@bongos/core 1.19.409 → 1.19.411

package/tests/bump_version.mjs

@@ -4,7 +4,10 @@
 // These tests pin the three properties that must survive any refactor:
 //   1. the bumped literal keeps the exact `^const CORE_VERSION = '…';` shape
 //      deploy-divergence.js greps and regex-reads;
-//   2. a changelog entry lands inside the comment block, not after the const;
+//   2. a changelog entry lands above the ledger's closing divider in
+//      docs/module-api-changelog.md (ADR 0203 moved the ledger out of
+//      src/module-api.js — appending to it there grew the file past the
+//      oversized-file fitness ratchet and broke `unit` on main);
 //   3. unrecognizable input throws instead of silently mis-editing.
 
 import test from 'node:test';
@@ -22,16 +25,28 @@ const { bumpPatch, CONST_RE } = bump;
 const { execFileSync } = require('node:child_process');
 
 const SAMPLE = [
-  '// prologue',
-  '//   1.19.0 — some entry. (task 1)',
-  '//   1.19.1 — another entry. (task 2)',
   '// ---------------------------------------------------------------------------',
-  "const CORE_VERSION = '1.19.1'; // carrier; see changelog above",
+  '// CORE_VERSION — the changelog lives in docs/module-api-changelog.md.',
+  '// ---------------------------------------------------------------------------',
+  "const CORE_VERSION = '1.19.1'; // carrier; changelog: docs/module-api-changelog.md",
   '',
   'module.exports = { CORE_VERSION };',
   '',
 ].join('\n');
 
+// The ledger's shape: a fenced text block, oldest entry first, closed by the
+// divider each new entry is inserted immediately above.
+const SAMPLE_CHANGELOG = [
+  '# `CORE_VERSION` changelog',
+  '',
+  '```text',
+  '1.19.0 — some entry. (task 1)',
+  '  1.19.1 — another entry. (task 2)',
+  '---------------------------------------------------------------------------',
+  '```',
+  '',
+].join('\n');
+
 test('bumps patch and keeps the exact const line shape', () => {
   const { from, to, text } = bumpPatch(SAMPLE);
   assert.equal(from, '1.19.1');
@@ -43,13 +58,29 @@ test('bumps patch and keeps the exact const line shape', () => {
   assert.equal([...text.matchAll(/^const CORE_VERSION = /gm)].length, 1);
 });
 
+test('the const line points a reader at the ledger, wherever it moved to', () => {
+  // The pointer is the whole reason moving the changelog out is safe: someone
+  // grepping src/module-api.js for the history must be told where it went.
+  const { text } = bumpPatch(SAMPLE);
+  assert.match(text, /^const CORE_VERSION = .*docs\/module-api-changelog\.md/m);
+});
+
 test('inserts the changelog entry above the divider, mentioning both versions', () => {
-  const { text } = bumpPatch(SAMPLE, { note: 'run 42' });
-  const dividerAt = text.indexOf('// ------');
-  const entryAt = text.indexOf('1.19.2 — CI auto-patch');
+  const { changelogText } = bumpPatch(SAMPLE, { note: 'run 42', changelog: SAMPLE_CHANGELOG });
+  const dividerAt = changelogText.indexOf('\n---------');
+  const entryAt = changelogText.indexOf('1.19.2 — CI auto-patch');
   assert.ok(entryAt !== -1, 'entry exists');
-  assert.ok(entryAt < dividerAt, 'entry sits inside the changelog block, above the divider');
-  assert.match(text, /landed since 1\.19\.1 with no explicit bump\. run 42\./);
+  assert.ok(entryAt < dividerAt, 'entry sits inside the ledger, above its closing divider');
+  assert.match(changelogText, /landed since 1\.19\.1 with no explicit bump\. run 42\./);
+  // oldest-first ordering survives: the new entry is the LAST one.
+  assert.ok(changelogText.indexOf('1.19.1 — another entry') < entryAt, 'newest entry lands last');
+  // the entry is a comment-free ledger line — no `//` scaffolding leaks back in.
+  assert.equal(/^\s*\/\//m.test(changelogText.slice(entryAt - 4, entryAt)), false);
+});
+
+test('without a changelog the ledger is untouched, never silently half-written', () => {
+  const { changelogText } = bumpPatch(SAMPLE);
+  assert.equal(changelogText, null, 'no ledger in, no ledger out — main() refuses this case');
 });
 
