@bongos/core 1.19.507 → 1.19.509

package/tests/hall_page_gate_map.mjs

@@ -47,6 +47,13 @@ const ORACLE = {
   '/builders/modules': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   '/builders/roadmap': 'requireBuilderPage',
+  // Gated at this tier all along, but with no row until task 1003448 walked the
+  // module's pages: copy-desk (task 1003113) and ideas (task 1002928) are open to
+  // every rank by design, and collab's reads (task 1003172) are scoped to the
+  // caller by the server — so for all three, sign-in IS the whole gate.
+  '/builders/copy-desk': 'requireBuilderPage',
+  '/builders/ideas': 'requireBuilderPage',
+  '/builders/collab': 'requireBuilderPage',
   // task 1002710: the orientation reading rooms moved DOWN to this tier from
   // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
   // them above xenos turned away the exact reader they were written for. The
@@ -92,10 +99,33 @@ const ORACLE = {
   '/builders/drachmae': null,
   '/builders/profile': null,
   '/builders/not-ready': null,
+
+  // NOT deliberate — recorded because it is true, and filed as idea 1000907
+  // (task 1003448). The detail pages are addressed by a second segment, and
+  // /builders/task/:id and /builders/idea/:id are both gated at signed-in; the
+  // id-less slugs still resolve to the same shells through BUILDERS_PAGE_RE and
+  // match no gate. No data rides the shell and every read behind it is gated
+  // server-side, so this is an inconsistency rather than an exposure — but it is
+  // a row that should turn into a real gate (or a redirect) when that is decided.
+  '/builders/task': null,
+  '/builders/idea': null,
+
+  // Gone, not public — the hall ships no my-projects page at all since task
+  // 1003308 (owner's decision: "my projects" is a user-level page the hub owns,
+  // so the hall ships no page, no link and no redirect). Nothing is served here,
+  // so there is nothing to gate. Recorded rather than left out, because "absent
+  // from the map" is indistinguishable from the oversight this file exists to
+  // catch. GONE_PAGES below keeps the row honest if the file ever returns.
+  '/builders/my-projects': null,
 };
 
 // ─── reconstruct the URL→gate map from the source ───────────────────────────
 // 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+// The eval below turns a matched regex LITERAL back into a RegExp. Its only
+// input is this repo's own serve-internal.js, read from a path fixed at the top
+// of this file — never a caller's string, never anything fetched. Keep it that
+// way: sourcing SRC from anywhere an outsider can influence makes this arbitrary
+// code execution rather than a parser.
 function readRegexes(src) {
   const out = new Map();
   const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
@@ -170,6 +200,47 @@ test('path-normalization tricks do not slip past a gate', () => {
   }
 });
 
+// ═══ exhaustiveness — the reason a page can go missing from the oracle ═══════
+// The ORACLE above is hand-written, so until now a page could ship with NO gate
+// and NO row and nothing would notice — the same blind spot that let /sessions
+// and /scouting ship ungated, and that left /my-projects out of the map entirely
+// (task 1003448). Walking the module's own pages turns "someone remembered to
+// add a row" into "the tree is walked", which is the half this test was missing.
+const HALL_PAGES_DIR = path.join(ROOT, 'modules/hall-ui/public');
+
+function hallPageUrls() {
+  return fs.readdirSync(HALL_PAGES_DIR)
+    .filter((f) => f.endsWith('.html'))
+    .map((f) => (f === 'index.html' ? '/builders/' : `/builders/${f.replace(/\.html$/, '')}`));
+}
+
+test('every hall page the module ships has a row in the oracle', () => {
+  const missing = hallPageUrls().filter((url) => !(url in ORACLE));
+  assert.deepEqual(missing, [],
+    `hall pages with no ORACLE row: ${missing.join(', ')} — give each a gate, or a deliberate null with the reason`);
+});
+
+// A page can also LEAVE the hall, and then `null` claims something weaker than
+// "the shell is public": nothing is served at that URL at all. Spelling those out
+// keeps the row honest — if the file ever comes back, the null stops describing
+// reality, and this fails instead of quietly waving an ungated shell through.
+const GONE_PAGES = {
+  // Removed by an owner decision in task 1003308 — "my projects" is a user-level
+  // page the hub already owns, so the hall ships no page, no link and no
+  // redirect. tests/hall_settings_world.mjs pins the deletion itself; this row
+  // pins what the deletion means for the gate map.
+  '/builders/my-projects': 'task 1003308 — the hub owns "my projects"',
+};
+
+test('a row that is null because the page left the hall serves no page', () => {
+  for (const [url, why] of Object.entries(GONE_PAGES)) {
+    assert.equal(ORACLE[url], null, `${url} is gone (${why}), so it can carry no gate`);
+    const file = path.join(HALL_PAGES_DIR, `${url.replace('/builders/', '')}.html`);
+    assert.ok(!fs.existsSync(file),
+      `${url} is back, so "${why}" no longer holds — give it a real gate and a real row`);
+  }
+});
+
 test('no gated page is left matching only a REMOVED gate function', () => {
   // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
   // catalog atom an Archon can attach to a custom role) but task 1002710 left it

