@bongos/core 1.19.564 → 1.19.565

package/tests/visibility_pull.mjs

@@ -0,0 +1,213 @@
+// tests/visibility_pull.mjs — the self-hosted visibility PULL (R08, task 1002327;
+// ADR 0252, corrected by ADR 0253).
+//
+// DB-free. The three properties worth a test are the three that are easy to get wrong in
+// the direction that silently breaks the map:
+//
+//   1. THE TRI-STATE DOES NOT PURGE. A project that answered once and is unreachable now
+//      keeps its door AND its stamp. The naive version — treat "no answer" as a value —
+//      quietly empties the map one outage at a time.
+//   2. THE PULL NEVER TOUCHES A CONTROL-PLANE ROW, at the decision AND in the SQL. Two
+//      writers on one column is the drift ADR 0246's projection exists to prevent.
+//   3. THE PULL NEVER MOVES `status`. This is what makes the retraction lever real
+//      (ADR 0252 §5.2) — asserted against the statement text, so adding a status write
+//      later reds this test rather than silently undoing every takedown.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const vp = require('../modules/platform-identity/visibility-pull.js');
+const feed = require('../modules/platform-identity/projects-feed.js');
+
+// A pool that records every statement and answers from a queue.
+function recordingPool(responses = []) {
+  const calls = [];
+  const queue = [...responses];
+  return {
+    calls,
+    query(text, params) {
+      calls.push({ text, params });
+      return Promise.resolve(queue.shift() || { rows: [] });
+    },
+  };
+}
+
+const manifest = (visibility) => ({ brand: { project: { visibility } } });
+
+// ── 1. What a manifest is allowed to say ──
+
+test('reads the join door from the live manifest key, which is `brand`, not `branding`', () => {
+  // ADR 0252 §2 and task 1002327's body both write `branding.project.visibility`, but
+  // buildInstanceManifest projects the pack under `brand`. Reading only the documented
+  // spelling would have made every pull a silent no-verdict — the failure that looks
+  // exactly like "no self-hosted project ever reports".
+  assert.equal(vp.visibilityFromManifest({ brand: { project: { visibility: 'private' } } }), 'private');
+  assert.equal(vp.visibilityFromManifest({ branding: { project: { visibility: 'private' } } }), 'private');
+});
+
+test('an off-vocabulary or absent answer is NO VERDICT, never a default', () => {
+  // Defaulting to 'public' would let a project that said nothing be read as having asked
+  // to be on the map — ADR 0252 §2's "no verdict, never a default".
+  for (const body of [
+    {}, null, undefined,
+    { brand: {} },
+    { brand: { project: {} } },
+    { brand: { project: { visibility: 'unlisted' } } },
+    { brand: { project: { visibility: 'PUBLIC' } } },   // case is not normalised away
+    { brand: { project: { visibility: 42 } } },
+    { brand: { project: { visibility: { public: true } } } },
+  ]) {
+    assert.equal(vp.visibilityFromManifest(body), null, `expected no verdict for ${JSON.stringify(body)}`);
+  }
+});
+
+test('the channel carries visibility ONLY — no name, tagline or art can ride it', () => {
+  // ADR 0252 §7: today no project owner controls a free-text field that reaches the
+  // public feed. A visibility report is not the place to spend that property.
+  const out = vp.visibilityFromManifest({
+    brand: { project: { visibility: 'public' }, identity: { productName: 'Injected' } },
+    name: 'Injected', tagline: 'Injected', art_url: 'https://evil.example/x.png',
+  });
+  assert.equal(out, 'public');
+  assert.equal(typeof out, 'string');
+});
+
+// ── 2. The tri-state ──
+
+test('never read + no answer => stays dark; nothing is written', () => {
+  const d = vp.pullDecision({ visibility: 'public', visibility_reported_at: null, visibility_source: null }, null);
+  assert.equal(d.write, false);
+  assert.equal(d.reason, 'never_reported');
+});
+
+test('READ BEFORE + unreachable now => KEEPS its last state and its stamp', () => {
+  // The load-bearing half of the tri-state. A project does not leave the map because its
+  // server was down for one sweep (ADR 0199 / 0226). Implemented as "write nothing",
+  // which is also what keeps `visibility_reported_at` meaning LAST SUCCESSFUL read.
