@bongos/core 1.24.5 → 1.24.6

package/tests/credit_log_no_spend_db.mjs

@@ -0,0 +1,160 @@
+// tests/credit_log_no_spend_db.mjs — task 1004988 (goal 1000092; ADR 0385
+// decision 2, ADR 0387). Real DB.
+//
+// Builds credit_log in a throwaway schema, applies the REAL migration
+// (migrations/core_286_credit_log_no_spend.sql), and proves the DATABASE refuses a row that spends,
+// redeems or transfers credits, while every existing reversal path still books:
+//
+//   - task.confirmed_reversal — the only reversal path that exists today: the
+//     ADR 0120 clawback, migrations/core_194_confirmed_backlog_clawback.sql. It is
+//     re-run here, verbatim, AFTER the trigger, exactly as the integration suite's
+//     clawback_confirmed_backlog test re-runs it on a fully migrated database.
+//   - reversal:<id> — the general shape the trigger defines for any future one.
+//
+// modules/economy itself writes no negative row today (every writer there books
+// earnings, and the descent and idea writers drop a non-positive delta), so the
+// economy writers are covered by the "positive and zero rows are untouched"
+// cases rather than by a reversal of their own.
+//
+// The probe the task asks for is built in: the last block DROPS the trigger and
+// shows the same spend row is then admitted, so a test that kept passing without
+// the trigger would fail that block.
+//
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/credit_log_no_spend_db.mjs
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATION = 'core_286_credit_log_no_spend.sql';
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try { client = await pgPool.connect(); } catch (e) {
+  console.log(`credit_log_no_spend_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+const SCHEMA = `t1004988_${process.pid}`;
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+const refused = async (sql, params, m) => {
+  await client.query('SAVEPOINT s');
+  let err = null;
+  try { await client.query(sql, params); } catch (e) { err = e; }
+  await client.query('ROLLBACK TO SAVEPOINT s');
+  ok(err && err.code === '23514', `${m}${err ? '' : ' (it was admitted)'}`);
+};
+const ins = (builder, task, delta, reason) => client.query(
+  'INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES ($1, $2, $3, $4) RETURNING id',
+  [builder, task, delta, reason],
+).then((r) => r.rows[0].id);
+const balance = async (b) => Number((await client.query('SELECT total_credits FROM builders WHERE id = $1', [b])).rows[0].total_credits);
+
+try {
+  await client.query(`CREATE SCHEMA ${SCHEMA}`);
+  await client.query(`SET search_path TO ${SCHEMA}`);
+  // The columns credit_log and its balance trigger carry (migrations/003_pms.sql
+  // plus the later description/session columns), and the task columns core_194
+  // reads and writes.
+  await client.query(`CREATE TABLE builders (id bigserial PRIMARY KEY, total_credits integer NOT NULL DEFAULT 0)`);
+  await client.query(`CREATE TABLE tasks (id bigserial PRIMARY KEY, status text NOT NULL,
+    needs_rebase boolean NOT NULL DEFAULT false, needs_rebase_reason text, needs_rebase_at timestamptz, updated_at timestamptz)`);
+  await client.query(`CREATE TABLE credit_log (id bigserial PRIMARY KEY, builder_id bigint NOT NULL REFERENCES builders(id),
+    task_id bigint REFERENCES tasks(id), delta integer NOT NULL, reason text NOT NULL, description text,
+    session_id text, recorded_at timestamptz NOT NULL DEFAULT now())`);
+  await client.query(`CREATE FUNCTION pms_apply_credit() RETURNS trigger AS $$
+    BEGIN UPDATE builders SET total_credits = total_credits + NEW.delta WHERE id = NEW.builder_id; RETURN NEW; END;
+    $$ LANGUAGE plpgsql`);
+  await client.query('CREATE TRIGGER trg_credit_log_apply AFTER INSERT ON credit_log FOR EACH ROW EXECUTE FUNCTION pms_apply_credit()');
+  await client.query(readFileSync(join(here, '..', 'migrations', MIGRATION), 'utf8'));
+
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 1
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 2
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 3
+  await client.query("INSERT INTO tasks (status) VALUES ('confirmed'), ('shipped')"); // 1, 2
+  await client.query('BEGIN');
+
+  // Earning and audit rows are untouched.
+  const earned = await ins(1, 2, 30, 'task.shipped');
+  await ins(1, null, 12, 'session.token_reward');
+  await ins(1, null, 0, 'rank_change');
+  ok(await balance(1) === 42, 'positive and zero rows book as before');
+  // Every reason the economy writers book today (modules/economy/credits.js and
+  // achievements.js). All are positive; none may be caught by the spend names.
+  const ECONOMY_REASONS = [
+    'task.shipped', 'task.confirmed', 'session.token_reward', 'idea_promotion_bonus',
+    'ship.net_negative', 'tweak.page_approved:2', 'idea.credit.task_ship:7:2',
+    'idea.credit.full_pass:7', 'idea.credit.governance_pass:7', 'achievement.first-ship',
+  ];
+  for (const reason of ECONOMY_REASONS) await ins(3, null, 1, reason);
+  ok(await balance(3) === ECONOMY_REASONS.length, `every economy writer's reason still books (${ECONOMY_REASONS.join(', ')})`);
+
+  // Spend, redemption, transfer: refused.
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['spend'], 'a raw negative spend row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['redemption'], 'a raw negative redemption row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['module.purchase'], 'any other negative row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, 5, $1)', ['transfer.in'], 'the positive half of a transfer is refused too');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 0, $1)', ['redemption'], 'a zero-value redemption row is refused');
+  ok(await balance(1) === 42, 'no refused row moved the balance');
+  // The refused names match as whole words, so a reason that only starts with
+  // the letters still books.
+  await ins(3, null, 1, 'achievement.spender-of-the-month');
+  await ins(3, null, 1, 'spender-of-the-month');
+  ok(await balance(3) === ECONOMY_REASONS.length + 2, 'a reason that merely starts with "spend" is not refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 1, $1)', ['spend:7'], 'spend:<x> is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 1, $1)', ['Transfer-out'], 'and the match ignores case');
+
+  // reversal:<id> — exists, same builder, positive, never more than booked.
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['reversal:999999'], 'a reversal naming no row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, -5, $1)', [`reversal:${earned}`], 'a reversal of another builder\'s row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -31, $1)', [`reversal:${earned}`], 'a reversal larger than the row is refused');
+  await ins(1, 2, -20, `reversal:${earned}`);
+  await ins(1, 2, -10, `reversal:${earned}`);
+  ok(await balance(1) === 12, 'reversal:<id> books, in parts, up to the whole row');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -1, $1)', [`reversal:${earned}`], 'a reversal past the row\'s total is refused');
+  const audit = (await client.query("SELECT id FROM credit_log WHERE reason = 'rank_change'")).rows[0].id;
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -1, $1)', [`reversal:${audit}`], 'a zero row cannot be reversed');
+
+  // task.confirmed_reversal — the ADR 0120 clawback, re-run verbatim.
+  await ins(2, 1, 15, 'task.confirmed');
+  const core194 = readFileSync(join(here, '..', 'migrations', 'core_194_confirmed_backlog_clawback.sql'), 'utf8')
+    .replace(/^\s*(BEGIN|COMMIT);\s*$/gim, ''); // already inside this test's transaction
+  await client.query(core194);
+  ok(await balance(2) === 0, 'core_194 (task.confirmed_reversal) still reverses a confirmed task\'s credit');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, 1, -1, $1)', ['task.confirmed_reversal'], 'that reversal cannot go past what was booked');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, 2, -1, $1)', ['task.confirmed_reversal'], 'nor reverse a task that booked nothing');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, -1, $1)', ['task.confirmed_reversal'], 'nor run without a task');
+
+  // Existing rows are never rewritten: the trigger is INSERT-only.
