@bongos/core 1.19.427 → 1.19.429

package/modules/platform-identity/terms-acceptance.js

@@ -0,0 +1,97 @@
+// modules/platform-identity/terms-acceptance.js — THE platform T&C acceptance
+// record: which text is current, and the SQL that stamps a builder's acceptance
+// of it (ADR 0213, task 1002913).
+//
+// WHAT THIS ANSWERS: "did the hub itself witness this human accept the platform
+// terms, and which text did they accept?" — the artifact ADR 0141 §4 deferred
+// consent for cross-project aggregation to, and ADR 0171 D3 reserved a place for
+// ("the one path where a human is demonstrably at the hub, and where T&C
+// acceptance can later be captured, task 1002913").
+//
+// WHY ITS OWN FILE. platform-identity.js sits at the 1500-line fitness ratchet
+// with `oversized_file_count: 0` as the baseline — there is no headroom, and
+// four sessions have already set the precedent that new logic lands beside it
+// (account-visibility.js, application-echo.js, routes/connections.js,
+// src/bongos/routes/my-sessions.js). This file is that, for consent.
+//
+// THE WRITE SIDE ONLY — read the record through account-visibility.js. That file
+// is the SOLE owner of every effective-visibility answer, and acceptance is now
+// part of the consent axis it publishes (accountActiveSql / isAccountActive).
+// Nothing here compares terms_accepted_at to anything; these are the statements
+// that SET it. tests/effective_visibility_predicate.mjs enforces that split —
+// its SPELLINGS list fails any file but the owner that writes the acceptance
+// predicate, and deliberately does not match a write.
+//
+// WHY THE CALLER CANNOT FORGE ONE. These fragments have exactly one call site:
+// upsertAccount's `activate` branch, whose only caller is /sso/authorize
+// (routes/sso.js). There `activate: true` is a SOURCE LITERAL and every other
+// field comes from the hub's own resolved session — the ADR 0205 D3 property
+// established for recordFederatedSignin by task 1003340. No request-body field
+// reaches these statements, which is the whole point: an acceptance record a
+// caller could assert would be evidence of nothing.
+//
+// IDEMPOTENT BY CONSTRUCTION: the conflict branch is COALESCE(existing, new), so
+// the FIRST acceptance stands and a second sign-in never rewrites or duplicates
+// it. The two columns are only ever written together, so they cannot diverge.
+//
+// A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
+// recorded and never overwritten, publishing a new TERMS_VERSION leaves every
+// existing row naming the text it actually agreed to — so the platform can see
+// who has not accepted the new one. Re-acceptance on revision is deliberately
+// NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
+'use strict';
+
+// The version of the platform terms currently served at /terms. It is stamped
+// onto every acceptance, so it must match the version the page states — the
+// pairing is asserted by tests/terms_acceptance.mjs, which reads both.
+//
+// Date-stamped rather than numbered: the page says "Version <this>", and a
+// reader comparing page to record should not have to translate.
+const TERMS_VERSION = '2026-08-29';
+
+// A Postgres placeholder, e.g. '$5'. Interpolated into SQL, so it is validated
+// rather than trusted — the account-visibility.js alias-guard pattern.
+function assertPlaceholder(fn, value) {
+  if (!/^\$[1-9][0-9]*$/.test(String(value))) {
+    throw new Error(`${fn}: expected a Postgres placeholder like '$5', got ${JSON.stringify(value)}`);
+  }
+}
+
+// The acceptance columns, for an INSERT column list. Leading comma: it appends
+// to an existing list rather than standing alone.
+function acceptanceInsertColumns() {
+  return ', terms_accepted_at, terms_version';
+}
+
+// The matching VALUES fragment. A row created by a NON-activating caller
+// (ensureAccount's check-in / device-poll path) gets NULL — fail-closed: no hub
+// session witnessed that human, so there is no acceptance to record.
+function acceptanceInsertValues(activateParam, versionParam) {
+  assertPlaceholder('acceptanceInsertValues', activateParam);
+  assertPlaceholder('acceptanceInsertValues', versionParam);
+  return `, CASE WHEN ${activateParam}::boolean THEN now() ELSE NULL END`
+    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`;
+}
+
+// The ON CONFLICT DO UPDATE SET fragment — the idempotent half. COALESCE keeps
+// the FIRST acceptance, so signing in again re-reads the terms but does not
+// restamp them; a non-activating upsert leaves both columns exactly as they are,
+// mirroring the one-way rule profile_state already follows.
+//
+// Trailing comma: it sits between two other assignments in the SET list.
+function acceptanceConflictSet(activateParam, versionParam) {
+  assertPlaceholder('acceptanceConflictSet', activateParam);
+  assertPlaceholder('acceptanceConflictSet', versionParam);
+  const self = 'platform_identity_accounts';
+  return `terms_accepted_at = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
+    + ` terms_version = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`;
+}
+
+module.exports = {
+  TERMS_VERSION,
+  acceptanceInsertColumns,
+  acceptanceInsertValues,
+  acceptanceConflictSet,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.427",
+  "version": "1.19.429",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.427",
+      "version": "1.19.429",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.427",
+  "version": "1.19.429",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/terms.html

@@ -61,6 +61,14 @@
     <p>A project stood up from the hub runs on the platform's servers at your request. Any cost is shown before you confirm. Tearing it down stops its server; it keeps its database and backups so it can come back, and its web address stays with it while it can.</p>
     <!--apex-only:end-->
 
+    <!--apex-only:start-->
+    <h2>Your work across projects</h2>
+    <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the disciplines you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
+    <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
+    <p><b>What is public.</b> Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.</p>
+    <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>
 

package/src/bongos/routes/builders.js

@@ -32,6 +32,7 @@ const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 // 0093 §1): GET /builders/:id/onboarding resolves the `onboarding` kernel port
 // for the roster-visible checklist (read/shape) — never a direct require.
 const { pool } = require('../pool');
+const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
 const seams = require('../../module-seams');
 const { branding } = require('../../branding');
 // task 1003208: structured logging — was console.*. A core file logs through
@@ -480,7 +481,17 @@ module.exports = function buildBuildersRouter() {
   // monthly_budget_usd / system_role / box_blocked*) are NEVER spread into the
   // JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their
   // absence + the 404-on-unknown-id behaviour.
-  router.get('/builders/:id/profile', async (req, res) => {
+  // THROTTLED since task 1002804. The global limiter meters WRITES only
+  // (rateLimitMiddleware returns early for GET) and the public read limiter is
+  // mounted under /public/*, which this is not — so this route answered at line
+  // rate. That was tolerable while it re-presented leaderboard data; it is not
+  // now that it also carries `handle`, because an id walk then yields the
+  // builder → canonical-profile-handle map in one call per builder.
+  // modules/platform-identity/routes/public-profile.js caps /profiles/:handle
+  // for exactly that mapping, so the two routes that publish it get the same
+  // ceiling. The EXISTING shared /public/* budget (120/60s per IP), not a new
+  // one — ADR 0209's rule that routes answering one question spend one budget.
+  router.get('/builders/:id/profile', publicReadRateLimitMiddleware, async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     try {
@@ -493,11 +504,21 @@ module.exports = function buildBuildersRouter() {
       // shelf degrades to empty and the cross_project section is absent, not a 500.
       const reward = seams.resolveOptional('reward');
       const hub = seams.resolveOptional('platform-identity.hub');
-      const [shippedCount, recentShips, achievements, crossProject] = await Promise.all([
+      // handle: the account's PUBLIC canonical-profile address (P08, task
+      // 1002804 / ADR 0214 D3). It rides a DIFFERENT predicate from
+      // cross_project on purpose — existence, not the rollup — because
+      // hide_stats suppresses numbers and never addressability, so a builder
+      // who hides their stats still has a canonical URL and a connect button.
+      // Absent (null) for no account, provisional and private alike, which is
+      // the same indistinguishable answer cross_project already gives.
+      // Optional-chained so an older hub provider without the function degrades
+      // to null rather than throwing across a version window.
+      const [shippedCount, recentShips, achievements, crossProject, handle] = await Promise.all([
         lc().countShippedTasksForBuilder(targetId),
         lc().recentShippedTasksByBuilder(targetId, 5),
         reward ? reward.getBuilderAchievements(targetId) : [],
         hub ? hub.getPublicProfileExtras(b.github_id) : null,
+        hub && hub.getPublicHandle ? hub.getPublicHandle(b.github_id) : null,
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
@@ -531,6 +552,7 @@ module.exports = function buildBuildersRouter() {
           recent_ships: recentShips,
           achievements,
           cross_project: crossProject,
+          handle: handle || null,
         });
       }
       res.json({

package/src/bongos/serve-internal.js

@@ -41,6 +41,7 @@ const { attachFail } = require('./middleware/error-envelope');
 const metrics = require('./metrics');
 const { logger } = require('./logger');
 const gdsAuth = require('./auth');
+const { loadIdpConfig } = require('./auth-config');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
@@ -164,7 +165,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
-function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase()) {
+function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
   const tagline = (brand.copy && brand.copy.tagline) || '';
@@ -182,7 +183,13 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     // whichever instance authored the file
     .split('{{buildersOrigin}}').join(esc(hall))
     .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''))
-    .split('{{instanceBase}}').join(esc(instanceBase || ''));
+    .split('{{instanceBase}}').join(esc(instanceBase || ''))
+    // The PLATFORM HUB's apex — where a builder's canonical cross-project
+    // profile lives (P08, task 1002804 / ADR 0214 D2). Empty on a vanilla
+    // instance, and a page that reads it MUST render nothing rather than fall
+    // back: never write this token straight into an href, because an empty
+    // value would leave a same-host relative URL claiming to be the hub.
+    .split('{{hubOrigin}}').join(esc(hubOrigin || ''));
 }
 // A link whose href is a BARE origin token that resolves empty is dropped whole,
 // server-side (task 1003242; the branding contract): a pack that names no domains
@@ -231,6 +238,25 @@ function safeBuildersOrigin() {
 function safeInstanceBase() {
   try { return branding().domains.instanceBase || ''; } catch { return ''; }
 }
+// The PLATFORM HUB's apex — the origin a builder's canonical cross-project
+// profile is addressed on (P08, task 1002804; ADR 0171 D1 named this gap, ADR
+// 0214 D2 fills it). Three cases, in the order they are asked:
+//   * THIS instance IS the hub — `platform-identity` enabled is the hub flag
+//     itself (src/platform-server.js), not a proxy for it — so the hub apex is
+//     its own publicOrigin;
+//   * a FEDERATED instance — the hub it signs in through, from the same
+//     `<PREFIX>_HUB_ORIGIN` env that auth-config's loadIdpConfig resolves; there
+//     is no second source of truth for "which hub am I on";
+//   * a VANILLA instance — no hub, so '' and every consumer renders nothing.
+// Best-effort like its four siblings above: a branding or env hiccup must resolve
+// to "no hub", never break every served page.
+function safeHubOrigin() {
+  try {
+    if (isModuleEnabled('platform-identity')) return safePublicOrigin();
+    const idp = loadIdpConfig();
+    return (idp && idp.origin) || '';
+  } catch { return ''; }
+}
 // The instance's own source repo, from the pack's `repo: {owner, name}` binding —
 // another server-only field (the branding contract keeps repo off clientBranding
 // alongside domains). A page that wants to link "read the source" must take it

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.427'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.429'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');