create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/middleware/__tests__/auth.cookie-path.test.ts

@@ -72,7 +72,13 @@ describe("auth preHandler — cookie path", () => {
     // The signature suffix must be stripped before the Session lookup.
     expect(prisma.session.findUnique).toHaveBeenCalledWith({
       where: { token: "sess_tok_abc" },
-      select: { userId: true, expiresAt: true },
+      select: {
+        id: true,
+        userId: true,
+        expiresAt: true,
+        activeOrganizationId: true,
+        activeWorkspaceId: true,
+      },
     });
   });
 

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -14,9 +14,16 @@
  */
 
 import Fastify from "fastify";
-import { rateLimitMiddleware, __resetBuckets } from "../rate-limit.js";
-
-function buildApp(opts: { perIpPerMinute?: number; windowMs?: number } = {}) {
+import {
+  rateLimitMiddleware,
+  __resetBuckets,
+  __bucketCount,
+  DEFAULT_PER_IP_PER_MINUTE_STRICT,
+} from "../rate-limit.js";
+
+function buildApp(
+  opts: { perIpPerMinute?: number; windowMs?: number; maxBuckets?: number } = {},
+) {
   const app = Fastify({ trustProxy: true });
   app.register(rateLimitMiddleware, opts);
   app.get("/test", async () => ({ ok: true }));
@@ -159,6 +166,48 @@ describe("per-IP rate limit middleware", () => {
     expect(ipB.statusCode).toBe(200);
   });
 
+  it("derives independent buckets from the ORIGINATING address when two visitors share a proxy hop (#4730)", async () => {
+    // Simulates a consumer site's Next.js server action forwarding the
+    // visitor's real IP as x-forwarded-for, with this API's own edge then
+    // appending the calling web function's shared egress IP as a second
+    // hop — the exact multi-hop shape a consumer double-hop produces
+    // (apps/web/app/[locale]/flows/[slug]/flow.actions.ts). With
+    // trustProxy:true, req.ip resolves to the LEFTMOST (originating)
+    // address, so two visitors sharing the same egress hop still get
+    // independent buckets — this is the failure #4730 reports: before the
+    // fix, ALL visitors behind one web function's egress IP shared ONE
+    // bucket.
+    app = buildApp({ perIpPerMinute: 1 });
+    await app.ready();
+    const SHARED_EGRESS = "9.9.9.9";
+
+    const visitorA = await app.inject({
+      method: "GET",
+      url: "/test",
+      headers: { "x-forwarded-for": `20.0.0.1, ${SHARED_EGRESS}` },
+    });
+    expect(visitorA.statusCode).toBe(200);
+
+    // Visitor A's own second request, still behind the shared egress hop,
+    // correctly trips ITS OWN (now-exhausted) bucket.
+    const visitorAOverLimit = await app.inject({
+      method: "GET",
+      url: "/test",
+      headers: { "x-forwarded-for": `20.0.0.1, ${SHARED_EGRESS}` },
+    });
+    expect(visitorAOverLimit.statusCode).toBe(429);
+
+    // Visitor B, behind the SAME shared egress hop, still has a fresh
+    // budget — the two are bucketed on the leftmost (visitor) address, not
+    // the shared egress IP.
+    const visitorB = await app.inject({
+      method: "GET",
+      url: "/test",
+      headers: { "x-forwarded-for": `20.0.0.2, ${SHARED_EGRESS}` },
+    });
+    expect(visitorB.statusCode).toBe(200);
+  });
+
   it("respects custom perIpPerMinute option over env/default", async () => {
     app = buildApp({ perIpPerMinute: 3 });
     await app.ready();
@@ -183,7 +232,7 @@ describe("per-IP rate limit middleware", () => {
   });
 