+  const { rows: trig } = await client.query(
+    "SELECT tgtype FROM pg_trigger WHERE tgname = 'trg_credit_log_refuse_spend' AND tgrelid = 'credit_log'::regclass");
+  // tgtype bits: 1 ROW, 2 BEFORE, 4 INSERT, 8 DELETE, 16 UPDATE.
+  ok(trig.length === 1 && (trig[0].tgtype & 2) && (trig[0].tgtype & 4) && !(trig[0].tgtype & 24), 'the trigger is BEFORE INSERT only');
+  const { rows: idx } = await client.query(
+    "SELECT pg_get_indexdef(indexrelid) AS def FROM pg_index WHERE indexrelid = 'idx_credit_log_reversals'::regclass");
+  ok(idx.length === 1 && /\(builder_id, reason\) WHERE \(delta < 0\)/.test(idx[0].def),
+    'the reversal sums read a partial index of negative rows only, not the whole ledger');
+  const { rows: cmt } = await client.query(`SELECT col_description('credit_log'::regclass,
+       (SELECT attnum FROM pg_attribute WHERE attrelid = 'credit_log'::regclass AND attname = 'delta')) AS d,
+     obj_description('credit_log'::regclass) AS t`);
+  ok(!/redemption|spent \(future\)/i.test(`${cmt[0].d} ${cmt[0].t}`), 'the comments no longer offer redemption or a future spend');
+
+  // The probe: without the trigger the same spend row is admitted.
+  await client.query('DROP TRIGGER trg_credit_log_refuse_spend ON credit_log');
+  await ins(1, null, -5, 'spend');
+  ok(await balance(1) === 7, 'probe: with the trigger dropped, the spend row books — the trigger is what refuses it');
+
+  await client.query('ROLLBACK');
+  console.log(`credit_log_no_spend_db: ${pass} passed`);
+} finally {
+  await client.query('ROLLBACK').catch(() => {});
+  await client.query('SET search_path TO public').catch(() => {});
+  await client.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end();
+}

package/tests/effective_visibility_predicate.mjs

@@ -172,6 +172,14 @@ const NON_PUBLIC_READS = [
     fn: 'listLoginsForPerson',
     why: 'the own-scope read behind GET /me/sign-in-methods (task 1004992): which ways in the signed-in person has, keyed on their authenticated key only. It returns their own providers and addresses to themselves; a private account must still see its own sign-in methods.',
   },
+  {
+    fn: 'linkLogin',
+    why: 'linking a second way in (task 1004995): finds the signed-in person\'s own account row by their authenticated key to attach the login to. It returns only linked/refused to that person; a private account must still be able to link.',
+  },
+  {
+    fn: 'unlinkLogin',
+    why: 'removing a way in (task 1004995): locks the signed-in person\'s own logins by their authenticated key to count them. It returns only unlinked/refused to that person; a private account must still be able to unlink.',
+  },
   {
     fn: 'hiddenGithubIds',
     why: 'the closeness-graph consent gate — it answers only "which of these accounts set hide_stats", the OPPOSITE question to visibility. Its callers are requireBuilder-gated and it must stay fail-closed on hide alone (ADR 0171 D4); joining addressability would silently empty the graph of every private account for readers who are allowed to see the edge.',

package/tests/hub_account_page.mjs

@@ -83,8 +83,8 @@ test('the script builds no markup from strings, and the controls are real markup
 
 test('the door returns here, and the page calls only its own-scoped routes', () => {
   assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
-  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
-  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/', 'GET /me/guilds'].sort());
+  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST|DELETE)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/', 'GET /me/guilds', 'GET /me/sign-in-methods', 'DELETE /me/sign-in-methods/'].sort());
   // the bar's two calls live in the shared asset: the identity read and sign out
   const barCalls = [...BAR.matchAll(/fetch\(API \+ '([^']+)', \{ method: '(GET|POST)'/g)].map((m) => `${m[2]} ${m[1]}`);
   assert.deepEqual(barCalls.sort(), ['GET /me', 'POST /auth/logout']);
@@ -183,7 +183,7 @@ const ACCOUNT = () => ({
 // A DOM stub just wide enough for this page: every id in the markup is an
 // element (hidden where the markup says so), every radio and link input is
 // addressable by the selectors the script uses, and fetch answers from a handler.
-function boot(answer) {
+function boot(answer, { search = '' } = {}) {
   const els = new Map();
   const listeners = (o) => { o._on = {}; o.addEventListener = (t, f) => { (o._on[t] ||= []).push(f); }; return o; };
   // textContent reads the node's own text plus its children's, and setting it
@@ -299,7 +299,7 @@ function boot(answer) {
   };
   const location = { hostname: 'cloudbongos.com', pathname: '/account' };
   // one global, as in the browser: hub-bar.js sets window.HubBar, then the page reads it
-  const ctx = vm.createContext({ document, fetch, location, window: { location: { assign(p) { dom.assigned = p; } } }, URL, Array, Object, JSON, Promise });
+  const ctx = vm.createContext({ document, fetch, location, window: { location: { search, assign(p) { dom.assigned = p; } } }, URL, Array, Object, JSON, Promise });
   vm.runInContext(BAR, ctx);
   vm.runInContext(SCRIPT, ctx);
   return dom;
@@ -498,7 +498,7 @@ test('the section ships inside the signed-in body, last, as a list with an empty
 test('signed in: the list is read once, after the account, and each row names its project and host with its own Leave', async () => {
   const dom = boot(building(BUILDING));
   await settle();
-  assert.deepEqual(dom.calls.filter((c) => c.method === 'GET' && c.path !== '/me').map((c) => c.path), ['/me/cross-project', '/my-projects', '/me/guilds']);
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'GET' && c.path !== '/me').map((c) => c.path), ['/me/cross-project', '/my-projects', '/me/guilds', '/me/sign-in-methods']);
   assert.equal(dom.els.get('buildingLoading').hidden, true);
   assert.equal(dom.els.get('buildingEmpty').hidden, true);
   const rows = rowsOf(dom);
@@ -857,3 +857,89 @@ test('the hall trusts only a bare https hub origin (OTB.hubOrigin, shared by Set
   assert.equal(origin('https://cloudbongos.com/account'), null, 'a value with a path is not an origin');
   assert.equal(origin('https://user@cloudbongos.com'), null);
 });
+
+// ── ways to sign in (task 1004995) ───────────────────────────────────────────
+// Link is a link to the sign-in routes; their answer comes back in the address.
+// A way in the server says cannot be removed shows why, never a Remove.
+
+const WAYS = (methods) => (m, p) => {
+  if (m === 'GET' && p === '/me/cross-project') return { status: 200, data: ACCOUNT() };
+  if (m === 'GET' && p === '/me/sign-in-methods') return { status: 200, data: { methods, providers: ['github', 'google'] } };
+  if (m === 'DELETE' && p === '/me/sign-in-methods/google') return { status: 200, data: { ok: true } };
+  if (m === 'DELETE' && p === '/me/sign-in-methods/github') return { status: 409, data: { error: { code: 'last_way_in', message: 'this is your only way in, so it cannot be removed — link another first' } } };
+  return { status: 500, data: null };
+};
+const waysOf = (dom) => dom.els.get('waysList').children;
+const actionOf = (row) => row.children[1].children[0];
+
+test('the ways section sits in the signed-in body with its list and status line', () => {
+  const body = PAGE.split('<div id="acctBody" hidden>')[1].split('</main>')[0];
+  const sec = (body.match(/<section class="aSec" id="aWaysIn" aria-labelledby="aWaysIn-h">[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(sec, 'ways to sign in is a section of the account body (the link routes land on #aWaysIn)');
+  assert.match(sec, /<ul class="mineRows" id="waysList"><\/ul>/);
+  assert.match(sec, /Linking never joins two accounts\./, 'the page says the no-merge rule up front');
+});
+
+test('one row per provider: a held way in shows its address and Remove; a missing one links to its sign-in', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: 'born_with' },
+  ]));
+  await settle();
+  const rows = waysOf(dom);
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].children[0].children[0].textContent, 'GitHub');
+  assert.equal(rows[0].children[0].children[1].textContent, 'linked', 'no address shown → linked');
+  assert.equal(rows[0].children[0].children[2].textContent, 'Your account was made with GitHub, so GitHub stays linked.');
+  assert.equal(rows[0].children[1].children.length, 0, 'no Remove for a way in the server keeps');
+  assert.equal(rows[1].children[0].children[1].textContent, 'not linked');
+  assert.equal(actionOf(rows[1]).textContent, 'Link Google');
+  assert.equal(actionOf(rows[1]).href, '/api/bongos/auth/google/start?link=1');
+});
+
+test('Link GitHub goes to the GitHub link route; the only way in says why it stays', async () => {
+  const dom = boot(WAYS([{ provider: 'google', email: 'ana@example.com', unlink_refused: 'last_way_in' }]));
+  await settle();
+  const [gh, goo] = waysOf(dom);
+  assert.equal(actionOf(gh).href, '/api/bongos/auth/link/github/start');
+  assert.equal(goo.children[0].children[1].textContent, 'ana@example.com');
+  assert.match(goo.children[0].children[2].textContent, /^Your only way in, so it stays\./);
+});
+
+test('Remove sends one DELETE, says so, and re-reads the list', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: null },
+    { provider: 'google', email: 'ana@example.com', unlink_refused: null },
+  ]));
+  await settle();
+  const google = waysOf(dom)[1];
+  dom.click(actionOf(google));
+  assert.equal(actionOf(google).textContent, 'Removing…');
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'DELETE').map((c) => c.path), ['/me/sign-in-methods/google']);
+  assert.equal(dom.text('waysMsg'), 'Google is removed. It no longer opens this account.');
+  assert.equal(dom.calls.filter((c) => c.path === '/me/sign-in-methods' && c.method === 'GET').length, 2);
+});
+
+test('a refused Remove is said in the server’s words and keeps the button', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: null },
+    { provider: 'google', email: null, unlink_refused: null },
+  ]));
+  await settle();
+  const gh = waysOf(dom)[0];
+  dom.click(actionOf(gh));
+  await settle();
+  assert.equal(dom.text('waysMsg'), 'This is your only way in, so it cannot be removed — link another first.');
+  assert.equal(actionOf(gh).disabled, false);
+  assert.equal(actionOf(gh).textContent, 'Remove');
+});
+
+test('a link’s answer is said plainly: linked, already its own account (never merged), cancelled', async () => {
+  const say = async (search) => { const d = boot(WAYS([]), { search }); await settle(); return [d.text('waysMsg'), d.els.get('waysMsg').className]; };
+  assert.deepEqual(await say('?linked=google'), ['Google is linked. You can now sign in with either.', 'projMsg ok']);
+  const [taken, cls] = await say('?link_refused=taken&provider=github');
+  assert.match(taken, /^That GitHub account already has its own account here, so it was not linked\. We never join two accounts; nothing changed\.$/);
+  assert.equal(cls, 'projMsg err');
+  assert.match((await say('?link_refused=cancelled&provider=google'))[0], /^You cancelled linking Google\. Nothing changed\.$/);
+  assert.match((await say('?link_refused=whatever&provider=google'))[0], /^Couldn’t link Google\. Try again\.$/);
+});