@bongos/core 1.23.22 → 1.24.2

package/tests/google_sign_in.mjs

@@ -0,0 +1,401 @@
+// tests/google_sign_in.mjs — signing up and in with Google, and approving a
+// command-line sign-in in the browser (task 1004993, ADR 0396).
+//
+// WHY. Google is the one new way into the platform. What must hold:
+//   - a Google identity is trusted only when Google issued it for OUR app, for
+//     THIS sign-in (nonce), and it has not expired;
+//   - the person is found by Google's own id through the hub, never an email, and
+//     a first sign-in creates them and sends them to choose their name;
+//   - their builder row gets a stand-in login that can never be a GitHub login;
+//   - the site's sign-in links show "Continue with GitHub / Continue with Google";
+//   - the CLI's device sign-in works for them: the terminal is sent to an approval
+//     page, the signed-in person approves from their browser cookie, and the
+//     terminal's poll receives a CLI session exactly once.
+// No server, no database, no network: the db-kernel functions and the hub port are
+// stubbed before the files that destructure them load, and Google's token
+// endpoint is a fake fetch.
+//
+// Run:  node tests/google_sign_in.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+process.env.BONGOS_GOOGLE_CLIENT_ID = 'google-test-client';
+process.env.BONGOS_GOOGLE_CLIENT_SECRET = 'google-test-secret';
+// The hub runs open enrollment; one case below closes it.
+process.env.BONGOS_OPEN_XENOS_ENROLLMENT = '1';
+
+// ── stubs, installed before anything destructures them ──
+const kernel = require('../src/bongos/db-kernel.js');
+const calls = { upsertBuilder: [], createSession: [], signIn: [], recordHubSignin: [] };
+const builders = new Map(); // github_id → row
+kernel.getBuilderByGithubId = async (id) => builders.get(String(id)) || null;
+kernel.upsertBuilder = async (b) => {
+  calls.upsertBuilder.push(b);
+  const row = { id: 77, github_id: String(b.githubId), github_login: b.githubLogin, display_name: b.displayName, rank: 'xenos', status: 'active' };
+  builders.set(String(b.githubId), row);
+  return row;
+};
+kernel.createSession = async (s) => { calls.createSession.push(s); return { id: 1, expires_at: s.expiresAt }; };
+const dbMod = require('../src/bongos/db.js');
+dbMod.createSession = kernel.createSession;
+const admission = require('../src/bongos/auth-admission.js');
+admission.safeSyncRankRole = async () => {};
+
+const seams = require('../src/module-seams.js');
+let nextPerson = { personKey: '-5', handle: 'ana', githubLogin: null, created: true };
+if (!seams.hasProvider('platform-identity.hub')) {
+  seams.registerProvider('platform-identity.hub', {
+    signInWithGoogle: async (identity) => { calls.signIn.push(identity); return { ...nextPerson }; },
+    recordHubSignin: async (r) => { calls.recordHubSignin.push(r); },
+  });
+}
+
+const { googleConfigured, buildGoogleAuthorizeUrl, verifyGoogleClaims, exchangeGoogleCode, standInLogin } = require('../src/bongos/auth-google.js');
+const { FLOW_TTL_MS, normalizeUserCode, startBrowserDeviceFlow, pendingFlow, pollBrowserDeviceFlow } = require('../src/bongos/device-approval.js');
+const pages = require('../src/bongos/sign-in-pages.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildAuthGoogleRouter = require('../src/bongos/routes/auth-google.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+function idToken(claims) {
