@bongos/core 1.19.671 → 1.19.672

package/tests/project_type_editable.mjs

@@ -0,0 +1,427 @@
+// tests/project_type_editable.mjs
+//
+// A declared project type can be CHANGED after creation (task 1003504, the
+// task 1002772 follow-up).
+//
+// Task 1002772 shipped the Type step as a declaration and had to narrow the
+// wizard's own promise to match the machinery: the copy stopped saying "you can
+// change it later", because nothing owner-facing could. Its review panel named
+// the three gaps (C4/C7/C8) — a create re-request answers `type_ignored`,
+// `updateInstanceDetail`'s patch excluded `type`, and the curation POST
+// /projects is Metic+ only, so an owner had no route at all. This closes the
+// middle one and puts a picker on it, which is what earns the sentence back.
+//
+// ONE PREMISE CORRECTION, recorded because the task body carries the other
+// reading: the task asks for "a type COALESCE-carry rule decision for the
+// catalog". There is nothing to decide. The catalog upsert carries the type as
+// COALESCE(EXCLUDED.type, existing.type) — preserve-on-null — and 'not-sure' is
+// a REAL value in PROJECT_TYPES, so an owner's edit is always non-null and
+// always wins. The carry rule only matters for a null, which is exactly why the
+// route refuses one: a null would leave the map showing the declaration the
+// owner had just taken back.
+//
+// Two layers, mirroring tests/provisioning_module_selection.mjs beside it:
+//   * PATCH /instances/:id/detail — validation (loud, never a silent drop),
+//     threading into the patch, and the receipt
+//   * the manage page's "Its kind" band — sliced out of the inline script and
+//     run in a vm, the tests/project_modules_ui.mjs idiom
+//
+// DB-free: the pool is a recording fake and the data-access fns the route needs
+// are stubbed on the cached module object. No network beyond a loopback listener.
+//
+// Run:  node --test --test-reporter=tap tests/project_type_editable.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { after, test } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const catalogBridge = require('../modules/provisioning/catalog-bridge.js');
+// Captured BEFORE layer 2 stubs the property. `node --test` defers every test body,
+// so the stubbing below has already run by the time the first one executes — a layer-1
+// test that reached for provisioning.updateInstanceDetail would silently exercise the
+// fake and record nothing.
+const realUpdateInstanceDetail = provisioning.updateInstanceDetail;
+
+// ── layer 1 · the column write ───────────────────────────────────────────────
+// A recording pool: assert the STATEMENT, because the difference between
+// assigning the type and COALESCEing it is invisible in the returned row and is
+// the whole point — this is the owner RE-declaring, so the new word has to win
+// even over one curation put there.
+function recordingDb(returnRow = {}) {
+  const calls = [];
+  return {
+    calls,
+    async query(text, params) { calls.push({ text, params }); return { rows: [returnRow] }; },
+  };
+}
+
+test('updateInstanceDetail ASSIGNS the type — a re-declaration must win, not merge', async () => {
+  const db = recordingDb({ id: 41, type: 'research' });
+  await realUpdateInstanceDetail(db, 41, { type: 'research' });
+  assert.equal(db.calls.length, 1);
+  const { text, params } = db.calls[0];
+  assert.match(text, /type = \$\d+/, 'the type is set');
+  assert.doesNotMatch(text, /COALESCE/, 'never COALESCEd here — that rule belongs to the catalog projection, not the row');
+  assert.ok(params.includes('research'), 'the word reaches the statement');
+});
+
+test('updateInstanceDetail leaves the column alone when no type is sent', async () => {
+  const db = recordingDb({ id: 41 });
+  await realUpdateInstanceDetail(db, 41, { description: 'A study of small things.' });
+  assert.doesNotMatch(db.calls[0].text, /type =/, 'a description-only patch must never touch the declaration');
+});
+
+test('updateInstanceDetail can change the type and something else in one statement', async () => {
+  const db = recordingDb({ id: 41 });
+  await realUpdateInstanceDetail(db, 41, { description: 'Hello.', type: 'business' });
+  const { text, params } = db.calls[0];
+  assert.match(text, /description = \$\d+/);
+  assert.match(text, /type = \$\d+/);
+  assert.ok(params.includes('Hello.') && params.includes('business'));
+});
+
+// EVERY branch of this statement, not just the one this task added. The type branch
+// was written by editing the lines around the `modules` branch, and that edit dropped
+// the `$` sigil from `modules = $${params.length}::jsonb` — leaving `modules = 3::jsonb`,
+// which is not valid Postgres and would have failed every extras save on the very route
+// this task's own field rides. The first cut of this file patched only `type` and
+// `description`, so nothing here saw it; the grader did. Assert the SHAPE of the whole
+// SET clause instead of one branch at a time, and no future branch can repeat it.
