@bongos/core 1.25.24 → 1.25.25

package/modules/public-landing/public/projects.html

@@ -1558,6 +1558,12 @@ summary{min-height:24px;padding:3px 0;}
               <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
               Continue with GitHub
             </a>
+            <!-- No GitHub account yet (task 1005283): the same sign-in, opened on GitHub's
+                 sign-up page (signup=1), which offers "Continue with Google" and hands the
+                 sign-in straight back here once the account exists. Bongos cannot make a
+                 GitHub account for anyone; GitHub can, in one step, with Google. -->
+            <p class="finePrint" id="wizWhyGh">Your project’s files live in a GitHub repository, so it needs a GitHub account.</p>
+            <p class="finePrint" id="wizNoGh">No GitHub account? <a id="wizSignup" href="/api/bongos/auth/web/start?via=github&amp;signup=1&amp;return=/projects%3Fview%3Dnew&amp;repos=1">Make one free with Google</a>. On GitHub’s page choose <strong>Continue with Google</strong>, and you come straight back here.</p>
             <!-- Informed consent BEFORE GitHub's own wording (ADR 0155): the scope the
                  button asks for reads as "all your repositories" on GitHub's screen, so
                  the reason is stated here, on the path every founder actually takes. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.24",
+  "version": "1.25.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.24",
+      "version": "1.25.25",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.24",
+  "version": "1.25.25",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11912,5 +11912,11 @@
       "id": "1005107",
       "text": "A founder can now go back and change their Genesis plan after saving it, and change any earlier stage's answers until the Board Room has voted that stage through — a voted stage shows its answers with a plain reason why they a"
     }
+  ],
+  "1.25.25": [
+    {
+      "id": "1005283",
+      "text": "Someone with no GitHub account can now start a project. The creation page explains why GitHub is needed and offers a 'Make one free with Google' link. GitHub's own sign-up page opens, they continue with their Google account, a"
+    }
   ]
 }

package/src/bongos/auth-github.js

@@ -291,6 +291,22 @@ function buildAuthorizeUrl(state, redirectUri, { repos = false, switchAccount =
   return u.toString();
 }
 
+// GitHub's own sign-up page, for a person with no GitHub account (task 1005283). It is the page GitHub's sign-in screen links as "Create an account"
+// during an OAuth sign-in: `return_to` carries the authorize step back, so once the
+// account exists (GitHub's sign-up offers "Continue with Google") GitHub resumes the
+// SAME sign-in — same state, same scope — and our callback lands the person where they
+// started. Only github.com's own authorize path is ever handed on; anything else is null
+// and the caller falls back to the plain authorize redirect.
+function githubSignupUrl(authorizeUrl) {
+  let u;
+  try { u = new URL(String(authorizeUrl)); } catch { return null; }
+  if (u.protocol !== 'https:' || u.host !== 'github.com' || u.pathname !== '/login/oauth/authorize') return null;
+  const signup = new URL('https://github.com/signup');
+  signup.searchParams.set('return_to', u.pathname + u.search);
+  signup.searchParams.set('source', 'oauth');
+  return signup.toString();
+}
+
 async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken = false }) {
   const { accessToken, scope: grantedScope } = await exchangeCodeForToken(code, redirectUri);
   const ghUser = await fetchGithubUser(accessToken);
@@ -386,6 +402,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
 // slashes on origin are trimmed so `https://hub/` and `https://hub` behave alike.
 
 module.exports = {
+  githubSignupUrl,
   buildAuthorizeUrl,
   completeWebFlow,
   exchangeCodeForToken,

package/src/bongos/auth.js

@@ -58,7 +58,7 @@ const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
 const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readAppStatusFromHub, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
-const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
+const { buildAuthorizeUrl, githubSignupUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
 
