@bongos/core 1.19.772 → 1.19.774

package/tests/sso_checkin_legacy_field_gone.mjs

@@ -0,0 +1,246 @@
+// tests/sso_checkin_legacy_field_gone.mjs — the test of the shim's ABSENCE: the
+// legacy `role` field on POST /sso/membership/check-in is gone (task 1003092,
+// ADR 0177 §"the window closed"; the Lineage lesson of ADR 0174).
+//
+// WHY THIS FILE EXISTS, AND WHY IT LANDED WITH THE REMOVAL AND NOT BEFORE. Task
+// 1003090 renamed the coarse project membership from `role` to `membership_kind`
+// but kept accepting the legacy field for a cross-version window, because the
+// callers are OTHER instances on their own upgrade schedule. For as long as an
+// un-upgraded instance could still send `role: 'builder'`, the field was
+// load-bearing — dropping it would have silently defaulted that instance's owner
+// to 'member' (the owner flag vanishing from My Projects). Only once every
+// federated instance that can check in was past core 1.19.241 could the hub
+// stop understanding it — and the moment it does, THIS test is what keeps the
+// shim from quietly coming back.
+//
+// Three things are pinned, at three altitudes:
+//   1. ROUTE — a body carrying `role` is refused by the strict schema (400,
+//      unknown_field) and touches the database NOT AT ALL: no client lookup, no
+//      membership statement. "Must no longer set the membership" is proven by the
+//      absence of any SQL, not by inspecting a value it might have written.
+//   2. CONTROL — the same body with `membership_kind` instead still lands, and
+//      the UPDATE carries the kind it named. The removal is a wall, not a leak.
+//   3. CONTRACT — the generated OpenAPI + reference no longer list the field, so
+//      a typed client regenerated from them cannot offer it.
+//
+// DB-free: a recording fake pool, the REAL sso router, the REAL domain module,
+// core pinned through the doorway (the tests/sso_checkin_identity_spoof.mjs
+// harness). Runs in the default unit gate.
+//
+// Run:  node --test tests/sso_checkin_legacy_field_gone.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// ---- the recording fake pool ----------------------------------------------
+let queued = [];
+let calls = [];
+const pool = {
+  query: async (text, params) => {
+    calls.push({ text: String(text).replace(/\s+/g, ' ').trim(), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; }
+const sqlFor = (re) => calls.filter((c) => re.test(c.text));
+
+// ---- the real routes over the real domain, with core pinned ----------------
+const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    resolveSession: async () => null,
+    logger: () => noopLog,
+    hasProvider: () => true,
+    registerProvider: () => {},
+    on: () => () => {},
+    resolveEnv: () => null,
+    userAgent: () => 'cloud-bongos-tests',
+    LIVE_RANK_LADDER: ['xenos', 'thetes', 'metic', 'archon'],
+  },
+};
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildSsoRoutes = require('../modules/platform-identity/routes/sso.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildSsoRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ---- fixtures: a legitimate federated instance, checking in its own OWNER -----
+//
+// The owner is the case that made the window load-bearing: a legacy-only sender
+// said `role: 'owner'`, and a hub that ignored the field would have defaulted the
+// row to 'member'. Now that the hub REFUSES the field instead, nothing is written
+// at all — which is the correct failure, because it is loud on the sender's side.
