@bongos/core 1.19.491 → 1.19.492

package/tests/task_detail_includes.mjs

@@ -0,0 +1,108 @@
+// tests/task_detail_includes.mjs — the task read's two new opt-in siblings
+// (task 1003437, goal 1000081): ?include=session_logs and ?include=claims on
+// GET /tasks/:id, and the two reads behind them.
+//
+// WHY. The hall's task page grew a grade panel and a session log (the owner's
+// two net-new regions), and the claim block finally shows the whole ledger. The
+// grade already rode the read behind ?include=grade; the session log and the
+// claim ledger had NO read surface at all — session_logs was write-only from
+// the API's point of view, and claims exposed only the most recent holder. The
+// endpoint is a CRITICAL §4 supervisor hot path, so every sibling is opt-in:
+// a caller that does not ask pays for nothing.
+//
+// What it locks:
+//   * THE ROUTE honours both include keys, calls the two reads, and sets each
+//     sibling only when asked (an unasked key is ABSENT, not null).
+//   * THE READS are keyed by task_id, newest first, joined to builders for the
+//     name — and, like getLastClaimHolder (#678), never return a rank.
+//   * THE FACADE (modules/lifecycle/db.js) re-exports both, so the route's
+//     `db.getTaskSessionLogs` / `db.getTaskClaims` resolve.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
+const require = createRequire(import.meta.url);
+
+const routeSrc = read('modules/lifecycle/routes/tasks.js');
+const handler = routeSrc.slice(routeSrc.indexOf("router.get('/tasks/:id',"), routeSrc.indexOf("// GET /tasks/:id/dependencies"));
+
+test('GET /tasks/:id honours ?include=session_logs and ?include=claims as opt-in siblings', () => {
+  assert.ok(handler.length > 0, 'the handler is where it was');
+  assert.match(handler, /includes\.includes\('session_logs'\)/);
+  assert.match(handler, /includes\.includes\('claims'\)/);
+  assert.match(handler, /wantSessionLogs \? db\.getTaskSessionLogs\(id\) : Promise\.resolve\(null\)/, 'the read runs only when asked');
+  assert.match(handler, /wantClaims \? db\.getTaskClaims\(id\) : Promise\.resolve\(null\)/);
+  assert.match(handler, /if \(wantSessionLogs\) body\.session_logs = sessionLogs;/, 'set only when asked — absent otherwise');
+  assert.match(handler, /if \(wantClaims\) body\.claims = claims;/);
+  assert.match(handler, /auth\.requireBuilder/, 'the gate is unchanged: any signed-in builder');
+});
+
+test('the lifecycle facade re-exports both reads', () => {
+  const db = require('../modules/lifecycle/db.js');
+  assert.equal(typeof db.getTaskSessionLogs, 'function');
+  assert.equal(typeof db.getTaskClaims, 'function');
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  assert.equal(db.getTaskSessionLogs, reads.getTaskSessionLogs);
+  assert.equal(db.getTaskClaims, reads.getTaskClaims);
+});
+
+// The reads run against the module-api pool the module destructured at load; the
+// pool OBJECT is shared, so swapping its query for the test's duration is enough.
+async function withQuery(fn, body) {
+  const api = require('../src/module-api');
+  const orig = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql: String(sql).replace(/\s+/g, ' '), params }); return fn(sql, params); };
+  try { return await body(calls); } finally { api.pool.query = orig; }
+}
+
+test('getTaskSessionLogs: by task_id, newest first, the builder joined for a name, no rank', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  const rows = [{ id: '2', outcome: 'shipped' }, { id: '1', outcome: 'partial' }];
+  await withQuery(async () => ({ rows }), async (calls) => {
+    const out = await reads.getTaskSessionLogs(1003437);
+    assert.deepEqual(out, rows, 'rows pass through untouched');
+    assert.equal(calls.length, 1);
+    const { sql, params } = calls[0];
+    assert.deepEqual(params, [1003437]);
+    assert.match(sql, /FROM session_logs s/);
+    assert.match(sql, /JOIN builders b ON b\.id = s\.builder_id/);
+    assert.match(sql, /WHERE s\.task_id = \$1/);
+    assert.match(sql, /ORDER BY s\.ended_at DESC, s\.id DESC/);
+    for (const col of ['s.started_at', 's.ended_at', 's.outcome', 's.notes_md', 's.confidence', 'b.github_login', 'b.display_name']) {
+      assert.ok(sql.includes(col), `selects ${col}`);
+    }
+    assert.doesNotMatch(sql, /\brank\b/, 'rank is sensitive metadata and stays off this read (#678)');
+  });
+});
+
+test('getTaskClaims: the whole ledger by task_id, newest first, the builder joined, no rank', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  const rows = [{ claim_id: '2' }, { claim_id: '1' }];
+  await withQuery(async () => ({ rows }), async (calls) => {
+    const out = await reads.getTaskClaims(1003437);
+    assert.deepEqual(out, rows);
+    const { sql, params } = calls[0];
+    assert.deepEqual(params, [1003437]);
+    assert.match(sql, /FROM claims c/);
+    assert.match(sql, /JOIN builders b ON b\.id = c\.builder_id/);
+    assert.match(sql, /WHERE c\.task_id = \$1/);
+    assert.match(sql, /ORDER BY c\.claimed_at DESC, c\.id DESC/);
+    assert.doesNotMatch(sql, /LIMIT/, 'the ledger, not the last holder');
+    assert.doesNotMatch(sql, /\brank\b/);
+  });
+});
+
+test('an empty ledger is an empty array, never null — the page tells "none" from "not asked"', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  await withQuery(async () => ({ rows: [] }), async () => {
+    assert.deepEqual(await reads.getTaskSessionLogs(1), []);
+    assert.deepEqual(await reads.getTaskClaims(1), []);
+  });
+});