@bongos/core 1.19.1081 → 1.20.2

package/tests/provisioning_app_status.mjs

@@ -0,0 +1,204 @@
+// tests/provisioning_app_status.mjs — what the owner is told about their app's setup on
+// Render, and the knock that says when it is live (task 1004353).
+//
+// The load-bearing assertions:
+//   • the read is OWNER ONLY, returns env var NAMES only, and never the key or a value
+//   • a failure comes back as one sentence, with the answers a Retry re-sends — the
+//     answers only, never a key
+//   • an app address is only ever an onrender.com one, and a Render link is only ever
+//     built from a checked service id — a stored value cannot shape either
+//   • the poller marks an app live only when it answers at that address, never on
+//     Render's no-deploy page, never on a 5xx; it follows no redirect; and its write is
+//     compare-and-set, so it never overwrites what the runner wrote since
+//
+// DB-free and network-free. Run:  node tests/provisioning_app_status.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers } = require('../modules/provisioning/app-status.js');
+const liveness = require('../modules/provisioning/pollers/app-liveness.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOST = { platform: 'render', mode: 'greenfield', ownerId: 'tea-aaaaaaaa1111', serviceId: 'srv-aaaaaaaa1111', serviceUrl: 'https://demo.onrender.com',
+  runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', webPlan: 'starter', database: true, dbPlan: 'basic_256mb' };
+
+console.log('the status (app-status.js):');
+await ta('no app host, or another platform → null', () => {
+  assert.equal(appStatus(null), null);
+  assert.equal(appStatus({ platform: 'vercel' }), null);
+});
+await ta('each runner state maps to the stage the owner sees', () => {
+  const stage = (state) => appStatus({ ...HOST, state }).stage;
+  assert.equal(stage('requested'), 'creating');
+  assert.equal(stage('creating'), 'creating');
+  assert.equal(stage('deploying'), 'building');
+  assert.equal(stage('linked'), 'building', 'a link waits for the app to answer too');
+  assert.equal(stage('live'), 'live');
+  assert.equal(appStatus({ ...HOST, state: 'failed', error: 'x' }).stage, null, 'a failure is not a stage');
+});
+await ta('a live app carries its address and the two Render links', () => {
+  const s = appStatus({ ...HOST, state: 'live' });
+  assert.equal(s.url, 'https://demo.onrender.com');
+  assert.deepEqual(s.links, { service: 'https://dashboard.render.com/web/srv-aaaaaaaa1111', env: 'https://dashboard.render.com/web/srv-aaaaaaaa1111/env' });
+  assert.equal(s.error, null);
+  assert.equal(s.retry, null);
+});
+await ta('a stored value cannot shape the address or a link', () => {
+  assert.equal(appUrl('https://evil.example.com'), null);
+  assert.equal(appUrl('http://demo.onrender.com'), null, 'https only');
+  assert.equal(appUrl('https://demo.onrender.com.evil.io'), null);
+  assert.equal(appUrl('javascript:alert(1)'), null);
+  assert.equal(serviceLinks('srv-x/../../account'), null);
+  assert.equal(serviceLinks(null), null);
+});
+await ta('a failure is ONE sentence, and a Retry re-sends the answers — never a key', () => {
+  const s = appStatus({ ...HOST, state: 'failed', error: 'this Render key cannot reach workspace tea-aaaaaaaa1111\nstack…' });
+  assert.equal(s.error, 'This Render key cannot reach workspace tea-aaaaaaaa1111.');
+  assert.deepEqual(s.retry, { owner_id: 'tea-aaaaaaaa1111', mode: 'greenfield', runtime: 'node', start_command: 'npm start', build_command: 'npm ci', web_plan: 'starter', database: true, db_plan: 'basic_256mb' });
+  assert.ok(!('key' in s.retry));
+  assert.equal(oneSentence(''), 'The setup stopped without saying why.');
+  assert.deepEqual(retryAnswers({ mode: 'adopt', ownerId: 'tea-aaaaaaaa1111', serviceId: 'srv-aaaaaaaa1111' }), { owner_id: 'tea-aaaaaaaa1111', mode: 'adopt', service_id: 'srv-aaaaaaaa1111' });
+  assert.deepEqual(retryAnswers({ mode: 'greenfield', ownerId: 'tea-aaaaaaaa1111', runtime: 'docker', startCommand: 'ignored' }), { owner_id: 'tea-aaaaaaaa1111', mode: 'greenfield', runtime: 'docker', database: false });
+});
+await ta('a run still holding the lent key reads as waiting, not as something to retry', () => {
+  const s = appStatus({ ...HOST, state: 'requested' }, { keyWaiting: true });
+  assert.equal(s.waiting, true);
+  assert.equal(s.retry, null);
+});
+
+console.log('\nGET /provisioning/instances/:id/render:');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const envManifest = require('../modules/provisioning/env-manifest.js');
