@bongos/core 1.21.131 → 1.21.133

package/tests/github_sign_in_seen.mjs

@@ -5,7 +5,7 @@
 // Sign-in used to tick only from the one-click GitHub attempt reaching 'done', so a project
 // whose sign-in was wired some other way — a hand-made OAuth app, or a GitHub tab that never
 // came back — sat at "Waiting on GitHub" for good. Now the liveness sweep reads the project's
-// /healthz answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
+// JSON health answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
 // The page half (what the founder sees) is tests/setup_status_facts.mjs §6.
 //
 // Pinned here, DB-free over recording fakes and real loopback servers:
@@ -14,7 +14,10 @@
 //   * pickUpFor offers nothing to pick up once sign-in works elsewhere;
 //   * githubSetupRead reads the fact even when no attempt exists;
 //   * recordSignInSeen writes at most one row per attempt;
-//   * probeHealthz reports auth_configured only from a small JSON answer saying true;
+//   * probeHealthz reports auth_configured only from a small JSON answer saying true, read
+//     from <API prefix>/healthz — the root /healthz says a plain "ok" (task 1004743), and every
+//     server here answers both paths the way a real project does;
+//   * a sign-in read that fails, hangs or redirects never turns an up project down;
 //   * sweepOnce records the fact only for an up project that says so.
 //
 // Run:  node --test tests/github_sign_in_seen.mjs
@@ -23,6 +26,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
 import path from 'node:path';
+import { readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -30,6 +34,8 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const gs = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
 const liveness = require(path.join(ROOT, 'modules', 'provisioning', 'pollers', 'liveness-sweep.js'));
+const { API_PREFIX } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
+const AUTH_PATH = `${API_PREFIX}/healthz`;
 
 const SEEN = { signInSeenAt: '2026-10-14T10:00:00.000Z' };
 
@@ -100,13 +106,38 @@ test('recordSignInSeen writes at most one row per attempt, from the liveness swe
 });
 
 // ── the probe and the sweep ────────────────────────────────────────────────────────────
-function serve(body, type = 'application/json') {
-  const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': type }); res.end(body); });
-  return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server)));
+// A project as it really answers: the ROOT /healthz is a plain-text "ok", and auth_configured
+// lives only on the JSON answer under the API prefix. `api` handles that one path; without it
+// the path 404s, like a core with no such route. A root mocked as JSON is what hid task 1004743.
+function project(api) {
+  const server = http.createServer((req, res) => {
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
+    if (req.url === AUTH_PATH && api) { api(req, res); return; }
+    res.writeHead(404); res.end();
+  });
+  return listen(server);
 }
+function json(body, status = 200) {
+  return (_req, res) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' }); res.end(body); };
+}
+function listen(server) { return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server))); }
 function close(server) { if (server.closeAllConnections) server.closeAllConnections(); server.close(); }
+const rootOf = (s) => `http://127.0.0.1:${s.address().port}/healthz`;
+
+test('the fixture is the real shape: the root /healthz says a plain-text "ok"', () => {
+  const src = readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8').replace(/\r\n/g, '\n');
+  assert.match(src, /app\.get\('\/healthz', \(_req, res\) => \{\n\s*res\.type\('text\/plain'\)\.send\('ok'\);/,
+    'if the root ever answers JSON, project() above must change with it');
+});
 
-test('probeHealthz says auth_configured only from a small JSON answer saying true', async () => {
+test('a project whose root is the only answer is up, never configured, and never crashes the probe', async () => {
+  const s = await project(null);
+  try {
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: false });
+  } finally { close(s); }
+});
+
+test('probeHealthz says auth_configured only from a small JSON answer under the API prefix saying true', async () => {
   const cases = [
     ['{"ok":true,"auth_configured":true}', true],
     ['{"ok":true,"auth_configured":false}', false],
@@ -116,23 +147,80 @@ test('probeHealthz says auth_configured only from a small JSON answer saying tru
     [JSON.stringify({ ok: true, auth_configured: true, pad: 'x'.repeat(8000) }), false],
   ];
   for (const [body, want] of cases) {
-    const s = await serve(body);
+    const s = await project(json(body));
     try {
-      const r = await liveness.probeHealthz(`http://127.0.0.1:${s.address().port}/healthz`, { timeoutMs: 3000 });
-      assert.equal(r.up, true, 'any 2xx is still up');
+      const r = await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 });
+      assert.equal(r.up, true, 'the root answered, so it is up');
       assert.equal(r.authConfigured, want, body.slice(0, 50));
     } finally { close(s); }
   }
 });
 
+test('against the REAL healthz router, the probe reads what the project\'s auth says', async () => {
+  const express = require('express');
+  const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+  const buildHealthzRouter = require(path.join(ROOT, 'src', 'bongos', 'routes', 'healthz.js'));
+  const realAuthConfigured = auth.authConfigured;
+  let configured = true;
+  let s = null;
+  try {
+    auth.authConfigured = () => configured;
+    const app = express();
+    app.get('/healthz', (_req, res) => { res.type('text/plain').send('ok'); });
+    app.use(API_PREFIX, buildHealthzRouter());
+    s = await listen(http.createServer(app));
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: true });
+    configured = false;
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: false });
+  } finally { auth.authConfigured = realAuthConfigured; if (s) close(s); }
+});
+
+test('a sign-in read that fails, hangs or redirects never turns an up project down, and is never followed', async () => {
+  const elsewhere = await project(json('{"ok":true,"auth_configured":true}'));
+  const answers = {
+    'a 500': json('{"ok":true,"auth_configured":true}', 500),
+    'a hang': () => {},
+    'a redirect to a yes': (_req, res) => { res.writeHead(302, { location: `http://127.0.0.1:${elsewhere.address().port}${AUTH_PATH}` }); res.end(); },
+  };
+  try {
+    for (const [name, api] of Object.entries(answers)) {
+      const s = await project(api);
+      try {
+        assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 400 }), { up: true, authConfigured: false }, name);
+      } finally { close(s); }
+    }
+  } finally { close(elsewhere); }
+});
+
+test('the sign-in read rides only a vetted address, and no shape of failure turns it into a down', async () => {
+  const asked = [];
+  const answering = async (url) => {
+    asked.push(String(url));
+    return String(url).endsWith(AUTH_PATH) ? new Response('{"ok":true,"auth_configured":true}', { status: 200 }) : new Response('ok', { status: 200 });
+  };
+  const url = 'https://kestrel.example.com/healthz';
+  assert.deepEqual(await liveness.probeHealthz(url, { fetchImpl: answering, pin: { address: '93.184.216.34', family: 4 } }), { up: true, authConfigured: true });
+  assert.deepEqual(asked, [url, `https://kestrel.example.com${AUTH_PATH}`], 'the same origin, nowhere else');
+  asked.length = 0;
+  assert.deepEqual(await liveness.probeHealthz(url, { fetchImpl: answering }), { up: true, authConfigured: false });
+  assert.deepEqual(asked, [url], 'an https answer the gate never pinned is asked nothing more');
+
+  let calls = 0;
+  const throwsSecond = (u) => { calls += 1; if (calls > 1) throw new TypeError(`no: ${u}`); return Promise.resolve(new Response('ok', { status: 200 })); };
+  assert.deepEqual(await liveness.probeHealthz('http://127.0.0.1:1/healthz', { fetchImpl: throwsSecond }), { up: true, authConfigured: false }, 'a synchronous throw is only "no"');
+  const noStatus = await liveness.probeHealthz('http://127.0.0.1:1/healthz', { fetchImpl: async () => ({}) });
+  assert.equal(noStatus.up, false, 'an answer with no status is not a 2xx');
+});
+
 test('the sweep records the fact for an up project that says so, and for no other', async () => {
-  const yes = await serve('{"ok":true,"auth_configured":true}');
-  const no = await serve('{"ok":true,"auth_configured":false}');
+  const kestrel = await project(json('{"ok":true,"auth_configured":true}'));
+  const tern = await project(json('{"ok":true,"auth_configured":false}'));
+  const wren = await project(null);
   const inserts = [];
   const db = {
     query: async (sql, params) => {
       if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) {
-        return { rows: [{ id: 1, slug: 'kestrel', domain: null, port: yes.address().port }, { id: 2, slug: 'tern', domain: null, port: no.address().port }] };
+        return { rows: [kestrel, tern, wren].map((s, i) => ({ id: i + 1, slug: ['kestrel', 'tern', 'wren'][i], domain: null, port: s.address().port })) };
       }
       if (/^UPDATE provisioning_instances/.test(sql)) return { rows: [{ id: params[0], prev_up: true }] };
       if (/INSERT INTO provisioning_events/.test(sql)) { inserts.push(params); return { rows: [] }; }
@@ -142,7 +230,7 @@ test('the sweep records the fact for an up project that says so, and for no othe
   try {
     liveness.resetNoticeState();
     const out = await liveness.sweepOnce({ pool: db, log: () => {}, timeoutMs: 3000, notify: () => {}, collectRunnerDrift: async () => [] });
-    assert.equal(out.up, 2);
+    assert.equal(out.up, 3, 'what the sign-in read finds never changes up or down');
     assert.deepEqual(inserts, [[1, 'github-sign-in-seen']]);
-  } finally { close(yes); close(no); }
+  } finally { close(kestrel); close(tern); close(wren); }
 });

package/tests/goal_author_ui.mjs

@@ -0,0 +1,210 @@
+// tests/goal_author_ui.mjs — authoring a goal and a done-when criterion from the
+// hall (task 1003463; ADR 0366 D1.2/D1.3/D2/D3). Three layers:
+//   1. the pure lib (goal-author-lib.js) in a vm — the request BODIES the form
+//      sends, the derived slug, and how a refusal is put into words;
+//   2. the page wiring, read as source — the form carries no scope field and no
+//      interview-shaped step;
+//   3. the two server walls the form must not soften, driven with the form's OWN
+//      request through the assembled routers: a Metic's goal on a protected module
+//      is still refused, and a non-member's criterion is still refused.
+//
+// Run:  node --test tests/goal_author_ui.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
+
+const win = {};
+const sandbox = { window: win, String, Number, Array, Object, JSON, Math, Date, Set, Map };
+vm.createContext(sandbox);
+vm.runInContext(read('goal-author-lib.js'), sandbox, { filename: 'goal-author-lib.js' });
+const lib = win.OTBGoalAuthor;
+// Objects built inside the vm are another realm's; compare their JSON.
+const plain = (v) => JSON.parse(JSON.stringify(v));
+
+// ── 1. the pure half ─────────────────────────────────────────────────────────
+
+test('the goal body carries spec_task:true and NO scope, successor or admission', () => {
+  const body = lib.buildGoalBody({
+    version_id: ' V9 ', title: '  Hall goal ', subtitle: ' what it is for ', description: '', category_id: '3',
+    scope_modules: ['kernel'], succeeds_goal_id: 5, admit_reason: 'because reasons',
+  });
+  assert.deepEqual(plain(body), { version_id: 'V9', title: 'Hall goal', spec_task: true, subtitle: 'what it is for', category_id: 3 });
+  for (const k of ['scope_modules', 'succeeds_goal_id', 'admit_reason']) assert.ok(!(k in body), `${k} must not be sendable from this form`);
+});
+
+test('an empty subtitle, description and category are omitted rather than sent blank', () => {
+  const body = lib.buildGoalBody({ version_id: 'V9', title: 'x', subtitle: '  ', description: '', category_id: '' });
+  assert.deepEqual(plain(body), { version_id: 'V9', title: 'x', spec_task: true });
+});
+
+test('the goal form asks only for what the server checks first', () => {
+  assert.match(lib.goalFormProblem({ version_id: '', title: 'x' }), /version/i);
+  assert.match(lib.goalFormProblem({ version_id: 'V9', title: '   ' }), /name/i);
+  assert.match(lib.goalFormProblem({ version_id: 'V9', title: 'x'.repeat(lib.TITLE_MAX + 1) }), /under/);
+  assert.equal(lib.goalFormProblem({ version_id: 'V9', title: 'x' }), null);
+});
+
+test('the criterion slug is derived from the outcome text and is never positional', () => {
+  assert.equal(lib.criterionSlug('A goal and a criterion can be authored from the hall!'), 'a-goal-and-a-criterion-can-be-authored-from-the');
+  assert.equal(lib.criterionSlug('C7'), 'criterion-c7', 'a Cn-shaped slug is refused by the server, so it is never produced');
+  assert.equal(lib.criterionSlug('!!!'), '');
+  assert.ok(lib.criterionSlug('word '.repeat(40)).length <= 48);
+  assert.ok(!lib.criterionSlug('café déjà vu').match(/[^a-z0-9-]/));
+});
+
+test('the criterion request is POST /versions/<goal\'s version>/done-when with the goal named', () => {
+  const r = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V 9', outcome: ' Hall can author a goal ' });
+  assert.equal(r.path, '/versions/V%209/done-when');
+  assert.deepEqual(plain(r.body), { criterion_id: 'hall-can-author-a-goal', criterion_md: 'Hall can author a goal', goal_id: 12 });
+  assert.match(lib.criterionFormProblem({ goal_id: '', outcome: 'x' }), /goal/i);
+  assert.match(lib.criterionFormProblem({ goal_id: '3', outcome: ' ' }), /true/i);
+  assert.equal(lib.criterionFormProblem({ goal_id: '3', outcome: 'x' }), null);
+});
+
+test('a refusal keeps the server\'s own sentence and only fills in a bare code', () => {
+  assert.equal(lib.refusalText(403, { error: { code: 'x', message: 'Only an Archon.' } }), 'Only an Archon.');
+  assert.match(lib.refusalText(403, { error: 'goal_not_yours', message: 'Ask the owner.' }), /owner/);
+  assert.match(lib.refusalText(403, { error: { code: 'archon_required_for_protected_scope', message: 'archon_required_for_protected_scope' } }), /Archon/);
+  assert.match(lib.refusalText(409, { error: 'criterion_exists' }), /already exists/);
+  assert.match(lib.refusalText(500, null), /did not go through/);
+});
+
+test('versions are listed by openness only — the rank wall is the server\'s', () => {
+  const v = lib.openVersions([{ id: 'A', status: 'shipped' }, { id: 'B', status: 'building' }, { id: 'C', status: 'planning' }, null]);
+  assert.deepEqual(plain(v).map((x) => x.id), ['B', 'C']);
+});
+
+// ── 2. the page wiring ───────────────────────────────────────────────────────
+
+test('the form has no scope field and none of the interview-shaped steps', () => {
+  const ui = read('goal-author.js');
+  assert.ok(!/scope_modules|ga-scope|succeeds_goal_id|admit_reason/.test(ui), 'no scope / carry-forward / admission control');
+  assert.ok(!/\/goals\/\$\{[^}]*\}\/scope/.test(ui), 'the scope is set by the spec task, not here');
+  assert.match(ui, /goals\/suggestions\?version=/, 'matching open goals are shown before submit');
+  assert.match(ui, /\/goals`, \{ body: lib\.buildGoalBody/, 'POST /goals goes through the pure body builder');
+});
+
+test('goals.html loads the lib before the UI, and goals-page.js mounts it behind a guard', () => {
+  const html = read('goals.html');
+  const at = (f) => html.indexOf(`src="/builders/${f}"`);
+  assert.ok(at('goal-author-lib.js') > 0 && at('goal-author-lib.js') < at('goal-author.js'));
+  assert.ok(at('goal-author.js') < at(html.match(/src="\/builders\/(goals-page\.js[^"]*)"/)[1]));
+  assert.match(html, /id="goal-author-mount"/);
+  assert.match(read('goals-page.js'), /window\.OTBGoalAuthorUI\?\.mount\(/);
+});
+
+// ── 3. the walls, driven with the form's own request ─────────────────────────
+
+const r2 = createRequire(import.meta.url);
+
+async function withRouter(routeFile, rank, setup, fn) {
+  const auth = r2(path.join(ROOT, 'src/bongos/auth.js'));
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const db = r2(path.join(ROOT, 'modules/lifecycle/db.js'));
+  const routePath = r2.resolve(path.join(ROOT, routeFile));
+  const saved = { rb: auth.requireBuilder, rp: auth.requirePermission, tx: api.withTx };
+  const savedDb = {};
+  auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank }; next(); };
+  auth.requirePermission = () => (_req, _res, next) => next();
+  api.withTx = async (f) => f({ query: async () => ({ rows: [] }) });
+  const calls = setup(db, (k) => { savedDb[k] = savedDb[k] || db[k]; });
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(r2(routePath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = async (p, body) => {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}${p}`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+    });
+    return { status: res.status, data: await res.json().catch(() => ({})) };
+  };
+  try { await fn(post, calls); } finally {
+    server.close();
+    auth.requireBuilder = saved.rb; auth.requirePermission = saved.rp; api.withTx = saved.tx;
+    for (const [k, v] of Object.entries(savedDb)) db[k] = v;
+    delete r2.cache[routePath];
+  }
+}
+
+const goalSetup = (db, keep) => {
+  const calls = { createGoal: 0 };
+  for (const k of ['getVersion', 'createGoal', 'createTask']) keep(k);
+  db.getVersion = async (id) => ({ id, status: 'planning' });
+  db.createGoal = async (f) => { calls.createGoal += 1; return { id: 42, version_id: f.versionId, title: f.title }; };
+  db.createTask = async (f) => ({ id: 500, ...f });
+  return calls;
+};
+
+test('wall: the form\'s own goal request succeeds for a Metic and creates the spec task', async () => {
+  await withRouter('modules/lifecycle/routes/goals.js', 'metic', goalSetup, async (post, calls) => {
+    const body = lib.buildGoalBody({ version_id: 'V9', title: 'Hall goal', subtitle: 'for the hall' });
+    const res = await post('/goals', body);
+    assert.equal(res.status, 201, JSON.stringify(res.data));
+    assert.equal(res.data.spec_task.id, 500);
+    assert.equal(calls.createGoal, 1);
+  });
+});
+
+test('wall: a Metic still cannot create a goal scoped to a protected module', async () => {
+  await withRouter('modules/lifecycle/routes/goals.js', 'metic', goalSetup, async (post, calls) => {
+    // The hall form cannot send this field; the server must refuse it anyway.
+    const res = await post('/goals', { ...lib.buildGoalBody({ version_id: 'V9', title: 'Hall goal' }), scope_modules: ['kernel'] });
+    assert.equal(res.status, 403);
+    assert.equal(res.data.error && res.data.error.code, 'archon_required_for_protected_scope');
+    assert.equal(calls.createGoal, 0);
+    assert.match(lib.refusalText(res.status, res.data), /Archon/);
+  });
+});
+
+const criterionSetup = (membership) => (db, keep) => {
+  const calls = { createCriterion: 0 };
+  for (const k of ['getVersion', 'getGoal', 'getGoalMember', 'createCriterion']) keep(k);
+  db.getVersion = async (id) => ({ id, status: 'building' });
+  db.getGoal = async (id) => ({ id, version_id: 'V9', status: 'open', created_by: 99 });
+  db.getGoalMember = async () => membership;
+  db.createCriterion = async (f) => { calls.createCriterion += 1; return { criterion_id: f.criterionId }; };
+  return calls;
+};
+
+test('wall: a non-member Metic\'s criterion is refused by the server, with its reason', async () => {
+  await withRouter('modules/lifecycle/routes/done-when.js', 'metic', criterionSetup(null), async (post, calls) => {
+    const req = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V9', outcome: 'Hall can author a goal' });
+    req.body.goal_id = 12;
+    const res = await post(req.path, req.body);
+    assert.equal(res.status, 403);
+    assert.equal(res.data.error, 'goal_not_yours');
+    assert.equal(calls.createCriterion, 0);
+    assert.match(lib.refusalText(res.status, res.data), /owner or a manager/);
+  });
+});
+
+test('wall: the goal\'s manager can add the same criterion through the same request', async () => {
+  await withRouter('modules/lifecycle/routes/done-when.js', 'metic', criterionSetup({ membership_kind: 'lead' }), async (post, calls) => {
+    const req = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V9', outcome: 'Hall can author a goal' });
+    const res = await post(req.path, req.body);
+    assert.equal(res.status, 201, JSON.stringify(res.data));
+    assert.equal(calls.createCriterion, 1);
+  });
+});
+
+test('wall: both routes still sit behind their permission atoms', () => {
+  const g = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/goals.js'), 'utf8');
+  const d = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/done-when.js'), 'utf8');
+  assert.match(g, /router\.post\('\/goals', auth\.requireBuilder, auth\.requirePermission\('goal\.create'\)/);
+  assert.match(d, /router\.post\('\/versions\/:id\/done-when', auth\.requireBuilder, auth\.requirePermission\('criterion\.create'\)/);
+});