@bongos/core 1.20.34 → 1.20.36

package/tests/hall_client_request_shape.mjs

@@ -0,0 +1,103 @@
+// tests/hall_client_request_shape.mjs — every write a hall page sends through the
+// generated client's escape hatch carries its payload UNDER `body` (task 1004458).
+//
+// `api.request(method, path, opts)` reads `opts.body` as the JSON payload and
+// nothing else. Handing it the payload itself fails two quiet ways, and both
+// shipped: `{ decision }` (the mingle buttons) and `{ reason }` / `{ version_id,
+// … }` (the studio's verdicts) have no `body` key, so the request goes out EMPTY;
+// and `{ body: text }` (the Collab reply) sends a bare JSON string, which the
+// server's strict parser refuses as `bad_json`. Neither is visible until someone
+// presses the button on the live site.
+//
+// So this RUNS the real client against a recording fetch to pin what `body`
+// means, then scans every hall-side call for an options object whose keys are
+// not options.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const OPTION_KEYS = new Set(['body', 'query', 'headers', 'hasBody', 'cache']);
+
+function client() {
+  const sent = [];
+  const win = {};
+  const src = fs.readFileSync(path.join(ROOT, 'clients', 'bongos-client', 'bongos-client.global.js'), 'utf8');
+  new Function('window', 'globalThis', 'self', src)(win, win, win);
+  const fetch = async (url, init) => { sent.push({ url, init }); return { ok: true, status: 200, text: async () => '{}' }; };
+  return { sent, api: win.BongosClient.createClient({ fetch, throwOnError: false }) };
+}
+
+test('the escape hatch sends opts.body as the payload, and nothing else', async () => {
+  const { sent, api } = client();
+  await api.request('POST', '/x', { body: { body: 'hello' } });
+  assert.equal(sent[0].init.body, '{"body":"hello"}', 'a nested object arrives as an object');
+  await api.request('POST', '/x', { decision: 'accepted' });
+  assert.equal(sent[1].init.body, undefined, 'a payload passed as options is DROPPED — this is the trap');
+});
+
+// Every `api.request('POST'|'PATCH'|'PUT'|'DELETE', …)` in a hall-side file.
+function hallFiles() {
+  const out = [];
+  for (const mod of fs.readdirSync(path.join(ROOT, 'modules'))) {
+    const dir = path.join(ROOT, 'modules', mod, 'public');
+    if (!fs.existsSync(dir)) continue;
+    for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) out.push(path.join(dir, f));
+  }
+  return out;
+}
+
+// The top-level arguments of the call starting at `open` (the index of its "(").
+function argsAt(src, open) {
+  const args = [];
+  let depth = 0; let cur = ''; let quote = null;
+  for (let i = open + 1; i < src.length; i++) {
+    const c = src[i];
+    if (quote) { cur += c; if (c === '\\') { cur += src[++i]; } else if (c === quote) quote = null; continue; }
+    if (c === '"' || c === "'" || c === '`') { quote = c; cur += c; continue; }
+    if ('({['.includes(c)) depth++;
+    if (')}]'.includes(c)) { if (depth === 0) { args.push(cur.trim()); return args; } depth--; }
+    if (c === ',' && depth === 0) { args.push(cur.trim()); cur = ''; continue; }
+    cur += c;
+  }
+  return args;
+}
+
+// The keys of an object literal's top level: `{ a, b: 1, ...c }` → ['a', 'b', '...'].
+function topKeys(obj) {
+  const inner = obj.trim().replace(/^\{/, '').replace(/\}$/, '');
+  return argsAt(`(${inner})`, 0).filter(Boolean).map((part) => {
+    if (part.startsWith('...')) return '...';
+    const m = /^([A-Za-z_$][\w$]*)\s*(?::|$)/.exec(part);
+    return m ? m[1] : part;
+  });
+}
+
+test('no hall page hands the client a payload where it expects options', () => {
+  const bad = [];
+  let seen = 0;
+  for (const file of hallFiles()) {
+    const src = fs.readFileSync(file, 'utf8');
+    const re = /\bapi\.request\(\s*'(POST|PATCH|PUT|DELETE)'/g;
+    let m;
+    while ((m = re.exec(src))) {
+      seen++;
+      const args = argsAt(src, src.indexOf('(', m.index));
+      const where = `${path.relative(ROOT, file)}:${src.slice(0, m.index).split('\n').length}`;
+      const opts = args[2];
+      if (!opts) continue;
+      if (!opts.startsWith('{')) { bad.push(`${where} passes \`${opts}\` — wrap it as { body: … }`); continue; }
+      const unknown = topKeys(opts).filter((k) => !OPTION_KEYS.has(k));
+      if (unknown.length) bad.push(`${where} passes ${unknown.join(', ')} as options — they are dropped; nest them under body`);
+    }
+  }
+  assert.ok(seen > 10, `the scan found the calls it is guarding (${seen})`);
+  assert.deepEqual(bad, [], bad.join('\n'));
+});
+
+test('the Collab reply nests its `body` field inside the payload', () => {
+  const js = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'collab.js'), 'utf8');
+  assert.match(js, /\/replies`, \{ body: \{ body: v\.body \} \}\)/, 'a bare string is refused by the server as bad_json');
+});

