@bongos/core 1.19.981 → 1.19.983

package/tests/provisioning_repo_private_route.mjs

@@ -0,0 +1,224 @@
+// tests/provisioning_repo_private_route.mjs
+//
+// Split (c) of task 1003078: POST /provisioning/instances/:id/repo-private — the owner's
+// "make this project's repository private" request. It only ENQUEUES the `repo-private`
+// intent (task 1004193); the runner wires the project's own deploy key and only then flips.
+//
+// The load-bearing assertions:
+//   • OWNER ONLY (owner decision, task 1004194): the runner flips with the OWNER's stored
+//     GitHub token whoever asked, so an archon on someone else's project gets the same 404
+//     as a stranger — and nothing is queued or recorded
+//   • the reply is a RECEIPT, never the new state: the repository is still public when it
+//     is sent, and only GitHub can say when that changed
+//   • a project the runner would refuse is refused HERE, in plain words, before anything is
+//     queued — not left to fail its retries into an error note
+//   • the body is strict: this route takes no fields, so any field is a 400
+//
+// DB-free: data access is stubbed on the cached module objects (the provisioning_restart.mjs
+// pattern), over a real mounted router. No network beyond localhost.
+//
+// Run:  node tests/provisioning_repo_private_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const repoPrivate = require('../modules/provisioning/repo-private.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+let instance = null;
+let enqueueCalls = [];
+let enqueueResult = null;
+let events = [];
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+repoPrivate.enqueueRepoPrivate = async (_db, id, requestedBy) => {
+  enqueueCalls.push({ id, requestedBy });
+  return enqueueResult || { intent: { id: 9, action: 'repo-private', state: 'pending' }, created: true };
+};
+
+const api = require('../src/module-api.js');
+let builder = null;
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/repo-private.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(Array.isArray(details) ? { details } : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST', headers: payload ? { 'Content-Type': 'application/json' } : {},
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', target_ref: 'example-owner/spike' };
+const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
+function reset(patch = {}) {
+  instance = { ...LIVE, ...patch };
+  enqueueCalls = []; enqueueResult = null; events = [];
+  builder = { ...OWNER };
+}
+const URL_18 = '/provisioning/instances/18/repo-private';
+
+console.log('POST /provisioning/instances/:id/repo-private — who may ask:');
+
+await ta('the owner queues it: 200, one repo-private intent stamped api:self, one audit event', async () => {
+  // Arrange
+  reset();
+  // Act
+  const r = await post(URL_18);
+  // Assert
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(enqueueCalls, [{ id: 18, requestedBy: 'api:self' }]);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'repo-private');
+  assert.equal(events[0].actor, 'api:self');
+  assert.equal(events[0].ownerBuilderId, 7);
+});
+
+await ta('an ARCHON on someone else\'s project gets 404 — the runner would act on the owner\'s GitHub account', async () => {
+  reset();
+  builder = { id: 42, github_login: 'arch', rank: 'archon' };
+  const r = await post(URL_18);
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+  assert.equal(enqueueCalls.length, 0, 'nothing queued');
+  assert.equal(events.length, 0, 'nothing recorded');
+});
+
+await ta('an archon who OWNS the project may ask — the rule is ownership, not rank', async () => {
+  reset({ owner_builder_id: 42 });
+  builder = { id: 42, github_login: 'arch', rank: 'archon' };
+  const r = await post(URL_18);
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls[0].requestedBy, 'api:self');
+});
+
+await ta('another builder\'s project is 404 — no existence leak', async () => {
+  reset();
+  builder = { id: 99, github_login: 'stranger', rank: 'thetes' };
+  const r = await post(URL_18);
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+  assert.equal(enqueueCalls.length, 0);
+});
+
+await ta('a missing project is 404, not a 500', async () => {
+  reset();
+  instance = null;
+  const r = await post(URL_18);
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+
+await ta('a malformed id is 400 bad_id — and id 0 is ANSWERED, never left hanging', async () => {
+  for (const bad of ['abc', '0', '-3', '1.5']) {
+    reset();
+    const r = await post(`/provisioning/instances/${bad}/repo-private`);
+    assert.equal(r.status, 400, `${bad}: ${r.raw}`);
+    assert.equal(r.body.error.code, 'bad_id', bad);
+    assert.equal(enqueueCalls.length, 0);
+  }
+});
+
+console.log('\nthe reply:');
+
+await ta('it is a RECEIPT — queued + a sentence, never a visibility the repository does not have yet', async () => {
+  reset();
+  const r = await post(URL_18);
+  assert.equal(r.body.ok, true);
+  assert.equal(r.body.queued, true);
+  assert.equal(r.body.action, 'repo-private');
+  assert.equal(r.body.private, undefined, 'no new state is claimed');
+  assert.equal(r.body.repo, undefined, 'no repository answer is invented');
+  assert.match(r.body.message, /deploy key/, 'the sentence says the key comes first');
+});
+
+await ta('a repeat while one is open is idempotent: 200 queued:false, and no second audit event', async () => {
+  reset();
+  enqueueResult = { intent: { id: 9, action: 'repo-private', state: 'running' }, created: false };
+  const r = await post(URL_18);
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.queued, false);
+  assert.equal(events.length, 0);
+});
+
+await ta('any OTHER open run is a 409 intent_conflict naming it', async () => {
+  reset();
+  enqueueResult = { intent: { id: 3, action: 'settings-apply', state: 'running' }, created: false, conflict: 'open_intent' };
+  const r = await post(URL_18);
+  assert.equal(r.status, 409, r.raw);
+  assert.equal(r.body.error.code, 'intent_conflict');
+  assert.match(r.body.error.message, /settings-apply/);
+  assert.equal(events.length, 0);
+});
+
+console.log('\nrefused before anything is queued:');
+
+for (const [label, patch, why] of [
+  ['a project on the owner\'s own host', { hosting_shape: 'byo-host' }, /on GitHub directly/],
+  ['a project on another shape', { hosting_shape: 'dedicated' }, /Cloud host/],
+  ['a project that is not running', { status: 'error' }, /isn’t running/],
+  ['a project with no repository linked', { target_ref: null }, /no GitHub repository/],
+]) {
+  await ta(`${label}: 409 repo_private_unavailable in plain words, nothing queued`, async () => {
+    reset(patch);
+    const r = await post(URL_18);
+    assert.equal(r.status, 409, r.raw);
+    assert.equal(r.body.error.code, 'repo_private_unavailable');
+    assert.match(r.body.error.message, why);
+    assert.equal(enqueueCalls.length, 0);
+    assert.equal(events.length, 0);
+  });
+}
+
+await ta('the body is strict — this route takes no fields, so a visibility field is a 400', async () => {
+  reset();
+  const r = await post(URL_18, { visibility: 'private' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(r.body.error.code, 'validation_failed');
+  assert.equal(enqueueCalls.length, 0);
+});
+
+console.log('\nwiring:');
+
+await ta('module.json mounts the route file', async () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('repo-private'));
+});
+
+server.close();
+console.log(`\nprovisioning_repo_private_route: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/public_landing_projects.mjs

@@ -155,23 +155,17 @@ test('the served teardown copy no longer claims the address goes quiet (task 100
     'the truthful replacement is what ships');
 });
 
-test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
+test('the repo-visibility section is served live, with the private direction queued (tasks 1003045, 1003078)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="mRepoVis"/, 'the live section body is served');
-  assert.match(body, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words');
+  assert.match(body, /id="mRepoVisMsg"/, 'with a slot for the make-private receipt');
+  assert.match(body, /\/repo-private'/, 'the private direction rides the provisioning route');
   assert.doesNotMatch(body, /visibility:\s*'private'/,
-    'no served code path may send the private direction');
+    'the core flip is never asked for the private direction');
   assert.match(body, /repos=1/, 'the reconnect door asks for repository access');
-  // the limitation is one click away (task 1003077). This DB-free serve is the
-  // STANDALONE shape, where apex-only spans are stripped — so the explanation
-  // must survive while the cloudbongos task link must NOT (a child instance
-  // never shows another platform's tracker). The link itself is pinned inside
-  // its sentinels by tests/projects_hub.mjs.
-  assert.match(body, /id="mRepoVisWhy"/, 'the why-fold is served');
-  assert.match(body, /an older key that only works on public repositories/, 'the explanation survives the strip');
-  assert.doesNotMatch(body, /#\/task\/1002735/,
-    'the apex-only task link is stripped from a standalone serve');
+  assert.match(body, /id="mRepoVisWhy"/, 'the fold is served');
+  assert.match(body, /its own read-only deploy key/, 'and says the key comes first');
+  assert.doesNotMatch(body, /isn’t possible from here yet/, 'no served copy still refuses');
 });
 
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {