@bongos/core 1.23.14 → 1.23.15

package/tests/privacy_matrix.mjs

@@ -150,6 +150,10 @@ function identitySentinels(acct) {
 //                'listed' | 'name-only' (listed, disciplines null) | 'absent'
 //   board      GET /community/leaderboard   Anon · Builder — the cross-project leaderboard
 //                'listed' | 'absent'
+//   week       GET /community/builder-of-the-week   Anon · Builder · Recruiter — the crown and
+//                the past weeks (task 1002981, spec D5): a row IS stats, so the board's rule.
+//                Every fixture account has won a recorded week, so the read's own predicate
+//                decides: 'listed' | 'absent'
 //   directory  GET /scouting                Recruiter — 'full' | 'name-only' | 'absent'
 //   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
 //   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
@@ -166,13 +170,13 @@ function identitySentinels(acct) {
 //                people the guild page already shows them — shown_publicly AND existence;
 //                hide_stats never hides membership, and private or provisional is never listed
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', week: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', week: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', week: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
 };
 
 // ===========================================================================
@@ -280,6 +284,19 @@ function guildRosterFilter(sql, params) {
 // origin the hall links point at.
 const MX_CLIENT = { client_id: 'mx-proj', secret_hash: '', name: 'MX Project', redirect_uris: [], origin: 'https://mx-proj.example', owner_github_id: null, status: 'active' };
 
+// THE WEEKS each fixture account won (task 1002981): PUB the week now crowned, every
+// other account a week before it, so the crown and the past list both carry a cell.
+// Lazy: the module may only load after the pool is pinned below, through the routes.
+let weeksWon = null;
+function weekOf(key) {
+  if (!weeksWon) {
+    const { crownedWeek } = require('../modules/platform-identity/builder-of-the-week.js');
+    weeksWon = Object.fromEntries(['PUB', ...KEYS.filter((k) => k !== 'PUB')].map((k, i) =>
+      [k, new Date(crownedWeek().start.getTime() - i * 7 * 24 * 60 * 60 * 1000).toISOString().slice(0, 10)]));
+  }
+  return weeksWon[key];
+}
+
 const pool = {
   query: async (text, params = []) => {
     const sql = String(text).replace(/\s+/g, ' ').trim();
@@ -338,6 +355,21 @@ const pool = {
     // ... and the weekly totals: never computed on a read (guild-totals.js); none stored here.
     if (/FROM platform_identity_guild_totals WHERE guild_id = \$1$/.test(sql)) return { rows: [], rowCount: 0 };
 
+    // BUILDER OF THE WEEK (task 1002981): every week is already recorded (no crowning
+    // here), one per fixture account, PUB the current one — so the read's own predicate
+    // decides who is shown. The projection is pinned: a new column is a new disclosure.
+    if (/^SELECT 1 FROM platform_identity_weekly_features WHERE week_start = \$1::date$/.test(sql)) return { rows: [{ '?column?': 1 }], rowCount: 1 };
+    if (/FROM platform_identity_weekly_features f JOIN platform_identity_accounts pa/.test(sql)) {
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      if (cols !== "to_char(f.week_start, 'YYYY-MM-DD') AS week_start, f.credits_delta, f.ships_delta, pa.handle, pa.github_login, pa.display_name, pa.avatar_url") throw new Error(`fake pool: the builder-of-the-week read selects something new — ${cols}`);
+      const where = lift(sql, /WHERE f\.week_start <= \$1::date AND (.+?) ORDER BY/, 'builder of the week');
+      const rows = ACCOUNTS.filter(accountFilter(where, [])).map((a) => ({
+        week_start: weekOf(a.key), credits_delta: String(ROLLUP[a.github_id].credits), ships_delta: String(ROLLUP[a.github_id].works_shipped),
+        handle: a.handle, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url,
+      })).sort((x, y) => (x.week_start < y.week_start ? 1 : -1)).slice(0, params[1]);
+      return { rows, rowCount: rows.length };
+    }
+
     // THE LEADERBOARD's totals: the rollup floor sits on the act CTE's join.
     if (/platform_identity_activity_snapshots/.test(sql)) {
       const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'leaderboard totals');
@@ -764,6 +796,19 @@ test('the cross-project leaderboard — only shown, public, active accounts, the
   }
 });
 
+test('the builder of the week — only shown, public, active winners, on the crown and the past weeks, the same for every viewer', async () => {
+  const seen = [];
+  for (const who of [ANON, STRANGER, RECRUITER]) seen.push(await get(who, '/api/bongos/community/builder-of-the-week'));
+  for (const r of seen.slice(1)) assert.equal(r.text, seen[0].text, `${r.who} got a different builder of the week`);
+  const { winner, past } = seen[0].json;
+  assert.equal(winner && winner.handle, ACCT.PUB.handle, 'control: a shown winner is crowned, or absence below is vacuous');
+  const listed = new Set([winner, ...past].filter(Boolean).map((x) => x.handle));
+  for (const k of KEYS) {
+    assert.equal(listed.has(ACCT[k].handle), MATRIX[k].week === 'listed', `${k}: expected ${MATRIX[k].week}`);
+  }
+  assert.doesNotMatch(seen[0].text, /github_id/, 'github_id never crosses');
+});
+
 test('the recruiting directory — the recruiter sees the full and name-only tiers; Anon and Builder are refused', async () => {
   const r = await get(RECRUITER, '/api/bongos/scouting');
   assert.equal(r.status, 200);
@@ -806,7 +851,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/community/builder-of-the-week', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);