@bongos/core 1.19.64 → 1.19.66

package/tests/public_landing_projects.mjs

@@ -0,0 +1,121 @@
+// tests/public_landing_projects.mjs — the owner's my-projects surface (task
+// 1002693, goal 1000059 / gap 6 of the creation-flow audit): after the /create
+// tab closes an owner was blind to their own instances — only create.html read
+// GET /provisioning/instances, and it was sessionStorage-bound. /projects is the
+// durable place to find, watch, and manage them without the original tab.
+//
+// Covers (DB-free — static HTML over the platform app, runs in the unit gate):
+//   • GET /projects on the apex serves the branding-injected projects page
+//   • /projects is apex-only — the builders/status hosts never serve it (the
+//     /create precedent: landing pages belong to the apex host)
+//   • the page drives ONLY the own-scoped provisioning surface: list, per-id
+//     watch (the create.html poll pattern), teardown, domain-attach — and
+//     carries the truthful refusal copy for each (task 1002691/1002692 lessons:
+//     intent_conflict, not_teardownable, bad_domain, domain_taken,
+//     domain_already_set, domain_not_attachable are all SAID, never swallowed)
+//   • an instance with no domain gets an HONEST no-address state, not a blank
+//   • create.html's poll give-up now points at /projects — the false "the hall
+//     has it" stop (the hall my-projects card was removed in task 1002675) is gone
+//
+// Run:  node --test tests/public_landing_projects.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import platformMod from '../src/platform-server.js';
+
+const { buildPlatformApp } = platformMod;
+
+let server;
+let port;
+
+before(async () => {
+  const app = buildPlatformApp();
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+
+after(async () => {
+  await new Promise((resolve) => server.close(resolve));
+});
+
+// Explicit Host header so the apex / builders.* / status.* routing is exercised
+// (fetch treats `host` as forbidden — the platform_boot.mjs helper).
+function request(pathname, host = '127.0.0.1') {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, path: pathname, method: 'GET', headers: { Host: host } },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the apex host serves the branded /projects page', async () => {
+  const res = await request('/projects', 'game.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.headers['content-type'] || '', /text\/html/);
+  // branding-injected exactly like the landing + /create (same landingPage memo)
+  assert.match(res.body, /window\.__BRANDING__=/);
+  // the page's own shell, not the 404 tail or a stray document
+  assert.match(res.body, /id="projectsList"/);
+  assert.doesNotMatch(res.body, /404 — not found/);
+});
+
+test('/projects is apex-only — the builders and status hosts never serve it', async () => {
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    const res = await request('/projects', host);
+    assert.doesNotMatch(res.body, /id="projectsList"/, `${host} must not serve the projects page`);
+  }
+});
+
+test('the page drives the own-scoped provisioning surface: list, watch, teardown, domain', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // list + per-id watch (the create.html:1034 poll pattern — GET, own-scoped)
+  assert.match(body, /provisioning\/instances/);
+  // manage: request teardown + attach an address — both ENQUEUE-only routes
+  // (ADR 0111 §2: this page can only ask; the control-plane runner acts)
+  assert.match(body, /\/teardown/);
+  assert.match(body, /\/domain/);
+  // it never reaches for archon/fleet surfaces
+  assert.doesNotMatch(body, /provisioning\/fleet/);
+});
+
+test('every truthful refusal the API can give is mapped to human copy, never swallowed', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  for (const code of [
+    'intent_conflict',        // an open run holds the slot (tasks 1002691/1002692)
+    'not_teardownable',       // teardown refused for the real state
+    'bad_domain',             // malformed hostname
+    'domain_taken',           // another instance already answers there
+    'domain_already_set',     // re-pointing is not this surface
+    'domain_not_attachable',  // mid-flight/torn-down states refuse truthfully
+  ]) {
+    assert.match(body, new RegExp(code), `the page must handle '${code}' explicitly`);
+  }
+});
+
+test('a domainless instance gets an honest no-address state', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /[Nn]o address yet/);
+});
+
+test('the empty state points a new owner at /create — never at a hall', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /href="\/create"/);
+  // the hall my-projects card was REMOVED (task 1002675; hall my-projects is
+  // federation-only) — this page must not send an owner there
+  assert.doesNotMatch(body, /Enter the Hall/i);
+});
+
+test('create.html: the poll give-up points at /projects — "the hall has it" is dead', async () => {
+  const { body } = await request('/create', 'game.test.local');
+  assert.match(body, /\/projects/, 'the give-up path must hand the owner the projects page');
+  assert.doesNotMatch(body, /the hall has it/, 'the false poll-stop copy must be gone');
+});

package/tests/upgrade.mjs

@@ -935,6 +935,100 @@ t('healDocAssets: a generator absent from this core is recorded, not spawned', (
   assert.equal(spawned.length, 1, 'the absent script is never spawned');
 });
 
