@bongos/core 1.20.21 → 1.20.23

package/tests/watch_applications_queue.mjs

@@ -94,6 +94,7 @@ async function boot(opts = {}) {
     rank = 'archon',
     queueStatus = null,          // non-200 for the queue read (403 seals it)
     patchResult = null,          // a scripted answer for PATCH /access-requests/:id
+    search = '',                 // the page's query string (?invite=<login>, task 1002818)
   } = opts;
 
   const requests = [];
@@ -136,7 +137,7 @@ async function boot(opts = {}) {
   // the ones shipped rather than ones this test invented.
   parseInto(documentObj.body, PAGE);
 
-  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search: '', hash: '', assign() {} };
+  const locationObj = { hostname: 'builders.example.test', pathname: '/builders/watch', search, hash: '', assign() {} };
 
   const kit = {
     makeTabs: () => ({}),
@@ -187,7 +188,7 @@ async function boot(opts = {}) {
     console: { log() {}, warn() {}, error() {} },
     setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, isNaN,
     Number, String, Object, Array, Boolean, Set, Map, RegExp,
-    encodeURIComponent, decodeURIComponent, parseInt, parseFloat,
+    encodeURIComponent, decodeURIComponent, parseInt, parseFloat, URLSearchParams,
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -491,4 +492,34 @@ await test('the profile changes what the row SAYS, never what it offers (ADR 001
     'a rich record is not a reason to admit and an empty one is not a reason to refuse — the decisions must be identical');
 });
 
+// ── ?invite=<login>: the platform hub hands an owner here (task 1002818, ADR 0353) ──
+// The hub's invite widget cannot admit anyone, so it links an owner to THIS box with the
+// name filled in. Filling is all a link may do: the send stays the owner's own click.
+
+await test('?invite= fills the invite box — and sends nothing on its own', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  assert.ok(box, 'the invite box rendered');
+  assert.equal(box.value, 'octo-builder');
+  assert.equal(h.requests.filter((r) => r.method === 'POST').length, 0,
+    'a link anyone can craft must never be the act that admits');
+});
+
+await test('?invite= is spent on first use — a re-render does not put the name back', async () => {
+  const h = await boot({ search: '?invite=octo-builder' });
+  const box = h.documentObj.getElementById('gate-invite-login');
+  box.value = '';
+  await h.switchView('invited');  // the gate re-renders, invite box and all
+  assert.equal(h.documentObj.getElementById('gate-invite-login').value, '');
+});
+
+await test('?invite= that is not a GitHub username fills nothing', async () => {
+  for (const bad of ['?invite=%3Cscript%3E', '?invite=a%20b', '?invite=-lead', '?invite=' + 'x'.repeat(40)]) {
+    const h = await boot({ search: bad });
+    assert.equal(h.documentObj.getElementById('gate-invite-login').value || '', '', bad);
+  }
+  const at = await boot({ search: '?invite=%40octo' });
+  assert.equal(at.documentObj.getElementById('gate-invite-login').value, 'octo', 'a pasted @ is dropped, as the form itself does');
+});
+
 summary();