@bongos/core 1.19.790 → 1.19.792

package/tests/hall_studio_world.mjs

@@ -106,15 +106,17 @@ test('the verdict is offered only to a viewer the routes will accept', () => {
   assert.match(JS, /studio-verdict__sealed/, 'a viewer below the floor gets a sentence, not three dead buttons');
 });
 
-test('the review card shows the reviewed work\'s picture, through the kit', () => {
-  // "the picture is the card" — and drawn by the kit's ONE full-size renderer
-  // rather than a third hand-rolled <figure> (the task's own instruction).
-  assert.match(JS, /kit\.taskVisualFigureHtml\(/, 'the plate comes from the kit renderer');
+test('the review card shows the reviewed work\'s picture, through the shared renderer', () => {
+  // "the picture is the card" — and drawn by the ONE full-size renderer rather
+  // than a hand-rolled <figure>. That renderer moved out of hall-kit.js into
+  // hall-visual.js in task 1003835, so the Studio now reaches for OTBVisual; the
+  // rule this pins is unchanged, only where the one copy lives.
+  assert.match(JS, /vis\.taskVisualFigureHtml\(/, 'the plate comes from the shared renderer');
   assert.ok(!/<figure/.test(JS), 'studio.js builds no <figure> of its own');
-  assert.match(HTML, /hall-kit\.js/, 'and the page loads the kit that owns it');
+  assert.match(HTML, /hall-visual\.js/, 'and the page loads the file that owns it');
   // The degrade: a review with no visual (or one that could not be read) draws
   // nothing at all rather than an empty frame, so it still reads as a review.
-  assert.match(JS, /if \(!p\.shipped \|\| !kit/, 'no reviewed task, no kit → no plate');
+  assert.match(JS, /if \(!p\.shipped \|\| !vis/, 'no reviewed task, no renderer → no plate');
   // The reviewed task is read for the card in focus, once — not 50 times up front.
   assert.match(JS, /p\.hydrated = true;/, 'the read is made once per review');
   assert.match(JS, /\$\{API\}\/tasks\/\$\{encodeURIComponent\(p\.shippedId\)\}/, 'and it reads the SHIPPED task the review names');
@@ -204,7 +206,8 @@ test('the accent is spent only where the rule allows', () => {
 });
 
 // ---------------------------------------------------------------------------
-// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js beside it
+// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js and
+// hall-visual.js beside it
 // (the bootShell pattern below, pointed at the page script). The static-source
 // assertions above pin the wiring; these render the card and read what it
 // actually says, which is the only way to pin a DEGRADE — "no picture" and
@@ -215,11 +218,15 @@ test('the accent is spent only where the rule allows', () => {
 // NEW_TASK_ID so the "needs work" pair can be followed to its merge.
 const NEW_TASK_ID = '2001';
 async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags = null, onWrite = null } = {}) {
-  // The REAL kit, not a stub — the plate's URL guard and escaping are its code,
-  // and a stub here would make the degrade tests below pass for the wrong reason
-  // (no kit also means no plate). It is node-require-safe by its own contract.
+  // The REAL modules, not stubs — the plate's URL guard and escaping are their
+  // code, and a stub here would make the degrade tests below pass for the wrong
+  // reason (no renderer also means no plate). Both are node-require-safe by their
+  // own contract. hall-visual.js carries the renderer since task 1003835; the kit
+  // is still loaded because the page still uses the rest of it.
   const kit = (await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`)).default;
-  assert.equal(typeof kit.taskVisualFigureHtml, 'function', 'the real kit loaded');
+  const vis = (await import(`file://${path.join(HALL, 'hall-visual.js').replace(/\\/g, '/')}`)).default;
+  assert.equal(typeof vis.taskVisualFigureHtml, 'function', 'the real visual module loaded');
+  assert.equal(typeof kit.taskVisualFigureHtml, 'undefined', 'and the kit no longer carries a second copy');
   const els = new Map();
   const el = (id) => {
     if (!els.has(id)) els.set(id, { id, innerHTML: '', textContent: '', hidden: false, value: '' });
@@ -258,6 +265,7 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
       errMessage: (d) => (d && d.error && d.error.message) || '',
     },
     OTBKit: kit,
+    OTBVisual: vis,
     scrollTo: () => {},
   };
   const document = { addEventListener: (t, h) => handlers.push({ t, h }) };

package/tests/task_visuals.mjs

@@ -13,13 +13,16 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
 const require = createRequire(import.meta.url);
 
 // Point storage at a throwaway dir BEFORE requiring the module.
 const TMP = path.join(os.tmpdir(), `otb-taskvisual-${process.pid}`);
 process.env.TASK_VISUALS_DIR = TMP;
 const tv = require('../modules/lifecycle/task-visuals.js');
-const kit = require('../modules/hall-ui/public/hall-kit.js');
+// The renderers left hall-kit.js for hall-visual.js (task 1003835) — the task
+// record page draws a visual and needs nothing else the kit holds.
+const vis = require('../modules/hall-ui/public/hall-visual.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -140,7 +143,7 @@ await t('persistImageBuffer: writes a name the serve route accepts, under the ri
   assert.equal(tv.taskIdFromName(r.file), 1003109);
   assert.equal(r.url, `/api/bongos/task-visuals/${r.file}`);
   // Both prefixes are permanent aliases, so a URL minted under either resolves.
-  assert.equal(kit.isTaskVisualUrl(r.url), true);
+  assert.equal(vis.isTaskVisualUrl(r.url), true);
   assert.equal(r.bytes, PNG.length);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.deepEqual(onDisk, PNG);
@@ -170,23 +173,23 @@ await t('deleteStored: removes by name or URL, is idempotent, refuses a traversa
 });
 
 // ---- the client-side URL guard --------------------------------------------
-await t('hall-kit: only a server-minted visual URL is ever rendered', () => {
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
-  assert.equal(kit.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
+await t('hall-visual: only a server-minted visual URL is ever rendered', () => {
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
+  assert.equal(vis.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
   // Anything that is not that exact shape renders nothing — including an
   // absolute URL to another origin, and a javascript: payload.
-  assert.equal(kit.isTaskVisualUrl('https://evil.example/x.png'), false);
-  assert.equal(kit.isTaskVisualUrl('javascript:alert(1)'), false);
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
-  assert.equal(kit.isTaskVisualUrl(''), false);
-  assert.equal(kit.isTaskVisualUrl(null), false);
-});
-
-await t('hall-kit: no visual renders nothing at all — never a placeholder', () => {
-  assert.equal(kit.shipVisualThumbHtml({ id: 1 }), '');
-  assert.equal(kit.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.shipVisualThumbHtml(null), '');
-  const html = kit.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
+  assert.equal(vis.isTaskVisualUrl('https://evil.example/x.png'), false);
+  assert.equal(vis.isTaskVisualUrl('javascript:alert(1)'), false);
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
+  assert.equal(vis.isTaskVisualUrl(''), false);
+  assert.equal(vis.isTaskVisualUrl(null), false);
+});
+
+await t('hall-visual: no visual renders nothing at all — never a placeholder', () => {
+  assert.equal(vis.shipVisualThumbHtml({ id: 1 }), '');
+  assert.equal(vis.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.shipVisualThumbHtml(null), '');
+  const html = vis.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
   assert.ok(html.includes('ship-visual-thumb'));
   // The caption is attacker-adjacent text (a builder wrote it) — it must be escaped.
   assert.ok(html.includes('"before"'));
@@ -194,18 +197,18 @@ await t('hall-kit: no visual renders nothing at all — never a placeholder', ()
 });
 
 // ---- the full-size figure (task 1003829) -----------------------------------
-await t('hall-kit: the full-size figure is the same guard, at reading size', () => {
+await t('hall-visual: the full-size figure is the same guard, at reading size', () => {
   // Same no-placeholder rule as the thumbnail: nothing at all without a visual.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1 }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.taskVisualFigureHtml(null), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1 }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.taskVisualFigureHtml(null), '');
   // And the same URL wall — an off-origin src or a javascript: payload is not
   // "rendered without a caption", it is not rendered.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
 
   const url = '/api/gds/task-visuals/task-1-0011223344556677.png';
-  const html = kit.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
+  const html = vis.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
   assert.ok(html.includes('<figure class="task-visual">'));
   assert.ok(html.includes('class="task-visual__img"'));
   // The caption is the SHIPPER's text — attacker-adjacent, so escaped in both
@@ -215,19 +218,80 @@ await t('hall-kit: the full-size figure is the same guard, at reading size', ()
 
   // The caller owns the size, so it owns the class base; anything but
   // [A-Za-z0-9_-] is stripped rather than interpolated into the attribute.
-  const studio = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
+  const studio = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
   assert.ok(studio.includes('<figure class="studio-plate">'));
   assert.ok(studio.includes('class="studio-plate__img"'));
-  const hostile = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
+  const hostile = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
   assert.ok(hostile.includes('<figure class="xonloada">'), hostile);
 
   // No written alt → no caption at all. The fallback alt is a machine sentence
   // for a screen reader, never a caption shown to a reader.
-  const bare = kit.taskVisualFigureHtml({ id: 7, visual_url: url });
+  const bare = vis.taskVisualFigureHtml({ id: 7, visual_url: url });
   assert.ok(!bare.includes('figcaption'));
   assert.ok(bare.includes('alt="Visual for task 7"'));
 });
 
+// ---- the convergence is the deliverable (task 1003835) ---------------------
+//
+// Reading the source is the right altitude here: the defect this task closes is
+// a SECOND definition existing, which no behavioural assertion against one of
+// them can see. A duplicate renderer passes every test above.
+
+const HALL = (f) => fsSync.readFileSync(new URL(`../modules/hall-ui/public/${f}`, import.meta.url), 'utf8');
+
+await t('hall-kit no longer defines a visual renderer', () => {
+  const kitSrc = HALL('hall-kit.js');
+  // The function DEFINITIONS are what must be gone — the pointer comment naming
+  // them is the thing that tells the next reader where they went, so match on
+  // the definition syntax rather than on the bare name.
+  assert.ok(!/function\s+taskVisualFigureHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines taskVisualFigureHtml');
+  assert.ok(!/function\s+shipVisualThumbHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines shipVisualThumbHtml');
+  assert.ok(!/function\s+isTaskVisualUrl\s*\(/.test(kitSrc), 'hall-kit.js still defines isTaskVisualUrl');
+  // …and it must not re-export them either, or callers keep two ways in.
+  const kitApi = require('../modules/hall-ui/public/hall-kit.js');
+  assert.equal(kitApi.taskVisualFigureHtml, undefined);
+  assert.equal(kitApi.shipVisualThumbHtml, undefined);
+  assert.equal(kitApi.isTaskVisualUrl, undefined);
+});
+
+await t('task.js renders through the shared module, not its own <figure>', () => {
+  const src = HALL('task.js');
+  assert.ok(src.includes('vis.taskVisualFigureHtml(t, { className: \'tk-visual\' })'),
+    'task.js should delegate to OTBVisual with its own class base');
+  // The hand-rolled markup is the thing that came back three times. If any of it
+  // reappears in this file, the convergence has been undone.
+  assert.ok(!src.includes('<figure class="tk-visual">'), 'task.js hand-rolls the figure again');
+  assert.ok(!src.includes('tk-visual__img'), 'task.js hand-rolls the img class again');
+  assert.ok(!src.includes('task-visuals/task-'), 'task.js carries its own copy of the URL guard again');
+});
+
+await t('every page whose script draws a visual actually loads hall-visual.js', () => {
+  // A missing <script> is the one failure this split introduces, and it is
+  // silent: the guard in each caller degrades to rendering nothing, so a visual
+  // would simply stop appearing with no error anywhere.
+  for (const page of ['index.html', 'profile.html', 'studio.html', 'task.html']) {
+    assert.ok(HALL(page).includes('/builders/hall-visual.js'), `${page} does not load hall-visual.js`);
+  }
+});
+
+await t('the callers reach for OTBVisual, and no longer for the kit', () => {
+  for (const f of ['hall-render.js', 'profile.js', 'studio.js', 'task.js']) {
+    const src = HALL(f);
+    assert.ok(!/OTBKit(\.|\[')?\s*(shipVisualThumbHtml|taskVisualFigureHtml|isTaskVisualUrl)/.test(src),
+      `${f} still reads a visual renderer off OTBKit`);
+  }
+  assert.ok(HALL('hall-render.js').includes('window.OTBVisual.shipVisualThumbHtml'));
+  assert.ok(HALL('studio.js').includes('vis.taskVisualFigureHtml('));
+});
+
+await t('the dead .td-visual rules are gone, and nothing emits the class', () => {
+  // task 1003829's comment and this task's own brief both asserted a second
+  // renderer in task-detail.js. `git log -S` shows that file never carried one:
+  // the CSS was the fossil of a renderer that was planned and not built.
+  assert.ok(!HALL('style.css').includes('.td-visual'), 'style.css still carries the dead rules');
+  assert.ok(!HALL('task-detail.js').includes('td-visual'));
+});
+
 // ---- cleanup ---------------------------------------------------------------
 await fs.rm(TMP, { recursive: true, force: true });