+const api = require('../src/module-api.js');
+let instance = null, builder = null, waiting = false, queries = [];
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+envManifest.listEnvVars = async () => [
+  { name: 'DATABASE_URL', required: true, description: 'x' },
+  { name: 'SESSION_SECRET', required: true },
+  { name: 'STRIPE_KEY', required: false },
+];
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+Object.defineProperty(api, 'pool', { configurable: true, get: () => ({ query: async (sql, p) => { queries.push(sql); return { rows: [{ waiting }] }; } }) });
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/render-standup.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => { res.fail = (code, opts) => res.status((opts && opts.status) || (typeof opts === 'number' ? opts : 400)).json({ error: { code } }); next(); });
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const get = (id) => new Promise((resolve, reject) => {
+  http.get(`http://127.0.0.1:${server.address().port}/api/bongos/provisioning/instances/${id}/render`, (res) => {
+    let d = ''; res.on('data', (c) => { d += c; }); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d || '{}'), raw: d }));
+  }).on('error', reject);
+});
+function reset(host) { instance = { owner_builder_id: 7, slug: 'demo', status: 'active', app_host: host }; builder = { id: 7 }; waiting = false; queries = []; }
+
+await ta('the owner reads the status, with env var NAMES only, and DATABASE_URL marked as set for them', async () => {
+  reset({ ...HOST, state: 'live' });
+  const r = await get(18);
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.app.stage, 'live');
+  assert.deepEqual(r.body.env_vars, [
+    { name: 'DATABASE_URL', required: true, set_for_you: true },
+    { name: 'SESSION_SECRET', required: true, set_for_you: false },
+    { name: 'STRIPE_KEY', required: false, set_for_you: false },
+  ]);
+  assert.equal(r.body.values_held, false);
+  assert.doesNotMatch(r.raw, /description|borrowed_key|rnd_/, 'no description, no key column, no key');
+});
+await ta('someone else\'s project — even for an archon — and a missing one are the same 404', async () => {
+  reset({ ...HOST, state: 'live' }); builder = { id: 42, rank: 'archon' };
+  assert.equal((await get(18)).status, 404);
+  reset(null); instance = null;
+  assert.equal((await get(18)).status, 404);
+});
+await ta('no platform chosen → app null, and no env list', async () => {
+  reset(null);
+  const r = await get(18);
+  assert.equal(r.status, 200);
+  assert.equal(r.body.app, null);
+  assert.deepEqual(r.body.env_vars, []);
+});
+await ta('a lent key still waiting on a run reads as waiting', async () => {
+  reset({ ...HOST, state: 'requested' }); waiting = true;
+  const r = await get(18);
+  assert.equal(r.body.app.waiting, true);
+  assert.match(queries[0], /borrowed_key_enc IS NOT NULL/, 'asked as a yes/no — the key column is never selected');
+  assert.doesNotMatch(queries[0], /SELECT borrowed_key_enc/);
+});
+await ta('the read is capped per builder — two surfaces polling fit well inside it', async () => {
+  reset({ ...HOST, state: 'live' }); builder = { id: 777 };
+  let last = null;
+  for (let i = 0; i < 61; i++) last = await get(18);
+  assert.equal(last.status, 429);
+});
+server.close();
+
+console.log('\nthe knock (pollers/app-liveness.js):');
+const res = (status, routing) => ({ status, headers: { get: (h) => (h === 'x-render-routing' ? routing || null : null) } });
+await ta('live only when the app answers: not on the no-deploy page, not on a 5xx, not on an error', async () => {
+  const f = (r) => async () => r;
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(200)) }), true);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(404)) }), true, 'a 404 at the root is still an app answering');
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(502, 'no-deploy')) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(404, 'no-deploy')) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(503)) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: async () => { throw new Error('ECONNRESET'); } }), false);
+});
+await ta('it knocks only on an onrender.com address, and follows no redirect', async () => {
+  const seen = [];
+  const fetchImpl = async (url, init) => { seen.push({ url, redirect: init.redirect, auth: init.headers.Authorization }); return res(200); };
+  assert.equal(await liveness.appAnswers('https://10.0.0.1', { fetchImpl }), false);
+  assert.equal(await liveness.appAnswers('https://metadata.google.internal', { fetchImpl }), false);
+  assert.equal(seen.length, 0, 'never even asked');
+  await liveness.appAnswers('https://demo.onrender.com', { fetchImpl });
+  assert.equal(seen[0].redirect, 'manual');
+  assert.equal(seen[0].auth, undefined, 'no credential of any kind');
+});
+await ta('a sweep marks only answering apps live, compare-and-set on the state it read', async () => {
+  const writes = [];
+  const db = { query: async (sql, params) => {
+    if (/^\s*SELECT/.test(sql)) {
+      assert.match(sql, /app_host->>'state' IN \('deploying', 'linked'\)/);
+      return { rows: [
+        { id: 1, slug: 'up', app_host: { state: 'deploying', serviceUrl: 'https://up.onrender.com' } },
+        { id: 2, slug: 'building', app_host: { state: 'deploying', serviceUrl: 'https://building.onrender.com' } },
+        { id: 3, slug: 'linked', app_host: { state: 'linked', serviceUrl: 'https://linked.onrender.com' } },
+      ] };
+    }
+    writes.push({ sql: sql.replace(/\s+/g, ' '), params });
+    return { rowCount: 1 };
+  } };
+  const fetchImpl = async (url) => (url.includes('building') ? res(502, 'no-deploy') : res(200));
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 3, live: 2 });
+  assert.deepEqual(writes.map((w) => w.params), [[1, 'deploying'], [3, 'linked']]);
+  assert.match(writes[0].sql, /WHERE id = \$1 AND app_host->>'state' = \$2/, 'never overwrites what the runner wrote since');
+});
+await ta('the knocks run a few at a time, never all at once and never one by one', async () => {
+  let inFlight = 0, peak = 0;
+  const rows = Array.from({ length: 12 }, (_, i) => ({ id: i + 1, slug: `a${i}`, app_host: { state: 'deploying', serviceUrl: `https://a${i}.onrender.com` } }));
+  const db = { query: async (sql) => (/^\s*SELECT/.test(sql) ? { rows } : { rowCount: 1 }) };
+  const fetchImpl = async () => { inFlight++; peak = Math.max(peak, inFlight); await new Promise((r) => setTimeout(r, 5)); inFlight--; return res(200); };
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 12, live: 12 });
+  assert.equal(peak, 5);
+});
+await ta('the module starts the poller', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('app-liveness'));
+});
+
+console.log(`\nprovisioning_app_status: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_render_route.mjs

@@ -85,17 +85,18 @@ function reset(patch = {}) {
   builder = { id: 7, github_login: 'owner', rank: 'thetes' };
 }
 const PATH = '/provisioning/instances/18/render';
-const GREEN = { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield' };
+const GREEN = { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield', runtime: 'node', start_command: 'npm start' };
 const noKeyAnywhere = (...xs) => xs.forEach((x) => assert.ok(!JSON.stringify(x).includes(KEY), 'the plaintext key leaked: ' + JSON.stringify(x)));
 
 console.log('who may ask:');
 await ta('the owner queues it: ciphertext only, the request recorded on the row, one audit event', async () => {
   reset();
-  const r = await post(PATH, { ...GREEN, web_plan: 'standard' });
+  const r = await post(PATH, { ...GREEN, web_plan: 'standard', build_command: ' npm ci ', database: true });
   assert.equal(r.status, 200, r.raw);
   assert.equal(enqueueCalls.length, 1);
   assert.equal(enqueueCalls[0].keyEnc, `v1.sealed(${KEY.length})`);
-  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null, webPlan: 'standard' });
+  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null,
+    runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', database: true, webPlan: 'standard' });
   assert.equal(events.length, 1);
   noKeyAnywhere(enqueueCalls, events, r.body);
 });
@@ -122,7 +123,13 @@ for (const [name, body, re] of [
   ['an unknown mode', { ...GREEN, mode: 'migrate' }, /link a Render service/],
   ['adopt with no service', { ...GREEN, mode: 'adopt' }, /service to link/],
   ['greenfield naming a service', { ...GREEN, service_id: 'srv-abcdefgh1234' }, /leave the service out/],
-  ['an unknown plan', { ...GREEN, db_plan: 'free' }, /not a Render database plan/],
+  ['an unknown plan', { ...GREEN, database: true, db_plan: 'free' }, /not a Render database plan/],
+  ['a database plan with no database', { ...GREEN, db_plan: 'basic_1gb' }, /needs a database/],
+  ['a new app with no runtime', { ...GREEN, runtime: undefined }, /built with/],
+  ['an unknown runtime', { ...GREEN, runtime: 'cobol' }, /built with/],
+  ['a native runtime with no start command', { ...GREEN, start_command: '  ' }, /how your app starts/],
