@bongos/core 1.19.561 → 1.19.563

package/tests/goal_create_version_gate.mjs

@@ -0,0 +1,136 @@
+// tests/goal_create_version_gate.mjs — a version's goal set closes when the
+// version starts building (BV1.R03, task 1003591, goal 1000086, ADR 0250 D1).
+//
+// THE HOLE. `POST /goals` fetched the version row and discarded it after the null
+// check. `version.status` was never read, so a goal could be added to a version
+// that had been building for months — which is how a version's scope grows
+// without anyone deciding to widen it, and why 64 goals accumulated on
+// BONGOS-V1. New goals belong on the `planning` version: that is what a planning
+// version is FOR, scoping the next one in advance.
+//
+// The gate is pure and DB-free (the `authorizeGoalTaskCreate` precedent), so its
+// whole truth table is exercised here without a database, and the route's only
+// job is to render the decision.
+//
+// Run:  node --test tests/goal_create_version_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { authorizeGoalCreate } = require('../modules/lifecycle/routes/goal-route-authz.js');
+const { versionAcceptsNewWork } = require('../modules/lifecycle/db-tasks.js');
+
+const V = (status) => ({ id: 'BONGOS-V1', status });
+const decide = (version, override) => authorizeGoalCreate({ version, override });
+
+// ---- the truth table --------------------------------------------------------
+
+test('planning accepts — that is what a planning version is for', () => {
+  assert.deepEqual(decide(V('planning')), { ok: true });
+});
+
+test('building refuses with a named 409 an agent can act on', () => {
+  const d = decide(V('building'));
+  assert.equal(d.ok, false);
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'version_not_planning');
+  assert.equal(d.body.status, 'building', 'the caller learns WHICH state refused');
+  assert.match(d.body.message, /planning version/,
+    'and where the goal should go instead — a refusal with no next move gets routed around');
+});
+
+test('shipped refuses as closed history, not as "not planning"', () => {
+  // Two different facts deserve two different codes: a building version might
+  // still admit this goal via an Archon override; a shipped one never will.
+  const d = decide(V('shipped'));
+  assert.equal(d.body.error, 'version_closed');
+  assert.match(d.body.message, /has shipped/);
+});
+
+test('a missing version is a 404, before any status reasoning', () => {
+  const d = decide(null);
+  assert.equal(d.status, 404);
+  assert.equal(d.body.error, 'version_not_found');
+});
+
+test('FAIL-CLOSED: a status nobody taught this gate about refuses', () => {
+  // A version status added later must not default to "sure, file it here".
+  for (const status of ['paused', 'draft', '', undefined, null, 42]) {
+    const d = decide(V(status));
+    assert.equal(d.ok, false, `'${String(status)}' must not be accepted`);
+    assert.equal(d.body.error, 'version_closed');
+  }
+});
+
+test('an unrecognised status is NOT described as shipped', () => {
+  // The fail-closed arm catches more than `shipped`, and telling someone their
+  // version "has shipped" when it says 'paused' is a confident lie about state
+  // they can see for themselves.
+  const d = decide(V('paused'));
+  assert.match(d.body.message, /is 'paused'/);
+  assert.equal(/has shipped/.test(d.body.message), false);
+});
+
+// ---- the override seam (R07 is not built yet) -------------------------------
+
+test('override admits a building version — the R07 seam, already shaped', () => {
+  assert.deepEqual(decide(V('building'), true), { ok: true });
+});
+
+test('override does NOT reopen a shipped version', () => {
+  // The escape hatch is for a scope decision, not for rewriting closed history.
+  assert.equal(decide(V('shipped'), true).body.error, 'version_closed');
+  assert.equal(decide(V('paused'), true).body.error, 'version_closed');
+});
+
+test('only a literal true overrides — a truthy value does not', () => {
+  for (const v of ['yes', 1, {}, [] ]) {
+    assert.equal(decide(V('building'), v).ok, false,
+      'a JSON body coercing to truthy must not open the gate');
+  }
+});
+
+// ---- one definition of "open to work" ---------------------------------------
+
+test('the gate reuses versionAcceptsNewWork rather than respelling the statuses', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goal-route-authz.js', import.meta.url), 'utf8');
+  const body = src.slice(src.indexOf('function authorizeGoalCreate'), src.indexOf('function authorizeGoalTaskCreate'));
+  assert.match(body, /versionAcceptsNewWork\(version\.status\)/);
+  assert.equal(/'shipped'\s*,\s*'planning'|new Set\(\[/.test(body), false,
+    'no second copy of the status list lives in this gate');
+});
+
+test('the gate is STRICTER than versionAcceptsNewWork, deliberately', () => {
+  // Work may still LAND on a building version; its SCOPE may not grow. Those are
+  // two different questions and this pins that they give different answers.
+  assert.equal(versionAcceptsNewWork('building'), true, 'tasks may still be filed');
+  assert.equal(decide(V('building')).ok, false, 'but a new goal may not');
+  assert.equal(versionAcceptsNewWork('planning'), true);
+  assert.equal(decide(V('planning')).ok, true);
+});
+
+// ---- the route renders the decision and nothing else ------------------------
+
+test('POST /goals consults the gate and returns its exact status + body', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  const start = src.indexOf("router.post('/goals'");
+  assert.notEqual(start, -1);
+  const body = src.slice(start, src.indexOf('router.', start + 20));
+  assert.match(body, /const versionDecision = authorizeGoalCreate\(\{ version \}\);/);
+  assert.match(body, /return res\.status\(versionDecision\.status\)\.json\(versionDecision\.body\);/,
+    'the route renders the decision, it does not re-derive one');
+  assert.equal(/version\.status\s*[=!]==/.test(body), false,
+    'and it must not compare the status itself — that is the gate\'s job');
+});
+
+test('the 404 moved INTO the gate, so the route has no second version check', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  const start = src.indexOf("router.post('/goals'");
+  const body = src.slice(start, src.indexOf('router.', start + 20));
+  assert.equal(/if \(!version\)/.test(body), false,
+    'one ordered decision, not a null check here and a status check there');
+});

package/tests/one_planning_version.mjs

@@ -0,0 +1,161 @@
+// tests/one_planning_version.mjs — exactly one version plans at a time
+// (BV1.R04, task 1003592, goal 1000086, ADR 0250 D5).
+//
+// WHY THIS EXISTS AT ALL. On its own the rule looks like housekeeping. It is the
+// second half of R03: once a building version's goal set is closed, the first
+// thing a refused caller reaches for is a NEW version to put the goal on — and
+// the scope gate becomes decorative. One planning version means one queue for
+// future work and no parallel escape hatch.
+//
+// Scope, stated so the next reader does not think it was forgotten: this guards
+// the PLANNING slot only. Creating a `shipped` or `frozen` version is archival
+// bookkeeping. Refusing a second BUILDING version is D5's other half and belongs
+// to task 1003606 (R19).
+//
+// The rule is a pure predicate (`authorizeVersionCreate`, the `authorizeGoalCreate`
+// precedent), so it is EXERCISED here rather than string-matched — including the
+// shapes a live-Postgres test would never set up. The route's own write path stays
+// covered by versions_route.mjs against real Postgres; what is checked of the route
+// here is only the wiring, which is all the route now contains.
+//
+// Run:  node --test tests/one_planning_version.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { versionsWithStatus } = require('../modules/lifecycle/db.js');
+const { authorizeVersionCreate } = require('../modules/lifecycle/routes/version-route-authz.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const V2 = { id: 'BONGOS-V2', name: 'Next' };
+const V3 = { id: 'BONGOS-V3', name: 'After' };
+
+function fakePool(rows) {
+  const c = makeSqlAwareClient(() => ({ rows }));
+  return { query: (sql, p) => c._client.query(sql, p), connect: c.connect, queries: c._client.queries };
+}
+
+// ---- the decision, exercised ------------------------------------------------
+
+test('the planning slot is free → allowed', () => {
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: [] }), { ok: true });
+});
+
+test('the planning slot is taken → named 409 that says which version has it', () => {
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2] });
+  assert.equal(d.ok, false);
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'planning_version_exists');
+  assert.match(d.body.message, /BONGOS-V2/,
+    'a caller who has to go look up which version is one step from cutting one');
+  assert.deepEqual(d.body.planning, [V2], 'and the rows travel with the refusal');
+});
+
+test('creating a shipped, frozen or building version is untouched', () => {
+  // Archival bookkeeping must not be caught by a rule about the future queue,
+  // even while a planning version exists.
+  for (const status of ['shipped', 'frozen', 'building']) {
+    assert.deepEqual(authorizeVersionCreate({ status, planning: [V2] }), { ok: true },
+      `'${status}' is not the planning slot`);
+  }
+});
+
+test('more than one planning version already present → still refuses, names the first', () => {
+  // The state this rule exists to prevent may already exist (the cutover is R28).
+  // The gate must not throw or wave it through on the way to fixing it.
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2, V3] });
+  assert.equal(d.body.error, 'planning_version_exists');
+  assert.equal(d.body.planning.length, 2, 'the caller sees the full mess, not a sample');
+});
+
+test('a missing or malformed planning list does not crash the gate', () => {
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning' }), { ok: true },
+    'omitted defaults to empty — the route only reads when status is planning');
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: null }), { ok: true });
+  assert.deepEqual(authorizeVersionCreate({ status: 'planning', planning: [null, undefined] }), { ok: true },
+    'empty-after-filtering is empty; a falsy row must not become a phantom refusal');
+});
+
+test('the refusal is data, not a rendered string the route has to parse', () => {
+  const d = authorizeVersionCreate({ status: 'planning', planning: [V2] });
+  assert.deepEqual(Object.keys(d).sort(), ['body', 'ok', 'status']);
+  assert.ok(typeof d.body.error === 'string' && typeof d.status === 'number');
+});
+
+// ---- the read ---------------------------------------------------------------
+
+test('versionsWithStatus binds the status and returns id + name only', async () => {
+  const pool = fakePool([V2]);
+  const out = await versionsWithStatus('planning', { pool });
+  assert.deepEqual(out, [V2]);
+  assert.match(String(pool.queries[0].sql), /SELECT id, name FROM versions WHERE status = \$1/);
+  assert.deepEqual(pool.queries[0].params, ['planning'], 'the status is bound, not interpolated');
+});
+
+test('no planning version reads as an empty list, not a null', async () => {
+  assert.deepEqual(await versionsWithStatus('planning', { pool: fakePool([]) }), [],
+    'and the gate treats empty as allowed, closing the loop between read and decision');
+});
+
+// ---- the wiring, which is all the route now carries -------------------------
+
+const ROUTE = (() => {
+  const s = src('modules/lifecycle/routes/versions.js');
+  const a = s.indexOf("router.post('/versions'");
+  assert.notEqual(a, -1, 'POST /versions not found');
+  const b = s.indexOf('router.', a + 20);
+  return s.slice(a, b === -1 ? s.length : b);
+})();
+
+test('the route renders the decision and does not carry the rule', () => {
+  assert.match(ROUTE, /const versionDecision = authorizeVersionCreate\(\{/);
+  assert.match(ROUTE, /return res\.status\(versionDecision\.status\)\.json\(versionDecision\.body\);/);
+  assert.equal(/planning_version_exists/.test(ROUTE), false,
+    'the refusal is the gate\'s to name, not a second copy in the handler');
+});
+
+test('the route reads the planning versions ONLY when it could matter', () => {
+  // Creating a shipped version must not pay for a query about the planning queue.
