@bongos/core 1.23.22 → 1.24.2

package/tests/access_holders.mjs

@@ -0,0 +1,214 @@
+// tests/access_holders.mjs — who holds the keys OUTSIDE Bongos, and blockers that need
+// them (task 1005000, goal 1000111).
+//
+// WHAT IT GUARDS (the task's done-when, one by one):
+//   1. Only the owner can record a holder: the writes refuse anyone without
+//      government.manage; the read is the docket's atom.
+//   2. An ask on access:<key> resolves to exactly the recorded holders, and to the
+//      owner when none is recorded.
+//   3. Such a blocker shows under its holder as "needs repo-owner access".
+//   4. No secret is stored: the table has no column a credential could live in.
+//   And the trap: it is a record of who to ask, never authority — no gate, rank check
+//   or permission atom reads it.
+//
+// Also: the vocabulary, the ask grammar (asks.SEAT) and both migration CHECKs agree.
+// DB-free: the government db is stubbed by property. Run:  node --test tests/access_holders.mjs
+
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gov = (f) => path.join(ROOT, 'modules', 'government', f);
+const access = require(gov('access.js'));
+const asks = require(gov('asks.js'));
+const routing = require(gov('routing.js'));
+const waiting = require(gov('waiting.js'));
+const leads = require(gov('leads.js'));
+const people = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'blockers-by-person.js'));
+const page = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government-access.js'));
+const SQL = fs.readFileSync(gov('migrations/government_036_access_holders.sql'), 'utf8');
+
+const owner = leads.ownerOf([{ id: 1, github_login: 'lars', display_name: 'Lars' }]);
+const KIM = { access_key: 'github-admin', builder_id: 5, github_login: 'kim', display_name: 'Kim', granted_at: '2026-10-29T00:00:00Z' };
+const blocker = (id, waitsOn) => ({ id: `blockers:${id}`, source: 'blockers', building: 'planning', state: 'needs', title: `Blocker ${id}`, opened_at: '2026-10-29T00:00:00Z', ref: { type: 'blocker', id: String(id) }, ask: { question: 'Allow it?', waits_on: waitsOn, if_nobody_answers: 'It stays stuck.' } });
+
+test('one vocabulary: access.js, the holders CHECK and the asks CHECK name the same keys', () => {
+  const holders = /access_key IN \(([^)]+)\)/.exec(SQL)[1].match(/'([^']+)'/g).map((s) => s.slice(1, -1));
+  assert.deepEqual(holders, access.KEYS);
+  const seat = new RegExp(/CHECK \(waits_on ~ '([^']+)'\)/.exec(SQL)[1]);
+  for (const s of ['owner', 'lead:planning', 'board:charter', 'committee:review.testers', ...access.KEYS.map((k) => `access:${k}`)]) {
+    assert.equal(seat.test(s), true, `${s}: the table takes it`);
+    assert.equal(asks.SEAT.test(s), true, `${s}: the module takes it`);
+  }
+  for (const s of ['access:nope', 'access:', 'access:github-admin.x', 'lead:nowhere']) {
+    assert.equal(seat.test(s), false, `${s}: the table refuses it`);
+    assert.equal(asks.SEAT.test(s), false, `${s}: the module refuses it`);
+  }
+});
+
+test('an ask can wait on an outside access, and reads as its holder', () => {
+  const ok = asks.checkAsk({
+    question: 'Allow the publish token to change CI workflow files?',
+    options: [{ key: 'yes', label: 'Add the scope', result: 'It lands on the next ship.' }, { key: 'no', label: 'Leave it', result: 'It stays stuck.' }],
+    recommend: { key: 'yes', why: 'One setting fixes it.' },
+    waits_on: 'access:github-admin',
+    if_nobody_answers: 'It stays stuck.',
+  });
+  assert.equal(ok.ok, true, JSON.stringify(ok.errors || []));
+  assert.equal(asks.seatWords('access:github-admin'), 'the repo owner');
+  assert.equal(asks.checkAsk({ ...ok.ask, waits_on: 'access:nope' }).ok, false);
+});
+
+test('access:<key> resolves to exactly the recorded holders, and to the owner when none is', () => {
