@bongos/core 1.19.865 → 1.19.866

package/tests/hall_builders_page_pass.mjs

@@ -0,0 +1,324 @@
+// tests/hall_builders_page_pass.mjs — the three parts of task 1004004, each
+// pinned by RUNNING the shipped renderer rather than reading it.
+//
+// The three were filed separately (1002851, 1002837, 1002835) and consolidated
+// because their touches[] overlap serialised them anyway. What they share is one
+// failure mode: a fact the hall already holds was rendered as a footnote, as
+// nothing at all, or not rendered at all, so the reader had to go and look it up
+// somewhere else.
+//
+//   A (1002851) — the signed-out landing. Signing in was a footnote LINK, but
+//     only on the `apply` door; `open` and `invite_only` already render a real
+//     .landing__btn inside the primary door. So the button belongs on `apply`
+//     alone — adding one to all three would have made a third scattered path.
+//     These tests hold BOTH halves: the button appears on `apply`, and the two
+//     doors that already had one do NOT grow a second.
+//   B (1002837) — the roster's place cell. A builder's number is the id every
+//     task row and ship note cites, and the roster was the one place that knew
+//     who the builder was and didn't print it. Degrades to the place alone when
+//     the payload carries no id.
+//   C (1002835) — the peer-acclaim feed. A karma vote was cast on a title. The
+//     grade and the cost now ride along, and ABSENCE RENDERS AS ABSENCE: an
+//     ungraded ship says "not graded" and an unlogged cost says "no cost
+//     logged", because 0.0 and $0.00 are measurements that were never taken.
+//
+// Pure vm + file-read (no DB, no network) — runs in the DB-free unit gate.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8').replace(/\r\n/g, '\n');
+
+const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => (
+  { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+));
+
+// Count real sign-in CONTROLS (a .landing__btn), as opposed to prose links.
+const countButtons = (html) => (html.match(/class="[^"]*landing__btn[^"]*"/g) || []).length;
+
+// =========================================================================
+// PART A — the returning builder's door (task 1002851)
+// =========================================================================
+
+// Render the signed-out landing for one joinability mode and hand back the HTML
+// the page actually wrote. Runs the shipped hall-render.js in a DOM stub thin
+// enough that anything renderLanding touches beyond the landing root would
+// throw rather than pass silently.
+function hallRender(joinability) {
+  let written = '';
+  const el = (extra = {}) => ({
+    hidden: false,
+    textContent: '',
+    contains() { return false; },
+    addEventListener() {},
+    set innerHTML(v) { written = v; },
+    get innerHTML() { return written; },
+    ...extra,
+  });
+  const nodes = { '#landing-root': el(), '#welcome-line': el() };
+
+  const sandbox = {
+    window: {
+      OTB: {
+        escapeHtml,
+        $: (sel) => nodes[sel] || null,
+        fmtNum: (n) => String(n),
+        moduleOn: () => true,
+      },
+      OTBShell: { applyAccess() {} },
+      // hall-render builds its pagers at factory time; the landing uses none.
+      OTBKit: { makePager: () => ({ page: 1 }), pagerBarHtml: () => '' },
+      __BRANDING__: joinability ? { project: { joinability } } : {},
+    },
+    document: { querySelectorAll: () => [] },
+    console,
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(read('hall-render.js'), sandbox, { filename: 'hall-render.js' });
+
+  const hall = sandbox.window.OTBHallRender({
+    API: '/api/bongos',
+    RANK_ORDER: { xenos: 1, thetes: 2, metic: 3, archon: 4 },
+    api: { request: () => Promise.resolve({ status: 200, ok: true, data: {} }) },
+    brandWorld: () => 'Testworld',
+    curLabel: () => 'Credits',
+    emptyRow: () => '',
+    fmtDate: () => '',
+    mins: () => '',
+    normalizeRank: (r) => r,
+    pct: () => 0,
+    postJSON: () => Promise.resolve({}),
+    rankLabel: (r) => r,
+    rankWeight: () => 0,
+    signClasses: () => '',
+    toast: () => {},
+    usd: (n) => `$${n}`,
+  });
+  return { hall, html: () => written };
+}
+
+// Render the signed-out landing for one joinability mode and hand back the
+// HTML the page actually wrote.
