@bongos/core 1.19.260 → 1.19.262

package/tests/provisioning_settings_env.mjs

@@ -0,0 +1,121 @@
+// tests/provisioning_settings_env.mjs
+//
+// The standup leg of the platform->instance settings channel (task 1003139, goal
+// 1000058): a per-project setting the PLATFORM stores must reach the INSTANCE that
+// has to obey it.
+//
+// The gap this closes: PATCH /provisioning/instances/:id/settings wrote
+// platform_visibility / joinability to the platform's jsonb and pushed nothing, and a
+// standalone instance never federates — it holds no hub credential and has no
+// authenticated path back to the platform to pull one. The settings were write-only
+// state. The transport that DOES exist is /etc/<slug>/web.env, read through the
+// branding pack, so the runner now writes them there at standup and src/branding.js
+// resolves them onto project.*.
+//
+// NOT covered here because it is NOT built: pushing a CHANGED setting to an
+// already-running instance (the branding pack is memoized + deep-frozen for the
+// process lifetime, so that needs a re-write + restart — the deferred
+// 'settings-apply' intent). These tests assert the standup leg only, and one of them
+// pins that the generated file does not CLAIM the push exists.
+//
+// DB-free and hermetic: pure builders + a child process with env set. No network.
+//
+// Run:  node tests/provisioning_settings_env.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const linesOf = (s) => s.split('\n').filter((l) => l && !l.startsWith('#'));
+const varsOf = (s) => Object.fromEntries(linesOf(s).map((l) => l.split('=')));
+
+console.log('settingsEnvLines — the platform\'s stored settings, as the instance reads them:');
+
+t('a stored setting is carried verbatim under the pack\'s env prefix', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'gated', joinability: 'invite_only' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'gated');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'invite_only');
+});
+
+t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothing', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'CLOUDBONGOS'));
+  // an instance must never have to infer a policy from an absent variable
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 2, 'both keys always present');
+});
+
+t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'sort-of-public', joinability: 'whenever' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+});
+
+t('the prefix is the pack\'s, not a guess — a wrong prefix silently never fires', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'MERCURY'));
+  assert.ok('MERCURY_PLATFORM_VISIBILITY' in v);
+  assert.ok(!('CLOUDBONGOS_PLATFORM_VISIBILITY' in v));
+});
+
+t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
+  const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
+  assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),
+    'a key added to the vocabulary must be carried, or the instance never learns it');
+});
+
+console.log('\nThe generated file tells the truth about what it is:');
+
+t('it does NOT claim a live push exists — that intent is not built', () => {
+  const s = provisioning.settingsEnvLines({}, 'X');
+  assert.doesNotMatch(s, /settings-apply/,
+    'no comment may name an intent action the runner cannot dispatch');
+  assert.match(s, /next provision run/i, 'it says when a change actually takes effect');
+});
+
+console.log('\nwebEnvBody — the settings ride the real per-instance env file:');
+
+t('the runner writes them into web.env alongside PORT and PGDATABASE', () => {
+  const provision = require('../scripts/gds/provision.js');
+  const body = provision.webEnvBody(
+    { slug: 'spike-harbor', port: 3010, db_name: 'spike-harbor', target_ref: 'jaxri/spike-harbor',
+      hosting_shape: 'standalone', settings: { platform_visibility: 'gated' } }, {});
+  assert.match(body, /_PLATFORM_VISIBILITY=gated/);
+  assert.match(body, /_JOINABILITY=apply/);
+  assert.match(body, /PORT=3010/, 'the rest of the file is untouched');
+});
+
+console.log('\nsrc/branding.js — the value actually reaches code:');
+
+t('the neutral pack ships today\'s behavior, so an un-pushed instance is unchanged', () => {
+  const pack = require('../config/branding.neutral.json');
+  assert.equal(pack.project.platformVisibility, 'public');
+  assert.equal(pack.project.joinability, 'apply');
+});
+
+t('the env override resolves onto project.* in a real process', () => {
+  const read = (env) => JSON.parse(execFileSync(process.execPath, ['-e',
+    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({v:r.project.platformVisibility,j:r.project.joinability}))"],
+    { cwd: ROOT, encoding: 'utf8', env: { ...process.env, ...env } }));
+  assert.deepEqual(read({}), { v: 'public', j: 'apply' }, 'no env → the pack default');
+  assert.deepEqual(
+    read({ CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'invite_only' }),
+    { v: 'gated', j: 'invite_only' },
+    'the web.env the runner writes is what the instance reads');
+});
+
+console.log(`\nprovisioning_settings_env: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/provisioning_teardown_states.mjs