+// --- module maintenance & deprecation surfacing (ADR 0107 §7 / ADR 0166, task 1001773) ---
+//
+// The bug this pins: preflightModules used to return ONLY `blocking`, so a DISABLED module
+// whose coreVersion the target core no longer satisfies vanished from a real bump entirely.
+// An accepted catalog module ships default:false (ADR 0107 §6) — so that was every rotted
+// catalog entry, silently.
+
+// A modules/ dir on disk that preflightModules will really discover, driven through a stub
+// moduleLib so the verdict shape (not the loader) is what's under test.
+function moduleLibStub(verdict) {
+  return { gatherUpgrade: () => ({ rows: verdict.rows || [], errors: [], core: verdict.core }), evaluateUpgrade: () => verdict };
+}
+
+t('preflightModules: a DISABLED incompatible module is returned as a warning, not dropped', () => {
+  const dir = scratchConsumer();
+  mkdirSync(join(dir, 'modules'), { recursive: true });
+  const warned = { key: 'stale-catalog-entry', coreVersion: '^1.0.0', enabled: false, satisfied: false, maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } };
+  const res = u.preflightModules({ instanceDir: dir, targetVersion: '2.0.0' }, {
+    moduleLib: moduleLibStub({ ok: true, blocking: [], warnings: [warned], deprecations: [], expired: [], core: '2.0.0' }),
+  });
+  assert.equal(res.ok, true, 'a disabled mismatch must never block the bump');
+  assert.deepEqual(res.warnings.map((w) => w.key), ['stale-catalog-entry']);
+  assert.match(res.note, /1 disabled module\(s\) do NOT/, 'the headline note admits the rot instead of claiming all-clear');
+});
+
+t('preflightModules: with everything healthy the note stays the plain all-clear', () => {
+  const dir = scratchConsumer();
+  mkdirSync(join(dir, 'modules'), { recursive: true });
+  const res = u.preflightModules({ instanceDir: dir, targetVersion: '2.0.0' }, {
+    moduleLib: moduleLibStub({ ok: true, blocking: [], warnings: [], deprecations: [], expired: [], core: '2.0.0' }),
+  });
+  assert.equal(res.note, 'all enabled modules satisfy the target');
+  assert.deepEqual(res.warnings, []);
+});
+
+t('preflightModules: no modules/ dir returns every collection empty (a vanilla consumer)', () => {
+  const dir = scratchConsumer();
+  const res = u.preflightModules({ instanceDir: dir, targetVersion: '2.0.0' });
+  assert.equal(res.ok, true);
+  for (const k of ['blocking', 'warnings', 'deprecations', 'expired']) assert.deepEqual(res[k], [], k);
+});
+
+t('reportModulePreflight: prints the rotted-but-disabled module WITH its maintainer named', () => {
+  const out = [];
+  const mods = {
+    warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' } }],
+    deprecations: [], expired: [],
+  };
+  u.reportModulePreflight(mods, '2.0.0', { log: (s) => out.push(s), err: (s) => out.push(s) });
+  const text = out.join('\n');
+  assert.match(text, /stale-catalog-entry/);
+  assert.match(text, /silently fail to mount/);
+  assert.match(text, /maintainer Ada <ada@example\.com>/);
+});
+
+t('reportModulePreflight: calls out a deprecation the core has already passed removeAfter', () => {
+  const out = [];
+  const dep = { key: 'sunset', maintenance: { status: 'deprecated', successor: 'newer', removeAfter: '1.12.0' } };
+  u.reportModulePreflight({ warnings: [], deprecations: [dep], expired: [dep] }, '1.13.0', { log: (s) => out.push(s), err: (s) => out.push(s) });
+  const text = out.join('\n');
+  assert.match(text, /module "sunset" is deprecated/);
+  assert.match(text, /PAST its removeAfter 1\.12\.0/);
+  assert.match(text, /due for removal/);
+});
+
+t('reportModulePreflight: nothing to say prints nothing', () => {
+  const out = [];
+  const lines = u.reportModulePreflight({ warnings: [], deprecations: [], expired: [] }, '2.0.0', { log: (s) => out.push(s), err: (s) => out.push(s) });
+  assert.deepEqual(lines, []);
+  assert.deepEqual(out, []);
+});
+
+t('runUpgrade: a REFUSED bump still reports the non-blocking module findings', async () => {
+  // A refusal is exactly when someone is reading this output, so the warnings must
+  // already have been emitted by the time the blocking check returns.
+  const dir = scratchConsumer();
+  mkdirSync(join(dir, 'modules'), { recursive: true });
+  const out = [];
+  const res = await u.runUpgrade({ to: '2.0.0', instance: dir, force: true, dryRun: true }, {
+    log: (s) => out.push(String(s)),
+    err: (s) => out.push(String(s)),
+    moduleLib: moduleLibStub({
+      ok: false,
+      blocking: [{ key: 'enabled-breaker', coreVersion: '^1.0.0', enabled: true, satisfied: false }],
+      warnings: [{ key: 'stale-catalog-entry', coreVersion: '^1.0.0', maintenance: { status: 'orphaned', note: 'author unreachable' } }],
+      deprecations: [], expired: [], core: '2.0.0',
+    }),
+  });
+  assert.equal(res.ok, false, 'the enabled mismatch still refuses');
+  const text = out.join('\n');
+  assert.match(text, /stale-catalog-entry/, 'the disabled rot is reported even on a refused bump');
+  assert.match(text, /author unreachable/);
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);