@bongos/core 1.19.578 → 1.19.580

package/tests/applicant_profile_read_bounds.mjs

@@ -0,0 +1,95 @@
+// tests/applicant_profile_read_bounds.mjs — the one hub call that FANS OUT is
+// bounded in time (task 1003681, from a grader finding).
+//
+// THE DEFECT. `readApplicantProfileFromHub()` had no timeout on its fetch to the
+// hub. Its own doc-comment already promised the outcome — "a queue that fails to
+// load because the hub is slow is a broken one" — but nothing enforced it.
+//
+// WHY IT MATTERS MORE HERE THAN FOR ITS TWO SIBLINGS. reportMembershipCheckIn
+// and reportActivityRollup fire at most once per sign-in or per ship. This one
+// runs up to MAX_LIVE_PROFILE_READS (25) times CONCURRENTLY inside the
+// Promise.all that `GET /access-requests` awaits before responding (D7 resolves
+// the profile live on every render, deliberately — a snapshot would keep
+// publishing a consent since withdrawn). So one unresponsive hub held the whole
+// reviewer queue open for as long as the sockets lived, 25 at a time.
+//
+// The fix is a bound, not a behaviour change: every other failure mode here
+// already answers `null`, so a timeout simply joins them.
+//
+// DB-free and network-free: auth-config is pinned in require.cache so the
+// federation config resolves without env, and global fetch is a spy.
+//
+// Run:  node --test --test-reporter=tap tests/applicant_profile_read_bounds.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Pin the federation config BEFORE auth-admission loads, so loadIdpConfig()
+// answers without HUB_* env (the tests/profile_route.mjs require.cache idiom).
+const cfgPath = require.resolve('../src/bongos/auth-config.js');
+const realCfg = require('../src/bongos/auth-config.js');
+require.cache[cfgPath] = {
+  id: cfgPath,
+  filename: cfgPath,
+  loaded: true,
+  exports: {
+    ...realCfg,
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'cid', clientSecret: 'sec' }),
+  },
+};
+
+const admission = require('../src/bongos/auth-admission.js');
+
+function withFetch(impl, run) {
+  const real = globalThis.fetch;
+  globalThis.fetch = impl;
+  return Promise.resolve(run()).finally(() => { globalThis.fetch = real; });
+}
+
+test('the hub read carries an abort signal — the queue can never wait on it forever', async () => {
+  // Arrange
+  let seen = null;
+  const ok = { ok: true, json: async () => ({ profile: { bio: 'hi' } }) };
+
+  // Act
+  const profile = await withFetch(async (_url, init) => { seen = init; return ok; },
+    () => admission.readApplicantProfileFromHub(42));
+
+  // Assert
+  assert.deepEqual(profile, { bio: 'hi' }, 'the happy path still returns the hub’s view');
+  assert.ok(seen, 'fetch was called');
+  assert.ok(seen.signal, 'an AbortSignal must be passed — without one the call is unbounded');
+  assert.equal(typeof seen.signal.aborted, 'boolean', 'and it must be a real AbortSignal');
+  assert.equal(seen.signal.aborted, false, 'not already aborted when the request goes out');
+});
+
+test('a timed-out hub answers null, exactly like every other failure here', async () => {
+  // Arrange — what AbortSignal.timeout produces when the budget expires
+  const abortErr = Object.assign(new Error('This operation was aborted'), { name: 'TimeoutError' });
+
+  // Act
+  const profile = await withFetch(async () => { throw abortErr; },
+    () => admission.readApplicantProfileFromHub(42));
+
+  // Assert — a degraded queue, never a broken one
+  assert.equal(profile, null, 'an abort must fail soft to null, not reject into the route');
+});
+
+test('the timeout is a real, small budget — a 25-wide fan-out cannot outlive it', () => {
+  // Structural: the constant is the bound the route inherits, so it is pinned
+  // rather than measured (a real 5s wait would make this suite sleep).
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth-admission.js'), 'utf8');
+  const m = /const APPLICANT_PROFILE_TIMEOUT_MS = (\d+);/.exec(src);
+  assert.ok(m, 'the budget must be a named constant, not an inline number');
+  const ms = Number(m[1]);
+  assert.ok(ms > 0 && ms <= 10000, `the budget must be small and real (got ${ms}ms)`);
+  assert.match(src, /signal: AbortSignal\.timeout\(APPLICANT_PROFILE_TIMEOUT_MS\)/,
+    'and the fetch must actually use it — the constant alone bounds nothing');
+});

package/tests/module_api.mjs

@@ -38,6 +38,7 @@ const PUBLISHED_SURFACE = [
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
+  'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',

package/tests/projects_hub.mjs

@@ -1543,6 +1543,30 @@ test('the join-door labels are PLAIN — the space metaphor is the orb’s, neve
   assert.doesNotMatch(options, /unlisted/i, 'dark matter is DERIVED — there is deliberately no way to choose it');
 });
 
