@bongos/core 1.19.294 → 1.19.296

package/tests/idea_spark_mark.mjs

@@ -0,0 +1,231 @@
+// tests/idea_spark_mark.mjs
+//
+// task 1002920 (BV1.R144, goal 1000062) — mark a Quick Idea as a Big Idea Spark.
+//
+// The done-when, as assertions: ONLY the original author can mark their idea
+// (the mark is the consent that makes cross-builder development fair, so a
+// non-author is a 403 and writes NOTHING); the mark is REVERSIBLE (DELETE puts
+// the idea back to quick); and a spark is visibly DISTINCT from both a quick and
+// a full idea (the grade comes back on the row, and a Full Idea is refused
+// rather than being flattened into a spark).
+//
+// DB-free the idea_full_capture.mjs way (pool.query patched on the doorway
+// before the modules load), driving the REAL route handlers through a stub
+// req/res — the same author gate, the same error map a client sees.
+//
+// Run:  node tests/idea_spark_mark.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+// The one idea every test reads, reshaped per-test. `captured_by: '9'` is the
+// stub builder below, so the default row IS author-owned.
+let idea = null;
+let queries = [];
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/INSERT INTO ideas_grades/i.test(sql)) {
+    return { rows: [{ idea_id: params[0], grade: params[1], template_key: params[2], field_values: JSON.parse(params[3]), completeness_score: params[4] }] };
+  }
+  // Any read of idea_inbox is getIdea — return the row under test (or nothing).
+  if (/FROM idea_inbox/i.test(sql)) {
+    return { rows: idea ? [idea] : [] };
+  }
+  return { rows: [] };
+};
+
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+const router = routesFactory({});
+
+// Pull the real handlers off the mounted router — the last handler in each
+// stack, i.e. after requireBuilder.
+function handlerFor(pathStr, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pathStr && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${pathStr} is not mounted`);
+  const stack = layer.route.stack.map((s) => s.handle);
+  return stack[stack.length - 1];
+}
+const postSpark = handlerFor('/inbox/:id/spark', 'post');
+const deleteSpark = handlerFor('/inbox/:id/spark', 'delete');
+
+function call(handler, { builderId = '9' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = { params: { id: '77' }, body: {}, query: {}, builder: { id: builderId, rank: 'xenos' } };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    // asyncHandler owns the catch in production; surface a throw as a failure here.
+    Promise.resolve(handler(req, res, (err) => reject(err || new Error('next() called')))).catch(reject);
+  });
+}
+
+const gradeWrites = () => queries.filter((q) => /INSERT INTO ideas_grades/i.test(q.sql));
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  idea = { id: '77', title: 'a thought', status: 'open', captured_by: '9', grade: 'quick', template_key: null, field_values: null, completeness_score: null };
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- the author gate: the whole point of the mark ------------------------
+
+await test('the AUTHOR can mark their quick idea as a spark', async () => {
+  const r = await call(postSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.sparked, true);
+  assert.equal(r.payload.unchanged, false);
+  assert.equal(r.payload.idea.grade, 'spark', 'the row comes back carrying its new grade');
+  const w = gradeWrites();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].params[1], 'spark');
+});
+
+await test('a NON-author is a 403 and nothing is written — the consent is not theirs to give', async () => {
+  const r = await call(postSpark, { builderId: '12' });
+  assert.equal(r.status, 403);
+  assert.equal(r.payload.error, 'not_your_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('an idea with NO author cannot be sparked by anyone (no consent to read)', async () => {
+  idea.captured_by = null;
+  const r = await call(postSpark);
+  assert.equal(r.status, 403);
+  assert.equal(r.payload.error, 'not_your_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('a non-author cannot WITHDRAW the mark either', async () => {
+  idea.grade = 'spark';
+  const r = await call(deleteSpark, { builderId: '12' });
+  assert.equal(r.status, 403);
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- reversible ----------------------------------------------------------
+
+await test('the mark is REVERSIBLE: DELETE puts the idea back to quick', async () => {
+  idea.grade = 'spark';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.sparked, false);
+  assert.equal(r.payload.unchanged, false);
+  assert.equal(r.payload.idea.grade, 'quick');
