@bongos/core 1.19.205 → 1.19.207

package/tests/publish_branch_route.mjs

@@ -476,7 +476,7 @@ async function withEnv(vars, fn) {
 const APP_ENV = { GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: '456', GITHUB_APP_PRIVATE_KEY: APP_PRIVKEY };
 const NO_APP = { GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined };
 
-await t('appConfigured / isConfigured: true only with App (all 3 vars) or PAT', async () => {
+await t('appConfigured / isConfigured: true with App (id + key; installation id optional) or PAT', async () => {
   await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: undefined }, async () => {
     assert.equal(gp.appConfigured(), false);
     assert.equal(gp.isConfigured(), false);
@@ -490,7 +490,11 @@ await t('appConfigured / isConfigured: true only with App (all 3 vars) or PAT',
     assert.equal(gp.isConfigured(), true, 'App alone configures it');
   });
   await withEnv({ GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: APP_PRIVKEY, GITHUB_PUSH_TOKEN: undefined }, async () => {
-    assert.equal(gp.appConfigured(), false, 'partial App config (no installation id) is NOT configured');
+    assert.equal(gp.appConfigured(), true, 'id + key ARE enough — the installation id is discovered from the repo (task 1003049)');
+    assert.equal(gp.isConfigured(), true);
+  });
+  await withEnv({ GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: '456', GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(gp.appConfigured(), false, 'no private key → not configured');
     assert.equal(gp.isConfigured(), false);
   });
 });
@@ -548,6 +552,153 @@ await t('getInstallationToken: App configured but the exchange fails → APP_TOK
   });
 });
 
+// task 1003049 — a manifest-born instance knows its App id + key at cred-placement
+// time but never the installation id: that only exists after the owner's one-click
+// install. The server derives it live instead of demanding a third env var.
+const APP_ENV_NO_INST = { GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: APP_PRIVKEY };
+
+await t('getInstallationToken: no installation id in env → discovers it from the repo, then mints (task 1003049)', async () => {
+  await withEnv({ ...APP_ENV_NO_INST, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    const urls = [];
+    const fetchImpl = async (url, opts = {}) => {
+      urls.push(url);
+      if (url.endsWith('/repos/someowner/somerepo/installation')) {
+        const authz = opts.headers.Authorization;
+        assert.ok(/^Bearer /.test(authz) && jwtSignatureVerifies(authz.slice(7), APP_PUBKEY), 'discovery authenticates with a valid App JWT');
+        return jsonRes(200, { id: 789 });
+      }
+      if (url.includes('/app/installations/789/access_tokens')) {
+        return jsonRes(201, { token: 'ghs_discovered', expires_at: '2999-01-01T00:00:00Z' });
+      }
+      throw new Error('unexpected ' + url);
+    };
+    const now = () => 1_700_000_000 * 1000;
+    const tok = await gp.getInstallationToken({ fetchImpl, now, repoInfo: REPO });
+    assert.equal(tok, 'ghs_discovered');
+    assert.ok(urls.some((u) => u.endsWith('/repos/someowner/somerepo/installation')), 'looked the installation up on the repo');
+  });
+});
+
+await t('getInstallationToken: env GITHUB_APP_INSTALLATION_ID still wins — no discovery call (the ADR 0055 v1 shape)', async () => {
+  await withEnv({ ...APP_ENV, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    const fetchImpl = async (url) => {
+      if (url.endsWith('/installation')) throw new Error('must not discover when the env id is set');
+      return jsonRes(201, { token: 'ghs_env', expires_at: '2999-01-01T00:00:00Z' });
+    };
+    assert.equal(await gp.getInstallationToken({ fetchImpl, now: () => 1_700_000_000 * 1000, repoInfo: REPO }), 'ghs_env');
+  });
+});
+
+await t('getInstallationToken: App not installed on the repo → APP_NOT_INSTALLED carrying the install URL (task 1003049)', async () => {
+  await withEnv({ ...APP_ENV_NO_INST, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    const fetchImpl = async (url) => {
+      if (url.endsWith('/repos/someowner/somerepo/installation')) return jsonRes(404, { message: 'Not Found' });
+      if (url.endsWith('api.github.com/app')) return jsonRes(200, { html_url: 'https://github.com/apps/mercury-signin' });
+      throw new Error('unexpected ' + url);
+    };
+    await assert.rejects(
+      () => gp.getInstallationToken({ fetchImpl, now: () => 1_700_000_000 * 1000, repoInfo: REPO }),
+      (e) => e.code === 'APP_NOT_INSTALLED'
+        && e.owner === 'someowner' && e.repo === 'somerepo'
+        && e.install_url === 'https://github.com/apps/mercury-signin/installations/new',
+      'names the repo + the one-click install URL so the refusal is self-serve'
+    );
+  });
+});
+
+await t('discoverInstallationId: APP_NOT_INSTALLED is negative-cached for a short TTL (no per-poll re-probe)', async () => {
+  await withEnv({ ...APP_ENV_NO_INST, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    let probes = 0;
+    const fetchImpl = async (url) => {
+      if (url.endsWith('/repos/someowner/somerepo/installation')) { probes++; return jsonRes(404, {}); }
+      if (url.endsWith('api.github.com/app')) return jsonRes(200, { html_url: 'https://github.com/apps/x' });
+      throw new Error('unexpected ' + url);
+    };
+    let nowMs = 1_700_000_000 * 1000;
+    const now = () => nowMs;
+    const call = () => gp.getInstallationToken({ fetchImpl, now, repoInfo: REPO });
+    await assert.rejects(call, (e) => e.code === 'APP_NOT_INSTALLED');
+    await assert.rejects(call, (e) => e.code === 'APP_NOT_INSTALLED');
+    assert.equal(probes, 1, 'the second poll inside the TTL reuses the cached refusal');
+    nowMs += 61_000;
+    await assert.rejects(call, (e) => e.code === 'APP_NOT_INSTALLED');
+    assert.equal(probes, 2, 'after the TTL the state is re-probed (an install must be noticed)');
+  });
+});
+
+await t('getInstallationToken: a stale DISCOVERED id is dropped on exchange failure — next call re-discovers (no restart needed)', async () => {
+  await withEnv({ ...APP_ENV_NO_INST, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    let discoveries = 0, exchanges = 0;
+    const fetchImpl = async (url) => {
+      if (url.endsWith('/repos/someowner/somerepo/installation')) {
+        discoveries++;
+        return jsonRes(200, { id: discoveries === 1 ? 111 : 222 });
+      }
+      if (url.includes('/access_tokens')) {
+        exchanges++;
+        // the first (stale) id fails the exchange; the re-discovered one works
+        if (url.includes('/111/')) return jsonRes(404, { message: 'gone (uninstalled+reinstalled)' });
+        return jsonRes(201, { token: 'ghs_fresh', expires_at: '2999-01-01T00:00:00Z' });
+      }
+      throw new Error('unexpected ' + url);
+    };
+    const now = () => 1_700_000_000 * 1000;
+    await assert.rejects(
+      () => gp.getInstallationToken({ fetchImpl, now, repoInfo: REPO }),
+      (e) => e.code === 'APP_TOKEN_FAILED'
+    );
+    assert.equal(await gp.getInstallationToken({ fetchImpl, now, repoInfo: REPO }), 'ghs_fresh',
+      'the stale id was dropped and re-discovery healed the exchange');
+    assert.equal(discoveries, 2);
+    assert.equal(exchanges, 2);
+  });
+});
+
+await t('foreignInstallations: installs beyond the repo owner are surfaced; own install is not; API miss → null (task 1003049 grade)', async () => {
+  await withEnv({ ...APP_ENV_NO_INST, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    const roster = [
+      { id: 1, account: { login: 'SomeOwner' } },   // own (case-insensitive)
+      { id: 2, account: { login: 'stranger' } },
+      { id: 3, account: { login: 'another-org' } },
+    ];
+    const fetchImpl = async (url) => {
+      if (url.includes('/app/installations?')) return jsonRes(200, roster);
+      throw new Error('unexpected ' + url);
+    };
+    const foreign = await gp.foreignInstallations({ fetchImpl, now: () => 1_700_000_000 * 1000, repoInfo: REPO });
+    assert.deepEqual(foreign.map((f) => f.account).sort(), ['another-org', 'stranger']);
+    const miss = await gp.foreignInstallations({ fetchImpl: async () => jsonRes(500, {}), now: () => 1_700_000_000 * 1000, repoInfo: REPO });
+    assert.equal(miss, null, 'a watch that cannot tell says null, never a fake all-clear');
+  });
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(await gp.foreignInstallations({ fetchImpl: async () => { throw new Error('no'); } }), null,
+      'unconfigured App → null');
+  });
+});
+
+await t('GET /tasks/:id/publish-status with no credential → a plain-sentence 503, not a bare code (task 1003049)', async () => {
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    const router = buildTasksRouter();
+    const layer = findRouteLayer(router, '/tasks/:id/publish-status', 'get');
+    const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+    const out = { failCode: null, failOpts: null };
+    const res = {
+      status() { return this; },
+      json() { return this; },
+      fail(code, opts) { out.failCode = code; out.failOpts = opts; return this; },
+    };
+    // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
+    const req = { params: { id: '77' }, query: { branch: 'claude/x' }, builder: { id: 95, rank: 'archon' } };
+    await handler(req, res);
+    assert.equal(out.failCode, 'push_unconfigured');
+    assert.equal(out.failOpts && out.failOpts.status, 503);
+    const msg = String((out.failOpts && out.failOpts.message) || '');
+    assert.match(msg, /publish credential/i, 'says WHAT is missing in a sentence');
+    assert.match(msg, /GitHub App/, 'says what to set up');
+    assert.match(msg, /GITHUB_PUSH_TOKEN/, 'names the PAT alternative');
+  });
+});
+
 await t('resolveToken precedence: deps.token > App installation token > PAT > null', async () => {
   await withEnv({ ...APP_ENV, GITHUB_PUSH_TOKEN: 'pat' }, async () => {
     assert.equal(

