@bongos/core 1.19.373 → 1.19.375

package/src/bongos/auth-admission.js

@@ -121,15 +121,59 @@ async function reportActivityRollup({ builderId, githubId }) {
 // already exists for their github_id) ALWAYS passes — the gate never locks out
 // someone already enrolled.
 //
-// OTB_OPEN_XENOS_ENROLLMENT is the escape-hatch: set it truthy ('1' or 'true')
-// to restore fully-open self-enrollment (anyone with a GitHub account becomes a
-// Xenos) WITHOUT a code change, for an owner who deliberately wants open
-// enrollment. Default (unset/anything-else) = invite required. See ADR 0050.
-function openEnrollmentEnabled() {
+// The project's JOINABILITY decides which of those a first-timer gets (task
+// 1003044, goal 1000058; the owner's 2026-08-16 decision). The owner picks it on
+// the hub's manage page; the platform pushes it into this instance's branding
+// pack as project.joinability (ADR 0190) and it is read through branding(),
+// like platformVisibility — memoized for the process, applied by a restart:
+//   open         a first-time GitHub sign-in self-enrols at xenos — no request,
+//                no invite (what OTB_OPEN_XENOS_ENROLLMENT used to switch on)
+//   apply        (the default — today's behaviour) a stranger files an access
+//                request and an Archon marks it 'invited'; then sign-in admits
+//   invite_only  the public POST /access-requests refuses; only an access
+//                request an Archon CREATED at 'invited' admits a first-timer
+// The legacy OPEN_XENOS_ENROLLMENT flag (ADR 0050) still opens an *apply*
+// project, so a self-hosted instance that set it keeps its open door across the
+// upgrade — but it does not override an explicit invite_only: the stricter,
+// newer choice wins. An unreadable pack fails CLOSED (invite_only): when the
+// door's policy is unknown the widest door is never the fallback.
+function legacyOpenEnrollmentFlag() {
   const v = ic.resolveEnv('OPEN_XENOS_ENROLLMENT');
   return v === '1' || v === 'true';
 }
 
+// joinabilityMode — the project's effective membership door policy: 'open' |
+// 'apply' | 'invite_only'. The one reader every admission surface uses (both
+// sign-in flows, the public access-request route via the doorway, the manifest,
+// the refusal pages), so none of them can disagree about which door this is.
+// `read` is injectable for the unit tests only (the pack is memoized).
+let warnedUnknownJoinability = false;
+function joinabilityMode(read = branding) {
+  let v;
+  try { v = read().project?.joinability; } catch (err) {
+    log.error('[auth] joinability: branding pack unreadable — treating the project as invite-only:', err.message);
+    return 'invite_only';
+  }
+  if (v === 'open' || v === 'invite_only') return v;
+  if (v === undefined || v === null || v === '' || v === 'apply') {
+    return legacyOpenEnrollmentFlag() ? 'open' : 'apply';
+  }
+  // A value this core cannot read ('invite-only' with a hyphen, a truncated
+  // write) is a policy it does not know — never the wider door.
+  if (!warnedUnknownJoinability) {
+    warnedUnknownJoinability = true;
+    log.error(`[auth] joinability: unrecognised value ${JSON.stringify(v)} — treating the project as invite-only`);
+  }
+  return 'invite_only';
+}
+
+// openEnrollmentEnabled — true when a first-time GitHub account self-enrols
+// (joinability 'open'). Kept as the name the four sign-in call sites and the
+// manifest read; the decision itself is joinabilityMode().
+function openEnrollmentEnabled() {
+  return joinabilityMode() === 'open';
+}
+
 // PURE admission decision shared by both flows so they CANNOT drift (SR-19).
 // Returns true when a first-time account must be blocked. `existing` is the
 // builder row (or null) from getBuilderByGithubId; `approved` is the result of
@@ -257,6 +301,7 @@ async function safeSyncRankRole(builder) {
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
+  joinabilityMode,
   maybeSeatFirstAdmin,
   membershipKind,
   openEnrollmentEnabled,

