@bongos/core 1.19.582 → 1.19.584

package/tests/provisioning_paid_shape_gate.mjs

@@ -0,0 +1,172 @@
+// tests/provisioning_paid_shape_gate.mjs
+//
+// The paid-shape gate on POST /provisioning/instances (task 1003682).
+//
+// Before this, the create route's only gate was requireBuilder, and `hosting_shape` was
+// caller-supplied and validated only against the allowed set. `dedicated` is the ONE shape
+// whose runner leg creates a real DigitalOcean droplet (scripts/gds/provision.js — billed
+// monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos included —
+// could queue recurring infrastructure spend the owner never approved. The route that
+// SPENDS was less gated than force-teardown, which stops spending and sits behind
+// provisioning.fleet.manage.
+//
+// The fix gates the SHAPE, not the route: every $0 shape (standalone, co-tenant) stays open
+// to any authenticated builder, because ordinary project creation must not require a rank.
+// Only `dedicated` demands provisioning.fleet.manage — deliberately the same atom that
+// already guards the fleet cost-ledger and force-teardown, since spending on the fleet and
+// managing the fleet are one authority.
+//
+// DB-free: the pool is never reached (createInstance is stubbed), auth is faked. No network
+// beyond a loopback listener.
+//
+// Run:  node tests/provisioning_paid_shape_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── stubs: the route's data access + auth ────────────────────────────────────────
+let lastCreateArgs = null;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return { instance: { id: 42, owner_builder_id: 7, slug: args.slug, hosting_shape: args.hostingShape }, created: true };
+};
+provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
+provisioning.recordEvent = async () => {};
+provisioning.getInstanceBySlug = async () => null;
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+// The permission gate, faked at the same seam the real one uses. `held` is flipped per
+// case below so one mounted app covers both the denied and the admitted builder.
+let held = [];
+api.requirePermission = (...perms) => async (req, res, next) => {
+  if (perms.every((p) => held.includes(p))) return next();
+  return res.fail('permission_forbidden', {
+    status: 403,
+    message: `missing permission: ${perms.filter((p) => !held.includes(p)).join(', ')}`,
+    details: { required: perms, held: perms.filter((p) => held.includes(p)) },
+  });
+};
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ── the $0 shapes stay open — this is the half a careless fix would break ─────────
+
+await ta('standalone: a builder with NO fleet permission still creates (the live wizard path)', async () => {
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
+});
+
+await ta('co-tenant (and an absent shape, which defaults to it) stays open with no permission', async () => {
+  for (const body of [
+    { slug: 'demo', hosting_shape: 'co-tenant', no_address: true },
+    { slug: 'demo', no_address: true },
+  ]) {
+    held = [];
+    const res = await post('/provisioning/instances', body);
+    assert.equal(res.status, 201, `expected 201 for ${JSON.stringify(body)}, got ${res.status} ${res.raw}`);
+  }
+});
+
+// ── dedicated is the metered one ──────────────────────────────────────────────────
+
+await ta('dedicated: REFUSED for a builder without provisioning.fleet.manage', async () => {
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  // requirePermission reports the gate's literal list under `details` (the same envelope
+  // requireRank uses), so the denial names the atom a caller has to be granted.
+  assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
+  assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
+});
+
+await ta('dedicated: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+  held = ['provisioning.fleet.manage'];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'dedicated');
+});
+
+await ta('the gate refuses BEFORE the row exists — a denied dedicated create leaves nothing behind', async () => {
+  // The denial must land ahead of createInstance, not after it: a refused-but-inserted row
+  // would still be drained by the runner, which reads the column, not the HTTP status.
+  held = [];
+  lastCreateArgs = null;
+  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'dedicated', tier: 's-4vcpu-8gb' });
+  assert.equal(lastCreateArgs, null);
+});
+
+// ── the gate cannot be walked around ──────────────────────────────────────────────
+
+await ta('a case-variant shape does not slip past the gate INTO a dedicated row', async () => {
+  // The gate matches the exact wire value, and so does the shape validator — so a variant
+  // is refused as a bad shape rather than admitted as a cheap one and stored as dedicated.
+  // The property that matters is not WHICH error comes back, it is that no dedicated row
+  // is ever created without the permission.
+  for (const shape of ['DEDICATED', 'Dedicated', ' dedicated', 'dedicated ']) {
+    held = [];
+    lastCreateArgs = null;
+    const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
+    assert.ok(res.status === 400 || res.status === 403, `${JSON.stringify(shape)} → expected refusal, got ${res.status} ${res.raw}`);
+    assert.equal(lastCreateArgs, null, `${JSON.stringify(shape)} must not create a row`);
+  }
+});
+
+await ta('HOSTING_SHAPES still carries exactly the three shapes the gate reasons about', () => {
+  // If a fourth, also-metered shape is ever added, this test is the tripwire that says the
+  // gate's single-shape assumption needs revisiting.
