@bongos/core 1.21.152 → 1.21.153

package/tests/github_install_nudge.mjs

@@ -0,0 +1,219 @@
+// tests/github_install_nudge.mjs — a project whose GitHub App is not installed keeps showing
+// its owner the install link (task 1004763).
+//
+// WHY. Toast (instance 52) was made before the wizard asked anyone to install the app (task
+// 1004649), so nobody did, and every ship ended land-not-proven: the platform could not read
+// the repo to see the merge. The install link lived only inside the creation wizard's
+// checklist. Now the owner's two reads carry `github_install`, and the project list card and
+// the project's own page say "Install the GitHub App" until the runner has seen the install.
+//
+// Three layers, DB-free and network-free:
+//   1. modules/provisioning/github-setup.js — installNudge (pure) and installNudgesFor (two reads for a whole list).
+//   2. the REAL list and instance routes over a mounted router: the field rides both.
+//   3. projects.html's ghInstallRow, groupFor and the click handler, run in a vm: the link on
+//      the card and the manage page, "Needs you", and the click asking for a re-check.
+//
+// Run:  node --test tests/github_install_nudge.mjs
+
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GS = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+
+const INSTALL = 'https://github.com/apps/uattest-app/installations/new';
+const APP_ROW = { id: 9, instance_id: 56, status: 'done', app_id: 5, app_slug: 'uattest-app', state: 'SECRETSTATE', attempts: 1,
+  created_at: '2026-10-01T00:00:00Z', updated_at: '2026-10-01T00:05:00Z', resolved_at: '2026-10-01T00:05:00Z' };
+const INST = { id: 56, slug: 'uattest', status: 'active', target_ref: 'acme/uattest' };
+
+// ── 1. the helper ───────────────────────────────────────────────────────────
+
+test('installNudge: the link and repo while the install is unconfirmed, null otherwise', () => {
+  const setup = (install, url = INSTALL) => ({ checklist: { install }, install_url: url, repo: 'acme/uattest' });
+  assert.deepEqual(GS.installNudge(setup('now')), { install_url: INSTALL, repo: 'acme/uattest' });
+  assert.equal(GS.installNudge(setup('done')), null, 'GitHub confirmed it: nothing to say');
+  assert.equal(GS.installNudge(setup('todo', null)), null, 'no app of ours: nothing to install');
+  assert.equal(GS.installNudge(null), null);
+});
+
+// A fake pool answering the two batched reads from plain tables, counting the queries.
+function fakeDb({ attempts = [], installedEvents = [], fail = false } = {}) {
+  const db = { queries: 0 };
+  db.query = async (sql, params) => {
+    db.queries += 1;
+    if (fail) throw new Error('db down');
+    if (/FROM provisioning_oauth_manifests/.test(sql)) {
+      const ids = params[0].map(String);
+      return { rows: attempts.filter((r) => ids.includes(String(r.instance_id))) };
+    }
+    if (/FROM provisioning_events/.test(sql)) {
+      assert.equal(params[2], GS.SETUP_EVENTS.installed, 'only the verified install counts, never a report');
+      const since = new Map(params[0].map((id, i) => [String(id), Date.parse(params[1][i])]));
+      return { rows: installedEvents.filter((e) => since.has(String(e.instance_id)) && Date.parse(e.created_at) >= since.get(String(e.instance_id))) };
+    }
+    throw new Error(`unexpected query: ${sql}`);
+  };
+  return db;
+}
+
+test('installNudgesFor: two reads for the whole list; silent with no app, once installed, switched off, or on a failed read', async () => {
+  const insts = [
+    INST,
+    { id: 52, slug: 'toast', status: 'active', target_ref: 'acme/toast' },
+    { id: 13, slug: 'charter', status: 'active', target_ref: 'acme/charter' },
+    { id: 70, slug: 'gone', status: 'torn_down', target_ref: 'acme/gone' },
+    { id: 71, slug: 'old', status: 'active', target_ref: 'acme/old' },
+  ];
+  const db = fakeDb({
+    attempts: [
+      { instance_id: '56', app_slug: 'uattest-app', created_at: '2026-10-01T00:00:00Z' },
+      { instance_id: '52', app_slug: 'toast-app', created_at: '2026-10-01T00:00:00Z' },
+      { instance_id: '13', app_slug: null, created_at: '2026-10-01T00:00:00Z' },
+      { instance_id: '70', app_slug: 'gone-app', created_at: '2026-10-01T00:00:00Z' },
+      { instance_id: '71', app_slug: 'old-app', created_at: '2026-10-05T00:00:00Z' },
+    ],
+    installedEvents: [
+      { instance_id: '52', created_at: '2026-10-20T10:00:00Z' },
+      { instance_id: '71', created_at: '2026-10-02T00:00:00Z' },
+    ],
+  });
+  const n = await GS.installNudgesFor(db, insts);
+  assert.equal(db.queries, 2, 'two reads, however many projects');
+  assert.deepEqual(n.get('56'), { install_url: 'https://github.com/apps/uattest-app/installations/new', repo: 'acme/uattest' }, 'the stateless link: never the state token');
+  assert.equal(n.get('52'), null, 'the runner saw the install');
+  assert.equal(n.get('13'), null, 'no app was made: nothing to install');
+  assert.equal(n.get('70'), null, 'a switched-off project is silent');
+  assert.deepEqual(n.get('71'), { install_url: 'https://github.com/apps/old-app/installations/new', repo: 'acme/old' }, 'an install seen before the latest attempt began does not count for it');
+  const empty = fakeDb();
+  assert.equal((await GS.installNudgesFor(empty, [{ ...INST, status: 'torn_down' }])).get('56'), null);
+  assert.equal(empty.queries, 0, 'nothing live: no read at all');
+  const broken = await GS.installNudgesFor(fakeDb({ fail: true }), insts);
+  assert.ok([...broken.values()].every((v) => v === null), 'a failed read is no nudge, never a failed list');
+});
+
+test('the instance read: the nudge comes from the same checklist the wizard reads', () => {
+  const read = (install, url) => ({ checklist: { install }, install_url: url, repo: 'acme/uattest' });
+  assert.equal(GS.installNudge(read('now', INSTALL)).install_url, INSTALL);
+  assert.equal(GS.installNudge(read('todo', null)), null, 'no app: githubSetupRead gives no link, so no nudge');
+});
+
+// ── 2. the owner's two reads ────────────────────────────────────────────────
+
+test('GET /provisioning/instances and /provisioning/instances/:id carry github_install', async () => {
+  const provisioning = require(path.join(ROOT, 'modules', 'provisioning', 'provisioning.js'));
+  const api = require(path.join(ROOT, 'src', 'module-api.js'));
+  const catalogBridge = require(path.join(ROOT, 'modules', 'provisioning', 'catalog-bridge.js'));
+  const saved = {
+    list: provisioning.listInstancesForOwner, byId: provisioning.getInstanceById, open: provisioning.getOpenIntent,
+    latest: provisioning.getLatestOAuthManifestForInstance, rb: api.requireBuilder, heal: catalogBridge.healInstanceCatalog, facts: GS.githubSetupFacts,
+  };
+  const owned = [{ ...INST, owner_builder_id: 7 }, { id: 52, slug: 'toast', status: 'active', target_ref: 'acme/toast', owner_builder_id: 7 }];
+  provisioning.listInstancesForOwner = async () => owned;
+  provisioning.getInstanceById = async (_db, id) => owned.find((i) => Number(i.id) === Number(id)) || null;
+  provisioning.getOpenIntent = async () => null;
+  provisioning.getLatestOAuthManifestForInstance = async (_db, id) => ({ ...APP_ROW, instance_id: id, app_slug: `app-${id}` });
+  api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: 'metic' }; next(); };
+  catalogBridge.healInstanceCatalog = async () => {};
+  GS.githubSetupFacts = async () => ({});
+  const realBatch = GS.installNudgesFor;
+  const listDb = fakeDb({
+    attempts: owned.map((i) => ({ instance_id: String(i.id), app_slug: `app-${i.id}`, created_at: '2026-10-01T00:00:00Z' })),
+    installedEvents: [{ instance_id: '52', created_at: '2026-10-20T10:00:00Z' }],
+  });
+  GS.installNudgesFor = (_pool, rows) => realBatch(listDb, rows);
+
+  const express = require('express');
+  const app = express();
+  app.use((_req, res, next) => { res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } }); next(); });
+  app.use('/api/bongos', require(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'))());
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  after(() => {
+    server.close();
+    Object.assign(provisioning, { listInstancesForOwner: saved.list, getInstanceById: saved.byId, getOpenIntent: saved.open, getLatestOAuthManifestForInstance: saved.latest });
+    api.requireBuilder = saved.rb; catalogBridge.healInstanceCatalog = saved.heal; GS.githubSetupFacts = saved.facts; GS.installNudgesFor = realBatch;
+  });
+  const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+  const list = await (await fetch(`${base}/provisioning/instances`)).json();
+  const by = Object.fromEntries(list.instances.map((i) => [i.slug, i]));
+  assert.deepEqual(by.uattest.github_install, { install_url: 'https://github.com/apps/app-56/installations/new', repo: 'acme/uattest' });
+  assert.equal(by.toast.github_install, null, 'installed: no nudge');
+  assert.equal(listDb.queries, 2, 'the list reads the nudges in two queries');
+
+  const one = await (await fetch(`${base}/provisioning/instances/56`)).json();
+  assert.deepEqual(one.instance.github_install, { install_url: 'https://github.com/apps/app-56/installations/new', repo: 'acme/uattest' });
+  assert.ok(!/SECRETSTATE/.test(JSON.stringify(one)) && !/SECRETSTATE/.test(JSON.stringify(list)), 'the state token never rides an owner read');
+  assert.equal(one.github_setup.checklist.install, 'now', 'the wizard checklist still rides the same read');
+});
+
+// ── 3. the page ─────────────────────────────────────────────────────────────
+
+function grab(head) {
+  const at = HUB.indexOf(`\n  ${head}`);
+  assert.ok(at >= 0, `${head} must exist`);
+  const end = HUB.indexOf('\n  }', at + 1);
+  const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
+  return HUB.slice(at, close);
+}
+function page() {
+  const ctx = { STATE_GROUP: { active: 'live', error: 'attention', torn_down: 'gone' } };
+  vm.createContext(ctx);
+  vm.runInContext(['function esc(', 'function ghInstallRow(', 'function groupFor('].map(grab).join('\n'), ctx);
+  return ctx;
+}
+
+test('ghInstallRow: the install link on its own, for an unconfirmed install only', () => {
+  const p = page();
+  const html = p.ghInstallRow({ id: 56, status: 'active', github_install: { install_url: INSTALL, repo: 'acme/uattest' } });
+  assert.match(html, /Install the GitHub App ↗/);
+  assert.match(html, new RegExp(`href="${INSTALL.replace(/[.?/]/g, '\\$&')}" target="_blank" rel="noopener" data-gh-install="56"`));
+  assert.match(html, /<code>acme\/uattest<\/code>/);
+  assert.equal(p.ghInstallRow({ id: 52, status: 'active', github_install: null }), '');
+  assert.equal(p.ghInstallRow({ id: 56, status: 'torn_down', github_install: { install_url: INSTALL } }), '', 'switched off: silent');
+  assert.equal(p.ghInstallRow({ id: 56, status: 'active', github_install: { install_url: 'https://evil.example/x' } }), '', 'only GitHub\'s own app pages are linked');
+  assert.match(p.ghInstallRow({ id: 56, status: 'active', github_install: { install_url: INSTALL, repo: '<b>x</b>' } }), /&lt;b&gt;/, 'the repo is escaped');
+});
+
+test('groupFor: a project waiting on the install counts under Needs you', () => {
+  const p = page();
+  assert.equal(p.groupFor({ status: 'active', last_verified_up: true, github_install: { install_url: INSTALL } }), 'attention');
+  assert.equal(p.groupFor({ status: 'active', last_verified_up: true, github_install: null }), 'live');
+});
+
+test('the card and the project\'s own page both draw it', () => {
+  assert.match(grab('function renderCard('), /var gh = ghInstallRow\(inst\);\n    if \(gh\) body \+= '<div class="projMsg">' \+ gh \+ '<\/div>';/);
+  assert.match(grab('function renderManage('), /var gh = ghInstallRow\(inst\);\n    \$\('mGh'\)\.innerHTML = gh;\n    \$\('mGh'\)\.hidden = !gh;/);
+  assert.match(HUB, /<div class="projMsg" id="mGh" hidden><\/div>/);
+});
+
+test('the click opens GitHub and asks the platform to look again', async () => {
+  const at = HUB.indexOf("\n  document.addEventListener('click', function (ev) {\n    var a = ev.target.closest && ev.target.closest('a[data-gh-install]');");
+  assert.ok(at >= 0, 'the install click handler must exist');
+  const src = HUB.slice(at, HUB.indexOf('\n  });', at) + 6);
+  let listener = null;
+  const calls = [];
+  const ctx = {
+    API: '/api/bongos',
+    document: { addEventListener: (type, fn) => { if (type === 'click') listener = fn; } },
+    fetch: (url, opts) => { calls.push({ url, opts }); return Promise.resolve({ ok: true }); },
+  };
+  vm.createContext(ctx);
+  vm.runInContext(src, ctx);
+  let prevented = false;
+  const link = { getAttribute: (k) => (k === 'data-gh-install' ? '56' : null) };
+  listener({ target: { closest: (sel) => (sel === 'a[data-gh-install]' ? link : null) }, preventDefault: () => { prevented = true; } });
+  assert.equal(prevented, false, 'the link still opens GitHub');
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].url, '/api/bongos/provisioning/instances/56/github-app/pick-up');
+  assert.equal(calls[0].opts.method, 'POST');
+  listener({ target: { closest: () => null }, preventDefault() {} });
+  assert.equal(calls.length, 1, 'any other click asks nothing');
+});

package/tests/hall_catalog_world.mjs

@@ -39,7 +39,7 @@ const noAlias = (rawCss, where) => {
 
 // ---- modules ----------------------------------------------------------------
 
-test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll', () => {
+test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll (a third, the store, since task 1003799)', () => {
   const html = read('modules.html');
   assert.match(html, /<link rel="stylesheet" href="\/builders\/oversight\.css">\s*<link rel="stylesheet" href="\/builders\/modules\.css">/, 'the family sheet loads before the page sheet');
   assert.equal((html.match(/class="scroll[ "]/g) || []).length, 1, 'one panel, not three');
@@ -47,7 +47,7 @@ test('modules: ONE panel of family rows — the filter bar, the figure band and
   assert.match(html, /class="ov-figs" id="mod-figs"/, 'the figure band is the family\'s');
   assert.match(html, /<ul class="ov-rows" id="core-grid">/, 'the core catalog is a run of rows');
   assert.match(html, /<ul class="ov-rows" id="own-grid">/, 'the project\'s own modules are a run of rows');
-  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 2, 'two group heads');
+  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 3, 'three group heads: the core, this project, the store');
   assert.doesNotMatch(decomment(html), /mod-grid|mod-card|mod-browse|submit-scroll|class="settings-status"/, 'the card grid, the boxed search and the third panel are gone');
   assert.doesNotMatch(html, /\d+ module\(s\)/, 'the page head no longer says the numbers as prose');
 });
@@ -89,6 +89,23 @@ test('modules: upkeep colours the exception — undeclared is the warn pill, mai
   assert.match(js, /cat\.parentTitle, cat\.sub\]/, 'the hall search covers the category, as searchCatalog does');
 });
 
+test('modules: the store group reads strengths and weaknesses off the server row (task 1003799)', () => {
+  const js = read('modules.js');
+  const html = read('modules.html');
+  assert.match(html, /<div class="ov-group" id="store-group" hidden>/, 'the store group is hidden until the store answers');
+  assert.match(html, /<ul class="ov-rows" id="store-grid"><\/ul>/);
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/store\/modules`\)/, 'it reads GET /store/modules');
+  assert.match(js, /<span class="ov-fact">strong at \$\{partsList\(strong\)\}<\/span>/, 'a strength is a plain fact');
+  assert.match(js, /<span class="fact-pill fact-pill--warn">weak at \$\{partsList\(weak\)\}<\/span>/, 'a weakness is the warn pill');
+  assert.match(js, /not measured yet/, 'a part with no data is named, never counted as weak');
+  assert.match(js, /<details class="mod-more"[^`]*Strengths and weaknesses of/, 'the detail sentence is one click away');
+  assert.doesNotMatch(decomment(js), /score\s*>=\s*80|STRONG_AT/, 'the page does not re-derive the reading — the server owns the thresholds');
+  const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'store__modules.json'), 'utf8'));
+  const two = fixture.listed.filter((m) => m.overall === 74);
+  assert.equal(two.length, 2, 'the harness shows the criterion: two modules on the same score');
+  assert.notDeepEqual(two[0].strengths.map((s) => s.part), two[1].strengths.map((s) => s.part), '…that are strong at different things');
+});
+
 test('modules: the kit filter bar carries the search and a state lens, and the empty state is the kit\'s', () => {
   const js = read('modules.js');
   assert.match(js, /kit\.makeFilterBar\(\{/, 'the bar is the kit\'s');

package/tests/module_store_listing.mjs

@@ -15,7 +15,7 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 // ---- the fake registry the route reads ----
-const state = { modules: {}, versions: [], scores: [] };
+const state = { modules: {}, versions: [], scores: [], signals: [] };
 const pool = {
   async query(sql, params = []) {
     if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
@@ -35,6 +35,17 @@ const pool = {
       }
       return { rows: [...newest.values()] };
     }
+    if (/FROM module_assessment_signals/.test(sql)) {
+      const ids = params[0].map(String);
+      const newest = new Map();
+      for (const s of state.signals) {
+        if (!ids.includes(String(s.version_id))) continue;
+        const k = `${s.version_id}:${s.part}`;
+        const have = newest.get(k);
+        if (!have || s.measured_at > have.measured_at || (s.measured_at === have.measured_at && s.id > have.id)) newest.set(k, s);
+      }
+      return { rows: [...newest.values()] };
+    }
     return { rows: [] };
   },
 };
@@ -154,3 +165,69 @@ test('GET /store/modules: an empty store answers empty lists and the floor', asy
   const res = await invoke(handle, {});
   assert.deepEqual(res.body, { floor: 50, listed: [], new: [] });
 });
+
+// ---------------------------------------------------------------------------
+// strengths and weaknesses (task 1003799, ADR 0343 D4)
+// ---------------------------------------------------------------------------
+
+const { readParts, STRONG_AT } = require('../src/bongos/module-listing.js');
