@bongos/core 1.19.528 → 1.19.530

package/tests/provisioning_callback_page.mjs

@@ -0,0 +1,74 @@
+// tests/provisioning_callback_page.mjs — the pin for the extracted callback-page
+// module (task 1003570).
+//
+// WHY. `esc` and `callbackPage` were carried inside modules/provisioning/routes/
+// provisioning.js and were only ever exercised THROUGH the route
+// (tests/provisioning_github_app_routes.mjs mounts the router and reads the served
+// HTML). Once they became a module of their own they needed a pin of their own, or
+// the extraction would be a surface nothing tests directly: this file requires
+// callback-page.js and asserts the escaping contract and that both page variants
+// carry the ESCAPED values, so a later edit that drops an esc() call — the XSS shape
+// this helper exists to prevent — fails here rather than in a served page.
+//
+// DB-free and network-free: callback-page.js reaches core only for branding().
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_callback_page.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+
+// ESM named imports, deliberately — knip credits a named CJS export to a
+// destructured/named binding but not to a property read off a createRequire
+// namespace, and these two exports have no other reader outside the route file.
+import { esc, callbackPage } from '../modules/provisioning/routes/callback-page.js';
+
+test('esc replaces every HTML-significant character, and nothing else', () => {
+  assert.equal(esc('&<>"\''), '&amp;&lt;&gt;&quot;&#39;');
+  assert.equal(esc('<script>alert(1)</script>'), '&lt;script&gt;alert(1)&lt;/script&gt;');
+  // repeats are all replaced, not just the first
+  assert.equal(esc('<<>>'), '&lt;&lt;&gt;&gt;');
+  // ordinary text passes through untouched
+  assert.equal(esc('mercury.example.com'), 'mercury.example.com');
+});
+
+test('esc renders an absent value as the empty string, never "null"/"undefined"', () => {
+  assert.equal(esc(null), '');
+  assert.equal(esc(undefined), '');
+  assert.equal(esc(0), '0');
+  assert.equal(esc(false), 'false');
+});
+
+test('the progress variant escapes the title + domain it interpolates', () => {
+  const html = callbackPage({
+    ok: true,
+    title: 'Setting up <your> instance',
+    state: 'GOODSTATE',
+    domain: 'evil".example.com',
+  });
+  assert.match(html, /<title>Setting up &lt;your&gt; instance<\/title>/);
+  assert.match(html, /evil&quot;\.example\.com/, 'the domain rides through esc');
+  assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
+  assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
+  // it IS the progress variant: the stepper + the config block the client script reads
+  assert.match(html, /id="steps"/);
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com"\}/);
+});
+
+test('the message variant escapes the title but passes server-authored body HTML through', () => {
+  const html = callbackPage({
+    ok: false,
+    title: 'This setup link has <expired>',
+    body: '<p>Ask the owner for a fresh link.</p>',
+  });
+  assert.match(html, /<h1>This setup link has &lt;expired&gt;<\/h1>/);
+  assert.match(html, /<div class="sub"><p>Ask the owner for a fresh link\.<\/p><\/div>/,
+    'body is trusted server-authored HTML — the route composes it, a request never does');
+  assert.doesNotMatch(html, /id="steps"/, 'no stepper without ok + state + domain');
+  assert.match(html, /badge-warn">⚠️</, 'a failure wears the warning badge');
+});
+
+test('ok without state or domain falls back to the message variant', () => {
+  const html = callbackPage({ ok: true, title: 'GitHub app created', body: '<p>Done.</p>' });
+  assert.doesNotMatch(html, /__CB_SETUP__/, 'nothing to poll for, so no client config block');
+  assert.match(html, /badge-warn">✓</, 'but it is still a success');
+});

package/tests/provisioning_module_selection.mjs

@@ -30,7 +30,7 @@ import http from 'node:http';
 // ESM named imports off the CJS module on purpose — knip cannot trace a
 // createRequire() import, so these would read as dead exports (the repo's knip
 // learning; tests/provisioning_starter_bundles.mjs does the same).
-import { ALWAYS_ON_CORE, bundleForProjectType } from '../modules/provisioning/starter-bundles.js';
+import { ALWAYS_ON_CORE, bundleForProjectType, effectiveModules } from '../modules/provisioning/starter-bundles.js';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
@@ -152,9 +152,13 @@ t('publicInstance: a row written before provisioning_014 reads as the bundle, no
 
