@bongos/core 1.21.82 → 1.21.83

package/tests/hub_invite_badge.mjs

@@ -0,0 +1,204 @@
+// tests/hub_invite_badge.mjs — what is waiting on you, said where you already look
+// (task 1004646; the owner's report of 2026-10-08 that invitations "aren't obvious").
+//
+// The REAL assets/invite-badge.js, executed in a node:vm under a small DOM stub: the
+// count on the identity chip and on the profile band's Invitations item, the line on
+// the mine view, nothing at all when nothing waits or nobody is signed in, and no
+// read at all on a child instance (its Invitations item is stripped as apex-only).
+// Then the pages: every page that wears the hub's bar loads it.
+//
+// Run:  node --test tests/hub_invite_badge.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const BADGE = fs.readFileSync(path.join(LANDING, 'assets', 'invite-badge.js'), 'utf8');
+
+// ── a DOM just big enough for this file ──────────────────────────────────────
+
+class El {
+  constructor(tag, attrs = {}) {
+    this.tagName = tag.toUpperCase();
+    this.children = [];
+    this.parentNode = null;
+    this.attrs = { ...attrs };
+    this.className = attrs.class || '';
+    this.id = attrs.id || '';
+    this._text = '';
+  }
+  get firstChild() { return this.children[0] || null; }
+  get lastChild() { return this.children[this.children.length - 1] || null; }
+  get nextSibling() { const k = this.parentNode.children; return k[k.indexOf(this) + 1] || null; }
+  set textContent(v) { this.children = []; this._text = String(v); }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(''); }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  set href(v) { this.attrs.href = v; }
+  get href() { return this.attrs.href; }
+  appendChild(c) { return this.insertBefore(c, null); }
+  insertBefore(c, ref) {
+    if (c.parentNode) c.remove();
+    c.parentNode = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  remove() { const p = this.parentNode; if (p) p.children.splice(p.children.indexOf(this), 1); this.parentNode = null; }
+  *walk() { for (const c of this.children) { yield c; yield* c.walk(); } }
+  matches(sel) {
+    if (sel === '.invBadge') return this.className.split(' ').includes('invBadge');
+    if (sel === '.hero') return this.className === 'hero';
+    if (sel === 'svg.cv') return this.tagName === 'SVG' && this.className === 'cv';
+    if (sel === 'a[href="/invitations"]') return this.tagName === 'A' && this.attrs.href === '/invitations';
+    throw new Error(`stub selector: ${sel}`);
+  }
+  querySelector(sel) { for (const n of this.walk()) if (n.matches(sel)) return n; return null; }
+}
+
+function world({ child = false, mineView = false } = {}) {
+  const body = new El('body');
+  const who = body.appendChild(new El('button', { id: 'who', class: 'trig who' }));
+  who.appendChild(new El('span', { class: 'whoName' }));
+  who.appendChild(new El('svg', { class: 'cv' }));
+  const band = body.appendChild(new El('div', { id: 'menuProfile' }));
+  const mine = band.appendChild(new El('a', { href: '/projects?view=mine' }));
+  mine.textContent = 'My projects';
+  let inv = null;
+  if (!child) { inv = band.appendChild(new El('a', { href: '/invitations', class: 'bandT' })); inv.textContent = 'Invitations'; }
+  let section = null;
+  if (mineView) {
+    const view = body.appendChild(new El('section', { id: 'view-mine' }));
+    section = view.appendChild(new El('div', { class: 'hero' }));
+    section.appendChild(new El('h1')).textContent = 'Your projects';
+    section.appendChild(new El('p', { class: 'lede' }));
+    view.appendChild(new El('ul', { id: 'projectsList' }));
+  }
+  const byId = (id) => { for (const n of body.walk()) if (n.id === id) return n; return null; };
+  const document = { getElementById: byId, createElement: (t) => new El(t) };
+  return { body, who, inv, section, document, byId };
+}
+
+async function run(w, answers) {
+  const asked = [];
+  const fetch = async (url) => {
+    asked.push(url);
+    const a = answers[url];
+    if (a === undefined) return { ok: false, status: 404, json: async () => ({}) };
+    if (a instanceof Error) throw a;
+    return { ok: a.status === undefined, status: a.status || 200, json: async () => a };
+  };
+  const window = {};
+  vm.runInNewContext(BADGE, { window, document: w.document, fetch, Promise });
+  await window.InviteBadge.refresh();
+  return { asked, window };
+}
+
+const INVITES = '/api/bongos/my-projects/invites';
+const GUILDS = '/api/bongos/me/guild-requests';
+const badgeOf = (el) => el && el.querySelector('.invBadge');
+
+// ── the count ────────────────────────────────────────────────────────────────
+
+test('project invites and guild asks add up, on the chip and on the Invitations item', async () => {
+  const w = world();
+  await run(w, {