@@ -0,0 +1,176 @@
+// tests/provisioning_teardown_states.mjs
+//
+// The teardown STATE gate (task 1003042, walk finding N5). Sibling of
+// provisioning_teardown_intent.mjs, which covers the intent-collision mapping;
+// this file covers which STATES may be torn down at all, and how the one
+// remaining refusal reads.
+//
+// The bug: TEARDOWN_FROM was a hand-kept whitelist, ['provisioning','active',
+// 'tearing_down'], that silently omitted 'requested' and 'error'. Because the
+// archon force-teardown route reuses the SAME set, there was no path — owner or
+// archon — to remove a snagged project, so errored rows accumulated forever
+// (instance 15 'swag' from 2026-08-07). Two things are pinned here:
+//
+//   • the set is DERIVED from INSTANCE_STATES minus 'torn_down', so a future
+//     state is teardownable by default and cannot be silently excluded again;
+//   • the surviving refusal is a plain SENTENCE on BOTH routes. force-teardown
+//     used the positional res.fail(code, 409, details) form with no message,
+//     and envelope()'s `message || code` fallback then put the bare string
+//     "not_teardownable" on the wire as the human text (§5.1's plain-sentence
+//     rule). This test mounts the REAL attachFail, not a shim, so that exact
+//     regression is caught on the wire and not merely in the call shape.
+//
+// DB-free: the pool is never queried — the data-access fns the routes need are
+// stubbed on the cached module object (the provisioning_teardown_intent.mjs
+// pattern). No network beyond a loopback listener.
+//
+// Run:  node tests/provisioning_teardown_states.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── the constant itself ──────────────────────────────────────────────────────
+
+console.log('TEARDOWN_FROM — every state except the one with nothing left:');
+
+t('every INSTANCE_STATE except torn_down may be torn down', () => {
+  for (const s of provisioning.INSTANCE_STATES) {
+    assert.equal(provisioning.TEARDOWN_FROM.has(s), s !== 'torn_down',
+      `${s} should ${s === 'torn_down' ? 'NOT ' : ''}be teardownable`);
+  }
+});
+
+t("'requested' and 'error' are IN — the two the old whitelist dropped (N5)", () => {
+  assert.equal(provisioning.TEARDOWN_FROM.has('requested'), true);
+  assert.equal(provisioning.TEARDOWN_FROM.has('error'), true);
+});
+
+t('the set is derived, not hand-listed — size tracks INSTANCE_STATES', () => {
+  assert.equal(provisioning.TEARDOWN_FROM.size, provisioning.INSTANCE_STATES.length - 1,
+    'a state added to INSTANCE_STATES must be teardownable by default, never silently excluded');
+});
+
+// ── the routes, over a real mounted router + the REAL error envelope ─────────
+
+let currentStatus = 'active';
+let teardownCalls = [];
+provisioning.getInstanceById = async (_db, id) =>
+  ({ id, owner_builder_id: 7, slug: 'swag', status: currentStatus });
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => {
+  teardownCalls.push({ id, requestedBy, status: currentStatus });
+  return { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: false };
+};
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner', rank: 'archon' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);   // the REAL envelope — a shim would hide the bare-code bug
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': 2 },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end('{}');
+  });
+}
+
+const OWNER = '/provisioning/instances/15/teardown';
+const FORCE = '/provisioning/instances/15/force-teardown';
+
+console.log('\nEvery non-torn-down state is accepted — on BOTH routes:');
+
+for (const state of ['requested', 'provisioning', 'active', 'tearing_down', 'error']) {
+  await ta(`owner teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(OWNER);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1, 'the intent was actually enqueued');
+  });
+  await ta(`force-teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(FORCE);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1);
+  });
+}
+
+await ta("the live repro: instance 15 'swag' sat at 'error' and could not be removed by ANYONE", async () => {
+  currentStatus = 'error';
+  teardownCalls = [];
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.status, 200, `owner teardown: ${owner.raw}`);
+  assert.equal(force.status, 200, `force-teardown: ${force.raw}`);
+  assert.equal(teardownCalls.length, 2, 'both roles now have a real path out');
+});
+
+console.log("\nOnly 'torn_down' still refuses — and it refuses in a sentence:");
+
+for (const [label, path] of [['owner teardown', OWNER], ['force-teardown', FORCE]]) {
+  await ta(`${label} refuses a torn-down project with 409 not_teardownable`, async () => {
+    currentStatus = 'torn_down'; teardownCalls = [];
+    const res = await post(path);
+    assert.equal(res.status, 409, res.raw);
+    assert.equal(res.body.error.code, 'not_teardownable');
+    assert.equal(res.body.error.details.status, 'torn_down', 'the real state is named');
+    assert.equal(teardownCalls.length, 0, 'nothing was enqueued');
+  });
+
+  await ta(`${label}'s message is a plain sentence, never the bare code (the N5 §5.1 violation)`, async () => {
+    currentStatus = 'torn_down';
+    const res = await post(path);
+    const m = String(res.body.error.message || '');
+    assert.notEqual(m, 'not_teardownable', 'the bare code must never be the human text');
+    assert.doesNotMatch(m, /_/, 'no snake_case identifier leaks into owner-facing copy');
+    assert.ok(/\s/.test(m) && /\.$/.test(m), `a real sentence, got: ${JSON.stringify(m)}`);
+    assert.match(m, /torn down/i, 'it says what is actually true of the project');
+  });
+}
+
+await ta('both routes give the SAME refusal — the copies cannot drift again', async () => {
+  currentStatus = 'torn_down';
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.body.error.message, force.body.error.message);
+  assert.equal(owner.status, force.status);
+});
+
+server.close();
+
+console.log(`\nprovisioning_teardown_states: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/public_landing_projects.mjs

