@bongos/core 1.19.142 → 1.19.144

package/tests/public_landing_projects.mjs

@@ -251,6 +251,124 @@ test('the create-repo response keeps the html_url it already returned', async ()
   assert.match(fn, /saveDraft\(\)/, 'the draft is persisted after the URL lands on state');
 });
 
+/* ── The address step's three choices (task 1002898 N2 / N8 / N10) ───────────
+   One root: the create path asserted things it had not verified. The step offered
+   an address it had not checked was free, hid the no-address opt-out under a fold
+   labelled the OPPOSITE choice, and re-sent a client-derived default the server
+   already owns. ── */
+
+test('the no-address opt-out is visible at the step, not folded under "a domain I own" (N8)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const panel = (body.match(/<div class="addrConfirm" id="addrConfirm">([\s\S]*?)\n {14}<\/div>/) || [, ''])[1];
+  assert.ok(panel, 'the address confirmation box must be extractable');
+  const fold = (panel.match(/<details id="addrCustom">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold, 'the bring-your-own-domain disclosure still exists');
+  assert.match(fold, /id="f-domain"/, 'the domain field is what the fold is FOR');
+  assert.doesNotMatch(fold, /f-noaddr/,
+    'the opt-out for NO address may not live under a fold labelled "use a domain I own"');
+  assert.match(panel, /<\/details>[\s\S]*id="f-noaddr"/,
+    'the opt-out sits after the disclosure, in the open');
+  // all three choices legible at once: assigned address, own domain, no address
+  assert.match(panel, /id="addrAssigned"/);
+  assert.match(fold, /Use a domain I own instead/);
+  assert.match(panel, /Start without an address/);
+});
+
+test('the ownership promise is gated on the availability answer, never on format (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderAddrPanel\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderAddrPanel() must be extractable');
+  // the promise now rides a branch that requires the server's verdict
+  assert.match(fn, /avail === 'free'[\s\S]{0,200}yours from the moment it stands up/,
+    "'yours from the moment it stands up' must only render on a free verdict");
+  // and the honest alternatives exist rather than a single optimistic string
+  assert.match(fn, /already taken/, 'a taken handle is said, not confirmed');
+  assert.match(fn, /you already have that one/i, "the caller's own handle reads as theirs, not as a stranger's");
+  assert.match(fn, /reserved by the platform/, 'a platform-reserved address is said');
+  assert.match(fn, /checking that it’s free/, 'the in-flight state has its own calm rung');
+  // the degrade: an unanswered check names the address WITHOUT promising it
+  assert.match(fn, /the address it would take/, 'no answer degrades to naming, not promising');
+  assert.match(fn, /couldn’t check whether that handle is free/, 'and says so honestly');
+});
+
+test('the availability check is debounced, generation-guarded, and fails to "unknown" (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function checkSlugAvailable\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'checkSlugAvailable() must be extractable');
+  assert.match(fn, /\/provisioning\/slug-available\?slug=/, 'it asks the real route');
+  assert.match(fn, /encodeURIComponent\(slug\)/, 'the handle is encoded into the query');
+  assert.match(fn, /clearTimeout\(slugCheckT\)[\s\S]*setTimeout\(/, 'debounced on a timer');
+  assert.match(fn, /myGen !== slugCheckGen/, 'a stale in-flight answer cannot overwrite a newer one');
+  assert.match(fn, /catch[\s\S]*state: 'unknown'/, 'a failed check is never read as free');
+  // a verdict only counts for the handle it was asked about
+  const guard = (body.match(/function slugAvailState\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.match(guard, /slugAvail\.slug === state\.slug/, 'a verdict for another handle is not trusted');
+});
+
+test('only a DEFINITE negative blocks the step — unknown and checking never gate it (N10)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function validateStep\(step\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'validateStep() must be extractable');
+  const gate = (fn.match(/if \(!state\.domain && !state\.noAddress\) \{[\s\S]*?\n {8}\}/) || [''])[0];
+  assert.ok(gate, 'the availability gate must be extractable');
+  assert.match(gate, /av === 'taken' \|\| av === 'yours' \|\| av === 'reserved'/,
+    'exactly the three definite negatives block');
+  assert.doesNotMatch(gate, /'unknown'|'checking'/,
+    'an unanswered or in-flight check must never trap the owner on the step');
+});
+
+test("the wizard's validSlug() agrees with the server's isValidSlug(), handle for handle (N10)", async () => {
+  // The whole availability contract is "answer what create would answer" — but the
+  // page gates on its OWN hand-copied validSlug() before it even asks. If the two
+  // drift, the wizard promises (or refuses) an address the server would not, which is
+  // the exact class of dishonesty N10 exists to close. Run both over the same corpus.
+  const { body } = await request('/projects', 'game.test.local');
+  const src = (body.match(/(function validSlug\(s\)\s*\{[\s\S]*?\n    \})/) || [, ''])[1];
+  assert.ok(src, 'validSlug() must be extractable');
+  const clientValid = new Function('s', `${src}\nreturn validSlug(s);`);
+  const { createRequire } = await import('node:module');
+  const require = createRequire(import.meta.url);
+  const serverValid = require('../modules/provisioning/provisioning.js').isValidSlug;
+
+  const corpus = [
+    'mercury', 'a1', 'x'.repeat(40), 'has-dash', 'a-b-c', '0start', 'end0',
+    'a', '', 'x'.repeat(41), '-lead', 'trail-', 'do--uble', 'UPPER', 'sp ace',
+    'dot.ted', 'under_score', 'bang!', 'uni✦code', '--', '-', 'a--b',
+  ];
+  for (const s of corpus) {
+    assert.equal(clientValid(s), serverValid(s),
+      `validSlug(${JSON.stringify(s)}) disagrees: page=${clientValid(s)} server=${serverValid(s)}`);
+  }
+});
+
+test('the create POST lets the SERVER assign the default address (N2)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // the wizard may only carry a bring-your-own domain; the <slug>.<apex> default is
+  // the server's (task 1002704), and re-asserting a client-derived copy could only
+  // disagree with it
+  assert.match(body, /domain: byoDomain\(\) \|\| undefined/,
+    'only a bring-your-own domain travels in the create body');
+  assert.doesNotMatch(body, /domain: resolvedDomain\(\) \|\| undefined/,
+    'the client-derived assigned default must no longer be re-sent');
+  const fn = (body.match(/function byoDomain\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'byoDomain() must be extractable');
+  assert.match(fn, /looksLikeDomain\(state\.domain\)/, 'and only a domain that parses');
+  // the opt-out is still the only thing that means "no address"
+  assert.match(body, /no_address: state\.noAddress \? true : undefined/,
+    'the explicit opt-out shape must survive — an absent domain now means "assign one"');
+  // resolvedDomain() still drives what the page DISPLAYS; it just stops driving the wire
+  assert.match(body, /resolvedDomain\(\)/, 'the display path keeps its own resolver');
+});
+
+test('the done panel promises the address the SERVER assigned, not our preview (N2)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /var madeDomain = \(data\.instance && data\.instance\.domain\) \|\| '';/,
+    'the created-instance stash reads the address off the create response');
+  assert.match(body, /domain: madeDomain/, 'and stashes that, not resolvedDomain()');
+  assert.match(body, /noaddr: !madeDomain/,
+    'no address on the row IS the no-address state — derived, not re-asserted');
+});
+
 test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');