@bongos/core 1.19.419 → 1.19.421

package/tests/account_existence_rate_limit.mjs

@@ -0,0 +1,375 @@
+// tests/account_existence_rate_limit.mjs — the account-existence oracle has a
+// ceiling, and it is ONE ceiling (task 1003339, goal 1000045; ADR 0209).
+//
+// The hole this pins shut: two PUBLIC routes answer "does this GitHub login have
+// an account here?" — the onboarding module's GET /access-requests/status (the
+// rich member|invited|pending|dismissed|none) and core's
+// GET /auth/web/admission-status (its boolean twin) — and neither was throttled.
+// The global limiter returns early for non-write methods, so every GET bypassed
+// it. Scripted at line rate, either route turns a list of GitHub usernames into a
+// membership roster: who builds here, and confirmation that a named person is
+// present. That is targeting data, and it is worth having for a phishing run.
+//
+// What is executed here, not asserted about:
+//
+//   1. COUNTING — the first ACCOUNT_EXISTENCE_LIMIT probes from one address pass
+//      and the next is refused, on BOTH routes, over real HTTP through the real
+//      routers.
+//   2. SHARING — the two routes spend from ONE budget. Exhaust it on the rich
+//      route and the boolean twin is closed too, and vice versa. This is the
+//      property that matters most and the easiest one to fake: two limiters
+//      configured 120/60s each look identical in a diff and hand an enumerator
+//      240/min. So it is proved by behaviour AND by object identity (§4).
+//   3. SLIDING — still refused 30s in, open again at 61s. Proved on the real
+//      mounted route by moving Date.now, not by testing a private helper.
+//   4. ISOLATION — the ceiling is per-IP, so one abuser cannot close the door on
+//      everybody else.
+//   5. CHEAPNESS — a refused probe issues no database query. The limiter runs
+//      ahead of the lookups, so the oracle is not also a free amplifier.
+//
+// MUTATION-CHECKED (the tests/own_session_revoke.mjs standard): remove
+// `accountExistenceReadRateLimit` from either route's mount and this file goes
+// red — §1's counting fails for that route and §2's sharing fails in both
+// directions. Replace the shared instance with a per-route copy and §2 fails
+// while §1 still passes, which is exactly the regression worth catching.
+//
+// DB-FREE. The fake pool below is a small in-memory builders/access_requests
+// pair that answers from the statement's OWN shape, so the 200s are real answers
+// and the query counter in §5 counts real intent. Everything above it is real:
+// the real doorway (src/module-api.js — the module gets the limiter through it,
+// which is the point), the real auth.webAdmissionStatus, the real routers, real
+// HTTP with the production 'trust proxy' setting.
+//
+// Run:  node tests/account_existence_rate_limit.mjs
+
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+// ESM `import`, not createRequire, ON PURPOSE: the knip dead-code ratchet does
+// not credit a CJS export reached through createRequire, so these three would
+// read as unused and regress the baseline. Safe to hoist above the pool pin
+// below — rate-limit.js has no requires of its own — and an ESM import of a CJS
+// module resolves through the same cache, so SHARED_LIMITER is the very object
+// auth.js and the doorway hold (which §4 asserts).
+import {
+  accountExistenceReadRateLimit as SHARED_LIMITER,
+  ACCOUNT_EXISTENCE_LIMIT as LIMIT,
+  ACCOUNT_EXISTENCE_WINDOW_MS as WINDOW_MS,
+} from '../src/bongos/middleware/rate-limit.js';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+// 'ada' is a member; 'bo' has an invite; 'cy' is still pending; everyone else is
+// a stranger. The 200-level answers below are therefore real route output, which
+// is what makes "the limiter refused before the lookup" (§5) meaningful.
+const builders = new Set(['ada']);
+const accessRequests = [
+  { github_login: 'bo', status: 'invited' },
+  { github_login: 'cy', status: 'pending' },
+  { github_login: 'dez', status: 'dismissed' },
+];
+
+let queries = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    queries.push({ sql, params });
+    const login = String(params[0] ?? '').toLowerCase();
+    const req = accessRequests.filter((r) => r.github_login.toLowerCase() === login);
+
+    // db-kernel accessStateByLogin — the three-EXISTS probe behind
+    // auth.webAdmissionStatus. Recognised by its own projection.
+    if (/AS member/.test(sql)) {
+      return { rows: [{
+        member: builders.has(login),
+        invited: req.some((r) => r.status === 'invited'),
+        pending: req.some((r) => r.status === 'pending'),
+      }], rowCount: 1 };
+    }
+    if (/^SELECT 1 FROM builders/.test(sql)) {
+      return builders.has(login) ? { rows: [{ '?column?': 1 }], rowCount: 1 } : { rows: [], rowCount: 0 };
+    }
+    if (/FROM access_requests/.test(sql)) {
+      // The route prefers an 'invited' row, else the most recent.
