@bongos/core 1.20.27 → 1.20.29

package/tests/invite_expiry_db.mjs

@@ -0,0 +1,196 @@
+// tests/invite_expiry_db.mjs — task 1002969 (privacy spec D4, ADR 0356). Real DB.
+//
+// A recruit invite's door closes 30 days after it is sent, computed at read time.
+// tests/application_lifecycle.mjs pins the behaviour over an interpreter that reads
+// each statement's WHERE; this file runs the SAME statements on Postgres, because an
+// interpreter cannot tell you that Postgres would reject a statement, or what
+// `now() - interval '30 days'` does at the boundary. Two halves:
+//
+//   the instance — the real onboarding router and the real db-kernel admission reads,
+//                  over access_requests built from its real migrations;
+//   the hub      — inviteToProject and listPendingInvitesForAccount over the real
+//                  memberships table: an expired notice is hidden, a re-invite
+//                  restamps it, and a member's row is never touched.
+//
+// Each half builds its tables in a throwaway schema, so a shared database's rows are
+// never seen or changed.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/invite_expiry_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const express = require('express');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const coreSql = (f) => readFileSync(join(here, '..', 'migrations', `${f}.sql`), 'utf8');
+const piSql = (f) => readFileSync(join(here, '..', 'modules', 'platform-identity', 'migrations', `platform_identity_${f}.sql`), 'utf8');
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try {
+  client = await pgPool.connect();
+} catch (e) {
+  console.log(`invite_expiry_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+
+const q = (sql, params) => client.query(sql, params);
+const SCHEMA = `t1002969_${process.pid}`;
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+// Core's admission reads go through ./pool, and the router through the doorway's
+// pool: both are pointed at this one connection, whose search_path is the schema.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: client } };
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+let notices = [];
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: client,
+  projectJoinDoor: () => 'apply',
+  logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
+  requirePermission: () => (_req, _res, next) => next(),
+  readApplicationVouch: () => null,
+  notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
+};
+const broadcastPath = require.resolve('../modules/onboarding/approval-broadcast.js');
+require.cache[broadcastPath] = { id: broadcastPath, filename: broadcastPath, loaded: true, exports: { postMemberApprovalRequest: async () => ({}) } };
+
+const dbKernel = require('../src/bongos/db-kernel.js');
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const port = server.address().port;
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({ host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, json: JSON.parse(Buffer.concat(chunks).toString('utf8') || 'null') }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// Backdate one login's rows by `days` (an invite's resolved_at is its created_at).
+const age = (login, days) => q(
+  `UPDATE access_requests SET created_at = now() - make_interval(days => $2),
+          resolved_at = CASE WHEN kind = 'invite' THEN now() - make_interval(days => $2) ELSE resolved_at END
+    WHERE github_login = $1`, [login, days]);
+
+try {
+  await q(`CREATE SCHEMA ${SCHEMA}`);
+  await q(`SET search_path TO ${SCHEMA}`);
+  await q('CREATE TABLE schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())');
+  await q('CREATE TABLE builders (id bigserial PRIMARY KEY, github_login text NOT NULL)');
+  await q(`INSERT INTO builders (id, github_login) VALUES (42, 'owner')`);
+  for (const f of ['060_access_requests', 'core_230_access_requests_applicant_vouch',
+    'core_254_access_requests_applicant_handle', 'core_255_access_requests_invite_kind',
+    'core_266_access_requests_invited_login_idx']) await q(coreSql(f));
+
+  // ── The instance: the door, the queues, the probe ────────────────────────
+  console.log('the instance:');
+  for (const login of ['eve', 'fay']) assert.equal((await call('POST', '/api/gds/access-requests/invite', { github_login: login })).status, 201);
+  await q(`INSERT INTO access_requests (github_login, status, resolved_at, created_at) VALUES ('cy', 'invited', now(), now() - interval '60 days')`);
+  await age('eve', 29);
+  await age('fay', 31);
+  ok(await dbKernel.hasInvitedAccessRequest('eve') === true, 'day 29: the invite still admits');
+  ok(await dbKernel.hasInvitedAccessRequest('fay') === false, 'day 31: the sign-in gate refuses it');
+  ok(await dbKernel.hasInvitedAccessRequest('cy') === true, 'an application approved 60 days ago is not an invite and still admits');
