@bongos/core 1.24.25 → 1.24.26

package/tests/software_update.mjs

@@ -504,6 +504,39 @@ test('the platform, which runs the door, keeps /deploy behind its own page gate'
   assert.match(String(r.location), /auth|sign/i, 'and is sent to sign in, as before');
 });
 
+// ── the door on the hub's apex (task 1004736) ─────────────────────────────────
+//
+// Every hosted project's Update button is `<hub origin>/deploy?project=<slug>` — the IdP
+// origin, or HUB_UPGRADE_URL built from the hub's public origin — and on cloudbongos.com
+// that origin is the apex, where /deploy was a 404 (2026-10-14). The page is the hall's,
+// on builders.<apex>. The hub answers the apex address with the hall's, so every link
+// already written into a project's web.env works without that project moving its core.
+
+function getOn(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => { res.resume(); res.on('end', () => resolve({ status: res.statusCode, location: res.headers.location })); });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the apex /deploy sends the owner to the hall\'s door for the same project (task 1004736)', async () => {
+  const port = await startServer({ [MODULE_ENV]: '1' });
+  for (const p of ['/deploy?project=toast', '/deploy.html?project=toast', '/deploy/?project=toast']) {
+    const r = await getOn(port, p, 'hall.test');
+    assert.equal(r.status, 302, p);
+    assert.equal(r.location, 'https://builders.hall.test/deploy?project=toast', `${p}: the project is carried, so the door opens on it`);
+  }
+  const bare = await getOn(port, '/deploy', 'hall.test');
+  assert.equal(bare.location, 'https://builders.hall.test/deploy', 'no project → the door itself');
+  for (const p of ['/deployments', '/deploy/x', '/api/deploy']) {
+    const r = await getOn(port, p, 'hall.test');
+    assert.notEqual(String(r.location || '').includes('builders.hall.test/deploy'), true, `${p} is not the door`);
+  }
+  const onHall = await getOn(port, '/deploy?project=toast', 'builders.hall.test');
+  assert.doesNotMatch(String(onHall.location || ''), /^https:\/\/builders\./, 'on the hall itself the page is served, not bounced');
+});
+
 // ── the project's OWN update rule reaches the offer (task 1004535) ────────────
 //
 // The live defect, 2026-10-02: cloudbongos's rule on /deploy is `minor` and the sweep