@bongos/core 1.21.92 → 1.21.94

package/tests/github_one_trip.mjs

@@ -0,0 +1,297 @@
+// tests/github_one_trip.mjs — "Connect GitHub in one trip: approving the app goes straight
+// to installing it on the repo, and the checklist ticks itself" (task 1004649).
+//
+// Four layers, DB-free and network-free:
+//   1. modules/provisioning/github-setup.js — each checklist step's state from server facts,
+//      the honest "not yet" states included; the install link; the verify window (PURE).
+//   2. scripts/gds/provision-github-setup.js — the runner's check, asked of GitHub with the
+//      app's OWN key: the creds read back out of a REAL webEnvBody, a JWT that verifies,
+//      installed / not installed / cannot tell, device flow on / off / cannot tell, and the
+//      tick recording only what GitHub confirmed — never a secret in a log line.
+//   3. the REAL projection (githubSetupRead) run into the REAL page renderers (projects.html,
+//      the vm-slice idiom): each server state draws the step the founder should see.
+//   4. the device-flow finding is written down where the next builder will look.
+//
+// Run:  node --test tests/github_one_trip.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GS = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
+const RUN = require(path.join(ROOT, 'scripts', 'gds', 'provision-github-setup.js'));
+const UNITS = require(path.join(ROOT, 'scripts', 'gds', 'provision-units.js'));
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+// ── 1. the checklist from server facts ──────────────────────────────────────
+
+test('each step reads only what the server has seen — the honest "not yet" states included', () => {
+  const none = GS.githubChecklist(null, null);
+  assert.deepEqual(none, { approve: 'todo', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false }, 'never started');
+  assert.equal(GS.githubChecklist('pending', null).approve, 'now', 'waiting for the approval on GitHub');
+  for (const s of ['code_received', 'converting']) {
+    const c = GS.githubChecklist(s, null);
+    assert.equal(c.approve, 'now', `${s}: approved, but no keys placed yet — not ticked`);
+    assert.equal(c.install, 'todo', `${s}: nothing to install before the app is named`);
+  }
+  const placed = GS.githubChecklist('converting', 'mercury-app');
+  assert.deepEqual([placed.approve, placed.install, placed.sign_in, placed.device_flow], ['done', 'now', 'now', 'todo'], 'keys placed: approve ticks, install and sign-in are under way');
+  const signedIn = GS.githubChecklist('done', 'mercury-app');
+  assert.deepEqual([signedIn.install, signedIn.sign_in, signedIn.device_flow, signedIn.connected], ['now', 'done', 'later', false],
+    'sign-in verified is NOT connected: the install has not been confirmed by GitHub');
+  const installed = GS.githubChecklist('done', 'mercury-app', { installedAt: '2026-10-08T10:00:00Z' });
+  assert.equal(installed.connected, true, 'approve + install + sign-in = connected');
+  assert.equal(installed.device_flow, 'later', 'device flow stays optional and never holds "connected" back');
+  assert.equal(GS.githubChecklist('done', 'mercury-app', { installedAt: 'x', deviceFlowAt: 'y' }).device_flow, 'done');
+  // a REPORTED install (the setup_url redirect, spoofable) ticks nothing
+  assert.equal(GS.githubChecklist('done', 'mercury-app', { installReportedAt: '2026-10-08T10:00:00Z' }).install, 'now');
+  // failures: where it stopped
+  assert.equal(GS.githubChecklist('error', null).approve, 'stopped');
+  assert.equal(GS.githubChecklist('expired', null).approve, 'stopped');
+  const signInFailed = GS.githubChecklist('error', 'mercury-app');
+  assert.deepEqual([signInFailed.approve, signInFailed.sign_in], ['done', 'stopped'], 'an app exists; sign-in is where it stopped');
+});
+
+test('the install link names the app and carries the attempt; the repo is strict', () => {
+  assert.equal(GS.installUrlFor({ appSlug: null, state: 'abc' }), null);
+  assert.equal(GS.installUrlFor({ appSlug: 'mercury-app', state: 'ab cd' }), 'https://github.com/apps/mercury-app/installations/new?state=ab%20cd');
+  assert.equal(GS.installUrlFor({ appSlug: 'mercury-app' }), 'https://github.com/apps/mercury-app/installations/new');
+  assert.equal(GS.targetRepo({ target_ref: 'acme/mercury' }), 'acme/mercury');
+  assert.equal(GS.targetRepo({ target_ref: 'acme/mercury.git' }), 'acme/mercury');
+  for (const bad of ['', 'acme', '../x/y', 'a/b/c', 'acme/mer cury', '-acme/x']) assert.equal(GS.targetRepo({ target_ref: bad }), null, bad);
+});
+
+test('the runner checks for a bounded window after the attempt settles, re-opened by an install report', () => {
+  const now = Date.parse('2026-10-08T12:00:00Z');
+  assert.equal(GS.stillVerifying({ resolved_at: '2026-10-08T11:00:00Z' }, {}, now), true);
+  assert.equal(GS.stillVerifying({ resolved_at: '2026-10-08T09:00:00Z' }, {}, now), false);
+  assert.equal(GS.stillVerifying({ resolved_at: '2026-10-08T09:00:00Z' }, { installReportedAt: '2026-10-08T11:30:00Z' }, now), true);
+  assert.equal(GS.stillVerifying(null, {}, now), false);
+});
+
+test('githubSetupRead: one events read since the attempt began; the owner read leaves the state off', async () => {
+  const seen = [];
+  const db = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ event: GS.SETUP_EVENTS.installed, at: '2026-10-08T10:00:00Z' }] }; } };
+  const row = { instance_id: 42, state: 'S1', created_at: '2026-10-08T09:00:00Z', app_slug: 'mercury-app', status: 'done' };
+  const pub = await GS.githubSetupRead(db, { target_ref: 'acme/mercury' }, row, 'done', { now: Date.parse('2026-10-08T10:30:00Z') });
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].sql, /FROM provisioning_events/);
+  assert.deepEqual(seen[0].params, [42, Object.values(GS.SETUP_EVENTS), '2026-10-08T09:00:00Z']);
+  assert.equal(pub.checklist.install, 'done');
+  assert.equal(pub.install_url, null, 'no install link once it is verified');
+  const notYet = await GS.githubSetupRead({ query: async () => ({ rows: [] }) }, {}, row, 'done', { withState: false });
+  assert.equal(notYet.install_url, 'https://github.com/apps/mercury-app/installations/new', 'the owner read never carries the state token');
+  const broken = await GS.githubSetupRead({ query: async () => { throw new Error('db down'); } }, {}, row, 'done');
+  assert.equal(broken.checklist.install, 'now', 'a failed read is "nothing verified yet", never a 500');
+});
+
+// ── 2. the runner's check ───────────────────────────────────────────────────
+
+const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
+const PEM = privateKey.export({ type: 'pkcs1', format: 'pem' });
+const INST = { id: 42, slug: 'mercury', port: 4100, domain: 'mercury.example.com', target_ref: 'acme/mercury', hosting_shape: 'co-tenant' };
+const ENV = UNITS.webEnvBody(INST, { clientId: 'Iv23liABCDEF123456', clientSecret: 's'.repeat(40), appId: 5189633, appPem: PEM });
+
+test('the app creds come back out of the web.env the runner itself writes', () => {
+  const c = RUN.appCredsFromEnv(ENV);
+  assert.equal(c.appId, '5189633');
+  assert.equal(c.clientId, 'Iv23liABCDEF123456');
+  assert.equal(c.pem.trim(), PEM.trim(), 'the one-line pem is restored to real newlines');
+  assert.deepEqual(RUN.appCredsFromEnv(''), { appId: null, pem: null, clientId: null });
+});
+
+test('the app JWT is RS256, signed by the app key, issued by the app id, under ten minutes', () => {
+  const jwt = RUN.appJwt({ appId: 5189633, pem: PEM, nowSec: 1_800_000_000 });
+  const [h, b, s] = jwt.split('.');
+  const ok = crypto.createVerify('RSA-SHA256').update(`${h}.${b}`).verify(publicKey, Buffer.from(s, 'base64url'));
+  assert.equal(ok, true);
+  const body = JSON.parse(Buffer.from(b, 'base64url').toString());
+  assert.equal(body.iss, '5189633');
+  assert.ok(body.exp - body.iat <= 600);
+});
+
+test('installed / not installed / cannot tell — only a 200 with an id is "installed"', async () => {
+  const calls = [];