package/tests/hall_studio_home.mjs

@@ -130,7 +130,13 @@ function bootStudio({ answers = {}, signedIn = true } = {}) {
     execCommand() {},
   };
   const client = {
-    request: async (method, url, body) => {
+    // The real client takes an OPTIONS object and sends `opts.body` as the JSON
+    // payload (task 1004458 moved every hall write onto that shape). Record the
+    // payload, not the options, so assertions read what the server would receive.
+    request: async (method, url, opts) => {
+      // Strictly `opts.body`, like the real client: a bare payload passed as the
+      // third argument arrives as undefined, which is the dropped-payload bug 1004458 fixed.
+      const body = opts ? opts.body : undefined;
       requests.push({ method, url, body });
       const key = `${method} ${url.replace(/^\/api\/bongos/, '')}`;
       if (key === 'GET /me') return signedIn ? ok({ builder: { id: ME, display_name: 'Artist A', rank: 'metic' } }) : { ok: false, status: 401, data: {} };

package/tests/hall_studio_world.mjs

@@ -239,7 +239,11 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
     return els.get(id);
   };
   const calls = [];
-  const request = async (method, url, body) => {
+  // The REAL client's shape: request(method, path, { body }). This fake once took
+  // the payload as the third argument, which is exactly the mistake the studio
+  // made — so every verdict here was green while each one sent nothing (task 1004458).
+  const request = async (method, url, opts) => {
+    const body = opts && opts.body;
     calls.push({ method, url, body });
     if (method !== 'GET') {
       const custom = onWrite && onWrite({ method, url, body });

package/tests/help_requests.mjs

@@ -276,8 +276,10 @@ test('the settle refusal no longer lets you enumerate ids', () => {
   const from = routes.indexOf("'PATCH /help-requests/:id'");
   const patch = routes.slice(from, routes.indexOf('help_request_update_failed', from));
   assert.ok(!/getHelpRequest/.test(patch), 'no existence lookup in the refusal path');
+  // One refusal per WRITE: the settle's, and since task 1004458 the reopen's.
+  // Each covers absent / not yours / wrong state in one sentence.
   const reasons = patch.match(/reason: '[^']+'/g) || [];
-  assert.equal(reasons.length, 1, `exactly one refusal reason, got ${reasons}`);
+  assert.equal(reasons.length, 2, `exactly one refusal reason per write, got ${reasons}`);
 });
 
 test('both reads are capped', () => {
@@ -504,3 +506,54 @@ test('a reply to an ask that never existed is a named 404, not an FK 500', () =>
   const line = routes.slice(routes.lastIndexOf('router.post', idx), idx);
   assert.match(line, /api\.requireBuilder/, 'signed in, like every other route here');
 });
+
+// ---- reopen (task 1004458) ------------------------------------------------
+// RUN against a recording pool, like the settle tests above: the rule is the
+// WHERE, and a source grep would agree with a WHERE that had lost a clause.
+async function reopenSql(args) {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 1 }] }; } };
+  const row = await help.reopenHelpRequest(args, { pool });
+  return { ...calls[0], row };
+}
+
+test('only the ASKER reopens, and only a settled ask', async () => {
+  const c = await reopenSql({ id: 5, builderId: 7 });
+  const where = c.sql.slice(c.sql.indexOf('WHERE'), c.sql.indexOf('RETURNING'));
+  assert.match(where, /requested_by = \$2/, 'the asker, bound, in the WHERE');
+  assert.ok(!/needs_builder_id|needs_craft/.test(where), 'the addressee has no branch here');
+  assert.ok(!/\bOR\b/.test(where), `a pure conjunction, so no clause can be bypassed: ${where}`);
+  assert.match(where, /status <> 'open'/, 'an open ask is not reopened again');
+  assert.deepEqual(c.params, [5, 7]);
+});
+
+test('reopening clears who settled it and marks it reopened', async () => {
+  const c = await reopenSql({ id: 5, builderId: 7 });
+  assert.match(c.sql, /status = 'open'/);
+  assert.match(c.sql, /settled_by = NULL/, 'it no longer reads as closed by someone');
+  assert.match(c.sql, /settled_reason = NULL/, 'nor as closed by the ledger');
+  assert.match(c.sql, /reopened_at = now\(\)/, 'the fact the ledger settle reads to leave it alone');
+});
+
+test('a REOPENED ask is never closed again by its task having shipped', async () => {
+  const calls = [];
+  const pool = { query: async (sql) => { calls.push(sql); return { rows: [] }; } };
+  await help.settleFromLedger({ pool });
+  assert.match(calls[0], /h\.reopened_at IS NULL/, 'the asker said the shipped task did not answer it');
+});
+
+test('PATCH routes status open to the asker-only reopen, never to the settle', () => {
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'PATCH /help-requests/:id'");
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.match(body, /enum: \['answered', 'withdrawn', 'open'\]/);
+  assert.match(body, /req\.body\.status === 'open'[\s\S]*?reopenHelpRequest\(\{ id, builderId: req\.builder\.id \}\)/,
+    'the reopen takes the caller from the session, and no crafts at all');
+  assert.ok(body.indexOf('reopenHelpRequest') < body.indexOf('setHelpRequestStatus'), 'and returns before the settle runs');
+});
+
+test('the reopen migration adds the column and alters no core table', () => {
+  const sql = read('modules', 'lifecycle', 'migrations', 'lifecycle_016_help_request_reopen.sql');
+  assert.match(sql, /ALTER TABLE lifecycle_help_requests\s+ADD COLUMN IF NOT EXISTS reopened_at timestamptz/);
+  assert.ok(!/ALTER TABLE (?!lifecycle_)/.test(sql));
+});

package/tests/projects_hub_app_step.mjs

@@ -283,6 +283,48 @@ test('Next needs a complete answer: a mode, then a start command for a native ru
   assert.equal(w.validateRender(), true, 'docker needs no commands');
 });
 
+// task 1004457 — found live: the ask stayed on screen after the command was typed.
+test('typing a start command clears the "how your app starts" ask at once', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  assert.equal(w.validateRender(), false);
+  assert.match(w.$('h-render').className, /err/);
+  w.$('f-renderStart').value = '   ';
+  w.$('renderNew').fire('input', { target: w.$('f-renderStart') });
+  assert.match(w.$('h-render').textContent, /how your app starts/, 'blank is still no answer');
+  w.$('f-renderStart').value = 'npm start';
+  w.$('renderNew').fire('input', { target: w.$('f-renderStart') });
+  assert.doesNotMatch(w.$('h-render').className, /err/);
+  assert.doesNotMatch(w.$('h-render').textContent, /how your app starts/);
+});
+
+test('the empty command boxes read as examples, not as filled-in values', () => {
+  assert.match(HUB, /id="f-renderBuild"[^>]*placeholder="for example: npm ci"/);
+  assert.match(HUB, /id="f-renderStart"[^>]*placeholder="for example: npm start"/);
+});
+
+// task 1004457 — owner call 2026-09-30: offer Render's Free web plan, never preselected.
+test('Free is on the plan list with its catch spelled out, and Starter stays the default', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
+  w.typeKey(KEY);
+  await w.check();
+  await w.pickWorkspace(0);
+  w.pickService({ value: 'new' });
+  const opts = w.$('f-renderPlan').children;
+  assert.deepEqual(opts.map((o) => o.value), ['free', 'starter', 'standard', 'pro']);
+  assert.match(opts[0].textContent, /^Free — \$0, but it sleeps when idle/);
+  assert.equal(opts.find((o) => o.selected).value, 'starter', 'Free is never the preselected plan');
+  w.state.renderPlan = 'free'; w.state.renderStart = 'npm start';
+  assert.equal(w.renderRequestBody().web_plan, 'free');
+  const dbOpts = w.$('f-renderDbPlan').children.map((o) => o.value);
+  assert.equal(dbOpts.includes('free'), false, 'the database stays paid-only');
+  const r = load({ draft: { appPlatform: 'render', renderOwnerName: 'Mine', renderMode: 'greenfield', renderRuntime: 'node', renderPlan: 'free' } });
+  assert.equal(r.appRow(), 'Render, workspace Mine — a new app (Node.js, Free, $0, but it sleeps when idle and takes about a minute to wake up), no database. Render bills you directly.');
+});
+
 test('what Create sends: greenfield carries the build and the plans, a link only the service', async () => {
   const w = load({ answers: ANSWERS, draft: { appPlatform: 'render' } });
   w.typeKey(KEY);

package/tests/provisioning_render_route.mjs

@@ -116,6 +116,13 @@ await ta('a missing project is 404', async () => {
   assert.equal((await post(PATH, GREEN)).status, 404);
 });
 
+await ta('Render\'s Free web plan is accepted and recorded (task 1004457)', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, web_plan: 'free' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls[0].appHost.webPlan, 'free');
+});
+
 console.log('\nthe shape is checked first:');
 for (const [name, body, re] of [
   ['a key that is not a Render key', { ...GREEN, key: 'ghp_notrender' }, /Render API key/],