@bongos/core 1.19.1080 → 1.20.1

package/tests/provisioning_render_route.mjs

@@ -0,0 +1,336 @@
+// tests/provisioning_render_route.mjs — POST /provisioning/instances/:id/render and its
+// queue seam (task 1004183; ADR 0327).
+//
+// The load-bearing assertions:
+//   • OWNER ONLY: the key and the Render account are the owner's, so an archon on someone
+//     else's project gets the same 404 as a stranger, and nothing is encrypted or queued
+//   • only CIPHERTEXT reaches the queue — the plaintext key is never passed on, never in
+//     the reply, never in the audit event
+//   • the shape is checked before anything is kept; the web tier makes no Render call
+//   • no secret box → 503, and the key is not kept
+//   • a conflicting open intent → 409, and the key is not kept
+//   • the queue seam writes the intent AND the row in ONE statement, so a collision on
+//     the open-intent index stores nothing at all
+//
+// DB-free: data access is stubbed on the cached module objects, over a real mounted
+// router. No network beyond localhost. Run:  node tests/provisioning_render_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const renderStandup = require('../modules/provisioning/render-standup.js');
+const secretBox = require('../src/bongos/secret-box.js');
+const guard = require('../modules/provisioning/control-plane-guard.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const KEY = 'rnd_abcdefghijklmnopqrstuvwx';
+let instance = null, enqueueCalls = [], enqueueResult = null, events = [], boxOn = true;
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+const realEnqueue = renderStandup.enqueueRenderStandup;
+renderStandup.enqueueRenderStandup = async (_db, id, args) => {
+  enqueueCalls.push({ id, ...args });
+  return enqueueResult || { intent: { id: 9, action: 'render-standup', state: 'pending' } };
+};
+secretBox.isConfigured = () => boxOn;
+secretBox.encrypt = (plain) => `v1.sealed(${plain.length})`;
+
+const api = require('../src/module-api.js');
+let builder = null;
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/render-standup.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(Array.isArray(details) ? { details } : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', target_ref: 'example-owner/spike' };
+function reset(patch = {}) {
+  instance = { ...LIVE, ...patch };
+  enqueueCalls = []; enqueueResult = null; events = []; boxOn = true;
+  builder = { id: 7, github_login: 'owner', rank: 'thetes' };
+}
+const PATH = '/provisioning/instances/18/render';
+const GREEN = { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield', runtime: 'node', start_command: 'npm start' };
+const noKeyAnywhere = (...xs) => xs.forEach((x) => assert.ok(!JSON.stringify(x).includes(KEY), 'the plaintext key leaked: ' + JSON.stringify(x)));
+
+console.log('who may ask:');
+await ta('the owner queues it: ciphertext only, the request recorded on the row, one audit event', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, web_plan: 'standard', build_command: ' npm ci ', database: true });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls.length, 1);
+  assert.equal(enqueueCalls[0].keyEnc, `v1.sealed(${KEY.length})`);
+  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null,
+    runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', database: true, webPlan: 'standard' });
+  assert.equal(events.length, 1);
+  noKeyAnywhere(enqueueCalls, events, r.body);
+});
+await ta('an ARCHON on someone else\'s project gets 404 — nothing encrypted, queued or recorded', async () => {
+  reset();
+  builder = { id: 42, github_login: 'arch', rank: 'archon' };
+  let sealed = 0; const enc = secretBox.encrypt; secretBox.encrypt = (p) => { sealed++; return enc(p); };
+  const r = await post(PATH, GREEN);
+  secretBox.encrypt = enc;
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(sealed, 0);
+  assert.equal(enqueueCalls.length, 0);
+  assert.equal(events.length, 0);
+});
+await ta('a missing project is 404', async () => {
+  reset(); instance = null;
+  assert.equal((await post(PATH, GREEN)).status, 404);
+});
+
+console.log('\nthe shape is checked first:');
+for (const [name, body, re] of [
+  ['a key that is not a Render key', { ...GREEN, key: 'ghp_notrender' }, /Render API key/],
+  ['a workspace id of the wrong shape', { ...GREEN, owner_id: 'srv-abcdefgh1234' }, /workspace/],
+  ['an unknown mode', { ...GREEN, mode: 'migrate' }, /link a Render service/],
