@bongos/core 1.21.113 → 1.21.115

package/tests/hub_connections_page.mjs

@@ -0,0 +1,507 @@
+// tests/hub_connections_page.mjs — the hub's /connections page (task 1004278; the
+// owner's calls of 2026-09-25, ADR 0337 D5.4: the hub is the primary home for
+// connections).
+//
+// The page renders the platform-identity connection routes (ADR 0202, 0207) and
+// adds nothing to them: no scoring, no data, no new route. What this file pins:
+//   • the markup: the hub's bar with Connections as the one current place, the
+//     signed-out door, the not-active and unreadable lines, the four lists in order,
+//     and the handle field with the route's own limits
+//   • the privacy rules the hall's panel keeps (profile-connections.js): a sent ask
+//     claims "Request sent." and no more, `seen_at` never reaches the screen, every
+//     count is the length of the list beside it, and the server's suggestions and
+//     reasons are drawn as they come
+//   • the page RUN in a vm: signed out it reads nothing; signed in it reads the three
+//     lists once; a 403 is the viewer's own inactive profile, a failed list read is
+//     an alert and never an empty page, a failed suggestions read only drops that
+//     panel; Accept, Decline, Remove and Withdraw each make their one call and the
+//     page re-reads; asking by handle strips an @, sends the note, and says each of
+//     the route's refusals in plain words
+//   • the Connections item on every page that wears the hub's bar (apex-only where the
+//     page also serves a child)
+//   • the route: served on the hub's apex; never on a child, the builders host or the
+//     status host
+//   • the kit: the stub's held graph answers as the routes do (no id on a sent ask, a
+//     silent decline, one 404), and the states and probes files exist
+//
+// DB-free. Run:  node --test tests/hub_connections_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8').replace(/\r\n/g, '\n');
+const PAGE = read('connections.html');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+// the code alone: the comments name what they rule out
+const CODE = SCRIPT.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*?\*\//g, '');
+const MAIN = PAGE.split('<main class="acct" id="conn">')[1].split('</main>')[0];
+const ROUTES = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'routes', 'connections.js'), 'utf8');
+const DOMAIN = fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'connections.js'), 'utf8');
+
+// ── 1. the markup ────────────────────────────────────────────────────────────
+
+test('the page wears the hub’s bar, with Connections as the one current place; dark only, no page :root, not indexed', () => {
+  assert.match(PAGE, /<html lang="en" data-mode="dark">/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/);
+  assert.match(PAGE, /<title>\{\{productName\}\} — Connections<\/title>/);
+  assert.match(PAGE, /<link rel="stylesheet" href="\/assets\/cosmos\.css">/, 'the rows, field and buttons are cosmos.css’s own rules');
+  assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>/, 'the bar runs on the shared asset');
+  assert.match(PAGE, /<script src="\/assets\/invite-badge\.js"><\/script>/, 'the waiting count rides every page that wears the bar');
+  assert.doesNotMatch(STYLE, /:root/, 'the pack’s injected theme owns the tokens');
+  assert.doesNotMatch(STYLE, /#[0-9a-fA-F]{3,8}\b/, 'every colour is a token or a mix of one');
+  assert.deepEqual(PAGE.match(/<a [^>]*aria-current="page"[^>]*>[^<]+/g), ['<a class="bandT" href="/connections" aria-current="page">Connections']);
+  assert.match(PAGE, /<a class="skip vh" href="#conn">Skip to content<\/a>/);
+  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/connections&amp;repos=1">Sign in<\/a>/);
+  assert.equal((PAGE.match(/<!--apex-only:start-->/g) || []).length, 1, 'hub-only: the footer’s platform sentence is the one apex-only region');
+  assert.ok(PAGE.indexOf('<!--apex-only:start-->') > PAGE.indexOf('<footer class="foot">'));
+});
+
+test('the bar is /invitations’ bar but for the sign-in return and the current place', () => {
+  const bar = (html) => html.slice(html.indexOf('<header class="shell bar">'), html.indexOf('<main '))
+    .replace(/return=\/\w+&amp;/g, 'return=X&amp;').replace(/ aria-current="page"/g, '');
