@bongos/core 1.21.95 → 1.21.97

package/tests/github_org_account.mjs

@@ -0,0 +1,379 @@
+// tests/github_org_account.mjs — a personal or an organisation GitHub account for the
+// project's repo and its sign-in app (task 1004651).
+//
+// Before: the page always posted `{}` to mint the app, so the server's org support was
+// dead and every app landed on the founder's personal account; and the new repo could only
+// be made on the personal account, so an organisation-owned project needed the manual
+// "create it yourself" fallback.
+//
+// What this pins:
+//   1. the personal path is UNCHANGED: the page posts `{}` to mint the app and `{name}` to
+//      make the repo, and GitHub is asked for /settings/apps/new and POST /user/repos;
+//   2. choosing an organisation builds the org manifest URL and creates the repo with
+//      POST /orgs/{org}/repos, and the app's settings link follows the organisation;
+//   3. an organisation the founder does not own is shown with the reason and cannot be
+//      picked, and the page refuses to start a trip for it;
+//   4. a bad organisation name is refused by the server before it reaches GitHub;
+//   5. GitHub's org refusals never come back as a 403 (the page reads that as "sign in").
+//
+// The whole path runs for real: the REAL routes (core GitHub router + provisioning mint
+// route), over HTTP, with GitHub faked at the fetch boundary, feeding the REAL page code
+// (sliced out of projects.html and run in a vm). DB-free: the token read and the
+// provisioning data-access fns are stubbed on their cached modules.
+//
+// Run:  node --test tests/github_org_account.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.BUILDER_SECRET_KEY = process.env.BUILDER_SECRET_KEY || 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// CRLF on a Windows checkout — a vm cannot run a slice with stray \r in it
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+// ── fake GitHub, at the fetch boundary ──────────────────────────────────────────────
+const realFetch = globalThis.fetch;
+let gh = {};            // path → (init) => [status, body]
+const ghCalls = [];
+function ghAnswer(url, init = {}) {
+  const u = new URL(url);
+  const key = `${(init.method || 'GET').toUpperCase()} ${u.pathname}`;
+  ghCalls.push({ key, url, body: init.body ? JSON.parse(init.body) : null });
+  const h = gh[key];
+  const [status, body] = h ? h(init) : [404, { message: 'Not Found' }];
+  return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+}
+globalThis.fetch = async (url, init) => (String(url).startsWith('https://api.github.com/') ? ghAnswer(String(url), init) : realFetch(url, init));
+
+// ── the signed-in founder and their stored repo token ───────────────────────────────
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+db.getGithubToken = async () => ({ token: 'tok', scope: 'read:user,repo' });
+db.deleteGithubToken = async () => {};
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'founder' }; next(); };
+const api = require(path.join(ROOT, 'src/module-api.js'));
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'founder' }; next(); };
+
+// ── the provisioning world: one project, its attempts recorded ──────────────────────
+const provisioning = require(path.join(ROOT, 'modules/provisioning/provisioning.js'));
+let targetRef = 'founder/mercury';
+const events = [];
+provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 7, slug: 'mercury', domain: 'mercury.example.com', target_ref: targetRef, status: 'requested' });
+provisioning.createOAuthManifest = async (_db, row) => ({ id: 99, ...row });
+provisioning.getLatestOAuthManifestForInstance = async () => null;   // no earlier attempt (task 1004652's mint guard)
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+const branding = require(path.join(ROOT, 'src/branding.js'));
+const realBranding = branding.branding;
+branding.branding = () => ({ ...realBranding(), identity: { ...(realBranding().identity || {}), productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://cloudbongos.com' } });
+const GS = require(path.join(ROOT, 'modules/provisioning/github-setup.js'));
+const githubRepos = require(path.join(ROOT, 'src/bongos/github-repos.js'));
+
+const express = require('express');
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+const provisioningRoutes = require(path.join(ROOT, 'modules/provisioning/routes/provisioning.js'));
+let server, origin;
+before(async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use('/api/bongos', buildGithubRouter());
+  app.use('/api/bongos', provisioningRoutes());
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  origin = `http://127.0.0.1:${server.address().port}`;
+});
+after(() => { server.close(); globalThis.fetch = realFetch; });
+
+// GitHub's answers for a founder who owns acme-studio and is only a member of bigcorp
+function memberships() {
+  return {
+    'GET /user/memberships/orgs': () => [200, [
+      { role: 'member', state: 'active', organization: { login: 'bigcorp' } },
+      { role: 'admin', state: 'active', organization: { login: 'acme-studio' } },
+    ]],
+  };
+}
+
+// ── the page code, sliced (each boundary asserted below) ────────────────────────────
+function region(startMark, endMark) {
+  const s = SCRIPT.indexOf(startMark);
+  const e = s < 0 ? -1 : SCRIPT.indexOf(endMark, s);
+  return s > 0 && e > s ? SCRIPT.slice(s, e) : null;
+}
+const PICKER = region("    /* ── whose GitHub account: mine or an organisation's (task 1004651) ──", "    var repoPick = acctPicker('ra', {");
+const ENSURE_REPO = region('    function ensureFreshRepo() {', "    $('doCreate').addEventListener('click'");
+const NOTE_ORG = region("    /* the organisation the server says this attempt's app is on: change-only */", '    function startManifest(btn) {');
+const START = region('    function startManifest(btn) {', '    /* the "start again" offer once a wait has clearly gone wrong');
+const SETTINGS = region('    /* the organisation that owns the app, when the founder made it on one (task 1004651) */', '    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow');
+
+test('the page regions are still findable (a rename must fail loudly, not test nothing)', () => {
+  for (const [name, r] of Object.entries({ PICKER, ENSURE_REPO, NOTE_ORG, START, SETTINGS })) assert.ok(r, `${name} region not found`);
+  assert.match(PICKER, /function acctPicker\(p, opts\)/);
+  assert.doesNotMatch(PICKER, /innerHTML/, 'organisation names are DOM text, never markup');
+});
+
+// A miniature DOM: just what the picker, the repo create and the mint touch.
+class El {
+  constructor(id, tag = 'div') { this.id = id; this.tagName = tag; this.hidden = false; this.textContent = ''; this.className = ''; this.children = []; this._v = ''; this.listeners = {}; this.disabled = false; }
+  addEventListener(ev, fn) { (this.listeners[ev] = this.listeners[ev] || []).push(fn); }
+  fire(ev, extra = {}) { (this.listeners[ev] || []).forEach((fn) => fn({ preventDefault() {}, ...extra })); }
+  focus() { this.focused = true; }
+  appendChild(c) { this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); }
+  get firstChild() { return this.children[0] || null; }
+  get value() { return this._v; }
+  set value(v) {
+    // a select takes only a value one of its options has, as a browser does
+    if (this.tagName === 'select') this._v = this.children.some((o) => o.value === v) ? v : '';
+    else this._v = v;
+  }
+  submit() { this.submitted = true; }
+  remove() {}
+}
+function opt(value) { const o = new El(null, 'option'); o.value = value; return o; }
+
+function page({ state = {}, live = {} } = {}) {
+  const els = {};
+  const $ = (id) => {
+    if (!els[id]) {
+      const tag = /(Sel|Org)$/.test(id) ? 'select' : 'div';
+      els[id] = new El(id, tag);
+      if (/Sel$/.test(id)) { els[id].children.push(opt('personal'), opt('org')); els[id]._v = 'personal'; }
+    }
+    return els[id];
+  };
+  const posted = [];
+  const forms = [];
+  const sandbox = {
+    API: '/api/bongos', $, JSON, String, Promise, encodeURIComponent, Error,
+    document: {
+      body: { appendChild() {} },
+      createElement: (tag) => { const e = new El(null, tag); if (tag === 'form') forms.push(e); return e; },
+    },
+    window: { open: () => ({ close() {} }), location: { assign() {} } },
+    fetch: (p, init) => { posted.push({ p, init }); return realFetch(origin + p, { method: (init && init.method) || 'GET', headers: init && init.headers, body: init && init.body }); },
+    state: { repo: 'mercury', mode: 'greenfield', owner: 'founder', ...state },
+    live: { manifest: null, manifestMsg: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, ...live },
+    repoAccess: true, instanceId: 42, me: { github_login: 'founder' },
+    hopForRepoAccess: () => false, syncHome() {}, saveDraft() {},
+    rememberManifest() {}, renderSteps() {}, pollManifest() {}, watchGhTab() {},
+  };
+  sandbox.manifestStartedAt = 0;
+  vm.createContext(sandbox);
+  vm.runInContext([PICKER, ENSURE_REPO, NOTE_ORG, START, SETTINGS, "var appPick = acctPicker('aa', { needsOwner: true });"].join('\n'), sandbox);
+  return { sb: sandbox, els, posted, forms, settle: () => new Promise((r) => setTimeout(r, 60)) };
+}
+async function settled(p, n = 6) { for (let i = 0; i < n; i++) await p.settle(); }
+
+// ── 1. the personal path is unchanged ───────────────────────────────────────────────
+test('personal: the page mints with an empty body, and GitHub is asked for the personal app page', async () => {
+  gh = memberships(); events.length = 0;
+  const p = page();
+  p.sb.appPick.load(null);
+  const btn = new El('btn');
+  p.sb.startManifest(btn);
+  await settled(p);
+  const mint = p.posted.find((x) => /\/github-app$/.test(x.p));
+  assert.equal(mint.init.body, '{}', 'byte-for-byte what the page always sent');
+  assert.equal(p.forms.length, 1);
+  assert.match(p.forms[0].action, /^https:\/\/github\.com\/settings\/apps\/new\?state=[0-9a-f]{64}$/);
+  assert.ok(!events.some((e) => e.event === GS.SETUP_EVENTS.appOrg), 'no organisation is recorded for a personal app');
+  assert.ok(!p.posted.some((x) => /\/github\/orgs/.test(x.p)), 'GitHub is not even asked for organisations');
+});
+
+test('personal: the new repo is made with {name} and POST /user/repos, as before', async () => {
+  gh = { 'POST /user/repos': () => [201, { full_name: 'founder/mercury', html_url: 'https://github.com/founder/mercury' }] };
+  ghCalls.length = 0;
+  const p = page();
+  await p.sb.ensureFreshRepo();
+  const sent = p.posted.find((x) => x.p === '/api/bongos/github/repos');
+  assert.equal(sent.init.body, JSON.stringify({ name: 'mercury' }));
+  assert.deepEqual(ghCalls.map((c) => c.key), ['POST /user/repos']);
+  assert.deepEqual(ghCalls[0].body, { name: 'mercury', private: true, auto_init: false });
+  assert.equal(p.sb.state.owner, 'founder');
+});
+
+// ── 2. an organisation ──────────────────────────────────────────────────────────────
+test('organisation: listed from GitHub; one the founder only belongs to is shown with the reason and cannot be picked', async () => {
+  gh = memberships();
+  const p = page();
+  p.sb.appPick.load(null);