+  const b = (o) => Buffer.from(JSON.stringify(o)).toString('base64url');
+  return `${b({ alg: 'RS256' })}.${b(claims)}.sig`;
+}
+const NOW = Date.UTC(2026, 9, 29, 12);
+const good = (over = {}) => ({
+  iss: 'https://accounts.google.com', aud: 'google-test-client', sub: '1098765',
+  exp: NOW / 1000 + 600, nonce: 'n1', email: 'ana@example.com', email_verified: true,
+  name: 'Ana Example', picture: 'https://lh3.googleusercontent.com/a/x', ...over,
+});
+
+function fakeRes() {
+  const res = {
+    _status: 200, _body: null, _redirect: null, _type: null, _cookies: {}, _cleared: [], _headers: {},
+    status(c) { this._status = c; return this; },
+    type(x) { this._type = x; return this; },
+    send(b) { this._body = b; return this; },
+    json(b) { this._body = b; return this; },
+    set(k, v) { this._headers[k.toLowerCase()] = v; return this; },
+    redirect(a, b) { this._redirect = b === undefined ? a : b; return this; },
+    cookie(n, v, o) { this._cookies[n] = { v, o }; return this; },
+    clearCookie(n) { this._cleared.push(n); return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+function handler(router, method, path) {
+  const layer = router.stack.find((l) => l.route?.path === path && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${path} exists`);
+  return layer.route.stack.at(-1).handle;
+}
+const req = (over = {}) => ({ query: {}, headers: { host: 'localhost' }, baseUrl: '/api/bongos', body: {}, ...over });
+
+// ── the ID token check ──
+await t('a Google identity issued for this app and this sign-in is accepted', () => {
+  const id = verifyGoogleClaims(good(), { clientId: 'google-test-client', nonce: 'n1', nowMs: NOW });
+  assert.equal(id.subject, '1098765');
+  assert.equal(id.email, 'ana@example.com');
+  assert.equal(id.emailVerified, true);
+  assert.equal(id.displayName, 'Ana Example');
+});
+
+await t('a wrong issuer, audience, expiry, nonce or id is refused', () => {
+  const opts = { clientId: 'google-test-client', nonce: 'n1', nowMs: NOW };
+  for (const bad of [
+    good({ iss: 'https://evil.example' }),
+    good({ aud: 'someone-elses-app' }),
+    good({ aud: ['google-test-client', 'other'], azp: 'other' }),
+    good({ exp: NOW / 1000 - 3600 }),
+    good({ nonce: 'stolen' }),
+    good({ nonce: undefined }),
+    good({ sub: '' }),
+    good({ sub: 'has space' }),
+  ]) {
+    assert.throws(() => verifyGoogleClaims(bad, opts), undefined, JSON.stringify(bad));
+  }
+  assert.throws(() => verifyGoogleClaims(null, opts));
+  assert.throws(() => verifyGoogleClaims(good(), { ...opts, nonce: '' }), undefined, 'no nonce on our side is never a match');
+});
+
+await t('the authorize URL asks only for identity, carries state + nonce and lets the person pick an account', () => {
+  const u = new URL(buildGoogleAuthorizeUrl({ state: 's1', nonce: 'n1', redirectUri: 'https://hub.example/api/bongos/auth/google/callback' }));
+  assert.equal(u.origin + u.pathname, 'https://accounts.google.com/o/oauth2/v2/auth');
+  assert.equal(u.searchParams.get('scope'), 'openid email profile');
+  assert.equal(u.searchParams.get('client_id'), 'google-test-client');
+  assert.equal(u.searchParams.get('state'), 's1');
+  assert.equal(u.searchParams.get('nonce'), 'n1');
+  assert.equal(u.searchParams.get('response_type'), 'code');
+  assert.equal(u.searchParams.get('prompt'), 'select_account');
+});
+
+await t('the code exchange posts our secret to Google and checks the token it returns', async () => {
+  let sent = null;
+  const fetchImpl = async (url, init) => { sent = { url, body: new URLSearchParams(init.body) }; return { ok: true, status: 200, json: async () => ({ id_token: idToken(good()) }) }; };
+  const id = await exchangeGoogleCode({ code: 'c1', redirectUri: 'https://hub/cb', nonce: 'n1', fetchImpl, nowMs: NOW });
+  assert.equal(sent.url, 'https://oauth2.googleapis.com/token');
+  assert.equal(sent.body.get('client_secret'), 'google-test-secret');
+  assert.equal(sent.body.get('grant_type'), 'authorization_code');
+  assert.equal(id.subject, '1098765');
+  const refused = async () => ({ ok: false, status: 400, json: async () => ({ error: 'invalid_grant' }) });
+  await assert.rejects(exchangeGoogleCode({ code: 'c1', redirectUri: 'x', nonce: 'n1', fetchImpl: refused }), /invalid_grant/);
+  const forged = async () => ({ ok: true, status: 200, json: async () => ({ id_token: idToken(good({ nonce: 'other' })) }) });
+  await assert.rejects(exchangeGoogleCode({ code: 'c1', redirectUri: 'x', nonce: 'n1', fetchImpl: forged, nowMs: NOW }), /this sign-in/);
+});
+
+// ── the stand-in login ──
+await t('a stand-in login can never be a GitHub login', () => {
+  const GITHUB_LOGIN = /^[A-Za-z0-9-]+$/;
+  for (const [handle, key] of [['ana', '-5'], ['Ana Smith!', '-6'], ['', '-7'], [null, '-8'], ['x'.repeat(80), '-9']]) {
+    const s = standInLogin(handle, key);
+    assert.ok(s.startsWith('~'), s);
+    assert.ok(!GITHUB_LOGIN.test(s), `${s} must not look like a GitHub login`);
+    assert.ok(s.length <= 40, s);
+  }
+  assert.equal(standInLogin('ana', '-5'), '~ana');
+  assert.equal(standInLogin('', '-7'), '~builder7');
+});
+
+// ── the whole browser sign-in through the routes ──
+const gRouter = buildAuthGoogleRouter();
+
+await t('Google sign-in is offered only where the hub and the owner’s Google app both are', () => {
+  assert.equal(googleConfigured(), true);
+  const saved = process.env.BONGOS_GOOGLE_CLIENT_SECRET;
+  delete process.env.BONGOS_GOOGLE_CLIENT_SECRET;
+  try {
+    assert.equal(googleConfigured(), false);
+    const res = fakeRes();
+    handler(gRouter, 'get', '/auth/google/start')(req(), res);
+    assert.equal(res._status, 404, 'no app, no Google door');
+  } finally { process.env.BONGOS_GOOGLE_CLIENT_SECRET = saved; }
+});
+
+let stateCookie;
+await t('start sets a state+nonce cookie and sends the person to Google', () => {
+  const res = fakeRes();
+  handler(gRouter, 'get', '/auth/google/start')(req({ query: { return: '/community' } }), res);
+  stateCookie = res._cookies.bongos_google_state.v;
+  assert.match(stateCookie, /^[0-9a-f]{32}\.[0-9a-f]{32}$/);
+  assert.equal(res._cookies.bongos_google_state.o.httpOnly, true);
+  assert.equal(res._cookies.gds_return.v, '/community');
+  const u = new URL(res._redirect);
+  assert.equal(u.hostname, 'accounts.google.com');
+  assert.equal(u.searchParams.get('state'), stateCookie.split('.')[0]);
+  assert.equal(u.searchParams.get('nonce'), stateCookie.split('.')[1]);
+  assert.match(u.searchParams.get('redirect_uri'), /\/api\/bongos\/auth\/google\/callback$/);
+});
+
+await t('a callback whose state does not match this browser’s is refused and signs nobody in', async () => {
+  const res = fakeRes();
+  await handler(gRouter, 'get', '/auth/google/callback')(req({
+    query: { state: 'forged', code: 'c1' }, headers: { host: 'localhost', cookie: `bongos_google_state=${stateCookie}` },
+  }), res);
+  assert.equal(res._status, 400);
+  assert.equal(calls.createSession.length, 0);
+});
+
+const realFetch = globalThis.fetch;
+async function callback({ person, cookieExtra = '' }) {
+  nextPerson = person;
+  const [state, nonce] = stateCookie.split('.');
+  globalThis.fetch = async () => ({ ok: true, status: 200, json: async () => ({ id_token: idToken(good({ nonce, exp: Date.now() / 1000 + 600 })) }) });
+  const res = fakeRes();
+  try {
+    await handler(gRouter, 'get', '/auth/google/callback')(req({
+      query: { state, code: 'c1' }, headers: { host: 'localhost', cookie: `bongos_google_state=${stateCookie}${cookieExtra}` },
+    }), res);
+  } finally { globalThis.fetch = realFetch; }
+  return res;
+}
+
+await t('a first Google sign-in creates the person, signs them in and sends them to choose their name', async () => {
+  const res = await callback({ person: { personKey: '-5', handle: 'ana', githubLogin: null, created: true } });
+  assert.equal(res._status, 200, res._body);
+  assert.deepEqual(calls.signIn.at(-1), {
+    subject: '1098765', email: 'ana@example.com', emailVerified: true, displayName: 'Ana Example',
+    avatarUrl: 'https://lh3.googleusercontent.com/a/x',
+  }, 'the hub is asked by Google’s own id; the email rides along for display only');
+  const b = calls.upsertBuilder.at(-1);
+  assert.equal(b.githubId, '-5', 'the builder row is keyed on the minted person key');
+  assert.equal(b.githubLogin, '~ana', 'with a stand-in login, never a GitHub-shaped one');
+  assert.equal(calls.createSession.at(-1).source, 'web');
+  assert.equal(calls.createSession.at(-1).builderId, 77);
+  assert.ok(Object.values(res._cookies).some((c) => c.v === calls.createSession.at(-1).token), 'the session cookie is set');
+  assert.equal(res._redirect, '/account?welcome=google');
+  assert.equal(calls.recordHubSignin.at(-1).githubLogin, null, 'the hub is never handed the stand-in as a GitHub login');
+});
+
+await t('a returning Google sign-in goes back where it began', async () => {
+  const res = await callback({ person: { personKey: '-5', handle: 'ana', githubLogin: null, created: false }, cookieExtra: '; gds_return=%2Fcommunity' });
+  assert.equal(res._redirect, '/community');
+});
+
+await t('a person whose GitHub is linked keeps their real GitHub login on the builder row', async () => {
+  await callback({ person: { personKey: '424242', handle: 'octo', githubLogin: 'octocat', created: false } });
+  assert.equal(calls.upsertBuilder.at(-1).githubLogin, 'octocat');
+  assert.equal(calls.recordHubSignin.at(-1).githubLogin, 'octocat');
+});
+
+await t('an invite-only site turns a first-time Google person away without a session', async () => {
+  const before = calls.createSession.length;
+  const saved = process.env.BONGOS_OPEN_XENOS_ENROLLMENT;
+  process.env.BONGOS_OPEN_XENOS_ENROLLMENT = '0';
+  try {
+    assert.equal(admission.openEnrollmentEnabled(), false, 'the case runs with enrollment closed');
+    const res = await callback({ person: { personKey: '-99', handle: 'newbie', githubLogin: null, created: true } });
+    assert.equal(res._status, 403);
+    assert.equal(calls.createSession.length, before, 'no session for a refused person');
+    // …while a person who already has a seat here still gets in.
+    const back = await callback({ person: { personKey: '-5', handle: 'ana', githubLogin: null, created: false } });
+    assert.equal(back._status, 200);
+  } finally {
+    if (saved === undefined) delete process.env.BONGOS_OPEN_XENOS_ENROLLMENT; else process.env.BONGOS_OPEN_XENOS_ENROLLMENT = saved;
+  }
+});
+
+// ── the sign-in chooser on every sign-in link ──
+await t('every sign-in link lands on Continue with GitHub / Continue with Google', async () => {
+  const start = handler(buildAuthRouter(), 'get', '/auth/web/start');
+  const res = fakeRes();
+  await start(req({ query: { return: '/connections', repos: '1' } }), res);
+  assert.equal(res._redirect, null, 'no straight jump to GitHub');
+  assert.match(res._body, /Continue with GitHub/);
+  assert.match(res._body, /Continue with Google/);
+  assert.match(res._body, /auth\/web\/start\?via=github&amp;return=%2Fconnections&amp;repos=1/);
+  assert.match(res._body, /auth\/google\/start\?return=%2Fconnections/);
+  assert.doesNotMatch(res._body, /<script/i, 'the chooser runs no script');
+
+  const viaGithub = fakeRes();
+  await start(req({ query: { via: 'github', return: '/connections' } }), viaGithub);
+  assert.match(viaGithub._redirect, /^https:\/\/github\.com\/login\/oauth\/authorize/, 'the GitHub button goes to GitHub');
+
+  const sw = fakeRes();
+  await start(req({ query: { switch: '1' } }), sw);
+  assert.match(sw._redirect, /github\.com/, '"New account" names a GitHub account and skips the chooser');
+});
+
+// ── the command-line sign-in, approved in the browser ──
+await t('typed codes are read the way people type them', () => {
+  assert.equal(normalizeUserCode('bcdf-ghjk'), 'BCDF-GHJK');
+  assert.equal(normalizeUserCode(' bcdf ghjk '), 'BCDF-GHJK');
+  assert.equal(normalizeUserCode('BCDFGHJ'), null);
+  assert.equal(normalizeUserCode('ABCD-EFGH'), null, 'vowels are never in a code');
+});
+
+await t('with Google offered, the CLI’s device start points the terminal at this site’s approval page', async () => {
+  const start = handler(buildAuthRouter(), 'post', '/auth/device/start');
+  const res = fakeRes();
+  await start(req(), res);
+  const out = res._body;
+  assert.match(out.user_code, /^[B-Z]{4}-[B-Z]{4}$/);
+  assert.match(out.verification_uri, /\/api\/bongos\/auth\/device\?code=[B-Z]{4}-[B-Z]{4}$/);
+  assert.equal(typeof out.device_code, 'string');
+  assert.equal(out.interval, 5);
+  assert.ok(out.expires_in > 0);
+});
+
+await t('the approval page asks a signed-out person to sign in, with both ways in, and comes back', async () => {
+  const flow = startBrowserDeviceFlow({ pageUrl: 'https://hub/api/bongos/auth/device' });
+  const res = fakeRes();
+  await handler(gRouter, 'get', '/auth/device')(req({ query: { code: flow.user_code.toLowerCase() } }), res);
+  assert.match(res._body, /Continue with GitHub/);
+  assert.match(res._body, /Continue with Google/);
+  assert.ok(res._body.includes(encodeURIComponent(`/api/bongos/auth/device?code=${flow.user_code}`)), 'both doors return to this page');
+  const gone = fakeRes();
+  await handler(gRouter, 'get', '/auth/device')(req({ query: { code: 'BBBB-BBBB' } }), gone);
+  assert.equal(gone._status, 404);
+  assert.match(gone._body, /Enter your code/);
+});
+
+const approver = { id: 77, github_id: '-5', github_login: '~ana', display_name: 'Ana Example', rank: 'xenos', status: 'active' };
+const approveReq = (code, over = {}) => req({
+  method: 'POST',
+  body: { user_code: code, decision: 'approve' },
+  builder: approver,
+  headers: { host: 'localhost', cookie: 'bongos_session=tok', origin: 'http://localhost', 'sec-fetch-site': 'same-origin' },
+  ...over,
+});
+
+await t('approving needs the browser cookie and a same-site form, never a bearer or another site', async () => {
+  const approve = handler(gRouter, 'post', '/auth/device/approve');
+  const flow = startBrowserDeviceFlow({ pageUrl: 'https://hub/x' });
+  const before = calls.createSession.length;
+  for (const headers of [
+    { host: 'localhost', authorization: 'Bearer tok' },
+    { host: 'localhost', cookie: 'bongos_session=tok', 'sec-fetch-site': 'cross-site' },
+    { host: 'localhost', cookie: 'bongos_session=tok', origin: 'https://evil.example' },
+  ]) {
+    const res = fakeRes();
+    await approve(approveReq(flow.user_code, { headers }), res);
+    assert.equal(res._status, 403, JSON.stringify(headers));
+  }
+  assert.equal(calls.createSession.length, before, 'nothing minted');
+  assert.ok(pendingFlow(flow.user_code), 'the code is still waiting');
+});
+
+await t('an approved code hands the terminal a CLI session for the approver, exactly once', async () => {
+  const flow = startBrowserDeviceFlow({ pageUrl: 'https://hub/x' });
+  const poll = handler(buildAuthRouter(), 'post', '/auth/device/poll');
+  const pollOnce = async (now) => {
+    const res = fakeRes();
+    await poll(req({ method: 'POST', body: { device_code: flow.device_code } }), res);
+    return res._body;
+  };
+  assert.equal((await pollOnce()).state, 'pending');
+
+  const res = fakeRes();
+  await handler(gRouter, 'post', '/auth/device/approve')(approveReq(flow.user_code), res);
+  assert.equal(res._status, 200, res._body);
+  assert.match(res._body, /You’re signed in/);
+  const minted = calls.createSession.at(-1);
+  assert.equal(minted.source, 'cli');
+  assert.equal(minted.builderId, 77, 'the session belongs to whoever approved');
+  assert.equal(minted.expiresAt, null);
+
+  const out = pollBrowserDeviceFlow(flow.device_code, Date.now() + 60_000);
+  assert.equal(out.state, 'ok');
+  assert.equal(out.token, minted.token);
+  assert.equal(out.builder.github_login, '~ana');
+  assert.equal(pollBrowserDeviceFlow(flow.device_code, Date.now() + 120_000).state, 'expired', 'the token leaves once');
+
+  const again = fakeRes();
+  await handler(gRouter, 'post', '/auth/device/approve')(approveReq(flow.user_code), again);
+  assert.equal(again._status, 404, 'a used code cannot be approved twice');
+});
+
+await t('a cancelled code tells the terminal it was denied and mints nothing', async () => {
+  const flow = startBrowserDeviceFlow({ pageUrl: 'https://hub/x' });
+  const before = calls.createSession.length;
+  const res = fakeRes();
+  await handler(gRouter, 'post', '/auth/device/approve')(approveReq(flow.user_code, { body: { user_code: flow.user_code, decision: 'deny' } }), res);
+  assert.match(res._body, /Sign-in cancelled/);
+  assert.equal(calls.createSession.length, before);
+  assert.equal(pollBrowserDeviceFlow(flow.device_code, Date.now() + 60_000).state, 'denied');
+});
+
+await t('a code expires after ten minutes', () => {
+  const now = Date.now();
+  const flow = startBrowserDeviceFlow({ pageUrl: 'https://hub/x', now });
+  assert.ok(pendingFlow(flow.user_code, now + 60_000));
+  assert.equal(pendingFlow(flow.user_code, now + FLOW_TTL_MS + 1), null);
+  assert.equal(pollBrowserDeviceFlow(flow.device_code, now + FLOW_TTL_MS + 1).state, 'expired');
+});
+
+await t('the pages escape what they show', () => {
+  const html = pages.renderDeviceApprovalPage({ state: 'confirm', userCode: 'BCDF-GHJK', name: '<img src=x onerror=alert(1)>', action: '/a' });
+  assert.ok(!html.includes('<img src=x'), 'a display name is never markup');
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/government_board_expiry.mjs

@@ -107,3 +107,97 @@ test('the manifest declares the poller, and start/stop are idempotent + unref-sa
   // the test runner hanging IS the assertion.
   assert.ok(true);
 });
+
+// --- task 1004960: sleep until the soonest deadline, never overlap ------------
+
+test('cadence: sleeps until just after the soonest deadline, at most 5 minutes; overdue retries at 1 minute', () => {
+  assert.equal(poller.MAX_WAIT_MS, 5 * 60_000, 'the idle wait is 5 minutes, not the old 1');
+  assert.equal(poller.nextDelayMs(null), 5 * 60_000, 'no open clock: one read per 5 minutes');
+  assert.equal(poller.nextDelayMs(30_000), 30_000 + poller.GRACE_MS, 'a window closing in 30s is swept ~1s after it closes');
+  assert.equal(poller.nextDelayMs(2 * 3600_000), 5 * 60_000, 'a far deadline is capped at 5 minutes');
+  assert.equal(poller.nextDelayMs(-5_000), 60_000, 'still overdue after a sweep (close rolled back): retry in a minute, never spin');
+  assert.equal(poller.nextDelayMs(0), 60_000);
+});
+
+test('a run arms the next one from ONE soonest-deadline read', async () => {
+  let reads = 0;
+  const deps = { listFn: async () => [], log: () => {}, error: () => {}, soonestFn: async () => { reads += 1; return 40_000; } };
+  poller.start(deps);
+  try {
+    await poller.tick(deps);
+    assert.equal(reads, 1, 'one MIN(closes_at) read per run');
+    const ms = poller._state().msUntilNextRun;
+    assert.ok(ms > 39_000 && ms <= 41_000, `armed for just after the deadline (got ${ms})`);
+    await poller.tick({ ...deps, soonestFn: async () => null });
+    const idle = poller._state().msUntilNextRun;
+    assert.ok(idle > 299_000 && idle <= 300_000, `no clock open: 5-minute sleep (got ${idle})`);
+  } finally { poller.stop(); }
+});
+
+test('a window opened mid-sleep wakes the poller sooner, so a 1-minute window still closes on time', async () => {
+  const deps = { listFn: async () => [], log: () => {}, error: () => {}, soonestFn: async () => null };
+  poller.start(deps);
+  try {
+    await poller.tick(deps);
+    assert.ok(poller._state().msUntilNextRun > 299_000);
+    poller.noteDeadline(60_000);
+    const ms = poller._state().msUntilNextRun;
+    assert.ok(ms > 60_000 && ms <= 61_000, `woken for the new deadline (got ${ms})`);
+    poller.noteDeadline(4 * 60_000);
+    assert.ok(poller._state().msUntilNextRun <= 61_000, 'a LATER deadline never pushes the alarm back');
+  } finally { poller.stop(); }
+});
+
+test('a deadline noted while a sweep is in flight is kept for the re-arm', async () => {
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  const deps = { listFn: async () => { await gate; return []; }, log: () => {}, error: () => {}, soonestFn: async () => null };
+  poller.start(deps);
+  try {
+    const run = poller.tick(deps);
+    poller.noteDeadline(90_000);
+    release();
+    await run;
+    const ms = poller._state().msUntilNextRun;
+    assert.ok(ms > 89_000 && ms <= 91_000, `the mid-sweep hint set the alarm (got ${ms})`);
+  } finally { poller.stop(); }
+});
+
+test('a run that starts while the previous one is in flight is skipped', async () => {
+  let reads = 0;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  const deps = { listFn: async () => { reads += 1; await gate; return []; }, log: () => {}, error: () => {}, soonestFn: async () => null };
+  const first = poller.tick(deps);
+  const secondRun = poller.tick(deps); // fires while the first is still reading
+  release();
+  const [, second] = await Promise.all([first, secondRun]);
+  assert.deepEqual(second, { skipped: true });
+  assert.equal(reads, 1, 'the overlapping run never touched the database');
+});
+
+test('opening a timed window through db.openBoardItem wakes the started poller', async () => {
+  const gdb = require(path.join(GOV, 'db.js'));
+  const { pool } = require(path.join(ROOT, 'src', 'module-api.js'));
+  const realQuery = pool.query;
+  pool.query = async () => ({ rows: [{ id: '9', closes_at: new Date() }] }); // the INSERT ... RETURNING
+  const deps = { listFn: async () => [], log: () => {}, error: () => {}, soonestFn: async () => null };