+  ['adopt with no service', { ...GREEN, mode: 'adopt' }, /service to link/],
+  ['greenfield naming a service', { ...GREEN, service_id: 'srv-abcdefgh1234' }, /leave the service out/],
+  ['an unknown plan', { ...GREEN, database: true, db_plan: 'free' }, /not a Render database plan/],
+  ['a database plan with no database', { ...GREEN, db_plan: 'basic_1gb' }, /needs a database/],
+  ['a new app with no runtime', { ...GREEN, runtime: undefined }, /built with/],
+  ['an unknown runtime', { ...GREEN, runtime: 'cobol' }, /built with/],
+  ['a native runtime with no start command', { ...GREEN, start_command: '  ' }, /how your app starts/],
+  ['docker with commands', { ...GREEN, runtime: 'docker' }, /leave the commands out/],
+  ['adopt saying how to build', { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234', runtime: 'node' }, /exactly as it is/],
+]) {
+  await ta(`${name} → 400, nothing kept`, async () => {
+    reset();
+    const r = await post(PATH, body);
+    assert.equal(r.status, 400, r.raw);
+    assert.match(r.body.error.message, re);
+    assert.equal(enqueueCalls.length, 0);
+    noKeyAnywhere(r.body);
+  });
+}
+await ta('an unknown field is refused by the strict validator', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, value: 'x' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('adopt with a service id is accepted and records it', async () => {
+  reset();
+  const r = await post(PATH, { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls[0].appHost.serviceId, 'srv-abcdefgh1234');
+  assert.equal(enqueueCalls[0].appHost.runtime, undefined, 'a link records nothing about building');
+});
+await ta('docker needs no commands, and no database is the default', async () => {
+  reset();
+  const r = await post(PATH, { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield', runtime: 'docker' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual([enqueueCalls[0].appHost.runtime, enqueueCalls[0].appHost.startCommand, enqueueCalls[0].appHost.database], ['docker', undefined, false]);
+  assert.doesNotMatch(r.body.message, /database/, 'the receipt does not promise a database');
+});
+
+console.log('\nrefusals keep nothing:');
+await ta('greenfield with no repository → 409', async () => {
+  reset({ target_ref: null });
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 409, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('a removed project → 409', async () => {
+  reset({ status: 'torn_down' });
+  assert.equal((await post(PATH, GREEN)).status, 409);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('no secret box → 503, and the key is not kept', async () => {
+  reset(); boxOn = false;
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 503, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('something already open → 409 saying the key was not kept', async () => {
+  reset(); enqueueResult = { conflict: 'open_intent', intent: { action: 'provision', state: 'running' } };
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 409, r.raw);
+  assert.match(r.body.error.message, /not kept/);
+  assert.equal(events.length, 0);
+});
+
+console.log('\nthe queue seam:');
+const realGuard = guard.assertIntentAllowed;
+guard.assertIntentAllowed = async () => {};
+await ta('one statement writes the intent with the ciphertext and merges the row', async () => {
+  const sqls = [];
+  const db = { query: async (sql, params) => { sqls.push({ sql, params }); return { rows: [{ id: 5, action: 'render-standup', state: 'pending' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234' }, requestedBy: 'api:self' });
+  assert.equal(out.intent.id, 5);
+  assert.equal(sqls.length, 1, 'a single statement — both land or neither does');
+  assert.match(sqls[0].sql, /INSERT INTO provisioning_intents[\s\S]*borrowed_key_enc[\s\S]*UPDATE provisioning_instances[\s\S]*app_host/);
+  assert.equal(sqls[0].params[2], 'v1.x');
+  assert.doesNotMatch(sqls[0].sql, /RETURNING \*[\s\S]*SELECT i\.\*/, 'the ciphertext is not read back');
+});
+await ta('a collision on the open-intent index stores nothing and names the blocker', async () => {
+  let n = 0;
+  const db = { query: async () => { const i = n++; if (i === 0) throw Object.assign(new Error('dup'), { code: '23505' }); if (i === 1) return { rows: [] }; return { rows: [{ id: 3, action: 'teardown', state: 'pending' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { mode: 'greenfield', ownerId: 'tea-abcdefgh1234' } });
+  assert.equal(out.conflict, 'open_intent');
