@bongos/core 1.21.69 → 1.21.71

package/src/bongos/routes/feedback.js

@@ -1,110 +1,134 @@
 'use strict';
 
-// src/bongos/routes/feedback.js — POST /api/bongos/feedback (task 1004462).
+// src/bongos/routes/feedback.js — the project's half of `bongos feedback`: a
+// one-time RECEIPT that proves who sent a report (tasks 1004462, 1004591).
 //
-// `bongos feedback "…"` lands here, on the builder's OWN project, with the session
-// they already hold. This route stamps who sent it and which core this project
-// runs, then relays it to the hub's POST /sso/feedback over the hub-federation
-// client credential (ADR 0141) — the channel the activity rollup already uses. So
-// a builder never signs in to cloudbongos.com to report something about Bongos.
+// The report itself goes straight from the builder's CLI to the Cloud Bongos hub,
+// never through this project — so a project with no hub link (self-hosted, or a
+// hosted one provisioned before federation) can still send. What the hub cannot
+// know on its own is WHO sent it. This project can: the builder holds a session
+// here. So the CLI first asks for a receipt naming the signed-in builder and a
+// hash of the text; the hub then calls this project's public receipt URL and
+// files the report only if the project vouches for both. Nothing for the builder
+// to do beyond the session they already have.
 //
-// Only the text the builder typed and version stamps travel. No code, transcript,
-// task or file content from this project is attached.
+// Two routes:
+//   POST /feedback/receipt      — signed-in builder; records { who, sha256, kind }.
+//   GET  /feedback/receipt/:id  — public, single-use; the hub redeems it once.
 //
-// In the CORE, not a module, for the reason core-update.js gives: the hub link is
-// kernel (src/bongos/auth-config.js), and every hosted project must have this door
-// whatever modules it runs. A project with no hub link (self-hosted, or the hub
-// itself) answers 409 not_hub_connected — told, not silently dropped.
+// Receipts live in memory for RECEIPT_TTL_MS: the CLI redeems within seconds, and
+// a restart in between only loses that one report. In the CORE, not a module, for
+// the reason core-update.js gives: every project must have this door.
 
+const crypto = require('node:crypto');
 const express = require('express');
 const { asyncHandler, validateOrRespond } = require('./_helpers');
 const auth = require('../auth');
-const { loadIdpConfig } = require('../auth-config');
-const { userAgent } = require('../../branding');
+const ic = require('../../instance-config');
 
-const MESSAGE_MAX = 4000;
-const HUB_TIMEOUT_MS = 15000;
+const RECEIPT_TTL_MS = 10 * 60 * 1000;
+const RECEIPTS_MAX = 1000;
 
-function safeIdpConfig() {
-  try { return loadIdpConfig(); } catch { return null; }
+// Where reports go: the Bongos maintainers' hub. <PREFIX>_FEEDBACK_HUB overrides
+// it (a test hub, a fork with its own maintainers). A project that IS the hub
+// answers null — the CLI then sends to the project it already talks to.
+const DEFAULT_FEEDBACK_HUB = 'https://cloudbongos.com';
+
+function feedbackHub({ env, isHub } = {}) {
+  const override = ic.resolveEnv('FEEDBACK_HUB', env ? { env } : undefined);
+  if (override) return String(override).replace(/\/+$/, '');
+  let hub = isHub;
+  if (hub === undefined) {
+    try { hub = require('../../modules').isModuleEnabled('platform-identity'); } catch { hub = false; }
+  }
+  return hub ? null : DEFAULT_FEEDBACK_HUB;
 }
 
 function runningCore() {
   try { return require('../../module-api').CORE_VERSION || null; } catch { return null; }
 }
 
-// Hub refusals the builder can act on are passed through by code; anything else
-// is one generic failure, so the hub's internals never leak through this door.
-const PASS_THROUGH = new Set(['membership_required', 'rate_limited', 'feedback_unavailable', 'validation_failed']);
+// makeReceiptStore — issue/redeem with expiry, single use, and a size cap so an
+// abusive signed-in caller cannot grow the map without bound. A full store
+// refuses the NEW receipt (issue → null) rather than evicting a live one, so one
+// noisy builder can never drop another builder's pending report.
+function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIPTS_MAX } = {}) {
+  const rows = new Map(); // id -> { ...receipt, exp }
+  function prune() {
+    const t = now();
+    for (const [id, r] of rows) if (r.exp <= t) rows.delete(id);
+  }
+  return {
+    issue(receipt) {
+      prune();
+      if (rows.size >= max) return null;
+      const id = crypto.randomBytes(18).toString('base64url');
+      rows.set(id, { ...receipt, exp: now() + ttlMs });
+      return id;
+    },
+    redeem(id) {
+      const r = rows.get(id);
+      rows.delete(id);
+      if (!r || r.exp <= now()) return null;
+      const { exp: _exp, ...receipt } = r;
+      return receipt;
+    },
+    _rows: rows,
+  };
+}
 