+  ['docker with commands', { ...GREEN, runtime: 'docker' }, /leave the commands out/],
+  ['adopt saying how to build', { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234', runtime: 'node' }, /exactly as it is/],
 ]) {
   await ta(`${name} → 400, nothing kept`, async () => {
     reset();
@@ -141,9 +148,17 @@ await ta('an unknown field is refused by the strict validator', async () => {
 });
 await ta('adopt with a service id is accepted and records it', async () => {
   reset();
-  const r = await post(PATH, { ...GREEN, mode: 'adopt', service_id: 'srv-abcdefgh1234' });
+  const r = await post(PATH, { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234' });
   assert.equal(r.status, 200, r.raw);
   assert.equal(enqueueCalls[0].appHost.serviceId, 'srv-abcdefgh1234');
+  assert.equal(enqueueCalls[0].appHost.runtime, undefined, 'a link records nothing about building');
+});
+await ta('docker needs no commands, and no database is the default', async () => {
+  reset();
+  const r = await post(PATH, { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield', runtime: 'docker' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual([enqueueCalls[0].appHost.runtime, enqueueCalls[0].appHost.startCommand, enqueueCalls[0].appHost.database], ['docker', undefined, false]);
+  assert.doesNotMatch(r.body.message, /database/, 'the receipt does not promise a database');
 });
 
 console.log('\nrefusals keep nothing:');
@@ -187,13 +202,118 @@ await ta('one statement writes the intent with the ciphertext and merges the row
 });
 await ta('a collision on the open-intent index stores nothing and names the blocker', async () => {
   let n = 0;
-  const db = { query: async () => { if (n++ === 0) throw Object.assign(new Error('dup'), { code: '23505' }); return { rows: [{ id: 3, action: 'teardown', state: 'pending' }] }; } };
+  const db = { query: async () => { const i = n++; if (i === 0) throw Object.assign(new Error('dup'), { code: '23505' }); if (i === 1) return { rows: [] }; return { rows: [{ id: 3, action: 'teardown', state: 'pending' }] }; } };
   const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { mode: 'greenfield', ownerId: 'tea-abcdefgh1234' } });
   assert.equal(out.conflict, 'open_intent');
   assert.equal(out.intent.action, 'teardown');
 });
+await ta('a Create still being set up takes the key onto its OWN run (task 1004352)', async () => {
+  const sqls = []; let n = 0;
+  const db = { query: async (sql, params) => { sqls.push({ sql, params }); if (n++ === 0) throw Object.assign(new Error('dup'), { code: '23505' }); return { rows: [{ id: 7, action: 'provision', state: 'running' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234' } });
+  assert.equal(out.attached, true);
+  assert.equal(out.intent.action, 'provision');
+  assert.equal(out.conflict, undefined);
+  const attach = sqls[1].sql.replace(/\s+/g, ' ');
+  assert.match(attach, /action = 'provision' AND state IN \('pending', 'running'\) AND borrowed_key_enc IS NULL/, 'only an open provision run with no key yet');
+  assert.match(attach, /UPDATE provisioning_instances SET app_host = \$3::jsonb WHERE id = \$1 AND EXISTS \(SELECT 1 FROM i\)/, 'the row is touched only if the key landed');
+  assert.equal(sqls[1].params[1], 'v1.x');
+});
 guard.assertIntentAllowed = realGuard;
 
+console.log('\nPOST /provisioning/render/lookup — what the key can see (ADR 0348):');
+const lookupApp = express();
+lookupApp.use(express.json());
+lookupApp.use((_req, res, next) => { res.fail = (code, opts) => res.status((opts && opts.status) || 400).json({ error: { code, ...(typeof opts === 'object' ? opts : {}) } }); next(); });
+let renderCalls = [], renderAnswers = {};
+const fakeRenderFetch = async (url, init) => {
+  renderCalls.push({ url, method: init.method, auth: init.headers.Authorization, body: init.body });
+  const path = url.replace('https://api.render.com/v1', '');
+  const a = renderAnswers[path];
+  if (a === undefined) return { ok: false, status: 404, json: async () => ({}) };
+  if (typeof a === 'number') return { ok: false, status: a, json: async () => ({}) };
+  return { ok: true, status: 200, json: async () => a };
+};
+lookupApp.use('/api/bongos', buildRouter({ fetchImpl: fakeRenderFetch }));
+const lookupServer = lookupApp.listen(0);
+await new Promise((r) => lookupServer.once('listening', r));
+const lookupBase = `http://127.0.0.1:${lookupServer.address().port}/api/bongos/provisioning/render/lookup`;
