@bongos/core 1.20.20 → 1.20.22

package/tests/guild_map_db.mjs

@@ -0,0 +1,157 @@
+// tests/guild_map_db.mjs — the guild map against REAL SQL (R30, task 1002306;
+// ADR 0336 D8, amended by ADR 0337 D4.4).
+//
+// Why a real database: who is listed is an INNER join to an aggregated roster,
+// size is a capped count under the shared existence predicate, and the shipped
+// ordering puts un-refreshed guilds (NULL) last — each a planner fact the
+// DB-free route test (tests/guilds_api.mjs §3b) can only assert the shape of.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r30-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guild_map_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guild_map_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const guildMap = require('../modules/platform-identity/guild-map.js');
+const guilds = require('../modules/platform-identity/guilds.js');
+
+const A = 9002306001;    // public
+const B = 9002306002;    // public
+const C = 9002306003;    // public
+const HID = 9002306004;  // public account, hides their numbers
+const PRIV = 9002306005; // private account
+const PROV = 9002306006; // provisional
+const ALL_IDS = [A, B, C, HID, PRIV, PROV];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r30-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+async function account(id, handle, { visibility = 'public', hide = false, state = 'active' } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility, hide_stats)
+     VALUES ($1, $2, $2, $2, $3, CASE WHEN $3 = 'active' THEN now() END, $4, $5)`,
+    [id, handle, state, visibility, hide],
+  );
+}
+async function guild(slug, visibility = 'public') {
+  const { rows } = await q(
+    `INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ($1, $1, $2) RETURNING id`,
+    [slug, visibility],
+  );
+  return rows[0].id;
+}
+async function member(gid, id, { kind = 'member', shown = true } = {}) {
+  await q(
+    `INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly)
+     VALUES ($1, $2, $3, $4)`,
+    [gid, id, kind, shown],
+  );
+}
+const totals = (gid, shipped) => q(
+  `INSERT INTO platform_identity_guild_totals (guild_id, credits, works_shipped, karma, projects)
+   VALUES ($1, 0, $2, 0, 0)`, [gid, shipped],
+);
+// Only this file's guilds: a shared DB may hold others.
+const mine = async (order) => (await guildMap.listGuildMap({ order, limit: 100 }, { pool }))
+  .results.filter((r) => r.slug.startsWith('r30-'));
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_019_terms_acceptance.sql', 'platform_identity_025_guilds.sql',
+    'platform_identity_027_guild_totals.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  await account(A, 'r30a');
+  await account(B, 'r30b');
+  await account(C, 'r30c');
+  await account(HID, 'r30hid', { hide: true });
+  await account(PRIV, 'r30priv', { visibility: 'private' });
+  await account(PROV, 'r30prov', { state: 'provisional' });
+
+  // r30-big: three public members, one who hides numbers (still shown), one private (never).
+  const big = await guild('r30-big');
+  await member(big, A, { kind: 'owner' });
+  await member(big, B);
+  await member(big, HID);
+  await member(big, PRIV);
+  await totals(big, 20);
+  // r30-alpha / r30-beta: two each, a size tie broken on slug; beta has no record yet.
+  const alpha = await guild('r30-alpha');
+  await member(alpha, A, { kind: 'owner' });
+  await member(alpha, C);
+  await totals(alpha, 50);
+  const beta = await guild('r30-beta');
+  await member(beta, B, { kind: 'owner' });
+  await member(beta, C);
+  // r30-gamma: same shipped band as big (tie on shipped → slug).
+  const gamma = await guild('r30-gamma');
+  await member(gamma, C, { kind: 'owner' });
+  await totals(gamma, 20);
+  // Never on the map: unlisted; a public guild whose only members are private,
+  // provisional or unshown.
+  const quiet = await guild('r30-quiet', 'unlisted');
+  await member(quiet, A, { kind: 'owner', shown: false });
+  await member(quiet, B, { shown: false });
+  const hollow = await guild('r30-hollow');
+  await member(hollow, PRIV, { kind: 'owner' });
+  await member(hollow, PROV);
+  await member(hollow, A, { shown: false });
+
+  same((await mine('size')).map((r) => [r.slug, r.size]),
+    [['r30-big', 3], ['r30-alpha', 2], ['r30-beta', 2], ['r30-gamma', 1]],
+    'size order: public roster length, slug tiebreak; the hidden member counts, the private one never; unlisted and empty-roster guilds absent');
+  same((await mine('shipped')).map((r) => [r.slug, r.shipped]),
+    [['r30-alpha', 50], ['r30-big', 20], ['r30-gamma', 20], ['r30-beta', null]],
+    'shipped order: the stored band floor, slug tiebreak, a guild with no record yet last');
+
+  const page = await guilds.getPublicGuild('r30-big', { pool });
+  same((await mine('size')).find((r) => r.slug === 'r30-big').size, page.size,
+    'the map\'s size is exactly the guild page\'s size');
+
+  // Hides beat the map on the very next read: B goes private.
+  await q(`UPDATE platform_identity_accounts SET account_visibility = 'private' WHERE github_id = $1`, [B]);
+  same((await mine('size')).map((r) => [r.slug, r.size]),
+    [['r30-alpha', 2], ['r30-big', 2], ['r30-beta', 1], ['r30-gamma', 1]],
+    'a member going private leaves every guild\'s size on the next read — nothing cached');
+
+  same(Object.keys((await mine('size'))[0]).sort(), ['name', 'shipped', 'size', 'slug'],
+    'a row carries only what it publishes');
+
+  console.log(`\nguild_map_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/guilds_api.mjs

