@bongos/core 1.19.654 → 1.19.656

package/tests/watch_sealed_floor.mjs

@@ -0,0 +1,241 @@
+// tests/watch_sealed_floor.mjs — a sealed panel names the floor the SERVER
+// enforced, EXECUTED (task 1003449).
+//
+// THE DEFECT. Every panel on /watch answered a 403 with the literal string
+// "Archons only." ADR 0157 moved most of this surface to metic — five of the
+// atoms behind these panels carry "(ADR 0157, was archon)" in their own catalog
+// entry — so the page was teaching a permission model the server had stopped
+// implementing. The hall audit filed it against watch.html:30 and sessions.html:27;
+// both of those lines are gone (the page heads were rewritten by task 1003307) and
+// scouting.js was deleted by task 1003440, so the copy actually lived in the
+// fourteen `sealedMsg` strings in watch.js. The reported symptom was real; the
+// reported location was not.
+//
+// WHY THE FIX IS NOT "CHANGE archon TO metic". The floors are MIXED, and a blanket
+// rewrite would have been wrong in the other direction:
+//
+//   access_request.review   → archon   ("Archons only" was CORRECT here)
+//   override_request.decide → metic    (ADR 0157, was archon)
+//   builder.roster.read     → metic    (ADR 0157, was archon)
+//   session.search          → metic    (ADR 0157, was archon)
+//   audit_log.read          → metic    (ADR 0157, was archon)
+//   box.fleet.manage        → metic    (ADR 0157, was archon)
+//
+// A hardcoded 'metic' is the same defect one ADR later, which is why the fix reads
+// the floor off the DENIAL: requirePermission already rides `details.floors` on
+// every 403, and its own comment in src/bongos/auth.js names hardcoded prose as
+// "the D-16/N-3 failure shape ADR 0157 left behind". The page just never read it.
+//
+// These run the real watch.js in a vm against the real watch.html — the harness
+// tests/watch_applications_queue.mjs established — because the claim under test is
+// what a denied builder READS. A source grep can see that the string changed; it
+// cannot see which sentence a 403 actually paints.
+//
+// Run:  node tests/watch_sealed_floor.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner, makeEl, parseInto } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const SRC = fs.readFileSync(path.join(HALL, 'watch.js'), 'utf8');
+const PAGE = fs.readFileSync(path.join(HALL, 'watch.html'), 'utf8');
+
+const { test, summary } = makeRunner();
+
+const escapeHtml = (s) => String(s == null ? '' : s).replace(/[&<>"']/g,
+  (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+const tick = () => new Promise((r) => setTimeout(r, 0));
+async function settle() { for (let i = 0; i < 40; i++) await tick(); }
+
+const ok = (data) => ({ status: 200, ok: true, data });
+
+// The ADR 0116 envelope requirePermission actually sends: the sentence, plus
+// `details.floors` mapping each MISSING permission key to its catalog floor.
+const denied = (floors) => ({
+  status: 403,
+  ok: false,
+  data: {
+    error: {
+      code: 'permission_forbidden',
+      message: 'missing permission',
+      details: { required: Object.keys(floors || {}), held: [], floors: floors || null },
+    },
+  },
+});
+
+// The label the page is expected to render the rank THROUGH. Distinct from the
+// bare rank key on purpose: if a test passed when the page printed the raw key,
+// it would also pass on an instance that renamed its ranks and got the old word.
+const LABELS = { archon: 'Archon', metic: 'Metic', thetes: 'Thetes', xenos: 'Xenos' };
+
+// ===========================================================================
+// Boot the real page, scripting one answer per route.
+// ===========================================================================
+
+async function boot({ answers = {}, fallback = ok({}) } = {}) {
+  const api = {
+    async request(method, p) {
+      const url = String(p).replace('/api/bongos', '');
+      const route = url.split('?')[0];
+      if (method === 'GET' && route === '/me') {
+        return ok({ builder: { id: 1, rank: 'metic', github_login: 'someone' } });
+      }
+      if (Object.prototype.hasOwnProperty.call(answers, route)) return answers[route];
+      return fallback;
+    },
+  };
+
+  const documentObj = {
+    readyState: 'complete',
+    body: makeEl('body'),
+    documentElement: makeEl('html'),
+    createElement: (tag) => makeEl(tag),
+    getElementById(id) { return this.body.querySelector(`#${id}`); },
+    querySelector(sel) { return this.body.querySelector(sel); },
+    querySelectorAll(sel) { return this.body.querySelectorAll(sel); },
+    addEventListener() {},
+  };
+  parseInto(documentObj.body, PAGE);
+
+  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search: '', hash: '', assign() {} };
+
+  const kit = {
+    makeTabs: () => ({}),
+    makeLedger: () => ({ render() {} }),
+    makePager: () => ({ page: 1, perPage: 25 }),
+    emptyStateHtml: (msg) => `<div class="empty-state"><p>${escapeHtml(msg)}</p></div>`,
+    makeFilterBar: (o) => ({ el: o.mount, values: () => ({}) }),
+  };
+
+  const windowObj = {
+    __BRANDING__: { project: { joinability: 'apply' } },
+    OTB: {
+      escapeHtml,
+      $: (sel) => documentObj.querySelector(sel),
+      num: (v) => Number(v),
+      fmtInt: (n) => String(n),
+      fmtCompact: (n) => String(n),
+      fmtDate: (iso) => String(iso).slice(0, 10),
+      rankLabel: (r) => LABELS[String(r)] || '',
+      toast: () => {},
+    },
+    OTBKit: kit,
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    BongosClient: { createClient: () => api },
+    location: locationObj,
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: locationObj,
+    console: { log() {}, warn() {}, error() {} },
+    setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, isNaN,
+    Number, String, Object, Array, Boolean, Set, Map, RegExp,
+    encodeURIComponent, decodeURIComponent, parseInt, parseFloat,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'watch.js' });
+  await settle();
+
+  const sealed = (id) => {
+    const el = documentObj.getElementById(id);
+    const p = el && el.querySelector('.watch-unavailable');
+    return p ? p.textContent : null;
+  };
+  return { sealed, documentObj };
+}
+
+// ===========================================================================
+// The floor comes from the denial
+// ===========================================================================
+
+await test('an archon-floored panel still says Archon', async () => {
+  // access_request.review really is archon-floored, so the old copy happened to
+  // be right HERE. The fix must not "correct" a sentence that was already true.
