@bongos/core 1.19.925 → 1.19.927

package/tests/core_upgrade_door.mjs

@@ -93,10 +93,29 @@ await t('every action not explicitly allowed is refused on the self row', () =>
   }
 });
 
-await t('the allow-list is exactly the two acts that cannot destroy the box', () => {
+await t('the allow-list is exactly the acts that cannot destroy the box', () => {
   // Pinned by NAME so widening it is a deliberate edit someone has to argue for,
-  // not a side effect of adding an action to INTENT_ACTIONS.
-  assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(), ['core-upgrade', 'restart']);
+  // not a side effect of adding an action to INTENT_ACTIONS. It did its job: adding
+  // 'core-upgrade-preflight' to INTENT_ACTIONS in task 1004121 did NOT reach here, and
+  // this line is what forced the argument to be made (task 1004125). The argument: a
+  // dry run returns at pre-flight having moved no pin, run no npm and restarted
+  // nothing, and the control plane is the only instance whose hall HAS an Upgrade
+  // page — so refusing the preview there protected nothing and removed everything.
+  assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(),
+    ['core-upgrade', 'core-upgrade-preflight', 'restart']);
+});
+
+await t('the preview is permitted on the control plane — the one row that can use it', () => {
+  assert.equal(G.intentAllowedForShape('core-upgrade-preflight', 'control-plane'), true);
+});
+
+await t('and widening it did NOT let the destructive acts through', () => {
+  // The whole risk of arguing one action onto an allow-list is arguing four.
+  for (const a of P.INTENT_ACTIONS) {
+    if (['core-upgrade', 'core-upgrade-preflight', 'restart'].includes(a)) continue;
+    assert.equal(G.intentAllowedForShape(a, 'control-plane'), false,
+      `'${a}' must still be refused against the box the platform runs on`);
+  }
 });
 
 await t('an ordinary instance is untouched by the guard', () => {
@@ -456,5 +475,227 @@ await t('no verdict at all is null — never an implied pass', () => {
   assert.equal(p.behind, true, 'and the rest of the reading is unaffected');
 });
 
