@bongos/core 1.21.69 → 1.21.70

package/src/bongos/routes/feedback.js

@@ -1,110 +1,124 @@
 'use strict';
 
-// src/bongos/routes/feedback.js — POST /api/bongos/feedback (task 1004462).
+// src/bongos/routes/feedback.js — the project's half of `bongos feedback`: a
+// one-time RECEIPT that proves who sent a report (tasks 1004462, 1004591).
 //
-// `bongos feedback "…"` lands here, on the builder's OWN project, with the session
-// they already hold. This route stamps who sent it and which core this project
-// runs, then relays it to the hub's POST /sso/feedback over the hub-federation
-// client credential (ADR 0141) — the channel the activity rollup already uses. So
-// a builder never signs in to cloudbongos.com to report something about Bongos.
+// The report itself goes straight from the builder's CLI to the Cloud Bongos hub,
+// never through this project — so a project with no hub link (self-hosted, or a
+// hosted one provisioned before federation) can still send. What the hub cannot
+// know on its own is WHO sent it. This project can: the builder holds a session
+// here. So the CLI first asks for a receipt naming the signed-in builder and a
+// hash of the text; the hub then calls this project's public receipt URL and
+// files the report only if the project vouches for both. Nothing for the builder
+// to do beyond the session they already have.
 //
-// Only the text the builder typed and version stamps travel. No code, transcript,
-// task or file content from this project is attached.
+// Two routes:
+//   POST /feedback/receipt      — signed-in builder; records { who, sha256, kind }.
+//   GET  /feedback/receipt/:id  — public, single-use; the hub redeems it once.
 //
-// In the CORE, not a module, for the reason core-update.js gives: the hub link is
-// kernel (src/bongos/auth-config.js), and every hosted project must have this door
-// whatever modules it runs. A project with no hub link (self-hosted, or the hub
-// itself) answers 409 not_hub_connected — told, not silently dropped.
+// Receipts live in memory for RECEIPT_TTL_MS: the CLI redeems within seconds, and
+// a restart in between only loses that one report. In the CORE, not a module, for
+// the reason core-update.js gives: every project must have this door.
 
+const crypto = require('node:crypto');
 const express = require('express');
 const { asyncHandler, validateOrRespond } = require('./_helpers');
 const auth = require('../auth');
-const { loadIdpConfig } = require('../auth-config');
-const { userAgent } = require('../../branding');
+const ic = require('../../instance-config');
 
-const MESSAGE_MAX = 4000;
-const HUB_TIMEOUT_MS = 15000;
+const RECEIPT_TTL_MS = 10 * 60 * 1000;
+const RECEIPTS_MAX = 1000;
 
-function safeIdpConfig() {
-  try { return loadIdpConfig(); } catch { return null; }
+// Where reports go: the Bongos maintainers' hub. <PREFIX>_FEEDBACK_HUB overrides
+// it (a test hub, a fork with its own maintainers). A project that IS the hub
+// answers null — the CLI then sends to the project it already talks to.
+const DEFAULT_FEEDBACK_HUB = 'https://cloudbongos.com';
+
+function feedbackHub({ env, isHub } = {}) {
+  const override = ic.resolveEnv('FEEDBACK_HUB', env ? { env } : undefined);
+  if (override) return String(override).replace(/\/+$/, '');
+  let hub = isHub;
+  if (hub === undefined) {
+    try { hub = require('../../modules').isModuleEnabled('platform-identity'); } catch { hub = false; }
+  }
+  return hub ? null : DEFAULT_FEEDBACK_HUB;
 }
 
 function runningCore() {
   try { return require('../../module-api').CORE_VERSION || null; } catch { return null; }
 }
 
-// Hub refusals the builder can act on are passed through by code; anything else
-// is one generic failure, so the hub's internals never leak through this door.
-const PASS_THROUGH = new Set(['membership_required', 'rate_limited', 'feedback_unavailable', 'validation_failed']);
-
-async function relayToHub({ idp, builder, message, kind, context, fetchImpl = fetch }) {
-  const res = await fetchImpl(`${idp.origin.replace(/\/+$/, '')}/api/bongos/sso/feedback`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-    body: JSON.stringify({
-      client_id: idp.clientId,
-      client_secret: idp.clientSecret,
-      github_id: builder.github_id,
-      message,
-      kind,
-      context,
-    }),
-    signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
-  });
-  let body = null;
-  try { body = await res.json(); } catch { /* non-JSON answer */ }
-  return { status: res.status, body };
+// makeReceiptStore — issue/redeem with expiry, single use, and a size cap so an
+// abusive signed-in caller cannot grow the map without bound. A full store
+// refuses the NEW receipt (issue → null) rather than evicting a live one, so one
+// noisy builder can never drop another builder's pending report.
+function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIPTS_MAX } = {}) {
+  const rows = new Map(); // id -> { ...receipt, exp }
+  function prune() {
+    const t = now();
+    for (const [id, r] of rows) if (r.exp <= t) rows.delete(id);
+  }
+  return {
+    issue(receipt) {
+      prune();
+      if (rows.size >= max) return null;
+      const id = crypto.randomBytes(18).toString('base64url');
+      rows.set(id, { ...receipt, exp: now() + ttlMs });
+      return id;
+    },
+    redeem(id) {
+      const r = rows.get(id);
+      rows.delete(id);
+      if (!r || r.exp <= now()) return null;
+      const { exp: _exp, ...receipt } = r;
+      return receipt;
+    },
+    _rows: rows,
+  };
 }
 
