@bongos/core 1.19.655 → 1.19.657

package/tests/government_claim_eligibility.mjs

@@ -37,6 +37,13 @@ const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+// The doorway, so section D can stand a stub `government` port up in front of the
+// REAL claimPermissionsFor instead of re-implementing its branches in the test.
+const moduleApi = require(path.join(ROOT, 'src', 'module-api.js'));
+// claimPermissionsFor is NOT on the db.js facade — db-claims.js imports it from
+// the authz module directly, so the test reads it from the same place the real
+// caller does rather than from a re-export that does not exist.
+const rankAuthz = require(path.join(LIFECYCLE, 'db-rank-authz.js'));
 import { lifecycleDbSource } from './helpers.mjs';
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
@@ -262,3 +269,78 @@ test('the abuse case stays blocked: a xenos cannot reach the general queue by an
   assert.equal(permissionAllowsClaim(held, false), false);
   assert.equal(permissionAllowsClaim(held, true), true);
 });
+
+// --- D. claimPermissionsFor's three-way answer (task 1003816) ---------------
+//
+// The function this section covers had NO test of its own: every case above
+// drives the pure consumer (claimEligibilityAllows) with a hand-made
+// heldPermissions value, so nothing proved which value the REAL reader produces.
+// That is exactly where the bug lived — an empty permission set was folded in
+// with "could not establish authority" and silently became a rank-rule fallback.
+//
+// The distinction is the whole point, so it is asserted as a distinction: null
+// (fall back) for the two unestablished cases, a Set (a real verdict, denied when
+// empty) whenever the resolver actually answered.
+const realResolveOptional = moduleApi.resolveOptional;
+async function withGovernance(stub, fn) {
+  moduleApi.resolveOptional = (name) => (name === 'government' ? stub : realResolveOptional.call(moduleApi, name));
+  try { return await fn(); } finally { moduleApi.resolveOptional = realResolveOptional; }
+}
+
+test('no governance port — authority cannot be established, so the rank rule decides', async () => {
+  await withGovernance(undefined, async () => {
+    assert.equal(await rankAuthz.claimPermissionsFor('42'), null);
+  });
+  // A port object that does not implement the resolver is the same situation.
+  await withGovernance({}, async () => {
+    assert.equal(await rankAuthz.claimPermissionsFor('42'), null);
+  });
+});
+
+test('the resolver throwing is UNKNOWN, not empty — still the rank rule', async () => {
+  await withGovernance({ resolveBuilderPermissions: async () => { throw new Error('synthetic resolver outage'); } }, async () => {
+    assert.equal(await rankAuthz.claimPermissionsFor('42'), null);
+  });
+});
+
+test('a broken port contract (non-array) is unknown, never a deny', async () => {
+  for (const bad of [null, undefined, 'task.claim.any', 42, {}]) {
+    await withGovernance({ resolveBuilderPermissions: async () => bad }, async () => {
+      assert.equal(await rankAuthz.claimPermissionsFor('42'), null, `a ${typeof bad} return must not read as "denied"`);
+    });
+  }
+});
+
+test('ZERO permissions is a real verdict now, not a fallback (the 1003816 fix)', async () => {
+  await withGovernance({ resolveBuilderPermissions: async () => [] }, async () => {
+    const held = await rankAuthz.claimPermissionsFor('42');
+    assert.ok(held instanceof Set, 'an answered resolve returns a Set, so the rank rule is NOT consulted');
+    assert.equal(held.size, 0);
+    // And the consumer turns that into a deny for every queue, however permissive
+    // the incumbent rank rule would have been.
+    for (const nf of NF_VALUES) {
+      assert.equal(
+        claimEligibilityAllows({ heldPermissions: held, newcomerFriendly: nf, rankRuleAllows: true }),
+        false,
+        'a builder with no role row is denied even where the rank rule would allow',
+      );
+    }
+  });
+});
+
+test('a real permission set is passed through as the verdict', async () => {
+  await withGovernance({ resolveBuilderPermissions: async () => [CLAIM_ANY] }, async () => {
+    const held = await rankAuthz.claimPermissionsFor('42');
+    assert.ok(held instanceof Set);
+    assert.equal(held.has(CLAIM_ANY), true);
+    assert.equal(claimEligibilityAllows({ heldPermissions: held, newcomerFriendly: false, rankRuleAllows: false }), true);
+  });
+});
+
+test('the doc comment no longer argues for the fallback it describes retiring', () => {
+  const src = fs.readFileSync(path.join(LIFECYCLE, 'db-rank-authz.js'), 'utf8');
+  assert.ok(
+    !/nothing yet re-assigns a rank-role/.test(src),
+    'the stale "nothing yet re-assigns a rank-role" claim is false since BV1.R95b + task 1003193 — it must not survive the fix',
+  );
+});

package/tests/government_constitution_view.mjs

@@ -95,12 +95,17 @@ test('the read rides the vote atom, and the client renders the SERVER value (sou
 // of a grammar is exactly the drift that produced the bug this task fixes, so
 // they are held equal here over every form.
 //
+// The mirror lives in modules/hall-ui/public/board-lib.js since task 1003761.
+// It was in government.js, and ADR 0266's carve left a SECOND copy in
+// board-room.js — so this test lifted one of two implementations and proved
+// nothing about the other. One copy, one lift.
+//
 // This matters more than a normal mirror: the Constitution panel is where an
 // owner READS who governs before deciding whether to change it. A panel that
 // misdescribes the franchise is the same failure as a resolver that mis-seats
 // it, one layer up.
 test('the hall renders every predicate form the server actually resolves', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/board-lib.js'), 'utf8');
 
   // Lift the browser mirror out of the IIFE and run it.
   const ladder = /const STANDARD_LADDER = (\[[^\]]*\]);/.exec(src);
@@ -131,7 +136,7 @@ test('the hall renders every predicate form the server actually resolves', () =>
 });
 
 test('the ladder the hall expands against IS the government ladder', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/board-lib.js'), 'utf8');
   const { RANK_ORDER } = require(path.join(ROOT, 'modules/government/catalog.js'));
   const m = /const STANDARD_LADDER = \[([^\]]*)\]/.exec(src);
   assert.ok(m);

package/tests/rank_tier_single_source.mjs

@@ -107,23 +107,35 @@ const STATIC_LADDER_FILES = [
   'modules/hall-ui/public/ranks.js',
   'modules/hall-ui/public/profile.js',
   'modules/hall-ui/public/watch.js',
-  // task 1003094: the Constitution panel expands the `rank:<key>+` membership
-  // form ("that rank and above") to render who governs in plain language, so it
-  // needs the ladder to expand against. Browser code cannot require the server
-  // module — the established mirror pattern here — and listing it in this array
-  // is what makes the copy provable rather than merely allowed. A second,
-  // government-specific pin lives in tests/government_constitution_view.mjs,
-  // which holds it against catalog.RANK_ORDER and holds the whole browser parser
-  // equal to the server one.
+  // task 1003094: the Constitution panel and the Board Room's sitting card both
+  // expand the `rank:<key>+` membership form ("that rank and above") to render
+  // who governs in plain language, so both need the ladder to expand against.
+  // Browser code cannot require the server module — the established mirror
+  // pattern here — and listing it in this array is what makes the copy provable
+  // rather than merely allowed.
+  //
+  // ONE ROW, not two, since task 1003761. ADR 0266 carved the Board Room onto
+  // its own page and the carve COPIED the ladder and the parser into both page
+  // files, so this array had to allowlist BOTH — which permitted a drift between
+  // them by construction: the exact-literal pin below proved each matched the
+  // canonical ladder, but nothing held the two parsers equal to EACH OTHER, and
+  // government_constitution_view.mjs lifted only one of them. board-lib.js is
+  // the single copy now. A second, government-specific pin lives in
+  // tests/government_constitution_view.mjs, which holds it against
+  // catalog.RANK_ORDER and runs the whole browser parser against the server one.
+  //
+  // This row used to claim tests/government_board_vote_ui.mjs pinned the
+  // board-room copy. It does not — that file asserts the sitting card, the
+  // ballot and the vote form, and has no parser assertion at all, so the second
+  // copy was guarded only by the exact-literal ladder match.
+  'modules/hall-ui/public/board-lib.js',
+  // government.js keeps a ladder literal of its own — the charter library's
+  // `seatsRanks` worked example for `rank:xenos+` (the full ladder, spelled out
+  // so a reader sees what the predicate resolves to). That is documentation of
+  // the grammar rather than a second implementation of it, and it must still
+  // match the canonical order or the example teaches a ladder that does not
+  // exist.
   'modules/hall-ui/public/government.js',
-  // ADR 0266: the Board Room moved off the government page onto its own, and the
-  // sitting card's `decidedByHtml` expands the same `rank:<key>+` membership form
-  // to say who may vote on THAT sitting — so the carve took a copy of the ladder
-  // with it. Same reason as the row above (browser code cannot require the server
-  // module), and the same pinning: `tests/government_board_vote_ui.mjs` reads
-  // board-room.js and holds its predicate parser equal to the server's, and the
-  // pin below in this file holds the array itself against LIVE_RANK_LADDER.
-  'modules/hall-ui/public/board-room.js',
   // task 1002487: the pure agent-definition validator applies the ADR 0043
   // sub-Metic floor to an agent's declared scope, so it needs the ladder to
   // compare against. It is one of the "dependency-free" cases this array exists