@bongos/core 1.19.950 → 1.19.952

package/tests/provisioning_paid_shape_gate.mjs

@@ -11,7 +11,8 @@
 // provisioning.fleet.manage.
 //
 // The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
-// so `co-tenant` — the front door — stays open to any authenticated builder. Everything else
+// so the front door — `byo-host` since ADR 0323, `co-tenant` before it — stays open to any
+// authenticated builder. Everything else
 // demands provisioning.fleet.manage, deliberately the same atom that already guards the fleet
 // cost-ledger and force-teardown, since spending on the fleet and managing the fleet are one
 // authority.
@@ -110,17 +111,79 @@ function post(path, body) {
 
 // ── the front door stays open — this is the half a careless fix would break ───────
 
-await ta('co-tenant (and an absent shape, which defaults to it) stays open with no permission', async () => {
+await ta('byo-host (and an absent shape, which defaults to it) stays open with no permission', async () => {
+  // ADR 0323 moved the front door from 'co-tenant' to 'byo-host'. It is a STRONGER
+  // front door: co-tenant cost nothing to invoice but still ran the caller's process on
+  // our box, whereas byo-host runs on the owner's own machine and never touches ours.
+  // The absent-shape case is the one a careless fix breaks — createInstance coerces an
+  // unknown or missing shape to byo-host, and if the gate's own default disagreed with
+  // that coercion the wizard's shapeless create would 403 instead of 201.
   for (const body of [
-    { slug: 'demo', hosting_shape: 'co-tenant', no_address: true },
+    { slug: 'demo', hosting_shape: 'byo-host', no_address: true },
     { slug: 'demo', no_address: true },
   ]) {
     held = [];
+    lastCreateArgs = null;
     const res = await post('/provisioning/instances', body);
     assert.equal(res.status, 201, `expected 201 for ${JSON.stringify(body)}, got ${res.status} ${res.raw}`);
+    // Assert the STORED shape, not just the status. A 201 alone does not prove the row is
+    // right: the create route resolves an absent shape independently of this gate, and at
+    // task 1004141 that default was briefly still 'co-tenant' — the gate admitted the
+    // request as byo-host and the route stored the retired shape, with no error anywhere.
+    // Checking the status only is what let that through.
+    assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'byo-host',
+      `${JSON.stringify(body)} must STORE byo-host, got ${lastCreateArgs && lastCreateArgs.hostingShape}`);
   }
 });
 
+await ta('co-tenant is RETIRED: refused for every caller, and not as a permission problem', async () => {
+  // ADR 0323 retires the shape whose name meant "a process on OUR box" — the opposite
+  // of bring-your-own-host, so the name could not be carried over. It stays a valid
+  // STORED value (one torn-down row carries it, and HOSTING_SHAPES still lists it) but
+  // becomes UNREQUESTABLE, which is the difference between closing a door and rewriting
+  // the record. The refusal must NOT be a 403-for-want-of-permission: no rank admits a
+  // retired shape, so granting fleet.manage must not open it either.
+  held = [];
+  lastCreateArgs = null;
+  let res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'a retired shape must not create a row');
+
+  held = ['provisioning.fleet.manage'];
+  res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.equal(res.status, 403, `every permission still must not admit it, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+});
+
+await ta('the refusal speaks WIRE vocabulary — no owner-facing label is translated here', async () => {
+  // The single-translation invariant, ENFORCED rather than stated. ADR 0323 puts the
+  // stored value → owner-facing name map in exactly one place (SHAPE_LABEL in
+  // modules/public-landing/public/projects.html), and an API error string is the worst
+  // place for a second copy: whoever renames the product next will change the label map
+  // and a wizard heading, and a sentence buried in a 403 will go on selling a name that
+  // no longer exists, with nothing failing. This assertion is what fails instead.
+  //
+  // It checks BOTH unrequestable shapes, because the retired one is the tempting case —
+  // it is the refusal that wants to suggest an alternative, which is exactly where a
+  // product name creeps in. Suggesting one is fine; `details.requestable` already does
+  // it in stored values, and the message points at that field.
+  held = [];
+  for (const shape of ['co-tenant', 'control-plane']) {
+    const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
+    assert.equal(res.status, 403, `expected 403 for ${shape}, got ${res.status} ${res.raw}`);
+    const message = res.body.error.message || '';
+    for (const label of ['bring your own host', 'cloud host', 'dedicated cloud host']) {
+      assert.ok(!message.toLowerCase().includes(label),
+        `the ${shape} refusal translates a stored value into the owner-facing label "${label}" — that map lives only in projects.html's SHAPE_LABEL (ADR 0323): ${message}`);
+    }
+  }
+  // And the caller is still told what they CAN ask for, in the vocabulary they sent.
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'dedicated', 'standalone'],
+    'a refusal that names no alternative is a dead end — the stored values are the alternative');
+});
+
 // ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
 
 await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
@@ -232,20 +295,27 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // POST for a second control plane until task 1003370.
   //
   // So the question this list now forces is the one that generalises. The gate is an
-  // allow-list: `co-tenant` needs nothing, `control-plane` is refused outright, and
+  // allow-list: `byo-host` needs nothing, `control-plane` and `co-tenant` are refused
+  // outright (for different reasons — never-yours vs retired), and
   // EVERY other shape — including one added after this file was last read — demands
   // provisioning.fleet.manage by omission. A fifth shape therefore arrives already
   // gated, and this assertion is the prompt to confirm that is what was wanted
   // rather than the thing that has to catch the hole.
+  //
+  // It fired a SECOND time at task 1004141 (ADR 0323), which added 'byo-host' and
+  // retired 'co-tenant'. That retirement is why the list below still carries a shape
+  // no caller may request: the value stays storable so one torn-down row remains
+  // readable, and the door is shut in UNREQUESTABLE_SHAPES instead. Dropping it from
+  // HOSTING_SHAPES would make that historical row violate its own CHECK constraint.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
-    ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
+    ['byo-host', 'co-tenant', 'control-plane', 'dedicated', 'standalone']);
 });
 
 await ta('an unknown shape is answered by the validator, not by the gate', () => {
   // The gate DEFERS anything outside HOSTING_SHAPES so a typo gets `bad_hosting_shape`
   // naming the valid set, rather than a 403 about a permission the caller would not
   // have needed. Deferring is safe: the validator refuses it microseconds later, and
-  // createInstance coerces an unrecognised shape to co-tenant rather than storing it,
+  // createInstance coerces an unrecognised shape to byo-host rather than storing it,
   // so no deferred value can become a privileged row.
   return post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenamt', no_address: true })
     .then((res) => {