Render directional-CLV badge — Analyst+Desk, server-gated, receipt-bearing
CARD BADGE ONLY. Ticker-CLV explicitly DEFERRED (named, not lost).
PHASE 1 — SERVER-SIDE GATE AT THE DATA LAYER. A Free request never
RECEIVES dclv data: the CLV columns are appended to the SELECT only behind
canAccess(tier,'clv_badge') (new capability, analyst+desk), and responses
are ALSO stripped as defence in depth so a future SELECT change cannot
quietly leak. No CSS/client gate — data that reaches the browser has left
the building. dclv_fair_lock/fair_close are de-vig internals and are never
sent at all.
SURFACE AUDIT, all six channels, each test-locked to contain no CLV:
public profile (share link), snapshot/card feed, ticker feed, share
card/OG, embeddable widget, newsletter. A test also asserts no
ledger_entries read uses select('*') — a star would auto-leak every new
column, which is exactly how a gate becomes theatre.
PHASE 2 — IMMUTABLE ONCE COMPUTED. A settle can re-run (stat correction,
protested game) and a badge that flips positive->negative AFTER a user saw
or screenshotted it is a credibility failure. First computation wins: dclv
is only computed when dclv_computed_at is null, so a re-settle can never
rewrite a shown badge. Same discipline as the locked grade.
PHASE 3 — RENDER, test-first, ABSENCE IS HONEST. unknown / flat / null /
missing-receipt all render NOTHING — no element, no placeholder, no
"pending". Proven on an ALL-NULL board (today: 0 badges) and a MIXED board
(tomorrow: 1 of 4 badged, badge-less cards clean). Binary states only:
positive -> MOVED TOWARD US "graded -110 · closed -145"
negative -> MOVED AWAY "graded -110 · closed +120"
The RECEIPT is the persuasive part, so a badge with no numbers is
suppressed rather than shown as a bare claim. Negative is neutral context
and NEVER touches the locked grade — no back-door re-grading.
NO aggregate, count or rollup exists by construction: the module exports
exactly {clvBadge, fmtPrice} and a badge payload carries exactly
{tone,label,receipt} — asserted by test, because an on-screen tally would
be the held aggregate claim through the side door.
Build gotcha hit and fixed: clvBadge is CommonJS (allowJs) with no TS
types, so the .tsx needed an explicit cast at the call site — the build
worker exits 1 on type errors even though compilation "succeeds".
Suite 288/3473 green, build exit 0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA
This commit is contained in:
@@ -0,0 +1,76 @@
|
||||
/**
|
||||
* Session 64 — CLV badge rendering model. Absence must be a NON-ELEMENT.
|
||||
*/
|
||||
const { clvBadge } = require('../../web/src/lib/clvBadge');
|
||||
|
||||
const read = (o = {}) => ({ dclv_state: 'positive', locked_odds: '-110', closing_odds: '-145', ...o });
|
||||
|
||||
describe('ABSENCE IS HONEST — renders NOTHING', () => {
|
||||
test('unknown → null (no element, not "pending")', () => {
|
||||
expect(clvBadge(read({ dclv_state: 'unknown' }))).toBeNull();
|
||||
});
|
||||
test('flat → null (a held line is not news)', () => {
|
||||
expect(clvBadge(read({ dclv_state: 'flat' }))).toBeNull();
|
||||
});
|
||||
test('missing state → null', () => {
|
||||
expect(clvBadge(read({ dclv_state: null }))).toBeNull();
|
||||
expect(clvBadge({})).toBeNull();
|
||||
expect(clvBadge(null)).toBeNull();
|
||||
});
|
||||
test('a Free response (CLV stripped server-side) renders nothing', () => {
|
||||
const free = { player_name: 'X', grade: 'B', locked_odds: '-110' }; // no dclv_*
|
||||
expect(clvBadge(free)).toBeNull();
|
||||
});
|
||||
test('no receipt numbers → NO badge (a label without evidence is an assertion)', () => {
|
||||
expect(clvBadge(read({ closing_odds: null }))).toBeNull();
|
||||
expect(clvBadge(read({ locked_odds: null }))).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe('THE RECEIPT — numbers, not just a label', () => {
|
||||
test('positive carries tone, label and the concrete prices', () => {
|
||||
const b = clvBadge(read());
|
||||
expect(b.tone).toBe('confirm');
|
||||
expect(b.label).toBe('MOVED TOWARD US');
|
||||
expect(b.receipt).toBe('graded -110 · closed -145');
|
||||
});
|
||||
test('negative is CAUTION and also carries the receipt', () => {
|
||||
const b = clvBadge(read({ dclv_state: 'negative', closing_odds: '+120' }));
|
||||
expect(b.tone).toBe('caution');
|
||||
expect(b.receipt).toBe('graded -110 · closed +120');
|
||||
});
|
||||
test('positive prices render with an explicit +', () => {
|
||||
expect(clvBadge(read({ locked_odds: 105, closing_odds: 130 })).receipt)
|
||||
.toBe('graded +105 · closed +130');
|
||||
});
|
||||
});
|
||||
|
||||
describe('BOARD SHAPES — all-null and mixed both render clean', () => {
|
||||
const board = [
|
||||
read({ dclv_state: 'positive' }),
|
||||
read({ dclv_state: 'unknown' }),
|
||||
read({ dclv_state: 'flat' }),
|
||||
{ player_name: 'free-view', grade: 'B' },
|
||||
];
|
||||
test('a MIXED board badges only the real signals', () => {
|
||||
const badges = board.map(clvBadge);
|
||||
expect(badges.filter(Boolean)).toHaveLength(1);
|
||||
expect(badges[1]).toBeNull();
|
||||
expect(badges[2]).toBeNull();
|
||||
});
|
||||
test('an ALL-NULL board (today) produces zero badges and no errors', () => {
|
||||
const allNull = [read({ dclv_state: 'unknown' }), read({ dclv_state: null }), {}];
|
||||
expect(allNull.map(clvBadge).filter(Boolean)).toHaveLength(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe('NO AGGREGATE anywhere', () => {
|
||||
test('the module exposes no count/rollup helper', () => {
|
||||
const mod = require('../../web/src/lib/clvBadge');
|
||||
expect(Object.keys(mod).sort()).toEqual(['clvBadge', 'fmtPrice']);
|
||||
});
|
||||
test('a badge payload carries no totals', () => {
|
||||
const b = clvBadge(read());
|
||||
expect(Object.keys(b).sort()).toEqual(['label', 'receipt', 'tone']);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* Session 64 — the CLV gate is SERVER-SIDE, at the data layer.