@@ -854,6 +854,7 @@ module.exports = {
   startDeviceFlow,
   pollDeviceFlow,
   buildAuthorizeUrl,
+  githubSignupUrl,
   scopeForWebFlow,
   grantedScopeCoversRepos,
   buildIdpAuthorizeUrl,

package/src/bongos/routes/auth.js

@@ -710,6 +710,7 @@ module.exports = function buildAuthRouter() {
     // ?switch=1 — sign in as a DIFFERENT GitHub account (task 1004789): show
     // GitHub's account picker instead of re-using the one logged in there.
     const wantsSwitch = req.query.switch === '1' || req.query.switch === 'true';
+    const wantsSignup = req.query.signup === '1' || req.query.signup === 'true'; // no GitHub account yet: its sign-up page (task 1005283)
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
     // the canonical host (task 1004357). The handshake cookies are host-only now,
     // and the callback always lands on the canonical host, so a state cookie set
@@ -720,8 +721,7 @@ module.exports = function buildAuthRouter() {
       const raw = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer) || '/';
       const back = raw.startsWith('/') ? `https://${host}${raw}` : raw;
       const params = new URLSearchParams({ return: back });
-      if (wantsRepos) params.set('repos', '1');
-      if (wantsSwitch) params.set('switch', '1');
+      for (const [k, on] of [['repos', wantsRepos], ['switch', wantsSwitch], ['signup', wantsSignup]]) if (on) params.set(k, '1');
       if (req.query.via === 'github') params.set('via', 'github');
       return res.redirect(`${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/web/start?${params}`);
     }
@@ -729,7 +729,7 @@ module.exports = function buildAuthRouter() {
     // host (a builder who signed in on the apex, then opened builders.): no
     // GitHub round-trip, just hand that host its copy. A repo-scope sign-in
     // still goes to GitHub — it exists to ask for the broader grant.
-    if (!wantsRepos && !wantsSwitch) {
+    if (!wantsRepos && !wantsSwitch && !wantsSignup) {
       const target = safeReturnTo(req.query.return);
       if (target && !target.startsWith('/')) {
         try {
@@ -746,7 +746,7 @@ module.exports = function buildAuthRouter() {
     // lands on one chooser — Continue with GitHub or Continue with Google — so no
     // page needs its own pair of buttons. `via=github` is the GitHub button (and
     // any door that needs GitHub itself); "New account" names a GitHub account.
-    if (req.query.via !== 'github' && !wantsSwitch && googleConfigured()) {
+    if (req.query.via !== 'github' && !wantsSwitch && !wantsSignup && googleConfigured()) {
       const ret = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer);
       const gh = new URLSearchParams({ via: 'github' });
       if (ret) gh.set('return', ret);
@@ -803,9 +803,9 @@ module.exports = function buildAuthRouter() {
     // Federate through the hub when configured (ADR 0141 §1); otherwise the direct
     // GitHub authorize, carrying the repo-scope opt-in. Same CSRF state cookie either
     // way — the callback validates it identically, so the hub leg is CSRF-protected too.
-    res.redirect(auth.idpConfigured()
-      ? auth.buildIdpAuthorizeUrl(state, redirectUri)
-      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch }));
+    if (auth.idpConfigured()) return res.redirect(auth.buildIdpAuthorizeUrl(state, redirectUri));
+    const authorizeUrl = auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch });
+    res.redirect((wantsSignup && auth.githubSignupUrl(authorizeUrl)) || authorizeUrl);
   });
 
   // GET /auth/web/handoff?code=&return= — the far side of the one-time session

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.25'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auth_switch_account.mjs

@@ -24,13 +24,9 @@ test('switchAccount adds prompt=select_account; a plain sign-in does not', () =>
   assert.equal(sw.searchParams.get('scope'), plain.searchParams.get('scope'));
 });
 
-test('the start route reads ?switch=1 and passes it to the GitHub leg', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
-  assert.match(src, /const wantsSwitch = req\.query\.switch === '1'/);
-  assert.match(src, /switchAccount: wantsSwitch/);
-  // a switch must reach GitHub, never short-circuit through the live-session handoff
-  assert.match(src, /if \(!wantsRepos && !wantsSwitch\) \{/);
-});
+// The start route itself is now RUN, not read (task 1005283): tests/github_signup_handoff.mjs
+// calls GET /auth/web/start with ?switch=1 and asserts the redirect carries
+// prompt=select_account and goes to GitHub, never through the live-session handoff.
 
 test('the landing carries the New account door beside Sign in', () => {
   const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/index.html'), 'utf8');

package/tests/github_signup_handoff.mjs

@@ -0,0 +1,135 @@
+// tests/github_signup_handoff.mjs — no GitHub account yet: GitHub's own sign-up page, with
+// "Continue with Google", and back to project creation (task 1005283).
+//
+// WHY. Bongos cannot make a GitHub account for anyone, and every project lives in a GitHub
+// repository. A person with only a Google account used to meet "Continue with GitHub" and
+// nothing else. GitHub's sign-up page offers "Continue with Google", and during an OAuth
+// sign-in GitHub's own screen links it with `return_to` = the authorize step, so the
+// sign-in resumes once the account exists (checked on GitHub's live pages, signed out,
+// 2026-11-13). `?signup=1` on our sign-in start opens THAT page directly.
+//
+// What this pins, by RUNNING the start route's handler (no network, no database):
+//   1. ?signup=1 redirects to https://github.com/signup with return_to = the same
+//      authorize step (same state cookie, same client, same repo scope, same callback);
+//   2. it skips the GitHub-or-Google chooser, which would offer a Bongos Google sign-in
+//      that cannot make a project;
+//   3. a plain sign-in still goes to the authorize step, and ?switch=1 still adds the
+//      account picker (converted here from tests/auth_switch_account.mjs's source read);
+//   4. githubSignupUrl hands on only github.com's own authorize path;
+//   5. the creation page's gate says why GitHub is needed and carries the door, whose
+//      link runs through the route above and returns to /projects?view=new.
+//
+// Run:  node --test tests/github_signup_handoff.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+// Google sign-in on, so the chooser would show for a plain sign-in: the door must skip it
+process.env.BONGOS_GOOGLE_CLIENT_ID = 'google-test-client';
+process.env.BONGOS_GOOGLE_CLIENT_SECRET = 'google-test-secret';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// "Continue with Google" is offered only when the hub that keeps Google sign-ins is present
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+if (!seams.hasProvider('platform-identity.hub')) {
+  seams.registerProvider('platform-identity.hub', { signInWithGoogle: async () => null, recordHubSignin: async () => {} });
+}
+const buildAuthRouter = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { githubSignupUrl } = require(path.join(ROOT, 'src/bongos/auth.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+function fakeRes() {
+  const res = {
+    _status: 200, _body: null, _redirect: null, _cookies: {},
+    status(c) { this._status = c; return this; },
+    type() { return this; },
+    send(b) { this._body = b; return this; },
+    json(b) { this._body = b; return this; },
+    set() { return this; },
+    redirect(a, b) { this._redirect = b === undefined ? a : b; return this; },
+    cookie(n, v, o) { this._cookies[n] = { v, o }; return this; },
+    clearCookie() { return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+const start = (() => {
+  const layer = buildAuthRouter().stack.find((l) => l.route?.path === '/auth/web/start' && l.route.methods.get);
+  assert.ok(layer, 'GET /auth/web/start exists');
+  return layer.route.stack.at(-1).handle;
+})();
+const req = (query) => ({ query, headers: { host: 'localhost' }, baseUrl: '/api/bongos', body: {} });
+async function run(query) { const res = fakeRes(); await start(req(query), res); return res; }
+
+test('?signup=1 opens GitHub’s sign-up page, which resumes this same sign-in', async () => {
+  const res = await run({ via: 'github', signup: '1', return: '/projects?view=new', repos: '1' });
+  assert.ok(res._redirect, 'a redirect, not the chooser page');
+  const signup = new URL(res._redirect);
+  assert.equal(signup.origin + signup.pathname, 'https://github.com/signup');
+  assert.equal(signup.searchParams.get('source'), 'oauth', 'the same marker GitHub’s own "Create an account" link carries');