@@ -10,6 +10,10 @@
 //   3. THE PUBLIC READ — 404 for an unlisted guild is byte-identical to an
 //      unknown slug, needs no session, is no-store, and its roster statement
 //      carries shown_publicly AND the shared existence predicate.
+//   3b. THE GUILD MAP (task 1002306) — public guilds with a non-empty public
+//      roster, sized by the guild page's own predicate and cap, ranked only by
+//      published fields (size, or the STORED shipped band floor), paging
+//      clamped, and an unknown order refused before any SQL.
 //   4. SILENCE — a request written and one swallowed by a decline cooldown
 //      answer identically; a decline is an empty 204.
 //   5. THE CARD — an invite accept must echo the visibility its card showed,
@@ -90,6 +94,7 @@ require.cache[moduleApiPath] = {
   },
 };
 const guilds = require('../modules/platform-identity/guilds.js');
+const guildMap = require('../modules/platform-identity/guild-map.js');
 const buildGuildRoutes = require('../modules/platform-identity/routes/guilds.js');
 const buildPublicRoutes = require('../modules/platform-identity/routes/guilds-public.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
@@ -281,6 +286,75 @@ test('public read: the roster is shown_publicly AND the shared existence predica
   assert.equal(calls[0].params[0], 'guild-a', 'the slug is looked up in canonical form');
 });
 
+// ===========================================================================
+// 3b. The guild map (R30, task 1002306; ADR 0336 D8 + ADR 0337 D4.4)
+// ===========================================================================
+
+const IS_MAP = (t) => /WITH roster AS/.test(t) && /FROM platform_identity_guilds g/.test(t);
+
+test('guild map: public guilds with a public roster, sized like the guild page, ranked by size then slug', async () => {
+  on((t) => (IS_MAP(t) ? result([
+    { slug: 'big', name: 'Big', size: 9, shipped: 50 },
+    { slug: 'new', name: 'New', size: 2, shipped: null },
+  ]) : result()));
+  session = null; // the map must not need one
+  try {
+    const res = await call('GET', '/api/bongos/guilds');
+    assert.equal(res.status, 200);
+    assert.equal(res.headers['cache-control'], 'no-store');
+    assert.deepEqual(Object.keys(res.json).sort(), ['count', 'order', 'page', 'results']);
+    assert.equal(res.json.order, 'size', 'size is the default ordering');
+    assert.equal(res.json.count, res.json.results.length);
+    assert.deepEqual(res.json.page, { limit: guildMap.DEFAULT_LIMIT, offset: 0 });
+    assert.equal(calls.length, 1, 'one statement, and no read of the viewer');
+    const { text, params } = calls[0];
+    assert.match(text, /AND m\.shown_publicly AND \(\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\) AND pa\.account_visibility = 'public'\)/,
+      'size is the public roster: shown_publicly AND accountVisibleSql — the getPublicGuild predicate');
+    assert.match(text, /JOIN roster r ON r\.guild_id = g\.id/, 'an INNER join: a guild with an empty public roster is not on the map');
+    assert.match(text, /WHERE g\.visibility = 'public'/, 'an unlisted guild is never listed');
+    assert.match(text, /LEAST\(count\(\*\), \$3\)/, 'size is capped like the guild page\'s roster');
+    assert.match(text.split('SELECT g.slug')[0], /WHERE pg\.visibility = 'public' AND m\.shown_publicly/,
+      'the aggregate groups PUBLIC guilds\' memberships only — an unlisted guild is never scanned for the map');
+    assert.deepEqual(params, [guildMap.DEFAULT_LIMIT, 0, guilds.LIST_MAX]);
+    assert.match(text, /ORDER BY size DESC, g\.slug\s+LIMIT/, 'ties break on slug');
+  } finally { session = { github_id: ME, github_login: 'octo' }; }
+});
+
+test('guild map: shipped ranks by the STORED band floor, never an exact sum; a guild not yet refreshed sorts last', async () => {
+  on((t) => (IS_MAP(t) ? result([]) : result()));
+  const res = await call('GET', '/api/bongos/guilds?order=shipped');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.order, 'shipped');
+  const { text } = calls[0];
+  assert.match(text, /LEFT JOIN platform_identity_guild_totals t ON t\.guild_id = g\.id/);
+  assert.match(text, /t\.works_shipped AS shipped/, 'the published key IS the sort key (ADR 0255)');
+  assert.match(text, /ORDER BY shipped DESC NULLS LAST, g\.slug/);
+  assert.doesNotMatch(text, /platform_identity_builder_project_activity/, 'no exact sum is ever read here (ADR 0337 D4.4)');
+});
+
+test('guild map: a row carries slug, name, size and shipped — nothing that names an account', async () => {
+  on((t) => (IS_MAP(t) ? result([]) : result()));
+  await call('GET', '/api/bongos/guilds');
+  const select = calls[0].text.split(/SELECT g\.slug/)[1].split('FROM')[0];
+  assert.equal(`g.slug${select}`.replace(/\s+/g, ' ').trim(), 'g.slug, g.name, r.size, t.works_shipped AS shipped');
+});
+
+test('guild map: an unknown order is a 400 that reaches no SQL; paging is clamped and echoed', async () => {
+  on(() => result());
+  const bad = await call('GET', '/api/bongos/guilds?order=credits');
+  assert.equal(bad.status, 400);
+  assert.equal(bad.json.error.code, 'guild_map_bad_order');
+  assert.equal(calls.length, 0);
+
+  on((t) => (IS_MAP(t) ? result([]) : result()));
+  const big = await call('GET', '/api/bongos/guilds?limit=1000&offset=99999');
+  assert.deepEqual(big.json.page, { limit: guildMap.MAX_LIMIT, offset: guildMap.MAX_OFFSET });
+  assert.deepEqual(calls[0].params.slice(0, 2), [guildMap.MAX_LIMIT, guildMap.MAX_OFFSET]);
+  on((t) => (IS_MAP(t) ? result([]) : result()));
+  const junk = await call('GET', '/api/bongos/guilds?limit=-3&offset=abc');
+  assert.deepEqual(junk.json.page, { limit: guildMap.DEFAULT_LIMIT, offset: 0 });
+});
+
 // ===========================================================================
 // 4. Join requests and silence (D3)
 // ===========================================================================

