@bongos/core 1.19.691 → 1.19.693

package/tests/grade_body_limit.mjs

@@ -0,0 +1,154 @@
+// tests/grade_body_limit.mjs — the grade body is not capped at 64 KB (task 1003850).
+//
+// WHAT BROKE. A 1,141-file rename produced a grade body over the global 64 KB JSON cap,
+// so POST /tasks/:id/grade came back 413 payload_too_large and fully verified work was
+// stranded at 'completed' with no way to record its grade. --regrade fails identically:
+// the size is deterministic, not transient.
+//
+// WHY THE BODY CANNOT SIMPLY BE TRIMMED. committed_files carries EVERY changed path, and
+// it is not decoration: modules/grading/grader-score.js runs the server-side
+// permission-path pre-pass against that exact list (SR-9 / SEC #863), so a shortened list
+// would quietly weaken a security check rather than just lose detail. The body gets its
+// own parser instead — the same shape memory/sync, sessions, publish-branch and the task
+// visual already use.
+//
+// Two halves, and BOTH are required: the global parser must SKIP this path (otherwise it
+// 413s before the route-scoped one ever runs — the comment in routes.js says exactly
+// this), and the route must mount a larger parser of its own.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const GRADE_PATH = '/tasks/1003850/grade';
+
+test('the global 64 KB parser SKIPS the grade path', () => {
+  const src = read('src/bongos/routes.js');
+
+  // The cap itself is still 64 KB for everything else — this test is about the exemption,
+  // not about loosening the default.
+  assert.match(src, /express\.json\(\{ limit: '64kb' \}\)/,
+    'the global cap should stay 64 KB; only named paths are exempt');
+
+  // Pull the skip predicate's path patterns straight out of the source and run them, so
+  // this asserts the REAL routing decision rather than the presence of a comment.
+  const block = src.slice(src.indexOf('const globalJson'), src.indexOf('// Audit middleware'));
+  // Regex LITERALS of the form /^...$/ — the body may contain escaped slashes, so the
+  // scan has to allow `\.` rather than stopping at the first `/`.
+  const patterns = [...block.matchAll(/\/\^(?:\\.|[^/\n])*\$\//g)].map((m) => m[0]);
+  assert.ok(patterns.length >= 3, `expected the skip list to carry several path regexes, saw ${patterns.length}`);
+
+  const matched = patterns.some((lit) => {
+    // eslint-disable-next-line no-new-func -- the literal comes from our own source
+    const re = new Function(`return ${lit}`)();
+    return re.test(GRADE_PATH);
+  });
+  assert.ok(matched, `no skip-list pattern matches ${GRADE_PATH} — the global parser would 413 the body before the route's own parser runs`);
+});
+
+test('the grade route mounts its own, larger parser', () => {
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  const m = /const GRADE_BODY_LIMIT = '(\d+)(kb|mb)';/.exec(src);
+  assert.ok(m, 'GRADE_BODY_LIMIT is gone — the route would fall back to whatever parser ran first');
+
+  const bytes = Number(m[1]) * (m[2] === 'mb' ? 1024 * 1024 : 1024);
+  assert.ok(bytes > 64 * 1024,
+    `GRADE_BODY_LIMIT (${m[1]}${m[2]}) must exceed the 64 KB global cap or the exemption buys nothing`);
+
+  // Mounted ON the route, ahead of the handler.
+  assert.match(src, /const gradeUpload = express\.json\(\{ limit: GRADE_BODY_LIMIT \}\);/,
+    'the route-scoped parser is not built from GRADE_BODY_LIMIT');
+  // Mounted ON the route. The ORDER (auth first) is asserted separately below; pinning it
+  // here too would mean changing the same fact in two places.
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade',[^)]*gradeUpload,/,
+    'the grade route must run its own parser before the handler');
+});
+
+test('a realistic mass-change body fits the new limit', () => {
+  // The shape that broke it: one path per changed file, plus the panel's findings. 1,141
+  // paths measured ~38 KB of JSON on their own — comfortably over 64 KB once the grade
+  // output is added, and comfortably under 1 MB.
+  const files = Array.from({ length: 1200 }, (_, i) => `scripts/gds/some-fairly-long-script-name-${i}.js`);
+  const body = JSON.stringify({
+    committed_files: files,
+    subagent_output: { functional_fidelity: 9, code_quality: 9, notes: 'x'.repeat(20_000) },
+  });
+  assert.ok(body.length > 64 * 1024,
+    'this fixture is meant to EXCEED the old cap — if it does not, it is not reproducing the bug');
+  assert.ok(body.length < 1024 * 1024,
+    `a mass-change body (${body.length} bytes) must fit the route limit`);