+const lookup = (body) => new Promise((resolve, reject) => {
+  const req = http.request(lookupBase, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+    let d = ''; res.on('data', (c) => { d += c; }); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d || '{}'), raw: d }));
+  });
+  req.on('error', reject); req.end(JSON.stringify(body));
+});
+const TEA_A = 'tea-aaaaaaaa1111', TEA_B = 'tea-bbbbbbbb2222';
+function resetLookup() {
+  reset(); renderCalls = [];
+  renderAnswers = {
+    '/owners?limit=100': [{ owner: { id: TEA_A, name: 'Mine', type: 'team' } }, { owner: { id: TEA_B, name: 'A friend\'s team', type: 'team' } }],
+    [`/services?ownerId=${TEA_A}&type=web_service&limit=100`]: [{ service: { id: 'srv-aaaaaaaa1111', name: 'shop', ownerId: TEA_A, repo: 'https://github.com/example-owner/spike', serviceDetails: { url: 'https://shop.onrender.com' } } }],
+  };
+}
+await ta('a key that reaches several workspaces lists them ALL, in Render\'s order, and picks none', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.workspaces.map((w) => w.id), [TEA_A, TEA_B]);
+  assert.equal(r.body.services, undefined, 'no workspace is chosen for the owner, so none is looked into');
+  assert.equal(renderCalls.length, 1);
+  assert.equal(renderCalls[0].auth, `Bearer ${KEY}`);
+  assert.ok(!renderCalls[0].url.includes(KEY), 'the key is never in a URL');
+  noKeyAnywhere(r.body);
+});
+await ta('a refused key says so, in words, and nothing else is called', async () => {
+  resetLookup(); renderAnswers['/owners?limit=100'] = 401;
+  const r = await lookup({ key: KEY });
+  assert.equal(r.status, 422, r.raw);
+  assert.equal(r.body.error.code, 'render_key_refused');
+  assert.match(r.body.error.message, /refused that key/);
+  assert.equal(renderCalls.length, 1);
+  noKeyAnywhere(r.body);
+});
+await ta('the chosen workspace lists its web services, each checked to be from that workspace', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY, owner_id: TEA_A });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.services, [{ id: 'srv-aaaaaaaa1111', name: 'shop', repo: 'https://github.com/example-owner/spike', url: 'https://shop.onrender.com' }]);
+});
+await ta('a service from ANOTHER workspace in the answer shows nothing at all', async () => {
+  resetLookup();
+  renderAnswers[`/services?ownerId=${TEA_A}&type=web_service&limit=100`] = [{ service: { id: 'srv-x', name: 'theirs', ownerId: TEA_B } }];
+  const r = await lookup({ key: KEY, owner_id: TEA_A });
+  assert.equal(r.status, 502, r.raw);
+  assert.equal(r.body.error.code, 'render_owner_mismatch');
+  assert.equal(r.body.services, undefined);
+});
+await ta('a workspace the key cannot reach is refused before its services are asked for', async () => {
+  resetLookup();
+  const r = await lookup({ key: KEY, owner_id: 'tea-cccccccc3333' });
+  assert.equal(r.status, 422, r.raw);
+  assert.equal(renderCalls.length, 1);
+});
+await ta('the lookup only ever GETs', async () => {
+  resetLookup();
+  await lookup({ key: KEY }); await lookup({ key: KEY, owner_id: TEA_A });
+  assert.deepEqual([...new Set(renderCalls.map((c) => c.method))], ['GET']);
+  assert.ok(renderCalls.every((c) => !c.body));
+  const src = readFileSync(new URL('../modules/provisioning/render-lookup.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /method: '(POST|PUT|PATCH|DELETE)'/);
+});
+await ta('a malformed key or workspace never reaches Render', async () => {
+  resetLookup();
+  assert.equal((await lookup({ key: 'ghp_nope' })).status, 400);
+  assert.equal((await lookup({ key: KEY, owner_id: 'srv-aaaaaaaa1111' })).status, 400);
+  assert.equal(renderCalls.length, 0);
+});
+await ta('the lookup is capped per builder', async () => {
+  resetLookup(); builder = { id: 555, github_login: 'burst', rank: 'thetes' };
+  let last = null;
+  for (let i = 0; i < 21; i++) last = await lookup({ key: KEY });
+  assert.equal(last.status, 429);
+});
+lookupServer.close();
+
 console.log('\nwiring:');
 await ta('module.json mounts the route; the action is in the vocabulary and the newest CHECK', () => {
   const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));

package/tests/render_check.mjs

@@ -24,7 +24,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   // sky-data.js is shared by the two doors of one page (task 1004232): /thinking and /goal-map.
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['projects.states.json']);
+  // the account page links the hub's sheet too since task 1004259
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {