@bongos/core 1.21.94 → 1.21.96

package/tests/github_org_account.mjs

@@ -0,0 +1,378 @@
+// tests/github_org_account.mjs — a personal or an organisation GitHub account for the
+// project's repo and its sign-in app (task 1004651).
+//
+// Before: the page always posted `{}` to mint the app, so the server's org support was
+// dead and every app landed on the founder's personal account; and the new repo could only
+// be made on the personal account, so an organisation-owned project needed the manual
+// "create it yourself" fallback.
+//
+// What this pins:
+//   1. the personal path is UNCHANGED: the page posts `{}` to mint the app and `{name}` to
+//      make the repo, and GitHub is asked for /settings/apps/new and POST /user/repos;
+//   2. choosing an organisation builds the org manifest URL and creates the repo with
+//      POST /orgs/{org}/repos, and the app's settings link follows the organisation;
+//   3. an organisation the founder does not own is shown with the reason and cannot be
+//      picked, and the page refuses to start a trip for it;
+//   4. a bad organisation name is refused by the server before it reaches GitHub;
+//   5. GitHub's org refusals never come back as a 403 (the page reads that as "sign in").
+//
+// The whole path runs for real: the REAL routes (core GitHub router + provisioning mint
+// route), over HTTP, with GitHub faked at the fetch boundary, feeding the REAL page code
+// (sliced out of projects.html and run in a vm). DB-free: the token read and the
+// provisioning data-access fns are stubbed on their cached modules.
+//
+// Run:  node --test tests/github_org_account.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.BUILDER_SECRET_KEY = process.env.BUILDER_SECRET_KEY || 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// CRLF on a Windows checkout — a vm cannot run a slice with stray \r in it
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+// ── fake GitHub, at the fetch boundary ──────────────────────────────────────────────
+const realFetch = globalThis.fetch;
+let gh = {};            // path → (init) => [status, body]
+const ghCalls = [];
+function ghAnswer(url, init = {}) {
+  const u = new URL(url);
+  const key = `${(init.method || 'GET').toUpperCase()} ${u.pathname}`;
+  ghCalls.push({ key, url, body: init.body ? JSON.parse(init.body) : null });
+  const h = gh[key];
+  const [status, body] = h ? h(init) : [404, { message: 'Not Found' }];
+  return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+}
+globalThis.fetch = async (url, init) => (String(url).startsWith('https://api.github.com/') ? ghAnswer(String(url), init) : realFetch(url, init));
+
+// ── the signed-in founder and their stored repo token ───────────────────────────────
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+db.getGithubToken = async () => ({ token: 'tok', scope: 'read:user,repo' });
+db.deleteGithubToken = async () => {};
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'founder' }; next(); };
+const api = require(path.join(ROOT, 'src/module-api.js'));
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'founder' }; next(); };
+
+// ── the provisioning world: one project, its attempts recorded ──────────────────────
+const provisioning = require(path.join(ROOT, 'modules/provisioning/provisioning.js'));
+let targetRef = 'founder/mercury';
+const events = [];
+provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 7, slug: 'mercury', domain: 'mercury.example.com', target_ref: targetRef, status: 'requested' });
+provisioning.createOAuthManifest = async (_db, row) => ({ id: 99, ...row });
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+const branding = require(path.join(ROOT, 'src/branding.js'));
+const realBranding = branding.branding;
+branding.branding = () => ({ ...realBranding(), identity: { ...(realBranding().identity || {}), productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://cloudbongos.com' } });
+const GS = require(path.join(ROOT, 'modules/provisioning/github-setup.js'));
+const githubRepos = require(path.join(ROOT, 'src/bongos/github-repos.js'));
+
+const express = require('express');
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+const provisioningRoutes = require(path.join(ROOT, 'modules/provisioning/routes/provisioning.js'));
+let server, origin;
+before(async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use('/api/bongos', buildGithubRouter());
+  app.use('/api/bongos', provisioningRoutes());
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  origin = `http://127.0.0.1:${server.address().port}`;
+});
+after(() => { server.close(); globalThis.fetch = realFetch; });
+
+// GitHub's answers for a founder who owns acme-studio and is only a member of bigcorp
+function memberships() {
+  return {
+    'GET /user/memberships/orgs': () => [200, [
+      { role: 'member', state: 'active', organization: { login: 'bigcorp' } },
+      { role: 'admin', state: 'active', organization: { login: 'acme-studio' } },
+    ]],
+  };
+}
+
+// ── the page code, sliced (each boundary asserted below) ────────────────────────────
+function region(startMark, endMark) {
+  const s = SCRIPT.indexOf(startMark);
+  const e = s < 0 ? -1 : SCRIPT.indexOf(endMark, s);
+  return s > 0 && e > s ? SCRIPT.slice(s, e) : null;
+}
+const PICKER = region("    /* ── whose GitHub account: mine or an organisation's (task 1004651) ──", "    var repoPick = acctPicker('ra', {");
+const ENSURE_REPO = region('    function ensureFreshRepo() {', "    $('doCreate').addEventListener('click'");
+const NOTE_ORG = region("    /* the organisation the server says this attempt's app is on: change-only */", '    function startManifest(btn) {');
+const START = region('    function startManifest(btn) {', '    /* the "start again" offer once a wait has clearly gone wrong');
+const SETTINGS = region('    /* the organisation that owns the app, when the founder made it on one (task 1004651) */', '    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow');
+
+test('the page regions are still findable (a rename must fail loudly, not test nothing)', () => {
+  for (const [name, r] of Object.entries({ PICKER, ENSURE_REPO, NOTE_ORG, START, SETTINGS })) assert.ok(r, `${name} region not found`);
+  assert.match(PICKER, /function acctPicker\(p, opts\)/);
+  assert.doesNotMatch(PICKER, /innerHTML/, 'organisation names are DOM text, never markup');
+});
+
+// A miniature DOM: just what the picker, the repo create and the mint touch.
+class El {
+  constructor(id, tag = 'div') { this.id = id; this.tagName = tag; this.hidden = false; this.textContent = ''; this.className = ''; this.children = []; this._v = ''; this.listeners = {}; this.disabled = false; }
+  addEventListener(ev, fn) { (this.listeners[ev] = this.listeners[ev] || []).push(fn); }
+  fire(ev, extra = {}) { (this.listeners[ev] || []).forEach((fn) => fn({ preventDefault() {}, ...extra })); }
+  focus() { this.focused = true; }
+  appendChild(c) { this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); }
+  get firstChild() { return this.children[0] || null; }
+  get value() { return this._v; }
+  set value(v) {
+    // a select takes only a value one of its options has, as a browser does
+    if (this.tagName === 'select') this._v = this.children.some((o) => o.value === v) ? v : '';
+    else this._v = v;
+  }
+  submit() { this.submitted = true; }
+  remove() {}
+}
+function opt(value) { const o = new El(null, 'option'); o.value = value; return o; }
+
+function page({ state = {}, live = {} } = {}) {
+  const els = {};
+  const $ = (id) => {
+    if (!els[id]) {
+      const tag = /(Sel|Org)$/.test(id) ? 'select' : 'div';
+      els[id] = new El(id, tag);
+      if (/Sel$/.test(id)) { els[id].children.push(opt('personal'), opt('org')); els[id]._v = 'personal'; }
+    }
+    return els[id];
+  };
+  const posted = [];
+  const forms = [];
+  const sandbox = {
+    API: '/api/bongos', $, JSON, String, Promise, encodeURIComponent, Error,
+    document: {
+      body: { appendChild() {} },
+      createElement: (tag) => { const e = new El(null, tag); if (tag === 'form') forms.push(e); return e; },
+    },
+    window: { open: () => ({ close() {} }), location: { assign() {} } },
+    fetch: (p, init) => { posted.push({ p, init }); return realFetch(origin + p, { method: (init && init.method) || 'GET', headers: init && init.headers, body: init && init.body }); },
+    state: { repo: 'mercury', mode: 'greenfield', owner: 'founder', ...state },
+    live: { manifest: null, manifestMsg: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, ...live },
+    repoAccess: true, instanceId: 42, me: { github_login: 'founder' },
+    hopForRepoAccess: () => false, syncHome() {}, saveDraft() {},
+    rememberManifest() {}, renderSteps() {}, pollManifest() {},
+  };
+  sandbox.manifestStartedAt = 0; sandbox.manifestStale = false;
+  vm.createContext(sandbox);