 test('a 9→10 patch rollover carries, not truncates', () => {
@@ -61,16 +92,31 @@ test('a 9→10 patch rollover carries, not truncates', () => {
 test('unrecognizable input throws loudly instead of mis-editing', () => {
   assert.throws(() => bumpPatch('nothing here'), /could not find the CORE_VERSION literal/);
   assert.throws(
-    () => bumpPatch("const CORE_VERSION = '1.2.3'; // no divider above"),
+    () => bumpPatch(SAMPLE, { changelog: '# a ledger with no closing divider\n' }),
     /changelog closing divider/
   );
 });
 
-test('the REAL src/module-api.js is bumpable right now (shape not drifted)', () => {
+test('the REAL src/module-api.js + ledger are bumpable right now (shape not drifted)', () => {
   const real = fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8');
-  const { from, to, text } = bumpPatch(real);
+  const ledger = fs.readFileSync(path.join(ROOT, 'docs', 'module-api-changelog.md'), 'utf8');
+  const { from, to, text, changelogText } = bumpPatch(real, { changelog: ledger });
   assert.match(from, /^\d+\.\d+\.\d+$/);
   assert.ok(text.includes(`const CORE_VERSION = '${to}';`));
+  assert.ok(changelogText.includes(`${to} — CI auto-patch`), 'the real ledger takes the entry');
+  assert.ok(changelogText.length > ledger.length, 'the real ledger grew');
+});
+
+test('the ledger is NOT a .js file — the ratchet that forced the move stays satisfied', () => {
+  // ADR 0203: the carrier appends on every release and pushes straight to main.
+  // Inside a .js file that growth trips scripts/gds/fitness-ratchets.js's
+  // oversized_file_count (it counts `git ls-files '*.js'`) and turns `unit` red
+  // for main and every open PR at once. Markdown is the whole fix.
+  const rel = 'docs/module-api-changelog.md';
+  assert.equal(rel.endsWith('.js'), false);
+  assert.ok(fs.existsSync(path.join(ROOT, rel)), 'the ledger exists where the carrier writes it');
+  const api = fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8').split('\n').length;
+  assert.ok(api <= 1500, `src/module-api.js is ${api} lines — the 1500-line ratchet is the reason the ledger moved`);
 });
 
 // ---- isReleaseCommit: the cascade terminator (task 1002636) ----
@@ -108,6 +154,19 @@ test('work-merge subjects, junk, and empties never match', () => {
   assert.equal(RELEASE_COMMIT_RE.source.startsWith('^'), true, 'anchored — a subject QUOTING a release message must not match');
 });
 
+test('publish.yml stages BOTH files the bump writes (ADR 0203)', () => {
+  // The carrier writes two files now. Staging only src/module-api.js would push
+  // a version whose changelog entry never left the runner — the ledger main
+  // carries would fall one entry behind on every release, forever, and nobody
+  // would see it until someone went looking for a version's history.
+  const m = PUBLISH_YML.match(/^\s*git add (.+)$/m);
+  assert.ok(m, 'publish.yml must stage the bump');
+  const staged = m[1].trim().split(/\s+/);
+  for (const f of ['src/module-api.js', 'docs/module-api-changelog.md']) {
+    assert.ok(staged.includes(f), `publish.yml must \`git add\` ${f} — it is written by bump-version.js --apply`);
+  }
+});
+
 test('publish.yml wires the terminator: guard step present, every armed step gated', () => {
   assert.ok(PUBLISH_YML.includes('id: relhead'), 'the Already released? guard step exists');
   assert.match(PUBLISH_YML, /isReleaseCommit/, 'the guard delegates to bump-version.js — single source');

package/tests/goal_membership_requests.mjs

@@ -19,6 +19,10 @@
 //     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
 //     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
+//   • setGoalAcceptingRequests + the D6 closed-to-requests gate (task 1002971) —
+//     a private goal can stop taking join-requests WITHOUT stopping invitations.
+//   • authorizeRescindInvitation (task 1002971) — the manager-side rescind, the
+//     missing half of core_188's 'cancelled' state.
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -32,6 +36,7 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const {
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,
@@ -48,6 +53,8 @@ const {
   authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
+  authorizeRescindInvitation,
+  authorizeGoalManagement,
   decorateGoalScope,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
@@ -76,6 +83,27 @@ await test('setGoalVisibility: writes visibility + returns the goal row', async
   assert.deepEqual(q.params, [7, 'private']);
 });
 
