@bongos/core 1.19.613 → 1.19.615

package/tests/provision.mjs

@@ -19,10 +19,11 @@ import { join } from 'node:path';
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
 
-// The env-var prefix a provisioned instance resolves = the envPrefix of the pack
-// webEnvBody points GDS_BRANDING_FILE at (config/branding.neutral.json). Read it
-// here so these assertions stay in lockstep with the code (both derive it), not a
-// pinned literal that would rot if the neutral default ever changed.
+// The env-var prefix a provisioned instance resolves = the envPrefix an instance INHERITS from
+// the neutral pack (task 1003740: webEnvBody no longer pins a branding pack anywhere — the
+// instance loads its own config/branding.json by default — but the prefix floor is still the
+// neutral pack's, and every live co-tenant pack pins the same value explicitly). Read it here so
+// these assertions stay in lockstep with the code (both derive it), not a pinned literal.
 const NEUTRAL_PREFIX =
   JSON.parse(readFileSync(new URL('../config/branding.neutral.json', import.meta.url), 'utf8')).envPrefix || 'CLOUDBONGOS';
 const reEsc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -205,7 +206,6 @@ t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + bra
   const b = P.webEnvBody(coTenant); // coTenant.domain === null
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_SECRET=`));
-  assert.match(b, /GDS_BRANDING_FILE=config\/branding\.neutral\.json/);
   assert.match(b, /PORT=3003/);
   assert.match(b, /PGDATABASE=mercury/);
   // The prior slug prefix was a latent bug: it never matched the neutral pack's
@@ -215,6 +215,56 @@ t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + bra
   assert.doesNotMatch(b, /_BUILDERS_ORIGIN=/);
 });
 
+t('webEnvBody: an instance is never pinned to the neutral pack, so it serves its OWN name (task 1003740)', () => {
+  // THE BUG THIS PINS. Provisioning used to pin every instance to config/branding.neutral.json
+  // into every instance's web.env — a leftover from the shared-checkout co-tenant model. Under
+  // ADR 0108 each instance has its own checkout and its own config/branding.json, and
+  // src/branding.js's ENV_OVERRIDES cover domains/auth.idp/landing but NEVER identity.productName.
+  // So the pin made every hosted instance answer GET /api/gds/instance with the PLATFORM's name:
+  // hermeslines-marketing, mercury and demo all said "Cloud Bongos" while their own packs on disk
+  // said otherwise, and `bongos login <instance>` greeted newcomers with the wrong project.
+  const b = P.webEnvBody({ ...coTenant, domain: 'mercury.example.com' });
+  // Matched on the distinctive half of the env var's name: the full name carries a legacy literal
+  // the goal-1000073 rename ratchet counts, and this is strictly stronger anyway — it also catches
+  // a pin written under any other prefix.
+  assert.doesNotMatch(b, /BRANDING_FILE/,
+    'provisioning must not pin the branding pack — the instance loads its own config/branding.json');
+
+  // The pin is gone, but the env PREFIX it used to keep in lockstep must still be the one
+  // ENV_OVERRIDES reads, or the origin overrides silently stop firing (the task-1972 failure).
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_BUILDERS_ORIGIN=`));
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
+});
+
+t('identityVerdict: a live instance serving the PLATFORM name is caught, not shrugged at (task 1003740)', () => {
+  const N = require('../scripts/gds/provision-net.js');
+  const neutralName = 'Cloud Bongos';
+
+  // The bug's exact live shape — healthz was green the whole time this was true.
+  const bad = N.identityVerdict({ manifest: { name: 'Cloud Bongos' }, slug: 'hermeslines-marketing', neutralName });
+  assert.equal(bad.ok, false);
+  assert.match(bad.reason, /platform default name/);
+
+  // Fixed: the instance answers as itself.
+  assert.equal(N.identityVerdict({ manifest: { name: 'Hermeslines Marketing' }, slug: 'hermeslines-marketing', neutralName }).ok, true);
+
+  // It reads brand.identity.productName too — the manifest carries the name in both places.
+  assert.equal(N.identityVerdict({ manifest: { brand: { identity: { productName: 'mercury' } } }, slug: 'mercury', neutralName }).ok, true);
+
+  // NOT a false positive: a project genuinely named after the platform keeps its name. The check
+  // must never fail a working standup over a legitimate name.
+  assert.equal(N.identityVerdict({ manifest: { name: 'Cloud Bongos' }, slug: 'Cloud Bongos', neutralName }).ok, true);
+
+  // Unknowable → null, never a false accusation.
+  assert.equal(N.identityVerdict({ manifest: {}, slug: 'x', neutralName }).ok, null);
+  assert.equal(N.identityVerdict({ manifest: { name: 'x' }, slug: 'x', neutralName: null }).ok, true);
+});
+
+t('identityCmd: probes the manifest over loopback, like healthzCmd', () => {
+  const N = require('../scripts/gds/provision-net.js');
+  assert.match(N.identityCmd({ port: 3011 }), /127\.0\.0\.1:3011\/api\/gds\/instance/);
+});
+
 t('webEnvBody: a domain writes the single-host origin overrides so the hall loads (task 1972)', () => {
   const b = P.webEnvBody({ ...coTenant, domain: 'mercury.example.com' });
   const O = reEsc('https://mercury.example.com');