   it("reads perIpPerMinute from AILK_RATE_LIMIT_PER_IP_PER_MINUTE env var when option is absent", async () => {
-    // Cover `Number(process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE) || 10` left-side truthy arm
+    // Cover `Number(process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE) || 20` left-side truthy arm
     // Build the app without a perIpPerMinute option so the env var path is taken
     const prev = process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE;
     process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE = "2";
@@ -289,4 +338,42 @@ describe("per-IP rate limit middleware", () => {
     // Cleanup fired — the route still responds normally.
     expect(res.statusCode).toBe(200);
   });
+
+  it("caps total distinct buckets at maxBuckets, evicting the oldest-inserted entry on overflow (#5111/#4780 AC-3)", async () => {
+    // A caller minting a fresh identity every request (e.g. a spoofed
+    // X-Forwarded-For under trustProxy:true) must not grow the in-house
+    // buckets Map without bound — independent of the EXISTING time-based
+    // eviction (which only fires on stale/expired windows). This test
+    // never lets any window expire, so ONLY the new entry-count cap can
+    // be responsible for keeping distinct-bucket growth bounded. A small
+    // maxBuckets is passed explicitly so the test doesn't need thousands
+    // of injected requests to reach the real production default.
+    const maxBuckets = 3;
+    app = buildApp({ perIpPerMinute: 200, maxBuckets });
+    await app.ready();
+
+    for (let i = 0; i < maxBuckets; i++) {
+      const res = await app.inject({
+        method: "GET",
+        url: "/test",
+        headers: { "x-forwarded-for": `172.16.0.${i}` },
+      });
+      expect(res.statusCode).toBe(200);
+      expect(__bucketCount()).toBe(i + 1);
+    }
+
+    // A 4th distinct identity must not push the store past maxBuckets —
+    // the oldest-inserted bucket is evicted to make room.
+    const overflowRes = await app.inject({
+      method: "GET",
+      url: "/test",
+      headers: { "x-forwarded-for": "203.0.113.99" },
+    });
+    expect(overflowRes.statusCode).toBe(200);
+    expect(__bucketCount()).toBe(maxBuckets);
+  });
+
+  it("exposes DEFAULT_PER_IP_PER_MINUTE_STRICT as the pre-#4730 per-scope default (10/min)", () => {
+    expect(DEFAULT_PER_IP_PER_MINUTE_STRICT).toBe(10);
+  });
 });

package/templates/apps/api/src/middleware/auth.ts

@@ -29,6 +29,7 @@
 import { createHash } from "node:crypto";
 
 import { getClock } from "@working-theory/common";
+import type { Id } from "@working-theory/ids";
 import type {
   FastifyPluginCallback,
   FastifyReply,
@@ -50,10 +51,25 @@ const UNAUTHORIZED = { error: "unauthorized" } as const;
 
 declare module "fastify" {
   interface FastifyRequest {
-    userId?: string;
+    userId?: Id<"user">;
+    sessionTenant?: SessionTenant;
   }
 }
 
+/**
+ * Active tenant context carried by a cookie session (multi-tenant module).
+ * Set ONLY on the cookie path — bearer tokens carry no workspace binding yet
+ * (#3591 tracks tenant-scoped agent auth), so bearer-authenticated requests
+ * are denied by the tenant guard (default-deny), never silently granted a
+ * tenant. `sessionRowId` is the Session PK, used by the workspace-switch
+ * service to update the active tenant server-side.
+ */
+export type SessionTenant = {
+  sessionRowId: Id<"session">;
+  activeOrganizationId: Id<"organization"> | null;
+  activeWorkspaceId: Id<"workspace"> | null;
+};
+
 /**
  * Hash an opaque bearer-token string the same way `tokens.ts` does at create
  * time. Centralised here so the lookup contract stays identical.
@@ -114,10 +130,11 @@ function isOriginAllowed(
   if (method === "GET" || method === "HEAD" || method === "OPTIONS")
     return true;
   if (!frontendOrigin) {
-    // No FRONTEND_URL configured → accept any origin. The single-tenant OSS
-    // default trusts the deployment to set FRONTEND_URL; mis-configuration
-    // is a deploy-time concern, not a runtime auth failure.
-    return true;
+    // No FRONTEND_URL configured: fail OPEN in dev/test (zero-config OSS
+    // boot), fail CLOSED in production (security review M1 — with the
+    // multi-tenant module's state-changing routes, an unset origin must not
+    // silently disable the CSRF check in a real deployment).
+    return process.env.NODE_ENV !== "production";
   }
   const origin = request.headers.origin;
   if (!origin) return false;
@@ -125,8 +142,11 @@ function isOriginAllowed(
 }
 
 type SessionRow = {
+  id: string;
   userId: string;
   expiresAt: Date;
+  activeOrganizationId: string | null;
+  activeWorkspaceId: string | null;
 };
 
 async function resolveCookieSession(
@@ -134,7 +154,13 @@ async function resolveCookieSession(
 ): Promise<SessionRow | undefined> {
   const row = await prisma.session.findUnique({
     where: { token: cookieToken },
-    select: { userId: true, expiresAt: true },
+    select: {
+      id: true,
+      userId: true,
+      expiresAt: true,
+      activeOrganizationId: true,
+      activeWorkspaceId: true,
+    },
   });
   if (!row) return undefined;
   return row;
@@ -187,7 +213,15 @@ export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
           reply.code(401).send(UNAUTHORIZED);
           return;
         }
-        request.userId = session.userId;
+        // Brand assertion at the Prisma read edge (ADR-0031 rule 5): the DB
+        // CHECK constraints guarantee these columns hold well-formed
+        // prefixed ids, so the compile-time brand is asserted once here.
+        request.userId = session.userId as Id<"user">;
+        request.sessionTenant = {
+          sessionRowId: session.id as Id<"session">,
+          activeOrganizationId: session.activeOrganizationId as Id<"organization"> | null,
+          activeWorkspaceId: session.activeWorkspaceId as Id<"workspace"> | null,
+        };
         return;
       }
       // Cookie present but invalid / expired → 401 (no silent bearer fallback).
@@ -210,7 +244,7 @@ export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
         reply.code(401).send(UNAUTHORIZED);
         return;
       }
-      request.userId = row.userId;
+      request.userId = row.userId as Id<"user">;
       // Best-effort: bump lastUsedAt. Failure here MUST NOT 401 — the caller
       // is already authenticated. Swallow the error and continue.
       prisma.apiToken
@@ -237,6 +271,7 @@ export const authPreHandlerPlugin: FastifyPluginCallback<
 > = (fastify, opts, done) => {
   const handler = makeAuthPreHandler(opts);
   fastify.decorateRequest("userId", undefined);
+  fastify.decorateRequest("sessionTenant", undefined);
   fastify.addHook("preHandler", handler);
   done();
 };

