@bongos/core 1.21.96 → 1.21.97

package/tests/provisioning_github_app_routes.mjs

@@ -29,6 +29,9 @@ provisioning.getOAuthManifestByState = async (_db, state) => (state === 'GOODSTA
   ? { id: 99, instance_id: 42, requested_by: 7, status: 'pending', expires_at: new Date(Date.now() + 600000).toISOString() }
   : null);
 provisioning.attachManifestCode = async (_db, id, code) => ({ id, status: 'code_received', github_code: code });
+// the latest attempt the mint guard and the pick-up route read (task 1004652); none by default
+let latest = null;
+provisioning.getLatestOAuthManifestForInstance = async () => latest;
 
 // A branding with a known publicOrigin so mothershipOrigin() resolves deterministically.
 const branding = require(`${ROOT}/src/branding.js`);
@@ -281,6 +284,76 @@ console.log('\nGET /provisioning/github-app/status (the page poll → auto-open
   t('missing state → 400', res.status === 400, `status=${res.status}`);
 }
 
+console.log('\nNever a second app (task 1004652): the mint guard and "Pick up where it stopped":');
+{
+  const mint = async () => fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  const soon = new Date(Date.now() + 600000).toISOString();
+  // a link still waiting on GitHub is handed back — the SAME state, no new attempt row
+  stored = null;
+  latest = { id: 70, instance_id: 42, state: 'WAITINGSTATE', status: 'pending', attempts: 0, expires_at: soon, created_at: new Date().toISOString() };
+  let res = await mint();
+  let j = await res.json();
+  t('a waiting link is reopened, not re-minted: same state, same expiry, no new row', res.status === 200 && j.state === 'WAITINGSTATE' && j.expires_at === soon && stored === null && j.post_url === 'https://github.com/settings/apps/new?state=WAITINGSTATE', JSON.stringify(j));
+  // GitHub already made the app (keys placed, sign-in unconfirmed): refused, nothing minted
+  for (const row of [
+    { id: 71, instance_id: 42, state: 'S71', status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', expires_at: soon },
+    { id: 72, instance_id: 42, state: 'S72', status: 'done', attempts: 1, app_id: 5, app_slug: 'mercury-app', expires_at: soon },
+    { id: 73, instance_id: 42, state: 'S73', status: 'error', attempts: 2, app_id: null, app_slug: null, expires_at: soon },
+  ]) {
+    stored = null; latest = row;
+    res = await mint(); j = await res.json();
+    t(`an attempt GitHub approved (${row.status}, attempts ${row.attempts}) refuses a new link: 409 app_exists, nothing minted`, res.status === 409 && j.error.code === 'app_exists' && stored === null, JSON.stringify(j));
+  }
+  stored = null; latest = { id: 74, instance_id: 42, state: 'S74', status: 'converting', attempts: 1, expires_at: soon };
+  res = await mint(); j = await res.json();
+  t('an attempt the runner is converting refuses a new link: 409 github_in_progress', res.status === 409 && j.error.code === 'github_in_progress' && stored === null, JSON.stringify(j));
+  // nothing was made on GitHub: a fresh link is minted
+  for (const row of [
+    { id: 75, instance_id: 42, state: 'S75', status: 'pending', attempts: 0, expires_at: new Date(Date.now() - 1000).toISOString() },
+    { id: 76, instance_id: 42, state: 'S76', status: 'error', attempts: 0, expires_at: soon },
+  ]) {
+    stored = null; latest = row;
+    res = await mint(); j = await res.json();
+    t(`nothing made on GitHub (${row.status}, attempts ${row.attempts}) → a fresh state is minted`, res.status === 200 && stored && stored.state === j.state && j.state !== row.state, JSON.stringify(j));
