@bongos/core 1.19.173 → 1.19.174

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.173",
-  "core_contract": "1.19.173",
-  "source_commit": "dfc63944c504d88bf4ebb93b033c06b7b3b472a7",
+  "core_version": "1.19.174",
+  "core_contract": "1.19.174",
+  "source_commit": "01b7a9adb8720d04035ce515c8ed16155486b694",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:48:53.327Z",
+  "built_at": "2026-08-16T19:56:25.262Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1272,
+    "functional_verbatim": 1273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1598,
-  "tree_sha256": "ac7b1f942e74709cb79d331fe15d21c4fcfdb8c30c8f0d88fd199404d06462b1",
+  "file_count": 1599,
+  "tree_sha256": "8bdaa736f97566f66d4afb3f53a7a779eaf343a244651e18831cbf3629c05957",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4222,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c8e9ca33aba6a1b42addf6f862daad54f2e0ba87a43090129a2afe23edc53e6"
+      "sha256": "3218421cd172f2d2201d5ea5573d36a5534f08a47e82eca9940eb3084275ef52"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c163fb61de2b5c9024266f6b1bd494687307421fb05370874842e67639e0311"
+      "sha256": "907133ee8dd8cab837d620480df2af2d001825a2a9094ef528cf37a7e93a58da"
     },
     {
       "path": "public-docs/index.html",
@@ -5832,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "479f80926d0dfcd56bfb6b47dfe8fac208ce8ce3c873e6a016c4af0e5f015edd"
+      "sha256": "c4c789739d3759c20717b498e03783b14b3d8db3e53995415616885fa99d2cfc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6944,6 +6944,11 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/hub_profile_leak.mjs",
+      "mode": "0000644",
+      "sha256": "f0934fad2cd869a0955b9b087cab449932e921032ca94fc356a952e88f528d82"
+    },
     {
       "path": "tests/idea_completeness.mjs",
       "mode": "0000644",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.173",
+  "version": "1.19.174",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.173",
+      "version": "1.19.174",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.173",
+  "version": "1.19.174",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -773,8 +773,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.171 with no explicit bump. run 31968188738. (task 1002620)
 //   1.19.173 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.172 with no explicit bump. run 31968656001. (task 1002620)
+//   1.19.174 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.173 with no explicit bump. run 31969032984. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.173'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.174'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_profile_leak.mjs

@@ -0,0 +1,220 @@
+// tests/hub_profile_leak.mjs — P05, task 1002801 (goal 1000045; real DB).
+//
+// The mirror of tests/profile_route.mjs for the HUB profile surface (spec
+// Constraints §1: "the whitelist is the pattern, not the exception" — the new
+// cross-project read needs its OWN sentinel leak test over the account + rollup
+// projection before it is public). Where profile_route.mjs stubs the hub port,
+// this runs the REAL module projection over real SQL and the REAL public route
+// (GET /profiles/:handle, R05), with sentinel strings planted on every
+// module-internal value that must never serialize:
+//
+//   - client_id + secret_hash on both reporting sso_clients,
+//   - a non-public project's name (counted in more_projects, never named),
+//   - the account's previous_handle (the 301 window key — resolvable as a URL,
+//     never a response value),
+//   - and the consent/join machinery itself: profile_state, hide_stats,
+//     github_id must not appear anywhere in a 200 body.
+//
+// Plus the behaviour edges: 404 on unknown / invalid / provisional
+// (indistinguishable, fail-closed D3), hidden → cross_project null with no
+// partial numbers, previous handle → 301 to the current one, no-store.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/hub_profile_leak.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+const express = require('express');
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`hub_profile_leak.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// The real route over the real domain — only the doorway is pinned so the
+// route's pool IS the fixture DB (the profile_route.mjs require.cache pattern).
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: { pool, corsPublicGet: () => (_req, _res, next) => next() },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ---- fixtures (sentinels on everything that must never serialize) ---------
+
+const ACTIVE = 9002801001, HIDDEN = 9002801002, PROV = 9002801003;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV];
+const SECRET_CLIENT_PUB = 'cli-DO-NOT-LEAK-p05-pub';
+const SECRET_CLIENT_PRIV = 'cli-DO-NOT-LEAK-p05-priv';
+const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
+const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
+const SECRET_PREV = 'p05-prev-sentinel';
+const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
+const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since'];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [[SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV]]).catch(() => {});
+}
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function get(port, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch (_) {}
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const NEVER_IN_A_BODY = [
+  SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
+  'profile_state', 'hide_stats', 'github_id',
+];
+function assertNoSentinels(text, where) {
+  for (const s of NEVER_IN_A_BODY) {
+    assert.ok(!text.includes(s), `"${s}" leaked in ${where}`);
+  }
+}
+
+let server = null;
+try {
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL)`,
+    [ACTIVE, HIDDEN, PROV, SECRET_PREV],
+  );
+  await q(
+    `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
+     VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, featured, status)
+     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
+  );
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
+     VALUES ($1, $3, 100, 5, 3, 'metic',  '{engineer}', '2026-08-01T00:00:00Z'),
+            ($2, $3,  50, 2, 1, 'archon', '{ui}',       '2026-08-02T00:00:00Z'),
+            ($1, $4,  10, 1, 0, 'metic',  '{engineer}', '2026-08-03T00:00:00Z')`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, ACTIVE, HIDDEN],
+  );
+
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildPublicProfileRoutes());
+  const port = await new Promise((resolve) => {
+    server = app.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+
+  await t('active handle → 200: identity-band whitelist, exact cross_project contract, no sentinels', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-active');
+    assert.equal(r.status, 200);
+    assert.equal(r.headers['cache-control'], 'no-store', 'hide must beat the cache (D5)');
+    assert.deepEqual(Object.keys(r.json.account).sort(), [...ACCOUNT_KEYS].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_KEYS].sort());
+    assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
+    assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
+    assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
+    assertNoSentinels(r.text, 'the 200 body');
+  });
+
+  await t('lookup is case-insensitive', async () => {
+    const r = await get(port, '/api/bongos/profiles/P05-ACTIVE');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.account.handle, 'p05-active');
+  });
+
+  await t('hidden builder → 200 with cross_project null — no partial numbers', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-hidden');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.cross_project, null);
+    assert.ok(!r.text.includes('totals'), 'nothing derived from the rollup serializes');
+    assertNoSentinels(r.text, 'the hidden body');
+  });
+
+  await t('provisional → 404, indistinguishable from unknown (fail-closed D3)', async () => {
+    const prov = await get(port, '/api/bongos/profiles/p05-prov');
+    const ghost = await get(port, '/api/bongos/profiles/p05-no-such-handle');
+    assert.equal(prov.status, 404);
+    assert.equal(ghost.status, 404);
+    assert.equal(prov.json.error.code, ghost.json.error.code, 'same envelope for both');
+    assertNoSentinels(prov.text, 'the provisional 404 body');
+  });
+
+  await t('an invalid handle → 404, not a 500', async () => {
+    const r = await get(port, '/api/bongos/profiles/not%20a%20handle!');
+    assert.equal(r.status, 404);
+  });
+
+  await t('a previous handle → 301 to the current one; the old handle never echoes', async () => {
+    const r = await get(port, `/api/bongos/profiles/${SECRET_PREV}`);
+    assert.equal(r.status, 301);
+    assert.ok(r.headers.location.endsWith('/profiles/p05-active'), `Location points at the current handle (got ${r.headers.location})`);
+    assert.deepEqual(r.json, { moved_to: 'p05-active' });
+    assert.ok(!r.text.includes(SECRET_PREV), 'the requested old handle is not echoed');
+  });
+
+  await t('domain projection is clean even off-route (the port surface)', async () => {
+    const extras = await pi.getPublicProfileExtras(ACTIVE, { pool });
+    assertNoSentinels(JSON.stringify(extras), 'getPublicProfileExtras');
+    const page = await pi.getPublicProfileByHandle('p05-active', { pool });
+    assertNoSentinels(JSON.stringify(page), 'getPublicProfileByHandle');
+  });
+
+  console.log(`\nhub_profile_leak: ${passed} passed, ${failed} failed`);
+  if (failed > 0) process.exitCode = 1;
+} finally {
+  if (server) server.close();
+  await cleanup();
+  await pool.end().catch(() => {});
+}