@bongos/core 1.19.532 → 1.19.534

package/tests/provisioning_module_selection.mjs

@@ -30,7 +30,8 @@ import http from 'node:http';
 // ESM named imports off the CJS module on purpose — knip cannot trace a
 // createRequire() import, so these would read as dead exports (the repo's knip
 // learning; tests/provisioning_starter_bundles.mjs does the same).
-import { ALWAYS_ON_CORE, bundleForProjectType, effectiveModules } from '../modules/provisioning/starter-bundles.js';
+import { ALWAYS_ON_CORE, bundleForProjectType, effectiveModules, normalizeModuleSelection }
+  from '../modules/provisioning/starter-bundles.js';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
@@ -178,6 +179,10 @@ provisioning.updateInstanceDetail = async (_db, _id, patch) => {
   if (patch.detail !== undefined) {
     lastUpdatedRow.detail = { ...(detailRow.detail || {}), ...provisioning.normalizeProjectDetail(patch.detail) };
   }
+  // `modules` REPLACES and is normalized on the way in — the real statement's
+  // `modules = $n::jsonb` over normalizeModuleSelection (BV1.R23, task 1002342).
+  // A stub that merged would hide the removal half of "add modules later".
+  if (patch.modules !== undefined) lastUpdatedRow.modules = normalizeModuleSelection(patch.modules);
   return lastUpdatedRow;
 };
 
@@ -286,8 +291,9 @@ await ta('POST /instances: modules must be an array of strings', async () => {
 });
 
 await ta('POST /instances: a re-request never changes an existing project\'s modules — and SAYS so', async () => {
-  // Same honesty as type_ignored (task 1002772). There is no mutation route yet
-  // (R23, task 1002342 is "add modules later"), so the receipt does not name one.
+  // Same honesty as detail_ignored (task 1002334): since BV1.R23 (task 1002342)
+  // there IS a way back, so the receipt names it rather than leaving the owner
+  // to hunt for one.
   existingRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents'], detail: {} };
   const res = await post('/provisioning/instances', {
     slug: 'mercury', hosting_shape: 'standalone', modules: ['discord'],
@@ -295,6 +301,7 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.modules_ignored, 'the dropped answer is reported, not swallowed');
   assert.match(res.body.modules_ignored.hint, /never changes/);
+  assert.match(res.body.modules_ignored.hint, /\/detail/, 'and names the route that does change it');
   assert.deepEqual(res.body.instance.modules.selected, ['agents'], 'and the stored answer is what reads back');
   existingRow = null;
 });
@@ -341,6 +348,160 @@ await ta('PATCH /detail: a description-only patch answers with modules too — t
   detailRow = null; lastUpdatedRow = null;
 });
 