+  assert.equal(bar(PAGE), bar(read('invitations.html')));
+});
+
+test('the body: a door, a loading line, the inactive and unreadable lines, then the four lists in order', () => {
+  assert.match(MAIN, /<h1>connections<\/h1>/);
+  assert.match(MAIN, /it grants no rank and no access to anything/, 'a connection is never authority (ADR 0016, ADR 0202)');
+  assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/connections&amp;repos=1"/, 'signed out, the door returns here');
+  assert.match(MAIN, /<p class="loading" id="loading">/);
+  assert.match(MAIN, /<p class="mineEmpty" id="inactive" hidden>/);
+  assert.match(MAIN, /<p class="projMsg err" id="readFailed" role="alert" hidden>/);
+  assert.match(MAIN, /<p class="projMsg" id="connMsg" role="status" aria-live="polite" hidden><\/p>/);
+  assert.match(MAIN, /<div class="mineExtra" id="connBody" hidden>/, 'nothing but the door shows until who is signed in is known');
+  const order = ['incomingList', 'connList', 'suggestList', 'outgoingList'].map((id) => MAIN.indexOf(`<ul class="mineRows" id="${id}"></ul>`));
+  assert.ok(order.every((i) => i > 0), 'each list is real markup the script only fills');
+  assert.deepEqual([...order].sort((a, b) => a - b), order);
+  assert.match(MAIN, /<section id="connAsks" aria-labelledby="connAsksH" hidden>/, 'the asking section shows only when someone asks');
+  assert.match(MAIN, /<section id="connSuggest" aria-labelledby="connSuggestH" hidden>/, 'the suggestions panel shows only when the server suggests');
+  assert.match(MAIN, /<h2 id="connSuggestH">Builders you may know<\/h2>/);
+  assert.match(MAIN, /<button id="askBtn" type="button" class="btn small">Connect<\/button>/);
+});
+
+test('the handle and note limits are the route’s own (boundary-forced copies)', () => {
+  const routeHandle = ROUTES.match(/handle: \{ required: true, type: 'string', minLength: 1, maxLength: (\d+) \}/);
+  const domainNote = DOMAIN.match(/const NOTE_MAX_CHARS = (\d+);/);
+  assert.ok(routeHandle && domainNote);
+  assert.match(SCRIPT, new RegExp(`var HANDLE_MAX = ${routeHandle[1]};`));
+  assert.match(SCRIPT, new RegExp(`var NOTE_MAX = ${domainNote[1]};`));
+  assert.match(MAIN, new RegExp(`<textarea id="askNote" class="mineJoinNote" rows="2" maxlength="${domainNote[1]}"`));
+});
+
+test('the script builds no markup from strings, calls only the connection routes, and never reads seen_at', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
+  assert.doesNotMatch(CODE, /seen_at/, 'when a request was read never reaches the screen (ADR 0202 D2)');
+  const paths = [...CODE.matchAll(/(?:read\(|API \+ |act\('(?:POST|DELETE)', )'(\/[^']*)'/g)].map((m) => m[1]);
+  assert.equal(paths.length, 8, 'three reads, accept, decline, remove, withdraw and the ask');
+  for (const p of paths) assert.match(p, /^\/connections(\/|$)/, `${p} is a connections route`);
+  assert.doesNotMatch(CODE, /\.count\b|_count\b/, 'every count is the length of the list beside it (ADR 0171 D4)');
+  assert.doesNotMatch(CODE, /\.sort\(|\.score\b/, 'the server ranks suggestions; the page adds no order of its own');
+});
+
+test('every refusal the page has words for is one the route can send', () => {
+  const block = SCRIPT.match(/var CONNECT_REFUSED = \{([\s\S]*?)\};/)[1];
+  const codes = [...block.matchAll(/^\s*(\w+):/gm)].map((m) => m[1]);
+  assert.deepEqual(codes.sort(), ['cannot_connect_to_self', 'connection_already_open', 'connection_target_not_found', 'profile_provisional']);
+  for (const c of codes) assert.match(ROUTES, new RegExp(`'${c}'`), `routes/connections.js sends ${c}`);
+});
+
+// ── 2. the page, run ─────────────────────────────────────────────────────────
+
+function el(tag) {
+  const n = { tag, children: [], _text: '', className: '', hidden: false, disabled: false, value: '', attrs: {}, _on: {}, parent: null };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  return n;
+}
+const settle = async () => { for (let i = 0; i < 60; i++) await Promise.resolve(); };
+const kids = (n) => n.children;
+const find = (n, cls) => {
+  for (const c of n.children) {
+    if (String(c.className).split(' ').includes(cls)) return c;
+    const d = find(c, cls);
+    if (d) return d;
+  }
+  return null;
+};
+const all = (n, cls, out = []) => {
+  for (const c of n.children) { if (String(c.className).split(' ').includes(cls)) out.push(c); all(c, cls, out); }
+  return out;
+};
+
+const GRAPH = () => ({
+  '/connections': { status: 200, body: { connections: [
+    { id: '41', connected_at: '2026-09-30T10:00:00Z', handle: 'mira', display_name: 'Mira Okafor', avatar_url: 'https://avatars.example/u/1' },
+    { id: '42', connected_at: null, handle: 'juno', display_name: null, avatar_url: 'javascript:alert(1)' },
+  ], count: 99 } },
+  '/connections/requests': { status: 200, body: {
+    incoming: [{ id: '51', note: 'We met on <b>Tidepool</b>.', created_at: '2026-10-10T00:00:00Z', seen_at: '2026-10-11T08:00:00Z', handle: 'priya', display_name: 'Priya Nair', avatar_url: null }],
+    outgoing: [{ id: '61', note: null, created_at: '2026-10-07T00:00:00Z', handle: 'leo-b', display_name: 'Leo Brandt', avatar_url: null }],
+    incoming_count: 7, outgoing_count: 7,
+  } },
+  '/connections/suggestions': { status: 200, body: { suggestions: [
+    { handle: 'sana', display_name: 'Sana Iqbal', avatar_url: null, reason: '2 connections in common' },
+    { handle: 'owen-c', display_name: 'Owen Clarke', avatar_url: null, reason: 'You both build on Tidepool' },
+  ], count: 2 } },
+});
+
+async function boot({ me = { builder: { github_login: 'builder' } }, reads = GRAPH(), writes = [] } = {}) {
+  const ids = new Map();
+  for (const id of [...PAGE.matchAll(/ id="([^"]+)"/g)].map((m) => m[1])) {
+    const n = el('x');
+    n.id = id;
+    const tag = PAGE.match(new RegExp(`<(\\w+)[^>]* id="${id}"[^>]*>`));
+    n.hidden = !!(tag && / hidden[ >]/.test(tag[0]));
+    ids.set(id, n);
+  }
+  const requests = [];
+  const queued = writes.slice();
+  const fetch = (url, init = {}) => {
+    const method = init.method || 'GET';
+    requests.push({ url, method, body: init.body ? JSON.parse(init.body) : undefined, credentials: init.credentials });
+    const a = method === 'GET' ? reads[url.replace(/^\/api\/bongos/, '')] : queued.shift();
+    if (!a || a.reject) return Promise.reject(new Error('offline'));
+    return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => (a.body === undefined ? Promise.reject(new SyntaxError('no body')) : Promise.resolve(a.body)) });
+  };
+  const document = { getElementById: (id) => ids.get(id) || null, createElement: el };
+  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) } };
+  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, Date, isNaN, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(SCRIPT, sandbox, { filename: 'connections.html' });
+  await settle();
+  const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
+  const key = async (n, k) => { const e = { key: k, preventDefault() { e.prevented = true; } }; for (const f of n._on.keydown || []) f(e); await settle(); return e; };
+  const gets = () => requests.filter((r) => r.method === 'GET').map((r) => r.url);
+  return { ids, requests, gets, click, key, $: (id) => ids.get(id) };
+}
+const button = (row, label) => all(row, 'btn').find((b) => b.textContent === label);
+
+test('signed out: the door, nothing read', async () => {
+  const ui = await boot({ me: null });
+  assert.equal(ui.$('door').hidden, false);
+  assert.equal(ui.$('connBody').hidden, true);
+  assert.equal(ui.$('loading').hidden, true);
+  assert.deepEqual(ui.requests, [], 'GET /me is the bar’s; this page asks nothing of a stranger');
+});
+
+test('signed in: the three lists read once, each painted from the server’s answer and nothing else', async () => {
+  const ui = await boot();
+  assert.deepEqual(ui.gets(), ['/api/bongos/connections', '/api/bongos/connections/requests', '/api/bongos/connections/suggestions']);
+  assert.ok(ui.requests.every((r) => r.credentials === 'same-origin'));
+  assert.equal(ui.$('connBody').hidden, false);
+  assert.equal(ui.$('door').hidden, true);
+  assert.equal(ui.$('loading').hidden, true);
+  assert.equal(ui.$('connMsg').hidden, true, 'the status line says nothing yet, so it takes no room');
+
+  // asking to connect: the note as typed (text, never markup), Accept and Decline, no "read" time
+  assert.equal(ui.$('connAsks').hidden, false);
+  const ask = kids(ui.$('incomingList'))[0];
+  assert.equal(find(ask, 'mineRow__name').textContent, 'Priya Nair');