+  assert.equal(out.intent.action, 'teardown');
+});
+await ta('a Create still being set up takes the key onto its OWN run (task 1004352)', async () => {
+  const sqls = []; let n = 0;
+  const db = { query: async (sql, params) => { sqls.push({ sql, params }); if (n++ === 0) throw Object.assign(new Error('dup'), { code: '23505' }); return { rows: [{ id: 7, action: 'provision', state: 'running' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234' } });
+  assert.equal(out.attached, true);
+  assert.equal(out.intent.action, 'provision');
+  assert.equal(out.conflict, undefined);
+  const attach = sqls[1].sql.replace(/\s+/g, ' ');
+  assert.match(attach, /action = 'provision' AND state IN \('pending', 'running'\) AND borrowed_key_enc IS NULL/, 'only an open provision run with no key yet');
+  assert.match(attach, /UPDATE provisioning_instances SET app_host = \$3::jsonb WHERE id = \$1 AND EXISTS \(SELECT 1 FROM i\)/, 'the row is touched only if the key landed');
+  assert.equal(sqls[1].params[1], 'v1.x');
+});
+guard.assertIntentAllowed = realGuard;
+
+console.log('\nPOST /provisioning/render/lookup — what the key can see (ADR 0348):');
+const lookupApp = express();
+lookupApp.use(express.json());
+lookupApp.use((_req, res, next) => { res.fail = (code, opts) => res.status((opts && opts.status) || 400).json({ error: { code, ...(typeof opts === 'object' ? opts : {}) } }); next(); });
+let renderCalls = [], renderAnswers = {};
+const fakeRenderFetch = async (url, init) => {
+  renderCalls.push({ url, method: init.method, auth: init.headers.Authorization, body: init.body });
+  const path = url.replace('https://api.render.com/v1', '');
+  const a = renderAnswers[path];
+  if (a === undefined) return { ok: false, status: 404, json: async () => ({}) };
+  if (typeof a === 'number') return { ok: false, status: a, json: async () => ({}) };
+  return { ok: true, status: 200, json: async () => a };
+};
+lookupApp.use('/api/bongos', buildRouter({ fetchImpl: fakeRenderFetch }));
+const lookupServer = lookupApp.listen(0);
+await new Promise((r) => lookupServer.once('listening', r));
+const lookupBase = `http://127.0.0.1:${lookupServer.address().port}/api/bongos/provisioning/render/lookup`;
+const lookup = (body) => new Promise((resolve, reject) => {
+  const req = http.request(lookupBase, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+    let d = ''; res.on('data', (c) => { d += c; }); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d || '{}'), raw: d }));
+  });
+  req.on('error', reject); req.end(JSON.stringify(body));
+});
+const TEA_A = 'tea-aaaaaaaa1111', TEA_B = 'tea-bbbbbbbb2222';
+function resetLookup() {
+  reset(); renderCalls = [];
+  renderAnswers = {
+    '/owners?limit=100': [{ owner: { id: TEA_A, name: 'Mine', type: 'team' } }, { owner: { id: TEA_B, name: 'A friend\'s team', type: 'team' } }],
+    [`/services?ownerId=${TEA_A}&type=web_service&limit=100`]: [{ service: { id: 'srv-aaaaaaaa1111', name: 'shop', ownerId: TEA_A, repo: 'https://github.com/example-owner/spike', serviceDetails: { url: 'https://shop.onrender.com' } } }],
+  };
+}
+await ta('a key that reaches several workspaces lists them ALL, in Render\'s order, and picks none', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.workspaces.map((w) => w.id), [TEA_A, TEA_B]);
+  assert.equal(r.body.services, undefined, 'no workspace is chosen for the owner, so none is looked into');
+  assert.equal(renderCalls.length, 1);
+  assert.equal(renderCalls[0].auth, `Bearer ${KEY}`);
+  assert.ok(!renderCalls[0].url.includes(KEY), 'the key is never in a URL');
+  noKeyAnywhere(r.body);
+});
+await ta('a refused key says so, in words, and nothing else is called', async () => {
+  resetLookup(); renderAnswers['/owners?limit=100'] = 401;
+  const r = await lookup({ key: KEY });
+  assert.equal(r.status, 422, r.raw);
+  assert.equal(r.body.error.code, 'render_key_refused');
+  assert.match(r.body.error.message, /refused that key/);
+  assert.equal(renderCalls.length, 1);
+  noKeyAnywhere(r.body);
+});
+await ta('the chosen workspace lists its web services, each checked to be from that workspace', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY, owner_id: TEA_A });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.services, [{ id: 'srv-aaaaaaaa1111', name: 'shop', repo: 'https://github.com/example-owner/spike', url: 'https://shop.onrender.com' }]);
+});
