@bongos/core 1.19.422 → 1.19.424

package/tests/profile_privacy_owner_view.mjs

@@ -0,0 +1,477 @@
+// tests/profile_privacy_owner_view.mjs — P10 (task 1002806, goal 1000045):
+// "a private account's profile 404s to a stranger and RENDERS TO ITS OWNER",
+// and a stats-hidden account renders NO PARTIAL NUMBERS.
+//
+// WHAT THIS FILE IS, AND WHAT IT DELIBERATELY IS NOT. The 404 half of P10 was
+// already landed by task 1002967 in tests/effective_visibility_predicate.mjs:
+// private / provisional / private-discoverable / private-previous-handle all
+// 404 on GET /profiles/:handle, never 403, byte-identically for an anonymous
+// viewer, a signed-in stranger and the owner. Re-asserting that here would buy
+// nothing. This file is the OTHER half — the two things that proof left open:
+//
+//   1. THE OWNER'S PAGE, OVER REAL HTTP. 1002967 proves the own-scope side door
+//      at the FUNCTION level (pi.getOwnProfileExtras). But the page shell reads
+//      GET /me/cross-project, and that route is what must hand it the banner
+//      input (account_visibility='private') alongside the owner's own numbers.
+//      A function that behaves is not a route that behaves.
+//
+//   2. THE BYPASS THAT WOULD NULLIFY EVERY 404. The public read is viewer-
+//      independent precisely because the owner gets their page from the
+//      own-scope door instead. That door is therefore load-bearing for the
+//      privacy model: if it ever answered a CALLER-NAMED github_id instead of
+//      the session's, every 404 in 1002967 becomes a speed bump — ask the side
+//      door for the private account instead. Nothing tested that. This does.
+//
+//   3. NO PARTIAL NUMBERS, PROVED BY SUBTRACTION. 1002967 asserts the hidden
+//      account's body matches /"cross_project":null/. That is necessary and not
+//      sufficient: a future response that added `projects_count: 7` beside a
+//      null cross_project still matches it. So here every rollup-derived value
+//      is a PLANTED SENTINEL and the assertion is that none of them appears
+//      ANYWHERE in the hidden account's response text — with two controls that
+//      stop it passing vacuously (a public account's body DOES carry its
+//      sentinels; the hidden account's own numbers DO exist behind the door).
+//
+// THE RULE THIS FOLLOWS IS THE CODE'S, NOT THE PROFILE-PAGE SPEC'S. The spec
+// docs/specs/bongos-v1-builder-profile-page.md says 404 "to everyone but the
+// account itself", which reads as a viewer-dependent public response. The
+// AUTHORITATIVE model — the privacy spec (task 1002785) D2 — reconciles it the
+// other way and the code implements the reconciliation: the PUBLIC read 404s to
+// everyone INCLUDING the owner, and the owner's page is composed from the
+// own-scope endpoint. Both halves are asserted below.
+//
+// MECHANISM (tests/connections_ownership.mjs + tests/own_session_revoke.mjs):
+// an in-memory accounts + activity table whose row filter is built FROM EACH
+// STATEMENT'S OWN WHERE CLAUSE, refusing any statement whose placeholders or
+// literal comparisons it did not consume — so a predicate the fake cannot read
+// is a loud error rather than a silently absent filter. Everything above the
+// pool is real: the real routers, the real domain module, real HTTP.
+//
+// DB-free by construction. Runs in the lane that actually executes (the last
+// test in this file proves that).
+//
+// Run:  node tests/profile_privacy_owner_view.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// ===========================================================================
+// The fixture: four accounts, and a sentinel for every rollup-derived value
+// ===========================================================================
+//
+// Sentinels are per-account so a cross-wired response is caught too, and they
+// are improbable literals so "absent from the body" means absent, not merely
+// "did not collide with a 0 or a 1".