+/* ADR 0259: the one thing Stealth does NOT hide is the switch itself. A project
+   leaving the named list while the anonymous count rises names it to anyone
+   holding yesterday's feed — inherent in publishing a named list, and the owner
+   chose to accept it and say so rather than pay for a delay or decoys. The
+   copy is the whole fix, so the copy is what gets pinned: without this, a
+   future edit tightening the blurb drops the caveat and the page goes back to
+   implying a guarantee the feed does not make. */
+test('the Stealth copy names its own limit — switching is visible, even though the project is not (ADR 0259)', () => {
+  const options = (SCRIPT.match(/var DOOR_OPTIONS = \{[\s\S]*?\n  \};/) || [''])[0];
+  const fold = (HUB.match(/<details class="finePrint" id="mDoorWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(options && fold, 'both the option table and the fold must be extractable');
+  for (const [where, text] of [['the choice’s blurb', options], ['the what-changes fold', fold]]) {
+    assert.match(text, /Switching to Stealth is itself visible/,
+      `${where} states the boundary — a privacy control that oversells is worse than one that admits a limit`);
+    assert.match(text, /comparing the map before and after can tell which project went quiet/,
+      `${where} says HOW it is visible, so the owner can judge it rather than take our word`);
+  }
+  /* the plain-register rule this card is held to still binds the new sentence
+     (the space metaphor is the drawn orb's, never the copy's) */
+  for (const word of ['planet', 'star', 'black hole', 'dark matter', 'feed', 'snapshot']) {
+    assert.doesNotMatch(options.toLowerCase(), new RegExp(`\\b${word}\\b`), `"${word}" must not reach a choice’s blurb`);
+  }
+});
+
 test('the join-door pick is a real radio group built from the server’s own options list', () => {
   const render = fnHub('renderDoor');
   assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!DOOR_OPTIONS\[v\]; \}\)/,

package/tests/recruiter_sliver_boundary.mjs

@@ -803,6 +803,25 @@ test('each route spells its OWN gate in its OWN middleware list', () => {
 // 7. IT GRANTS NOTHING (ADR 0016)
 // ===========================================================================
 
+// The first-party files allowed to read the sliver module, each with the reason
+// it is not a DECIDER. The list is the assertion: a new name here is a claim
+// that must be argued, not a line added to make a red test green.
+//
+//   routes/scouting.js       serializes the sliver onto its one archon-gated
+//                            route. The original sole reader.
+//   applicant-profile.js     reuses the PROJECTION for the D7 applicant view
+//                            (task 1002972) and supplies its own consent floor —
+//                            see sliverShapeFor's contract. Sharing the
+//                            projection is what keeps D7's "no new disclosure
+//                            class" literally true: the alternative was a second
+//                            five-key object free to drift from this one field
+//                            by field, which this whitelist proof would not
+//                            cover. It reads the shape; it decides nothing.
+const SLIVER_READERS = [
+  'modules/platform-identity/applicant-profile.js',
+  'modules/platform-identity/routes/scouting.js',
+];
+
 test('the sliver module is read by exactly one first-party server file — the one that serializes it', () => {
   const files = [];
   const walk = (dir) => {
@@ -817,8 +836,22 @@ test('the sliver module is read by exactly one first-party server file — the o
   const readers = files
     .filter((f) => /require\(\s*['"][^'"]*recruiter-sliver['"]\s*\)/.test(fs.readFileSync(f, 'utf8')))
     .map((f) => path.relative(ROOT, f).split(path.sep).join('/'));
-  assert.deepEqual(readers, ['modules/platform-identity/routes/scouting.js'],
-    'nothing may consult the sliver to DECIDE anything: cross-project numbers are descriptive analytics, never authority (ADR 0016)');
+  assert.deepEqual(readers, SLIVER_READERS,
+    'nothing may consult the sliver to DECIDE anything: cross-project numbers are descriptive analytics, never authority (ADR 0016). '
+    + 'A new reader needs a stated reason in SLIVER_READERS — and it must serialize the shape, never branch on it.');
+
+  // The reason each allowance rests on, enforced rather than trusted: a reader
+  // may PROJECT the sliver, never READ A VALUE OUT OF IT to decide something. A
+  // comparison against a sliver field is what "authority" would look like here,
+  // so the shape of that mistake is what this refuses.
+  for (const rel of SLIVER_READERS) {
+    const code = fs.readFileSync(path.join(ROOT, rel), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+    for (const key of SLIVER_KEYS) {
+      assert.doesNotMatch(code, new RegExp(`\\.${key}\\s*(?:===|!==|==|!=|>|<)`),
+        `${rel} compares a sliver's \`${key}\` — a reader that BRANCHES on this data is consulting descriptive analytics as authority (ADR 0016)`);
+    }
+  }
 });
 
 test('no rank, role, permission or membership travels with the sliver, under any name', async () => {

package/tests/watch_applications_queue.mjs

@@ -378,4 +378,98 @@ await test('the section lede tells the owner the queue is more than one decision
   assert.match(h.lede(), /decided/i);
 });
 