+    [INVITES]: { invites: [{ client_id: 'a' }, { client_id: 'b' }] },
+    [GUILDS]: { incoming: [{ id: '1' }], owner_incoming: [{ id: '2' }], outgoing: [{ id: '3' }] },
+  });
+  for (const host of [w.who, w.inv]) {
+    const b = badgeOf(host);
+    assert.ok(b, 'a badge is drawn');
+    assert.equal(b.firstChild.textContent, '4', 'two project invites, a guild invite and a request to a guild you own');
+    assert.equal(b.firstChild.getAttribute('aria-hidden'), 'true');
+    assert.equal(b.lastChild.className, 'vh');
+    assert.equal(b.lastChild.textContent, ', 4 invitations waiting', 'a screen reader hears what the number means');
+  }
+  assert.equal(w.who.children.indexOf(badgeOf(w.who)), 1, 'on the chip, before its chevron');
+});
+
+test('one invitation reads in the singular, and a large count is capped', async () => {
+  let w = world();
+  await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.inv).lastChild.textContent, ', 1 invitation waiting');
+  w = world();
+  await run(w, { [INVITES]: { invites: Array.from({ length: 120 }, () => ({})) }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.who).firstChild.textContent, '99+');
+});
+
+test('the mine view says it in a line that links to the invitations page', async () => {
+  const w = world({ mineView: true });
+  await run(w, { [INVITES]: { invites: [{}, {}] }, [GUILDS]: {} });
+  const p = w.byId('mineInvitesWaiting');
+  assert.ok(p, 'the line is drawn');
+  assert.equal(w.section.children[2], p, 'at the top of the view, under its heading and lede — not below a long list');
+  assert.equal(p.firstChild.tagName, 'A');
+  assert.equal(p.firstChild.href, '/invitations');
+  assert.equal(p.textContent, 'You have 2 invitations waiting →');
+});
+
+test('nothing waiting, signed out, or a failed read: nothing is drawn', async () => {
+  for (const answers of [
+    { [INVITES]: { invites: [] }, [GUILDS]: { incoming: [], owner_incoming: [] } },
+    { [INVITES]: { status: 401 }, [GUILDS]: { status: 401 } },
+    { [INVITES]: new Error('offline'), [GUILDS]: new Error('offline') },
+  ]) {
+    const w = world({ mineView: true });
+    await run(w, answers);
+    assert.equal(badgeOf(w.who), null);
+    assert.equal(badgeOf(w.inv), null);
+    assert.equal(w.byId('mineInvitesWaiting'), null);
+  }
+});
+
+test('a refresh after an answer takes the badge and the line away again', async () => {
+  const w = world({ mineView: true });
+  const answers = { [INVITES]: { invites: [{}] }, [GUILDS]: {} };
+  const { window } = await run(w, answers);
+  assert.ok(badgeOf(w.who));
+  window.InviteBadge.paint(0);
+  assert.equal(badgeOf(w.who), null);
+  assert.equal(badgeOf(w.inv), null);
+  assert.equal(w.byId('mineInvitesWaiting'), null);
+});
+
+test('a child instance, with no Invitations item, reads nothing', async () => {
+  const w = world({ child: true });
+  const { asked } = await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.deepEqual(asked, [], 'the hub-only routes are never asked');
+  assert.equal(badgeOf(w.who), null);
+});
+
+test('the file builds nodes only and makes only its two reads', () => {
+  assert.doesNotMatch(BADGE, /innerHTML|insertAdjacentHTML|outerHTML/);
+  const calls = [...BADGE.matchAll(/readCount\('([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(calls, ['/my-projects/invites', '/me/guild-requests']);
+});
+
+// ── the pages ────────────────────────────────────────────────────────────────
+
+test('every page that wears the hub bar loads it once, before the Artist review tag', () => {
+  for (const page of ['projects', 'account', 'invitations', 'guild', 'privacy', 'terms', 'contact']) {
+    const html = fs.readFileSync(path.join(LANDING, `${page}.html`), 'utf8');
+    const tags = html.match(/<script src="\/assets\/invite-badge\.js"><\/script>/g) || [];
+    assert.equal(tags.length, 1, `${page}: one tag`);
+    assert.ok(html.indexOf(tags[0]) < html.lastIndexOf('<script src="/assets/artist-review.js"'), `${page}: before the review button`);
+  }
+});
+
+test('the hub page repaints the count after it rebuilds the chip, and the invitations page after an answer', () => {
+  const hub = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+  assert.match(hub, /renderWho\(\);\r?\n[^\n]*\r?\n\s*if \(window\.InviteBadge\) window\.InviteBadge\.refresh\(\);/);
+  const inv = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8');
+  assert.equal((inv.match(/recount\(\);/g) || []).length, 4, 'a decline, a guild decline, a guild accept and a request accepted');
+});
+
+test('the badge is the accent with its own ink, the .btn pairing', () => {
+  const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
+  assert.match(css, /\.invBadge\{[^}]*background:var\(--accent\);color:var\(--accent-on\);/);
+});

package/tests/hub_invite_notices.mjs

@@ -55,6 +55,8 @@ const pool = {
     }
     if (/^\s*INSERT INTO platform_identity_project_memberships/.test(sql)) return { rows: [{ id: '1', membership_kind: 'pending' }] };
     if (/^\s*DELETE FROM platform_identity_project_memberships/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*INSERT INTO platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*DELETE FROM platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 0, rows: [] };
     throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
   },
 };
@@ -119,13 +121,15 @@ test('clear drops ONLY a pending row on the calling project', async () => {
   assert.equal(res.status, 200);
   assert.deepEqual(res.body, { ok: true });
   const w = writes();
-  assert.equal(w.length, 1);
-  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
+  assert.equal(w.length, 2, 'the parked notice under the login, then the pending row on the account');
+  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_parked_invite_notices WHERE client_id = \$1 AND login_lower = \$2/);
+  assert.deepEqual(w[0].params, ['mercury', 'octo']);
+  assert.match(w[1].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
     'a rescind can never remove someone who has signed in');
-  assert.deepEqual(w[0].params, ['mercury', '4242']);
+  assert.deepEqual(w[1].params, ['mercury', '4242']);
 });
 
-test('a login with no hub account writes nothing — and the answer is byte-identical', async () => {
+test('a login with no hub account is PARKED by login — and the answer is byte-identical (task 1004646)', async () => {
   // The project must not learn from this route which GitHub logins have platform accounts.
   for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
     calls = [];
@@ -133,9 +137,60 @@ test('a login with no hub account writes nothing — and the answer is byte-iden
     const unknown = await notice(route, { github_login: 'nobody-here' });
     assert.deepEqual(unknown, known, `${route}: same status, same body`);
   }
+  // Before task 1004646 this wrote nothing, so a new invitee — no account until they sign
+  // in to a project through the hub — never saw the invite. Now it waits under the login.
   calls = [];
-  await notice('/sso/invites/notify', { github_login: 'nobody-here' });
-  assert.equal(writes().length, 0);
+  await notice('/sso/invites/notify', { github_login: '@Nobody-Here' });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /^\s*INSERT INTO platform_identity_parked_invite_notices \(client_id, login_lower\)/);
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, login_lower\) DO UPDATE SET noted_at = now\(\)/, 'a re-invite restarts its 30 days in place');
+  assert.deepEqual(w[0].params, ['mercury', 'nobody-here'], 'the calling project, and the login folded: no @, lower case');
+  assert.equal(w.filter((x) => /project_memberships/.test(x.sql)).length, 0, 'no membership row for a login with no account');
+});
+
+test('the invitations read lists a parked notice for whoever signs in with that login', async () => {
+  const seen = [];
+  const readPool = {
+    async query(text, params = []) {
+      const sql = String(text);
+      seen.push({ sql, params });
+      if (/FROM platform_identity_project_memberships m\s+LEFT JOIN/.test(sql)) {
+        return { rows: [{ client_id: 'mercury', invited_at: 't2', project_name: 'Mercury', project_origin: 'https://mercury.test' }] };
