@bongos/core 1.20.21 → 1.20.22

package/tests/hub_invite_notices.mjs

@@ -0,0 +1,261 @@
+// tests/hub_invite_notices.mjs — a project's own invite reaches the hub as a NOTICE, and a
+// rescind takes it back (task 1002818, R6 of goal 1000110; ADR 0353).
+//
+// Three halves, each DB-free:
+//   1. the HUB routes (POST /sso/invites/notify|clear) — the real router, the real
+//      platform-identity domain functions and the real error envelope, over a recording
+//      fake pool, so the SQL a notice runs is the SQL asserted. What must hold: only an
+//      authenticated project writes, only to ITS OWN client_id, only ever a `pending` row,
+//      and the answer never says whether the login has a hub account.
+//   2. the hub's hand-off link (hallInviteUrl) — it becomes an <a href> on the hub.
+//   3. the INSTANCE sender (notifyHubOfInvite) — one login and one direction on the wire,
+//      the client credentials from config, and nothing it does can throw into a caller
+//      that never awaits it.
+//
+// The instance ROUTE wiring (which invite outcomes notify, which rescinds clear) is pinned
+// where those routes are already executed: tests/access_requests_invite.mjs and
+// tests/application_lifecycle.mjs.
+//
+// Run:  node --test tests/hub_invite_notices.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// ── the world: two projects, one hub account ─────────────────────────────────
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const SECRET = 'project-secret';
+const CLIENTS = {
+  mercury: { client_id: 'mercury', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: 'https://mercury.test' },
+  // Suspended, and catalog-only (no secret at all): neither may speak for a project.
+  frozen: { client_id: 'frozen', secret_hash: pi.sha256hex(SECRET), status: 'suspended', origin: 'https://frozen.test' },
+  shell: { client_id: 'shell', secret_hash: '', status: 'active', origin: 'https://shell.test' },
+};
+const ACCOUNTS = { octo: { github_id: '4242', github_login: 'Octo' } };
+
+let calls = [];
+const pool = {
+  async query(text, params = []) {
+    const sql = String(text);
+    calls.push({ sql, params });
+    if (/FROM platform_identity_sso_clients WHERE client_id = \$1/.test(sql)) {
+      return { rows: CLIENTS[params[0]] ? [CLIENTS[params[0]]] : [] };
+    }
+    if (/FROM platform_identity_accounts WHERE lower\(github_login\) = lower\(\$1\)/.test(sql)) {
+      const a = ACCOUNTS[String(params[0]).toLowerCase()];
+      return { rows: a ? [a] : [] };
+    }
+    if (/^\s*INSERT INTO platform_identity_project_memberships/.test(sql)) return { rows: [{ id: '1', membership_kind: 'pending' }] };
+    if (/^\s*DELETE FROM platform_identity_project_memberships/.test(sql)) return { rowCount: 1, rows: [] };
+    throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
+  },
+};
+const writes = () => calls.filter((c) => /^\s*(INSERT|UPDATE|DELETE)/.test(c.sql));
+
+// The doorway, with the pool swapped, BEFORE the domain file and the router load: both
+// take `pool` off it at require time.
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = { ...realApi, pool, logger: () => ({ error() {}, warn() {}, info() {} }) };
+delete require.cache[require.resolve('../modules/platform-identity/platform-identity.js')];
+delete require.cache[require.resolve('../modules/platform-identity/invite-notices.js')];
+const buildRoutes = require('../modules/platform-identity/routes/sso-invites.js');
+const inviteNotices = require('../modules/platform-identity/invite-notices.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildRoutes());
+const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function post(route, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${route}`, {
+      method: 'POST', headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+const notice = (route, extra = {}) => post(route, { client_id: 'mercury', client_secret: SECRET, github_login: 'octo', ...extra });
+
+test.beforeEach(() => { calls = []; });
+
+// ── 1. the hub routes ────────────────────────────────────────────────────────
+
+test('notify seeds a PENDING row on the calling project, and cannot touch a real membership', async () => {
+  const res = await notice('/sso/invites/notify');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { ok: true });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /VALUES \(\$1, \$2, 'pending'\)/, 'a notice is a pending row, never a membership');
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'a current member is left exactly as they are');
+  assert.deepEqual(w[0].params, ['mercury', '4242'], 'keyed on the authenticated client and the account the LOGIN resolves to');
+});
+
+test('clear drops ONLY a pending row on the calling project', async () => {
+  const res = await notice('/sso/invites/clear');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { ok: true });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
+    'a rescind can never remove someone who has signed in');
+  assert.deepEqual(w[0].params, ['mercury', '4242']);
+});
+
+test('a login with no hub account writes nothing — and the answer is byte-identical', async () => {
+  // The project must not learn from this route which GitHub logins have platform accounts.
+  for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
+    calls = [];
+    const known = await notice(route);
+    const unknown = await notice(route, { github_login: 'nobody-here' });
+    assert.deepEqual(unknown, known, `${route}: same status, same body`);
+  }
+  calls = [];
+  await notice('/sso/invites/notify', { github_login: 'nobody-here' });
+  assert.equal(writes().length, 0);
+});
+
+test('only an authenticated, active, credentialed project may speak — and writes nothing otherwise', async () => {
+  const refusals = [
