@bongos/core 1.21.56 → 1.21.57

package/tests/privacy_matrix.mjs

@@ -153,14 +153,21 @@ function identitySentinels(acct) {
 //   directory  GET /scouting                Recruiter — 'full' | 'name-only' | 'absent'
 //   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
 //   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
+//   guild      GET /guilds/:slug            Anon · Builder · Recruiter · Self — the guild page's PUBLIC
+//                roster (task 1002301; ADR 0336 D4), viewer-independent: 'listed' | 'absent'.
+//                Every fixture account is a member with shown_publicly ON, so the account
+//                predicates alone decide; hide_stats never hides membership (D4 §2)
+//   members    GET /guilds/:slug/members    a fellow Member — the own-scope roster: 'listed' |
+//                'absent'. Joining is consent to be seen BY THE GUILD (D4 §1), so a private
+//                member is listed here and nowhere public; a provisional account is never
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed' },
 };
 
 // ===========================================================================
@@ -243,10 +250,59 @@ function activityScope(sql, params) {
   return String(params[Number(m[1]) - 1]);
 }
 
+// THE GUILDS (task 1002301): one public and one unlisted guild, each with every
+// fixture account as a member and shown_publicly ON — the most permissive guild
+// flag, so the account predicates alone decide each cell. PUB owns both.
+const GUILDS = [
+  { id: '880001', slug: 'mx-guild', name: 'Matrix Guild', description: 'mx-guild-desc', visibility: 'public', created_at: 'T0' },
+  { id: '880002', slug: 'mx-unlisted', name: 'Matrix Unlisted', description: 'mx-unlisted-desc', visibility: 'unlisted', created_at: 'T0' },
+];
+const GUILD_MEMBERS = GUILDS.flatMap((g) => ACCOUNTS.map((a) => ({
+  guild_id: g.id, github_id: a.github_id, membership_kind: a.key === 'PUB' ? 'owner' : 'member', shown_publicly: true, counted_in_totals: true,
+})));
+/** The members-of-a-guild statements: the guild and shown terms consumed here, the rest read as an account filter. */
+function guildRosterFilter(sql, params) {
+  let where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = m\.github_id WHERE (.+?) ORDER BY/, 'guild roster');
+  if (!/\bm\.guild_id = \$1\b/.test(where)) throw new Error(`fake pool: a guild roster with no guild scope — ${where}`);
+  where = where.replace(/\bm\.guild_id = \$1\b/, '');
+  const shownOnly = /\bm\.shown_publicly\b/.test(where);
+  where = where.replace(/\bm\.shown_publicly\b/, '');
+  const byAccount = accountFilter(where, []);
+  return (m) => m.guild_id === String(params[0]) && (!shownOnly || m.shown_publicly) && byAccount(ACCOUNTS.find((a) => a.github_id === m.github_id));
+}
+
 const pool = {
   query: async (text, params = []) => {
     const sql = String(text).replace(/\s+/g, ' ').trim();
 
+    // THE GUILD PAGE's reads. The public guild: its WHERE is read, not assumed.
+    if (/^SELECT id, slug, name, description, created_at FROM platform_identity_guilds WHERE /.test(sql)) {
+      if (!/WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(sql)) throw new Error(`fake pool: the public guild read moved — ${sql}`);
+      const rows = GUILDS.filter((g) => g.slug === String(params[0]) && g.visibility === 'public').map(({ visibility, ...g }) => g);
+      return { rows, rowCount: rows.length };
+    }
+    // ... a member's own row in a guild (the own-scope door).
+    if (/FROM platform_identity_guilds g JOIN platform_identity_guild_members m ON m\.guild_id = g\.id AND m\.github_id = \$2::bigint WHERE lower\(g\.slug\) = \$1$/.test(sql)) {
+      const g = GUILDS.find((x) => x.slug === String(params[0]));
+      const m = g && GUILD_MEMBERS.find((x) => x.guild_id === g.id && x.github_id === String(params[1]));
+      const rows = m ? [{ ...g, ...m, joined_at: 'T2' }] : [];
+      return { rows, rowCount: rows.length };
+    }
+    // ... both rosters: public (shown AND visible) and members' (active).
+    if (/FROM platform_identity_guild_members m JOIN platform_identity_accounts pa/.test(sql)) {
+      // the projection is pinned: a new column here is a new disclosure, and this fails first
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      if (cols !== 'pa.handle, pa.display_name, pa.avatar_url, m.membership_kind') throw new Error(`fake pool: the guild roster selects something new — ${cols}`);
+      const keep = guildRosterFilter(sql, params);
+      const rows = GUILD_MEMBERS.filter(keep).map((m) => {
+        const a = ACCOUNTS.find((x) => x.github_id === m.github_id);
+        return { handle: a.handle, display_name: a.display_name, avatar_url: a.avatar_url, membership_kind: m.membership_kind };
+      });
+      return { rows, rowCount: rows.length };
+    }
+    // ... and the weekly totals: never computed on a read (guild-totals.js); none stored here.
+    if (/FROM platform_identity_guild_totals WHERE guild_id = \$1$/.test(sql)) return { rows: [], rowCount: 0 };
+
     // THE LEADERBOARD's totals: the rollup floor sits on the act CTE's join.
     if (/platform_identity_activity_snapshots/.test(sql)) {
       const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'leaderboard totals');
@@ -346,6 +402,8 @@ const ANON = null;
 const STRANGER = { name: 'Builder', github_id: '7100001', rank: 'xenos', curate: false };
 const RECRUITER = { name: 'Recruiter', github_id: '7100002', rank: 'archon', curate: true };
 const selfOf = (k) => ({ name: 'Self', github_id: ACCT[k].github_id, rank: 'xenos', curate: false });
+// a fellow guild member: PUB's session, which owns both fixture guilds
+const MEMBER = { name: 'Member', github_id: ACCT.PUB.github_id, rank: 'xenos', curate: false };
 
