@bongos/core 1.19.424 → 1.19.426

package/src/bongos/auth.js

@@ -390,9 +390,54 @@ const PAGE_GATES = Object.freeze({
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
   requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
   requireGovernmentManagePage: Object.freeze({ permission: 'government.manage', deniedTo: '/builders' }),
-  requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
+  // `alsoAdmits` — a SECOND, non-rank audience this page's DATA ROUTE admits, so
+  // the page can follow it (ADR 0210, task 1002290). /people fronts GET /scouting,
+  // which since R14 admits a `project.curate` holder OR a PROJECT OWNER; a page
+  // gate that could only ever ask about a permission would leave the widened
+  // audience staring at a redirect. The value names a function on the
+  // `platform-identity.hub` port — the module that owns the ownership fact — and
+  // is consulted ONLY after the permission check has already refused, so it can
+  // widen and never narrow. Absent port, absent function, or a throw: no admit.
+  requireProjectCuratePage: Object.freeze({
+    permission: 'project.curate', deniedTo: '/builders', alsoAdmits: 'isProjectOwner',
+  }),
 });
 
+// The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
+// the module that owns the answer, only for the one gate that declares one.
+//
+// FAIL-CLOSED, EVERY WAY IT CAN FAIL: a gate with no `alsoAdmits`, a hub module
+// that is off (every non-hub instance), a port that never grew the function, or a
+// resolver that throws all answer FALSE — the visitor is redirected exactly as
+// before. The only outcome that admits is an explicit truthy answer.
+//
+// Not authority (ADR 0016): the answer gates a PAGE SHELL and nothing else, and
+// every data endpoint behind that shell still carries its own server-side gate.
+async function pageGateAlsoAdmits(name, session) {
+  const { alsoAdmits } = PAGE_GATES[name];
+  if (!alsoAdmits) return false;
+  // The WHOLE lookup is inside the try, not just the call: resolving a seam can
+  // throw too, and a throw there would 500 the page instead of taking the clean
+  // deny-redirect every other failure here takes. One catch, one outcome.
+  try {
+    const hub = seams.resolveOptional('platform-identity.hub');
+    // OWN property only. Every object inherits `constructor`, `valueOf` and
+    // `toString`, each of which is a function whose result is truthy — so a plain
+    // `hub[name]` lookup would let a mis-typed or mis-declared `alsoAdmits` admit
+    // EVERYONE. Unreachable today (the only value is a frozen literal), but a
+    // fail-OPEN default has no business sitting in an authorization path.
+    if (!hub || !Object.prototype.hasOwnProperty.call(hub, alsoAdmits)) return false;
+    const ask = hub[alsoAdmits];
+    if (typeof ask !== 'function') return false;
+    return !!(await ask(session.github_id));
+  } catch (err) {
+    // Message only — the answer came from a query that can carry row data.
+    require('./logger').logger.child({ src: 'auth' })
+      .error({ err: err && err.message }, `${name} ${alsoAdmits} check failed`);
+    return false;
+  }
+}
+
 // A builder's effective permission set, or NULL when authority cannot be
 // ESTABLISHED (the `governance` port is absent or malformed, or the resolver
 // threw). Every caller must read null as a DENIAL: admitting when the authority
@@ -446,6 +491,15 @@ async function runPageGate(name, req, res, next) {
   }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
+    // The rank door said no. A page whose data route admits a SECOND audience
+    // asks that door before redirecting (ADR 0210) — consulted here and nowhere
+    // else, so it can only widen. Asked on the authority-outage branch too,
+    // because the ownership fact does not come from the authority system: not
+    // asking would make the page narrower than the route it fronts.
+    if (await pageGateAlsoAdmits(name, session)) {
+      next();
+      return;
+    }
     // N-1 (task 1002613): a bare deniedTo rendered nothing — every denial read as
     // "I signed in and got dumped at the home page". Name the permission (and an
     // authority outage, distinctly) in the query so the hall shell can say why.
@@ -488,8 +542,10 @@ async function requireGovernmentManagePage(req, res, next) {
 // The /people builder-directory page (task 1002577) — gated on the
 // `project.curate` ATOM, the same key its one data route (GET /scouting,
 // modules/platform-identity) checks, so the page layer can never drift wider
-// than the API it fronts. Spec R14 (goal 1000045) widens the atom's audience
-// later; this gate follows it automatically.
+// than the API it fronts. R14 (goal 1000045, ADR 0210) widened that route to a
+// SECOND audience that is not a rank at all — a project owner — so this gate
+// carries the same OR through `alsoAdmits` above: the two doors of the page are
+// exactly the two doors of the route, and neither layer can drift from it.
 async function requireProjectCuratePage(req, res, next) {
   return runPageGate('requireProjectCuratePage', req, res, next);
 }

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.424'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.426'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -284,23 +284,33 @@ test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, na
     'the section ships hidden — it reveals only where the hub module answers');
 });
 
-test('each toggle claims exactly what is enforced — visibility in force, recruiting not yet', () => {
+test('each toggle claims exactly what is enforced — and BOTH are now in force', () => {
   const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
   const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
-  // A toggle may promise only what a read path actually enforces, and the two
-  // rows are at different stages. Task 1002967 wired VISIBILITY into every
-  // public read, so its row moved to the present tense here — and it must also
-  // say the page 404s to the OWNER, because that is the surprising half of D2
-  // (the owner reads their record through the own-scope side door instead).
-  // DISCOVERABILITY is still stored-only: no recruiting surface reads it, so a
-  // present-tense promise there would be the "protection you do not have" this
-  // assertion pair exists to prevent.
+  // A toggle may promise only what a read path actually enforces. The two rows
+  // reached that point one task apart. Task 1002967 wired VISIBILITY into every
+  // public read, so its row moved to the present tense — and it must also say
+  // the page 404s to the OWNER, because that is the surprising half of D2 (the
+  // owner reads their record through the own-scope side door instead). Task
+  // 1002290 then wired RECRUITING REACH into listScoutingRollup, the one reader
+  // behind /scouting and the hall's People directory, so its row followed on the
+  // same terms. The assertions are unchanged in KIND — copy must track
+  // enforcement — only in which tense each row is now required to be in.
   assert.match(js, /Private hides the page from everyone — including you/,
     'visibility is enforced now, so the row says so — and names the 404-to-self');
   assert.doesNotMatch(js, /Private will hide the page/,
     'the future tense outlived its truth the moment resolveHandle joined the predicate');
-  assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability is saved to your[\s\S]*starts applying as the recruiting surfaces land/,
-    'the section note splits the two: one in force, one recorded and waiting');
-  assert.doesNotMatch(js, /Recruiters looking for builders (?:can|are able to) find you\b/,
-    'no present-tense promise about recruiting reach — nothing reads that flag yet');
+  assert.match(js, /Recruiters looking for builders can find you\b/,
+    'recruiting reach is enforced now (task 1002290), so the row promises it in the present tense');
+  assert.doesNotMatch(js, /will be able to find you/,
+    'the future tense outlived its truth the moment listScoutingRollup joined the reach predicate');
+  assert.match(js, /takes you out of the People directory straight away/,
+    'and the row names the ONE surface that reads the flag today — a promise you can go and check');
+  assert.doesNotMatch(js, /every recruiting view/,
+    'never a promise over surfaces that do not exist yet: the D3 recruiter sliver is unbuilt, so no '
+    + 'guard here could hold that claim, and the copy rule is that a toggle promises exactly what is enforced');
+  assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability applies now too/,
+    'the section note now says both are live, rather than splitting them');
+  assert.doesNotMatch(html, /starts applying as the recruiting surfaces land/,
+    'the "recorded and waiting" note must not outlive the surface that started reading it');
 });

package/tests/effective_visibility_predicate.mjs

@@ -77,6 +77,8 @@ import {
   rollupVisibleSql,
   isRollupVisible,
   isRecruiterDiscoverable,
+  recruiterReachSql,
+  scoutingListableSql,
 } from '../modules/platform-identity/account-visibility.js';
 
 const require = createRequire(import.meta.url);
@@ -244,7 +246,14 @@ function blankComments(src) {
 const SPELLINGS = [
   [/\bprofile_state\s*(?:=|==|===|!=|!==|<>)\s*['"]/g, "profile_state compared to a literal"],
   [/\baccount_visibility\s*(?:=|==|===|!=|!==|<>)\s*['"]/g, 'account_visibility compared to a literal'],
-  [/\bCOALESCE\s*\(\s*recruiter_discoverable/gi, 'the recruiter-reach COALESCE'],
+  // The reach COALESCE, in every form a real query writes it. The unqualified
+  // spelling alone was a hole: the ONE production copy of this predicate is
+  // written `COALESCE(${q}recruiter_discoverable, …)` and emits
+  // `COALESCE(pa.recruiter_discoverable, …)`, and NEITHER matched — so the rule
+  // that is supposed to make this file the only home for the reach answer was
+  // catching only the spelling nobody uses. A drift copy would most likely be
+  // aliased too (task 1002290, found in this task's adversarial review).
+  [/\bCOALESCE\s*\(\s*(?:[A-Za-z_$][\w$]*|\$\{[^}]*\})?\s*\.?\s*recruiter_discoverable/gi, 'the recruiter-reach COALESCE'],
   [/\bNOT\s+(?:[A-Za-z_][\w]*\.)?hide_stats\b/g, 'a SQL NOT hide_stats'],
   [/\bhide_stats\s*(?:=|==|===)\s*(?:true|false)\b/g, 'hide_stats compared to a boolean'],
 ];
@@ -318,8 +327,14 @@ function accountStatements(code) {
   return out;
 }
 
-/** Does this function body route through one of the shared predicates? */
-const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
+/**
+ * Does this function body route through one of the shared predicates?
+ * scoutingListableSql (task 1002290) is COMPOSED from rollupVisibleSql and
+ * recruiterReachSql inside the owner file, so a reader that joins it has adopted
+ * the shared rule — but it must be named here, or wiring the recruiting reach in
+ * would read as a reader that stopped adopting anything.
+ */
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
 
 // ===========================================================================
 // Self-tests — the machinery is the guard, so it gets proved too.
@@ -342,6 +357,17 @@ t('SPELLINGS catch a hand-written variant in either language, and leave writes a
   assert.ok(caught("AND account_visibility = 'public'"), 'the existence axis in SQL');
   assert.ok(caught("acct.account_visibility === 'private'"), 'the existence axis in JS');
   assert.ok(caught('COALESCE(recruiter_discoverable, account_visibility)'), 'the recruiter COALESCE');
+  // The forms a REAL query carries — an alias, a template variable, and the two
+  // together. Testing only the bare spelling is how this rule came to match
+  // nothing that ships: the ONE production copy emits `COALESCE(pa.recruiter_-
+  // discoverable, …)` from source that reads `COALESCE(${q}recruiter_-
+  // discoverable, …)`, and the rule matched NEITHER (task 1002290, found in this
+  // task's adversarial review — and then again one form later, which is why all
+  // four are pinned rather than the one that failed first).
+  assert.ok(caught('COALESCE(pa.recruiter_discoverable, TRUE)'), 'the reach COALESCE, aliased');
+  assert.ok(caught('COALESCE(${q}recruiter_discoverable, x)'), 'the reach COALESCE, as the builder writes it');
+  assert.ok(caught('COALESCE(${alias}.recruiter_discoverable, TRUE)'), 'a template alias AND a dot — the drift copy most likely to be written');
+  assert.ok(!caught('COALESCE(hide_stats, false)'), 'and it is the REACH column it watches, not any COALESCE');
   assert.ok(caught('AND NOT pa.hide_stats'), 'the hide half of a rollup predicate');
   // A WRITE names the column but compares it to nothing — it decides no visibility.
   assert.ok(!caught("profile_state = CASE WHEN $5::boolean THEN 'active' ELSE x END"), 'an upsert is not a predicate');
@@ -390,10 +416,24 @@ t('rollupVisibleSql is COMPOSED from accountVisibleSql, never restated', () => {
   assert.match(rollupVisibleSql('pa'), /AND NOT pa\.hide_stats/, 'and add exactly the hide term');
 });
 