+
+console.log('\nthe body the page actually sends (task 1004124):');
+
+// THE REAL VALIDATOR, NOT A STUB. Every other handler test here injects
+// `validateOrRespond: () => false`, which is right for asserting branch behaviour and
+// is exactly why this shipped broken: the route declares `{ strict: true }`, so a field
+// the schema does not NAME is a 400 before the handler runs — and task 1004121 added
+// the `dry_run` read without the declaration. Two correct halves, one contract, and no
+// test across it. `src/bongos/routes/core-update.js` documents this same class in its
+// own comment; this is the provisioning half learning it.
+const HELPERS = require('../src/bongos/routes/_helpers.js');
+
+const validatorHarness = () => {
+  const calls = [];
+  const provisioning = {
+    getInstanceById: async () => ACTIVE,
+    enqueueIntent: async (_db, id, action, requestedBy, targetVersion) => {
+      calls.push({ id, action, requestedBy, targetVersion });
+      return { intent: { id: 1, action, state: 'pending', target_version: targetVersion }, created: true };
+    },
+    recordEvent: async () => {},
+  };
+  const handler = CU.makeCoreUpgradeHandler({
+    provisioning, pool: {}, parseId: () => 7,
+    validateOrRespond: HELPERS.validateOrRespond, log: { error() {} },
+  });
+  let body = null;
+  let status = 200;
+  const res = {
+    json: (b) => { body = b; return res; },
+    fail: (code, o) => { body = { code, ...(typeof o === 'object' ? o : { status: o }) }; status = (o && o.status) || o || 400; return res; },
+    status: (c) => { status = c; return res; },
+  };
+  return { calls, handler, res, provisioning, read: () => ({ body, status }) };
+};
+
+await t('the preview payload the page posts is ACCEPTED, not refused as an unknown field', async () => {
+  // deploy.js:183 sends exactly `{ to, dry_run: true }`. Live, before the fix, this
+  // answered 400 unknown_field — so the whole "see what would change" button was dead.
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_run: true } }, h.res);
+  const { body } = h.read();
+  assert.ok(!body || body.code !== 'validation_failed', `the body must validate — got ${JSON.stringify(body)}`);
+  const queued = h.calls.find((c) => c.action === 'core-upgrade-preflight');
+  assert.ok(queued, 'and it reaches the queue as a PREVIEW, not as a move');
+});
+
+await t('a guard refusal reaches the owner as ITS OWN sentence, not "internal error"', async () => {
+  // The guard writes `code`, `status: 409` and a publicMessage for exactly this moment.
+  // The catch discarded all three, so every control-plane refusal this route ever made
+  // was shown as a 500 "internal error" while the real sentence sat in the journal —
+  // which is how the preview refusal stayed invisible until it was pressed live.
+  // Elsewhere in this file we already assert that sentence is well-formed; nothing
+  // asserted it ARRIVED.
+  const h = validatorHarness();
+  const refusal = Object.assign(new Error('blocked'), {
+    code: 'control_plane_protected', status: 409,
+    publicMessage: 'That action cannot be aimed at the machine the platform itself runs on.',
+  });
+  h.provisioning.enqueueIntent = async () => { throw refusal; };
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'control_plane_protected', 'the guard\'s own code, not core_upgrade_failed');
+  assert.equal(body && body.status, 409, 'a refusal is not a 500');
+  assert.match((body && body.message) || '', /cannot be aimed at the machine/);
+});
+
+await t('an UNEXPECTED throw is still opaque — this is not a blanket error passthrough', async () => {
+  // Forwarding every error would leak internals. Only an error that declared itself
+  // public (code + status + publicMessage) is forwarded.
+  const h = validatorHarness();
+  h.provisioning.enqueueIntent = async () => { throw new Error('connection terminated: relation "secrets" does not exist'); };
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'core_upgrade_failed');
+  assert.equal(body && body.message, 'internal error');
+  assert.ok(!/secrets|relation/.test(JSON.stringify(body)), 'no internals reach the client');
+});
+
+await t('the move payload still validates, and still queues a move', async () => {
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925' } }, h.res);
+  const { body } = h.read();
+  assert.ok(!body || body.code !== 'validation_failed', `the body must validate — got ${JSON.stringify(body)}`);
+  assert.ok(h.calls.find((c) => c.action === 'core-upgrade'), 'no dry_run means a real move');
+});
+
+await t('strict is still strict — a typo is still refused', async () => {
+  // The fix is a declaration, not a loosening. Widening to non-strict would have made
+  // the button work and silently swallowed every future typo, which is the trade
+  // _helpers.js exists to refuse.
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_runn: true } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'validation_failed', 'an undeclared field is still a 400');
+  assert.equal(h.calls.length, 0, 'and nothing was queued');
+});
+
+await t('dry_run must be a boolean — a truthy string does not become a preview', async () => {
+  const h = validatorHarness();
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925', dry_run: 'yes' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'validation_failed',
+    'the handler compares === true, so a string would silently queue a MOVE where a preview was asked for');
+});
+
+
+// A REAL REQUEST THROUGH THE ASSEMBLED ROUTER. The harness above proves the SCHEMA
+// (it injects the very function object the route injects — api.validateOrRespond IS
+// _helpers.validateOrRespond), but it cannot see the wiring: middleware order, a
+// missing body parser, a mis-shaped handler mount. Those are invisible to any test
+// that calls the factory directly, which is the same lesson
+// src/bongos/routes/core-update.js records about its own asyncHandler bug. So: boot
+// the actual router over express and POST to it.
+await t('a real POST through the assembled router accepts the preview body', async () => {
+  const api = require('../src/module-api.js');
+  const prov = require('../modules/provisioning/provisioning.js');
+  const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+
+  const saved = {};
+  const stub = (obj, key, value) => {
+    saved[key] = Object.getOwnPropertyDescriptor(obj, key);
+    Object.defineProperty(obj, key, { value, configurable: true, writable: true });
+  };
+  // Only the two auth gates and the data layer are replaced. parseId and
+  // validateOrRespond stay REAL — they are the contract under test.
+  stub(api, 'requireBuilder', (req, _res, next) => { req.builder = { id: 42 }; next(); });
+  stub(api, 'requirePermission', () => (_req, _res, next) => next());
+  stub(api, 'pool', {});
+  const queued = [];
+  const savedProv = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent };
+  prov.getInstanceById = async () => ACTIVE;
+  prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+    queued.push({ id, action, requestedBy, targetVersion });
+    return { intent: { id: 1, action, state: 'pending', target_version: targetVersion }, created: true };
+  };
+  prov.recordEvent = async () => {};
+  delete require.cache[routePath];
+
+  const express = require('express');
+  const app = express();
+  app.use(express.json());
+  app.use(require(routePath)());
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/provisioning/instances/41/core-upgrade`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ to: '1.19.925', dry_run: true }),
+    });
+    const body = await res.json().catch(() => null);
+    assert.notEqual(res.status, 400, `the page's own payload must not be refused — got ${res.status} ${JSON.stringify(body)}`);
+    const preview = queued.find((q) => q.action === 'core-upgrade-preflight');
+    assert.ok(preview, `and it reaches the queue as a preview — queued ${JSON.stringify(queued)}`);
+    assert.equal(preview.targetVersion, '1.19.925');
+    assert.equal(preview.requestedBy, 'api:archon:42', 'attributed through the real auth seam');
+  } finally {
+    server.close();
+    for (const [k, d] of Object.entries(saved)) Object.defineProperty(api, k, d);
+    prov.getInstanceById = savedProv.get;
+    prov.enqueueIntent = savedProv.enq;
+    prov.recordEvent = savedProv.rec;
+    delete require.cache[routePath];
+  }
+});
+
+
+// THE AUDIT, AS A GUARD RATHER THAN A CLAIM. The task asked for a sweep of the other
+// provisioning write routes for this same shape. A sweep performed once and reported in
+// prose is indistinguishable, later, from one never performed — and the next route to
+// add a strict schema gets no help from it. So the sweep is a test: it re-runs on every
+// build and fails on the next occurrence rather than on this one.
+await t('every strict body schema in this module declares each field its handler reads', () => {
+  const dir = join(repoRoot, 'modules', 'provisioning');
+  const files = [];
+  const walk = (d) => {
+    for (const e of readdirSync(d, { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name === 'tests') continue;
+      const full = join(d, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (e.name.endsWith('.js')) files.push(full);
+    }
+  };
+  walk(dir);
+
+  const offenders = [];
+  let strictSites = 0;
+  for (const f of files) {
+    const src = readFileSync(f, 'utf8');
+    const lines = src.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!lines[i].includes('validateOrRespond(req')) continue;
+      // The call spans until its `)) return;`; the handler body follows it.
+      let j = i;
+      while (j < lines.length && j < i + 40 && !lines[j].includes(')) return;')) j += 1;
+      const call = lines.slice(i, j + 1).join('\n');
+      if (!/strict:\s*true/.test(call)) continue;   // extras are ignored by design
+      strictSites += 1;
+      // The SCHEMA argument only — brace-matched from the `{` after `res,`. Scanning the
+      // whole call would also count the options object's keys as declared fields, which
+      // is exactly the kind of over-broad match that turns a guard into decoration.
+      const open = call.indexOf('{', call.indexOf('res,'));
+      let depth = 0;
+      let close = open;
+      for (; close < call.length; close += 1) {
+        if (call[close] === '{') depth += 1;
+        else if (call[close] === '}') { depth -= 1; if (!depth) break; }
+      }
+      const schemaSrc = call.slice(open, close + 1);
+      const declared = new Set([...schemaSrc.matchAll(/(\w+)\s*:\s*\{/g)].map((m) => m[1]));
+      const body = lines.slice(j + 1, j + 140).join('\n');
+      const read = new Set([...body.matchAll(/req\.body\.(\w+)/g)].map((m) => m[1]));
+      const missing = [...read].filter((k) => !declared.has(k));
+      if (missing.length) offenders.push(`${f.replace(repoRoot + '/', '')}:${i + 1} reads ${missing.join(', ')} but does not declare it`);
+    }
+  }
+  assert.ok(strictSites > 0, 'the scan found no strict schema at all — it has stopped looking');
+  assert.deepEqual(offenders, [],
+    'under strict, a field the schema does not name is a 400 BEFORE the handler runs, so reading it is unreachable code and a broken endpoint');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/helpers.mjs

