test(teams): phase 5's server surface, and the negative property under it

1008 pass (972 before). The tests worth reading first are the ones that pin a property no screen would look different without: * **The edit window is decided on the server, twice.** One test proves the read path stamps `canEdit` per post per viewer; another proves the WRITE path re-derives it from `created_at` and refuses a stale edit even though the client was told it could — because a time-bounded permission must not take its clock from the party it bounds. * **A locked thread refuses staff too**, asserted over member, leader and staff in one loop, at 409 rather than 403: well-formed request, refusing state. * **delete → restore is reversible for images.** Without the second half of the pair a restored post returns its words and loses its pictures a retention window later, silently — the test asserts both calls and that `hide` makes neither. * **Post moderation recomputes the thread's counters** rather than nudging them; the test runs hide → unhide → hide, which is the cycle a delta gets wrong. * **acceptance: nothing in the report model is reachable by a Team leader.** The negative property is the whole point of §5.6 and negatives are what nobody notices going, so it is asserted directly — the module's function surface is pinned, and `queue`/`handle` are checked not to mention leadership at all. If a leader-facing queue is ever wanted it is the org lead's decision, and this test is what makes somebody ask. * **A report never changes the content it is about**, proved by stubbing every mutation the forum has to throw. If filing a report touched a status then "report" would BE moderation, and the first person to work that out would have found a way to hide anything on the site. The test suite caught one real defect: `describeTarget` returned `undefined` for a hard-deleted target, and `undefined` is dropped by JSON.stringify — so the documented `target: null` would have reached clients as an absent key. Two phase-4 tests were updated rather than added to, both because phase 5 changed what they describe: `canPost` split into `canPost` (open a discussion, everyone) and `canAnnounce` (leaders), and `discussion` is no longer a refused thread type. Phase 5's four new player routes are added to acceptance criterion 2's list, so "with the forum off every forum route 404s" keeps covering the whole surface. Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-18 12:58:15 -05:00
parent fff14848f1
commit 128de0ff2e
4 changed files with 660 additions and 13 deletions
--- a/server/test/teamForum.test.js
+++ b/server/test/teamForum.test.js
@@ -1,7 +1,7 @@
-// The forum's access model, its switches, and its renderer
-// (docs/website/TEAMS.md Part 5, phase 4 "5a").
+// The forum's access model, its switches, its renderer (phase 4, "5a") and its
+// discussion half (phase 5, "5b") — docs/website/TEAMS.md Part 5.
 //
-// The four tests named "acceptance" are §Phase 4's four acceptance criteria,
+// The tests named "acceptance" are the phases' stated acceptance criteria,
 // verbatim. They are the ones to read first, and the ones not to weaken: each
 // names a property that the code around it can lose without any screen looking
 // different.
@@ -306,16 +306,18 @@ test('a member who is also a grantee is listed as a member, not as a guest', asy

 // ── threads (§5.1, §5.3) ───────────────────────────────────────────────────

-test('5a creates announcements and refuses discussion threads', async () => {
+test('both thread types are creatable, and an invented one is not', async () => {
  patch(forumDb, 'insertThread', async () => 1)
  patch(forumDb, 'insertPost', async () => 1)

-  const ok = await forum.createThread({ team, actor: leader, type: 'announcement', title: 'Raid', body: '<p>Hi</p>' })
-  assert.equal(ok.ok, true)
+  // Phase 5 opened `discussion`. Neither type needed a migration: both have been
+  // in the enum since 5a, which is what §5.1's split-by-layer bought.
+  for (const type of ['announcement', 'discussion']) {
+    const ok = await forum.createThread({ team, actor: leader, type, title: 'Raid', body: '<p>Hi</p>' })
+    assert.equal(ok.ok, true, type)
+  }

-  // The type exists in the enum from day one so 5b adds no migration — but
-  // nothing creates one yet.
