@bongos/core 1.19.625 → 1.19.627

package/tests/profile_activity.mjs

@@ -35,6 +35,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { assertCannotSwallow } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -79,11 +80,9 @@ const ideaRouter = ideaRoutesFactory({});
 const mountedPaths = ideaRouter.stack.filter((l) => l.route).map((l) => l.route.path);
 
 await test('GET /inbox/by-builder/:id is declared BEFORE GET /inbox/:id', () => {
-  const trail = mountedPaths.indexOf('/inbox/by-builder/:id');
-  const byId = mountedPaths.indexOf('/inbox/:id');
-  assert.ok(trail > -1, 'the trail route is mounted');
-  assert.ok(byId > -1, 'the by-id route is mounted');
-  assert.ok(trail < byId, `/inbox/by-builder/:id (${trail}) must precede /inbox/:id (${byId}) or :id swallows it`);
+  // Order OR a constrained param — either makes the trail route reachable. See
+  // assertCannotSwallow in tests/helpers.mjs (task 1003747).
+  assertCannotSwallow(assert, mountedPaths, '/inbox/by-builder/:id', '/inbox/:id');
 });
 
 // ---------------------------------------------------------------------------

package/tests/prose_edits.mjs

@@ -160,7 +160,12 @@ await test('ROUTE SHAPE: the triage-gated PATCH /inbox/:id was NOT widened to re
   assert.ok(row, 'the triage route still exists');
   assert.equal(row.rank, 'metic+archon', 'PATCH /inbox/:id must keep its triage-level gate');
   const src = readFileSync(new URL('../modules/ideas/routes/inbox.js', import.meta.url), 'utf8');
-  const start = src.indexOf("router.patch('/inbox/:id',");
+  // Tolerate an inline param constraint on the path — `'/inbox/:id(\d+)'` (task
+  // 1003747, which added one so this route stops swallowing another module's
+  // `/inbox/rotting`). Matching the bare literal made this test report the triage
+  // route as missing when only its MATCHER had been narrowed. The route key above
+  // is canonicalised for the same reason (src/bongos/route-rank-check.js).
+  const start = src.search(/router\.patch\('\/inbox\/:id(?:\([^)]*\))?',/);
   const body = src.slice(start, src.indexOf('router.', start + 20));
   // Assert on the VALIDATION SCHEMA, not on any mention of the string: that route
   // already discusses body_md in a comment (about it not being parseable as a

