@bongos/core 1.20.59 → 1.20.60

package/modules/provisioning/routes/look.js

@@ -0,0 +1,204 @@
+// modules/provisioning/routes/look.js — a project's look, night tint and logo
+// (task 1004421, BV2.PS06; ADR 0358; spec D2 + D8).
+//
+//   GET    /provisioning/instances/:id/look   the look as stored: { look, night_tint, look_accent, logo_url }
+//   PATCH  /provisioning/instances/:id/look   { look?, night_tint?, accent? } — a custom look's accent is
+//                                             nudged until it reads in both modes (lookAdjustAccent) and
+//                                             the reply names the colour actually kept
+//   PUT    /provisioning/instances/:id/logo   { image_b64, content_type } — PNG, JPEG or WebP, ≤256 KB
+//   DELETE /provisioning/instances/:id/logo
+//   GET    /provisioning/logos/:file          the stored image, public and content-addressed
+//
+// The four own-scoped routes are the owner's, with the archon override (the settings
+// route's rule, 404 for anyone else so an id confirms nothing). Every write that changes
+// what the hall wears answers through settings-push.js, exactly as PATCH …/settings
+// does: an ACTIVE project restarts to pick it up, any other state takes it at standup.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at
+// the size ratchet — the routes/disconnect.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const look = require('../look');
+const { settingsPush, failPushConflict } = require('../settings-push');
+const { failFrom } = require('../public-refusal');
+
+const log = api.logger('provisioning');
+
+// The JSON cap for the logo upload: 256 KB decoded is ~342 KB of base64. Two layers,
+// like the task-visual upload: this bounds the ENCODED body, screenLogo the bytes.
+const LOGO_BODY_LIMIT = '400kb';
+const LOGO_B64_MAX = 360 * 1024;
+
+// The platform's own public origin — where the hall is told to fetch the logo. The
+// provisioning front door when there is one, else the platform's public origin (the
+// mothershipOrigin rule in routes/provisioning.js). '' when unconfigured.
+function platformOrigin() {
+  try {
+    const d = api.branding().domains || {};
+    return String(d.provisioningOrigin || d.publicOrigin || '').replace(/\/+$/, '');
+  } catch { return ''; }
+}
+
+async function ownInstance(req, res) {
+  const id = parseId(req, res); // sends 400 bad_id + returns null on failure
+  if (!id) return null;
+  const inst = await provisioning.getInstanceById(pool, id);
+  const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
+  if (!inst || (!isOwner && req.builder.rank !== 'archon')) {
+    res.fail('instance_not_found', 404);
+    return null;
+  }
+  return inst;
+}
+
+const actorFor = (inst, builder) => (String(inst.owner_builder_id) === String(builder.id) ? 'api:self' : `api:archon:${builder.id}`);
+const choiceOf = (row) => look.lookChoice(row, provisioning.effectiveSettings(row));
+
+// Write a look change and answer it — the shared tail of PATCH …/look and both logo
+// writes. `stored` is the jsonb patch; `changed` says whether the hall's look moves.
+async function saveAndPush({ req, res, inst, stored, changed, event, extra = {} }) {
+  const id = inst.id;
+  const actor = actorFor(inst, req.builder);
+  const pushOwed = provisioning.settingsPushOwed(inst);
+  // The owner re-kick (the settings route's rule): the same values re-sent over a push
+  // that never got carried, or that ran and failed, queue it again.
+  const policyResent = provisioning.ownsErrorNote(inst, 'settings-apply') || pushOwed;
+  const updated = changed ? await provisioning.updateInstanceSettings(pool, id, stored) : inst;
+  if (changed) {
+    await provisioning.recordEvent(pool, { instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'settings', detail: event, actor }).catch(() => {});
+  }
+  const { push, conflict } = await settingsPush({ pool, provisioning, inst, id, actor, changed, policyChanged: changed,
+    policyResent, pushOwed, log, logTag: `${req.method} ${req.route && req.route.path}` });
+  if (conflict) return failPushConflict(res, conflict);
+  return res.json({ ok: true, look: choiceOf(updated || inst), push, ...extra });
+}
+
+module.exports = function buildLookRouter() {
+  const router = express.Router();
+
+  // GET — rank: any authenticated builder (own resource; archon may read any).
