@bongos/core 1.21.31 → 1.21.33

package/tests/module_catalog.mjs

@@ -225,10 +225,11 @@ test('formatCatalog: a search with no hits says so instead of printing an empty
   assert.ok(!/KEY\s+SOURCE/.test(out), 'no header row over an empty result');
 });
 
-test('cmdList: --json emits the rows + summary, and honours --catalog/--search', () => {
+test('cmdList: --json emits the rows + summary, and honours --catalog/--search', async () => {
   const lines = [];
-  const code = mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
+  const code = await mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
     log: (s) => lines.push(s),
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
     gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
   });
   assert.equal(code, 0);
@@ -239,17 +240,18 @@ test('cmdList: --json emits the rows + summary, and honours --catalog/--search',
   assert.deepEqual(payload.modules.map((m) => m.key), ['provisioning']);
 });
 
-test('cmdList: --search with no value is a usage error, not a silent empty listing', () => {
+test('cmdList: --search with no value is a usage error, not a silent empty listing', async () => {
   const errs = [];
-  const code = mod.cmdList(['--search'], { log: () => {}, errlog: (s) => errs.push(s), gather: () => { throw new Error('must not gather'); } });
+  const code = await mod.cmdList(['--search'], { log: () => {}, errlog: (s) => errs.push(s), gather: () => { throw new Error('must not gather'); } });
   assert.equal(code, 2);
   assert.match(errs.join('\n'), /usage: bongos module list/);
 });
 
-test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently dropped', () => {
+test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently dropped', async () => {
   const errs = [];
-  const code = mod.cmdList([], {
+  const code = await mod.cmdList([], {
     log: () => {},
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
     errlog: (s) => errs.push(s),
     gather: () => ({ rows: sample(), skipped: [{ key: 'rotted', reason: 'coreVersion "^0.1.0" not satisfied by core 1.19.0' }], errors: [], core: '1.19.0' }),
   });
@@ -257,6 +259,32 @@ test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently
   assert.match(errs.join('\n'), /rotted: not listed — coreVersion/);
 });
 
+test('cmdList: an installed store module the store delisted is marked, and only instance modules are asked about (task 1003797)', async () => {
+  const lines = [];
+  const asked = [];
+  const code = await mod.cmdList([], {
+    log: (s) => lines.push(s),
+    gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
+    checkStore: async (rows) => {
+      asked.push(...rows.map((r) => r.key));
+      return { checked: true, latest: Object.fromEntries(rows.map((r) => [r.key, { version: '9.9.9', status: 'delisted' }])) };
+    },
+  });
+  assert.equal(code, 0);
+  const instanceKeys = sample().filter((r) => r.source === 'instance').map((r) => r.key);
+  assert.deepEqual(asked, instanceKeys, 'a core module is never a store install, so it is not asked about');
+  const out = lines.join('\n');
+  assert.match(out, /DELISTED/);
+  assert.match(out, /your copy keeps working, but no more versions will come/);
+  const json = [];
+  await mod.cmdList(['--json'], {
+    log: (s) => json.push(s),
+    gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
+  });
+  assert.ok(JSON.parse(json.join('\n')).modules.every((m) => m.store_delisted === false), 'offline: nothing is marked');
+});
+
 // ---------------------------------------------------------------------------
 // The live tree — the catalog must actually describe THIS checkout
 // ---------------------------------------------------------------------------

package/tests/module_store_delist.mjs

@@ -0,0 +1,146 @@
+// tests/module_store_delist.mjs — a Metic+ person can take a module out of the store,
+// and a delisted module actually leaves it, while every instance that already holds
+// it keeps it (task 1003797, ADR 0338 D2). Drives the real POST
+// /store/modules/:key/delist handler off the real router, and the real store reads
+// behind acquire / download / update checks, against a stand-in pool (no port, no
+// real DB — the module_store_reassess.mjs harness).
+//
+// Run:  node tests/module_store_delist.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const fresh = () => ({
+  modules: { weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed', delisted_at: null } },
+  versions: [{ id: 7, module_key: 'weather', version: '1.2.0', core_version: '^1.20.0', tree_sha256: 't', tarball_sha256: 'x', tarball_bytes: 10, artifact_path: 'weather/weather-1.2.0.tgz', published_at: '2026-09-30T00:00:00Z' }],
+  sql: [],
+});
+let state = fresh();
+const query = async (sql, params = []) => {
+  state.sql.push(sql);
+  if (/^\s*UPDATE store_modules SET status = 'delisted'/.test(sql)) {
+    const m = state.modules[params[0]];
+    if (!m || m.status !== 'listed') return { rows: [] };
+    m.status = 'delisted'; m.delisted_at = '2026-10-01T00:00:00Z';
+    return { rows: [{ ...m }] };
+  }
+  if (/FROM store_modules WHERE module_key = ANY\(\$1\) AND status = 'delisted'/.test(sql)) {
+    return { rows: params[0].map((k) => state.modules[k]).filter((m) => m && m.status === 'delisted') };
+  }
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/JOIN store_modules m/.test(sql)) {
+    return { rows: state.versions.filter((v) => params[0].includes(v.module_key)).map((v) => ({ ...v, status: state.modules[v.module_key].status })) };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0]) };
+  }
+  return { rows: [] };
+};
+const pool = { connect: async () => ({ query, release() {} }), query };
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+const store = require('../src/bongos/module-store.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+
+const PATH = '/store/modules/:key/delist';
+function handlerFor(router) {
+  const layer = router.stack.find((l) => l.route && l.route.path === PATH && l.route.methods.post);
+  assert.ok(layer, `no POST ${PATH} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function invoke(handle, { key = 'weather', body = {} } = {}) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) { const o = typeof opts === 'number' ? { status: opts, details } : (opts || {}); this.statusCode = o.status; this.body = { error: code, ...o }; return this; },
+  };
+  let nextErr = null;
+  await handle({ params: { key }, body, builder: { id: 3 } }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const { handle, depth } = handlerFor(buildModulesRouter());
+
+test('the route is gated by its own Metic+ atom, granted to metic and archon, and pinned', () => {
+  assert.ok(depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  assert.match(src, /router\.post\('\/store\/modules\/:key\/delist', auth\.requireBuilder, auth\.requirePermission\('module\.delist'\)/);
+  const { byKey } = require('../modules/government/catalog.js');
+  const p = byKey('module.delist');
+  assert.equal(p.floor, 'metic');
+  assert.equal(p.system, false);
+  const mig = fs.readFileSync(path.join(ROOT, 'modules/government/migrations/government_025_module_delist.sql'), 'utf8');
+  for (const rank of ['metic', 'archon']) assert.match(mig, new RegExp(`SELECT '${rank}', unnest\\(ARRAY\\[\\s*'module\\.delist'`));
+  const pins = fs.readFileSync(path.join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  assert.match(pins, /'POST \/store\/modules\/:key\/delist': 'perm:module\.delist'/);
+});
+
+test('no reason, no delist — and only `reason` is accepted', async () => {
+  state = fresh();
+  for (const body of [{}, { reason: '' }, { reason: '   ' }]) {
+    const res = await invoke(handle, { body });
+    assert.equal(res.statusCode, 400);
+    assert.equal(res.body.error, 'reason_required');
+  }
+  assert.equal((await invoke(handle, { body: { reason: 'r', revoke: true } })).statusCode, 400, 'unknown fields are refused');
+  assert.equal(state.modules.weather.status, 'listed');
+});
+
+test('a bad key is refused, an unknown module is 404, a second delist is 409', async () => {
+  state = fresh();
+  assert.equal((await invoke(handle, { key: 'Bad_Key', body: { reason: 'r' } })).statusCode, 400);
+  const missing = await invoke(handle, { key: 'nope', body: { reason: 'r' } });
+  assert.equal(missing.statusCode, 404);
+  assert.equal(missing.body.error, 'module_not_found');
+  assert.equal((await invoke(handle, { body: { reason: 'r' } })).statusCode, 200);
+  const again = await invoke(handle, { body: { reason: 'r' } });
+  assert.equal(again.statusCode, 409);
+  assert.equal(again.body.error, 'already_delisted');
+});
+
+test('a delisted module leaves the store: no new install, download, version or update', async () => {
+  state = fresh();
+  assert.equal((await store.resolveAcquirable('weather', { db: pool })).ok, true, 'installable before');
+  const res = await invoke(handle, { body: { reason: 'a security issue was reported' } });
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body.status, 'delisted');
+  assert.ok(res.body.delisted_at);
+  // acquire, tarball and acquired all go through resolveAcquirable.
+  const acq = await store.resolveAcquirable('weather', { db: pool });
+  assert.equal(acq.ok, false);
+  assert.equal(acq.code, 'module_delisted');
+  assert.equal((await store.resolveAcquirable('weather', { version: '1.2.0', db: pool })).code, 'module_delisted');
+  // `bongos upgrade` sees the status and tells the holder no more versions will come.
+  const latest = await store.latestVersions(['weather'], { db: pool });
+  assert.equal(latest.weather.status, 'delisted');
+  // The hall's Modules tab marks it.
+  assert.deepEqual([...(await store.delistedKeySet(['weather', 'other'], { db: pool }))], ['weather']);
+});
+
+test('a delist never touches holders, entitlements or scores (ADR 0338 D2, ADR 0359)', async () => {
+  state = fresh();
+  await invoke(handle, { body: { reason: 'r' } });
+  assert.ok(state.sql.every((q) => !/module_entitlements|module_assessment_scores|module_assessment_signals/.test(q)),
+    'the delist writes no entitlement, score or signal row');
+  // An installed module loads from the instance's own disk: the loader never asks
+  // the store, so a delist cannot stop a held copy from mounting.
+  for (const f of fs.readdirSync(path.join(ROOT, 'src/module-loader'))) {
+    if (!f.endsWith('.js')) continue;
+    const src = fs.readFileSync(path.join(ROOT, 'src/module-loader', f), 'utf8');
+    assert.doesNotMatch(src, /store_modules|delisted|\/store\/modules/, `${f} must not consult the store`);
+  }
+});