@bongos/core 1.19.428 → 1.19.429

package/tests/profile_connections_ui.mjs

@@ -544,6 +544,44 @@ test('a 2nd-degree connection names the mutuals it was computed from', async ()
   assert.match(page.html(), /data-handle="bo"/, 'the write must address the canonical handle, never the login the page happened to hold');
 });
 
+// The gap ADR 0212 stated honestly and left to task 1002804: the login hop
+// resolves against the current handle or ONE previous-handle slot, so a builder
+// who renamed twice matched neither and got no section at all. Now that
+// GET /builders/:id/profile carries the canonical `handle` (ADR 0214 D3), the
+// page addresses by that and the login is only the fallback.
+test('the canonical handle from the profile response is what gets addressed, not the login', async () => {
+  reset();
+  const page = boot();
+  // A twice-renamed builder: 'bo' is current, 'bo-was' is the single previous
+  // slot, and the login the page holds ('bo-ancient') matches NEITHER.
+  await page.render({ builder: { id: 12, github_login: 'bo-ancient' }, handle: 'bo' }, 99);
+  assert.equal(page.$('#conn-scroll').hidden, false,
+    'a twice-renamed builder used to get no connections section at all — that is the hole the widened response closes');
+  assert.match(page.html(), />2nd</);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo')),
+    'the canonical handle must be what is asked for');
+  assert.ok(!asked.some((p) => p.includes('bo-ancient')),
+    'the stale login must not be sent once the response names the builder canonically');
+});
+
+test('a profile response with no handle still falls back to the login hop', async () => {
+  reset();
+  const page = boot();
+  // An instance whose server predates the widening sends no `handle` key at all.
+  await page.render(profileOf('bo-was', 12), 99);
+  assert.match(page.html(), />2nd</);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo-was')),
+    'without a handle the page must still hand over the login it holds');
+});
+
+test('an empty-string handle is not treated as an address', async () => {
+  reset();
+  const page = boot();
+  await page.render({ builder: { id: 12, github_login: 'bo-was' }, handle: '' }, 99);
+  assert.ok(asked.some((p) => p.includes('/connections/degree/bo-was')),
+    'a falsy handle must fall through to the login, never be sent as an empty path segment');
+});
+
 test('a 3rd-degree connection renders "3rd"', async () => {
   reset();
   const page = boot();

package/tests/profile_route.mjs

@@ -470,11 +470,36 @@ await t('R06.1 the record is viewer-INDEPENDENT — another account sees the sam
 await t('R06.1 the profile read takes NO auth middleware — the portfolio is shareable', () => {
   // A future PR walling this behind requireBuilder would break "another account
   // can see it" while every assertion above still passed, so pin the shape.
-  const line = sourceOf('src/bongos/routes/builders.js').split('\n')
-    .find((l) => l.includes("router.get('/builders/:id/profile'"));
-  assert.ok(line, 'the profile route registration is findable');
-  assert.match(line, /router\.get\('\/builders\/:id\/profile', async \(req, res\) => \{/,
-    'nothing may sit between the path and the handler — that is what makes the record public');
+  //
+  // Asserted against the REAL ROUTER STACK rather than the registration line
+  // (task 1002804). The old line-regex demanded the handler be the only thing on
+  // the route, which caught an inline `requireBuilder` — but missed one mounted
+  // by `router.use`, and could not tell an auth gate from a rate limiter. This
+  // form catches both mounting styles and names what it forbids: AUTH. Throttling
+  // is not authentication — /public/* is rate-limited and public — so the shared
+  // public read limiter is allowed BY IDENTITY (a private copy would be a second
+  // budget, ADR 0209), and nothing else is.
+  const auth = require('../src/bongos/auth.js');
+  const { publicReadRateLimitMiddleware } = require('../src/bongos/middleware/rate-limit.js');
+  const router = buildBuildersRouter();
+  const layer = router.stack.find(
+    (l) => l.route && l.route.path === '/builders/:id/profile' && l.route.methods.get,
+  );
+  assert.ok(layer, 'the profile route registration is findable');
+
+  const bare = router.stack.filter((l) => !l.route).map((l) => l.handle);
+  assert.deepEqual(bare, [], 'a router-level middleware would gate EVERY route here, this one included');
+
+  const handlers = layer.route.stack.map((s) => s.handle);
+  const authGates = new Set(Object.values(auth).filter((v) => typeof v === 'function'));
+  for (const h of handlers) {
+    assert.ok(!authGates.has(h),
+      'an auth gate sits on the profile read — that is what would stop another account seeing the record');
+  }
+  const ALLOWED = new Set([publicReadRateLimitMiddleware]);
+  const extra = handlers.slice(0, -1).filter((h) => !ALLOWED.has(h));
+  assert.deepEqual(extra, [],
+    'only the shared public read limiter may sit between the path and the handler — anything else must justify itself here first');
 });
 
 await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is planted', async () => {