+  const back = new URL(signup.searchParams.get('return_to'), 'https://github.com');
+  assert.equal(back.pathname, '/login/oauth/authorize', 'the way back is the authorize step');
+  assert.equal(back.searchParams.get('client_id'), process.env.BONGOS_GITHUB_CLIENT_ID);
+  const stateCookie = Object.values(res._cookies).find((c) => /^[0-9a-f]{32}$/.test(String(c.v)));
+  assert.ok(stateCookie, 'a state cookie is set');
+  assert.equal(back.searchParams.get('state'), stateCookie.v,
+    'the state GitHub hands back is the one in this browser’s cookie, so the callback accepts it');
+  assert.match(back.searchParams.get('scope'), /\brepo\b/, 'the repo access project creation needs is asked once, on the way back');
+  assert.match(back.searchParams.get('redirect_uri'), /\/auth\/web\/callback$/);
+  assert.ok(Object.values(res._cookies).some((c) => c.v === '/projects?view=new'), 'after the callback, the person lands on project creation');
+});
+
+test('the door skips the GitHub-or-Google chooser; a plain sign-in still shows it', async () => {
+  const signup = await run({ signup: '1', return: '/projects?view=new', repos: '1' });
+  assert.match(signup._redirect || '', /^https:\/\/github\.com\/signup\?/, 'no via=github needed: a GitHub sign-up is GitHub');
+  const plain = await run({ return: '/projects?view=new', repos: '1' });
+  assert.equal(plain._redirect, null);
+  assert.match(plain._body, /Continue with GitHub/);
+});
+
+test('without ?signup a sign-in goes to the authorize step, and ?switch=1 still adds the account picker', async () => {
+  const plain = await run({ via: 'github', return: '/projects?view=new', repos: '1' });
+  const p = new URL(plain._redirect);
+  assert.equal(p.origin + p.pathname, 'https://github.com/login/oauth/authorize');
+  assert.equal(p.searchParams.get('prompt'), null);
+  const sw = await run({ switch: '1', return: '/' });
+  const s = new URL(sw._redirect);
+  assert.equal(s.pathname, '/login/oauth/authorize');
+  assert.equal(s.searchParams.get('prompt'), 'select_account', 'a switch reaches GitHub, never the live-session handoff');
+});
+
+test('githubSignupUrl hands on only github.com’s own authorize path', () => {
+  const ok = githubSignupUrl('https://github.com/login/oauth/authorize?client_id=c&state=s&scope=repo');
+  assert.equal(new URL(ok).searchParams.get('return_to'), '/login/oauth/authorize?client_id=c&state=s&scope=repo');
+  for (const bad of [
+    'https://evil.example/login/oauth/authorize?state=s',
+    'http://github.com/login/oauth/authorize?state=s',
+    'https://github.com/settings/tokens',
+    'https://github.com.evil.example/login/oauth/authorize',
+    'not a url',
+    null,
+  ]) assert.equal(githubSignupUrl(bad), null, String(bad));
+});
+
+test('the creation page says why GitHub is needed and offers the door, returning to creation', () => {
+  const hub = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/projects.html'), 'utf8').replace(/\r\n/g, '\n');
+  const gate = (hub.match(/<section class="panel" id="panel-gate"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(gate, 'the gate is findable');
+  assert.match(gate, /<p class="finePrint" id="wizWhyGh">Your project’s files live in a GitHub repository, so it needs a GitHub account\.<\/p>/);
+  const door = gate.match(/<a id="wizSignup" href="([^"]+)">Make one free with Google<\/a>/);
+  assert.ok(door, 'the door sits on the gate');
+  assert.ok(gate.indexOf('id="wizSignin"') < gate.indexOf('id="wizSignup"'), 'under Continue with GitHub, not instead of it');
+  const href = new URL(door[1].replace(/&amp;/g, '&'), 'https://hub.example');
+  assert.equal(href.pathname, '/api/bongos/auth/web/start');
+  assert.equal(href.searchParams.get('signup'), '1');
+  assert.equal(href.searchParams.get('repos'), '1', 'the same repo access the GitHub button asks for');
+  assert.equal(href.searchParams.get('return'), '/projects?view=new');
+  assert.match(gate, /choose <strong>Continue with Google<\/strong>, and you come straight back here/);
+});