+});
+
+// ── the two findings the panel raised on the first round ────────────────────────────────
+
+test('the LARGER parser runs AFTER auth, like every other exempted route here', () => {
+  // Raised by the panel, round 1. Mounting the 1 MB parser before requireBuilder lets an
+  // UNAUTHENTICATED caller make the server parse up to 1 MB — sixteen times the global cap
+  // — before it is rejected. This file already had the right shape twice over; the new
+  // route simply diverged from it.
+  const src = read('modules/lifecycle/routes/tasks.js');
+
+  assert.match(src, /router\.post\('\/tasks\/:id\/grade', auth\.requireBuilder, gradeUpload,/,
+    'the grade route must authenticate BEFORE parsing a larger body');
+
+  // The convention this follows, asserted so the three stay in step.
+  assert.match(src, /router\.post\('\/tasks\/:id\/publish-branch', auth\.requireBuilder, publishUpload,/,
+    'publish-branch is the precedent for auth-then-parser');
+});
+
+test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', () => {
+  // The worse half of the same buffer bug, and the panel caught it: computeDiffText was
+  // fixed while its sibling was not. At the default 1 MB buffer a large diff returned null
+  // and the old code hashed the EMPTY STRING — one fixed SHA-256 shared by every large
+  // diff. shouldReuseGrade compares that hash to the stored grade's, so two different large
+  // diffs on one task collided and a stale PASS could be reused on changed code, skipping
+  // the panel entirely.
+  const src = read('scripts/gds/ship-grade.js');
+
+  const fn = src.slice(src.indexOf('function computeRawDiffHash'), src.indexOf('function shouldReuseGrade'));
+  assert.ok(fn.length > 0, 'computeRawDiffHash is gone');
+  assert.match(fn, /maxBuffer: DIFF_CAPTURE_MAX_BYTES/,
+    'computeRawDiffHash must capture at the same size as computeDiffText');
+  assert.match(fn, /if \(raw === null\) return null;/,
+    'a failed capture must be "unknown" (null), never hash(\'\')');
+  assert.doesNotMatch(fn, /diffHash\(raw \|\| ''\)/,
+    'hashing `raw || \'\'` is the bug: every uncapturable diff hashes identically');
+
+  // And "unknown" must actually refuse reuse, which is what makes null the safe answer.
+  const reuse = src.slice(src.indexOf('function shouldReuseGrade'), src.indexOf('function shouldReuseGrade') + 400);
+  assert.match(reuse, /!currentDiffHash/, 'shouldReuseGrade must refuse a null/absent current hash');
+});
+
+test('both diff captures use one shared size, not two drifting numbers', () => {
+  // The two call sites are the same decision; a second literal is how one gets fixed and
+  // the other does not — which is exactly what happened here.
+  const src = read('scripts/gds/ship-grade.js');
+  assert.match(src, /const DIFF_CAPTURE_MAX_BYTES = /, 'the capture size must be named once');
+  const uses = (src.match(/maxBuffer: DIFF_CAPTURE_MAX_BYTES/g) || []).length;
+  assert.equal(uses, 2, `both diff captures must share the constant, saw ${uses}`);
+});
+
+test('the grade endpoint keeps its full generated description', () => {
+  // Panel finding, round 1 — and I doubted it before measuring, which was the wrong
+  // instinct. gen-api-docs' commentBlockAbove reads only the `//` lines IMMEDIATELY above
+  // `router.post(`, so declaring the parser between the doc-comment and the route collapses
+  // this endpoint's description from 1251 chars to 94: the rank line survives and every
+  // word about what the endpoint does, and how it fails, is dropped from BOTH
+  // docs/api-reference.md and openapi.json. Measured both ways before believing it.
+  //
+  // Pinned on LENGTH rather than exact prose so ordinary edits to the comment do not red
+  // this, while the collapse (which is an order-of-magnitude drop) still does.
+  const spec = JSON.parse(read('docs/api/openapi.json'));
+  const desc = spec.paths['/tasks/{id}/grade']?.post?.description || '';
+  assert.ok(desc.length > 400,
+    `the grade endpoint's generated description collapsed to ${desc.length} chars — `
+    + 'something now sits between its doc-comment and router.post(');
+  assert.match(desc, /[Ss]ubagent grader/,
+    'the description should still explain what the endpoint is');
+});

package/tests/task_classifier_vocab.mjs

@@ -5,8 +5,12 @@
 // drive the pure builder + the generic core rule with no disk I/O.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import classifier from '../modules/lifecycle/task-classifier.js';
 