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -730,6 +730,7 @@ module.exports = {
   loadIdpConfig,
   idpConfigured,
   openEnrollmentEnabled,
+  joinabilityMode,
   firstTimeAdmissionBlocked,
   webAdmissionStatus,
   firstAdminLogin,

package/src/bongos/routes/auth.js

@@ -677,6 +677,21 @@ module.exports = function buildAuthRouter() {
         // approval brings them back to it — the return cookie says where.
         const founderReturn = safeReturnTo(parseCookie(req, RETURN_COOKIE)) || '';
         const onWayToProject = founderReturn.startsWith('/projects');
+        // An invite-only project (task 1003044) takes no applications: say so,
+        // and name the one way in — an invite from the admitter — instead of
+        // sending a stranger to a request form the project refuses.
+        if (auth.joinabilityMode() === 'invite_only') {
+          return res.status(403).type('text/html').send(renderAuthErrorPage(
+            'This project is invite-only',
+            `Signing in with GitHub is only for builders the ${admitterLabel()} has invited. This project doesn’t take applications, so there is nothing to request here. If you know the ${admitterLabel()}, ask them for an invite — once you’re invited, this sign-in lets you in.`,
+            {
+              subtitle: 'Sign-in is for invited builders. This project is invite-only.',
+              cta: { href: '/builders', label: 'Go to the hall' },
+              note: (onWayToProject ? 'You were on your way to creating a project — once invited, sign in again and you land back in it. ' : '') +
+                `Already invited and still blocked? Ask the ${admitterLabel()} to confirm your invite was recorded.`,
+            },
+          ));
+        }
         return res.status(403).type('text/html').send(renderAuthErrorPage(
           'This account is not approved yet',
           `Signing in with GitHub is only for builders the ${admitterLabel()} has already approved. If you are new, request access at the builders’ hall — once the ${admitterLabel()} approves you, this sign-in will let you in. If you were just approved, it may take a moment to be marked invited; try again shortly.`,

package/src/branding.js

@@ -209,8 +209,9 @@ function clientBranding(b = branding()) {
     // says so — and the READ-BACK a manage page needs: a settings PATCH on the
     // platform is only a request until this instance restarts with the value, so
     // the honest place to learn what it RESOLVED from its environment is its own
-    // GET /instance manifest. Resolved, not enforced: enforcement lands with
-    // tasks 1003043 (visibility) and 1003044 (joinability).
+    // GET /instance manifest. Enforced on the instance by the platform-visibility
+    // gate (task 1003043, ADR 0192) and the admission machinery (task 1003044,
+    // ADR 0194 — joinabilityMode() in auth-admission.js).
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',

