@bongos/core 1.19.430 → 1.19.432

package/tests/scouting_owner_access_and_reach.mjs

@@ -22,13 +22,31 @@
 //     including from their own copy of it.
 //
 // WHY THE FAKE POOL IS SHAPED THE WAY IT IS. Every filter below is built FROM THE
-// STATEMENT'S OWN WHERE CLAUSE — the tests/own_session_revoke.mjs and
-// tests/effective_visibility_predicate.mjs pattern. So deleting the reach term
-// from listScoutingRollup genuinely stops the clause from carrying the COALESCE,
-// the opted-out row genuinely comes back, and the assertions below genuinely go
-// red. A statement carrying a placeholder or a literal comparison the
-// interpreter cannot read is a LOUD ERROR, never a silently absent filter — a
-// guard that degrades to "no WHERE at all" passes forever and protects nothing.
+// STATEMENT'S OWN WHERE CLAUSE — the tests/recruiter_sliver_boundary.mjs pattern.
+// So deleting the reach term from listScoutingRollup genuinely stops the clause
+// from carrying the COALESCE, the opted-out row genuinely comes back, and the
+// assertions below genuinely go red. A statement carrying a placeholder, a
+// literal comparison, a NULL test or a boolean SHAPE the interpreter cannot read
+// is a LOUD ERROR, never a silently absent filter — a guard that degrades to "no
+// WHERE at all" passes forever and protects nothing.
+//
+// IT READS STRUCTURE, NOT JUST TERMS, and that is why each filter is a CONSUMING
+// parse rather than a list of `.test()` calls. Two ways a term-collecting
+// interpreter lies, both found and both closed here (task 1003354):
+//
+//   THE MISSING TERM. ADR 0213 made consent two columns and this file modelled
+//     only the first, so `terms_accepted_at IS NOT NULL` was silently ignored —
+//     the exact failure the paragraph above claims is impossible. An unmodelled
+//     term now survives in the residue and the structure check refuses it.
+//   THE REWRITTEN JOINER. An interpreter that COLLECTS the terms it recognises
+//     and ANDs them re-imposes an `AND` the SQL may no longer contain: rewrite
+//     scoutingListableSql's `AND` to `OR` and Postgres serves every active
+//     account on the platform, while a term-collecting fake answers exactly as
+//     before (idea 1000877, from the adversarial review of task 1002968).
+//
+// So each recognised term is REMOVED from the text as it is matched, and whatever
+// survives must be nothing but whitespace, parentheses and `AND`. Both mutations
+// are pinned by executable checks below, on the REAL predicates.
 //
 // Everything above the pool is real: the real route file, the real
 // requirePermission gate over the real government catalog, real HTTP. Only the
@@ -75,27 +93,43 @@ async function t(name, fn) {
 // ===========================================================================
 
 // Accounts. Only the columns the predicate reads matter; the rest is display.
+//
+// CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state = 'active' AND
+// terms_accepted_at IS NOT NULL, both stamped by the same upsertAccount branch.
+// So a consented fixture carries both, and a row carrying only the first is an
+// account activated BEFORE the platform terms existed — a real shape in the
+// database, and the one that makes the acceptance term below load-bearing here
+// rather than merely satisfied by every row.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+
 const ACCOUNTS = [
   // The control: public, unhidden, reach unset (NULL = follow visibility = in).
   { github_id: '4242', github_login: 'octo', display_name: 'Octo',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   // THE ROW THIS TASK EXISTS FOR: public, unhidden, and explicitly opted OUT.
   // Before R14 this account appeared in /scouting anyway.
   { github_id: '5000', github_login: 'optout', display_name: 'Opt Out',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
   // Explicitly opted IN while public — the same effective answer as NULL, from
   // the other side of the tri-state. Proves the column is read, not the default.
   { github_id: '8000', github_login: 'optin', display_name: 'Opt In',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
   // Private AND discoverable — the spec's D2 "private / discoverable" row. Reach
   // never buys addressability: the full rollup is never its disclosure.
   { github_id: '5151', github_login: 'scout', display_name: 'Scout',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
   // Hidden, and provisional — the two floors that already held before R14.
   { github_id: '6060', github_login: 'shy', display_name: 'Shy',
-    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
   { github_id: '7070', github_login: 'newbie', display_name: 'Newbie',
-    profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // The ADR 0213 floor, and the ONLY row that differs from `octo` in exactly one
+  // column: active and public and unhidden and reachable, but activated before
+  // the platform terms existed. Delete the acceptance term from the composition
+  // and this is the row that walks back in — which is what makes the term's
+  // presence in the SQL provable here rather than merely asserted.
+  { github_id: '3030', github_login: 'unaccepted', display_name: 'Unaccepted',
+    profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
 ];
 
 // Project memberships, as the hub holds them. `membership_kind` is what the
@@ -133,24 +167,75 @@ const CLIENTS = [
 
 const KNOWN_ACCOUNT_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'recruiter_discoverable']);
 
+// What a fully-consumed WHERE may leave behind: whitespace, the parentheses the
+// predicates compose with, and the `AND` that joins them. Anything else — an
+// `OR`, a `NOT`, a `CASE`, or a term this interpreter never learned — means the
+// fake would be applying a predicate the database was never given.
+const PURE_CONJUNCTION = /^[\s()]*(?:AND[\s()]*)*$/;
+
+/**
+ * Make a consuming term-matcher over one WHERE string. `take(re, make)` matches,
+ * models, and SPLICES the matched text out, so `residue()` is exactly the part
+ * of the clause this interpreter did not understand — and `assertPureConjunction`
+ * can then refuse a boolean shape it cannot faithfully reproduce.
+ *
+ * Written out per file rather than shared: each interpreter's TERM vocabulary is
+ * its own table's, and a shared registry would be a small SQL engine. What must
+ * not drift is the REFUSAL, so the guard below is identical everywhere and each
+ * copy pins it with its own calibration test.
+ */
+function consumingParse(where) {
+  let residue = where;
+  const tests = [];
+  return {
+    tests,
+    take(re, make) {
+      const m = re.exec(residue);
+      if (!m) return null;
+      residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+      tests.push(make(m));
+      return m;
+    },
+    assertPureConjunction() {
+      if (!PURE_CONJUNCTION.test(residue)) {
+        throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
+      }
+    },
+  };
+}
+
 /**
  * A row test for platform_identity_accounts, built from `where`. Literal
  * comparisons count as much as placeholders: the effective-visibility predicate
  * is made ENTIRELY of literals, so an interpreter that modelled only $N filters
- * would score every privacy term as absent and pass no matter what.
+ * would score every privacy term as absent and pass no matter what. And the
+ * consent half is a NULL TEST, a third syntax again — which is precisely how it
+ * went unmodelled and unnoticed until task 1003354.
  */
 function accountFilter(where, params) {
-  const tests = [];
+  const { tests, take, assertPureConjunction } = consumingParse(where);
   const consumed = new Set();
 
-  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
-  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
-  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
-  // The reach term, modelled through the SHARED JS twin rather than
-  // re-implemented — an interpreter that read the COALESCE its own way could
+  // The reach axis FIRST, because recruiterReachSql's COALESCE spells
+  // `account_visibility = 'public'` inside itself as its own fallback —
+  // consuming it first is what stops that fallback being scored as a separate
+  // existence check. Modelled through the SHARED JS twin rather than
+  // re-implemented: an interpreter that read the COALESCE its own way could
   // agree with a WRONG query and still call it a pass.
-  if (/COALESCE\((?:[a-z_]+\.)?recruiter_discoverable,/.test(where)) tests.push(isRecruiterDiscoverable);
-
+  take(/\bCOALESCE\((?:[a-z_]+\.)?recruiter_discoverable,\s*(?:[a-z_]+\.)?account_visibility = 'public'\s*\)/,
+    () => isRecruiterDiscoverable);
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  // The T&C half of the CONSENT floor (ADR 0213). Neither sweep below can see
+  // it — the placeholder sweep scans `$N`, the literal sweep matches `col = '…'`
+  // — so before this line the term was silently dropped and every fixture sailed
+  // through a predicate it did not satisfy. Now it is modelled; if it ever
+  // changes shape, the residue check refuses the statement instead.
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  // The TERM guards run before the STRUCTURE guard, so an unreadable term is
+  // reported as the unreadable term it is rather than as leftover text.
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
@@ -161,6 +246,7 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
+  assertPureConjunction();
   assert.ok(tests.length > 0, `fake pool: the accounts predicate in "${where}" carried NO readable term — the boundary would be vacuous`);
   return (r) => tests.every((fn) => fn(r));
 }
@@ -172,33 +258,29 @@ function accountFilter(where, params) {
  * how the client-status join announced itself when it was added.
  */
 function membershipFilter(where, params) {
-  const tests = [];
+  const { tests, take, assertPureConjunction } = consumingParse(where);
   const consumed = new Set();
   const clientStatus = (clientId) => (CLIENTS.find((c) => c.client_id === clientId) || {}).status;
+  const bind = (m) => { consumed.add(m[1]); return params[Number(m[1]) - 1]; };
 
