@bongos/core 1.19.663 → 1.19.665

package/tests/provisioning_credential_preflight.mjs

@@ -0,0 +1,153 @@
+// tests/provisioning_credential_preflight.mjs
+//
+// The create-route credential preflight (task 1002909, 1002898 N3).
+//
+// Before this, POST /provisioning/instances checked that an `adopt` NAMED a repo but
+// never that the caller could read it, so the API admitted standups that were doomed at
+// request time and surfaced ~2 minutes later as raw git stderr on the runner (the
+// task-1002697 acceptance walk). The preflight asks ADR 0176's question one round-trip
+// early: can this builder's credential carry THIS repo's standup?
+//
+// The two properties that matter, and the two ways this can be got wrong:
+//   1. it must never refuse a create that would have SUCCEEDED (greenfield, public repos,
+//      admin-on-private, and — deliberately — a GitHub outage), and
+//   2. it must refuse the ones that cannot (no credential, stale public_repo scope on a
+//      private repo, read-only access to a private repo).
+// 1002898 carved this task out rather than guess at the definition precisely because a
+// preflight written against the wrong one fails in one of those two directions.
+//
+// DB-free and network-free: readToken and fetchRepo are injected seams.
+//
+// Run:  node tests/provisioning_credential_preflight.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const { adoptCredentialFault, parseTargetRef } = require('../modules/provisioning/credential-preflight.js');
+// The REAL scope helper, not a stand-in: its whole point is that `public_repo` contains
+// the substring "repo", so a test double would hide the bug it exists to prevent.
+const { grantedScopeCoversRepos } = require('../src/bongos/auth-config.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A deps bundle with every leg stubbed; each test overrides only what it is about.
+function deps({ configured = true, token = { token: 't', scope: 'repo' }, repo = { private: false, admin: false }, throws = null } = {}) {
+  return {
+    secretBox: { isConfigured: () => configured },
+    grantedScopeCoversRepos,
+    userAgent: 'test-agent',
+    readToken: async () => token,
+    fetchRepo: async () => { if (throws) throw Object.assign(new Error('x'), { code: throws }); return repo; },
+  };
+}
+const adopt = (targetRef = 'octo-owner/demo') => ({ builderId: 7, onboardMode: 'adopt', targetRef });
+
+// ── the exemption that is load-bearing ──────────────────────────────────────────
+
+await ta('greenfield is EXEMPT — the platform creates that repo, so nothing is checked', async () => {
+  // Asserted via the seams: a greenfield create must not even read the token, or a
+  // builder with no GitHub connection could no longer make a fresh project at all.
+  let touched = false;
+  const d = deps();
+  d.readToken = async () => { touched = true; return null; };
+  assert.equal(await adoptCredentialFault({ builderId: 7, onboardMode: 'greenfield', targetRef: null }, d), null);
+  assert.equal(touched, false, 'greenfield must not consult the credential at all');
+});
+
+// ── the refusals ────────────────────────────────────────────────────────────────
+
+await ta('no stored credential → 403 repo_scope_required, and the message says what to do', async () => {
+  const f = await adoptCredentialFault(adopt(), deps({ token: null }));
+  assert.equal(f.code, 'repo_scope_required');
+  assert.equal(f.status, 403);
+  assert.match(f.message, /Connect your GitHub account/);
+});
+
+await ta('secret-box unconfigured → 503, not 403 — the fault is the server config, not the caller', async () => {
+  const f = await adoptCredentialFault(adopt(), deps({ configured: false }));
+  assert.equal(f.code, 'github_credential_unavailable');
+  assert.equal(f.status, 503);
+});
+
+await ta('THE HERMESLINES SHAPE: a stale public_repo token 404ing on a private repo re-prompts for scope', async () => {
+  // GitHub answers 404 identically for "absent" and "private and invisible to you", so a
+  // pre-ADR-0155 token reaching its owner's own private repo lands here. Asserting the
+  // repo does not exist would be a lie; the message must offer both readings.
+  const f = await adoptCredentialFault(adopt(), deps({ token: { token: 't', scope: 'public_repo,read:user' }, throws: 'repo_not_found' }));
+  assert.equal(f.code, 'repo_scope_required');
+  assert.equal(f.status, 403);
+  assert.match(f.message, /private/i);
+  assert.match(f.message, /reconnect/i);
+});
+
+await ta('a repo-scoped token that still 404s → 404 target_repo_not_found (it really is absent)', async () => {
+  const f = await adoptCredentialFault(adopt(), deps({ token: { token: 't', scope: 'repo' }, throws: 'repo_not_found' }));
+  assert.equal(f.code, 'target_repo_not_found');
+  assert.equal(f.status, 404);
+});
+
+await ta('private repo WITHOUT admin → 403: the runner could read it and then fail registering the deploy key', async () => {
+  const f = await adoptCredentialFault(adopt(), deps({ repo: { private: true, admin: false } }));
+  assert.equal(f.code, 'repo_admin_required');
+  assert.equal(f.status, 403);
+  assert.match(f.message, /ADMIN/);
+});
+
+await ta('a rejected token → 403 telling the caller to reconnect, not a raw 401', async () => {
+  const f = await adoptCredentialFault(adopt(), deps({ throws: 'github_unauthorized' }));
+  assert.equal(f.code, 'repo_scope_required');
+  assert.match(f.message, /reconnect/i);
+});
+
+await ta('an unparseable target_ref is refused for THAT reason, not admitted unchecked', async () => {
+  const f = await adoptCredentialFault(adopt('not a repo ref!!'), deps());
+  assert.equal(f.code, 'bad_target_ref');
+  assert.equal(f.status, 400);
+});
+
+// ── the admissions (the half a bad preflight breaks) ────────────────────────────
+
+await ta('public repo + any readable credential → ADMITTED, admin irrelevant', async () => {
+  // The deploy pull rides the shared SSH alias for a public repo, so no deploy key and
+  // therefore no admin is needed. Demanding admin here would refuse valid creates.
+  assert.equal(await adoptCredentialFault(adopt(), deps({ repo: { private: false, admin: false } })), null);
+});
+
+await ta('private repo WITH admin → ADMITTED — this is exactly what ADR 0176 needs', async () => {
+  assert.equal(await adoptCredentialFault(adopt(), deps({ repo: { private: true, admin: true } })), null);
+});
+
+await ta('GitHub unreachable → ADMITTED, matching the runner: an outage must not stop project creation', async () => {
+  // No positive evidence of doom. The runner takes the same posture
+  // (ensurePrivateRepoAccess returns skipped:'github_unreachable' rather than throwing),
+  // so refusing here would turn a GitHub hiccup into an outage of the create route.
+  assert.equal(await adoptCredentialFault(adopt(), deps({ throws: 'github_error' })), null);
+});
+
+// ── the parse must not drift from the runner's ──────────────────────────────────
+
+await ta('parseTargetRef accepts every form the runner accepts, and rejects what it rejects', async () => {
+  // A divergence from scripts/gds/provision-repo.js parseTargetRef would be silent: this
+  // would admit refs the runner cannot parse, or refuse ones it can.
+  for (const ref of ['octo-owner/demo', 'git@github.com:octo-owner/demo.git', 'https://github.com/octo-owner/demo', 'https://github.com/octo-owner/demo.git']) {
+    assert.deepEqual(parseTargetRef(ref), { owner: 'octo-owner', name: 'demo' }, `should parse ${ref}`);
+  }
+  for (const ref of ['', null, 'demo', 'a/b/c', 'not a repo ref!!']) {
+    assert.equal(parseTargetRef(ref), null, `should reject ${JSON.stringify(ref)}`);
+  }
+});
+
+await ta('the real scope helper is used, so public_repo never passes as repo', async () => {
+  // The trap this guards: 'public_repo'.includes('repo') is true.
+  assert.equal(grantedScopeCoversRepos('public_repo,read:user'), false);
+  assert.equal(grantedScopeCoversRepos('repo'), true);
+});
+
+console.log(`\nprovisioning_credential_preflight: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_onboard_mode.mjs

