@bongos/core 1.19.791 → 1.19.793

package/tests/auth_session_ttl.mjs

@@ -19,15 +19,30 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const db = require('../src/bongos/db.js');
 
 let passed = 0;
 let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+// Cases are queued rather than run inline so an ASYNC one (the createSession
+// checks below hit a stubbed pool through an async function) is actually awaited.
+// Running those inline would report PASS before the assertion resolved, and a
+// rejection would surface as an unhandled rejection instead of a FAIL.
+const queue = [];
+function t(name, fn) { queue.push({ name, fn }); }
+// Section headers queue too, so they still print ABOVE the cases they introduce
+// instead of all bunching at the top once execution is deferred.
+function section(label) { queue.push({ label }); }
+async function runQueue() {
+  for (const item of queue) {
+    if (item.label) { console.log(item.label); continue; }
+    const { name, fn } = item;
+    try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+    catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+  }
+  queue.length = 0;
 }
 
 // ---------------------------------------------------------------------------
@@ -103,7 +118,7 @@ function isDemotion(oldRank, newRank) {
   return newIdx > oldIdx;
 }
 
-console.log('\ndemotion-detection (revoke-all hook in setBuilderRank):');
+section('\ndemotion-detection (revoke-all hook in setBuilderRank):');
 
 t('archon → metic is a demotion (revoke triggers)', () => {
   assert.equal(isDemotion('archon', 'metic'), true);
@@ -135,21 +150,119 @@ t('an unknown rank string does not crash and returns false', () => {
 });
 
 // ---------------------------------------------------------------------------
-// 3. TTL constant (criterion C9: idle-session hygiene)
+// 3. No expiry on a CLI session (ADR 0294)
 // ---------------------------------------------------------------------------
-// V3.R90 / #400: widened from 1h to 24h. Refresh-on-use is unchanged, so an
-// actively-used session is still indefinite — the constant only governs how
-// long an idle session lives. 1h kicked builders out over lunch; 24h still
-// kills idle sessions overnight. C7 (rank-change-near-instant) is unaffected
-// because demotion calls revokeAllSessionsForBuilder synchronously.
+// The TTL was argued three times — 1h (V3.R38/#259), 24h (V3.R90/#400), then
+// gone (ADR 0294 / task 1003956). The first two rounds moved the number; the
+// third removed the mechanism, because refresh-on-use meant the timer only ever
+// fired on a session gone QUIET — the legitimate holder stepping away — while a
+// leaked token's own traffic kept it alive. What is asserted here is the shape
+// that replaced it, and the two ways it could silently come back.
+//
+// createSession is exercised against a STUB POOL rather than a live Postgres, in
+// keeping with this file's no-real-PG stance: the claim under test is which
+// value reaches the INSERT, which is a pure function of the argument. The pool
+// module is stubbed in the require cache before db-kernel is loaded fresh, since
+// db-kernel binds `pool` once at module load.
 
-console.log('\nSESSION_TTL_MS constant:');
+section('\nSESSION_TTL_MS constant:');
 
 t('SESSION_TTL_MS is exactly 24 hours (86,400,000 ms)', () => {
   assert.equal(db.SESSION_TTL_MS, 24 * 60 * 60 * 1000);
 });
 
+section('\ncreateSession expiry default (ADR 0294):');
+
+// Load db-kernel over a stub pool that records the parameters it is handed.
+const poolPath = require.resolve('../src/bongos/pool.js');
+const kernelPath = require.resolve('../src/bongos/db-kernel.js');
+const realPool = require.cache[poolPath];
+const realKernel = require.cache[kernelPath];
+const calls = [];
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true, exports: {
+    pool: { query: async (text, params) => { calls.push({ text, params }); return { rows: [{ id: '1' }] }; } },
+  },
+};
+delete require.cache[kernelPath];
+const kernel = require('../src/bongos/db-kernel.js');
+
+// expires_at is the 5th INSERT parameter — see createSession's VALUES list.
+async function expiryFor(expiresAt) {
+  calls.length = 0;
+  await kernel.createSession({ builderId: '1', token: 't', source: 'cli', userAgent: null, expiresAt });
+  return calls[0].params[4];
+}
+
+t('a CLI session named with NO expiry is stored with expires_at NULL', async () => {
+  assert.equal(await expiryFor(null), null);
+});
+
+t('an OMITTED expiresAt is also stored as NULL, not a 24h default', async () => {
+  assert.equal(await expiryFor(undefined), null);
+});
+
+t('an EXPLICIT expiry is preserved verbatim — the web flow keeps its 30 days', async () => {
+  const thirtyDays = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+  assert.equal((await expiryFor(thirtyDays)).getTime(), thirtyDays.getTime());
+});
+
+section('\nrefresh-on-use must not re-mint an expiry (ADR 0294):');
+
+// THE REGRESSION THIS GUARDS. lookupSession rolls expires_at forward on every
+// authenticated request. Without the NULL guard, the FIRST request after sign-in
+// would write now()+24h onto a never-expires row and restore the whole timeout —
+// silently, with createSession still looking correct. Asserted over the source
+// because the behaviour lives in SQL the stub pool never executes.
+const kernelSrc = readFileSync(new URL('../src/bongos/db-kernel.js', import.meta.url), 'utf8');
+const refreshSql = kernelSrc.slice(
+  kernelSrc.indexOf('UPDATE builder_sessions'),
+  kernelSrc.indexOf('[row.session_id, SESSION_TTL_MS]')
+);
+
+t("refresh-on-use leaves a NULL expires_at NULL", () => {
+  assert.ok(refreshSql.includes('UPDATE builder_sessions'), 'refresh statement not found');
+  assert.match(refreshSql, /CASE\s*\n?\s*WHEN expires_at IS NULL THEN NULL/);
+});
+
+t('refresh-on-use still bumps last_used_at (the own-sessions list reads it)', () => {
+  assert.match(refreshSql, /last_used_at = now\(\)/);
+});
+
+section('\nmigration core_243 scope:');
+
+// The migration clears expires_at on rows that already exist. Its source filter
+// is the entire safety property: lookupSession only rolls an expiry it can
+// already SEE, so a web row cleared here would stay cleared forever — an
+// immortality nobody decided on, and unrecoverable by normal use.
+//
+// Comment lines are STRIPPED before matching. This file's header explains the
+// source filter at length, so asserting over the raw text would let the prose
+// satisfy a check the statement no longer meets — verified by deleting the WHERE
+// clause and watching the revoked_at assertion still pass.
+const migrationSql = readFileSync(
+  new URL('../migrations/core_243_cli_sessions_never_expire.sql', import.meta.url), 'utf8'
+)
+  .split('\n')
+  .filter((line) => !line.trim().startsWith('--'))
+  .join('\n');
+
+t("core_243 only clears CLI rows", () => {
+  assert.match(migrationSql, /SET expires_at = NULL/);
+  assert.match(migrationSql, /WHERE source = 'cli'/);
+});
+
+t('core_243 leaves revoked rows alone (they are the audit trail)', () => {
+  assert.match(migrationSql, /revoked_at IS NULL/);
+});
+
 // ---------------------------------------------------------------------------
 
+await runQueue();
+
+// Put the real modules back so anything importing this file after it is unaffected.
+if (realPool) require.cache[poolPath] = realPool; else delete require.cache[poolPath];
+if (realKernel) require.cache[kernelPath] = realKernel; else delete require.cache[kernelPath];
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/bongos_cli.mjs

@@ -13,6 +13,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -43,6 +44,33 @@ test('verbHelpText: names the verb, its summary, and the full-help pointer', ()
   assert.match(out, /bongos help/);
 });
 