+function renderLandingHtml(joinability) {
+  const { hall, html } = hallRender(joinability);
+  hall.renderLanding();
+  return html();
+}
+
+test('A: the apply door gives signing in a real button, not a footnote link', () => {
+  const html = renderLandingHtml('apply');
+  assert.match(html, /landing__returning/, 'the apply door renders a returning-builder block');
+  assert.match(
+    html,
+    /class="landing__btn landing__btn--quiet" href="\/api\/bongos\/auth\/web\/start"/,
+    'that block carries a real sign-in control in the quiet fill',
+  );
+  // The whole point of the change: the footnote link is GONE from this door, so
+  // there is exactly one sign-in path and it is the button.
+  assert.ok(
+    !/Already a member\? <a /.test(html),
+    'the apply door no longer repeats sign-in as a prose link under the form',
+  );
+  assert.match(html, /We store only your GitHub login/, 'the privacy sentence survives the note');
+  // Two controls total: request access, and sign in. Not three.
+  assert.equal(countButtons(html), 2, 'the apply door carries the request button and the sign-in button');
+});
+
+test('A: the two doors that already had a sign-in button do not grow a second', () => {
+  for (const mode of ['open', 'invite_only']) {
+    const html = renderLandingHtml(mode);
+    assert.ok(
+      !/landing__returning/.test(html),
+      `the ${mode} door does not add a returning block — its primary door already signs you in`,
+    );
+    assert.equal(countButtons(html), 1, `the ${mode} door carries exactly one sign-in control`);
+    assert.match(html, /Already a member\? <a /, `the ${mode} door keeps its prose note for returning builders`);
+  }
+});
+
+test('A: an older branding pack with no joinability falls back to the apply door', () => {
+  // joinabilityMode() treats anything but open/invite_only as 'apply', so the
+  // button must follow that fallback — not sit behind a field an older pack
+  // never sent.
+  assert.match(renderLandingHtml(null), /landing__returning/);
+});
+
+test('A: the quiet fill is a defined variant, not an inline colour', () => {
+  const css = read('style.css');
+  const i = css.indexOf('\n.landing__btn--quiet {');
+  assert.ok(i > 0, 'style.css defines .landing__btn--quiet');
+  const block = css.slice(i, css.indexOf('}', i));
+  assert.deepEqual(block.match(/#[0-9a-f]{3,8}\b/gi) || [], [], 'the variant carries no literal colour');
+  // Same geometry as the request button means it inherits .landing__btn's
+  // min-height and padding rather than restating them.
+  assert.ok(!/min-height|padding/.test(block), 'the variant overrides fill only, never geometry');
+});
+
+// =========================================================================
+// PART B — the builder's number on the roster (task 1002837)
+// =========================================================================
+
+// roster.js is an IIFE that fetches and mounts. Run it against a stubbed kit,
+// capture the rowHtml it hands makeLedger, and call the real function.
+async function rosterRowHtml(rows) {
+  let rowFn = null;
+  const elStub = { innerHTML: '', className: '', textContent: '', hidden: false };
+  const sandbox = {
+    window: {
+      OTB: { fmtInt: (n) => String(n == null ? 0 : n), rankLabel: (r) => r },
+      OTBBranding: { currencyLabel: () => 'Credits' },
+      OTBKit: {
+        esc: escapeHtml,
+        makePager: () => ({ page: 1 }),
+        makeFilterBar: () => {},
+        makeLedger: (cfg) => { rowFn = cfg.rowHtml; return { render() {} }; },
+        paginate: (xs) => xs,
+      },
+    },
+    document: { getElementById: () => ({ ...elStub }) },
+    fetch: () => Promise.resolve({ ok: true, json: () => Promise.resolve({ leaderboard: rows }) }),
+    console,
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(read('roster.js'), sandbox, { filename: 'roster.js' });
+  // Let the fetch promise chain drain.
+  await new Promise((r) => setImmediate(r));
+  assert.ok(rowFn, 'roster.js mounted a ledger and handed it a row renderer');
+  return rowFn;
+}
+
+const ROSTER_ROWS = [
+  { id: '1000025', github_login: 'someone', display_name: 'Someone', rank: 'metic', total_credits: 900, karma: 5, tokens_used: 10 },
+  { github_login: 'nameless', display_name: 'Nameless', rank: 'xenos', total_credits: 10, karma: 0, tokens_used: 1 },
+];
+
+test('B: the roster prints the builder\'s number under their place', async () => {
+  const rowHtml = await rosterRowHtml(ROSTER_ROWS);
+  const html = rowHtml({ ...ROSTER_ROWS[0], __place: 1 });
+  assert.match(html, /<span class="ledger__id">#1000025<\/span>/, 'the id renders');
+  // Under the place, not beside the name — the place cell is what answers
+  // "which builder is this row".
