@bongos/core 1.19.400 → 1.19.402

package/tests/provisioning_domain_attach.mjs

@@ -41,7 +41,7 @@ async function ta(name, fn) {
 
 console.log('service slice — updateInstanceDomain / getInstanceByDomain:');
 
-await ta('updateInstanceDomain: parameterized UPDATE of only the domain (+updated_at), returns the row', async () => {
+await ta('updateInstanceDomain: parameterized UPDATE of the domain + the release queue, returns the row', async () => {
   const calls = [];
   const db = { query: async (sql, params) => {
     calls.push({ sql, params });
@@ -50,8 +50,34 @@ await ta('updateInstanceDomain: parameterized UPDATE of only the domain (+update
   const row = await provisioning.updateInstanceDomain(db, 18, 'spike.cloudbongos.com');
   assert.equal(row.domain, 'spike.cloudbongos.com');
   assert.match(calls[0].sql, /UPDATE provisioning_instances/);
-  assert.match(calls[0].sql, /SET domain = \$2, updated_at = now\(\)/, 'touches ONLY the domain column');
-  assert.deepEqual(calls[0].params, [18, 'spike.cloudbongos.com']);
+  assert.match(calls[0].sql, /SET domain = \$2/);
+  assert.match(calls[0].sql, /released_domains/, 'the release queue rides the SAME statement (task 1003237)');
+  assert.match(calls[0].sql, /last_verified_up = CASE WHEN domain IS DISTINCT FROM \$2 THEN NULL/,
+    'a CHANGED address has never been probed - the overlay must not describe the address it left (F16)');
+  assert.doesNotMatch(calls[0].sql, /status/, 'still never drifts the lifecycle');
+  assert.match(calls[0].sql, /array_length\(released_domains, 1\), 0\) >= \$4/,
+    'the queue is CAPPED in SQL, not trusted from the caller - the runner drains it against a shared token');
+  assert.deepEqual(calls[0].params, [18, 'spike.cloudbongos.com', null, provisioning.MAX_RELEASED_DOMAINS],
+    'no `releasing` means a null 3rd param, and the CASE leaves the queue exactly as it stands');
+});
+
+await ta('updateInstanceDomain: a re-point APPENDS the old address, lowercased, and never duplicates it', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 18 }] }; } };
+  await provisioning.updateInstanceDomain(db, 18, 'right.example.com', 'TYPO.example.com');
+  assert.deepEqual(calls[0].params, [18, 'right.example.com', 'typo.example.com', provisioning.MAX_RELEASED_DOMAINS]);
+  assert.match(calls[0].sql, /array_append\(released_domains, \$3\)/, 'appends — a second correction must not drop the first');
+  assert.match(calls[0].sql, /\$3 = ANY\(released_domains\)/, 'idempotent: a retry never queues the same address twice');
+});
+
+await ta('clearReleasedDomains: empties the queue and touches nothing else', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 18 }] }; } };
+  await provisioning.clearReleasedDomains(db, 18);
+  assert.match(calls[0].sql, /SET released_domains = '\{\}'/);
+  assert.doesNotMatch(calls[0].sql, /updated_at|status|domain = /,
+    'draining a queue is not an owner-visible change (the clearErrorNote rule)');
+  assert.deepEqual(calls[0].params, [18]);
 });
 
 await ta('getInstanceByDomain: case-insensitive exact match, parameterized', async () => {
@@ -80,8 +106,8 @@ let createResult = null;         // what createInstance reports (re-request test
 let manifestRows = [];
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
 provisioning.getInstanceByDomain = async (_db, d) => domainHolder;
-provisioning.updateInstanceDomain = async (_db, id, domain) => {
-  updateCalls.push({ id, domain });
+provisioning.updateInstanceDomain = async (_db, id, domain, releasing = null) => {
+  updateCalls.push({ id, domain, releasing });
   instance = { ...instance, domain };
   return { ...instance, id };
 };
@@ -100,10 +126,24 @@ const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();
 api.branding = () => ({
-  domains: { publicOrigin: 'https://cb.test' },
+  // instanceBase is the platform APEX the route's reserved + in-apex-squat guards
+  // read (instanceApex()). Set here so the re-point suite below can exercise them
+  // against a real apex instead of the guard-free '' the stub used to imply.
+  domains: { publicOrigin: 'https://cb.test', instanceBase: 'cb.test' },
   identity: { productName: 'Cloud Bongos' },
 });
 
