@bongos/core 1.19.422 → 1.19.424

package/tests/application_echo.mjs

@@ -0,0 +1,446 @@
+// tests/application_echo.mjs — the hub's statusless echo of an application, and
+// the one rule that makes it safe: it records only what the PROJECT actually
+// accepted, and it can never say what came of it (task 1002284, R08 of goal
+// 1000045; ADR 0201 D1.3/D1.4, ADR 0016).
+//
+// TWO HALVES.
+//
+//   Part A — the domain functions directly, over a recording pool. The window
+//   constant is asserted to be the one the query BINDS, so the doc, the reader
+//   and the table comment cannot drift apart into three different 30s.
+//
+//   Part B — the real POST /my-projects/join and GET /my-projects over an
+//   in-memory echo table whose filter is built from each statement's own WHERE
+//   clause. The relay's answer is scripted, so every outcome joinRelayOutcome
+//   can produce is asked the same question: did this leave a trace? Only an
+//   accepted application may. A refusal that wrote an echo would let the hub
+//   tell an applicant they applied to a project that turned them away at the
+//   door — the hub asserting a fact about someone else's project, which is the
+//   inversion ADR 0141 exists to prevent.
+//
+// The echo is a CONVENIENCE on the applicant's own view and never authority, so
+// it is best-effort in both directions: a failed echo write must not turn a
+// filed application into a reported failure, and a failed echo read must not
+// cost the memberships listing. Both are asserted, because "best-effort" written
+// in a comment is not best-effort.
+//
+// DB-free. Runs in the unit gate that executes on a PR.
+//
+// Run:  node --test tests/application_echo.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+// ESM import so the knip ratchet credits the constant this file consumes
+// (a createRequire() import does not credit a CJS export).
+import {
+  APPLICATION_ECHO_WINDOW_DAYS,
+  recordApplication,
+  listRecentApplications,
+} from '../modules/platform-identity/application-echo.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const DAY = 24 * 60 * 60 * 1000;
+const ME = 4242;
+
+// ===========================================================================
+// Part A — the domain functions, over a recording pool
+// ===========================================================================
+
+function recorder(result = { rows: [] }) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params }); return result; } };
+}
+
+test('the read binds the window constant itself — one 30, not three', async () => {
+  assert.equal(APPLICATION_ECHO_WINDOW_DAYS, 30, 'the privacy-spec D4 constant');
+  const pool = recorder();
+  await listRecentApplications(ME, { pool });
+  const [{ sql, params }] = pool.calls;
+  assert.match(sql, /applied_at > now\(\) - make_interval\(days => \$2::int\)/,
+    'the window is READ-TIME — no sweep, no expiry column');
+  assert.equal(params[1], APPLICATION_ECHO_WINDOW_DAYS,
+    'the query must bind the exported constant, so a change to it moves the behaviour');
+});
+
+test('the write is an upsert on the pair, refreshing the date (D1.4)', async () => {
+  const pool = recorder();
+  const wrote = await recordApplication({ githubId: ME, clientId: 'proj-a' }, { pool });
+  assert.equal(wrote, true);
+  const [{ sql, params }] = pool.calls;
+  assert.match(sql, /ON CONFLICT \(github_id, client_id\) DO UPDATE SET applied_at = now\(\)/,
+    're-applying is a success, so a second ask refreshes rather than erroring or piling up a row');
+  assert.deepEqual(params, [String(ME), 'proj-a']);
+});
+
+test('neither function carries a status, because the table holds none', async () => {
+  const pool = recorder();
+  await recordApplication({ githubId: ME, clientId: 'proj-a' }, { pool });
+  await listRecentApplications(ME, { pool });
+  for (const { sql } of pool.calls) {
+    assert.ok(!/\bstatus\b/.test(sql),
+      `the hub is not allowed to hold an admission fact about someone else's project: ${sql}`);
+  }
+});
+
+test('a non-numeric principal is refused before any query (ADR 0171 D2)', async () => {
+  const pool = recorder();
+  assert.equal(await recordApplication({ githubId: 'system:bfg', clientId: 'proj-a' }, { pool }), false);
+  assert.deepEqual(await listRecentApplications('system:bfg', { pool }), []);
+  assert.equal(await recordApplication({ githubId: ME, clientId: '' }, { pool }), false);
+  assert.equal(pool.calls.length, 0, 'binding a text principal to a bigint column would throw mid-request');
+});
+
+// ===========================================================================
+// Part B — the real routes over an in-memory echo table
+// ===========================================================================
+
+let echoes = [];
+let memberships = [];
+let echoFails = false;
+let statements = [];
+
+function seed() {
+  const now = Date.now();
+  echoes = [
+    { github_id: ME, client_id: 'proj-open', applied_at: now - 2 * DAY },
