@bongos/core 1.25.13 → 1.25.15

package/tests/genesis_work_db.mjs

@@ -0,0 +1,73 @@
+// tests/genesis_work_db.mjs — the genesis stage-work contract against a REAL Postgres
+// (task 1005116).
+//
+// tests/genesis_work.mjs runs the contract against an in-memory store in the DB-free
+// unit lane. This runs the SAME contract (imported, not copied) through the real
+// Postgres store (genesis-work.js pgStore) over the real migration, so the one-statement
+// answer-plus-history writes, the no-op guard, the if-empty carry-over and the CHECK
+// constraints are proven where they live. Integration lane (run-unit-tests.js).
+//
+// Needs a MIGRATED database (scripts/migrate.sh). SKIPS (exit 0) with no reachable
+// Postgres, like every *_db test.
+//
+// Run:  DATABASE_URL=postgres://... node tests/genesis_work_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { contract } from './genesis_work.mjs';
+import { insertTestBuilders } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const { Pool } = require('pg');
+const gw = require('../modules/onboarding/genesis-work.js');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`genesis_work_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_002_genesis_work.sql'), 'utf8');
+const wipe = () => pool.query('DELETE FROM onboarding_genesis_answers; DELETE FROM onboarding_genesis_answer_history; DELETE FROM onboarding_genesis_work;');
+
+await test('postgres: the migration re-applies cleanly over the migrated schema (idempotent)', async () => {
+  await pool.query(MIGRATION);
+  await pool.query(MIGRATION);
+});
+
+const A = 910000201;
+await insertTestBuilders(pool, [{ id: A, login: 'genesis-a' }]);
+await wipe();
+try {
+  await contract(test, 'postgres', { store: gw.pgStore(pool) }, A);
+  await test('postgres: the CHECKs refuse a wordless answer, a bad state, origin, door and link', async () => {
+    const bad = (sql, params) => assert.rejects(pool.query(sql, params), (e) => e.code === '23514');
+    await bad("INSERT INTO onboarding_genesis_answers (stage, question_id, state, answer_md) VALUES ('scope', 'what', 'answered', '  ')");
+    await bad("INSERT INTO onboarding_genesis_answers (stage, question_id, state) VALUES ('scope', 'what', 'maybe')");
+    await bad("INSERT INTO onboarding_genesis_answers (stage, question_id, state, origin) VALUES ('scope', 'what', 'skipped', 'model')");
+    await bad("INSERT INTO onboarding_genesis_answers (stage, question_id, state) VALUES ('decide', 'what', 'skipped')");
+    await bad("INSERT INTO onboarding_genesis_work (stage, door) VALUES ('charter', 'autopilot')");
+    await bad("INSERT INTO onboarding_genesis_work (stage, link_url) VALUES ('charter', 'javascript:alert(1)')");
+  });
+} finally {
+  await wipe().catch(() => {});
+  await pool.query('DELETE FROM builders WHERE id = $1', [A]).catch(() => {});
+  await pool.end().catch(() => {});
+}
+
+console.log(`\ngenesis_work_db: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/genesis_work_routes.mjs

@@ -0,0 +1,130 @@
+// tests/genesis_work_routes.mjs — the genesis stage-work HTTP surface (task 1005116)
+//
+// Drives the REAL routes (modules/onboarding/routes/genesis-work.js) over a real express
+// server and an in-memory store. Auth is stubbed at the doorway the way other route
+// tests do it: a request names its builder in `x-test-builder`, and only the builder
+// named in `x-test-owner` holds `project.settings.manage`. What it proves: any builder
+// reads, only the owner writes, a refusal is a 4xx with its code, un-answer is DELETE,
+// and the planning read path comes back over the wire.
+//
+// Run:  node tests/genesis_work_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { memStore } from './genesis_work.mjs';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const api = require('../src/module-api.js');
+
+const OWNER = 1;
+const OTHER = 2;
+api.requireBuilder = (req, res, next) => {
+  const id = Number(req.get('x-test-builder'));
+  if (!id) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id };
+  next();
+};
+api.requirePermission = () => (req, res, next) => (req.builder.id === OWNER ? next() : res.status(403).json({ error: { code: 'forbidden' } }));
+
+const mount = require('../modules/onboarding/routes/genesis-work.js');
+const store = memStore();
+const app = express();
+app.use(express.json());
+const router = express.Router();
+mount(router, { store });
+app.use('/api/bongos', router);
+const server = app.listen(0);
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+async function call(method, path, { as = OWNER, body } = {}) {
+  const r = await fetch(base + path, {
+    method,
+    headers: { 'content-type': 'application/json', ...(as ? { 'x-test-builder': String(as) } : {}) },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  return { status: r.status, data: await r.json() };
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+try {
+  await test('reads need a signed-in builder', async () => {
+    assert.equal((await call('GET', '/founding/work', { as: null })).status, 401);
+  });
+
+  await test('the owner answers, and any builder reads the answer back', async () => {
+    const w = await call('PUT', '/founding/work/strategize/answers/big_pieces', { body: { text: 'Ledger first.' } });
+    assert.equal(w.status, 200);
+    assert.equal(w.data.changed, true);
+    const r = await call('GET', '/founding/work/strategize', { as: OTHER });
+    assert.equal(r.status, 200);
+    assert.equal(r.data.work.questions.find((q) => q.id === 'big_pieces').answer.text, 'Ledger first.');
+  });
+
+  await test('a builder who is not the owner cannot write', async () => {
+    for (const [m, p, body] of [
+      ['PUT', '/founding/work/strategize/answers/risks', { text: 'x' }],
+      ['DELETE', '/founding/work/strategize/answers/big_pieces'],
+      ['PUT', '/founding/work/strategize/door', { door: 'open' }],
+      ['PUT', '/founding/work/strategize/page', { page: 'x' }],
+      ['PUT', '/founding/work/strategize/link', { url: 'https://example.com' }],
+    ]) assert.equal((await call(m, p, { as: OTHER, body })).status, 403, `${m} ${p}`);
+    assert.equal(store.answers.size, 1, 'nothing was written');
+  });
+
+  await test('"not sure yet" over the wire, then un-answer back to empty', async () => {
+    const ns = await call('PUT', '/founding/work/strategize/answers/risks', { body: { state: 'not_sure' } });
+    assert.equal(ns.data.work.questions.find((q) => q.id === 'risks').answer.state, 'not_sure');
+    const del = await call('DELETE', '/founding/work/strategize/answers/risks');
+    assert.equal(del.status, 200);
+    assert.equal(del.data.cleared, true);
+    assert.equal(del.data.work.questions.find((q) => q.id === 'risks').answer, null);
+    const h = await call('GET', '/founding/work/strategize/answers/risks/history', { as: OTHER });
+    assert.deepEqual(h.data.history.map((x) => x.state), ['cleared', 'not_sure']);
+  });
+
+  await test('refusals come back as 4xx with their code', async () => {
+    const cases = [
+      ['PUT', '/founding/work/strategize/answers/nope', { text: 'x' }, 404, 'unknown_question'],
+      ['GET', '/founding/work/decide', undefined, 404, 'unknown_stage'],
+      ['PUT', '/founding/work/strategize/answers/risks', { text: ' ' }, 400, 'empty_answer'],
+      ['PUT', '/founding/work/strategize/door', { door: 'autopilot' }, 400, 'bad_door'],
+      ['PUT', '/founding/work/strategize/link', { url: 'ftp://x' }, 400, 'bad_link'],
+    ];
+    for (const [m, p, body, status, code] of cases) {
+      const r = await call(m, p, { body });
+      assert.equal(r.status, status, `${m} ${p}`);
+      assert.equal(r.data.error.code, code);
+    }
+    const unknownField = await call('PUT', '/founding/work/strategize/door', { body: { door: 'open', extra: 1 } });
+    assert.equal(unknownField.status, 400, 'an unknown field is refused');
+  });
+
+  await test('switching door over the wire keeps the answers', async () => {
+    await call('PUT', '/founding/work/strategize/page', { body: { page: 'Bet on the ledger.' } });
+    const r = await call('PUT', '/founding/work/strategize/door', { body: { door: 'open' } });
+    assert.equal(r.data.work.door, 'open');
+    assert.equal(r.data.work.page, 'Bet on the ledger.');
+    assert.equal(r.data.work.counts.answered, 1);
+  });
+
+  await test('the planning read path and the assisted brief are readable by any builder', async () => {
+    const c = await call('GET', '/founding/context', { as: OTHER });
+    assert.equal(c.status, 200);
+    assert.match(c.data.markdown, /Ledger first\./);
+    assert.match(c.data.markdown, /Bet on the ledger\./);
+    const a = await call('GET', '/founding/work/strategize/assist', { as: OTHER });
+    assert.match(a.data.prompt, /I am the author/);
+  });
+} finally {
+  server.close();
+}
+
+console.log(`\ngenesis_work_routes: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/package_core.mjs

@@ -363,15 +363,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to the core deps, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -450,7 +450,7 @@ t('the publish lane sets no long-lived npm credential (OIDC only)', () => {
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -458,8 +458,10 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
+// The security-card libraries are core runtime deps: routes/my-passkeys.js serves the browser bundle
+// and requires the server lib. Left out, every packaged instance answers bundle_missing (task 1005269).
+t('CORE_DEP_NAMES is exactly [express, pg, pino, @simplewebauthn/browser, @simplewebauthn/server]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino', '@simplewebauthn/browser', '@simplewebauthn/server']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and
@@ -542,7 +544,9 @@ t('prunePackageLock: on the real repo lockfile, drops the vast majority of packa
   });
   const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
   const sourceCount = Object.keys(realLock.packages).length - 1;
-  assert.ok(keptCount < sourceCount / 2, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
+  // Under two thirds: the card libraries (task 1005269) added their certificate-parsing closure, taking the
+  // kept share from ~44% to ~55%. That the game deps stay out is asserted by the closure test above.
+  assert.ok(keptCount < sourceCount * 2 / 3, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
   assert.ok(keptCount > 0);
 });
 

package/tests/pruned_lockfile_integrity.mjs

@@ -34,7 +34,7 @@ const isRegistryResolved = (v) => typeof v.resolved === 'string' && /^https?:\/\
 
 const pruned = prunePackageLock(realLock, {
   name: '@bongos/core', version: '0.0.0-test',
-  rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+  rootRanges: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' },
 });
 
 t('pruned lockfile: non-trivial and closes over the core deps (express + pg present)', () => {
@@ -42,6 +42,8 @@ t('pruned lockfile: non-trivial and closes over the core deps (express + pg pres
   assert.ok(keys.length > 2, `pruned lockfile is suspiciously empty (${keys.length} entries)`);
   assert.ok(pruned.packages['node_modules/express'], 'express missing from the pruned closure');
   assert.ok(pruned.packages['node_modules/pg'], 'pg missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/browser'], 'card browser library missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/server'], 'card server library missing from the pruned closure');
 });
 
 t('pruned lockfile: EVERY registry-resolved package keeps a well-formed integrity hash (R88 guard)', () => {
@@ -72,7 +74,7 @@ t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rew
 });
 
 t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg + pino)', () => {
-  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino'));
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino') && CORE_DEP_NAMES.includes('@simplewebauthn/browser') && CORE_DEP_NAMES.includes('@simplewebauthn/server'));
 });
 
 console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);

package/tests/status_page_no_dead_uptime.mjs

@@ -69,7 +69,7 @@ test('the server no longer registers GET /public/uptime', () => {
 
 test('the core package exports only files that exist, and the codemod maps only exported subpaths', () => {
   const { buildPackageJson } = require('../scripts/bongos/package-core.js');
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   for (const [sub, target] of Object.entries(pkg.exports)) {
     assert.ok(existsSync(join(ROOT, target)), `export ${sub} points at missing ${target}`);
   }

package/tests/task_lib.mjs

@@ -136,5 +136,51 @@ t('conflictChipHtml: empty for none, count + capped list for many', () => {
   assert.doesNotMatch(many, /#6/);
 });
 
+// task 1005109 — the one Copy prompt click, shared by the Tasks board, a goal's to-do
+// list and the Genesis stage list. Runs against fake browser globals.
+async function at(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+function fakeBtn() {
+  const icon = { textContent: '📋' };
+  const attrs = {};
+  return { icon, attrs, querySelector: (sel) => (sel === '.task__copy-icon' ? icon : null), setAttribute: (k, v) => { attrs[k] = v; } };
+}
+const savedGlobals = { navigator: globalThis.navigator, location: globalThis.location, setTimeout: globalThis.setTimeout };
+function stubGlobals(writeText) {
+  Object.defineProperty(globalThis, 'navigator', { value: { clipboard: { writeText } }, configurable: true, writable: true });
+  globalThis.location = { hostname: 'builders.example.test', origin: 'https://builders.example.test' };
+  globalThis.setTimeout = () => 0;
+}
+
+await at('copyTaskPrompt copies the task\'s own words, flips the button, says one sentence', async () => {
+  const copied = [];
+  const toasts = [];
+  stubGlobals(async (x) => { copied.push(x); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 42, title: 'Write the scope', description: 'Answer the questions.' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, true);
+  assert.equal(copied.length, 1);
+  assert.match(copied[0], /Answer the questions\./);
+  assert.doesNotMatch(copied[0], /\(no description\)/);
+  assert.equal(btn.icon.textContent, '✓');
+  assert.equal(btn.attrs['data-copied'], '1');
+  assert.deepEqual(toasts, ['Prompt for task 42 copied to your clipboard.']);
+});
+
+await at('copyTaskPrompt: a refused clipboard with no fallback says so and leaves the button alone', async () => {
+  const toasts = [];
+  stubGlobals(async () => { throw new Error('denied'); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 7, title: 'x', description: 'y' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, false, 'no document under Node, so the textarea fallback fails too');
+  assert.equal(btn.icon.textContent, '📋');
+  assert.deepEqual(toasts, ['Could not copy to the clipboard. Try again.']);
+});
+Object.defineProperty(globalThis, 'navigator', { value: savedGlobals.navigator, configurable: true, writable: true });
+globalThis.location = savedGlobals.location;
+globalThis.setTimeout = savedGlobals.setTimeout;
+
 console.log(`\ntask-lib tests: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);