@bongos/core 1.19.529 → 1.19.531

package/tests/explore_visible_states.mjs

@@ -0,0 +1,285 @@
+// tests/explore_visible_states.mjs — the Explore page draws the three visible
+// states off the R06 feed (BV1.R07, task 1002326; goal 1000046, criterion
+// `proj-visibility-states`; ADR 0182 D1/D2a).
+//
+// WHY THIS FILE EXECUTES THE PAGE RATHER THAN GREPPING IT. explore.js builds every
+// card with createElement/appendChild — there is no markup in explore.html to pin.
+// A static test could only assert that the words "planet" and "black-hole" appear
+// somewhere in the source, which a page that renders nothing would also pass. So
+// this runs the REAL file in `vm` under a small DOM stub (the tests/idea_detail_page.mjs
+// precedent — there is no jsdom in this repo) and asserts over the tree a visitor
+// would actually get.
+//
+// The three things R07 owes, as assertions:
+//   1. each visible state draws ITS orb — planet / star / black hole — off the
+//      feed's own `orb` field, with the plain word (Public / Private / Stealth)
+//      as the label, because the space words are the drawn orb's, not the copy's;
+//   2. a stealth row is ANONYMOUS on the page: no name, no address, no picture,
+//      no link — and stays anonymous even if a regressed server sends identity,
+//      which is the client half of the feed's server-side allow-list (D2a);
+//   3. DARK MATTER NEVER DRAWS. It is excluded in SQL and must never reach here;
+//      if it ever does, a row this page cannot classify is dropped, not guessed at.
+//
+// Run:  node --test --test-reporter=tap tests/explore_visible_states.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+// The state→orb mapping is the feed's, not this page's (projects-feed.js is the
+// only copy of it in the repo). Importing it here means a rename on the server
+// fails this file rather than silently leaving Explore drawing the old words.
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { ORB_BY_STATE, feedShapeFor } = require('../modules/platform-identity/projects-feed.js');
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PAGE = path.join(ROOT, 'modules/status-ui/public');
+const SRC = fs.readFileSync(path.join(PAGE, 'explore.js'), 'utf8');
+const HTML = fs.readFileSync(path.join(PAGE, 'explore.html'), 'utf8');
+
+// ---- the DOM stub ---------------------------------------------------------
+// Only what explore.js touches: createElement, appendChild, textContent, className,
+// setAttribute and plain property assignment (href/src/alt/loading/target/rel).
+
+function makeElement(tag) {
+  return {
+    tagName: String(tag).toUpperCase(),
+    className: '',
+    textContent: '',
+    hidden: false,
+    children: [],
+    attrs: {},
+    appendChild(child) { this.children.push(child); return child; },
+    setAttribute(k, v) { this.attrs[k] = String(v); },
+    getAttribute(k) { return Object.prototype.hasOwnProperty.call(this.attrs, k) ? this.attrs[k] : null; },
+  };
+}
+
+// Every node in the subtree, root first.
+function nodes(el) {
+  return [el, ...el.children.flatMap(nodes)];
+}
+
+// Everything a visitor can READ on this subtree.
+function textOf(el) {
+  return nodes(el).map((n) => n.textContent || '').join(' ').replace(/\s+/g, ' ').trim();
+}
+
+// Everything a visitor's BROWSER can reach: text plus every attribute and every
+// URL-bearing property. This is what an anonymity assertion has to look at — a
+// name hidden in an href or an <img src> has still left the building.
+function reachable(el) {
+  return nodes(el)
+    .flatMap((n) => [n.textContent, n.className, n.href, n.src, n.alt, ...Object.values(n.attrs)])
+    .filter((v) => typeof v === 'string')
+    .join(' ');
+}
+
+const classed = (el, cls) => nodes(el).filter((n) => String(n.className).split(/\s+/).includes(cls));
+
+// Boot explore.js against the stub with `projects` as the feed's answer.
+function render(projects, { ok = true, body = null } = {}) {
+  const els = new Map(['grid', 'empty', 'err'].map(
+    (id) => [id, Object.assign(makeElement('div'), { id, hidden: true })]));
+
+  const documentObj = {
+    getElementById: (id) => els.get(id) || null,
+    createElement: (tag) => makeElement(tag),
+  };