@@ -101,6 +101,19 @@ provisioning.getInstanceBySlug = async () => null;
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 
+// An `adopt` create now also passes the credential preflight (task 1002909), which is a
+// REAL precondition and not test scaffolding: the route refuses a standup whose owner
+// holds no usable credential for the repo it is about to queue a push to. So give this
+// harness a passing one — a `repo`-scoped token over a PUBLIC repo, the cheapest shape
+// that admits — and leave the preflight's own branch matrix to
+// tests/provisioning_credential_preflight.mjs, which owns it.
+api.secretBox = { isConfigured: () => true };
+api.pool = {
+  query: async () => ({ rows: [{ token_enc: 'enc', scope: 'repo', expires_at: new Date(Date.now() + 3600e3) }] }),
+};
+api.secretBox.decrypt = () => 'tok';
+globalThis.fetch = async () => ({ status: 200, ok: true, json: async () => ({ private: false, permissions: { admin: true } }) });
+
 const express = require('express');
 const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
 const app = express();

package/tests/rank_tier_single_source.mjs

@@ -163,7 +163,12 @@ const HALL_SCRIPTS = ['modules/hall-ui/public/builders.js', 'modules/hall-ui/pub
   // it needs both the tier order (its `rank` sort lens) and the known-rank test
   // (the badge variant class). Browser code cannot require db-kernel, so it takes
   // the pinned-copy shape builders.js already takes.
-  'modules/hall-ui/public/roster.js'];
+  'modules/hall-ui/public/roster.js',
+  // task 1003829: the Studio's verdict row offers four writes that all floor at
+  // METIC server-side, so the room reads the tier order to decide whether to draw
+  // them at all. Browser code cannot require db-kernel, so it takes the same
+  // pinned-copy shape builders.js and roster.js take.
+  'modules/hall-ui/public/studio.js'];
 // Filtered INSIDE the test, not at module scope: extractRankMaps is declared
 // further down, so calling it up here is a temporal-dead-zone crash.
 const staticMapFiles = () => HALL_SCRIPTS.filter(
@@ -198,6 +203,8 @@ const MAP_ALLOWLIST = new Set([
   'modules/hall-ui/public/goals-render.js',
   // task 1003441 — see the HALL_SCRIPTS note above: pinned, not unchecked.
   'modules/hall-ui/public/roster.js',
+  // task 1003829 — see the HALL_SCRIPTS note above: pinned, not unchecked.
+  'modules/hall-ui/public/studio.js',
 ]);
 // Where a rank-ladder array literal is allowed to exist.
 const LADDER_ALLOWLIST = new Set([

package/tests/task_visuals.mjs

@@ -193,6 +193,41 @@ await t('hall-kit: no visual renders nothing at all — never a placeholder', ()
   assert.ok(!html.includes('"before"'));
 });
 
+// ---- the full-size figure (task 1003829) -----------------------------------
+await t('hall-kit: the full-size figure is the same guard, at reading size', () => {
+  // Same no-placeholder rule as the thumbnail: nothing at all without a visual.
+  assert.equal(kit.taskVisualFigureHtml({ id: 1 }), '');
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
+  assert.equal(kit.taskVisualFigureHtml(null), '');
+  // And the same URL wall — an off-origin src or a javascript: payload is not
+  // "rendered without a caption", it is not rendered.
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
+  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
+
+  const url = '/api/gds/task-visuals/task-1-0011223344556677.png';
+  const html = kit.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
+  assert.ok(html.includes('<figure class="task-visual">'));
+  assert.ok(html.includes('class="task-visual__img"'));
+  // The caption is the SHIPPER's text — attacker-adjacent, so escaped in both
+  // the caption and the alt.
+  assert.ok(html.includes('<figcaption class="task-visual__caption">a &quot;before&quot; shot'));
+  assert.ok(!html.includes('"before"'));
+
+  // The caller owns the size, so it owns the class base; anything but
+  // [A-Za-z0-9_-] is stripped rather than interpolated into the attribute.
+  const studio = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
+  assert.ok(studio.includes('<figure class="studio-plate">'));
+  assert.ok(studio.includes('class="studio-plate__img"'));
+  const hostile = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
+  assert.ok(hostile.includes('<figure class="xonloada">'), hostile);
+
+  // No written alt → no caption at all. The fallback alt is a machine sentence
+  // for a screen reader, never a caption shown to a reader.
+  const bare = kit.taskVisualFigureHtml({ id: 7, visual_url: url });
+  assert.ok(!bare.includes('figcaption'));
+  assert.ok(bare.includes('alt="Visual for task 7"'));
+});
+
 // ---- cleanup ---------------------------------------------------------------
 await fs.rm(TMP, { recursive: true, force: true });