+  p.els.aaSel.value = 'org'; p.els.aaSel.fire('change');
+  await settled(p);
+  const opts = p.els.aaOrg.children.map((o) => ({ v: o.value, t: o.textContent, off: o.disabled }));
+  assert.deepEqual(opts, [
+    { v: 'acme-studio', t: 'acme-studio', off: false },
+    { v: 'bigcorp', t: 'bigcorp (you’re a member, not an owner)', off: true },
+    { v: '__other', t: 'Another organisation…', off: false },
+  ]);
+  assert.equal(p.els.aaOrg.value, 'acme-studio', 'the one they own is picked');
+  assert.equal(p.els.aaOrgField.hidden, false);
+  // a refused one forced in (an old browser ignoring disabled) still cannot go ahead
+  p.els.aaOrg._v = 'bigcorp'; p.els.aaOrg.fire('change');
+  assert.equal(p.sb.appPick.value().ok, false);
+  assert.match(p.els.aaNote.textContent, /member of bigcorp, not an owner/);
+  const btn = new El('btn');
+  p.sb.startManifest(btn);
+  await settled(p, 2);
+  assert.ok(!p.posted.some((x) => /\/github-app$/.test(x.p)), 'no link is minted for an organisation they cannot make apps on');
+});
+
+test('organisation: the app is made on it — the org manifest URL, the org recorded, its settings linked there', async () => {
+  gh = memberships(); events.length = 0;
+  const p = page();
+  p.sb.appPick.load('acme-studio');
+  await settled(p);
+  assert.equal(p.sb.appPick.value().org, 'acme-studio');
+  p.sb.startManifest(new El('btn'));
+  await settled(p);
+  const mint = p.posted.find((x) => /\/github-app$/.test(x.p));
+  assert.deepEqual(JSON.parse(mint.init.body), { account: 'org', org: 'acme-studio' });
+  assert.match(p.forms[0].action, /^https:\/\/github\.com\/organizations\/acme-studio\/settings\/apps\/new\?state=[0-9a-f]{64}$/);
+  assert.deepEqual(events.filter((e) => e.event === GS.SETUP_EVENTS.appOrg).map((e) => e.detail), ['acme-studio']);
+  // the page now knows whose app it is, and links its settings under the organisation
+  p.sb.live.appSlug = 'mercury-app';
+  assert.equal(vm.runInContext('appSettingsUrl()', p.sb), 'https://github.com/organizations/acme-studio/settings/apps/mercury-app');
+  p.sb.live.appOrg = null;
+  assert.equal(vm.runInContext('appSettingsUrl()', p.sb), 'https://github.com/settings/apps/mercury-app', 'and under the founder for a personal app');
+});
+
+test('organisation: the new repo is made under it with POST /orgs/{org}/repos, and the project points at it', async () => {
+  gh = { 'POST /orgs/acme-studio/repos': () => [201, { full_name: 'acme-studio/mercury', html_url: 'https://github.com/acme-studio/mercury' }] };
+  ghCalls.length = 0;
+  const p = page({ state: { repoAcct: 'org', repoOrg: 'acme-studio' } });
+  await p.sb.ensureFreshRepo();
+  assert.deepEqual(ghCalls.map((c) => c.key), ['POST /orgs/acme-studio/repos']);
+  assert.deepEqual(ghCalls[0].body, { name: 'mercury', private: true, auto_init: false });
+  assert.equal(p.sb.state.owner, 'acme-studio');
+  assert.equal(p.sb.state.repoUrl, 'https://github.com/acme-studio/mercury');
+  assert.equal(p.sb.state.repoAutoCreated, true);
+});
+
+test('organisation: GitHub refusing the org repo comes back with its reason, never as "sign in again"', async () => {
+  const cases = [
+    [{ message: 'Although you appear to have the correct authorization credentials, the `acme-studio` organization has enabled OAuth App access restrictions' }, 'org_app_restricted', /Third-party access/],
+    [{ message: 'You need admin access to the organization before adding a repository to it.' }, 'org_forbidden', /didn't let your account|didn’t let your account/],
+  ];
+  for (const [body, code, words] of cases) {
+    gh = { 'POST /orgs/acme-studio/repos': () => [403, body] };