+      const ordered = [...req].sort((a, b) => Number(b.status === 'invited') - Number(a.status === 'invited'));
+      return ordered.length ? { rows: [{ status: ordered[0].status }], rowCount: 1 } : { rows: [], rowCount: 0 };
+    }
+    throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 90)}`);
+  },
+  on: () => {},
+};
+
+// Pin the fake pool BEFORE anything that reaches for a connection is loaded, so
+// the doorway, db-kernel and the routers all resolve to it and no real pg Pool
+// is ever built.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: { pool, instanceDbName: () => 'test' },
+};
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const api = require('../src/module-api.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+
+const RICH = (login) => `/api/gds/access-requests/status?github_login=${encodeURIComponent(login)}`;
+const BOOL = (login) => `/api/gds/auth/web/admission-status?login=${encodeURIComponent(login)}`;
+
+const authRouter = buildAuthRouter();
+const accessRouter = buildAccessRequestsRouter();
+
+const app = express();
+// Exactly what src/platform-server.js sets, so req.ip resolves from
+// X-Forwarded-For the same way it does behind the real proxy.
+app.set('trust proxy', 1);
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', accessRouter);
+app.use('/api/gds', authRouter);
+
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const PORT = server.address().port;
+
+// node:http rather than fetch — §3 moves Date.now, and undici's connection
+// bookkeeping should not be dragged along for the ride.
+function call(path, ip) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port: PORT, path, method: 'GET', headers: { 'x-forwarded-for': ip } },
+      (res) => {
+        let data = '';
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => resolve({
+          status: res.statusCode,
+          headers: res.headers,
+          body: data ? JSON.parse(data) : null,
+        }));
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// Spend the whole budget for `ip`, asserting every probe was actually served.
+async function exhaust(ip, pathFor = RICH, login = 'ada') {
+  for (let i = 0; i < LIMIT; i++) {
+    const r = await call(pathFor(login), ip);
+    assert.equal(r.status, 200, `probe ${i + 1} of ${LIMIT} should still be inside the budget (got ${r.status})`);
+  }
+}
+
+// ===========================================================================
+// 1 — the ceiling exists, on both routes
+// ===========================================================================
+
+console.log('the ceiling exists — both probes stop answering:');
+
+await t(`the rich probe answers ${LIMIT} times from one address, then refuses`, async () => {
+  const ip = '10.0.0.1';
+  await exhaust(ip);
+  const over = await call(RICH('ada'), ip);
+  assert.equal(over.status, 429, `probe ${LIMIT + 1} must be refused`);
+});
+
+await t('the rich probe\'s refusal is the ADR 0116 envelope, and says which budget ran out', async () => {
+  const ip = '10.0.0.2';
+  await exhaust(ip);
+  const over = await call(RICH('ada'), ip);
+  assert.equal(over.body.error.code, 'rate_limited');
+  assert.equal(over.body.error.details.scope, 'account-existence',
+    'the two routes must name ONE budget — a per-route scope name would mean per-route buckets');
+  assert.equal(over.headers['x-ratelimit-scope'], 'account-existence');
+  assert.equal(over.headers['x-ratelimit-limit'], String(LIMIT));
+  const retry = Number(over.headers['retry-after']);
+  assert.ok(Number.isInteger(retry) && retry >= 1 && retry <= WINDOW_MS / 1000,
+    `Retry-After must be a whole number of seconds inside the window (got ${over.headers['retry-after']})`);
+  assert.equal(over.body.error.details.retry_after_seconds, retry, 'the body agrees with the header');
+});
+
+await t(`the boolean probe answers ${LIMIT} times from one address, then refuses`, async () => {
+  const ip = '10.0.0.3';
+  await exhaust(ip, BOOL);
+  const over = await call(BOOL('ada'), ip);
+  assert.equal(over.status, 429, `probe ${LIMIT + 1} must be refused`);
+  assert.equal(over.body.error.code, 'rate_limited');
+  assert.equal(over.body.error.details.scope, 'account-existence');
+});
+
+await t('under the ceiling both probes still answer truthfully — this is a cap, not a mute', async () => {
+  const ip = '10.0.0.4';
+  const member = await call(RICH('ada'), ip);
+  assert.deepEqual(member.body, { github_login: 'ada', status: 'member', admitted: true });
+  const invited = await call(RICH('bo'), ip);
+  assert.equal(invited.body.status, 'invited');
+  const stranger = await call(RICH('zzz'), ip);
+  assert.equal(stranger.body.status, 'none');
+  const bool = await call(BOOL('ada'), ip);
+  assert.deepEqual(bool.body, { admitted: true });
+  assert.equal((await call(BOOL('zzz'), ip)).body.admitted, false);
+});
+
+// ===========================================================================
+// 2 — ONE budget, not two. The property a copy-pasted limiter would lose.
+// ===========================================================================
+
+console.log('\none oracle, one budget — the routes cannot be alternated for double the rate:');
+
+await t('spending the budget on the rich probe closes the boolean twin as well', async () => {
+  const ip = '10.0.0.5';
+  await exhaust(ip, RICH);
+  const twin = await call(BOOL('ada'), ip);
+  assert.equal(twin.status, 429,
+    'the twin answers the same question — two separate 120/60s budgets would hand an enumerator 240/min');
+  assert.equal(twin.body.error.details.scope, 'account-existence');
+});
+
+await t('and in the other direction — spending it on the boolean twin closes the rich probe', async () => {
+  const ip = '10.0.0.6';
+  await exhaust(ip, BOOL);
+  const rich = await call(RICH('ada'), ip);
+  assert.equal(rich.status, 429);
+});
+
+await t('a budget spent half on each route still totals one budget', async () => {
+  const ip = '10.0.0.7';
+  for (let i = 0; i < LIMIT; i++) {
+    const r = await call(i % 2 === 0 ? RICH('ada') : BOOL('ada'), ip);
+    assert.equal(r.status, 200, `alternating probe ${i + 1} should still be inside the shared budget`);
+  }
+  assert.equal((await call(RICH('ada'), ip)).status, 429, 'alternating must not buy a single extra probe');
+  assert.equal((await call(BOOL('ada'), ip)).status, 429);
+});
+
+// ===========================================================================
+// 3 — the window slides, so the cap is a cap and not a permanent ban
+// ===========================================================================
+
+console.log('\nthe window slides — an exhausted address recovers, and not a moment early:');
+
+await t(`still refused part-way through the window, open again after ${WINDOW_MS / 1000}s`, async () => {
+  const ip = '10.0.0.8';
+  const realNow = Date.now;
+  try {
+    await exhaust(ip);
+    assert.equal((await call(RICH('ada'), ip)).status, 429, 'exhausted to begin with');
+
+    // Move the clock, not the limiter: this is the route that ships, with its
+    // real 60s window, being asked again later.
+    const t0 = realNow();
+    Date.now = () => t0 + WINDOW_MS / 2;
+    assert.equal((await call(RICH('ada'), ip)).status, 429,
+      'half a window later the timestamps are still inside it — a fixed-bucket reset would wrongly open here');
+
+    Date.now = () => t0 + WINDOW_MS + 1000;
+    const after = await call(RICH('ada'), ip);
+    assert.equal(after.status, 200, 'once the whole window has passed the budget is back');
+    assert.equal(after.body.status, 'member', 'and it is serving real answers again, not a cached 200');
+  } finally {
+    Date.now = realNow;
+  }
+});
+
+// ===========================================================================
+// 4 — per-IP, and structurally shared
+// ===========================================================================
+
+console.log('\nthe ceiling is per-address, and the sharing is structural:');
+
+await t('one exhausted address does not close the door on anybody else', async () => {
+  const noisy = '10.0.0.9';
+  const bystander = '10.0.0.10';
+  await exhaust(noisy);
+  assert.equal((await call(RICH('ada'), noisy)).status, 429);
+  const other = await call(RICH('ada'), bystander);
+  assert.equal(other.status, 200, 'a per-IP cap must not degenerate into a global kill switch');
+  assert.equal((await call(BOOL('ada'), bystander)).status, 200);
+});
+
+await t('both routes mount the very same middleware INSTANCE — sharing that cannot drift', () => {
+  const shared = SHARED_LIMITER;
+  assert.equal(typeof shared, 'function');
+  assert.equal(require('../src/bongos/middleware/rate-limit.js').accountExistenceReadRateLimit, shared,
+    'the ESM and CJS views of the middleware must be the same object, or this whole test proves nothing');
+  assert.equal(api.accountExistenceReadRateLimit, shared,
+    'the doorway must hand modules the same instance core uses, not a fresh one');
+
+  const handlers = (router, path) => {
+    const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods.get);
+    assert.ok(layer, `${path} must be a declared GET route`);
+    return layer.route.stack.map((s) => s.handle);
+  };
+  assert.ok(handlers(accessRouter, '/access-requests/status').includes(shared),
+    'the onboarding probe must mount the shared limiter');
+  assert.ok(handlers(authRouter, '/auth/web/admission-status').includes(shared),
+    'the core probe must mount the shared limiter');
+});
+
+await t('neither route vendors its own sliding window — the copy-paste regression stays out', () => {
+  for (const rel of ['modules/onboarding/routes/access-requests.js', 'src/bongos/routes/auth.js']) {
+    const src = readFileSync(join(ROOT, rel), 'utf8');
+    assert.ok(!/RATE_(WINDOW|LIMIT)|readRateLimit\s*=|new Map\(\); \/\/ ip/.test(src),
+      `${rel} must reach the shared limiter, never vendor a second one`);
+  }
+  const onboarding = readFileSync(join(ROOT, 'modules/onboarding/routes/access-requests.js'), 'utf8');
+  assert.match(onboarding, /accountExistenceReadRateLimit\s*\}?\s*=\s*api/,
+    'the module reaches it through the published doorway (ADR 0083), not a deep core require');
+});
+
+// ===========================================================================
+// 5 — a refused probe is cheap, so the oracle is not also an amplifier
+// ===========================================================================
+
+console.log('\na refused probe costs nothing:');
+
+await t('the limiter runs ahead of the lookups — a 429 issues no query', async () => {
+  const ip = '10.0.0.11';
+  await exhaust(ip);
+  queries = [];
+  assert.equal((await call(RICH('ada'), ip)).status, 429);
+  assert.equal((await call(BOOL('ada'), ip)).status, 429);
+  assert.deepEqual(queries, [], 'a refused probe must not reach the database at all');
+});
+
+await t('an allowed probe DOES query — so the previous test is not vacuous', async () => {
+  queries = [];
+  await call(RICH('ada'), '10.0.0.12');
+  assert.ok(queries.length > 0, 'the 200 path really does hit the pool');
+});
+
+// ===========================================================================
+// 6 — the budget is sized for the honest callers it has to clear
+// ===========================================================================
+
+await t('the ceiling clears both honest pollers with room to spare', () => {
+  // renderAccessPendingPage polls the boolean probe every 3s; `bongos login`
+  // polls the rich one every 5s. A future tightening that cannot fit both,
+  // several times over, would break sign-in for a shared/NAT address.
+  const honestPerMinute = 60 / 3 + 60 / 5;
+  assert.ok(LIMIT >= honestPerMinute * 3,
+    `${LIMIT}/min must leave real margin over the ${honestPerMinute}/min the pollers need`);
+});
+
+// ===========================================================================
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/account_privacy_flags.mjs

@@ -284,16 +284,23 @@ test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, na
     'the section ships hidden — it reveals only where the hub module answers');
 });
 
-test('no toggle claims a protection this task has not built — the read paths are still open', () => {
+test('each toggle claims exactly what is enforced — visibility in force, recruiting not yet', () => {
   const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
   const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
-  // Storing a flag is not enforcing it (task 1002967 wires the read paths). A
-  // builder flipping this for personal safety must not be told they are hidden
-  // while GET /profiles/:handle still serves the page.
-  assert.match(html, /saved to your account now\. They start applying as[\s\S]*nothing is hidden yet/,
-    'the section states plainly that the choice is recorded, not yet in force');
-  assert.doesNotMatch(js, /Private hides the page|is private — hidden from everyone/,
-    'no present-tense promise that the page is already hidden');
-  assert.match(js, /Private will hide the page from everyone but you/,
-    'the row says what the choice WILL do');
+  // A toggle may promise only what a read path actually enforces, and the two
+  // rows are at different stages. Task 1002967 wired VISIBILITY into every
+  // public read, so its row moved to the present tense here — and it must also
+  // say the page 404s to the OWNER, because that is the surprising half of D2
+  // (the owner reads their record through the own-scope side door instead).
+  // DISCOVERABILITY is still stored-only: no recruiting surface reads it, so a
+  // present-tense promise there would be the "protection you do not have" this
+  // assertion pair exists to prevent.
+  assert.match(js, /Private hides the page from everyone — including you/,
+    'visibility is enforced now, so the row says so — and names the 404-to-self');
+  assert.doesNotMatch(js, /Private will hide the page/,
+    'the future tense outlived its truth the moment resolveHandle joined the predicate');
+  assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability is saved to your[\s\S]*starts applying as the recruiting surfaces land/,
+    'the section note splits the two: one in force, one recorded and waiting');
+  assert.doesNotMatch(js, /Recruiters looking for builders (?:can|are able to) find you\b/,
+    'no present-tense promise about recruiting reach — nothing reads that flag yet');
 });