@bongos/core 1.21.39 → 1.21.41

package/tests/page_notes_db.mjs

@@ -0,0 +1,140 @@
+// tests/page_notes_db.mjs — the page feedback doc's tables hold their rules in
+// Postgres, not just in JS (task 1004496). Runs the REAL migration and the REAL
+// db.js against a database; SKIPS (exit 0) with no reachable Postgres, like
+// every *_db test (the copy_desk_flags_db.mjs pattern).
+//
+// Run:  DATABASE_URL=postgres://... node tests/page_notes_db.mjs
+
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`page_notes_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const db = require('../modules/page-notes/db.js');
+const q = (text, params) => pool.query(text, params);
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+async function refuses(sql, params, constraint) {
+  try { await pool.query(sql, params); } catch (e) {
+    if (constraint && e.constraint !== constraint) throw new Error(`refused by ${e.constraint || e.code}, expected ${constraint}`);
+    return;
+  }
+  throw new Error(`expected ${constraint || 'a refusal'}, but the write landed`);
+}
+
+await pool.query(`
+  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
+  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
+  CREATE TABLE IF NOT EXISTS idea_inbox (id bigserial PRIMARY KEY, title text, status text);
+`);
+const A = 910000001;
+const B = 910000002;
+await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
+  [A, 'pntest-a', 'Page Notes Test A', B, 'pntest-b', '']);
+
+const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_001_notes.sql'), 'utf8');
+await pool.query(MIGRATION);
+const PAGE = 'builders:pn-test-page';
+const clean = () => pool.query('DELETE FROM page_notes_docs WHERE page_id LIKE $1', ['builders:pn-test-%']);
+await clean();
+
+const PNG = Buffer.from('89504e470d0a1a0a0000000d4948445200000001000000010806000000', 'hex');
+
+console.log('page_notes — the constraints hold in Postgres, not just in JS');
+
+await test('the migration is idempotent (re-running is clean)', async () => {
+  await pool.query(MIGRATION);
+});
+
+await test('ONE DRAFT per builder per page: opening twice resumes the same row', async () => {
+  const one = await db.openDraft({ authorId: A, pageId: PAGE, pagePath: '/x', pageTitle: 'X' }, q);
+  const two = await db.openDraft({ authorId: A, pageId: PAGE, pagePath: '/x', pageTitle: 'X' }, q);
+  assert.equal(String(one.id), String(two.id));
+  assert.equal(one.status, 'draft');
+  assert.equal(one.author_name, 'Page Notes Test A');
+  const other = await db.openDraft({ authorId: B, pageId: PAGE, pagePath: '/x', pageTitle: 'X' }, q);
+  assert.notEqual(String(other.id), String(one.id), 'another builder gets their own draft');
+  assert.equal(other.author_name, 'pntest-b', 'an empty display name falls back to the login');
+});
+
+await test('the page id, path, status and body are checked by the schema', async () => {
+  await refuses("INSERT INTO page_notes_docs (page_id, author_id) VALUES ('nope', $1)", [A], 'page_notes_page_id_chk');
+  await refuses("INSERT INTO page_notes_docs (page_id, page_path, author_id) VALUES ($1, 'javascript:x', $2)", [PAGE, A], 'page_notes_page_path_chk');
+  await refuses("INSERT INTO page_notes_docs (page_id, status, author_id) VALUES ($1, 'published', $2)", [PAGE, A], 'page_notes_status_chk');
+  await refuses('INSERT INTO page_notes_docs (page_id, body_md, author_id) VALUES ($1, $2, $3)', [PAGE, 'x'.repeat(40001), A], 'page_notes_body_chk');
+});
+
+await test('IMAGES ONLY: the schema refuses SVG and anything over 4 MB', async () => {
+  const note = await db.openDraft({ authorId: A, pageId: 'builders:pn-test-img', pagePath: '', pageTitle: '' }, q);
+  const row = await db.addImage(note.id, { content_type: 'image/png', bytes: PNG, name: 'a.png' }, q);
+  assert.equal(Number(row.size), PNG.length);