 let lastCreateArgs = null;
 let existingRow = null;
+// The row PATCH …/detail reads, and the row its UPDATE returned. Both null by
+// default, so the POST /instances tests below see the same "no such id" world.
+let detailRow = null;
+let lastUpdatedRow = null;
 provisioning.getInstanceBySlug = async () => existingRow;
 provisioning.getInstanceByDomain = async () => null;
-provisioning.getInstanceById = async () => null;
+provisioning.getInstanceById = async () => detailRow;
 provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   return existingRow
@@ -164,6 +168,18 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
+// Mirrors the real statement: `detail = detail || $n::jsonb` MERGES the
+// normalized answers onto what is already stored. The row the route then hands
+// `effectiveModules` is that merged one, so a stub that returned the pre-patch
+// row would hide exactly the staleness this test exists to catch.
+provisioning.updateInstanceDetail = async (_db, _id, patch) => {
+  lastUpdatedRow = { ...detailRow };
+  if (patch.description !== undefined) lastUpdatedRow.description = patch.description;
+  if (patch.detail !== undefined) {
+    lastUpdatedRow.detail = { ...(detailRow.detail || {}), ...provisioning.normalizeProjectDetail(patch.detail) };
+  }
+  return lastUpdatedRow;
+};
 
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
@@ -185,11 +201,11 @@ const server = app.listen(0);
 await new Promise((r) => server.once('listening', r));
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
 
-function post(path, body) {
+function send(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = JSON.stringify(body);
     const req = http.request(`${base}${path}`, {
-      method: 'POST',
+      method,
       headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
     }, (res) => {
       let d = '';
@@ -200,6 +216,8 @@ function post(path, body) {
     req.end(payload);
   });
 }
+const post = (path, body) => send('POST', path, body);
+const patch = (path, body) => send('PATCH', path, body);
 
 await ta('POST /instances: the picker\'s ids ride the create request through to storage', async () => {
   // Arrange
@@ -281,6 +299,48 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   existingRow = null;
 });
 
+// ── PATCH /instances/:id/detail, over the same mounted router ──────────────
+// The interview's answer MOVES a bundle-sourced project's modules (BV1.R22, ADR
+// 0243), so the reply that takes the answer says what the project now has rather
+// than making the caller re-read. openapi.json names `modules` in this response's
+// `required` list; nothing kept that promise until here — only the pure
+// `effectiveModules` was pinned (tests/provisioning_starter_bundles.mjs).
+
+await ta('PATCH /detail: the reply carries modules, resolved from the row the UPDATE returned', async () => {
+  // Arrange — a game project that skipped the picker, so its modules still
+  // resolve from the bundle and an interview answer can still move them.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  // Act — the owner says they are building it alone
+  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+
+  // Assert — the field is there, and it is the POST-patch resolution: a route
+  // that answered off `inst` instead of `updated` would still say 'dev-box'.
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(lastUpdatedRow, 'the route ran the update');
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'solo drops the shared dev box out of the game bundle');
+  assert.equal(res.body.modules.source, 'bundle');
+  assert.ok(res.body.modules.adjustments.some((a) => a.module === 'dev-box'), 'and the change carries its reason');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a description-only patch answers with modules too — the field is not conditional', async () => {
+  // openapi lists `modules` as REQUIRED, so every 200 off this route carries it,
+  // including the ones that moved nothing a bundle reads.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'research', modules: ['agents', 'discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { description: 'A study of small things.' });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['agents', 'discord'], 'a chosen set is not re-derived from the type');
+  assert.equal(res.body.modules.source, 'chosen');
+  detailRow = null; lastUpdatedRow = null;
+});
+
 server.close();
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/provisioning_starter_bundles.mjs

