@bongos/core 1.24.15 → 1.24.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.15",
+  "version": "1.24.16",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10975,5 +10975,11 @@
       "id": "1004906",
       "text": "The payment processor is chosen: Stripe Connect. Each project's money will sit in its own Stripe account, so we never hold anyone's money. J.P. Morgan Payments is recorded as the backup. Nothing is bought or opened yet, and th"
     }
+  ],
+  "1.24.16": [
+    {
+      "id": "1005028",
+      "text": "Settings now has a Your age section where you record your age group, which switches on AI Studio for adults."
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.16'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/settings_age.mjs

@@ -0,0 +1,110 @@
+// tests/settings_age.mjs — the "Your age" panel on /builders/settings (task 1005028).
+// WHY. AI Studio and payouts read the latest age record, and the only writer is a
+// route that needs a person signed in on the website. This page is the one way to
+// write it, so the panel must read the band, offer exactly the server's four bands,
+// and save through that route — a panel that drifted from the server's tiers would
+// offer a choice the server refuses.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import vm from 'node:vm';
+
+const require = createRequire(import.meta.url);
+const read = (f) => readFileSync(new URL(`../modules/hall-ui/public/${f}`, import.meta.url), 'utf8');
+const gates = require('../src/bongos/payout-gates.js');
+
+const html = read('settings.html');
+const js = read('settings-age.js');
+
+test('the panel offers exactly the age bands the server accepts', () => {
+  const offered = [...html.matchAll(/name="age-tier" value="([^"]+)"/g)].map((m) => m[1]).sort();
+  assert.deepEqual(offered, [...gates.AGE_TIERS].sort());
+});
+
+test('the section joins a rail group, starts hidden, and its script is loaded and self-boots', () => {
+  const section = html.match(/<section class="scroll" id="age-scroll"[^>]*>/);
+  assert.ok(section, 'the panel has a section');
+  assert.match(section[0], /data-group="account"/);
+  assert.match(section[0], /\bhidden\b/);
+  assert.match(html, /<script src="\/builders\/settings-age\.js/);
+  assert.match(js, /\$\('#age-scroll'\)\.hidden = false/);
+  assert.match(read('settings.js'), /'age': 'age-scroll'/, 'the deep link /settings#age resolves');
+});
+
+// Run the real script against a fake page and a fake client.
+async function run({ tier, saveStatus = 201, loadStatus = 200 }) {
+  const calls = [];
+  const el = () => ({ hidden: true, textContent: '', disabled: false, listeners: {}, addEventListener(e, f) { this.listeners[e] = f; } });
+  const nodes = { '#age-current': el(), '#age-status': el(), '#age-save': el(), '#age-scroll': el() };
+  let checked = null;
+  const radios = {};
+  const sandbox = {
+    window: {
+      OTB: { $: (q) => nodes[q], toast: (m) => calls.push(['toast', m]) },
+      BongosClient: {
+        createClient: () => ({
+          request: async (method, path, opts) => {
+            calls.push([method, path, opts && opts.body]);
+            if (method === 'GET') return loadStatus < 400 ? { ok: true, status: 200, data: { age_tier: tier } } : { ok: false, status: loadStatus, data: { error: { message: 'The server said so.' } } };
+            return saveStatus < 400 ? { ok: true, status: saveStatus, data: {} } : { ok: false, status: saveStatus, data: { error: { message: 'no' } } };
+          },
+        }),
+      },
+      location: { assign() {} },
+    },
+    document: {
+      querySelector: (q) => {
+        if (q === 'input[name="age-tier"]:checked') return checked;
+        const m = q.match(/value="([^"]+)"/);
+        return m ? (radios[m[1]] = radios[m[1]] || { value: m[1], checked: false }) : null;
+      },
+    },
+  };
+  vm.runInNewContext(js, sandbox);
+  await new Promise((r) => setTimeout(r, 0));
+  return { calls, nodes, radios, choose: (v) => { checked = { value: v }; } };
+}
+
+test('nothing on record says so, and shows the panel', async () => {
+  const r = await run({ tier: null });
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.equal(r.nodes['#age-scroll'].hidden, false);
+});
+
+test('the band on record is shown and preselected', async () => {
+  const r = await run({ tier: 'adult' });
+  assert.match(r.nodes['#age-current'].textContent, /18 or older/);
+  assert.equal(r.radios.adult.checked, true);
+});
+
+test('saving posts the chosen band to the server route, and refuses to post with nothing chosen', async () => {
+  const r = await run({ tier: null });
+  await r.nodes['#age-save'].listeners.click();
+  assert.equal(r.calls.filter((c) => c[0] === 'POST').length, 0, 'no choice, no request');
+  r.choose('adult');
+  await r.nodes['#age-save'].listeners.click();
+  // JSON, because an object born inside the vm fails strict deepEqual on its prototype.
+  assert.equal(JSON.stringify(r.calls.find((c) => c[0] === 'POST')), JSON.stringify(['POST', '/api/bongos/me/payout-age', { tier: 'adult' }]));
+  assert.match(r.nodes['#age-current'].textContent, /18 or older/);
+});
+
+test('a refused save keeps what was on record and tells the person', async () => {
+  const r = await run({ tier: null, saveStatus: 403 });
+  r.choose('adult');
+  await r.nodes['#age-save'].listeners.click();
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.ok(r.calls.some((c) => c[0] === 'toast' && /Could not save/.test(c[1])));
+});
+
+test('a failed read says what the server said and leaves the panel hidden', async () => {
+  const r = await run({ tier: null, loadStatus: 500 });
+  assert.equal(r.nodes['#age-scroll'].hidden, true);
+  assert.ok(r.calls.some((c) => c[0] === 'toast' && /The server said so./.test(c[1])), 'the envelope message, not a bare HTTP code');
+});
+
+test('a band the page does not know is never put into a selector', async () => {
+  const r = await run({ tier: 'x"],body[x="' });
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.equal(Object.keys(r.radios).length, 0);
+});