@bongos/core 1.19.623 → 1.19.625

package/tests/cli_sessions.mjs

@@ -28,16 +28,79 @@ const ic  = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
 const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
 
 // SESSION_PATH is frozen at module load from os.homedir(), so anything touching the real save path
-// runs in a child with its own HOME.
+// runs in a child with its own home directory.
+//
+// SETTING `HOME` ALONE IS NOT ISOLATION, AND THE MISS COST REAL CREDENTIALS (task 1003760).
+// On Windows os.homedir() reads USERPROFILE and never consults HOME, so the original
+// `env: { ...process.env, HOME: home }` isolated nothing there: every child below wrote
+// its fixtures into the developer's ACTUAL ~/.config/<instance>/, overwriting the live
+// CLI session with `token:'TOKEN-A', api_base:'https://a.example.com'` and leaving
+// a.example.com.json / b.example.com.json / broken.json in the real session store. The
+// owner had to re-issue a CLI token to recover, and because a claim is bound to the
+// session that created it, the re-auth then orphaned an in-flight claim too.
+//
+// CI is Linux, where HOME *is* honoured — so this can never go red there. Two layers,
+// because the platform list is not knowable in advance:
+//   1. Override every variable a platform might read (USERPROFILE is the Windows one;
+//      HOMEDRIVE/HOMEPATH are the legacy fallback os.homedir() tries next).
+//   2. FAIL CLOSED IN THE CHILD: prove os.homedir() actually landed in the sandbox
+//      BEFORE running any body, and abort if it did not. A future platform that reads
+//      some third variable then fails this test loudly instead of silently eating the
+//      developer's credentials — which is the only outcome that is acceptable for a
+//      test whose whole job is writing to a session store.
+// THE AUDIT THIS FIX OWED, RECORDED HERE RATHER THAN IN A SHIP NOTE. `grep -rn "HOME:"
+// tests/ scripts/` at the time of the fix (task 1003760) found the pattern in ten files.
+// Three already override the Windows variable and are correct: tests/memory_pull.mjs:438,
+// tests/redteam_patrol.mjs:123, tests/setup_device_flow_fallback.mjs:130 — so the
+// convention existed and THIS file simply missed it. Two still set HOME alone and can go
+// FALSE-GREEN on Windows, tracked as task 1003763: tests/cli_package.mjs:140+149 (whose own
+// comment says the temp HOME exists "so a real session file on this machine cannot make a
+// verb look healthier than it is" — on Windows it can) and tests/cli_surface.mjs:174 (which
+// points HOME at a nonexistent dir to simulate "no session", and on Windows sees the real
+// one). Neither DESTROYS anything — this file was the only one writing a session store — so
+// they were filed rather than folded in. Two uses are legitimately HOME-only and must stay:
+// tests/scrubber_corpus.mjs:228 uses HOME:'/root' as corpus DATA, and
+// tests/lib_sh_resolution.mjs exercises POSIX shell resolution where HOME is the subject.
+// They are why closing this class needs an allowlist, not a blanket rule (1003763).
+//
+// Also done off-repo when this landed, and unverifiable from a diff, so stated plainly: the
+// three fixture files this bug left in the REAL session store — a.example.com.json,
+// b.example.com.json, broken.json under ~/.config/<instance>/instances/ — were deleted, and
+// the live session + auth were re-verified afterwards.
+//
+// KNOWN GAP, deliberately left: on Windows this suite now asserts no permission-tightness
+// property at all (see the owner-only test below). NTFS has no POSIX triad, so the real
+// property is the per-user profile ACL; an icacls-style assertion would restore the signal
+// and does not exist here.
+function sandboxEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,                          // Windows: what os.homedir() actually reads
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),     // legacy Windows fallback pair
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
 function inSandbox(body) {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-sess-'));
   try {
     const code = `const R=${JSON.stringify(REPO_ROOT)};
+      const SANDBOX=${JSON.stringify(home)};
+      const os=require('node:os');
+      // Layer 2: refuse to touch a session store outside the sandbox. Runs before the
+      // requires below so not even a module-load side effect can reach the real home.
+      if (os.homedir() !== SANDBOX) {
+        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX
+          + ' — this platform does not take the home override, and writing here would clobber the real session store.');
+        process.exit(2);
+      }
       const lib=require(R+'/scripts/gds/cli-lib.js');
       const ic=require(R+'/src/instance-config.js');
       const fs=require('node:fs'), path=require('node:path');
       (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
-    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: { ...process.env, HOME: home } });
+    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
     return { home, out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
   } finally {
     fs.rmSync(home, { recursive: true, force: true });
@@ -78,6 +141,36 @@ test('the store anchor is FIXED, not brand-derived — that is the whole fix', (
   assert.ok(!/configHome|configDirName|safeBrand/.test(fn), `sessionStoreDir must not read the brand:\n${fn}`);
 });
 
+// ── 1b. The sandbox is really a sandbox ─────────────────────────────────────────────────────
+//
+// These guard the guard (task 1003760). Every test below writes to a session store, so if
+// the isolation is a no-op they write to the DEVELOPER'S store — which is exactly what
+// happened on Windows, where os.homedir() reads USERPROFILE and the original helper set
+// only HOME. A test suite that can delete credentials must prove it cannot before it runs.
+
+test('the sandbox actually relocates os.homedir() — on THIS platform', () => {
+  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ h: require('node:os').homedir() }));`);
+  assert.equal(status, 0, `sandbox child failed: ${out}`);
+  const { h } = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(h, home,
+    'os.homedir() inside the sandbox must BE the sandbox — otherwise every test here writes to the real session store');
+});
+
+test('a session store path resolved inside the sandbox stays inside it', () => {
+  const { out, status, home } = inSandbox(`console.log(JSON.stringify({ p: ic.configPath('gds-session.json'), d: lib.sessionStoreDir() }));`);
+  assert.equal(status, 0, `sandbox child failed: ${out}`);
+  const { p, d } = JSON.parse(out.trim().split('\n').pop());
+  assert.ok(p.startsWith(home), `the active session pointer resolved OUTSIDE the sandbox: ${p}`);
+  assert.ok(d.startsWith(home), `the session store dir resolved OUTSIDE the sandbox: ${d}`);
+});
+
+test('sandboxEnv overrides every home variable a platform might read', () => {
+  const env = sandboxEnv(path.join(os.tmpdir(), 'probe-home'));
+  assert.equal(env.HOME, path.join(os.tmpdir(), 'probe-home'));
+  assert.equal(env.USERPROFILE, env.HOME, 'USERPROFILE is the one Windows reads — the original miss');
+  assert.ok('HOMEDRIVE' in env && 'HOMEPATH' in env, 'the legacy Windows fallback pair must be set too');
+});
+
 // ── 2. A login never destroys another instance's session ────────────────────────────────────
 
 test('signing into a second instance PRESERVES the first — including one written before the store existed', () => {
@@ -127,13 +220,25 @@ test('re-saving the SAME instance is idempotent and files nothing extra', () =>
   assert.equal(r.token, 'T2');
 });
 
+// POSIX MODE BITS DO NOT EXIST ON WINDOWS, so this assertion could never pass there
+// (task 1003760). NTFS has no owner/group/other triad: Node reports 0666 for any
+// writable file and 0444 for a read-only one, and chmod(0o600) is silently a no-op —
+// measured on win32, both before and after an explicit chmod. Asserting '600' there
+// made the unit suite permanently red on every Windows checkout, which is the exact
+// harm task 1003754 names: a test that always fails is how a genuinely failing suite
+// stops being read. So the mode claim is asserted where the platform can express it,
+// and on Windows the file's EXISTENCE is still asserted — the security property has
+// to be met by NTFS ACLs (the per-user profile directory), not by a mode integer.
 test('session files are owner-only', () => {
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
-    const f = fs.statSync(lib.sessionStorePath('https://a.example.com')).mode & 0o777;
+    const p = lib.sessionStorePath('https://a.example.com');
+    const f = fs.statSync(p).mode & 0o777;
     const d = fs.statSync(lib.sessionStoreDir()).mode & 0o777;
-    console.log(JSON.stringify({ file: f.toString(8), dir: d.toString(8) }));`);
+    console.log(JSON.stringify({ file: f.toString(8), dir: d.toString(8), exists: fs.existsSync(p) }));`);
   const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.exists, true, 'the session file must be written wherever we run');
+  if (process.platform === 'win32') return; // no POSIX triad to assert — see above
   assert.equal(r.file, '600', 'a session file holds a bearer token');
   assert.equal(r.dir, '700');
 });

package/tests/session_earnings_mirror_db.mjs

@@ -0,0 +1,250 @@
+// tests/session_earnings_mirror_db.mjs
+//
+// task 1003634 — the session earnings mirror, against a REAL Postgres.
+//
+// WHAT IS BEING PROVEN, and why a fake cannot prove it. The defect was never in
+// JavaScript arithmetic; it was in which credit_log rows a WHERE clause can
+// reach. credit_log pays a builder by two different keys — the per-task streams
+// key on `task_id` and leave session_id NULL, the cost-plus session reward
+// (ADR 0054) keys on `session_id` and leaves task_id NULL — and the mirror
+// summed only the first. A stubbed client would answer whatever the stub was
+// written to answer, which is exactly the assumption under test. So the SQL has
+// to meet a real planner over real columns.
+//
+// NON-DESTRUCTIVE BY CONSTRUCTION: every fixture and credit row is written inside
+// ONE transaction that is ALWAYS rolled back. It never TRUNCATEs, never commits,
+// and is safe to point at a dev database holding real rows. (The precedent and
+// the schema-driven insertRow helper are tests/idea_credit_streams_db.mjs's.)
+//
+// Real-DB (self-skips without Postgres; belongs in the INTEGRATION set).
+//
+// Run:  DATABASE_URL=postgres://... node tests/session_earnings_mirror_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const credits = require('../modules/economy/credits.js');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+let passed = 0;
+let failed = 0;
+// Each test runs inside its own SAVEPOINT: a failure rolls back to it, so one
+// broken assertion cannot abort the transaction and cascade into every test
+// after it.
+let client;
+async function test(name, fn) {
+  await client.query('SAVEPOINT t');
+  try {
+    await fn();
+    passed++; console.log(`  ok  ${name}`);
+    await client.query('RELEASE SAVEPOINT t');
+  } catch (err) {
+    failed++; console.error(`  FAIL ${name}\n    ${err.message}`);
+    await client.query('ROLLBACK TO SAVEPOINT t');
+  }
+}
+
+const schemaCache = new Map();
+async function columnsOf(client, table) {
+  if (schemaCache.has(table)) return schemaCache.get(table);
+  const { rows } = await client.query(
+    `SELECT column_name, data_type, is_nullable, column_default, is_identity
+       FROM information_schema.columns
+      WHERE table_schema = 'public' AND table_name = $1`,
+    [table]
+  );
+  schemaCache.set(table, rows);
+  return rows;
+}
+
+function placeholderFor(dataType, columnName) {
+  switch (dataType) {
+    case 'integer': case 'bigint': case 'smallint':
+    case 'numeric': case 'real': case 'double precision':
+      return 0;
+    case 'boolean': return false;
+    case 'timestamp with time zone': case 'timestamp without time zone': case 'date':
+      return new Date();
+    case 'json': case 'jsonb': return {};
+    case 'ARRAY': return [];
+    default: return `sem-${columnName}`;
+  }
+}
+
+// Identifiers are interpolated because SQL cannot parameterise them. Both are
+// trusted by construction: `table` is a literal from this file, and the column
+// names come from information_schema for that table — never from input.
+async function insertRow(client, table, explicit = {}) {
+  const cols = await columnsOf(client, table);
+  if (cols.length === 0) throw new Error(`table ${table} not found — is this database migrated?`);
+  const values = { ...explicit };
+  for (const c of cols) {
+    if (c.column_name in values) continue;
+    if (c.is_nullable === 'YES') continue;
+    if (c.column_default !== null) continue;
+    if (c.is_identity === 'YES') continue;
+    values[c.column_name] = placeholderFor(c.data_type, c.column_name);
+  }
+  const names = Object.keys(values);
+  const params = names.map((_, i) => `$${i + 1}`);
+  const { rows } = await client.query(
+    `INSERT INTO ${table} (${names.map((n) => `"${n}"`).join(', ')})
+     VALUES (${params.join(', ')}) RETURNING *`,
+    names.map((n) => values[n])
+  );
+  return rows[0];
+}
+
+// The query the mirror used BEFORE this fix — sumCreditsForTasks's predicate,
+// inlined so the bug itself is asserted rather than described. It cannot use
+// credits.sumCreditsForTasks() directly: that reads the module's own pool and so
+// cannot see this transaction's uncommitted rows.
+async function taskKeyedSumOnly(client, builderId, taskIds) {
+  const { rows } = await client.query(
+    `SELECT COALESCE(SUM(delta), 0)::int AS total
+       FROM credit_log WHERE builder_id = $1 AND task_id = ANY($2::bigint[])`,
+    [builderId, taskIds]
+  );
+  return rows[0].total;
+}
+
+// One builder, one shipped task, one session_record linking them.
+async function fixture(client) {
+  const tag = `sem-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const builder = await insertRow(client, 'builders', {
+    github_id: `${tag}-gh`,
+    github_login: tag,
+    display_name: tag,
+    total_credits: 0,
+  });
+  const version = await insertRow(client, 'versions', { id: `${tag}-v`, status: 'building' });
+  const task = await insertRow(client, 'tasks', {
+    title: `${tag} task`,
+    status: 'shipped',
+    version_id: version.id,
+  });
