@bongos/core 1.24.9 → 1.24.10

package/tests/market_watch_settings.mjs

@@ -0,0 +1,392 @@
+// tests/market_watch_settings.mjs — the owner's Market Watch settings (task 1004938, goal
+// 1000137): the four routes in modules/market-watch/routes/settings.js, through real HTTP,
+// the route's own owner-seat check and the real error envelope, over an in-memory pool that
+// answers the module's own SQL. The permission atom gate (project.settings.manage, floor
+// metic) is stood in by a fake that admits exactly its floor, since the real one resolves
+// grants from the database; tests/government_parity.mjs proves the real one matches the
+// floor. So a Xenos is refused by the atom and a Metic, who holds it, by the owner seat.
+//
+// What it proves, in the task's words:
+//   - a non-owner cannot change anything: every route answers 403 to a Metic and a Xenos,
+//     and the stored settings and key are unchanged afterwards;
+//   - turning Market Watch off stops the next run, asserted against the run's OWN gate:
+//     run.js runDue reading settings through store.js createStore over the same pool the
+//     route wrote, with the key read back by key.js readProjectKey;
+//   - the key is write-only: stored sealed, opened by the run's reader, and never in any
+//     response, not even its last four characters.
+//
+// No database, no network, no paid call: the run's createRun is stubbed, so a run that
+// passes every pre-check stops there. The SQL runs on real Postgres in
+// tests/market_watch_data_db.mjs (INTEGRATION set).
+//
+// Run:  node tests/market_watch_settings.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const settings = require('../modules/market-watch/settings.js');
+const key = require('../modules/market-watch/key.js');
+const run = require('../modules/market-watch/run.js');
+const store = require('../modules/market-watch/store.js');
+
+const P = 'https://watch.example.test';
+const OTHER = 'https://other.example.test';
+const KEY = 'sk-ant-api03-the-projects-own-key-QX7Z';
+const NOW = Date.parse('2026-10-29T10:00:00Z');
+
+// --- an in-memory pool that answers the module's SQL ----------------------------------
+// Each branch matches ONE statement by a phrase only that statement has; anything else
+// throws, so a new query can never be silently answered by the wrong branch.
+function fakePool() {
+  const rows = new Map(); // project → settings row
+  const runs = [];        // { id, project, status, reason, trigger, created_at, cost_usd, items_total, items_done }
+  const items = [];       // { project, status }
+  const seen = [];
+  const row = (p) => rows.get(p);
+  const ensure = (p) => {
+    if (!rows.has(p)) rows.set(p, { project: p, enabled: false, monthly_cap_usd: '20.00', cadence: 'weekly', anthropic_key_enc: null, anthropic_key_last4: null, anthropic_key_set_at: null, updated_by: null });
+    return rows.get(p);
+  };
+  async function query(sql, params = []) {
+    seen.push(sql);
+    const s = String(sql);
+    const p = params[0];
+    if (/INSERT INTO market_watch_settings \(project, enabled,/.test(s)) {
+      const existed = rows.has(p);
+      const r = ensure(p);
+      const pick = (v, cur, dflt) => (v !== null ? v : existed ? cur : dflt);
+      r.enabled = pick(params[1], r.enabled, params[5]);
+      r.monthly_cap_usd = String(pick(params[2], r.monthly_cap_usd, params[6]));
+      r.cadence = pick(params[3], r.cadence, params[7]);
+      r.updated_by = params[4];
+      return { rows: [{ enabled: r.enabled, monthly_cap_usd: r.monthly_cap_usd, cadence: r.cadence }] };
+    }
+    if (/INSERT INTO market_watch_settings \(project, anthropic_key_enc,/.test(s)) {
+      const r = ensure(p);
+      assert.match(params[1], /^v1\./, 'the stored key is a secret-box blob');
+      assert.equal(params[2].length, 4);
+      Object.assign(r, { anthropic_key_enc: params[1], anthropic_key_last4: params[2], anthropic_key_set_at: 'now', updated_by: params[3] });
+      return { rows: [{ project: p }] };
+    }
+    if (/SET anthropic_key_enc = NULL/.test(s)) {
+      const r = row(p);
+      if (!r || r.anthropic_key_enc === null) return { rows: [] };
+      Object.assign(r, { anthropic_key_enc: null, anthropic_key_last4: null, anthropic_key_set_at: null, updated_by: params[1] });
+      return { rows: [{ project: p }] };
+    }
+    if (/SELECT \(anthropic_key_enc IS NOT NULL\) AS key_set/.test(s)) {
+      return { rows: row(p) ? [{ key_set: row(p).anthropic_key_enc !== null }] : [] };
+    }
+    if (/^SELECT anthropic_key_enc FROM market_watch_settings/.test(s.trim())) {
+      return { rows: row(p) ? [{ anthropic_key_enc: row(p).anthropic_key_enc }] : [] };
+    }
+    if (/^SELECT enabled, monthly_cap_usd, cadence(, updated_by, updated_at)?\s+FROM market_watch_settings/.test(s.trim())) {
+      return { rows: row(p) ? [{ ...row(p) }] : [] };
+    }
+    if (/COALESCE\(sum\(ri\.cost_usd\), 0\) AS spent/.test(s)) {
+      const spent = runs.filter((r) => r.project === p).reduce((n, r) => n + r.cost_usd, 0);
+      return { rows: [{ spent: String(spent) }] };
+    }
+    if (/AS items_done/.test(s)) {
+      return { rows: runs.filter((r) => r.project === p && r.trigger !== 'seed').slice().reverse().slice(0, params[1]).map((r) => ({ ...r, cost_usd: String(r.cost_usd) })) };
+    }
+    if (/count\(\*\)::int AS n FROM market_watch_items/.test(s)) {
+      return { rows: [{ n: items.filter((i) => i.project === p && i.status === 'active').length }] };
+    }
+    if (/^SELECT created_at FROM market_watch_runs/.test(s.trim())) {
+      const mine = runs.filter((r) => r.project === p);
+      return { rows: mine.length ? [{ created_at: mine[mine.length - 1].created_at }] : [] };
+    }
+    throw new Error(`fake pool: unexpected SQL ${s.slice(0, 80)}`);
+  }
+  return { query, rows, runs, items, seen };
+}
+
+// The secret box, faked so a test can see that the route sealed the key and the run's
+// reader opened it. A route must never decrypt: the box counts every decrypt.
+let decrypts = 0;
+let configured = true;
+const box = {
+  isConfigured: () => configured,
+  encrypt: (s) => `v1.iv.tag.${Buffer.from(s).toString('base64url')}`,
+  decrypt: (b) => { decrypts += 1; return Buffer.from(b.split('.')[3], 'base64url').toString(); },
+};
+
+// --- the app: real envelope, the route's owner seat, a stubbed session and atom --------
+let viewer = null;
+Object.defineProperty(api, 'requireBuilder', {
+  configurable: true,
+  value: (req, res, next) => {
+    if (!viewer) return res.fail('unauthenticated', 401);
+    req.builder = viewer;
+    next();
+  },
+});
+// The atom gate, at the catalog floor it names: read from catalog.js, not retyped here.
+const catalog = require('../modules/government/catalog.js');
+const atomsAsked = [];
+Object.defineProperty(api, 'requirePermission', {
+  configurable: true,
+  value: (...atoms) => {
+    atomsAsked.push(...atoms);
+    return (req, res, next) => {
+      const ok = atoms.every((a) => {
+        const p = catalog.PERMISSIONS.find((x) => x.key === a);
+        return p && api.rankMeetsThreshold(req.builder && req.builder.rank, [p.floor]);
+      });
+      return ok ? next() : res.fail('permission_forbidden', 403);
+    };
+  },
+});
+const quiet = { info() {}, warn() {}, error() {}, debug() {}, child() { return quiet; } };
+Object.defineProperty(api, 'logger', { configurable: true, value: () => quiet });
+
+const pool = fakePool();
+const express = require('express');
+const app = express();
+app.use(attachFail);
+app.use(express.json());
+const buildRouter = require('../modules/market-watch/routes/settings.js');
+app.use('/api/bongos', buildRouter({ pool, project: P, secretBox: box, now: () => NOW, ceilingUsd: 0.27 }));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); let parsed = null; try { parsed = JSON.parse(raw); } catch (_) { /* not json */ } resolve({ status: res.statusCode, raw, body: parsed }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+const OWNER = { id: 1, rank: 'archon' };
+const METIC = { id: 2, rank: 'metic' };
+const XENOS = { id: 3, rank: 'xenos' };
+const as = (who) => { viewer = who; };
+
+// The run, with its own gate: settings through store.js over the SAME pool, the key
+// through key.js readProjectKey. Everything past the pre-checks is stubbed, so a run that
+// would start is recorded as `started` and nothing is ever researched or paid for.
+async function nextTick() {
+  const real = store.createStore(pool);
+  const started = [];
+  const skipped = [];
+  const r = await run.runDue({
+    project: P,
+    now: () => NOW,
+    store: {
+      ...real,
+      openRun: async () => null,
+      lastRun: async () => null,
+      monthSpend: async () => 0,
+      activeRules: async () => ({ id: 1 }),
+      insertSkipped: async (project, o) => { skipped.push(o.reason); return 900 + skipped.length; },
+      createRun: async () => { started.push(true); return null; },
+    },
+    readKey: (project) => key.readProjectKey(pool, project, { decrypt: box.decrypt }),
+    ceilingUsd: 0.27,
+    createClient: () => { throw new Error('no client may be built in this test'); },
+    warn: () => {},
+  });
+  return { r, started: started.length > 0, skipped };
+}
+
+const ROUTES = [
+  ['GET', '/market-watch/settings', undefined],
+  ['PATCH', '/market-watch/settings', { enabled: false }],
+  ['PUT', '/market-watch/settings/key', { key: 'sk-ant-api03-somebody-elses-key-0000' }],
+  ['DELETE', '/market-watch/settings/key', undefined],
+];
+
+// ---------------------------------------------------------------------------------------
+
+test('no session: every route answers 401', async () => {
+  as(null);
+  for (const [m, p, b] of ROUTES) assert.equal((await call(m, p, b)).status, 401, `${m} ${p}`);
+});
+
+test('the owner turns it on, sets the cap and the cadence, and pastes the key', async () => {
+  as(OWNER);
+  const first = await call('GET', '/market-watch/settings');
+  assert.equal(first.status, 200);
+  assert.equal(first.body.enabled, false, 'off until the owner turns it on');
+  assert.equal(first.body.key_set, false);
+  const on = await call('PATCH', '/market-watch/settings', { enabled: true, monthly_cap_usd: 30, cadence: 'biweekly' });
+  assert.equal(on.status, 200, on.raw);
+  assert.deepEqual([on.body.enabled, on.body.monthly_cap_usd, on.body.cadence], [true, 30, 'biweekly']);
+  const k = await call('PUT', '/market-watch/settings/key', { key: KEY });
+  assert.equal(k.status, 200, k.raw);
+  assert.equal(k.body.key_set, true);
+  assert.equal(pool.rows.get(P).updated_by, OWNER.id);
+  // A one-field change keeps the others.
+  const cap = await call('PATCH', '/market-watch/settings', { monthly_cap_usd: 25 });
+  assert.deepEqual([cap.body.enabled, cap.body.monthly_cap_usd, cap.body.cadence], [true, 25, 'biweekly']);
+});
+
+test('a non-owner gets 403 from every route, and nothing changes', async () => {
+  const before = JSON.stringify(pool.rows.get(P));
+  // A Xenos lacks the atom; a Metic holds it and is refused by the owner seat.
+  for (const [who, code] of [[METIC, 'rank_forbidden'], [XENOS, 'permission_forbidden']]) {
+    as(who);
+    for (const [m, p, b] of ROUTES) {
+      const res = await call(m, p, b);
+      assert.equal(res.status, 403, `${who.rank} ${m} ${p}: ${res.raw}`);
+      assert.equal(res.body.error.code, code, `${who.rank} ${m} ${p}`);
+    }
+  }
+  assert.deepEqual([...new Set(atomsAsked)], ['project.settings.manage']);
+  assert.equal(JSON.stringify(pool.rows.get(P)), before, 'a refused write left the settings and the key as they were');
+});
+
+test('with the watch on and a key set, the next run starts', async () => {
+  const { r, started, skipped } = await nextTick();
+  assert.equal(started, true, JSON.stringify(r));
+  assert.deepEqual(skipped, []);
+});
+
+test('a non-owner cannot turn it off: the run still starts', async () => {
+  as(METIC);
+  assert.equal((await call('PATCH', '/market-watch/settings', { enabled: false })).status, 403);
+  const { started } = await nextTick();
+  assert.equal(started, true);
+});
+
+test('turning Market Watch off stops the next run (the run records it skipped: off)', async () => {
+  as(OWNER);
+  const off = await call('PATCH', '/market-watch/settings', { enabled: false });
+  assert.equal(off.status, 200);
+  assert.equal(off.body.enabled, false);
+  assert.deepEqual(off.body.next_run, { state: 'paused', due_at: null });
+  const { r, started, skipped } = await nextTick();
+  assert.equal(started, false, 'no run started');
+  assert.deepEqual([r.outcome, r.reason], ['skipped', 'off']);
+  assert.deepEqual(skipped, ['off']);
+  // On again, and it runs again.
+  await call('PATCH', '/market-watch/settings', { enabled: true });
+  assert.equal((await nextTick()).started, true);
+});
+
+test('the key is stored sealed, opened by the run\'s reader, and never sent back', async () => {
+  as(OWNER);
+  decrypts = 0;
+  const blob = pool.rows.get(P).anthropic_key_enc;
+  assert.ok(blob.startsWith('v1.') && !blob.includes(KEY), 'sealed, not plaintext');
+  for (const [m, p, b] of [['GET', '/market-watch/settings'], ['PATCH', '/market-watch/settings', { cadence: 'weekly' }], ['PUT', '/market-watch/settings/key', { key: KEY }]]) {
+    const res = await call(m, p, b);
+    assert.equal(res.status, 200);
+    assert.ok(!res.raw.includes(KEY), `${m} ${p} returned the key`);
+    assert.ok(!res.raw.includes(KEY.slice(-4)), `${m} ${p} returned the key's last four`);
+    assert.ok(!res.raw.includes('anthropic_key'), `${m} ${p} named a key column`);
+  }
+  assert.equal(decrypts, 0, 'no route decrypts the key');
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), KEY, 'the run reads exactly what the owner pasted');
+});
+
+test('clearing the key stops the next run with no_key; replacing it brings it back', async () => {
+  as(OWNER);
+  const cleared = await call('DELETE', '/market-watch/settings/key');
+  assert.equal(cleared.status, 200);
+  assert.equal(cleared.body.key_set, false);
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), null);
+  const { r, started } = await nextTick();
+  assert.equal(started, false);
+  assert.equal(r.reason, 'no_key');
+  const replaced = await call('PUT', '/market-watch/settings/key', { key: `${KEY}-2` });
+  assert.equal(replaced.body.key_set, true);
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), `${KEY}-2`);
+  assert.equal((await nextTick()).started, true);
+});
+
+test('bad input is refused with 400 and changes nothing', async () => {
+  as(OWNER);
+  const before = JSON.stringify(pool.rows.get(P));
+  for (const body of [{}, { enabled: 'yes' }, { monthly_cap_usd: 0 }, { monthly_cap_usd: 5000 }, { monthly_cap_usd: '20' }, { cadence: 'daily' }, { enabled: true, colour: 'red' }]) {
+    const res = await call('PATCH', '/market-watch/settings', body);
+    assert.equal(res.status, 400, JSON.stringify(body));
+  }
+  for (const body of [{}, { key: 'short' }, { key: 'sk-ant-api03 with spaces in it' }, { key: 42 }]) {
+    const res = await call('PUT', '/market-watch/settings/key', body);
+    assert.equal(res.status, 400, JSON.stringify(body));
+    assert.ok(!res.raw.includes('with spaces'), 'a refused key is not echoed');
+  }
+  assert.equal(JSON.stringify(pool.rows.get(P)), before);
+});
+
+test('no key storage on the project: the key is refused with 409, never stored in the clear', async () => {
+  as(OWNER);
+  configured = false;
+  try {
+    const res = await call('PUT', '/market-watch/settings/key', { key: KEY });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'storage_not_configured');
+  } finally { configured = true; }
+});
+
+test('another project\'s settings are never read or written', async () => {
+  assert.equal(pool.rows.has(OTHER), false);
+  for (const sql of pool.seen) assert.ok(!sql.includes(OTHER));
+});
+
+test('the view: spend, runs of fuel left, the next run, and recent runs with skipped ones marked', async () => {
+  as(OWNER);
+  const day = (d) => new Date(Date.parse('2026-10-01T09:00:00Z') + d * 86_400_000).toISOString();
+  pool.runs.push(
+    { id: 1, project: P, status: 'done', reason: null, trigger: 'seed', created_at: day(0), cost_usd: 0, items_total: 0, items_done: 0 },
+    { id: 2, project: P, status: 'done', reason: null, trigger: 'poller', created_at: day(7), cost_usd: 3, items_total: 33, items_done: 33 },
+    { id: 3, project: P, status: 'skipped', reason: 'cap_reached', trigger: 'poller', created_at: day(14), cost_usd: 0, items_total: 0, items_done: 0 },
+    { id: 4, project: P, status: 'done', reason: null, trigger: 'poller', created_at: day(23), cost_usd: 3.2, items_total: 35, items_done: 35 },
+  );
+  await call('PATCH', '/market-watch/settings', { enabled: true, monthly_cap_usd: 20, cadence: 'weekly' });
+  const v = (await call('GET', '/market-watch/settings')).body;
+  assert.equal(v.spent_this_month_usd, 6.2);
+  assert.equal(v.left_this_month_usd, 13.8);
+  assert.equal(v.month, 'october');
+  assert.equal(v.run_estimate_usd, 3.1);
+  assert.equal(v.run_estimate_basis, 'recent');
+  assert.equal(v.runs_left, 4);
+  assert.deepEqual(v.next_run, { state: 'scheduled', due_at: new Date(Date.parse(day(23)) + 7 * 86_400_000).toISOString() });
+  assert.deepEqual(v.recent_runs.map((r) => [r.id, r.status, r.reason]), [[4, 'done', null], [3, 'skipped', 'cap_reached'], [2, 'done', null]], 'newest first, the seed run hidden');
+  assert.deepEqual(v.cadences, ['weekly', 'biweekly', 'monthly']);
+});
+
+// --- pure ---------------------------------------------------------------------------
+
+test('runEstimate: recent runs first, else every active item at its ceiling, else nothing', () => {
+  assert.deepEqual(settings.runEstimate([{ status: 'done', cost_usd: 2 }, { status: 'skipped', cost_usd: 0 }, { status: 'partial', cost_usd: 4 }], 10, 0.27), { usd: 3, basis: 'recent' });
+  assert.deepEqual(settings.runEstimate([], 10, 0.27), { usd: 2.7, basis: 'ceiling' });
+  assert.deepEqual(settings.runEstimate([], 0, 0.27), { usd: null, basis: 'none' });
+});
+
+test('nextRun: paused when off, soon when due, else the date', () => {
+  const now = Date.parse('2026-10-29T00:00:00Z');
+  assert.deepEqual(settings.nextRun(false, '2026-10-28T00:00:00Z', 'weekly', now), { state: 'paused', due_at: null });
+  assert.deepEqual(settings.nextRun(true, null, 'weekly', now), { state: 'soon', due_at: null });
+  assert.deepEqual(settings.nextRun(true, '2026-10-01T00:00:00Z', 'weekly', now), { state: 'soon', due_at: null });
+  assert.equal(settings.nextRun(true, '2026-10-28T00:00:00Z', 'biweekly', now).due_at, '2026-11-11T00:00:00.000Z');
+});
+
+// --- the wall is on every route, not just the ones above -------------------------------
+
+test('every route in the settings router mounts requireBuilder, the atom, then the owner seat', () => {
+  const src = readFileSync(new URL('../modules/market-watch/routes/settings.js', import.meta.url), 'utf8');
+  const routes = [...src.matchAll(/router\.(get|post|put|patch|delete)\(\s*'([^']+)'\s*,([^\n]*)/g)];
+  assert.equal(routes.length, ROUTES.length, 'a new route joins ROUTES above, so its 403 is tested');
+  for (const [, m, p, rest] of routes) {
+    assert.match(rest, /^\s*api\.requireBuilder,\s*api\.requirePermission\('project\.settings\.manage'\),\s*ownerSeat,/, `${m.toUpperCase()} ${p}`);
+    assert.ok(ROUTES.some(([rm, rp]) => rm === m.toUpperCase() && rp === p), `${m.toUpperCase()} ${p} is in ROUTES`);
+  }
+});

package/tests/nav_permission_atoms.mjs

@@ -92,8 +92,9 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the seats read from /me's server-resolved positions block; task 1004730: the banner
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
-// task 1004846: the new logo (its bump landed late, in task 1004852).
-const SHELL_SHA = 'cea38eeab6b234cc';
+// task 1004846: the new logo (its bump landed late, in task 1004852); task 1004938: the
+// Market Watch settings nav item and its fuel glyph.
+const SHELL_SHA = '4022e01fbb4045ad';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);