-  const refused = await forum.createThread({ team, actor: leader, type: 'discussion', title: 'Chat', body: '<p>Hi</p>' })
+  const refused = await forum.createThread({ team, actor: leader, type: 'sticky', title: 'x', body: '<p>Hi</p>' })
  assert.equal(refused.ok, false)
  assert.equal(refused.status, 400)
 })
@@ -372,3 +374,238 @@ test('a RIFF container that is not WebP is not accepted as one', () => {
  const wav = Buffer.concat([Buffer.from('RIFF'), Buffer.alloc(4), Buffer.from('WAVE'), Buffer.alloc(4)])
  assert.equal(uploads.sniff(wav), null)
 })
+
+
+// ── phase 5 ("5b"): replies, the edit window, post moderation ──────────────
+
+const member = { id: 11, username: 'wanderer', role: 'player' }
+
+// A visible discussion thread and one post in it, as the DB layer would return
+// them. Written as a factory rather than a shared constant because half these
+// tests mutate the row they are given.
+const discussion = (over = {}) => ({
+  id: 5, team_id: 1, type: 'discussion', title: 'Raid night',
+  status: 'visible', locked: 0, pinned: 0, post_count: 1,
+  created_by: 11, created_username: 'wanderer', ...over,
+})
+const post = (over = {}) => ({
+  id: 80, thread_id: 5, author_user_id: 11, author_username: 'wanderer',
+  body_html: '<p>Hi</p>', status: 'visible', created_at: new Date(), edited_at: null,
+  edited_by: null, ...over,
+})
+
+test('a reply lands on a discussion thread and never on an announcement', async () => {
+  patch(forumDb, 'insertPost', async () => 81)
+
+  patch(forumDb, 'threadById', async () => discussion())
+  const ok = await forum.createPost({ team, threadId: 5, actor: member, body: '<p>Count me in</p>' })
+  assert.equal(ok.ok, true)
+  assert.equal(ok.postId, 81)
+
+  // 400, not 404 and not 409: the request is malformed FOR THIS THREAD and no
+  // amount of retrying fixes it. An announcement takes no replies by TYPE.
+  patch(forumDb, 'threadById', async () => discussion({ type: 'announcement' }))
+  const refused = await forum.createPost({ team, threadId: 5, actor: member, body: '<p>Hi</p>' })
+  assert.equal(refused.ok, false)
+  assert.equal(refused.status, 400)
+})
+
+test('a locked thread refuses replies with 409 — and refuses staff too', async () => {
+  patch(forumDb, 'insertPost', async () => { throw new Error('must not write') })
+  patch(forumDb, 'threadById', async () => discussion({ locked: 1 }))
+
+  for (const actor of [member, leader, staff]) {
+    const refused = await forum.createPost({ team, threadId: 5, actor, body: '<p>Hi</p>' })
+    assert.equal(refused.ok, false, actor.username)
+    // Well-formed request, refusing STATE — which is the distinction a client
+    // needs to tell "you cannot" from "not right now".
+    assert.equal(refused.status, 409, actor.username)
+  }
+})
+
+test('a reply to a hidden or foreign thread reads as not found', async () => {
+  patch(forumDb, 'insertPost', async () => { throw new Error('must not write') })
+
+  patch(forumDb, 'threadById', async () => discussion({ status: 'hidden' }))
+  assert.equal((await forum.createPost({ team, threadId: 5, actor: member, body: '<p>x</p>' })).status, 404)
+
+  patch(forumDb, 'threadById', async () => discussion({ team_id: 999 }))
+  assert.equal((await forum.createPost({ team, threadId: 5, actor: member, body: '<p>x</p>' })).status, 404)
+})
+
+test('the edit window is decided on the server, from created_at', () => {
+  const fresh = post({ created_at: new Date(Date.now() - 60_000) })          // a minute old
+  const stale = post({ created_at: new Date(Date.now() - 60 * 60_000) })     // an hour old
+
+  assert.equal(forum.editability(fresh, { userId: 11, windowMinutes: 15 }).canEdit, true)
+  assert.equal(forum.editability(stale, { userId: 11, windowMinutes: 15 }).canEdit, false)
+
+  // Somebody else's post, inside the window, is still not theirs to edit.
+  assert.equal(forum.editability(fresh, { userId: 99, windowMinutes: 15 }).canEdit, false)
+
+  // Staff are not time-bounded, and `editableUntil: null` reads as "no deadline"
+  // rather than as "no permission" — canEdit is the permission.
+  const asStaff = forum.editability(stale, { userId: 2, isStaff: true, windowMinutes: 15 })
+  assert.equal(asStaff.canEdit, true)
+  assert.equal(asStaff.editableUntil, null)
+
+  // A window of zero is a legitimate operator choice: posts immutable once written.
+  assert.equal(forum.editability(fresh, { userId: 11, windowMinutes: 0 }).canEdit, false)
+})
+
+test('a hidden post is editable by nobody, staff included', () => {
+  const hidden = post({ status: 'hidden', created_at: new Date() })
+  assert.equal(forum.editability(hidden, { userId: 11, windowMinutes: 15 }).canEdit, false)
+  // Restoring it is a moderation action with a ledger row; quietly rewriting it
+  // while it is out of sight is the same act with no record.
+  assert.equal(forum.editability(hidden, { userId: 2, isStaff: true, windowMinutes: 15 }).canEdit, false)
+})
+
+test('the write path re-derives the window and does not trust the read path', async () => {
+  const stale = post({ created_at: new Date(Date.now() - 60 * 60_000) })
+  patch(forumDb, 'postById', async () => stale)
+  patch(forumDb, 'threadById', async () => discussion())
+  const writes = []
+  patch(forumDb, 'updatePostBody', async (...args) => { writes.push(args); return true })
+
+  const refused = await forum.editPost({ team, postId: 80, actor: member, windowMinutes: 15, body: '<p>new</p>' })
+  assert.equal(refused.ok, false)
+  assert.equal(refused.status, 403)
+  assert.equal(writes.length, 0)
+
+  // Staff, same post, same moment.
+  const allowed = await forum.editPost({ team, postId: 80, actor: staff, isStaff: true, windowMinutes: 15, body: '<p>new</p>' })
+  assert.equal(allowed.ok, true)
+  assert.equal(writes.length, 1)
+  // Reported so the controller can write the §5.3 accountability row — a staffer
+  // editing someone ELSE's words is an intervention.
+  assert.equal(allowed.staffEdit, true)
+})
+
+test('a staffer editing their own post is an ordinary edit, not an intervention', async () => {
+  patch(forumDb, 'postById', async () => post({ author_user_id: staff.id, author_username: staff.username }))
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'updatePostBody', async () => true)
+
+  const result = await forum.editPost({ team, postId: 80, actor: staff, isStaff: true, windowMinutes: 15, body: '<p>x</p>' })
+  assert.equal(result.ok, true)
+  assert.equal(result.staffEdit, false)
+})
+
+test('a member may not edit somebody else’s post at all', async () => {
+  patch(forumDb, 'postById', async () => post({ author_user_id: 99, author_username: 'someone' }))
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'updatePostBody', async () => { throw new Error('must not write') })
+
+  const refused = await forum.editPost({ team, postId: 80, actor: member, windowMinutes: 15, body: '<p>x</p>' })
+  assert.equal(refused.ok, false)
+  assert.equal(refused.status, 403)
+})
+
+test('post moderation shares the thread ledger, tagged as a post', async () => {
+  const ledger = []
+  patch(forumDb, 'postById', async () => post())
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'setPostStatus', async () => true)
+  patch(forumDb, 'recountThread', async () => {})
+  patch(forumDb, 'softDeleteUploadsForPost', async () => {})
+  patch(forumDb, 'restoreUploadsForPost', async () => {})
+  patch(forumDb, 'insertModeration', async (row) => { ledger.push(row) })
+
+  await forum.moderatePost({ team, postId: 80, action: 'hide', actor: leader, actorRole: 'leader' })
+  await forum.moderatePost({ team, postId: 80, action: 'delete', actor: staff, actorRole: 'staff' })
+
+  // One table, two target kinds — so "everything moderated in this Team" stays
+  // one query instead of a union.