package/tests/publish_reconciler.mjs

@@ -212,6 +212,69 @@ test('no push credential → no-op (skipped: unconfigured), never touches the DB
   assert.equal(deps._calls.status.length, 0, 'must not call GitHub when unconfigured');
 });
 
+// task 1003049 — an App with id + key but no repo installation passes isConfigured,
+// then every per-branch call throws APP_NOT_INSTALLED into a best-effort catch:
+// silent stranding. The sweep must instead say it loudly ONCE and park.
+test('1003049 App configured but NOT installed → loud one-time WARN, sweep parked, heals when installed', async () => {
+  const deps = mkDeps({ configured: true, rows: [{ task_id: 1, builder_id: 9, worktree_name: 'wt' }] });
+  deps.warnState = {};
+  let installed = false;
+  deps.githubPush.appConfigured = () => true;
+  deps.githubPush.getInstallationToken = async () => {
+    if (!installed) {
+      throw Object.assign(new Error('APP_NOT_INSTALLED'), {
+        code: 'APP_NOT_INSTALLED', owner: 'someowner', repo: 'somerepo',
+        install_url: 'https://github.com/apps/x/installations/new',
+      });
+    }
+    return 'tok';
+  };
+  const r1 = await reconciler.runSweep(deps);
+  assert.equal(r1.skipped, 'app_not_installed');
+  assert.equal(deps._calls.status.length, 0, 'no per-branch GitHub calls while uninstallable');
+  const warns = () => deps._calls.errors.filter((m) => /not installed/.test(m));
+  assert.equal(warns().length, 1, 'warned exactly once');
+  assert.match(warns()[0], /someowner\/somerepo/, 'names the repo');
+  assert.match(warns()[0], /installations\/new/, 'carries the install URL');
+  const r2 = await reconciler.runSweep(deps);
+  assert.equal(r2.skipped, 'app_not_installed');
+  assert.equal(warns().length, 1, 'the streak stays quiet');
+  installed = true;
+  const r3 = await reconciler.runSweep(deps);
+  assert.ok(!r3.skipped, 'an installed App lets the sweep run again');
+});
+
+test('1003049 foreign-install watch: WARNs once per streak on installs beyond the repo owner, re-arms when clean', async () => {
+  const deps = mkDeps({ configured: true, rows: [] });
+  deps.warnState = {};
+  let roster = [{ id: 2, account: 'stranger' }];
+  deps.githubPush.appConfigured = () => true;
+  deps.githubPush.getInstallationToken = async () => 'tok';
+  deps.githubPush.foreignInstallations = async () => roster;
+  const warns = () => deps._calls.errors.filter((m) => /beyond the repo owner/.test(m));
+  await reconciler.runSweep(deps);
+  assert.equal(warns().length, 1, 'a foreign install is surfaced loudly');
+  assert.match(warns()[0], /stranger/, 'names the account');
+  await reconciler.runSweep(deps);
+  assert.equal(warns().length, 1, 'the streak stays quiet');
+  roster = [];
+  await reconciler.runSweep(deps);
+  roster = [{ id: 9, account: 'other' }];
+  await reconciler.runSweep(deps);
+  assert.equal(warns().length, 2, 'a clean roster re-arms the warning');
+});
+
+test('1003049 a transient App-token exchange failure does NOT park the sweep', async () => {
+  const deps = mkDeps({ configured: true, rows: [] });
+  deps.warnState = {};
+  deps.githubPush.appConfigured = () => true;
+  deps.githubPush.getInstallationToken = async () => {
+    throw Object.assign(new Error('boom'), { code: 'APP_TOKEN_FAILED', status: 500 });
+  };
+  const r = await reconciler.runSweep(deps);
+  assert.ok(!r.skipped, 'transient exchange failures are per-branch territory, not a park');
+});
+
 test('a landed branch → shipTask + broadcast fire, reconciled=1, attributed to the claim holder', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 1096, builder_id: 7, worktree_name: 't1096-helpers', published_head_sha: ON_MAIN }],