+// ===========================================================================
+// The applicant's own profile beside their ask (task 1002972, privacy spec D7)
+// ===========================================================================
+//
+// The SERVER decides what may be disclosed — tests/applicant_profile_boundary.mjs
+// is that proof. What is asserted HERE is the half a reviewer actually sees: that
+// the row draws whichever shape it was handed, draws NOTHING when handed null,
+// and escapes the applicant's own words. A source-text assertion cannot see any
+// of that; this runs the real watch.js over the real markup.
+
+const PUBLIC_PROFILE = {
+  view: 'public',
+  account: {
+    handle: 'mona', github_login: 'octocat', display_name: 'Mona Lisa',
+    avatar_url: 'https://avatars.githubusercontent.com/u/583231?v=4',
+    member_since: '2025-01-01T00:00:00Z', bio: 'I draw maps.', links: null,
+  },
+  cross_project: {
+    totals: { projects: 3, credits: 4200, works_shipped: 41, karma: 7 },
+    disciplines: ['engineer', 'artist'], last_active: '2026-08-30T00:00:00Z',
+    projects: [], more_projects: 0,
+  },
+};
+const SLIVER_PROFILE = {
+  view: 'sliver',
+  sliver: { handle: 'quiet', display_name: 'Quiet Person', avatar_url: null, disciplines: ['engineer'], active_recently: true },
+};
+const withProfile = (profile, over = {}) => [{ ...WAITING[0], profile, ...over }];
+
+await test('a PUBLIC applicant renders their record beside the ask', async () => {
+  const h = await boot({ rows: { pending: withProfile(PUBLIC_PROFILE), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.ok(block_, 'the public applicant view rendered no profile block at all');
+  const text = block_.textContent;
+  assert.match(text, /I draw maps\./, 'the bio is part of what the public page already shows');
+  assert.match(text, /3 projects/);
+  assert.match(text, /41 shipped/);
+  assert.match(text, /engineer/);
+});
+
+await test('a PRIVATE applicant renders the sliver AND says why it is thin', async () => {
+  const h = await boot({ rows: { pending: withProfile(SLIVER_PROFILE), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.ok(block_, 'the sliver rendered no profile block');
+  const text = block_.textContent;
+  assert.match(text, /Private account/,
+    'a reviewer must not read the thinness as a poor record — it is a boundary, and applying is what opened even this much');
+  assert.match(text, /engineer/);
+  assert.match(text, /Active recently/);
+});
+
+await test('hidden stats: a public applicant keeps their name and says the record is hidden', async () => {
+  const hidden = { ...PUBLIC_PROFILE, cross_project: null };
+  const h = await boot({ rows: { pending: withProfile(hidden), invited: [], dismissed: [] } });
+  const text = h.rows()[0].querySelector('.ov-row__profile').textContent;
+  assert.match(text, /hides their cross-project record/,
+    'a blank would read as "this applicant has done nothing", which is a different claim entirely');
+});
+
+await test('NO profile is not an error — the row renders exactly as it always did', async () => {
+  const h = await boot({ rows: { pending: withProfile(null), invited: [], dismissed: [] } });
+  const row = h.rows()[0];
+  assert.equal(row.querySelector('.ov-row__profile'), null,
+    'null covers unvouched, no hub, hub down and hidden alike — none of them may draw a box');
+  assert.ok(row.querySelector('.fact-pill'), 'and the vouch pill still says whether anyone confirmed the name');
+  assert.match(row.textContent, /octocat/);
+});
+
+await test('an unrecognised view shape draws nothing rather than guessing', async () => {
+  const h = await boot({ rows: { pending: withProfile({ view: 'everything', account: { bio: 'x' } }), invited: [], dismissed: [] } });
+  assert.equal(h.rows()[0].querySelector('.ov-row__profile'), null,
+    'a shape this page does not know is a shape it must not render — fail closed');
+});
+
+await test('an applicant own words are ESCAPED, never linkified (the render contract)', async () => {
+  const nasty = {
+    ...PUBLIC_PROFILE,
+    account: { ...PUBLIC_PROFILE.account, bio: '<img src=x onerror=alert(1)>ping http://evil.example' },
+  };
+  const h = await boot({ rows: { pending: withProfile(nasty), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.equal(block_.querySelectorAll('img').length, 0, 'a bio is user content on a page an Archon reads');
+  assert.equal(block_.querySelectorAll('a').length, 0, 'the contract says never linkify — an Archon must not be handed a one-click link a stranger wrote');
+  assert.match(block_.textContent, /evil\.example/, 'the text itself is still shown, just inert');
+});
+
+await test('the profile changes what the row SAYS, never what it offers (ADR 0016)', async () => {
+  const rich = await boot({ rows: { pending: withProfile(PUBLIC_PROFILE), invited: [], dismissed: [] } });
+  const bare = await boot({ rows: { pending: withProfile(null), invited: [], dismissed: [] } });
+  const actionsOf = (h) => [...h.rows()[0].querySelectorAll('button')].map((b) => b.textContent.trim()).sort();
+  assert.deepEqual(actionsOf(rich), actionsOf(bare),
+    'a rich record is not a reason to admit and an empty one is not a reason to refuse — the decisions must be identical');
+});
+
 summary();