create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts

@@ -0,0 +1,869 @@
+/**
+ * @file drafts.test.ts
+ *
+ * THE ACCEPTANCE GATE for the draft lifecycle (#5036 D1/D7) — the three
+ * anonymous routes that replaced the single `POST /v1/project-listings`
+ * create: `start`, `patch` and `submit`.
+ *
+ * Real routes and real services, mocked `lib/prisma.js` backed by a small
+ * in-memory row store, so a patch genuinely WRITES and a later read genuinely
+ * READS BACK. A `jest.fn()` returning a canned object could not tell a
+ * round-trip from a no-op, and the round-trip is the thing under test.
+ * `routeLead` runs for real against a per-test temp path
+ * (`setupLeadFileEnv`), matching the create test's discipline before it;
+ * `@working-theory/email` and `@working-theory/license` stay mocked (external
+ * package boundaries — see docs/lessons/project-listings/02).
+ *
+ * `slack-notify` is NOT mocked, deliberately: `AILK_SLACK_BOT_TOKEN` is unset
+ * here, so `postListingApplication` takes its own documented no-op branch
+ * (`slack-skipped`) and never reaches `fetch`. Stubbing the module would be
+ * mocking internal code to avoid a boundary that is already closed.
+ *
+ * Four of these fail QUIETLY if they regress, which is why each is here:
+ *   - a draft created from name and email alone must PERSIST, and a
+ *     single-field patch must round-trip — otherwise the lifecycle silently
+ *     stores nothing and the founder loses ten steps of work;
+ *   - an incomplete draft at submit must be refused with the missing fields
+ *     NAMED, not silently accepted into `requested`;
+ *   - a resume token must grant ONE listing and nothing else, since it is the
+ *     only credential on an anonymous surface;
+ *   - drafts must COUNT toward the two-listing limit, or the limit is evaded
+ *     by never submitting.
+ */
+import { createHash } from "node:crypto";
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import {
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+} from "@working-theory/validation";
+
+import { prisma } from "../../../lib/prisma.js";
+import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  MAX_CONSENT_KEYS, UNRECOVERABLE_CONSENT_STATEMENT } from "../../../services/consent.js";
+import { patchProjectListingDraftRoute } from "../patch-draft.js";
+import { startProjectListingRoute } from "../start.js";
+import { submitProjectListingRoute } from "../submit.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const opt = (value: string, label: string) => ({ value, label });
+
+const VALID_QUESTIONS = {
+  q2: {
+    prompt: "Why are you here?",
+    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
+  },
+  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: {
+    prompt: "Urgency?",
+    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
+  },
+  q6: {
+    prompt: "Pain?",
+    options: [
+      opt("low", "Low"),
+      opt("medium", "Medium"),
+      opt("high", "High"),
+      opt("critical", "Critical"),
+    ],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+/**
+ * The site is named by its PUBLIC KEY now (#5048 D2) — `siteId` never travels
+ * in a request body. `installStore` maps this key to `SITE_ID` the way a
+ * `SiteListingConfig.publicKey` row does.
+ */
+const SITE_ID = "site-1";
+const SITE_KEY = "site-1-public-key";
+
+const START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderName: "Ada Founder",
+  founderEmail: "ada@example.com",
+  consent: true,
+};
+
+/** Everything the ten steps after step one collect. */
+const COMPLETE_APPLICATION = {
+  name: "My Project",
+  headline: "Ten words or fewer for the tile title here",
+  oneLiner: "A short sentence describing what the project does for its people.",
+  problem: "The problem is real and this describes it.",
+  product: "wireframes",
+  commitment: "part-time",
+  teamComposition: "co-founders",
+  faqs: [
+    { question: "Q one?", answer: "A one." },
+    { question: "Q two?", answer: "A two." },
+    { question: "Q three?", answer: "A three." },
+  ],
+  address: "1 Founder Way, Springfield",
+  questions: VALID_QUESTIONS,
+};
+
+// ─── The in-memory row store the Prisma mock is backed by ───────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (key === "OR") {
+      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
+    }
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+      if ("startsWith" in clause) {
+        return typeof row[key] === "string" && (row[key] as string).startsWith(clause["startsWith"] as string);
+      }
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+
+  (prisma.lead.create as jest.Mock).mockImplementation(() =>
+    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
+  );
+  // One delegate, two lookups (#5048 D2): `where.publicKey` is the site-key
+  // resolution (`siteIdForPublicKey`), `where.siteId` the config read
+  // (`listingConfigFor`). No config row for the latter, so the platform
+  // defaults apply — the behaviour every test below was written against.
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
+      }
+      return Promise.resolve(null);
+    },
+  );
+
+  // #5275 — `start` writes the row and its grant in one interactive
+  // transaction; the mock hands the same store-backed client through.
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+  (prisma.projectListing.create as jest.Mock).mockImplementation(
+    ({ data }: { data: Row }) => {
+      const now = new Date();
+      const row: Row = {
+        id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+        slug: null,
+        name: null,
+        oneLiner: null,
+        problem: null,
+        url: null,
+        product: null,
+        commitment: null,
+        teamComposition: null,
+        faqs: null,
+        anythingElse: null,
+        address: null,
+        questions: null,
+        founderCompany: null,
+        leadId: null,
+        headline: null,
+        logoMarkUrl: null,
+        logoWordmarkUrl: null,
+        featured: false,
+        decidedAt: null,
+        decidedBy: null,
+        issueUrl: null,
+        experimentKey: null,
+        windowEndsAt: null,
+        createdAt: now,
+        updatedAt: now,
+        ...data,
+      };
+      rows.push(row);
+      return Promise.resolve(row);
+    },
+  );
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where))),
+  );
+
+  (prisma.projectListing.update as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const row = rows.find((r) => matches(r, where));
+      Object.assign(row!, data, { updatedAt: new Date() });
+      return Promise.resolve(row);
+    },
+  );
+
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const matched = rows.filter((r) => matches(r, where));
+      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
+      return Promise.resolve({ count: matched.length });
+    },
+  );
+
+  // #5275 — the grant write `start` now makes. Append-only, so the mock only
+  // needs to resolve; the start tests below assert on what it was called with.
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+const sha256 = (value: string) => createHash("sha256").update(value).digest("hex");
+
+const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.register(patchProjectListingDraftRoute);
+  await app.register(submitProjectListingRoute);
+  await app.ready();
+  return app;
+}
+
+async function startDraft(
+  app: FastifyInstance,
+  overrides: Record<string, unknown> = {},
+): Promise<{ id: string; resumeToken: string }> {
+  const res = await app.inject({
+    method: "POST",
+    url: "/v1/project-listings",
+    payload: { ...START_PAYLOAD, ...overrides },
+  });
+  expect(res.statusCode).toBe(201);
+  return (res.json() as { ok: true; data: { id: string; resumeToken: string } }).data;
+}
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe("the draft lifecycle (#5036 D1)", () => {
+  setupLeadFileEnv("project-listing-drafts");
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── start ──
+
+  it("start: a draft created from name and email alone PERSISTS", async () => {
+    const { id, resumeToken } = await startDraft(app);
+
+    expect(id).toMatch(/^prjl_/);
+    expect(resumeToken.length).toBeGreaterThan(0);
+
+    // The row exists, at `draft`, carrying nothing but the identity — every
+    // application field still null. This is the "nullable at rest" invariant
+    // seen from the outside: without it the create itself would have failed.
+    const row = rows[0]!;
+    expect(row["status"]).toBe("draft");
+    expect(row["founderEmail"]).toBe("ada@example.com");
+    expect(row["name"]).toBeNull();
+    expect(row["oneLiner"]).toBeNull();
+    expect(row["product"]).toBeNull();
+    expect(row["questions"]).toBeNull();
+    expect(row["slug"]).toBeNull();
+
+    // NO Lead at step one. The contact is already captured on this row, and
+    // `routeLead` mails the operator — which on an anonymous route would let a
+    // stranger fill the operator's inbox by opening drafts they never finish
+    // (PR #5042 security review, finding 4). The Lead waits for `submit`.
+    expect(prisma.lead.create).not.toHaveBeenCalled();
+    expect(row["leadId"]).toBeNull();
+  });
+
+  it("start: lowercases the founder's email, so the limit cannot be evaded by case", async () => {
+    // Postgres text equality is case-sensitive, so without this the
+    // concurrent-listing limit is evaded by holding down shift. (Surrounding
+    // whitespace needs no test: `z.string().email()` refuses it outright.)
+    await startDraft(app, { founderEmail: "Ada@Example.COM" });
+    expect(rows[0]!["founderEmail"]).toBe("ada@example.com");
+  });
+
+  it("start: stores a DIGEST of the resume token, never the token", async () => {
+    const { resumeToken } = await startDraft(app);
+    const stored = rows[0]!["resumeTokenHash"];
+
+    expect(stored).not.toBe(resumeToken);
+    expect(stored).toBe(sha256(resumeToken));
+    // 256 bits of CSPRNG output, base64url-encoded.
+    expect(Buffer.from(resumeToken, "base64url")).toHaveLength(32);
+  });
+
+  it("start: two drafts get different tokens", async () => {
+    const first = await startDraft(app);
+    const second = await startDraft(app, { founderEmail: "grace@example.com" });
+    expect(first.resumeToken).not.toBe(second.resumeToken);
+  });
+
+  it("start: refuses a payload that declines consent", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, consent: false },
+    });
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { ok: boolean }).ok).toBe(false);
+    expect(rows).toHaveLength(0);
+  });
+
+  // ── start: the consent grant (#5275 D7/D11) ──
+
+  it.each([
+    ["DECLINES the required purpose", { service_terms: false }],
+    ["is EMPTY beside the literal", {}],
+    ["OMITS the required purpose", { marketing: true }],
+  ])(
+    "start: a consents map that %s is a 400 and creates no row and no grant",
+    async (_label, consents) => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, consents, locale: "en" },
+      });
+      expect(res.statusCode).toBe(400);
+      const body = res.json() as { ok: boolean; error: { code: string; message: string } };
+      expect(body.ok).toBe(false);
+      expect(body.error.code).toBe("invalid_input");
+      expect(body.error.message).toMatch(/service_terms/);
+      expect(rows).toHaveLength(0);
+      expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
+    },
+  );
+
+  it("start: a consents map with more than MAX_CONSENT_KEYS purposes is a 400", async () => {
+    const consents: Record<string, boolean> = { service_terms: true };
+    for (let i = 0; i < MAX_CONSENT_KEYS; i += 1) consents[`junk_${i}`] = true;
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, consents, locale: "en" },
+    });
+    expect(res.statusCode).toBe(400);
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: a grant write that fails takes the row with it — one transaction, no stranded listing", async () => {
+    (prisma.$transaction as jest.Mock).mockImplementation(
+      async (fn: (tx: typeof prisma) => Promise<unknown>) => {
+        const before = rows.length;
+        try {
+          return await fn(prisma);
+        } catch (err) {
+          rows.splice(before); // roll back the in-memory store
+          throw err;
+        }
+      },
+    );
+    (prisma.consentGrant.createMany as jest.Mock).mockRejectedValueOnce(new Error("db down"));
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, consents: { service_terms: true }, locale: "en" },
+    });
+    expect(res.statusCode).toBe(500);
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: a body carrying consents records one grant per purpose with the DEFAULT statement text", async () => {
+    const { id } = await startDraft(app, { consents: { service_terms: true }, locale: "en" });
+
+    // The expected wording is DERIVED from the registry the server resolves
+    // from, never retyped — the whole point is that the row carries the string
+    // the renderer showed, not a string this test happens to agree with.
+    const purpose = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!;
+    const { statement } = resolveConsentStatement(purpose, "en");
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
+      data: Row[];
+    };
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({
+      siteId: SITE_ID,
+      subjectType: "project_listing",
+      subjectId: id,
+      purposeId: "service_terms",
+      granted: true,
+      locale: "en",
+      statement,
+      statementHash: sha256(statement),
+    });
+    expect(data[0]!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
+    // The row's own consentAt is untouched by the grant write (spec §2.3).
+    expect(rows[0]!["consentAt"]).toBeInstanceOf(Date);
+  });
+
+  it("start: a body carrying only the legacy literal records ONE grant marked unrecoverable", async () => {
+    const { id } = await startDraft(app);
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
+      data: Row[];
+    };
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({
+      siteId: SITE_ID,
+      subjectType: "project_listing",
+      subjectId: id,
+      purposeId: "service_terms",
+      granted: true,
+      locale: "und",
+      statement: UNRECOVERABLE_CONSENT_STATEMENT,
+      statementHash: sha256(UNRECOVERABLE_CONSENT_STATEMENT),
+    });
+    // Never today's wording for a legacy call — that would fabricate evidence (D11).
+    expect(data[0]!["statement"]).not.toContain("You agree to being contacted");
+  });
+
+  // ── patch ──
+
+  it("patch: a SINGLE-field patch round-trips", async () => {
+    const { id, resumeToken } = await startDraft(app);
+
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { oneLiner: "Just the one field, saved on its own." },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { ok: boolean; data: Record<string, unknown> };
+    expect(body.ok).toBe(true);
+    expect(body.data["oneLiner"]).toBe("Just the one field, saved on its own.");
+    // Still a draft, still incomplete — `patch` asserts no completeness.
+    expect(body.data["status"]).toBe("draft");
+    expect(body.data["name"]).toBeNull();
+  });
+
+  it("patch: a later patch MERGES rather than replacing", async () => {
+    const { id, resumeToken } = await startDraft(app);
+
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { name: "Step three" },
+    });
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { address: "1 Founder Way" },
+    });
+
+    const body = res.json() as { data: Record<string, unknown> };
+    // The earlier step survives the later one — the failure this guards is a
+    // patch that blanks the nine fields the founder already filled in.
+    expect(body.data["name"]).toBe("Step three");
+    expect(body.data["address"]).toBe("1 Founder Way");
+  });
+
+  it("patch: refuses an empty body", async () => {
+    const { id, resumeToken } = await startDraft(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: {},
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("patch: 401s with no resume token at all", async () => {
+    const { id } = await startDraft(app);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      payload: { name: "No credential" },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  // ── the token's binding ──
+
+  it("a resume token grants ONE listing and no other", async () => {
+    const first = await startDraft(app);
+    const second = await startDraft(app, { founderEmail: "grace@example.com" });
+
+    // The first founder's token, presented against the second's listing.
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${second.id}`,
+      headers: bearer(first.resumeToken),
+      payload: { name: "Not mine to write" },
+    });
+
+    expect(res.statusCode).toBe(404);
+    // And nothing was written to the row it was aimed at.
+    const target = rows.find((r) => r["id"] === second.id)!;
+    expect(target["name"]).toBeNull();
+  });
+
+  it("a wrong token is a 404, indistinguishable from an unknown draft", async () => {
+    const { id } = await startDraft(app);
+
+    const wrongToken = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer("not-the-token"),
+      payload: { name: "x" },
+    });
+    const unknownDraft = await app.inject({
+      method: "PATCH",
+      url: "/v1/project-listings/drafts/prjl_00000000-0000-7000-8000-0000000000ff",
+      headers: bearer("not-the-token"),
+      payload: { name: "x" },
+    });
+
+    expect(wrongToken.statusCode).toBe(404);
+    expect(unknownDraft.statusCode).toBe(404);
+    expect(wrongToken.json()).toEqual(unknownDraft.json());
+  });
+
+  // ── submit ──
+
+  it("submit: an INCOMPLETE draft is refused with the missing fields NAMED", async () => {
+    const { id, resumeToken } = await startDraft(app);
+    // Two of the eleven required fields filled in; nine still missing.
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { name: "My Project", address: "1 Founder Way" },
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+
+    expect(res.statusCode).toBe(422);
+    const body = res.json() as { error: { code: string; missingFields: string[] } };
+    expect(body.error.code).toBe("incomplete_application");
+    // NAMED, so the form can send the founder to the step that owns each one.
+    expect(body.error.missingFields).toEqual(
+      expect.arrayContaining([
+        "commitment",
+        "faqs",
+        "headline",
+        "oneLiner",
+        "problem",
+        "product",
+        "questions",
+        "teamComposition",
+      ]),
+    );
+    // The two fields that WERE filled in are not reported missing.
+    expect(body.error.missingFields).not.toContain("name");
+    expect(body.error.missingFields).not.toContain("address");
+    // And the row did not move.
+    expect(rows.find((r) => r["id"] === id)!["status"]).toBe("draft");
+  });
+
+  it("submit: a COMPLETE draft transitions to `requested` and returns the derived slug", async () => {
+    const { id, resumeToken } = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: { id, slug: "my-project" } });
+
+    const row = rows.find((r) => r["id"] === id)!;
+    expect(row["status"]).toBe("requested");
+    // The Lead is written HERE, once, for a completed application.
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    const lead = (prisma.lead.create as jest.Mock).mock.calls[0][0];
+    expect(lead.data.source).toBe("projects-apply");
+    expect(lead.data.email).toBe("ada@example.com");
+    expect(row["leadId"]).not.toBeNull();
+    expect(row["slug"]).toBe("my-project");
+    // The token is spent: a leak after submission grants nothing.
+    expect(row["resumeTokenHash"]).toBeNull();
+  });
+
+  it("submit: a spent token cannot patch or re-submit the listing", async () => {
+    const { id, resumeToken } = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+
+    const patchAgain = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { name: "Renamed after the fact" },
+    });
+    const submitAgain = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+
+    expect(patchAgain.statusCode).toBe(404);
+    expect(submitAgain.statusCode).toBe(404);
+    expect(rows.find((r) => r["id"] === id)!["name"]).toBe("My Project");
+  });
+
+  it("submit: 401s with no resume token at all", async () => {
+    const { id } = await startDraft(app);
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  // ── the concurrent-listing limit (#5036 D7) ──
+
+  it("a third concurrent listing is refused at submit — and one of the two is a DRAFT", async () => {
+    // One already ACTIVE listing for this founder…
+    const active = await startDraft(app);
+    Object.assign(rows.find((r) => r["id"] === active.id)!, {
+      status: "active",
+      slug: "already-live",
+      windowEndsAt: new Date(Date.now() + 86_400_000),
+    });
+
+    // …and one still a DRAFT. If drafts did not count, the limit would be
+    // evaded by simply never submitting — which is the state a ten-step form
+    // leaves a founder in by default.
+    await startDraft(app);
+
+    // The third.
+    const third = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${third.id}`,
+      headers: bearer(third.resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${third.id}/submit`,
+      headers: bearer(third.resumeToken),
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("listing_limit_reached");
+    expect(rows.find((r) => r["id"] === third.id)!["status"]).toBe("draft");
+  });
+
+  it("a long-abandoned draft stops holding a slot", async () => {
+    // Drafts count — that is D7, and it is what stops the limit being evaded by
+    // never submitting. But `founderEmail` is unverified here, so a draft that
+    // counted FOREVER would let two anonymous requests lock a named founder out
+    // permanently, with no operator remedy (PR #5042 security review, finding
+    // 1). The window is what makes that lockout expire.
+    for (let i = 0; i < 2; i += 1) {
+      const stale = await startDraft(app);
+      Object.assign(rows.find((r) => r["id"] === stale.id)!, {
+        createdAt: new Date(Date.now() - 15 * 24 * 60 * 60 * 1000),
+      });
+    }
+
+    const third = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${third.id}`,
+      headers: bearer(third.resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${third.id}/submit`,
+      headers: bearer(third.resumeToken),
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("a FRESH draft still holds a slot", async () => {
+    // The other half of the window: two drafts created today do bind, so the
+    // limit is not evaded by simply not pressing submit.
+    await startDraft(app);
+    await startDraft(app);
+
+    const third = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${third.id}`,
+      headers: bearer(third.resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${third.id}/submit`,
+      headers: bearer(third.resumeToken),
+    });
+
+    expect(res.statusCode).toBe(409);
+  });
+
+  it("a TERMINAL listing does not count toward the limit", async () => {
+    // Two listings, but both terminal: one rejected, one whose window elapsed
+    // (which reads `closed`, computed, with no job having run).
+    const rejected = await startDraft(app);
+    Object.assign(rows.find((r) => r["id"] === rejected.id)!, {
+      status: "rejected",
+      slug: "turned-down",
+    });
+    const expired = await startDraft(app);
+    Object.assign(rows.find((r) => r["id"] === expired.id)!, {
+      status: "active",
+      slug: "ran-its-course",
+      windowEndsAt: new Date(Date.now() - 86_400_000),
+    });
+
+    const third = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${third.id}`,
+      headers: bearer(third.resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${third.id}/submit`,
+      headers: bearer(third.resumeToken),
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("the limit is scoped to one founder — another founder's listings do not count", async () => {
+    for (const email of ["grace@example.com", "alan@example.com"]) {
+      const other = await startDraft(app, { founderEmail: email });
+      Object.assign(rows.find((r) => r["id"] === other.id)!, {
+        status: "active",
+        slug: `live-${email.split("@")[0]}`,
+        windowEndsAt: new Date(Date.now() + 86_400_000),
+      });
+    }
+
+    const mine = await startDraft(app);
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${mine.id}`,
+      headers: bearer(mine.resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const res = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${mine.id}/submit`,
+      headers: bearer(mine.resumeToken),
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
+  // ── logging ──
+
+  it("no founder PII and no resume token reaches the route's own log line", async () => {
+    // Scoped to the log statements THIS route makes. Fastify's built-in
+    // request/response logging serializes the raw request (body included) and
+    // `inject`'s own harness stashes the response payload on it — neither is
+    // this route's doing, and neither is what the PII boundary is about. What
+    // is this route's doing is the one `request.log.info` call below.
+    const calls: Record<string, unknown>[] = [];
+    const logging = Fastify({
+      logger: {
+        level: "info",
+        hooks: {
+          logMethod(args: unknown[], method: (...a: never[]) => void) {
+            if (typeof args[1] === "string" && args[1] === "project listing draft started") {
+              calls.push(args[0] as Record<string, unknown>);
+            }
+            method.apply(this, args as never[]);
+          },
+        },
+      },
+      disableRequestLogging: true,
+    });
+    await logging.register(startProjectListingRoute);
+    await logging.ready();
+
+    const res = await logging.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+    const { resumeToken } = (res.json() as { data: { resumeToken: string } }).data;
+
+    expect(calls).toHaveLength(1);
+    const serialized = JSON.stringify(calls[0]);
+    expect(serialized).not.toContain("ada@example.com");
+    expect(serialized).not.toContain("Ada Founder");
+    expect(serialized).not.toContain(resumeToken);
+    // Routing metadata only.
+    expect(Object.keys(calls[0]!).sort()).toEqual(["ip", "listingId", "siteId"]);
+
+    await logging.close();
+  });
+});