@bongos/core 1.19.141 → 1.19.143

package/tests/provisioning_slug_available.mjs

@@ -0,0 +1,243 @@
+// tests/provisioning_slug_available.mjs
+//
+// GET /provisioning/slug-available (task 1002898 N10). The create wizard declared
+// '<slug>.<apex> — yours from the moment it stands up' on FORMAT validation alone;
+// no availability route existed anywhere, so a collision surfaced only as a 409 at
+// the final Create click. This route answers the same question POST
+// /provisioning/instances will, and the panel now waits for it before promising.
+//
+// The contract under test is AGREEMENT with the create route — the route is only
+// worth having if its three refusals match the three ways create actually answers:
+//   taken    → another builder holds the slug   → create 409s slug_taken
+//   yours    → the CALLER holds it              → create is an idempotent re-request
+//   reserved → row free, <slug>.<apex> reserved → create 400s domain_reserved
+// plus the same trim+lowercase normalization and the same isValidSlug bar, and the
+// same byte-exact `slug text UNIQUE` lookup (no lower(slug), which would over-report).
+//
+// Also pinned: it requires a session (NOT public — the answer is a yes/no about every
+// project slug on the instance) and it is rate-limited (same reason).
+//
+// DB-free: data-access fns are stubbed on the cached module object (the
+// provisioning_default_domain.mjs harness). No network.
+//
+// Run:  node tests/provisioning_slug_available.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── harness ─────────────────────────────────────────────────────────────────
+let slugHolder = null;        // what getInstanceBySlug returns
+let lookedUp = [];            // the exact string the route handed the lookup
+provisioning.getInstanceBySlug = async (_db, s) => { lookedUp.push(s); return slugHolder; };
+
+const api = require('../src/module-api.js');
+let authOk = true;            // flipped to prove the route is gated, not public
+api.requireBuilder = (req, res, next) => {
+  if (!authOk) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id: 7, github_login: 'owner' };
+  next();
+};
+api.requirePermission = () => (_req, _res, next) => next();
+let brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+api.branding = () => ({ domains: brandingDomains, identity: { productName: 'Cloud Bongos' } });
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+
+// Each app gets its OWN router — and therefore its own fresh rate-limit bucket, so
+// the limiter test cannot be starved (or starve) the correctness tests.
+function mount() {
+  const app = express();
+  app.use(express.json());
+  app.use((_req, res, next) => {
+    res.fail = (code, opts, details) => {
+      const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+      res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+    };
+    next();
+  });
+  app.use('/api/bongos', provisioningRoutes());
+  return app;
+}
+
+const server = mount().listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function get(path, origin = base) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${origin}${path}`, { method: 'GET' }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => {
+        let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, body: j, raw: d, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const heldBy = (ownerId) => ({ id: 41, owner_builder_id: ownerId, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' });
+
+function reset() {
+  slugHolder = null;
+  lookedUp = [];
+  authOk = true;
+  brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+}
+
+// ── the answer, and its agreement with the create route ─────────────────────
+console.log('GET /provisioning/slug-available — the verdict:');
+
+await ta('a free handle → available, with the address create would assign', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(res.body, { slug: 'spike', available: true, reason: null, address: 'spike.cloudbongos.com' });
+});
+
+await ta("held by ANOTHER builder → taken (the create route's 409 slug_taken)", async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'taken');
+});
+
+await ta("held by the CALLER → 'yours', never 'taken' — create re-requests it, it is not a new project", async () => {
+  reset();
+  slugHolder = heldBy(7);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'yours', 'the caller must not be told a stranger holds it');
+});
+
+await ta('the holder row NEVER travels — only the verdict', async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.deepEqual(Object.keys(res.body).sort(), ['address', 'available', 'reason', 'slug']);
+  assert.doesNotMatch(res.raw, /owner_builder_id|status|"id"/, 'no instance shape may leak');
+});
+
+await ta("a free row whose <slug>.<apex> is platform-reserved → 'reserved' (create 400s domain_reserved)", async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'reserved');
+  // agrees with the helper the create route itself calls
+  assert.equal(provisioning.isReservedHostname('www.cloudbongos.com', 'cloudbongos.com'), true);
+});
+
+await ta('a taken row wins over reserved — the row is the uniqueness rule', async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.body.reason, 'taken');
+});
+
+// ── normalization: the same sequence the create route runs ──────────────────
+console.log('\nnormalization — must match the create route byte for byte:');
+
+await ta('trim + lowercase before the lookup, exactly as create does', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=%20%20SPIKE%20%20');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.slug, 'spike', 'the normalized handle is echoed back');
+  assert.deepEqual(lookedUp, ['spike'], 'the UNIQUE index is byte-exact — the lookup must be too');
+});
+
+await ta('an invalid handle → 400 bad_slug, the same bar and reason string as create', async () => {
+  for (const bad of ['a', '-bad', 'bad-', 'do--uble', 'Nope!', '', 'x'.repeat(41)]) {
+    reset();
+    const res = await get(`/provisioning/slug-available?slug=${encodeURIComponent(bad)}`);
+    assert.equal(res.status, 400, `${JSON.stringify(bad)} → ${res.raw}`);
+    assert.equal(res.body.error.code, 'bad_slug');
+    assert.match(res.body.error.reason, /lowercase, 2–40 chars/);
+  }
+});
+
+await ta('a missing slug param → 400 bad_slug, never a lookup', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available');
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_slug');
+  assert.deepEqual(lookedUp, [], 'nothing may reach the database');
+});
+
+await ta('a blank apex (self-host) still answers availability, with no address to promise', async () => {
+  reset();
+  brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: '' };
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.address, null, 'nothing to assign → nothing to name');
+  assert.equal(res.body.available, true, 'with no apex there is no reserved address to collide with');
+});
+
+// ── the gate + the throttle ─────────────────────────────────────────────────
+console.log('\nthe gate and the throttle — it is an enumeration oracle:');
+
+await ta('requires a session — this route is NOT public', async () => {
+  reset();
+  authOk = false;
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 401, res.raw);
+  assert.deepEqual(lookedUp, [], 'an unauthenticated caller learns nothing');
+});
+
+await ta('the limiter keys on the BUILDER, not the IP — one office address cannot starve itself', async () => {
+  reset();
+  const RL = require('../modules/provisioning/rate-limit.js');
+  // default key is still the IP (the public tls-check/status limiters depend on it)
+  assert.equal(RL.clientIp({ ip: '203.0.113.7' }), '203.0.113.7');
+  const seen = [];
+  const limiter = RL.makeAskRateLimiter({ max: 1, key: (req) => `b:${req.builder.id}` });
+  const runFor = (id) => new Promise((resolve) => {
+    const res = { set() {}, status(c) { this._c = c; return this; }, json(b) { resolve({ status: this._c, body: b }); } };
+    limiter({ ip: '203.0.113.7', builder: { id } }, res, () => { seen.push(id); resolve({ status: 200 }); });
+  });
+  assert.equal((await runFor(7)).status, 200, 'builder 7 gets its first call');
+  assert.equal((await runFor(7)).status, 429, 'and is throttled on its second');
+  assert.equal((await runFor(8)).status, 200,
+    'a DIFFERENT builder on the same IP still gets through — the bucket is per-builder');
+  assert.deepEqual(seen, [7, 8]);
+});
+
+await ta('rate-limited — a crawler is shed with 429 + Retry-After', async () => {
+  reset();
+  const rlServer = mount().listen(0);
+  await new Promise((r) => rlServer.once('listening', r));
+  const rlBase = `http://127.0.0.1:${rlServer.address().port}/api/bongos`;
+  try {
+    let limited = null;
+    // the limiter's cap is 30/min/IP; walk past it and the next answer must be 429
+    for (let i = 0; i < 40 && !limited; i++) {
+      const res = await get(`/provisioning/slug-available?slug=spike${i}`, rlBase);
+      if (res.status === 429) limited = res;
+    }
+    assert.ok(limited, 'the route must stop answering under a flood');
+    assert.equal(limited.body.error, 'rate_limited');
+    assert.ok(Number(limited.headers['retry-after']) > 0, 'Retry-After must tell the caller when');
+  } finally {
+    rlServer.close();
+  }
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/public_landing_projects.mjs

@@ -251,6 +251,124 @@ test('the create-repo response keeps the html_url it already returned', async ()
   assert.match(fn, /saveDraft\(\)/, 'the draft is persisted after the URL lands on state');
 });
 
+/* ── The address step's three choices (task 1002898 N2 / N8 / N10) ───────────
+   One root: the create path asserted things it had not verified. The step offered
+   an address it had not checked was free, hid the no-address opt-out under a fold
+   labelled the OPPOSITE choice, and re-sent a client-derived default the server
+   already owns. ── */
+
+test('the no-address opt-out is visible at the step, not folded under "a domain I own" (N8)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const panel = (body.match(/<div class="addrConfirm" id="addrConfirm">([\s\S]*?)\n {14}<\/div>/) || [, ''])[1];
+  assert.ok(panel, 'the address confirmation box must be extractable');
+  const fold = (panel.match(/<details id="addrCustom">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold, 'the bring-your-own-domain disclosure still exists');
+  assert.match(fold, /id="f-domain"/, 'the domain field is what the fold is FOR');
+  assert.doesNotMatch(fold, /f-noaddr/,
+    'the opt-out for NO address may not live under a fold labelled "use a domain I own"');
+  assert.match(panel, /<\/details>[\s\S]*id="f-noaddr"/,
+    'the opt-out sits after the disclosure, in the open');
+  // all three choices legible at once: assigned address, own domain, no address
+  assert.match(panel, /id="addrAssigned"/);
+  assert.match(fold, /Use a domain I own instead/);
+  assert.match(panel, /Start without an address/);
+});
+
+test('the ownership promise is gated on the availability answer, never on format (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderAddrPanel\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderAddrPanel() must be extractable');
+  // the promise now rides a branch that requires the server's verdict
+  assert.match(fn, /avail === 'free'[\s\S]{0,200}yours from the moment it stands up/,
+    "'yours from the moment it stands up' must only render on a free verdict");
+  // and the honest alternatives exist rather than a single optimistic string
+  assert.match(fn, /already taken/, 'a taken handle is said, not confirmed');
+  assert.match(fn, /you already have that one/i, "the caller's own handle reads as theirs, not as a stranger's");
+  assert.match(fn, /reserved by the platform/, 'a platform-reserved address is said');
+  assert.match(fn, /checking that it’s free/, 'the in-flight state has its own calm rung');
+  // the degrade: an unanswered check names the address WITHOUT promising it
+  assert.match(fn, /the address it would take/, 'no answer degrades to naming, not promising');
+  assert.match(fn, /couldn’t check whether that handle is free/, 'and says so honestly');
+});
+
+test('the availability check is debounced, generation-guarded, and fails to "unknown" (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function checkSlugAvailable\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'checkSlugAvailable() must be extractable');
+  assert.match(fn, /\/provisioning\/slug-available\?slug=/, 'it asks the real route');
+  assert.match(fn, /encodeURIComponent\(slug\)/, 'the handle is encoded into the query');
+  assert.match(fn, /clearTimeout\(slugCheckT\)[\s\S]*setTimeout\(/, 'debounced on a timer');
+  assert.match(fn, /myGen !== slugCheckGen/, 'a stale in-flight answer cannot overwrite a newer one');
+  assert.match(fn, /catch[\s\S]*state: 'unknown'/, 'a failed check is never read as free');
+  // a verdict only counts for the handle it was asked about
+  const guard = (body.match(/function slugAvailState\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.match(guard, /slugAvail\.slug === state\.slug/, 'a verdict for another handle is not trusted');
+});
+
+test('only a DEFINITE negative blocks the step — unknown and checking never gate it (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function validateStep\(step\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'validateStep() must be extractable');
+  const gate = (fn.match(/if \(!state\.domain && !state\.noAddress\) \{[\s\S]*?\n {8}\}/) || [''])[0];
+  assert.ok(gate, 'the availability gate must be extractable');
+  assert.match(gate, /av === 'taken' \|\| av === 'yours' \|\| av === 'reserved'/,
+    'exactly the three definite negatives block');
+  assert.doesNotMatch(gate, /'unknown'|'checking'/,
+    'an unanswered or in-flight check must never trap the owner on the step');
+});
+
+test("the wizard's validSlug() agrees with the server's isValidSlug(), handle for handle (N10)", async () => {
+  // The whole availability contract is "answer what create would answer" — but the
+  // page gates on its OWN hand-copied validSlug() before it even asks. If the two
+  // drift, the wizard promises (or refuses) an address the server would not, which is
+  // the exact class of dishonesty N10 exists to close. Run both over the same corpus.
+  const { body } = await request('/projects', 'game.test.local');
+  const src = (body.match(/(function validSlug\(s\)\s*\{[\s\S]*?\n    \})/) || [, ''])[1];
+  assert.ok(src, 'validSlug() must be extractable');
+  const clientValid = new Function('s', `${src}\nreturn validSlug(s);`);
+  const { createRequire } = await import('node:module');
+  const require = createRequire(import.meta.url);
+  const serverValid = require('../modules/provisioning/provisioning.js').isValidSlug;
+
+  const corpus = [
+    'mercury', 'a1', 'x'.repeat(40), 'has-dash', 'a-b-c', '0start', 'end0',
+    'a', '', 'x'.repeat(41), '-lead', 'trail-', 'do--uble', 'UPPER', 'sp ace',
+    'dot.ted', 'under_score', 'bang!', 'uni✦code', '--', '-', 'a--b',
+  ];
+  for (const s of corpus) {
+    assert.equal(clientValid(s), serverValid(s),
+      `validSlug(${JSON.stringify(s)}) disagrees: page=${clientValid(s)} server=${serverValid(s)}`);
+  }
+});
+
+test('the create POST lets the SERVER assign the default address (N2)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // the wizard may only carry a bring-your-own domain; the <slug>.<apex> default is
+  // the server's (task 1002704), and re-asserting a client-derived copy could only
+  // disagree with it
+  assert.match(body, /domain: byoDomain\(\) \|\| undefined/,
+    'only a bring-your-own domain travels in the create body');
+  assert.doesNotMatch(body, /domain: resolvedDomain\(\) \|\| undefined/,
+    'the client-derived assigned default must no longer be re-sent');
+  const fn = (body.match(/function byoDomain\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'byoDomain() must be extractable');
+  assert.match(fn, /looksLikeDomain\(state\.domain\)/, 'and only a domain that parses');
+  // the opt-out is still the only thing that means "no address"
+  assert.match(body, /no_address: state\.noAddress \? true : undefined/,
+    'the explicit opt-out shape must survive — an absent domain now means "assign one"');
+  // resolvedDomain() still drives what the page DISPLAYS; it just stops driving the wire
+  assert.match(body, /resolvedDomain\(\)/, 'the display path keeps its own resolver');
+});
+
+test('the done panel promises the address the SERVER assigned, not our preview (N2)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /var madeDomain = \(data\.instance && data\.instance\.domain\) \|\| '';/,
+    'the created-instance stash reads the address off the create response');
+  assert.match(body, /domain: madeDomain/, 'and stashes that, not resolvedDomain()');
+  assert.match(body, /noaddr: !madeDomain/,
+    'no address on the row IS the no-address state — derived, not re-asserted');
+});
+
 test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');