package/tests/hub_invite_notices.mjs

@@ -0,0 +1,261 @@
+// tests/hub_invite_notices.mjs — a project's own invite reaches the hub as a NOTICE, and a
+// rescind takes it back (task 1002818, R6 of goal 1000110; ADR 0353).
+//
+// Three halves, each DB-free:
+//   1. the HUB routes (POST /sso/invites/notify|clear) — the real router, the real
+//      platform-identity domain functions and the real error envelope, over a recording
+//      fake pool, so the SQL a notice runs is the SQL asserted. What must hold: only an
+//      authenticated project writes, only to ITS OWN client_id, only ever a `pending` row,
+//      and the answer never says whether the login has a hub account.
+//   2. the hub's hand-off link (hallInviteUrl) — it becomes an <a href> on the hub.
+//   3. the INSTANCE sender (notifyHubOfInvite) — one login and one direction on the wire,
+//      the client credentials from config, and nothing it does can throw into a caller
+//      that never awaits it.
+//
+// The instance ROUTE wiring (which invite outcomes notify, which rescinds clear) is pinned
+// where those routes are already executed: tests/access_requests_invite.mjs and
+// tests/application_lifecycle.mjs.
+//
+// Run:  node --test tests/hub_invite_notices.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// ── the world: two projects, one hub account ─────────────────────────────────
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const SECRET = 'project-secret';
+const CLIENTS = {
+  mercury: { client_id: 'mercury', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: 'https://mercury.test' },
+  // Suspended, and catalog-only (no secret at all): neither may speak for a project.
+  frozen: { client_id: 'frozen', secret_hash: pi.sha256hex(SECRET), status: 'suspended', origin: 'https://frozen.test' },
+  shell: { client_id: 'shell', secret_hash: '', status: 'active', origin: 'https://shell.test' },
+};
+const ACCOUNTS = { octo: { github_id: '4242', github_login: 'Octo' } };
+
+let calls = [];
+const pool = {
+  async query(text, params = []) {
+    const sql = String(text);
+    calls.push({ sql, params });
+    if (/FROM platform_identity_sso_clients WHERE client_id = \$1/.test(sql)) {
+      return { rows: CLIENTS[params[0]] ? [CLIENTS[params[0]]] : [] };
+    }
+    if (/FROM platform_identity_accounts WHERE lower\(github_login\) = lower\(\$1\)/.test(sql)) {
+      const a = ACCOUNTS[String(params[0]).toLowerCase()];
+      return { rows: a ? [a] : [] };
+    }
+    if (/^\s*INSERT INTO platform_identity_project_memberships/.test(sql)) return { rows: [{ id: '1', membership_kind: 'pending' }] };
+    if (/^\s*DELETE FROM platform_identity_project_memberships/.test(sql)) return { rowCount: 1, rows: [] };
+    throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
+  },
+};
+const writes = () => calls.filter((c) => /^\s*(INSERT|UPDATE|DELETE)/.test(c.sql));
+
+// The doorway, with the pool swapped, BEFORE the domain file and the router load: both
+// take `pool` off it at require time.
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = { ...realApi, pool, logger: () => ({ error() {}, warn() {}, info() {} }) };
+delete require.cache[require.resolve('../modules/platform-identity/platform-identity.js')];
+delete require.cache[require.resolve('../modules/platform-identity/invite-notices.js')];
+const buildRoutes = require('../modules/platform-identity/routes/sso-invites.js');
+const inviteNotices = require('../modules/platform-identity/invite-notices.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildRoutes());
+const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function post(route, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${route}`, {
+      method: 'POST', headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+const notice = (route, extra = {}) => post(route, { client_id: 'mercury', client_secret: SECRET, github_login: 'octo', ...extra });
+
+test.beforeEach(() => { calls = []; });
+
+// ── 1. the hub routes ────────────────────────────────────────────────────────
+
+test('notify seeds a PENDING row on the calling project, and cannot touch a real membership', async () => {
+  const res = await notice('/sso/invites/notify');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { ok: true });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /VALUES \(\$1, \$2, 'pending'\)/, 'a notice is a pending row, never a membership');
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'a current member is left exactly as they are');
+  assert.deepEqual(w[0].params, ['mercury', '4242'], 'keyed on the authenticated client and the account the LOGIN resolves to');
+});
+
+test('clear drops ONLY a pending row on the calling project', async () => {
+  const res = await notice('/sso/invites/clear');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { ok: true });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
+    'a rescind can never remove someone who has signed in');
+  assert.deepEqual(w[0].params, ['mercury', '4242']);
+});
+
+test('a login with no hub account writes nothing — and the answer is byte-identical', async () => {
+  // The project must not learn from this route which GitHub logins have platform accounts.
+  for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
+    calls = [];
+    const known = await notice(route);
+    const unknown = await notice(route, { github_login: 'nobody-here' });
+    assert.deepEqual(unknown, known, `${route}: same status, same body`);
+  }
+  calls = [];
+  await notice('/sso/invites/notify', { github_login: 'nobody-here' });
+  assert.equal(writes().length, 0);
+});
+
+test('only an authenticated, active, credentialed project may speak — and writes nothing otherwise', async () => {
+  const refusals = [
+    { client_secret: 'wrong' },
+    { client_id: 'frozen' },
+    { client_id: 'shell', client_secret: '' },
+    { client_id: 'nobody' },
+  ];
+  for (const bad of refusals) {
+    for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
+      const res = await notice(route, bad);
+      assert.ok(res.status === 401 || res.status === 400, `${route} ${JSON.stringify(bad)} → ${res.status}`);
+    }
+  }
+  assert.equal(writes().length, 0);
+});
+
+test('a project can only notify about ITSELF — no body field names another project', async () => {
+  // The client row authenticated is the one written; there is no project field to steer.
+  const res = await notice('/sso/invites/notify', { project: 'someone-else' });
+  assert.equal(res.status, 400, 'the body is strict: an unknown field is refused, not ignored');
+  assert.equal(writes().length, 0);
+});
+
+test('each body is exactly three fields — a later field must ride a header (ADR 0352)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso-invites.js'), 'utf8');
+  const schemas = [...src.matchAll(/validateOrRespond\(req, res, \{([\s\S]*?)\}\)\) return/g)].map((m) => m[1]);
+  assert.equal(schemas.length, 2, 'one schema per route');
+  for (const schema of schemas) {
+    assert.deepEqual([...schema.matchAll(/^\s+(\w+): \{/gm)].map((m) => m[1]), ['client_id', 'client_secret', 'github_login']);
+  }
+});
+
+test('the module mounts the route file, and every route in it carries its rank line', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/platform-identity/module.json'), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('sso-invites'));
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso-invites.js'), 'utf8');
+  const routes = src.match(/router\.post\(/g) || [];
+  const ranks = src.match(/\/\/ rank: public — authenticated by client_id \+ client_secret/g) || [];
+  assert.equal(routes.length, 2);
+  assert.equal(ranks.length, routes.length);
+});
+
+// ── 2. the hand-off link ─────────────────────────────────────────────────────
+
+test('hallInviteUrl points at the project\'s own hall invite box, name filled in', () => {
+  const f = inviteNotices.hallInviteUrl;
+  assert.equal(f('https://mercury.test', 'octo'), 'https://mercury.test/builders/watch?invite=octo');
+  assert.equal(f('https://mercury.test/some/path/', '@octo'), 'https://mercury.test/builders/watch?invite=octo',
+    'the origin only, and a pasted @ is dropped');
+  assert.equal(f('https://mercury.test', 'a b&c'), 'https://mercury.test/builders/watch?invite=a%20b%26c', 'the login is encoded');
+  assert.equal(f('https://mercury.test', ''), 'https://mercury.test/builders/watch');
+});
+
+test('hallInviteUrl refuses anything that is not a web origin — it becomes an <a href>', () => {
+  for (const bad of ['javascript:alert(1)', 'data:text/html,x', 'not a url', '', null]) {
+    assert.equal(inviteNotices.hallInviteUrl(bad, 'octo'), null, String(bad));
+  }
+});
+
+// ── 3. the instance sender ───────────────────────────────────────────────────
+
+const pin = (rel, exports) => {
+  const p = require.resolve(rel);
+  require.cache[p] = { id: p, filename: p, loaded: true, exports };
+};
+
+function loadSender(idp) {
+  pin('../src/bongos/auth-config.js', { loadIdpConfig: typeof idp === 'function' ? idp : () => idp });
+  delete require.cache[require.resolve('../src/bongos/auth-admission.js')];
+  return require('../src/bongos/auth-admission.js').notifyHubOfInvite;
+}
+
+async function withFetch(impl, fn) {
+  const real = globalThis.fetch;
+  const sent = [];
+  globalThis.fetch = async (url, init) => { sent.push({ url, init }); return impl(url, init); };
+  try { await fn(sent); } finally { globalThis.fetch = real; }
+}
+
+const IDP = { origin: 'https://hub.test', clientId: 'mercury', clientSecret: SECRET };
+
+test('an invite posts one login to /notify with this project\'s credentials, and nothing else', async () => {
+  const send = loadSender(IDP);
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await send('octo', { invited: true });
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0].url, 'https://hub.test/api/bongos/sso/invites/notify');
+    assert.equal(sent[0].init.method, 'POST');
+    assert.deepEqual(JSON.parse(sent[0].init.body), { client_id: 'mercury', client_secret: SECRET, github_login: 'octo' });
+    assert.ok(sent[0].init.signal, 'bounded in time — a slow hub must not hold anything open');
+  });
+});
+
+test('a rescind posts to /clear', async () => {
+  const send = loadSender(IDP);
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await send('octo', { invited: false });
+    assert.equal(sent[0].url, 'https://hub.test/api/bongos/sso/invites/clear');
+  });
+});
+
+test('no hub, or no login, sends nothing', async () => {
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await loadSender(null)('octo', { invited: true });
+    await loadSender(IDP)('', { invited: true });
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('nothing the sender meets can throw into a caller that never awaits it', async () => {
+  // An older hub (404), a hub that is down (rejects), and a config read that throws.
+  await withFetch(async () => ({ ok: false, status: 404 }), async () => {
+    await assert.doesNotReject(loadSender(IDP)('octo'));
+  });
+  await withFetch(async () => { throw new Error('ECONNREFUSED'); }, async () => {
+    await assert.doesNotReject(loadSender(IDP)('octo'));
+  });
+  await assert.doesNotReject(loadSender(() => { throw new Error('bad config'); })('octo'));
+});
+
+test('the doorway publishes the sender as a narrow port, and never the config that holds the secret', () => {
+  assert.equal(typeof realApi.notifyHubOfInvite, 'function');
+  assert.equal(realApi.loadIdpConfig, undefined);
+});