+    { client_secret: 'wrong' },
+    { client_id: 'frozen' },
+    { client_id: 'shell', client_secret: '' },
+    { client_id: 'nobody' },
+  ];
+  for (const bad of refusals) {
+    for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
+      const res = await notice(route, bad);
+      assert.ok(res.status === 401 || res.status === 400, `${route} ${JSON.stringify(bad)} → ${res.status}`);
+    }
+  }
+  assert.equal(writes().length, 0);
+});
+
+test('a project can only notify about ITSELF — no body field names another project', async () => {
+  // The client row authenticated is the one written; there is no project field to steer.
+  const res = await notice('/sso/invites/notify', { project: 'someone-else' });
+  assert.equal(res.status, 400, 'the body is strict: an unknown field is refused, not ignored');
+  assert.equal(writes().length, 0);
+});
+
+test('each body is exactly three fields — a later field must ride a header (ADR 0352)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso-invites.js'), 'utf8');
+  const schemas = [...src.matchAll(/validateOrRespond\(req, res, \{([\s\S]*?)\}\)\) return/g)].map((m) => m[1]);
+  assert.equal(schemas.length, 2, 'one schema per route');
+  for (const schema of schemas) {
+    assert.deepEqual([...schema.matchAll(/^\s+(\w+): \{/gm)].map((m) => m[1]), ['client_id', 'client_secret', 'github_login']);
+  }
+});
+
+test('the module mounts the route file, and every route in it carries its rank line', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/platform-identity/module.json'), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('sso-invites'));
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso-invites.js'), 'utf8');
+  const routes = src.match(/router\.post\(/g) || [];
+  const ranks = src.match(/\/\/ rank: public — authenticated by client_id \+ client_secret/g) || [];
+  assert.equal(routes.length, 2);
+  assert.equal(ranks.length, routes.length);
+});
+
+// ── 2. the hand-off link ─────────────────────────────────────────────────────
+
+test('hallInviteUrl points at the project\'s own hall invite box, name filled in', () => {
+  const f = inviteNotices.hallInviteUrl;
+  assert.equal(f('https://mercury.test', 'octo'), 'https://mercury.test/builders/watch?invite=octo');
+  assert.equal(f('https://mercury.test/some/path/', '@octo'), 'https://mercury.test/builders/watch?invite=octo',
+    'the origin only, and a pasted @ is dropped');
+  assert.equal(f('https://mercury.test', 'a b&c'), 'https://mercury.test/builders/watch?invite=a%20b%26c', 'the login is encoded');
+  assert.equal(f('https://mercury.test', ''), 'https://mercury.test/builders/watch');
+});
+
+test('hallInviteUrl refuses anything that is not a web origin — it becomes an <a href>', () => {
+  for (const bad of ['javascript:alert(1)', 'data:text/html,x', 'not a url', '', null]) {
+    assert.equal(inviteNotices.hallInviteUrl(bad, 'octo'), null, String(bad));
+  }
+});
+
+// ── 3. the instance sender ───────────────────────────────────────────────────
+
+const pin = (rel, exports) => {
+  const p = require.resolve(rel);
+  require.cache[p] = { id: p, filename: p, loaded: true, exports };
+};
+
+function loadSender(idp) {
+  pin('../src/bongos/auth-config.js', { loadIdpConfig: typeof idp === 'function' ? idp : () => idp });
+  delete require.cache[require.resolve('../src/bongos/auth-admission.js')];
+  return require('../src/bongos/auth-admission.js').notifyHubOfInvite;
+}
+
+async function withFetch(impl, fn) {
+  const real = globalThis.fetch;
+  const sent = [];
+  globalThis.fetch = async (url, init) => { sent.push({ url, init }); return impl(url, init); };
+  try { await fn(sent); } finally { globalThis.fetch = real; }
+}
+
+const IDP = { origin: 'https://hub.test', clientId: 'mercury', clientSecret: SECRET };
+
+test('an invite posts one login to /notify with this project\'s credentials, and nothing else', async () => {
+  const send = loadSender(IDP);
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await send('octo', { invited: true });
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0].url, 'https://hub.test/api/bongos/sso/invites/notify');
+    assert.equal(sent[0].init.method, 'POST');
+    assert.deepEqual(JSON.parse(sent[0].init.body), { client_id: 'mercury', client_secret: SECRET, github_login: 'octo' });
+    assert.ok(sent[0].init.signal, 'bounded in time — a slow hub must not hold anything open');
+  });
+});
+
+test('a rescind posts to /clear', async () => {
+  const send = loadSender(IDP);
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await send('octo', { invited: false });
+    assert.equal(sent[0].url, 'https://hub.test/api/bongos/sso/invites/clear');
+  });
+});
+
+test('no hub, or no login, sends nothing', async () => {
+  await withFetch(async () => ({ ok: true }), async (sent) => {
+    await loadSender(null)('octo', { invited: true });
+    await loadSender(IDP)('', { invited: true });
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('nothing the sender meets can throw into a caller that never awaits it', async () => {
+  // An older hub (404), a hub that is down (rejects), and a config read that throws.
+  await withFetch(async () => ({ ok: false, status: 404 }), async () => {
+    await assert.doesNotReject(loadSender(IDP)('octo'));
+  });
+  await withFetch(async () => { throw new Error('ECONNREFUSED'); }, async () => {
+    await assert.doesNotReject(loadSender(IDP)('octo'));
+  });
+  await assert.doesNotReject(loadSender(() => { throw new Error('bad config'); })('octo'));
+});
+
+test('the doorway publishes the sender as a narrow port, and never the config that holds the secret', () => {
+  assert.equal(typeof realApi.notifyHubOfInvite, 'function');
+  assert.equal(realApi.loadIdpConfig, undefined);
+});

