   const after = await row(LEGACY);
   ok(after.terms_accepted_source === 'signin', 'the next sign-in replaces the grandfather with a signin');