+  await refuses("INSERT INTO page_notes_images (note_id, content_type, bytes) VALUES ($1, 'image/svg+xml', $2)", [note.id, Buffer.from('<svg/>')], 'page_notes_images_type_chk');
+  await refuses("INSERT INTO page_notes_images (note_id, content_type, bytes) VALUES ($1, 'image/png', $2)", [note.id, Buffer.alloc(4 * 1024 * 1024 + 1)], 'page_notes_images_size_chk');
+  const img = await db.getImage(row.id, q);
+  assert.ok(Buffer.from(img.bytes).equals(PNG), 'the bytes come back as they went in');
+  assert.equal(img.status, 'draft');
+  assert.equal(String(img.author_id), String(A));
+});
+
+await test('SUBMIT: once only, dropping the images the text no longer shows', async () => {
+  const note = await db.openDraft({ authorId: A, pageId: 'builders:pn-test-submit', pagePath: '/s', pageTitle: 'S' }, q);
+  const keep = await db.addImage(note.id, { content_type: 'image/png', bytes: PNG, name: 'keep' }, q);
+  await db.addImage(note.id, { content_type: 'image/png', bytes: PNG, name: 'drop' }, q);
+  assert.equal(await db.countImages(note.id, q), 2);
+  assert.ok(await db.saveBody(note.id, A, 'words', q));
+  assert.equal(await db.saveBody(note.id, B, 'not yours', q), null, 'only the author saves');
+  assert.equal(await db.markSplitting(note.id, B, [String(keep.id)], q), false, 'only the author submits');
+  assert.equal(await db.markSplitting(note.id, A, [String(keep.id)], q), true);
+  assert.equal(await db.markSplitting(note.id, A, [String(keep.id)], q), false, 'a second submit is a no-op');
+  assert.deepEqual((await db.listImages(note.id, q)).map((i) => String(i.id)), [String(keep.id)]);
+  assert.equal(await db.saveBody(note.id, A, 'too late', q), null, 'a submitted doc is no longer a draft');
+  const idea = await pool.query("INSERT INTO idea_inbox (title, status) VALUES ('pn test idea', 'open') RETURNING id");
+  assert.equal(await db.markFiled(note.id, { ideaIds: [String(idea.rows[0].id)], splitBy: 'ai' }, q), true);
+  assert.equal(await db.markFiled(note.id, { ideaIds: [], splitBy: 'ai' }, q), false, 'only a splitting doc is filed');
+  const filed = await db.getNote(note.id, q);
+  assert.equal(filed.status, 'filed');
+  assert.equal(filed.split_by, 'ai');
+  assert.deepEqual((await db.ideaTitles(filed.idea_ids, q)).map((i) => i.title), ['pn test idea']);
+  const list = await db.listForPage('builders:pn-test-submit', {}, q);
+  assert.deepEqual(list.map((r) => String(r.id)), [String(note.id)], 'the page lists its submitted docs');
+  await pool.query('DELETE FROM idea_inbox WHERE id = $1', [idea.rows[0].id]);
+});
+
+await test('a submitted doc frees the page for a new draft', async () => {
+  const fresh = await db.openDraft({ authorId: A, pageId: 'builders:pn-test-submit', pagePath: '/s', pageTitle: 'S' }, q);
+  assert.equal(fresh.status, 'draft');
+  assert.equal((await db.listForPage('builders:pn-test-submit', {}, q)).length, 1, 'drafts are not listed');
+});
+
+await test('deleting a doc takes its images with it', async () => {
+  const note = await db.openDraft({ authorId: B, pageId: 'builders:pn-test-cascade', pagePath: '', pageTitle: '' }, q);
+  await db.addImage(note.id, { content_type: 'image/png', bytes: PNG, name: '' }, q);
+  await pool.query('DELETE FROM page_notes_docs WHERE id = $1', [note.id]);
+  assert.equal(await db.countImages(note.id, q), 0);
+});
+
+await clean();
+await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
+await pool.end();
+console.log(`page_notes_db: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/page_notes_panel.mjs

@@ -0,0 +1,145 @@
+// tests/page_notes_panel.mjs — the hall side of the artist's page feedback doc
+// (task 1004496): the palette tool craft-mode.js puts in the top bar, and the
+// reader in page-notes.js. The server half is tests/page_notes.mjs.