+  assert.equal(find(ask, 'mineRow__host').textContent, '@priya');
+  assert.equal(find(ask, 'connNote').textContent, 'We met on <b>Tidepool</b>.', 'textContent: the asker’s words are never markup');
+  assert.deepEqual(all(ask, 'btn').map((b) => b.textContent), ['Accept', 'Decline']);
+  const everything = ['incomingList', 'connList', 'suggestList', 'outgoingList'].map((id) => ui.$(id).textContent).join(' ');
+  assert.doesNotMatch(everything, /Oct 11|2026-10-11|08:00/, 'seen_at never reaches the screen');
+
+  // the connections: the count is the list’s length, never the server’s count field
+  assert.equal(ui.$('connCount').textContent, '2 connections.');
+  const [mira, juno] = kids(ui.$('connList'));
+  assert.equal(find(mira, 'connAv').src, 'https://avatars.example/u/1');
+  assert.match(find(mira, 'mineRow__hint').textContent, /^Connected /);
+  assert.equal(find(juno, 'mineRow__name').textContent, 'juno', 'no display name: the handle stands in');
+  assert.equal(find(juno, 'connAv').tag, 'span', 'an avatar that is not http(s) is never loaded');
+  assert.equal(find(juno, 'mineRow__hint'), null, 'no date, no "Connected" line');
+  assert.deepEqual(all(ui.$('connList'), 'btn').map((b) => b.textContent), ['Remove', 'Remove']);
+  assert.ok(kids(ui.$('connList')).every((r) => /\bconnOne\b/.test(r.className)), 'one button: kept beside the name on a phone');
+
+  // builders you may know: the server’s order and its reasons, verbatim
+  assert.equal(ui.$('connSuggest').hidden, false);
+  assert.deepEqual(kids(ui.$('suggestList')).map((r) => find(r, 'mineRow__hint').textContent), ['2 connections in common', 'You both build on Tidepool']);
+  assert.deepEqual(kids(ui.$('suggestList')).map((r) => find(r, 'mineRow__host').textContent), ['@sana', '@owen-c']);
+
+  // what you sent: "Request sent" and Withdraw
+  assert.equal(ui.$('sentH').hidden, false);
+  const sent = kids(ui.$('outgoingList'))[0];
+  assert.equal(find(sent, 'mineRow__hint').textContent, 'Request sent');
+  assert.deepEqual(all(sent, 'btn').map((b) => b.textContent), ['Withdraw']);
+});
+
+test('nothing yet: no asking section, no sent heading, and the count line says how to start', async () => {
+  const reads = GRAPH();
+  reads['/connections'].body = { connections: [], count: 0 };
+  reads['/connections/requests'].body = { incoming: [], outgoing: [] };
+  reads['/connections/suggestions'].body = { suggestions: [] };
+  const ui = await boot({ reads });
+  assert.equal(ui.$('connAsks').hidden, true);
+  assert.equal(ui.$('sentH').hidden, true);
+  assert.equal(ui.$('connSuggest').hidden, true, 'no suggestions, no empty shell');
+  assert.equal(ui.$('connCount').textContent, 'No connections yet. Accept a request above, or ask a builder below.');
+});
+
+test('a 403 is the viewer’s own inactive profile; a failed list read is an alert, never an empty page', async () => {
+  const inactive = GRAPH();
+  inactive['/connections'] = { status: 403, body: { error: { code: 'profile_provisional' } } };
+  inactive['/connections/requests'] = { status: 403, body: { error: { code: 'profile_provisional' } } };
+  let ui = await boot({ reads: inactive });
+  assert.equal(ui.$('inactive').hidden, false);
+  assert.equal(ui.$('connBody').hidden, true);
+
+  const broken = GRAPH();
+  broken['/connections/requests'] = { status: 500, body: {} };
+  ui = await boot({ reads: broken });
+  assert.equal(ui.$('readFailed').hidden, false);
+  assert.equal(ui.$('connBody').hidden, true, '"no connections" would be a claim the page cannot make');
+
+  const expired = GRAPH();
+  expired['/connections'] = { status: 401, body: {} };
+  ui = await boot({ reads: expired });
+  assert.equal(ui.$('door').hidden, false, 'a session that ended while the page loaded gets the door back');
+});
+
+test('a failed suggestions read drops only that panel', async () => {
+  const reads = GRAPH();
+  reads['/connections/suggestions'] = { status: 500, body: {} };
+  const ui = await boot({ reads });
+  assert.equal(ui.$('connBody').hidden, false);
+  assert.equal(ui.$('connSuggest').hidden, true);
+  assert.equal(kids(ui.$('connList')).length, 2);
+});
+
+test('Accept, Decline, Remove and Withdraw: one call each, then the page re-reads', async () => {
+  const cases = [