+  }
+
+  // the pick-up route: 'convert' re-queues the SAME attempt with the code it holds
+  const queries = [];
+  const pg = require(`${ROOT}/src/module-api.js`).pool;
+  const prevQuery = pg.query;
+  pg.query = async (sql, params) => { queries.push({ sql, params }); return { rows: /UPDATE provisioning_oauth_manifests/.test(sql) ? [{ id: params[0] }] : [] }; };
+  const pickUp = async () => fetch(`${base}/provisioning/instances/42/github-app/pick-up`, { method: 'POST' });
+  latest = { id: 80, instance_id: 42, state: 'S80', status: 'error', attempts: 1, github_code: 'CODE', app_id: null, app_slug: null, created_at: new Date(Date.now() - 10 * 60000).toISOString(), expires_at: soon };
+  const before = reported.length;
+  stored = null;
+  res = await pickUp(); j = await res.json();
+  const requeue = queries.find((q) => /UPDATE provisioning_oauth_manifests/.test(q.sql));
+  t("pick-up 'convert' re-queues attempt 80 itself (status code_received, attempts reset), mints nothing", res.status === 200 && j.action === 'convert' && requeue && requeue.params[0] === 80 && /status = 'code_received', attempts = 0/.test(requeue.sql) && /github_code IS NOT NULL/.test(requeue.sql) && stored === null, JSON.stringify(j));
+  // 'check': keys placed, the runner's window closed → a check request, no new attempt
+  queries.length = 0;
+  latest = { id: 81, instance_id: 42, state: 'S81', status: 'error', attempts: 1, app_id: 5, app_slug: 'mercury-app', created_at: new Date(Date.now() - 5 * 3600000).toISOString(), resolved_at: new Date(Date.now() - 4 * 3600000).toISOString(), expires_at: soon };
+  res = await pickUp(); j = await res.json();
+  const asked = reported.slice(before).filter((e) => e.event === 'github-app-check-requested');
+  t("pick-up 'check' records one check request for the project and writes no attempt", res.status === 200 && j.action === 'check' && asked.length === 1 && asked[0].instanceId === 42 && !queries.some((q) => /UPDATE|INSERT/.test(q.sql)) && stored === null, JSON.stringify(j));
+  // nothing the route itself can pick up: 409 naming the page's own action
+  for (const [row, action] of [
+    [{ id: 82, instance_id: 42, state: 'S82', status: 'pending', attempts: 0, expires_at: soon }, 'reopen'],
+    [{ id: 83, instance_id: 42, state: 'S83', status: 'error', attempts: 2, github_code: null, app_id: null, created_at: new Date().toISOString(), expires_at: soon }, 'operator'],
+  ]) {
+    latest = row;
+    res = await pickUp(); j = await res.json();
+    t(`pick-up on '${action}' is the page's own: 409 nothing_to_pick_up, action named`, res.status === 409 && j.error.code === 'nothing_to_pick_up' && j.error.action === action, JSON.stringify(j));
+  }
+  // another builder's project is a 404, like a missing one
+  const prevInst = provisioning.getInstanceById;
+  provisioning.getInstanceById = async () => ({ id: 42, owner_builder_id: 8, slug: 'mercury', domain: 'mercury.example.com', status: 'active' });
+  res = await pickUp();
+  t('pick-up on someone else’s project → 404', res.status === 404, `status=${res.status}`);
+  provisioning.getInstanceById = prevInst;
+  pg.query = prevQuery;
+  latest = null;
+}
+
 console.log('\nparseId contract (the (req,res) signature — a bad id is a clean 400, not a 500):');
 {
   const res = await fetch(`${base}/provisioning/instances/not-a-number/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });

package/tests/wizard_github_feedback.mjs

@@ -69,9 +69,9 @@ test('publicGithubApp: effective status, failure only on error, started_at, and
 
 // ── 2. the words for each stage ─────────────────────────────────────────────
 
-// from the shared helpers of the four GitHub steps (task 1004649) to the next step
+// from the shared helpers of the four GitHub steps (task 1004649) to the renderer table
 const RS = SCRIPT.indexOf('    /* The four GitHub steps of part 03');
-const RE = SCRIPT.indexOf('    /* device-flow', RS);
+const RE = SCRIPT.indexOf('    var STEP_RENDERERS = {', RS);
 const RENDER = SCRIPT.slice(RS, RE);
 
 test('the GitHub step region is still findable (a rename must fail loudly)', () => {
@@ -79,11 +79,10 @@ test('the GitHub step region is still findable (a rename must fail loudly)', ()
   assert.match(RENDER, /function renderStepOauthApp\(\)/);
 });
 
-function stage(live, { stale = false } = {}) {
+function stage(live, { tab = null, fn = 'renderStepOauthApp' } = {}) {
   const sandbox = {
-    live: { manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null, instStatus: 'active', addrReady: true, ...live },
+    live: { manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null, instStatus: 'active', addrReady: true, pickUp: null, verifying: false, askedPlatform: false, ...live },
     state: { name: 'Mercury', slug: 'mercury' },
-    manifestStale: stale,
     autoOpenArmed: false,
     resolvedDomain: () => 'mercury.example.com',
     apexBase: () => 'example.com',
@@ -95,17 +94,26 @@ function stage(live, { stale = false } = {}) {
     progressMarkup: (now, done, note, cls) => `<prog now=${now} done=${done} cls="${cls}">${note}</prog>`,
   };
   vm.createContext(sandbox);
-  vm.runInContext(`${RENDER}\nvar out = renderStepOauthApp();`, sandbox);
+  vm.runInContext(`${RENDER}\nghTabTrouble = ${JSON.stringify(tab)};\nvar out = ${fn}();`, sandbox);
   return sandbox.out;
 }
 const startButton = /data-action="manifest-start"/;
+const NEVER_A_CHORE = /\/contact|Contact us|delete it first|Developer settings → GitHub Apps\) so|Try again anyway|Start the setup again/;
 
-test('pending: waiting for approval, and says where a missing GitHub tab went', () => {
+test('pending: waiting for approval, says where a missing GitHub tab went, and reopens the SAME setup', () => {
   const html = stage({ manifest: 'pending' });
   assert.match(html, /Waiting for your approval on GitHub/);
   assert.match(html, /No GitHub tab\? It may have opened behind this window or in another one/);
-  assert.doesNotMatch(html, startButton, 'no restart offer while the wait is young');
-  assert.match(stage({ manifest: 'pending' }, { stale: true }), /Start the setup again/, 'offered once the wait has gone wrong');
+  assert.doesNotMatch(html, startButton, 'no new-link button while GitHub holds this one (task 1004652)');
+  assert.match(html, /class="linklike" data-action="reopen-github">No GitHub tab\? Reopen GitHub/, 'the way back is there from the first second, not after 90');
+  // the tab this page opened, seen from here (task 1004652)
+  const behind = stage({ manifest: 'pending' }, { tab: 'behind' });
+  assert.match(behind, /Your GitHub tab opened behind this window/);
+  assert.match(behind, /class="ghbtn" data-action="reopen-github">Reopen GitHub ↗/);
+  const closed = stage({ manifest: 'pending' }, { tab: 'closed' });
+  assert.match(closed, /The GitHub tab closed before the app was approved, so nothing was made on GitHub/);
+  assert.match(closed, /data-action="reopen-github"/);
+  assert.doesNotMatch(behind + closed, startButton);
 });
 
 test('converting is the SAME stage as code_received — approved, placing credentials — never "waiting for approval"', () => {
@@ -118,24 +126,59 @@ test('converting is the SAME stage as code_received — approved, placing creden
   }
 });
 
-test('a failure AFTER approval says an app now exists, names it, and does not push a second one', () => {
-  const html = stage({ manifest: 'error', manifestFailure: 'sign_in_unconfirmed', appSlug: 'mercury-cloudbongos-com' });
-  assert.match(html, /GitHub approved the app and the platform placed its credentials/);
-  assert.match(html, /href="https:\/\/github\.com\/settings\/apps\/mercury-cloudbongos-com"/);
-  assert.match(html, /would make a second app/);
-  assert.match(html, /href="\/contact"/);
-  assert.match(html, /cls="isErr"/, 'the strip shows where it stopped');
-  assert.doesNotMatch(html, /Nothing was changed on GitHub/, 'the old claim was false here');
-  assert.doesNotMatch(html, /class="ghbtn"/, 'no big primary "set up" button inviting a second app');
-  assert.match(html, /Try again anyway/, '…but the founder is never left with no way forward');
+test('sign-in unconfirmed: the app stays ticked, sign-in is the stopped step, and picking it up makes no second app', () => {
+  const live = { manifest: 'error', manifestFailure: 'sign_in_unconfirmed', appSlug: 'mercury-cloudbongos-com', pickUp: 'check' };
+  const approve = stage(live);
+  assert.match(approve, /^<li class="sdone"/, 'GitHub made the app and its keys are placed: that much is true');
+  const signIn = stage(live, { fn: 'renderStepFirstSignIn' });
+  assert.match(signIn, /^<li class="sstopped"/);
+  assert.match(signIn, /Your project didn’t confirm that sign-in works\. Nothing is lost, and no second app will be made\./);
+  assert.match(signIn, /data-action="pick-up">Pick up where it stopped/);
+  assert.match(signIn, /data-action="ask-platform">Send it to the platform team/, 'a project that still will not answer goes to the platform team from here');
+  assert.doesNotMatch(approve + signIn, startButton, 'no new link: it would make a second app');
+  assert.doesNotMatch(approve + signIn, NEVER_A_CHORE);
+  // while the runner is asking again, the step says so and offers no button that repeats it
+  const checking = stage({ ...live, pickUp: null, verifying: true }, { fn: 'renderStepFirstSignIn' });
+  assert.match(checking, /We’re asking it again, with the app GitHub already made/);
+  assert.doesNotMatch(checking, /data-action="pick-up"/);
+  // sent: the step says the platform team has it
+  assert.match(stage({ ...live, askedPlatform: true }, { fn: 'renderStepFirstSignIn' }), /Sent\. The platform team has it/);
+  assert.match(stage({ ...live, askedPlatform: 'failed' }, { fn: 'renderStepFirstSignIn' }), /That didn’t send\. Try again\.[\s\S]*data-action="ask-platform"/);
 });
 
-test('approved but never finished: delete the app GitHub made first, then try again', () => {
-  const html = stage({ manifest: 'error', manifestFailure: 'finish_failed' });
-  assert.match(html, /GitHub approved the app, but the platform couldn’t finish/);
-  assert.match(html, /delete it first/);
+test('approved, conversion stopped with its code still young: pick it up, no second app', () => {
+  const html = stage({ manifest: 'error', manifestFailure: 'finish_failed', pickUp: 'convert' });
+  assert.match(html, /^<li class="sstopped"/);
+  assert.match(html, /GitHub approved the app, and the platform stopped before it finished collecting the app’s keys\. Nothing is lost, and no second app will be made\./);
+  assert.match(html, /data-action="pick-up">Pick up where it stopped/);
+  assert.doesNotMatch(html, startButton);
+  assert.doesNotMatch(html, NEVER_A_CHORE);
+});
+
+test('approved but the keys never reached us: the platform team, sent from the page — never a GitHub chore', () => {
+  const html = stage({ manifest: 'error', manifestFailure: 'finish_failed', pickUp: 'operator' });
+  assert.match(html, /GitHub made the app, but its keys never reached your project/);
+  assert.match(html, /data-action="ask-platform">Send it to the platform team/);
+  assert.doesNotMatch(html, startButton, 'a new link would leave the founder with two apps');
+  assert.doesNotMatch(html, NEVER_A_CHORE);
   assert.doesNotMatch(html, /Nothing was changed on GitHub/);
-  assert.match(html, startButton);
+});
+
+test('the install the runner stopped checking for: the mockup’s sentence, and a pick-up that opens the SAME app’s install', () => {
+  const html = stage({ manifest: 'done', appSlug: 'mercury-app', installUrl: 'https://github.com/apps/mercury-app/installations/new', pickUp: 'check' }, { fn: 'renderStepAppInstall' });
+  assert.match(html, /^<li class="sstopped" data-onboard-step="app-install">/);
+  assert.match(html, /GitHub stopped before the app was installed on your repo\. Nothing is lost, and no second app will be made\./);
+  assert.match(html, /<a class="ghbtn" href="https:\/\/github\.com\/apps\/mercury-app\/installations\/new" target="_blank" rel="noopener" data-action="pick-up">Pick up where it stopped ↗<\/a>/);
+  // still being checked: the ordinary step, no stop
+  assert.doesNotMatch(stage({ manifest: 'done', appSlug: 'mercury-app', pickUp: null, verifying: true }, { fn: 'renderStepAppInstall' }), /sstopped/);
+});
+
+test('device flow after the runner stopped checking: "Check again", once the install has ticked', () => {
+  const setup = { approve: 'done', install: 'done', sign_in: 'done', device_flow: 'later', connected: true };
+  const again = stage({ manifest: 'done', appSlug: 'mercury-app', setup, pickUp: 'check' }, { fn: 'renderStepDeviceFlow' });
+  assert.match(again, /data-action="pick-up">Turned it on\? Check again/);
+  assert.doesNotMatch(stage({ manifest: 'done', appSlug: 'mercury-app', setup, pickUp: null, verifying: true }, { fn: 'renderStepDeviceFlow' }), /Check again/);
+  assert.doesNotMatch(stage({ manifest: 'done', appSlug: 'mercury-app', setup: { ...setup, install: 'now', connected: false }, pickUp: 'check' }, { fn: 'renderStepDeviceFlow' }), /Check again/, 'the install step carries the action until it ticks');
 });
 
 test('a failure before GitHub (or a refused start) keeps the honest "nothing changed" line', () => {
@@ -175,7 +218,8 @@ function reloaded(githubApp, now) {
   const sandbox = {
     data: { github_app: githubApp },
     live: { manifest: null, manifestFailure: null, appSlug: null },
-    manifestPollTimer: null, manifestStartedAt: 0, manifestStale: false,
+    manifestPollTimer: null, manifestStartedAt: 0, ghTabTrouble: null,
+    document: { hidden: false, hasFocus: () => true },
     rememberManifest: () => {}, renderSteps: () => renders.push(1),
     Date: { now: () => now, parse: Date.parse },
   };
@@ -184,19 +228,41 @@ function reloaded(githubApp, now) {
   return { sandbox, renders, tick: () => vm.runInContext(SEED, sandbox) };
 }
 
-test('a reloaded page times the wait from when the link was minted, and still reaches "start again"', () => {
+test('a reloaded page seeds the wait from when the link was minted, and keeps watching it', () => {
   const minted = '2026-10-04T20:20:00Z';
   const young = reloaded({ status: 'pending', app_slug: null, failure: null, started_at: minted }, Date.parse(minted) + 30000);
   assert.equal(young.sandbox.live.manifest, 'pending');
   assert.equal(young.sandbox.manifestStartedAt, Date.parse(minted), 'seeded from the server');
-  assert.equal(young.sandbox.manifestStale, false);
 
   const old = reloaded({ status: 'pending', app_slug: null, failure: null, started_at: minted }, Date.parse(minted) + 120000);
-  old.tick();   // the next 5s read: same status, so the wait timer decides
-  assert.equal(old.sandbox.manifestStale, true, 'the offer appears — it used to be never after a reload');
+  old.tick();   // the next 5s read: same status
+  // a reloaded page holds no handle on a GitHub tab, so it claims nothing about one; the
+  // step's "Reopen GitHub" is always on show instead (task 1004652)
+  assert.equal(old.sandbox.ghTabTrouble, null);
   assert.equal(vm.runInContext('manifestInFlight()', old.sandbox), true);
 });
 
+test('the GitHub tab this page opened: behind or closed is noticed in seconds, not after 90', () => {
+  const r = reloaded({ status: 'pending', app_slug: null, failure: null, started_at: null }, 0);
+  const at = (tab, left, since, now, focused) => vm.runInContext(`ghTabState(${tab}, ${left}, ${since}, ${now}, ${focused})`, r.sandbox);
+  assert.equal(at('null', false, 0, 60000, true), null, 'no handle, nothing claimed');
+  assert.equal(at('{ closed: true }', true, 0, 1000, false), 'closed', 'closed is seen at once');
+  assert.equal(at('{ closed: false }', false, 0, 5000, true), 'behind', 'this page kept the focus five seconds after opening it');
+  assert.equal(at('{ closed: false }', false, 0, 3000, true), null, 'not before a few seconds');
+  assert.equal(at('{ closed: false }', true, 0, 60000, false), null, 'the founder went to the tab: it is in front');
+  assert.equal(at('{ closed: false }', false, 0, 60000, false), null, 'this page lost the focus: not behind');
+  assert.doesNotMatch(SCRIPT, /90000/, 'the 90-second wait is gone');
+  // the poll's check redraws only on a change, and stops once the link is no longer waiting
+  r.sandbox.ghTab = { closed: true };
+  vm.runInContext('ghTab = { closed: true }; ghTabSince = 0; noteManifestWait();', r.sandbox);
+  assert.equal(r.sandbox.ghTabTrouble, 'closed');
+  const n = r.renders.length;
+  vm.runInContext('noteManifestWait();', r.sandbox);
+  assert.equal(r.renders.length, n, 'no redraw when nothing moved');
+  vm.runInContext("live.manifest = 'code_received'; noteManifestWait();", r.sandbox);
+  assert.equal(r.sandbox.ghTabTrouble, null, 'approved: the tab no longer matters');
+});
+
 test('a reloaded page learns HOW a failure happened, not just that it did', () => {
   const r = reloaded({ status: 'error', app_slug: 'mercury-cloudbongos-com', failure: 'sign_in_unconfirmed', started_at: null }, NOW);
   assert.equal(r.sandbox.live.manifest, 'error');