+
+const OCTO = '4242';   // active · public · shown  — the CONTROL
+const GHOST = '5150';  // active · PRIVATE         — the owner-renders subject
+const SHY = '6060';    // active · public · HIDDEN — the no-partial-numbers subject
+const NOSY = '7777';   // active · public          — the stranger at the side door
+
+const ACCOUNTS = [
+  { id: 1, github_id: OCTO, github_login: 'octo', display_name: 'Octo', avatar_url: null,
+    handle: 'octo', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  { id: 2, github_id: GHOST, github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
+    handle: 'ghost', previous_handle: null, handle_changed_at: null, bio: 'ghost-bio-515007', links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  { id: 3, github_id: SHY, github_login: 'shy', display_name: 'Shy', avatar_url: null,
+    handle: 'shy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  { id: 4, github_id: NOSY, github_login: 'nosy', display_name: 'Nosy', avatar_url: null,
+    handle: 'nosy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+];
+
+// Every number and name the cross-project rollup can produce, per account.
+const ROLLUP = {
+  [OCTO]: {
+    agg: { projects: 811008, credits: 811001, works_shipped: 811002, karma: 811003, last_active: 'octo-active-811007', disciplines: ['octo-craft-811004'] },
+    projects: [{ name: 'Octo-Project-811005', origin: 'https://octo.example', rank_held: 'metic', recent_ships: ['Octo-Ship-811006'], is_public: true }],
+  },
+  [GHOST]: {
+    agg: { projects: 515008, credits: 515001, works_shipped: 515002, karma: 515003, last_active: 'ghost-active-515007', disciplines: ['ghost-craft-515004'] },
+    projects: [{ name: 'Ghost-Project-515005', origin: 'https://ghost.example', rank_held: 'metic', recent_ships: ['Ghost-Ship-515006'], is_public: true }],
+  },
+  [SHY]: {
+    agg: { projects: 606008, credits: 606001, works_shipped: 606002, karma: 606003, last_active: 'shy-active-606007', disciplines: ['shy-craft-606004'] },
+    projects: [{ name: 'Shy-Project-606005', origin: 'https://shy.example', rank_held: 'metic', recent_ships: ['Shy-Ship-606006'], is_public: true }],
+  },
+  [NOSY]: {
+    agg: { projects: 777008, credits: 777001, works_shipped: 777002, karma: 777003, last_active: 'nosy-active-777007', disciplines: ['nosy-craft-777004'] },
+    projects: [{ name: 'Nosy-Project-777005', origin: 'https://nosy.example', rank_held: 'metic', recent_ships: ['Nosy-Ship-777006'], is_public: true }],
+  },
+};
+
+// Every sentinel belonging to one account, as strings — the "did any of this
+// leak?" alphabet. Numbers are included as their serialized form.
+function sentinelsOf(githubId) {
+  const r = ROLLUP[githubId];
+  return [
+    String(r.agg.projects),
+    String(r.agg.credits), String(r.agg.works_shipped), String(r.agg.karma),
+    r.agg.last_active, ...r.agg.disciplines,
+    ...r.projects.flatMap((p) => [p.name, p.origin, ...p.recent_ships]),
+  ];
+}
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+// The columns this interpreter can filter on. A literal comparison against
+// anything else throws — a WHERE it cannot read must never degrade to no WHERE.
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
+
+/**
+ * Build a row test from a statement's own WHERE text. Literal comparisons carry
+ * as much weight as placeholders here: the effective-visibility predicate is
+ * made ENTIRELY of literal comparisons, so a fake that modelled only $N filters
+ * would score the privacy terms as absent and pass however the code changed.
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+
+  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
+  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
+
+  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
+  if (byId) {
+    consumed.add(byId[1]);
+    const v = params[Number(byId[1]) - 1];
+    tests.push((r) => String(r.github_id) === String(v));
+  }
+
+  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
+  if (byHandle) {
+    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
+    const v = String(params[Number(byHandle[1]) - 1]);
+    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
+  }
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The github_id an activity statement is scoped to, read from its own WHERE.
+function activityScope(sql, params) {
+  const m = /\ba\.github_id = \$(\d+)/.exec(sql);
+  if (!m) throw new Error(`fake pool: an activity read with no github_id scope — ${sql.slice(0, 120)}`);
+  return String(params[Number(m[1]) - 1]);
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ')
+        ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '')
+        : '';
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      let rows = ACCOUNTS.filter(accountFilter(where, params));
+      if (/is_current/.test(cols)) {
+        // resolveHandle asks the row whether the handle it matched is the CURRENT
+        // one — the flag that forks 200 from 301. Derived, never assumed.
+        const asked = String(params[0]).toLowerCase();
+        rows = rows
+          .map((r) => ({ ...r, is_current: String(r.handle || '').toLowerCase() === asked }))
+          .sort((a, b) => Number(b.is_current) - Number(a.is_current))
+          .slice(0, /LIMIT 1/.test(sql) ? 1 : rows.length);
+      }
+      return { rows: rows.map((r) => ({ ...r })), rowCount: rows.length };
+    }
+
+    // The rollup aggregate — one row, always (an aggregate with no GROUP BY).
+    if (/WITH agg AS/.test(sql) && /platform_identity_builder_project_activity/.test(sql)) {
+      const who = ROLLUP[activityScope(sql, params)];
+      const agg = who ? who.agg : { projects: 0, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null };
+      return { rows: [{ ...agg }], rowCount: 1 };
+    }
+
+    // The per-project rows the rollup names (or collapses into more_projects).
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      const who = ROLLUP[activityScope(sql, params)];
+      const rows = who ? who.projects.map((p) => ({ ...p })) : [];
+      return { rows, rowCount: rows.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 140)}`);
+  },
+};
+
+// ===========================================================================
+// The real routers over those tables
+// ===========================================================================
+
+// The viewer the stubbed session middleware presents. Real requireBuilder reads
+// it from the session; the route body under test is untouched, and the route
+// body is the whole point — a route that reached for req.query.github_id would
+// be just as wrong with real auth in front of it.
+let viewer = null;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    // The public route's CORS wrapper is not under test; a pass-through keeps
+    // the doorway honest without dragging core config in.
+    corsPublicGet: () => (_req, _res, next) => next(),
+    requireBuilder: (req, res, next) => {
+      if (!viewer) return res.fail('unauthenticated', 401);
+      req.builder = { ...viewer };
+      next();
+    },
+  },
+};
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildProfileRoutes = require('../modules/platform-identity/routes/profile.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildProfileRoutes());
+app.use('/api/bongos', buildPublicProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function get(path_, headers = {}) {
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, text, json });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const asAccount = (githubId) => {
+  const a = ACCOUNTS.find((x) => x.github_id === githubId);
+  viewer = { github_id: a.github_id, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url };
+};
+
+// ===========================================================================
+// 0. The instrument is calibrated before it is trusted
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(
+    () => accountFilter('github_id = $1 AND some_new_flag = $2', [OCTO, true]),
+    /unread predicate on \$2/,
+    'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens',
+  );
+  assert.throws(
+    () => accountFilter("github_id = $1 AND shadow_banned = 'yes'", [OCTO]),
+    /unrecognised literal comparison on shadow_banned/,
+    'the privacy predicate is made of LITERAL comparisons — an unmodelled one must not read as absent',
+  );
+});
+
+test('the interpreter really does narrow on the visibility literals', () => {
+  const gated = ACCOUNTS.filter(accountFilter("(profile_state = 'active' AND account_visibility = 'public') AND (lower(handle) = $1 OR lower(previous_handle) = $1)", ['ghost']));
+  const ungated = ACCOUNTS.filter(accountFilter('(lower(handle) = $1 OR lower(previous_handle) = $1)', ['ghost']));
+  assert.equal(gated.length, 0, 'with the predicate, the private account is not reachable by handle');
+  assert.equal(ungated.length, 1, 'without it the SAME shape finds them — so dropping it genuinely changes this fixture');
+});
+
+// ===========================================================================
+// 1. No partial numbers: the hidden account leaks nothing by subtraction
+// ===========================================================================
+
+test('CONTROL: a public account really does serve every rollup sentinel', async () => {
+  // Without this, "no sentinels in the hidden body" could just mean the rollup
+  // never ran at all, and every assertion below would be vacuous.
+  viewer = null;
+  const res = await get('/api/bongos/profiles/octo');
+  assert.equal(res.status, 200);
+  for (const s of sentinelsOf(OCTO)) {
+    assert.ok(res.text.includes(s), `a public account's body must carry its rollup value ${s} — otherwise the leak test proves nothing`);
+  }
+  assert.ok(res.json.cross_project && res.json.cross_project.totals, 'and the payload really is the rollup shape');
+});
+
+test('CONTROL: the hidden account HAS numbers — they exist, they are withheld', async () => {
+  // The other vacuity guard: prove the sentinels are real data behind the door,
+  // not an empty fixture that trivially cannot appear in any response.
+  const own = await pi.getOwnProfileExtras(SHY, { pool });
+  assert.equal(own.totals.credits, 606001, 'the hidden account has real numbers');
+  assert.equal(own.totals.works_shipped, 606002);
+  assert.deepEqual(own.projects.map((p) => p.name), ['Shy-Project-606005']);
+});
+
+test('a stats-hidden account renders NO PARTIAL NUMBERS — not one sentinel survives', async () => {
+  viewer = null;
+  const res = await get('/api/bongos/profiles/shy');
+  assert.equal(res.status, 200, 'hide removes the ROLLUP, not the page (spec D2) — the identity band still resolves');
+
+  // The whole point of P10: a count beside a hidden total is a leak by
+  // subtraction, so the test is not "cross_project is null" (which a stray
+  // sibling key would satisfy) but "none of these values is anywhere".
+  for (const s of sentinelsOf(SHY)) {
+    assert.ok(!res.text.includes(s), `the hidden account's ${s} appears in the response — a count beside a hidden total is a leak by subtraction`);
+  }
+
+  // ...and the withholding is TOTAL, not a hollowed-out object. An empty
+  // {totals:{}} would tell a reader the rollup exists and is being suppressed.
+  assert.equal(res.json.cross_project, null, 'cross_project must be exactly null, never a partial or emptied object');
+  assert.ok(!('totals' in res.json), 'no rollup key may be hoisted to the top level to survive the null');
+  assert.deepEqual(Object.keys(res.json).sort(), ['account', 'cross_project'],
+    'the hidden response must carry no extra key — a new sibling key is exactly how a partial number arrives');
+
+  // The identity band is the other place a stray number can dock. The route
+  // whitelists it, and this pins that whitelist: a field added here reaches the
+  // world, so it must be a deliberate act that fails a test first.
+  assert.deepEqual(Object.keys(res.json.account).sort(),
+    ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since'],
+    'a new key on the identity band of a HIDDEN account is how a count arrives beside a hidden total');
+});
+
+test('the withholding is indistinguishable from having no numbers at all', async () => {
+  // A distinct "hidden" marker would be the same disclosure as a 403: it tells
+  // a stranger the account has a track record it is choosing not to show.
+  viewer = null;
+  const shy = await get('/api/bongos/profiles/shy');
+  assert.doesNotMatch(shy.text, /hidden|hide_stats|private|withheld|suppressed/i,
+    'the response must not name WHY the numbers are absent — that is itself the disclosure');
+});
+
+// ===========================================================================
+// 2. Renders to its owner: the own-scope door, over real HTTP
+// ===========================================================================
+
+test('the private account gets its OWN page from the own-scope door', async () => {
+  // The half the public 404 exists to make safe. GET /me/cross-project is what
+  // the page shell reads when the viewer is the account.
+  asAccount(GHOST);
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 200, 'a private account is still a full participant in its own scope');
+
+  // The banner input: the shell renders "private" from this field, and it must
+  // be the STORED value, not a default.
+  assert.equal(res.json.account_visibility, 'private',
+    'without this the owner cannot be told their page is private — the banner has no input');
+  assert.equal(res.json.handle, 'ghost', 'and it is their own record, identified');
+  assert.equal(res.json.bio, 'ghost-bio-515007');
+
+  // Their numbers are theirs: the side door is deliberately flag-blind.
+  assert.ok(res.json.cross_project, 'a private account must be able to read its own track record');
+  assert.equal(res.json.cross_project.totals.credits, 515001);
+  assert.equal(res.json.cross_project.totals.works_shipped, 515002);
+  assert.deepEqual(res.json.cross_project.projects.map((p) => p.name), ['Ghost-Project-515005']);
+
+  // ...and the reason it is a SIDE door: no visibility predicate is applied.
+  assert.ok(!calls.some((c) => /account_visibility = '|profile_state = '/.test(c.sql)),
+    'the self view must apply no visibility predicate — that is what makes it a side door, not a second public read');
+});
+
+test('BOTH HALVES AT ONCE: the same account, same instant — 404 public, 200 own', async () => {
+  // P10 stated as one assertion. The public response is viewer-independent, so
+  // the owner sees 404 there too (privacy spec D2, reconciling the profile-page
+  // spec's looser "404 to everyone but the account itself"); the page they
+  // actually see is composed from the own-scope door.
+  asAccount(GHOST);
+  const publicRead = await get('/api/bongos/profiles/ghost');
+  assert.equal(publicRead.status, 404, 'the PUBLIC read 404s even for the owner — it takes no viewer, so it cannot vary by one');
+  assert.notEqual(publicRead.status, 403, 'a 403 would confirm the handle exists, which is the disclosure the 404 rule prevents');
+  assert.ok(!publicRead.text.includes('Ghost'), 'and nothing about the account rides in the 404 body');
+  assert.ok(!publicRead.text.includes('ghost-bio-515007'));
+
+  const ownRead = await get('/api/bongos/me/cross-project');
+  assert.equal(ownRead.status, 200, 'and the very same account, in the very same state, renders to itself');
+  assert.equal(ownRead.json.handle, 'ghost');
+});
+
+test('a HIDDEN owner still sees their own numbers — hide is a public rule, not a self rule', async () => {
+  asAccount(SHY);
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.hide_stats, true, 'the toggle reads back, so Settings can render its state');
+  assert.equal(res.json.cross_project.totals.credits, 606001,
+    'ADR 0171 D2: a hidden builder inspects their numbers HERE, which is why the public route may return null');
+});
+
+// ===========================================================================
+// 3. The bypass that would nullify every 404
+// ===========================================================================
+
+test('the own-scope door answers the SESSION, never a caller-named account', async () => {
+  // If this door ever honoured a caller-named id, every 404 the public read
+  // returns becomes a speed bump: ask the side door for the private account
+  // instead. It is the single most load-bearing assertion in this file.
+  asAccount(NOSY);
+  const attempts = [
+    ['/api/bongos/me/cross-project?github_id=' + GHOST, {}],
+    ['/api/bongos/me/cross-project?id=' + GHOST, {}],
+    ['/api/bongos/me/cross-project?handle=ghost', {}],
+    ['/api/bongos/me/cross-project?github_login=ghost', {}],
+    ['/api/bongos/me/cross-project', { 'x-github-id': GHOST }],
+    ['/api/bongos/me/cross-project', { 'x-builder-id': GHOST, 'x-github-login': 'ghost' }],
+  ];
+  for (const [path_, headers] of attempts) {
+    const res = await get(path_, headers);
+    assert.equal(res.status, 200, `${path_} must still serve the caller`);
+    assert.equal(res.json.handle, 'nosy', `${path_} returned someone else's account — the own-scope door is not own-scoped`);
+    assert.equal(res.json.account_visibility, 'public', `${path_} leaked another account's privacy state`);
+    for (const s of sentinelsOf(GHOST)) {
+      assert.ok(!res.text.includes(s), `${path_} leaked the private account's ${s}`);
+    }
+  }
+});
+
+test('the own-scope door is closed to an unauthenticated caller', async () => {
+  viewer = null;
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 401, 'no session, no self — otherwise "own scope" means "anyone\'s scope"');
+});
+
+// ===========================================================================
+// 4. Lane proof — a test that never runs is not a gate (task 1002282)
+// ===========================================================================
+
+test('this proof runs in the DB-free lane that executes on every PR', () => {
+  const runner = fs.readFileSync(join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/profile_privacy_owner_view/.test(runner),
+    'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing',
+  );
+});