+//
+// Runs the REAL craft-mode.js over a small DOM: the palette shows in Artistry
+// alone and leaves when the mode changes, pressing it loads page-notes.js once
+// (same ?v as craft-mode.js) and a ?note= link opens the doc in any mode. Then
+// the REAL page-notes.js reader: it escapes the doc and shows only this module's
+// own images, which is what keeps a doc from pulling a picture off another site.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const CRAFT = fs.readFileSync(path.join(HALL, 'craft-mode.js'), 'utf8');
+const NOTES = fs.readFileSync(path.join(HALL, 'page-notes.js'), 'utf8');
+
+function node(tag, id, cls) {
+  const attrs = {};
+  const listeners = {};
+  const el = {
+    tagName: tag, id: id || '', className: cls || '', dataset: {}, children: [], parentNode: null, innerHTML: '', title: '', type: '', src: '',
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    get nextSibling() { const s = this.parentNode && this.parentNode.children; return s ? s[s.indexOf(this) + 1] || null : null; },
+    appendChild(c) { c.parentNode = this; this.children.push(c); if (this.onAppend) this.onAppend(c); return c; },
+    insertBefore(c, ref) { c.parentNode = this; const at = ref ? this.children.indexOf(ref) : -1; if (at === -1) this.children.push(c); else this.children.splice(at, 0, c); return c; },
+    removeChild(c) { this.children.splice(this.children.indexOf(c), 1); c.parentNode = null; return c; },
+    querySelector(sel) { return all(this).find((n) => sel === '.' + n.className) || null; },
+    querySelectorAll() { return []; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    click() { (listeners.click || []).forEach((fn) => fn({ target: el })); },
+    classList: { toggle() {} },
+  };
+  return el;
+}
+function all(root) { return root.children.flatMap((c) => [c, ...all(c)]); }
+
+function boot({ session = {}, search = '' } = {}) {
+  const sidebar = node('NAV', 'app-sidebar');
+  const topbar = node('DIV', 'app-topbar');
+  const side = topbar.appendChild(node('DIV', '', 'topbar-side'));
+  const sw = side.appendChild(node('DIV', 'craft-switch'));
+  const head = node('HEAD');
+  const loaded = [];
+  const root = node('HTML');
+  const everything = () => [sidebar, topbar, ...all(sidebar), ...all(topbar)];
+  const document = {
+    documentElement: root, body: node('BODY'), head, activeElement: null,
+    currentScript: { src: 'https://h/builders/craft-mode.js?v=2026-10-04-test' },
+    getElementById: (id) => everything().find((n) => n.id === id) || null,
+    querySelectorAll: (sel) => (sel === '[data-craft-tool]' ? everything().filter((n) => n.hasAttribute('data-craft-tool')) : []),
+    createElement: (t) => node(t.toUpperCase()),
+    addEventListener() {}, removeEventListener() {}, dispatchEvent() { return true; },
+  };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const opened = [];
+  const window = { localStorage: mk({}), sessionStorage: mk(session), matchMedia: () => ({ matches: false }), location: { search } };
+  // "Loading" page-notes.js: record the tag, then define the API it would define.