package/tests/my_projects_surface.mjs

@@ -0,0 +1,112 @@
+// tests/my_projects_surface.mjs
+//
+// GUARD (task 1003448): pins the three answers the "/my-projects is unreachable"
+// audit finding actually has, so that none of them is a claim in a session log
+// that the next reader has to take on faith.
+//
+// The audit (2026-08-30) reported the hall's my-projects page as unreachable and
+// ungated, and flagged the second half as "NOT CONFIRMED AS A LEAK — check the
+// API gates first, then decide whether the fix is a gate, a nav entry, or both".
+// By the time the task was worked, the answer to "a gate or a nav entry" had
+// become "neither":
+//
+//   1. WHERE THE PAGE WENT. Task 1003308 deleted it on an owner decision — "my
+//      projects" is a user-level page the hub already owns, so the hall ships no
+//      page, no link and no redirect. A nav entry would reverse that decision and
+//      a page gate would guard a URL that resolves to no file. (The deletion
+//      itself is pinned by tests/hall_settings_world.mjs; the gate map's row for
+//      it by tests/hall_page_gate_map.mjs.)
+//   2. WHETHER ANYTHING LEAKED. No: every /my-projects* route is sign-in-gated
+//      and reads the caller's OWN identity off the session. This is the half the
+//      audit could not confirm, so it is asserted here rather than described.
+//   3. WHAT IS STILL MISSING. The invitations half has no caller anywhere — no
+//      surface fetches the invite list, so a builder holding an invitation still
+//      cannot act on it. That is tracked work (task 1002970, idea 1000903), and
+//      pinning it keeps a known gap from decaying back into an unknown one.
+//
+// Static reads only (no import of the app, no DB) → runs in the `unit` gate.
+//
+// Run:  node --test --test-reporter=tap tests/my_projects_surface.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ROUTES = 'modules/platform-identity/routes/my-projects.js';
+
+// ── 1. the page is gone from the hall, by decision ──────────────────────────
+// Kept to the ONE fact this file's other assertions lean on: there is no hall
+// page, so "unreachable from the hall" is a decision to honour and not a defect
+// to fix. tests/hall_settings_world.mjs owns the full deletion pin.
+test('the hall ships no my-projects page, so there is nothing to link or gate', () => {
+  const dir = path.join(ROOT, 'modules/hall-ui/public');
+  const strays = fs.readdirSync(dir).filter((f) => f.startsWith('my-projects'));
+  assert.deepEqual(strays, [],
+    'task 1003308 removed the hall page (the hub owns "my projects") — if it is back, that decision changed and this file, the nav and the page gate all need revisiting');
+});
+
+// ── 2. the "not confirmed as a leak" half, confirmed ────────────────────────
+// The audit's worry was a shell served to anyone who asked. The shell is gone,
+// but the routes behind it outlived it, so the gate is what matters now.
+const MY_PROJECTS_ROUTES = [
+  "router.get('/my-projects'",
+  "router.post('/my-projects/join'",
+  "router.get('/my-projects/invites'",
+  "router.post('/my-projects/invites/:clientId/accept'",
+  "router.post('/my-projects/invites/:clientId/decline'",
+  "router.post('/my-projects/:clientId/leave'",
+];
+
+test('every /my-projects route is sign-in gated', () => {
+  const src = read(ROUTES);
+  for (const decl of MY_PROJECTS_ROUTES) {
+    const at = src.indexOf(decl);
+    assert.notEqual(at, -1, `${decl} — route missing; this list is stale`);
+    // The gate is the argument immediately after the path, so read the rest of
+    // that line rather than the whole file: a requireBuilder somewhere else in
+    // the module must not vouch for a route that carries no gate of its own.
+    const line = src.slice(at, src.indexOf('\n', at));
+    assert.match(line, /,\s*requireBuilder\s*,/,
+      `${decl} must carry requireBuilder — an ungated route here exposes cross-project membership`);
+  }
+});
+
+test('every /my-projects handler reads the caller identity from the session', () => {
+  // The gate only proves SOMEONE is signed in. What keeps one builder out of
+  // another's projects is that the github_id comes off req.builder and is never
+  // accepted from the caller — no :githubId param, no body-supplied account.
+  const src = read(ROUTES);
+  assert.ok(src.includes('req.builder.github_id'), 'identity must come off the session');
+  assert.doesNotMatch(src, /\/my-projects[^']*:githubId/,
+    'no /my-projects route may take an account id as a path parameter');
+  assert.doesNotMatch(src, /githubId:\s*(?:req\.body|req\.query)/,
+    'no /my-projects handler may take the account id from the request body or query');
+});
+
+// ── 3. the gap that is left, named and tracked ─────────────────────────────
+test('the invitations API still has no caller — the tracked gap, pinned', () => {
+  // Deliberately asserts a MISSING feature. Task 1003308 removed the only
+  // surface that fetched invitations, so a builder who holds one has nowhere to
+  // accept or decline it. Task 1002970 (blocked on task 1002969) and idea
+  // 1000903 own the replacement; this pin exists so the gap stays visible until
+  // one of them lands, and so it is impossible to close this quietly.
+  const surfaces = [];
+  const modules = path.join(ROOT, 'modules');
+  for (const key of fs.readdirSync(modules)) {
+    const pub = path.join(modules, key, 'public');
+    if (!fs.existsSync(pub)) continue;
+    for (const f of fs.readdirSync(pub)) {
+      if (!/\.(js|html)$/.test(f)) continue;
+      if (fs.readFileSync(path.join(pub, f), 'utf8').includes('/my-projects/invites')) {
+        surfaces.push(`modules/${key}/public/${f}`);
+      }
+    }
+  }
+  assert.deepEqual(surfaces, [],
+    `an invitations surface exists now (${surfaces.join(', ')}) — good: delete this pin and close task 1002970 / idea 1000903`);
+});

package/tests/projects_hub.mjs

@@ -1813,6 +1813,68 @@ test('one row grammar: the every-project row and the Your-projects row lay the S
   assert.match(COSMOS, /#sub-table-body\{overflow-x:auto;\}/, 'the wrap scrolls, never the page');
 });
 
+// ── the publish gate on the owner's own pages (task 1002335, BV1.R16) ────────
+
+test('the manage page carries an "on the public map" card, and it ships as real markup', () => {
+  const card = (HUB.match(/<div class="card mSec" id="mPublish"[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, '#mPublish ships as markup, not built by script (C7)');
+  assert.match(card, /hidden/, 'hidden until the server sends a verdict — a platform with no map says nothing');
+  assert.match(card, /id="mPub"/, 'the volatile slot the verdict renders into');
+  // the explanation is a SIBLING of the volatile slot, the #mRepoVisWhy shape, so
+  // no re-render of the slot can drop it
+  assert.match(card, /<details class="finePrint" id="mPubWhat">/);
+  assert.match(card, /keep empty shells off the map/, 'it says why the bar exists, not just what it is');
+});
+
+test('the verdict rendered is the SERVER’s — the browser never re-derives the gate', () => {
+  const fn = (SCRIPT.match(/function renderPublish\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'renderPublish exists');
+  assert.match(fn, /inst && inst\.publish/, 'it reads the verdict off the instance');
+  assert.match(fn, /v\.missing_phrase/, 'and names what is missing in the server’s own words (ADR 0182 D4)');
+  // no second copy of the two-field rule anywhere in the page
+  assert.doesNotMatch(SCRIPT, /publishable\s*=\s*[^;]*description/,
+    'the page must never compute publishability itself — that is how two surfaces disagree');
+  // a missing verdict HIDES the card rather than guessing one
+  assert.match(fn, /if \(!v\) \{ \$\('mPublish'\)\.hidden = true; return; \}/);
+});
+
+test('the owner’s prose is set as a property, never interpolated into markup', () => {
+  const fn = (SCRIPT.match(/function renderPublish\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /\$\('mPubDesc'\)\.value = inst\.description \|\| '';/,
+    'what someone typed about their project is not HTML');
+  assert.doesNotMatch(fn, /esc\(inst\.description/, 'and it never rides the innerHTML string at all');
+});
+
+test('the publish card is rendered on entry only — the in-flight tick must not eat a half-typed sentence', () => {
+  // renderManage() is called by the fetch-free minute tick AND the 5s in-flight
+  // watch. A textarea repainted from either loses the caret and the text.
+  const renderManage = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.doesNotMatch(renderManage, /renderPublish/,
+    'renderPublish must NOT hang off the repaint path');
+  assert.match(SCRIPT, /if \(!keepRepo\) renderPublish\(inst\);/,
+    'it rides the entry + tab-return guard the other fetching sections use');
+});
+
+test('saving the description takes the server’s verdict whole, and clearing it is a real answer', () => {
+  const fn = (SCRIPT.match(/function doPubSave\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /\/detail'/, 'it PATCHes the detail route R15 built as the way back');
+  assert.match(fn, /method: 'PATCH'/);
+  assert.match(fn, /manageInst\.publish = data\.publish \|\| manageInst\.publish/,
+    'the verdict comes back from the server, not from what was typed');
+  assert.match(fn, /stays off the public map/,
+    'clearing the description un-publishes the project, and the receipt says so');
+});
+
+test('a dark-matter project says so on its list card too, and only then', () => {
+  const fn = (SCRIPT.match(/function publishRow\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'publishRow exists');
+  assert.match(fn, /if \(!v \|\| v\.publishable\) return '';/,
+    'being on the map is the expected state — announcing it on every card is noise');
+  assert.match(fn, /torn_down/, 'a torn-down project has no business being told about the public map');
+  assert.match(fn, /view=manage&id=/, 'the refusal points at the one page that fixes it');
+  assert.match(SCRIPT, /var pub = publishRow\(inst\);/, 'and the card actually renders it');
+});
+
 test('the sort left the column head for a control the keyboard and a screen reader can both read (task 1003356)', () => {
   // aria-sort is only valid on a columnheader; with no header row the order has
   // to be stated by the control itself and by a sentence in a live region

package/tests/publish_gate.mjs

@@ -0,0 +1,167 @@
+// tests/publish_gate.mjs — the PUBLISH GATE (task 1002335, BV1.R16; ADR 0182 D3/D4).
+//
+// A project is on the public map if and only if it has a name AND a description.
+// That is the whole bar — identity only, deliberately not a completeness check —
+// and until it is met the project is DARK MATTER: off the map and un-joinable.
+//
+// R04 (task 1002323) landed the DEFINITION, dormant. This file pins what R16 does
+// with it, which is three things:
+//
+//   1. the gate BLOCKS the one publish action that could bypass it — an Archon
+//      featuring a row. ADR 0182 D3: `featured` may rank or promote among projects
+//      already on the map, it may never put one there;
+//   2. every refusal NAMES what is absent (D4), in one shared phrase, because a
+//      project that cannot be published and is not told why is indistinguishable
+//      from a broken one;
+//   3. the OTHER plane — `provisioning`, where an owner stands before their project
+//      is ever catalogued — asks the same gate through the kernel seam instead of
+//      keeping a second copy of the rule. The ADR 0083 one-way rule forbids the
+//      import; a duplicated two-field predicate is exactly the drift that the
+//      single SQL definition (publishableSql) exists to prevent.
+//
+// Pure + DB-free: the pool is a recording fake, and the seam is the real port object.
+//
+// Run:  node --test tests/publish_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const pi = require('../modules/platform-identity/platform-identity.js');
+const api = require('../src/module-api.js');
+
+// The REAL port object, registered exactly as routes/projects.js registers it at
+// boot — so provisioning below is answered by platform-identity's own gate, not by
+// a stub that could agree with a rule nobody ships.
+if (!api.hasProvider('project.publishGate')) {
+  api.registerProvider('project.publishGate', pi.publishGatePort);
+}
+const provRoutes = require('../modules/provisioning/routes/provisioning.js');
+
+// A recording fake pool: returns queued responses in order, records every call.
+function mockPool(responses = []) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text: String(text), params: params || [] });
+      return responses[i++] || { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+// ── what is missing, said the same way everywhere ────────────────────────────
+
+test('missingPhrase names every absent field, so no surface invents its own wording', () => {
+  assert.equal(pi.missingPhrase(['description']), 'no description');
+  assert.equal(pi.missingPhrase(['name', 'description']), 'no name and no description');
+  // a met bar has nothing to name — the caller renders the "on the map" sentence
+  assert.equal(pi.missingPhrase([]), '');
+  assert.equal(pi.missingPhrase(undefined), '');
+});
+
+// ── the gate as a kernel seam port ───────────────────────────────────────────
+
+test('the gate is published as a PORT, so another module can ask without importing', () => {
+  const port = pi.publishGatePort;
+  assert.deepEqual([...port.fields].sort(), ['description', 'name']);
+  assert.deepEqual(port.evaluate({ name: 'Mercury', description: 'A weather sim.' }),
+    { publishable: true, missing: [] });
+  assert.deepEqual(port.evaluate({ name: 'Mercury' }), { publishable: false, missing: ['description'] });
+  assert.equal(typeof port.missingPhrase, 'function');
+  // The port answers with the SAME function the SQL predicate mirrors — a caller
+  // that reached a private copy could drift from the feed's own definition.
+  assert.deepEqual(port.evaluate({ name: 'x', description: ' ' }),
+    pi.projectPublishability({ name: 'x', description: ' ' }));
+});
+
+test('the module manifest DECLARES the port — an undeclared provider is invisible to the boot check', () => {
+  const manifest = require('../modules/platform-identity/module.json');
+  assert.ok(manifest.provides.includes('project.publishGate'));
+});
+
+// ── featuring cannot publish an unpublishable project (ADR 0182 D3) ──────────
+
+test('featuring is bounded IN THE UPDATE, not by a read-then-write', async () => {
+  const pool = mockPool([{ rows: [{ id: '7', origin: 'https://p', name: 'P', featured: true, status: 'active' }] }]);
+  const out = await pi.setProjectFeatured(7, true, { pool });
+  assert.equal(out.project.featured, true);
+  assert.equal(pool.calls.length, 1, 'the happy path is ONE statement — no separate check to race');
+  const sql = pool.calls[0].text;
+  assert.match(sql, /UPDATE platform_identity_projects SET featured = \$2/);
+  // the bound is the same predicate the public feed reads
+  assert.ok(sql.includes(pi.publishableSql()), 'the gate rides in the WHERE, from the one SQL definition');
+  assert.deepEqual(pool.calls[0].params, [7, true]);
+});
+
+test('featuring a DARK-MATTER project is refused, and the refusal names what is missing', async () => {
+  const pool = mockPool([
+    { rows: [] },                                                               // the guarded UPDATE matched nothing
+    { rows: [{ id: '7', origin: 'https://p', name: 'P', description: null }] }, // …because of the gate
+  ]);
+  const out = await pi.setProjectFeatured(7, true, { pool });
+  assert.equal(out.blocked, true);
+  assert.deepEqual(out.missing, ['description'], 'ADR 0182 D4 — never merely refuse');
+  assert.ok(!out.project, 'nothing was featured');
+});
+
+test('a missing row is NOT reported as a gate refusal — the two answers are different', async () => {
+  const pool = mockPool([{ rows: [] }, { rows: [] }]);
+  const out = await pi.setProjectFeatured(999, true, { pool });
+  assert.equal(out.notFound, true);
+  assert.ok(!out.blocked, 'a curator told to "add a description" for a row that does not exist is sent chasing nothing');
+});
+
+test('UN-featuring is never gate-bound — a husk that is already featured must stay removable', async () => {
+  const pool = mockPool([{ rows: [{ id: '7', featured: false }] }]);
+  const out = await pi.setProjectFeatured(7, false, { pool });
+  assert.equal(out.project.featured, false);
+  // the predicate short-circuits on the OFF direction, in SQL, for every row
+  assert.match(pool.calls[0].text, /\$2 = false OR /);
+  assert.deepEqual(pool.calls[0].params, [7, false]);
+});
+
+// ── the other plane asks the same gate through the seam ──────────────────────
+
+test('provisioning maps its own row onto the gate: an instance slug IS its name', () => {
+  const told = provRoutes.publishVerdict({ slug: 'mercury', description: 'A weather sim.' });
+  assert.equal(told.publishable, true);
+  assert.deepEqual(told.missing, []);
+
+  // The About step skipped: the only identity field this plane can lack.
+  const skipped = provRoutes.publishVerdict({ slug: 'mercury', description: null });
+  assert.equal(skipped.publishable, false);
+  assert.deepEqual(skipped.missing, ['description']);
+  assert.equal(skipped.missing_phrase, 'no description',
+    'the phrase travels WITH the verdict so the owner-facing card cannot word the rule differently');
+
+  // A slug is never empty, so `name` can never be the missing half here — and the
+  // gate is never told about a column this table does not have.
+  assert.ok(!skipped.missing.includes('name'));
+});
+
+test('an instance read carries the verdict, so no read can ship the row without the reason', () => {
+  const row = { id: 4, slug: 'mercury', status: 'active', description: null, detail: {} };
+  const out = provRoutes.ownerInstance(row);
+  assert.equal(out.slug, 'mercury', 'the allow-listed projection is still there');
+  assert.equal(out.publish.publishable, false);
+  assert.deepEqual(out.publish.missing, ['description']);
+});
+
+test('with NO hub on the platform there is no map — and the verdict is silence, not a guess', () => {
+  // resolveOptional's absent case. platform-identity is hub-only (`default: false`),
+  // and the public map is a hub concept: an instance without it has nothing to be
+  // on. A locally-invented rule here is exactly what the seam exists to prevent, so
+  // the surfaces hide the section instead.
+  const seams = require('../src/module-seams.js');
+  const saved = seams.resolve('project.publishGate');
+  seams._reset();
+  try {
+    assert.equal(provRoutes.publishVerdict({ slug: 'mercury', description: null }), null);
+    assert.equal(provRoutes.ownerInstance({ id: 1, slug: 'mercury' }).publish, null);
+  } finally {
+    seams.registerProvider('project.publishGate', saved);
+  }
+});