+  poller.start(deps);
+  try {
+    await poller.tick(deps);
+    assert.ok(poller._state().msUntilNextRun > 299_000, 'idle: asleep for 5 minutes');
+    await gdb.openBoardItem({ subjectType: 'full_idea', subjectId: '1', windowMinutes: 2 });
+    const ms = poller._state().msUntilNextRun;
+    assert.ok(ms > 119_000 && ms <= 121_000, `a 2-minute window woke it for its deadline (got ${ms})`);
+    poller.stop();
+    await gdb.openBoardItem({ subjectType: 'full_idea', subjectId: '2', windowMinutes: 1 });
+    assert.equal(poller._state().msUntilNextRun, null, 'a stopped poller is not re-armed');
+  } finally { poller.stop(); pool.query = realQuery; }
+});
+
+test('the soonest-deadline read is on the database clock (SQL pin)', () => {
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const read = src.slice(src.indexOf('async function msUntilSoonestOpenDeadline'), src.indexOf('// The summons read'));
+  assert.match(read, /MIN\(closes_at\) - now\(\)/, 'measured on the DATABASE clock');
+  assert.match(read, /closed_at IS NULL AND closes_at IS NOT NULL/, 'open items with a clock only');
+});

package/tests/government_board_membership.mjs

@@ -256,7 +256,10 @@ test('the membership queries exclude machines and the deactivated — structural
   const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
   const start = src.indexOf('getActiveBuildersWithRank');
   assert.ok(start > -1);
-  const block = src.slice(start);
+  // bounded to the two membership reads: a later query filtering status for its own
+  // reasons (task 1005000's access holders) is not one of them
+  const end = src.indexOf('\nasync function ', src.indexOf('async function builderHoldsRankActive') + 1);
+  const block = src.slice(start, end > start ? end : undefined);
   assert.equal((block.match(/b\.status = 'active'/g) || []).length, 2, 'both reads filter status');
   assert.equal((block.match(/b\.system_role IS NULL/g) || []).length, 2, 'both reads exclude principals');
 });

package/tests/government_protected_surfaces.mjs

@@ -279,7 +279,7 @@ const ADDED_SINCE_R101 = [
   // had been carved into `<name>-*.js` siblings and only the facade stayed registered. The
   // carve tripwire further down is what found the four beyond the one the task named.
   // Listed BY NAME, not as `<name>-*.js`: path-match (the goal scope wall) reads no '*'.
-  ...carve('src/bongos/auth.js', ['auth-admission', 'auth-config', 'auth-discord', 'auth-github', 'auth-idp'],
+  ...carve('src/bongos/auth.js', ['auth-admission', 'auth-config', 'auth-discord', 'auth-github', 'auth-google', 'auth-idp'],
     'the auth.js carve: session-token minting and the OAuth exchange, admission and '
     + 'first-admin seating, IdP assertion checks.'),
   ...carve('src/bongos/db.js', ['db-kernel'],

package/tests/government_routes.mjs

@@ -104,7 +104,7 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // task 1004712: the treasury is read, and its pots and borrows decided, where the room is (the holder and the seat are the walls).
   // task 1004715: the strictness presets are read where the law book is.
   // task 1004716: the counts are read where the docket they count is.
-  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
+  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.includes('/government/blockers/') || key.endsWith('/government/access') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }

package/tests/government_seed.mjs

@@ -52,6 +52,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_030_buildouts.sql',                  // a Lead's build-outs, on the record at once or by a passed vote (task 1004711)
   'government_031_treasury.sql',                   // the treasury: a pot per goal and the loans a dry pot asks the reserve for (task 1004712)
   'government_032_ask_flags.sql',                  // the reword list: matters a reader flagged as unclear (owner 2026-10-23)
+  'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.