+const CLIENT_ID = 't1003092-instance';
+const CLIENT_SECRET = 't1003092-secret';
+const OWNER = 7100309200;
+
+const clientRow = () => ({
+  client_id: CLIENT_ID,
+  secret_hash: pi.sha256hex(CLIENT_SECRET),
+  name: 'Federated Project',
+  redirect_uris: ['https://federated.example/api/gds/auth/web/callback'],
+  origin: 'https://federated.example',
+  owner_github_id: String(OWNER),
+  status: 'active',
+});
+const membershipRow = (over = {}) => ({
+  id: '5', client_id: CLIENT_ID, github_id: String(OWNER),
+  membership_kind: 'owner', joined_at: 'T0', last_active: 'T0',
+  signin_verified_at: '2026-09-01T00:00:00.000Z', ...over,
+});
+const baseBody = () => ({
+  client_id: CLIENT_ID,
+  client_secret: CLIENT_SECRET,
+  github_id: OWNER,
+  github_login: 'federated-owner',
+  display_name: 'Federated Owner',
+  avatar_url: 'https://federated.example/av.png',
+});
+
+const errorCode = (r) => r.json?.error?.code ?? r.json?.error;
+const unknownFields = (r) => (r.json?.error?.details ?? r.json?.details ?? [])
+  .filter((d) => d.reason === 'unknown_field').map((d) => d.field);
+
+// ── 1. ROUTE: the legacy field is refused, and refused BEFORE any SQL ──────────
+
+test('a check-in carrying ONLY the legacy field is refused 400 and sets no membership', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow()] });
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), role: 'owner' });
+  assert.equal(r.status, 400, `legacy-only body must be refused, got ${r.status}: ${r.text}`);
+  assert.equal(errorCode(r), 'validation_failed');
+  assert.deepEqual(unknownFields(r), ['role'], 'and the refusal names the field, so the sender can see why');
+  assert.equal(calls.length, 0,
+    'strict validation runs before the client lookup — a legacy body must not even authenticate, let alone write');
+  assert.equal(sqlFor(/platform_identity_project_memberships/).length, 0,
+    'no membership statement of any kind: this is the "must no longer set the membership" the task asked for');
+});
+
+test('a check-in carrying BOTH spellings is refused too — the window admitted the pair, the wall admits neither', async () => {
+  // A sender inside the window sent both deliberately (task 1003090). No shipped
+  // core does any more (tests/membership_kind_lockstep.mjs pins the sender), so a
+  // body with both is by definition an un-upgraded sender, and it is refused rather
+  // than half-honoured: honouring `membership_kind` while ignoring `role` would make
+  // the legacy field look accepted when it is not.
+  expect({ rows: [clientRow()] }, { rows: [membershipRow()] });
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: 'owner', role: 'owner' });
+  assert.equal(r.status, 400);
+  assert.deepEqual(unknownFields(r), ['role']);
+  assert.equal(calls.length, 0);
+});
+
+test('the legacy VALUE is no longer a recognised kind: "builder" is clamped like any unknown value, not translated', async () => {
+  // The translator that turned 'builder' into 'member' is gone with the field. What
+  // remains is the domain's GENERIC clamp — touchMembership writes 'member' for any
+  // value outside MEMBERSHIP_KINDS, whether that is the old craft word or a rank
+  // name. The two must land identically: if 'builder' were still special-cased
+  // anywhere on the path, this is where it would show as a difference.