-async function relayToHub({ idp, builder, message, kind, context, fetchImpl = fetch }) {
-  const res = await fetchImpl(`${idp.origin.replace(/\/+$/, '')}/api/bongos/sso/feedback`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-    body: JSON.stringify({
-      client_id: idp.clientId,
-      client_secret: idp.clientSecret,
-      github_id: builder.github_id,
-      message,
-      kind,
-      context,
-    }),
-    signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
-  });
-  let body = null;
-  try { body = await res.json(); } catch { /* non-JSON answer */ }
-  return { status: res.status, body };
+// The process's one receipt store. Shared, because a receipt is redeemed at the public
+// route below whoever issued it: the CLI's POST /feedback/receipt, or this project's own
+// "Ask for this upgrade" (src/bongos/upgrade-request.js, task 1004595).
+let sharedStore = null;
+function defaultReceiptStore() {
+  if (!sharedStore) sharedStore = makeReceiptStore();
+  return sharedStore;
 }
 
-function buildFeedbackRouter({ idpConfig = safeIdpConfig, fetchImpl = fetch } = {}) {
+function buildFeedbackRouter({ store = defaultReceiptStore(), hub = feedbackHub } = {}) {
   const router = express.Router();
 
-  // rank: any signed-in builder — reporting a problem with Bongos grants nothing
-  // here, and the hub files every report at 'backlog' behind a Metic+ nod.
+  // rank: any signed-in builder — a receipt only says "this builder sent this
+  // text"; it grants nothing here, and the hub files every report behind a nod.
   router.post(
-    '/feedback',
+    '/feedback/receipt',
     auth.requireBuilder,
-    asyncHandler('POST /feedback', async (req, res) => {
+    asyncHandler('POST /feedback/receipt', async (req, res) => {
       if (validateOrRespond(req, res, {
-        message: { required: true, type: 'string', maxLength: MESSAGE_MAX },
+        sha256: { required: true, type: 'string', maxLength: 64 },
         kind: { type: 'string', enum: ['bug', 'idea'] },
-        context: {},
       })) return;
-      const b = req.body || {};
-      const message = b.message.trim();
-      if (!message) return res.fail('message_required', 400);
-      const kind = b.kind || 'bug';
-
-      const idp = idpConfig();
-      if (!idp) return res.fail('not_hub_connected', 409);
-
-      const ctx = b.context && typeof b.context === 'object' ? b.context : {};
-      const context = {
+      const b = req.body;
+      if (!/^[a-f0-9]{64}$/.test(b.sha256)) return res.fail('validation_failed', 400, [{ field: 'sha256', reason: 'not_a_sha256' }]);
+      const receipt = store.issue({
+        github_id: String(req.builder.github_id),
+        github_login: req.builder.github_login || null,
+        sha256: b.sha256,
+        kind: b.kind || 'bug',
         core_version: runningCore(),
-        cli_version: typeof ctx.cli_version === 'string' ? ctx.cli_version.slice(0, 40) : null,
-        os: typeof ctx.os === 'string' ? ctx.os.slice(0, 40) : null,
-      };
-
-      let hub;
-      try {
-        hub = await relayToHub({ idp, builder: req.builder, message, kind, context, fetchImpl });
-      } catch {
-        return res.fail('hub_unreachable', 502);
-      }
-      if (hub.status === 201 && hub.body && hub.body.ok) {
-        const { ok: _ok, ...landing } = hub.body;
-        return res.status(201).json({ ok: true, hub_origin: idp.origin, ...landing });
-      }
-      const err = hub.body && hub.body.error && typeof hub.body.error === 'object' ? hub.body.error : null;
-      if (err && PASS_THROUGH.has(err.code)) {
-        const retry = err.details && err.details.retry_after_seconds;
-        return res.fail(err.code, hub.status, retry ? { retry_after_seconds: retry } : undefined);
-      }
-      return res.fail('hub_refused', 502, { hub_status: hub.status });
-    }, { errorCode: 'feedback_failed', message: false }),
+      });
+      if (!receipt) return res.fail('rate_limited', 429, { retry_after_seconds: Math.ceil(RECEIPT_TTL_MS / 1000) });
+      res.status(201).json({ ok: true, receipt, hub: hub() });
+    }, { errorCode: 'feedback_receipt_failed', message: false }),
   );
 