+await ta('a service from ANOTHER workspace in the answer shows nothing at all', async () => {
+  resetLookup();
+  renderAnswers[`/services?ownerId=${TEA_A}&type=web_service&limit=100`] = [{ service: { id: 'srv-x', name: 'theirs', ownerId: TEA_B } }];
+  const r = await lookup({ key: KEY, owner_id: TEA_A });
+  assert.equal(r.status, 502, r.raw);
+  assert.equal(r.body.error.code, 'render_owner_mismatch');
+  assert.equal(r.body.services, undefined);
+});
+await ta('a workspace the key cannot reach is refused before its services are asked for', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY, owner_id: 'tea-cccccccc3333' });
+  assert.equal(r.status, 422, r.raw);
+  assert.equal(renderCalls.length, 1);
+});
+await ta('the lookup only ever GETs', async () => {
+  resetLookup();
+  await lookup({ key: KEY }); await lookup({ key: KEY, owner_id: TEA_A });
+  assert.deepEqual([...new Set(renderCalls.map((c) => c.method))], ['GET']);
+  assert.ok(renderCalls.every((c) => !c.body));
+  const src = readFileSync(new URL('../modules/provisioning/render-lookup.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /method: '(POST|PUT|PATCH|DELETE)'/);
+});
+await ta('a malformed key or workspace never reaches Render', async () => {
+  resetLookup();
+  assert.equal((await lookup({ key: 'ghp_nope' })).status, 400);
+  assert.equal((await lookup({ key: KEY, owner_id: 'srv-aaaaaaaa1111' })).status, 400);
+  assert.equal(renderCalls.length, 0);
+});
+await ta('the lookup is capped per builder', async () => {
+  resetLookup(); builder = { id: 555, github_login: 'burst', rank: 'thetes' };
+  let last = null;
+  for (let i = 0; i < 21; i++) last = await lookup({ key: KEY });
+  assert.equal(last.status, 429);
+});
+lookupServer.close();
+
+console.log('\nwiring:');
+await ta('module.json mounts the route; the action is in the vocabulary and the newest CHECK', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('render-standup'));
+  assert.ok(provisioning.INTENT_ACTIONS.includes('render-standup'));
+  const mig = readFileSync(new URL('../modules/provisioning/migrations/provisioning_028_render_standup.sql', import.meta.url), 'utf8');
+  assert.match(mig, /borrowed_key_enc IS NULL OR state IN \('pending', 'running'\)/, 'a resolved intent cannot keep a key');
+});
+await ta('every path that resolves an intent clears the key', () => {
+  const src = readFileSync(new URL('../modules/provisioning/provisioning.js', import.meta.url), 'utf8');
+  const resolve = src.slice(src.indexOf('async function resolveIntent'), src.indexOf('async function resolveIntent') + 400);
+  assert.match(resolve, /borrowed_key_enc = NULL/);
+  const teardown = src.slice(src.indexOf('async function enqueueTeardown'), src.indexOf('async function enqueueTeardown') + 600);
+  assert.match(teardown, /borrowed_key_enc = NULL/, 'a superseded standup drops its key');
+  assert.match(teardown, /'render-standup'\) AND state = 'pending'/);
+});
+
+server.close();
+console.log(`\nprovisioning_render_route: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_settings_apply.mjs

@@ -169,7 +169,7 @@ await ta('enqueueTeardown supersedes a PENDING settings push (a push into a proj
   const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.superseded, true, 'the queued push was cancelled so the teardown could take the slot');
-  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
+  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
 });
 
 // ── the route, over a real mounted router (stubbed data access) ─────────────────

package/tests/provisioning_teardown_intent.mjs

@@ -31,7 +31,7 @@ const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
 
 // The actions a teardown supersedes, mirroring enqueueTeardown's SQL.
-const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private']);
+const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private', 'render-standup']);
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -81,7 +81,7 @@ function fakeIntentDb(seed = [], { shape = 'co-tenant' } = {}) {
         // dead work in front of a teardown (task 1003140 widened it to the settings
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
-        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/);
+        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/);
         updates++;
         // The supersede must skip the platform's own row IN ITS OWN SQL (task 1004286): the
         // guard refuses that teardown only afterwards, in enqueueIntent. Modelled, not assumed.