+  assert.deepEqual(ledger.map((r) => r.targetType), ['post', 'post'])
+  assert.deepEqual(ledger.map((r) => r.action), ['hide', 'delete'])
+  assert.deepEqual(ledger.map((r) => r.actorRole), ['leader', 'staff'])
+})
+
+test('pin and lock are refused BY NAME on a post, not as unknown actions', async () => {
+  patch(forumDb, 'postById', async () => post())
+  patch(forumDb, 'threadById', async () => discussion())
+
+  const wrongObject = await forum.moderatePost({ team, postId: 80, action: 'pin', actor: leader, actorRole: 'leader' })
+  assert.equal(wrongObject.status, 400)
+  assert.match(wrongObject.error, /applies to a thread/)
+
+  const nonsense = await forum.moderatePost({ team, postId: 80, action: 'incinerate', actor: leader, actorRole: 'leader' })
+  assert.equal(nonsense.status, 400)
+  assert.match(nonsense.error, /Unknown/)
+})
+
+test('deleting a post takes its images with it, and restoring brings them back', async () => {
+  const calls = []
+  patch(forumDb, 'postById', async () => post())
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'setPostStatus', async () => true)
+  patch(forumDb, 'recountThread', async () => {})
+  patch(forumDb, 'insertModeration', async () => {})
+  patch(forumDb, 'softDeleteUploadsForPost', async (id) => { calls.push(['soft', id]) })
+  patch(forumDb, 'restoreUploadsForPost', async (id) => { calls.push(['restore', id]) })
+
+  await forum.moderatePost({ team, postId: 80, action: 'delete', actor: staff, actorRole: 'staff' })
+  await forum.moderatePost({ team, postId: 80, action: 'restore', actor: staff, actorRole: 'staff' })
+  // Without the second half, delete → restore returns the words and loses the
+  // pictures a retention window later, silently.
+  assert.deepEqual(calls, [['soft', 80], ['restore', 80]])
+
+  // Hiding is not deleting: a hidden post's images are untouched, because
+  // unhiding must be free.
+  calls.length = 0
+  await forum.moderatePost({ team, postId: 80, action: 'hide', actor: staff, actorRole: 'staff' })
+  assert.deepEqual(calls, [])
+})
+
+test('post moderation recomputes the thread’s counters rather than nudging them', async () => {
+  const recounts = []
+  patch(forumDb, 'postById', async () => post())
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'setPostStatus', async () => true)
+  patch(forumDb, 'insertModeration', async () => {})
+  patch(forumDb, 'softDeleteUploadsForPost', async () => {})
+  patch(forumDb, 'restoreUploadsForPost', async () => {})
+  patch(forumDb, 'recountThread', async (id) => { recounts.push(id) })
+
+  // hide → unhide → hide is a cycle a counter kept by deltas gets wrong the
+  // first time a step is retried or raced.
+  for (const action of ['hide', 'unhide', 'hide']) {
+    await forum.moderatePost({ team, postId: 80, action, actor: staff, actorRole: 'staff' })
+  }
+  assert.deepEqual(recounts, [5, 5, 5])
+})
+
+test('a thread reports whether it takes replies, and why not', async () => {
+  patch(forumDb, 'postsByThread', async () => [])
+
+  patch(forumDb, 'threadById', async () => discussion())
+  assert.equal((await forum.getThread(1, 5, { canModerate: false })).canReply, true)
+
+  patch(forumDb, 'threadById', async () => discussion({ locked: 1 }))
+  const locked = await forum.getThread(1, 5, { canModerate: false })
+  assert.equal(locked.canReply, false)
+  assert.equal(locked.locked, true)     // the UI can say WHICH half refused
+
+  patch(forumDb, 'threadById', async () => discussion({ type: 'announcement' }))
+  const announcement = await forum.getThread(1, 5, { canModerate: false })
+  assert.equal(announcement.canReply, false)
+  assert.equal(announcement.type, 'announcement')
+})
+
+test('every post comes back knowing whether THIS reader may edit it', async () => {
+  patch(forumDb, 'threadById', async () => discussion())
+  patch(forumDb, 'postsByThread', async () => [
+    post({ id: 80, author_user_id: 11, created_at: new Date() }),
+    post({ id: 81, author_user_id: 99, author_username: 'someone', created_at: new Date() }),
+  ])
+
+  const mine = await forum.getThread(1, 5, { viewer: { userId: 11, windowMinutes: 15 } })
+  assert.deepEqual(mine.posts.map((p) => p.canEdit), [true, false])
+  assert.deepEqual(mine.posts.map((p) => p.mine), [true, false])
+
+  // A caller that does not say who is reading gets the safe answer, which is what
+  // keeps every phase-4 call site correct without changing it.
+  const anonymous = await forum.getThread(1, 5, {})
+  assert.deepEqual(anonymous.posts.map((p) => p.canEdit), [false, false])
+})