+  const answer = (status, body) => async (url, opts) => { calls.push({ url, opts }); return { status, ok: status >= 200 && status < 300, json: async () => body }; };
+  assert.equal(await RUN.installedOnRepo({ appId: 1, pem: PEM, repo: 'acme/mercury', fetchImpl: answer(200, { id: 99 }) }), true);
+  assert.equal(calls[0].url, 'https://api.github.com/repos/acme/mercury/installation');
+  assert.match(calls[0].opts.headers.Authorization, /^Bearer [\w-]+\.[\w-]+\.[\w-]+$/, 'asked as the app');
+  assert.equal(await RUN.installedOnRepo({ appId: 1, pem: PEM, repo: 'acme/mercury', fetchImpl: answer(404, {}) }), false);
+  assert.equal(await RUN.installedOnRepo({ appId: 1, pem: PEM, repo: 'acme/mercury', fetchImpl: answer(500, {}) }), null);
+  assert.equal(await RUN.installedOnRepo({ appId: 1, pem: PEM, repo: 'acme/mercury', fetchImpl: async () => { throw new Error('offline'); } }), null);
+});
+
+test('device flow on / off / cannot tell — read from GitHub\'s own answer to a device sign-in start', async () => {
+  const with_ = (body) => async () => ({ status: 200, ok: true, json: async () => body });
+  assert.equal(await RUN.deviceFlowOn({ clientId: 'Iv1', fetchImpl: with_({ device_code: 'dc', user_code: 'AB-CD' }) }), true);
+  assert.equal(await RUN.deviceFlowOn({ clientId: 'Iv1', fetchImpl: with_({ error: 'device_flow_disabled' }) }), false);
+  assert.equal(await RUN.deviceFlowOn({ clientId: 'Iv1', fetchImpl: with_({ error: 'slow_down' }) }), null, 'any other answer is never read as off');
+});
+
+// A fake db that answers the runner's two reads: the attempts in the window, and the facts.
+function fakeDb({ attempts, facts = [] }) {
+  return { query: async (sql) => (/WITH latest AS/.test(sql) ? { rows: attempts } : /FROM provisioning_events/.test(sql) ? { rows: facts } : { rows: [] }) };
+}
+const ATTEMPT = { id: 18, instance_id: 42, created_at: '2026-10-08T09:00:00Z', requested_by: 7, slug: 'mercury', target_ref: 'acme/mercury', hosting_shape: 'co-tenant', instance_status: 'active' };
+
+test('the runner records what GitHub confirmed — and only that — reading the creds on the box', async () => {
+  const events = [], logs = [], cmds = [];
+  const fetchImpl = async (url) => (/\/installation$/.test(url)
+    ? { status: 200, ok: true, json: async () => ({ id: 31337 }) }
+    : { status: 200, ok: true, json: async () => ({ error: 'device_flow_disabled' }) });
+  const out = await RUN.verifyGithubAppSetups({
+    apply: true, privileged: true, log: (m) => logs.push(m), fetchImpl,
+    db: fakeDb({ attempts: [ATTEMPT] }),
+    exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: ENV }; },
+    provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
+  });
+  assert.deepEqual(out, { checked: 1, installed: 1, deviceFlow: 0 });
+  assert.deepEqual(cmds, ['sudo cat /etc/mercury/web.env'], 'the creds are read where the runner placed them');
+  assert.deepEqual(events.map((e) => e.event), ['github-app-installed'], 'device flow off records nothing');
+  assert.match(events[0].detail, /acme\/mercury/);
+  const said = logs.join('\n') + JSON.stringify(events);
+  assert.doesNotMatch(said, /BEGIN RSA|s{40}|Iv23liABCDEF123456/, 'no key, secret or client id ever reaches a log or an event');
+});
+
+test('an attempt already fully verified is skipped; dry-run asks GitHub nothing', async () => {
+  let asked = 0;
+  const deps = {
+    apply: true, log: () => {}, fetchImpl: async () => { asked++; return { status: 200, ok: true, json: async () => ({}) }; },
+    db: fakeDb({ attempts: [ATTEMPT], facts: [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }, { event: 'github-app-device-flow', at: '2026-10-08T10:00:00Z' }] }),
+    exec: () => { throw new Error('must not read the box'); }, provisioning: { recordEvent: async () => { throw new Error('nothing to record'); } },
+  };
+  assert.deepEqual(await RUN.verifyGithubAppSetups(deps), { checked: 0, installed: 0, deviceFlow: 0 });
+  const lines = [];
+  await RUN.verifyGithubAppSetups({ ...deps, apply: false, log: (m) => lines.push(m), db: fakeDb({ attempts: [ATTEMPT] }) });
+  assert.equal(asked, 0);
+  assert.match(lines.join('\n'), /would check the GitHub install \+ device flow for mercury/);
+});
+
+test('the window query takes each project\'s LATEST attempt, past placement, still settling or newly reported', async () => {
+  let sql = '', params = null;
+  await RUN.attemptsToVerify({ query: async (q, p) => { sql = q; params = p; return { rows: [] }; } });
+  assert.match(sql, /DISTINCT ON \(instance_id\)[\s\S]*ORDER BY instance_id, created_at DESC/);
+  assert.match(sql, /l\.app_id IS NOT NULL AND l\.status IN \('done', 'error'\) AND i\.status = 'active'/);
+  assert.match(sql, /LIMIT 20/);
+  assert.deepEqual(params, [GS.VERIFY_WINDOW_MS / 1000, 'github-app-install-reported']);
+  assert.match(fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'provision.js'), 'utf8'), /require\('\.\/provision-github-setup\.js'\)\.verifyGithubAppSetups\(deps\)/, 'it runs on every runner tick, after the conversions');
+});
+
+// ── 3. the real projection into the real renderers ──────────────────────────
+
+const RS = SCRIPT.indexOf('    /* The four GitHub steps of part 03');
+const RE = SCRIPT.indexOf('    var STEP_RENDERERS = {', RS);
+const SS = SCRIPT.indexOf('    /* the checklist the server derived (task 1004649)');
+const SE = SCRIPT.indexOf('    function pollManifest(stateToken) {', SS);
+const PS = SCRIPT.indexOf('    function stepsPaint() {');
+const PE = SCRIPT.indexOf('    (function hopInput()', PS);
+
+test('the regions are findable (a rename must fail loudly)', () => {
+  assert.ok(RS > 0 && RE > RS && SS > 0 && SE > SS && PS > 0 && PE > PS);
+});
+
+function page({ manifest, appSlug = null }) {
+  const sandbox = {
+    live: { manifest, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug, setup: null, installUrl: null, instStatus: 'active', addrReady: true },
+    state: { name: 'Mer<cury', slug: 'mercury', owner: 'acme', repo: 'mercury', step: 2 },
+    manifestStale: false, autoOpenArmed: false,
+    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com',
+    esc: (x) => String(x).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+    GH_ICON: '', manualOauthDetails: () => '', projectPageLink: (t) => t, autoOpenTick: () => '',
+    progressMarkup: (a, b, note) => `<prog>${note}</prog>`, encodeURIComponent, JSON, Array,
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(`${SCRIPT.slice(RS, RE)}\n${SCRIPT.slice(SS, SE)}\n${SCRIPT.slice(PS, PE)}`, sandbox);
+  return sandbox;
+}
+const ROWS = ['renderStepOauthApp', 'renderStepAppInstall', 'renderStepFirstSignIn', 'renderStepDeviceFlow'];
+function draw(sb) {
+  return ROWS.map((f) => vm.runInContext(`${f}()`, sb));
+}
+function cls(li) { return ((li.match(/^<li(?: class="([^"]*)")?/) || [])[1] || '').split(/\s+/).filter(Boolean); }
+
+async function serverSays(status, appSlug, eventRows) {
+  const db = { query: async () => ({ rows: eventRows }) };
+  const row = { instance_id: 42, state: 'S1', created_at: '2026-10-08T09:00:00Z', resolved_at: new Date().toISOString(), app_slug: appSlug };
+  return GS.githubSetupRead(db, { target_ref: 'acme/mercury' }, row, status);
+}
+
+test('the mockup\'s four steps, in its words and order, the typed name escaped', () => {
+  const sb = page({ manifest: null });
+  const rows = draw(sb);
+  const titles = rows.map((li) => (li.match(/<b>([^<]*)<\/b>/) || [])[1]);
+  assert.deepEqual(titles, ['Approve the Mer&lt;cury app on GitHub', 'Install it on your repo', 'Builders can sign in', 'Command-line sign-in is on']);
+  assert.match(rows[0], /data-action="manifest-start"[^>]*>Connect GitHub ↗/, 'one click starts the one trip');
+  assert.equal(SCRIPT.match(/var STEP_ORDER = \[([^\]]*)\]/)[1], "'github-repo', 'oauth-app', 'app-install', 'first-sign-in', 'device-flow', 'enter-hall'", 'drawn in the mockup\'s order');
+});
+
+test('each server state draws the step the founder should see — from the REAL projection', async () => {
+  // keys placed, nothing verified on GitHub yet
+  let sb = page({ manifest: 'converting', appSlug: 'mercury-app' });
+  let d = await serverSays('converting', 'mercury-app', []);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  let rows = draw(sb);
+  assert.deepEqual(rows.map(cls), [['sdone'], [], ['slocked'], ['slocked', 'soptional']]);
+  assert.match(rows[1], /href="https:\/\/github\.com\/apps\/mercury-app\/installations\/new\?state=S1"/, 'the way back to the install, with the attempt');
+  assert.equal(vm.runInContext('stepsPaint.toString().length > 0', sb), true);
+
+  // sign-in verified, install still unconfirmed: NOT connected
+  sb = page({ manifest: 'done', appSlug: 'mercury-app' });
+  d = await serverSays('done', 'mercury-app', []);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  rows = draw(sb);
+  assert.deepEqual(rows.map(cls), [['sdone'], [], ['sdone'], ['soptional']]);
+  assert.match(rows[3], /Optional — turn it on later\./);
+  assert.equal(vm.runInContext('setupOpen()', sb), true, 'the page keeps watching for the install');
+
+  // GitHub confirmed the install to the runner: connected, device flow still optional
+  sb = page({ manifest: 'done', appSlug: 'mercury-app' });
+  d = await serverSays('done', 'mercury-app', [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }]);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  rows = draw(sb);
+  assert.deepEqual(rows.map(cls), [['sdone'], ['sdone'], ['sdone'], ['soptional']]);
+  assert.match(rows[1], /The app is on acme\/mercury/);
+  assert.equal(vm.runInContext('setupOpen()', sb), false);
+  // the part's state line, from these very rows: the optional step does not hold it back
+  const items = rows.map((li) => ({ classList: { contains: (c) => cls(li).includes(c) } }));
+  const ghState = { textContent: '' };
+  sb.$ = (id) => (id === 'humanSteps' ? { children: items } : id === 'ghState' ? ghState : null);
+  sb.manifestInFlight = () => false;
+  vm.runInContext('stepsPaint()', sb);
+  assert.equal(ghState.textContent, 'connected ✓');
+
+  // and once GitHub has device flow on, the fourth ticks too
+  sb = page({ manifest: 'done', appSlug: 'mercury-app' });
+  d = await serverSays('done', 'mercury-app', [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }, { event: 'github-app-device-flow', at: '2026-10-08T10:05:00Z' }]);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  assert.deepEqual(cls(draw(sb)[3]), ['sdone', 'soptional']);
+});
+
+test('seedSetup is change-only, and an install link must be GitHub\'s', () => {
+  const sb = page({ manifest: 'done', appSlug: 'a' });
+  const c = JSON.stringify(GS.githubChecklist('done', 'a'));
+  assert.equal(vm.runInContext(`seedSetup(${c}, 'https://github.com/apps/a/installations/new?state=S')`, sb), true);
+  assert.equal(vm.runInContext(`seedSetup(${c}, 'https://github.com/apps/a/installations/new?state=S')`, sb), false, 'nothing moved, nothing redrawn');
+  assert.equal(vm.runInContext(`seedSetup(${c}, 'https://github.com/apps/a/installations/new')`, sb), false, 'a stateless link never replaces the one carrying the attempt');
+  assert.equal(vm.runInContext('live.installUrl', sb), 'https://github.com/apps/a/installations/new?state=S');
+  const sb2 = page({ manifest: 'done', appSlug: 'a' });
+  vm.runInContext(`seedSetup(${c}, 'javascript:alert(1)')`, sb2);
+  assert.equal(vm.runInContext('live.installUrl', sb2), null);
+  assert.equal(vm.runInContext('seedSetup(null, null)', sb2), false);
+});
+
+// ── 4. the finding is written down ──────────────────────────────────────────
+
+test('the device-flow finding lives in the direction doc, and the code points at it', () => {
+  const doc = fs.readFileSync(path.join(ROOT, 'docs', 'design', 'project-startup-direction.md'), 'utf8');
+  assert.match(doc, /Device flow cannot be switched on for the founder \(spike, task 1004649\)/);
+  assert.match(fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'), 'utf8'), /docs\/design\/project-startup-direction\.md/);
+});