+test('every SET clause binds a PLACEHOLDER — a bare index is not valid SQL', async () => {
+  const db = recordingDb({ id: 41 });
+  await realUpdateInstanceDetail(db, 41, {
+    description: 'Hello.', detail: { team_shape: 'solo' }, modules: ['dev-box'], type: 'business',
+  });
+  const { text, params } = db.calls[0];
+  const sets = text.slice(text.indexOf('SET '), text.indexOf(' WHERE '));
+  assert.doesNotMatch(sets, /=\s*\d/, `a column is being set to a literal number: ${sets}`);
+  for (const col of ['description', 'detail', 'modules', 'type']) {
+    assert.match(sets, new RegExp(`${col} = [^,]*\\$\\d`), `${col} binds a parameter`);
+  }
+  // and every parameter the builder pushed is actually referenced by the statement
+  for (let i = 2; i <= params.length; i++) {
+    assert.match(text, new RegExp(`\\$${i}\\b`), `$${i} is referenced — a pushed param nothing reads is a dropped write`);
+  }
+});
+
+test('the modules branch still binds its JSON, not its own parameter index', async () => {
+  const db = recordingDb({ id: 41 });
+  await realUpdateInstanceDetail(db, 41, { modules: ['dev-box', 'discord'] });
+  const { text, params } = db.calls[0];
+  assert.match(text, /modules = \$\d+::jsonb/, 'the placeholder carries the cast, the index does not replace it');
+  assert.ok(params.some((p) => typeof p === 'string' && p.includes('dev-box')),
+    'the serialized selection reaches the statement');
+});
+
+// ── layer 2 · the route ──────────────────────────────────────────────────────
+let detailRow = null;
+let lastPatch = null;
+let lastPublished = null;
+provisioning.getInstanceBySlug = async () => null;
+provisioning.getInstanceByDomain = async () => null;
+provisioning.getInstanceById = async () => detailRow;
+provisioning.recordEvent = async () => {};
+provisioning.updateInstanceDetail = async (_db, _id, patch) => {
+  lastPatch = patch;
+  return { ...detailRow, ...(patch.type !== undefined ? { type: patch.type } : {}),
+    ...(patch.description !== undefined ? { description: patch.description } : {}) };
+};
+// The projection is where a change has to REACH — a type an owner changed that
+// never leaves the platform row is a map telling strangers the old word.
+catalogBridge.publishInstanceToCatalog = async (_db, row) => { lastPublished = row; return { published: true }; };
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function patchDetail(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}/provisioning/instances/41/detail`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+function arrange(row = {}) {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', detail: {}, modules: null, ...row };
+  lastPatch = null; lastPublished = null;
+}
+
+test('PATCH /detail: an owner changes the declared kind, and the reply is the row\'s own answer', async () => {
+  arrange();
+  const res = await patchDetail({ type: 'research' });
+  assert.equal(res.status, 200, `expected 200, got ${res.status} ${res.raw}`);
+  assert.equal(lastPatch.type, 'research', 'the word reaches the patch');
+  assert.equal(res.body.type, 'research', 'and comes back, so the caller repaints from the platform, not from what it sent');
+});
+
+test('PATCH /detail: the change REACHES the catalog projection — the map cannot keep the old word', async () => {
+  arrange();
+  await patchDetail({ type: 'non-profit' });
+  assert.ok(lastPublished, 'the projection is re-taken on a type change, as it is on a description change');
+  assert.equal(lastPublished.type, 'non-profit', 'and it carries the row as updated, not as read');
+});
+
+test('PATCH /detail: "not-sure" is a real answer — it is the way back to saying nothing', async () => {
+  arrange();
+  const res = await patchDetail({ type: 'not-sure' });
+  assert.equal(res.status, 200, `expected 200, got ${res.status} ${res.raw}`);
+  assert.equal(lastPatch.type, 'not-sure');
+});
+
+test('PATCH /detail: null is REFUSED, and the refusal names the word that does the job', async () => {
+  // The one place the two un-answer conventions on this route part company:
+  // `detail: { key: null }` un-answers a question whose vocabulary has no word for
+  // "never said"; the type vocabulary HAS one. A null would also be unsafe — the
+  // catalog carries the type as COALESCE(new, old), so it would leave the map
+  // showing the declaration the owner had just taken back.