+  vm.runInContext([PICKER, ENSURE_REPO, NOTE_ORG, START, SETTINGS, "var appPick = acctPicker('aa', { needsOwner: true });"].join('\n'), sandbox);
+  return { sb: sandbox, els, posted, forms, settle: () => new Promise((r) => setTimeout(r, 60)) };
+}
+async function settled(p, n = 6) { for (let i = 0; i < n; i++) await p.settle(); }
+
+// ── 1. the personal path is unchanged ───────────────────────────────────────────────
+test('personal: the page mints with an empty body, and GitHub is asked for the personal app page', async () => {
+  gh = memberships(); events.length = 0;
+  const p = page();
+  p.sb.appPick.load(null);
+  const btn = new El('btn');
+  p.sb.startManifest(btn);
+  await settled(p);
+  const mint = p.posted.find((x) => /\/github-app$/.test(x.p));
+  assert.equal(mint.init.body, '{}', 'byte-for-byte what the page always sent');
+  assert.equal(p.forms.length, 1);
+  assert.match(p.forms[0].action, /^https:\/\/github\.com\/settings\/apps\/new\?state=[0-9a-f]{64}$/);
+  assert.ok(!events.some((e) => e.event === GS.SETUP_EVENTS.appOrg), 'no organisation is recorded for a personal app');
+  assert.ok(!p.posted.some((x) => /\/github\/orgs/.test(x.p)), 'GitHub is not even asked for organisations');
+});
+
+test('personal: the new repo is made with {name} and POST /user/repos, as before', async () => {
+  gh = { 'POST /user/repos': () => [201, { full_name: 'founder/mercury', html_url: 'https://github.com/founder/mercury' }] };
+  ghCalls.length = 0;
+  const p = page();
+  await p.sb.ensureFreshRepo();
+  const sent = p.posted.find((x) => x.p === '/api/bongos/github/repos');
+  assert.equal(sent.init.body, JSON.stringify({ name: 'mercury' }));
+  assert.deepEqual(ghCalls.map((c) => c.key), ['POST /user/repos']);
+  assert.deepEqual(ghCalls[0].body, { name: 'mercury', private: true, auto_init: false });
+  assert.equal(p.sb.state.owner, 'founder');
+});
+
+// ── 2. an organisation ──────────────────────────────────────────────────────────────
+test('organisation: listed from GitHub; one the founder only belongs to is shown with the reason and cannot be picked', async () => {
+  gh = memberships();
+  const p = page();
+  p.sb.appPick.load(null);
+  p.els.aaSel.value = 'org'; p.els.aaSel.fire('change');
+  await settled(p);
+  const opts = p.els.aaOrg.children.map((o) => ({ v: o.value, t: o.textContent, off: o.disabled }));
+  assert.deepEqual(opts, [
+    { v: 'acme-studio', t: 'acme-studio', off: false },
+    { v: 'bigcorp', t: 'bigcorp (you’re a member, not an owner)', off: true },
+    { v: '__other', t: 'Another organisation…', off: false },
+  ]);
+  assert.equal(p.els.aaOrg.value, 'acme-studio', 'the one they own is picked');
+  assert.equal(p.els.aaOrgField.hidden, false);
+  // a refused one forced in (an old browser ignoring disabled) still cannot go ahead
+  p.els.aaOrg._v = 'bigcorp'; p.els.aaOrg.fire('change');
+  assert.equal(p.sb.appPick.value().ok, false);
+  assert.match(p.els.aaNote.textContent, /member of bigcorp, not an owner/);
+  const btn = new El('btn');
+  p.sb.startManifest(btn);
+  await settled(p, 2);
+  assert.ok(!p.posted.some((x) => /\/github-app$/.test(x.p)), 'no link is minted for an organisation they cannot make apps on');
+});
+
+test('organisation: the app is made on it — the org manifest URL, the org recorded, its settings linked there', async () => {
+  gh = memberships(); events.length = 0;
+  const p = page();
+  p.sb.appPick.load('acme-studio');
+  await settled(p);
+  assert.equal(p.sb.appPick.value().org, 'acme-studio');
+  p.sb.startManifest(new El('btn'));
+  await settled(p);
+  const mint = p.posted.find((x) => /\/github-app$/.test(x.p));
+  assert.deepEqual(JSON.parse(mint.init.body), { account: 'org', org: 'acme-studio' });
+  assert.match(p.forms[0].action, /^https:\/\/github\.com\/organizations\/acme-studio\/settings\/apps\/new\?state=[0-9a-f]{64}$/);
+  assert.deepEqual(events.filter((e) => e.event === GS.SETUP_EVENTS.appOrg).map((e) => e.detail), ['acme-studio']);
+  // the page now knows whose app it is, and links its settings under the organisation
+  p.sb.live.appSlug = 'mercury-app';
+  assert.equal(vm.runInContext('appSettingsUrl()', p.sb), 'https://github.com/organizations/acme-studio/settings/apps/mercury-app');
+  p.sb.live.appOrg = null;
+  assert.equal(vm.runInContext('appSettingsUrl()', p.sb), 'https://github.com/settings/apps/mercury-app', 'and under the founder for a personal app');
+});
+
+test('organisation: the new repo is made under it with POST /orgs/{org}/repos, and the project points at it', async () => {
+  gh = { 'POST /orgs/acme-studio/repos': () => [201, { full_name: 'acme-studio/mercury', html_url: 'https://github.com/acme-studio/mercury' }] };
+  ghCalls.length = 0;
+  const p = page({ state: { repoAcct: 'org', repoOrg: 'acme-studio' } });
+  await p.sb.ensureFreshRepo();
+  assert.deepEqual(ghCalls.map((c) => c.key), ['POST /orgs/acme-studio/repos']);
+  assert.deepEqual(ghCalls[0].body, { name: 'mercury', private: true, auto_init: false });
+  assert.equal(p.sb.state.owner, 'acme-studio');
+  assert.equal(p.sb.state.repoUrl, 'https://github.com/acme-studio/mercury');
+  assert.equal(p.sb.state.repoAutoCreated, true);
+});
+
+test('organisation: GitHub refusing the org repo comes back with its reason, never as "sign in again"', async () => {
+  const cases = [
+    [{ message: 'Although you appear to have the correct authorization credentials, the `acme-studio` organization has enabled OAuth App access restrictions' }, 'org_app_restricted', /Third-party access/],
+    [{ message: 'You need admin access to the organization before adding a repository to it.' }, 'org_forbidden', /didn't let your account|didn’t let your account/],
+  ];
+  for (const [body, code, words] of cases) {
+    gh = { 'POST /orgs/acme-studio/repos': () => [403, body] };
+    const res = await realFetch(`${origin}/api/bongos/github/repos`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'mercury', org: 'acme-studio' }) });
+    const j = await res.json();
+    assert.equal(res.status, 409, code);
+    assert.equal(j.error.code, code);
+    assert.match(j.error.message, words);
+    // the page takes the founder to the Code row with that reason, not to a sign-in hop
+    const p = page({ state: { repoAcct: 'org', repoOrg: 'acme-studio' } });
+    let hopped = false; p.sb.hopForRepoAccess = () => { hopped = true; return true; };
+    await assert.rejects(() => p.sb.ensureFreshRepo(), (e) => e.gotoHome === true && e.homeMsg === j.error.message);
+    assert.equal(hopped, false);
+  }
+});
+
+// ── 3. when GitHub will not show the founder's memberships ──────────────────────────
+test('typed name: GitHub hides the memberships, so the founder types it and it is checked', async () => {
+  gh = {
+    'GET /user/memberships/orgs': () => [403, { message: 'requires read:org' }],
+    'GET /user/repos': () => [403, {}],
+    'GET /user/memberships/orgs/acme-studio': () => [403, { message: 'requires read:org' }],
+    'GET /orgs/acme-studio': () => [200, { login: 'acme-studio', type: 'Organization' }],
+    'GET /orgs/someone': () => [200, { login: 'someone', type: 'User' }],
+  };
+  const p = page();
+  p.sb.appPick.load('');
+  await settled(p);
+  assert.deepEqual(p.els.aaOrg.children.map((o) => o.value), ['__other']);
+  assert.equal(p.els.aaTyped.hidden, false);
+  assert.match(p.els.aaNote.textContent, /didn’t show us your organisations/);
+  assert.equal(p.sb.appPick.value().ok, false, 'nothing to go ahead with until it is checked');
+  p.els.aaName.value = 'acme-studio'; p.els.aaCheck.fire('click');
+  await settled(p);
+  const v = p.sb.appPick.value();
+  assert.equal(v.org, 'acme-studio');
+  assert.equal(v.ok, true, 'an organisation GitHub did not give a role for is offered, said as such');
+  assert.match(p.els.aaNote.textContent, /didn't tell us your role in acme-studio/);
+  // a personal account's login is not an organisation
+  p.els.aaName.value = 'someone'; p.els.aaCheck.fire('click');
+  await settled(p);
+  assert.equal(p.sb.appPick.value().ok, false);
+  assert.match(p.els.aaNote.textContent, /an organisation called someone/);
+});
+
+// ── 4. bad names never reach GitHub ─────────────────────────────────────────────────
+test('bad organisation names are refused by the server before GitHub is asked', async () => {
+  gh = {}; ghCalls.length = 0;
+  for (const bad of ['-acme', 'acme-', 'ac--me', 'a/b', 'acme studio', 'x'.repeat(40), '../etc']) {
+    const mint = await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org', org: bad }) });
+    assert.equal(mint.status, 400, `mint: ${bad}`);
+    const repo = await realFetch(`${origin}/api/bongos/github/repos`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'mercury', org: bad }) });
+    assert.equal(repo.status, 400, `repo: ${bad}`);
+  }
+  const check = await realFetch(`${origin}/api/bongos/github/orgs/${encodeURIComponent('ac--me')}`);
+  assert.equal(check.status, 400);
+  assert.deepEqual(ghCalls, [], 'GitHub was never called with any of them');
+  for (const bad of ['-acme', 'ac--me', 'acme_', '']) assert.equal(githubRepos.validGithubLogin(bad), false, bad);
+  for (const ok of ['a', 'acme-studio', 'A1-b2', 'x'.repeat(39)]) assert.equal(githubRepos.validGithubLogin(ok), true, ok);
+});
+
+test('mint: an explicit organisation choice never falls back to the personal account unseen', async () => {
+  targetRef = 'founder_x/mercury';   // an owner that is not a login, and nothing typed
+  try {
+    const res = await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org' }) });
+    assert.equal(res.status, 400);
+    assert.equal((await res.json()).error.code, 'org_required');
+  } finally { targetRef = 'founder/mercury'; }
+  // with no org typed, account 'org' still means the repo's own organisation, as before
+  targetRef = 'acme-studio/mercury';
+  try {
+    const j = await (await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org' }) })).json();
+    assert.equal(j.account, 'org');
+    assert.match(j.post_url, /^https:\/\/github\.com\/organizations\/acme-studio\/settings\/apps\/new\?state=/);
+  } finally { targetRef = 'founder/mercury'; }
+});
+
+// ── 5. the helpers, at unit altitude ────────────────────────────────────────────────
+test('listUserOrgs: roles from the memberships; else the organisations the repos sit in, roles unknown', async () => {
+  gh = { 'GET /user/memberships/orgs': () => [200, [{ role: 'admin', state: 'pending', organization: { login: 'newco' } }, { role: 'admin', state: 'active', organization: { login: 'bad name' } }]] };
+  let out = await githubRepos.listUserOrgs('tok');
+  assert.equal(out.listed, 'memberships');
+  assert.deepEqual(out.orgs.map((o) => [o.login, o.can_create_apps]), [['newco', false]], 'a malformed login is dropped; a pending invite cannot');
+  assert.match(out.orgs[0].reason, /invitation to newco is still waiting/);
+  gh = {
+    'GET /user/memberships/orgs': () => [403, {}],
+    'GET /user/repos': () => [200, [
+      { owner: { login: 'Zeta', type: 'Organization' } }, { owner: { login: 'founder', type: 'User' } },
+      { owner: { login: 'alpha', type: 'Organization' } }, { owner: { login: 'zeta', type: 'Organization' } },
+    ]],
+  };
+  out = await githubRepos.listUserOrgs('tok');
+  assert.equal(out.listed, 'repos');
+  assert.deepEqual(out.orgs.map((o) => [o.login, o.can_create_apps]), [['alpha', null], ['Zeta', null]]);
+  gh = { 'GET /user/memberships/orgs': () => [403, {}], 'GET /user/repos': () => [500, {}] };
+  assert.deepEqual(await githubRepos.listUserOrgs('tok'), { orgs: [], listed: 'none' });
+});
+
+test('getOrgAccess: the role when GitHub gives it, unknown when it only proves the org exists, missing otherwise', async () => {
+  gh = { 'GET /user/memberships/orgs/acme-studio': () => [200, { role: 'admin', state: 'active', organization: { login: 'Acme-Studio' } }] };
+  assert.deepEqual(await githubRepos.getOrgAccess('tok', { org: 'acme-studio' }), { login: 'Acme-Studio', role: 'admin', can_create_apps: true, reason: null });
+  gh = { 'GET /user/memberships/orgs/ghost': () => [404, {}], 'GET /orgs/ghost': () => [404, {}] };
+  await assert.rejects(() => githubRepos.getOrgAccess('tok', { org: 'ghost' }), (e) => e.code === 'org_not_found');
+  await assert.rejects(() => githubRepos.getOrgAccess('tok', { org: 'a--b' }), (e) => e.code === 'bad_org');
+});
+
+test('github-setup: the organisation recorded at the mint rides the checklist read as app_org', async () => {
+  const row = { instance_id: 42, state: 'S1', created_at: '2026-10-08T09:00:00Z', app_slug: 'mercury-app' };
+  const said = await GS.githubSetupRead({ query: async () => ({ rows: [{ event: GS.SETUP_EVENTS.appOrg, at: '2026-10-08T09:00:01Z', detail: 'acme-studio' }] }) }, {}, row, 'done');
+  assert.equal(said.app_org, 'acme-studio');
+  const bad = await GS.githubSetupRead({ query: async () => ({ rows: [{ event: GS.SETUP_EVENTS.appOrg, at: '2026-10-08T09:00:01Z', detail: '<script>' }] }) }, {}, row, 'done');
+  assert.equal(bad.app_org, null, 'a recorded value that is not a login never reaches a link');
+  const none = await GS.githubSetupRead({ query: async () => ({ rows: [] }) }, {}, row, 'done');
+  assert.equal(none.app_org, null, 'nothing recorded = the founder’s own account');
+});

package/tests/projects_hub.mjs

@@ -355,8 +355,12 @@ test('C8 — the wizard polls stop dead off the new view, like the sky off the m
   // guard — merged unguarded they would poll a hidden view for up to 33
   // minutes. Both ticks must consult the same gate the sky consults.
   assert.match(SCRIPT, /function wizPollActive\(\)/, 'the wizard needs its own stage guard');
-  assert.match(SCRIPT, /!document\.hidden && currentView === 'new'/,
-    'the guard is hidden-tab aware and view-scoped');
+  assert.match(SCRIPT, /function wizPollActive\(\) \{\s*return currentView === 'new';\s*\}/,
+    'the guard is view-scoped');
+  // a HIDDEN tab slows the wizard's polls instead of stopping them (task 1004650): that
+  // is exactly when the founder is on GitHub. tests/github_handback_any_device.mjs runs it.
+  assert.match(SCRIPT, /return document\.hidden \? Math\.max\(ms, HIDDEN_POLL_MS\) : ms;/,
+    'a hidden tab keeps checking at the slow pace');
   const gatedTicks = (SCRIPT.match(/if \(!wizPollActive\(\)\)/g) || []).length;
   assert.ok(gatedTicks >= 2, `both wizard ticks (progress + manifest) must check the guard, found ${gatedTicks}`);
   assert.match(SCRIPT, /if \(v === 'new'\) wizard\.enter\(focus\); else wizard\.leave\(\);/,

package/tests/provisioning_callback_page.mjs

@@ -50,8 +50,9 @@ test('the hand-back variant escapes the title + domain it interpolates', () => {
   assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
   assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
   // it IS the hand-back variant (task 1004548): the way back + the config block the client script reads
-  assert.match(html, /id="back" href="\/projects\?view=new"/);
-  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/projects\?view=new"\}/);
+  // the way back is the return route, which names the project on the server (task 1004650)
+  assert.ok(html.includes('id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE"'));
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/api\/bongos\/provisioning\/github-app\/return\?state=GOODSTATE"\}/);
 });
 
 test('the message variant escapes the title but passes server-authored body HTML through', () => {

package/tests/provisioning_github_app_routes.mjs

@@ -108,7 +108,11 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('good state → 200 text/html one-trip page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub app created/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   // task 1004649: GitHub's half of the approval is done — the SAME tab goes on to the install
   t('says the next step is installing it on the repo', /Next, install it on your repo/.test(html));
-  t('carries a plain way back to the project (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my project/.test(html));
+  // task 1004650: the way back is the return route, which names the project on the server
+  t('carries a plain way back to the project (works without script)', html.includes('<a class="btn" id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE">Back to my project'));
+  // the script's config is the one the page SERVED, not a copy (task 1004650)
+  const servedCfg = JSON.parse((html.match(/window\.__CB_SETUP__=(\{[^<]*?\});/) || [])[1] || '{}');
+  t('the served config sends the founder to the return route, never to a bare create page', servedCfg.back === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(servedCfg));
   t('no progress stepper or countdown left on the page', !/id="steps"/.test(html) && !/Placing credentials/.test(html) && !/location\.href=target/.test(html));
 
   // Run the served INSTALL script (not a copy): it polls the real status shape and goes on.
@@ -116,11 +120,11 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('the one-trip page ships its client script', typeof installScript === 'string' && /installations|install_url/.test(installScript));
   async function runInstall(statuses, repoAnswer) {
     const vm = await import('node:vm');
-    const back = { href: '/projects?view=new' }, note = { textContent: '' };
+    const back = { href: '' }, note = { textContent: '' };
     const timers = [], fetched = [];
     const calls = { replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      __CB_SETUP__: servedCfg,
       document: { getElementById: (id) => (id === 'back' ? back : id === 'note' ? note : null) },
       location: { replace: (u) => { calls.replaced = u; } },
       setTimeout: (fn) => { timers.push(fn); return timers.length; },
@@ -154,9 +158,9 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   const plain = await runInstall([named], null);
   t('a repo GitHub will not describe (private) falls back to the plain install page', plain.replaced === 'https://github.com/apps/mercury-app/installations/new?state=GOODSTATE', JSON.stringify(plain));
   const doneAlready = await runInstall([{ ...named, checklist: { ...named.checklist, install: 'done' } }], null);
-  t('already installed → straight back to the checklist', doneAlready.replaced === '/projects?view=new#ghstate=GOODSTATE', JSON.stringify(doneAlready));
+  t('already installed → straight back to the checklist', doneAlready.replaced === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(doneAlready));
   const stopped = await runInstall([{ ...named, status: 'error' }], null);
-  t('a stopped attempt → back to the checklist, which says what stopped', stopped.replaced === '/projects?view=new#ghstate=GOODSTATE', JSON.stringify(stopped));
+  t('a stopped attempt → back to the checklist, which says what stopped', stopped.replaced === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(stopped));
 }
 
 console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task 1004649):');
@@ -181,16 +185,17 @@ console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task
   // the plain hand-back page (now the setup_url's) still behaves as before (task 1004548)
   const callbackPage = require(`${ROOT}/modules/provisioning/routes/callback-page.js`).callbackPage;
   const html = callbackPage({ ok: true, title: 'Installed on GitHub', state: 'GOODSTATE', domain: 'mercury.example.com' });
-  t('carries a plain "back to my checklist" link (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my checklist/.test(html));
+  t('carries a plain "back to my checklist" link (works without script)', html.includes('<a class="btn" id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE">Back to my checklist'));
+  const servedCfg = JSON.parse((html.match(/window\.__CB_SETUP__=(\{[^<]*?\});/) || [])[1] || '{}');
   const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
   t('the hand-back page ships the client script', typeof script === 'string' && script.length > 100);
   async function runCallback({ opener }) {
     const vm = await import('node:vm');
-    const back = { href: '/projects?view=new' };
+    const back = { href: '' };
     const timers = [];
     const calls = { close: 0, focusOpener: 0, replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      __CB_SETUP__: servedCfg,
       opener: opener ? { closed: false, focus: () => { calls.focusOpener++; } } : null,
       close: () => { calls.close++; },
       document: { getElementById: (id) => (id === 'back' ? back : null) },
@@ -204,12 +209,12 @@ console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task
     while (timers.length) timers.shift()();
     return { ...calls, replacedBeforeTimer, backHref: back.href };
   }
-  const want = '/projects?view=new#ghstate=GOODSTATE';
+  const want = '/api/bongos/provisioning/github-app/return?state=GOODSTATE';
   const popup = await runCallback({ opener: true });
   t('as the wizard’s pop-up it focuses the checklist tab and closes itself', popup.focusOpener === 1 && popup.close === 1 && popup.replacedBeforeTimer === null, JSON.stringify(popup));
   t('…and if the browser refuses the close, the pop-up becomes the checklist', popup.replaced === want, JSON.stringify(popup));
   const sameTab = await runCallback({ opener: false });
-  t('as a same-tab return it goes straight back to the checklist, carrying the attempt in the fragment', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
+  t('as a same-tab return it goes straight back through the return route, carrying the attempt', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);

package/tests/wizard_draft_resume.mjs

@@ -247,6 +247,10 @@ function runEnter({ draftStep, focus = false, resumeIntent = false, created = {
   const log = { shown: [], created: [], offer: undefined };
   const sandbox = {
     authKnown: true, me: { github_login: 'probe' }, resumeIntent,
+    // the server's resume read (task 1004650) already answered for this page load —
+    // this slice is about the record the tab stored (tests/github_handback_any_device.mjs
+    // holds the server's half)
+    resumeAsked: true, handbackProject: null, askServerResume() { throw new Error('not asked twice'); },
     state: { step: draftStep },
     createdRecord: () => created,
     enterCreated: (rec, f) => log.created.push({ id: rec.id, focus: f }),

package/tests/wizard_github_feedback.mjs

@@ -164,7 +164,8 @@ const SEED = SCRIPT.slice(SS, SE);
 test('the reload regions are still findable (a rename must fail loudly)', () => {
   assert.ok(WS > 0 && WE > WS, 'wait-timer boundaries found');
   assert.ok(SS > 0 && SE > SS, 'instance-read seed boundaries found');
-  assert.match(SCRIPT, /if \(!terminal \|\| manifestInFlight\(\) \|\| setupOpen\(\)\) pollTimer = setTimeout\(tick, 5000\);/,
+  // the pace slows while the tab is hidden, never stops (task 1004650)
+  assert.match(SCRIPT, /if \(!terminal \|\| manifestInFlight\(\) \|\| setupOpen\(\)\) pollTimer = setTimeout\(tick, wizPollDelay\(5000\)\);/,
     'a GitHub leg in flight — or an install not yet verified (task 1004649) — keeps the instance read alive once the project is up');
 });