@@ -37,8 +37,11 @@ import {
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   HUB_ONLY_MODULES,
+  RULED_TEAM_SHAPES,
   bundleForProjectType,
   allStarterBundles,
+  adjustBundle,
+  starterBundleAnswerTable,
   normalizeModuleSelection,
   effectiveModules,
 } from '../modules/provisioning/starter-bundles.js';
@@ -259,8 +262,60 @@ test('GET /provisioning/starter-bundles is public and serves the resolved bundle
   // Assert
   assert.equal(res.status, 200, `readable with no session (got ${res.status} ${res.raw})`);
   assert.deepEqual(res.body.core, [...ALWAYS_ON_CORE]);
-  assert.deepEqual(res.body.bundles, allStarterBundles());
+  // `starterBundleAnswerTable` since R22 (task 1002341): every bundle, plus the
+  // same bundle re-resolved for each About-step answer. It is a superset of
+  // `allStarterBundles()` — the untailored keys are byte-for-byte what they were.
+  assert.deepEqual(res.body.bundles, starterBundleAnswerTable());
   assert.equal(res.body.bundles.length, provisioning.PROJECT_TYPES.length);
+  for (const [i, plain] of allStarterBundles().entries()) {
+    const { byTeamShape, ...rest } = res.body.bundles[i];
+    assert.deepEqual(rest, plain, `bundle ${plain.type} kept its pre-R22 shape`);
+    assert.ok(byTeamShape, `bundle ${plain.type} carries the tailored table`);
+  }
+});
+
+test('every bundle carries a resolution for every team shape a rule can fire on', async () => {
+  // The picker preselects straight out of this table with no second read (ADR
+  // 0243), so a missing row is a panel that silently preselects the untailored
+  // set for an answer the owner did give.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+
+  for (const row of res.body.bundles) {
+    assert.deepEqual(Object.keys(row.byTeamShape).sort(), [...RULED_TEAM_SHAPES].sort(),
+      `${row.type} answers every team shape`);
+    for (const [shape, tailored] of Object.entries(row.byTeamShape)) {
+      assert.ok(Array.isArray(tailored.bundle), `${row.type}/${shape} names a module list`);
+      assert.ok(Array.isArray(tailored.adjustments), `${row.type}/${shape} names its adjustments`);
+      // never the always-on core, never a key off the catalog
+      for (const key of tailored.bundle) {
+        assert.ok(OPTIONAL_MODULES.some((m) => m.key === key),
+          `${row.type}/${shape} preselects "${key}", which is not a choice the picker offers`);
+      }
+      // an adjustment is a DELTA: it only claims what it actually changed
+      for (const adj of tailored.adjustments) {
+        const inBase = row.bundle.includes(adj.module);
+        const inNow = tailored.bundle.includes(adj.module);
+        assert.notEqual(inBase, inNow, `${row.type}/${shape}: "${adj.rule}" claims a change it did not make`);
+        assert.ok(adj.reason && adj.reason.length > 20, `${row.type}/${shape}: "${adj.rule}" needs an owner-facing reason`);
+      }
+    }
+  }
+});
+
+test('an adjusted bundle is in CATALOG order, like every other module list', () => {
+  // normalizeModuleSelection stores a chosen set in catalog order and the picker
+  // re-derives its toggles that way, so an appended adjustment would make one set
+  // of modules read as two different lists depending on whether the owner
+  // answered the picker or skipped it.
+  const order = OPTIONAL_MODULES.map((m) => m.key);
+  const sorted = (list) => [...list].sort((a, b) => order.indexOf(a) - order.indexOf(b));
+
+  for (const preset of allStarterBundles()) {
+    for (const shape of RULED_TEAM_SHAPES) {
+      const { modules } = adjustBundle(preset.bundle, shape);
+      assert.deepEqual(modules, sorted(modules), `${preset.type}/${shape} is in catalog order`);
+    }
+  }
 });
 
 test('the route never reaches the database — the bundles are a declaration, not a query', async () => {
@@ -355,6 +410,40 @@ test('effectiveModules: an answered picker wins over the bundle, including "none
   assert.equal(none.source, 'chosen');
 });
 
+test('effectiveModules: a skipped picker after an ANSWERED interview yields the TAILORED bundle', () => {
+  // BV1.R22 / ADR 0243 — the property ADR 0240 §2 leans the skip on ("the
+  // preselect and the fallback are the same declaration"), now that the panel
+  // preselects the team-shape-adjusted set. Without this the picker would show a
+  // solo owner one thing and the project would quietly get another.
+  const eff = effectiveModules({ type: 'game', modules: null, detail: { team_shape: 'solo' } });
+
+  assert.deepEqual(eff.selected, ['discord'], 'the shared environment the rule removes is not silently restored');
+  assert.equal(eff.source, 'bundle', 'and it is still an UNANSWERED set, not a stored one');
+  assert.deepEqual(eff.adjustments.map((a) => a.module), ['dev-box']);
+  assert.match(eff.adjustments[0].reason, /building this alone/, 'carrying the reason the panel showed');
+});
+
+test("effectiveModules: the owner's own answer is never re-adjusted by a rule", () => {
+  // A rule corrects a PRESELECT the owner did not make. Once they have toggled,
+  // re-applying it would overrule them with an answer they had already refused.
+  const eff = effectiveModules({ type: 'game', modules: ['dev-box'], detail: { team_shape: 'solo' } });
+
+  assert.deepEqual(eff.selected, ['dev-box'], 'solo removes dev-box, and the owner put it back');
+  assert.equal(eff.source, 'chosen');
+  assert.deepEqual(eff.adjustments, [], 'and no reason is handed back for a choice they made themselves');
+});
+
+test('effectiveModules: a detail that says nothing usable adjusts nothing', () => {
+  // {} (skipped), a shape that has left the vocabulary, and a non-object column
+  // value all read as NO ANSWER — normalizeProjectDetail's rule, reached without
+  // importing it.
+  for (const detail of [undefined, null, {}, { team_shape: null }, { team_shape: 'a-huge-corporation' }, 'not-an-object', []]) {
+    const eff = effectiveModules({ type: 'game', modules: null, detail });
+    assert.deepEqual(eff.selected, ['dev-box', 'discord'], `detail=${JSON.stringify(detail)} falls back to the type's bundle`);
+    assert.deepEqual(eff.adjustments, []);
+  }
+});
+
 test('effectiveModules: an undeclared type resolves to the core, never a guess', () => {
   for (const row of [{ type: null, modules: null }, { type: 'not-sure', modules: null }, {}]) {
     const eff = effectiveModules(row);