+    { github_id: ME, client_id: 'proj-joined', applied_at: now - 5 * DAY },
+    { github_id: ME, client_id: 'proj-stale', applied_at: now - 40 * DAY },
+    { github_id: 9999, client_id: 'proj-someone-elses', applied_at: now - DAY },
+  ];
+  memberships = [
+    { client_id: 'proj-joined', membership_kind: 'builder', joined_at: now - 4 * DAY, last_active: now, project_name: 'Joined', project_origin: 'https://joined.example', owner_github_id: null },
+  ];
+  echoFails = false;
+  statements = [];
+}
+const echo = (clientId) => echoes.find((e) => e.github_id === ME && e.client_id === clientId);
+
+/** A row filter built from the statement's own WHERE text; an unread placeholder throws. */
+function predicateFor(rawWhere, params) {
+  const tests = [];
+  const consumed = new Set();
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+  let where = rawWhere;
+  let m;
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\b(?:e\.)?github_id = \$(\d+)::bigint/.exec(where))) {
+    const v = p(m[1]); tests.push((r) => String(r.github_id) === String(v)); eat();
+  }
+  if ((m = /\bm\.github_id = \$(\d+)/.exec(where))) {
+    const v = p(m[1]); tests.push((r) => String(r.github_id ?? ME) === String(v)); eat();
+  }
+  if ((m = /\b(?:e\.)?applied_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1])); tests.push((r) => r.applied_at > Date.now() - days * DAY); eat();
+  }
+  if ((m = /\bclient_id = \$(\d+)/.exec(where))) {
+    const v = p(m[1]); tests.push((r) => r.client_id === v); eat();
+  }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+
+  // Every fragment matched above blanks itself to TRUE, so whatever is LEFT is a
+  // predicate this interpreter did not model. The $-sweep above cannot catch a
+  // LITERAL-ONLY one (`AND resolved_at IS NULL`, `AND status <> 'dismissed'`) —
+  // it binds nothing — and such a predicate silently narrows or widens the real
+  // query while every test stays green. That hole was found by review after it
+  // had already hidden one real filter, so the residual is swept too: this is
+  // what makes "refuses a predicate it cannot read" true of ALL predicates
+  // rather than only parameterised ones.
+  const residual = where
+    .replace(/\bTRUE\b/gi, ' ')
+    .replace(/\b(?:AND|OR)\b/gi, ' ')
+    .replace(/[()\s]/g, '');
+  if (residual) {
+    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+const CLIENTS = {
+  'https://target.example': { client_id: 'proj-open', name: 'Target', origin: 'https://target.example', status: 'active' },
+};
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    statements.push({ sql, params });
+    let m;
+
+    if (/FROM platform_identity_sso_clients WHERE origin = \$1 AND status = 'active'/.test(sql)) {
+      const c = CLIENTS[params[0]];
+      return { rows: c ? [c] : [] };
+    }
+
+    if (/FROM platform_identity_project_memberships m/.test(sql)) {
+      m = /WHERE (.+?) ORDER BY/.exec(sql);
+      return { rows: memberships.filter(predicateFor(m[1].replace(/ AND m\.membership_kind <> 'pending'/, ''), params)) };
+    }
+
+    if (/^DELETE FROM platform_identity_project_memberships WHERE client_id = \$1 AND github_id = \$2$/.test(sql)) {
+      const before = memberships.length;
+      memberships = memberships.filter((x) => !(x.client_id === params[0] && String(params[1]) === String(ME)));
+      return { rows: [], rowCount: before - memberships.length };
+    }
+
+    if ((m = /^DELETE FROM platform_identity_application_echoes WHERE (.+?)$/.exec(sql))) {
+      if (echoFails) throw new Error('echo table is on fire');
+      const doomed = echoes.filter(predicateFor(m[1], params));
+      echoes = echoes.filter((e) => !doomed.includes(e));
+      return { rows: [], rowCount: doomed.length };
+    }
+
+    if (/^INSERT INTO platform_identity_application_echoes/.test(sql)) {
+      if (echoFails) throw new Error('echo table is on fire');
+      const [githubId, clientId] = params;
+      const existing = echoes.find((e) => String(e.github_id) === String(githubId) && e.client_id === clientId);
+      if (existing) existing.applied_at = Date.now();
+      else echoes.push({ github_id: Number(githubId), client_id: clientId, applied_at: Date.now() });
+      return { rows: [] };
+    }
+
+    if (/FROM platform_identity_application_echoes e/.test(sql)) {
+      if (echoFails) throw new Error('echo table is on fire');
+      m = /WHERE (.+?) ORDER BY/.exec(sql);
+      const hit = echoes.filter(predicateFor(m[1], params)).sort((a, b) => b.applied_at - a.applied_at);
+      return {
+        rows: hit.map((e) => ({
+          client_id: e.client_id, applied_at: e.applied_at,
+          project_name: e.client_id === 'proj-open' ? 'Target' : null,
+          project_origin: e.client_id === 'proj-open' ? 'https://target.example' : null,
+        })),
+      };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+// project-stats reaches every project's own public API over the network; the
+// hall enrichment is not what this file is about, so it is stubbed out.
+const statsPath = require.resolve('../modules/platform-identity/project-stats.js');
+require.cache[statsPath] = {
+  id: statsPath, filename: statsPath, loaded: true,
+  exports: { getProjectStats: async () => ({}) },
+};
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+  requireBuilder: (req, _res, next) => {
+    req.builder = { id: 1, github_id: ME, github_login: 'octo', display_name: 'Octo' };
+    next();
+  },
+};
+
+const myProjectsRoutes = require('../modules/platform-identity/routes/my-projects.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// The project's own admission surface, scripted. This is the only thing that
+// decides whether an application happened.
+let relay = { status: 201, body: { ok: true } };
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url) => {
+  if (String(url).endsWith('/api/gds/access-requests')) {
+    if (relay === null) throw new Error('connection refused');
+    return { status: relay.status, json: async () => relay.body };
+  }
+  throw new Error(`unexpected fetch: ${url}`);
+};
+after(() => { globalThis.fetch = realFetch; });
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', myProjectsRoutes());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function call(method, pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path: pathname,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* empty */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'https://target.example', note });
+
+test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
+  assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
+  assert.throws(() => predicateFor("github_id = $1::bigint AND client_id <> 'x'", [1]), /unmodelled predicate/,
+    'a literal-only filter binds nothing, so the placeholder sweep alone would miss it');
+});
+
+// ── the echo is written only for an application the project actually took ────
+
+test('an accepted application leaves an echo', async () => {
+  seed();
+  echoes = echoes.filter((e) => e.client_id !== 'proj-open');
+  relay = { status: 201, body: { ok: true } };
+  const r = await join('please');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.status, 'requested');
+  assert.ok(echo('proj-open'), 'the applicant can now be told when they applied');
+});
+
+test('a re-application refreshes the date rather than failing or duplicating (D1.4)', async () => {
+  seed();
+  const before = echo('proj-open').applied_at;
+  // The project answers its own already_pending 200; the relay reads any 2xx as
+  // a filed request, which is what makes a double-clicked Apply harmless.
+  relay = { status: 200, body: { ok: true, already_pending: true } };
+  const r = await join();
+  assert.equal(r.json.status, 'requested');
+  assert.equal(echoes.filter((e) => e.github_id === ME && e.client_id === 'proj-open').length, 1, 'the pair is the key');
+  assert.ok(echo('proj-open').applied_at > before,
+    'the window is measured from the most recent ask, so a re-asker does not watch their own card go quiet');
+});
+
+for (const [name, answer, outcome] of [
+  ['a standing membership', { status: 409, body: { error: { code: 'already_member' } } }, 'already_member'],
+  ['an invite-only door', { status: 403, body: { error: { code: 'invite_only' } } }, 'invite_only'],
+  ['an open door', { status: 409, body: { error: { code: 'open_enrollment' } } }, 'open_enrollment'],
+  ['a members-only project', { status: 401, body: { error: { code: 'unauthorized' } } }, 'members_only'],
+]) {
+  test(`${name} is not an application, and leaves NO echo`, async () => {
+    seed();
+    echoes = echoes.filter((e) => e.client_id !== 'proj-open');
+    relay = answer;
+    const r = await join();
+    assert.equal(r.status, 200);
+    assert.equal(r.json.status, outcome);
+    assert.equal(echo('proj-open'), undefined,
+      'the hub must never tell an applicant they applied to a project that refused them at the door');
+  });
+}
+
+test('a project that cannot be reached leaves no echo', async () => {
+  seed();
+  echoes = echoes.filter((e) => e.client_id !== 'proj-open');
+  relay = null;
+  const r = await join();
+  assert.equal(r.status, 502);
+  assert.equal(echo('proj-open'), undefined);
+});
+
+test('a failed echo write never turns a filed application into a reported failure', async () => {
+  seed();
+  relay = { status: 201, body: { ok: true } };
+  echoFails = true;
+  const r = await join();