+  assert.match(ROUTE, /status === 'planning' \? await db\.versionsWithStatus\('planning'\) : \[\]/);
+});
+
+test('the gate runs AFTER validation and BEFORE the insert', () => {
+  const badStatus = ROUTE.indexOf("'bad_status'");
+  const exists = ROUTE.indexOf("'version_exists'");
+  const gate = ROUTE.indexOf('authorizeVersionCreate');
+  const write = ROUTE.indexOf('db.createVersion');
+  assert.ok(badStatus !== -1 && exists !== -1 && gate !== -1 && write !== -1);
+  assert.ok(badStatus < gate, 'an invalid status is its own answer, not a queue conflict');
+  assert.ok(exists < gate, 'a duplicate id keeps its own answer too');
+  assert.ok(gate < write, 'a refusal after the insert is not a refusal');
+});
+
+test('the default status is planning, so an unqualified create hits the gate', () => {
+  // The body may omit `status`. If that default ever changed, the gate would
+  // silently stop applying to the most common call.
+  assert.match(ROUTE, /const status = body\.status \|\| 'planning';/);
+});
+
+test('the accepted race is described as unmitigated, because it is', () => {
+  // An earlier draft of this comment said the race was "left to a partial unique
+  // index" — which reads as though one exists. It does not, and a future reader
+  // taking that at face value would believe two concurrent creates cannot both
+  // slip through. Pinned so the honest wording cannot quietly regress.
+  assert.match(ROUTE, /RACE, ACCEPTED AND UNMITIGATED/);
+  assert.match(ROUTE, /no database\s*\n?\s*\/\/ constraint backs it/,
+    'the comment must say plainly that nothing catches it');
+});
+
+// ---- the rule is one half of a pair ----------------------------------------
+
+test('R03 and R04 are the pair: closing the goal set, and closing the way around it', () => {
+  assert.match(src('modules/lifecycle/routes/goal-route-authz.js'), /function authorizeGoalCreate/,
+    'R03 closes a building version\'s goal set');
+  assert.equal(authorizeVersionCreate({ status: 'planning', planning: [V2] }).ok, false,
+    'and R04 closes the obvious route around it — neither is much use alone');
+});

package/tests/project_invite_suggestions.mjs

@@ -0,0 +1,133 @@
+// tests/project_invite_suggestions.mjs — WHO the creation wizard suggests
+// inviting (BV1.R28, task 1002347, goal 1000046 criterion C6, ADR 0251).
+//
+// tests/project_invite_ui.mjs pins the SURFACE (how a suggestion renders and what
+// clicking it sends). This file pins the LOOKUP behind it, and above all the two
+// properties that are security rather than behaviour:
+//
+//   • it reads the RECRUITING DIRECTORY, not the leaderboard — so the recruiting
+//     opt-out is honoured. The two readers differ by exactly one SQL predicate
+//     and the wrong one would hand an owner the name of every builder who asked
+//     not to be recruited (community spec D3; see scoutingListableSql).
+//   • `github_id` never leaves the module — the invite route takes a LOGIN, and
+//     the id names someone who has consented to nothing.
+//
+// Run:  node --test --test-reporter=tap tests/project_invite_suggestions.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+// ESM named import off the CJS module: knip cannot trace a createRequire()
+// import, so a test-only export would read as dead code and move the ratchet.
+import { listInviteSuggestions } from '../modules/platform-identity/invite-suggestions.js';
+
+// A pool that records the SQL it was handed and replays canned rows.
