@bongos/core 1.19.805 → 1.19.807

package/tests/goal_invite_consent.mjs

@@ -0,0 +1,307 @@
+// tests/goal_invite_consent.mjs — the goals page INVITES; it does not force-add
+// behind the word "Invited." (task 1002886, goal 1000095).
+//
+// WHY THIS FILE EXISTS. The '+ Invite' control posted to POST /goals/:id/members
+// — the immediate force-add — and then toasted 'Invited.' The person was already
+// in the goal and had never been asked. Meanwhile ADR 0112's consented flow
+// (POST /goals/:id/invitations -> a pending row -> the invitee accepts) had its
+// RECEIVING half fully wired in goal-inbox.js and no sender anywhere in the hall,
+// so nothing in the product ever created an invitation.
+//
+// Nothing in tests/ touched the invite box before this file — which is how a
+// control could claim one thing and do the opposite for as long as it did. The
+// lesson generalises past this button: assert the REQUEST a control issues and
+// the SENTENCE it then shows, because those two drifting apart is invisible to
+// any test that only checks the control renders.
+//
+// It runs the REAL goals-render.js (plus the real goals-lib, task-lib and kit)
+// in a vm against a stub DOM and a recording postJSON, and drives renderDetail —
+// the actual entry point, not the private renderer — so what is asserted is the
+// call the page really makes.
+//
+// Run:  node tests/goal_invite_consent.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const P = 'modules/hall-ui/public/';
+const RENDER_JS = read(`${P}goals-render.js`);
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+const SELF = 7001;          // the viewer: the goal's creator, so canManage is true
+const MEMBER_ID = 7002;     // already in the goal
+const PENDING_ID = 7003;    // holds a pending invitation the goal sent
+const FREE_ID = 7004;       // neither — the only genuinely invitable builder
+
+function makeEl(id) {
+  const el = {
+    id,
+    innerHTML: '', textContent: '', value: '', className: '',
+    hidden: false, disabled: false, checked: false,
+    options: [], style: {}, dataset: {},
+    children: [],
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild(c) { el.children.push(c); return c; },
+    setAttribute() {}, removeAttribute() {}, focus() {}, scrollIntoView() {},
+    _on: new Map(),
+    addEventListener(ev, fn) {
+      if (!el._on.has(ev)) el._on.set(ev, []);
+      el._on.get(ev).push(fn);
+    },
+    fire(ev, arg) {
+      for (const fn of el._on.get(ev) || []) fn(arg || { preventDefault() {} });
+    },
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+  };
+  return el;
+}
+
+function harness({ pendingRequests = [] } = {}) {
+  const els = new Map();
+  // The box is re-rendered by replacing innerHTML, and the stub DOM does not
+  // parse HTML — so the controls the page writes into #goal-invite are modelled
+  // by their ids, which is exactly how the page reaches them ($('#id')).
+  // Ids the invite box writes INTO itself. Listed rather than inferred because
+  // the stub does not parse HTML — this is the seam where it has to imitate the
+  // one thing real innerHTML does that matters here: destroy what was there.
+  const INVITE_CHILD_IDS = [
+    'goal-invite-open', 'goal-invite-form', 'goal-invite-builder', 'goal-invite-note',
+    'goal-invite-cancel', 'goal-direct-open', 'goal-direct-form', 'goal-direct-builder',
+    'goal-direct-kind', 'goal-direct-cancel',
+  ];
+  const getEl = (id) => {
+    const key = String(id).replace(/^#/, '');
+    if (!els.has(key)) {
+      const el = makeEl(key);
+      if (key === 'goal-invite') {
+        // THE BUG THIS MODELS IS REAL: renderInviteBox rebuilds the box on every
+        // call, and a stub that kept the old nodes alive would keep their click
+        // handlers too — so a single click would re-enter the renderer once per
+        // previous render. That is a defect in the STUB, not the page, but only
+        // because the page really does replace these nodes. Keep them in step.
+        let html = '';
+        Object.defineProperty(el, 'innerHTML', {
+          get: () => html,
+          set: (v) => { html = String(v); for (const cid of INVITE_CHILD_IDS) els.delete(cid); },
+        });
+      }
+      els.set(key, el);
+    }
+    return els.get(key);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    body: makeEl('body'),
+    getElementById: getEl,
+    querySelector: (sel) => getEl(sel),
+    querySelectorAll: () => [],
+    createElement: () => makeEl(),
+    addEventListener() {},
+  };
+
+  const posts = [];
+  const toasts = [];
+  const state = {
+    current: 1,
+    view: 'detail',
+    details: new Map(),
+    directory: [
+      { id: MEMBER_ID, display_name: 'Ada Member', github_login: 'ada' },
+      { id: PENDING_ID, display_name: 'Ben Pending', github_login: 'ben' },
+      { id: FREE_ID, display_name: 'Cleo Free', github_login: 'cleo' },
+    ],
+    pendingRequests,
+    myPendingRequest: null,
+    inviteOpen: false,
+    addDirectOpen: false,
+    // The rest of the page state renderDetail walks through on its way to the
+    // invite box. Shapes copied from goals-page.js's initial state — the
+    // renderers read several of these unguarded, so a partial stub throws
+    // before execution ever reaches what is under test here.
+    workSort: { todo: { by: null, dir: 'desc' }, done: { by: null, dir: 'desc' } },
+    work: { todo: [], done: [] },
+    workLoaded: false,
+    claimsByTask: new Map(),
+    conflictPairs: null,
+    conflictSource: null,
+    rollups: new Map(),
+    activity: new Map(),
+  };
+
+  const windowObj = {
+    location: { assign() {}, href: '/goals' },
+    localStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    scrollTo() {}, addEventListener() {},
+    matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtNum: (n) => String(n ?? ''),
+      fmtInt: (n) => String(n ?? ''),
+      fmtDate: (d) => String(d ?? '').slice(0, 10),
+      toast: (m) => toasts.push(String(m)),
+      rankLabel: (r) => String(r ?? ''),
+      categoryChip: () => '',
+      num: (n) => Number(n) || 0,
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON, Set, Map,
+    fetch: () => Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['hall-kit.js', 'task-lib.js', 'goals-lib.js', 'goals-render.js']) {
+    vm.runInContext(read(P + f), sandbox, { filename: f });
+  }
+
+  const goal = {
+    id: 1, version_id: 'BONGOS-V2', status: 'open', visibility: 'public',
+    created_by: SELF, title: 'A goal', scope_modules: [], accepting_requests: true,
+  };
+  const members = [{ builder_id: MEMBER_ID, display_name: 'Ada Member', membership_kind: 'member' }];
+  const detail = { goal, members, criteria: [], satisfied: [], tasks: [] };
+  state.details.set('1', detail);
+
+  const api = sandbox.window.OTBGoalsRender({
+    API: '/api/bongos',
+    curLabel: () => 'Credits',
+    // URL-aware, because the renderers walk several feeds on the way to the
+    // invite box and a one-shape-fits-all reply feeds the wrong array into the
+    // wrong pager.
+    getJSON: async (url) => {
+      if (/\/goals\/\d+\/requests$/.test(url)) return { requests: pendingRequests };
+      if (/\/goals\/inbox$/.test(url)) return { myPendingRequests: [] };
+      if (/\/builders\/directory/.test(url)) return { builders: state.directory };
+      if (/\/tasks/.test(url)) return { tasks: [] };
+      if (/\/claims/.test(url)) return { claims: [] };
+      return {};
+    },
+    patchJSON: async () => ({}),
+    postJSON: async (url, body) => { posts.push({ url, body }); return { ok: true }; },
+    sameId: (a, b) => String(a ?? '') === String(b ?? ''),
+    selfId: () => SELF,
+    state,
+    get workTabs() { return { activate() {} }; },
+  });
+
+  return { api, state, posts, toasts, getEl, els };
+}
+
+// Open the invite box the way a user does: render the detail, then click
+// "+ Invite". Returns the harness with the form on screen.
+async function openInviteForm(h) {
+  h.api.renderDetail(1);
+  await tick();
+  h.getEl('goal-invite-open').fire('click');
+  await tick(); await tick();
+  return h;
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the source no longer names the force-add as an "invite"', () => {
+  assert.ok(!/async function inviteMember\b/.test(RENDER_JS),
+    'inviteMember() was the force-add wearing the word invite — it is split in two');
+  assert.match(RENDER_JS, /async function sendInvitation\(/, 'the consented sender exists');
+  assert.match(RENDER_JS, /async function addMemberDirectly\(/, 'the force-add is named for what it does');
+  assert.ok(!/toast\('Invited\.'\)/.test(RENDER_JS), "the 'Invited.' toast on a force-add is gone");
+});
+
+await test('the invite form posts to /invitations and never claims they joined', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '  we could use your eye on this  ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1, 'exactly one write');
+  const { url, body } = h.posts[0];
+  assert.match(url, /\/goals\/1\/invitations$/, 'the CONSENTED endpoint, not /members');
+  assert.ok(!/\/members$/.test(url), 'the force-add endpoint is not what Invite calls');
+  assert.equal(body.builder_id, FREE_ID);
+  assert.equal(body.note, 'we could use your eye on this', 'the note is sent, trimmed');
+  assert.ok(!('membership_kind' in body),
+    'the invitations route carries no membership_kind — sending one would be a choice dropped in silence');
+
+  const said = h.toasts.join(' ');
+  assert.match(said, /accept/i, 'the toast turns on their acceptance');
+  assert.ok(!/^Invited\.$/.test(h.toasts[0]), 'the old lie is not relocated');
+  assert.ok(!/\b(added|joined|is now a member)\b/i.test(said),
+    `nobody joined anything yet — got: ${JSON.stringify(h.toasts)}`);
+});
+
+await test('an empty note is omitted rather than sent as an empty string', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '   ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+  assert.ok(!('note' in h.posts[0].body), 'a blank note is absent, not ""');
+});
+
+await test('the invite form offers no membership-kind picker', async () => {
+  const h = await openInviteForm(harness());
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!/id="goal-invite-kind"/.test(html),
+    'the picker cannot be honoured by an invitation — goal_membership_requests has no such column');
+  assert.match(html, /join as a member/i, 'and the form says what they will join as instead');
+});
+
+await test('the dropdown excludes members AND anyone already pending', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 55, kind: 'invite', builder_id: PENDING_ID, display_name: 'Ben Pending' }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(html.includes(`value="${FREE_ID}"`), 'the invitable builder is offered');
+  assert.ok(!html.includes(`value="${MEMBER_ID}"`), 'a member would 409 already_a_member');
+  // The one that matters: a pending invitation is INVISIBLE in the member list,
+  // so without this filter the user picks an ordinary-looking name and is handed
+  // an error they had no way to predict.
+  assert.ok(!html.includes(`value="${PENDING_ID}"`), 'a pending invitee would 409 invite_pending');
+});
+
+await test('a pending JOIN-REQUEST is excluded too, not just an invitation', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 56, kind: 'request', builder_id: PENDING_ID }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!html.includes(`value="${PENDING_ID}"`),
+    'the server refuses on EITHER kind, so the filter may not look only at invites');
+});
+
+await test('the force-add survives, one click away, and says nobody was asked', async () => {
+  const h = await openInviteForm(harness());
+  const collapsed = h.getEl('goal-invite').innerHTML;
+  assert.match(collapsed, /without asking/i, 'the path is discoverable, not removed');
+  assert.ok(!/id="goal-direct-form"/.test(collapsed), 'but it is not the default control');
+
+  h.getEl('goal-direct-open').fire('click');
+  await tick();
+  const open = h.getEl('goal-invite').innerHTML;
+  assert.match(open, /id="goal-direct-kind"/, 'the membership kind IS honoured on this path, so it is offered here');
+
+  h.getEl('goal-direct-builder').value = String(FREE_ID);
+  h.getEl('goal-direct-kind').value = 'lead';
+  h.getEl('goal-direct-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1);
+  assert.match(h.posts[0].url, /\/goals\/1\/members$/, 'the force-add endpoint');
+  assert.equal(h.posts[0].body.membership_kind, 'lead', 'and the chosen kind travels');
+  const said = h.toasts.join(' ');
+  assert.match(said, /without being asked/i, 'the consequence is stated, not hidden behind "Invited."');
+});
+
+summary();

package/tests/routine_schedule.mjs

@@ -50,13 +50,73 @@ test('cronCadence refuses what its vocabulary cannot describe, rather than guess
   // Unclassifiable must mean "never matches a declared cadence" — the safe
   // direction. A clever cron that silently counted as `weekly` would reopen
   // exactly the drift this check exists to catch.
-  for (const expr of ['*/5 * * * *', '0 6 * * 1-5', '0 6 * * 1,4', '0 0 1 1 *', '17 6 * *', '', 'nonsense']) {
+  for (const expr of ['0 6 * * 1-5', '0 6 * * 1,4', '0 0 1 1 *', '17 6 * *', '', 'nonsense']) {
     assert.equal(rs.cronCadence(expr), null, `${expr} should not classify`);
   }
   // A day-of-month AND day-of-week together is an OR in cron — neither period.
   assert.equal(rs.cronCadence('17 6 3 * 1'), null);
 });
 
+test('cronCadence classifies a uniform sub-hourly step (task 1003674)', () => {
+  // The vocabulary used to stop at `hourly`, so a routine meant to fire every
+  // 15 minutes had no way to declare it: the cron that realizes it read as
+  // unclassifiable and hard-failed, leaving "declare nothing, stay dormant" as
+  // the only green option — the state this check exists to refuse.
+  assert.equal(rs.cronCadence('*/15 * * * *'), '15min');
+  assert.equal(rs.cronCadence('*/5 * * * *'), '5min');
+  assert.equal(rs.cronCadence('*/30 * * * *'), '30min');
+  assert.equal(rs.cronCadence('0/15 * * * *'), '15min', 'the 0/N spelling is the same schedule');
+});
+
+test('cronCadence refuses a step that is not a true period (task 1003674)', () => {
+  // A cron step restarts every hour, so only a divisor of 60 is uniform:
+  // */7 fires at :00…:56 then waits 4. Calling that "7min" would be the same
+  // silent drift between declared and realized period the check is here for.
+  for (const expr of ['*/7 * * * *', '*/8 * * * *', '*/45 * * * *', '*/60 * * * *', '*/0 * * * *']) {
+    assert.equal(rs.cronCadence(expr), null, `${expr} is not a uniform period`);
+  }
+  // A step narrowed to one hour or one weekday is not the sub-hourly period it
+  // resembles — it only fires inside that window.
+  assert.equal(rs.cronCadence('*/15 6 * * *'), null);
+  assert.equal(rs.cronCadence('*/15 * * * 1'), null);
+});
+
+test('isCadence accepts the named periods and the divisor-of-60 Nmin form (task 1003674)', () => {
+  for (const ok of ['hourly', 'daily', 'weekly', 'monthly', '15min', '5min', '30min', '1min']) {
+    assert.equal(rs.isCadence(ok), true, `${ok} should be declarable`);
+  }
+  for (const no of ['7min', '60min', '90min', 'min', '0min', 'fortnightly', '', null, undefined]) {
+    assert.equal(rs.isCadence(no), false, `${no} should not be declarable`);
+  }
+});
+
+test('a routine declaring a sub-hourly cadence matches a step cron that fires it (task 1003674)', () => {
+  // End-to-end through evaluate(): declaring 15min is only green when a
+  // committed scheduler actually fires it at 15 minutes.
+  const wf = (cron) => [{
+    file: 'sweep.yml',
+    text: `on:\n  schedule:\n    - cron: '${cron}'\njobs:\n  go:\n    steps:\n      - run: node scripts/gds/run-routine.js sweepy\n`,
+  }];
+  const declared = routines([{ name: 'sweepy', cadence: '15min', steps: [] }]);
+  assert.deepEqual(rs.evaluate(declared, wf('*/15 * * * *')).violations, []);
+
+  // Wrong period, and the check names both sides rather than shrugging.
+  const drifted = rs.evaluate(declared, wf('17 6 * * *')).violations;
+  assert.equal(drifted.length, 1);
+  assert.match(drifted[0], /declares cadence: 15min/);
+  assert.match(drifted[0], /-> daily|→ daily/);
+
+  // A non-divisor step cannot satisfy it either — it classifies as nothing.
+  assert.match(rs.evaluate(declared, wf('*/7 * * * *')).violations[0], /unclassifiable/);
+});
+
+test('an undeclarable cadence is refused by name (task 1003674)', () => {
+  const v = rs.evaluate(routines([{ name: 'sweepy', cadence: '7min', steps: [] }]), []).violations;
+  assert.equal(v.length, 1);
+  assert.match(v[0], /unknown cadence "7min"/);
+  assert.match(v[0], /N divides 60/);
+});
+
 test('workflowCrons reads every cron a workflow declares, quoted or bare, ignoring trailing comments', () => {
   const y = ["  schedule:", "    - cron: '17 6 * * 1'", '    - cron: "0 3 * * *"', '    - cron: 5 * * * *  # bare + comment'].join('\n');
   assert.deepEqual(rs.workflowCrons(y), ['17 6 * * 1', '0 3 * * *', '5 * * * *']);