 const moduleApiPath = require.resolve('../src/module-api.js');
 const helpers = require('../src/bongos/routes/_helpers.js');
@@ -413,7 +471,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting']) {
+for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting', 'guilds-public', 'guilds']) {
   app.use('/api/bongos', require(`../modules/platform-identity/routes/${file}.js`)());
 }
 const server = app.listen(0, '127.0.0.1');
@@ -535,6 +593,52 @@ for (const k of KEYS) {
   });
 }
 
+// The guild page's two rosters (task 1002301; ADR 0336 D4). One read per viewer
+// serves every row, so each row's cell is checked against the same bodies.
+const GUILD_PATH = '/api/bongos/guilds/mx-guild';
+const ROSTER_KEYS = ['avatar_url', 'display_name', 'handle', 'membership_kind'];
+const ALL_VIEWERS = () => [ANON, STRANGER, RECRUITER, MEMBER, ...KEYS.map(selfOf)];
+
+test('the guild page’s public roster — the same bytes to Anon, Builder, Recruiter, a Member and every Self; listed or absent per the matrix', async () => {
+  const seen = [];
+  for (const who of ALL_VIEWERS()) seen.push(await get(who, GUILD_PATH));
+  for (const r of seen.slice(1)) {
+    assert.equal(r.status, seen[0].status, `${r.who} got a different status — the public guild read must not vary by viewer (ADR 0336 D4)`);
+    assert.equal(r.text, seen[0].text, `${r.who} got a different body — the public guild read must not vary by viewer (ADR 0336 D4)`);
+  }
+  const [r] = seen;
+  assert.equal(r.status, 200);
+  const listed = new Set(r.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].guild === 'listed', `${k} on the public roster: expected ${MATRIX[k].guild}`);
+  assert.equal(r.json.size, r.json.members.length, 'size is the roster’s own length — never a "+N more" (ADR 0336 D4)');
+  for (const m of r.json.members) assert.deepEqual(Object.keys(m).sort(), ROSTER_KEYS, 'handle, name, avatar, kind — never a GitHub id or login');
+});
+
+test('the guild members’ roster — a fellow member sees every active member, private ones included; Anon is refused', async () => {
+  const r = await get(MEMBER, `${GUILD_PATH}/members`);
+  assert.equal(r.status, 200);
+  const listed = new Set(r.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].members === 'listed', `${k} on the members’ roster: expected ${MATRIX[k].members}`);
+  assert.equal(r.json.count, r.json.members.length);
+  for (const m of r.json.members) assert.deepEqual(Object.keys(m).sort(), ROSTER_KEYS);
+  assert.deepEqual(Object.keys(r.json.you).sort(), ['counted_in_totals', 'membership_kind', 'shown_publicly'], 'the reader’s own two switches, and nobody else’s');
+  assert.equal((await get(ANON, `${GUILD_PATH}/members`)).status, 401);
+});
+
+test('an unlisted guild’s public read is a 404 to everyone, its own members included, byte-identical to a slug nobody holds; members reach it through the own-scope door', async () => {
+  const none = await get(ANON, '/api/bongos/guilds/mx-nobody');
+  assert.equal(none.status, 404);
+  for (const who of ALL_VIEWERS()) {
+    const r = await get(who, '/api/bongos/guilds/mx-unlisted');
+    assert.equal(r.status, 404, `${r.who}: an unlisted guild has no public existence (ADR 0336 D4)`);
+    assert.equal(r.text.replaceAll('mx-unlisted', 'S'), none.text.replaceAll('mx-nobody', 'S'), `${r.who}: no existence oracle`);
+  }
+  const own = await get(MEMBER, '/api/bongos/guilds/mx-unlisted/members');
+  assert.equal(own.status, 200);
+  const listed = new Set(own.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].members === 'listed', `${k} on the unlisted guild’s members’ roster`);
+});
+
 test('the sliver’s key lists are D3’s, transcribed: handle, name, avatar, disciplines, a recent-activity boolean — or the first three', () => {
   // The cells above compare a response to the MODULE's lists; this pins those
   // lists to the spec, so a sixth key added to the module cannot pass with them.
@@ -594,6 +698,10 @@ test('the recruiting directory — the recruiter sees the full and name-only tie
 // ===========================================================================
 