+// =========================================================================
+// setGoalAcceptingRequests (task 1002971, spec D6) — the same shape as its
+// visibility sibling: the route owns WHO may call it, the helper just writes.
+// =========================================================================
+
+await test('setGoalAcceptingRequests: writes the flag + returns the goal row', async () => {
+  const GOAL = { id: 7, visibility: 'private', accepting_requests: false };
+  const pool = fakePool((s) => (/UPDATE goals SET accepting_requests = \$2/.test(s) ? { rows: [GOAL] } : null));
+  const g = await setGoalAcceptingRequests({ goalId: 7, acceptingRequests: false }, { pool });
+  assert.deepEqual(g, GOAL);
+  const q = find(pool.queries, /UPDATE goals SET accepting_requests/);
+  assert.deepEqual(q.params, [7, false]);
+  assert.ok(/RETURNING .*accepting_requests/.test(norm(q.sql)),
+    'the returned row carries the flag, so the hall can render the toggle state');
+});
+
+await test('setGoalAcceptingRequests: unknown goal → null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalAcceptingRequests({ goalId: 999, acceptingRequests: true }, { pool }), null);
+});
+
 await test('setGoalVisibility: unknown goal → null', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   assert.equal(await setGoalVisibility({ goalId: 999, visibility: 'public' }, { pool }), null);
@@ -302,6 +330,15 @@ await test('migration core_188: additive, defaults public, partial-unique pendin
     'migration is purely additive');
 });
 
+await test('migration core_229: accepting_requests is additive and defaults TRUE', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_229_goals_accepting_requests.sql'), 'utf8');
+  assert.ok(/ADD COLUMN IF NOT EXISTS accepting_requests boolean NOT NULL DEFAULT true/.test(sql),
+    'defaults true so every existing private goal keeps taking requests');
+  assert.ok(!/\bDROP\s+(TABLE|COLUMN|INDEX)\b|\bDELETE\s+FROM\b|\bTRUNCATE\b/i.test(sql),
+    'migration is purely additive');
+});
+
 // =========================================================================
 // The pure route gates (task 1952) — DB-free, ordering included.
 // =========================================================================
@@ -348,6 +385,45 @@ await test('authorizeCreateJoinRequest: public but PROTECTED scope → ALLOW (no
   assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public' }, isMember: false, scopeProtected: true }), { ok: true });
 });
 
+// The D6 closed-to-requests arm (task 1002971). A private goal whose lead closed
+// applications refuses the ask with honest copy instead of queueing it.
+const CLOSED_PRIVATE = { id: 5, status: 'open', created_by: '1', visibility: 'private', accepting_requests: false };
+await test('authorizeCreateJoinRequest: private + closed → 409 not_accepting_requests, honest copy', () => {
+  const d = authorizeCreateJoinRequest({ goal: CLOSED_PRIVATE, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'not_accepting_requests');
+  assert.equal(d.body.message, "This goal isn't taking requests right now.",
+    'the spec D6 copy verbatim — the refusal says why, it does not pretend the goal is gone');
+});
+await test('authorizeCreateJoinRequest: private + explicitly accepting → ALLOW', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { ...CLOSED_PRIVATE, accepting_requests: true }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// A goal row read before the migration (or by an older release) has no such key.
+// Only an explicit false closes the door — undefined must never read as closed.
+await test('authorizeCreateJoinRequest: private, flag absent → ALLOW (fails OPEN, not closed)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'private' }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// D6 calls the flag meaningless on a public goal, so a PUBLIC protected-scope goal
+// keeps its Archon-mediated request door open whatever the column says.
+await test('authorizeCreateJoinRequest: PUBLIC protected goal + closed flag → ALLOW (flag is private-only)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public', accepting_requests: false }, isMember: false, scopeProtected: true }), { ok: true });
+});
+// The whole point of D6: closing applications is about unsolicited inbound. The
+// invite path is gated by authorizeGoalManagement, which never reads the flag —
+// so a lead can still invite into a goal that is closed to requests.
+await test('closed to requests: INVITATIONS are unaffected — the invite gate still allows the owner', () => {
+  assert.deepEqual(authorizeGoalManagement({ goal: CLOSED_PRIVATE, actorId: '1', actorRank: 'metic', actorMembership: null }), { ok: true });
+});
+await test('routes: the invitation paths never read accepting_requests (only the request gate does)', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const authz = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goal-route-authz.js'), 'utf8');
+  const gates = authz.match(/^function authorize\w+[\s\S]*?^}/gm) || [];
+  const reading = gates.filter((g) => /goal\.accepting_requests/.test(g));
+  assert.equal(reading.length, 1, 'exactly one gate reads the flag');
+  assert.ok(/^function authorizeCreateJoinRequest/.test(reading[0]),
+    'and it is the JOIN-REQUEST gate — invitations must stay unaffected (spec D6)');
+});
+
 // authorizeInvitationResponse — only the invitee resolves their own pending invite.
 const INVITE = { id: 9, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
 await test('authorizeInvitationResponse: unknown request → 404', () => {
@@ -480,6 +556,80 @@ await test('authorizeWithdrawJoinRequest: the requester (string vs number id)
   assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// =========================================================================
+// authorizeRescindInvitation (task 1002971) — the manager-side mirror of
+// withdraw, and the missing half of core_188's 'cancelled' state. Authority is
+// authorizeGoalManagement (owner|manager|Archon), checked BEFORE the request
+// lookup so an unauthorized actor never learns an invitation exists.
+// =========================================================================
+
+const RESCIND_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
+const PENDING_INVITE = { id: 12, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
+const rescind = (over = {}) => authorizeRescindInvitation({
+  goal: RESCIND_GOAL, actorId: '1', actorRank: 'metic', actorMembership: null,
+  request: PENDING_INVITE, goalId: 5, ...over,
+});
+
+await test('authorizeRescindInvitation: the goal OWNER → ALLOW', () => {
+  assert.deepEqual(rescind(), { ok: true });
+});
+await test('authorizeRescindInvitation: a manager (lead) → ALLOW', () => {
+  assert.deepEqual(rescind({ actorId: '3', actorMembership: mgr(3) }), { ok: true });
+});
+await test('authorizeRescindInvitation: an Archon → ALLOW (acts as owner anywhere)', () => {
+  assert.deepEqual(rescind({ actorId: '99', actorRank: 'archon' }), { ok: true });
+});
+await test('authorizeRescindInvitation: a non-owner/manager → 403 (before any request lookup — no leak)', () => {
+  const d = rescind({ actorId: '7' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+  const blind = authorizeRescindInvitation({
+    goal: RESCIND_GOAL, actorId: '7', actorRank: 'metic', actorMembership: null, request: null, goalId: 5,
+  });
+  assert.deepEqual(blind, d, 'the answer is identical whether or not the invitation exists');
+});
+await test('authorizeRescindInvitation: the INVITEE cannot rescind their own invitation → 403', () => {
+  const d = rescind({ actorId: '2' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+});
+await test('authorizeRescindInvitation: unknown request → 404', () => {
+  const d = rescind({ request: null });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeRescindInvitation: invitation on a different goal → 404 (containment)', () => {
+  assert.equal(rescind({ request: { ...PENDING_INVITE, goal_id: '99' } }).status, 404);
+});
+await test('authorizeRescindInvitation: row is a join-request, not an invitation → 400', () => {
+  const d = rescind({ request: { ...PENDING_INVITE, kind: 'request' } });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_an_invitation');
+});
+// Rescinding an invite that is already resolved changes nothing: the gate refuses
+// 409 not_pending, and db.resolveMembershipRequest moves only from 'pending', so a
+// repeat rescind can never re-cancel an accepted membership.
+await test('authorizeRescindInvitation: already resolved → 409 not_pending (no state change on a repeat)', () => {
+  for (const status of ['accepted', 'rejected', 'cancelled']) {
+    const d = rescind({ request: { ...PENDING_INVITE, status } });
+    assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending'); assert.equal(d.body.status, status);
+  }
+});
+await test('authorizeRescindInvitation: a closed goal cannot be managed → 409 goal_not_open', () => {
+  const d = rescind({ goal: { ...RESCIND_GOAL, status: 'archived' } });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'goal_not_open');
+});
+// The route must land the state core_188 already defined for "rescinded by the
+// opener" — not a second word for the same thing (source-pinned, the addGoalMember
+// resolvedBy precedent; the live route is exercised in goal_routes.mjs).
+await test('routes: the rescind route resolves to cancelled, attributed to the actor', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/rescind'"));
+  assert.ok(handler.startsWith("router.post('/goals/:id/invitations/:reqId/rescind'"), 'the rescind route exists');
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  assert.ok(/db\.resolveMembershipRequest\(\{ id: reqId, status: 'cancelled', resolvedBy: req\.builder\.id \}\)/.test(body),
+    "cancelled — core_188's 'withdrawn/rescinded by the opener' state, attributed to the rescinder");
+  assert.ok(body.indexOf('authorizeRescindInvitation({') < body.indexOf('db.resolveMembershipRequest('),
+    'the gate runs before the write');
+});
+
 // =========================================================================
 // decorateGoalScope (task 1002689) — goal payloads carry a derived
 // scope_protected flag so the hall can render the join-gate on a
@@ -509,7 +659,7 @@ await test('decorateGoalScope: returns a copy, never mutates the row', () => {
 // stay 'any-builder'; an accidental requireRank re-gate must be a red build.
 // =========================================================================
 
-await test('route-rank pins: the eight private-goal routes are pinned any-builder', () => {
+await test('route-rank pins: the ten private-goal routes are pinned any-builder', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   for (const r of [
     'GET /goals/inbox',
@@ -520,6 +670,9 @@ await test('route-rank pins: the eight private-goal routes are pinned any-builde
     'POST /goals/:id/invitations/:reqId/respond',
     'GET /goals/:id/requests',
     'POST /goals/:id/requests/:reqId/withdraw',
+    // task 1002971 — the D6 toggle + the manager-side rescind.
+    'PATCH /goals/:id/accepting-requests',
+    'POST /goals/:id/invitations/:reqId/rescind',
   ]) {
     assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
   }

package/tests/prose_edits.mjs

@@ -182,16 +182,20 @@ await test('ROUTE SHAPE: the author gate is fail-closed and uses the array form
   assert.match(src, /captured_by != null/, 'and the author check treats a NULL author as not-you');
 });
 
-await test('ROUTE SHAPE: the goal + visibility handlers share ONE authority gate', () => {
-  // Both were moved into goal-edits.js precisely because they are the same kind
-  // of operation behind the same gate; this pins that they still are.
+await test('ROUTE SHAPE: every goal-edit handler shares ONE authority gate', () => {
+  // Each was moved into goal-edits.js precisely because they are the same kind
+  // of operation behind the same gate; this pins that they still are. The count
+  // grows with the file — task 1002971 added the D6 accepting-requests toggle,
+  // the third write to a goal's own row behind authorizeGoalManagement.
   const src = readFileSync(new URL('../modules/lifecycle/goal-edits.js', import.meta.url), 'utf8');
-  assert.equal((src.match(/authorizeGoalManagement\(/g) || []).length, 2, 'prose + visibility, both gated');
+  assert.equal((src.match(/authorizeGoalManagement\(/g) || []).length, 3, 'prose + visibility + accepting-requests, all gated');
   assert.equal(typeof goalEdits.goalProseHandler, 'function');
   assert.equal(typeof goalEdits.goalVisibilityHandler, 'function');
+  assert.equal(typeof goalEdits.goalAcceptingRequestsHandler, 'function');
   const routes = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
   assert.match(routes, /router\.patch\('\/goals\/:id',/, 'the REGISTRATION stays in the route file so route-rank-check sees it');
   assert.match(routes, /router\.patch\('\/goals\/:id\/visibility',/);
+  assert.match(routes, /router\.patch\('\/goals\/:id\/accepting-requests',/);
 });
 
 // ---- 5. THE HANDLERS ARE ACTUALLY INVOKED ---------------------------------