+  assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(), ['co-tenant', 'dedicated', 'standalone']);
+});
+
+server.close();
+console.log(`\nprovisioning_paid_shape_gate: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/wizard_draft_resume.mjs

@@ -0,0 +1,194 @@
+// tests/wizard_draft_resume.mjs — the create wizard survives a round-trip through GitHub
+// (task 1003683).
+//
+// Two defects on the Home step, both found while walking the R24 proof on live:
+//
+//   1. EVERY boot reset the draft to step 1. enter() deliberately renders the name step
+//      before /me settles ("deeper steps carry authenticated side effects"), and its own
+//      comment promises "onAuth() re-enters to the real draft step the moment /me answers".
+//      But show() PERSISTS whatever step it renders, so the placeholder overwrote the
+//      draft's real position with 1 — leaving onAuth() nothing to return to. Granting repo
+//      access from step 5 therefore dumped the visitor back at the name step, every time.
+//      Reproduced live on core 1.19.580: planting {step:5} and reloading read back step 1.
+//
+//   2. "or enter it manually" was a ONE-WAY door. #ghConnect renders only while repoAccess
+//      is 'need-connect', the toggle set repoAccess='manual', and nothing ever set it back
+//      — so the "Allow repo access" button vanished until a full page reload. Navigating
+//      back to step 4 and forward again did not restore it.
+//
+// Harness: there is no jsdom in this repo, so this follows tests/project_door_ui.mjs —
+// slice the real region out of the page's INLINE script and run it in a vm under a minimal
+// DOM stub. The slice boundaries are asserted, so a rename can never leave this file
+// quietly testing nothing.
+//
+// NOT covered here, deliberately: the team shape. The first draft of this task claimed the
+// OAuth hop dropped it; that was wrong — teamShape, projType and modules all survive a
+// reload (verified live). What looked like a drop was the documented "clicking the chosen
+// pill again UNSAYS it" toggle being re-clicked by hand.
+//
+// Run:  node --test --test-reporter=tap tests/wizard_draft_resume.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+
+// ── slice 1 · the step-resolution block inside enter() ────────────────────────────
+const STEP_RE = /var step = authKnown &&[\s\S]*?show\(step, !!focus\);\r?\n\s*\}/;
+const stepSlice = (HUB.match(STEP_RE) || [null])[0];
+
+test('the step-resolution slice is still findable (a rename must fail loudly, not silently pass)', () => {
+  assert.ok(stepSlice, 'enter()\'s step-resolution block was not found in projects.html');
+  assert.match(stepSlice, /show\(1, false\)/, 'the pre-auth placeholder render is part of the slice');
+});
+
+// A faithful miniature of the real show(): the ONE behaviour that matters here is that it
+// writes state.step and then persists the whole state. If show() ever stops persisting,
+// this test still passes for the right reason — the draft keeps the real step either way.
+function runStep({ authKnown, draftStep }) {
+  const store = new Map();
+  const state = { step: draftStep, name: 'probe', teamShape: 'small-team' };
+  store.set('draft', JSON.stringify(state));
+  const rendered = [];
+  const sandbox = {
+    authKnown,
+    state,
+    focus: false,
+    saveDraft() { store.set('draft', JSON.stringify(state)); },
+    show(step) { state.step = step; rendered.push(step); sandbox.saveDraft(); },
+    $: () => ({ focus() {} }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(stepSlice, sandbox);
+  return { rendered, persisted: JSON.parse(store.get('draft')), state };
+}
+
+test('pre-auth: the placeholder renders step 1 but the draft KEEPS the real step', () => {
+  const { rendered, persisted } = runStep({ authKnown: false, draftStep: 5 });
+  assert.deepEqual(rendered, [1], 'still renders the name step before identity settles');
+  assert.equal(persisted.step, 5, 'the draft must not be overwritten with the placeholder');
+});
+
+test('pre-auth: the in-memory step is restored too, so onAuth() can re-enter to it', () => {
+  // onAuth() calls enter() again and reads state.step from MEMORY, not from storage — so
+  // restoring only the stored copy would fix nothing.
+  const { state } = runStep({ authKnown: false, draftStep: 6 });
+  assert.equal(state.step, 6);
+});
+
+test('post-auth: the real step is rendered', () => {
+  const { rendered, persisted } = runStep({ authKnown: true, draftStep: 5 });
+  assert.deepEqual(rendered, [5]);
+  assert.equal(persisted.step, 5);
+});
+
+test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
+  assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
+  // 8 is the done panel, reached by its own branch above this slice; 0 is the gate. Neither
+  // is a resumable wizard position, so the placeholder is allowed to stand.