+  arrange();
+  const res = await patchDetail({ type: null });
+  assert.equal(res.status, 400, `expected 400, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'bad_type');
+  assert.match(res.body.error.message, /not-sure/, 'the refusal says what to send instead');
+  assert.equal(lastPatch, null, 'and nothing was written');
+});
+
+test('PATCH /detail: an off-vocabulary kind is refused LOUDLY, with the choices listed', async () => {
+  arrange();
+  const res = await patchDetail({ type: 'startup' });
+  assert.equal(res.status, 400, `expected 400, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'bad_type');
+  for (const k of provisioning.PROJECT_TYPES) {
+    assert.match(res.body.error.message, new RegExp(k), `the message offers "${k}"`);
+  }
+  assert.equal(lastPatch, null, 'a typo is never silently dropped into a stored null');
+});
+
+test('PATCH /detail: a type-only body is a real change, not "nothing to change"', async () => {
+  arrange();
+  const res = await patchDetail({ type: 'business' });
+  assert.equal(res.status, 200, `expected 200, got ${res.status} ${res.raw}`);
+  assert.deepEqual(Object.keys(lastPatch), ['type'], 'and it carries only the key that was sent');
+});
+
+test('PATCH /detail: an empty body still says what may be sent — now including the kind', async () => {
+  arrange();
+  const res = await patchDetail({});
+  assert.equal(res.status, 400);
+  assert.match(res.body.error.message, /description, detail, modules, type/,
+    'the list of what this route takes must not go stale the moment it grows');
+});
+
+test('PATCH /detail: a description-only patch still never touches the declaration', async () => {
+  arrange();
+  const res = await patchDetail({ description: 'A study of small things.' });
+  assert.equal(res.status, 200, `expected 200, got ${res.status} ${res.raw}`);
+  assert.equal(lastPatch.type, undefined, 'an omitted key is not an instruction');
+});
+
+// after(), not a bare call: the listener has to outlive every deferred test body.
+after(() => server.close());
+
+// ── layer 3 · the manage page's picker ───────────────────────────────────────
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8')
+  .replace(/\r\n/g, '\n');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+const KIND_RE = /\/\* The declared kind \(task 1003504\)[\s\S]*?doKindPick\(b\.getAttribute\('data-kind'\)\);\n {2}\}\);/;
+const TYPE_META_RE = /var TYPE_META = \{[\s\S]*?\n {2}\};/;
+const kindSlice = (SCRIPT.match(KIND_RE) || [null])[0];
+const typeMetaSlice = (SCRIPT.match(TYPE_META_RE) || [null])[0];
+
+test('the kind region is still findable, and sits OUTSIDE the extras region a sibling test slices', () => {
+  assert.ok(kindSlice, 'the kind picker was not found in projects.html');
+  assert.ok(typeMetaSlice, 'TYPE_META was not found in projects.html');
+  assert.match(kindSlice, /function renderKind\(inst\) \{/);
+  assert.match(kindSlice, /function doKindPick\(key\) \{/);
+  // tests/project_modules_ui.mjs slices `var modsCatalog = null;` → the join-door
+  // comment and RUNS it under a DOM stub. A top-level document.addEventListener
+  // inside that slice throws there, which is why this block lives above it.
+  assert.ok(SCRIPT.indexOf('/* The declared kind (task 1003504)') < SCRIPT.indexOf('var modsCatalog = null;'),
+    'the kind block must stay above the extras region');
+});
+
+test('the section ships as real markup with its own fold, beside the extras (C7)', () => {
+  const sec = HUB.slice(HUB.indexOf('id="mKind"'), HUB.indexOf('id="mModules"'));
+  assert.match(sec, /<h2>Its kind<\/h2>/);
+  assert.match(sec, /<div id="mKindPick">/, 'the volatile slot');
+  assert.match(sec, /<details class="finePrint" id="mKindWhat">/, 'and its fold is a SIBLING, so no re-render drops it');
+  assert.match(sec, /never picked your extras yourself/,
+    'the fold states the one consequence the owner has to be told about before picking');
+});
+
+// A faithful miniature of the page's DOM: the band is written as a string into one
+// slot (the extras band's own idiom), so the assertions read that markup back.
+function runKind({ inst, fetchImpl, catalogMods } = {}) {
+  const els = {};
+  const el = (id) => (els[id] || (els[id] = { id, innerHTML: '', textContent: '', className: '' }));
+  const calls = { mods: 0, listeners: [] };
+  const sandbox = {
+    manageInst: inst,
+    manageId: inst && inst.id,
+    API: '/api/bongos',
+    $: el,
+    esc: (v) => String(v == null ? '' : v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+    fetch: fetchImpl || (() => new Promise(() => {})),
+    jsonOrEmpty: (res) => Promise.resolve(res.__body || {}),
+    apiError: (data) => (data && data.error && data.error.message) || 'error',
+    signInAgain: () => '<a href="#">Sign in again</a>',
+    renderMods: () => { calls.mods += 1; },
+    modsSource: (i) => (i && i.modules && i.modules.source) || null,
+    document: { addEventListener: (evt, fn) => calls.listeners.push([evt, fn]) },
+    Promise,
+    JSON,
+    Object,
+    String,
+    encodeURIComponent,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(`${typeMetaSlice}\n${kindSlice}`, sandbox);
+  void catalogMods;
+  return { sandbox, els, calls, band: () => el('mKindPick').innerHTML, msg: () => el('mKindMsg') };
+}
+
+const INST = (over = {}) => ({ id: 18, type: 'game', modules: { selected: ['dev-box'], source: 'bundle' }, ...over });
+
+test('the band paints every kind from TYPE_META, with the declared one pressed', () => {
+  const h = runKind({ inst: INST() });
+  h.sandbox.renderKind(h.sandbox.manageInst);
+  const band = h.band();
+  for (const key of ['game', 'research', 'business', 'non-profit', 'not-sure']) {
+    assert.ok(band.includes(`data-kind="${key}"`), `${key} is offered`);
+  }
+  assert.match(band, /data-kind="game" aria-pressed="true"/, 'the declared one reads as chosen');
+  assert.match(band, /data-kind="research" aria-pressed="false"/);
+  assert.ok(band.includes('Non-Profit'), 'labels come from the page\'s one vocabulary, never a second copy');
+  assert.doesNotMatch(band, /never said what kind it is/, 'a declared project is not told it has said nothing');
+});
+
+test('a project that never declared shows none pressed, and is told what saying so would do', () => {
+  const h = runKind({ inst: INST({ type: null }) });
+  h.sandbox.renderKind(h.sandbox.manageInst);
+  assert.doesNotMatch(h.band(), /aria-pressed="true"/, 'nothing is invented on the owner\'s behalf');
+  assert.match(h.band(), /never said what kind it is/);
+});
+
+test('re-picking the kind already declared is a NO-OP — the way back is "Not Sure", not a toggle-off', async () => {
+  let sent = 0;
+  const h = runKind({ inst: INST({ type: 'game' }), fetchImpl: () => { sent += 1; return new Promise(() => {}); } });
+  h.sandbox.doKindPick('game');
+  assert.equal(sent, 0, 'no write, so the route never has to refuse the null a toggle-off would send');
+});
+
+function okFetch(body) {
+  return (_url, opts) => {
+    okFetch.lastBody = JSON.parse(opts.body);
+    okFetch.lastUrl = _url;
+    return Promise.resolve({ ok: true, status: 200, __body: body });
+  };
+}
+
+test('a pick sends the kind on the own-scoped detail channel and repaints from the PLATFORM\'S answer', async () => {
+  const h = runKind({
+    inst: INST({ type: 'game' }),
+    fetchImpl: okFetch({ type: 'research', modules: { selected: ['dev-box'], source: 'picked' } }),
+  });
+  h.sandbox.doKindPick('research');
+  await new Promise((r) => setImmediate(r));
+  assert.deepEqual(okFetch.lastBody, { type: 'research' }, 'the whole declaration, and nothing else');
+  assert.match(okFetch.lastUrl, /\/provisioning\/instances\/18\/detail$/, 'the same route the extras and the description use');
+  assert.equal(h.sandbox.manageInst.type, 'research');
+  assert.match(h.band(), /data-kind="research" aria-pressed="true"/);
+  assert.equal(h.msg().className, 'projMsg ok');
+});
+
+test('when the extras followed the kind, the band above is repainted AND the owner is told', async () => {
+  // For a project whose picker was skipped, `modules` is NULL and the read resolves
+  // the type's starter bundle (ADR 0240 §2) — so changing the kind moves the extras.
+  // Leaving that band painted from the old kind would be a lie on the same page.
