@bongos/core 1.20.20 → 1.20.22

package/tests/project_invite_ui.mjs

@@ -19,8 +19,10 @@
 //     before that an invite could only ever 404
 //   • an invite sends exactly { client_id, github_login } — the slug IS the
 //     client_id — on the cookie session, and nothing else
-//   • the 201 row is what the pending line is drawn from, and the github_id it
-//     carries is never shown
+//   • the answer is a HAND-OFF (task 1002818, ADR 0353): the route writes nothing
+//     and answers `{ invited: false, invite_url }` — the project's hall invite link — and
+//     each name becomes a line whose link finishes the invite there — never a
+//     window opened for the owner, and never a link that is not http(s)
 //   • every refusal the route can give is said in the route's own vocabulary,
 //     and the 403 is said CAREFULLY: it is byte-identical whether or not the
 //     project exists (ADR 0248), so the page may not read it as "it is there"
@@ -57,8 +59,14 @@ for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function ski
 // Narrow on purpose (the project_modules_ui.mjs rule): it supports exactly what
 // the region uses, so it stays honest about what it can prove.
 
-const ROW = /<li><b>([^<]*)<\/b><small>([^<]*)<\/small><\/li>/g;
-const parseRows = (html) => [...String(html).matchAll(ROW)].map((m) => ({ login: m[1], said: m[2] }));
+const ROW = /<li><b>([^<]*)<\/b><small>([^<]*)<\/small><a class="btn small" href="([^"]*)" target="_blank" rel="noopener">Send the invite →<\/a><\/li>/g;
+const parseRows = (html) => [...String(html).matchAll(ROW)].map((m) => ({ login: m[1], said: m[2], url: m[3] }));
+
+// The route's answer to an admitted caller since task 1002818: where to send the invite.
+const handoff = (login, origin = 'https://mercury.cloudbongos.test') => ({
+  ok: true, status: 200,
+  body: { invited: false, invite_url: origin + '/builders/watch?invite=' + encodeURIComponent(login) },
+});
 
 // A suggestion row: whatever the row NAMES, plus the login its button carries.
 // Parsed off the button so the test reads the address the click will actually
@@ -113,7 +121,8 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
     requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
-    const a = queued.shift() || { ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 4242, membership_kind: 'pending' } } };
+    const sent = (() => { try { return JSON.parse(init.body).github_login; } catch { return ''; } })();
+    const a = queued.shift() || handoff(sent);
     if (a.reject) return Promise.reject(new Error('offline'));
     return Promise.resolve({ ok: a.ok, status: a.status, _json: a.body, json: () => Promise.resolve(a.body) });
   };
@@ -127,7 +136,12 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
     apiError: (data, status) => ({
       code: (data && data.error && data.error.code) || ('http_' + status),
       message: (data && data.error && data.error.message) || '',
+      details: (data && data.error && data.error.details) || {},
     }),
+    safeHttpUrl: (raw) => {
+      try { const u = new URL(String(raw)); return (u.protocol === 'https:' || u.protocol === 'http:') ? u.href : ''; } catch (e) { return ''; }
+    },
+    URL,
     signInAgain: () => 'Your session expired — <a href="/in">sign in again</a>.',
   };
   sandbox.globalThis = sandbox;
@@ -238,7 +252,7 @@ test('an invite carries exactly { client_id, github_login } — the slug IS the
     'exactly the two fields the route validates, and nothing else');
 });
 
-test('the pending line is drawn from the 201 ROW, and the github_id on it is never shown', async () => {
+test('the answer is a hand-off line: the name, "not sent yet", and the hall link that sends it', async () => {
   const ui = boot();
   await ui.open('mercury');
 
