@bongos/core 1.19.428 → 1.19.429

package/modules/platform-identity/routes/sso.js

@@ -18,6 +18,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
+const canonicalProfile = require('../canonical-profile');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -120,6 +121,12 @@ function registerSeams() {
       // The ownership fact lives in this module, so the answer does too; core
       // asks through the port and treats an absent one as a denial.
       isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
+      // task 1002804 (P08, ADR 0214 D3): the account's PUBLIC handle — the
+      // canonical profile address — so the numeric profile route can name a
+      // builder by the rename-proof key instead of a mutable github_login.
+      // Floors on the EXISTENCE predicate, not the rollup one: hide_stats
+      // suppresses numbers, never addressability.
+      getPublicHandle: (githubId) => canonicalProfile.getPublicHandle(githubId, { pool }),
     });
   }
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.428",
+  "version": "1.19.429",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.428",
+      "version": "1.19.429",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.428",
+  "version": "1.19.429",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/builders.js

@@ -32,6 +32,7 @@ const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 // 0093 §1): GET /builders/:id/onboarding resolves the `onboarding` kernel port
 // for the roster-visible checklist (read/shape) — never a direct require.
 const { pool } = require('../pool');
+const { publicReadRateLimitMiddleware } = require('../middleware/rate-limit');
 const seams = require('../../module-seams');
 const { branding } = require('../../branding');
 // task 1003208: structured logging — was console.*. A core file logs through
@@ -480,7 +481,17 @@ module.exports = function buildBuildersRouter() {
   // monthly_budget_usd / system_role / box_blocked*) are NEVER spread into the
   // JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their
   // absence + the 404-on-unknown-id behaviour.
-  router.get('/builders/:id/profile', async (req, res) => {
+  // THROTTLED since task 1002804. The global limiter meters WRITES only
+  // (rateLimitMiddleware returns early for GET) and the public read limiter is
+  // mounted under /public/*, which this is not — so this route answered at line
+  // rate. That was tolerable while it re-presented leaderboard data; it is not
+  // now that it also carries `handle`, because an id walk then yields the
+  // builder → canonical-profile-handle map in one call per builder.
+  // modules/platform-identity/routes/public-profile.js caps /profiles/:handle
+  // for exactly that mapping, so the two routes that publish it get the same
+  // ceiling. The EXISTING shared /public/* budget (120/60s per IP), not a new
+  // one — ADR 0209's rule that routes answering one question spend one budget.
+  router.get('/builders/:id/profile', publicReadRateLimitMiddleware, async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     try {
@@ -493,11 +504,21 @@ module.exports = function buildBuildersRouter() {
       // shelf degrades to empty and the cross_project section is absent, not a 500.
       const reward = seams.resolveOptional('reward');
       const hub = seams.resolveOptional('platform-identity.hub');
-      const [shippedCount, recentShips, achievements, crossProject] = await Promise.all([
+      // handle: the account's PUBLIC canonical-profile address (P08, task
+      // 1002804 / ADR 0214 D3). It rides a DIFFERENT predicate from
+      // cross_project on purpose — existence, not the rollup — because
+      // hide_stats suppresses numbers and never addressability, so a builder
+      // who hides their stats still has a canonical URL and a connect button.
+      // Absent (null) for no account, provisional and private alike, which is
+      // the same indistinguishable answer cross_project already gives.
+      // Optional-chained so an older hub provider without the function degrades
+      // to null rather than throwing across a version window.
+      const [shippedCount, recentShips, achievements, crossProject, handle] = await Promise.all([
         lc().countShippedTasksForBuilder(targetId),
         lc().recentShippedTasksByBuilder(targetId, 5),
         reward ? reward.getBuilderAchievements(targetId) : [],
         hub ? hub.getPublicProfileExtras(b.github_id) : null,
+        hub && hub.getPublicHandle ? hub.getPublicHandle(b.github_id) : null,
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
@@ -531,6 +552,7 @@ module.exports = function buildBuildersRouter() {
           recent_ships: recentShips,
           achievements,
           cross_project: crossProject,
+          handle: handle || null,
         });
       }
       res.json({

package/src/bongos/serve-internal.js

@@ -41,6 +41,7 @@ const { attachFail } = require('./middleware/error-envelope');
 const metrics = require('./metrics');
 const { logger } = require('./logger');
 const gdsAuth = require('./auth');
+const { loadIdpConfig } = require('./auth-config');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
@@ -164,7 +165,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
-function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase()) {
+function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
   const tagline = (brand.copy && brand.copy.tagline) || '';
@@ -182,7 +183,13 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     // whichever instance authored the file
     .split('{{buildersOrigin}}').join(esc(hall))
     .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''))
-    .split('{{instanceBase}}').join(esc(instanceBase || ''));
+    .split('{{instanceBase}}').join(esc(instanceBase || ''))
+    // The PLATFORM HUB's apex — where a builder's canonical cross-project
+    // profile lives (P08, task 1002804 / ADR 0214 D2). Empty on a vanilla
+    // instance, and a page that reads it MUST render nothing rather than fall
+    // back: never write this token straight into an href, because an empty
+    // value would leave a same-host relative URL claiming to be the hub.
+    .split('{{hubOrigin}}').join(esc(hubOrigin || ''));
 }
 // A link whose href is a BARE origin token that resolves empty is dropped whole,
 // server-side (task 1003242; the branding contract): a pack that names no domains
@@ -231,6 +238,25 @@ function safeBuildersOrigin() {
 function safeInstanceBase() {
   try { return branding().domains.instanceBase || ''; } catch { return ''; }
 }
+// The PLATFORM HUB's apex — the origin a builder's canonical cross-project
+// profile is addressed on (P08, task 1002804; ADR 0171 D1 named this gap, ADR
+// 0214 D2 fills it). Three cases, in the order they are asked:
+//   * THIS instance IS the hub — `platform-identity` enabled is the hub flag
+//     itself (src/platform-server.js), not a proxy for it — so the hub apex is
+//     its own publicOrigin;
+//   * a FEDERATED instance — the hub it signs in through, from the same
+//     `<PREFIX>_HUB_ORIGIN` env that auth-config's loadIdpConfig resolves; there
+//     is no second source of truth for "which hub am I on";
+//   * a VANILLA instance — no hub, so '' and every consumer renders nothing.
+// Best-effort like its four siblings above: a branding or env hiccup must resolve
+// to "no hub", never break every served page.
+function safeHubOrigin() {
+  try {
+    if (isModuleEnabled('platform-identity')) return safePublicOrigin();
+    const idp = loadIdpConfig();
+    return (idp && idp.origin) || '';
+  } catch { return ''; }
+}
 // The instance's own source repo, from the pack's `repo: {owner, name}` binding —
 // another server-only field (the branding contract keeps repo off clientBranding
 // alongside domains). A page that wants to link "read the source" must take it

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.428'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.429'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');