+    const res = await realFetch(`${origin}/api/bongos/github/repos`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'mercury', org: 'acme-studio' }) });
+    const j = await res.json();
+    assert.equal(res.status, 409, code);
+    assert.equal(j.error.code, code);
+    assert.match(j.error.message, words);
+    // the page takes the founder to the Code row with that reason, not to a sign-in hop
+    const p = page({ state: { repoAcct: 'org', repoOrg: 'acme-studio' } });
+    let hopped = false; p.sb.hopForRepoAccess = () => { hopped = true; return true; };
+    await assert.rejects(() => p.sb.ensureFreshRepo(), (e) => e.gotoHome === true && e.homeMsg === j.error.message);
+    assert.equal(hopped, false);
+  }
+});
+
+// ── 3. when GitHub will not show the founder's memberships ──────────────────────────
+test('typed name: GitHub hides the memberships, so the founder types it and it is checked', async () => {
+  gh = {
+    'GET /user/memberships/orgs': () => [403, { message: 'requires read:org' }],
+    'GET /user/repos': () => [403, {}],
+    'GET /user/memberships/orgs/acme-studio': () => [403, { message: 'requires read:org' }],
+    'GET /orgs/acme-studio': () => [200, { login: 'acme-studio', type: 'Organization' }],
+    'GET /orgs/someone': () => [200, { login: 'someone', type: 'User' }],
+  };
+  const p = page();
+  p.sb.appPick.load('');
+  await settled(p);
+  assert.deepEqual(p.els.aaOrg.children.map((o) => o.value), ['__other']);
+  assert.equal(p.els.aaTyped.hidden, false);
+  assert.match(p.els.aaNote.textContent, /didn’t show us your organisations/);
+  assert.equal(p.sb.appPick.value().ok, false, 'nothing to go ahead with until it is checked');
+  p.els.aaName.value = 'acme-studio'; p.els.aaCheck.fire('click');
+  await settled(p);
+  const v = p.sb.appPick.value();
+  assert.equal(v.org, 'acme-studio');
+  assert.equal(v.ok, true, 'an organisation GitHub did not give a role for is offered, said as such');
+  assert.match(p.els.aaNote.textContent, /didn't tell us your role in acme-studio/);
+  // a personal account's login is not an organisation
+  p.els.aaName.value = 'someone'; p.els.aaCheck.fire('click');
+  await settled(p);
+  assert.equal(p.sb.appPick.value().ok, false);
+  assert.match(p.els.aaNote.textContent, /an organisation called someone/);
+});
+
+// ── 4. bad names never reach GitHub ─────────────────────────────────────────────────
+test('bad organisation names are refused by the server before GitHub is asked', async () => {
+  gh = {}; ghCalls.length = 0;
+  for (const bad of ['-acme', 'acme-', 'ac--me', 'a/b', 'acme studio', 'x'.repeat(40), '../etc']) {
+    const mint = await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org', org: bad }) });
+    assert.equal(mint.status, 400, `mint: ${bad}`);
+    const repo = await realFetch(`${origin}/api/bongos/github/repos`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ name: 'mercury', org: bad }) });
+    assert.equal(repo.status, 400, `repo: ${bad}`);
+  }
+  const check = await realFetch(`${origin}/api/bongos/github/orgs/${encodeURIComponent('ac--me')}`);
+  assert.equal(check.status, 400);
+  assert.deepEqual(ghCalls, [], 'GitHub was never called with any of them');
+  for (const bad of ['-acme', 'ac--me', 'acme_', '']) assert.equal(githubRepos.validGithubLogin(bad), false, bad);
+  for (const ok of ['a', 'acme-studio', 'A1-b2', 'x'.repeat(39)]) assert.equal(githubRepos.validGithubLogin(ok), true, ok);
+});
+
+test('mint: an explicit organisation choice never falls back to the personal account unseen', async () => {
+  targetRef = 'founder_x/mercury';   // an owner that is not a login, and nothing typed
+  try {
+    const res = await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org' }) });
+    assert.equal(res.status, 400);
+    assert.equal((await res.json()).error.code, 'org_required');
+  } finally { targetRef = 'founder/mercury'; }
+  // with no org typed, account 'org' still means the repo's own organisation, as before
+  targetRef = 'acme-studio/mercury';
+  try {
+    const j = await (await realFetch(`${origin}/api/bongos/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ account: 'org' }) })).json();
+    assert.equal(j.account, 'org');
+    assert.match(j.post_url, /^https:\/\/github\.com\/organizations\/acme-studio\/settings\/apps\/new\?state=/);
+  } finally { targetRef = 'founder/mercury'; }
+});
+
+// ── 5. the helpers, at unit altitude ────────────────────────────────────────────────
+test('listUserOrgs: roles from the memberships; else the organisations the repos sit in, roles unknown', async () => {
+  gh = { 'GET /user/memberships/orgs': () => [200, [{ role: 'admin', state: 'pending', organization: { login: 'newco' } }, { role: 'admin', state: 'active', organization: { login: 'bad name' } }]] };
+  let out = await githubRepos.listUserOrgs('tok');
+  assert.equal(out.listed, 'memberships');
+  assert.deepEqual(out.orgs.map((o) => [o.login, o.can_create_apps]), [['newco', false]], 'a malformed login is dropped; a pending invite cannot');
+  assert.match(out.orgs[0].reason, /invitation to newco is still waiting/);
+  gh = {
+    'GET /user/memberships/orgs': () => [403, {}],
+    'GET /user/repos': () => [200, [
+      { owner: { login: 'Zeta', type: 'Organization' } }, { owner: { login: 'founder', type: 'User' } },
+      { owner: { login: 'alpha', type: 'Organization' } }, { owner: { login: 'zeta', type: 'Organization' } },
+    ]],
+  };
+  out = await githubRepos.listUserOrgs('tok');
+  assert.equal(out.listed, 'repos');
+  assert.deepEqual(out.orgs.map((o) => [o.login, o.can_create_apps]), [['alpha', null], ['Zeta', null]]);
+  gh = { 'GET /user/memberships/orgs': () => [403, {}], 'GET /user/repos': () => [500, {}] };
+  assert.deepEqual(await githubRepos.listUserOrgs('tok'), { orgs: [], listed: 'none' });
+});
+
+test('getOrgAccess: the role when GitHub gives it, unknown when it only proves the org exists, missing otherwise', async () => {
+  gh = { 'GET /user/memberships/orgs/acme-studio': () => [200, { role: 'admin', state: 'active', organization: { login: 'Acme-Studio' } }] };
+  assert.deepEqual(await githubRepos.getOrgAccess('tok', { org: 'acme-studio' }), { login: 'Acme-Studio', role: 'admin', can_create_apps: true, reason: null });
+  gh = { 'GET /user/memberships/orgs/ghost': () => [404, {}], 'GET /orgs/ghost': () => [404, {}] };
+  await assert.rejects(() => githubRepos.getOrgAccess('tok', { org: 'ghost' }), (e) => e.code === 'org_not_found');
+  await assert.rejects(() => githubRepos.getOrgAccess('tok', { org: 'a--b' }), (e) => e.code === 'bad_org');
+});
+
+test('github-setup: the organisation recorded at the mint rides the checklist read as app_org', async () => {
+  const row = { instance_id: 42, state: 'S1', created_at: '2026-10-08T09:00:00Z', app_slug: 'mercury-app' };
+  const said = await GS.githubSetupRead({ query: async () => ({ rows: [{ event: GS.SETUP_EVENTS.appOrg, at: '2026-10-08T09:00:01Z', detail: 'acme-studio' }] }) }, {}, row, 'done');
+  assert.equal(said.app_org, 'acme-studio');
+  const bad = await GS.githubSetupRead({ query: async () => ({ rows: [{ event: GS.SETUP_EVENTS.appOrg, at: '2026-10-08T09:00:01Z', detail: '<script>' }] }) }, {}, row, 'done');
+  assert.equal(bad.app_org, null, 'a recorded value that is not a login never reaches a link');
+  const none = await GS.githubSetupRead({ query: async () => ({ rows: [] }) }, {}, row, 'done');
+  assert.equal(none.app_org, null, 'nothing recorded = the founder’s own account');
+});