+    ['incomingList', 'Accept', 'POST', '/api/bongos/connections/51/accept', { status: 200, body: { status: 'accepted' } }, 'Connected.'],
+    ['incomingList', 'Decline', 'POST', '/api/bongos/connections/51/decline', { status: 204 }, 'Declined. They are not told.'],
+    ['connList', 'Remove', 'DELETE', '/api/bongos/connections/41', { status: 200, body: { outcome: 'removed' } }, 'Connection removed.'],
+    ['outgoingList', 'Withdraw', 'DELETE', '/api/bongos/connections/61', { status: 200, body: { outcome: 'cancelled' } }, 'Request withdrawn.'],
+  ];
+  for (const [list, label, method, url, answer, said] of cases) {
+    const ui = await boot({ writes: [answer] });
+    await ui.click(button(kids(ui.$(list))[0], label));
+    const write = ui.requests.find((r) => r.method !== 'GET');
+    assert.deepEqual([write.method, write.url, write.body], [method, url, undefined], `${label} sends no body`);
+    assert.equal(ui.$('connMsg').textContent, said);
+    assert.equal(ui.$('connMsg').className, 'projMsg ok');
+    assert.equal(ui.$('connMsg').hidden, false);
+    assert.equal(ui.gets().length, 6, `${label}: the page re-reads the three lists rather than patching rows`);
+  }
+});
+
+test('a row the server no longer has is one 404, said once; a dropped network keeps the buttons usable', async () => {
+  let ui = await boot({ writes: [{ status: 404, body: { error: { code: 'connection_request_not_found' } } }] });
+  await ui.click(button(kids(ui.$('incomingList'))[0], 'Accept'));
+  assert.equal(ui.$('connMsg').textContent, 'That request is no longer there.');
+  assert.equal(ui.$('connMsg').className, 'projMsg err');
+
+  ui = await boot({ writes: [{ reject: true }] });
+  const row = kids(ui.$('connList'))[0];
+  const remove = button(row, 'Remove');
+  await ui.click(remove);
+  assert.equal(remove.disabled, false);
+  assert.match(ui.$('connMsg').textContent, /did not go through/);
+});
+
+test('Connect on a builder you may know: "Request sent." is the whole claim, then the page re-reads', async () => {
+  const ui = await boot({ writes: [{ status: 201, body: { status: 'pending' } }] });
+  await ui.click(button(kids(ui.$('suggestList'))[0], 'Connect'));
+  const write = ui.requests.find((r) => r.method === 'POST');
+  assert.deepEqual([write.url, write.body], ['/api/bongos/connections', { handle: 'sana' }]);
+  assert.equal(ui.$('connMsg').textContent, 'Request sent.');
+  assert.equal(ui.gets().length, 6);
+});
+
+test('asking by handle: an @ is dropped, the note rides, the field clears, and each refusal is said plainly', async () => {
+  let ui = await boot({ writes: [{ status: 201, body: { status: 'pending' } }] });
+  ui.$('askHandle').value = '  @nadia ';
+  ui.$('askNote').value = ' We met on Tidepool. ';
+  await ui.click(ui.$('askBtn'));
+  const sent = ui.requests.find((r) => r.method === 'POST');
+  assert.deepEqual(sent.body, { handle: 'nadia', note: 'We met on Tidepool.' });
+  assert.equal(ui.$('askStatus').textContent, 'Request sent.');
+  assert.equal(ui.$('askStatus').className, 'projMsg ok');
+  assert.equal(ui.$('askHandle').value, '');
+  assert.equal(ui.$('askNote').value, '');
+  assert.equal(ui.gets().length, 6);
+
+  const refusals = [
+    [409, 'connection_already_open', 'There is already a request or a connection between you.'],
+    [404, 'connection_target_not_found', 'No builder with that handle can be asked right now.'],
+    [400, 'cannot_connect_to_self', 'That is your own handle.'],
+    [403, 'profile_provisional', 'Your profile is not active yet, so you cannot ask anyone to connect.'],
+    [500, 'connection_request_failed', 'That request could not be sent. Check the handle and try again.'],
+  ];
+  for (const [status, code, said] of refusals) {
+    ui = await boot({ writes: [{ status, body: { error: { code } } }] });
+    ui.$('askHandle').value = 'nadia';
+    await ui.click(ui.$('askBtn'));
+    assert.equal(ui.$('askStatus').textContent, said, code);
+    assert.equal(ui.$('askStatus').className, 'projMsg err');
+    assert.equal(ui.$('askHandle').value, 'nadia', 'a refused ask keeps what was typed');
+    assert.equal(ui.$('askBtn').disabled, false);
+  }
+});
+
+test('asking by handle: nothing is sent for an empty or over-long handle; Enter asks too', async () => {
+  let ui = await boot();