@@ -630,5 +630,104 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
   };
 }
 
+
+// bootIdeaPage — boot the REAL modules/hall-ui/public/idea.js in a vm against a
+// stub DOM, and hand back the HTML it wrote into #idea-body plus every request
+// it made.
+//
+// The sibling of bootProfilePage above, and here for the same reason: the
+// descent surface (task 1004094 / BV2.R10) is asserted at the RENDERED layer,
+// because the first of the three findings inherited from the abandoned task
+// 1004054 is that testing the server-side read alone is exactly how a renderer
+// bug survives. What a reader is handed is HTML, so that is what the suite reads.
+//
+// Unlike profile.js, this page writes straight into an element's innerHTML
+// rather than through OTBKit's ledger, so the capture is the element itself.
+const IDEA_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/idea.js'), 'utf8');
+export function bootIdeaPage({ idea = null, status = 200, template = null, viewer = { id: 1 }, ideaId = '1' } = {}) {
+  const els = new Map();
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    addEventListener() {},
+    querySelector() { return null; }, querySelectorAll() { return []; }, appendChild() {},
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    title: '',
+    body: { dataset: { page: 'idea' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelector(sel) {
+      const id = String(sel).replace(/^#/, '');
+      // The mark control's button and error slot exist only once the page has
+      // rendered one. Returning a live element for every selector would make
+      // the boot look as though it had wired a control that is not on the page.
+      if (id === 'ig-mark-btn' || id === 'ig-mark-err') {
+        return /id="ig-mark-btn"/.test(els.get('idea-body')?.innerHTML || '') ? this.getElementById(id) : null;
+      }
+      return this.getElementById(id);
+    },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  const client = {
+    inbox: {
+      getInboxId: async ({ id }) => {
+        requests.push(`/inbox/${id}`);
+        return { status, ok: status === 200, data: status === 200 ? { idea } : null };
+      },
+      getInboxTemplate: async () => {
+        requests.push('/inbox/template');
+        return template
+          ? { status: 200, ok: true, data: { template } }
+          : { status: 500, ok: false, data: null };
+      },
+      postInboxIdSpark: async () => ({ status: 200, ok: true, data: { idea } }),
+      deleteInboxIdSpark: async () => ({ status: 200, ok: true, data: { idea } }),
+    },
+    me: {
+      getMe: async () => {
+        requests.push('/me');
+        return viewer
+          ? { status: 200, ok: true, data: { builder: viewer } }
+          : { status: 401, ok: false, data: null };
+      },
+    },
+  };
+
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => client },
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      toast() {},
+    },
+    location: { hostname: 'builders.cloudbongos.com', search: '', pathname: `/idea/${ideaId}`, assign() {} },
+    localStorage: { getItem: () => null, setItem() {} },
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console, setTimeout, clearTimeout, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(IDEA_JS, sandbox, { filename: 'idea.js' });
+
+  return {
+    requests,
+    html: () => documentObj.getElementById('idea-body').innerHTML,
+    title: () => documentObj.title,
+  };
+}
+
 // One microtask turn — profile.js boots through a chain of awaits.
 export const settle = () => new Promise((r) => setTimeout(r, 0));