@bongos/core 1.19.417 → 1.19.419

package/tests/connections_ownership.mjs

@@ -0,0 +1,313 @@
+// tests/connections_ownership.mjs — "a builder cannot act on someone else's
+// connection", EXECUTED rather than asserted against a string (task 1002295,
+// goal 1000045; ADR 0202 D2).
+//
+// Its sibling `connections_api.mjs` proves the SHAPE of every statement — which
+// parameters are bound, which caps are carried. That is necessary and not
+// sufficient: a shape assertion still passes if the WHERE clause is rewritten in
+// a way the regex happens to match. So this file does the other half.
+//
+// THE MECHANISM, copied from tests/own_session_revoke.mjs (task 1003341): the
+// pool below is a real in-memory `platform_identity_connections` table plus a
+// mini-interpreter that builds each statement's row filter FROM THAT STATEMENT'S
+// OWN WHERE CLAUSE. Drop `addressee_github_id = $2` from the accept and the
+// filter genuinely widens, so a stranger's row genuinely changes, and the test
+// genuinely fails. The interpreter REFUSES any statement whose placeholders it
+// did not all consume, so a predicate it cannot read is a loud error rather than
+// a silently weaker filter — the failure mode that makes a fake pool worthless.
+//
+// Everything above the pool is real: the real router, the real domain functions,
+// real HTTP. Only the storage is in memory.
+//
+// DB-free. Runs in the unit gate that executes on a PR.
+//
+// Run:  node tests/connections_ownership.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+const DAY = 24 * 60 * 60 * 1000;
+
+// Four accounts: the caller and three other people whose rows must be untouchable.
+const ME = 4242;
+const ADA = 9001;
+const BO = 9002;
+const CY = 9003;
+
+// ===========================================================================
+// The in-memory table + its statement interpreter
+// ===========================================================================
+
+let rows = [];
+function seed() {
+  const now = Date.now();
+  rows = [
+    // 1 — Ada asked ME. Mine to accept or decline.
+    { id: 1, requester_github_id: ADA, addressee_github_id: ME, status: 'pending', created_at: now - DAY, resolved_at: null },
+    // 2 — Cy asked Bo. None of my business, and I know its id.
+    { id: 2, requester_github_id: CY, addressee_github_id: BO, status: 'pending', created_at: now - DAY, resolved_at: null },
+    // 3 — ME and Cy are connected. Either of us may end it.
+    { id: 3, requester_github_id: ME, addressee_github_id: CY, status: 'accepted', created_at: now - 30 * DAY, resolved_at: now - 29 * DAY },
+    // 4 — Bo and Cy are connected. Not mine to end.
+    { id: 4, requester_github_id: BO, addressee_github_id: CY, status: 'accepted', created_at: now - 30 * DAY, resolved_at: now - 29 * DAY },
+    // 5 — I asked Ada and she has not answered. Mine to cancel.
+    { id: 5, requester_github_id: ME, addressee_github_id: ADA, status: 'pending', created_at: now - 2 * DAY, resolved_at: null },
+    // 6 — Ada asked me 40 days ago. Expired: gone from both queues, and it must
+    //     not be resurrectable into an acceptance or a fresh 90-day cooldown.
+    { id: 6, requester_github_id: ADA, addressee_github_id: ME, status: 'pending', created_at: now - 40 * DAY, resolved_at: null },
+  ];
+}
+const row = (id) => rows.find((r) => r.id === id);
+
+/**
+ * Build a row filter from a statement's own WHERE text. Every placeholder the
+ * clause mentions must be consumed by a fragment below; one that is not throws,
+ * so a predicate this cannot read can never degrade into "no constraint".
+ */
+function predicateFor(rawWhere, params) {
+  let where = rawWhere;
+  const tests = [];
+  const consumed = new Set();
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+
+  // The either-side clause (remove) is matched and STRIPPED first, so the
+  // single-column matchers below cannot re-read half of it as a one-sided filter.
+  const either = /\(requester_github_id = \$(\d+)::bigint OR addressee_github_id = \$(\d+)::bigint\)/.exec(where);
+  if (either) {
+    const a = p(either[1]);
+    const b = p(either[2]);
+    tests.push((r) => String(r.requester_github_id) === String(a) || String(r.addressee_github_id) === String(b));
+    where = where.replace(either[0], ' TRUE ');
+  }
+
+  let m;
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
+  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
+  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
+  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
+  if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1]));
+    tests.push((r) => r.created_at > Date.now() - days * DAY);
+  }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+const ACCOUNT = {
+  id: 1, github_id: String(ME), github_login: 'octo', display_name: 'Octo', avatar_url: null,
+  profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  recruiter_discoverable: null, handle: 'octo', previous_handle: null,
+};
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+
+    // The caller's own account (the profile_state floor every route reads first).
+    if (/FROM platform_identity_accounts WHERE github_id = \$1$/.test(sql)) {
+      return { rows: [{ ...ACCOUNT }], rowCount: 1 };
+    }
+
+    // accept / decline — one UPDATE, one WHERE.
+    let m = /^UPDATE platform_identity_connections SET status = '(accepted|rejected)'.*? WHERE (.+?) RETURNING/.exec(sql);
+    if (m) {
+      const hit = rows.filter(predicateFor(m[2], params));
+      for (const r of hit) { r.status = m[1]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: String(r.id) })), rowCount: hit.length };
+    }
+
+    // remove / cancel — a DELETE branch and an UPDATE branch in one statement.
+    if (/^WITH removed AS \( DELETE FROM platform_identity_connections/.test(sql)) {
+      const del = /DELETE FROM platform_identity_connections WHERE (.+?) RETURNING/.exec(sql);
+      const upd = /UPDATE platform_identity_connections SET status = 'cancelled'.*? WHERE (.+?) RETURNING/.exec(sql);
+      assert.ok(del && upd, 'the remove statement lost one of its two branches');
+      const out = [];
+      const removed = rows.filter(predicateFor(del[1], params));
+      for (const r of removed) { rows = rows.filter((x) => x !== r); out.push({ outcome: 'removed' }); }
+      const cancelled = rows.filter(predicateFor(upd[1], params));
+      for (const r of cancelled) { r.status = 'cancelled'; r.resolved_at = Date.now(); out.push({ outcome: 'cancelled' }); }
+      return { rows: out, rowCount: out.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+// ===========================================================================
+// The real router over that table
+// ===========================================================================
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    parsePagination: helpers.parsePagination,
+    logger: () => ({ error() {}, warn() {}, info() {} }),
+    requireBuilder: (req, _res, next) => { req.builder = { github_id: ME, github_login: 'octo' }; next(); },
+  },
+};
+const buildConnectionRoutes = require('../modules/platform-identity/routes/connections.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildConnectionRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* 204 */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ===========================================================================
+// The interpreter is the instrument, so it gets calibrated first
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(
+    () => predicateFor("id = $1 AND some_new_column = $2", [1, 2]),
+    /unread predicate on \$2/,
+    'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens'
+  );
+});
+
+test('the interpreter really does narrow on the owner column', () => {
+  seed();
+  const mine = rows.filter(predicateFor("id = $1 AND addressee_github_id = $2::bigint AND status = 'pending'", [1, ME]));
+  const wide = rows.filter(predicateFor("id = $1 AND status = 'pending'", [2]));
+  assert.equal(mine.length, 1);
+  assert.equal(wide.length, 1, 'without the owner column the same shape matches a stranger row');
+  assert.equal(wide[0].addressee_github_id, BO);
+});
+
+// ===========================================================================
+// The proof: another builder's row does not move
+// ===========================================================================
+
+test('accept: my own incoming request really is accepted', async () => {
+  seed();
+  const res = await call('POST', '/api/bongos/connections/1/accept');
+  assert.equal(res.status, 200);
+  assert.equal(row(1).status, 'accepted');
+});
+
+test("accept: a STRANGER'S request is 404 and the row is byte-for-byte untouched", async () => {
+  seed();
+  const before = { ...row(2) };
+  const res = await call('POST', '/api/bongos/connections/2/accept');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(2), before, 'Cy asked Bo — nothing I send may move that row');
+});
+
+test('accept: an EXPIRED request of mine cannot be accepted', async () => {
+  seed();
+  const before = { ...row(6) };
+  const res = await call('POST', '/api/bongos/connections/6/accept');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(6), before);
+});
+
+test('decline: mine flips to rejected — the row that IS the 90-day cooldown', async () => {
+  seed();
+  const res = await call('POST', '/api/bongos/connections/1/decline');
+  assert.equal(res.status, 204);
+  assert.equal(row(1).status, 'rejected');
+  assert.ok(row(1).resolved_at, 'resolved_at is what the cooldown window is measured from');
+});
+
+test("decline: a stranger's request is 404 and unmoved", async () => {
+  seed();
+  const before = { ...row(2) };
+  const res = await call('POST', '/api/bongos/connections/2/decline');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(2), before);
+});
+
+test('decline: an EXPIRED request cannot be turned into a fresh cooldown', async () => {
+  seed();
+  const before = { ...row(6) };
+  const res = await call('POST', '/api/bongos/connections/6/decline');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(6), before, 'a request ADR 0202 D2 §3 considers gone must not silently block the requester for 90 days');
+});
+
+test('remove: my own accepted connection is HARD-DELETED, leaving no tombstone', async () => {
+  seed();
+  const res = await call('DELETE', '/api/bongos/connections/3');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { outcome: 'removed' });
+  assert.equal(row(3), undefined, 'no "ME removed CY" row survives — neither party consented to keep one');
+});
+
+test("remove: two strangers' connection is 404 and still there", async () => {
+  seed();
+  const before = { ...row(4) };
+  const res = await call('DELETE', '/api/bongos/connections/4');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(4), before, 'Bo and Cy know each other and I am not in that pair');
+});
+
+test('remove: a request I SENT is cancelled, not deleted', async () => {
+  seed();
+  const res = await call('DELETE', '/api/bongos/connections/5');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { outcome: 'cancelled' });
+  assert.equal(row(5).status, 'cancelled');
+});
+
+test('remove: a request SENT TO ME cannot be deleted — that route is decline, which arms the cooldown', async () => {
+  seed();
+  const before = { ...row(1) };
+  const res = await call('DELETE', '/api/bongos/connections/1');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(1), before, 'otherwise an addressee dodges the 90-day cooldown by calling a decline a delete');
+});
+
+test('an id nobody owns changes nothing at all', async () => {
+  seed();
+  const snapshot = JSON.stringify(rows);
+  for (const [method, path] of [
+    ['POST', '/api/bongos/connections/999/accept'],
+    ['POST', '/api/bongos/connections/999/decline'],
+    ['DELETE', '/api/bongos/connections/999'],
+  ]) {
+    const res = await call(method, path);
+    assert.equal(res.status, 404, `${method} ${path}`);
+  }
+  assert.equal(JSON.stringify(rows), snapshot, 'the table is bit-identical after three misses');
+});

package/tests/own_scope_guard.mjs

@@ -79,6 +79,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the /me aggregator: identity, rank, credits, streak, claims and prefs for the CALLER. Every slice keys on req.builder.id.',
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-sessions.js',
+    why: "the caller's OWN auth sessions — list, revoke one, sign out everywhere (task 1003341, ADR 0206). Every statement carries builder_id = req.builder.id, so a session id belonging to somebody else matches no row. Kept OUT of routes/auth.js precisely so this whole file can be held to the own-scope rule: the admin cross-builder pair next door takes its target from the body, which is what makes it admin.",
+    crossOwner: [],
+  },
   {
     file: 'modules/builder-settings/routes/settings.js',
     why: 'the per-builder preference domain (wandering, skill, sound, render, model-allocation, display name) carved out of /me — read and write, all keyed on req.builder.id.',
@@ -89,6 +94,11 @@ const OWN_SCOPED_SURFACES = [
     why: "the builder's OWN cross-project profile controls (hide flag, handle, bio/links) — all keyed on req.builder.github_id.",
     crossOwner: [],
   },
+  {
+    file: 'modules/platform-identity/routes/connections.js',
+    why: 'the connection graph (ADR 0202, task 1002295). The ACTING account is always the session; a counterparty is named by public handle or by the connection row id, never by an account identifier — and the degree label is a viewer-relative own-scope read (D4 §4).',
+    crossOwner: [],
+  },
   {
     file: 'modules/memory/routes/memory.js',
     why: 'per-builder memory (ADR 0024 §4). The self endpoints are own-scoped; the five cross-builder endpoints name their target in the path and are gate-verified below.',