@bongos/core 1.19.170 → 1.19.172

package/tests/profile_ui_cross_project.mjs

@@ -0,0 +1,182 @@
+// tests/profile_ui_cross_project.mjs — the profile page's cross-project section
+// (task 1002280, R04 · goal 1000045, ADR 0171).
+//
+// EXECUTES the real modules/hall-ui/public/profile.js in a minimal DOM stub
+// (the hall_signout.mjs pattern) against canned API responses, and asserts the
+// consent-sensitive render contract:
+//
+//   - no `cross_project` key in the response (vanilla instance) → the section
+//     stays hidden entirely;
+//   - `cross_project: null` (hidden / provisional / none — indistinguishable by
+//     design) → the "keeps their track record private" line renders and NOTHING
+//     derived from the rollup does (no tiles, no digits — a count plus a hidden
+//     total is a leak by subtraction);
+//   - the self hide-toggle is client-side only (ADR 0171 D4): the Settings link
+//     renders iff the /me id matches the profile id, on both the ?id= and the
+//     own-profile load paths;
+//   - the full object renders totals tiles, named project rows (https origins
+//     linked, anything else plain text), `rank_held` as plain text — never the
+//     local rank-badge component (spec Decision 1) — and the counted-never-named
+//     "+N more" line.
+//
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
+const HTML = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.html'), 'utf8');
+
+// ---- fixtures -------------------------------------------------------------
+
+const BUILDER = {
+  id: 7, github_login: 'pheidias', display_name: 'Pheidias', avatar_url: null,
+  rank: 'metic', total_credits: 120, karma: 3, created_at: '2026-01-01T00:00:00.000Z',
+  preferred_disciplines: ['engineer'],
+};
+
+const CP_FULL = {
+  totals: { projects: 3, credits: 150, works_shipped: 7, karma: 4 },
+  disciplines: ['engineer', 'ui'],
+  last_active: '2026-08-01T00:00:00.000Z',
+  projects: [
+    { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' },
+    { name: 'Odd Origin', origin: 'http://insecure.example', rank_held: null },
+  ],
+  more_projects: 1,
+};
+
+const baseProfile = () => ({ builder: { ...BUILDER }, shipped_count: 1, recent_ships: [], achievements: [] });
+
+// ---- harness --------------------------------------------------------------
+
+// Boot profile.js with canned /me + profile responses; returns the memoised
+// element map after the async load() settles.
+async function boot({ search = '', me, profile } = {}) {
+  const els = new Map();
+  const makeEl = () => ({
+    hidden: false, textContent: '', _html: '',
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
+  // Mirror the markup: the section ships with the `hidden` attribute.
+  $('#xp-scroll').hidden = true;
+
+  const escapeHtml = (s) => String(s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const api = {
+    async request(_method, url) {
+      if (url === '/api/bongos/me') return me ?? { status: 401, ok: false, data: null };
+      if (/\/builders\/[^/]+\/profile$/.test(url)) return profile ?? { status: 404, ok: false, data: null };
+      return { status: 404, ok: false, data: null };
+    },
+  };
+  const windowObj = {
+    __BRANDING__: {},
+    BongosClient: { createClient: () => api },
+    OTB: {
+      $, escapeHtml,
+      fmtNum: (n) => String(Number(n) || 0),
+      fmtDate: (d) => String(d).slice(0, 10),
+      rankLabel: (r) => r,
+      toast() {},
+    },
+  };
+  const sandbox = {
+    window: windowObj, location: { search }, URLSearchParams, console,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'profile.js' });
+  // load() is fire-and-forget; let its await chain settle.