+  await ui.click(ui.$('askBtn'));
+  assert.equal(ui.$('askStatus').textContent, 'Type a builder’s handle first.');
+  ui.$('askHandle').value = 'x'.repeat(40);
+  await ui.click(ui.$('askBtn'));
+  assert.equal(ui.$('askStatus').textContent, 'A handle is at most 39 characters.');
+  assert.equal(ui.requests.filter((r) => r.method === 'POST').length, 0);
+
+  ui = await boot({ writes: [{ status: 201, body: { status: 'pending' } }] });
+  ui.$('askHandle').value = 'nadia';
+  const e = await ui.key(ui.$('askHandle'), 'Enter');
+  assert.ok(e.prevented);
+  assert.deepEqual(ui.requests.find((r) => r.method === 'POST').body, { handle: 'nadia' }, 'no note: the key is left out');
+});
+
+// ── 3. every bar names the page ──────────────────────────────────────────────
+
+test('the profile band carries Connections between Invitations and Account on every page that wears the hub’s bar', () => {
+  const item = '<li class="bandCell"><a class="bandT" href="/connections">Connections</a></li>';
+  for (const f of ['projects.html', 'account.html', 'invitations.html', 'guild.html', 'privacy.html', 'terms.html', 'contact.html', 'index.html']) {
+    const html = read(f);
+    const at = html.indexOf(item);
+    assert.ok(at > 0, `${f} names /connections`);
+    assert.ok(html.lastIndexOf('>Invitations</a></li>', at) > 0 && html.indexOf('href="/account"', at) === at + item.length + '<li class="bandCell"><a class="bandT" '.length, `${f}: between Invitations and Account`);
+    const apexOnly = /<!--apex-only:start-->/.test(html.slice(html.indexOf('id="menuProfile"'), at));
+    if (['privacy.html', 'terms.html', 'contact.html', 'index.html', 'projects.html'].includes(f)) {
+      assert.ok(apexOnly, `${f} also serves a child, which has no /connections: the item sits in the apex-only region`);
+    }
+  }
+});
+
+// ── 4. the route ─────────────────────────────────────────────────────────────
+
+const { buildPlatformApp, stripApexOnly } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /connections: served on the hub’s apex, stamped; never on a child, the builders host or the status host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  const child = await get('/connections', 'game.test.local');
+  assert.equal(child.status, 404, 'a child instance has none of the routes this page reads, so no page');
+  modules.setModuleOverrides({ 'platform-identity': true });
+  const hub = await get('/connections', 'game.test.local');
+  assert.equal(hub.status, 200);
+  assert.match(hub.body, /— Connections<\/title>/);
+  assert.match(hub.body, /window\.__BRANDING__=/);
+  assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/);
+  assert.match(hub.body, /\/assets\/hub-bar\.js\?v=[0-9a-f]{8}/, 'the shared bar asset is content-stamped');
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    const other = await get('/connections', host);
+    assert.doesNotMatch(other.body, /— Connections<\/title>/, `${host} must not serve /connections`);
+  }
+});
+
+test('a child’s pages drop the Connections item with the rest of the apex-only region', () => {
+  for (const f of ['privacy.html', 'terms.html', 'contact.html', 'index.html', 'projects.html']) {
+    assert.doesNotMatch(stripApexOnly(read(f), false), /href="\/connections"/, f);
+  }
+});
+
+// ── 5. the kit ───────────────────────────────────────────────────────────────
+
+test('the kit renders the filled page, the empty page, the inactive profile and the door, and probes every action', () => {
+  const json = (f) => JSON.parse(read(f));
+  const states = json('connections.states.json');
+  assert.equal(states.page, '/connections');
+  assert.deepEqual(states.modes, ['dark']);
+  for (const s of ['out', 'in', 'in-profile-band']) assert.ok(states.states[s], `kit state ${s}`);
+  for (const [file, fixture] of [['connections-empty.states.json', 'connections-empty'], ['connections-inactive.states.json', 'connections-inactive']]) {
+    const v = json(file);
+    assert.equal(v.stub.fixtures.connections, fixture);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
+  }
+  const probes = json('connections.probes.json').probes.map((p) => p.name).join('\n');
+  for (const word of ['signed out', 'Accept', 'Decline', 'Withdraw', 'Remove', 'builder you may know', 'asking by handle', 'own handle']) {
+    assert.ok(probes.includes(word), `a probe covers ${word}`);
+  }
+});
+
+function stub(env = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js')], {
+      env: { ...process.env, AUTH: '1', STUB_PORT: '0', ...env }, stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    let out = '';
+    child.stdout.on('data', (c) => {
+      out += c;
+      const m = out.match(/stub on (http:\/\/127\.0\.0\.1:\d+)\//);
+      if (m) resolve({ origin: m[1], stop: () => child.kill() });
+    });
+    child.on('exit', (code) => reject(new Error(`stub exited ${code}: ${out}`)));
+  });
+}
+async function call(origin, method, p, body) {
+  const res = await globalThis.fetch(origin + '/api/bongos' + p, {
+    method, headers: body ? { 'content-type': 'application/json' } : {}, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  return { status: res.status, body: text ? JSON.parse(text) : undefined };
+}
+
+test('the kit stub answers the connection routes the way the routes do', async () => {
+  const s = await stub();
+  try {
+    const reqs = await call(s.origin, 'GET', '/connections/requests');
+    assert.ok(reqs.body.outgoing.every((r) => !('seen_at' in r)), 'the outbox never carries seen_at');
+    assert.equal(reqs.body.incoming_count, reqs.body.incoming.length);
+    const asked = await call(s.origin, 'POST', '/connections', { handle: 'nadia' });
+    assert.deepEqual([asked.status, asked.body], [201, { status: 'pending' }], 'no id, nothing to difference');
+    assert.equal((await call(s.origin, 'POST', '/connections', { handle: 'nadia' })).status, 409);
+    assert.equal((await call(s.origin, 'POST', '/connections', { handle: 'nobody-here' })).body.error.code, 'connection_target_not_found');
+    assert.equal((await call(s.origin, 'POST', '/connections', { handle: 'builder' })).body.error.code, 'cannot_connect_to_self');
+    assert.equal((await call(s.origin, 'POST', '/connections', { handle: '' })).status, 400);
+    const declined = await call(s.origin, 'POST', '/connections/52/decline');
+    assert.deepEqual([declined.status, declined.body], [204, undefined], 'a decline is silent');
+    assert.equal((await call(s.origin, 'POST', '/connections/52/accept')).status, 404, 'a declined request is gone');
+    assert.equal((await call(s.origin, 'POST', '/connections/51/accept')).status, 200);
+    const list = await call(s.origin, 'GET', '/connections');
+    assert.equal(list.body.connections[0].handle, 'priya');
+    assert.equal(list.body.count, list.body.connections.length);
+    assert.equal((await call(s.origin, 'DELETE', '/connections/51')).body.outcome, 'removed');
+    assert.equal((await call(s.origin, 'DELETE', '/connections/61')).body.outcome, 'cancelled');
+    assert.equal((await call(s.origin, 'DELETE', '/connections/abc')).status, 404);
+  } finally { s.stop(); }
+  const inactive = await stub({ FIXTURE_ALIAS: JSON.stringify({ connections: 'connections-inactive' }) });
+  try {
+    assert.equal((await call(inactive.origin, 'GET', '/connections')).body.error.code, 'profile_provisional');
+  } finally { inactive.stop(); }
+});

package/tests/hub_invite_badge.mjs

@@ -183,7 +183,7 @@ test('the file builds nodes only and makes only its two reads', () => {
 // ── the pages ────────────────────────────────────────────────────────────────
 
 test('every page that wears the hub bar loads it once, before the Artist review tag', () => {
-  for (const page of ['projects', 'account', 'invitations', 'guild', 'privacy', 'terms', 'contact']) {
+  for (const page of ['projects', 'account', 'invitations', 'connections', 'guild', 'privacy', 'terms', 'contact']) {
     const html = fs.readFileSync(path.join(LANDING, `${page}.html`), 'utf8');
     const tags = html.match(/<script src="\/assets\/invite-badge\.js"><\/script>/g) || [];
     assert.equal(tags.length, 1, `${page}: one tag`);

package/tests/idp_device_exchange.mjs

@@ -368,5 +368,23 @@ t('a handle outside the canonical charset rides as null — the identity still s
   }
 });
 
+t('a vouch whose subject is not a numeric GitHub id is no vouch — the id feeds the hub profile read', () => {
+  // The hub mints only for numeric ids, so this shape needs the raw signer: a
+  // correctly signed vouch whose sub is anything else still lands unvouched.