+  ok((await dbKernel.accessStateByLogin('fay')).invited === false, 'the waiting page agrees with the gate');
+
+  // core_266: the gate's own statement, captured as it runs, can use the invited-login
+  // index. Seq scans are switched off only so a tiny table still shows the plan.
+  const seen = [];
+  const realQuery = client.query.bind(client);
+  client.query = (text, params) => { seen.push({ text, params }); return realQuery(text, params); };
+  await dbKernel.hasInvitedAccessRequest('eve');
+  client.query = realQuery;
+  await q('SET enable_seqscan = off');
+  const plan = (await q(`EXPLAIN ${seen[0].text}`, seen[0].params)).rows.map((r) => r['QUERY PLAN']).join('\n');
+  await q('RESET enable_seqscan');
+  ok(/idx_access_requests_invited_login/.test(plan), 'the sign-in gate can read invited rows through core_266\'s index');
+
+  const hist = Object.fromEntries((await call('GET', '/api/gds/access-requests?status=invited')).json.requests.map((r) => [r.github_login, r]));
+  ok(hist.fay.expired === true && hist.eve.expired === false && hist.cy.expired === false, 'the queue marks only the expired invite');
+  ok(hist.cy.expires_at === null && new Date(hist.fay.expires_at) <= new Date() && new Date(hist.eve.expires_at) > new Date(),
+    'and says when each invite closes; an application has no such day');
+
+  const probe = (await call('GET', '/api/gds/access-requests/status?github_login=fay')).json;
+  ok(probe.status === 'expired' && probe.admitted === false, 'the status probe reports expired, not invited');
+
+  notices = [];
+  const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  ok(again.status === 201 && await dbKernel.hasInvitedAccessRequest('fay') === true, 're-inviting an expired login opens a fresh door');
+  ok(notices.length === 1 && notices[0].invited === true, 'and tells the hub');
+  const out = (await call('GET', '/api/gds/access-requests/invites')).json.invites;
+  ok(out.filter((r) => r.github_login === 'fay').length === 1 && out.find((r) => r.github_login === 'fay').expired === false,
+    'the outstanding list shows the live invite in place of the expired one');
+  const mine = (await call('GET', '/api/gds/access-requests/invites?mine=1')).json.invites;
+  ok(mine.filter((r) => r.github_login === 'fay').length === 1, 'and so does the sender\'s own list (?mine=1)');
+
+  notices = [];
+  await call('PATCH', `/api/gds/access-requests/${again.json.request.id}`, { status: 'dismissed' });
+  ok(notices.length === 1 && notices[0].invited === false, 'rescinding the live invite clears the hub notice; the expired row does not stand');
+
+  // ── The hub: the notice follows the door ──────────────────────────────────
+  console.log('the hub:');
+  for (const f of ['001_tables', '003_project_memberships', '010_membership_kind', '021_drop_legacy_role']) await q(piSql(f));
+  const joined = async (id) => (await q(
+    `SELECT membership_kind, joined_at FROM platform_identity_project_memberships WHERE client_id = 'demo' AND github_id = $1`, [id])).rows[0];
+  const backdate = (id, days) => q(
+    `UPDATE platform_identity_project_memberships SET joined_at = now() - make_interval(days => $2) WHERE client_id = 'demo' AND github_id = $1`, [id, days]);
+
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 1 }, { pool: client })).invited === true, 'a first invite writes a notice');
+  await backdate(1, 10);
+  const before = (await joined(1)).joined_at;
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 1 }, { pool: client })).invited === false
+    && (await joined(1)).joined_at.getTime() === before.getTime(), 'a re-send while the invite is live leaves the notice as it was');
+
+  await pi.inviteToProject({ clientId: 'demo', githubId: 2 }, { pool: client });
+  await backdate(2, 31);
+  const listed = async (id) => (await pi.listPendingInvitesForAccount(id, { pool: client })).length;
+  ok(await listed(1) === 1, 'a 10-day-old notice is listed');
+  ok(await listed(2) === 0, 'a 31-day-old notice is not: its door no longer opens');
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 2 }, { pool: client })).invited === true && await listed(2) === 1,
+    'a re-invite after the 30 days restamps the notice, so it shows again');
+
+  await q(`INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind, joined_at)
+           VALUES ('demo', 3, 'member', now() - interval '400 days')`);
+  const member = await joined(3);
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 3 }, { pool: client })).invited === false, 'inviting a member writes nothing');
+  const after = await joined(3);
+  ok(after.membership_kind === 'member' && after.joined_at.getTime() === member.joined_at.getTime(),
+    'and their row is untouched, however old it is');
+
+  console.log(`\ninvite_expiry_db.mjs: ${pass} passed`);
+} finally {
+  await new Promise((r) => server.close(r));
+  await q(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end().catch(() => {});
+}

