@bongos/core 1.19.412 → 1.19.413

package/tests/account_privacy_flags.mjs

@@ -0,0 +1,299 @@
+// tests/account_privacy_flags.mjs — account_visibility + recruiter_discoverable
+// (task 1002966, goal 1000045; docs/specs/bongos-v1-privacy-and-invites.md D1/D3).
+//
+// These two flags are the keystone of the privacy model — task 1002967 (the
+// shared effective-visibility predicate), task 1002968 (recruiter-sliver
+// gating), task 1002806 (the private-profile 404 proof) and task 1002290
+// (opt out of recruiting) all read them — so the MODEL is what this pins, not
+// the plumbing:
+//
+//   1. the migration's stored shape: visibility NOT NULL DEFAULT 'public' with a
+//      two-value CHECK, discoverable NULLABLE (the tri-state is deliberate);
+//   2. isRecruiterDiscoverable() — the ONE predicate, the JS twin of
+//      COALESCE(recruiter_discoverable, account_visibility = 'public'): a fresh
+//      account is public + discoverable, private flips the effective answer
+//      while the column stays NULL, and an explicit boolean beats both (the
+//      spec's D2 "private · discoverable" row is allowed, not refused);
+//   3. the own-scoped write: only the flags sent are written, never identity,
+//      never consent, never hide_stats — and the account is always the SESSION's
+//      (a body can neither name nor reach another one);
+//   4. the leak rule: neither column may appear in a public response body.
+//
+// Pure — a recording fake pool, no Postgres, no network. Runs in the DB-free
+// unit gate.
+//
+// Run:  node tests/account_privacy_flags.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATION = readFileSync(
+  join(ROOT, 'modules/platform-identity/migrations/platform_identity_012_account_privacy.sql'), 'utf8');
+
+// ---- the recording fake pool ----------------------------------------------
+//
+// One shared pool object so the route's `pool` (pinned into module-api below,
+// resolved once at require time) and each test's queue are the same thing.
+let queued = [];
+let calls = [];
+const pool = {
+  query: async (text, params) => {
+    calls.push({ text: String(text), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; }
+
+// ---- the route over the real domain, with core pinned ----------------------
+
+const SESSION = { github_id: 4242, github_login: 'octo', display_name: 'Octo', avatar_url: 'https://a.example/o.png' };
+const OTHER_ACCOUNT = 9999;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    // The own-scope stub: a live session, exactly as requireBuilder leaves it.
+    requireBuilder: (req, _res, next) => { req.builder = { ...SESSION }; next(); },
+  },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildProfileRoutes = require('../modules/platform-identity/routes/profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// A stored row as the module's RETURNING clause hands it back.
+const row = (over = {}) => ({
+  github_id: String(SESSION.github_id), github_login: 'octo', profile_state: 'active',
+  hide_stats: false, account_visibility: 'public', recruiter_discoverable: null,
+  handle: 'octo', ...over,
+});
+
+// ---- 1. the stored shape ---------------------------------------------------
+
+test('migration 012 stores visibility NOT NULL DEFAULT public and discoverable NULLABLE', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS account_visibility text NOT NULL DEFAULT 'public'/,
+    "public is the default, and the DEFAULT clause IS the backfill — no existing profile changes state");
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS recruiter_discoverable boolean;/,
+    'recruiter_discoverable is a bare nullable boolean');
+  assert.doesNotMatch(MIGRATION, /recruiter_discoverable boolean NOT NULL/,
+    'NOT NULL would destroy the tri-state: NULL is what "follow visibility" is made of');
+  assert.match(MIGRATION, /CHECK \(account_visibility IN \('public', 'private'\)\)/,
+    'the engine refuses a third visibility value');
+  assert.match(MIGRATION, /ALTER TABLE platform_identity_accounts/, 'the flags live on the hub account (ADR 0171 D4 precedent)');
+});
+
+// ---- 2. the ONE predicate --------------------------------------------------
+
+test('a fresh account is public AND discoverable — the opt-out half of D1', () => {
+  assert.equal(pi.isRecruiterDiscoverable(row()), true);
+  assert.equal(pi.isRecruiterDiscoverable(row({ recruiter_discoverable: false })), false,
+    'a public account can leave recruiting and stay public');
+});
+
+test('private flips the effective answer to false while the column stays NULL', () => {
+  const acct = row({ account_visibility: 'private' });
+  assert.equal(acct.recruiter_discoverable, null, 'the stored flag is untouched — only the derived answer moves');
+  assert.equal(pi.isRecruiterDiscoverable(acct), false, 'recruiting is opt-IN for a private account');
+});
+
+test('an explicit true on a private account WINS (the spec D2 private-discoverable row)', () => {
+  assert.equal(pi.isRecruiterDiscoverable(row({ account_visibility: 'private', recruiter_discoverable: true })), true,
+    'the spec allows this state — it is exactly what the D3 recruiter sliver serves');
+});
+
+test('isRecruiterDiscoverable is fail-closed on a missing account or a missing column', () => {
+  assert.equal(pi.isRecruiterDiscoverable(null), false);
+  assert.equal(pi.isRecruiterDiscoverable({}), false, 'no visibility column read → not discoverable');
+  assert.deepEqual(pi.ACCOUNT_VISIBILITY, ['public', 'private']);
+});
+
+// ---- 3. the own-scoped write -----------------------------------------------
+
+test('setAccountPrivacy writes ONLY the flags sent — never identity, consent, or hide_stats', async () => {
+  expect({ rows: [row({ account_visibility: 'private' })] });
+  const out = await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, githubLogin: 'octo', fields: { account_visibility: 'private' } }, { pool });
+  assert.equal(out.account_visibility, 'private');
+  const sql = calls[0].text;
+  const updateBranch = sql.slice(sql.indexOf('DO UPDATE'), sql.indexOf('RETURNING'));
+  assert.match(updateBranch, /account_visibility\s+= CASE WHEN \$7::boolean THEN EXCLUDED\.account_visibility/);
+  assert.match(updateBranch, /recruiter_discoverable = CASE WHEN \$8::boolean THEN EXCLUDED\.recruiter_discoverable/);
+  assert.doesNotMatch(updateBranch, /github_login|display_name|avatar_url|profile_state|hide_stats/,
+    'a privacy toggle is not an identity refresh, a consent grant, or a hide');
+  assert.equal(calls[0].params[6], true, 'visibility was sent');
+  assert.equal(calls[0].params[7], false, 'discoverable was not — its CASE arm keeps the stored value');
+});
+
+test('setAccountPrivacy accepts an explicit null discoverable — the reset to "follow visibility"', async () => {
+  expect({ rows: [row()] });
+  await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { recruiter_discoverable: null } }, { pool });
+  assert.equal(calls[0].params[5], null, 'null is written, not skipped');
+  assert.equal(calls[0].params[7], true, 'and it counts as sent');
+});
+
+test('setAccountPrivacy refuses a value outside the model, before any query', async () => {
+  expect();
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { account_visibility: 'stealth' } }, { pool })).error,
+  'invalid_account_visibility');
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { recruiter_discoverable: 'yes' } }, { pool })).error,
+  'invalid_recruiter_discoverable');
+  assert.equal((await pi.setAccountPrivacy({ githubId: SESSION.github_id, fields: {} }, { pool })).error, 'no_fields');
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: 'system:bfg', fields: { account_visibility: 'private' } }, { pool })).error, 'no_account');
+  assert.equal(calls.length, 0, 'a rejected write never reaches the database');
+});
+
+test('PATCH keys the write on the SESSION account — a body can neither name nor reach another one', async () => {
+  expect({ rows: [row({ account_visibility: 'private' })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { account_visibility: 'private' });
+  assert.equal(res.status, 200);
+  assert.equal(calls[0].params[0], SESSION.github_id, 'the write is keyed on the authenticated github_id');
+  assert.ok(!JSON.stringify(calls[0].params).includes(String(OTHER_ACCOUNT)));
+
+  expect({ rows: [row()] });
+  const named = await call('PATCH', '/api/bongos/me/cross-project',
+    { account_visibility: 'private', github_id: OTHER_ACCOUNT });
+  assert.equal(named.status, 400, 'a body that names an account is rejected outright (strict validation)');
+  assert.equal(named.json.error.code, 'validation_failed');
+  assert.equal(calls.length, 0, 'and nothing was written');
+});
+
+test('PATCH refuses a visibility outside the model and an empty body', async () => {
+  expect();
+  const bad = await call('PATCH', '/api/bongos/me/cross-project', { account_visibility: 'stealth' });
+  assert.equal(bad.status, 400);
+  assert.equal(bad.json.error.code, 'validation_failed');
+  const empty = await call('PATCH', '/api/bongos/me/cross-project', {});
+  assert.equal(empty.status, 400);
+  assert.equal(empty.json.error.code, 'no_fields');
+  assert.equal(calls.length, 0);
+});
+
+test('PATCH answers with the stored flags plus the ONE derived effective answer', async () => {
+  expect({ rows: [row({ account_visibility: 'private', recruiter_discoverable: true })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { recruiter_discoverable: true });
+  assert.deepEqual(res.json, {
+    hide_stats: false, account_visibility: 'private',
+    recruiter_discoverable: true, recruiter_discoverable_effective: true,
+  });
+});
+
+test('PATCH { hide_stats } alone still works and carries the privacy flags back', async () => {
+  expect({ rows: [row({ hide_stats: true })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { hide_stats: true });
+  assert.equal(res.status, 200);
+  assert.equal(res.json.hide_stats, true);
+  assert.equal(res.json.account_visibility, 'public');
+  assert.equal(res.json.recruiter_discoverable_effective, true);
+  assert.match(calls[0].text, /hide_stats/, 'the hide flag keeps its own writer (ADR 0171 D4)');
+});
+
+test('GET serves the own-scope view: both flags plus the effective answer', async () => {
+  expect(
+    { rows: [row({ account_visibility: 'private' })] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  );
+  const res = await call('GET', '/api/bongos/me/cross-project');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.account_visibility, 'private');
+  assert.equal(res.json.recruiter_discoverable, null);
+  assert.equal(res.json.recruiter_discoverable_effective, false, 'derived server-side, so no client re-derives it');
+});
+
+// ---- 4. the leak rule ------------------------------------------------------
+
+test('neither flag crosses a PUBLIC response — the /u/<handle> read stays a whitelist', async () => {
+  // The stored row carries both flags AND a sentinel private value; the public
+  // shape must be built from the whitelist, not spread from the row.
+  expect(
+    { rows: [{
+      github_id: '4242', github_login: 'octo', display_name: 'Octo', avatar_url: null,
+      handle: 'octo', bio: null, links: null, created_at: 'T', is_current: true,
+      account_visibility: 'private', recruiter_discoverable: true, profile_state: 'active', hide_stats: false,
+    }] },
+    { rows: [{ profile_state: 'active', hide_stats: false }] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  );
+  const out = await pi.getPublicProfileByHandle('octo', { pool });
+  const text = JSON.stringify(out);
+  for (const leak of ['account_visibility', 'recruiter_discoverable', 'profile_state', 'hide_stats', 'github_id']) {
+    assert.ok(!text.includes(leak), `${leak} must never serialize into a public body`);
+  }
+  assert.deepEqual(Object.keys(out.account).sort(),
+    ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since']);
+});
+
+// ---- 5. the settings copy states the grant ---------------------------------
+
+test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, name-only when hidden', () => {
+  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
+  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  assert.match(js, /your name, your disciplines, and whether you have been active in the last 30 days/,
+    'the sliver is name + disciplines + a coarse activity signal — spelled out, not implied');
+  assert.match(js, /never your credits, works shipped, karma, or the projects you build on/,
+    'and the copy says what it does NOT grant');
+  assert.match(js, /cross-project record is hidden, they will see your name and nothing else/,
+    'hide_stats shrinks the grant to name-only, because the rest is rollup-derived');
+  assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
+    'the section ships hidden — it reveals only where the hub module answers');
+});
+
+test('no toggle claims a protection this task has not built — the read paths are still open', () => {
+  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
+  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  // Storing a flag is not enforcing it (task 1002967 wires the read paths). A
+  // builder flipping this for personal safety must not be told they are hidden
+  // while GET /profiles/:handle still serves the page.
+  assert.match(html, /saved to your account now\. They start applying as[\s\S]*nothing is hidden yet/,
+    'the section states plainly that the choice is recorded, not yet in force');
+  assert.doesNotMatch(js, /Private hides the page|is private — hidden from everyone/,
+    'no present-tense promise that the page is already hidden');
+  assert.match(js, /Private will hide the page from everyone but you/,
+    'the row says what the choice WILL do');
+});