+// task 1003961 — the hall's re-auth copy button emits `bongos paste-token <token>`.
+// That string is composed by the SERVER and run on an INSTANCE, so the verb has to
+// exist here or the one-click path dead-ends on "unknown command". Pinned against
+// the routes file so the two halves cannot drift apart.
+test('paste-token is a registered verb wired to paste-token.js', () => {
+  const def = cli.VERBS['paste-token'];
+  assert.ok(def, 'bongos paste-token must be a registered verb');
+  assert.equal(def.script, 'paste-token.js');
+  assert.equal(def.group, 'account', 'it belongs with the other session verbs');
+});
+
+test('paste-token is bundled into the standalone binary, like reauth', () => {
+  // Two halves of one on-ramp: reauth mints the token, paste-token stores it.
+  // A builder recovering a dead session on a bare laptop has only the binary.
+  assert.ok(cli.BUNDLED_RUNNERS['paste-token.js'],
+    'paste-token.js must be in BUNDLED_RUNNERS or the compiled binary refuses the verb');
+  assert.ok(cli.BUNDLED_RUNNERS['reauth.js'], 'reauth is the sibling this mirrors');
+});
+
+test('the server emits exactly the verb the CLI registers', () => {
+  const routes = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
+  const m = routes.match(/paste_command:\s*`([^`]+)`/);
+  assert.ok(m, 'auth.js should emit a paste_command template literal');
+  const verb = m[1].split(' ')[1];
+  assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+});
+
 test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {
   // Verified by reading each script (they all branch on --help/-h to a usage()
   // printer). If a verb is added here, verify its script first — a wrong

package/tests/cli_token_reissue.mjs

@@ -119,16 +119,23 @@ const issueBlock = (() => {
   return routeSrc.slice(start, start + 3000);
 })();
 
-t("the issue handler reads SESSION_COOKIE (not just Authorization)", () => {
-  assert.ok(issueBlock.includes('parseCookie(req, SESSION_COOKIE)'),
-    'handler must use parseCookie(req, SESSION_COOKIE)');
+// Refreshed for the current handler (task 1003961). These two assertions named
+// `parseCookie(req, SESSION_COOKIE)` and `res.status(403)`, the shape BEFORE the
+// handler moved to the `sessionCookieToken` helper and the `res.fail` envelope.
+// They had been red on main ever since — invisible, because this file is in the
+// runner's INTEGRATION set and self-skips in CI's DB-free lane. Left alone they
+// would have masked the new assertions below: a file that is already red cannot
+// tell you whether the test you just added passes.
+t("the issue handler reads the session COOKIE (not just Authorization)", () => {
+  assert.ok(issueBlock.includes('sessionCookieToken(req)'),
+    'handler must resolve the browser cookie via sessionCookieToken(req)');
 });
 
 t('the issue handler rejects bearer-only callers with cookie_required', () => {
   assert.ok(issueBlock.includes("cookie_required"),
     "error code 'cookie_required' missing");
-  assert.ok(/status\(403\)/.test(issueBlock),
-    'must respond with 403 when cookie is missing');
+  assert.ok(/status:\s*403/.test(issueBlock),
+    'must respond 403 when the cookie is missing (res.fail envelope carries `status: 403`)');
 });
 
 t("mints a session with source='cli' (CHECK constraint compliant)", () => {
@@ -141,6 +148,23 @@ t('returns a paste_command field the portal can show verbatim', () => {
     'response should include paste_command for one-click UX');
 });
 
+// The regression this pins (task 1003961): paste_command is composed on the SERVER
+// and run on an INSTANCE, where the core is an installed dependency and there is no
+// `scripts/gds/` directory. Emitting a repo-relative script path handed every
+// instance builder a command naming a file they did not have. A verb has no such
+// coupling — `bongos` is on PATH wherever the core is installed.
+t('paste_command names a CLI VERB, never a filesystem path', () => {
+  const m = issueBlock.match(/paste_command:\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command should be a template literal the test can read');
+  const cmd = m[1];
+  assert.ok(/^bongos paste-token /.test(cmd),
+    `paste_command must start with the verb form, got: ${cmd}`);
+  assert.ok(!cmd.includes('/'),
+    `paste_command must contain no path separator — it runs where the layout differs. Got: ${cmd}`);
+  assert.ok(!/\bnode\b/.test(cmd),
+    `paste_command must not invoke node directly (that assumes a script on disk). Got: ${cmd}`);
+});
+
 // ---------------------------------------------------------------------------
 
 console.log(`\n${passed} passed, ${failed} failed`);