-t('the alias is the one interpolated thing, and both builders refuse a non-identifier', () => {
+t('scoutingListableSql is COMPOSED from the rollup AND the reach halves (task 1002290)', () => {
+  // The recruiting directory asks BOTH questions; a leaderboard asks only the
+  // first. Composition is what keeps that distinction from becoming two rules.
+  assert.ok(scoutingListableSql('pa').includes(rollupVisibleSql('pa')),
+    'the directory predicate must literally contain the rollup predicate');
+  assert.ok(scoutingListableSql('pa').includes(recruiterReachSql('pa')),
+    'and the reach predicate — wiring reach in is the whole of task 1002290');
+  assert.ok(!rollupVisibleSql('pa').includes('recruiter_discoverable'),
+    'and reach must NOT leak back down into the rollup rule: the community spec D3 '
+    + 'leaderboards join rollupVisibleSql and the opt-out must not empty them');
+});
+
+t('the alias is the one interpolated thing, and every builder refuses a non-identifier', () => {
   const inject = "pa; DROP TABLE platform_identity_accounts --";
   assert.throws(() => accountVisibleSql(inject), /bare SQL identifier/);
   assert.throws(() => rollupVisibleSql(inject), /bare SQL identifier/);
+  assert.throws(() => recruiterReachSql(inject), /bare SQL identifier/);
+  assert.throws(() => scoutingListableSql(inject), /bare SQL identifier/);
 });
 
 t('the JS ports answer exactly what the SQL asks, row for row', () => {
@@ -655,6 +695,11 @@ function accountFilter(where, params) {
   if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
   if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
   if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
+  // The recruiting-reach COALESCE (task 1002290). Modelled through the shared JS
+  // twin, not re-implemented — an interpreter that read this term its own way
+  // could agree with a WRONG query. Unmodelled it would degrade to no filter,
+  // which is precisely what this interpreter exists to refuse.
+  if (/COALESCE\((?:[a-z_]+\.)?recruiter_discoverable,/.test(where)) tests.push(isRecruiterDiscoverable);
 
   const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
   if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }

package/tests/projects_hub.mjs

@@ -1676,3 +1676,59 @@ test('one column grammar: the table lays every row on one set of fixed tracks (e
   assert.match(COSMOS, /@media \(max-width:780px\)\{\.tbl \.colTags,\.tbl \.colType\{display:none;\}\.tbl\{min-width:600px;\}\}/, 'a phone scrolls the table inside its wrap');
   assert.match(COSMOS, /#sub-table-body\{overflow-x:auto;\}/, 'the wrap scrolls, never the page');
 });
+
+/* ── the create wizard in the world (task 1003346; direction record §15, the pick: v1 the
+   rail above, the bongo pair kept). Two sheets carry it: cosmos.css draws the FRAME by scope
+   (#view-new), projects.html's own wizard block draws the wizard's structures. ── */
+test('the wizard takes the world by scope: no card ground, the six-step strip as the rail, the doors as pills (task 1003346)', () => {
+  const at = COSMOS.indexOf('THE CREATE WIZARD, IN THE WORLD');
+  assert.ok(at > -1, 'the #view-new block exists in cosmos.css');
+  const block = COSMOS.slice(at);
+  assert.match(block, /#view-new \.card\{background:none;border-radius:0;box-shadow:none;/, 'no card ground');
+  assert.match(block, /#view-new \.steps\{display:grid;grid-template-columns:repeat\(6,1fr\);/, 'the strip lays its six steps on six tracks');
+  assert.match(block, /#view-new \.steps li::before\{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;/, 'the connector becomes the 7px dot');
+  assert.match(block, /#view-new \.steps li\.now::before\{background:var\(--accent\);border-color:var\(--accent\);outline:4px solid/, 'the lit step carries the accent and an outline halo');
+  assert.match(block, /#view-new \.panel h1\{font-weight:300;[^}]*text-transform:lowercase;/, 'the step title in the display voice, lowercase');
+  assert.match(block, /#view-new \.btn\{[^}]*text-transform:lowercase;[^}]*box-shadow:none;/, 'the doors are pills without a shadow');
+  assert.match(block, /#view-new \.btn\.ghost\{[^}]*border:1px solid var\(--rule\);/, 'back and skip are hairline pills');
+  assert.match(block, /#view-new #wizSignin\{background:var\(--ink\);color:var\(--bg\);/, 'the GitHub sign-in is the inverted pill');
+  assert.match(block, /#view-new \.bongos \.glow\{display:none;\}/, 'the bongo pair stays (the owner\'s one mark on every surface), its halo goes');
+  assert.match(block, /#view-new \.panel \.lede a\{display:inline-block;padding:3px 0;min-height:24px;/, 'the done clause\'s link clears the 24px floor (the sheet\'s first problem)');
+  assert.doesNotMatch(block, /box-shadow:(?!none)/, 'halos are outlines in the world, never box-shadow');
+  assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b/i, 'every colour is a token');
+});
+
+test('the wizard\'s own structures wear the world: hairline fields, cells of one band, the review as a ledger, the human steps as a numbered ledger, the standup strip as the rail (task 1003346)', () => {
+  const at = STYLE.indexOf('the create wizard (task 1002763');
+  assert.ok(at > -1, 'the wizard block is still the page\'s own');
+  const block = STYLE.slice(at);
+  assert.match(block, /#view-new input\[type=text\], #view-new textarea\{\s*width:100%;[^}]*border:0;border-bottom:1px solid var\(--rule\);border-radius:0;/, 'a field is one bottom hairline');
+  assert.match(block, /#view-new input\[type=text\]:focus, #view-new textarea:focus\{border-bottom-color:var\(--ink\);box-shadow:none;\}/, 'focus takes ink, never a glow');
+  assert.match(block, /\.typeCards\{display:grid;[^}]*border-top:1px solid var\(--rule\);border-bottom:1px solid var\(--rule\);/, 'the type and team choices are cells of one band');
+  assert.match(block, /\.tpill\[aria-pressed=true\]::before\{background:var\(--accent\);/, 'the chosen cell carries the dot');
+  assert.match(block, /\.choices\{display:grid;grid-template-columns:1fr 1fr;gap:0;border-top:1px solid var\(--rule\);/, 'start fresh / adopt are two cells of one band');
+  assert.match(block, /\.choice svg\{display:none;\}/, 'the dot is the mark, the icon leaves');
+  assert.match(block, /\.review\{list-style:none;display:grid;grid-template-columns:172px 1fr;/, 'the review is a ledger');
+  assert.match(block, /\.review li\{display:contents;\}/, 'renderReview\'s li markup stands; the grid lays its k and v');
+  assert.match(block, /\.humanSteps>li\{\s*display:grid;grid-template-columns:44px 1fr;/, 'the human steps are a numbered ledger');
+  assert.match(block, /\.humanSteps>li>\*\{grid-column:2;/, 'every child of a step sits in the text column, never under the counter (the sheet\'s bug)');
+  assert.match(block, /\.humanSteps>li\.sdone::before\{content:"done";/, 'a finished step reads DONE in the ok ink');
+  assert.match(block, /\.prog\{background:none;border:0;border-radius:0;padding:0;/, 'the standup strip is drawn as the rail');
+  assert.match(block, /\.prog \.stages li\.now \.sdot::after\{content:none;animation:none;\}/, 'no pulse on the rail');
+  assert.match(block, /\.doneHead \.tick\{display:none;\}/, 'the tick leaves; the rail says filed');
+  assert.match(block, /\.addrBig code\{display:block;font-family:var\(--font-display\);/, 'the address stands in the display voice');
+  assert.doesNotMatch(block, /linear-gradient/, 'no tinted plates');
+  assert.doesNotMatch(block, /box-shadow:(?!none)/, 'no box shadow in the wizard block');
+  assert.match(HUB, /<div class="nav">\s*<button type="button" class="btn ghost" data-back="5">← Back<\/button>\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>/, 'the review\'s doors sit on one row, back then the primary');
+  assert.match(HUB, /<h2 class="stepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style');
+  // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
+  assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');
+  assert.match(SCRIPT, /hosting_shape: 'standalone',/, 'the shape is unchanged');
+  assert.match(SCRIPT, /target_ref: state\.owner \+ '\/' \+ state\.repo,/, 'the repo ref is unchanged');
+  assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
+  // the kit walks every step and files against the stub
+  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8')).states;
+  for (const s of ['type', 'about', 'home', 'address', 'review', 'done']) assert.ok(states['in-new-' + s], `the ${s} step has a kit state`);
+  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8')).probes;
+  assert.ok(probes.some((p) => /the wizard driver \(task 1003346\)/.test(p.name) && p.steps.some((st) => st[1] === '#doCreate')), 'the wizard driver files a project end to end');
+});