package/tests/rank_floor_wiring.mjs

@@ -0,0 +1,135 @@
+// tests/rank_floor_wiring.mjs — the rank floor is WIRED, not merely derivable
+// (task 1003663, goal 1000111, ADR 0270).
+//
+// WHY THIS FILE EXISTS SEPARATELY FROM tests/rank_gate.mjs. That file pins the
+// PURE helpers — `deriveRequiredRank` / `highestRank` — by handing them opts it
+// builds itself. That is necessary and it is not sufficient: the whole defect
+// ADR 0270 repairs was a derivation that was perfectly correct and never
+// REACHED, because the input it needed (`touches[]`) stopped arriving at the
+// call site. A test that constructs the inputs by hand cannot catch that class
+// of bug a second time — it asserts the calculator, not the plumbing.
+//
+// So this file drives the real `createTask` against a SQL-aware client and reads
+// the `requires_rank` actually bound into the INSERT, plus the two PATCH setters
+// that can move a floor input after creation.
+//
+// Run:  node --test tests/rank_floor_wiring.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient, lifecycleDbSource } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { createTask } = require('../modules/lifecycle/db.js');
+
+// The INSERT binds ~25 columns positionally, so a hardcoded params[20] would be a
+// silent lie the first time somebody inserts a column. Read the column list out of
+// the statement under test and resolve the index by NAME.
+function boundValue(sql, params, column) {
+  const cols = String(sql).slice(sql.indexOf('(') + 1, sql.indexOf(')'))
+    .split(',').map((c) => c.trim());
+  const i = cols.indexOf(column);
+  assert.notEqual(i, -1, `INSERT INTO tasks no longer binds a '${column}' column — update this test`);
+  return params[i];
+}
+
+// One create against a fake goal row; returns the requires_rank the INSERT bound.
+async function createdFloor({ scopeModules, needsMigration = false, requiresRank = null }) {
+  let insert = null;
+  const { _client } = makeSqlAwareClient(async (sql, params) => {
+    if (/^SELECT scope_modules FROM goals/i.test(sql)) {
+      return { rows: [{ scope_modules: scopeModules }] };
+    }
+    if (/^INSERT INTO tasks/i.test(sql)) {
+      insert = { sql, params };
+      return { rows: [{ id: '9001' }] };
+    }
+    return { rows: [] };
+  });
+
+  await createTask({
+    versionId: 'BONGOS-V2',
+    title: 'a task',
+    goalId: '1000111',
+    needsMigration,
+    requiresRank,
+  }, { client: _client });
+
+  assert.ok(insert, 'createTask never reached its INSERT');
+  return boundValue(insert.sql, insert.params, 'requires_rank');
+}
+
+// ---------------------------------------------------------------------------
+// createTask — the create path actually reads the goal wall
+// ---------------------------------------------------------------------------
+
+test('a goal whose wall reaches protected territory floors the task at metic', async () => {
+  // No touches[], not security_sensitive, not a migration — every pre-0270 input
+  // is absent, which is precisely the shape that used to come out 'xenos'.
+  assert.equal(await createdFloor({ scopeModules: ['hall-ui', 'kernel'] }), 'metic');
+});
+
+test('an unprotected wall leaves the task in the open queue', async () => {
+  assert.equal(await createdFloor({ scopeModules: ['hall-ui'] }), 'xenos');
+});
+
+test('needs_migration floors at metic even under an unprotected wall', async () => {
+  assert.equal(await createdFloor({ scopeModules: ['hall-ui'], needsMigration: true }), 'metic');
+});
+
+test('THE REGRESSION: the create path reads the wall, it does not just own a helper', async () => {
+  // Mutation guard. If someone drops the goalScopeProtected call from createTask
+  // — the exact way this bug happened the first time, by a caller ceasing to
+  // supply an input — the pure tests in rank_gate.mjs all still pass and this one
+  // fails. That asymmetry is the point of the file.
+  assert.equal(await createdFloor({ scopeModules: ['lifecycle'] }), 'metic');
+  assert.equal(await createdFloor({ scopeModules: ['government'] }), 'metic');
+});
+
+test('an explicit requires_rank still only RAISES, never lowers the derived floor', async () => {
+  assert.equal(await createdFloor({ scopeModules: ['kernel'], requiresRank: 'xenos' }), 'metic');
+  assert.equal(await createdFloor({ scopeModules: ['hall-ui'], requiresRank: 'archon' }), 'archon');
+});
+
+test('a missing goal row is the honest false, not a throw', async () => {
+  // scope_modules is NOT NULL DEFAULT '{}', but a goal deleted mid-transaction
+  // returns no row at all. That must fall through to the other arms, not crash a
+  // create.
+  assert.equal(await createdFloor({ scopeModules: undefined }), 'xenos');
+  assert.equal(await createdFloor({ scopeModules: undefined, needsMigration: true }), 'metic');
+});
+
+// ---------------------------------------------------------------------------
+// The PATCH setters — a floor INPUT may be flipped after creation
+// ---------------------------------------------------------------------------
+// These two write through the module-level pool rather than an injectable client,
+// so they are pinned at the source. The assertion is narrow on purpose: it is the
+// RATCHET that matters (raise on true, never lower), not the surrounding SQL.
+
+test('updateTaskNeedsMigration ratchets requires_rank UP, exactly like its security_sensitive sibling', () => {
+  const src = lifecycleDbSource();
+  const setter = src.slice(src.indexOf('async function updateTaskNeedsMigration'));
+  const body = setter.slice(0, setter.indexOf('\n}\n') + 1);
+
+  assert.match(
+    body.replace(/\s+/g, ' '),
+    /requires_rank = CASE WHEN \$1 AND requires_rank IN \('xenos', 'thetes'\) THEN 'metic' ELSE requires_rank END/,
+    'PATCHing needs_migration=true must raise the floor — otherwise ADR 0270 is closed on the create path and open on the PATCH path'
+  );
+  // Raise-only: nothing in the setter may write a rank BACK DOWN when the flag
+  // clears. An existing metic may be a protected-scope floor or an Archon override.
+  assert.doesNotMatch(body, /ELSE 'xenos'/, 'the setter must never lower an existing floor');
+});
+
+test('both floor-input setters share one ratchet — neither may drift from the other', () => {
+  const src = lifecycleDbSource();
+  const ratchet = /requires_rank = CASE WHEN \$1 AND requires_rank IN \('xenos', 'thetes'\)\s+THEN 'metic' ELSE requires_rank END/g;
+  const hits = src.match(ratchet) || [];
+  assert.equal(
+    hits.length, 2,
+    `expected the ratchet in exactly 2 setters (security_sensitive + needs_migration), found ${hits.length} — ` +
+    'a new boolean that feeds deriveRequiredRank needs one too, and a removed one is a reopened gap'
+  );
+});

package/tests/rank_gate.mjs

@@ -399,6 +399,51 @@ t('empty / null / undefined touches with no sensitivity => xenos (no throw)', ()
   assert.equal(db.deriveRequiredRank(undefined, undefined), 'xenos');
 });
 
+// ---------------------------------------------------------------------------
+// task 1003663 / ADR 0270 — the two touches-FREE inputs. ADR 0049 retired
+// predictive touches[], so at CREATE time the arms above see an empty array on
+// most vectors and the floor never rose: 68 of 88 needs_migration tasks sat at
+// xenos, one of them a ready task to rewrite the auth token store. These pin the
+// replacement, which derives from facts a task carries WITHOUT a prediction.
+// ---------------------------------------------------------------------------
+console.log('\nderiveRequiredRank (the touches-free floors — task 1003663):');
+
+t('needs_migration floors at metic with NO touches at all', () => {
+  assert.equal(db.deriveRequiredRank([], false, { needsMigration: true }), 'metic');
+  assert.equal(db.deriveRequiredRank(null, false, { needsMigration: true }), 'metic');
+});
+
+t('a protected goal scope floors at metic with NO touches at all', () => {
+  assert.equal(db.deriveRequiredRank([], false, { scopeProtected: true }), 'metic');
+  assert.equal(db.deriveRequiredRank(null, false, { scopeProtected: true }), 'metic');
+});
+
+t('THE REGRESSION: the exact shape of task 1003372 (ready, migration, no touches)', () => {
+  // Before ADR 0270 this returned 'xenos' — a Xenos could claim a task to hash
+  // the builder_sessions token store at rest. It must never do so again.
+  assert.equal(
+    db.deriveRequiredRank([], false, { needsMigration: true, scopeProtected: false }),
+    'metic'
+  );
+});
+
+t('the flags are opt-in: false / absent / non-boolean never RAISE the floor', () => {
+  // Only a strict === true raises, so a stray truthy value cannot quietly wall
+  // off the open queue (the fail-closed direction here is "stay open").
+  assert.equal(db.deriveRequiredRank([], false, {}), 'xenos');
+  assert.equal(db.deriveRequiredRank([], false, { needsMigration: false, scopeProtected: false }), 'xenos');
+  assert.equal(db.deriveRequiredRank([], false, { needsMigration: 'yes' }), 'xenos');
+  assert.equal(db.deriveRequiredRank([], false, { needsMigration: 1 }), 'xenos');
+});
+
+t('omitting opts entirely is the pre-0270 two-argument behaviour, unchanged', () => {
+  // Every existing call site passes two arguments; none may change meaning.
+  assert.equal(db.deriveRequiredRank([], false), 'xenos');
+  assert.equal(db.deriveRequiredRank(['public/game/main.js'], false), 'xenos');
+  assert.equal(db.deriveRequiredRank(['migrations/145_x.sql'], false), 'metic');
+  assert.equal(db.deriveRequiredRank([], true), 'metic');
+});
+
 console.log('\nhighestRank (compose floor with an override; raise-only):');
 
 t('picks the higher-authority rank either way', () => {

package/tests/route_shadow_guard.mjs

@@ -0,0 +1,215 @@
+// tests/route_shadow_guard.mjs — the guard that keeps a `:param` route from
+// swallowing a literal route mounted after it (task 1003747).
+//
+// GET /inbox/rotting answered 400 bad_id in production for releases: `ideas`
+// mounts GET /inbox/:id before `lifecycle` mounts GET /inbox/rotting, so the param
+// matched first and ended the request before the rot handler was reached. The
+// whole 30-day rot cadence was dead, and the hall's only caller swallowed the
+// error into an empty section that looked like "nothing is rotting".
+//
+// The guard is tested on SYNTHETIC mount sequences, not only the live tree: a scan
+// that passes because the tree is clean today proves nothing about what it
+// REFUSES. The live-tree case at the bottom is what proves the real fix holds.
+//
+// Run:  node tests/route_shadow_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const {
+  checkNoRouteShadowing,
+  findShadowPairs,
+  mountSequence,
+  isBareParam,
+  isConstrainedParam,
+} = require('../scripts/gds/route-shadow-guard.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const r = (module_, file, method, route) => ({ module: module_, file, method, route });
+
+// --- THE DEFECT, EXACTLY AS IT SHIPPED -------------------------------------
+
+test('catches the real pair: GET /inbox/:id mounted before GET /inbox/rotting', () => {
+  const pairs = findShadowPairs([
+    r('ideas', 'modules/ideas/routes/inbox.js', 'get', '/inbox/:id'),
+    r('lifecycle', 'modules/lifecycle/routes/rot.js', 'get', '/inbox/rotting'),
+  ]);
+  assert.equal(pairs.length, 1);
+  assert.equal(pairs[0].early.route, '/inbox/:id');
+  assert.equal(pairs[0].later.route, '/inbox/rotting');
+});
+
+test('the check hard-fails on that sequence, and names the fall-through fix', () => {
+  const out = checkNoRouteShadowing({
+    sequence: [
+      r('ideas', 'modules/ideas/routes/inbox.js', 'get', '/inbox/:id'),
+      r('lifecycle', 'modules/lifecycle/routes/rot.js', 'get', '/inbox/rotting'),
+    ],
+  });
+  assert.equal(out.ok, false);
+  assert.equal(out.hardFail, true);
+  assert.equal(out.violations.length, 1);
+  assert.match(out.violations[0], /\/inbox\/rotting/);
+  assert.match(out.violations[0], /never reaches its handler/);
+  assert.match(out.violations[0], /\\d\+/, 'points at constraining the param');
+});
+
+// --- WHAT THE FIX DOES -----------------------------------------------------
+
+test('a CONSTRAINED param shadows nothing — this is what the fix relies on', () => {
+  const pairs = findShadowPairs([
+    r('ideas', 'modules/ideas/routes/inbox.js', 'get', '/inbox/:id(\\d+)'),
+    r('lifecycle', 'modules/lifecycle/routes/rot.js', 'get', '/inbox/rotting'),
+  ]);
+  assert.deepEqual(pairs, []);
+});
+
+test('order matters: a literal mounted BEFORE the param is fine', () => {
+  const pairs = findShadowPairs([
+    r('ideas', 'modules/ideas/routes/inbox.js', 'get', '/inbox/awaiting-nod'),
+    r('ideas', 'modules/ideas/routes/inbox.js', 'get', '/inbox/:id'),
+  ]);
+  assert.deepEqual(pairs, [], 'declaring literals first is the in-file convention and stays legal');
+});
+
+// --- WHAT MUST NOT BE FLAGGED ---------------------------------------------
+
+test('different methods never compete', () => {
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/inbox/:id'),
+    r('b', 'b.js', 'patch', '/inbox/rotting'),
+  ]), []);
+});
+
+test('different depths never compete', () => {
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/inbox/:id'),
+    r('b', 'b.js', 'get', '/inbox/rotting/detail'),
+  ]), []);
+});
+
+test('two params at the same position are one shape, not a shadow', () => {
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/inbox/:id'),
+    r('b', 'b.js', 'get', '/inbox/:ideaId'),
+  ]), []);
+});
+
+test('a differing earlier literal segment means the routes never overlap', () => {
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/inbox/:id'),
+    r('b', 'b.js', 'get', '/blockers/rotting'),
+  ]), []);
+});
+
+test('the param must sit WHERE the literal is', () => {
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/tasks/:id/water'),
+    r('b', 'b.js', 'get', '/tasks/rotting/water'),
+  ]).length, 1, 'same position, so it does shadow');
+  assert.deepEqual(findShadowPairs([
+    r('a', 'a.js', 'get', '/tasks/:id/water'),
+    r('b', 'b.js', 'get', '/tasks/:id/rotting'),
+  ]), [], 'literal in a position the param does not occupy');
+});
+
+// --- SEGMENT CLASSIFIERS ---------------------------------------------------
+
+test('bare vs constrained param', () => {
+  assert.equal(isBareParam(':id'), true);
+  assert.equal(isBareParam(':id(\\d+)'), false);
+  assert.equal(isBareParam('rotting'), false);
+  assert.equal(isConstrainedParam(':id(\\d+)'), true);
+  assert.equal(isConstrainedParam(':id'), false);
+});
+
+// --- SCAN INTEGRITY --------------------------------------------------------
+
+test('an empty enumeration is a scan DEFECT, never a clean pass', () => {
+  const out = checkNoRouteShadowing({ sequence: [] });
+  assert.equal(out.ok, false);
+  assert.equal(out.hardFail, true);
+  assert.match(out.violations[0], /scan defect/);
+});
+
+// --- THE LIVE TREE ---------------------------------------------------------
+
+test('the real repo enumerates routes and has no shadowing pair', () => {
+  const seq = mountSequence();
+  assert.ok(seq.length > 100, `expected a real mount sequence, got ${seq.length}`);
+  const out = checkNoRouteShadowing();
+  assert.equal(out.hardFail, false, `live tree has shadowing pairs:\n${out.violations.join('\n')}`);
+});
+
+test('the live tree still declares the rot feed and the constrained idea read', () => {
+  const seq = mountSequence();
+  const rot = seq.find((x) => x.route === '/inbox/rotting' && x.method === 'get');
+  assert.ok(rot, 'GET /inbox/rotting must still be declared');
+  const idea = seq.find((x) => x.route.startsWith('/inbox/:id') && x.method === 'get');
+  assert.ok(idea, 'GET /inbox/:id must still be declared');
+  assert.ok(isConstrainedParam(idea.route.split('/').filter(Boolean)[1]),
+    `GET ${idea.route} must constrain its id, or it eats /inbox/rotting again`);
+});
+
+// --- THE BEHAVIOUR THE FIX DEPENDS ON -------------------------------------
+//
+// The static guard above proves the DECLARATION is constrained. This proves the
+// constraint actually routes that way in the Express version we ship — and it is
+// not a formality: Express 5 REMOVED inline param regexes, so an upgrade would
+// silently turn `:id(\d+)` back into a path that eats /inbox/rotting, with the
+// static check still passing because the declaration text is unchanged. This is
+// the test that goes red on that upgrade.
+
+async function behaviour() {
+  const express = require('express');
+  const http = require('node:http');
+  const app = express();
+
+  // Mounted in the SAME order the real loader mounts them: `ideas` (the param
+  // route) before `lifecycle` (the literal).
+  const ideas = express.Router();
+  ideas.get('/inbox/:id(\\d+)', (req, res) => res.json({ handler: 'idea', id: req.params.id }));
+  const lifecycle = express.Router();
+  lifecycle.get('/inbox/rotting', (_req, res) => res.json({ handler: 'rot' }));
+  app.use(ideas);
+  app.use(lifecycle);
+
+  const server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try {
+    const rot = await fetch(`${base}/inbox/rotting`);
+    const rotBody = await rot.json();
+    test('GET /inbox/rotting reaches the ROT handler despite being mounted second', () => {
+      assert.equal(rot.status, 200);
+      assert.equal(rotBody.handler, 'rot');
+    });
+
+    const idea = await fetch(`${base}/inbox/1234`);
+    const ideaBody = await idea.json();
+    test('a numeric id still reaches the idea handler', () => {
+      assert.equal(idea.status, 200);
+      assert.equal(ideaBody.handler, 'idea');
+      assert.equal(ideaBody.id, '1234');
+    });
+
+    const junk = await fetch(`${base}/inbox/not-a-number`);
+    test('an unmatched non-numeric segment 404s instead of 400 — the accepted trade-off', () => {
+      assert.equal(junk.status, 404);
+    });
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+await behaviour();
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);