create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/me-route-precedence.test.ts

@@ -0,0 +1,221 @@
+// oss: false
+/**
+ * @file me-route-precedence.test.ts
+ *
+ * The regression net for the one structural risk in #5295: the static
+ * `/v1/project-listings/me` and the parametric `/v1/project-listings/:id` share
+ * a prefix and are registered in DIFFERENT scopes — `/me` in `server.ts`'s
+ * `authScope`, `/:id` inside the encapsulated `tenantScope` behind
+ * `tenantPreHandlerPlugin`.
+ *
+ * `me.test.ts` registers `/me` alone, so nothing there would catch a
+ * registration reorder that shadowed `/me` or weakened the tenant guard on
+ * `/:id`. The security review for this change verified the behaviour by hand and
+ * named the missing net; this file is that net.
+ *
+ * It asserts three things in ONE Fastify instance with the REAL preHandlers:
+ *   1. `/v1/project-listings/me` reaches the `/me` handler — static beats
+ *      parametric — and runs auth ONLY, no tenant guard.
+ *   2. `/v1/project-listings/<id>` still reaches the tenant handler WITH the
+ *      tenant guard: registering a static sibling in the outer scope does not
+ *      weaken it. A member below the `owner|admin` floor is still refused.
+ *   3. Registering both raises no duplicate-route error.
+ *
+ * This file is `oss: false` because it imports the multi-tenant slice
+ * (`middleware/tenant.js`, `./get.js`), the same reason `tenant-isolation.test.ts`
+ * is.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    user: { findUnique: jest.fn() },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    projectListing: { findMany: jest.fn(), findFirst: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { projectListingMeRoute, projectListingTenantRoutes } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const ORG = "org_00000000-0000-7000-8000-000000000001";
+const WS = "wksp_00000000-0000-7000-8000-000000000001";
+const LISTING_ID = "prjl_00000000-0000-7000-8000-0000000000d1";
+
+/** `owner` clears the floor; `member` does not. Both are real members of ORG. */
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_owner: {
+    id: "sess_owner",
+    userId: "owner-user",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG,
+    activeWorkspaceId: WS,
+  },
+  cookie_member: {
+    id: "sess_member",
+    userId: "member-user",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG,
+    activeWorkspaceId: WS,
+  },
+};
+
+const MEMBERSHIPS: Record<string, string> = {
+  "owner-user": "owner",
+  "member-user": "member",
+};
+
+async function buildApp(): Promise<FastifyInstance> {
+  // The exact nesting server.ts uses: /me in the OUTER auth scope, the tenant
+  // routes in an INNER scope behind the tenant preHandler.
+  const app = Fastify();
+  await app.register(async (authScope) => {
+    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(projectListingMeRoute);
+    await authScope.register(async (tenantScope) => {
+      await tenantScope.register(tenantPreHandlerPlugin);
+      await tenantScope.register(projectListingTenantRoutes);
+    });
+  });
+  await app.ready();
+  return app;
+}
+
+const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
+
+let app: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
+    Promise.resolve({ id: where.id, email: `${where.id}@example.com`, emailVerified: true }),
+  );
+  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({ id: WS, organizationId: ORG });
+  // The composite key is `organizationId_userId` — the order `tenant-context.ts`
+  // actually queries with.
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { organizationId_userId?: { userId: string } } }) => {
+      const userId = where.organizationId_userId?.userId;
+      const role = userId ? MEMBERSHIPS[userId] : undefined;
+      return Promise.resolve(role ? { role } : null);
+    },
+  );
+  // The /me read returns nothing; this file is about routing, not payloads.
+  (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([]);
+  (prisma.projectListing.findFirst as jest.Mock).mockResolvedValue(null);
+  app = await buildApp();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("route precedence: static /me beside parametric /:id in one instance", () => {
+  it("registering both raises no duplicate-route error", async () => {
+    // buildApp() already awaited app.ready(); reaching here is the assertion.
+    const tree = app.printRoutes();
+    expect(tree).toContain("me");
+    expect(tree).toContain(":id");
+  });
+
+  it("/v1/project-listings/me reaches the /me handler, not the parametric one", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/me",
+      headers: cookie("cookie_owner"),
+    });
+
+    // The /me handler answers its own 200 + empty list. The parametric handler
+    // would have answered 400 `validation_failed` — "me" is not a listing id.