+  const sessionId = `${tag}-session`;
+  await insertRow(client, 'session_records', {
+    session_id: sessionId,
+    builder_id: builder.id,
+    task_ids: [task.id],
+    drachmae_earned: 0,
+    total_tokens: 7823777,
+  });
+  return { builder, task, sessionId };
+}
+
+// Book a cost-plus session reward the way credits.js does: keyed on session_id,
+// with task_id deliberately NULL.
+function sessionReward(client, builderId, sessionId, delta, basis) {
+  return client.query(
+    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description, session_id, reward_basis)
+     VALUES ($1, NULL, $2, 'session.token_reward', $3, $4, $5)`,
+    [builderId, delta, `$${delta} test`, sessionId, basis]
+  );
+}
+
+async function main() {
+  try {
+    client = await pool.connect();
+  } catch {
+    console.log('session_earnings_mirror_db: no Postgres (DATABASE_URL unset/unreachable) — skipping');
+    process.exit(0);
+  }
+
+  await client.query('BEGIN');
+  try {
+    // 1. THE BUG, executable. A session paid purely on cost-plus reads as zero
+    //    through the old predicate — the exact state a builder reported as
+    //    missing pay while the ledger showed them paid.
+    await test('the task-keyed sum alone cannot see a cost-plus session reward (the bug)', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 7, 581);
+
+      assert.equal(await taskKeyedSumOnly(client, builder.id, [task.id]), 0,
+        'the old predicate should report 0 — this is the defect being fixed');
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 7,
+        'the two-key sum must find the 7 drachmae actually paid');
+    });
+
+    // 2. Neither key may be lost when both streams pay the same session.
+    await test('both attribution keys are summed together', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 7, 581);
+      await client.query(
+        `INSERT INTO credit_log (builder_id, task_id, delta, reason, session_id)
+         VALUES ($1, $2, 60, 'task.ship', NULL)`,
+        [builder.id, task.id]
+      );
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 67,
+        'a session paid on both streams must total both');
+    });
+
+    // 3. The OR is one predicate over one scan. A row carrying BOTH keys must be
+    //    summed once — if it were summed per-key, every fix would over-report.
+    await test('a row carrying both keys is counted once, not twice', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await client.query(
+        `INSERT INTO credit_log (builder_id, task_id, delta, reason, session_id)
+         VALUES ($1, $2, 5, 'idea.credit.task_ship:1:2', $3)`,
+        [builder.id, task.id, sessionId]
+      );
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 5,
+        'the doubly-keyed row must contribute 5, not 10');
+    });
+
+    // 4. The figure is SET from ledger state, so re-deriving is a no-op. This is
+    //    what lets every pay-on-land trigger call the sync and lets a re-attempt
+    //    repair a stale row instead of inflating a correct one.
+    await test('re-deriving is idempotent across a top-up', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 18, 1496);
+      const first = await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId);
+      const again = await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId);
+      assert.equal(first, 18);
+      assert.equal(again, 18, 'the same ledger state must yield the same figure');
+
+      // A second ship in the same session tops the reward up at a higher basis.
+      await sessionReward(client, builder.id, sessionId, 35, 4403);
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 53,
+        'a top-up must be reflected in full, not added to a stale total');
+    });
+
+    // 5. Degenerate inputs must not become an unfiltered scan of the ledger.
+    await test('no keys means zero, never an unscoped sum', async () => {
+      const { builder, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 9, 750);
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, [], null), 0);
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, null, null), 0);
+      // A session key alone is enough — the cost-plus-only case.
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, [], sessionId), 9);
+    });
+
+    // 6. Another builder's rows are never reachable, whichever key matches.
+    await test('the sum stays scoped to one builder', async () => {
+      const a = await fixture(client);
+      const b = await fixture(client);
+      await sessionReward(client, a.builder.id, a.sessionId, 7, 581);
+      await sessionReward(client, b.builder.id, b.sessionId, 99, 8250);
+      assert.equal(
+        await credits.sumSessionEarnings(client, a.builder.id, [a.task.id, b.task.id], a.sessionId), 7,
+        "another builder's credits must not leak in via a shared task id");
+    });
+  } finally {
+    await client.query('ROLLBACK');
+    client.release();
+    await pool.end();
+  }
+
+  console.log(`\nsession_earnings_mirror_db: ${passed} passed, ${failed} failed`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((err) => { console.error(err); process.exit(1); });