-function buildFeedbackRouter({ idpConfig = safeIdpConfig, fetchImpl = fetch } = {}) {
+function buildFeedbackRouter({ store = makeReceiptStore(), hub = feedbackHub } = {}) {
   const router = express.Router();
 
-  // rank: any signed-in builder — reporting a problem with Bongos grants nothing
-  // here, and the hub files every report at 'backlog' behind a Metic+ nod.
+  // rank: any signed-in builder — a receipt only says "this builder sent this
+  // text"; it grants nothing here, and the hub files every report behind a nod.
   router.post(
-    '/feedback',
+    '/feedback/receipt',
     auth.requireBuilder,
-    asyncHandler('POST /feedback', async (req, res) => {
+    asyncHandler('POST /feedback/receipt', async (req, res) => {
       if (validateOrRespond(req, res, {
-        message: { required: true, type: 'string', maxLength: MESSAGE_MAX },
+        sha256: { required: true, type: 'string', maxLength: 64 },
         kind: { type: 'string', enum: ['bug', 'idea'] },
-        context: {},
       })) return;
-      const b = req.body || {};
-      const message = b.message.trim();
-      if (!message) return res.fail('message_required', 400);
-      const kind = b.kind || 'bug';
-
-      const idp = idpConfig();
-      if (!idp) return res.fail('not_hub_connected', 409);
-
-      const ctx = b.context && typeof b.context === 'object' ? b.context : {};
-      const context = {
+      const b = req.body;
+      if (!/^[a-f0-9]{64}$/.test(b.sha256)) return res.fail('validation_failed', 400, [{ field: 'sha256', reason: 'not_a_sha256' }]);
+      const receipt = store.issue({
+        github_id: String(req.builder.github_id),
+        github_login: req.builder.github_login || null,
+        sha256: b.sha256,
+        kind: b.kind || 'bug',
         core_version: runningCore(),
-        cli_version: typeof ctx.cli_version === 'string' ? ctx.cli_version.slice(0, 40) : null,
-        os: typeof ctx.os === 'string' ? ctx.os.slice(0, 40) : null,
-      };
-
-      let hub;
-      try {
-        hub = await relayToHub({ idp, builder: req.builder, message, kind, context, fetchImpl });
-      } catch {
-        return res.fail('hub_unreachable', 502);
-      }
-      if (hub.status === 201 && hub.body && hub.body.ok) {
-        const { ok: _ok, ...landing } = hub.body;
-        return res.status(201).json({ ok: true, hub_origin: idp.origin, ...landing });
-      }
-      const err = hub.body && hub.body.error && typeof hub.body.error === 'object' ? hub.body.error : null;
-      if (err && PASS_THROUGH.has(err.code)) {
-        const retry = err.details && err.details.retry_after_seconds;
-        return res.fail(err.code, hub.status, retry ? { retry_after_seconds: retry } : undefined);
-      }
-      return res.fail('hub_refused', 502, { hub_status: hub.status });
-    }, { errorCode: 'feedback_failed', message: false }),
+      });
+      if (!receipt) return res.fail('rate_limited', 429, { retry_after_seconds: Math.ceil(RECEIPT_TTL_MS / 1000) });
+      res.status(201).json({ ok: true, receipt, hub: hub() });
+    }, { errorCode: 'feedback_receipt_failed', message: false }),
   );
 
+  // rank: public — the hub redeems a receipt with no session of its own. The id
+  // is 144 random bits, known only to the CLI that asked for it and the hub it
+  // sent it to, and it works once.
+  router.get('/feedback/receipt/:id', (req, res) => {
+    const id = String(req.params.id || '');
+    const receipt = /^[A-Za-z0-9_-]{16,64}$/.test(id) ? store.redeem(id) : null;
+    res.set('Cache-Control', 'no-store');
+    if (!receipt) return res.fail('receipt_unknown', 404);
+    res.json({ ok: true, ...receipt });
+  });
+
   return router;
 }
 
 module.exports = buildFeedbackRouter;
+module.exports.makeReceiptStore = makeReceiptStore;
+module.exports.feedbackHub = feedbackHub;
+module.exports.DEFAULT_FEEDBACK_HUB = DEFAULT_FEEDBACK_HUB;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.69'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');