+  head.onAppend = (tag) => {
+    loaded.push(tag.src);
+    window.OTBPageNotes = { open: () => opened.push('open'), openNote: (id) => opened.push('note ' + id) };
+    tag.onload();
+  };
+  const sandbox = { window, document, Promise, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  vm.createContext(sandbox);
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  window.OTBCraftMode.mount();
+  return { craft: window.OTBCraftMode, side, sw, loaded, opened, tools: () => all(side).filter((n) => n.hasAttribute('data-craft-tool')) };
+}
+const flush = () => new Promise((r) => setTimeout(r, 0));
+
+test('THE PALETTE: in the top bar in Artistry alone, right before the switch, and gone when the mode changes', () => {
+  const p = boot({ session: { 'hall-craft': 'artistry' } });
+  assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette']);
+  assert.equal(p.tools()[0].nextSibling, p.sw, 'it sits right before the mode switch');
+  assert.equal(p.tools()[0].getAttribute('aria-label'), 'Write feedback on this page');
+  for (const m of ['building', 'ideating', 'governing', 'legacy']) {
+    p.craft.choose(m);
+    assert.equal(p.tools().length, 0, `no palette in ${m}`);
+  }
+  p.craft.choose('artistry');
+  p.craft.choose('artistry');
+  assert.equal(p.tools().length, 1, 'choosing Artistry twice draws one palette');
+  assert.equal(boot().tools().length, 0, 'and none with no mode at all');
+});
+
+test('pressing it loads page-notes.js once, at the same version as craft-mode.js, and opens it', async () => {
+  const p = boot({ session: { 'hall-craft': 'artistry' } });
+  assert.deepEqual(p.loaded, [], 'nothing loads until the palette is pressed');
+  p.tools()[0].click();
+  await flush();
+  p.tools()[0].click();
+  await flush();
+  assert.deepEqual(p.loaded, ['/builders/page-notes.js?v=2026-10-04-test']);
+  assert.deepEqual(p.opened, ['open', 'open']);
+});
+
+test('a ?note= link opens that doc on arrival, in any mode', async () => {
+  const p = boot({ search: '?note=42' });
+  await flush();
+  assert.deepEqual(p.opened, ['note 42']);
+  const q = boot({ session: { 'hall-craft': 'governing' }, search: '?x=1&note=7' });
+  await flush();
+  assert.deepEqual(q.opened, ['note 7']);
+  const bad = boot({ search: '?note=7x' });
+  await flush();
+  assert.deepEqual(bad.opened, [], 'a malformed id opens nothing');
+});
+
+// ---------- the reader ----------
+function reader() {
+  const window = { location: { pathname: '/studio' } };
+  const document = { body: { dataset: { page: 'studio', pageTitle: 'Studio' } }, title: 'Studio — hall' };
+  const sandbox = { window, document };
+  vm.createContext(sandbox);
+  vm.runInContext(NOTES, sandbox, { filename: 'page-notes.js' });
+  return window.OTBPageNotes;
+}
+
+test('the reader escapes the doc and shows ONLY this module\'s own images', () => {
+  const R = reader();
+  const html = R.renderBody('# Header <b>\n- one\n- two\n\nSee ![shot](/api/bongos/page-notes/images/12) and ![x](https://evil.example/a.png)\n<script>alert(1)</script>');
+  assert.match(html, /<h3 class="pn-doc__h">Header &lt;b&gt;<\/h3>/);
+  assert.match(html, /<ul><li>one<\/li><li>two<\/li><\/ul>/);
+  assert.match(html, /<img class="pn-doc__img" src="\/api\/bongos\/page-notes\/images\/12" alt="shot" loading="lazy">/);
+  assert.doesNotMatch(html, /<img[^>]+evil\.example/, 'another site\'s image is left as text');
+  assert.doesNotMatch(html, /<script/);
+  assert.equal((html.match(/<img/g) || []).length, 1);
+});
+
+test('the doc names its page the way the page inventory does', () => {
+  const R = reader();
+  assert.deepEqual(JSON.parse(JSON.stringify(R.page())), { id: 'builders:studio', path: '/studio', title: 'Studio' });
+});
+
+test('colours live in style.css, and the panel and tool are styled there', () => {
+  assert.doesNotMatch(NOTES, /#[0-9a-f]{3,6}\b|rgba?\(/i, 'no colour literal in the panel script');
+  const css = fs.readFileSync(path.join(HALL, 'style.css'), 'utf8');
+  for (const sel of ['.craft-tool {', '.pn {', '.pn__panel {', '.pn__text {', '.pn-doc__img {']) assert.ok(css.includes(sel), sel);
+});