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  const d = vp.pullDecision(row, null);
+  assert.equal(d.write, false);
+  assert.equal(d.reason, 'unreachable_keeps_last_state');
+});
+
+test('a NARROWING report is applied immediately — hiding yourself needs no trust', () => {
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  const d = vp.pullDecision(row, 'stealth');
+  assert.deepEqual(d, { write: true, visibility: 'stealth' });
+});
+
+test('a WIDENING report is applied too — the pull is the door\'s only source for these rows', () => {
+  const row = { visibility: 'stealth', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  assert.deepEqual(vp.pullDecision(row, 'public'), { write: true, visibility: 'public' });
+});
+
+test('an unchanged answer writes nothing, so a sweep cannot churn feed ordering', () => {
+  // listPublicProjects orders on updated_at, so bumping it every 15 minutes would make a
+  // row's position on the map track the sweep clock instead of the project.
+  const row = { visibility: 'public', visibility_reported_at: new Date('2026-09-01'), visibility_source: 'pull' };
+  assert.equal(vp.pullDecision(row, 'public').write, false);
+});
+
+test('a first successful read DOES write, even when the value equals the column default', () => {
+  // The row starts at the NOT NULL DEFAULT 'public' with no stamp. Treating that as
+  // "unchanged" would leave visibility_reported_at NULL forever, so the project would
+  // stay dark matter no matter how many times it answered — the bug the `visibility_source
+  // === 'pull'` half of the unchanged-check exists to prevent.
+  const row = { visibility: 'public', visibility_reported_at: null, visibility_source: null };
+  assert.deepEqual(vp.pullDecision(row, 'public'), { write: true, visibility: 'public' });
+});
+
+// ── 3. The two writers never share a row ──
+
+test('a control-plane row is refused at the decision, whatever it reports', () => {
+  for (const reported of ['public', 'private', 'stealth', null]) {
+    const d = vp.pullDecision({ visibility: 'private', visibility_source: 'control-plane' }, reported);
+    assert.equal(d.write, false);
+    assert.equal(d.reason, 'control_plane_row');
+  }
+});
+
+test('the exclusion is ALSO in the SQL, at both the read and the write', async () => {
+  // A bridge projection can land between the SELECT and the UPDATE, so the invariant has
+  // to hold at the write, not merely at the read. `IS DISTINCT FROM` and not `<>`: a NULL
+  // source is the unclaimed state, and plain inequality drops exactly those rows.
+  assert.match(vp.PULLABLE_SQL, /IS DISTINCT FROM 'control-plane'/);
+
+  const readPool = recordingPool([{ rows: [] }]);
+  await vp.pullableProjects({ pool: readPool });
+  assert.ok(readPool.calls[0].text.includes(vp.PULLABLE_SQL), 'the read must filter on PULLABLE_SQL');
+
+  const writePool = recordingPool([{ rows: [{ id: 1 }] }]);
+  await vp.recordVisibilityPull(1, 'public', { pool: writePool });
+  assert.ok(writePool.calls[0].text.includes(vp.PULLABLE_SQL), 'the write must re-assert PULLABLE_SQL');
+});
+
+test('the write refuses an off-vocabulary value rather than trusting its caller', async () => {
+  const pool = recordingPool();
+  await assert.rejects(() => vp.recordVisibilityPull(1, 'unlisted', { pool }), /off-vocabulary/);
+  assert.equal(pool.calls.length, 0, 'nothing may reach the database');
+});
+
+// ── 4. The pull may not move `status` ──
+
+test('NO statement in the pull writes `status` — the retraction lever stays real', async () => {
+  // ADR 0252 §5.2: a retracted project that keeps reporting `public` STAYS hidden. The
+  // cheapest possible proof is that the column never appears in a write this file issues.
