@bongos/core 1.25.27 → 1.25.29

package/tests/home_camera.mjs

@@ -0,0 +1,34 @@
+// tests/home_camera.mjs — the camera over Home's city in game mode (task 1005305).
+// Runs home-camera.js's own maths: the world is always larger than the view, the camera
+// never shows past an edge, and the cursor pushes only when it rests near a side.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const Cam = require('../modules/hall-ui/public/home-camera.js');
+
+test('the world keeps the drawing\'s shape and is larger than the view on both axes', () => {
+  for (const [vw, vh] of [[1280, 800], [390, 844], [2560, 1080]]) {
+    const s = Cam.worldSize(vw, vh, 1000, 793);
+    assert.ok(s.w >= vw * Cam.OVER - 1 && s.h >= vh * Cam.OVER - 1, `${vw}x${vh} -> ${s.w}x${s.h}`);
+    assert.ok(Math.abs(s.w / s.h - 1000 / 793) < 0.01, 'the drawing is not stretched');
+  }
+  assert.deepEqual(Cam.worldSize(0, 800, 1000, 793), { w: 0, h: 0 }, 'no view, no world');
+});
+
+test('the camera never shows past an edge of the world', () => {
+  assert.equal(Cam.clamp(50, 1280, 2000), 0, 'not past the left edge');
+  assert.equal(Cam.clamp(-5000, 1280, 2000), -720, 'not past the right edge');
+  assert.equal(Cam.clamp(-300, 1280, 2000), -300, 'anywhere between is kept');
+});
+
+test('the cursor pushes only near a side, harder the closer it is, and toward that side', () => {
+  assert.equal(Cam.edgePush(640, 1280), 0, 'the middle of the view does not move the city');
+  assert.equal(Cam.edgePush(Cam.EDGE + 1, 1280), 0);
+  assert.ok(Cam.edgePush(10, 1280) > Cam.edgePush(40, 1280) && Cam.edgePush(40, 1280) > 0, 'left side: the view goes left');
+  assert.ok(Cam.edgePush(1275, 1280) < Cam.edgePush(1240, 1280) && Cam.edgePush(1240, 1280) < 0, 'right side: the view goes right');
+  assert.equal(Cam.edgePush(0, 1280), 1);
+  assert.equal(Cam.edgePush(1280, 1280), -1);
+  assert.equal(Cam.edgePush(null, 1280), 0, 'no cursor, no push');
+});

package/tests/home_city_world.mjs

@@ -0,0 +1,119 @@
+// tests/home_city_world.mjs — game mode: Home's city is the whole view (task 1005305).
+//
+// Runs city-draw.js + home-city-draw.js + home-camera.js + home-city.js in a real page with
+// html[data-game="on"]: the page holds nothing but the city and cannot scroll, the arrow keys
+// move the world and never past its edge, the time is handed to the visor (OTBVisor.timeline)
+// and a drag on it sends the city back through the weeks, and classic mode is as it was.
+// Skips where no system Edge or Chrome is installed.
+//
+// Run:  node --test tests/home_city_world.mjs
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lib = require(path.join(ROOT, 'modules', 'ui-design', 'kit', 'lib.js'));
+const pub = (f) => fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', f), 'utf8');
+const FIXTURE = fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'home__city.json'), 'utf8');
+
+let browser = null;
+try { browser = await lib.launchBrowser(); } catch (e) { if (!(e instanceof lib.NoBrowserError)) throw e; }
+after(() => browser && browser.close());
+const skip = !browser && 'no system Edge or Chrome';
+
+const stubs = `
+  window.__CITY = ${FIXTURE};
+  window.BongosClient = { createClient: () => ({ request: async (m, p) =>
+    (p.startsWith('/api/bongos/home/city') ? { ok: true, status: 200, data: window.__CITY } : { ok: false, status: 404, data: null }) }) };
+  window.OTBCraftMode = { iconHtml: () => '', choose: () => {}, current: () => 'artisan' };
+  document.documentElement.dataset.craft = 'artisan';
+  window.__tl = []; window.__scenes = [];
+  window.OTBVisor = { timeline: (t) => window.__tl.push(t), scene: (s) => window.__scenes.push(s), isOpen: () => false };
+  window.OTB = { contributeHallWidget(w) { window.__widget = w; } };`;
+
+async function boot({ game = true } = {}) {
+  const ctx = await browser.newContext({ viewport: { width: 1280, height: 800 }, reducedMotion: 'reduce' });
+  const page = await ctx.newPage();
+  await page.setContent(`<!doctype html><html${game ? ' data-game="on"' : ''}><head><style>[hidden]{display:none!important}${pub('home-city.css')}</style></head><body>
+    <div class="page-head--hall">Hello</div><section id="home-city" class="scroll home-city" hidden></section>
+    <div id="zone-home-main" style="height:3000px">cards</div><footer class="app-foot">foot</footer></body></html>`);
+  await page.addScriptTag({ content: stubs });
+  for (const f of ['city-draw.js', 'home-city-draw.js', 'home-camera.js', 'home-city.js']) await page.addScriptTag({ content: pub(f) });
+  await page.evaluate(() => window.__widget.mount(document.getElementById('home-city')));
+  await page.waitForFunction(() => document.querySelector('.hc-svg').childNodes.length > 0);
+  return { ctx, page };
+}
+const shown = (page, sel) => page.evaluate((s) => { const e = document.querySelector(s); return !!e && getComputedStyle(e).display !== 'none'; }, sel);
+const worldX = (page) => page.evaluate(() => Math.round(document.querySelector('.hc-svg').getBoundingClientRect().x));
+const lastTl = (page, pick) => page.evaluate(pick);
+
+test('game mode: the page is only the city, it cannot scroll, and the world is larger than the view', { skip }, async () => {
+  const { ctx, page } = await boot();
+  const s = await page.evaluate(() => {
+    const r = document.querySelector('.hc-svg').getBoundingClientRect(), h = document.documentElement;
+    window.scrollTo(0, 500);
+    return { world: h.classList.contains('hc-world'), overflow: getComputedStyle(h).overflowY, scrolled: window.scrollY, w: r.width, h: r.height, x: r.x, y: r.y };
+  });
+  const parts = {};
+  for (const sel of ['.page-head--hall', '#zone-home-main', '.app-foot', '.hc-ladder', '.hc-time', '.hc-svg']) parts[sel] = await shown(page, sel);
+  await ctx.close();
+  assert.equal(s.world, true);
+  assert.equal(s.overflow, 'hidden');
+  assert.equal(s.scrolled, 0, 'the page does not scroll');
+  assert.ok(s.w > 1280 && s.h > 800, 'the city is a world larger than the view');
+  assert.ok(s.x < 0 && s.y < 0, 'the view opens on the middle of it');
+  assert.deepEqual(parts, { '.page-head--hall': false, '#zone-home-main': false, '.app-foot': false, '.hc-ladder': false, '.hc-time': false, '.hc-svg': true });
+});
+
+test('game mode: the arrow keys move the city, and never past its edge', { skip }, async () => {
+  const { ctx, page } = await boot();
+  const start = await worldX(page);
+  await page.keyboard.down('ArrowRight');
+  await page.waitForFunction((x0) => Math.round(document.querySelector('.hc-svg').getBoundingClientRect().x) < x0 - 40, start);
+  await page.keyboard.up('ArrowRight');
+  await page.keyboard.down('ArrowLeft');
+  await page.waitForFunction(() => Math.round(document.querySelector('.hc-svg').getBoundingClientRect().x) === 0, null, { timeout: 15000 });
+  await page.waitForTimeout(200);
+  const end = await worldX(page);
+  const scrolled = await page.evaluate(() => window.scrollX + window.scrollY);
+  await page.keyboard.up('ArrowLeft');
+  await ctx.close();
+  assert.equal(end, 0, 'held against the left edge, the world stops at it');
+  assert.equal(scrolled, 0);
+});
+
+test('game mode: time is on the visor; a drag sends the city back, and Home registers its rows, keys and the cursor sight', { skip }, async () => {
+  const { ctx, page } = await boot();
+  const read = () => lastTl(page, () => { const t = window.__tl[window.__tl.length - 1]; return { live: t.live, value: t.value, label: t.label, speed: t.speed, len: document.querySelector('.hc-svg').innerHTML.length }; });
+  const before = await read();
+  await page.evaluate(() => window.__tl[window.__tl.length - 1].seek(0.3));
+  const back = await read();
+  await page.evaluate(() => window.__tl[window.__tl.length - 1].faster());
+  const sped = (await read()).speed;
+  const scene = await page.evaluate(() => { const s = window.__visorScene; return { aim: s.aim, keys: s.keys.map((k) => k.key), rows: s.actions.map((a) => a.label) }; });
+  await page.evaluate(() => window.__tl[window.__tl.length - 1].toLive());
+  const live = (await read()).live;
+  await ctx.close();
+  assert.deepEqual([before.live, before.value, before.label, before.speed], [true, 1, 'Live', '1×']);
+  assert.equal(back.live, false);
+  assert.ok(Math.abs(back.value - 0.3) < 0.01 && back.label !== 'Live', 'the city is where the drag sent it: ' + back.label);
+  assert.notEqual(back.len, before.len, 'the city is redrawn for that week');
+  assert.equal(sped, '2×');
+  assert.equal(scene.aim, true);
+  assert.deepEqual(scene.keys, ['Arrows']);
+  assert.ok(scene.rows.includes('Play the city over time') && scene.rows.includes('Back to live') && scene.rows.some((r) => r.startsWith('Speed')), scene.rows.join(' | '));
+  assert.equal(live, true);
+});
+
+test('classic mode is as it was: the ladder, the slider and the cards are on the page, and no timeline is handed over', { skip }, async () => {
+  const { ctx, page } = await boot({ game: false });
+  const s = await page.evaluate(() => ({ world: document.documentElement.classList.contains('hc-world'), tl: window.__tl.filter(Boolean).length, aim: window.__visorScene.aim, transform: document.querySelector('.hc-svg').style.transform }));
+  const parts = { ladder: await shown(page, '.hc-ladder'), time: await shown(page, '.hc-time'), cards: await shown(page, '#zone-home-main') };
+  await ctx.close();
+  assert.deepEqual(s, { world: false, tl: 0, aim: false, transform: '' });
+  assert.deepEqual(parts, { ladder: true, time: true, cards: true });
+});

package/tests/platform_sandbox.mjs

@@ -0,0 +1,96 @@
+// tests/platform_sandbox.mjs — Cloud Bongos's own sandbox (task 1005292; ADR 0406 §7).
+//
+// The platform runs a second copy of itself that takes every release before the live hub.
+// That copy is the same server started with BONGOS_SANDBOX=1. Pinned here:
+//   1. the hub server installs the sandbox middleware, before any surface answers, so every
+//      page of the copy carries the band — and on the live hub (no variable) it is a no-op;
+//   2. the sandbox page only claims Render's blocked mail ports where Render is the host,
+//      because the platform's sandbox runs on a plain server where that sentence is false.
+//
+// Run:  node tests/platform_sandbox.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { install, pageHtml } = require('../src/sandbox/index.js');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const src = fs.readFileSync(path.join(ROOT, 'src/platform-server.js'), 'utf8')
+  .replace(/^\s*\/\/.*$/gm, ''); // comments may cite the rule; only code counts
+
+await t('the hub server mounts the sandbox middleware', () => {
+  assert.match(src, /app\.use\(require\('\.\/sandbox'\)\.install\(\)\.middleware\)/);
+});
+
+await t('it is mounted before any surface or module answers', () => {
+  const at = src.indexOf("require('./sandbox')");
+  const divert = src.indexOf("resolveOptional('request.divert')");
+  const surfaces = src.indexOf('mountInternalSurfaces(');
+  assert.ok(at > 0 && divert > 0 && at < divert, 'sandbox must come before the request.divert seam');
+  // the import of mountInternalSurfaces sits at the top; the CALL is what matters
+  const call = src.indexOf('mountInternalSurfaces(', surfaces + 1);
+  assert.ok(call < 0 || at < call, 'sandbox must come before the surfaces mount');
+});
+
+await t('on the live hub (no BONGOS_SANDBOX) it changes nothing', () => {
+  const r = install({ env: {} });
+  assert.equal(r.active, false);
+  let called = false;
+  r.middleware({}, {}, () => { called = true; });
+  assert.equal(called, true);
+});
+
+const log = { items: [] };
+await t('on a plain server the page makes no claim about blocked mail ports', () => {
+  assert.doesNotMatch(pageHtml(log, { BONGOS_SANDBOX: '1' }), /email ports/);
+});
+await t('on Render it still says the free plan blocks them', () => {
+  assert.match(pageHtml(log, { BONGOS_SANDBOX: '1', RENDER: 'true' }), /blocks outgoing email ports/);
+});
+
+// 3. The one named exception: creating a repository (owner's choice, 2026-11-14).
+const { decide, parseAllowances } = require('../src/sandbox/gate.js');
+const ALLOW = parseAllowances('github-repo-create');
+await t('without the exception, creating a GitHub repository is refused', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos' }).allow, false);
+});
+await t('with it, creating a repository for a person or an organisation passes', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos', allowances: ALLOW }).allow, true);
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/orgs/acme-co/repos', allowances: ALLOW }).allow, true);
+});
+await t('every other GitHub change stays refused with it on', () => {
+  for (const [m, p] of [['POST', '/repos/o/r/pulls'], ['PUT', '/repos/o/r/pulls/1/merge'], ['PATCH', '/repos/o/r'], ['DELETE', '/repos/o/r'], ['POST', '/repos/o/r/keys'], ['PUT', '/repos/o/r/collaborators/x'], ['POST', '/user/repos/extra']]) {
+    assert.equal(decide({ method: m, host: 'api.github.com', path: p, allowances: ALLOW }).allow, false, `${m} ${p}`);
+  }
+});
+await t('an unknown exception name allows nothing', () => {
+  assert.deepEqual(parseAllowances('everything, github-*'), []);
+});
+await t('install() reads the exception from BONGOS_SANDBOX_ALLOW', async () => {
+  const seen = [];
+  const host = { fetch: async (u) => { seen.push(String(u)); return new Response('{}', { status: 201 }); } };
+  const fakeMod = () => ({ request() {}, get() {} });
+  const idx = require('../src/sandbox/index.js');
+  // a fresh module instance, since install() keeps one state per process
+  delete require.cache[require.resolve('../src/sandbox/index.js')];
+  const fresh = require('../src/sandbox/index.js');
+  fresh.install({ env: { BONGOS_SANDBOX: '1', BONGOS_SANDBOX_ALLOW: 'github-repo-create' }, fetchHost: host, http: fakeMod(), https: fakeMod(), write() {} });
+  void idx;
+  return host.fetch('https://api.github.com/user/repos', { method: 'POST' }).then((r) => {
+    assert.equal(r.status, 201);
+    assert.equal(seen.length, 1);
+  });
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);