@bongos/core 1.19.570 → 1.19.572

package/tests/hall_landing_boot.mjs

@@ -0,0 +1,141 @@
+// tests/hall_landing_boot.mjs — the front door's boot order (task 1003673).
+//
+// Regression guard for the bug that locked every invite-only instance out of its
+// own first builder: a signed-out visitor to /builders never saw the landing.
+// builders.js mounted the hall widgets BEFORE /me resolved, a widget's own boot
+// read 401'd, that read treated 401 as "go and sign in" and NAVIGATED — so the
+// page bounced to GitHub, which refuses a first-timer with "request access
+// first" and points them back at /builders to be bounced again. The request form
+// sat behind that loop, unreachable, so the approval queue could never fill.
+//
+// The invariant this locks down: AUTH IS RESOLVED BEFORE THE HALL MOUNTS
+// ANYTHING. A signed-out visitor gets the landing and nothing else; only a
+// signed-in one mounts widgets. Executes the real builders.js in a minimal DOM
+// stub (the hall_signout.mjs / hall_nav.mjs pattern) and drives DOMContentLoaded.
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/builders.js'), 'utf8');
+
+// Boot builders.js against a /me that answers `meStatus`, then fire
+// DOMContentLoaded and let the microtasks drain. Returns what the page DID.
+async function boot({ meStatus }) {
+  const calls = { assign: [], requests: [], rendered: [] };
+
+  const makeEl = () => ({
+    dataset: {}, style: {}, title: '', textContent: '', hidden: false, value: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+    addEventListener() {}, querySelector() { return null; }, querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, closest() { return null; },
+    set innerHTML(_v) {}, get innerHTML() { return ''; },
+  });
+
+  const location = { pathname: '/builders', search: '', hash: '', href: 'https://x/builders', assign(u) { calls.assign.push(u); } };
+
+  const api = {
+    request(method, p) {
+      calls.requests.push(`${method} ${p}`);
+      const isMe = /\/me(\?|$)/.test(p);
+      const status = isMe ? meStatus : 200;
+      if (status === 401) return Promise.resolve({ status: 401, ok: false, data: null });
+      // A shape generic enough for the boot path; the renderers are spies below.
+      return Promise.resolve({ status: 200, ok: true, data: { builder: { id: '1', rank: 'metic' }, onboarding: null, tasks: [], goals: [], items: [] } });
+    },
+  };
+
+  const spy = (name) => (...args) => { calls.rendered.push(name); return args; };
+  const documentObj = {
+    body: { dataset: { page: 'home' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById() { return makeEl(); },
+    querySelector() { return makeEl(); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    listeners: {},
+    addEventListener(type, fn) { (this.listeners[type] || (this.listeners[type] = [])).push(fn); },
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+
+  const windowObj = {
+    __BRANDING__: { identity: { worldName: 'W', productName: 'W' }, currency: { label: 'credits' } },
+    __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => api },
+    OTB: {
+      moduleOn: () => true,
+      escapeHtml: (s) => String(s == null ? '' : s),
+      $: () => makeEl(),
+      fmtNum: (n) => String(n),
+      fmtDate: () => '',
+      rankLabel: (r) => String(r || '—'),
+      toast: () => {},
+      hallWidgets: () => [],
+      contributeHallWidget: () => {},
+    },
+    OTBKit: {
+      makePager: () => ({ page: 1, perPage: 10 }),
+      paginate: (rows) => rows,
+      wirePager: () => {},
+    },
+    OTBHallRender: () => ({
+      SETUP_CONFIG_KEY: 'k', analyticsState: {}, lbState: {}, onboardingBox: () => makeEl(),
+      shipState: {}, shipsPager: { page: 1 }, welcomeDismissalKey: () => 'k',
+      mountHallWidgets: spy('mountHallWidgets'),
+      renderLanding: spy('renderLanding'),
+      renderCurveBody: spy('renderCurveBody'), renderGreeting: spy('renderGreeting'),
+      renderNav: spy('renderNav'), renderOnboarding: spy('renderOnboarding'),
+      renderProfile: spy('renderProfile'), renderRecentShips: spy('renderRecentShips'),
+      renderWelcomeCore: spy('renderWelcomeCore'),
+    }),
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem() { return null; }, setItem() {}, removeItem() {} },
+    location,
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location, console,
+    setTimeout, clearTimeout, setInterval, clearInterval, fetch: () => Promise.reject(new Error('no network in this test')),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'builders.js' });
+
+  for (const fn of documentObj.listeners.DOMContentLoaded || []) fn();
+  // Drain the boot promise chain (a handful of awaits, no timers).
+  for (let i = 0; i < 25; i += 1) await Promise.resolve();
+  return calls;
+}
+
+test('a signed-out visitor gets the landing — and is NEVER navigated away from it', async () => {
+  const calls = await boot({ meStatus: 401 });
+
+  assert.deepEqual(calls.assign, [],
+    'the signed-out front door navigated somewhere. That is the dead end: GitHub refuses a '
+    + 'first-timer and sends them back here, so the request-access form is unreachable and '
+    + 'an invite-only instance can never admit anyone.');
+  assert.ok(calls.rendered.includes('renderLanding'), 'the landing (sign in / request access) never rendered');
+  assert.ok(!calls.rendered.includes('mountHallWidgets'),
+    'widgets mounted for a signed-out visitor — each one boots its own authenticated read, '
+    + 'and any of those may navigate. The landing must be the whole page.');
+});
+
+test('auth is resolved BEFORE anything else is asked for', async () => {
+  const calls = await boot({ meStatus: 401 });
+  assert.equal(calls.requests.length, 1, `the page asked for more than /me while signed out: ${calls.requests.join(', ')}`);
+  assert.match(calls.requests[0], /\/me$/);
+});
+
+test('a signed-in builder still gets the hall', async () => {
+  const calls = await boot({ meStatus: 200 });
+  assert.ok(calls.rendered.includes('mountHallWidgets'), 'the hall did not mount for a signed-in builder');
+  assert.deepEqual(calls.assign, [], 'a signed-in boot navigated away');
+  assert.equal(calls.requests.filter((r) => /\/me$/.test(r)).length, 1,
+    'boot asked for /me more than once — the resolved payload is handed to loadAll, not re-fetched');
+});