@bongos/core 1.19.567 → 1.19.569

package/tests/visible_projects_feed.mjs

@@ -16,6 +16,13 @@
 //   3. WHAT A BLACK HOLE MAY SAY. Stealth exposes EXISTENCE, never IDENTITY (D2a), and
 //      the redaction is at the boundary because the orbs page is a static site outside
 //      this repo and could not be trusted to redact even in principle.
+//   4. IN WHAT ORDER, and on what page (task 1003561, which absorbed task 1003560; ADR
+//      0255). The ORDER BY is a covert column, and it was leaking one: sorting by
+//      `updated_at` — which this projection deliberately withholds — MOVED a black hole
+//      whenever its hidden project was touched, handing an observer the stable,
+//      activity-tracking handle STEALTH_ANONYMOUS_KEEPS exists to refuse. A row is now
+//      ordered only by what it publishes, anonymous rows are one keyed-permuted trailing
+//      block, and the 500-row cap became a page window instead of a silent truncation.
 //
 // The stealth assertions are the security spec: they assert ABSENT FIELDS, not absent
 // pixels, which is what R10 (task 1002329) then demonstrates live.
@@ -194,20 +201,147 @@ test('featuring no longer GATES presence — it only ranks among projects alread
   const sql = pool.calls[0].text;
   const where = (sql.match(/WHERE([\s\S]*?)ORDER BY/i) || [, ''])[1];
   assert.doesNotMatch(where, /featured/, 'featured must not appear in the predicate at all');
-  assert.match(sql, /ORDER BY featured DESC/, 'it keeps the job D3 leaves it: ranking');
+  const order = (sql.match(/ORDER BY([\s\S]*?)LIMIT/i) || [, ''])[1];
+  assert.match(order, /AND featured\) DESC/,
+    'it keeps the job D3 leaves it: ranking — now guarded, so it ranks only rows that publish a name');
 });
 
-test('the public feed is CAPPED — the swap to self-service removed the human bound on its size', async () => {
+test('the cap is now a PAGE WINDOW — bound as parameters and clamped to the fan-out ceiling', async () => {
   // Until R06 the listing was bounded by an Archon choosing to feature a project. Making
   // it `publishable` replaced that bound with self-service, on a route that is public,
-  // CORS-open, unauthenticated AND fans out one outbound stats fetch per row. The cap is
-  // the cheap half of that trade; pagination is its own task.
+  // CORS-open, unauthenticated AND fans out up to four outbound stats fetches per cold
+  // row. Task 1002325 answered with a hard LIMIT 500 — the cheap half. This is the honest
+  // half (task 1003560, merged into 1003561): the same 500 still bounds one request's
+  // fan-out, but a caller can now reach past it instead of being truncated in silence.
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool, limit: 10000, offset: 25 });
+  const { text, params } = pool.calls[0];
+  assert.match(text, /LIMIT \$2::int OFFSET \$3::int/,
+    'the window is BOUND, never interpolated — it is the first caller-supplied value this SQL has ever carried');
+  assert.equal(params[1], feed.PUBLIC_FEED_MAX_PAGE_SIZE,
+    'a caller cannot ask past the ceiling, so no request can aim more fan-out than one could before');
+  assert.equal(params[2], 25);
+});
+
+test('no window at all means the OLD hard cap, so every pre-paging consumer is unchanged', async () => {
+  // The compatibility guarantee, asserted rather than trusted: one consumer of this feed
+  // is a static orbs site in ANOTHER REPO that this commit cannot update. A default page
+  // smaller than the old LIMIT would have silently shrunk somebody else's map.
   const pool = mockPool([{ rows: [] }]);
   await pi.listPublicProjects({ pool });
-  assert.match(pool.calls[0].text, new RegExp(`LIMIT ${feed.PUBLIC_FEED_MAX_PROJECTS}\\b`));
-  assert.equal(Number.isInteger(feed.PUBLIC_FEED_MAX_PROJECTS), true,
-    'the cap is interpolated into SQL, so it must be a literal integer and never a caller value');
-  assert.ok(feed.PUBLIC_FEED_MAX_PROJECTS > 0);
+  assert.deepEqual(pool.calls[0].params.slice(1), [feed.PUBLIC_FEED_MAX_PAGE_SIZE, 0]);
+  assert.equal(feed.PUBLIC_FEED_MAX_PAGE_SIZE, 500, 'the number the feed was capped at before it could page');
+});
+
+test('a nonsense window is CLAMPED, never rejected and never unbounded', async () => {
+  // Clamped in listPublicProjects as well as at the route: this is a module-public
+  // function and the ceiling is a fan-out bound, so it may not depend on every future
+  // caller remembering to pass one.