package/tests/render_api.mjs

@@ -0,0 +1,153 @@
+// tests/render_api.mjs — the Render client's workspace guard (task 1004183; ADR 0327).
+//
+// The load-bearing assertions:
+//   • a client cannot exist without the workspace it acts in — never defaulted
+//   • a response from ANOTHER workspace is refused (RenderOwnerMismatch), and so is a
+//     response carrying no workspace — in both of Render's shapes (service `ownerId`,
+//     Postgres `owner.id`) and on every element that carries one
+//   • the calls whose answer carries no owner (connection-info, env-var PUT, deploy) are
+//     only sent after the parent resource was read through the guard — so a service in
+//     another workspace gets NO write
+//   • there is no delete, and the verb is refused outright
+//   • a dry-run sends nothing and never prints an env var value
+//
+// Hermetic: a recording fake fetch. Run:  node tests/render_api.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { RenderApi, RenderApiError, RenderOwnerMismatch, ownerOf } = require('../scripts/gds/render-api.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const THEIRS = 'tea-theirs000001';
+
+// A fake Render: `routes` maps "METHOD path" to the JSON it answers.
+function fakeFetch(routes) {
+  const calls = [];
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    calls.push({ method: init.method, path, body: init.body ? JSON.parse(init.body) : null, auth: init.headers.Authorization });
+    const key = `${init.method} ${path}`;
+    if (!(key in routes)) return { ok: false, status: 404, text: async () => JSON.stringify({ message: 'not found' }) };
+    return { ok: true, status: 200, text: async () => JSON.stringify(routes[key]) };
+  };
+  return { fetchImpl, calls };
+}
+const live = (routes, ownerId = OURS) => {
+  const f = fakeFetch(routes);
+  return { api: new RenderApi({ token: 'rnd_test', ownerId, dryRun: false, fetchImpl: f.fetchImpl }), calls: f.calls };
+};
+
+console.log('the workspace is required:');
+await ta('no ownerId → the client refuses to exist, even in dry-run', () => {
+  assert.throws(() => new RenderApi({ token: 'rnd_x', dryRun: false, fetchImpl: () => {} }), RenderApiError);
+  assert.throws(() => new RenderApi({}), /never defaulted/);
+  assert.throws(() => new RenderApi({ ownerId: '   ' }), RenderApiError);
+});
+await ta('live with no key → refuses', () => {
+  assert.throws(() => new RenderApi({ ownerId: OURS, dryRun: false, fetchImpl: () => {} }), /no API key/);
+});
+
+console.log('\nthe guard is on the RESPONSE:');
+await ta('a service from another workspace is refused', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS } });
+  await assert.rejects(api.getService('srv-1'), RenderOwnerMismatch);
+});
+await ta('a service carrying no workspace is refused', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1' } });
+  await assert.rejects(api.getService('srv-1'), /no workspace/);
+});
+await ta('a service from our workspace passes, in either envelope', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: OURS }, 'GET /services/srv-2': { service: { id: 'srv-2', ownerId: OURS } } });
+  assert.equal((await api.getService('srv-1')).id, 'srv-1');
+  assert.equal((await api.getService('srv-2')).id, 'srv-2');
+});
+await ta('a Postgres carries its owner as owner.id — a mismatch there is refused too', async () => {
+  const { api } = live({ 'GET /postgres/dpg-1': { id: 'dpg-1', owner: { id: THEIRS } } });
+  await assert.rejects(api.getPostgres('dpg-1'), RenderOwnerMismatch);
+  assert.equal(ownerOf({ owner: { id: OURS } }), OURS);
+  assert.equal(ownerOf({ ownerId: OURS }), OURS);
+  assert.equal(ownerOf({}), null);
+});
+await ta('a create answered from another workspace is refused', async () => {
+  const { api } = live({
+    'POST /services': { deployId: 'dep-1', service: { id: 'srv-9', ownerId: THEIRS } },
+    'POST /postgres': { id: 'dpg-9', owner: { id: THEIRS } },
+  });
+  await assert.rejects(api.createService({ ownerId: OURS, name: 'x' }), RenderOwnerMismatch);
+  await assert.rejects(api.createPostgres({ ownerId: OURS, name: 'x' }), RenderOwnerMismatch);
+});
+await ta('a payload naming another workspace is never sent', async () => {
+  const { api, calls } = live({});
+  await assert.rejects(api.createService({ ownerId: THEIRS, name: 'x' }), /this client's workspace/);
+  await assert.rejects(api.createPostgres({ name: 'x' }), /this client's workspace/);
+  assert.equal(calls.length, 0);
+});
+
+console.log('\nownerless answers are reached only through a checked parent:');
+await ta('an env var for a service in another workspace is never PUT', async () => {
+  const { api, calls } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS }, 'PUT /services/srv-1/env-vars/K': { key: 'K' } });
+  await assert.rejects(api.putEnvVar('srv-1', 'K', 'v'), RenderOwnerMismatch);
+  assert.deepEqual(calls.map((c) => c.method), ['GET'], 'the PUT is never sent');
+});
+await ta('a deploy for a service in another workspace is never triggered', async () => {
+  const { api, calls } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS } });
+  await assert.rejects(api.triggerDeploy('srv-1'), RenderOwnerMismatch);
+  assert.deepEqual(calls.map((c) => c.method), ['GET']);
+});
+await ta('connection-info for a database in another workspace is never read', async () => {
+  const { api, calls } = live({ 'GET /postgres/dpg-1': { id: 'dpg-1', owner: { id: THEIRS } }, 'GET /postgres/dpg-1/connection-info': { internalConnectionString: 'postgres://leak' } });
+  await assert.rejects(api.postgresConnectionInfo('dpg-1'), RenderOwnerMismatch);
+  assert.equal(calls.length, 1);
+});
+await ta('on our own resources they go through, with the key as a bearer', async () => {
+  const { api, calls } = live({
+    'GET /services/srv-1': { id: 'srv-1', ownerId: OURS },
+    'PUT /services/srv-1/env-vars/K': { key: 'K' },
+    'POST /services/srv-1/deploys': { id: 'dep-2' },
+  });
+  await api.putEnvVar('srv-1', 'K', 'v');
+  await api.triggerDeploy('srv-1');
+  assert.deepEqual(calls.map((c) => `${c.method} ${c.path}`), ['GET /services/srv-1', 'PUT /services/srv-1/env-vars/K', 'GET /services/srv-1', 'POST /services/srv-1/deploys']);
+  assert.deepEqual(calls[1].body, { value: 'v' });
+  assert.ok(calls.every((c) => c.auth === 'Bearer rnd_test'));
+});
+
+console.log('\nthe workspace list is for membership, never selection:');
+await ta('listOwners returns every workspace the key reaches, unwrapped', async () => {
+  const { api } = live({ 'GET /owners?limit=100': [{ owner: { id: THEIRS, type: 'team' }, cursor: 'a' }, { owner: { id: OURS, type: 'team' }, cursor: 'b' }] });
+  assert.deepEqual((await api.listOwners()).map((o) => o.id), [THEIRS, OURS]);
+});
+
+console.log('\nno delete:');
+await ta('there is no delete method, and the verb is refused', async () => {
+  const { api, calls } = live({});
+  const methods = Object.getOwnPropertyNames(RenderApi.prototype);
+  assert.ok(!methods.some((m) => /delete|destroy|remove|suspend/i.test(m)), `no destructive method: ${methods.join(', ')}`);
+  await assert.rejects(api._req('DELETE', '/services/srv-1'), /never deletes/);
+  assert.equal(calls.length, 0);
+});
+
+console.log('\ndry-run:');
+await ta('dry-run is the default, sends nothing, and prints no env var value', async () => {
+  const lines = [];
+  let sent = 0;
+  const api = new RenderApi({ ownerId: OURS, fetchImpl: () => { sent++; }, log: (l) => lines.push(l) });
+  const r = await api.createService({ ownerId: OURS, name: 'demo', envVars: [{ key: 'DATABASE_URL', value: 'postgres://secret' }] });
+  assert.equal(sent, 0);
+  assert.equal(r.service.ownerId, OURS);
+  await api.putEnvVar('srv-1', 'BUILDER_SECRET_KEY', 'deadbeef');
+  const out = lines.join('\n');
+  assert.ok(!out.includes('postgres://secret') && !out.includes('deadbeef'), out);
+  assert.match(out, /DATABASE_URL/, 'the name is still shown');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/render_check.mjs

@@ -24,7 +24,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   // sky-data.js is shared by the two doors of one page (task 1004232): /thinking and /goal-map.
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['projects.states.json']);
+  // the account page links the hub's sheet too since task 1004259
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {