@bongos/core 1.24.91 → 1.24.92

package/tests/cli_reauth_browser.mjs

@@ -0,0 +1,157 @@
+// tests/cli_reauth_browser.mjs — signing the command line back in is one Approve
+// click in the browser, on every instance (task 1005118).
+//
+// What this pins:
+//   - a re-sign-in's device start (approve_in_browser) gets this site's own approval
+//     page even where Google sign-in is OFF; a plain start keeps GitHub's flow, so
+//     `bongos login`'s not_approved → access-request path is untouched;
+//   - on a GitHub-only site the approval page offers GitHub alone (no dead Google door);
+//   - the CLI asks for the browser page only when told to, and prints the whole link;
+//   - the saved session keeps the builder's other fields for the same instance and
+//     never carries another instance's fields across.
+//
+// DB-free and network-free. Run: node tests/cli_reauth_browser.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+for (const p of ['BONGOS', 'CLOUDBONGOS', 'GDS', 'OTB']) {
+  delete process.env[`${p}_GOOGLE_CLIENT_ID`];
+  delete process.env[`${p}_GOOGLE_CLIENT_SECRET`];
+}
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+
+const auth = require('../src/bongos/auth.js');
+const { googleConfigured } = require('../src/bongos/auth-google.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const buildAuthGoogleRouter = require('../src/bongos/routes/auth-google.js');
+const { pollBrowserDeviceFlow } = require('../src/bongos/device-approval.js');
+const { runDeviceFlow } = require('../scripts/bongos/login.js');
+const { nextSession } = require('../scripts/bongos/reauth.js');
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+function fakeRes() {
+  const res = {
+    _status: 200, _body: null, _headers: {},
+    status(c) { this._status = c; return this; },
+    type() { return this; },
+    send(b) { this._body = b; return this; },
+    json(b) { this._body = b; return this; },
+    set(k, v) { this._headers[k.toLowerCase()] = v; return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+function handler(router, method, path) {
+  const layer = router.stack.find((l) => l.route?.path === path && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${path} exists`);
+  return layer.route.stack.at(-1).handle;
+}
+const req = (over = {}) => ({ query: {}, headers: { host: 'localhost' }, baseUrl: '/api/bongos', body: {}, ...over });
+
+const orig = { configured: auth.authConfigured, start: auth.startDeviceFlow, resolve: auth.resolveSession };
+auth.authConfigured = () => true;
+let githubStarts = 0;
+auth.startDeviceFlow = async () => {
+  githubStarts++;
+  return { device_code: 'gh_dc', user_code: 'WXYZ-1234', verification_uri: 'https://github.com/login/device', expires_in: 900, interval: 5 };
+};
+auth.resolveSession = async () => null;
+
+await t('this test runs as a GitHub-only site', () => {
+  assert.equal(googleConfigured(), false);
+});
+
+await t('a re-sign-in asks for the browser page and gets this site’s own approval page, Google or not', async () => {
+  const res = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: true } }), res);
+  assert.match(res._body.verification_uri, /\/api\/bongos\/auth\/device\?code=[B-Z]{4}-[B-Z]{4}$/);
+  assert.equal(githubStarts, 0, 'GitHub’s code entry is not started');
+  assert.equal(pollBrowserDeviceFlow(res._body.device_code).state, 'pending', 'the terminal waits on this site');
+});
+
+await t('a plain start on a GitHub-only site keeps GitHub’s flow (first sign-in, access requests)', async () => {
+  const res = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req(), res);
+  assert.equal(res._body.verification_uri, 'https://github.com/login/device');
+  assert.equal(githubStarts, 1);
+  const truthy = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: 'yes' } }), truthy);
+  assert.equal(truthy._status, 400, 'only a boolean asks; anything else is refused, never guessed');
+  const stray = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { other: 1 } }), stray);
+  assert.equal(stray._status, 400, 'unknown fields are refused (ADR 0118)');
+  assert.equal(githubStarts, 1, 'a refused ask starts nothing');
+});
+
+await t('on a GitHub-only site the approval page offers GitHub alone', async () => {
+  const start = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: true } }), start);
+  const res = fakeRes();
+  await handler(buildAuthGoogleRouter(), 'get', '/auth/device')(req({ query: { code: start._body.user_code } }), res);
+  assert.match(res._body, /Continue with GitHub/);
+  assert.doesNotMatch(res._body, /Continue with Google/, 'no door to a sign-in this site does not offer');
+});
+
+auth.authConfigured = orig.configured;
+auth.startDeviceFlow = orig.start;
+auth.resolveSession = orig.resolve;
+
+await t('the CLI asks for the browser page only when told to, and prints the whole link', async () => {
+  const realFetch = globalThis.fetch;
+  const bodies = [];
+  const link = 'https://cloudbongos.com/api/bongos/auth/device?code=BCDF-GHJK';
+  globalThis.fetch = async (url, opts) => {
+    if (/device\/start$/.test(url)) {
+      bodies.push(opts.body);
+      return { ok: true, status: 200, text: async () => JSON.stringify({ device_code: 'd', user_code: 'BCDF-GHJK', verification_uri: link, expires_in: 0, interval: 0 }) };
+    }
+    if (/device\/poll$/.test(url)) {
+      return { ok: true, status: 200, text: async () => JSON.stringify({ state: 'ok', token: 'tok', builder: { id: 3 } }) };
+    }
+    throw new Error(`unexpected fetch ${url}`);
+  };
+  const lines = [];
+  // The first poll approves (the loop waits one interval first); an unknown platform
+  // opens no real browser.
+  const savedPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+  Object.defineProperty(process, 'platform', { value: 'test-none' });
+  try {
+    const out = await runDeviceFlow('https://cloudbongos.com', { log: (l) => lines.push(l), browser: true });
+    assert.deepEqual(out, { state: 'ok', token: 'tok', builder: { id: 3 } }, 'the approval hands back the session');
+    await runDeviceFlow('https://cloudbongos.com', { log: () => {} });
+  } finally {
+    globalThis.fetch = realFetch;
+    Object.defineProperty(process, 'platform', savedPlatform);
+  }
+  assert.deepEqual(JSON.parse(bodies[0]), { approve_in_browser: true });
+  assert.equal(bodies[1], undefined, 'a plain login sends no ask');
+  assert.ok(lines.some((l) => l.includes(link)), 'the link is printed whole, never cut to the box');
+});
+
+await t('the saved session keeps the same instance’s fields and never carries another’s', () => {
+  const builder = { id: 3, github_login: 'test-archon', rank: 'archon' };
+  const same = nextSession(
+    { token: 'old', api_base: 'https://cloudbongos.com', gemini_api_key: 'g', builder: { id: 3 }, extra: 1 },
+    { token: 'new', builder, apiBase: 'https://cloudbongos.com' },
+  );
+  assert.deepEqual(same, { token: 'new', api_base: 'https://cloudbongos.com', gemini_api_key: 'g', builder, extra: 1 });
+  const other = nextSession(
+    { token: 'old', api_base: 'https://toast.cloudbongos.com', gemini_api_key: 'g', extra: 1 },
+    { token: 'new', builder, apiBase: 'https://cloudbongos.com' },
+  );
+  assert.deepEqual(other, { gemini_api_key: 'g', token: 'new', builder, api_base: 'https://cloudbongos.com' });
+  assert.deepEqual(nextSession(null, { token: 'n', builder, apiBase: 'https://x.test' }), { token: 'n', builder, api_base: 'https://x.test' });
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/hall_city.mjs

@@ -403,11 +403,20 @@ function fakeDom() {
     getElementById: (id) => byId.get(id) || null,
     createElement: (t) => mk(t),
     createElementNS: (_ns, t) => mk(t),
+    // the archived line, as city.html writes it (task 1005209 reads its links for the visor)
+    querySelector: (sel) => (sel === '.city-archived' ? archivedLine() : null),
   };
   return { document, byId, html };
 }
 
-async function bootPage({ feeds = {}, stored = null, osDark = true, shell = undefined, stage = null } = {}) {
+// The page's own archived line: its links, from city.html, word for word.
+function archivedLine() {
+  const line = /<p class="city-archived">([\s\S]*?)<\/p>/.exec(read('city.html'))[1];
+  const links = [...line.matchAll(/<a href="([^"]+)">([^<]+)<\/a>/g)].map(([, href, text]) => ({ textContent: text, getAttribute: (k) => (k === 'href' ? href : null) }));
+  return { querySelectorAll: () => links };
+}
+
+async function bootPage({ feeds = {}, stored = null, osDark = true, shell = undefined, stage = null, visor = undefined } = {}) {
   const { document, byId, html } = fakeDom();
   const store = new Map(stored ? [['hall-theme', stored]] : []);
   const calls = [];
@@ -425,6 +434,7 @@ async function bootPage({ feeds = {}, stored = null, osDark = true, shell = unde
   const observers = [];
   class MutationObserver { constructor(fn) { this.fn = fn; observers.push(this); } observe() {} }
   window.OTBShell = shell;
+  window.OTBVisor = visor;
   if (stage) { const m = document.createElement('main'); m.setAttribute('id', 'hall-main'); Object.assign(m, stage); }
   const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, console, MutationObserver });
   ctx.globalThis = ctx;
@@ -494,3 +504,33 @@ test('docket text lands as text: a title with markup is never parsed', async ()
   const p = await bootPage({ feeds: FEEDS([matter({ title: '<img src=x onerror=alert(1)>', short: '<b>x</b>' })]) });
   assert.equal(p.byId.get('cityPins').children.length, 1);
 });
+
+
+// task 1005209 (ADR 0403): in game mode the city's door and its archived links are the visor's.
+test("game mode: the door is the visor's lead action on D, and the archived links are in its sheet", async () => {
+  const scenes = [];
+  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs' }), matter({ id: 'blockers:2', state: 'needs' })];
+  const p = await bootPage({ feeds: FEEDS(ms), visor: { scene: (sc) => scenes.push(sc) } });
+  const last = scenes[scenes.length - 1];
+  assert.equal(last.place, 'Governor city');
+  const [lead, street, views] = last.actions;
+  assert.equal(lead.label, 'Start governing', 'what the door says, before the living city reads who it waits on (hall_city_living pins the count)');
+  assert.deepEqual([lead.key, lead.bind, lead.lead], ['d', true, true], 'it is on the glass, and D (which nothing else binds) presses it');
+  assert.deepEqual([street.label, views.label], ['Archived: Street', 'Archived: Building Level Views'], "the line's own words, read off the page");
+  assert.ok(!street.lead && !views.lead && !street.bind && !views.bind, 'the archived links are rows in the sheet, reached by A then the keyboard');
+  const went = [];
+  p.window.location = { assign: (u) => went.push(u) };
+  street.run();
+  views.run();
+  assert.deepEqual(went, ['/builders/street', '/builders/street#building=charter'], 'each goes where its link went');
+  const n = scenes.length;
+  p.window.GovCityPage.draw(true);
+  assert.equal(scenes.length, n, 'a redraw with the same door registers nothing new');
+  assert.deepEqual(JSON.parse(JSON.stringify(last.keys.map((k) => k.key))), ['1–9', '← →'], "the card's own keys are still listed");
+});
+
+test('game mode: the scene carries no button of its own; classic mode keeps the door and the links', () => {
+  const css = read('city.css');
+  assert.ok(css.includes('\nhtml.visor-on .city-start, html.visor-on .city-archived { display: none; }'), 'off the scene only while the visor is up');
+  assert.doesNotMatch(css, /^\.city-start[^{]*\{[^}]*display: none/m, 'never hidden outside game mode');
+});

package/tests/hall_city_living.mjs

@@ -534,6 +534,8 @@ test('the page reads the living feeds and draws the sky, the plates, the plaque
   const m = city();
   const start = p.byId.get('cityStart');
   assert.equal(start.textContent, m.cta.label);
+  const lead = p.window.__visorScene.actions[0];
+  assert.equal(lead.label.toLowerCase(), m.cta.label, 'in game mode the lead action on the visor says what the door says (task 1005209)');
   assert.equal(start.attrs.href, '#decide');
   assert.equal(p.byId.get('cityLine').textContent, m.line);
   for (const id of ['cityBlds', 'citySky', 'cityPins', 'cityPlaque']) assert.equal(findAll(p.byId.get(id), (n) => 'data-proto' in n.attrs).length, 0, id + ': nothing marked prototype');

package/tests/hall_visor.mjs

@@ -66,6 +66,17 @@ test('a key means an action only when nothing else spent it', () => {
   assert.equal(V.keyFor('artisan', ev('Escape')), null, 'the ambient glass never takes Escape (ADR 0399 §2.4)');
 });
 
+// task 1005209: a scene action the visor binds (bind: true) answers its key after the character's.
+test("a place's own key: the visor binds it only when the scene asks, and the character's keys win", () => {
+  const V = loadPure();
+  const ev = (key) => ({ key, defaultPrevented: false, ctrlKey: false, metaKey: false, altKey: false });
+  const run = () => {};
+  V.scene({ name: 'x', place: 'X', actions: [{ label: 'Decide', key: 'D', bind: true, lead: true, run }, { label: 'Back to centre', key: '0', run }, { label: 'Claim here', key: 'c', bind: true, run }] });
+  assert.equal(V.keyFor('artisan', ev('d')).label, 'Decide', 'bound, and case does not matter');
+  assert.equal(V.keyFor('artisan', ev('0')), null, "a key the scene binds itself stays the scene's");
+  assert.equal(V.keyFor('artisan', ev('c')).id, 'claim', "the character's key wins a clash");
+});
+
 // task 1005203: the four segments are the version the project is building, in quarters.
 test('progress: the starred version while open, else the one building, else none', () => {
   const V = loadPure();
@@ -146,7 +157,7 @@ test('source: the minimal visor spends the Helm tokens and types in no colour, s
   assert.ok(phone, 'the phone rules sit in the shared phone block');
   assert.match(phone[0], /\.visor__hint:not\(\[data-visor-sheet\]\) \{ display: none; \}/, 'a phone keeps only Actions of the hints');
   assert.doesNotMatch(read('home-city.css'), /visor-on/, 'Home has no top-right pill to clear any more');
-  assert.match(read('city.css'), /\nhtml\.visor-on \.city-door \{ bottom: 150px; \}/, 'the city\'s door clears the centred button at every width');
+  assert.match(read('city.css'), /\nhtml\.visor-on \.city-door \{ bottom: 224px; \}/, 'the city\'s door clears the centred button at every width');
 });
 
 // ---------- in a browser: the glass over a stand-in scene ----------
@@ -260,6 +271,21 @@ test('Escape closes one layer, top first: the sheet, then the scene\'s pick, the
   await ctx.close();
 });
 
+test('a lead scene action is the first key hint, and its click and its key run it (task 1005209)', { skip }, async () => {
+  const { ctx, page, errors } = await open();
+  await page.evaluate(() => OTBVisor.scene({ name: 'test', place: 'Test city', actions: [{ label: 'Decide 2 in a row', key: 'd', bind: true, lead: true, run() { window.decided = (window.decided || 0) + 1; } }] }));
+  const hints = await page.$$eval('.visor__hints .visor__hint', (h) => h.map((x) => x.textContent));
+  assert.deepEqual(hints, ['DDecide 2 in a row', 'TYour thinking', 'AActions', 'EscOptions']);
+  await page.click('.visor__hint--place');
+  await page.keyboard.press('d');
+  assert.equal(await page.evaluate(() => window.decided), 2, 'the hint and D both press it');
+  await page.evaluate(() => document.documentElement.removeAttribute('data-game'));
+  await page.keyboard.press('d');
+  assert.equal(await page.evaluate(() => window.decided), 2, 'outside game mode the glass binds no key');
+  assert.deepEqual(errors, []);
+  await ctx.close();
+});
+
 test('the sheet lists the character\'s actions, then this place, and runs a scene action', { skip }, async () => {
   const { ctx, page } = await open();
   await page.click('[data-visor-sheet]');