+  for (const bad of [0, 8, 99]) {
+    assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
+  }
+});
+
+// ── slice 2 · syncHome's control over the way back ────────────────────────────────
+const SYNC_RE = /function syncHome\(\) \{[\s\S]*?\n {4}\}/;
+const syncSlice = (HUB.match(SYNC_RE) || [null])[0];
+
+test('the syncHome slice is still findable', () => {
+  assert.ok(syncSlice, 'syncHome() was not found in projects.html');
+  assert.match(syncSlice, /ghManualBack/, 'syncHome governs the way-back control');
+});
+
+function runSync(repoAccess) {
+  const els = {};
+  // Elements start HIDDEN so that "shown" is only ever the result of syncHome setting it.
+  // With a `hidden: false` default, a control syncHome never mentions reads as visible and
+  // the assertion below would pass against the unfixed page.
+  const el = (id) => (els[id] ||= {
+    id, hidden: true, textContent: '', _on: false,
+    classList: { toggle(_c, v) { els[id]._on = !!v; } },
+  });
+  const sandbox = {
+    repoAccess,
+    state: { mode: 'greenfield' },
+    $: el,
+    isManualHome: () => repoAccess === 'manual' || repoAccess === 'unavailable',
+    initAdoptPicker() {}, syncFresh() {},
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(syncSlice + '\nsyncHome();', sandbox);
+  return { connectShown: el('ghConnect')._on, manualShown: !el('manualHome').hidden, backShown: !el('ghManualBack').hidden };
+}
+
+test('choosing manual leaves a way back to the connect offer', () => {
+  const manual = runSync('manual');
+  assert.equal(manual.manualShown, true, 'the manual fields are up');
+  assert.equal(manual.connectShown, false, 'the connect box is down — that is what made it a trap');
+  assert.equal(manual.backShown, true, 'and the way back is offered');
+});
+
+test('a FORCED fallback offers no way back, because connecting cannot help', () => {
+  // 'unavailable' means the server could not store a token. Offering "use my GitHub
+  // repositories instead" there would send the visitor through a round-trip that lands
+  // them right back here — an offer that cannot be honoured is worse than none.
+  const forced = runSync('unavailable');
+  assert.equal(forced.manualShown, true);
+  assert.equal(forced.backShown, false);
+});
+
+test('while the connect offer is up, the way back is not', () => {
+  const need = runSync('need-connect');
+  assert.equal(need.connectShown, true);
+  assert.equal(need.backShown, false, 'no second, redundant control beside the button itself');
+});
+
+// ── slice 3 · why this task's original team-shape claim was wrong ─────────────────
+// The bug was filed claiming a GitHub round-trip drops the team shape. It does not: a
+// planted draft reads teamShape back intact after a reload (verified live on 1.19.580).
+// The real explanation is this handler — the pill is an UNSAY toggle, so re-clicking the
+// already-chosen shape clears it. During the R24 walk that second click was mine. Pinning
+// it here so the claim rests on the handler's actual behaviour rather than on prose.
+// Anchored on addEventListener: the same selector also appears inside paintTeam(), which
+// only writes aria-pressed. Matching that one instead yields a slice that will not parse.
+const TEAM_RE = /root\.querySelectorAll\('#teamCards \.tpill'\)\.forEach\(function \(b\) \{\s*b\.addEventListener[\s\S]*?\n {4}\}\);/;
+const teamSlice = (HUB.match(TEAM_RE) || [null])[0];
+
+test('the team-pill slice is still findable', () => {
+  assert.ok(teamSlice, 'the #teamCards pill handler was not found in projects.html');
+  assert.match(teamSlice, /state\.teamShape/, 'the handler owns the team-shape answer');
+});
+
+test('the team pill UNSAYS on a second click — the answer is not dropped, it is toggled off', () => {
+  const state = { teamShape: null };
+  const handlers = [];
+  const pill = (team) => ({
+    getAttribute: (a) => (a === 'data-team' ? team : null),
+    addEventListener: (_e, fn) => handlers.push({ team, fn }),
+  });
+  const sandbox = {
+    state,
+    root: { querySelectorAll: () => [pill('solo'), pill('small-team'), pill('community')] },
+    paintTeam() {}, paintDetail() {}, saveDraft() {},
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(teamSlice, sandbox);
+
+  const click = (team) => handlers.find((h) => h.team === team).fn();
+  click('small-team');
+  assert.equal(state.teamShape, 'small-team', 'first click answers');
+  click('small-team');
+  assert.equal(state.teamShape, null, 'the SAME pill again unsays it — this is the mis-read bug');
+  click('small-team');
+  assert.equal(state.teamShape, 'small-team', 'and a third click answers again');
+  click('community');
+  assert.equal(state.teamShape, 'community', 'a DIFFERENT pill replaces rather than clears');
+});