+  const landed = async (kind) => {
+    expect({ rows: [clientRow()] }, { rows: [membershipRow()] }, { rows: [{ id: '9', handle: 'federated-owner' }] });
+    await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: kind });
+    const membership = sqlFor(/platform_identity_project_memberships/);
+    assert.equal(membership.length, 1, `one membership statement for kind=${kind}`);
+    return membership[0].params[2];
+  };
+  assert.equal(await landed('builder'), 'member', 'the craft word is not a kind — clamped');
+  assert.equal(await landed('archon'), 'member', 'a rank name is not a kind — clamped the same way');
+  assert.equal(await landed('visitor'), 'visitor', 'CONTROL: a real kind passes through untouched');
+});
+
+// ── 2. CONTROL: the one spelling still lands, and lands the kind it named ──────
+
+test('CONTROL: the same check-in with membership_kind lands, and the UPDATE carries the owner kind', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [membershipRow()] },
+    { rows: [{ id: '9', handle: 'federated-owner' }] },
+  );
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: 'owner' });
+  assert.equal(r.status, 200, `control must still pass, got ${r.status}: ${r.text}`);
+  const membership = sqlFor(/platform_identity_project_memberships/);
+  assert.equal(membership.length, 1, 'exactly one membership statement');
+  assert.match(membership[0].text, /^UPDATE platform_identity_project_memberships/);
+  assert.ok(membership[0].params.includes('owner'),
+    'the kind the sender named is the kind written — the owner flag survives the window closing');
+  assert.equal(membership[0].params[0], CLIENT_ID, 'keyed to the AUTHENTICATED client');
+});
+
+test('CONTROL: a check-in naming no kind at all still defaults to member (the sender-side default is unchanged)', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow({ membership_kind: 'member' })] }, { rows: [{ id: '9', handle: 'x' }] });
+  const r = await call('POST', '/sso/membership/check-in', baseBody());
+  assert.equal(r.status, 200);
+  const membership = sqlFor(/platform_identity_project_memberships/);
+  assert.equal(membership.length, 1);
+  assert.ok(membership[0].params.includes('member'), 'no kind → member, exactly as inside the window');
+});
+
+// ── 3. CONTRACT: the generated API surface no longer offers the field ──────────
+
+test('the generated OpenAPI request schema for the check-in has no `role` property', () => {
+  const spec = JSON.parse(readFileSync(join(ROOT, 'docs', 'api', 'openapi.json'), 'utf8'));
+  const key = Object.keys(spec.paths).find((p) => p.endsWith('/sso/membership/check-in'));
+  assert.ok(key, 'the check-in route is in the spec');
+  const ref = spec.paths[key].post.requestBody.content['application/json'].schema.$ref;
+  const schema = spec.components.schemas[ref.split('/').pop()];
+  const props = Object.keys(schema.properties || {});
+  assert.ok(props.includes('membership_kind'), `membership_kind is the field (got ${props.join(', ')})`);
+  assert.ok(!props.includes('role'),
+    'the legacy field is gone from the contract — a client regenerated from this spec cannot offer it');
+});
+
+test('the generated API reference row for the check-in lists one spelling', () => {
+  const md = readFileSync(join(ROOT, 'docs', 'api-reference.md'), 'utf8');
+  const row = md.split('\n').find((l) => l.includes('`/api/bongos/sso/membership/check-in`'));
+  assert.ok(row, 'the check-in row is in the reference');
+  const fields = row.split('|')[4];
+  assert.match(fields, /`membership_kind`/);
+  assert.ok(!/`role`/.test(fields), 'the reference is generated from the route schema, so it drops the field with it');
+});
+
+test('the route source itself declares no `role` rule (the schema is the wall, so the wall must be in the schema)', () => {
+  const src = readFileSync(join(ROOT, 'modules', 'platform-identity', 'routes', 'sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/membership/check-in'"), src.indexOf("router.post('/sso/activity/rollup'"));
+  assert.ok(!/^\s*role:\s*\{/m.test(route), 'no `role:` rule in the check-in schema');
+  assert.ok(!/membershipKindFromLegacy/.test(route), 'and no translator call — the mapping left with the field');
+});

package/tests/task_list_paging.mjs

@@ -0,0 +1,178 @@
+// tests/task_list_paging.mjs — the GET /tasks page bound, and the pager that
+// has to respect it (task 1003752).
+//
+// THE BUG THIS PINS. audit-deps.js --stranded asked for `limit: 3000` against a
+// route that caps `limit` at 1000. Every run 400'd before reading one task, so
+// the ONLY detector for work stranded behind an abandoned dependency had never
+// once produced a result — silently, for months, because a 400 on a read looks
+// exactly like a clean report to anyone not reading the exit code.
+//
+// So this file covers the CLASS, not just the instance:
+//   - the cap the route enforces and the page size the client asks for are held
+//     equal, so they cannot drift apart again (routes/tasks.js is a NEEDS_TRUST
+//     gate surface and the route was never the bug, so the pin lives here);
+//   - the fake here enforces the route's real rules (cap, and `offset` must be
+//     strictly positive — `offset=0` is a 400, the landmine under every naive
+//     `page * size` pager), so a pager that would 400 in production fails here;
+//   - the pager is driven with MORE than one page of rows, because a limit bug
+//     is invisible against a fixture that fits in a single page.
+//
+// Hermetic: no DB, no API, no network. Run: node tests/task_list_paging.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../modules/lifecycle/task-list-limits.js');
+const { fetchAllTasks } = require('../scripts/gds/audit-deps.js');
+
+let passed = 0, failed = 0;
+const t = async (n, f) => {
+  try { await f(); passed++; console.log(`  PASS  ${n}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); }
+};
+
+// A stand-in for GET /tasks that refuses everything the real route refuses.
+// `rows` is the whole corpus; the fake slices it the way listTasks does.
+function fakeRoute(rows, { cap = TASK_LIST_MAX_LIMIT } = {}) {
+  const calls = [];
+  const get = async (query) => {
+    calls.push({ ...query });
+    const { limit, offset } = query;
+    // routes/tasks.js: posInt(limitRaw, 'bad_limit', cap)
+    if (limit === undefined || !Number.isInteger(limit) || limit <= 0 || limit > cap) {
+      return { ok: false, status: 400, data: { error: { code: 'bad_limit' } } };
+    }
+    // routes/tasks.js: posInt(offsetRaw, 'bad_offset') — POSITIVE, so 0 is bad.
+    if (offset !== undefined && (!Number.isInteger(offset) || offset <= 0)) {
+      return { ok: false, status: 400, data: { error: { code: 'bad_offset' } } };
+    }
+    const start = offset || 0;
+    return { ok: true, status: 200, data: { tasks: rows.slice(start, start + limit) } };
+  };
+  return { get, calls };
+}
+
+const corpus = (n, from = 1) => Array.from({ length: n }, (_, i) => ({ id: from + i, status: 'ready' }));
+
+// ---------------------------------------------------------------- the cap
+
+await t('the shared cap is the number the route actually enforces', () => {
+  const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+
+  // routes/tasks.js is a NEEDS_TRUST gate surface, so this fix does not edit it
+  // — the route was never wrong, the client was. That leaves the cap written in
+  // two files, which is what let them drift in the first place, so the drift is
+  // pinned HERE instead: change the cap in the route and this test reds until
+  // task-list-limits.js is changed to match.
+  //
+  // Both reads are guarded against going blind. A source scan fails by quietly
+  // matching nothing, and a green test over a pattern that no longer matches is
+  // a false claim of coverage, not coverage.
+  const capM = routeSrc.match(/posInt\(limitRaw, 'bad_limit', (\d+)\)/);
+  assert.ok(capM, 'BLIND SCAN: the GET /tasks limit cap no longer matches this pattern — fix the pattern, do not delete the test');
+  assert.equal(Number(capM[1]), TASK_LIST_MAX_LIMIT,
+    `route caps limit at ${capM && capM[1]} but TASK_LIST_MAX_LIMIT is ${TASK_LIST_MAX_LIMIT} — the pager will 400 or under-read`);
+
+  // The 400 message is what a human debugging this actually reads, so it has to
+  // carry the same number the validator enforces.
+  const msgM = routeSrc.match(/limit must be a positive integer up to (\d+)\./);
+  assert.ok(msgM, 'BLIND SCAN: the bad_limit message no longer matches this pattern');
+  assert.equal(Number(msgM[1]), TASK_LIST_MAX_LIMIT, 'the error message must quote the cap it enforces');
+
+  // And `offset` must still be the STRICTLY-positive validator the pager is
+  // built around — if the route ever starts accepting offset=0, the first-page
+  // special case below becomes dead weight rather than a requirement.
+  assert.match(routeSrc, /posInt\(offsetRaw, 'bad_offset'\)/,
+    'offset is validated with no cap and must stay positive-only — buildTaskPageQuery depends on it');
+});
+
+await t('no page this pager requests can exceed the route cap', async () => {
+  // The literal regression: ask for 3000, the number that 400'd for months.