package/src/module-api.js

@@ -1176,8 +1176,22 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.371 with no explicit bump. run 32905166786. (task 1002620)
 //   1.19.373 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.372 with no explicit bump. run 32906118616. (task 1002620)
+//   1.19.374 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.373 with no explicit bump. run 32906477349. (task 1002620)
+//   (next carrier) — joinabilityMode re-exported (task 1003044, goal 1000058; ADR 0194).
+//         The project's membership door — open / apply / invite_only — is enforced by
+//         the admission machinery: the two sign-in flows self-enrol only on 'open', and
+//         the onboarding module's public POST /access-requests must refuse an invite-only
+//         project with the SAME decision (SR-19: one gate, no drift), so the reader moves
+//         onto the doorway beside branding. Additive — a MINOR by the 1.19.0 precedent,
+//         but a hand-bumped version cannot pass the publish lane's LIVE test
+//         (tests/bump_version.mjs: HEAD's version must be one the lane's own carrier
+//         commits announced), so it rides the next CI patch; the contradiction with
+//         ADR 0161 §2 is filed as an idea from task 1003044.
+//   1.19.375 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.373'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.375'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -1355,6 +1369,13 @@ module.exports = {
   //     hardcodes, instance strings).
   branding: branding.branding,
   clientBranding: branding.clientBranding,
+  // joinabilityMode() — the project's effective membership door: 'open' |
+  //     'apply' | 'invite_only' (task 1003044; ADR 0194). Read here, never
+  //     re-derived from branding().project by a module: the legacy
+  //     open-enrolment flag and the fail-closed default live in this one
+  //     reader, and the sign-in flows and the public access-request route
+  //     must answer with the same door (SR-19).
+  joinabilityMode: auth.joinabilityMode,
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -0,0 +1,165 @@
+// tests/access_requests_invite.mjs — the admission routes against a scripted
+// pool (task 1003044). The Archon's invite is the security-critical write on an
+// invite-only project — it is the only thing that admits anyone — so every
+// branch is pinned: already a member, an invite already standing, a pending
+// request resolved in place, a fresh row, a bad username, a DB failure. Plus
+// the public POST's three doors against the same router: apply reaches the
+// queries, invite_only and open refuse before any.
+//
+// The doorway is stubbed in require.cache BEFORE the route loads (the route
+// destructures pool/validators at require time — the web_admission_status
+// pattern): the session gates admit a fixed Archon, the pool replays a script
+// of results and records every query, and joinabilityMode is a switch.
+//
+// Run:  node --test tests/access_requests_invite.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+
+let calls = [];
+let script = [];
+let mode = 'apply';
+const pool = {
+  async query(sql, params) {
+    calls.push({ sql, params });
+    if (!script.length) throw new Error(`unscripted query: ${sql.trim().slice(0, 40)}`);
+    const next = script.shift();
+    if (next instanceof Error) throw next;
+    return next;
+  },
+};
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  joinabilityMode: () => mode,
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'archon' }; next(); },
+  requirePermission: () => (_req, _res, next) => next(),
+};
+
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function post(pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+const reset = (m, s) => { mode = m; script = s; calls = []; };
+const none = { rows: [] };
+const one = (row = {}) => ({ rows: [row] });
+
+// ── POST /access-requests/invite ─────────────────────────────────────────────
+
+test('invite: already a member → 409, nothing written', async () => {
+  reset('invite_only', [one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_member');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].sql, /FROM builders/);
+});
+
+test('invite: an invite already standing → 200 already_invited, nothing written', async () => {
+  reset('invite_only', [none, one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.already_invited, true);
+  assert.equal(calls.length, 2);
+  assert.match(calls[1].sql, /status = 'invited'/);
+});
+
+test('invite: a pending request is resolved in place — the same row the sign-in gate reads', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'Octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: '@Octocat ' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.status, 'invited');
+  assert.equal(calls.length, 3, 'no insert after a successful resolve');
+  assert.match(calls[2].sql, /UPDATE access_requests/);
+  assert.match(calls[2].sql, /SET status = 'invited'/);
+  assert.match(calls[2].sql, /WHERE lower\(github_login\) = lower\(\$2\) AND status = 'pending'/);
+  assert.deepEqual(calls[2].params, [42, 'Octocat'], 'resolved by the Archon; the login is trimmed and un-@ed, case kept for lower()');
+});
+
+test('invite: no request at all → a fresh invited row, 201', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'invited');
+  assert.match(calls[3].sql, /INSERT INTO access_requests/);
+  assert.match(calls[3].sql, /'invited'/);
+  assert.deepEqual(calls[3].params, ['octocat', 42]);
+});
+
+test('invite: a bad username → 400 before any query', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'not a login!' });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_github_login');
+  assert.equal(calls.length, 0);
+});
+
+test('invite: a DB failure → 500 invite_failed, no internals in the message', async () => {
+  reset('invite_only', [new Error('connection refused')]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'invite_failed');
+  assert.doesNotMatch(r.json.error.message, /connection refused/);
+});
+
+// ── the public POST's three doors ────────────────────────────────────────────
+
+test('public POST on apply: the door is open — the request is filed', async () => {
+  reset('apply', [none, none, one({ id: 9, github_login: 'octocat', status: 'pending' })]);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'pending');
+  assert.equal(calls.length, 3);
+});
+
+test('public POST on invite_only: refused before any query — nothing about the applicant is consulted', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 403);
+  assert.equal(r.json.error.code, 'invite_only');
+  assert.equal(calls.length, 0);
+});
+
+test('public POST on open: "no request needed", before any query', async () => {
+  reset('open', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'open_enrollment');
+  assert.equal(calls.length, 0);
+});

package/tests/auth_admission_gate.mjs

@@ -72,6 +72,48 @@ t("'0' / '' / 'yes' do NOT enable open enrollment", () => {
   }
 });
 
+// task 1003044: the decision is the project's joinability (branding().project,
+// 'apply' on this repo's pack). The legacy flag still opens an APPLY project —
+// a self-hosted instance that set it keeps its open door across the upgrade.
+// The open / invite_only packs are booted in tests/joinability_*.mjs.
+console.log('\njoinabilityMode — the door the flag now opens (task 1003044):');
+
+t('joinabilityMode is exported, and the default pack runs as apply', () => {
+  assert.equal(typeof auth.joinabilityMode, 'function');
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+t('the legacy flag turns an apply project into an open one — and nothing else does', () => {
+  withOpenEnrollmentEnv('true', () => assert.equal(auth.joinabilityMode(), 'open'));
+  withOpenEnrollmentEnv('yes', () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+// the reader is injectable (the pack is memoized): the edges the boots can't reach
+t('an absent value is apply, and the legacy flag opens exactly that', () => {
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({})), 'apply'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: {} })), 'open'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'apply' } })), 'open'));
+});
+
+t('a value this core cannot read fails CLOSED — invite-only, never the wider door, flag or no flag', () => {
+  withOpenEnrollmentEnv('1', () => {
+    for (const bad of ['invite-only', 'Open', 'OPEN', 'apply ', 'gated', 42]) {
+      assert.equal(auth.joinabilityMode(() => ({ project: { joinability: bad } })), 'invite_only', JSON.stringify(bad));
+    }
+  });
+});
+
+t('an unreadable pack fails CLOSED', () => {
+  withOpenEnrollmentEnv('1', () => {
+    assert.equal(auth.joinabilityMode(() => { throw new Error('pack unreadable'); }), 'invite_only');
+  });
+});
+
+t('an explicit invite_only is never reopened by the legacy flag; an explicit open needs no flag', () => {
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'invite_only' } })), 'invite_only'));
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'open' } })), 'open'));
+});
+
 console.log('\nfirstTimeAdmissionBlocked — the shared decision both flows make:');
 