+
+  const requests = [];
+  const sandbox = {
+    document: documentObj,
+    URL,
+    console,
+    setTimeout,
+    fetch(url, opts) {
+      requests.push({ url, opts });
+      return Promise.resolve({
+        ok,
+        status: ok ? 200 : 500,
+        json: () => Promise.resolve(body === null ? { projects } : body),
+      });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'explore.js' });
+
+  return {
+    requests,
+    grid: () => els.get('grid'),
+    empty: () => els.get('empty'),
+    err: () => els.get('err'),
+    cards: () => els.get('grid').children,
+  };
+}
+
+// fetch → .then(json) → .then(render) is three microtask hops; a macrotask drains them all.
+const settle = () => new Promise((r) => setTimeout(r, 0));
+
+// ---- fixtures: rows exactly as GET /projects/featured shapes them ----------
+// Built through the REAL feedShapeFor(), so the stealth row is redacted by the
+// server's own allow-list rather than by this test's idea of it.
+
+const IDENTIFIED = {
+  origin: 'https://example-project.test',
+  name: 'Example Project',
+  tagline: 'A tagline that says what it is.',
+  art_url: 'https://example-project.test/art.png',
+  type: 'game',
+  template: null,
+  created_at: '2026-01-01T00:00:00Z',
+};
+
+const publicRow = feedShapeFor({ ...IDENTIFIED, visibility: 'public' });
+const privateRow = feedShapeFor({
+  ...IDENTIFIED, origin: 'https://closed-project.test', name: 'Closed Project', visibility: 'private',
+});
+const stealthRow = feedShapeFor({
+  ...IDENTIFIED, origin: 'https://hidden-project.test', name: 'Hidden Project', visibility: 'stealth',
+});
+
+// ---- 1. each visible state draws its orb ----------------------------------
+
+test('the feed mapping this page reads is still planet / star / black-hole', () => {
+  assert.deepEqual({ ...ORB_BY_STATE }, { public: 'planet', private: 'star', stealth: 'black-hole' });
+});
+
+test('each of the three visible states draws its own orb, with the plain word beside it', async () => {
+  const r = render([publicRow, privateRow, stealthRow]);
+  await settle();
+  assert.equal(r.cards().length, 3, 'all three visible states are on the map');
+  assert.equal(r.grid().hidden, false, 'the grid is shown');
+  assert.equal(r.empty().hidden, true, 'and the empty state is not');
+
+  const expected = [['orb-planet', 'Public'], ['orb-star', 'Private'], ['orb-black-hole', 'Stealth']];
+  r.cards().forEach((card, i) => {
+    const [orbClass, label] = expected[i];
+    assert.equal(classed(card, orbClass).length, 1, `card ${i} draws exactly one ${orbClass}`);
+    assert.ok(classed(card, 'state-label').some((n) => n.textContent === label),
+      `card ${i} is labelled "${label}"`);
+  });
+});
+
+test('the drawn orb is decorative — the plain word beside it is its accessible name', async () => {
+  const r = render([publicRow]);
+  await settle();
+  const [orb] = classed(r.cards()[0], 'orb');
+  assert.equal(orb.getAttribute('aria-hidden'), 'true',
+    'a screen reader hears "Public", never a shape it cannot see');
+  assert.equal(orb.textContent, '', 'the orb carries no text of its own');
+});
+
+test('no card writes the space words as copy — the metaphor is drawn, not said', async () => {
+  const r = render([publicRow, privateRow, stealthRow]);
+  await settle();
+  for (const card of r.cards()) {
+    assert.doesNotMatch(textOf(card), /\b(planet|star|black hole|black-hole)\b/i,
+      'the goal\'s interview decision: plain labels only — Public, Private, Stealth');
+  }
+});
+
+// ---- 2. a stealth row is anonymous ----------------------------------------
+
+test('a stealth card names nothing: no name, no address, no picture, no link', async () => {
+  const r = render([stealthRow]);
+  await settle();
+  const card = r.cards()[0];
+
+  assert.equal(card.tagName, 'DIV', 'an anonymous card is not a link — there is nowhere to send anyone');
+  assert.equal(nodes(card).filter((n) => n.tagName === 'IMG').length, 0, 'and carries no picture');
+  assert.equal(nodes(card).filter((n) => n.tagName === 'A').length, 0, 'and no link inside it either');
+  assert.equal(classed(card, 'origin').length, 0, 'and shows no address');
+
+  const seen = reachable(card);
