@bongos/core 1.25.14 → 1.25.15

package/tests/genesis_work_routes.mjs

@@ -0,0 +1,130 @@
+// tests/genesis_work_routes.mjs — the genesis stage-work HTTP surface (task 1005116)
+//
+// Drives the REAL routes (modules/onboarding/routes/genesis-work.js) over a real express
+// server and an in-memory store. Auth is stubbed at the doorway the way other route
+// tests do it: a request names its builder in `x-test-builder`, and only the builder
+// named in `x-test-owner` holds `project.settings.manage`. What it proves: any builder
+// reads, only the owner writes, a refusal is a 4xx with its code, un-answer is DELETE,
+// and the planning read path comes back over the wire.
+//
+// Run:  node tests/genesis_work_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { memStore } from './genesis_work.mjs';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const api = require('../src/module-api.js');
+
+const OWNER = 1;
+const OTHER = 2;
+api.requireBuilder = (req, res, next) => {
+  const id = Number(req.get('x-test-builder'));
+  if (!id) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id };
+  next();
+};
+api.requirePermission = () => (req, res, next) => (req.builder.id === OWNER ? next() : res.status(403).json({ error: { code: 'forbidden' } }));
+
+const mount = require('../modules/onboarding/routes/genesis-work.js');
+const store = memStore();
+const app = express();
+app.use(express.json());
+const router = express.Router();
+mount(router, { store });
+app.use('/api/bongos', router);
+const server = app.listen(0);
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+async function call(method, path, { as = OWNER, body } = {}) {
+  const r = await fetch(base + path, {
+    method,
+    headers: { 'content-type': 'application/json', ...(as ? { 'x-test-builder': String(as) } : {}) },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  return { status: r.status, data: await r.json() };
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+try {
+  await test('reads need a signed-in builder', async () => {
+    assert.equal((await call('GET', '/founding/work', { as: null })).status, 401);
+  });
+
+  await test('the owner answers, and any builder reads the answer back', async () => {
+    const w = await call('PUT', '/founding/work/strategize/answers/big_pieces', { body: { text: 'Ledger first.' } });
+    assert.equal(w.status, 200);
+    assert.equal(w.data.changed, true);
+    const r = await call('GET', '/founding/work/strategize', { as: OTHER });
+    assert.equal(r.status, 200);
+    assert.equal(r.data.work.questions.find((q) => q.id === 'big_pieces').answer.text, 'Ledger first.');
+  });
+
+  await test('a builder who is not the owner cannot write', async () => {
+    for (const [m, p, body] of [
+      ['PUT', '/founding/work/strategize/answers/risks', { text: 'x' }],
+      ['DELETE', '/founding/work/strategize/answers/big_pieces'],
+      ['PUT', '/founding/work/strategize/door', { door: 'open' }],
+      ['PUT', '/founding/work/strategize/page', { page: 'x' }],
+      ['PUT', '/founding/work/strategize/link', { url: 'https://example.com' }],
+    ]) assert.equal((await call(m, p, { as: OTHER, body })).status, 403, `${m} ${p}`);
+    assert.equal(store.answers.size, 1, 'nothing was written');
+  });
+
+  await test('"not sure yet" over the wire, then un-answer back to empty', async () => {
+    const ns = await call('PUT', '/founding/work/strategize/answers/risks', { body: { state: 'not_sure' } });
+    assert.equal(ns.data.work.questions.find((q) => q.id === 'risks').answer.state, 'not_sure');
+    const del = await call('DELETE', '/founding/work/strategize/answers/risks');
+    assert.equal(del.status, 200);
+    assert.equal(del.data.cleared, true);
+    assert.equal(del.data.work.questions.find((q) => q.id === 'risks').answer, null);
+    const h = await call('GET', '/founding/work/strategize/answers/risks/history', { as: OTHER });
+    assert.deepEqual(h.data.history.map((x) => x.state), ['cleared', 'not_sure']);
+  });
+
+  await test('refusals come back as 4xx with their code', async () => {
+    const cases = [
+      ['PUT', '/founding/work/strategize/answers/nope', { text: 'x' }, 404, 'unknown_question'],
+      ['GET', '/founding/work/decide', undefined, 404, 'unknown_stage'],
+      ['PUT', '/founding/work/strategize/answers/risks', { text: ' ' }, 400, 'empty_answer'],
+      ['PUT', '/founding/work/strategize/door', { door: 'autopilot' }, 400, 'bad_door'],
+      ['PUT', '/founding/work/strategize/link', { url: 'ftp://x' }, 400, 'bad_link'],
+    ];
+    for (const [m, p, body, status, code] of cases) {
+      const r = await call(m, p, { body });
+      assert.equal(r.status, status, `${m} ${p}`);
+      assert.equal(r.data.error.code, code);
+    }
+    const unknownField = await call('PUT', '/founding/work/strategize/door', { body: { door: 'open', extra: 1 } });
+    assert.equal(unknownField.status, 400, 'an unknown field is refused');
+  });
+
+  await test('switching door over the wire keeps the answers', async () => {
+    await call('PUT', '/founding/work/strategize/page', { body: { page: 'Bet on the ledger.' } });
+    const r = await call('PUT', '/founding/work/strategize/door', { body: { door: 'open' } });
+    assert.equal(r.data.work.door, 'open');
+    assert.equal(r.data.work.page, 'Bet on the ledger.');
+    assert.equal(r.data.work.counts.answered, 1);
+  });
+
+  await test('the planning read path and the assisted brief are readable by any builder', async () => {
+    const c = await call('GET', '/founding/context', { as: OTHER });
+    assert.equal(c.status, 200);
+    assert.match(c.data.markdown, /Ledger first\./);
+    assert.match(c.data.markdown, /Bet on the ledger\./);
+    const a = await call('GET', '/founding/work/strategize/assist', { as: OTHER });
+    assert.match(a.data.prompt, /I am the author/);
+  });
+} finally {
+  server.close();
+}
+
+console.log(`\ngenesis_work_routes: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);