+  router.get('/provisioning/instances/:id/look', api.requireBuilder, async (req, res) => {
+    try {
+      const inst = await ownInstance(req, res);
+      if (!inst) return;
+      res.json({ ok: true, look: choiceOf(inst), options: look.LOOK_SETTINGS_VOCAB, logo_max_bytes: look.LOGO_MAX_BYTES });
+    } catch (err) {
+      log.error('[provisioning] GET /provisioning/instances/:id/look', err);
+      failFrom(res, err, 'look_read_failed');
+    }
+  });
+
+  // PATCH — rank: any authenticated builder (own resource; archon may change any). A
+  // custom look needs an accent, sent now or already stored; the stored one is the
+  // ADJUSTED colour, and `adjusted` in the reply says when it differs from what came in.
+  router.patch('/provisioning/instances/:id/look', api.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      look: { type: 'string', enum: look.LOOK_SETTINGS_VOCAB.look },
+      night_tint: { type: 'string', enum: look.LOOK_SETTINGS_VOCAB.night_tint },
+      accent: { type: 'string', maxLength: 16 },
+    })) return;
+    const body = req.body || {};
+    if (body.look === undefined && body.night_tint === undefined && body.accent === undefined) {
+      return res.fail('bad_look', { status: 400, message: 'The body carries nothing to change — send any of: look, night_tint, accent.' });
+    }
+    try {
+      const inst = await ownInstance(req, res);
+      if (!inst) return;
+      const before = provisioning.effectiveSettings(inst);
+      const beforeAccent = look.lookAccentOf(inst);
+      const stored = {};
+      if (body.look !== undefined) stored.look = body.look;
+      if (body.night_tint !== undefined) stored.night_tint = body.night_tint;
+      let adjusted = null;
+      if (body.accent !== undefined) {
+        const a = look.lookAdjustAccent(body.accent);
+        if (!a) return res.fail('bad_accent', { status: 400, message: 'An accent is a colour written #rrggbb, for example #b48cf2.' });
+        stored.look_accent = a.hex;
+        if (a.adjusted) adjusted = { from: String(body.accent).trim().toLowerCase(), to: a.hex };
+      }
+      const nextLook = stored.look || before.look;
+      if (nextLook === 'custom' && !(stored.look_accent || beforeAccent)) {
+        return res.fail('accent_required', { status: 400, message: 'Your own look needs an accent colour — send accent as #rrggbb.' });
+      }
+      const changed = Object.entries(stored).some(([k, v]) => (k === 'look_accent' ? beforeAccent !== v : before[k] !== v));
+      const event = `look changed: ${Object.entries(stored).map(([k, v]) => `${k}=${v}`).join(', ')}`;
+      return await saveAndPush({ req, res, inst, stored, changed, event, extra: { adjusted } });
+    } catch (err) {
+      log.error('[provisioning] PATCH /provisioning/instances/:id/look', err);
+      failFrom(res, err, 'look_update_failed');
+    }
+  });
+
+  // PUT …/logo — rank: any authenticated builder (own resource; archon may change any).
+  // The image is screened by its bytes, stored, and the hall told its new address.
+  router.put('/provisioning/instances/:id/logo', api.requireBuilder, express.json({ limit: LOGO_BODY_LIMIT }), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      image_b64: { required: true, type: 'string', minLength: 1, maxLength: LOGO_B64_MAX },
+      content_type: { required: true, type: 'string', minLength: 1, maxLength: 100 },
+    })) return;
+    try {
+      const inst = await ownInstance(req, res);
+      if (!inst) return;
+      // Buffer.from drops what it cannot decode, so a mangled body arrives as wrong
+      // bytes, and the sniff below refuses those.
