@bongos/core 1.21.172 → 1.21.173

package/src/bongos/routes/modules.js

@@ -841,6 +841,9 @@ module.exports = function buildModulesRouter() {
   // is not listed at all. The floor is fixed in module-listing.js and returned here.
   // `?sort=<part>` orders the listed modules by the part a buyer cares about
   // (task 1003800, sortByPart); the parts it accepts come back as sort_parts.
+  // Without it the listed modules are ranked quality first, price breaking ties
+  // (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules
+  // that cost more.
   //
   // rank: any-builder — a read of public store metadata, like /store/modules/latest:
   // no entitlement taken, nothing changed.
@@ -852,7 +855,18 @@ module.exports = function buildModulesRouter() {
         const names = SORT_PARTS.map((p) => `${p.title} (${p.part})`).join(', ');
         return res.fail('bad_request', { status: 400, message: `The store can be sorted by one part of the score: ${names}.` });
       }
-      const listing = await listCatalog({ sort });
+      // An optional maximum price (task 1003808): ?max_cents= and/or ?max_credits=,
+      // each a whole number of at least 0. Free modules always pass.
+      const maxPrice = {};
+      for (const [param, field] of [['max_cents', 'cents'], ['max_credits', 'credits']]) {
+        const v = req.query && req.query[param];
+        if (v == null || v === '') continue;
+        if (typeof v !== 'string' || !/^\d{1,9}$/.test(v)) {
+          return res.fail('bad_request', { status: 400, message: `${param} is a maximum price: a whole number, 0 or more.` });
+        }
+        maxPrice[field] = Number(v);
+      }
+      const listing = await listCatalog({ sort, maxPrice });
       res.set('Cache-Control', 'no-store');
       res.json(listing);
     }));

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.172'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.173'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auth_switch_account.mjs

@@ -0,0 +1,38 @@
+// tests/auth_switch_account.mjs — the home page's "New account" door (task 1004789).
+//
+// WHY. GitHub silently re-uses whoever is logged in to github.com in the browser,
+// so a second Cloud Bongos account was unreachable. ?switch=1 on /auth/web/start
+// must add prompt=select_account (GitHub's account picker); a plain sign-in must not.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'test-secret';
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+
+test('switchAccount adds prompt=select_account; a plain sign-in does not', () => {
+  const plain = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb'));
+  assert.equal(plain.searchParams.get('prompt'), null);
+  const sw = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb', { switchAccount: true }));
+  assert.equal(sw.searchParams.get('prompt'), 'select_account');
+  assert.equal(sw.searchParams.get('scope'), plain.searchParams.get('scope'));
+});
+
+test('the start route reads ?switch=1 and passes it to the GitHub leg', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
+  assert.match(src, /const wantsSwitch = req\.query\.switch === '1'/);
+  assert.match(src, /switchAccount: wantsSwitch/);
+  // a switch must reach GitHub, never short-circuit through the live-session handoff
+  assert.match(src, /if \(!wantsRepos && !wantsSwitch\) \{/);
+});
+
+test('the landing carries the New account door beside Sign in', () => {
+  const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/index.html'), 'utf8');
+  assert.match(html, /<a class="pill newacct" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1&amp;switch=1"[^>]*>New account<\/a>/);
+});

package/tests/module_store_listing.mjs

@@ -15,9 +15,18 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 // ---- the fake registry the route reads ----
-const state = { modules: {}, versions: [], scores: [], signals: [] };
+const state = { modules: {}, versions: [], scores: [], signals: [], prices: [] };
 const pool = {
   async query(sql, params = []) {
+    if (/FROM store_module_prices/.test(sql)) {
+      const newest = new Map();
+      for (const p of state.prices) {
+        if (!params[0].includes(p.module_key)) continue;
+        const have = newest.get(p.module_key);
+        if (!have || p.set_at > have.set_at) newest.set(p.module_key, p);
+      }
+      return { rows: [...newest.values()] };
+    }
     if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
       return {
         rows: state.versions
@@ -53,7 +62,7 @@ const poolPath = require.resolve('../src/bongos/pool.js');
 require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
 
 const buildModulesRouter = require('../src/bongos/routes/modules.js');
-const { QUALITY_FLOOR, SORT_PARTS, placeVersion, sortByPart } = require('../src/bongos/module-listing.js');
+const { QUALITY_FLOOR, SORT_PARTS, RANKING, placeVersion, sortByPart, priceOf, withinMaxPrice, rankListed } = require('../src/bongos/module-listing.js');
 
 function handlerFor(router, method, p) {
   const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
@@ -153,7 +162,7 @@ test('GET /store/modules: lists by the newest version\'s current score, drops wh
   assert.equal(res.statusCode, 200);
   assert.equal(res.headers['Cache-Control'], 'no-store');
   assert.equal(res.body.floor, 50);
-  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['fixed', '2.0.0', 60], ['good', '1.10.0', 80]]);
+  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['good', '1.10.0', 80], ['fixed', '2.0.0', 60]], 'highest score first');
   assert.deepEqual(res.body.new.map((m) => [m.key, m.is_new, m.overall]), [['fresh', true, null]]);
   const all = [...res.body.listed, ...res.body.new].map((m) => m.key);
   for (const k of ['low', 'unsafe', 'unscored', 'gone']) assert.ok(!all.includes(k), `${k} must not be listed`);
@@ -163,7 +172,7 @@ test('GET /store/modules: an empty store answers empty lists and the floor', asy
   state.modules = {}; state.versions = []; state.scores = [];
   const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
   const res = await invoke(handle, {});
-  assert.deepEqual(res.body, { floor: 50, sort: null, sort_parts: SORT_PARTS, listed: [], new: [] });
+  assert.deepEqual(res.body, { floor: 50, ranking: RANKING, sort: null, sort_parts: SORT_PARTS, max_price: null, listed: [], new: [] });
 });
 
 // ---------------------------------------------------------------------------
@@ -229,7 +238,7 @@ test('GET /store/modules?sort=: orders the listed modules by the part, leaves Ne
   assert.deepEqual(byTests.body.listed.map((m) => m.key), ['tested', 'steady']);
   const plain = await invoke(handle, { query: {} });
   assert.equal(plain.body.sort, null);
-  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is key order, as before');
+  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is the ranking: equal scores, both free, so key order');
   state.signals = [];
 });
 
@@ -307,3 +316,94 @@ test('the criterion: two modules with the same overall score read differently',
   assert.equal(by.steady.parts.reliability.score, 90);
   state.signals = [];
 });
+
+// ---------------------------------------------------------------------------
+// the ranking: quality first, price breaks ties, optional max price (task 1003808)
+// ---------------------------------------------------------------------------
+
+test('priceOf: no price row is free; 0 in either currency is free; null is not offered', () => {
+  assert.deepEqual(priceOf(null), { cents: null, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 0, price_credits: null }), { cents: 0, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 0 }), { cents: 500, credits: 0, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: null }), { cents: 500, credits: null, free: false });
+});
+
+test('rankListed: a higher score always wins, whatever it costs — price never buys a place', () => {
+  const ranked = rankListed([
+    { key: 'cheap', overall: 70, price: priceOf(null) },
+    { key: 'dear', overall: 90, price: priceOf({ price_cents: 99900 }) },
+  ]);
+  assert.deepEqual(ranked.map((e) => e.key), ['dear', 'cheap']);
+});
+
+test('rankListed: between equal scores, free first, then lowest cash, then lowest credits, then key', () => {
+  const input = [
+    { key: 'z-credits', overall: 80, price: priceOf({ price_credits: 5 }) },
+    { key: 'cents-900', overall: 80, price: priceOf({ price_cents: 900 }) },
+    { key: 'cents-100', overall: 80, price: priceOf({ price_cents: 100 }) },
+    { key: 'b-free', overall: 80, price: priceOf(null) },
+    { key: 'a-free', overall: 80, price: priceOf({ price_cents: 0 }) },
+  ];
+  assert.deepEqual(rankListed(input).map((e) => e.key), ['a-free', 'b-free', 'cents-100', 'cents-900', 'z-credits']);
+  assert.equal(input[0].key, 'z-credits', 'the input is untouched');
+});
+
+test('withinMaxPrice: free always passes; a priced module must be offered at or under a cap the buyer set', () => {
+  const p = priceOf({ price_cents: 500, price_credits: 7 });
+  assert.equal(withinMaxPrice(p, null), true, 'no cap, no filter');
+  assert.equal(withinMaxPrice(p, { cents: 500, credits: null }), true, 'at the cap is in');
+  assert.equal(withinMaxPrice(p, { cents: 499, credits: null }), false);
+  assert.equal(withinMaxPrice(p, { cents: 1, credits: 7 }), true, 'either currency under its cap is enough');
+  assert.equal(withinMaxPrice(priceOf({ price_cents: 500 }), { cents: null, credits: 100 }), false, 'not offered in credits, so a credit cap cannot let it in');
+  assert.equal(withinMaxPrice(priceOf(null), { cents: 0, credits: null }), true);
+});
+
+test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out what costs more', async () => {
+  state.modules = {
+    top: { status: 'listed', title: 'Top' }, 'tie-paid': { status: 'listed', title: 'Tie paid' },
+    'tie-free': { status: 'listed', title: 'Tie free' }, fresh: { status: 'listed', title: 'Fresh' },
+  };
+  state.versions = [
+    { id: 31, module_key: 'top', version: '1.0.0', published_at: 't' },
+    { id: 32, module_key: 'tie-paid', version: '1.0.0', published_at: 't' },
+    { id: 33, module_key: 'tie-free', version: '1.0.0', published_at: 't' },
+    { id: 34, module_key: 'fresh', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 31, version_id: 31, computed_at: 1, ...score({ overall: 92 }) },
+    { id: 32, version_id: 32, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 33, version_id: 33, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 34, version_id: 34, computed_at: 1, ...score({ is_new: true }) },
+  ];
+  state.signals = [];
+  state.prices = [
+    { module_key: 'top', price_cents: 2000, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 900, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 500, price_credits: null, set_at: 2 },
+    { module_key: 'fresh', price_cents: 3000, price_credits: null, set_at: 1 },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const all = await invoke(handle, { query: {} });
+  assert.equal(all.body.ranking, RANKING);
+  assert.deepEqual(all.body.listed.map((m) => m.key), ['top', 'tie-free', 'tie-paid']);
+  assert.deepEqual(all.body.listed.map((m) => m.price.cents), [2000, null, 500], 'the CURRENT price is shown');
+  assert.equal(all.body.max_price, null);
+
+  const capped = await invoke(handle, { query: { max_cents: '1000' } });
+  assert.deepEqual(capped.body.max_price, { cents: 1000, credits: null });
+  assert.deepEqual(capped.body.listed.map((m) => m.key), ['tie-free', 'tie-paid']);
+  assert.deepEqual(capped.body.new, [], 'the cap applies to New modules too');
+
+  const free = await invoke(handle, { query: { max_cents: '0' } });
+  assert.deepEqual(free.body.listed.map((m) => m.key), ['tie-free'], 'a cap of 0 is free only');
+  state.prices = [];
+});
+
+test('GET /store/modules: a maximum price that is not a whole number of 0 or more is refused', async () => {
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  for (const query of [{ max_cents: '-1' }, { max_cents: '5.5' }, { max_credits: 'ten' }, { max_cents: ['1', '2'] }]) {
+    const res = await invoke(handle, { query });
+    assert.equal(res.statusCode, 400, JSON.stringify(query));
+    assert.match(res.body.message, /maximum price/);
+  }
+});

package/tests/speciality_injection.mjs

@@ -105,3 +105,23 @@ test('the adoption read selects the contract itself', () => {
   // while still looking well-formed.
   assert.match(src('modules/specialities/db.js'), /SELECT s\.id, s\.slug, s\.name, s\.discipline, s\.summary, s\.contract_md/);
 });
+
+// task 1004817: two sessions, two worktrees, two claims in two crafts. Each
+// session gets ONLY the contract for the claim bound to its own worktree; the
+// account-wide pool is only the fallback when no claim is bound here.
+test('two claims in two worktrees: each session gets only its own contract', () => {
+  const claims = [
+    { ...claim('artist'), task_id: '1', worktree_name: 'task-1' },
+    { ...claim('engineer'), task_id: '2', worktree_name: 'task-2' },
+  ];
+  const specs = [
+    sp({ discipline: 'artist', contract: 'Speciality: Pixel art (under artist).' }),
+    sp({ discipline: 'engineer', contract: 'Speciality: Compilers (under engineer).' }),
+  ];
+  const got = (worktree) => ids(conductor.evaluateTriggers({ activeClaims: claims, specialities: specs, worktree }))
+    .filter((i) => String(i).startsWith('speciality:'));
+  assert.deepEqual(got('task-1'), ['speciality:artist']);
+  assert.deepEqual(got('task-2'), ['speciality:engineer']);
+  // No claim bound to this tree (main checkout): today's behaviour, every craft in play.
+  assert.deepEqual(got('main-checkout').sort(), ['speciality:artist', 'speciality:engineer']);
+});