+  const pool = mockPool([{ rows: [] }, { rows: [] }]);
+  await pi.listPublicProjects({ pool, limit: -1, offset: -50 });
+  assert.deepEqual(pool.calls[0].params.slice(1), [feed.PUBLIC_FEED_MAX_PAGE_SIZE, 0]);
+  await pi.listPublicProjects({ pool, limit: 'all', offset: 'next' });
+  assert.deepEqual(pool.calls[1].params.slice(1), [feed.PUBLIC_FEED_MAX_PAGE_SIZE, 0]);
+});
+
+// ── the ORDER BY is part of the payload (task 1003561, ADR 0255) ─────────────
+
+// The ORDER BY's terms, with the identified-state predicate masked so a naive comma
+// split survives the comma inside its IN-list.
+function orderTerms(sql) {
+  const clause = (sql.match(/ORDER BY([\s\S]*?)LIMIT/i) || [, ''])[1];
+  return clause.split(feed.IDENTIFIED_SQL).join('<identified>')
+    .split(',').map((t) => t.trim().replace(/\s+/g, ' ')).filter(Boolean);
+}
+
+async function feedSql(opts = {}) {
+  const pool = mockPool([{ rows: [] }]);
+  await pi.listPublicProjects({ pool, ...opts });
+  return pool.calls[0];
+}
+
+test('updated_at is gone from the query ENTIRELY — it may no longer even sort', async () => {
+  // THE bug (task 1003561). A public list's ORDER BY is a covert column: sorting by a
+  // value the projection withholds publishes it anyway, one comparison at a time. For a
+  // black hole that meant its position moved the moment its hidden project was touched.
+  const { text } = await feedSql();
+  assert.doesNotMatch(text, /updated_at/,
+    'not in the projection, and since task 1003561 not in the ORDER BY either');
+});
+
+test('anonymous rows are collated into ONE TRAILING BLOCK, never interleaved with named ones', async () => {
+  // The separation is what makes position meaningless: a black hole neighbours no named
+  // row, so it can no longer be bracketed between two rows whose own order is visible.
+  const terms = orderTerms((await feedSql()).text);
+  assert.equal(terms[0], '<identified> DESC',
+    'the FIRST sort term partitions the two blocks, so no later term ever compares across them');
+});
+
+test('no identified sort key is ever applied to an anonymous row', async () => {
+  // Blanking terms 2-4 is the whole trick. Without it, the trailing block would simply be
+  // re-sorted by featured, then created_at, then origin — none of which a black hole
+  // publishes, and created_at in particular would narrow WHICH project it is to anyone
+  // who watched the catalog fill up.
+  const terms = orderTerms((await feedSql()).text);
+  for (const [i, key] of [[1, 'featured'], [2, 'created_at'], [3, 'origin']]) {
+    assert.ok(terms[i].includes(key), `term ${i} ranks identified rows by ${key}`);
+    assert.ok(terms[i].includes('<identified>'),
+      `and it is guarded, so ${key} never orders an anonymous row`);
+  }
+  assert.ok(terms[3].includes('ELSE md5('),
+    'the anonymous block gets a permutation where the identified block gets its public keys');
+  assert.equal(terms.length, 4, 'and there is no fifth, unguarded term');
+});
+
+test('the anonymous permutation reads a BOUND salt — the key never enters the SQL text', async () => {
+  const { text, params } = await feedSql({ now: 0 });
+  assert.match(text, /md5\(origin \|\| \$1::text\)/, 'the hash reads its salt from $1');
+  assert.equal(params[0], feed.anonymousOrderSalt(0));
+  assert.ok(!text.includes(params[0]), 'and the secret is never interpolated into the query');
+});
+
+test('the permutation salt is KEYED and re-deals on an epoch — it is not a clock reading', () => {
+  // Two properties, and both are load-bearing. SECRET: origins are guessable (they are
+  // domain names), so a salt an observer could predict would let them hash their
+  // candidates, match the ranks and de-anonymise the whole block in one pass. ROTATING:
+  // a permanently stable order would make POSITION the durable per-project key that
+  // STEALTH_ANONYMOUS_KEEPS refuses to put on the wire.
+  const epoch = feed.ANONYMOUS_ORDER_EPOCH_MS;
+  const salt = feed.anonymousOrderSalt(1000);
+  assert.equal(feed.anonymousOrderSalt(epoch - 1), salt,
+    'stable within one period, so the pages of a single listing agree with each other');
+  assert.notEqual(feed.anonymousOrderSalt(epoch + 1), salt,
+    're-dealt across periods, so today\'s rank is not tomorrow\'s black hole');
+  const [key, period] = salt.split(':');
+  assert.equal(period, '0');
+  assert.match(key, /^[0-9a-f]{32}$/, 'a random per-process key — not a timestamp, not a constant');
+});
+
+test('SQL and feedShapeFor cannot disagree about who is anonymous — both read ORB_BY_STATE', () => {
+  // The two halves of one decision, written in two languages. A disagreement would not be
+  // cosmetic: SQL calling a state identified while feedShapeFor redacts it would POSITION
+  // the row by a created_at that its own wire row does not carry — exactly the leak this
+  // ordering closes, reopened one enum value later.
+  for (const state of feed.IDENTIFIED_STATES) {
+    assert.notEqual(feed.orbForState(state), 'black-hole', `${state} sorts identified, so it must render identified`);
+    assert.equal(feed.feedShapeFor({ ...PUBLIC_ROW, visibility: state }).name, 'Mercury');
+    assert.ok(feed.IDENTIFIED_SQL.includes(`'${state}'`), 'and the SQL names it too');
+  }
+  assert.deepEqual([...feed.IDENTIFIED_STATES].sort(), ['private', 'public']);
+  assert.ok(!feed.IDENTIFIED_STATES.includes(feed.FALLBACK_PROJECT_STATE),
+    'the anonymous fallback is never in the identified set');
+});
+
+test('the identified set is an ALLOW-list, so an unknown state SORTS anonymous too', () => {
+  // The same fail-closed direction orbStateOf() already took for rendering. A fourth enum
+  // value added upstream and forgotten here draws as a black hole AND sorts into the
+  // anonymous block; a deny-list would have drawn it anonymous but sorted it by its
+  // created_at, which is the worst of both.
+  assert.match(feed.IDENTIFIED_SQL, /^\(visibility IN \(/,
+    'an allow-list: identified by naming, never identified by omission');
+  assert.doesNotMatch(feed.IDENTIFIED_SQL, /NOT IN/);
+  assert.ok(!feed.IDENTIFIED_SQL.includes("'members-only'"));
+  assert.equal(feed.orbForState('members-only'), 'black-hole');
 });
 
 test('listPublicProjects projects `visibility`, the column the orb is derived from', async () => {
@@ -229,7 +363,8 @@ test('listPublicProjects stays a PUBLIC projection — no owner, no status, no b
   assert.ok(sel.trim(), 'the projection is an explicit SELECT list');
   assert.doesNotMatch(sel, /\*/, 'no star projection on a public route');
   assert.doesNotMatch(sel, /owner_github_id/, 'public projection must not leak owner id');
-  assert.doesNotMatch(sel, /updated_at/, 'curation noise — it may sort, it may never project');
+  assert.doesNotMatch(sel, /updated_at/,
+    'curation noise: it never projected, and since task 1003561 it does not sort either');
   assert.doesNotMatch(sel, /\bdescription\b/,
     'description is the publish BAR, not a card field — it is spent in the predicate');
   assert.match(sel, /created_at/, 'the LISTED date stays public');
@@ -241,16 +376,17 @@ test('listPublicProjects stays a PUBLIC projection — no owner, no status, no b
 // The real router, driven with a fake req/res. `pi.listPublicProjects` and the stats
 // enrichment are stubbed so the test needs neither Postgres nor the network — what is
 // under test is the ROUTE's composition, not either dependency.
-async function callFeaturedFeed(rows) {
+async function callFeaturedFeed(rows, query) {
   const router = projectsRoutes();
   const layer = router.stack.find((l) => l.route && l.route.path === '/projects/featured'
     && l.route.methods.get);
   assert.ok(layer, 'GET /projects/featured must still be a route on this router');
 
   const askedFor = [];
+  const listArgs = [];
   const savedList = pi.listPublicProjects;
   const savedStats = projectStats.getProjectStats;
-  pi.listPublicProjects = async () => rows;
+  pi.listPublicProjects = async (args) => { listArgs.push(args || {}); return rows; };
   projectStats.getProjectStats = async (origins) => { askedFor.push(...origins); return {}; };
   try {
     let body = null;
@@ -264,13 +400,13 @@ async function callFeaturedFeed(rows) {
     // would exercise the ceiling and never reach the route — and, worse, would keep
     // passing as a silent no-op if the handler were ever removed. A fresh req per call
     // keeps each test's reads out of the previous one's budget.
-    const req = { ip: `198.51.100.${Math.floor(Math.random() * 200) + 1}` };
+    const req = { ip: `198.51.100.${Math.floor(Math.random() * 200) + 1}`, query: query || {} };
     for (const entry of layer.route.stack) {
       let advanced = false;
       await entry.handle(req, res, () => { advanced = true; });
       if (!advanced) break;   // something short-circuited (a refusal), or it was the handler
     }
-    return { body, askedFor };
+    return { body, askedFor, listArgs };
   } finally {
     pi.listPublicProjects = savedList;
     projectStats.getProjectStats = savedStats;
@@ -329,3 +465,38 @@ test('dark matter never reaches the route at all — the exclusion is in SQL', a
   const fn = (src.match(/async function listPublicProjects[\s\S]*?\n\}/) || [''])[0];
   assert.ok(fn.includes('publishableSql()'), 'the gate is applied in the query, not after it');
 });
+
+// ── the route's half of the page window (task 1003560 → 1003561) ─────────────
+
+test('the route pages with ?limit=&offset= and reports back the window it used', async () => {
+  // ADR 0119's contract, which this feed was the last public list to hold out on.
+  const { body, listArgs } = await callFeaturedFeed([{ ...PUBLIC_ROW }], { limit: '2', offset: '4' });
+  assert.equal(listArgs[0].limit, 2);
+  assert.equal(listArgs[0].offset, 4);
+  assert.deepEqual(body.page, { limit: 2, offset: 4 });
+  assert.ok(Array.isArray(body.projects),
+    '`projects` keeps its name and its place — every consumer destructures it, so the wire is additive');
+});
+
+test('an unparamed read still asks for the whole ceiling — the other-repo orbs site is unchanged', async () => {
+  const { body, listArgs } = await callFeaturedFeed([{ ...PUBLIC_ROW }]);
+  assert.equal(listArgs[0].limit, pi.PUBLIC_FEED_MAX_PAGE_SIZE);
+  assert.equal(listArgs[0].offset, 0);
+  assert.deepEqual(body.page, { limit: pi.PUBLIC_FEED_MAX_PAGE_SIZE, offset: 0 });
+});
+
+test('?limit= can only SHRINK a page, so paging cannot aim more fan-out than one request already could', async () => {
+  // The constraint that makes paging safe on a public, CORS-open, unauthenticated route
+  // whose every cold row costs four outbound fetches at somebody else's server.
+  const { listArgs } = await callFeaturedFeed([], { limit: '99999' });
+  assert.equal(listArgs[0].limit, pi.PUBLIC_FEED_MAX_PAGE_SIZE);
+});
+
+test('no cursor: the page token is an offset, which encodes nothing about any row', async () => {
+  // Deliberate, and a security property as much as a style one. An opaque cursor over this
+  // feed would have to encode a sort position, and the obvious encoding — the last row's
+  // timestamp — is the very side-channel the ORDER BY above was rewritten to close.
+  const { body } = await callFeaturedFeed([{ ...PUBLIC_ROW }], { offset: '3' });
+  assert.deepEqual(Object.keys(body.page).sort(), ['limit', 'offset']);
+  assert.equal(body.page.offset, 3);
+});