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+    // And it read through the owner link, not by id.
+    expect(prisma.projectListing.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { ownerUserId: "owner-user" } }),
+    );
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("/me runs auth ONLY — a caller BELOW the owner|admin floor still gets their own rows", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/me",
+      headers: cookie("cookie_member"),
+    });
+
+    // A `member` is refused by the tenant routes and allowed here: /me is not
+    // behind the floor, and it does not need to be — the owner link is the gate.
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+  });
+
+  it("the parametric /:id still runs the tenant guard — the static sibling does not weaken it", async () => {
+    const ownerRes = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_ID}`,
+      headers: cookie("cookie_owner"),
+    });
+    // Owner clears the floor and reaches the service, which finds no row.
+    expect(ownerRes.statusCode).toBe(404);
+
+    const memberRes = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_ID}`,
+      headers: cookie("cookie_member"),
+    });
+    // Member is still refused BEFORE any read — the floor is intact.
+    expect(memberRes.statusCode).toBe(403);
+  });
+
+  it("the tenant LIST route is unaffected and still refuses a member", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: cookie("cookie_member"),
+    });
+
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("an unauthenticated caller is refused on both paths", async () => {
+    const meRes = await app.inject({ method: "GET", url: "/v1/project-listings/me" });
+    const idRes = await app.inject({ method: "GET", url: `/v1/project-listings/${LISTING_ID}` });
+
+    expect(meRes.statusCode).toBe(401);
+    expect(idRes.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -0,0 +1,468 @@
+/**
+ * @file me.test.ts
+ *
+ * THE ACCEPTANCE GATE for the founder's own listings read (#5295).
+ * Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
+ * projectListingMeRoute` (auth only, NO tenant guard), mocked `lib/prisma.js`.
+ *
+ * Proves the security properties the owner link exists for:
+ *   - two users sharing a `founderEmail` value never see each other's rows;
+ *   - a row whose owner link was never set is invisible to the person whose
+ *     address it carries — the read never falls back to an email comparison;
+ *   - the `where` clause carries `ownerUserId` and nothing resembling an email
+ *     (a clause carrying one is treated as a contract violation and returns
+ *     nothing, the `flow-checkouts` test's own discipline);
+ *   - a signed-in caller who owns nothing gets `200 []`, never a 403;
+ *   - `PROJECT_LISTING_ROLES` is untouched and this route never consults it.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { projectListingMeResponseSchema } from "@working-theory/validation";
+
+// `services/project-listings.ts` imports `routeLead` from `lead-routing.js` at
+// module scope, which transitively imports `@working-theory/email` and
+// `@working-theory/license` — mocked here purely so that import chain resolves,
+// mirroring `tenant-isolation.test.ts`'s discipline.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    user: { findUnique: jest.fn() },
+    projectListing: { findMany: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { PROJECT_LISTING_ROLES } from "../../../services/project-listings.js";
+import { projectListingMeRoute } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const SITE_A = "wksp_00000000-0000-7000-8000-000000000001";
+const SITE_B = "wksp_00000000-0000-7000-8000-000000000002";
+
+/**
+ * `ada` and `bruno` are TWO DIFFERENT PEOPLE who typed the SAME address into
+ * the anonymous application form. That is the whole point: `founderEmail` is
+ * not an identity, and nothing may derive ownership from it.
+ */
+const SHARED_EMAIL = "founder@example.com";
+
+const USERS: Record<string, { id: string; email: string; emailVerified: boolean }> = {
+  ada: { id: "ada", email: SHARED_EMAIL, emailVerified: true },
+  bruno: { id: "bruno", email: SHARED_EMAIL, emailVerified: true },
+  // Signed in, verified, owns nothing at all.
+  cleo: { id: "cleo", email: "cleo@example.com", emailVerified: true },
+  // Signed in with an address that was never verified, and whose own listing
+  // WAS linked earlier. See the test that covers this case.
+  dane: { id: "dane", email: "dane@example.com", emailVerified: false },
+};
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_ada: { id: "sess_ada", userId: "ada", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_bruno: { id: "sess_bruno", userId: "bruno", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_cleo: { id: "sess_cleo", userId: "cleo", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_dane: { id: "sess_dane", userId: "dane", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+};
+
+type ListingFixture = {
+  id: string;
+  siteId: string;
+  founderEmail: string;
+  ownerUserId: string | null;
+  experimentKey: string | null;
+  createdAt: Date;
+};
+
+/** A complete stored row at `PROJECT_LISTING_SELECT`'s shape. */
+function row(fixture: ListingFixture) {
+  return {
+    id: fixture.id,
+    siteId: fixture.siteId,
+    leadId: `lead_${fixture.id}`,
+    slug: fixture.id.replace("prjl_", ""),
+    name: "Atlas",
+    oneLiner: "A one-liner.",
+    problem: "A problem.",
+    url: "https://atlas.example.com",
+    product: "live-some-users",
+    commitment: "full-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Main St",
+    addressLine1: null,
+    addressLine2: null,
+    addressCity: null,
+    addressRegion: null,
+    addressPostalCode: null,
+    addressCountry: null,
+    questions: null,
+    siteAnswers: null,
+    windowDays: 30,
+    founderName: "A Founder",
+    founderEmail: fixture.founderEmail,
+    founderCompany: null,
+    headline: "Atlas",
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "requested",
+    consentAt: fixture.createdAt,
+    decidedAt: null,
+    decidedBy: "operator@example.com",
+    issueUrl: "https://github.com/example/repo/issues/1",
+    experimentKey: fixture.experimentKey,
+    windowEndsAt: null,
+    createdAt: fixture.createdAt,
+    updatedAt: fixture.createdAt,
+  };
+}
+
+const LISTINGS: ListingFixture[] = [
+  // ada's own, linked to ada.
+  {
+    id: "prjl_ada_one",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "ada",
+    experimentKey: "atlas-waitlist",
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+  },
+  // ada again, NEWER, and in a SECOND workspace of ada's — proves the per-site
+  // waitlistCount resolution and the newest-first ordering.
+  {
+    id: "prjl_ada_two",
+    siteId: SITE_B,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "ada",
+    experimentKey: "atlas-two-waitlist",
+    createdAt: new Date("2026-09-05T00:00:00.000Z"),
+  },
+  // bruno's own — SAME founderEmail as ada's rows, different person.
+  {
+    id: "prjl_bruno_one",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "bruno",
+    experimentKey: null,
+    createdAt: new Date("2026-09-03T00:00:00.000Z"),
+  },
+  // Carries the shared address and was NEVER linked. Invisible to everyone.
+  {
+    id: "prjl_unlinked",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: null,
+    experimentKey: null,
+    createdAt: new Date("2026-09-04T00:00:00.000Z"),
+  },
+  // dane's own, linked while dane's address was still verified.
+  {
+    id: "prjl_dane_one",
+    siteId: SITE_A,
+    founderEmail: "dane@example.com",
+    ownerUserId: "dane",
+    experimentKey: null,
+    createdAt: new Date("2026-09-02T00:00:00.000Z"),
+  },
+];
+
+type ListingWhere = Record<string, unknown> & { ownerUserId?: unknown };
+
+const WAITLIST_COUNTS: Record<string, Record<string, number>> = {
+  [SITE_A]: { "atlas-waitlist": 7 },
+  [SITE_B]: { "atlas-two-waitlist": 3 },
+};
+
+function installFixtureMocks(): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
+    Promise.resolve(USERS[where.id] ?? null),
+  );
+
+  /**
+   * The owner link is the ONLY join the service may use, and this mock is
+   * written to FAIL on a regression rather than to absorb one.
+   *
+   * Two earlier, weaker forms were rejected during review, both of which let a
+   * regression keep the security tests green:
+   *
+   *   - `expect(where).not.toHaveProperty("founderEmail")` inspects TOP-LEVEL
+   *     keys only, so an `OR`-wrapped email fallback
+   *     (`{ OR: [{ ownerUserId }, { founderEmail }] }`) sails straight past it —
+   *     and a mock that then filtered on `where.ownerUserId` returns `[]` for
+   *     that shape, which looks like "nothing leaked".