+  const h = await boot({ answers: { '/access-requests': denied({ 'access_request.review': 'archon' }) } });
+  const msg = h.sealed('gate-body');
+  assert.ok(msg, 'the access-requests panel rendered no sealed message');
+  assert.match(msg, /^Archon and up\./, `expected the archon floor, got: ${msg}`);
+  assert.match(msg, /Access requests are not visible at your rank\./, `the subject clause was lost: ${msg}`);
+});
+
+await test('a metic-floored panel says Metic — the defect, in one assertion', async () => {
+  // This is the sentence a metic used to read as "Archons only" on a page they
+  // could open, having been told the ladder was something it is not.
+  const h = await boot({ answers: { '/audit-log': denied({ 'audit_log.read': 'metic' }) } });
+  const msg = h.sealed('audit-body');
+  assert.ok(msg, 'the audit-log panel rendered no sealed message');
+  assert.match(msg, /^Metic and up\./, `expected the metic floor, got: ${msg}`);
+  assert.doesNotMatch(msg, /Archon/, `the retired floor came back: ${msg}`);
+});
+
+await test('two panels denied at DIFFERENT floors say different things', async () => {
+  // The whole reason the floor is read rather than written: one page, two true
+  // answers. A blanket rewrite in either direction fails this test.
+  const h = await boot({
+    answers: {
+      '/access-requests': denied({ 'access_request.review': 'archon' }),
+      '/builders/roster': denied({ 'builder.roster.read': 'metic' }),
+    },
+  });
+  assert.match(h.sealed('gate-body'), /^Archon and up\./);
+  assert.match(h.sealed('roster-body'), /^Metic and up\./);
+});
+
+// ===========================================================================
+// The honest silences
+// ===========================================================================
+
+await test('a denial carrying NO floor names no rank at all', async () => {
+  // The government port is optional (ADR 0083), so `floors` can legitimately be
+  // absent. Naming a rank anyway is guessing, and guessing is what this task is.
+  const h = await boot({ answers: { '/audit-log': { status: 403, ok: false, data: null } } });
+  const msg = h.sealed('audit-body');
+  assert.equal(msg, 'The audit log is not visible at your rank.',
+    `a floorless denial must render the subject alone, got: ${msg}`);
+});
+
+await test('a denial on keys with CONFLICTING floors names no rank', async () => {
+  // A multi-atom gate can deny on two keys with different floors. There is no
+  // single honest sentence, so the panel says none rather than picking the one
+  // that happens to sort first.
+  const h = await boot({
+    answers: { '/audit-log': denied({ 'audit_log.read': 'metic', 'something.else': 'archon' }) },
+  });
+  const msg = h.sealed('audit-body');
+  assert.equal(msg, 'The audit log is not visible at your rank.',
+    `an ambiguous floor must not be resolved by guessing, got: ${msg}`);
+});
+
+// ===========================================================================
+// The literal cannot come back
+// ===========================================================================
+
+await test('no sealed message on this page hardcodes a rank name', async () => {
+  // The source half of the claim: a future edit that re-writes "Archons only."
+  // into a sealedMsg reds here even if it never renders in a test.
+  const strings = [...SRC.matchAll(/sealedMsg:\s*'([^']*)'/g)].map((m) => m[1]);
+  assert.ok(strings.length >= 10, `expected the page's sealed messages, found ${strings.length}`);
+  for (const s of strings) {
+    assert.doesNotMatch(s, /Archon|Metic|Thetes|Xenos/i,
+      `a sealed message names a rank in its own text: "${s}". The rank comes from `
+      + 'the 403, or the sentence does not claim one.');
+  }
+});
+
+await test('the 403 path carries the floor rather than discarding the body', async () => {
+  // fetchJson used to throw a bare { kind: '403' }, which is what made every
+  // panel's sentence a guess. Pin the shape, not just the rendered output.
+  assert.match(SRC, /details\.floors/,
+    'fetchJson must read details.floors off the denial — otherwise the page is '
+    + 'back to writing the floor itself');
+});
+
+summary('watch sealed floor (task 1003449)');