@bongos/core 1.19.181 → 1.19.183

package/src/module-api.js

@@ -789,8 +789,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.179 with no explicit bump. run 31972568511. (task 1002620)
 //   1.19.181 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.180 with no explicit bump. run 31972686846. (task 1002620)
+//   1.19.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
+//   1.19.183 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.181'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.183'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/governance_protected_surfaces.mjs

@@ -83,14 +83,70 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
   '.claude/settings.json',
 ];
 
+// Globs added to the registry SINCE R101, each with the change that added it.
+// Kept separate from the verbatim pre-R101 array above so that array stays what
+// it claims to be — the literal pre-change constant. Overwriting it to make a
+// later addition pass would destroy the only evidence that R101 moved WHERE the
+// truth lives without changing WHAT is protected.
+//
+// Each entry is { after, glob, why }: `after` is the glob it is inserted
+// directly below, so the expected list is reconstructed in order rather than
+// re-pasted (a re-paste is how the two lists drift apart).
+const ADDED_SINCE_R101 = [
+  {
+    after: 'modules/governance/',
+    glob: 'modules/government/',
+    why: 'goal 1000068 / task 1003003 (ADR 0174) — the authz core is renamed '
+       + 'governance→government. The new glob is registered BEFORE the folder '
+       + 'moves because `protected` DERIVES from this registry: without it the '
+       + 'new module key computes protected:false and both the Archon gate on '
+       + 'goal creation and the pre-push block on these files would silently lapse.',
+  },
+];
+
+// The list the registry must produce TODAY: the pre-R101 set with each
+// documented addition spliced in at its declared position.
+const EXPECTED_GLOBS = (() => {
+  const out = [...EXPECTED_GLOBS_BEFORE_R101];
+  for (const a of ADDED_SINCE_R101) {
+    const at = out.indexOf(a.after);
+    assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
+    out.splice(at + 1, 0, a.glob);
+  }
+  return out;
+})();
+
 // ---------- behavior identity: the same globs, at the same floor ----------
 
-test('the registry reproduces the pre-R101 PROTECTED_GLOBS exactly, in order', () => {
-  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101);
-  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101,
+test('nothing protected before R101 has been unprotected since', () => {
+  // The load-bearing half. Additions are ordinary policy; a REMOVAL silently
+  // unprotects a trust surface, so it is asserted separately and must never be
+  // satisfied by editing the pre-R101 array.
+  for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
+    assert.ok(
+      registry.PROTECTED_GLOBS.includes(glob),
+      `'${glob}' was protected before R101 and is no longer in the registry — `
+      + 'a protected surface cannot be dropped without an ADR saying why.',
+    );
+  }
+});
+
+test('the registry reproduces the expected glob list exactly, in order', () => {
+  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS);
+  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS,
     'the kernel matcher must expose the same derived list the registry declares');
 });
 
+test('every glob added since R101 carries a documented reason', () => {
+  for (const a of ADDED_SINCE_R101) {
+    assert.ok(a.why && a.why.length > 40,
+      `${a.glob} must record WHY it became protected — an undocumented addition `
+      + 'is indistinguishable from a typo.');
+    assert.ok(registry.PROTECTED_GLOBS.includes(a.glob),
+      `${a.glob} is declared as added but is not in the registry`);
+  }
+});
+
 test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
   for (const s of registry.SURFACES) {
     assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
@@ -128,7 +184,7 @@ test('the registry loads synchronously from the repo with no DB and no server',
     "const p=require('./src/bongos/permission-path-check');" +
     "process.stdout.write(String(p.PROTECTED_GLOBS.length)+':'+String(p.floorFor('migrations/001.sql')));",
   ], { cwd: ROOT, encoding: 'utf8', env: { ...process.env, DATABASE_URL: '', PGHOST: '' } });
-  assert.equal(out, `${EXPECTED_GLOBS_BEFORE_R101.length}:metic`);
+  assert.equal(out, `${EXPECTED_GLOBS.length}:metic`);
 });
 