+  // rank: public — the hub redeems a receipt with no session of its own. The id
+  // is 144 random bits, known only to the CLI that asked for it and the hub it
+  // sent it to, and it works once.
+  router.get('/feedback/receipt/:id', (req, res) => {
+    const id = String(req.params.id || '');
+    const receipt = /^[A-Za-z0-9_-]{16,64}$/.test(id) ? store.redeem(id) : null;
+    res.set('Cache-Control', 'no-store');
+    if (!receipt) return res.fail('receipt_unknown', 404);
+    res.json({ ok: true, ...receipt });
+  });
+
   return router;
 }
 
 module.exports = buildFeedbackRouter;
+module.exports.makeReceiptStore = makeReceiptStore;
+module.exports.defaultReceiptStore = defaultReceiptStore;
+module.exports.feedbackHub = feedbackHub;
+module.exports.DEFAULT_FEEDBACK_HUB = DEFAULT_FEEDBACK_HUB;

package/src/bongos/upgrade-request.js

@@ -0,0 +1,158 @@
+'use strict';
+
+// src/bongos/upgrade-request.js — "Ask for this upgrade" on Settings → Software update
+// (task 1004595).
+//
+// WHY. A project that Cloud Bongos hosts is upgraded by the people who run its server,
+// not by its owner. Its Settings page said "Update ready" and then nothing: no button,
+// no next step (Will, mercury, 2026-10-06, 46 versions behind with nobody told). This
+// file gives that owner one press that reaches the operator, and remembers that it was
+// pressed so the page can say the request is pending.
+//
+// THE CHANNEL IS ONE THAT ALREADY EXISTS: the direct feedback door (task 1004591). The
+// project issues a one-time receipt for the signed-in builder in its OWN receipt store
+// (src/bongos/routes/feedback.js), then posts the request straight to the hub's
+// POST /api/bongos/sso/feedback/direct. The hub redeems the receipt at this project's
+// public URL, so the request lands in the maintainers' backlog attributed to the person
+// who really pressed the button, with no new credential and no new hub route.
+//
+// ONE REQUEST PER TARGET VERSION. Asking again for a version already asked for is
+// answered from the stored row and sends nothing. A different version may be asked for
+// once the cooldown has passed, so a project that falls further behind can say so,
+// without a press per patch release flooding the backlog.
+
+const crypto = require('node:crypto');
+
+const SETTING_KEY = 'software_update.request';
+const COOLDOWN_MS = 24 * 60 * 60 * 1000;
+const HUB_TIMEOUT_MS = 15000;
+
+const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
+const LOGIN_RE = /^[A-Za-z0-9-]{1,39}$/;
+
+// The host this hall answers on, as the hub will need it to redeem the receipt: a bare
+// public DNS name. Anything else (an IP, a port, localhost, a dev name) cannot be
+// reached by the hub, so it is not askable. Mirrors the hub's own projectOrigin check.
+function projectHost(raw) {
+  const host = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) return null;
+  if (/^\d+(\.\d+)+$/.test(host)) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return host;
+}
+
+function hubHostOf(hub) {
+  try { return new URL(String(hub)).host.toLowerCase(); } catch { return null; }
+}
+
+// Is this a project the hub's operator runs? Its door is the hub's, or it answers on a
+// name under the hub's own domain (the same rule the hub uses to call a sender "verified").
+function isOperatorRun({ doorKind, host, hub }) {
+  if (doorKind === 'local' || !hub) return false;
+  if (doorKind === 'hub') return true;
+  const h = hubHostOf(hub);
+  return !!(h && host && (host === h || host.endsWith(`.${h}`)));
+}
+
+// The stored request, or null. A row this file did not write reads as no request.
+function parseStored(row) {
+  if (!row || typeof row.value !== 'string') return null;
+  let v;
+  try { v = JSON.parse(row.value); } catch { return null; }
+  if (!v || !VERSION_RE.test(String(v.version || ''))) return null;
+  const at = Date.parse(v.requested_at);
+  if (!Number.isFinite(at)) return null;
+  return {
+    version: String(v.version),
+    requested_at: new Date(at).toISOString(),
+    by: typeof v.by === 'string' && LOGIN_RE.test(v.by) ? v.by : null,
+  };
+}
+
+// What the page needs: may it offer the button, and what was asked before.
+// `ask_again_after` is when a request for a DIFFERENT version would be taken.
+function askState({ offered, host, doorKind, hub, stored }) {
+  const available = !!offered && isOperatorRun({ doorKind, host, hub }) && !!projectHost(host);
+  const ask = { available, hub_host: hub ? hubHostOf(hub) : null, requested: stored || null, ask_again_after: null };
+  if (stored) ask.ask_again_after = new Date(Date.parse(stored.requested_at) + COOLDOWN_MS).toISOString();
+  return ask;
+}
+
+// The text the operator reads. Its first line becomes the hub task's title.
+function requestMessage({ host, running, wanted, login }) {
+  const who = login && LOGIN_RE.test(login) ? `@${login}` : 'its owner';
+  return [
+    `Upgrade request: ${host} asks for core ${wanted} (it runs ${running || 'an unknown version'})`,
+    '',
+    `${who} pressed "Ask for this upgrade" in Settings, Software update on ${host}.`,
+    'This project cannot upgrade itself: the people who run its server do it.',
+    `Move its core to ${wanted} or newer, or tell them when it will be.`,
+  ].join('\n');
+}
+
+/**
+ * Send one upgrade request, or answer from the stored one. Never throws for an
+ * expected refusal; returns { status, body } for the route to send.
+ *
+ * deps: { hub, issueReceipt(receipt) → id|null, fetchImpl, getSetting, setSetting, now }
+ */
+async function requestUpgrade({ host, running, wanted, builder, doorKind }, deps) {
+  const now = deps.now || Date.now;
+  const hub = deps.hub;
+  const target = projectHost(host);
+  if (!wanted || !VERSION_RE.test(String(wanted))) return { status: 409, body: { error: 'nothing_to_ask', message: 'This project is up to date.' } };
+  if (!target || !isOperatorRun({ doorKind, host: target, hub })) {
+    return { status: 409, body: { error: 'not_operator_run', message: 'This project is not upgraded by an operator, so there is no one to ask.' } };
+  }
+
+  const stored = parseStored(await deps.getSetting(SETTING_KEY));
+  if (stored && stored.version === wanted) return { status: 200, body: { ok: true, already: true, request: stored } };
+  if (stored && now() < Date.parse(stored.requested_at) + COOLDOWN_MS) {
+    const retry = Math.ceil((Date.parse(stored.requested_at) + COOLDOWN_MS - now()) / 1000);
+    return { status: 429, body: { error: 'asked_recently', message: 'This project already asked for an upgrade today. Ask again tomorrow.', retry_after_seconds: retry, request: stored } };
+  }
+
+  const login = builder && typeof builder.github_login === 'string' && LOGIN_RE.test(builder.github_login) ? builder.github_login : null;
+  const message = requestMessage({ host: target, running, wanted, login });
+  const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
+  const receipt = deps.issueReceipt({
+    github_id: String(builder && builder.github_id),
+    github_login: login,
+    sha256,
+    kind: 'bug',
+    core_version: running || null,
+  });
+  if (!receipt) return { status: 429, body: { error: 'rate_limited', message: 'Too many requests just now. Try again in ten minutes.', retry_after_seconds: 600 } };
+
+  let res;
+  try {
+    res = await (deps.fetchImpl || fetch)(`${String(hub).replace(/\/+$/, '')}/api/bongos/sso/feedback/direct`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({ origin: `https://${target}`, receipt, message, kind: 'bug', context: {} }),
+      redirect: 'error',
+      signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
+    });
+  } catch {
+    return { status: 502, body: { error: 'operator_unreachable', message: 'Could not reach the people who run this project. Try again in a few minutes.' } };
+  }
+  if (res.status === 429) return { status: 429, body: { error: 'rate_limited', message: 'Too many requests just now. Try again in an hour.', retry_after_seconds: 3600 } };
+  if (res.status !== 202) {
+    return { status: 502, body: { error: 'operator_unreachable', message: `The request was not taken (HTTP ${res.status}). Try again later.` } };
+  }
+
+  const request = { version: String(wanted), requested_at: new Date(now()).toISOString(), by: login };
+  await deps.setSetting(SETTING_KEY, JSON.stringify(request), builder && builder.id != null ? builder.id : null);
+  return { status: 201, body: { ok: true, already: false, request } };
+}
+
+module.exports = {
+  SETTING_KEY,
+  COOLDOWN_MS,
+  projectHost,
+  isOperatorRun,
+  parseStored,
+  askState,
+  requestMessage,
+  requestUpgrade,
+};

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.69'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.71'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');