+  const cell = html.slice(0, html.indexOf('</td>'));
+  assert.match(cell, /ledger__place/, 'the place cell is the one that carries it');
+  assert.match(cell, /1[\s\S]*ledger__id/, 'the place still comes first');
+});
+
+test('B: a payload with no id degrades to the place alone', async () => {
+  const rowHtml = await rosterRowHtml(ROSTER_ROWS);
+  const html = rowHtml({ ...ROSTER_ROWS[1], __place: 2 });
+  assert.ok(!/ledger__id/.test(html), 'no empty "#" is printed for a row the server sent no id for');
+  assert.match(html, /<td class="ledger__num ledger__place">2<\/td>/, 'the place renders on its own');
+});
+
+test('B: the id wears the same mono/faint voice as the login', () => {
+  const css = read('people.css');
+  const i = css.indexOf('.ledger__place .ledger__id {');
+  assert.ok(i > 0, 'people.css styles the roster id');
+  const block = css.slice(i, css.indexOf('}', i));
+  for (const token of ['var(--font-mono)', 'var(--ink-faint)']) {
+    assert.ok(block.includes(token), `the id spends ${token}, the voice .dir-login already uses`);
+  }
+  assert.match(block, /display: block/, 'it sits under the place rather than wrapping beside it');
+});
+
+// =========================================================================
+// PART C — grade and cost on the peer-acclaim feed (task 1002835)
+// =========================================================================
+
+// acclaimEvidenceHtml is a view painter, so it lives in the hall-render carve
+// (the same reason renderLanding does) and builders.js takes it from the
+// factory. Read it off the same factory rather than re-deriving it.
+const acclaimEvidence = () => hallRender().hall.acclaimEvidenceHtml;
+test('C: a graded, costed ship carries both numbers', () => {
+  const html = acclaimEvidence()({ grade_score: '8.5', grade_passed: true, cost_usd: '12.3456' });
+  assert.match(html, /ledger__verdict--ok">8\.5 \/ 10</, 'a passing grade reads as passing');
+  assert.match(html, /acclaim__cost">\$12\.35</, 'the cost rounds to cents');
+});
+
+test('C: a failing grade is not dressed as a passing one', () => {
+  const html = acclaimEvidence()({ grade_score: '3.0', grade_passed: false, cost_usd: '1' });
+  assert.match(html, /ledger__verdict--danger">3\.0 \/ 10</);
+});
+
+test('C: absence renders as absence, never as zero', () => {
+  const ev = acclaimEvidence();
+  // The case that matters: a grader outage arrives as a NULL score (the route
+  // nulls it through gradeQualityWhere), and a voter must not read "0.0 / 10".
+  const ungraded = ev({ grade_score: null, grade_passed: null, cost_usd: '4' });
+  assert.match(ungraded, /ledger__verdict--none">not graded</);
+  assert.ok(!/0\.0 \/ 10/.test(ungraded), 'an ungraded ship is never scored 0.0');
+
+  // cost_usd PRESENT and null is the "logged nothing" case, distinct from the
+  // key being absent entirely (covered above) — both must not print $0.00.
+  const uncosted = ev({ grade_score: '9.0', grade_passed: true, cost_usd: null });
+  assert.match(uncosted, /ledger__verdict--none">no cost logged</);
+  assert.ok(!/\$0\.00/.test(uncosted), 'an unlogged cost is never printed as free');
+
+  // A genuine zero is still a measurement and must survive.
+  assert.match(ev({ grade_score: '0.0', grade_passed: false, cost_usd: '0' }), /0\.0 \/ 10/);
+  assert.match(ev({ grade_score: '0.0', grade_passed: false, cost_usd: '0' }), /\$0\.00/);
+});
+
+test('C: the evidence line hangs under the work, in the feed row', () => {
+  const src = read('builders.js');
+  assert.match(
+    src,
+    /<td>\$\{title\}\$\{acclaimEvidenceHtml\(t\)\}<\/td>/,
+    'the row renders it beneath the title rather than adding a column',
+  );
+});
+
+test('C: a builder who may not vote is shown no cost figure at all', () => {
+  // The route OMITS cost_usd below Metic rather than nulling it, because a null
+  // means "nothing was logged" — telling a reader a figure is missing is a
+  // different (and false) statement from showing them no figure.