@@ -121,6 +121,28 @@ test('the manage view is served: identity block + honest not-yet sections (task
   assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
 });
 
+test('the delete section is served live, and never claims to erase (task 1003042)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="mDel"/, 'the live section body is served');
+  assert.match(body, /id="mDelWhat"/, 'the teardown-vs-delete fold is served');
+  assert.match(body, /does <b>not<\/b> erase the project/i,
+    'the distinction survives to the wire, not just the source');
+  assert.match(body, /no permanent-delete button/i, 'the absent capability is admitted');
+  // the confirmation asks for the project's own name — the heaviest gate on the page
+  assert.match(body, /Type the project’s name to confirm/, 'the typed confirmation is served');
+  assert.match(body, /data-del-yes disabled/, 'and the act starts unreachable');
+});
+
+test('the served teardown copy no longer claims the address goes quiet (task 1003042)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // teardown has no DNS or Caddy leg: the hostname keeps resolving and 502s, so
+  // this sentence was false on the wire. Task 1002897 owns actually releasing it.
+  assert.doesNotMatch(body, /the address stops answering/,
+    'no served copy may promise a silence the runner does not deliver');
+  assert.match(body, /stays reserved for this project/,
+    'the truthful replacement is what ships');
+});
+
 test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="mRepoVis"/, 'the live section body is served');