+   *   - Filtering on `where.ownerUserId` when it is `undefined` also returns
+   *     `[]`, while Prisma compiles an `undefined` filter to no filter at all
+   *     (`WHERE 1=1`) and the REAL read would be unscoped.
+   *
+   * So: any key other than `ownerUserId` THROWS, an `ownerUserId` that is not a
+   * string THROWS, and the filter is exact equality on it. A widened read now
+   * fails as a thrown error rather than as a quietly empty result.
+   */
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: ListingWhere }) => {
+      const keys = Object.keys(where);
+      if (keys.length !== 1 || keys[0] !== "ownerUserId") {
+        throw new Error(
+          `the /me read must scope on ownerUserId and nothing else; got where keys [${keys.join(", ")}]`,
+        );
+      }
+      if (typeof where.ownerUserId !== "string") {
+        throw new Error(
+          "ownerUserId must be a concrete string; Prisma compiles an undefined filter to no filter, leaving the read unscoped",
+        );
+      }
+      const ownerUserId = where.ownerUserId;
+      return Promise.resolve(
+        LISTINGS.filter((l) => l.ownerUserId === ownerUserId)
+          .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
+          .map(row),
+      );
+    },
+  );
+
+  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId: string; experimentKey: string } }) =>
+      Promise.resolve(WAITLIST_COUNTS[where.siteId]?.[where.experimentKey] ?? 0),
+  );
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(async (authScope) => {
+    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(projectListingMeRoute);
+  });
+  await app.ready();
+  return app;
+}
+
+const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
+const URL_ME = "/v1/project-listings/me";
+
+const listingWhere = (call = 0) =>
+  (prisma.projectListing.findMany as jest.Mock).mock.calls[call][0].where as ListingWhere;
+
+let app: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  installFixtureMocks();
+  app = await buildApp();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("GET /v1/project-listings/me — auth", () => {
+  it("no session cookie and no bearer → the preHandler's existing 401; no listing read", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME });
+
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+
+  it("an expired / unknown cookie → 401", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_nobody") });
+
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/project-listings/me — the owner link is the only join", () => {
+  /** SECURITY PROPERTY: two users sharing a founderEmail value. */
+  it("two users sharing a founderEmail never see each other's listings", async () => {
+    const adaRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+    const brunoRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
+
+    expect(adaRes.statusCode).toBe(200);
+    expect(brunoRes.statusCode).toBe(200);
+
+    const adaIds = (adaRes.json().data as Array<{ id: string }>).map((r) => r.id);
+    const brunoIds = (brunoRes.json().data as Array<{ id: string }>).map((r) => r.id);
+
+    // ada sees her two rows, newest first, and NOT bruno's.
+    expect(adaIds).toEqual(["prjl_ada_two", "prjl_ada_one"]);
+    // bruno sees his one row, and NOT ada's — though every row in play carries
+    // the identical founderEmail.
+    expect(brunoIds).toEqual(["prjl_bruno_one"]);
+
+    expect(adaIds).not.toContain("prjl_bruno_one");
+    expect(brunoIds).not.toContain("prjl_ada_one");
+    expect(brunoIds).not.toContain("prjl_ada_two");
+    // And neither of them reaches the un-linked row carrying the same address.
+    expect([...adaIds, ...brunoIds]).not.toContain("prjl_unlinked");
+  });
+
+  /** SECURITY PROPERTY: no read-time email fallback. */
+  it("a listing carrying the caller's own address but NO owner link is never returned", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    const ids = (res.json().data as Array<{ id: string }>).map((r) => r.id);
+    expect(ids).not.toContain("prjl_unlinked");
+  });
+
+  it("the where clause is the owner link and carries nothing email-shaped", async () => {
+    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
+  });
+
+  it("a query parameter is never read — ?email= and ?ownerUserId= change nothing", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `${URL_ME}?email=${encodeURIComponent(SHARED_EMAIL)}&ownerUserId=bruno`,
+      headers: cookie("cookie_ada"),
+    });
+
+    expect(res.statusCode).toBe(200);
+    // Still ada's own rows, scoped by the SESSION's user id.