package/tests/module_api.mjs

@@ -48,6 +48,7 @@ const PUBLISHED_SURFACE = [
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
+  'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask

package/tests/my_projects_surface.mjs

@@ -58,7 +58,6 @@ const MY_PROJECTS_ROUTES = [
   "router.get('/my-projects'",
   "router.post('/my-projects/join'",
   "router.get('/my-projects/invites'",
-  "router.post('/my-projects/invites/:clientId/accept'",
   "router.post('/my-projects/invites/:clientId/decline'",
   "router.post('/my-projects/:clientId/leave'",
 ];
@@ -122,3 +121,14 @@ test('the hub never calls the accept route — ADR 0335 retired that flip', () =
   assert.doesNotMatch(html, /invites\/[^'"]*\/accept/,
     'a hub caller of the accept route reopens the dead end ADR 0335 closed — render the invite as a link into the project instead');
 });
+
+// Task 1002818 (ADR 0353) finished the retirement on the server: the route is gone,
+// so no caller — this page, an old cached copy, a script — can flip a pending row
+// to 'member' and admit nobody. Signing in to the project is the only acceptance.
+test('the accept route itself is gone — only decline survives (ADR 0353)', () => {
+  const src = read(ROUTES);
+  assert.doesNotMatch(src, /router\.\w+\(\s*'\/my-projects\/invites\/:clientId\/accept'/,
+    'a hub-side accept admits nobody on the project; do not bring it back');
+  assert.doesNotMatch(src, /resolveInvite/, 'the accept-or-decline helper is retired too');
+  assert.match(src, /router\.post\('\/my-projects\/invites\/:clientId\/decline'/);
+});

package/tests/project_invite_ownership.mjs

@@ -149,14 +149,18 @@ beforeEach(() => { caller = OWNER; portMode = 'ok'; invites = []; portCalls = []
 
 // ── the arm ──────────────────────────────────────────────────────────────────
 
+// What an admitted caller gets since task 1002818 (ADR 0353): not a hub row, which let nobody
+// in, but WHERE the invite that admits is sent — the project's own hall, name filled in.
+const HANDOFF = 'https://spike-harbor.cloudbongos.test/builders/watch?invite=someone';
+
 test('the OWNER of a wizard-made project invites into it, holding no permission at all', async () => {
   // The whole point of the task: the wizard's audience is any signed-in GitHub user, and a
   // `xenos` owner used to get 403 on their own project before the target was even resolved.
   caller = OWNER;
   const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(res.status, 201);
-  assert.equal(res.body.invited, true);
-  assert.deepEqual(invites, [{ clientId: 'spike-harbor', githubId: 5150 }]);
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { invited: false, invite_url: HANDOFF });
+  assert.deepEqual(invites, [], 'the hub writes no membership row — only the project\'s own invite admits');
   // The ownership question was asked of the provisioning row, keyed on BOTH halves of the
   // catalog projection (ADR 0246: client_id = slug, origin = https://domain).
   assert.deepEqual(portCalls, [{ slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', builderId: 7 }]);
@@ -168,9 +172,9 @@ test('the OWNER of a wizard-made project invites into it, holding no permission
 test('a METIC curator still invites into a project they do not own — the old door is untouched', async () => {
   caller = CURATOR;
   const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(res.status, 201);
-  assert.equal(res.body.invited, true);
-  assert.equal(invites.length, 1);
+  assert.equal(res.status, 200);
+  assert.equal(res.body.invite_url, HANDOFF);
+  assert.deepEqual(invites, []);
 });
 
 test('a DIFFERENT builder is refused with the unchanged shape, and writes nothing', async () => {
@@ -253,7 +257,8 @@ test('a THROWING ownership check denies — it never 500s and never admits', asy
   // door is the old door, not an outage.
   caller = CURATOR;
   const asCurator = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(asCurator.status, 201);
+  assert.equal(asCurator.status, 200, 'past the gate — and handed to the hall, as every admitted caller is');
+  assert.equal(asCurator.body.invite_url, HANDOFF);
 });
 
 test('a non-string client_id is not an ownership claim', async () => {