+  const seats = { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) };
+  const held = routing.resolveSeat('access:github-admin', seats);
+  assert.deepEqual([held.seat, held.label, held.builder_ids, held.fell_to_owner], ['access:github-admin', 'the repo owner', ['5'], false]);
+  const unheld = routing.resolveSeat('access:dns', seats);
+  assert.deepEqual([unheld.seat, unheld.builder_ids, unheld.fell_to_owner], ['owner', ['1'], true]);
+  const route = routing.routeMatter(blocker(1, 'access:github-admin'), '5', seats, Date.now());
+  assert.deepEqual([route.yours, route.people], [true, [{ id: '5', login: 'kim', name: 'Kim' }]]);
+  assert.equal(routing.routeMatter(blocker(1, 'access:github-admin'), '1', seats, Date.now()).yours, false, 'not the owner\'s while a holder is recorded');
+  // no access read at all (an instance that has not migrated): every access seat falls to the owner
+  assert.deepEqual(routing.resolveSeat('access:github-admin', { leads: [], owner, holders: {} }).builder_ids, ['1']);
+});
+
+test('a blocker on an access seat shows under its holder as "needs repo-owner access"', () => {
+  const g = waiting.groupByPerson([blocker(7, 'access:github-admin'), blocker(8, 'access:payments')], { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) });
+  const kim = g.people.find((p) => p.person.name === 'Kim');
+  assert.deepEqual(kim.items.map((i) => [i.id, i.needs]), [['7', 'needs repo-owner access']]);
+  const lars = g.people.find((p) => p.person.name === 'Lars');
+  assert.deepEqual(lars.items.map((i) => [i.id, i.needs, i.fell_to_owner]), [['8', 'needs access to payments', true]]);
+  const esc = (s) => String(s);
+  const html = people.peopleHtml({ available: true, ...g }, { esc, fmtDate: (d) => d.slice(0, 10) });
+  assert.match(html, /needs repo-owner access · filed/);
+  assert.match(html, /needs access to payments, and nobody is recorded holding it/);
+  assert.equal(people.asWords({ as: 'the owner', asked: 'owner' }), 'as the owner', 'an ordinary seat reads as before');
+});
+
+test('no secret is stored, and nothing that gates reads it', () => {
+  const cols = /CREATE TABLE IF NOT EXISTS government_access_holders \(([\s\S]*?)\n\);/.exec(SQL)[1]
+    .split('\n').map((l) => /^\s+([a-z_]+)\s/.exec(l)).filter(Boolean).map((m) => m[1]).filter((c) => c !== 'PRIMARY');
+  assert.deepEqual(cols, ['access_key', 'builder_id', 'granted_by', 'granted_at']);
+  for (const f of ['src/bongos/auth.js', 'modules/government/resolver.js', 'modules/government/catalog.js', 'src/bongos/act-alone.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.doesNotMatch(src, /access_holders|listAccessHolders|require\(['"][./]*access['"]\)/, `${f} never reads access holders`);
+  }
+  const catalog = require(gov('catalog.js'));
+  const keys = catalog.PERMISSIONS.map((p) => p.key || p);
+  assert.ok(keys.length > 50, 'the real catalog, not an empty list');
+  for (const k of access.KEYS) assert.ok(!keys.some((p) => String(p).includes(k)), `${k} is not a permission atom`);
+});
+
+test('the access view: each access, what it is, its holders, or that it falls to the owner', () => {
+  const v = access.accessView([KIM, { ...KIM, access_key: 'not-a-key' }]);
+  assert.deepEqual(v.map((a) => a.key), access.KEYS);
+  const gh = v.find((a) => a.key === 'github-admin');
+  assert.deepEqual([gh.seat, gh.holders.map((h) => h.name), gh.falls_to_owner], ['access:github-admin', ['Kim'], false]);
+  assert.equal(v.find((a) => a.key === 'dns').falls_to_owner, true);
+  const html = page.accessHtml(v, (s) => String(s).replace(/</g, '&lt;'));
+  assert.match(html, /Repo owner/);
+  assert.match(html, /data-act="revoke" data-key="github-admin" data-id="5"/);
+  assert.match(html, /Nobody recorded — it falls to the owner/);
+  // the picker and the list say the same name, capitalised the same way
+  const opts = page.optionsHtml(v, (s) => String(s));
+  for (const a of v) {
+    assert.match(opts, new RegExp('<option value="' + a.key + '">' + a.title + '</option>'));
+    assert.ok(html.includes('>' + a.title + '<'), a.key + ': the list shows the same name');
+    assert.match(a.title, /^[A-Z]/);
+  }
+});
+
+test('every access reads as plain words when a blocker needs it — no "access access"', () => {
+  for (const k of access.KEYS) {
+    const w = access.needsWords(k);
+    assert.match(w, /^needs [a-z]/, k);
+    assert.doesNotMatch(w, /access access|-access access/, k + ': ' + w);
+  }
+  assert.equal(access.needsWords('github-admin'), 'needs repo-owner access');
+});
+
+test('the City keeps routing when the access read fails or is missing: every access seat falls to the owner', async () => {
+  const docket = require(gov('docket.js'));
+  const db = require(gov('db.js'));
+  const real = { leads: db.listLeads, archons: db.listActiveArchons, access: db.listAccessHolders };
+  db.listLeads = async () => [];
+  db.listActiveArchons = async () => [{ id: 1, github_login: 'lars', display_name: 'Lars' }];
+  try {
+    db.listAccessHolders = async () => { throw new Error('relation government_access_holders does not exist'); };
+    const failed = await docket.loadSeats({ holders: {} });
+    assert.ok(failed, 'seats still read');
+    assert.deepEqual(routing.resolveSeat('access:github-admin', failed).builder_ids, ['1'], 'falls to the owner');
+    assert.deepEqual(failed.access['github-admin'], []);
+    db.listAccessHolders = undefined;
+    const missing = await docket.loadSeats({ holders: {} });
+    assert.ok(missing, 'a db layer without the read still routes');
+    assert.deepEqual(routing.resolveSeat('access:dns', missing).builder_ids, ['1']);
+    db.listAccessHolders = async () => [KIM];
+    assert.deepEqual(routing.resolveSeat('access:github-admin', await docket.loadSeats({ holders: {} })).builder_ids, ['5']);
+  } finally {
+    db.listLeads = real.leads; db.listActiveArchons = real.archons; db.listAccessHolders = real.access;
+  }
+});
+
+// --- the routes, through the real router and the real permission gate ---------------
+
+const express = require('express');
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const govDb = require(gov('db.js'));
+
+const rows = [];
+const REAL = { list: govDb.listAccessHolders, grant: govDb.grantAccess, revoke: govDb.revokeAccess, who: govDb.getActiveBuilder };
+govDb.listAccessHolders = async () => rows.slice();
+govDb.grantAccess = async (k, id, by) => { if (rows.some((r) => r.access_key === k && r.builder_id === id)) return false; rows.push({ access_key: k, builder_id: id, granted_by: by, github_login: 'kim', display_name: 'Kim' }); return true; };
+govDb.revokeAccess = async (k, id) => { const i = rows.findIndex((r) => r.access_key === k && r.builder_id === id); if (i < 0) return false; rows.splice(i, 1); return true; };
+govDb.getActiveBuilder = async (id) => (id === 5 ? { id: 5, github_login: 'kim', display_name: 'Kim' } : null);
+const realRequireBuilder = api.requireBuilder;
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'archon' }; next(); };
+function grant(keys) { seams._reset(); seams.registerProvider('government', { resolveBuilderPermissions: async () => keys }); }
+grant(['government.manage', 'board.vote.cast']);
+const buildRouter = require(gov('routes/government.js'));
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => {
+  server.close();
+  api.requireBuilder = realRequireBuilder;
+  govDb.listAccessHolders = REAL.list; govDb.grantAccess = REAL.grant; govDb.revokeAccess = REAL.revoke; govDb.getActiveBuilder = REAL.who;
+  seams._reset();
+});
+const call = async (method, p, body) => {
+  const res = await fetch(BASE + p, { method, headers: body ? { 'content-type': 'application/json' } : {}, body: body ? JSON.stringify(body) : undefined });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+
+test('only the owner records a holder; everyone who can open the City can read who holds what', async () => {
+  grant(['board.vote.cast']);
+  assert.equal((await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status, 403, 'a voter cannot record');
+  assert.equal((await call('DELETE', '/government/access/github-admin/holders/5')).status, 403, 'nor remove');
+  assert.equal((await call('GET', '/government/access')).status, 200, 'but can read');
+  grant(['government.manage', 'board.vote.cast']);
+  const added = await call('POST', '/government/access/github-admin/holders', { builder_id: 5 });
+  assert.deepEqual([added.status, added.json.added], [201, true]);
+  assert.equal(rows[0].granted_by, 1, 'who recorded it rides the row');
+  assert.deepEqual([(await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status], [200], 'idempotent');
+  const read = await call('GET', '/government/access');
+  assert.deepEqual(read.json.access.find((a) => a.key === 'github-admin').holders.map((h) => h.id), ['5']);
+  assert.equal((await call('POST', '/government/access/nope/holders', { builder_id: 5 })).status, 400, 'an unknown access');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 99 })).status, 404, 'an unknown builder');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 'x' })).status, 400);
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 5, token: 'ghp_x' })).status, 400, 'strict: an unknown field (a token, say) is refused, never stored');
+  const removed = await call('DELETE', '/government/access/github-admin/holders/5');
+  assert.deepEqual([removed.status, removed.json.removed, rows.length], [200, true, 0]);
+});

package/tests/account_logins.mjs

@@ -0,0 +1,326 @@
+// tests/account_logins.mjs — a platform account is a person, and GitHub is one
+// way in (task 1004992, ADR 0393).
+//
+// What this proves, DB-free (the real SQL is tests/account_logins_db.mjs):
+//
+//   1. A provider identity is only ever the provider's stable user id — never an
+//      email or a login — and GitHub's is a positive integer.
+//   2. A person who arrives without GitHub gets a MINTED key that is negative,
+//      so it can never be mistaken for a GitHub id, and no GitHub login is
+//      invented for them.
+//   3. A second sign-in by the same Google identity — or a racing double-click —
+//      reaches the SAME account; it never makes a second person.
+//   4. GitHub accounts are never born here (one birth path per kind).
+//   5. The person's own settings read lists which ways in they have, never the
+//      provider ids, and is keyed on the signed-in person only.
+//   6. The hub's numeric-key guard now admits a minted key, and still refuses a
+//      system:* principal.
+//
+// Run:  node --test tests/account_logins.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+// A recording pool. `script` answers each statement by the first matching
+// pattern; connect() hands out a client that records into the same log, so a
+// transaction's statements are visible in order.
+function fakePool(script) {
+  const p = { log: [], script };
+  const run = async (sql, params = []) => {
+    p.log.push({ sql, params });
+    for (const [re, answer] of p.script) {
+      if (re.test(sql)) return typeof answer === 'function' ? answer(sql, params, p.log) : answer;
+    }
+    return { rows: [], rowCount: 0 };
+  };
+  p.query = run;
+  p.connect = async () => ({ query: run, release() {} });
+  return p;
+}
+
+// Swap what the route's pool answers. The route captured the pool object at
+// require time, so the object stays and its script and log are replaced.
+function scriptRoute(script) {
+  routePool.script = script;
+  routePool.log.length = 0;
+}
+
+let ME = '4242';
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+const routePool = fakePool([]);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: routePool,
+  requireBuilder: (req, _res, next) => {
+    req.builder = { id: 1, github_id: ME, github_login: 'octo' };
+    next();
+  },
+};
+
+const logins = require('../modules/platform-identity/account-logins.js');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const profileRoutes = require('../modules/platform-identity/routes/profile.js');
+const myProjectsRoutes = require('../modules/platform-identity/routes/my-projects.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+test('a provider identity is the provider\'s stable user id, nothing else', () => {
+  assert.deepEqual(logins.normalizeLogin({ provider: 'github', subject: 583231 }), { provider: 'github', subject: '583231' });
+  assert.deepEqual(logins.normalizeLogin({ provider: 'google', subject: '110169484474386276334' }), { provider: 'google', subject: '110169484474386276334' });
+  for (const bad of [
+    { provider: 'github', subject: 'octocat' }, // a login, not an id
+    { provider: 'github', subject: '-5' }, // a minted key is not a GitHub id
+    { provider: 'github', subject: '0' },
+    { provider: 'google', subject: '' },
+    { provider: 'google', subject: 'has space' },
+    { provider: 'google', subject: 'x'.repeat(256) },
+    { provider: 'email', subject: 'a@b.c' }, // not a provider (ADR 0393)
+    { provider: 'apple', subject: '123' },
+    {},
+  ]) assert.equal(logins.normalizeLogin(bad), null, JSON.stringify(bad));
+  assert.deepEqual([...logins.LOGIN_PROVIDERS], ['github', 'google']);
+});
+
+test('a minted person key is negative, and only a minted one is', () => {
+  assert.equal(logins.isMintedPersonKey('-17'), true);
+  assert.equal(logins.isMintedPersonKey(-17), true);
+  assert.equal(logins.isMintedPersonKey('583231'), false);
+  assert.equal(logins.isMintedPersonKey('system:bfg'), false);
+  assert.equal(logins.isMintedPersonKey(null), false);
+});
+
+test('the hub key guard admits a minted key and still refuses a system principal', () => {
+  assert.equal(pi.isNumericGithubId('-17'), true);
+  assert.equal(pi.isNumericGithubId('583231'), true);
+  assert.equal(pi.isNumericGithubId('system:bfg'), false);
+  assert.equal(pi.isNumericGithubId('--1'), false);
+  assert.equal(pi.isNumericGithubId(''), false);
+});
+
+test('a person arriving through Google gets a new account with a minted key and no GitHub login', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 77, person_key: '-3' }] }],
+    [/INSERT INTO platform_identity_account_logins/, { rows: [], rowCount: 1 }],
+    [/UPDATE platform_identity_accounts\s+SET handle/, { rows: [{ handle: 'janedoe' }], rowCount: 1 }],
+  ]);
+  const out = await logins.createAccountForLogin({
+    provider: 'google', subject: 'g-sub-1', email: ' jane@example.com ', displayName: 'Jane Doe',
+    avatarUrl: 'https://lh3.googleusercontent.com/a/x',
+  }, { pool });
+  assert.deepEqual(out, { accountId: 77, personKey: '-3', created: true });
+
+  const sqls = pool.log.map((q) => q.sql);
+  const insAcct = pool.log.find((q) => /INSERT INTO platform_identity_accounts/.test(q.sql));
+  assert.match(insAcct.sql, /-nextval\('platform_identity_person_key_seq'\)/, 'the key is minted negative from the sequence');
+  assert.match(insAcct.sql, /VALUES \(-nextval\('platform_identity_person_key_seq'\), NULL,/, 'no GitHub login is invented');
+  assert.match(insAcct.sql, /'provisional'/, 'not activated here — the sign-in route decides, as for GitHub');
+  assert.deepEqual(insAcct.params, ['Jane Doe', 'https://lh3.googleusercontent.com/a/x']);
+
+  const insLogin = pool.log.find((q) => /INSERT INTO platform_identity_account_logins/.test(q.sql));
+  assert.deepEqual(insLogin.params, [77, 'google', 'g-sub-1', 'jane@example.com']);
+
+  // Both inserts sit inside ONE transaction: an account never exists without its way in.
+  const b = sqls.indexOf('BEGIN');
+  const c = sqls.indexOf('COMMIT');
+  assert.ok(b >= 0 && c > b, 'a transaction ran');
+  assert.ok(sqls.indexOf(insAcct.sql) > b && sqls.indexOf(insLogin.sql) > sqls.indexOf(insAcct.sql) && c > sqls.indexOf(insLogin.sql),
+    'account then login, both between BEGIN and COMMIT');
+
+  const handle = pool.log.find((q) => /SET handle/.test(q.sql));
+  assert.deepEqual(handle.params, ['-3', 'janedoe'], 'the handle is seeded from the name, keyed on the minted key');
+});
+
+test('the same Google identity signing in again reaches the same person', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 77, person_key: '-3' }] }],
+  ]);
+  const out = await logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-1' }, { pool });
+  assert.deepEqual(out, { accountId: 77, personKey: '-3', created: false });
+  assert.ok(!pool.log.some((q) => /INSERT/.test(q.sql)), 'nothing written');
+});
+
+test('a racing double sign-up rolls back and returns the account the other request made', async () => {
+  let lookups = 0;
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, () => (++lookups === 1 ? { rows: [] } : { rows: [{ account_id: 78, person_key: '-4' }] })],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 79, person_key: '-5' }] }],
+    [/INSERT INTO platform_identity_account_logins/, () => { const e = new Error('duplicate key'); e.code = '23505'; throw e; }],
+  ]);
+  const out = await logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-2' }, { pool });
+  assert.deepEqual(out, { accountId: 78, personKey: '-4', created: false });
+  const sqls = pool.log.map((q) => q.sql);
+  assert.ok(sqls.includes('ROLLBACK'), 'our half-made account rolled back with its failed login');
+  assert.ok(!sqls.includes('COMMIT'));
+  assert.ok(!pool.log.some((q) => /SET handle/.test(q.sql)), 'no handle seeded for a rolled-back account');
+});
+
+test('any other failure is not swallowed', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, () => { const e = new Error('boom'); e.code = '57014'; throw e; }],
+  ]);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-3' }, { pool }), /boom/);
+});
+
+test('GitHub accounts and malformed identities are never born here', async () => {
+  const pool = fakePool([]);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'github', subject: '583231' }, { pool }), /GitHub account is born/);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'google', subject: '' }, { pool }), /not a valid provider identity/);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'email', subject: 'a@b.c' }, { pool }), /not a valid provider identity/);
+  assert.equal(pool.log.length, 0, 'nothing touched the database');
+});
+
+test('a lookup never runs for an identity that cannot be one', async () => {
+  const pool = fakePool([]);
+  assert.equal(await logins.findPersonByLogin({ provider: 'github', subject: 'octocat' }, { pool }), null);
+  assert.equal(pool.log.length, 0);
+});
+
+test('the lookup keys on provider and the provider\'s id only — never an email', async () => {
+  const pool = fakePool([]);
+  await logins.findPersonByLogin({ provider: 'google', subject: 'g-sub-9' }, { pool });
+  assert.equal(pool.log.length, 1);
+  assert.match(pool.log[0].sql, /WHERE l\.provider = \$1 AND l\.subject = \$2/);
+  assert.doesNotMatch(pool.log[0].sql, /email/);
+  assert.deepEqual(pool.log[0].params, ['google', 'g-sub-9']);
+});
+
+// --- signing in with Google (task 1004993, ADR 0396) -------------------------
+
+test('a returning Google sign-in finds the person, stamps the way in and answers their handle', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 77, person_key: '-3' }] }],
+    [/UPDATE platform_identity_account_logins SET last_used_at/, { rows: [], rowCount: 1 }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'janedoe', github_login: null }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-sub-1', email: 'new@example.com' }, { pool });
+  assert.deepEqual(out, { personKey: '-3', handle: 'janedoe', githubLogin: null, created: false });
+  const stamp = pool.log.find((q) => /SET last_used_at/.test(q.sql));
+  assert.deepEqual(stamp.params, ['google', 'g-sub-1', 'new@example.com'], 'keyed on Google\'s id; the email is only stored');
+  assert.ok(!pool.log.some((q) => /INSERT/.test(q.sql)), 'no second person');
+  assert.ok(!pool.log.some((q) => /WHERE[^;]*email/.test(q.sql)), 'no statement looks a person up by email');
+});
+
+test('a first Google sign-in creates the person and says so', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 80, person_key: '-6' }] }],
+    [/INSERT INTO platform_identity_account_logins/, { rows: [], rowCount: 1 }],
+    [/UPDATE platform_identity_accounts\s+SET handle/, { rows: [{ handle: 'ana' }], rowCount: 1 }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'ana', github_login: null }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-new', displayName: 'Ana' }, { pool });
+  assert.deepEqual(out, { personKey: '-6', handle: 'ana', githubLogin: null, created: true });
+  assert.ok(!pool.log.some((q) => /SET last_used_at/.test(q.sql)), 'a new way in was written with last_used_at already');
+});
+
+test('a person who links GitHub later answers their real GitHub login', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 9, person_key: '583231' }] }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'octo', github_login: 'octocat' }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-linked' }, { pool });
+  assert.equal(out.githubLogin, 'octocat');
+});
+
+test('a minted key never takes a GitHub login from a caller, on insert or update', async () => {
+  const pool = fakePool([[/INSERT INTO platform_identity_accounts/, { rows: [{ github_id: '-3', handle: 'ana' }] }]]);
+  await pi.upsertAccount({ githubId: '-3', githubLogin: '~ana', displayName: 'Ana', activate: true }, { pool });
+  const q = pool.log.find((x) => /INSERT INTO platform_identity_accounts/.test(x.sql));
+  assert.match(q.sql, /VALUES \(\$1, CASE WHEN \$1::bigint < 0 THEN NULL ELSE \$2 END,/, 'a minted key is inserted with no login');
+  assert.match(q.sql, /github_login = CASE WHEN platform_identity_accounts\.github_id < 0 THEN platform_identity_accounts\.github_login ELSE EXCLUDED\.github_login END/,
+    'a minted key keeps the login only linking sets');
+});
+
+// --- the route ---------------------------------------------------------------
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', profileRoutes());
+app.use('/api/bongos', myProjectsRoutes());
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data ? JSON.parse(data) : null }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /me/sign-in-methods lists the signed-in person\'s own ways in, and no provider ids', async () => {
+  ME = '-3';
+  scriptRoute([
+    [/FROM platform_identity_account_logins l\s+JOIN platform_identity_accounts a/, (_s, params) => ({
+      rows: params[0] === '-3'
+        ? [{ provider: 'github', email: null, created_at: '2026-10-29T00:00:00Z', last_used_at: null },
+          { provider: 'google', email: 'jane@example.com', created_at: '2026-10-28T00:00:00Z', last_used_at: '2026-10-29T00:00:00Z' }]
+        : [],
+    })],
+  ]);
+  const res = await get('/api/bongos/me/sign-in-methods');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'no-store');
+  assert.deepEqual(res.body.providers, ['github', 'google']);
+  assert.deepEqual(res.body.methods.map((m) => m.provider), ['github', 'google']);
+  assert.ok(!JSON.stringify(res.body).includes('subject'), 'provider ids never cross');
+  const q = routePool.log[0];
+  assert.deepEqual(q.params, ['-3', ['github', 'google']], 'keyed on the signed-in person, never a caller-named one');
+  assert.doesNotMatch(q.sql, /l\.subject/, 'the provider id is not even selected');
+});
+
+test('GET /me/sign-in-methods answers [] for a system principal without touching the database', async () => {
+  ME = 'system:bfg';
+  scriptRoute([]);
+  const res = await get('/api/bongos/me/sign-in-methods');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body.methods, []);
+  assert.equal(routePool.log.length, 0);
+});
+
+test('GET /me/sign-in-methods fails closed on a read error', async () => {
+  ME = '4242';
+  scriptRoute([[/./, () => { throw new Error('db down'); }]]);
+  const origError = console.error;
+  console.error = () => {};
+  try {
+    const res = await get('/api/bongos/me/sign-in-methods');
+    assert.equal(res.status, 500);
+    assert.ok(!('methods' in (res.body || {})));
+  } finally {
+    console.error = origError;
+  }
+});
+
+test('a Google-only person is not relayed to a project until halls can take one (task 1004994)', async () => {
+  ME = '-3';
+  scriptRoute([]);
+  try {
+    const res = await new Promise((resolve, reject) => {
+      const body = JSON.stringify({ origin: 'https://proj.example.com' });
+      const r = http.request({ host: '127.0.0.1', port, path: '/api/bongos/my-projects/join', method: 'POST',
+        headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) } }, (resp) => {
+        let data = ''; resp.on('data', (c) => { data += c; }); resp.on('end', () => resolve({ status: resp.statusCode, body: JSON.parse(data) }));
+      });
+      r.on('error', reject); r.end(body);
+    });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'google_join_not_yet');
+    assert.equal(routePool.log.length, 0, 'nothing was read or relayed');
+  } finally { ME = '4242'; }
+});