package/tests/module_api.mjs

@@ -48,6 +48,7 @@ const PUBLISHED_SURFACE = [
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
+  'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask

package/tests/my_projects_surface.mjs

@@ -58,7 +58,6 @@ const MY_PROJECTS_ROUTES = [
   "router.get('/my-projects'",
   "router.post('/my-projects/join'",
   "router.get('/my-projects/invites'",
-  "router.post('/my-projects/invites/:clientId/accept'",
   "router.post('/my-projects/invites/:clientId/decline'",
   "router.post('/my-projects/:clientId/leave'",
 ];
@@ -122,3 +121,14 @@ test('the hub never calls the accept route — ADR 0335 retired that flip', () =
   assert.doesNotMatch(html, /invites\/[^'"]*\/accept/,
     'a hub caller of the accept route reopens the dead end ADR 0335 closed — render the invite as a link into the project instead');
 });
+
+// Task 1002818 (ADR 0353) finished the retirement on the server: the route is gone,
+// so no caller — this page, an old cached copy, a script — can flip a pending row
+// to 'member' and admit nobody. Signing in to the project is the only acceptance.
+test('the accept route itself is gone — only decline survives (ADR 0353)', () => {
+  const src = read(ROUTES);
+  assert.doesNotMatch(src, /router\.\w+\(\s*'\/my-projects\/invites\/:clientId\/accept'/,
+    'a hub-side accept admits nobody on the project; do not bring it back');
+  assert.doesNotMatch(src, /resolveInvite/, 'the accept-or-decline helper is retired too');
+  assert.match(src, /router\.post\('\/my-projects\/invites\/:clientId\/decline'/);
+});

package/tests/project_invite_ownership.mjs

@@ -149,14 +149,18 @@ beforeEach(() => { caller = OWNER; portMode = 'ok'; invites = []; portCalls = []
 
