@bongos/core 1.19.1081 → 1.20.2

package/modules/provisioning/render-lookup.js

@@ -0,0 +1,68 @@
+// modules/provisioning/render-lookup.js — the ONE Render call the web tier may make: a
+// read-only look at what an owner's key can see (task 1004352; ADR 0348).
+//
+// The setup wizard has to tell the owner at once when a key is refused, and has to make
+// them choose among the workspaces the key reaches (a Render key belongs to a USER and
+// reaches every workspace that user is in — ADR 0327). Only a call to Render can answer
+// either, and the owner is still on the page. So ADR 0348 makes one narrow exception to
+// ADR 0111 §2 ("the web tier never calls a cloud API"), and this file is all of it:
+//
+//   - GET only — two calls, the workspace list and the services in ONE named workspace.
+//     Nothing here can create, change or delete anything, and there is no way to ask it to.
+//   - the key is the owner's own, held in memory for this one request; it is never
+//     stored, logged or returned, and it is not encrypted here because it is not kept.
+//   - every service in the answer is asserted to carry the workspace asked about — the
+//     same guard the runner's client applies (scripts/gds/render-api.js). A module may
+//     not require that file (ADR 0083), so this carries its own two GETs rather than a
+//     second client.
+//
+// `fetchImpl` is injectable so tests never touch the network.
+'use strict';
+
+const RENDER_API = 'https://api.render.com/v1';
+const TIMEOUT_MS = 10_000;
+
+class RenderLookupError extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+async function get(path, key, fetchImpl) {
+  let res;
+  try {
+    res = await fetchImpl(`${RENDER_API}${path}`, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+  } catch (_) {
+    throw new RenderLookupError('render_unreachable', 'Render didn’t answer. Try again in a moment.');
+  }
+  if (res.status === 401 || res.status === 403) {
+    throw new RenderLookupError('render_key_refused', 'Render refused that key. Check you copied all of it, and that it hasn’t been deleted.');
+  }
+  if (!res.ok) throw new RenderLookupError('render_unreachable', `Render answered ${res.status}. Try again in a moment.`);
+  try { return await res.json(); } catch (_) { throw new RenderLookupError('render_unreachable', 'Render sent an answer we couldn’t read.'); }
+}
+
+const unwrap = (json, field) => (Array.isArray(json) ? json : []).map((e) => (e && e[field]) || e).filter((o) => o && typeof o.id === 'string');
+
+// What the key can see: every workspace, and — when `ownerId` names one of them — the
+// web services in it. Throws RenderLookupError with a code the route maps to a reply.
+async function lookupRender(key, { ownerId = null, fetchImpl = globalThis.fetch } = {}) {
+  const workspaces = unwrap(await get('/owners?limit=100', key, fetchImpl), 'owner')
+    .map((o) => ({ id: o.id, name: String(o.name || o.email || o.id), type: o.type === 'user' ? 'user' : 'team' }));
+  if (!ownerId) return { workspaces };
+  if (!workspaces.some((w) => w.id === ownerId)) {
+    throw new RenderLookupError('render_workspace_unreachable', 'That key can’t reach the workspace you chose.');
+  }
+  const services = unwrap(await get(`/services?ownerId=${encodeURIComponent(ownerId)}&type=web_service&limit=100`, key, fetchImpl), 'service')
+    .map((s) => {
+      if (s.ownerId !== ownerId) {
+        throw new RenderLookupError('render_owner_mismatch', 'Render answered with a service from another workspace, so nothing was shown.');
+      }
+      return { id: s.id, name: String(s.name || s.id), repo: s.repo || null, url: (s.serviceDetails && s.serviceDetails.url) || null };
+    });
+  return { workspaces, services };
+}
+
+module.exports = { lookupRender, RenderLookupError, RENDER_API };

package/modules/provisioning/render-standup.js

@@ -10,6 +10,12 @@
 // compromised web tier — the key arrives here in plaintext before anything can encrypt
 // it. Nothing here stores the key anywhere else, logs it, or sends it back.
 //
+// A PROJECT STILL BEING SET UP. The wizard sends the key right after Create, while the
+// project's own `provision` run holds the one open-intent slot. Rather than refuse, the key
+// rides THAT run (task 1004352): the runner sets the app up on Render straight after the
+// project is up, in the same drain, and clears the key either way
+// (scripts/gds/provision-render.js afterProvision).
+//
 // Its own file because provisioning.js sits at the size ratchet.
 'use strict';
 
@@ -19,6 +25,9 @@ const WEB_PLANS = ['starter', 'standard', 'pro', 'pro_plus', 'pro_max', 'pro_ult
 const DB_PLANS = ['basic_256mb', 'basic_1gb', 'basic_4gb', 'pro_4gb', 'pro_8gb'];
 const REGIONS = ['virginia', 'ohio', 'oregon', 'frankfurt', 'singapore'];
 const MODES = ['adopt', 'greenfield'];
+// How the owner's app is built (task 1004350): a native runtime with their commands, or
+// `docker`, which builds the repository's own Dockerfile.
+const RUNTIMES = ['node', 'python', 'ruby', 'go', 'rust', 'elixir', 'docker'];
 
 // Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
 // one); services `srv-…`. Shape checks only — whether the key works, and whether it can
@@ -36,9 +45,16 @@ function badRequest(body) {
   if (!MODES.includes(b.mode)) return 'Say whether to link a Render service you already have, or create a new one.';
   if (b.mode === 'adopt' && !SERVICE_RE.test(String(b.service_id || ''))) return 'Choose the Render service to link. Its id starts with “srv-”.';
   if (b.mode === 'greenfield' && b.service_id) return 'A new setup creates its own service, so leave the service out.';
+  if (b.mode === 'adopt' && (b.runtime != null || b.build_command != null || b.start_command != null || b.database != null)) return 'Linking keeps your Render service exactly as it is, so leave out how it is built.';
+  if (b.mode === 'greenfield') {
+    if (!RUNTIMES.includes(b.runtime)) return 'Say what your app is built with — for example Node or Python, or Docker to use your repository’s Dockerfile.';
+    if (b.runtime === 'docker' && (b.build_command || b.start_command)) return 'Docker builds and starts your app from your Dockerfile, so leave the commands out.';
+    if (b.runtime !== 'docker' && !String(b.start_command || '').trim()) return 'Say how your app starts — the command Render should run, for example “npm start”.';
+  }
   if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
   if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;
   if (b.region != null && !REGIONS.includes(b.region)) return `“${b.region}” is not a Render region.`;
+  if (b.db_plan != null && b.database !== true) return 'A database plan needs a database — ask for one, or leave the plan out.';
   return null;
 }
 
@@ -46,6 +62,11 @@ function badRequest(body) {
 function appHostFrom(body) {
   const h = { platform: 'render', mode: body.mode, ownerId: body.owner_id, state: 'requested', error: null };
   if (body.mode === 'adopt') h.serviceId = body.service_id;
+  if (body.mode === 'greenfield') {
+    h.runtime = body.runtime;
+    if (body.runtime !== 'docker') { h.startCommand = body.start_command.trim(); if (body.build_command) h.buildCommand = body.build_command.trim(); }
+    h.database = body.database === true;
+  }
   if (body.web_plan) h.webPlan = body.web_plan;
   if (body.db_plan) h.dbPlan = body.db_plan;
   if (body.region) h.region = body.region;
@@ -79,6 +100,8 @@ async function enqueueRenderStandup(db, instanceId, { keyEnc, appHost, requested
     return { intent: rows[0] };
   } catch (e) {
     if (e && e.code === '23505') {
+      const attached = await attachToProvision(db, instanceId, { keyEnc, appHost });
+      if (attached) return { intent: attached, attached: true };
       const { rows } = await db.query(
         `SELECT id, action, state FROM provisioning_intents
           WHERE instance_id = $1 AND state IN ('pending', 'running') ORDER BY created_at DESC LIMIT 1`, [instanceId]);
@@ -88,4 +111,24 @@ async function enqueueRenderStandup(db, instanceId, { keyEnc, appHost, requested
   }
 }
 
-module.exports = { WEB_PLANS, DB_PLANS, REGIONS, MODES, badRequest, appHostFrom, enqueueRenderStandup };
+// Put the key on the project's OPEN provision run, and record the request on the row, in
+// one statement. Only a run that holds no key yet: a second request never overwrites the
+// first. Returns the intent, or null when there is no such run (the caller then reports
+// the conflict as usual). The table's CHECK still refuses a key on a resolved intent, so
+// a run that finished a moment ago cannot be handed one.
+async function attachToProvision(db, instanceId, { keyEnc, appHost }) {
+  const { rows } = await db.query(
+    `WITH i AS (
+       UPDATE provisioning_intents SET borrowed_key_enc = $2, updated_at = now()
+        WHERE instance_id = $1 AND action = 'provision' AND state IN ('pending', 'running') AND borrowed_key_enc IS NULL
+        RETURNING id, instance_id, action, state, created_at
+     ), u AS (
+       UPDATE provisioning_instances SET app_host = $3::jsonb
+        WHERE id = $1 AND EXISTS (SELECT 1 FROM i) RETURNING id
+     )
+     SELECT * FROM i`,
+    [instanceId, keyEnc, JSON.stringify(appHost)]);
+  return rows[0] || null;
+}
+
+module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/provisioning/routes/render-standup.js

@@ -2,7 +2,8 @@
 // (task 1004183; ADR 0327, ADR 0345).
 //
 // The owner lends their Render API key once, names the workspace, and says whether to link
-// a service they already run (adopt) or create a new one (greenfield). This route checks
+// a service they already run for this repository (adopt) or create a new one for their app
+// (greenfield: how it is built and started, and whether it needs a database — task 1004350). This route checks
 // the shape, encrypts the key with the secret box, and queues a `render-standup` intent;
 // the runner (scripts/gds/provision-render.js) spends the key in one drain and clears it.
 // This process never calls Render (ADR 0111 §2).
@@ -22,6 +23,10 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const renderStandup = require('../render-standup');
 const { failFrom } = require('../public-refusal');
+const { lookupRender, RenderLookupError } = require('../render-lookup');
+const { appStatus } = require('../app-status');
+const envManifest = require('../env-manifest');
+const { makeAskRateLimiter } = require('../rate-limit');
 
 const log = api.logger('provisioning');
 
@@ -29,12 +34,78 @@ const log = api.logger('provisioning');
 // before lending a key. The runner keeps its own checks.
 function unavailableReason(inst, mode) {
   if (inst.status === 'torn_down' || inst.status === 'tearing_down') return 'This project has been removed, so it can’t be set up on Render.';
-  if (mode === 'greenfield' && !inst.target_ref) return 'This project has no GitHub repository linked, so Render has nothing to build.';
+  if (!inst.target_ref) return mode === 'adopt' ? 'This project has no GitHub repository linked, so there is no app to check the Render service against.' : 'This project has no GitHub repository linked, so Render has nothing to build.';
   return null;
 }
 
-module.exports = function buildRenderStandupRouter() {
+// The lookup is a Render call made on the owner's behalf, so it is capped per builder:
+// a wizard needs a handful (check the key, then one workspace or two), never a stream.
+const LOOKUP_STATUS = { render_key_refused: 422, render_workspace_unreachable: 422, render_owner_mismatch: 502, render_unreachable: 502 };
+
+// OWNER ONLY, no archon override, for every Render route: the key and the account it acts
+// in are the owner's. A missing project and someone else's answer the same 404, so an id is
+// never confirmed.
+function ownedBy(inst, builder) { return !!(inst && builder && String(inst.owner_builder_id) === String(builder.id)); }
+
+module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
   const router = express.Router();
+  const lookupLimit = makeAskRateLimiter({ windowMs: 60_000, max: 20, key: (req) => `b:${req.builder && req.builder.id}` });
+  const statusLimit = makeAskRateLimiter({ windowMs: 60_000, max: 60, key: (req) => `s:${req.builder && req.builder.id}` });
+
+  // POST /provisioning/render/lookup — rank: any authenticated builder. What the owner's
+  // Render key can see: its workspaces, and the web services in the one they name. The
+  // ONLY Render call this process makes (ADR 0348): GET only, the key held for this
+  // request and never stored, logged or sent back. POST so the key travels in a body,
+  // never a URL.
+  router.post('/provisioning/render/lookup', api.requireBuilder, lookupLimit, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      owner_id: { type: 'string', maxLength: 80 },
+    })) return;
+    if (!renderStandup.KEY_RE.test(req.body.key)) {
+      return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+    }
+    if (req.body.owner_id != null && !renderStandup.OWNER_RE.test(req.body.owner_id)) {
+      return res.fail('render_request_invalid', { status: 400, message: 'That isn’t a Render workspace id.' });
+    }
+    try {
+      const out = await lookupRender(req.body.key, { ownerId: req.body.owner_id || null, fetchImpl: fetchImpl || globalThis.fetch });
+      res.json({ ok: true, ...out });
+    } catch (err) {
+      if (err instanceof RenderLookupError) return res.fail(err.code, { status: LOOKUP_STATUS[err.code] || 502, message: err.message });
+      log.error('[provisioning] POST /provisioning/render/lookup', err && err.message);
+      failFrom(res, err, 'render_lookup_failed');
+    }
+  });
+
+  // GET /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
+  // ONLY, like the POST (task 1004353). Where the project's app setup on Render stands:
+  // the stage, the app's address, the Render links, a failure as one sentence with the
+  // answers a Retry re-sends, and the env var NAMES still to set there (task 1004062's
+  // manifest — never a value; this platform holds none). Read from the row alone: nothing
+  // here calls Render, and there is no key to hold. `app` is null when the project's app
+  // has no platform chosen.
+  router.get('/provisioning/instances/:id/render', api.requireBuilder, statusLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      // A run that still carries the lent key has not spent it yet: the owner waits.
+      const { rows } = await pool.query(
+        `SELECT EXISTS (SELECT 1 FROM provisioning_intents WHERE instance_id = $1 AND state IN ('pending', 'running') AND borrowed_key_enc IS NOT NULL) AS waiting`,
+        [id]);
+      const app = appStatus(inst.app_host, { keyWaiting: !!(rows[0] && rows[0].waiting) });
+      const dbSet = !!(inst.app_host && inst.app_host.database === true);
+      const envVars = app && app.state !== 'disconnected'
+        ? (await envManifest.listEnvVars(pool, id)).map((v) => ({ name: v.name, required: v.required !== false, set_for_you: dbSet && v.name === 'DATABASE_URL' }))
+        : [];
+      res.json({ ok: true, app, env_vars: envVars, values_held: false });
+    } catch (err) {
+      log.error('[provisioning] GET /provisioning/instances/:id/render', err && err.message);
+      failFrom(res, err, 'render_status_failed');
+    }
+  });
 
   // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
   // ONLY: the key is the owner's and so is the account it acts in, so an archon on
@@ -51,10 +122,14 @@ module.exports = function buildRenderStandupRouter() {
       web_plan: { type: 'string', maxLength: 40 },
       db_plan: { type: 'string', maxLength: 40 },
       region: { type: 'string', maxLength: 40 },
+      runtime: { type: 'string', maxLength: 20 },
+      build_command: { type: 'string', maxLength: 500 },
+      start_command: { type: 'string', maxLength: 500 },
+      database: { type: 'boolean' },
     })) return;
     try {
       const inst = await provisioning.getInstanceById(pool, id);
-      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
       const bad = renderStandup.badRequest(req.body);
       if (bad) return res.fail('render_request_invalid', { status: 400, message: bad });
       const why = unavailableReason(inst, req.body.mode);
@@ -75,10 +150,10 @@ module.exports = function buildRenderStandupRouter() {
         instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-standup',
         detail: `Render ${appHost.mode === 'adopt' ? 'link' : 'setup'} requested by owner (workspace ${appHost.ownerId})`, actor: 'api:self',
       }).catch(() => {});
-      res.json({ ok: true, queued: true, action: 'render-standup', mode: appHost.mode,
+      res.json({ ok: true, queued: true, action: 'render-standup', mode: appHost.mode, with_setup: !!r.attached,
         message: appHost.mode === 'adopt'
           ? 'Queued. The platform will check the service in your Render account and link it, without changing anything there. Your key is used once and then thrown away.'
-          : 'Queued. The platform will create your database and web service in your Render account. Your key is used once and then thrown away; Render bills you directly.' });
+          : `Queued. The platform will create ${appHost.database ? 'a database and ' : ''}a web service for your app in your Render account. Your key is used once and then thrown away; Render bills you directly.` });
     } catch (err) {
       // Never log the request: it carries the key.
       log.error('[provisioning] POST /provisioning/instances/:id/render', err && err.message);

package/modules/provisioning/starter-bundles.js

@@ -73,7 +73,10 @@ const ALWAYS_ON_CORE = Object.freeze([
 // the hub creates receives those releases, so none is offered the publisher's page. It
 // is package-agnostic by construction, so offering it to a project that publishes its
 // own npm package is a later, deliberate removal from this list — with picker copy.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release']);
+// `render-deploy` (task 1004270) is the deploy page of a project whose app deploys through
+// Render: it is turned on by the connect-Render step, never chosen in this picker, so it is
+// kept out of the opt-in catalog by the same list.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/modules/public-landing/public/account-private.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The account page for a private account with its record hidden and no published profile yet (task 1004259): the recruiter copy shrinks to name and picture and says it is the one exception to 'not found', the record line says nothing has been reported and that the profile is not published, and the empty profile fields show their placeholders. stub.fixtures points the account read at fixtures/me-cross-project-private.json.",
+  "page": "/account",
+  "surface": "public-landing",
+  "stub": { "fixtures": { "me__cross-project": "me-cross-project-private" } },
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me/cross-project$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me/cross-project", "\\b401\\b", "Unauthorized"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "in-private": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#recWhat"], "checked": "input[name=visibility][value=private]", "value": [["#fName", ""], ["#fBio", ""]], "text": [["#recordLine", "No cross-project activity reported yet. Your profile is not published yet; it publishes after your next sign-in."]] } }
+  }
+}