+      const screened = look.screenLogo(Buffer.from(req.body.image_b64, 'base64'), req.body.content_type);
+      if (!screened.ok) return res.fail(`logo_${screened.reason}`, { status: 400, message: screened.message });
+      const origin = platformOrigin();
+      if (!/^https:\/\//.test(origin)) {
+        return res.fail('logo_unavailable', { status: 409, message: 'This platform has no public https address configured, so a hall could not load the logo from it.' });
+      }
+      const buf = Buffer.from(req.body.image_b64, 'base64');
+      await look.upsertLogo(pool, inst.id, screened, buf);
+      const url = `${origin}/api/bongos/provisioning/logos/${look.logoFileName(screened.sha, screened.ext)}`;
+      const changed = look.logoUrlOf(inst) !== url;
+      return await saveAndPush({ req, res, inst, stored: { logo_url: url }, changed, event: 'logo set' });
+    } catch (err) {
+      log.error('[provisioning] PUT /provisioning/instances/:id/logo', err);
+      failFrom(res, err, 'logo_update_failed');
+    }
+  });
+
+  // DELETE …/logo — rank: any authenticated builder (own resource; archon may change any).
+  router.delete('/provisioning/instances/:id/logo', api.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const inst = await ownInstance(req, res);
+      if (!inst) return;
+      await look.deleteLogo(pool, inst.id);
+      const had = !!look.logoUrlOf(inst);
+      // An empty string, not a removed key: the merge-only settings write cannot drop a
+      // key, and logoUrlOf reads '' as no logo, so the companion env goes out empty.
+      return await saveAndPush({ req, res, inst, stored: { logo_url: '' }, changed: had, event: 'logo removed' });
+    } catch (err) {
+      log.error('[provisioning] DELETE /provisioning/instances/:id/logo', err);
+      failFrom(res, err, 'logo_update_failed');
+    }
+  });
+
+  // rank: public — a logo is shown on a public hall, and its address is its own sha256,
+  // so it names no project and cannot be guessed. Served as an image only: nosniff, a
+  // sandboxing CSP, and a cache that never goes stale because a new image is a new name.
+  router.get('/provisioning/logos/:file', async (req, res) => {
+    const m = look.LOGO_FILE.exec(String(req.params.file || ''));
+    if (!m) return res.fail('logo_not_found', 404);
+    try {
+      const logo = await look.readLogo(pool, m[1], m[2]);
+      if (!logo) return res.fail('logo_not_found', 404);
+      res.setHeader('Content-Type', look.LOGO_MIME[m[2]]);
+      res.setHeader('X-Content-Type-Options', 'nosniff');
+      res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox");
+      res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+      res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+      res.end(logo.bytes);
+    } catch (err) {
+      log.error('[provisioning] GET /provisioning/logos/:file', err);
+      failFrom(res, err, 'logo_read_failed');
+    }
+  });
+
+  return router;
+};

package/modules/provisioning/routes/provisioning.js

@@ -63,6 +63,7 @@ const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
 const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
+const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -927,65 +928,10 @@ module.exports = function provisioningRoutes() {
         // needs no restart and no reachable shape — it is the PLATFORM's own row.
         await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
       }
-      // The push (task 1003140). The row is now the platform's truth, but a
-      // RUNNING instance reads its settings from web.env through a pack memoized
-      // for the process lifetime — so an ACTIVE instance on a reachable shape gets
-      // a 'settings-apply' intent (web.env patched in place + RESTART, drained by
-      // the runner; the web tier holds no tokens, ADR 0111 §2). The owner decided
-      // the restart is acceptable and that the surface must SAY so plainly. Every
-      // other state stores the value and says when it takes effect. One receipt
-      // shape on every branch — `restart` = a restart is what applies it,
-      // `reachable` = the platform can perform that restart — and state-only
-      // sentences throughout (the F16 rule): no wall-clock promises.
-      const reachable = provisioning.SETTINGS_APPLY_SHAPES.has(inst.hosting_shape);
-      const receipt = (fields) => ({ reachable, ...fields });
-      let push;
-      if (!changed && !policyResent) {
-        push = receipt({ queued: false, restart: false, message: 'No change — this project already has these settings.' });
-      } else if (!policyChanged && !policyResent) {
-        push = receipt({ queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' });
-      } else if (!provisioning.SETTINGS_APPLY_FROM.has(inst.status)) {
-        const offline = inst.status === 'torn_down' || inst.status === 'tearing_down';
-        push = receipt({ queued: false, restart: false, message: offline
-          ? 'Saved. This project is offline, so there is nothing to apply it to yet — it takes effect if the project is brought back.'
-          : inst.status === 'error'
-            ? 'Saved. This project’s standup stopped partway, so nothing is applying changes right now — it takes effect the next time the project is stood up.'
-            : 'Saved. It takes effect when the project finishes standing up.' });
-      } else if (!reachable) {
-        // A dedicated droplet has no runner write path — refuse the push honestly
-        // rather than queue one that never lands (the runner refuses it too).
-        push = receipt({ queued: false, restart: true, message:
-          'Saved on the platform. This project runs on a machine the platform doesn’t manage, so it can’t be restarted from here — whoever runs that machine has to apply it there.' });
-      } else {
-        let r = null;
-        try { r = await provisioning.enqueueSettingsApply(pool, id, actor); }
-        catch (err) {
-          // The value IS saved — say so; a 500 here would deny a durable write.
-          log.error('[provisioning] PATCH /provisioning/instances/:id/settings enqueue', err);
-          // The remedy this sentence names has to WORK (task 1003524): nothing is
-          // going to carry the saved value, so record the debt. Best-effort — a failed
-          // marker write must never turn a durable settings write into a 500.
-          await provisioning.recordSettingsPushOwed(pool, id, true).catch(() => {});
-          push = receipt({ queued: false, restart: true, message: 'Saved, but the restart could not be queued just now — send it again to apply it.' });
-        }
-        if (r && r.conflict) {
-          // Saved, but the slot is held by work that will not carry this change, so
-          // "send it again once that settles" has to re-queue when they do (task 1003524).
-          await provisioning.recordSettingsPushOwed(pool, id, true).catch(() => {});
-          return res.fail('intent_conflict', { status: 409,
-            message: `The change was saved, but a '${r.intent.action}' run is currently ${r.intent.state} for this project — send it again once that settles to apply it.`,
-            details: { action: r.intent.action, state: r.intent.state, recorded: true } });
-        }
-        if (r) {
-          // A push is now in hand — fresh, or a PENDING one that has not read the row
-          // yet — so either way it carries the current settings. Only written when
-          // there IS a debt, so the hot path stays a single UPDATE.
-          if (pushOwed) await provisioning.recordSettingsPushOwed(pool, id, false).catch(() => {});
-          push = receipt({ queued: r.created, restart: true, message: r.created
-            ? 'Saved. Your project will restart to pick this up — until then it keeps its current setting.'
-            : 'Saved. A restart is already queued for this project and will carry this change.' });
-        }
-      }
+      // The push and its receipt (task 1003140) — settings-push.js, shared with PATCH …/look.
+      const { push, conflict } = await settingsPush({ pool, provisioning, inst, id, actor, changed, policyChanged,
+        policyResent, pushOwed, log, logTag: 'PATCH /provisioning/instances/:id/settings' });
+      if (conflict) return failPushConflict(res, conflict);
       res.json({ ok: true, saved: provisioning.effectiveSettings(updated), planet: provisioning.planetChoice(updated), push });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);

package/modules/provisioning/settings-push.js

@@ -0,0 +1,76 @@
+// modules/provisioning/settings-push.js — after a settings save: queue the push that
+// carries it to a running project, and say what happens next (task 1003140; shared
+// with the look route by task 1004421, ADR 0358).
+//
+// The row is the platform's truth, but a RUNNING instance reads its settings from
+// web.env through a pack memoized for the process lifetime — so an ACTIVE instance on
+// a reachable shape gets a 'settings-apply' intent (web.env patched in place + RESTART,
+// drained by the runner; the web tier holds no tokens, ADR 0111 §2). The owner decided
+// the restart is acceptable and that the surface must SAY so plainly. Every other
+// state stores the value and says when it takes effect. One receipt shape on every
+// branch — `restart` = a restart is what applies it, `reachable` = the platform can
+// perform that restart — and state-only sentences throughout (the F16 rule): no
+// wall-clock promises.
+//
+// Moved out of routes/provisioning.js (at its size ratchet) so PATCH …/settings and
+// PATCH …/look answer from one copy. Returns { push } or { conflict } — the 409 the
+// caller sends when the open slot is held by other work (the change IS saved).