+  const w = gradeWrites();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].params[1], 'quick', 'un-sparking writes an EXPLICIT quick row (R140: it reads as quick either way)');
+});
+
+await test('both directions are idempotent and report `unchanged` rather than erroring', async () => {
+  idea.grade = 'spark';
+  const again = await call(postSpark);
+  assert.equal(again.status, 200);
+  assert.equal(again.payload.unchanged, true);
+  assert.equal(gradeWrites().length, 0, 'no write for a no-op');
+
+  queries = [];
+  idea.grade = 'quick';
+  const off = await call(deleteSpark);
+  assert.equal(off.status, 200);
+  assert.equal(off.payload.sparked, false);
+  assert.equal(off.payload.unchanged, true);
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- distinct from a FULL idea ------------------------------------------
+
+await test('a FULL idea is refused 409 — and its field_values are never touched', async () => {
+  const fields = { purpose: 'x'.repeat(60), big_picture: 'y'.repeat(60) };
+  idea.grade = 'full';
+  idea.field_values = fields;
+  idea.completeness_score = 80;
+  const r = await call(postSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'not_a_quick_idea');
+  assert.equal(r.payload.grade, 'full');
+  assert.equal(gradeWrites().length, 0, 'a spark write would have WIPED the five fields');
+  assert.deepEqual(idea.field_values, fields);
+});
+
+await test('un-sparking a FULL idea is refused too — it is not a withdrawn spark', async () => {
+  idea.grade = 'full';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'not_a_quick_idea');
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- only an OPEN idea awaits development -------------------------------
+
+await test('a promoted idea cannot be newly marked — the spark queue must stay pickable', async () => {
+  idea.status = 'promoted';
+  const r = await call(postSpark);
+  assert.equal(r.status, 409);
+  assert.equal(r.payload.error, 'idea_not_open');
+  assert.equal(r.payload.status, 'promoted');
+  assert.equal(gradeWrites().length, 0);
+});
+
+await test('but a stale mark can always be WITHDRAWN, whatever the status', async () => {
+  idea.status = 'discarded';
+  idea.grade = 'spark';
+  const r = await call(deleteSpark);
+  assert.equal(r.status, 200);
+  assert.equal(r.payload.idea.grade, 'quick');
+  assert.equal(gradeWrites().length, 1, 'housekeeping a dead idea\'s mark is never blocked');
+});
+
+// --- plumbing -----------------------------------------------------------
+
+await test('a missing idea is a 404, not a 500', async () => {
+  idea = null;
+  const r = await call(postSpark);
+  assert.equal(r.status, 404);
+  assert.equal(r.payload.error, 'idea_not_found');
+  assert.equal(gradeWrites().length, 0);
+});
+
+// --- the CLI's message layer, against the REAL envelope -----------------
+//
+// The stub res.fail above spreads its extras onto the payload for terseness (the
+// idea_full_capture.mjs idiom). Production does NOT: ADR 0116's envelope nests
+// them under error.details. So the CLI's explain() is checked against the real
+// builder, not the stub — that mismatch is a silent "grade=undefined" in an
+// ideator's terminal, which no route-level assertion above would catch.
+const { explain } = require('../scripts/gds/spark.js');
+const { envelope } = require('../src/bongos/api-errors.js');
+
+await test('the CLI reads each refusal off the REAL envelope shape', async () => {
+  const full = explain(409, envelope('not_a_quick_idea', undefined, { grade: 'full' }));
+  assert.match(full, /already a Full Idea \(grade=full\)/);
+  assert.doesNotMatch(full, /undefined/);
+
+  const closed = explain(409, envelope('idea_not_open', undefined, { status: 'promoted' }));
+  assert.match(closed, /is promoted, so it is not awaiting development/);
+  assert.doesNotMatch(closed, /undefined/);
+
+  assert.match(explain(403, envelope('not_your_idea')), /not yours to mark/);
+  assert.match(explain(404, envelope('idea_not_found')), /No idea with that id/);
+});
+
+await test('an UNMAPPED server refusal is shown raw, never swallowed', async () => {
+  const out = explain(409, envelope('some_future_rule', undefined, { hint: 'x' }));
+  assert.match(out, /spark failed \(409\)/);
+  assert.match(out, /some_future_rule/, 'a new server-side rule must stay visible');
+});
+
+console.log(`\nidea_spark_mark: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_spark_queue.mjs

@@ -0,0 +1,225 @@
+// tests/idea_spark_queue.mjs
+//
+// task 1002921 (BV1.R145, goal 1000062) — the spark queue.
+//
+// The done-when, as assertions: the GET returns OPEN sparks NOT YET DEVELOPED,
+// newest first; a DEVELOPED spark leaves the queue; and the queue is readable by
+// ANY builder (a Xenos included — it is a pickup surface, and the author's R144
+// mark is the consent).
