@bongos/core 1.23.5 → 1.23.7

package/tests/module_remove.mjs

@@ -0,0 +1,121 @@
+// tests/module_remove.mjs — `bongos module remove <key>` takes a store module off a
+// project without losing anything (task 1004896, goal 1000091). Runs the real
+// cmdRemove against a throwaway instance folder on disk and a stand-in store: no
+// port, no real DB, no session.
+//
+// Run:  node tests/module_remove.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { cmdRemove } = require('../scripts/bongos/module-remove.js');
+const mod = require('../scripts/bongos/module.js');
+
+function instance() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'module-remove-'));
+  const dir = path.join(root, 'modules', 'weather');
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'module.json'), '{"key":"weather","version":"1.2.0"}');
+  fs.writeFileSync(path.join(dir, 'index.js'), 'module.exports = {};');
+  return { root, dir };
+}
+const row = (over = {}) => ({ key: 'weather', source: 'instance', enabled: false, version: '1.2.0', ...over });
+
+// A stand-in store: GET /modules answers the hall's switch, GET .../listing whether
+// the store knows the key. Every call is recorded, so a test can prove nothing was written.
+function store({ hall = false, known = true, reachable = true } = {}) {
+  const calls = [];
+  const request = async (method, url) => {
+    calls.push(`${method} ${url}`);
+    if (!reachable) throw new Error('ECONNREFUSED');
+    if (url === '/modules') return { ok: true, status: 200, data: { modules: hall === null ? [] : [{ key: 'weather', enabled: hall }] } };
+    if (url === '/store/modules/weather/listing') {
+      return known ? { ok: true, status: 200, data: { module_key: 'weather', listed: true } } : { ok: false, status: 404, data: { error: 'module_not_found' } };
+    }
+    return { ok: false, status: 500, data: null };
+  };
+  return { request, calls };
+}
+
+async function run(args, { rows = [row()], st = store(), root } = {}) {
+  const out = [];
+  const err = [];
+  const code = await cmdRemove(args, {
+    log: (l) => out.push(l), errlog: (l) => err.push(l),
+    gather: () => ({ rows }), request: st.request, storeError: (r) => `HTTP ${r.status}`,
+    instanceRoot: root, now: () => new Date('2026-10-26T12:00:00Z'),
+  });
+  return { code, out: out.join('\n'), err: err.join('\n') };
+}
+
+test('a store module that is switched off is moved aside, not deleted, and the output says how to undo it', async () => {
+  const { root, dir } = instance();
+  const st = store();
+  const r = await run(['weather'], { st, root });
+  assert.equal(r.code, 0, r.err);
+  assert.equal(fs.existsSync(dir), false, 'modules/weather/ is gone from the project');
+  const parked = path.join(root, 'var', 'removed-modules', 'weather-1.2.0-20261026T120000Z');
+  assert.equal(fs.readFileSync(path.join(parked, 'index.js'), 'utf8'), 'module.exports = {};', 'every file kept, byte for byte');
+  assert.equal(fs.readFileSync(path.join(root, 'var', 'removed-modules', '.gitignore'), 'utf8'), '*\n', 'the parked folder never dirties the instance tree');
+  assert.match(r.out, /Removed "weather" 1\.2\.0/);
+  assert.match(r.out, /move it back to modules\/weather\/ to undo/);
+  assert.match(r.out, /database tables were left in place/, 'owner decision 2026-10-26: keep the tables');
+  assert.match(r.out, /without buying it again/, 'the entitlement is untouched');
+  assert.ok(st.calls.every((c) => c.startsWith('GET ')), 'nothing on the server is written');
+});
+
+test('a module switched on in config is refused, and nothing moves', async () => {
+  const { root, dir } = instance();
+  const r = await run(['weather'], { rows: [row({ enabled: true })], root });
+  assert.equal(r.code, 1);
+  assert.match(r.err, /is switched on\. Switch it off first/);
+  assert.ok(fs.existsSync(dir));
+});
+
+test('a module switched on only in the hall is refused too', async () => {
+  const { root, dir } = instance();
+  const r = await run(['weather'], { st: store({ hall: true }), root });
+  assert.equal(r.code, 1);
+  assert.match(r.err, /switched on in the hall's Modules tab/);
+  assert.ok(fs.existsSync(dir));
+});
+
+test('a key the store does not know is the project\'s own code: refused, nothing moved', async () => {
+  const { root, dir } = instance();
+  const r = await run(['weather'], { st: store({ known: false }), root });
+  assert.equal(r.code, 1);
+  assert.match(r.err, /this project's own code, not a store copy/);
+  assert.ok(fs.existsSync(dir));
+});
+
+test('a core module, a module not installed, and a bad key are refused', async () => {
+  const { root, dir } = instance();
+  const core = await run(['weather'], { rows: [row({ source: 'core' })], root });
+  assert.equal(core.code, 1);
+  assert.match(core.err, /ships with the core/);
+  const absent = await run(['rain'], { rows: [], root });
+  assert.equal(absent.code, 1);
+  assert.match(absent.err, /not installed in this project/);
+  for (const args of [[], ['--force'], ['Weather']]) assert.equal((await run(args, { root })).code, 2, args.join(' '));
+  assert.ok(fs.existsSync(dir));
+});
+
+test('an unreachable store refuses rather than guessing, and nothing moves', async () => {
+  const { root, dir } = instance();
+  const r = await run(['weather'], { st: store({ reachable: false }), root });
+  assert.equal(r.code, 1);
+  assert.match(r.err, /could not be reached/);
+  assert.ok(fs.existsSync(dir));
+});
+
+test('`bongos module remove` is dispatched and documented in the help', () => {
+  const out = [];
+  mod.printHelp((l) => out.push(l));
+  assert.match(out.join('\n'), /bongos module remove <key>/);
+  assert.equal(typeof mod.cmdRemove, 'function');
+});

package/tests/module_store_cli.mjs

@@ -158,7 +158,7 @@ test('the text view keeps the API order: listed ranked, then New, and says the f
   assert.equal(at('stripe-10'), -1, 'the eleventh is not shown');
   assert.match(text, /stripe-00@1\.0\.0 {2}99\/100 {2}free {2}Money › Stripe payments/);
   assert.match(text, /stripe-01@1\.0\.0 {2}98\/100 {2}\$9\.00/);
-  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}40 credits$/m, 'no category, no place');
+  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}40 credits \(not yet buyable\)$/m, 'no category, no place; paid is not yet buyable (task 1004894)');
   assert.match(text, /waiting@1\.0\.0 {2}60\/100 {2}free {2}Money$/m, 'a proposed sub-category shows its parent only');
   assert.match(text, /New — not ranked[\s\S]*fresh@1\.0\.0/);
 });

package/tests/module_store_price.mjs

@@ -0,0 +1,207 @@
+// tests/module_store_price.mjs — a store module's author sets its price (task
+// 1004894, criterion wa5-module-economy). Drives the real POST
+// /store/modules/:key/price handler off the real router, the real setPrice and
+// isFreePrice behind it, the real catalog read, and `bongos module price`, against a
+// stand-in pool that keeps the price history (no port, no real DB — the
+// module_store_delist.mjs harness).
+//
+// Run:  node tests/module_store_price.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const fresh = () => ({
+  modules: {
+    weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed' },
+    gone: { module_key: 'gone', title: 'Gone', author_id: 42, status: 'delisted' },
+  },
+  prices: [],
+  setAt: 0,
+});
+let state = fresh();
+const newestPrice = (key) => state.prices.filter((p) => p.module_key === key).at(-1) || null;
+const query = async (sql, params = []) => {
+  if (/^INSERT INTO store_module_prices/.test(sql)) {
+    const [module_key, price_cents, price_credits, set_by] = params;
+    state.prices.push({ module_key, price_cents, price_credits, set_by, set_at: ++state.setAt });
+    return { rows: [] };
+  }
+  if (/FROM store_module_prices\s+WHERE module_key = \$1/.test(sql)) {
+    const p = newestPrice(params[0]); return { rows: p ? [p] : [] };
+  }
+  if (/FROM store_module_prices\s+WHERE module_key = ANY/.test(sql)) {
+    return { rows: params[0].map(newestPrice).filter(Boolean) };
+  }
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1/.test(sql)) {
+    return { rows: [{ id: 1, module_key: params[0], version: '1.0.0', channel: 'general' }] };
+  }
+  if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
+    return { rows: [{ module_key: 'weather', title: 'Weather', version_id: 1, version: '1.0.0', published_at: 't' }] };
+  }
+  if (/FROM module_assessment_scores/.test(sql)) {
+    return { rows: [{ version_id: 1, overall: 80, security_passed: true, is_new: false }] };
+  }
+  return { rows: [] };
+};
+const pool = { connect: async () => ({ query, release() {} }), query };
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+const store = require('../src/bongos/module-store.js');
+const listing = require('../src/bongos/module-listing.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const mod = require('../scripts/bongos/module.js');
+
+const PRICE = '/store/modules/:key/price';
+function handlerFor() {
+  const layer = buildModulesRouter().stack.find((l) => l.route && l.route.path === PRICE && l.route.methods.post);
+  assert.ok(layer, `no POST ${PRICE} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function setPrice(body, { key = 'weather', builderId = 42 } = {}) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) {
+      const o = typeof opts === 'number' ? { status: opts, details } : (opts || {});
+      this.statusCode = o.status; this.body = { error: { code, message: o.message } }; return this;
+    },
+  };
+  let nextErr = null;
+  await handlerFor().handle({ params: { key }, body, builder: { id: builderId } }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+test('the route rides the publish atom and is pinned', () => {
+  assert.ok(handlerFor().depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const rank = fs.readFileSync(path.join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  assert.match(rank, /'POST \/store\/modules\/:key\/price': 'perm:module\.submit'/);
+});
+
+test('only the author may set the price; a stranger and a delisted module are refused', async () => {
+  state = fresh();
+  const stranger = await setPrice({ cents: 500 }, { builderId: 7 });
+  assert.equal(stranger.statusCode, 403);
+  assert.equal(stranger.body.error.code, 'not_module_author');
+  const gone = await setPrice({ cents: 500 }, { key: 'gone' });
+  assert.equal(gone.statusCode, 409);
+  const missing = await setPrice({ cents: 500 }, { key: 'nope' });
+  assert.equal(missing.statusCode, 404);
+  assert.equal(state.prices.length, 0, 'nothing was written');
+});
+
+test('a price must be whole numbers of 0 or more, and name at least one currency', async () => {
+  state = fresh();
+  for (const body of [{}, { cents: null, credits: null }, { cents: -1 }, { cents: 1.5 }, { credits: '10' }, { cents: 1e12 }]) {
+    const r = await setPrice(body);
+    assert.equal(r.statusCode, 400, JSON.stringify(body));
+    assert.ok(['bad_price', 'validation_failed'].includes(r.body.error.code), r.body.error.code);
+  }
+  assert.equal(state.prices.length, 0);
+});
+
+test('each change appends a row naming who set it, and the newest is what acquire reads', async () => {
+  state = fresh();
+  const first = await setPrice({ cents: 900 });
+  assert.equal(first.statusCode, 200);
+  assert.deepEqual(first.body, { ok: true, module_key: 'weather', previous: null, price: { cents: 900, credits: null } });
+  const second = await setPrice({ cents: 500, credits: 40 });
+  assert.deepEqual(second.body.previous, { cents: 900, credits: null });
+  assert.equal(state.prices.length, 2, 'the history is kept');
+  assert.equal(state.prices[1].set_by, 42);
+  const acq = await store.resolveAcquirable('weather', {});
+  assert.equal(acq.ok, true);
+  assert.deepEqual([acq.price.price_cents, acq.price.price_credits], [500, 40]);
+  assert.equal(acq.free, false);
+  await setPrice({ credits: 0 });
+  assert.equal((await store.resolveAcquirable('weather', {})).free, true, '0 in either currency is free');
+});
+
+test('the catalog shows the price, and marks a paid module not yet buyable until buying opens', async () => {
+  state = fresh();
+  let cat = await listing.listCatalog({});
+  assert.equal(cat.listed[0].price.free, true);
+  assert.equal(cat.listed[0].buyable, true, 'a free module can be had today');
+  await setPrice({ cents: 900 });
+  cat = await listing.listCatalog({});
+  assert.deepEqual(cat.listed[0].price, { cents: 900, credits: null, free: false });
+  assert.equal(cat.listed[0].buyable, false, 'buying arrives with task 1003788');
+});
+
+test('bongos module price: sends the price, says what it was and now is, and that paid is not yet buyable', async () => {
+  const sent = [];
+  const request = async (method, url, opts) => {
+    sent.push({ method, url, json: opts && opts.json });
+    return { ok: true, status: 200, data: { ok: true, previous: { cents: 0, credits: null }, price: { cents: 900, credits: 40 } } };
+  };
+  const out = [];
+  assert.equal(await mod.cmdPrice(['weather', '--cents', '900', '--credits', '40'], { log: (l) => out.push(l), errlog: () => {}, request }), 0);
+  assert.deepEqual(sent, [{ method: 'POST', url: '/store/modules/weather/price', json: { cents: 900, credits: 40 } }]);
+  assert.match(out.join('\n'), /"weather" now costs \$9\.00 or 40 credits \(was free\)/);
+  assert.match(out.join('\n'), /not yet buyable/);
+});
+
+test('bongos module price: refuses no key, no amount and a non-number before asking the store', async () => {
+  const request = async () => { throw new Error('must not be called'); };
+  for (const args of [[], ['--cents', '5'], ['weather'], ['weather', '--cents', 'five'], ['weather', '--credits', '-3']]) {
+    const errs = [];
+    assert.equal(await mod.cmdPrice(args, { log: () => {}, errlog: (l) => errs.push(l), request }), 2, args.join(' '));
+    assert.match(errs.join('\n'), /usage: bongos module price/);
+  }
+});
+
+test('bongos module price: the store refusing is reported, not swallowed', async () => {
+  const errs = [];
+  const request = async () => ({ ok: false, status: 403, data: { error: { code: 'not_module_author', message: 'Only the author of "weather" may set its price.' } } });
+  assert.equal(await mod.cmdPrice(['weather', '--cents', '100'], { log: () => {}, errlog: (l) => errs.push(l), request }), 1);
+  assert.match(errs.join('\n'), /Only the author of "weather" may set its price/);
+});
+
+test('the price history is the audit: who set each price and when, and what it replaced', async () => {
+  state = fresh();
+  await setPrice({ cents: 900 });
+  await setPrice({ cents: 500 }, { builderId: 42 });
+  const rows = state.prices.filter((r) => r.module_key === 'weather');
+  assert.deepEqual(rows.map((r) => [r.price_cents, r.set_by]), [[900, 42], [500, 42]], 'every change is a row naming who set it');
+  assert.ok(rows[1].set_at > rows[0].set_at, 'in order, so the row before is what it changed from');
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/module-store.js'), 'utf8');
+  assert.match(src, /FROM store_modules WHERE module_key = \$1 FOR UPDATE/, 'one transaction, the module row locked');
+});
+
+test('bongos module publish --cents/--credits sets the price after the upload, and checks it before packing', async () => {
+  const packed = { tgz: Buffer.from('x'), sidecar: { module_version: '1.0.0', core_version: '^1.0.0', file_count: 1, tree_sha256: 'a'.repeat(64), tarball: { name: 'x.tgz' } } };
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'publish-price-'));
+  fs.mkdirSync(path.join(dir, 'weather'));
+  const artifact = require('../scripts/bongos/module-artifact.js');
+  fs.writeFileSync(path.join(dir, 'weather', artifact.HOWTO_FILE), artifact.HOWTO_SECTIONS.map((h) => `## ${h}\n\nText.\n`).join('\n'));
+  const sent = [];
+  const priceRequest = async (method, url, opts) => { sent.push([method, url, opts.json]); return { ok: true, status: 200, data: { previous: null, price: opts.json } }; };
+  const upload = async () => ({ ok: true, status: 201, data: { version: { version: '1.0.0' }, channel: 'tester' } });
+  const out = [];
+  const code = await mod.cmdPublish(['--cents', '900', 'weather'], { log: (l) => out.push(l), errlog: (l) => out.push(l), modulesDir: dir, pack: () => packed, upload, priceRequest });
+  assert.equal(code, 0, out.join('\n'));
+  assert.deepEqual(sent, [['POST', '/store/modules/weather/price', { cents: 900, credits: null }]], 'the key is found even after a valued flag');
+  let packedAtAll = false;
+  const bad = await mod.cmdPublish(['weather', '--cents', 'nine'], { log: () => {}, errlog: () => {}, modulesDir: dir, pack: () => { packedAtAll = true; return packed; }, upload, priceRequest });
+  assert.equal(bad, 2);
+  assert.equal(packedAtAll, false, 'a bad price refuses before anything is packed or sent');
+  const failing = async () => ({ ok: false, status: 403, data: { error: { message: 'Only the author' } } });
+  const errs = [];
+  assert.equal(await mod.cmdPublish(['weather', '--credits', '40'], { log: () => {}, errlog: (l) => errs.push(l), modulesDir: dir, pack: () => packed, upload, priceRequest: failing }), 1);
+  assert.match(errs.join('\n'), /The version is published, but its price was not set\. Run `bongos module price weather --credits 40`/);
+});