@bongos/core 1.21.63 → 1.21.64

package/tests/watch_applications_queue.mjs

@@ -93,7 +93,8 @@ async function boot(opts = {}) {
     rows = { pending: WAITING, invited: ADMITTED, dismissed: DECLINED },
     rank = 'archon',
     queueStatus = null,          // non-200 for the queue read (403 seals it)
-    patchResult = null,          // a scripted answer for PATCH /access-requests/:id
+    patchResult = null,          // a scripted answer for PATCH /access-requests/:id (or a function of the id)
+    hub = null,                  // the hub origin OTB.hubOrigin() answers (task 1002304); null = no hub
     search = '',                 // the page's query string (?invite=<login>, task 1002818)
   } = opts;
 
@@ -114,7 +115,9 @@ async function boot(opts = {}) {
         return ok({ requests: rows[status] || [] });
       }
       if (method === 'PATCH' && route.startsWith('/access-requests/')) {
-        return patchResult || ok({ ok: true, request: { id: route.split('/').pop() } });
+        const id = route.split('/').pop();
+        const scripted = typeof patchResult === 'function' ? patchResult(id) : patchResult;
+        return scripted || ok({ ok: true, request: { id } });
       }
       if (method === 'POST' && route === '/access-requests/invite') return ok({ ok: true });
       // Every other panel on this page loads independently and degrades on its
@@ -175,6 +178,7 @@ async function boot(opts = {}) {
       fmtDate: (iso) => String(iso).slice(0, 10),
       rankLabel: (r) => String(r),
       toast: (m) => toasts.push(m),
+      hubOrigin: () => hub,
     },
     OTBKit: kit,
     OTBBranding: { currencyLabel: () => 'Credits' },
@@ -522,4 +526,110 @@ await test('?invite= that is not a GitHub username fills nothing', async () => {
   assert.equal(at.documentObj.getElementById('gate-invite-login').value, 'octo', 'a pasted @ is dropped, as the form itself does');
 });
 
+// ===========================================================================
+// A guild's applicants, together (task 1002304, R28; ADR 0365 D5)
+// ===========================================================================
+//
+// The hub labels an applicant who applied WITH their guild, and core passes the
+// label through as `guild` beside `profile` (tests/application_lifecycle.mjs
+// proves that half). What a reviewer sees is asserted here: the rows gathered
+// under the guild's name, "Invite all" as N ordinary invites, and the queue
+// exactly as it was when no row carries a guild.
+
+const LANTERN = { slug: 'lantern-works', name: 'Lantern Works' };
+const guildRow = (id, login, guild, over = {}) => ({
+  id, github_login: login, display_name: null, note: null, status: 'pending',
+  created_at: '2026-09-03T10:00:00Z', resolved_at: null, vouched: true, resolved_by_login: null,
+  profile: null, guild, ...over,
+});
+const GUILD_QUEUE = [
+  guildRow('21', 'ada', LANTERN),
+  guildRow('22', 'kel', LANTERN),
+  guildRow('23', 'fox', { slug: null, name: 'Night Shift' }),
+  WAITING[1],
+];
+const groupsOf = (h) => h.gate().querySelectorAll('section').filter((s) => String(s.className).split(/\s+/).includes('ov-group'));
+const groupNamed = (h, name) => groupsOf(h).find((g) => g.querySelector('.ov-group__name').textContent === name);
+const rowIdsIn = (el) => el.querySelectorAll('li').map((r) => r.getAttribute('data-req-id'));
+
+await test('applicants who applied with a guild are gathered under its name, the rest on their own', async () => {
+  const h = await boot({ rows: { pending: GUILD_QUEUE, invited: [], dismissed: [] } });
+  const lantern = groupNamed(h, 'Lantern Works');
+  assert.ok(lantern, 'the guild has a head of its own');
+  assert.deepEqual(rowIdsIn(lantern), ['21', '22'], 'both members, in the server order');
+  assert.equal(lantern.querySelector('.ov-group__n').textContent, '2');
+  assert.deepEqual(rowIdsIn(groupNamed(h, 'Night Shift')), ['23'], 'an unlisted guild is named too');
+  assert.deepEqual(rowIdsIn(groupNamed(h, 'On their own')), ['8'], 'a row with no guild stays out of every guild');
+  assert.equal(h.rows().length, 4, 'grouping moves rows, it never drops one');
+});
+
+await test('no row carries a guild (an older hub, no hub): the queue is exactly the list it was', async () => {
+  const h = await boot();
+  assert.equal(groupsOf(h).length, 0, 'no group heads at all when there is nothing to group');
+  assert.equal(h.gate().querySelectorAll('ul').filter((u) => u.className === 'ov-rows').length, 1);
+});
+
+await test('an UNVOUCHED row naming a guild is not filed under it — the label is the vouch’s to give', async () => {
+  const impostor = guildRow('31', 'mallory', LANTERN, { vouched: false });
+  const h = await boot({ rows: { pending: [guildRow('21', 'ada', LANTERN), impostor], invited: [], dismissed: [] } });
+  assert.deepEqual(rowIdsIn(groupNamed(h, 'Lantern Works')), ['21']);
+  assert.deepEqual(rowIdsIn(groupNamed(h, 'On their own')), ['31']);
+});
+
+await test('a grouped row keeps its own pill and its own two decisions (ADR 0016)', async () => {
+  const h = await boot({ rows: { pending: GUILD_QUEUE, invited: [], dismissed: [] } });
+  const verbs = h.rowFor('21').querySelectorAll('[data-gate-action]').map((b) => b.getAttribute('data-gate-action'));
+  assert.deepEqual(verbs, ['invited', 'dismissed']);
+  assert.match(h.rowFor('21').querySelector('.fact-pill').textContent, /vouched/i);
+});
+
+await test('"Invite all" is N ordinary invites — one PATCH per waiting member, then one re-read', async () => {
+  const h = await boot({ rows: { pending: GUILD_QUEUE, invited: [], dismissed: [] } });
+  const btn = groupNamed(h, 'Lantern Works').querySelector('[data-gate-bulk]');
+  assert.ok(btn, 'a guild of two offers Invite all');
+  assert.match(btn.textContent, /Invite all 2/);
+  const reads = h.queueReads().length;
+  btn.fire('click', {});
+  await h.settle();
+  assert.deepEqual(h.patches().map((p) => p.path).sort(),
+    ['/api/bongos/access-requests/21', '/api/bongos/access-requests/22'], 'each member, and nobody else');
+  for (const p of h.patches()) assert.deepEqual(plain(p.body), { status: 'invited' }, 'the very write the row button sends');
+  assert.equal(h.queueReads().length, reads + 1, 'the queue is re-read once, after every invite settled');
+  assert.match(h.toasts.at(-1), /Invited all 2/);
+});
+
+await test('one refused invite does not strand the rest, and the toast says how many landed', async () => {
+  const h = await boot({
+    rows: { pending: GUILD_QUEUE, invited: [], dismissed: [] },
+    patchResult: (id) => (id === '22' ? fail(409, 'already_member', 'They have already signed in.') : null),
+  });
+  groupNamed(h, 'Lantern Works').querySelector('[data-gate-bulk]').fire('click', {});
+  await h.settle();
+  assert.equal(h.patches().length, 2, 'both invites were sent');
+  assert.match(h.toasts.at(-1), /Invited 1 of 2/);
+  assert.match(h.toasts.at(-1), /already signed in/, 'the server sentence, not [object Object]');
+});
+
+await test('a lone member has no "Invite all", and the decided views offer no bulk move', async () => {
+  const h = await boot({ rows: { pending: GUILD_QUEUE, invited: GUILD_QUEUE.map((r) => ({ ...r, status: 'invited' })), dismissed: [] } });
+  assert.equal(groupNamed(h, 'Night Shift').querySelector('[data-gate-bulk]'), null, 'one applicant already has their own Invite');
+  await h.switchView('invited');
+  assert.ok(groupNamed(h, 'Lantern Works'), 'the history is still grouped by guild');
+  assert.equal(h.gate().querySelector('[data-gate-bulk]'), null, 'a mass rescind is not a gesture this queue makes');
+});
+
+await test('the guild name links to its hub page only when it has one, and is always escaped', async () => {
+  const hostile = { slug: 'lantern-works', name: '<img src=x onerror=alert(1)>Lantern' };
+  const rows = [guildRow('21', 'ada', hostile), guildRow('23', 'fox', { slug: null, name: 'Night Shift' })];
+  const linked = await boot({ hub: 'https://hub.example', rows: { pending: rows, invited: [], dismissed: [] } });
+  const a = linked.gate().querySelectorAll('a').find((x) => String(x.className).includes('gate-guild__link'));
+  assert.ok(a, 'a public guild links to its page on the hub');
+  assert.equal(a.getAttribute('href'), 'https://hub.example/g/lantern-works');
+  assert.equal(linked.gate().querySelectorAll('img').length, 0, 'a guild name is user text on a page an Archon reads');
+  assert.equal(groupNamed(linked, 'Night Shift').querySelectorAll('a').length, 0, 'an unlisted guild has no page to open');
+  const noHub = await boot({ rows: { pending: rows, invited: [], dismissed: [] } });
+  assert.equal(noHub.gate().querySelectorAll('a').filter((x) => String(x.className).includes('gate-guild__link')).length, 0,
+    'no hub, no link — never a same-host URL claiming to be the hub');
+});
+
 summary();