+  for (const secret of ['Hidden Project', 'hidden-project.test', 'art.png', 'A tagline']) {
+    assert.ok(!seen.includes(secret), `"${secret}" never reaches the page`);
+  }
+  assert.ok(/something is here/i.test(textOf(card)),
+    'it says what a black hole says: something is there, and that is all');
+});
+
+test('a stealth row stays anonymous even if a regressed server sends identity', async () => {
+  // The feed nulls these server-side (ADR 0182 D2a). This is the client half of
+  // the same allow-list: the anonymous branch never READS an identifying field,
+  // so a server that started sending one again could not put it on the page.
+  const leaky = { ...stealthRow, name: 'Hidden Project', origin: 'https://hidden-project.test',
+    tagline: 'A tagline that says what it is.', art_url: 'https://hidden-project.test/art.png' };
+  const r = render([leaky]);
+  await settle();
+  const seen = reachable(r.cards()[0]);
+  for (const secret of ['Hidden Project', 'hidden-project.test', 'A tagline', 'art.png']) {
+    assert.ok(!seen.includes(secret), `"${secret}" is dropped by the page too`);
+  }
+  assert.equal(classed(r.cards()[0], 'orb-black-hole').length, 1, 'it is still a black hole');
+});
+
+test('an identified card still shows its name, tagline, picture and address', async () => {
+  const r = render([publicRow]);
+  await settle();
+  const card = r.cards()[0];
+  assert.equal(card.tagName, 'A', 'a planet is somewhere you can go');
+  assert.equal(card.href, 'https://example-project.test/');
+  assert.ok(textOf(card).includes('Example Project'));
+  assert.ok(textOf(card).includes('A tagline that says what it is.'));
+  assert.equal(nodes(card).filter((n) => n.tagName === 'IMG')[0].src, 'https://example-project.test/art.png');
+  assert.ok(classed(card, 'origin')[0].textContent.includes('example-project.test'));
+});
+
+// ---- 3. dark matter never draws -------------------------------------------
+
+test('a row this page cannot classify is not drawn', async () => {
+  // Dark matter is excluded in SQL and has no orb to draw; the same drop covers a
+  // fourth state added later and not taught to this page. Fail-closed: a card is
+  // never guessed at from a row the feed did not classify.
+  const unclassifiable = [
+    { ...publicRow, state: 'dark-matter', orb: null },
+    { ...publicRow, orb: 'quasar' },
+    { ...publicRow, orb: undefined },
+  ];
+  const r = render([...unclassifiable, publicRow]);
+  await settle();
+  assert.equal(r.cards().length, 1, 'only the one row with a known orb is drawn');
+  assert.equal(classed(r.cards()[0], 'orb-planet').length, 1);
+});
+
+test('a feed of nothing drawable shows the empty state, not an empty grid', async () => {
+  const r = render([{ ...publicRow, state: 'dark-matter', orb: null }]);
+  await settle();
+  assert.equal(r.empty().hidden, false, 'the visitor is told the map is empty');
+  assert.equal(r.grid().hidden, true, 'rather than shown a grid with nothing in it');
+});
+
+test('an empty feed and a failed fetch both land on the empty state', async () => {
+  const none = render([]);
+  await settle();
+  assert.equal(none.empty().hidden, false);
+
+  const down = render([], { ok: false });
+  await settle();
+  assert.equal(down.empty().hidden, false, 'a non-hub instance 404s here — not an error to a visitor');
+});
+
+// ---- the page it draws into ------------------------------------------------
+
+test('explore.html paints all three orbs and defines the void colour', () => {
+  for (const cls of ['.orb-planet', '.orb-star', '.orb-black-hole']) {
+    assert.ok(HTML.includes(`${cls} {`) || HTML.includes(`${cls},`) || HTML.includes(`${cls}:`),
+      `${cls} has a rule — a class name with no paint draws nothing`);
+  }
+  assert.match(HTML, /--orb-void:\s*#[0-9a-fA-F]{6}/,
+    'the hole has its own colour, in both schemes — the ink token inverts and would paint it white in dark mode');
+});
+
+test('the page reads the public feed and asks for JSON', async () => {
+  const r = render([]);
+  await settle();
+  assert.equal(r.requests.length, 1);
+  assert.equal(r.requests[0].url, '/api/gds/projects/featured');
+  assert.equal(r.requests[0].opts.headers.Accept, 'application/json');
+});