+  const pool = recordingPool([{ rows: [{ id: 7 }] }]);
+  await vp.recordVisibilityPull(7, 'public', { pool });
+  const sql = pool.calls.map((c) => c.text).join('\n');
+  assert.ok(!/\bSET\b[\s\S]*\bstatus\b/.test(sql), `a pull statement writes status:\n${sql}`);
+  assert.ok(!/status_pinned/.test(sql), 'a pull may not touch the takedown latch either');
+});
+
+// ── 5. End to end, and the failure isolation the sweep depends on ──
+
+test('an unreachable instance is a no-verdict, not a crash and not a value', async () => {
+  const pool = recordingPool();
+  const out = await vp.pullOne(
+    { id: 1, origin: 'https://a.example', visibility: 'public', visibility_reported_at: new Date(), visibility_source: 'pull' },
+    { pool, fetchVisibility: async () => { throw new Error('ECONNREFUSED'); } },
+  );
+  assert.equal(out.written, false);
+  assert.equal(out.reason, 'unreachable_keeps_last_state');
+  assert.equal(pool.calls.length, 0, 'a failed read must not write');
+});
+
+test('one hostile instance does not stop the sweep reading the others', async () => {
+  const rows = [
+    { id: 1, origin: 'https://bad.example', visibility: 'public', visibility_reported_at: null, visibility_source: null },
+    { id: 2, origin: 'https://good.example', visibility: 'public', visibility_reported_at: null, visibility_source: null },
+  ];
+  const pool = recordingPool([{ rows }, { rows: [{ id: 2 }] }]);
+  const out = await vp.sweepVisibilityOnce({
+    pool,
+    fetchVisibility: async (origin) => {
+      if (origin === 'https://bad.example') throw new Error('boom');
+      return manifest('stealth');
+    },
+  });
+  assert.equal(out.scanned, 2);
+  assert.equal(out.updated, 1);
+  assert.equal(out.results[1].visibility, 'stealth');
+});
+
+// ── 6. The feed predicate, and the trap it would be without its scoping ──
+
+test('the map predicate admits a control-plane row with no stamp — ADR 0247 D4\'s trap', () => {
+  // Every row on the live table has visibility_reported_at NULL, because the column is
+  // new. A predicate that required a stamp of EVERY row would empty the public map on
+  // deploy — the exact shape ADR 0247 D4 found live, one column over. The
+  // `visibility_source = 'control-plane'` disjunct plus migration 020's backfill are what
+  // keep the default scoped to rows that have genuinely never answered.
+  assert.match(feed.DOOR_KNOWN_SQL, /visibility_source = 'control-plane'/);
+  assert.match(feed.DOOR_KNOWN_SQL, /visibility_reported_at IS NOT NULL/);
+  assert.match(feed.DOOR_KNOWN_SQL, /\bOR\b/, 'the two halves must be a disjunction, not a conjunction');
+});
+
+test('the public feed actually carries the predicate', async () => {
+  const pool = recordingPool([{ rows: [] }]);
+  await feed.listPublicProjects({ pool });
+  assert.ok(pool.calls[0].text.includes(feed.DOOR_KNOWN_SQL), 'listPublicProjects must join DOOR_KNOWN_SQL');
+});

package/tests/visible_projects_feed.mjs

@@ -256,9 +256,20 @@ async function callFeaturedFeed(rows) {
     let body = null;
     const res = {
       json: (b) => { body = b; },
+      set: () => {},
       fail: (code, detail) => { throw new Error(`route failed: ${code} ${JSON.stringify(detail)}`); },
     };
-    await layer.route.stack[0].handle({}, res, () => {});
+    // Drive the WHOLE stack, not stack[0]. Since task 1002327 the per-IP feed limiter
+    // sits in front of the handler (ADR 0252 §5.3), so calling the first entry alone
+    // would exercise the ceiling and never reach the route — and, worse, would keep
+    // passing as a silent no-op if the handler were ever removed. A fresh req per call
+    // keeps each test's reads out of the previous one's budget.
+    const req = { ip: `198.51.100.${Math.floor(Math.random() * 200) + 1}` };
+    for (const entry of layer.route.stack) {
+      let advanced = false;
+      await entry.handle(req, res, () => { advanced = true; });
+      if (!advanced) break;   // something short-circuited (a refusal), or it was the handler
+    }
     return { body, askedFor };
   } finally {
     pi.listPublicProjects = savedList;