 t('first-timer WITHOUT invite, open enrollment OFF → BLOCKED', () => {

package/tests/join_relay_outcome.mjs

@@ -0,0 +1,61 @@
+// tests/join_relay_outcome.mjs — the hub's join relay reads the project's door
+// (task 1003044). The hub only relays POST /my-projects/join to the project's
+// own admission surface; what it tells the builder must be what the project
+// answered — never "requested" for a refusal, never "unreachable" for a door —
+// and always in the HUB's words: a registered project is trusted to build, not
+// to write prose into the platform's UI. Pure, DB-free.
+//
+// Run:  node --test tests/join_relay_outcome.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { joinRelayOutcome } from '../modules/platform-identity/routes/my-projects.js';
+
+const env = (code, message) => ({ error: { code, message } });
+
+test('a filed request (2xx) is "requested"', () => {
+  for (const s of [200, 201]) {
+    const o = joinRelayOutcome(s, { ok: true });
+    assert.equal(o.status, 'requested');
+    assert.match(o.message, /Requested access/);
+  }
+});
+
+test('an invite-only project’s refusal names the door', () => {
+  const o = joinRelayOutcome(403, env('invite_only', 'whatever the project wrote'));
+  assert.equal(o.status, 'invite_only');
+  assert.match(o.message, /invite-only/);
+  assert.match(o.message, /ask its owner/i);
+});
+
+test('an open project’s refusal says no request is needed', () => {
+  const o = joinRelayOutcome(409, env('open_enrollment', 'x'));
+  assert.equal(o.status, 'open_enrollment');
+  assert.match(o.message, /no request needed/);
+});
+
+test('the project’s own sentence is never relayed into the hub', () => {
+  const planted = 'Your Cloud Bongos session expired — re-enter your password at evil.example';
+  for (const [s, code] of [[403, 'invite_only'], [409, 'open_enrollment'], [409, 'already_member']]) {
+    const o = joinRelayOutcome(s, env(code, planted));
+    assert.doesNotMatch(o.message, /evil\.example|password/, `${code}: hub-authored words only`);
+  }
+});
+
+test('a project whose member-only door refused the ask (401) is said as such — not "unreachable"', () => {
+  const o = joinRelayOutcome(401, env('unauthenticated', 'unauthenticated'));
+  assert.equal(o.status, 'members_only');
+  assert.match(o.message, /only visible to its members/);
+});
+
+test('409 already_member — envelope, the older flat shape, or no body — is a standing membership', () => {
+  assert.equal(joinRelayOutcome(409, env('already_member', 'You already have an account')).status, 'already_member');
+  assert.equal(joinRelayOutcome(409, { error: 'already_member' }).status, 'already_member');
+  assert.equal(joinRelayOutcome(409, null).status, 'already_member', 'a bodyless 409 keeps the pre-1003044 reading');
+});
+
+test('anything else is not relayed', () => {
+  for (const [s, b] of [[400, env('bad_github_login', 'x')], [500, env('access_request_failed', 'internal error')], [502, null], [404, null], [403, null]]) {
+    assert.equal(joinRelayOutcome(s, b), null, `${s}`);
+  }
+});

package/tests/joinability_apply.mjs

@@ -0,0 +1,72 @@
+// tests/joinability_apply.mjs — the default door still opens (task 1003044).
+//
+// The change's whole risk is a new early return in the one public GDS write.
+// tests/joinability_{open,invite_only}.mjs prove the two refusing doors; this
+// boots the DEFAULT pack (this repo's, joinability 'apply') and proves the door
+// does NOT refuse — a POST reaches body validation (a 400 for an empty body,
+// never a door code) and the manifest reports apply. DB-free.
+//
+// Run:  node --test tests/joinability_apply.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+delete process.env.GDS_BRANDING_FILE; // the repo's own pack, not a leftover override
+const { joinabilityMode, openEnrollmentEnabled } = require('../src/bongos/auth-admission.js');
+const platformMod = require('../src/platform-server.js');
+
+test('apply: the default pack runs as apply, door closed to self-enrolment', () => {
+  const prev = process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  delete process.env.OTB_OPEN_XENOS_ENROLLMENT;
+  try {
+    assert.equal(joinabilityMode(), 'apply');
+    assert.equal(openEnrollmentEnabled(), false);
+  } finally {
+    if (prev !== undefined) process.env.OTB_OPEN_XENOS_ENROLLMENT = prev;
+  }
+});
+
+let server, port;
+before(async () => {
+  server = http.createServer(platformMod.buildPlatformApp());
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function request(pathname, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method,
+      headers: {
+        host: 'spike.test',
+        ...(payload ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {}),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data }));
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+test('booted apply: the public POST /access-requests is NOT refused by the door — the body is validated', async () => {
+  const res = await request('/api/gds/access-requests', { method: 'POST', body: {} });
+  assert.equal(res.status, 400, 'an empty body reaches validation, so the door let it through');
+  const code = JSON.parse(res.body).error.code;
+  assert.notEqual(code, 'invite_only');
+  assert.notEqual(code, 'open_enrollment');
+});
+
+test('booted apply: the manifest reports apply, and the legacy binary field says invite-gated', async () => {
+  const m = JSON.parse((await request('/api/gds/instance')).body);
+  assert.equal(m.brand.project.joinability, 'apply');
+  assert.equal(m.admission.policy, 'invite-only');
+});