+// The domain route is rate-limited PER BUILDER (task 1003237) and every test in
+// this file posts as builder 7, so the real cap would throttle the suite rather
+// than the behaviour each test is about. Raise it for the shared app below —
+// `limiterMax = null` restores the route's own number, which the dedicated
+// limiter test at the end of this file uses to exercise the real 429.
+const rateLimit = require('../modules/provisioning/rate-limit.js');
+const realMakeAskRateLimiter = rateLimit.makeAskRateLimiter;
+let limiterMax = 10_000;
+rateLimit.makeAskRateLimiter = (opts = {}) =>
+  realMakeAskRateLimiter({ ...opts, ...(limiterMax === null ? {} : { max: limiterMax }) });
+
 const express = require('express');
 const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
 const app = express();
@@ -121,10 +161,12 @@ const server = app.listen(0);
 await new Promise((r) => server.once('listening', r));
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
 
-function post(path, body = {}) {
+function post(path, body = {}) { return postTo(base, path, body); }
+
+function postTo(origin, path, body = {}) {
   return new Promise((resolve, reject) => {
     const payload = JSON.stringify(body);
-    const req = http.request(`${base}${path}`, {
+    const req = http.request(`${origin}${path}`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
     }, (res) => {
@@ -137,9 +179,9 @@ function post(path, body = {}) {
   });
 }
 
-function reset({ inst } = {}) {
+function reset({ inst, holder } = {}) {
   instance = inst || null;
-  domainHolder = null;
+  domainHolder = holder || null;
   updateCalls = [];
   enqueueCalls = [];
   enqueueResult = null;
@@ -155,7 +197,7 @@ await ta('ACTIVE domainless instance: domain is validated, recorded, and a domai
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.ok, true);
   assert.equal(res.body.domain, 'spike.cloudbongos.com', 'normalized before storing');
-  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cloudbongos.com' }]);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cloudbongos.com', releasing: null }]);
   assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
   assert.equal(res.body.queued, true);
 });
@@ -229,21 +271,91 @@ await ta('re-kick honors enqueueIntent created:false — a racing enqueue is nev
   } finally { provisioning.enqueueIntent = savedEnqueue; }
 });
 
-await ta('a DIFFERENT domain already set is a truthful 409 domain_already_set (re-pointing is not this route)', async () => {
-  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'old.cloudbongos.com' } });
-  const res = await post('/provisioning/instances/18/domain', { domain: 'new.cloudbongos.com' });
+// -- the re-point (task 1003237, owner decision 2026-08-28 / ADR 0200) --------
+// A mistyped bring-your-own address used to be a permanent 409 domain_already_set.
+// It is now correctable, under exactly the guards the FIRST attach applied. The
+// apex here is cb.test (the harness's branding publicOrigin), so "inside the
+// apex" means *.cb.test.
+
+await ta('a DIFFERENT bring-your-own domain RE-POINTS — the address changes and the old one is queued for release', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.changed, true);
+  assert.equal(res.body.queued, true, 'an ACTIVE instance re-points via a domain-attach intent');
+  assert.equal(res.body.domain, 'right.example.com');
+  assert.equal(res.body.replaced, 'typo.example.com', 'the response NAMES what is being let go');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: 'typo.example.com' }],
+    'the new address and the release ride ONE write');
+  assert.match(res.body.message, /right\.example\.com/);
+  assert.match(res.body.message, /typo\.example\.com/, 'the sentence says the old address is going');
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+});
+
+await ta('a re-point onto a PLATFORM-RESERVED name is refused — the first attach guard, unweakened', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'cb.test' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+  assert.equal(updateCalls.length, 0, 'nothing was written - the old address still stands');
+});
+
+await ta('a re-point INSIDE the platform apex is refused as a squat (task 1002704) — except this slug own default', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const squat = await post('/provisioning/instances/18/domain', { domain: 'someone-else.cb.test' });
+  assert.equal(squat.status, 400, squat.raw);
+  assert.equal(squat.body.error.code, 'domain_reserved');
+  assert.equal(updateCalls.length, 0);
+
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const own = await post('/provisioning/instances/18/domain', { domain: 'spike.cb.test' });
+  assert.equal(own.status, 200, own.raw);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cb.test', releasing: 'typo.example.com' }],
+    'falling back to the assigned default still releases the BYO address it left');
+});
+
+await ta('a re-point onto an address ANOTHER project holds is a truthful 409 domain_taken', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' },
+    holder: { id: 99, slug: 'other' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'taken.example.com' });
   assert.equal(res.status, 409, res.raw);
-  assert.equal(res.body.error.code, 'domain_already_set');
-  assert.equal(res.body.error.details.current, 'old.cloudbongos.com', 'names the current address');
+  assert.equal(res.body.error.code, 'domain_taken');
   assert.equal(updateCalls.length, 0);
 });
 
+await ta('moving OFF the platform-assigned <slug>.<apex> queues NO release — that name is the platform own (ADR 0181)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cb.test' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'mine.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.replaced, null, 'the assigned default is never released - the revive path re-uses it');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'mine.example.com', releasing: null }]);
+});
+
+await ta('a re-point on a REQUESTED instance records without an intent, and releases NOTHING — it never stood up', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'requested', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.equal(res.body.replaced, null,
+    'nothing ever wrote an A record for the address it is leaving - parking that name would CREATE a junk record, not release one');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: null }]);
+  assert.deepEqual(enqueueCalls, [], 'nothing to re-assert on an instance that has not stood up');
+});
+
+await ta("an ERROR instance DOES release — a failed standup is frequently a PARTIAL one that already wrote the record (ADR 0181)", async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'error', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.replaced, 'typo.example.com');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: 'typo.example.com' }]);
+});
+
 await ta('REQUESTED instance: domain records with NO intent — the provision run wires it', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'fresh', status: 'requested', domain: null } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'fresh.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.queued, false);
-  assert.deepEqual(updateCalls, [{ id: 18, domain: 'fresh.cloudbongos.com' }]);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'fresh.cloudbongos.com', releasing: null }]);
   assert.equal(enqueueCalls.length, 0, 'provision will wire it — no separate intent');
 });
 
@@ -310,6 +422,43 @@ await ta('a fresh create with a domain is untouched (the domain is stored at cre
   assert.equal(res.body.domain_ignored, undefined);
 });
 
+console.log('\nPOST /provisioning/instances/:id/domain — the write is throttled per builder:');
+
+await ta('the re-point write is rate-limited on the BUILDER, so one owner cannot spend the platform-wide DNS budget', async () => {
+  // A re-point QUEUES an address the runner later releases with a call against the
+  // SHARED control-plane Cloudflare token, so an unthrottled owner spends a
+  // platform resource, not merely their own. Keyed on the builder, not the IP:
+  // per-IP starves co-located builders while an attacker rotates IPs.
+  limiterMax = null;                       // the route's own number, whatever it is
+  const limited = express();
+  limited.use(express.json());
+  limited.use((_req, res, next) => {
+    res.fail = (code, opts, details) => {
+      const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+      res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+    };
+    next();
+  });
+  limited.use('/api/bongos', provisioningRoutes());
+  const srv = limited.listen(0);
+  await new Promise((r) => srv.once('listening', r));
+  const at = `http://127.0.0.1:${srv.address().port}/api/bongos`;
+  try {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+    let sawLimit = false;
+    // well past any sane cap for a human correcting one typo
+    for (let i = 0; i < 60 && !sawLimit; i++) {
+      const res = await postTo(at, `/provisioning/instances/18/domain?i=${i}`, { domain: `h${i}.example.com` });
+      if (res.status === 429) {
+        sawLimit = true;
+        assert.equal(res.body.error.code || res.body.error, 'rate_limited');
+        assert.ok(i > 0, 'a first call is never throttled');
+      }
+    }
+    assert.ok(sawLimit, 'the route must shed a flood — an unthrottled owner can queue unbounded DNS work');
+  } finally { srv.close(); limiterMax = 10_000; }
+});
+
 console.log('\nPOST /provisioning/instances/:id/github-app — accepts the newly-addressed instance:');
 
 await ta('domainless instance still 409s domain_required; once addressed, the manifest mints', async () => {

package/tests/public_landing_projects.mjs

@@ -95,11 +95,15 @@ test('every truthful refusal the API can give is mapped to human copy, never swa
     'not_teardownable',       // teardown refused for the real state
     'bad_domain',             // malformed hostname
     'domain_taken',           // another instance already answers there
-    'domain_already_set',     // re-pointing is not this surface
+    'domain_reserved',        // the platform's own name, or a squat inside its apex
     'domain_not_attachable',  // mid-flight/torn-down states refuse truthfully
   ]) {
     assert.match(body, new RegExp(code), `the page must handle '${code}' explicitly`);
   }
+  // retired with the re-point (task 1003237): the server no longer sends it, so a
+  // branch for it would be copy the founder can never reach
+  assert.doesNotMatch(body, /domain_already_set/,
+    'the refusal the re-point removed must not linger as dead copy');
 });
 
 test('a domainless instance gets an honest no-address state', async () => {

package/tests/ui_design_kit.mjs

@@ -85,10 +85,11 @@ test('auditFloors names each floor a render breaks, and says nothing about a cle
 });
 
 test('expectProblems compares every expectation the vocabulary allows', () => {
-  const facts = { ...clean(), expanded: ['projTrig'], dialog: true, sel: { '#a': true, '#b': false }, activeId: 'x', activeText: 'Sky', param: { view: 'mine' }, attr: ['dark'], text: ['Table'], href: ['/docs'], count: [3], checked: false, value: ['demo'], hasClass: [true] };
-  assert.deepEqual(lib.expectProblems(facts, { expanded: true, dialog: true, visible: ['#a'], hidden: ['#b'], open: '#a', closed: '#b', activeId: 'x', activeText: 'Sky', expandedIds: ['projTrig'], param: { view: 'mine' }, attr: [['html', 'data-mode', 'dark']], text: [['h1', 'Table']], href: [['a', '/docs']], count: [['li', 3]], value: [['#q', 'demo']], hasClass: [['#w', 'is-open']] }), []);
-  const p = lib.expectProblems(facts, { expanded: false, dialog: false, visible: ['#b'], hidden: ['#a'], activeText: 'Table', param: { view: null }, count: [['li', 5]], checked: '#c', hasClass: [['#w', 'is-open', false]], noOverflow: true });
-  for (const needle of ['expected no expanded trigger', 'expected no visible dialog', 'expected visible: #b', 'expected hidden: #a', 'active text "Sky", expected "Table"', '?view=mine, expected null', '3 × li, expected 5', '#c is not checked', 'still has class "is-open"']) {
+  const facts = { ...clean(), expanded: ['projTrig'], dialog: true, sel: { '#a': true, '#b': false }, activeId: 'x', activeText: 'Sky', param: { view: 'mine' }, attr: ['dark'], text: ['Table'], href: ['/docs'], count: [3], checked: false, value: ['demo'], hasClass: [true], top: [64] };
+  assert.deepEqual(lib.expectProblems(facts, { expanded: true, dialog: true, visible: ['#a'], hidden: ['#b'], open: '#a', closed: '#b', activeId: 'x', activeText: 'Sky', expandedIds: ['projTrig'], param: { view: 'mine' }, attr: [['html', 'data-mode', 'dark']], text: [['h1', 'Table']], href: [['a', '/docs']], count: [['li', 3]], value: [['#q', 'demo']], hasClass: [['#w', 'is-open']], top: [['main', 64]] }), []);
+  // `top` is how a probe proves an overlay did not push the page (task 1003332)
+  const p = lib.expectProblems(facts, { expanded: false, dialog: false, visible: ['#b'], hidden: ['#a'], activeText: 'Table', param: { view: null }, count: [['li', 5]], checked: '#c', hasClass: [['#w', 'is-open', false]], noOverflow: true, top: [['main', 185]] });
+  for (const needle of ['expected no expanded trigger', 'expected no visible dialog', 'expected visible: #b', 'expected hidden: #a', 'active text "Sky", expected "Table"', '?view=mine, expected null', '3 × li, expected 5', '#c is not checked', 'still has class "is-open"', 'main top 64px, expected 185px']) {
     assert.ok(p.some((x) => x.includes(needle)), `missing: ${needle} in ${p.join(' | ')}`);
   }
 });