+//
+// It also pins two things that are load-bearing but invisible in a passing app:
+// the DECLARATION ORDER against `GET /inbox/:id` (which would otherwise capture
+// the literal "sparks" and 400 the whole queue), and the fact that the count and
+// the list share one predicate — a pill that disagrees with its rows is the
+// classic version of this bug.
+//
+// DB-free the idea_full_capture.mjs way: pool.query patched on the doorway before
+// the modules load, so the REAL SQL is captured and the REAL handler runs.
+//
+// Run:  node tests/idea_spark_queue.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+let queries = [];
+let listRows = [];
+let countN = 0;
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/COUNT\(\*\)/i.test(sql)) return { rows: [{ n: countN }] };
+  return { rows: listRows };
+};
+
+const inbox = require('../modules/ideas/inbox.js');
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+const router = routesFactory({});
+
+const mounted = router.stack.filter((l) => l.route)
+  .map((l) => `${Object.keys(l.route.methods)[0].toUpperCase()} ${l.route.path}`);
+
+function handlerFor(pathStr, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pathStr && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${pathStr} is not mounted`);
+  const stack = layer.route.stack.map((s) => s.handle);
+  return stack[stack.length - 1];
+}
+const getSparks = handlerFor('/inbox/sparks', 'get');
+
+function call({ query = {}, rank = 'metic' } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = { params: {}, body: {}, query, builder: { id: '9', rank } };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    Promise.resolve(getSparks(req, res, (err) => reject(err || new Error('next() called')))).catch(reject);
+  });
+}
+
+const listSql = () => queries.find((q) => !/COUNT\(\*\)/i.test(q.sql));
+const countSql = () => queries.find((q) => /COUNT\(\*\)/i.test(q.sql));
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  listRows = [];
+  countN = 0;
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- declaration order: the bug that would 400 the whole queue -----------
+
+await test('GET /inbox/sparks is declared BEFORE GET /inbox/:id', () => {
+  const iSparks = mounted.indexOf('GET /inbox/sparks');
+  const iId = mounted.indexOf('GET /inbox/:id');
+  assert.ok(iSparks >= 0, 'the spark queue route is mounted');
+  assert.ok(iId >= 0, 'the by-id read is mounted');
+  assert.ok(
+    iSparks < iId,
+    `declaration order is load-bearing: with :id first, "/inbox/sparks" binds id="sparks" and parseId 400s the queue (sparks@${iSparks}, :id@${iId})`,
+  );
+});
+
+// --- the predicate: open, undeveloped sparks, newest first ---------------
+
+await test('the queue asks for grade=spark AND status=open — nothing else', async () => {
+  const r = await call();
+  assert.equal(r.status, 200);
+  const sql = listSql().sql;
+  assert.match(sql, /g\.grade = 'spark'/, 'only sparks');
+  assert.match(sql, /i\.status = 'open'/, 'only open ideas');
+});
+
+await test('a DEVELOPED spark leaves the queue by GRADE, with no `developed` flag', async () => {
+  await call();
+  const sql = listSql().sql;
+  // R146 develops in place and flips the grade spark→full, so grade='spark' IS
+  // "not yet developed". A second source of truth could disagree with the grade.
+  assert.doesNotMatch(sql, /developed/i, 'no separate developed column/flag');
+  assert.doesNotMatch(sql, /promoted_to_task_id\s*IS\s*NULL/i, 'exit is the grade flip, not a promote link');
+});
+
+await test('newest first, with a stable tiebreak', async () => {
+  await call();
+  assert.match(listSql().sql, /ORDER BY i\.captured_at DESC, i\.id DESC/);
+});
+
+await test('an INNER join from ideas_grades — a spark is never implicit', async () => {
+  await call();
+  const sql = listSql().sql;
+  // Inverted from every other idea read on purpose: absence of a grade row means
+  // 'quick', so a spark ALWAYS has a real row, and starting from ideas_grades
+  // lets ideas_grades_grade_score_idx drive the scan.