+  for (const sub of ['octo', '42abc', '-42', '4.2', ' 42', '']) {
+    const token = signRaw({ iss: 'cloudbongos-hub', aud: 'client-x', sub, applicant_login: 'octo', handle: 'octo', purpose: 'application', iat: nowS(), exp: nowS() + 60, jti: `sub-${sub}` });
+    assert.equal(applicationVouchIdentity(token, vouchOpts('octo')), null, `sub=${JSON.stringify(sub)}`);
+  }
+  const numeric = signRaw({ iss: 'cloudbongos-hub', aud: 'client-x', sub: 42, applicant_login: 'octo', handle: 'octo', purpose: 'application', iat: nowS(), exp: nowS() + 60, jti: 'sub-number' });
+  assert.deepEqual(applicationVouchIdentity(numeric, vouchOpts('octo')), { githubId: '42', handle: 'octo' }, 'a JSON number is still a numeric id');
+});
+
+t('a refused vouch logs at debug — the public POST /access-requests lets anyone trigger it', () => {
+  const src = require('node:fs').readFileSync(new URL('../src/bongos/auth-idp.js', import.meta.url), 'utf8');
+  const body = src.slice(src.indexOf('function applicationVouchIdentity('), src.indexOf('function readApplicationVouch('));
+  assert.match(body, /log\.debug\(\{ reason: err\.message \}, 'application vouch not accepted/);
+  assert.doesNotMatch(body, /log\.(info|warn|error)\(/, 'no louder line on the refusal path');
+});
+
 console.log(`\nidp_device_exchange: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/landing_legal_pages.mjs

@@ -171,8 +171,8 @@ for (const p of PAGES) {
       '<div class="menuBand" id="menuProjects" data-menu="projects" hidden>',
       '<div class="menuBand" id="menuProfile" data-menu="profile" hidden>',
       '<div class="bandIn bandProfile">',
-      // Invitations and Account are one apex-only region: both pages exist only on the hub (task 1004276)
-      '<!--apex-only:start--><li class="bandCell"><a class="bandT" href="/invitations">Invitations</a></li><li class="bandCell"><a class="bandT" href="/account">Account</a></li><!--apex-only:end-->',
+      // Invitations, Connections and Account are one apex-only region: the three pages exist only on the hub (tasks 1004276, 1004278)
+      '<!--apex-only:start--><li class="bandCell"><a class="bandT" href="/invitations">Invitations</a></li><li class="bandCell"><a class="bandT" href="/connections">Connections</a></li><li class="bandCell"><a class="bandT" href="/account">Account</a></li><!--apex-only:end-->',
       '<li class="bandCell"><a class="bandT signout" href="/api/bongos/auth/logout">Sign out</a></li>',
     ]) {
       assert.ok(HUB.includes(piece), `projects.html no longer carries: ${piece}`);
@@ -188,12 +188,14 @@ for (const p of PAGES) {
     const html = read(p.file);
     const clauses = (band) => [...band.matchAll(/>([^<]+)<\/a><span class="bandC">([^<]+)<\/span>/g)].map((m) => [m[1], m[2]]);
     assert.deepEqual(clauses(bandOf(html, 'menuProjects')), clauses(bandOf(HUB, 'menuProjects')), 'the Projects band’s items and clauses are the hub’s');
+    assert.deepEqual(clauses(bandOf(html, 'menuProjects'))[2], ['Your projects', 'the ones you own'],
+      'the mine view lists what you own; the projects you build on live on /account (task 1004590)');
     assert.deepEqual(bandLinks(bandOf(html, 'menuProjects')), [
       ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&amp;sub=table'],
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
     ], 'this page has no views of its own, so every item names /projects in full');
     assert.deepEqual(bandLinks(bandOf(html, 'menuProfile')), [
-      ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
+      ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Connections', '/connections'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
     ]);
     assert.doesNotMatch(chrome(html), /aria-current/, 'no band item is this page');
     const child = stripApexOnly(html, false);
@@ -213,7 +215,7 @@ for (const p of PAGES) {
   });
 }
 
-test('the three doors, the account page and the invitations page carry one bar: identical but for the sign-in return and the current place', () => {
+test('the three doors, the account page, the invitations page and the connections page carry one bar: identical but for the sign-in return and the current place', () => {
   const norm = (html, route) => chrome(html)
     .replace(`return=${route}&amp;`, 'return=ROUTE&amp;')
     .replace(/href="#\w+">Skip to content/, 'href="#MAIN">Skip to content')
@@ -225,6 +227,7 @@ test('the three doors, the account page and the invitations page carry one bar:
   assert.equal(doors[2], doors[0], 'contact.html and privacy.html');
   assert.equal(norm(ACCOUNT, '/account'), doors[0], 'account.html and the doors: one bar, so a change to it is a change to all five');
   assert.equal(norm(read('invitations.html'), '/invitations'), doors[0], 'invitations.html too (task 1004276)');
+  assert.equal(norm(read('connections.html'), '/connections'), doors[0], 'connections.html too (task 1004278)');
 });
 
 test('cosmos.css still carries the bar and the bands the doors lean on', () => {
@@ -346,7 +349,7 @@ for (const p of PAGES) {
       assert.equal(dom.els.get('who').getAttribute('aria-label'), 'Account, octocat');
       for (const id of ['whoImg', 'bandWhoImg']) assert.equal(dom.els.get(id).src, 'https://avatars.example/u/1');
       assert.equal(dom.els.get('mineCell').hidden, false);
-      assert.deepEqual(dom.band('menuProfile').items.map((i) => i.text), hub ? ['My projects', 'Invitations', 'Account', 'Sign out'] : ['My projects', 'Sign out']);
+      assert.deepEqual(dom.band('menuProfile').items.map((i) => i.text), hub ? ['My projects', 'Invitations', 'Connections', 'Account', 'Sign out'] : ['My projects', 'Sign out']);
     });
   }