+'use strict';
+
+async function settingsPush({ pool, provisioning, inst, id, actor, changed, policyChanged, policyResent, pushOwed, log, logTag }) {
+  const reachable = provisioning.SETTINGS_APPLY_SHAPES.has(inst.hosting_shape);
+  const receipt = (fields) => ({ reachable, ...fields });
+  if (!changed && !policyResent) {
+    return { push: receipt({ queued: false, restart: false, message: 'No change — this project already has these settings.' }) };
+  }
+  if (!policyChanged && !policyResent) {
+    return { push: receipt({ queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' }) };
+  }
+  if (!provisioning.SETTINGS_APPLY_FROM.has(inst.status)) {
+    const offline = inst.status === 'torn_down' || inst.status === 'tearing_down';
+    return { push: receipt({ queued: false, restart: false, message: offline
+      ? 'Saved. This project is offline, so there is nothing to apply it to yet — it takes effect if the project is brought back.'
+      : inst.status === 'error'
+        ? 'Saved. This project’s standup stopped partway, so nothing is applying changes right now — it takes effect the next time the project is stood up.'
+        : 'Saved. It takes effect when the project finishes standing up.' }) };
+  }
+  if (!reachable) {
+    // A dedicated droplet has no runner write path — refuse the push honestly
+    // rather than queue one that never lands (the runner refuses it too).
+    return { push: receipt({ queued: false, restart: true, message:
+      'Saved on the platform. This project runs on a machine the platform doesn’t manage, so it can’t be restarted from here — whoever runs that machine has to apply it there.' }) };
+  }
+  let r = null;
+  try { r = await provisioning.enqueueSettingsApply(pool, id, actor); }
+  catch (err) {
+    // The value IS saved — say so; a 500 here would deny a durable write.
+    log.error(`[provisioning] ${logTag} enqueue`, err);
+    // The remedy this sentence names has to WORK (task 1003524): nothing is
+    // going to carry the saved value, so record the debt. Best-effort — a failed
+    // marker write must never turn a durable settings write into a 500.
+    await provisioning.recordSettingsPushOwed(pool, id, true).catch(() => {});
+    return { push: receipt({ queued: false, restart: true, message: 'Saved, but the restart could not be queued just now — send it again to apply it.' }) };
+  }
+  if (r && r.conflict) {
+    // Saved, but the slot is held by work that will not carry this change, so
+    // "send it again once that settles" has to re-queue when they do (task 1003524).
+    await provisioning.recordSettingsPushOwed(pool, id, true).catch(() => {});
+    return { conflict: r };
+  }
+  // A push is now in hand — fresh, or a PENDING one that has not read the row
+  // yet — so either way it carries the current settings. Only written when
+  // there IS a debt, so the hot path stays a single UPDATE.
+  if (pushOwed) await provisioning.recordSettingsPushOwed(pool, id, false).catch(() => {});
+  return { push: receipt({ queued: r.created, restart: true, message: r.created
+    ? 'Saved. Your project will restart to pick this up — until then it keeps its current setting.'
+    : 'Saved. A restart is already queued for this project and will carry this change.' }) };
+}
+
+// The 409 a conflicted push answers with — one wording for both routes.
+function failPushConflict(res, r) {
+  return res.fail('intent_conflict', { status: 409,
+    message: `The change was saved, but a '${r.intent.action}' run is currently ${r.intent.state} for this project — send it again once that settles to apply it.`,
+    details: { action: r.intent.action, state: r.intent.state, recorded: true } });
+}
+
+module.exports = { settingsPush, failPushConflict };

package/modules/public-landing/public/assets/cosmos.css

@@ -1603,7 +1603,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the six-step strip as the rail: six hairlines, a 7px dot, one lit step on the
    accent with its halo, the number in the display voice, the name in the label
    face; a step already answered (role=button) stays a way back */
-#view-new .steps{display:grid;grid-template-columns:repeat(8,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
+#view-new .steps{display:grid;grid-template-columns:repeat(9,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
 #view-new .steps li{display:block;position:relative;border-top:1px solid var(--rule);padding:12px 0 0;gap:0;}
 #view-new .steps li::before{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;margin:0;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
 #view-new .steps .snum{display:block;width:auto;height:auto;border:0;border-radius:0;background:none;font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;line-height:1.1;color:var(--ink-faint);margin-bottom:2px;}