 test('the registry data file carries no DB/network dependency', () => {

package/tests/hub_profile_leak.mjs

@@ -69,7 +69,7 @@ const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
 const SECRET_PREV = 'p05-prev-sentinel';
 const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
 const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
-const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since'];
+const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since', 'bio', 'links'];
 
 const q = (sql, params) => pool.query(sql, params);
 async function cleanup() {
@@ -103,7 +103,7 @@ function get(port, path) {
 
 const NEVER_IN_A_BODY = [
   SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
-  'profile_state', 'hide_stats', 'github_id',
+  'profile_state', 'hide_stats', 'github_id', 'display_name_source',
 ];
 function assertNoSentinels(text, where) {
   for (const s of NEVER_IN_A_BODY) {
@@ -118,14 +118,17 @@ try {
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await q(migrationSql('platform_identity_008_handle.sql'));
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
   await cleanup();
 
+  // The active account carries the P02 fields + a user-set name source, so the
+  // 200 proves bio/links serialize while display_name_source never does.
   await q(
     `INSERT INTO platform_identity_accounts
-       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle)
-     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4),
-            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL),
-            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL)`,
+       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle, bio, links, display_name_source)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL, NULL, NULL, 'github'),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL, NULL, NULL, 'github')`,
     [ACTIVE, HIDDEN, PROV, SECRET_PREV],
   );
   await q(
@@ -165,6 +168,8 @@ try {
     assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
     assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
     assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
+    assert.equal(r.json.account.bio, 'Builds things.', 'bio serializes (P02)');
+    assert.deepEqual(r.json.account.links, { website: 'https://p05.example/' }, 'links serialize (P02)');
     assertNoSentinels(r.text, 'the 200 body');
   });
 