+      }
+      if (/FROM platform_identity_parked_invite_notices n/.test(sql)) {
+        return { rows: [
+          { client_id: 'mercury', invited_at: 't1', project_name: 'Mercury', project_origin: 'https://mercury.test' },
+          { client_id: 'venus', invited_at: 't0', project_name: 'Venus', project_origin: 'https://venus.test' },
+        ] };
+      }
+      throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
+    },
+  };
+  const out = await inviteNotices.listInvitesForBuilder({ githubId: '4242', githubLogin: 'Octo' }, { pool: readPool });
+  assert.deepEqual(out.map((r) => r.client_id), ['mercury', 'venus'], 'one row per project: the pending row wins over its parked twin');
+  const parked = seen.find((c) => /parked_invite_notices/.test(c.sql));
+  assert.deepEqual(parked.params, ['octo', 30, '4242'], 'keyed on the SESSION login, folded; the 30 days; the session account');
+  assert.match(parked.sql, /n\.noted_at > now\(\) - make_interval\(days => \$2\)/, 'a lapsed invite is not shown (ADR 0356)');
+  assert.match(parked.sql, /NOT EXISTS \([\s\S]*m\.github_id = \$3 AND m\.membership_kind <> 'pending'\)/,
+    'a project the reader already builds on is not listed: signing in there accepted it');
+});
+
+test('a decline drops the parked notice too, keyed on the session login', async () => {
+  const seen = [];
+  const p = { async query(text, params) { seen.push({ sql: String(text), params }); return { rowCount: 1, rows: [] }; } };
+  const out = await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: 'Octo' }, { pool: p });
+  assert.deepEqual(out, { removed: true });
+  assert.deepEqual(seen[0].params, ['venus', 'octo']);
+  assert.deepEqual(await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: '' }, { pool: p }), { removed: false });
+  assert.equal(seen.length, 1, 'no login, no statement');
+});
+
+test('the invitations routes read and decline through the parked notices', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/my-projects.js'), 'utf8');
+  assert.match(src, /inviteNotices\.listInvitesForBuilder\(\s*\{ githubId: req\.builder\.github_id, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /inviteNotices\.removeParkedInvite\(\{ clientId, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /if \(!out\.removed && !parked\.removed\) return res\.fail\('no_pending_invite', 404\)/);
 });
 
 test('only an authenticated, active, credentialed project may speak — and writes nothing otherwise', async () => {

package/tests/landing_legal_pages.mjs

@@ -207,7 +207,7 @@ for (const p of PAGES) {
     const styles = [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
     assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
     // then the Artist review button's loader (task 1004499), the page's last tag
-    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
+    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<script src="\/assets\/invite-badge\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'the shared bar and its waiting count (task 1004646), after the markup they drive');
     assert.doesNotMatch(html, /<script>/, 'and no inline copy of the bands');
     assert.match(html, /<a data-link-hall href="\{\{buildersOrigin\}\}">Builders' hall<\/a><\/nav><\/footer>/, 'the hall keeps a door in the footer row now the bar has no Hall pill, as on /account');
   });