+  const h = runKind({
+    inst: INST({ type: 'game', modules: { selected: ['dev-box'], source: 'bundle' } }),
+    fetchImpl: okFetch({ type: 'research', modules: { selected: [], source: 'bundle' } }),
+  });
+  h.sandbox.doKindPick('research');
+  await new Promise((r) => setImmediate(r));
+  assert.ok(h.calls.mods >= 1, 'the extras band is repainted from the row that just changed');
+  assert.match(h.msg().textContent, /follow the kind/, 'and the receipt says so rather than claiming nothing moved');
+});
+
+test('a set the owner picked for themselves never moves, and the receipt does not claim it did', async () => {
+  const h = runKind({
+    inst: INST({ type: 'game', modules: { selected: ['dev-box'], source: 'picked' } }),
+    fetchImpl: okFetch({ type: 'business', modules: { selected: ['dev-box'], source: 'picked' } }),
+  });
+  h.sandbox.doKindPick('business');
+  await new Promise((r) => setImmediate(r));
+  assert.doesNotMatch(h.msg().textContent, /follow the kind/);
+  assert.match(h.msg().textContent, /nothing to restart/, 'the declaration reaches no running instance');
+});
+
+test('a refusal is said in the server\'s own words, and the band goes back to what the row still holds', async () => {
+  const h = runKind({
+    inst: INST({ type: 'game' }),
+    fetchImpl: () => Promise.resolve({ ok: false, status: 400, __body: { error: { code: 'bad_type', message: 'Unknown project type "startup".' } } }),
+  });
+  h.sandbox.doKindPick('research');
+  await new Promise((r) => setImmediate(r));
+  assert.equal(h.sandbox.manageInst.type, 'game', 'the row is untouched');
+  assert.match(h.band(), /data-kind="game" aria-pressed="true"/, 'and so is the band');
+  assert.equal(h.msg().className, 'projMsg err');
+  assert.match(h.msg().textContent, /Unknown project type/, 'the platform\'s words, not ours');
+});
+
+test('a signed-out save offers a way back in rather than a dead end', async () => {
+  const h = runKind({
+    inst: INST(),
+    fetchImpl: () => Promise.resolve({ ok: false, status: 401, __body: {} }),
+  });
+  h.sandbox.doKindPick('research');
+  await new Promise((r) => setImmediate(r));
+  assert.match(h.els.mKindMsg.innerHTML, /Sign in again/);
+});
+
+test('a network failure claims nothing about the project, and the picker unlocks', async () => {
+  const h = runKind({ inst: INST(), fetchImpl: () => Promise.reject(new Error('offline')) });
+  h.sandbox.doKindPick('research');
+  await new Promise((r) => setImmediate(r));
+  assert.match(h.msg().textContent, /Nothing about your project has changed/);
+  assert.doesNotMatch(h.band(), /disabled/, 'the band is live again, so a retry is one click');
+});
+
+test('the picker is wired by DELEGATION, so a repaint can never drop its handler', () => {
+  const h = runKind({ inst: INST() });
+  assert.equal(h.calls.listeners.length, 1, 'exactly one listener, on the document');
+  assert.equal(h.calls.listeners[0][0], 'click');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -437,10 +437,15 @@ test('decision 6 — the manage section is "Take it offline", and the teardown t
   assert.equal((truth.match(/until you bring it back\. Nothing here erases a project\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
 });
 
-test('decision 5 — the Type step says the type is fixed for now', () => {
+test('decision 5 — the Type step says where the type can be changed (task 1003504)', () => {
+  // Task 1002772 shipped this step with a NARROWED promise: "it stays as you pick it
+  // for now", because no owner-facing route could change a declared type. Task 1003504
+  // built that route and the manage page's "Its kind" picker on it, so the sentence is
+  // earned back — and it now has to name WHERE, or it is a promise with no address.
   const type = (HUB.match(/<section class="panel" id="panel-type"[\s\S]*?<\/section>/) || [''])[0];
   assert.ok(type, '#panel-type exists');
-  assert.match(type, /<p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now\. Not sure is a fine answer\.<\/p>/);
+  assert.match(type, /<p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and you can change it later from the project’s own page\. Not sure is a fine answer\.<\/p>/);
+  assert.doesNotMatch(type, /stays as you pick it/, 'the narrowed promise must not survive beside the wider one');
 });
 
 test('decision 8 — a card carrying a red error paragraph never tallies under Live', () => {