@@ -246,22 +260,29 @@ test('the pending line is drawn from the 201 ROW, and the github_id on it is nev
   await ui.send();
 
   assert.deepEqual(ui.rows().map((r) => r.login), ['octo-builder']);
-  assert.match(ui.rows()[0].said, /waiting for them to accept/i, "the row's own 'pending' is what the line says");
-  assert.equal(ui.msg().className, 'projMsg ok');
-  assert.doesNotMatch(ui.msg().textContent + ui.rows()[0].said + ui.rows()[0].login, /4242/,
-    'the row carries a github_id; a person who has accepted nothing yet is not published by it');
+  assert.match(ui.rows()[0].said, /not sent yet/i, 'the line may not claim an invite the hall has not sent');
+  assert.equal(ui.rows()[0].url, 'https://mercury.cloudbongos.test/builders/watch?invite=octo-builder',
+    'the link is the route\'s own invite_url, verbatim');
+  assert.equal(ui.msg().className, 'projMsg ok', 'being handed to the hall is the answer, not a failure');
+  assert.match(ui.msg().textContent, /hall/i);
 });
 
-test('a membership_kind the page does not know is shown VERBATIM, never papered over as pending', async () => {
-  // The state word is the row's, not this page's: if the route ever seeds a
-  // different kind, an owner sees that rather than a comfortable fiction.
-  const ui = boot({ answers: [{ ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 1, membership_kind: 'member' } } }] });
+test('a hand-off link that is not http(s) is never drawn — it is said as a failure instead', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { invited: false, invite_url: 'javascript:alert(1)' } }] });
   await ui.open('mercury');
 
   await ui.type('octo-builder');
   await ui.send();
 
-  assert.equal(ui.rows()[0].said, 'member');
+  assert.equal(ui.rows().length, 0, 'no line carries a link that is not a web address');
+  assert.doesNotMatch(ui.sandbox.$('wizInviteList').innerHTML, /javascript:/);
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /couldn’t be sent/);
+});
+
+test('the region never opens a window for the owner — the link is theirs to click', () => {
+  assert.doesNotMatch(REGION, /window\.open|location\.(?:href|assign|replace)\s*[=(]/,
+    'an open fired from a network answer is blocked, and a surprise navigation loses the wizard');
 });
 
 test('a name is trimmed, and an empty one is a question rather than a request', async () => {
@@ -299,12 +320,7 @@ test('Enter in the field sends the invite too', async () => {
 });
 
 test('two invites in a row both stand, newest last', async () => {
-  const ui = boot({
-    answers: [
-      { ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 1, membership_kind: 'pending' } } },
-      { ok: true, status: 201, body: { invited: true, row: { id: 8, client_id: 'mercury', github_id: 2, membership_kind: 'pending' } } },
-    ],
-  });
+  const ui = boot({ answers: [handoff('octo-builder'), handoff('second-builder')] });
   await ui.open('mercury');
 
   await ui.type('octo-builder');
@@ -317,29 +333,11 @@ test('two invites in a row both stand, newest last', async () => {
 
 // ── every refusal the route can give ─────────────────────────────────────────
 
-test('an invitee with no platform account is named honestly, and the step survives it', async () => {
-  const ui = boot({ answers: [refused(404, 'account_not_found', 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.')] });
-  await ui.open('mercury');
-
-  await ui.type('nobody-here');
-  await ui.send();
-
-  assert.equal(ui.msg().className, 'projMsg err');
-  assert.match(ui.msg().textContent, /hasn’t signed in here yet/i);
-  assert.equal(ui.box().hidden, false, 'the step stays — a failed invite is re-tryable');
-  assert.equal(ui.rows().length, 0, 'and nothing is drawn as pending that is not');
-});
-
-test('someone already on the project is said plainly, not as a failure', async () => {
-  const ui = boot({ answers: [{ ok: true, status: 200, body: { invited: false, alreadyMember: true } }] });
-  await ui.open('mercury');
-
-  await ui.type('octo-builder');
-  await ui.send();
-
-  assert.equal(ui.msg().className, 'projMsg ok');
-  assert.match(ui.msg().textContent, /already on this project/i);
-  assert.equal(ui.rows().length, 0, 'an existing member is not a pending invite');
+// Task 1002818 retired two answers with the hub row they described: `account_not_found`
+// (the hall invites any GitHub login, account or not) and 200 `alreadyMember` (the hall's
+// own invite route answers that, where the membership actually lives).
+test('the refusals the retired write used to give are gone from the page too', () => {
+  assert.doesNotMatch(REGION, /account_not_found|alreadyMember/);
 });
 
 test('a project the map has not caught up with says exactly that, and stays re-tryable', async () => {
@@ -407,7 +405,6 @@ test('an unknown refusal falls through to the server’s own words rather than a
 
 test('inviteRefusal is a pure function over the route’s own vocabulary', () => {
   const f = boot().sandbox.inviteRefusal;
-  assert.match(f('account_not_found', 404, ''), /signed in here yet/i);
   assert.match(f('unknown_project', 404, ''), /map yet/i);
   assert.match(f('permission_forbidden', 403, ''), /can’t invite/i);
   assert.equal(f('whatever', 500, 'the server said this'), 'the server said this');

package/tests/watch_applications_queue.mjs

@@ -94,6 +94,7 @@ async function boot(opts = {}) {
     rank = 'archon',
     queueStatus = null,          // non-200 for the queue read (403 seals it)
     patchResult = null,          // a scripted answer for PATCH /access-requests/:id
+    search = '',                 // the page's query string (?invite=<login>, task 1002818)
   } = opts;
 
   const requests = [];
@@ -136,7 +137,7 @@ async function boot(opts = {}) {
   // the ones shipped rather than ones this test invented.
   parseInto(documentObj.body, PAGE);
 
-  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search: '', hash: '', assign() {} };
+  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search, hash: '', assign() {} };
 
   const kit = {
     makeTabs: () => ({}),
@@ -187,7 +188,7 @@ async function boot(opts = {}) {
     console: { log() {}, warn() {}, error() {} },
     setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, isNaN,
     Number, String, Object, Array, Boolean, Set, Map, RegExp,
-    encodeURIComponent, decodeURIComponent, parseInt, parseFloat,
+    encodeURIComponent, decodeURIComponent, parseInt, parseFloat, URLSearchParams,
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -491,4 +492,34 @@ await test('the profile changes what the row SAYS, never what it offers (ADR 001
     'a rich record is not a reason to admit and an empty one is not a reason to refuse — the decisions must be identical');
 });
 
+// ── ?invite=<login>: the platform hub hands an owner here (task 1002818, ADR 0353) ──
+// The hub's invite widget cannot admit anyone, so it links an owner to THIS box with the
+// name filled in. Filling is all a link may do: the send stays the owner's own click.
+
+await test('?invite= fills the invite box — and sends nothing on its own', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  assert.ok(box, 'the invite box rendered');
+  assert.equal(box.value, 'octo-builder');
+  assert.equal(h.requests.filter((r) => r.method === 'POST').length, 0,
+    'a link anyone can craft must never be the act that admits');
+});
+
+await test('?invite= is spent on first use — a re-render does not put the name back', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  box.value = '';
+  await h.switchView('invited');  // the gate re-renders, invite box and all
+  assert.equal(h.documentObj.getElementById('gate-invite-login').value, '');
+});
+
+await test('?invite= that is not a GitHub username fills nothing', async () => {
+  for (const bad of ['?invite=%3Cscript%3E', '?invite=a%20b', '?invite=-lead', '?invite=' + 'x'.repeat(40)]) {
+    const h = await boot({ search: bad });
+    assert.equal(h.documentObj.getElementById('gate-invite-login').value || '', '', bad);
+  }
+  const at = await boot({ search: '?invite=%40octo' });
+  assert.equal(at.documentObj.getElementById('gate-invite-login').value, 'octo', 'a pasted @ is dropped, as the form itself does');
+});
+
 summary();