package/tests/provisioning_callback_page.mjs

@@ -0,0 +1,74 @@
+// tests/provisioning_callback_page.mjs — the pin for the extracted callback-page
+// module (task 1003570).
+//
+// WHY. `esc` and `callbackPage` were carried inside modules/provisioning/routes/
+// provisioning.js and were only ever exercised THROUGH the route
+// (tests/provisioning_github_app_routes.mjs mounts the router and reads the served
+// HTML). Once they became a module of their own they needed a pin of their own, or
+// the extraction would be a surface nothing tests directly: this file requires
+// callback-page.js and asserts the escaping contract and that both page variants
+// carry the ESCAPED values, so a later edit that drops an esc() call — the XSS shape
+// this helper exists to prevent — fails here rather than in a served page.
+//
+// DB-free and network-free: callback-page.js reaches core only for branding().
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_callback_page.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+
+// ESM named imports, deliberately — knip credits a named CJS export to a
+// destructured/named binding but not to a property read off a createRequire
+// namespace, and these two exports have no other reader outside the route file.
+import { esc, callbackPage } from '../modules/provisioning/routes/callback-page.js';
+
+test('esc replaces every HTML-significant character, and nothing else', () => {
+  assert.equal(esc('&<>"\''), '&amp;&lt;&gt;&quot;&#39;');
+  assert.equal(esc('<script>alert(1)</script>'), '&lt;script&gt;alert(1)&lt;/script&gt;');
+  // repeats are all replaced, not just the first
+  assert.equal(esc('<<>>'), '&lt;&lt;&gt;&gt;');
+  // ordinary text passes through untouched
+  assert.equal(esc('mercury.example.com'), 'mercury.example.com');
+});
+
+test('esc renders an absent value as the empty string, never "null"/"undefined"', () => {
+  assert.equal(esc(null), '');
+  assert.equal(esc(undefined), '');
+  assert.equal(esc(0), '0');
+  assert.equal(esc(false), 'false');
+});
+
+test('the progress variant escapes the title + domain it interpolates', () => {
+  const html = callbackPage({
+    ok: true,
+    title: 'Setting up <your> instance',
+    state: 'GOODSTATE',
+    domain: 'evil".example.com',
+  });
+  assert.match(html, /<title>Setting up &lt;your&gt; instance<\/title>/);
+  assert.match(html, /evil&quot;\.example\.com/, 'the domain rides through esc');
+  assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
+  assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
+  // it IS the progress variant: the stepper + the config block the client script reads
+  assert.match(html, /id="steps"/);
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com"\}/);
+});
+
+test('the message variant escapes the title but passes server-authored body HTML through', () => {
+  const html = callbackPage({
+    ok: false,
+    title: 'This setup link has <expired>',
+    body: '<p>Ask the owner for a fresh link.</p>',
+  });
+  assert.match(html, /<h1>This setup link has &lt;expired&gt;<\/h1>/);
+  assert.match(html, /<div class="sub"><p>Ask the owner for a fresh link\.<\/p><\/div>/,
+    'body is trusted server-authored HTML — the route composes it, a request never does');
+  assert.doesNotMatch(html, /id="steps"/, 'no stepper without ok + state + domain');
+  assert.match(html, /badge-warn">⚠️</, 'a failure wears the warning badge');
+});
+
+test('ok without state or domain falls back to the message variant', () => {
+  const html = callbackPage({ ok: true, title: 'GitHub app created', body: '<p>Done.</p>' });
+  assert.doesNotMatch(html, /__CB_SETUP__/, 'nothing to poll for, so no client config block');
+  assert.match(html, /badge-warn">✓</, 'but it is still a success');
+});

package/tests/provisioning_module_selection.mjs

@@ -30,7 +30,7 @@ import http from 'node:http';
 // ESM named imports off the CJS module on purpose — knip cannot trace a
 // createRequire() import, so these would read as dead exports (the repo's knip
 // learning; tests/provisioning_starter_bundles.mjs does the same).
-import { ALWAYS_ON_CORE, bundleForProjectType } from '../modules/provisioning/starter-bundles.js';
+import { ALWAYS_ON_CORE, bundleForProjectType, effectiveModules } from '../modules/provisioning/starter-bundles.js';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
@@ -152,9 +152,13 @@ t('publicInstance: a row written before provisioning_014 reads as the bundle, no
 
 let lastCreateArgs = null;
 let existingRow = null;
+// The row PATCH …/detail reads, and the row its UPDATE returned. Both null by
+// default, so the POST /instances tests below see the same "no such id" world.
+let detailRow = null;
+let lastUpdatedRow = null;
 provisioning.getInstanceBySlug = async () => existingRow;
 provisioning.getInstanceByDomain = async () => null;
-provisioning.getInstanceById = async () => null;
+provisioning.getInstanceById = async () => detailRow;
 provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   return existingRow
@@ -164,6 +168,18 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
+// Mirrors the real statement: `detail = detail || $n::jsonb` MERGES the
+// normalized answers onto what is already stored. The row the route then hands
+// `effectiveModules` is that merged one, so a stub that returned the pre-patch
+// row would hide exactly the staleness this test exists to catch.
+provisioning.updateInstanceDetail = async (_db, _id, patch) => {
+  lastUpdatedRow = { ...detailRow };
+  if (patch.description !== undefined) lastUpdatedRow.description = patch.description;
+  if (patch.detail !== undefined) {
+    lastUpdatedRow.detail = { ...(detailRow.detail || {}), ...provisioning.normalizeProjectDetail(patch.detail) };
+  }
+  return lastUpdatedRow;
+};
 
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
@@ -185,11 +201,11 @@ const server = app.listen(0);
 await new Promise((r) => server.once('listening', r));
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
 
-function post(path, body) {
+function send(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = JSON.stringify(body);
     const req = http.request(`${base}${path}`, {
-      method: 'POST',
+      method,
       headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
     }, (res) => {
       let d = '';
@@ -200,6 +216,8 @@ function post(path, body) {
     req.end(payload);
   });
 }
+const post = (path, body) => send('POST', path, body);
+const patch = (path, body) => send('PATCH', path, body);
 
 await ta('POST /instances: the picker\'s ids ride the create request through to storage', async () => {
   // Arrange
@@ -281,6 +299,48 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   existingRow = null;
 });
 
+// ── PATCH /instances/:id/detail, over the same mounted router ──────────────
+// The interview's answer MOVES a bundle-sourced project's modules (BV1.R22, ADR
+// 0243), so the reply that takes the answer says what the project now has rather
+// than making the caller re-read. openapi.json names `modules` in this response's
+// `required` list; nothing kept that promise until here — only the pure
+// `effectiveModules` was pinned (tests/provisioning_starter_bundles.mjs).
+
+await ta('PATCH /detail: the reply carries modules, resolved from the row the UPDATE returned', async () => {
+  // Arrange — a game project that skipped the picker, so its modules still
+  // resolve from the bundle and an interview answer can still move them.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  // Act — the owner says they are building it alone
+  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+
+  // Assert — the field is there, and it is the POST-patch resolution: a route
+  // that answered off `inst` instead of `updated` would still say 'dev-box'.
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(lastUpdatedRow, 'the route ran the update');
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'solo drops the shared dev box out of the game bundle');
+  assert.equal(res.body.modules.source, 'bundle');
+  assert.ok(res.body.modules.adjustments.some((a) => a.module === 'dev-box'), 'and the change carries its reason');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a description-only patch answers with modules too — the field is not conditional', async () => {
+  // openapi lists `modules` as REQUIRED, so every 200 off this route carries it,
+  // including the ones that moved nothing a bundle reads.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'research', modules: ['agents', 'discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { description: 'A study of small things.' });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['agents', 'discord'], 'a chosen set is not re-derived from the type');
+  assert.equal(res.body.modules.source, 'chosen');
+  detailRow = null; lastUpdatedRow = null;
+});
+
 server.close();
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);