+  assert.equal(r.status, 200, 'the application IS filed on the project — the hub losing its note cannot unfile it');
+  assert.equal(r.json.status, 'requested');
+});
+
+// ── the read-back ────────────────────────────────────────────────────────────
+
+test('GET /my-projects reports what was applied to and when — and no status', async () => {
+  seed();
+  relay = { status: 201, body: { ok: true } };
+  const r = await call('GET', '/api/gds/my-projects');
+  assert.equal(r.status, 200);
+  const applied = r.json.applied;
+  assert.deepEqual(applied.map((a) => a.client_id), ['proj-open']);
+  assert.equal(applied[0].name, 'Target', 'a client_id alone is not renderable');
+  assert.equal(applied[0].origin, 'https://target.example');
+  assert.ok(applied[0].applied_at);
+  assert.deepEqual(Object.keys(applied[0]).sort(), ['applied_at', 'client_id', 'name', 'origin'],
+    'no status field may appear here — the hub is not allowed to know what came of it');
+});
+
+test('a project the applicant now BUILDS on drops out of applied — membership is the approval signal', async () => {
+  seed();
+  const r = await call('GET', '/api/gds/my-projects');
+  assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
+  assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
+    'an approval becomes visible by the card flipping to member, never by the echo claiming it');
+});
+
+test('an echo older than the window is invisible, not deleted', async () => {
+  seed();
+  const r = await call('GET', '/api/gds/my-projects');
+  assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-stale'),
+    'a declined application must not read as "applied" forever');
+  assert.ok(echoes.some((e) => e.client_id === 'proj-stale'), 'and the row is still there — the window is read-time');
+});
+
+test('the echo read is own-scope: another account’s row is never reachable', async () => {
+  seed();
+  const r = await call('GET', '/api/gds/my-projects');
+  assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-someone-elses'));
+  const echoRead = statements.find((s) => /FROM platform_identity_application_echoes/.test(s.sql));
+  assert.match(echoRead.sql, /WHERE e\.github_id = \$1::bigint/, 'keyed on the session, never on anything from the request');
+  assert.equal(echoRead.params[0], String(ME));
+});
+
+// MED-5 from the adversarial review: apply → approved → sign in (the echo is
+// hidden because membership wins) → LEAVE, and the echo resurfaced with the
+// original date for the rest of the window. The card then said "you applied on
+// <date>" about a project the caller had already joined — the echo implying an
+// outcome, which is the one thing ADR 0201 D1.3 forbids it to do.
+test('leaving a project forgets the application that got you in', async () => {
+  seed();
+  assert.ok(echo('proj-joined'), 'precondition: the echo from the original application is still on file');
+  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  assert.equal(left.status, 200);
+  assert.equal(left.json.left, true);
+  assert.equal(echo('proj-joined'), undefined, 'the echo goes with the membership');
+
+  const after = await call('GET', '/api/gds/my-projects');
+  assert.ok(!after.json.building.some((b) => b.client_id === 'proj-joined'));
+  assert.ok(!after.json.applied.some((a) => a.client_id === 'proj-joined'),
+    'and it does NOT come back as "applied" now that the membership no longer hides it');
+});
+
+test('leaving forgets only the leaver’s own echo, for only that project', async () => {
+  seed();
+  await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  assert.ok(echo('proj-open'), 'a different project of mine is untouched');
+  assert.ok(echoes.some((e) => e.client_id === 'proj-someone-elses'), 'and so is another account’s row');
+});
+
+test('a failed echo cleanup does not fail a leave that already happened', async () => {
+  seed();
+  echoFails = true;
+  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  assert.equal(left.status, 200, 'the membership is already gone — the echo is a convenience, not the act');
+  assert.equal(left.json.left, true);
+});
+
+test('a failed echo read costs the applied list and nothing else', async () => {
+  seed();
+  echoFails = true;
+  const r = await call('GET', '/api/gds/my-projects');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.applied, []);
+  assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined'], 'the memberships listing still lands');
+});