package/tests/profile_fields.mjs

@@ -0,0 +1,133 @@
+// tests/profile_fields.mjs — P02, task 1002798 (goal 1000045; real DB).
+//
+// Proves migration 009 + the profile-fields machinery against real SQL (the
+// handle_machinery.mjs precedent):
+//   1. setAccountProfileFields on an UNSEEN builder creates a fail-closed
+//      provisional account, seeds the handle, stores bio + links
+//   2. the ADR 0156 mirror: setting display_name stamps source='user', and a
+//      later upsertAccount re-sync (the check-in shape) keeps its hands off the
+//      name while github_login/avatar_url still re-sync; a never-renamed
+//      account still follows GitHub renames
+//   3. the UPDATE branch touches ONLY the fields sent — bio alone leaves
+//      links/display_name alone, and never demotes profile_state or flips
+//      hide_stats
+//   4. links REPLACE wholesale; null clears; a rejected link writes nothing
+//   5. the public read (getPublicProfileByHandle) carries bio + links
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/profile_fields.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`profile_fields.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const FRESH = 9002798001, SYNCED = 9002798002;
+const ALL_IDS = [FRESH, SYNCED];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const acctOf = (id) => pi.getAccount(id, { pool });
+
+try {
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  // Idempotence is part of what this proves.
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  await cleanup();
+
+  // --- 1. INSERT branch: unseen builder fills their profile ahead of time ---
+  const first = await pi.setAccountProfileFields({
+    githubId: FRESH, githubLogin: 'P02Fresh', displayName: 'GH Fresh', avatarUrl: 'https://a.example/f.png',
+    fields: { bio: '  Builds bongos in the cloud.  ', links: { website: 'https://fresh.example', x: 'https://x.com/fresh' } },
+  }, { pool });
+  ok(first.bio === 'Builds bongos in the cloud.', 'INSERT branch stores the trimmed bio');
+  ok(first.links.website === 'https://fresh.example/' && first.links.x === 'https://x.com/fresh', 'INSERT branch stores normalized links');
+  ok(first.handle === 'p02fresh', 'the create path seeds the handle, like every other account-creating upsert');
+  let a = await acctOf(FRESH);
+  ok(a.profile_state === 'provisional', 'a profile-fields write never grants consent — fail-closed provisional');
+  ok(a.display_name === 'GH Fresh' && a.display_name_source === 'github', 'no display_name sent → GitHub-derived name, source stays github');
+
+  // --- 2. the ADR 0156 mirror ----------------------------------------------
+  const named = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'P02Fresh', fields: { display_name: 'Fresh, Renamed' } }, { pool });
+  ok(named.display_name === 'Fresh, Renamed', 'setting display_name writes it');
+  a = await acctOf(FRESH);
+  ok(a.display_name_source === 'user', 'and stamps display_name_source=user');
+
+  await pi.upsertAccount({ githubId: FRESH, githubLogin: 'p02fresh-renamed', displayName: 'GH Clobber', avatarUrl: 'https://a.example/new.png' }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.display_name === 'Fresh, Renamed', 'a check-in re-sync does NOT clobber a user-set name');
+  ok(a.github_login === 'p02fresh-renamed' && a.avatar_url === 'https://a.example/new.png', 'github_login + avatar_url still re-sync unconditionally');
+
+  await pi.upsertAccount({ githubId: SYNCED, githubLogin: 'p02synced', displayName: 'GH Old' }, { pool });
+  await pi.upsertAccount({ githubId: SYNCED, githubLogin: 'p02synced', displayName: 'GH New' }, { pool });
+  a = await acctOf(SYNCED);
+  ok(a.display_name === 'GH New', 'a never-renamed account still follows GitHub renames');
+
+  // --- 3. the UPDATE branch touches only what was sent ----------------------
+  await q(`UPDATE platform_identity_accounts SET profile_state = 'active', hide_stats = true WHERE github_id = $1`, [FRESH]);
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'Just the bio.' } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.bio === 'Just the bio.', 'bio alone updates');
+  ok(a.links.website === 'https://fresh.example/', 'links untouched by a bio-only write');
+  ok(a.display_name === 'Fresh, Renamed', 'display_name untouched by a bio-only write');
+  ok(a.profile_state === 'active' && a.hide_stats === true, 'profile_state + hide_stats never move on a profile-fields write');
+
+  // --- 4. links replace wholesale; null clears; rejects write nothing -------
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { links: { discord: 'https://discord.gg/bongos' } } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.links.discord === 'https://discord.gg/bongos' && !a.links.website && !a.links.x, 'a links write replaces the whole set');
+
+  const bad = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'never lands', links: { linkedin: 'https://evil.example/in' } } }, { pool });
+  ok(bad.error === 'invalid_link' && bad.reason === 'wrong_host', 'a host-pinned type refuses a foreign host');
+  a = await acctOf(FRESH);
+  ok(a.bio === 'Just the bio.' && a.links.discord === 'https://discord.gg/bongos', 'a rejected write writes NOTHING — not even the valid fields beside it');
+
+  const none = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: {} }, { pool });
+  ok(none.error === 'no_fields', 'an empty fields object is refused, not a silent no-op');
+
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: null, links: null } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.bio === null && a.links === null, 'null clears bio and links');
+
+  // --- 5. the public read carries the fields --------------------------------
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'Public bio.', links: { website: 'https://fresh.example' } } }, { pool });
+  const page = await pi.getPublicProfileByHandle('p02fresh', { pool });
+  ok(page.account.bio === 'Public bio.' && page.account.links.website === 'https://fresh.example/', 'getPublicProfileByHandle serves bio + links');
+  ok(!('display_name_source' in page.account), 'display_name_source never crosses the public whitelist');
+
+  console.log(`\nprofile_fields: ${pass} checks passed`);
+} catch (e) {
+  console.error(`\nFAIL after ${pass} checks: ${e.message}`);
+  process.exitCode = 1;
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}