@bongos/core 1.19.259 → 1.19.261

package/tests/provisioning_teardown_states.mjs

@@ -0,0 +1,176 @@
+// tests/provisioning_teardown_states.mjs
+//
+// The teardown STATE gate (task 1003042, walk finding N5). Sibling of
+// provisioning_teardown_intent.mjs, which covers the intent-collision mapping;
+// this file covers which STATES may be torn down at all, and how the one
+// remaining refusal reads.
+//
+// The bug: TEARDOWN_FROM was a hand-kept whitelist, ['provisioning','active',
+// 'tearing_down'], that silently omitted 'requested' and 'error'. Because the
+// archon force-teardown route reuses the SAME set, there was no path — owner or
+// archon — to remove a snagged project, so errored rows accumulated forever
+// (instance 15 'swag' from 2026-08-07). Two things are pinned here:
+//
+//   • the set is DERIVED from INSTANCE_STATES minus 'torn_down', so a future
+//     state is teardownable by default and cannot be silently excluded again;
+//   • the surviving refusal is a plain SENTENCE on BOTH routes. force-teardown
+//     used the positional res.fail(code, 409, details) form with no message,
+//     and envelope()'s `message || code` fallback then put the bare string
+//     "not_teardownable" on the wire as the human text (§5.1's plain-sentence
+//     rule). This test mounts the REAL attachFail, not a shim, so that exact
+//     regression is caught on the wire and not merely in the call shape.
+//
+// DB-free: the pool is never queried — the data-access fns the routes need are
+// stubbed on the cached module object (the provisioning_teardown_intent.mjs
+// pattern). No network beyond a loopback listener.
+//
+// Run:  node tests/provisioning_teardown_states.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── the constant itself ──────────────────────────────────────────────────────
+
+console.log('TEARDOWN_FROM — every state except the one with nothing left:');
+
+t('every INSTANCE_STATE except torn_down may be torn down', () => {
+  for (const s of provisioning.INSTANCE_STATES) {
+    assert.equal(provisioning.TEARDOWN_FROM.has(s), s !== 'torn_down',
+      `${s} should ${s === 'torn_down' ? 'NOT ' : ''}be teardownable`);
+  }
+});
+
+t("'requested' and 'error' are IN — the two the old whitelist dropped (N5)", () => {
+  assert.equal(provisioning.TEARDOWN_FROM.has('requested'), true);
+  assert.equal(provisioning.TEARDOWN_FROM.has('error'), true);
+});
+
+t('the set is derived, not hand-listed — size tracks INSTANCE_STATES', () => {
+  assert.equal(provisioning.TEARDOWN_FROM.size, provisioning.INSTANCE_STATES.length - 1,
+    'a state added to INSTANCE_STATES must be teardownable by default, never silently excluded');
+});
+
+// ── the routes, over a real mounted router + the REAL error envelope ─────────
+
+let currentStatus = 'active';
+let teardownCalls = [];
+provisioning.getInstanceById = async (_db, id) =>
+  ({ id, owner_builder_id: 7, slug: 'swag', status: currentStatus });
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => {
+  teardownCalls.push({ id, requestedBy, status: currentStatus });
+  return { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: false };
+};
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner', rank: 'archon' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);   // the REAL envelope — a shim would hide the bare-code bug
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': 2 },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end('{}');
+  });
+}
+
+const OWNER = '/provisioning/instances/15/teardown';
+const FORCE = '/provisioning/instances/15/force-teardown';
+
+console.log('\nEvery non-torn-down state is accepted — on BOTH routes:');
+
+for (const state of ['requested', 'provisioning', 'active', 'tearing_down', 'error']) {
+  await ta(`owner teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(OWNER);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1, 'the intent was actually enqueued');
+  });
+  await ta(`force-teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(FORCE);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1);
+  });
+}
+
+await ta("the live repro: instance 15 'swag' sat at 'error' and could not be removed by ANYONE", async () => {
+  currentStatus = 'error';
+  teardownCalls = [];
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.status, 200, `owner teardown: ${owner.raw}`);
+  assert.equal(force.status, 200, `force-teardown: ${force.raw}`);
+  assert.equal(teardownCalls.length, 2, 'both roles now have a real path out');
+});
+
+console.log("\nOnly 'torn_down' still refuses — and it refuses in a sentence:");
+
+for (const [label, path] of [['owner teardown', OWNER], ['force-teardown', FORCE]]) {
+  await ta(`${label} refuses a torn-down project with 409 not_teardownable`, async () => {
+    currentStatus = 'torn_down'; teardownCalls = [];
+    const res = await post(path);
+    assert.equal(res.status, 409, res.raw);
+    assert.equal(res.body.error.code, 'not_teardownable');
+    assert.equal(res.body.error.details.status, 'torn_down', 'the real state is named');
+    assert.equal(teardownCalls.length, 0, 'nothing was enqueued');
+  });
+
+  await ta(`${label}'s message is a plain sentence, never the bare code (the N5 §5.1 violation)`, async () => {
+    currentStatus = 'torn_down';
+    const res = await post(path);
+    const m = String(res.body.error.message || '');
+    assert.notEqual(m, 'not_teardownable', 'the bare code must never be the human text');
+    assert.doesNotMatch(m, /_/, 'no snake_case identifier leaks into owner-facing copy');
+    assert.ok(/\s/.test(m) && /\.$/.test(m), `a real sentence, got: ${JSON.stringify(m)}`);
+    assert.match(m, /torn down/i, 'it says what is actually true of the project');
+  });
+}
+
+await ta('both routes give the SAME refusal — the copies cannot drift again', async () => {
+  currentStatus = 'torn_down';
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.body.error.message, force.body.error.message);
+  assert.equal(owner.status, force.status);
+});
+
+server.close();
+
+console.log(`\nprovisioning_teardown_states: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/public_landing_projects.mjs

@@ -121,6 +121,28 @@ test('the manage view is served: identity block + honest not-yet sections (task
   assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
 });
 
+test('the delete section is served live, and never claims to erase (task 1003042)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="mDel"/, 'the live section body is served');
+  assert.match(body, /id="mDelWhat"/, 'the teardown-vs-delete fold is served');
+  assert.match(body, /does <b>not<\/b> erase the project/i,
+    'the distinction survives to the wire, not just the source');
+  assert.match(body, /no permanent-delete button/i, 'the absent capability is admitted');
+  // the confirmation asks for the project's own name — the heaviest gate on the page
+  assert.match(body, /Type the project’s name to confirm/, 'the typed confirmation is served');
+  assert.match(body, /data-del-yes disabled/, 'and the act starts unreachable');
+});
+
+test('the served teardown copy no longer claims the address goes quiet (task 1003042)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // teardown has no DNS or Caddy leg: the hostname keeps resolving and 502s, so
+  // this sentence was false on the wire. Task 1002897 owns actually releasing it.
+  assert.doesNotMatch(body, /the address stops answering/,
+    'no served copy may promise a silence the runner does not deliver');
+  assert.match(body, /stays reserved for this project/,
+    'the truthful replacement is what ships');
+});
+
 test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="mRepoVis"/, 'the live section body is served');