+  assert.match(sql, /FROM ideas_grades g/, 'driven by the graded table');
+  assert.match(sql, /JOIN idea_inbox i ON i\.id = g\.idea_id/);
+  assert.doesNotMatch(sql, /LEFT JOIN ideas_grades/, 'not the COALESCE-to-quick read shape');
+});
+
+await test('the author is named — attribution is the point of a pickup surface', async () => {
+  listRows = [{ id: '5', title: 'a spark', captured_by: '3', grade: 'spark', filed_by_login: 'someone' }];
+  const r = await call();
+  assert.match(listSql().sql, /github_login/);
+  assert.equal(r.payload.sparks[0].filed_by_login, 'someone');
+});
+
+// --- the count cannot disagree with the list ----------------------------
+
+await test('count and list share ONE predicate', async () => {
+  countN = 7;
+  const r = await call();
+  assert.equal(r.payload.count, 7);
+  const l = listSql().sql;
+  const c = countSql().sql;
+  for (const clause of [/g\.grade = 'spark'/, /i\.status = 'open'/]) {
+    assert.match(l, clause);
+    assert.match(c, clause, 'the pill must not claim sparks the list will not show');
+  }
+});
+
+// --- readable by ANY builder -------------------------------------------
+
+await test('a XENOS can read the queue — the R144 mark is the consent', async () => {
+  listRows = [{ id: '5', title: 'a spark', grade: 'spark' }];
+  const r = await call({ rank: 'xenos' });
+  assert.equal(r.status, 200, 'no rank gate on a pickup surface');
+  assert.equal(r.payload.sparks.length, 1);
+});
+
+await test('but the skill-friction visibility gate still applies, to BOTH halves', async () => {
+  await call({ rank: 'xenos' });
+  const l = listSql();
+  const c = countSql();
+  assert.match(l.sql, /i\.title NOT LIKE/, 'a Xenos does not see routine-filed friction rows');
+  assert.match(c.sql, /i\.title NOT LIKE/, 'nor are they counted for them');
+  assert.ok(l.params.some((p) => typeof p === 'string' && p.endsWith('%')));
+
+  queries = [];
+  await call({ rank: 'archon' });
+  assert.doesNotMatch(listSql().sql, /i\.title NOT LIKE/, 'a trusted rank sees everything');
+});
+
+// --- limit -------------------------------------------------------------
+
+await test('limit defaults to 50 and is clamped to 1..100', async () => {
+  await call();
+  assert.equal(listSql().params.at(-1), 50, 'default');
+
+  for (const [given, want] of [['10', 10], ['0', 50], ['-5', 50], ['1000', 50], ['abc', 50], ['100', 100]]) {
+    queries = [];
+    await call({ query: { limit: given } });
+    assert.equal(listSql().params.at(-1), want, `limit=${given}`);
+  }
+});
+
+await test('the count query takes no limit — it counts the whole queue', async () => {
+  await call({ query: { limit: '5' } });
+  assert.equal(countSql().params.length, 0, 'a trusted viewer adds no filter param, and the count never takes the limit');
+});
+
+// --- the CLI's rendering of the queue ------------------------------------
+
+const { renderQueue } = require('../scripts/gds/spark.js');
+
+await test('the empty queue reads as an ANSWER, not a blank screen', () => {
+  const out = renderQueue({ sparks: [], count: 0 });
+  assert.match(out, /No sparks are awaiting development/);
+  assert.match(out, /mark one of your own/, 'it says what to do next');
+});
+
+await test('each row links to the HALL, never a bare #NNN', () => {
+  const out = renderQueue({
+    sparks: [{ id: '812', title: 'a thought', filed_by_login: 'someone', captured_at: '2026-08-20T10:11:12Z' }],
+    count: 1,
+  });
+  // A bare "#NNN" autolinks to a GitHub issue and 404s — our ids are not
+  // GitHub's. The hall deep-link resolver form is /builders/#/idea/N.
+  assert.match(out, /\/builders\/#\/idea\/812/);
+  assert.doesNotMatch(out, /(^|[^/])#812\b/, 'no bare ref');
+  assert.match(out, /@someone/, 'the author is named');
+  assert.match(out, /2026-08-20/);
+});
+
+await test('a missing author degrades to prose, not "@undefined"', () => {
+  const out = renderQueue({ sparks: [{ id: '1', title: 't', filed_by_login: null }], count: 1 });
+  assert.match(out, /an unnamed builder/);
+  assert.doesNotMatch(out, /undefined|null/);
+});
+
+await test('the header distinguishes "showing N" from the true total', () => {
+  assert.match(renderQueue({ sparks: [{ id: '1', title: 't' }], count: 5 }), /5 sparks awaiting development \(showing 1\)/);
+  assert.match(renderQueue({ sparks: [{ id: '1', title: 't' }], count: 1 }), /^1 spark awaiting development:/m, 'singular, no "showing"');
+});
+
+console.log(`\nidea_spark_queue: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);