@bongos/core 1.19.424 → 1.19.426

package/tests/scouting_page_gate.mjs

@@ -0,0 +1,185 @@
+// tests/scouting_page_gate.mjs
+//
+// The OTHER half of R14 (task 1002290, ADR 0210 D3): the `/builders/people`
+// SHELL must admit exactly the two audiences `GET /scouting` admits.
+//
+// WHY THIS IS ITS OWN FILE, AND ITS OWN GATE. `runPageGate` grew an optional
+// `alsoAdmits` door — new authorization code that runs on EVERY page-gate
+// denial, for every gate. The route proof
+// (tests/scouting_owner_access_and_reach.mjs) cannot reach it: page gates are
+// driven by a session, and that file's ESM imports pull `auth.js` in through the
+// module graph before any session double could be installed. This file installs
+// the double FIRST, exactly as tests/government_page_gates.mjs does, and so gets
+// the real gate over a real permission resolve.
+//
+// WHAT IT PINS, in order of what would hurt most if it broke:
+//   1. a project owner holding NO permission reaches the shell — without this,
+//      the widening is real in the API and invisible in the product, which is
+//      the failure D3 exists to prevent;
+//   2. everyone the ROUTE refuses, the shell refuses too, with the byte-identical
+//      redirect it always sent (naming the permission, so the hall can say why);
+//   3. every way the second door can fail — module absent, function absent, a
+//      throw, a non-boolean, and a name that resolves only through the prototype
+//      — fails CLOSED. A fail-open default in an authz path is the bug class;
+//   4. the other four gates are untouched, and their seam is never even
+//      consulted, because they declare no second door.
+//
+// DB-free: a session double and a port double. No Postgres, no HTTP.
+//
+// Run:  node tests/scouting_page_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// --- the session double, installed BEFORE auth.js loads ---------------------
+// auth.js destructures lookupSession at require time, so an override that lands
+// after it would never be seen.
+const dbKernel = require('../src/bongos/db-kernel.js');
+let nextSession = null;
+dbKernel.lookupSession = async () => nextSession;
+
+const auth = require('../src/bongos/auth.js');
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The cast. `rank` is the caller's rank ON THE HUB; `github_id` is the account
+// whose project memberships the ownership door asks about. The whole point of
+// R14 is the first row: a project's registrant is an Archon on their OWN
+// instance and, here, very often a xenos holding nothing at all.
+const OWNER = { builder_id: 1, github_id: '9001', rank: 'xenos' };
+const STRANGER = { builder_id: 2, github_id: '9002', rank: 'xenos' };
+const OPERATOR = { builder_id: 5, github_id: '9005', rank: 'metic' };
+
+// The ownership answer, as the platform-identity.hub port supplies it.
+const OWNS = new Set(['9001']);
+const workingHub = { isProjectOwner: async (githubId) => OWNS.has(String(githubId)) };
+
+// A response double that records the one thing a page gate does.
+function fakeRes() {
+  const res = {
+    _redirect: null,
+    status() { return this; },
+    json() { return this; },
+    redirect(a, b) { this._redirect = b === undefined ? { code: 302, loc: a } : { code: a, loc: b }; return this; },
+    end() { return this; },
+  };
+  // Installed so a regression that answers JSON instead of redirecting fails an
+  // assertion rather than blowing up on an undefined method.
+  attachFail({}, res, () => {});
+  return res;
+}
+
+// Run one page gate as `session`. `hub` is what the platform-identity.hub port
+// offers — an object, or null for "the module is not installed at all".
+async function runGate(gate, session, hub) {
+  nextSession = session;
+  seams._reset();
+  seams.registerProvider('government', {
+    resolveBuilderPermissions: async () => catalog.seedForRank(session ? session.rank : 'xenos'),
+  });
+  if (hub) seams.registerProvider('platform-identity.hub', hub);
+  const res = fakeRes();
+  let nexted = false;
+  await auth[gate]({ headers: { cookie: 'gds_session=t' } }, res, () => { nexted = true; });
+  return { res, nexted };
+}
+
+const DENIED_CURATE = { code: 302, loc: '/builders?denied=project.curate' };
+
+console.log('the /people shell follows its data route:');
+
+await t('a PROJECT OWNER reaches the shell, holding no permission at all', async () => {
+  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  assert.ok(nexted,
+    'the page gate must admit the audience its data route admits — otherwise the widening is real in the API and unreachable in the product');
+});
+
+await t('CONTROL: the permission door still opens the shell on its own', async () => {
+  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, workingHub);
+  assert.ok(nexted, 'ADR 0157 put project.curate at the metic floor; R14 did not move it');
+  // ...and it does not need the second door at all.
+  const { nexted: noHub } = await runGate('requireProjectCuratePage', OPERATOR, null);
+  assert.ok(noHub, 'an operator gets in on a vanilla instance with no hub module');
+});
+
+await t('a builder who is neither gets the byte-identical redirect the gate always sent', async () => {
+  const { res, nexted } = await runGate('requireProjectCuratePage', STRANGER, workingHub);
+  assert.equal(nexted, false, 'building on a project is not owning one');
+  assert.deepEqual(res._redirect, DENIED_CURATE,
+    'the denial keeps naming the permission (task 1002613), so the hall shell can still render WHY');
+});
+
+await t('an unauthenticated visitor is still bounced into sign-in, never to the second door', async () => {
+  const { res, nexted } = await runGate('requireProjectCuratePage', null, workingHub);
+  assert.equal(nexted, false);
+  assert.match(res._redirect.loc, /auth\/web\/start/, 'no session means sign-in, not a denial page');
+});
+
+await t('every way the second door can fail, it fails CLOSED', async () => {
+  // OWNER would be admitted by a working port, so each case isolates one failure
+  // of the DOOR rather than a caller who was never eligible.
+  const cases = [
+    ['the hub module is not installed (every non-hub instance)', null],
+    ['the port exists but never grew the function', { getPublicProfileExtras: () => null }],
+    ['the function throws', { isProjectOwner: () => { throw new Error('simulated outage'); } }],
+    ['the function rejects', { isProjectOwner: async () => { throw new Error('simulated async outage'); } }],
+    ['the function answers a non-boolean falsy', { isProjectOwner: async () => undefined }],
+    // An inherited member is a function whose result is truthy, so a plain
+    // `hub[name]` lookup would admit EVERYONE. Own-property only.
+    ['the function resolves only through the prototype', Object.create({ isProjectOwner: () => true })],
+  ];
+  for (const [why, hub] of cases) {
+    const { res, nexted } = await runGate('requireProjectCuratePage', OWNER, hub);
+    assert.equal(nexted, false, `${why}: must not admit`);
+    assert.deepEqual(res._redirect, DENIED_CURATE,
+      `${why}: must still redirect rather than hang, throw, or answer JSON`);
+  }
+  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  assert.ok(nexted, 'CONTROL: the same caller IS admitted when the door works — the six refusals are the door, not the caller');
+});
+
+await t('the second door is consulted only where the AUTHORITY answer was no', async () => {
+  // A permission holder must not pay for it, and — more important — the seam
+  // must never be able to NARROW a caller the permission already admitted.
+  const spy = { isProjectOwner: () => { throw new Error('the seam must not be consulted for a caller the permission already admitted'); } };
+  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, spy);
+  assert.ok(nexted, 'the atom holder is admitted before the second door is reached');
+});
+
+await t('the OTHER page gates are untouched — their seam is never consulted at all', async () => {
+  const spy = { isProjectOwner: () => { throw new Error('a gate declaring no second door must not consult the seam'); } };
+  // requireGovernmentPage floors at metic (ADR 0157) and declares no alsoAdmits,
+  // so a project owner with no rank stays out even with the hub port registered.
+  const { res, nexted } = await runGate('requireGovernmentPage', OWNER, spy);
+  assert.equal(nexted, false, 'a xenos project owner is not a government-page audience');
+  assert.deepEqual(res._redirect, { code: 302, loc: '/builders?denied=page.view.government' },
+    'and its denial is unchanged, down to the permission it names');
+  const { nexted: pub } = await runGate('requireBuilderPage', OWNER, spy);
+  assert.ok(pub, 'the public hall page still admits every signed-in builder, exactly as before');
+  const { res: nx } = await runGate('requireNonXenosPage', OWNER, spy);
+  assert.deepEqual(nx._redirect, { code: 302, loc: '/builders/not-ready?denied=page.view.builder' },
+    'and the orientation rooms still send a xenos to the friendly notice');
+});
+
+await t('only ONE gate declares a second door (a widening must be opted into, one gate at a time)', () => {
+  const src = require('node:fs').readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
+  const declarations = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(declarations, ['isProjectOwner'],
+    'a second alsoAdmits appearing without its own proof is how a page gate quietly widens');
+});
+
+seams._reset();
+nextSession = null;
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);