+  const q = buildTaskPageQuery({ limit: 3000 });
+  assert.ok(q.limit <= TASK_LIST_MAX_LIMIT, `asked ${q.limit}, cap ${TASK_LIST_MAX_LIMIT}`);
+  const { get, calls } = fakeRoute(corpus(10));
+  await fetchAllTasks(get, { pageSize: 3000 });
+  assert.ok(calls.length > 0, 'the fake must actually have been called');
+  for (const c of calls) {
+    assert.ok(c.limit <= TASK_LIST_MAX_LIMIT, `page asked for limit=${c.limit}`);
+  }
+});
+
+// ------------------------------------------------------- the offset landmine
+
+await t('the FIRST page omits offset entirely (offset=0 is a 400)', () => {
+  const q = buildTaskPageQuery({ offset: 0 });
+  assert.ok(!('offset' in q), 'offset=0 must not be sent — the route rejects it');
+  assert.equal(buildTaskPageQuery({ offset: 1000 }).offset, 1000, 'a real offset is sent');
+});
+
+await t('a full-corpus read never trips bad_offset', async () => {
+  const { get, calls } = fakeRoute(corpus(2500));
+  await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.ok(!('offset' in calls[0]), 'first page must omit offset');
+  assert.ok(calls.slice(1).every((c) => c.offset > 0), 'later pages send a positive offset');
+});
+
+// --------------------------------------------------------------- the paging
+
+await t('reads EVERY row when the corpus is several pages long', async () => {
+  const rows = corpus(2500);
+  const { get, calls } = fakeRoute(rows);
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 2500, 'every row comes back');
+  assert.equal(new Set(out.map((r) => String(r.id))).size, 2500, 'no duplicates');
+  assert.equal(calls.length, 3, '1000 + 1000 + 500');
+});
+
+await t('an exact multiple of the page size still terminates', async () => {
+  const { get, calls } = fakeRoute(corpus(2000));
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 2000);
+  assert.equal(calls.length, 3, 'the third page comes back empty and ends the loop');
+});
+
+await t('a duplicated row across pages is collapsed, not double-counted', async () => {
+  // What an ordering tie does under LIMIT/OFFSET: one row served twice.
+  const rows = [...corpus(1000), ...corpus(1, 1000)];
+  const { get } = fakeRoute(rows);
+  const out = await fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT });
+  assert.equal(out.length, 1000, 'the repeat of id 1000 is deduped by id');
+});
+
+await t('the ORDER BY is a TOTAL order, so pages cannot drop a row', () => {
+  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db-tasks.js'), 'utf8');
+  assert.match(dbSrc, /ORDER BY priority NULLS LAST, created_at, t\.id/,
+    'listTasks must tiebreak on id — priority+created_at tie inside one seeding transaction');
+});
+
+// ------------------------------------------------------------- the failures
+
+await t('a failing page THROWS rather than returning a short corpus', async () => {
+  // The original defect dressed as success: a detector that reports "nothing
+  // found" because its read failed is worse than one that crashes.
+  const get = async () => ({ ok: false, status: 400, data: {} });
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT }), /400/);
+});
+
+await t('a mid-corpus failure does not silently truncate', async () => {
+  const rows = corpus(2500);
+  const real = fakeRoute(rows);
+  let n = 0;
+  const get = async (q) => (++n === 2 ? { ok: false, status: 500, data: {} } : real.get(q));
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT }), /500/);
+});
+
+await t('a route that never returns a short page cannot spin forever', async () => {
+  const get = async (q) => ({ ok: true, status: 200, data: { tasks: corpus(q.limit) } });
+  await assert.rejects(() => fetchAllTasks(get, { pageSize: TASK_LIST_MAX_LIMIT, maxPages: 5 }),
+    /refusing to loop forever/);
+});
+
+console.log(`\ntask_list_paging: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);