+// ── Adding (and removing) a module AFTER creation ──────────────────────────
+// BV1.R23, task 1002342, ADR 0244. The picker is optional at creation, and an
+// optional step is only a default rather than a dead end if there is a way back
+// — the same argument that made PATCH …/detail exist for the About step beside
+// it. So the way back is that route's `modules` key, not a new endpoint: the
+// same platform row, the same ownership gate, the same receipt.
+
+await ta('PATCH /detail: an owner who skipped the picker can add one module later', async () => {
+  // Arrange — a game project that skipped: the column is NULL and the read
+  // resolves the type's bundle.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+  const before = effectiveModules(detailRow);
+  assert.equal(before.source, 'bundle', 'the fixture really is an unanswered project');
+
+  // Act — the owner adds `agents` on top of what the bundle gave them
+  const res = await patch('/provisioning/instances/41/detail', {
+    modules: before.selected.concat(['agents']),
+  });
+
+  // Assert — stored, and the read-back is the answer rather than the bundle
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(lastUpdatedRow, 'the route ran the update');
+  assert.deepEqual(lastUpdatedRow.modules, normalizeModuleSelection(before.selected.concat(['agents'])),
+    'in catalog order, exactly as the creation write stores it');
+  assert.ok(res.body.modules.selected.includes('agents'), 'the added module is there');
+  assert.equal(res.body.modules.source, 'chosen', 'an answered project is no longer reading the bundle');
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow), 'the reply is the POST-patch resolution');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a module can be REMOVED later too — the list replaces, it never merges', async () => {
+  // The half a merging write would make impossible, which is why
+  // updateInstanceDetail replaces `modules` and merges `detail`.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['dev-box', 'discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: ['discord'] });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(lastUpdatedRow.modules, ['discord']);
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'dev-box is gone, not still merged in');
+  assert.equal(res.body.modules.source, 'chosen');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: switching them all off later is an answer, and it stays off', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: [] });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(lastUpdatedRow.modules, [], 'an empty answer is stored as one, never as NULL');
+  assert.deepEqual(res.body.modules.selected, []);
+  assert.equal(res.body.modules.source, 'chosen', 'a project that switched the bundle off does not get it back');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: the always-on core cannot be removed — it was never on the list', async () => {
+  // Two guards, both pinned: the route REFUSES a core key by name, and the read
+  // re-adds the whole core regardless of what was stored.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const refused = await patch('/provisioning/instances/41/detail', { modules: ['memory'] });
+  assert.equal(refused.status, 400, refused.raw);
+  assert.equal(refused.body.error.code, 'bad_modules');
+  assert.match(refused.body.error.message, /always on/i);
+  assert.equal(lastUpdatedRow, null, 'a refused write touches nothing');
+
+  const emptied = await patch('/provisioning/instances/41/detail', { modules: [] });
+  assert.deepEqual(emptied.body.modules.core, [...ALWAYS_ON_CORE], 'the core rides every read');
+  assert.deepEqual(emptied.body.modules.modules, [...ALWAYS_ON_CORE], 'and every project still has it');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: an unknown module is refused and NAMED, exactly as at creation', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: ['discrod'] });
+
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_modules');
+  assert.match(res.body.error.message, /discrod/, 'the message names what was wrong');
+  assert.match(res.body.error.message, /agents/, 'and what the choices are');
+  assert.equal(lastUpdatedRow, null);
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: modules must be an array of strings here too', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  const notArray = await patch('/provisioning/instances/41/detail', { modules: 'discord' });
+  assert.equal(notArray.status, 400, notArray.raw);
+  assert.equal(notArray.body.error.code, 'validation_failed');
+
+  const notStrings = await patch('/provisioning/instances/41/detail', { modules: [7] });
+  assert.equal(notStrings.status, 400, notStrings.raw);
+  assert.equal(notStrings.body.error.code, 'validation_failed');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a modules-only body is a real change, not an empty one', async () => {
+  // The "nothing to change" guard predates this key; a body carrying only
+  // modules must not be turned away by it.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: ['agents'] });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(lastUpdatedRow, 'the update ran off modules alone');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: null modules cannot UN-ASK the question — the skip state is not writable', async () => {
+  // ADR 0240 §2's three-valued contract: NULL means "nobody answered". A later
+  // edit that could write NULL back would make a project that HAD answered
+  // indistinguishable from one that never was, permanently.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: null, description: 'Still here.' });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(lastUpdatedRow.modules, ['discord'], 'the stored answer is untouched');
+  assert.equal(res.body.modules.source, 'chosen');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a body with only a null modules key is still nothing to change', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  const res = await patch('/provisioning/instances/41/detail', { modules: null });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_detail');
+  assert.match(res.body.error.message, /modules/, 'and the message names the third thing it accepts');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: another builder’s project is a 404, not a module change', async () => {
+  // The ownership wall is instanceAccessDenied's, shared with every sibling
+  // route — pinned here because this key is new on it.
+  detailRow = { id: 41, owner_builder_id: 99, slug: 'not-mine', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { modules: ['agents'] });
+
+  assert.equal(res.status, 404, res.raw);
+  assert.equal(res.body.error.code, 'instance_not_found');
+  assert.equal(lastUpdatedRow, null, 'nothing was written');
+  detailRow = null; lastUpdatedRow = null;
+});
+
 server.close();
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/provisioning_settings.mjs

@@ -164,7 +164,7 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
@@ -172,6 +172,9 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
     // the join door (task 1002324, ADR 0182 D1) — the third policy axis, offered
     // to the form the same way as its two neighbours
     visibility: ['public', 'private', 'stealth'],
+    // what a PUBLIC join grants (task 1002331, ADR 0247) — the fourth policy
+    // axis, offered to the form the same way
+    join_grant: ['view', 'apply', 'full'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -184,14 +187,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -219,7 +222,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -232,7 +235,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -271,7 +274,7 @@ await ta('the owner sets the door to stealth — stored, echoed effective, audit
   reset();
   const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
   assert.equal(events[0].actor, 'api:self');
   assert.match(events[0].detail, /visibility=stealth/);
@@ -331,7 +334,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -212,7 +212,7 @@ await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -261,7 +261,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -274,7 +274,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');

package/tests/provisioning_settings_env.mjs

@@ -57,7 +57,10 @@ t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothi
   assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
   // the join door rides the same transport (task 1002324, ADR 0182 D1)
   assert.equal(v.CLOUDBONGOS_VISIBILITY, 'public');
-  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 3, 'every policy key always present');
+  // what a public join grants rides it too (task 1002331, ADR 0182 D6)
+  assert.equal(v.CLOUDBONGOS_JOIN_GRANT, 'full');
+  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length,
+    Object.keys(provisioning.SETTINGS_VOCAB).length, 'every policy key always present');
 });
 
 t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
@@ -96,11 +99,11 @@ t('it names the live push by the intent the runner actually dispatches (task 100
 });
 
 t('settingsEnvVars is the single source both legs derive from — same keys, same values as the lines', () => {
-  const row = { settings: { platform_visibility: 'gated', joinability: 'open', visibility: 'stealth' } };
+  const row = { settings: { platform_visibility: 'gated', joinability: 'open', visibility: 'stealth', join_grant: 'view' } };
   const vars = provisioning.settingsEnvVars(row, 'CLOUDBONGOS');
-  assert.deepEqual(vars, { CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth' });
+  assert.deepEqual(vars, { CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth', CLOUDBONGOS_JOIN_GRANT: 'view' });
   assert.deepEqual(varsOf(provisioning.settingsEnvLines(row, 'CLOUDBONGOS')), vars, 'the standup lines ARE the vars');
-  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), { X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public' }, 'defaults, explicitly');
+  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), { X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full' }, 'defaults, explicitly');
 });
 
 console.log('\nwebEnvBody — the settings ride the real per-instance env file:');