-  const byId = /\bgithub_id = \$(\d+)/.exec(where);
-  if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }
-
-  const byKind = /\bmembership_kind = \$(\d+)/.exec(where);
-  if (byKind) { consumed.add(byKind[1]); const v = params[Number(byKind[1]) - 1]; tests.push((r) => r.membership_kind === v); }
-
-  if (/\bsignin_verified_at IS NOT NULL\b/.test(where)) tests.push((r) => !!r.signin_verified_at);
-
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => { const v = bind(m); return (r) => String(r.github_id) === String(v); });
+  take(/\b(?:[a-z_]+\.)?membership_kind = \$(\d+)/, (m) => { const v = bind(m); return (r) => r.membership_kind === v; });
+  take(/\b(?:[a-z_]+\.)?signin_verified_at IS NOT NULL\b/, () => (r) => !!r.signin_verified_at);
   // The JOIN's own condition. Modelled as a real lookup against CLIENTS, so a
   // membership whose project is not in the table drops out the way an INNER JOIN
   // drops it — not as a term that quietly passes.
-  const byStatus = /\bc\.status = \$(\d+)/.exec(where);
-  if (byStatus) {
-    consumed.add(byStatus[1]);
-    const v = params[Number(byStatus[1]) - 1];
-    tests.push((r) => clientStatus(r.client_id) === v);
-  }
+  take(/\bc\.status = \$(\d+)/, (m) => { const v = bind(m); return (r) => clientStatus(r.client_id) === v; });
 
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}"`);
     }
   }
+  // The ownership gate is four ANDed terms and an `OR` anywhere in it would
+  // admit on ANY one of them — an un-witnessed claim, or a membership on a
+  // suspended project. The same refusal the accounts filter makes, for the same
+  // reason: this interpreter must not invent a joiner the database never saw.
+  assertPureConjunction();
   assert.ok(tests.length > 0, `fake pool: the membership predicate in "${where}" carried NO readable term`);
   return (r) => tests.every((fn) => fn(r));
 }
@@ -263,6 +345,10 @@ require.cache[moduleApiPath] = {
     // THE REAL GATE. Not a stub: the 403 a non-owner gets below is produced by
     // production code resolving production permission atoms.
     requirePermission: auth.requirePermission,
+    // The sliver route beside the directory gates on rank (ADR 0215 D4), so the
+    // PARTIAL doorway this proof pins has to carry it — otherwise requiring the
+    // router throws and this file fails for a reason that is not its subject.
+    requireRank: auth.requireRank,
     requireBuilder: (req, res, next) => {
       if (!currentCaller) return res.fail('unauthenticated', 401);
       req.builder = { ...currentCaller };
@@ -435,7 +521,8 @@ await t('and the whole matrix lands exactly where the specs put it', async () =>
   assert.deepEqual(shown, ['octo', 'optin'],
     'in: reach-unset-and-public (octo) + explicitly-opted-in (optin). '
     + 'out: optout (opted out), scout (private, and reach never buys addressability), '
-    + `shy (hidden), newbie (provisional) — got ${JSON.stringify(shown)}`);
+    + 'shy (hidden), newbie (provisional), unaccepted (never accepted the platform '
+    + `terms — ADR 0213) — got ${JSON.stringify(shown)}`);
 });
 
 await t('opting back IN restores them — the toggle is a toggle, not a tombstone', async () => {
@@ -468,6 +555,55 @@ await t('MUTATION CHECK: drop the reach half and the opted-out builder comes str
     'WITHOUT it: optout is readmitted — so the passing assertions above are load-bearing, not decorative');
 });
 
+await t('MUTATION CHECK: drop the ACCEPTANCE half and the pre-terms account walks back in', async () => {
+  // The same standard applied to the ADR 0213 term, and the reason a fixture
+  // that never accepted the platform terms exists at all: without it every row
+  // would satisfy the acceptance clause and deleting the clause would change
+  // nothing observable — a modelled term that proves nothing. The clause is
+  // removed from the REAL predicate rather than hand-written, so this cannot
+  // drift from what account-visibility.js actually composes.
+  const withTerms = scoutingListableSql('pa');
+  assert.match(withTerms, /pa\.terms_accepted_at IS NOT NULL/,
+    'the directory predicate must still carry the acceptance term at all (ADR 0213)');
+  const withoutTerms = withTerms.replace(" AND pa.terms_accepted_at IS NOT NULL", '');
+
+  const admits = (clause) => ACCOUNTS.filter(accountFilter(clause, [])).map((a) => a.github_login).sort();
+  assert.deepEqual(admits(withTerms), ['octo', 'optin'], 'with the acceptance term: the pre-terms account is out');
+  assert.deepEqual(admits(withoutTerms), ['octo', 'optin', 'unaccepted'],
+    'WITHOUT it: an account activated before the platform terms existed is served the recruiting '
+    + 'directory on a consent premise that was never true — which is what the term prevents');
+});
+
+await t('CALIBRATION: the interpreter refuses what it cannot model, rather than ignoring it', () => {
+  // Every guard above is worth exactly as much as this test. Before task 1003354
+  // the acceptance term fell through all three sweeps in silence and this file
+  // reported 17 passed while modelling a predicate the database no longer had.
+  assert.throws(() => accountFilter("profile_state = 'active' AND tier = 'gold'", []),
+    /unrecognised literal comparison on tier/,
+    'a literal comparison on an unknown column is a term this interpreter cannot apply');
+  assert.throws(() => accountFilter("profile_state = 'active' AND github_id = $1", ['4242']),
+    /unrecognised predicate on \$1/,
+    'and an unread placeholder, which is the older half of the same rule');
+  assert.throws(() => accountFilter("profile_state = 'active' AND deleted_at IS NULL", []),
+    /unmodelled boolean structure "[^"]*deleted_at IS NULL"/,
+    'a NULL TEST is a third syntax again — invisible to both sweeps above, and the exact shape '
+    + 'that let terms_accepted_at be dropped silently');
+  assert.throws(() => accountFilter("profile_state = 'active' OR account_visibility = 'public'", []),
+    /unmodelled boolean structure/,
+    'AND rewritten to OR serves every active account on the platform; a term-collecting '
+    + 'interpreter would re-impose the AND and stay green (idea 1000877)');
+  assert.throws(() => membershipFilter("github_id = $1 OR membership_kind = $2", ['9001', 'owner']),
+    /unmodelled boolean structure/,
+    'the ownership gate gets the same refusal — an OR there admits on any one of its four terms');
+  // And the shapes it really does model still parse clean, so the guard is a
+  // filter on the unreadable and not a blanket refusal.
+  assert.doesNotThrow(() => accountFilter(scoutingListableSql('pa'), []));
+  assert.doesNotThrow(() => membershipFilter(
+    "m.github_id = $1 AND m.membership_kind = $2 AND m.signin_verified_at IS NOT NULL AND c.status = $3",
+    ['9001', 'owner', 'active'],
+  ));
+});
+
 await t('/people is the SAME endpoint, so "absent from /people" is true by construction', async () => {
   const page = fs.readFileSync(path.join(repo, 'modules/hall-ui/public/people.js'), 'utf8');
   assert.match(page, /fetch\('\/api\/gds\/scouting/,
@@ -499,7 +635,7 @@ await t('opting out of recruiting grants and denies NO permission', async () =>
 
 await t('being scoutable buys nothing either — the response is the same descriptive whitelist', async () => {
   const res = await getScouting(OWNER);
-  for (const leak of ['recruiter_discoverable', 'account_visibility', 'profile_state', 'hide_stats', 'client_id']) {
+  for (const leak of ['recruiter_discoverable', 'account_visibility', 'profile_state', 'terms_accepted_at', 'hide_stats', 'client_id']) {
     assert.ok(!res.text.includes(leak), `${leak} must never serialize into the directory body`);
   }
   const row = JSON.parse(res.text).builders[0];

package/tests/scouting_rollup_fanout.mjs

@@ -51,17 +51,28 @@ const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${
 
 try {
   // The module's actual migrations (idempotent CREATE TABLE IF NOT EXISTS).
+  // 012 and 019 are replayed because listScoutingRollup joins scoutingListableSql,
+  // which reads account_visibility + recruiter_discoverable (012) and
+  // terms_accepted_at (019). Without them a FRESH database answers 42703
+  // "column does not exist" rather than an aggregation assertion.
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
-  // profile_state='active' — since ADR 0171 the rollup only lists consented,
-  // visible builders; this test is about AGGREGATION, so fixtures opt in.
+  // Since ADR 0171 the rollup only lists consented, visible builders, and since
+  // ADR 0213 consent is TWO columns — profile_state='active' AND an acceptance
+  // of the platform terms, both stamped by the same upsertAccount branch. This
+  // test is about AGGREGATION, so every fixture opts fully in; a row carrying
+  // only profile_state would be a pre-terms account and would drop out.
   // (The predicate itself is proven by tests/profile_rollup_consent.mjs.)
   await q(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
-     VALUES ($1, 'multi', 'Multi', 'a', 'active'), ($2, 'solo', 'Solo', 'b', 'active'), ($3, 'ghost', 'Ghost', 'c', 'active')`,
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state, terms_accepted_at)
+     VALUES ($1, 'multi', 'Multi', 'a', 'active', now()),
+            ($2, 'solo',  'Solo',  'b', 'active', now()),
+            ($3, 'ghost', 'Ghost', 'c', 'active', now())`,
     [MULTI, SOLO, GHOST],
   );
   // MULTI: two projects, 2 and 3 disciplines — the exact fan-out shape the old