+const sig = (part, score, extra = {}) => ({ part, outcome: 'scored', score, sample_size: null, ...extra });
+
+test('readParts: a part at or above STRONG_AT is a strength, below the floor a weakness, between is neither', () => {
+  assert.equal(STRONG_AT, 80);
+  const r = readParts([sig('tests', 80), sig('install', 79), sig('reliability', 49), sig('docs', 50)]);
+  assert.deepEqual(r.strengths.map((s) => s.part), ['tests']);
+  assert.deepEqual(r.weaknesses.map((s) => s.part), ['reliability']);
+  assert.deepEqual(r.unmeasured.map((s) => s.part), ['tester_feedback'], 'a part with no row is unmeasured');
+});
+
+test('readParts: an unmeasured part is never a weakness, and Security is never listed', () => {
+  const r = readParts([
+    { part: 'security', outcome: 'passed', score: null },
+    { part: 'install', outcome: 'no_data', score: null },
+    { part: 'reliability', outcome: 'pending', score: null },
+    { part: 'tester_feedback', outcome: 'not_scored', score: null },
+    sig('tests', 10),
+  ]);
+  assert.deepEqual(r.weaknesses.map((s) => s.part), ['tests']);
+  assert.deepEqual(r.unmeasured.map((s) => s.part), ['install', 'reliability', 'tester_feedback', 'docs']);
+  for (const list of [r.strengths, r.weaknesses, r.unmeasured]) assert.ok(!list.some((s) => s.part === 'security'));
+  assert.ok(!('security' in r.parts), 'the gate is not one of the parts a buyer compares');
+  assert.deepEqual(r.parts.install, { outcome: 'no_data', score: null, sample_size: null });
+});
+
+test('readParts: strongest first, weakest first, and the detail says what the number rests on', () => {
+  const r = readParts([sig('tests', 85, { sample_size: 40 }), sig('docs', 95), sig('install', 30, { sample_size: 1 }), sig('reliability', 45, { sample_size: 12 })]);
+  assert.deepEqual(r.strengths.map((s) => [s.part, s.score]), [['docs', 95], ['tests', 85]]);
+  assert.deepEqual(r.weaknesses.map((s) => [s.part, s.score]), [['install', 30], ['reliability', 45]]);
+  assert.equal(r.strengths[1].detail, 'Tests scored 85 out of 100, from 40 test cases.');
+  assert.equal(r.weaknesses[0].detail, 'Clean installs scored 30 out of 100, from 1 install.');
+  assert.equal(r.strengths[0].detail, 'How-to scored 95 out of 100.');
+});
+
+test('the criterion: two modules with the same overall score read differently', async () => {
+  state.modules = { steady: { status: 'listed', title: 'Steady' }, tested: { status: 'listed', title: 'Tested' } };
+  state.versions = [
+    { id: 11, module_key: 'steady', version: '1.0.0', published_at: 't' },
+    { id: 12, module_key: 'tested', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 11, version_id: 11, computed_at: 1, ...score({ overall: 74 }) },
+    { id: 12, version_id: 12, computed_at: 1, ...score({ overall: 74 }) },
+  ];
+  state.signals = [
+    { id: 1, version_id: 11, measured_at: 1, ...sig('tests', 58) },
+    { id: 2, version_id: 11, measured_at: 1, ...sig('reliability', 40) }, // superseded below
+    { id: 3, version_id: 11, measured_at: 2, ...sig('reliability', 90) },
+    { id: 4, version_id: 12, measured_at: 1, ...sig('tests', 96) },
+    { id: 5, version_id: 12, measured_at: 1, ...sig('reliability', 52) },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, {});
+  const by = Object.fromEntries(res.body.listed.map((m) => [m.key, m]));
+  assert.equal(by.steady.overall, by.tested.overall);
+  assert.deepEqual(by.steady.strengths.map((s) => s.part), ['reliability'], 'the newest reliability row wins');
+  assert.deepEqual(by.tested.strengths.map((s) => s.part), ['tests']);
+  assert.equal(by.steady.parts.reliability.score, 90);
+  state.signals = [];
+});