 const isOwnRead = (r, a) => r.whoId === a.github_id && r.path === '/api/bongos/me/cross-project';
+// The one place ADR 0336 D4 lets a private member be named: their own guild's
+// members' roster, read by a fellow member — joining is consent to be seen BY THE
+// GUILD, never by the world. A provisional account is not on it (accountActiveSql).
+const isFellowMemberRead = (r) => r.who === 'Member' && /^\/api\/bongos\/guilds\/[^/?]+\/members$/.test(r.path);
 // What a response DISCLOSES: its body minus the fields that only echo the
 // caller's own request back (search's `query` and `discipline`). A discipline
 // the caller typed into the URL is not the server revealing it; the results
@@ -608,7 +716,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);
@@ -630,21 +738,25 @@ test('hide_stats beats everything: no hidden account’s numbers reach anyone bu
   assert.ok(SEEN.some((r) => r.who === 'Anon' && r.text.includes(String(ROLLUP[ACCT.PUB.github_id].credits))), 'a shown record must reach Anon, or absence above is vacuous');
 });
 
-test('provisional and private (not discoverable) are absent from every cross-project surface, for every viewer but Self', () => {
+test('provisional and private (not discoverable) are absent from every cross-project surface, for every viewer but Self — a private member’s own guild aside', () => {
   for (const k of ['PROV', 'PRIV']) {
     const a = ACCT[k];
-    for (const r of SEEN.filter((x) => !isOwnRead(x, a) && !x.path.endsWith(`/profiles/${a.handle}`) && !x.path.endsWith(`/scouting/${a.handle}`))) {
+    const ownGuild = (x) => k === 'PRIV' && isFellowMemberRead(x);
+    for (const r of SEEN.filter((x) => !isOwnRead(x, a) && !ownGuild(x) && !x.path.endsWith(`/profiles/${a.handle}`) && !x.path.endsWith(`/scouting/${a.handle}`))) {
       for (const s of identitySentinels(a)) assert.ok(!disclosed(r).includes(s), `${k}'s "${s}" reached ${r.who} through GET ${r.path}`);
     }
   }
 });
 
-test('private · discoverable reaches the recruiter’s sliver and nowhere else', () => {
+test('private · discoverable reaches the recruiter’s sliver and, as a member, its own guilds’ members’ rosters — nowhere else', () => {
   for (const k of ['PRIVD', 'PRIVDH']) {
     const a = ACCT[k];
     const leaks = SEEN.filter((r) => !isOwnRead(r, a) && identitySentinels(a).some((s) => disclosed(r).includes(s)));
-    assert.deepEqual(leaks.map((r) => `${r.who} ${r.path}`), [`Recruiter /api/bongos/scouting/${a.handle}`],
-      `${k} may be named only by the sliver, to the recruiter (D3)`);
+    assert.deepEqual([...new Set(leaks.map((r) => `${r.who} ${r.path}`))].sort(), [
+      'Member /api/bongos/guilds/mx-guild/members',
+      'Member /api/bongos/guilds/mx-unlisted/members',
+      `Recruiter /api/bongos/scouting/${a.handle}`,
+    ], `${k} may be named only by the sliver, to the recruiter (D3), and to its fellow guild members (ADR 0336 D4)`);
   }
 });
 

package/tests/render_check.mjs

@@ -24,8 +24,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   // sky-data.js is shared by the two doors of one page (task 1004232): /thinking and /goal-map.
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
-  // the account page links the hub's sheet too since task 1004259
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'projects.states.json']);
+  // the account page links the hub's sheet too since task 1004259, and the guild page since task 1002301
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'guild.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {

package/tests/ui_design_kit.mjs

@@ -34,7 +34,7 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/projects-dns-pending.states.json', 'modules/public-landing/public/projects-hall-live.states.json','modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/projects-dns-pending.states.json', 'modules/public-landing/public/projects-hall-live.states.json','modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/public-landing/public/guild.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
@@ -43,14 +43,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/guild.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json', 'modules/public-landing/public/guild.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }