create-ailk 0.1.0 → 0.1.1

package/templates/database/__tests__/prefixed-ids.db.test.ts

@@ -0,0 +1,146 @@
+/**
+ * @file prefixed-ids.db.test.ts
+ *
+ * LIVE-DATABASE proof of the ADR-0031 mechanical tier. Requires DATABASE_URL
+ * pointing at a Postgres with the migrations applied (`prisma migrate deploy`)
+ * — the whole suite SKIPS when DATABASE_URL is unset, keeping the workspace
+ * Jest run DB-free (the repo convention; the `apps/api Route Tests (Postgres)`
+ * workflow and local runs with a real DB exercise it).
+ *
+ * Uses the `pg` driver directly (raw SQL): the generated Prisma client is
+ * ESM-only (`import.meta`) and cannot load under this package's CJS ts-jest
+ * transform — and raw SQL is the sharper proof anyway, since the CHECK
+ * constraints must hold on the path no application helper can guard.
+ * (Client-level coverage — plain + nested `create` and Better Auth inserts
+ * landing DB-minted prefixed ids — was verified live against the migrated
+ * schema; see PR #3671's verification log.)
+ *
+ * What it proves — the ADR-0031 Tier-2 success criteria:
+ *   1. uuidv7() property tests: version nibble 7, RFC-4122 variant,
+ *      non-decreasing across a millisecond boundary. A failure here is a
+ *      staging bug to surface to Sam, NOT a signal to rewrite the SQL.
+ *   2. An insert with NO caller-supplied id lands a correctly-prefixed id via
+ *      the DATABASE default.
+ *   3. An insert with a malformed id is REJECTED by the CHECK constraint.
+ *   4. The relation-free scope columns (workspaceId refs) are CHECKed too.
+ *   5. The reserved-range sentinel ids are admitted by the CHECKs.
+ */
+import { Client } from "pg";
+
+import { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } from "../tenancy.js";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const V7_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+  });
+
+  afterAll(async () => {
+    await db.query(`DELETE FROM "leads" WHERE "site_id" = 'adr31-test'`);
+    await db.query(
+      `DELETE FROM "organizations" WHERE "slug" LIKE 'adr31-%'`,
+    );
+    await db.end();
+  });
+
+  describe("uuidv7() SQL function properties", () => {
+    it("version nibble is 7 and variant is RFC-4122 across 200 samples", async () => {
+      const { rows } = await db.query<{ id: string }>(
+        "SELECT uuidv7()::text AS id FROM generate_series(1, 200)",
+      );
+      expect(rows).toHaveLength(200);
+      for (const { id } of rows) {
+        expect(id).toMatch(V7_RE);
+      }
+    });
+
+    it("is non-decreasing across a millisecond boundary", async () => {
+      const first = (await db.query<{ id: string }>(
+        "SELECT uuidv7()::text AS id",
+      )).rows[0].id;
+      await new Promise((r) => setTimeout(r, 5));
+      const second = (await db.query<{ id: string }>(
+        "SELECT uuidv7()::text AS id",
+      )).rows[0].id;
+      expect(second >= first).toBe(true);
+    });
+  });
+
+  describe("DB-generated prefixed defaults", () => {
+    it("an insert with NO id lands a prefixed id via the database default", async () => {
+      const org = (await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('ADR31 Org', 'adr31-org', now()) RETURNING "id"`,
+      )).rows[0];
+      expect(org.id).toMatch(/^org_/);
+      expect(org.id.slice("org_".length)).toMatch(V7_RE);
+
+      const lead = (await db.query<{ id: string }>(
+        `INSERT INTO "leads" ("site_id", "source", "email", "payload")
+         VALUES ('adr31-test', 'test', 'adr31@example.com', '{}') RETURNING "id"`,
+      )).rows[0];
+      expect(lead.id).toMatch(/^lead_/);
+      expect(lead.id.slice("lead_".length)).toMatch(V7_RE);
+    });
+  });
+
+  describe("CHECK constraints — the mechanical tier", () => {
+    it("REJECTS an insert with a malformed primary key", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "leads" ("id", "site_id", "source", "email", "payload")
+           VALUES ('bad', 'adr31-test', 'x', 'a@b.co', '{}')`,
+        ),
+      ).rejects.toThrow(/leads_id_format/);
+    });
+
+    it("REJECTS an insert with a bare (unprefixed) uuid primary key", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "leads" ("id", "site_id", "source", "email", "payload")
+           VALUES ('0190f3a2-7c1d-7e4a-9b2c-0123456789ab', 'adr31-test', 'x', 'a@b.co', '{}')`,
+        ),
+      ).rejects.toThrow(/leads_id_format/);
+    });
+
+    it("REJECTS a malformed relation-free scope ref (workspaceId with no FK)", async () => {
+      await expect(
+        db.query(
+          `INSERT INTO "workspace_themes" ("workspace_id", "data", "updated_at")
+           VALUES ('not-a-workspace-id', '{}', now())`,
+        ),
+      ).rejects.toThrow(/workspace_themes_workspace_id_format/);
+    });
+
+    it("ADMITS the reserved-range sentinel ids (seed path stays valid)", async () => {
+      const org = (await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("id", "name", "slug", "updated_at")
+         VALUES ($1, 'ADR31 Sentinel', 'adr31-sentinel', now()) RETURNING "id"`,
+        [DEFAULT_ORG_ID],
+      )).rows[0];
+      expect(org.id).toBe(DEFAULT_ORG_ID);
+
+      const ws = (await db.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("id", "organization_id", "name", "slug", "updated_at")
+         VALUES ($1, $2, 'Sentinel WS', 'sentinel', now()) RETURNING "id"`,
+        [DEFAULT_WORKSPACE_ID, DEFAULT_ORG_ID],
+      )).rows[0];
+      expect(ws.id).toBe(DEFAULT_WORKSPACE_ID);
+    });
+
+    it("carries the full CHECK complement: 27 PK + 12 scope = 39", async () => {
+      const { rows } = await db.query<{ n: string }>(
+        `SELECT count(*)::text AS n FROM pg_constraint
+         WHERE contype = 'c' AND conname LIKE '%_format'`,
+      );
+      expect(rows[0].n).toBe("39");
+    });
+  });
+});

package/templates/database/__tests__/seed.test.ts

@@ -0,0 +1,88 @@
+/**
+ * @file seed.test.ts
+ *
+ * DB-free unit test for `provisionDefaultWorkspace` (#3622 —
+ * docs/specs/default-workspace-provision-spec.md AC-1 / AC-2).
+ *
+ * Prisma is injected as a lightweight jest-mock stub typed as
+ * `DefaultWorkspacePrismaClient` — no live Postgres, mirroring the DB-free
+ * convention in database/__tests__/user-cascade.test.ts and the
+ * `createAuth({ prisma })` DI pattern in apps-paid/workspace/__tests__.
+ */
+
+import {
+  DEFAULT_ORG_ID,
+  DEFAULT_ORG_SLUG,
+  DEFAULT_WORKSPACE_ID,
+  DEFAULT_WORKSPACE_SLUG,
+  provisionDefaultWorkspace,
+  type DefaultWorkspacePrismaClient,
+} from "../seed";
+
+function makeStubPrisma(workspaceCount: number) {
+  const organizationUpsert = jest.fn().mockResolvedValue({});
+  const workspaceUpsert = jest.fn().mockResolvedValue({});
+  const workspaceCountFn = jest.fn().mockResolvedValue(workspaceCount);
+
+  // Minimal Prisma delegate stub — only the two delegates
+  // provisionDefaultWorkspace touches. The full PrismaClient delegate method
+  // signatures are impractical to satisfy for a hand-built DB-free stub, so a
+  // double assertion through `unknown` is the sanctioned boundary here.
+  // eslint-disable-next-line no-restricted-syntax -- test stub: minimal Prisma delegate surface; full delegate types impractical for a DB-free unit stub
+  const prisma = {
+    organization: { upsert: organizationUpsert },
+    workspace: { count: workspaceCountFn, upsert: workspaceUpsert },
+  } as unknown as DefaultWorkspacePrismaClient;
+
+  return { prisma, organizationUpsert, workspaceUpsert, workspaceCountFn };
+}
+
+describe("provisionDefaultWorkspace (#3622)", () => {
+  it("AC-1: given workspace.count() === 0, upserts one default Organization + Workspace and returns { created: true }", async () => {
+    const { prisma, organizationUpsert, workspaceUpsert, workspaceCountFn } =
+      makeStubPrisma(0);
+
+    const result = await provisionDefaultWorkspace(prisma);
+
+    expect(result).toEqual({ created: true });
+    expect(workspaceCountFn).toHaveBeenCalledTimes(1);
+
+    expect(organizationUpsert).toHaveBeenCalledTimes(1);
+    expect(organizationUpsert).toHaveBeenCalledWith({
+      where: { slug: DEFAULT_ORG_SLUG },
+      create: expect.objectContaining({
+        id: DEFAULT_ORG_ID,
+        slug: DEFAULT_ORG_SLUG,
+      }),
+      update: {},
+    });
+
+    expect(workspaceUpsert).toHaveBeenCalledTimes(1);
+    expect(workspaceUpsert).toHaveBeenCalledWith({
+      where: {
+        organizationId_slug: {
+          organizationId: DEFAULT_ORG_ID,
+          slug: DEFAULT_WORKSPACE_SLUG,
+        },
+      },
+      create: expect.objectContaining({
+        id: DEFAULT_WORKSPACE_ID,
+        organizationId: DEFAULT_ORG_ID,
+        slug: DEFAULT_WORKSPACE_SLUG,
+      }),
+      update: {},
+    });
+  });
+
+  it("AC-2: given workspace.count() > 0, makes no organization/workspace create-or-upsert calls and returns { created: false } (multi-tenant / re-run no-op)", async () => {
+    const { prisma, organizationUpsert, workspaceUpsert, workspaceCountFn } =
+      makeStubPrisma(3);
+
+    const result = await provisionDefaultWorkspace(prisma);
+
+    expect(result).toEqual({ created: false });
+    expect(workspaceCountFn).toHaveBeenCalledTimes(1);
+    expect(organizationUpsert).not.toHaveBeenCalled();
+    expect(workspaceUpsert).not.toHaveBeenCalled();
+  });
+});

package/templates/database/__tests__/user-cascade.test.ts

@@ -24,10 +24,25 @@
  * Jest run stays DB-free.
  */
 
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { readFileSync, readdirSync } from "node:fs";
+import { resolve, join } from "node:path";
 
-const SCHEMA_PATH = resolve(__dirname, "..", "schema.prisma");
+// prismaSchemaFolder (ADR-0009 D4, #3607): models are defined across the
+// database/ folder (root schema.prisma + database/<namespace>/schema.prisma),
+// not a single file. Concatenate every .prisma file so the schema-shape
+// assertions below find each model regardless of which namespace file it lives in.
+const DB_DIR = resolve(__dirname, "..");
+
+function loadSchemaFolder(dir: string): string {
+  let out = "";
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === "generated") continue;
+    const p = join(dir, entry.name);
+    if (entry.isDirectory()) out += loadSchemaFolder(p);
+    else if (entry.name.endsWith(".prisma")) out += `${readFileSync(p, "utf-8")}\n`;
+  }
+  return out;
+}
 
 /**
  * `relationField` is the field name on User that points at each related
@@ -58,7 +73,7 @@ const BETTER_AUTH_RELATIONS: Array<{ model: string }> = [
 ];
 
 describe("User cascade — schema-shape contract (#587)", () => {
-  const schema = readFileSync(SCHEMA_PATH, "utf-8");
+  const schema = loadSchemaFolder(DB_DIR);
 
   it.each(CUSTOM_RELATIONS)(
     "$model FK to User declares onDelete: Cascade ($description)",