+  for (let i = 0; i < 4; i++) await new Promise((r) => setImmediate(r));
+  return { els, $ };
+}
+
+const meOk = (id) => ({ status: 200, ok: true, data: { builder: { id } } });
+const profileOk = (data) => ({ status: 200, ok: true, data });
+
+// ---- the markup ships the section hidden ----------------------------------
+
+test('profile.html carries the hidden cross-project section + reserved slots', () => {
+  assert.match(HTML, /<section[^>]*id="xp-scroll"[^>]*hidden>/, 'the section must ship hidden — it reveals only when the response carries a cross_project key');
+  assert.match(HTML, /Reserved slots[\s\S]*connections, guilds, and actions/, 'the spec Decision 5 slot reservation must stay in the layout');
+});
+
+// ---- vanilla instance: key absent → section absent -------------------------
+
+test('no cross_project key (vanilla instance) → the section stays hidden', async () => {
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(baseProfile()) });
+  assert.equal($('#xp-scroll').hidden, true);
+  assert.equal($('#xp-body').innerHTML, '');
+});
+
+// ---- cross_project: null → private line, nothing derived -------------------
+
+test('cross_project null, stranger view → private line only, no numbers, no self link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(data) });
+  const xp = $('#xp-scroll');
+  const html = $('#xp-body').innerHTML;
+  assert.equal(xp.hidden, false, 'on the hub the section reveals even when the record is private');
+  assert.match(html, /keeps their track record private/);
+  assert.ok(!html.includes('stat-tile'), 'no tiles in the private state');
+  assert.ok(!/\d/.test(html), 'no digits at all — no partial numbers (leak by subtraction)');
+  assert.ok(!html.includes('/settings#cross-project'), 'no self link for a stranger');
+});
+
+test('cross_project null, self view via ?id= → private line + the Settings link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  // /me id as a STRING (pg bigint serialization) against the numeric profile id
+  // — self-detection must be serialization-proof.
+  const { $ } = await boot({ search: '?id=7', me: meOk('7'), profile: profileOk(data) });
+  const html = $('#xp-body').innerHTML;
+  assert.match(html, /keeps their track record private/);
+  assert.ok(html.includes('/settings#cross-project'), 'the self hide-toggle links to Settings → Cross-project record');
+});
+
+test('self view with no ?id= (own-profile path) also gets the Settings link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  const { $ } = await boot({ search: '', me: meOk(7), profile: profileOk(data) });
+  assert.ok($('#xp-body').innerHTML.includes('/settings#cross-project'));
+});
+
+// ---- the full record -------------------------------------------------------
+
+test('full cross_project → tiles, named rows, plain-text standing, +N more', async () => {
+  const data = { ...baseProfile(), cross_project: CP_FULL };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(data) });
+  const xp = $('#xp-scroll');
+  const html = $('#xp-body').innerHTML;
+  assert.equal(xp.hidden, false);
+  assert.equal((html.match(/stat-tile__num/g) || []).length, 4, 'projects / works shipped / credits / karma tiles');
+  assert.match(html, /Public Proj/);
+  assert.ok(html.includes('href="https://pub.example"'), 'a well-formed https origin links out');
+  assert.match(html, /Odd Origin/);
+  assert.ok(!html.includes('href="http://insecure.example"'), 'a non-https origin renders as plain text');
+  assert.match(html, /Metic/, 'rank_held renders capitalized as that project\'s own standing');
+  assert.ok(!html.includes('rank-badge'), 'never the local rank-badge component for another project\'s rank (spec Decision 1)');
+  assert.match(html, /\+ 1 more project/, 'non-public projects are counted, never named');
+  assert.match(html, /Disciplines: engineer, ui/);
+  assert.match(html, /Last active 2026-08-01/);
+  assert.ok(!html.includes('/settings#cross-project'), 'no self link for a stranger');
+});
+
+test('zero-activity record → the empty line, no project table', async () => {
+  const cp = { ...CP_FULL, projects: [], more_projects: 0 };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk({ ...baseProfile(), cross_project: cp }) });
+  const html = $('#xp-body').innerHTML;
+  assert.match(html, /No cross-project activity reported yet\./);
+  assert.ok(!html.includes('<table'), 'no empty ledger');
+});
+
+// ---- signed-out empty state ------------------------------------------------
+
+test('signed-out visitor with no ?id= → empty state keeps the section hidden', async () => {
+  const { $ } = await boot({ search: '', me: { status: 401, ok: false, data: null } });
+  assert.equal($('#xp-scroll').hidden, true);
+});