+function fakePool(rows) {
+  const seen = [];
+  return {
+    seen,
+    query: async (text, params) => {
+      seen.push({ text, params });
+      return { rows };
+    },
+  };
+}
+
+const BUILDERS = [
+  { github_id: 1, github_login: 'ada', display_name: 'Ada L', avatar_url: 'a.png', disciplines: ['engineer'], project_count: 3, total_tasks_shipped: 40, total_credits: 900 },
+  { github_id: 2, github_login: 'grace', display_name: 'Grace H', avatar_url: 'g.png', disciplines: ['engineer'], project_count: 2, total_tasks_shipped: 30, total_credits: 800 },
+  { github_id: 3, github_login: 'linus', display_name: null, avatar_url: null, disciplines: null, project_count: 1, total_tasks_shipped: 10, total_credits: 100 },
+];
+
+test('it reads the RECRUITING directory — the consent predicate is in the query it runs', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 3, pool });
+
+  // Assert — the opt-out axis (`recruiter_reach`/opt-out columns via
+  // scoutingListableSql) must appear in the SQL. A leaderboard read would join
+  // rollupVisibleSql instead and quietly include opted-out builders.
+  const sql = pool.seen[0].text;
+  assert.match(sql, /platform_identity_builder_project_activity/, 'the cross-project activity rollup, not the credits ledger');
+  assert.match(sql, /platform_identity_accounts/, 'joined to accounts for the consent predicate');
+  assert.doesNotMatch(sql, /FROM\s+builders\b/, 'never the instance leaderboard table');
+});
+
+test('github_id never crosses the boundary — the caller gets the login, which is what an invite takes', async () => {
+  // Act
+  const out = await listInviteSuggestions({ limit: 3, pool: fakePool(BUILDERS) });
+
+  // Assert
+  assert.equal(out.length, 3);
+  for (const row of out) {
+    assert.ok(!('github_id' in row), 'no github_id on a suggestion');
+    assert.ok(row.github_login, 'the login IS the address the invite route takes');
+  }
+  assert.deepEqual(Object.keys(out[0]).sort(),
+    ['avatar_url', 'disciplines', 'display_name', 'github_login', 'project_count', 'total_tasks_shipped'],
+    'an explicit whitelist, so a new column on the rollup cannot leak by default');
+});
+
+test('the owner is dropped from their own suggestions, and the list still fills', async () => {
+  // Act — ada (1) is the owner asking
+  const out = await listInviteSuggestions({ limit: 2, exclude: [1], pool: fakePool(BUILDERS) });
+
+  // Assert
+  assert.deepEqual(out.map((r) => r.github_login), ['grace', 'linus'],
+    'the owner is gone and the next builder moved up — the limit is still met');
+});
+
+test('the over-read is sized to the exclusion, so filtering can never return short', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 3, exclude: [1, 2], pool });
+
+  // Assert
+  assert.equal(pool.seen[0].params[0], 5, 'asked for limit + the two it may have to drop');
+});
+
+test('a limit of zero asks the database nothing at all', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  const out = await listInviteSuggestions({ limit: 0, pool });
+
+  // Assert
+  assert.deepEqual(out, []);
+  assert.equal(pool.seen.length, 0, 'no seek, no query — the solo answer costs nothing');
+});
+
+test('the limit is clamped, so a caller cannot turn a suggestion into a directory dump', async () => {
+  // Arrange
+  const pool = fakePool(BUILDERS);
+
+  // Act
+  await listInviteSuggestions({ limit: 9999, pool });
+
+  // Assert
+  assert.equal(pool.seen[0].params[0], 25, 'clamped to the ceiling');
+});
+
+test('a row with no login is dropped — it cannot be invited, so it is not a suggestion', async () => {
+  // Act
+  const out = await listInviteSuggestions({
+    limit: 5,
+    pool: fakePool([{ github_id: 9, github_login: null, display_name: 'Ghost' }, ...BUILDERS]),
+  });
+
+  // Assert
+  assert.deepEqual(out.map((r) => r.github_login), ['ada', 'grace', 'linus']);
+});
+
+test('a missing disciplines array reads as empty rather than null', async () => {
+  // Act
+  const out = await listInviteSuggestions({ limit: 5, pool: fakePool(BUILDERS) });
+
+  // Assert — linus has disciplines: null on the row
+  assert.deepEqual(out[2].disciplines, [], 'the surface can map() it without a guard');
+});