@bongos/core 1.23.4 → 1.23.6

package/tests/module_store_withdraw.mjs

@@ -0,0 +1,201 @@
+// tests/module_store_withdraw.mjs — a Metic+ person can take one version back, and
+// the store stops handing it out while every project that runs it keeps it (task
+// 1004895, criterion wa5-staged-rollout). Drives the real POST
+// /store/modules/:key/versions/:version/withdraw handler and the real update-check
+// route off the real router, the real store reads behind acquire, and the real
+// `bongos upgrade` report, against a stand-in pool that keeps the channel history
+// (no port, no real DB — the module_store_delist.mjs harness).
+//
+// Run:  node tests/module_store_withdraw.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const version = (id, v) => ({ id, module_key: 'weather', version: v, core_version: '^1.20.0', tree_sha256: 't', tarball_sha256: 'x', tarball_bytes: 10, artifact_path: `weather/weather-${v}.tgz`, published_at: 't' });
+const fresh = () => ({
+  modules: { weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed' } },
+  versions: [version(1, '1.0.0'), version(2, '1.1.0')],
+  // The channel HISTORY; the current channel is the newest row per version.
+  channels: [
+    { version_id: 1, channel: 'general', reason: 'predates_staged_rollout', set_by: null },
+    { version_id: 2, channel: 'general', reason: 'promoted_after_7_days', set_by: null },
+  ],
+});
+let state = fresh();
+const current = (versionId) => {
+  const rows = state.channels.filter((c) => c.version_id === Number(versionId));
+  return rows.length ? rows[rows.length - 1].channel : null;
+};
+const query = async (sql, params = []) => {
+  if (/^\s*INSERT INTO store_module_version_channels/.test(sql)) {
+    assert.match(sql, /IS DISTINCT FROM 'withdrawn'/, 'the insert only lands while the version is not already withdrawn');
+    if (current(params[0]) === 'withdrawn') return { rowCount: 0, rows: [] };
+    state.channels.push({ version_id: Number(params[0]), channel: 'withdrawn', reason: 'withdrawn_by_person', set_by: params[1], note: params[2] });
+    return { rowCount: 1, rows: [] };
+  }
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1 AND version = \$2/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0] && v.version === params[1]) };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0]).map((v) => ({ ...v, channel: current(v.id) })) };
+  }
+  if (/AS note\s+FROM store_module_versions v/.test(sql)) {
+    const noteOf = (id) => state.channels.filter((c) => c.version_id === id).at(-1).note;
+    return { rows: state.versions.filter((v) => params[0].includes(v.module_key) && current(v.id) === 'withdrawn').map((v) => ({ ...v, note: noteOf(v.id) })) };
+  }
+  if (/JOIN store_modules m/.test(sql)) {
+    return { rows: state.versions.filter((v) => params[0].includes(v.module_key)).map((v) => ({ ...v, status: state.modules[v.module_key].status, channel: current(v.id) })) };
+  }
+  return { rows: [] };
+};
+const pool = { connect: async () => ({ query, release() {} }), query };
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+const store = require('../src/bongos/module-store.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const mod = require('../scripts/bongos/module.js');
+
+function handlerFor(method, p) {
+  const layer = buildModulesRouter().stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) { const o = typeof opts === 'number' ? { status: opts, details } : (opts || {}); this.statusCode = o.status; this.body = { error: code, ...o }; return this; },
+  };
+  let nextErr = null;
+  await handle({ builder: { id: 3 }, query: {}, body: {}, ...req }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const WITHDRAW = '/store/modules/:key/versions/:version/withdraw';
+const withdraw = (version, reason = 'crashes on start') =>
+  invoke(handlerFor('post', WITHDRAW).handle, { params: { key: 'weather', version }, body: { reason } });
+
+test('the route is gated by module.delist, the permission behind delist and release, and pinned', () => {
+  assert.ok(handlerFor('post', WITHDRAW).depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const rank = fs.readFileSync(path.join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  assert.match(rank, /'POST \/store\/modules\/:key\/versions\/:version\/withdraw': 'perm:module\.delist'/);
+  const catalog = fs.readFileSync(path.join(ROOT, 'modules/government/catalog.js'), 'utf8');
+  assert.match(catalog, /key: 'module\.delist'[^\n]*\/withdraw/, 'the permission says what it guards');
+});
+
+test('a reason is required, and an unknown version or a bad path is refused', async () => {
+  state = fresh();
+  assert.equal((await withdraw('1.1.0', '  ')).statusCode, 400);
+  assert.equal((await withdraw('9.9.9')).statusCode, 404);
+  const bad = await invoke(handlerFor('post', WITHDRAW).handle, { params: { key: 'Weather', version: '1.1.0' }, body: { reason: 'x' } });
+  assert.equal(bad.statusCode, 400);
+  assert.equal(state.channels.length, 2, 'nothing was written');
+});
+
+test('withdrawing writes one withdrawn row naming who did it; a second time is refused', async () => {
+  state = fresh();
+  const first = await withdraw('1.1.0');
+  assert.equal(first.statusCode, 200);
+  assert.deepEqual(first.body, { ok: true, module_key: 'weather', version: '1.1.0', channel: 'withdrawn', reason: 'crashes on start' });
+  assert.deepEqual(state.channels.at(-1), { version_id: 2, channel: 'withdrawn', reason: 'withdrawn_by_person', set_by: 3, note: 'crashes on start' },
+    'the person\'s reason is kept on the row (core_281), the machine code beside it');
+  const again = await withdraw('1.1.0');
+  assert.equal(again.statusCode, 409);
+  assert.equal(again.body.error, 'already_withdrawn');
+  assert.equal(state.channels.length, 3, 'one row, however many times it is asked');
+});
+
+test('the store stops handing it out: acquire offers the newest version still served, and refuses the withdrawn one by name', async () => {
+  state = fresh();
+  await withdraw('1.1.0');
+  const general = store.servedChannels(false);
+  const newest = await store.resolveAcquirable('weather', { channels: general });
+  assert.equal(newest.ok, true);
+  assert.equal(newest.version.version, '1.0.0', 'the withdrawn 1.1.0 is skipped');
+  const exact = await store.resolveAcquirable('weather', { version: '1.1.0', channels: store.servedChannels(true) });
+  assert.equal(exact.ok, false, 'not even a tester project is handed it');
+  assert.match(exact.message, /1\.1\.0 was withdrawn: it is no longer handed out/);
+});
+
+test('withdrawing the only served version leaves nothing to hand out, and acquire says so', async () => {
+  state = fresh();
+  await withdraw('1.0.0');
+  await withdraw('1.1.0');
+  const r = await store.resolveAcquirable('weather', { channels: store.servedChannels(false) });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'no_versions_on_channel');
+  assert.match(r.message, /every version was withdrawn/);
+});
+
+test('the update check names withdrawn versions beside the newest served one', async () => {
+  state = fresh();
+  await withdraw('1.1.0');
+  const res = await invoke(handlerFor('get', '/store/modules/latest').handle, { query: { keys: 'weather' } });
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body.latest.weather.version, '1.0.0');
+  assert.deepEqual(res.body.withdrawn, { weather: [{ version: '1.1.0', note: 'crashes on start' }] });
+});
+
+test('the hall\'s module list marks an installed module whose version was withdrawn, with the reason', async () => {
+  state = fresh();
+  await withdraw('1.1.0', 'security flaw, update now');
+  const routes = require('../src/bongos/routes/modules.js');
+  const realList = routes.listModules;
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  assert.match(src, /m\.store_withdrawn = taken \? \{ version: taken\.version, note: taken\.note \} : null;/, 'the row carries version and note');
+  assert.equal(typeof realList, 'function');
+  const hall = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/modules.js'), 'utf8');
+  const fn = hall.match(/function withdrawnFact\(m\) \{[\s\S]*?\n  \}/)[0];
+  const withdrawnFact = new Function('escapeHtml', `${fn}; return withdrawnFact;`)((t) => String(t).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])));
+  assert.equal(withdrawnFact({ store_withdrawn: null }), '', 'nothing to say when the version was not taken back');
+  const pill = withdrawnFact({ store_withdrawn: { version: '1.1.0', note: 'security flaw, "update" <now>' } });
+  assert.match(pill, /withdrawn · update when a fix is out/);
+  assert.match(pill, /Taken back from the store: security flaw, &quot;update&quot; &lt;now&gt;/, 'the reason is shown, escaped');
+  assert.match(hall, /\$\{delistedFact\(m\)\}\$\{withdrawnFact\(m\)\}/, 'and it is rendered on the row');
+});
+
+const row = (key, version) => ({ key, version, enabled: true, coreVersion: '^1.0.0', satisfied: true });
+function sink() { const s = { out: [], err: [] }; s.log = (l) => s.out.push(l); s.errlog = (l) => s.err.push(l); return s; }
+
+test('bongos upgrade tells a project its version was withdrawn, and names the way off only when one exists', async () => {
+  const run = async (installed, latest, withdrawn) => {
+    const s = sink();
+    const code = await mod.cmdUpgrade([], {
+      ...s,
+      gather: () => ({ core: '1.21.0', errors: [], rows: [row('weather', installed)] }),
+      checkUpdates: async () => ({ checked: true, latest: { weather: { version: latest, core_version: '^1.0.0', status: 'listed' } }, withdrawn }),
+    });
+    return { code, err: s.err.join('\n'), out: s.out.join('\n') };
+  };
+  const fixed = await run('1.1.0', '1.2.0', { weather: [{ version: '1.1.0', note: 'crashes on start' }] });
+  assert.equal(fixed.code, 0, 'a withdrawal is news, never a refusal');
+  assert.match(fixed.err, /weather\s+1\.1\.0\s+— withdrawn in the store \(crashes on start\): it keeps working here, but move to 1\.2\.0 with `bongos module update weather`/);
+  const stuck = await run('1.1.0', '1.0.0', { weather: ['1.1.0'] }); // an older server's plain list still works
+  assert.match(stuck.err, /withdrawn in the store: it keeps working here, but no newer version is out yet/, 'update only moves forward, so the older 1.0.0 is not offered');
+  assert.doesNotMatch(stuck.out, /every installed store module is on its newest version/);
+  const other = await run('1.0.0', '1.0.0', { weather: ['1.1.0'] });
+  assert.doesNotMatch(other.err, /withdrawn/, 'a project on a version that was NOT withdrawn hears nothing');
+  const older = await run('1.0.0', '1.0.0', undefined);
+  assert.equal(older.code, 0, 'a server that predates withdraw answers no withdrawn map, and that is fine');
+});
+
+test('evaluateUpdates: a withdrawn install is reported, whether or not an update exists', () => {
+  const { withdrawn, updates } = mod.evaluateUpdates([row('weather', '1.1.0')], { weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' } }, '1.21.0', { weather: [{ version: '1.1.0', note: 'crashes' }] });
+  assert.deepEqual(withdrawn, [{ key: 'weather', installed: '1.1.0', latest: '1.2.0', enabled: true, note: 'crashes' }]);
+  assert.equal(updates.length, 1, 'the update is still listed: it is the way off');
+});