package/templates/apps/api/src/middleware/rate-limit.ts

@@ -14,10 +14,37 @@
  * IP cardinality). No setInterval is started until the middleware is registered,
  * keeping the module import-side-effect-free.
  *
+ * Entry-count cap (#5111/#4780 AC-3): the eviction above is time-based only —
+ * it removes buckets whose WINDOW has expired, never bounding the TOTAL
+ * distinct-identity count within a still-open window. Once `trustProxy: true`
+ * made `req.ip` a caller-influenced value (see below), a caller minting a
+ * fresh identity on every request (e.g. varying `X-Forwarded-For`) can grow
+ * `buckets` without bound for the lifetime of one isolate. `MAX_BUCKETS`
+ * caps total entries independent of the time-based eviction: once at
+ * capacity, a genuinely new identity evicts the single oldest-inserted entry
+ * (`Map` iteration order is insertion order) before inserting itself — O(1)
+ * amortized, no behavior change for any caller under the cap.
+ *
  * Trust-proxy boundary: this middleware reads req.ip, which Fastify populates
  * from the socket address and any trusted proxy headers (X-Forwarded-For) per
  * the server's own trustProxy config. This middleware does NOT parse
- * X-Forwarded-For itself.
+ * X-Forwarded-For itself. `server.ts` enables `trustProxy: true`, so req.ip
+ * resolves to the leftmost (originating) address of a multi-hop
+ * X-Forwarded-For chain.
+ *
+ * Consumer double-hop caveat (#4730): when a consumer site's own Next.js
+ * server action calls one of the rate-limited scopes below (flows/leads/aeo/
+ * schedule) on a visitor's behalf, `req.ip` would otherwise reflect the
+ * calling web function's shared egress IP, not the visitor's — every visitor
+ * of that consumer site would collapse into one bucket. The fix lives on the
+ * caller's side: `@working-theory/api-client`'s `post()`/`get()` accept an
+ * `init.headers` override, and the flows server action
+ * (`apps/web/app/[locale]/flows/[slug]/flow.actions.ts`) forwards the
+ * visitor's own `x-forwarded-for` (read from ITS OWN incoming request via
+ * Next's `headers()`) as an explicit `x-forwarded-for` header on the outbound
+ * call — appending to, not replacing, whatever hop this API's own edge adds,
+ * so trustProxy's leftmost-address resolution still lands on the real
+ * visitor.
  */
 
 import { getClock } from "@working-theory/common";
@@ -28,12 +55,25 @@ import type {
 } from "fastify";
 
 export type RateLimitOptions = {
-  /** Requests allowed per IP per window. Default: AILK_RATE_LIMIT_PER_IP_PER_MINUTE env var ?? 10 */
+  /**
+   * Requests allowed per IP per window.
+   * Default: AILK_RATE_LIMIT_PER_IP_PER_MINUTE env var ?? 20 (#4730 — sized
+   * to cover a full flow: the longest shipped flow, ailk-founder-diagnostic,
+   * is 13 steps + 1 GET, plus headroom for an invisible aeo_score
+   * submission and one legitimate resubmit; see apps/api/src/routes/flows/
+   * README.md).
+   */
   perIpPerMinute?: number;
   /** Window duration in milliseconds. Default: 60_000 */
   windowMs?: number;
   /** Extract the IP key from a request. Default: req.ip */
   ipFromRequest?: (req: FastifyRequest) => string;
+  /**
+   * Maximum distinct entries `buckets` may hold at once, independent of the
+   * time-based eviction. Default: `MAX_BUCKETS`. Exposed for tests only —
+   * no production caller overrides this.
+   */
+  maxBuckets?: number;
 };
 
 type Bucket = {
@@ -43,6 +83,21 @@ type Bucket = {
 
 const RATE_LIMITED = "rate_limited" as const;
 
+/**
+ * The pre-#4730 per-scope default (10/min) — leads/aeo/schedule's own
+ * `perIpPerMinute` (#5111, DEF-004). `flowsScope` keeps the wider
+ * env-var-driven default below; it is NOT built from this constant.
+ */
+export const DEFAULT_PER_IP_PER_MINUTE_STRICT = 10;
+
+/**
+ * Default cap on `buckets`' total distinct entries (#5111/#4780 AC-3). Sized
+ * generously above any plausible legitimate per-minute visitor cardinality
+ * for this product's anonymous scopes, while still bounding worst-case
+ * memory growth under an unbounded-identity-churn attack.
+ */
+export const MAX_BUCKETS = 10_000;
+
 // Module-scoped bucket store. One entry per unique IP.
 const buckets = new Map<string, Bucket>();
 
@@ -68,6 +123,14 @@ export function __resetBuckets(): void {
   requestsSinceLastClean = 0;
 }
 
+/**
+ * Test-only accessor for the current distinct-bucket count. Not intended for
+ * production use.
+ */
+export function __bucketCount(): number {
+  return buckets.size;
+}
+
 // Break Fastify's plugin encapsulation so the onRequest hook propagates to
 // parent and sibling scopes. This is the manual equivalent of fastify-plugin's
 // `skip-override` mechanism — documented in Fastify's plugin guide.
@@ -79,9 +142,10 @@ export const rateLimitMiddleware: FastifyPluginCallback<RateLimitOptions> = (
 ) => {
   const {
     perIpPerMinute = Number(process.env.AILK_RATE_LIMIT_PER_IP_PER_MINUTE) ||
-      10,
+      20,
     windowMs = 60_000,
     ipFromRequest = (req: FastifyRequest) => req.ip,
+    maxBuckets = MAX_BUCKETS,
   } = opts;
 
   fastify.addHook(
@@ -98,6 +162,17 @@ export const rateLimitMiddleware: FastifyPluginCallback<RateLimitOptions> = (
       let bucket = buckets.get(ip);
 
       if (!bucket || now - bucket.windowStartMs >= windowMs) {
+        // A genuinely new distinct identity (not a window roll on an
+        // existing bucket) at capacity evicts the single oldest-inserted
+        // entry first — independent of the time-based eviction above,
+        // which only removes EXPIRED windows and may leave `buckets` at or
+        // above `maxBuckets` when every entry is still within its window.
+        if (!buckets.has(ip) && buckets.size >= maxBuckets) {
+          const oldestKey = buckets.keys().next().value;
+          if (oldestKey !== undefined) {
+            buckets.delete(oldestKey);
+          }
+        }
         bucket = { count: 0, windowStartMs: now };
         buckets.set(ip, bucket);
       }

package/templates/apps/api/src/middleware/tenant.ts

@@ -0,0 +1,99 @@
+// oss: false
+/**
+ * Tenant guard preHandler (multi-tenant module — FEAT-042).
+ *
+ * Runs AFTER the dual-mode auth preHandler inside the workspace route scope.
+ * Default-deny: resolves the caller's active tenant via
+ * `services/tenant-context.ts#resolveActiveTenant` and rejects everything
+ * that is not an explicit grant:
+ *
+ *   - bearer-authenticated requests (no workspace binding yet — #3591) → 403
+ *   - cookie sessions with no / stale active workspace                 → 403
+ *   - revoked membership                                               → 403
+ *   - URL workspaceId ≠ the session's active workspace                 → 403
+ *     (compared BEFORE any lookup of the target — no tenant enumeration)
+ *
+ * On grant it decorates `request.tenant` (a `TenantContext`); route handlers
+ * pass that to `tenantDb(tenant)` so every domain query is workspace-scoped.
+ * Routes whose target is a session/artifact id (no workspaceId param) rely on
+ * the scope layer's `findFirst({ id, workspaceId })` — a foreign target is a
+ * 404, indistinguishable from a missing one.
+ */
+import type {
+  FastifyPluginCallback,
+  FastifyReply,
+  FastifyRequest,
+} from "fastify";
+
+import {
+  resolveActiveTenant,
+  type TenantContext,
+} from "../services/tenant-context.js";
+
+declare module "fastify" {
+  interface FastifyRequest {
+    tenant?: TenantContext;
+  }
+}
+
+const FORBIDDEN = {
+  ok: false,
+  error: { code: "forbidden", message: "Forbidden" },
+} as const;
+
+/**
+ * Resolve + attach the active tenant, or reply 403. Registered as a hook in
+ * the workspace route scope (after auth), so no tenant-scoped handler runs
+ * without a granted TenantContext.
+ */
+export async function tenantPreHandler(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  const userId = request.userId;
+  if (!userId) {
+    reply.code(401).send({
+      ok: false,
+      error: { code: "unauthorized", message: "Authentication required" },
+    });
+    return;
+  }
+
+  const resolved = await resolveActiveTenant({
+    userId,
+    sessionTenant: request.sessionTenant,
+  });
+  if (!resolved.ok) {
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
+  // URL-scoped routes: the target workspace MUST be the session's active
+  // workspace. Compared before any target lookup — a foreign (or nonexistent)
+  // workspaceId gets the same 403.
+  const params = request.params as { workspaceId?: string } | undefined;
+  if (params?.workspaceId && params.workspaceId !== resolved.value.workspaceId) {
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
+  request.tenant = resolved.value;
+}
+
+/**
+ * Plugin form, mirroring `authPreHandlerPlugin`: skip-override so the hook
+ * propagates to sibling route plugins registered in the same scope.
+ */
+export const tenantPreHandlerPlugin: FastifyPluginCallback = (
+  fastify,
+  _opts,
+  done,
+) => {
+  fastify.decorateRequest("tenant", undefined);
+  fastify.addHook("preHandler", tenantPreHandler);
+  done();
+};
+
+(tenantPreHandlerPlugin as FastifyPluginCallback & { [key: symbol]: boolean })[
+  Symbol.for("skip-override")
+] = true;

package/templates/apps/api/src/openapi/__tests__/openapi.test.ts

@@ -126,4 +126,96 @@ describe("GET /api/openapi.json", () => {
       spec.paths["/v1/content/{type}"].get.responses["400"],
     ).toMatchObject({ $ref: "#/components/responses/BadRequest" });
   });
+
+  describe("lead-write routes (#4991)", () => {
+    const leadPaths: Array<{
+      path: string;
+      operationId: string;
+      requiredFields: string[];
+    }> = [
+      {
+        path: "/v1/leads/submit",
+        operationId: "submitLead",
+        requiredFields: ["siteId", "source", "email", "payload"],
+      },
+      {
+        path: "/v1/leads/subscribe",
+        operationId: "subscribeLead",
+        requiredFields: ["siteId", "email", "source"],
+      },
+      {
+        path: "/v1/leads/callback",
+        operationId: "requestCallback",
+        requiredFields: ["siteId", "name", "phone", "payload"],
+      },
+    ];
+
+    it.each(leadPaths)(
+      "documents $path as a POST with a matching operationId",
+      async ({ path, operationId }) => {
+        const res = await app.inject({
+          method: "GET",
+          url: "/v1/openapi.json",
+        });
+
+        const spec = JSON.parse(res.body);
+        expect(spec.paths[path].post.operationId).toBe(operationId);
+      },
+    );
+
+    it.each(leadPaths)(
+      "documents $path's requestBody with the Zod schema's required keys",
+      async ({ path, requiredFields }) => {
+        const res = await app.inject({
+          method: "GET",
+          url: "/v1/openapi.json",
+        });
+
+        const spec = JSON.parse(res.body);
+        const requestBodySchema =
+          spec.paths[path].post.requestBody.content["application/json"]
+            .schema;
+        const resolved =
+          "$ref" in requestBodySchema
+            ? resolveRef(spec, requestBodySchema.$ref)
+            : requestBodySchema;
+
+        expect(resolved.required.slice().sort()).toEqual(
+          requiredFields.slice().sort(),
+        );
+      },
+    );
+
+    it.each(leadPaths)(
+      "documents 201, 400, and 503 responses for $path",
+      async ({ path }) => {
+        const res = await app.inject({
+          method: "GET",
+          url: "/v1/openapi.json",
+        });
+
+        const spec = JSON.parse(res.body);
+        const responses = spec.paths[path].post.responses;
+        expect(responses["201"]).toBeDefined();
+        expect(responses["400"]).toBeDefined();
+        expect(responses["503"]).toBeDefined();
+      },
+    );
+
+    it("no longer describes the API as read-only", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/openapi.json",
+      });
+
+      const spec = JSON.parse(res.body);
+      expect(spec.info.description).not.toMatch(/Read-only/i);
+    });
+  });
 });
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- test helper over a raw JSON document
+function resolveRef(spec: any, ref: string): any {
+  const path = ref.replace(/^#\//, "").split("/");
+  return path.reduce((node, key) => node[key], spec);
+}