 // ── the arm ──────────────────────────────────────────────────────────────────
 
+// What an admitted caller gets since task 1002818 (ADR 0353): not a hub row, which let nobody
+// in, but WHERE the invite that admits is sent — the project's own hall, name filled in.
+const HANDOFF = 'https://spike-harbor.cloudbongos.test/builders/watch?invite=someone';
+
 test('the OWNER of a wizard-made project invites into it, holding no permission at all', async () => {
   // The whole point of the task: the wizard's audience is any signed-in GitHub user, and a
   // `xenos` owner used to get 403 on their own project before the target was even resolved.
   caller = OWNER;
   const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(res.status, 201);
-  assert.equal(res.body.invited, true);
-  assert.deepEqual(invites, [{ clientId: 'spike-harbor', githubId: 5150 }]);
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body, { invited: false, invite_url: HANDOFF });
+  assert.deepEqual(invites, [], 'the hub writes no membership row — only the project\'s own invite admits');
   // The ownership question was asked of the provisioning row, keyed on BOTH halves of the
   // catalog projection (ADR 0246: client_id = slug, origin = https://domain).
   assert.deepEqual(portCalls, [{ slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', builderId: 7 }]);
@@ -168,9 +172,9 @@ test('the OWNER of a wizard-made project invites into it, holding no permission
 test('a METIC curator still invites into a project they do not own — the old door is untouched', async () => {
   caller = CURATOR;
   const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(res.status, 201);
-  assert.equal(res.body.invited, true);
-  assert.equal(invites.length, 1);
+  assert.equal(res.status, 200);
+  assert.equal(res.body.invite_url, HANDOFF);
+  assert.deepEqual(invites, []);
 });
 
 test('a DIFFERENT builder is refused with the unchanged shape, and writes nothing', async () => {
@@ -253,7 +257,8 @@ test('a THROWING ownership check denies — it never 500s and never admits', asy
   // door is the old door, not an outage.
   caller = CURATOR;
   const asCurator = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
-  assert.equal(asCurator.status, 201);
+  assert.equal(asCurator.status, 200, 'past the gate — and handed to the hall, as every admitted caller is');
+  assert.equal(asCurator.body.invite_url, HANDOFF);
 });
 
 test('a non-string client_id is not an ownership claim', async () => {

package/tests/project_invite_ui.mjs

@@ -19,8 +19,10 @@
 //     before that an invite could only ever 404
 //   • an invite sends exactly { client_id, github_login } — the slug IS the
 //     client_id — on the cookie session, and nothing else
-//   • the 201 row is what the pending line is drawn from, and the github_id it
-//     carries is never shown
+//   • the answer is a HAND-OFF (task 1002818, ADR 0353): the route writes nothing
+//     and answers `{ invited: false, invite_url }` — the project's hall invite link — and
+//     each name becomes a line whose link finishes the invite there — never a
+//     window opened for the owner, and never a link that is not http(s)
 //   • every refusal the route can give is said in the route's own vocabulary,
 //     and the 403 is said CAREFULLY: it is byte-identical whether or not the
 //     project exists (ADR 0248), so the page may not read it as "it is there"
@@ -57,8 +59,14 @@ for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function ski
 // Narrow on purpose (the project_modules_ui.mjs rule): it supports exactly what
 // the region uses, so it stays honest about what it can prove.
 
-const ROW = /<li><b>([^<]*)<\/b><small>([^<]*)<\/small><\/li>/g;
-const parseRows = (html) => [...String(html).matchAll(ROW)].map((m) => ({ login: m[1], said: m[2] }));
+const ROW = /<li><b>([^<]*)<\/b><small>([^<]*)<\/small><a class="btn small" href="([^"]*)" target="_blank" rel="noopener">Send the invite →<\/a><\/li>/g;
+const parseRows = (html) => [...String(html).matchAll(ROW)].map((m) => ({ login: m[1], said: m[2], url: m[3] }));
+
+// The route's answer to an admitted caller since task 1002818: where to send the invite.
+const handoff = (login, origin = 'https://mercury.cloudbongos.test') => ({
+  ok: true, status: 200,
+  body: { invited: false, invite_url: origin + '/builders/watch?invite=' + encodeURIComponent(login) },
+});
 
 // A suggestion row: whatever the row NAMES, plus the login its button carries.
 // Parsed off the button so the test reads the address the click will actually
@@ -113,7 +121,8 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
     requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
-    const a = queued.shift() || { ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 4242, membership_kind: 'pending' } } };
+    const sent = (() => { try { return JSON.parse(init.body).github_login; } catch { return ''; } })();
+    const a = queued.shift() || handoff(sent);
     if (a.reject) return Promise.reject(new Error('offline'));
     return Promise.resolve({ ok: a.ok, status: a.status, _json: a.body, json: () => Promise.resolve(a.body) });
   };
@@ -127,7 +136,12 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
     apiError: (data, status) => ({
       code: (data && data.error && data.error.code) || ('http_' + status),
       message: (data && data.error && data.error.message) || '',
+      details: (data && data.error && data.error.details) || {},
     }),
+    safeHttpUrl: (raw) => {
+      try { const u = new URL(String(raw)); return (u.protocol === 'https:' || u.protocol === 'http:') ? u.href : ''; } catch (e) { return ''; }
+    },
+    URL,
     signInAgain: () => 'Your session expired — <a href="/in">sign in again</a>.',
   };
   sandbox.globalThis = sandbox;
@@ -238,7 +252,7 @@ test('an invite carries exactly { client_id, github_login } — the slug IS the
     'exactly the two fields the route validates, and nothing else');
 });
 