+    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
+    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
+      "prjl_ada_two",
+      "prjl_ada_one",
+    ]);
+  });
+});
+
+describe("GET /v1/project-listings/me — the empty case is not a refusal", () => {
+  /** SECURITY / UX PROPERTY: owning nothing is an empty list, never a 403. */
+  it("a signed-in caller who owns no listing gets 200 with an empty list, not a 403", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+    // Specifically NOT the tenant routes' 403 — cleo is legitimately signed in.
+    expect(res.statusCode).not.toBe(403);
+  });
+
+  it("no waitlist count is read when the caller owns nothing", async () => {
+    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
+
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/project-listings/me — the response shape", () => {
+  it("every row parses under projectListingMeResponseSchema", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(res.statusCode).toBe(200);
+    const parsed = projectListingMeResponseSchema.safeParse(res.json().data);
+    expect(parsed.success).toBe(true);
+  });
+
+  it("the five internal references never reach the founder", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    for (const listing of res.json().data as Array<Record<string, unknown>>) {
+      expect(listing).not.toHaveProperty("siteId");
+      expect(listing).not.toHaveProperty("leadId");
+      expect(listing).not.toHaveProperty("decidedBy");
+      expect(listing).not.toHaveProperty("issueUrl");
+      expect(listing).not.toHaveProperty("experimentKey");
+    }
+    // No workspace id reaches the wire anywhere in the body.
+    expect(res.body).not.toContain(SITE_A);
+    expect(res.body).not.toContain(SITE_B);
+  });
+
+  it("waitlistCount is resolved per site, not all under one site id", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    const byId = Object.fromEntries(
+      (res.json().data as Array<{ id: string; waitlistCount: number }>).map((r) => [
+        r.id,
+        r.waitlistCount,
+      ]),
+    );
+    // prjl_ada_one's experiment lives at SITE_A (7); prjl_ada_two's at SITE_B (3).
+    // One shared site id would have reported 0 for one of them.
+    expect(byId["prjl_ada_one"]).toBe(7);
+    expect(byId["prjl_ada_two"]).toBe(3);
+    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      where: { siteId: SITE_A, experimentKey: "atlas-waitlist" },
+    });
+    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      where: { siteId: SITE_B, experimentKey: "atlas-two-waitlist" },
+    });
+  });
+
+  it("the founder's own email is echoed back to the founder who wrote it", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
+
+    expect((res.json().data as Array<{ founderEmail: string }>)[0]?.founderEmail).toBe(
+      SHARED_EMAIL,
+    );
+  });
+});
+
+describe("GET /v1/project-listings/me — the read-time verification posture", () => {
+  /**
+   * A caller whose address is no longer verified still reads the rows their
+   * link already covers. This is deliberate, and it is the one place this route
+   * diverges from `/v1/flow-checkouts/me`, which re-checks `emailVerified`.
+   *
+   * The re-check is load-bearing on `/v1/waitlist-signups/me`, where the match
+   * IS an email, and it is defence in depth on `/v1/flow-checkouts/me`. Here it
+   * would be neither: the link is the proof, it was only ever issuable under
+   * verification, and refusing on a later unverified address would hide rows
+   * the caller already proved they own (changing your email address is not a
+   * reason to lose your own submissions). An unverified address still cannot
+   * CREATE a link — `listing-promotion.ts` refuses before any listing read.
+   */
+  it("a caller whose address is no longer verified still reads the rows their link already covers", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_dane") });
+
+    expect(res.statusCode).toBe(200);
+    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
+      "prjl_dane_one",
+    ]);
+    expect(listingWhere()).toEqual({ ownerUserId: "dane" });
+  });
+});
+
+describe("the existing operator role floor is untouched", () => {
+  it("PROJECT_LISTING_ROLES is still exactly owner + admin", () => {
+    expect([...PROJECT_LISTING_ROLES].sort()).toEqual(["admin", "owner"]);
+    expect(PROJECT_LISTING_ROLES.size).toBe(2);
+  });
+
+  it("the /me route never consults the tenant context or the role floor", async () => {
+    // The app this suite builds registers NO tenant preHandler at all, so
+    // `request.tenant` is undefined for every request above. That every test in
+    // this file answers 200 is the proof: a route that consulted the floor
+    // would have answered 401/403 instead.
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(res.statusCode).toBe(200);
+  });
+});