package/tests/module_api.mjs

@@ -49,6 +49,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
+  'inviteExpiry', // added by task 1002969 (ADR 0356): the ONE read-time definition of when a recruit invite's door closes. The sign-in gate reads it in core; the onboarding queues and the hub's notice list are modules, so without the doorway each would restate the 30 days and the predicate, and two copies can close a door on different days
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask

package/tests/project_admin_console_model.mjs

@@ -6,8 +6,9 @@
 // drift quietly is worse than none, so the load-bearing ones are pinned here:
 //
 //   D1  the hub relays and notifies; it never writes a project's admission row
-//   D2  an invite is a row the existing gate already reads — `kind` and
-//       `created_by` are descriptive and never enter the admission read
+//   D2  an invite is a row the existing gate already reads — `created_by` never
+//       enters the admission read, and `kind` enters it only through the invite
+//       expiry, which can close a door and never open one (ADR 0356 amends D2.5)
 //   D3  the admission verdict stays `access_request.review` at the archon floor,
 //       and `project.recruit`, once minted, takes exactly the shape the ADR fixes
 //
@@ -66,16 +67,22 @@ test('the ADR exists, is indexed, and ADR 0141 names it as superseding its §5 i
 
 // Both admission reads: the gate's own (hasInvitedAccessRequest) and the state the
 // "confirming access" waiting page polls (accessStateByLogin), which must agree with it.
-test('D2: both admission reads look at status alone — an invite and an approved application admit identically', () => {
+// Since ADR 0356 (task 1002969) `kind` reaches them through ONE door: the ANDed
+// invite-expiry unit, which only ever narrows `status = 'invited'`.
+test('D2: both admission reads look at status, narrowed only by the invite expiry — never widened by kind', () => {
   const src = read('src', 'bongos', 'db-kernel.js');
   for (const fn of ['hasInvitedAccessRequest', 'accessStateByLogin']) {
     const m = new RegExp(`async function ${fn}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n\\}`).exec(src);
     assert.ok(m, `${fn} is still an admission read in db-kernel.js`);
     const body = m[1];
-    assert.match(body, /status\s*=\s*'invited'/, `${fn}: admission is status = invited`);
-    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is descriptive; it must never decide admission`);
+    assert.match(body, /status\s*=\s*'invited'\s+AND\s+\$\{inviteLiveSql\(\)\}/, `${fn}: admission is status = invited AND the invite has not expired`);
+    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is never read directly; only through inviteLiveSql`);
     assert.doesNotMatch(body, /\bcreated_by\b/, `${fn}: created_by is audit data; it must never decide admission`);
   }
+  // And that unit can only close a door: NOT (an invite AND past its window).
+  const { inviteLiveSql } = require('../src/bongos/invite-expiry.js');
+  assert.match(inviteLiveSql(), /^NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\d+ days'\)$/,
+    'the expiry is a pure narrowing: a row that is not an invite is untouched by it');
 });
 
 test('D1: no hub (platform-identity) source writes access_requests — the hub relays, it never admits', () => {