|
||||
*
|
||||
* A Free request must never RECEIVE dclv data. Client/CSS hiding is rejected:
|
||||
* data that reaches the browser has left the building. These lock the gate and
|
||||
* the surface audit, so a future column addition can't quietly leak.
|
||||
*/
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const { canAccess } = require('../../src/config/tiers');
|
||||
|
||||
const read = (f) => fs.readFileSync(path.join(__dirname, '..', '..', f), 'utf8');
|
||||
|
||||
describe('TIER capability', () => {
|
||||
test('analyst and desk may see the badge; free may not', () => {
|
||||
expect(canAccess('analyst', 'clv_badge')).toBe(true);
|
||||
expect(canAccess('desk', 'clv_badge')).toBe(true);
|
||||
expect(canAccess('free', 'clv_badge')).toBeFalsy();
|
||||
expect(canAccess(undefined, 'clv_badge')).toBeFalsy();
|
||||
});
|
||||
});
|
||||
|
||||
describe('SERVER GATE — the data never leaves for an unentitled tier', () => {
|
||||
const ledger = read('src/routes/ledger.js');
|
||||
|
||||
test('CLV columns are appended only via a capability check', () => {
|
||||
expect(ledger).toMatch(/canAccess\(tier, 'clv_badge'\)/);
|
||||
expect(ledger).toMatch(/CLV_COLUMNS/);
|
||||
});
|
||||
|
||||
test('the base column list does NOT contain dclv', () => {
|
||||
// Assert on the literal itself — a nearby comment mentioning dclv is fine.
|
||||
const m = ledger.match(/const ROW_COLUMNS = '([^']+)'/);
|
||||
expect(m).toBeTruthy();
|
||||
expect(m[1]).not.toMatch(/dclv/);
|
||||
});
|
||||
|
||||
test('responses are ALSO stripped — defence in depth, not just the SELECT', () => {
|
||||
expect(ledger).toMatch(/function stripClv/);
|
||||
expect(ledger).toMatch(/stripClv\(data, req\)/);
|
||||
});
|
||||
|
||||
test('de-vig internals (fair_lock/fair_close) are never SELECTED for clients', () => {
|
||||
// They may (and should) appear in the strip list — that is the guard.
|
||||
const sel = ledger.match(/const CLV_COLUMNS = '([^']+)'/);
|
||||
expect(sel[1]).not.toMatch(/fair_lock|fair_close/);
|
||||
expect(ledger).toMatch(/dclv_fair_lock, dclv_fair_close, \.\.\.rest/);
|
||||
});
|
||||
});
|
||||
|
||||
describe('SURFACE AUDIT — every channel CLV could leak through', () => {
|
||||
const surfaces = {
|
||||
'public profile (share link)': 'src/routes/profiles.js',
|
||||
'snapshot / card feed': 'src/routes/snapshot.js',
|
||||
'ticker feed': 'src/routes/ticker.js',
|
||||
'share card / OG': 'src/routes/shareCard.js',
|
||||
'widget (embeddable)': 'src/routes/widget.js',
|
||||
'newsletter': 'src/services/newsletterService.js',
|
||||
};
|
||||
for (const [name, file] of Object.entries(surfaces)) {
|
||||
test(`${name} carries NO CLV data`, () => {
|
||||
expect(read(file)).not.toMatch(/dclv/);
|
||||
});
|
||||
}
|
||||
|
||||
test('no ledger read uses select("*") — a star would auto-leak new columns', () => {
|
||||
for (const f of ['src/routes/ledger.js', 'src/routes/profiles.js', 'src/services/ledgerService.js']) {
|
||||
const src = read(f);
|
||||
const stars = src.match(/from\('ledger_entries'\)[\s\S]{0,60}?select\('\*'\)/g) || [];
|
||||
expect(stars).toHaveLength(0);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('IMMUTABILITY — a shown badge never silently flips', () => {
|
||||
const svc = read('src/services/ledgerService.js');
|
||||
test('dclv is computed only when it has never been computed', () => {
|
||||
expect(svc).toMatch(/row\.dclv_computed_at\s*\n?\s*\?\s*null/);
|
||||
});
|
||||
test('the settle read fetches dclv_computed_at so the guard can see it', () => {
|
||||
expect(svc).toMatch(/dclv_computed_at, player_key/);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user