-test('the pending line is drawn from the 201 ROW, and the github_id on it is never shown', async () => {
+test('the answer is a hand-off line: the name, "not sent yet", and the hall link that sends it', async () => {
   const ui = boot();
   await ui.open('mercury');
 
@@ -246,22 +260,29 @@ test('the pending line is drawn from the 201 ROW, and the github_id on it is nev
   await ui.send();
 
   assert.deepEqual(ui.rows().map((r) => r.login), ['octo-builder']);
-  assert.match(ui.rows()[0].said, /waiting for them to accept/i, "the row's own 'pending' is what the line says");
-  assert.equal(ui.msg().className, 'projMsg ok');
-  assert.doesNotMatch(ui.msg().textContent + ui.rows()[0].said + ui.rows()[0].login, /4242/,
-    'the row carries a github_id; a person who has accepted nothing yet is not published by it');
+  assert.match(ui.rows()[0].said, /not sent yet/i, 'the line may not claim an invite the hall has not sent');
+  assert.equal(ui.rows()[0].url, 'https://mercury.cloudbongos.test/builders/watch?invite=octo-builder',
+    'the link is the route\'s own invite_url, verbatim');
+  assert.equal(ui.msg().className, 'projMsg ok', 'being handed to the hall is the answer, not a failure');
+  assert.match(ui.msg().textContent, /hall/i);
 });
 
-test('a membership_kind the page does not know is shown VERBATIM, never papered over as pending', async () => {
-  // The state word is the row's, not this page's: if the route ever seeds a
-  // different kind, an owner sees that rather than a comfortable fiction.
-  const ui = boot({ answers: [{ ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 1, membership_kind: 'member' } } }] });
+test('a hand-off link that is not http(s) is never drawn — it is said as a failure instead', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: { invited: false, invite_url: 'javascript:alert(1)' } }] });
   await ui.open('mercury');
 
   await ui.type('octo-builder');
   await ui.send();
 
-  assert.equal(ui.rows()[0].said, 'member');
+  assert.equal(ui.rows().length, 0, 'no line carries a link that is not a web address');
+  assert.doesNotMatch(ui.sandbox.$('wizInviteList').innerHTML, /javascript:/);
+  assert.equal(ui.msg().className, 'projMsg err');
+  assert.match(ui.msg().textContent, /couldn’t be sent/);
+});
+
+test('the region never opens a window for the owner — the link is theirs to click', () => {
+  assert.doesNotMatch(REGION, /window\.open|location\.(?:href|assign|replace)\s*[=(]/,
+    'an open fired from a network answer is blocked, and a surprise navigation loses the wizard');
 });
 
 test('a name is trimmed, and an empty one is a question rather than a request', async () => {
@@ -299,12 +320,7 @@ test('Enter in the field sends the invite too', async () => {
 });
 
 test('two invites in a row both stand, newest last', async () => {
-  const ui = boot({
-    answers: [
-      { ok: true, status: 201, body: { invited: true, row: { id: 7, client_id: 'mercury', github_id: 1, membership_kind: 'pending' } } },
-      { ok: true, status: 201, body: { invited: true, row: { id: 8, client_id: 'mercury', github_id: 2, membership_kind: 'pending' } } },
-    ],
-  });
+  const ui = boot({ answers: [handoff('octo-builder'), handoff('second-builder')] });
   await ui.open('mercury');
 
   await ui.type('octo-builder');
@@ -317,29 +333,11 @@ test('two invites in a row both stand, newest last', async () => {
 
 // ── every refusal the route can give ─────────────────────────────────────────
 
-test('an invitee with no platform account is named honestly, and the step survives it', async () => {
-  const ui = boot({ answers: [refused(404, 'account_not_found', 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.')] });
-  await ui.open('mercury');
-
-  await ui.type('nobody-here');
-  await ui.send();
-
-  assert.equal(ui.msg().className, 'projMsg err');
-  assert.match(ui.msg().textContent, /hasn’t signed in here yet/i);
-  assert.equal(ui.box().hidden, false, 'the step stays — a failed invite is re-tryable');
-  assert.equal(ui.rows().length, 0, 'and nothing is drawn as pending that is not');
-});
-
-test('someone already on the project is said plainly, not as a failure', async () => {
-  const ui = boot({ answers: [{ ok: true, status: 200, body: { invited: false, alreadyMember: true } }] });
-  await ui.open('mercury');
-
-  await ui.type('octo-builder');
-  await ui.send();
-
-  assert.equal(ui.msg().className, 'projMsg ok');
-  assert.match(ui.msg().textContent, /already on this project/i);
-  assert.equal(ui.rows().length, 0, 'an existing member is not a pending invite');
+// Task 1002818 retired two answers with the hub row they described: `account_not_found`
+// (the hall invites any GitHub login, account or not) and 200 `alreadyMember` (the hall's
+// own invite route answers that, where the membership actually lives).
+test('the refusals the retired write used to give are gone from the page too', () => {
+  assert.doesNotMatch(REGION, /account_not_found|alreadyMember/);
 });
 
 test('a project the map has not caught up with says exactly that, and stays re-tryable', async () => {
@@ -407,7 +405,6 @@ test('an unknown refusal falls through to the server’s own words rather than a
 
 test('inviteRefusal is a pure function over the route’s own vocabulary', () => {
   const f = boot().sandbox.inviteRefusal;
-  assert.match(f('account_not_found', 404, ''), /signed in here yet/i);
   assert.match(f('unknown_project', 404, ''), /map yet/i);
   assert.match(f('permission_forbidden', 403, ''), /can’t invite/i);
   assert.equal(f('whatever', 500, 'the server said this'), 'the server said this');

package/tests/watch_applications_queue.mjs

@@ -94,6 +94,7 @@ async function boot(opts = {}) {
     rank = 'archon',
     queueStatus = null,          // non-200 for the queue read (403 seals it)
     patchResult = null,          // a scripted answer for PATCH /access-requests/:id
+    search = '',                 // the page's query string (?invite=<login>, task 1002818)
   } = opts;
 
   const requests = [];
@@ -136,7 +137,7 @@ async function boot(opts = {}) {
   // the ones shipped rather than ones this test invented.
   parseInto(documentObj.body, PAGE);
 
-  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search: '', hash: '', assign() {} };
+  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search, hash: '', assign() {} };
 
   const kit = {
     makeTabs: () => ({}),
@@ -187,7 +188,7 @@ async function boot(opts = {}) {
     console: { log() {}, warn() {}, error() {} },
     setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, isNaN,
     Number, String, Object, Array, Boolean, Set, Map, RegExp,
-    encodeURIComponent, decodeURIComponent, parseInt, parseFloat,
+    encodeURIComponent, decodeURIComponent, parseInt, parseFloat, URLSearchParams,
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -491,4 +492,34 @@ await test('the profile changes what the row SAYS, never what it offers (ADR 001
     'a rich record is not a reason to admit and an empty one is not a reason to refuse — the decisions must be identical');
 });
 
+// ── ?invite=<login>: the platform hub hands an owner here (task 1002818, ADR 0353) ──
+// The hub's invite widget cannot admit anyone, so it links an owner to THIS box with the
+// name filled in. Filling is all a link may do: the send stays the owner's own click.
+
+await test('?invite= fills the invite box — and sends nothing on its own', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  assert.ok(box, 'the invite box rendered');
+  assert.equal(box.value, 'octo-builder');
+  assert.equal(h.requests.filter((r) => r.method === 'POST').length, 0,
+    'a link anyone can craft must never be the act that admits');
+});
+
+await test('?invite= is spent on first use — a re-render does not put the name back', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  box.value = '';
+  await h.switchView('invited');  // the gate re-renders, invite box and all
+  assert.equal(h.documentObj.getElementById('gate-invite-login').value, '');
+});
+
+await test('?invite= that is not a GitHub username fills nothing', async () => {
+  for (const bad of ['?invite=%3Cscript%3E', '?invite=a%20b', '?invite=-lead', '?invite=' + 'x'.repeat(40)]) {
+    const h = await boot({ search: bad });
+    assert.equal(h.documentObj.getElementById('gate-invite-login').value || '', '', bad);
+  }
+  const at = await boot({ search: '?invite=%40octo' });
+  assert.equal(at.documentObj.getElementById('gate-invite-login').value, 'octo', 'a pasted @ is dropped, as the form itself does');
+});
+
 summary();