+  const html = acclaimEvidence()({ grade_score: '8.0', grade_passed: true });
+  assert.match(html, /8\.0 \/ 10/, 'the grade is a quality verdict and still shows');
+  assert.ok(!/no cost logged/.test(html), 'a withheld cost is never reported as an unlogged one');
+  assert.ok(!/acclaim__cost/.test(html), 'and no figure is printed');
+  assert.ok(!/ · /.test(html), 'the separator goes with the part it separated');
+});
+
+test('C: the route hands the cost only to the ranks that can vote', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+  const i = route.indexOf("router.get('/tasks/peer-votes/feed'");
+  const handler = route.slice(i, route.indexOf('// POST /tasks/peer-votes/tally', i));
+  assert.match(
+    handler,
+    /const tasks = canVote \? rows : rows\.map\(\(\{ cost_usd, \.\.\.rest \}\) => rest\);/,
+    'the cost is stripped for a non-voter, by omission rather than by nulling',
+  );
+  assert.match(handler, /res\.json\(\{ tasks, can_vote: canVote \}\)/, 'and the gated rows are what is sent');
+  assert.ok(!/grade_score, \.\.\.rest/.test(handler), 'the grade is not spend and is not gated with it');
+});
+
+test('C: the route supplies both fields, and nulls a non-verdict grade', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+  const i = route.indexOf("router.get('/tasks/peer-votes/feed'");
+  assert.ok(i > 0, 'the feed route is still here');
+  const handler = route.slice(i, route.indexOf('// POST /tasks/peer-votes/tally', i));
+  for (const field of ['grade_score', 'grade_passed', 'cost_usd']) {
+    assert.ok(handler.includes(`AS ${field}`), `the feed selects ${field}`);
+  }
+  // The honesty half is server-side: a grader outage carries score 0 in
+  // task_grades, and only gradeQualityWhere tells it apart from a real 0.
+  assert.match(handler, /gradeQualityWhere\('g'\)/, 'an outage row is nulled, not passed through as 0');
+  // SUM over no rows is NULL, which is the "no cost logged" the client renders.
+  // A COALESCE here would turn every uncosted ship into a free one.
+  assert.ok(
+    !/COALESCE\(SUM\(amount_usd\)/.test(handler),
+    'the cost sum is left NULL when nothing was logged',
+  );
+  // Both joins are indexed lookups. Pinned here so a future reader does not have
+  // to re-derive it: task_grades.task_id is UNIQUE and cost_log.task_id carries
+  // idx_cost_log_task. If either ever stops being true, this reds.
+  const g016 = fs.readFileSync(path.join(ROOT, 'migrations/016_pms_task_grades.sql'), 'utf8');
+  assert.match(g016, /task_id\s+BIGINT NOT NULL UNIQUE/, 'task_grades.task_id is unique, so indexed');
+  const m003 = fs.readFileSync(path.join(ROOT, 'migrations/003_pms.sql'), 'utf8');
+  assert.match(m003, /CREATE INDEX IF NOT EXISTS idx_cost_log_task ON cost_log \(task_id\)/, 'cost_log.task_id is indexed');
+});

package/tests/joinability_invite_only.mjs

@@ -177,7 +177,17 @@ test('the hall landing renders one door per mode, and its form collapses on the
   assert.match(door, /mode === 'invite_only'/);
   assert.match(door, /there is nothing to apply for here/);
   assert.match(door, /id="access-request-form"/, 'the apply door keeps the request form');
-  assert.match(hall, /\$\{landingDoorHtml\(joinabilityMode\(\)\)\}/, 'renderLanding paints the door the pack names');
+  // This read `${landingDoorHtml(joinabilityMode())}` inline. Task 1004004 gave
+  // the apply door a real sign-in button, so renderLanding resolves the mode
+  // ONCE and hands the same value to both doors. The invariant is unchanged and
+  // now reaches further: BOTH doors are painted from the pack's own answer, so
+  // neither can drift onto a second reading of joinability.
+  const landing = (hall.match(/function renderLanding\(\) \{[\s\S]*?\n  \}\n/) || [''])[0];
+  assert.ok(landing, 'renderLanding() must exist');
+  assert.match(landing, /const mode = joinabilityMode\(\);/, 'the pack names the mode, once');
+  assert.match(landing, /\$\{landingDoorHtml\(mode\)\}/, 'renderLanding paints the door the pack names');
+  assert.match(landing, /\$\{returningDoorHtml\(mode\)\}/, 'and the returning-builder door off the same answer');
+  assert.equal((landing.match(/joinabilityMode\(\)/g) || []).length, 1, 'joinability is read once, not per door');
   assert.match(hall, /code === 'invite_only' \|\| code === 'open_enrollment'/, 'the refusal codes are handled, not shown red');
 });