@bongos/core 1.19.391 → 1.19.393

package/tests/project_visibility_db.mjs

@@ -0,0 +1,175 @@
+// tests/project_visibility_db.mjs — BV1.R04, task 1002323 (goal 1000046; real DB).
+//
+// The DB-free sibling (modules/platform-identity/tests/platform-identity.mjs) pins the
+// JS gate and the migration's TEXT. This proves what only a real transaction engine can:
+//
+//   1. THE BACKFILL — a row that existed BEFORE migration 011 comes out `visibility =
+//      'public'` (today's behaviour, unchanged) with `description` still NULL, because
+//      ADR 0182 D4 refuses to seed the publish bar from `tagline`.
+//   2. THE CHECK actually refuses a fourth stored state — 'unlisted' / 'dark-matter'
+//      cannot be written, which is the constraint the whole 3+1 split rests on.
+//   3. THE DERIVED GATE agrees in SQL and in JS — publishableSql() and
+//      projectPublishability() return the same verdict for the same row, so the feed
+//      (R06) and the owner-facing refusal (R16) cannot disagree about who is on the map.
+//   4. `featured = true AND status = 'active'` is NO LONGER "is this public" — a
+//      featured, active, visibility='public' husk with no description is dark matter.
+//   5. A client re-registration (registerClient → upsertProject) never resets an owner's
+//      door: the hub row is a CACHE and the door arrives by report (ADR 0182 D5 / R08).
+//   6. The migration is IDEMPOTENT — replaying it over populated rows changes nothing.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in run-unit-tests.js's
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/project_visibility_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`project_visibility_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// Fixture origins carry the task id so a shared DB can never collide with real rows.
+const LEGACY = 'https://legacy-1002323.test';
+const HUSK = 'https://husk-1002323.test';
+const FULL = 'https://full-1002323.test';
+const ALL = [LEGACY, HUSK, FULL];
+
+const q = (sql, params) => pool.query(sql, params);
+const cleanup = async () => {
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [ALL]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE origin = ANY($1::text[])`, [ALL]).catch(() => {});
+};
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const rowOf = async (origin) => (await q(
+  `SELECT id, origin, name, tagline, description, visibility, status, featured
+     FROM platform_identity_projects WHERE origin = $1`, [origin],
+)).rows[0];
+
+try {
+  // The table as it stood BEFORE this task, so the backfill has something to act on.
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_006_project_type.sql'));
+  await cleanup();
+
+  // ---------------------------------------------------------------------------
+  // 1. The backfill: a pre-migration row keeps today's behaviour.
+  // ---------------------------------------------------------------------------
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, tagline, featured)
+     VALUES ($1, 'Legacy', 'a card one-liner', true)`, [LEGACY],
+  );
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
+
+  const legacy = await rowOf(LEGACY);
+  ok(legacy.visibility === 'public', 'the backfill IS the DEFAULT: a pre-migration row lands visibility=public');
+  ok(legacy.description === null, 'description is NOT seeded from tagline (ADR 0182 D4) — the card cannot publish the project');
+  ok(legacy.tagline === 'a card one-liner', 'the existing tagline is untouched');
+  ok(legacy.featured === true && legacy.status === 'active', 'nothing else about the row moved');
+
+  // ---------------------------------------------------------------------------
+  // 2. The CHECK refuses a stored fourth state.
+  // ---------------------------------------------------------------------------
+  for (const forbidden of ['unlisted', 'dark-matter', 'published', '']) {
+    let refused = false;
+    try {
+      await q(`UPDATE platform_identity_projects SET visibility = $2 WHERE origin = $1`, [LEGACY, forbidden]);
+    } catch (e) {
+      refused = e.code === '23514'; // check_violation
+    }
+    ok(refused, `the DB CHECK refuses visibility='${forbidden}' — there is no stored fourth state`);
+  }
+  for (const allowed of ['public', 'private', 'stealth']) {
+    await q(`UPDATE platform_identity_projects SET visibility = $2 WHERE origin = $1`, [LEGACY, allowed]);
+    ok((await rowOf(LEGACY)).visibility === allowed, `the DB accepts the door value '${allowed}'`);
+  }
+  await q(`UPDATE platform_identity_projects SET visibility = 'public' WHERE origin = $1`, [LEGACY]);
+
+  // ---------------------------------------------------------------------------
+  // 3 + 4. The derived gate: SQL and JS agree, and `featured` no longer answers it.
+  // ---------------------------------------------------------------------------
+  await pi.upsertProject({ origin: HUSK, name: 'Husk' }, { pool });
+  await pi.upsertProject({ origin: FULL, name: 'Full', description: 'A weather simulation.' }, { pool });
+  await q(`UPDATE platform_identity_projects SET featured = true WHERE origin = ANY($1::text[])`, [[HUSK, FULL]]);
+
+  const verdicts = (await q(
+    `SELECT origin, name, description, ${pi.publishableSql()} AS publishable
+       FROM platform_identity_projects WHERE origin = ANY($1::text[]) ORDER BY origin`,
+    [[HUSK, FULL, LEGACY]],
+  )).rows;
+  for (const row of verdicts) {
+    const js = pi.projectPublishability(row);
+    ok(row.publishable === js.publishable,
+      `SQL and JS agree on ${row.origin} (publishable=${row.publishable}) — the feed and the refusal cannot drift`);
+  }
+  const husk = verdicts.find((r) => r.origin === HUSK);
+  ok(husk.publishable === false, 'a featured, active, visibility=public project with no description is DARK MATTER');
+  ok(pi.projectPublishability(husk).missing.join() === 'description', 'and the gate NAMES the missing field, never merely refuses');
+  ok(verdicts.find((r) => r.origin === FULL).publishable === true, 'name + description alone clears the bar — the gate is identity only');
+
+  // A whitespace-only description is not an identity, in SQL too (btrim, not NULL-checks).
+  await q(`UPDATE platform_identity_projects SET description = '   ' WHERE origin = $1`, [FULL]);
+  const blank = (await q(
+    `SELECT ${pi.publishableSql()} AS publishable FROM platform_identity_projects WHERE origin = $1`, [FULL],
+  )).rows[0];
+  ok(blank.publishable === false, 'a whitespace-only description does not clear the bar in SQL either');
+  await q(`UPDATE platform_identity_projects SET description = 'A weather simulation.' WHERE origin = $1`, [FULL]);
+
+  // The aliased form is the one R06 will use across a join — prove it parses and agrees.
+  const joined = (await q(
+    `SELECT p.origin, ${pi.publishableSql('p')} AS publishable
+       FROM platform_identity_projects p WHERE p.origin = $1`, [FULL],
+  )).rows[0];
+  ok(joined.publishable === true, 'publishableSql(alias) is valid SQL in a joined query and agrees');
+
+  // ---------------------------------------------------------------------------
+  // 5. The hub row is a CACHE — no write path here resets an owner's door.
+  // ---------------------------------------------------------------------------
+  await q(`UPDATE platform_identity_projects SET visibility = 'stealth' WHERE origin = $1`, [FULL]);
+  await pi.registerClient(
+    { clientId: `c-1002323-${Date.now()}`, secret: 'z'.repeat(64), name: 'Full', redirectUris: [], origin: FULL },
+    { pool },
+  );
+  ok((await rowOf(FULL)).visibility === 'stealth',
+    'a client re-registration does not reset the door to public (ADR 0182 D5 — the door arrives by report, R08)');
+  await pi.upsertProject({ origin: FULL, name: 'Full renamed' }, { pool });
+  const afterUpsert = await rowOf(FULL);
+  ok(afterUpsert.visibility === 'stealth', 'nor does a descriptionless catalog upsert');
+  ok(afterUpsert.description === 'A weather simulation.', 'nor does it erase the description (COALESCE-preserved)');
+
+  // A stealth project is a NORMAL row in the curation list — all three doors are visible.
+  const listed = (await pi.listAllProjects({ pool })).find((p) => p.origin === FULL);
+  ok(listed && listed.visibility === 'stealth' && listed.publishable === true,
+    'listAllProjects carries the stored door and the derived verdict together');
+
+  // ---------------------------------------------------------------------------
+  // 6. Idempotent replay over populated rows.
+  // ---------------------------------------------------------------------------
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
+  const replayed = await rowOf(FULL);
+  ok(replayed.visibility === 'stealth' && replayed.description === 'A weather simulation.',
+    'replaying migration 011 over populated rows changes nothing');
+
+  console.log(`\nproject_visibility_db: ${pass} assertions passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}