+const require = createRequire(import.meta.url);
+
 const { classifyTaskKind, buildBlockerVendorRe } = classifier;
 
 test('buildBlockerVendorRe: empty / non-array → null (vanilla has no vendors)', () => {
@@ -39,3 +43,53 @@ test('generic blocker terms still classify without any vendor config', () => {
   assert.equal(classifyTaskKind('Unblock the release', '').kind, 'blocker-resolution');
   assert.equal(classifyTaskKind('Rotate the API key', '').kind, 'blocker-resolution');
 });
+
+// ---- the kind vocabulary is ONE list, and everything reads it (task 1003453) --
+//
+// The board's Kind filter hardcoded its options and had gone stale: 'verify' was
+// added to VALID_KINDS (and to the DB CHECK by migration 187) but never to the
+// filter, so verify tasks existed, were claimable, and could not be filtered for.
+// The goals page carried a second copy of the same stale list. Both now build the
+// lens from the vocabulary the server serves, and these pin every hop of that.
+
+test('the DB CHECK constraint lists exactly VALID_KINDS', () => {
+  // Migration 187's own header records this drift in the other direction — the
+  // app gained 'verify', the CHECK did not, and POST /tasks 500'd for months.
+  // Comparing the two is the guard neither side had.
+  const sql = readFileSync(new URL('../migrations/187_tasks_kind_check_add_verify.sql', import.meta.url), 'utf8');
+  const inClause = /CHECK \(kind IN \(([\s\S]*?)\)\)/.exec(sql);
+  assert.ok(inClause, 'the CHECK constraint is still written as `kind IN (...)`');
+  const fromSql = [...inClause[1].matchAll(/'([a-z-]+)'/g)].map((m) => m[1]);
+  assert.deepEqual([...fromSql].sort(), [...classifier.VALID_KINDS].sort(),
+    'the DB CHECK and VALID_KINDS must name the same kinds — this is the drift migration 187 exists to record');
+});
+
+test('the lifecycle port serves the vocabulary as a JSON-safe array', () => {
+  const lifecycle = require('../modules/lifecycle/lifecycle.js');
+  const kinds = lifecycle.TASK_KINDS;
+  assert.ok(Array.isArray(kinds), 'an array — a Set does not survive JSON.stringify, which is how it reaches the hall');
+  assert.deepEqual([...kinds].sort(), [...classifier.VALID_KINDS].sort());
+  assert.ok(kinds.includes('verify'), 'the kind this whole task is about');
+  assert.notEqual(kinds, lifecycle.TASK_KINDS, 'a fresh copy each read — a caller must not be able to mutate the vocabulary');
+});
+
+// Scans the WHOLE surface — every .js AND .html — because the first cut of this
+// test read .js only and matched a JS array literal, so it could not see the third
+// copy: a static <option> list in ideas.html carrying the identical stale
+// vocabulary. A guard that cannot see one of the places the bug lives is worse
+// than no guard, because it is read as coverage. The grader caught that; this is
+// the shape that would have caught it first.
+test('no hall page carries its own copy of the kind list', () => {
+  const dir = new URL('../modules/hall-ui/public/', import.meta.url);
+  const pages = readdirSync(dir).filter((f) => f.endsWith('.js') || f.endsWith('.html'));
+  assert.ok(pages.length > 20, 'the surface was found — an empty scan must not pass silently');
+  // Three kinds in sequence is the signature of a spelled-out vocabulary, in a JS
+  // array ('cleanup', 'decision', …) or in markup (value="cleanup" … value="decision").
+  const SPELLED = /(['"])cleanup\1[\s\S]{0,80}?(['"])decision\2[\s\S]{0,120}?(['"])blocker-resolution\3/;
+  for (const page of pages) {
+    if (page === 'dom-utils.js') continue; // the one filler is allowed to name them
+    const src = readFileSync(new URL(page, dir), 'utf8');
+    assert.doesNotMatch(src, SPELLED,
+      `${page} spells out the kind vocabulary — fill it from /me task_kinds via OTB.fillKindFilter instead`);
+  }
+});