@bongos/core 1.25.19 → 1.25.21

package/tests/provisioning_project_refusal.mjs

@@ -0,0 +1,316 @@
+// tests/provisioning_project_refusal.mjs
+//
+// What a person the project gate REFUSES is told (task 1004162, ADR 0407 §6). The gate itself
+// is unchanged — who gets in is task 1004161's — and this file proves the refusal can only ever
+// refuse, while someone already connected to the project gets a next step instead of a dead end.
+//
+// Covers:
+//   • a stranger, an unregistered standing port, a port that throws and an unknown answer are
+//     all the 404 that confirms nothing
+//   • 'visitor' → 403 project_membership_required with the real join path (the hub's own
+//     POST /my-projects/join, carrying the project's origin); 'pending' → accept the invite;
+//     'applied' → it is with the owner
+//   • 'member'/'owner' rows: 403 project_access_required on a PUBLIC project, but the 404 on a
+//     private or stealth one — a `member` row comes from any device-flow sign-in, so it is no
+//     evidence a person may learn that a closed project's id is real
+//   • a grantee on a route not open to grantees → 403 owner_only
+//   • THE ATTACK again: with a witnessed `member` row and a public project, every declared
+//     project route still refuses and writes nothing; with a private project, every gated
+//     route stays the 404
+//   • the standing port's own reads (platform-identity/project-standing.js): only witnessed
+//     rows, a live invite, a recent application; a non-numeric person is no one
+//   • the structure: the refusal file never calls next() and never sets req.project
+//
+// DB-free: the real routers and envelope over stubbed data access.
+//
+// Run:  node --test tests/provisioning_project_refusal.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MODULE = path.join(ROOT, 'modules/provisioning');
+
+const api = require(path.join(ROOT, 'src/module-api.js'));
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+const provisioning = require(path.join(MODULE, 'provisioning.js'));
+const grants = require(path.join(MODULE, 'grants.js'));
+const githubSetup = require(path.join(MODULE, 'github-setup.js'));
+const catalogBridge = require(path.join(MODULE, 'catalog-bridge.js'));
+const envManifest = require(path.join(MODULE, 'env-manifest.js'));
+const STANDING_PORT = 'platform-identity.projectMembershipKind';
+
+const VISITOR = { id: 66, github_login: 'visitor', github_id: '6600', rank: 'xenos' };
+const ROW = {
+  id: 18, owner_builder_id: 7, slug: 'mercury', status: 'active', hosting_shape: 'cloud-host',
+  domain: 'mercury.example.com', target_ref: 'owner/mercury', settings: {}, detail: {}, tier: null,
+};
+
+let row = { ...ROW };
+let kind = null;            // what the standing port answers
+let kindThrows = false;
+let grantFor = null;        // builder id holding a live grant
+let grantThrows = false;
+const asked = [];
+const writes = [];
+
+api.requireBuilder = (req, _res, next) => { req.builder = { ...VISITOR }; next(); };
+api.requirePermission = () => (_req, res) => res.fail('permission_forbidden', 403);
+api.branding = () => ({ domains: { publicOrigin: 'https://cb.test', instanceBase: 'cb.test' }, identity: { productName: 'Cloud Bongos' } });
+api.pool.query = async (text) => {
+  const q = String(text).replace(/\s+/g, ' ').trim();
+  if (/^(INSERT|UPDATE|DELETE)/i.test(q)) writes.push(q);
+  return { rows: [], rowCount: 0 };
+};
+api.pool.connect = async () => ({ query: api.pool.query, release() {} });
+
+grants.liveGrant = async (_db, instanceId, builderId) => {
+  if (grantThrows) throw new Error('grant table gone');
+  return String(builderId) === String(grantFor) ? { id: 3, instance_id: instanceId, grantee_builder_id: builderId, level: 'operate' } : null;
+};
+provisioning.getInstanceById = async (_db, id) => (String(id) === String(row.id) ? { ...row } : null);
+provisioning.recordEvent = async (_db, e) => { writes.push(`event ${e.event}`); };
+for (const fn of ['enqueueRestart', 'enqueueTeardown', 'enqueueIntent', 'enqueueRepoPrivate', 'enqueueRenderStandup',
+  'updateInstanceSettings', 'updateInstanceDetail', 'updateInstanceDomain', 'createOAuthManifest']) {
+  provisioning[fn] = async () => { writes.push(fn); return { created: true, intent: { action: fn, state: 'pending' } }; };
+}
+provisioning.getOpenIntent = async () => null;
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+githubSetup.githubSetupRead = async () => ({ steps: [] });
+githubSetup.installNudge = () => null;
+catalogBridge.healInstanceCatalog = async () => {};
+envManifest.listEnvVars = async () => [];
+for (const fn of ['declareEnvVar', 'updateEnvVar', 'removeEnvVar']) envManifest[fn] = async () => { writes.push(fn); return { row: { id: 5, name: 'X' }, created: true }; };
+
+const routeFiles = JSON.parse(fs.readFileSync(path.join(MODULE, 'module.json'), 'utf8')).contributes.routes;
+const read = (f) => fs.readFileSync(f, 'utf8').replace(/\r\n/g, '\n');
+const DECLARED = [];
+for (const name of routeFiles) {
+  const src = read(path.join(MODULE, 'routes', `${name}.js`));
+  const re = /router\.(get|post|patch|put|delete)\(\s*'(\/provisioning\/instances\/:id[^']*)'/g;
+  let m;
+  while ((m = re.exec(src))) DECLARED.push({ method: m[1], route: m[2], gated: /requireProjectOwner\(/.test(src.slice(m.index, src.indexOf('async', m.index))) });
+}
+const concrete = (r) => r.replace(':id', '18').replace(':varId', '5').replace(':grantId', '3');
+
+const express = require('express');
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+let server, base;
+before(async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  for (const name of routeFiles) app.use('/api/bongos', require(path.join(MODULE, 'routes', `${name}.js`))());
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+});
+after(() => { server.closeAllConnections(); server.close(); });
+
+async function call(method, route, body = {}) {
+  const res = await fetch(`${base}${concrete(route)}`, {
+    method: method.toUpperCase(),
+    headers: { 'content-type': 'application/json', connection: 'close' },
+    body: method === 'get' ? undefined : JSON.stringify(body),
+  });
+  const raw = await res.text();
+  let json = null;
+  try { json = JSON.parse(raw); } catch { /* not JSON */ }
+  return { status: res.status, body: json, raw };
+}
+function setWorld({ standing = null, throws = false, grant = null, grantErr = false, settings = {} } = {}) {
+  kind = standing; kindThrows = throws; grantFor = grant; grantThrows = grantErr;
+  row = { ...ROW, settings };
+  writes.length = 0; asked.length = 0;
+}
+const READ = ['get', '/provisioning/instances/:id'];
+const TEARDOWN = ['post', '/provisioning/instances/:id/teardown'];
+
+// ── before the port exists ──────────────────────────────────────────────────────────
+test('with no standing port registered (a hub without platform-identity), a refused caller gets the 404', async () => {
+  assert.equal(seams.hasProvider(STANDING_PORT), false, 'nothing registers the port in this process yet');
+  setWorld({ standing: 'visitor' });
+  const r = await call(...READ);
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+// ── with the port ──────────────────────────────────────────────────────────────────
+test('register a fake standing port for the rest of the file', () => {
+  seams.registerProvider(STANDING_PORT, {
+    projectMembershipKind: async (clientId, githubId) => {
+      asked.push({ clientId, githubId });
+      if (kindThrows) throw new Error('membership table gone');
+      return kind;
+    },
+  });
+  assert.equal(seams.hasProvider(STANDING_PORT), true);
+});
+
+test('a stranger keeps the 404, and the port is asked about THIS project by its slug and the caller’s own id', async () => {
+  setWorld({ standing: null });
+  const r = await call(...READ);
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+  assert.deepEqual(asked, [{ clientId: 'mercury', githubId: '6600' }]);
+});
+
+test('a port that throws, or answers something unknown, is the 404 — on doubt, say less', async () => {
+  for (const world of [{ throws: true }, { standing: 'admin' }, { standing: 'grantee' }, { standing: '' }]) {
+    setWorld(world);
+    const r = await call(...READ);
+    assert.equal(r.status, 404, `${JSON.stringify(world)}: ${r.raw}`);
+  }
+});
+
+test('a visitor is told how to apply: the hub’s own join route, with this project’s origin', async () => {
+  setWorld({ standing: 'visitor' });
+  const r = await call(...TEARDOWN);
+  assert.equal(r.status, 403, r.raw);
+  assert.equal(r.body.error.code, 'project_membership_required');
+  assert.deepEqual(r.body.error.details.apply, {
+    state: 'can_apply', method: 'POST', path: '/api/bongos/my-projects/join', body: { origin: 'https://mercury.example.com' },
+  });
+  assert.match(r.body.error.message, /Ask to join it/);
+  assert.match(r.body.error.message, /hosting is something the project’s owner gives separately/);
+  assert.deepEqual(writes, []);
+});
+
+test('the join path it names is the route that really exists on the hub', () => {
+  const src = read(path.join(ROOT, 'modules/platform-identity/routes/my-projects.js'));
+  assert.match(src, /router\.post\('\/my-projects\/join', requireBuilder,/);
+});
+
+test('an invited person is told to sign in to the project to accept', async () => {
+  setWorld({ standing: 'pending' });
+  const r = await call(...READ);
+  assert.equal(r.status, 403, r.raw);
+  assert.equal(r.body.error.code, 'project_membership_required');
+  assert.deepEqual(r.body.error.details.apply, { state: 'invited', sign_in: 'https://mercury.example.com' });
+});
+
+test('someone who already asked to join is told the owner decides', async () => {
+  setWorld({ standing: 'applied' });
+  const r = await call(...READ);
+  assert.equal(r.status, 403, r.raw);
+  assert.deepEqual(r.body.error.details.apply, { state: 'applied' });
+});
+
+test('a member without a grant, on a PUBLIC project, is told to ask the owner', async () => {
+  for (const standing of ['member', 'owner']) {
+    setWorld({ standing });
+    const r = await call(...TEARDOWN);
+    assert.equal(r.status, 403, `${standing}: ${r.raw}`);
+    assert.equal(r.body.error.code, 'project_access_required');
+    assert.match(r.body.error.message, /Ask the owner to give you access/);
+    assert.equal(r.body.error.details, undefined, 'no self-serve request is offered');
+  }
+});
+
+test('a member row on a PRIVATE or STEALTH project confirms nothing: the 404', async () => {
+  for (const visibility of ['private', 'stealth']) {
+    for (const standing of ['member', 'owner']) {
+      setWorld({ standing, settings: { visibility } });
+      const r = await call(...READ);
+      assert.equal(r.status, 404, `${visibility}/${standing}: ${r.raw}`);
+      assert.equal(r.body.error.code, 'instance_not_found');
+    }
+  }
+});
+
+test('a grantee on a route not open to grantees is told it is the owner’s', async () => {
+  setWorld({ standing: 'member', grant: VISITOR.id });
+  const r = await call(...TEARDOWN);
+  assert.equal(r.status, 403, r.raw);
+  assert.equal(r.body.error.code, 'owner_only');
+  assert.deepEqual(writes, []);
+  setWorld({ standing: 'member', grant: VISITOR.id, grantErr: true });
+  const failed = await call(...TEARDOWN);
+  // teardown is not a grantee route, so only the refusal reads the grant: a failed read there
+  // says less (the 404), never more
+  assert.equal(failed.status, 404, failed.raw);
+  assert.deepEqual(writes, []);
+});
+
+test('a grant read that fails while choosing the WORDING is the 404, never an admission', async () => {
+  // GET /provisioning/instances/:id/look is inline-gated and never reaches this file; use a
+  // gated non-grantee route, where only the refusal reads the grant.
+  setWorld({ standing: 'visitor', grantErr: true });
+  const r = await call('post', '/provisioning/instances/:id/domain', { domain: 'x.example.com' });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+  assert.deepEqual(writes, []);
+});
+
+// ── the attack, with the new wording in place ───────────────────────────────────────
+test('a device-flow member on a PUBLIC project: every declared project route still refuses, and nothing is written', async () => {
+  for (const d of DECLARED) {
+    setWorld({ standing: 'member' });
+    const r = await call(d.method, d.route, d.method === 'get' ? undefined : {});
+    assert.ok(r.status >= 400 && r.status < 500, `${d.method} ${d.route} → ${r.status} ${r.raw.slice(0, 160)}`);
+    assert.deepEqual(writes, [], `${d.method} ${d.route} wrote ${JSON.stringify(writes)}`);
+  }
+});
+
+test('a device-flow member on a PRIVATE project: every gated route is the 404', async () => {
+  for (const d of DECLARED.filter((x) => x.gated)) {
+    setWorld({ standing: 'member', settings: { visibility: 'private' } });
+    const r = await call(d.method, d.route, d.method === 'get' ? undefined : {});
+    assert.equal(r.status, 404, `${d.method} ${d.route}: ${r.raw.slice(0, 160)}`);
+    assert.deepEqual(writes, []);
+  }
+});
+
+// ── the standing port's own reads ───────────────────────────────────────────────────
+const { projectMembershipKind } = require(path.join(ROOT, 'modules/platform-identity/project-standing.js'));
+function standingDb({ membership = null, applied = false } = {}) {
+  const seen = [];
+  return {
+    seen,
+    query: async (text, params) => {
+      const s = String(text).replace(/\s+/g, ' ');
+      seen.push({ s, params });
+      if (/platform_identity_project_memberships/.test(s)) return { rows: membership ? [{ membership_kind: membership }] : [] };
+      if (/platform_identity_application_echoes/.test(s)) return { rows: applied ? [{ 1: 1 }] : [] };
+      return { rows: [] };
+    },
+  };
+}
+
+test('the port reads only witnessed rows and a live invite, then a recent application', async () => {
+  let db = standingDb({ membership: 'member' });
+  assert.equal(await projectMembershipKind('mercury', '6600', { pool: db }), 'member');
+  assert.match(db.seen[0].s, /membership_kind <> 'pending' AND m\.signin_verified_at IS NOT NULL/);
+  assert.match(db.seen[0].s, /membership_kind = 'pending' AND m\.joined_at > now\(\) - make_interval/);
+  assert.deepEqual(db.seen[0].params.slice(0, 2), ['mercury', '6600']);
+  assert.equal(db.seen.length, 1, 'a row answers; the application is not asked');
+  db = standingDb({ applied: true });
+  assert.equal(await projectMembershipKind('mercury', '6600', { pool: db }), 'applied');
+  assert.match(db.seen[1].s, /client_id = \$2 AND applied_at > now\(\)/);
+  db = standingDb({});
+  assert.equal(await projectMembershipKind('mercury', '6600', { pool: db }), null);
+  db = standingDb({ membership: 'something-new' });
+  assert.equal(await projectMembershipKind('mercury', '6600', { pool: db }), null, 'an unknown kind is no one');
+});
+
+test('a non-numeric person or an empty project is no one, and nothing is queried', async () => {
+  const db = standingDb({ membership: 'member' });
+  assert.equal(await projectMembershipKind('mercury', 'system:bfg', { pool: db }), null);
+  assert.equal(await projectMembershipKind('', '6600', { pool: db }), null);
+  assert.equal(db.seen.length, 0);
+});
+
+// ── the structure ───────────────────────────────────────────────────────────────────
+test('the refusal can only refuse: it never calls next() and never sets the admitted row', () => {
+  const src = read(path.join(MODULE, 'project-refusal.js')).replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /next\s*\(/);
+  assert.doesNotMatch(src, /req\.project\s*=|req\.projectDoor\s*=/);
+  const gate = read(path.join(MODULE, 'route-helpers.js'));
+  assert.match(gate, /if \(!door\) return refuseProject\(req, res, inst\);/);
+  assert.match(gate, /if \(!inst\) return res\.fail\('instance_not_found', 404\);/, 'a missing project is the plain 404 — no lookup at all');
+});

package/tests/provisioning_render_route.mjs

@@ -338,7 +338,7 @@ await ta('every path that resolves an intent clears the key', () => {
   assert.match(resolve, /borrowed_key_enc = NULL/);
   const teardown = src.slice(src.indexOf('async function enqueueTeardown'), src.indexOf('async function enqueueTeardown') + 600);
   assert.match(teardown, /borrowed_key_enc = NULL/, 'a superseded standup drops its key');
-  assert.match(teardown, /'render-standup'\) AND state = 'pending'/);
+  assert.match(teardown, /'render-standup', 'render-promote'\) AND state = 'pending'/);
 });
 
 server.close();

package/tests/provisioning_restart.mjs

@@ -34,6 +34,8 @@ import http from 'node:http';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
+// The gate also admits an owner-made grant (task 1004161, ADR 0407); nobody in this file holds one.
+require('../modules/provisioning/grants.js').liveGrant = async () => null;
 
 let passed = 0, failed = 0;
 function t(name, fn) {

package/tests/provisioning_settings.mjs

@@ -23,6 +23,8 @@ import http from 'node:http';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
+// The gate also admits an owner-made grant (task 1004161, ADR 0407); nobody in this file holds one.
+require('../modules/provisioning/grants.js').liveGrant = async () => null;
 
 let passed = 0, failed = 0;
 async function ta(name, fn) {

package/tests/provisioning_settings_apply.mjs

@@ -169,7 +169,7 @@ await ta('enqueueTeardown supersedes a PENDING settings push (a push into a proj
   const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.superseded, true, 'the queued push was cancelled so the teardown could take the slot');
-  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
+  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup', 'render-promote'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
 });
 
 // ── the route, over a real mounted router (stubbed data access) ─────────────────

package/tests/provisioning_settings_env.mjs

@@ -128,7 +128,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     // route never stamped, which is every row made before it shipped (spec D8).
     CLOUDBONGOS_FOUNDING_BIRTH: '', CLOUDBONGOS_FOUNDING_GENESIS: '', CLOUDBONGOS_DEMO_PEOPLE: '', CLOUDBONGOS_DEMO_HOURS: '',
     // The wizard's ship mode (task 1004629): empty when none was picked.
-    CLOUDBONGOS_SHIP_MODE: '', CLOUDBONGOS_TEST_PROJECT: '',
+    CLOUDBONGOS_SHIP_MODE: '', CLOUDBONGOS_TEST_PROJECT: '', CLOUDBONGOS_GUIDE_HANDOFF: '',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
@@ -137,7 +137,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
     X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
     X_LOOK: 'own', X_NIGHT_TINT: 'on', X_LOOK_ACCENT: '', X_LOGO_URL: '',
-    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '', X_TEST_PROJECT: '',
+    X_FOUNDING_BIRTH: '', X_FOUNDING_GENESIS: '', X_DEMO_PEOPLE: '', X_DEMO_HOURS: '', X_SHIP_MODE: '', X_TEST_PROJECT: '', X_GUIDE_HANDOFF: '',
   }, 'defaults, explicitly');
 });
 

package/tests/provisioning_teardown_intent.mjs

@@ -31,7 +31,7 @@ const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
 
 // The actions a teardown supersedes, mirroring enqueueTeardown's SQL.
-const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private', 'render-standup']);
+const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private', 'render-standup', 'render-promote']);
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -81,7 +81,7 @@ function fakeIntentDb(seed = [], { shape = 'co-tenant' } = {}) {
         // dead work in front of a teardown (task 1003140 widened it to the settings
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
-        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/);
+        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup', 'render-promote'\) AND state = 'pending'/);
         updates++;
         // The supersede must skip the platform's own row IN ITS OWN SQL (task 1004286): the
         // guard refuses that teardown only afterwards, in enqueueIntent. Modelled, not assumed.