create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -0,0 +1,424 @@
+/**
+ * @file public.test.ts
+ *
+ * THE ACCEPTANCE GATE for `GET /v1/project-listings/public` (#4998 AC4).
+ * Real `publicProjectListingsRoute`, mocked `lib/prisma.js`. A five-row
+ * fixture (mixed status, decidedAt, waitlistCount) proves the D6 order: the
+ * three newest-by-decidedAt `active` rows first, then the rest by
+ * waitlistCount desc then decidedAt desc — and that `requested`/`rejected`
+ * rows never appear, `founderEmail` never appears on any row, and a
+ * malformed `siteKey` is 400.
+ *
+ * Extended by #5033 with the invariant that is a wrong-way failure rather
+ * than a visible one: a row whose window has ELAPSED reads `closed`,
+ * computed on this read, with no job having run and nothing having been
+ * written. Plus the per-site `featured` gate.
+ *
+ * Narrowed by #5036 D6b: a null window is no longer a free pass. Only a
+ * FEATURED row (never a time-boxed experiment) reads `active` without one; a
+ * non-featured row with no window is a data error and fails CLOSED. The row
+ * itself also changed shape — `audience`/`stage` are gone,
+ * `product`/`commitment`/`teamComposition`/`faqs`/`anythingElse`/`address`/
+ * `consentAt` are new, and the waitlist join reads `experimentKey` straight
+ * off the listing (D6d) rather than translating an id through
+ * `WaitlistExperiment`.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { projectListingPublicSchema } from "@working-theory/validation";
+
+// `services/project-listings.ts` imports `routeLead` from `lead-routing.js`
+// (used by the draft-submit path, not by this route) at module scope, which transitively
+// imports `@working-theory/email` and `@working-theory/license` — mocked
+// here purely so that import chain resolves, mirroring
+// `routes/leads/__tests__/index.test.ts`'s discipline.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    projectListing: { findMany: jest.fn() },
+    siteListingConfig: { findUnique: jest.fn() },
+    waitlistExperiment: { findMany: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { publicProjectListingsRoute } from "../public.js";
+
+const SITE = "site-1";
+/**
+ * The query names the site by its PUBLIC KEY now (#5048 D2) — one identifier
+ * for the whole mountable contract, resolved server-side through
+ * `SiteListingConfig.publicKey`.
+ */
+const SITE_KEY = "site-1-public-key";
+
+/**
+ * The `SiteListingConfig.data` blob this site is running on, per test. The
+ * config delegate serves TWO lookups now, so a test that wants a different
+ * config sets this rather than re-stubbing `findUnique` — a blanket
+ * `mockResolvedValue` would break the `publicKey` resolution the route makes
+ * first.
+ */
+let configData: Record<string, unknown> | null = null;
+
+const opt = (value: string, label: string) => ({ value, label });
+const QUESTIONS = {
+  q2: { prompt: "x", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
+  q3: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: { prompt: "x", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
+  q6: {
+    prompt: "x",
+    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
+  },
+  q7: { prompt: "x" },
+  extras: [],
+};
+
+function makeRow(overrides: Partial<Record<string, unknown>>) {
+  return {
+    siteId: SITE,
+    leadId: "lead_00000000-0000-7000-8000-000000000001",
+    name: "A Project",
+    oneLiner: "A one-liner",
+    problem: "The problem",
+    url: null,
+    // #5036 D2/D5 — the `product` ladder replaced `stage`, `audience` is gone,
+    // and these five carry what the tile and detail page render.
+    product: "working-prototype",
+    commitment: "part-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Example Street, Exampleton, EX1 2AM",
+    questions: QUESTIONS,
+    founderName: "Some Founder",
+    founderEmail: "founder@example.com",
+    founderCompany: null,
+    headline: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    consentAt: new Date("2026-08-01T00:00:00.000Z"),
+    issueUrl: null,
+    experimentKey: null,
+    // A LIVE window by default. Since #5036 D6b a non-featured `active` row
+    // with no window reads `closed` (the fail-closed error branch), so these
+    // fixtures have to carry one to be the ordinary active rows the ordering
+    // tests are about.
+    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+    createdAt: new Date("2026-08-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-08-01T00:00:00.000Z"),
+    decidedBy: "alice",
+    ...overrides,
+  };
+}
+
+// Five rows: two requested/rejected (excluded), three `active` with a
+// clear decidedAt ranking, two of which also carry a distinguishing
+// waitlistCount for the "rest" ordering below.
+const ROW_NEWEST = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000001",
+  slug: "newest",
+  status: "active",
+  decidedAt: new Date("2026-09-05T00:00:00.000Z"),
+  experimentKey: "exp-newest",
+});
+const ROW_SECOND = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000002",
+  slug: "second",
+  status: "active",
+  decidedAt: new Date("2026-09-04T00:00:00.000Z"),
+});
+const ROW_THIRD = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000003",
+  slug: "third",
+  status: "active",
+  decidedAt: new Date("2026-09-03T00:00:00.000Z"),
+});
+// Two more approved rows, older decidedAt (excluded from the top-3), whose
+// relative order among "the rest" is decided by waitlistCount desc.
+const ROW_REST_LOW_COUNT = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000004",
+  slug: "rest-low",
+  status: "active",
+  decidedAt: new Date("2026-08-20T00:00:00.000Z"),
+  experimentKey: "exp-rest-low",
+});
+const ROW_REST_HIGH_COUNT = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000005",
+  slug: "rest-high",
+  status: "active",
+  decidedAt: new Date("2026-08-10T00:00:00.000Z"),
+  experimentKey: "exp-rest-high",
+});
+const ROW_REQUESTED = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000006",
+  slug: "still-requested",
+  status: "requested",
+  decidedAt: null,
+});
+const ROW_REJECTED = makeRow({
+  id: "prjl_00000000-0000-7000-8000-000000000007",
+  slug: "was-rejected",
+  status: "rejected",
+  decidedAt: new Date("2026-09-06T00:00:00.000Z"),
+});
+
+const ALL_ROWS = [
+  ROW_NEWEST,
+  ROW_SECOND,
+  ROW_THIRD,
+  ROW_REST_LOW_COUNT,
+  ROW_REST_HIGH_COUNT,
+  ROW_REQUESTED,
+  ROW_REJECTED,
+];
+
+const COUNTS_BY_KEY: Record<string, number> = {
+  "exp-newest": 2,
+  "exp-rest-low": 1,
+  "exp-rest-high": 9,
+};
+
+function installFixtureMocks(): void {
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId: string; status: string } }) =>
+      Promise.resolve(
+        ALL_ROWS.filter((r) => r.siteId === where.siteId && r.status === where.status),
+      ),
+  );
+  // No SiteListingConfig row by default — the platform's schema defaults
+  // apply, which leave `featuredEnabled` false. The `publicKey` branch still
+  // resolves SITE_KEY, since the route cannot reach the read without it.
+  configData = null;
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE } : null);
+      }
+      return Promise.resolve(configData === null ? null : { data: configData });
+    },
+  );
+  // No `WaitlistExperiment` read is installed on purpose: since #5036 D6d the
+  // count is keyed on the `experimentKey` the listing already holds, so the
+  // id-to-key hop this route used to make is gone. A test below asserts it
+  // stays gone.
+  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
+    ({ where }: { where: { experimentKey: string } }) =>
+      Promise.resolve(COUNTS_BY_KEY[where.experimentKey] ?? 0),
+  );
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(publicProjectListingsRoute);
+  await app.ready();
+  return app;
+}
+
+describe("GET /v1/project-listings/public", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installFixtureMocks();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns the D6 order: three newest-by-decidedAt first, then the rest by waitlistCount desc then decidedAt desc", async () => {
+    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+    expect(res.statusCode).toBe(200);
+    const rows = res.json().data as Array<{ slug: string }>;
+    expect(rows.map((r) => r.slug)).toEqual(["newest", "second", "third", "rest-high", "rest-low"]);
+  });
+
+  it("never returns a requested or rejected row", async () => {
+    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+    const slugs = (res.json().data as Array<{ slug: string }>).map((r) => r.slug);
+    expect(slugs).not.toContain("still-requested");
+    expect(slugs).not.toContain("was-rejected");
+  });
+
+  it("never carries founderEmail on any row", async () => {
+    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+    const body = JSON.stringify(res.json());
+    expect(body).not.toContain("founderEmail");
+    expect(body).not.toContain("founder@example.com");
+    for (const row of res.json().data) {
+      expect(projectListingPublicSchema.safeParse(row).success).toBe(true);
+    }
+  });
+
+  it("400s on a malformed siteKey", async () => {
+    const res = await app.inject({ method: "GET", url: "/v1/project-listings/public?siteKey=" });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("400s when siteKey is missing entirely", async () => {
+    const res = await app.inject({ method: "GET", url: "/v1/project-listings/public" });
+    expect(res.statusCode).toBe(400);
+  });
+
+  // ── #5033 — `closed` is computed, not stored ────────────────────────────
+
+  describe("the computed closed state", () => {
+    const statusOf = (body: { data: Array<{ slug: string; status: string }> }, slug: string) =>
+      body.data.find((r) => r.slug === slug)?.status;
+
+    it("reads a row whose window has ELAPSED as closed, with no job having run", async () => {
+      const elapsed = makeRow({
+        id: "prjl_00000000-0000-7000-8000-000000000008",
+        slug: "window-elapsed",
+        status: "active",
+        decidedAt: new Date("2026-07-01T00:00:00.000Z"),
+        windowEndsAt: new Date("2026-08-01T00:00:00.000Z"),
+      });
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([elapsed]);
+
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(res.statusCode).toBe(200);
+      expect(statusOf(res.json(), "window-elapsed")).toBe("closed");
+      // Nothing was written to produce that answer.
+      expect(prisma.projectListing.update).toBeUndefined();
+    });
+
+    it("reads a row whose window is STILL OPEN as active", async () => {
+      const open = makeRow({
+        id: "prjl_00000000-0000-7000-8000-000000000009",
+        slug: "window-open",
+        status: "active",
+        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+        windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+      });
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([open]);
+
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(statusOf(res.json(), "window-open")).toBe("active");
+    });
+
+    // #5036 D6b. A null window used to mean "nothing to elapse, stay active".
+    // It now means one of two opposite things depending on the row's own
+    // `featured` flag, and the split is deliberate: the operator's products
+    // are featured rows with no meaningful window and must not vanish from the
+    // shelf, while a non-featured row with nothing bounding it is a data error
+    // that must not stay publicly open.
+    it("leaves a FEATURED row with no window at all active — it is not a time-boxed experiment", async () => {
+      const featuredNoWindow = makeRow({
+        id: "prjl_00000000-0000-7000-8000-00000000000a",
+        slug: "featured-no-window",
+        status: "active",
+        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+        featured: true,
+        windowEndsAt: null,
+      });
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredNoWindow]);
+
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(statusOf(res.json(), "featured-no-window")).toBe("active");
+    });
+
+    it("reads a NON-featured row with no window as closed — failing toward the closed shelf", async () => {
+      const unboundedNoWindow = makeRow({
+        id: "prjl_00000000-0000-7000-8000-00000000000b",
+        slug: "unbounded",
+        status: "active",
+        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+        featured: false,
+        windowEndsAt: null,
+      });
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([unboundedNoWindow]);
+
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(statusOf(res.json(), "unbounded")).toBe("closed");
+    });
+
+    // The row's OWN flag decides the exemption, not the site's
+    // `featuredEnabled` switch — that switch governs whether the flag
+    // SURFACES on a read, not whether the listing is time-boxed.
+    it("exempts on the row's own flag even where the site does not surface it", async () => {
+      const featuredNoWindow = makeRow({
+        id: "prjl_00000000-0000-7000-8000-00000000000c",
+        slug: "featured-hidden-flag",
+        status: "active",
+        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+        featured: true,
+        windowEndsAt: null,
+      });
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredNoWindow]);
+      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: false };
+
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      const row = res.json().data.find((r: { slug: string }) => r.slug === "featured-hidden-flag");
+      expect(row.featured).toBe(false); // not surfaced
+      expect(row.status).toBe("active"); // still exempt
+    });
+
+    it("counts the waitlist through the listing's own experimentKey, in one hop", async () => {
+      await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+        where: { siteId: SITE, experimentKey: "exp-newest" },
+      });
+      // The id-to-key translation read is gone with #5036 D6d.
+      expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();
+    });
+
+    it("selects on the STORED status, so the query never asks the database for `closed`", async () => {
+      await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      const where = (prisma.projectListing.findMany as jest.Mock).mock.calls[0][0].where;
+      expect(where.status).toBe("active");
+    });
+  });
+
+  // ── #5033 — the per-site featured gate ──────────────────────────────────
+
+  describe("the featured flag", () => {
+    const featuredRow = makeRow({
+      id: "prjl_00000000-0000-7000-8000-000000000010",
+      slug: "is-featured",
+      status: "active",
+      decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+      featured: true,
+    });
+
+    beforeEach(() => {
+      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredRow]);
+    });
+
+    it("surfaces the flag where the site's config enables it", async () => {
+      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: true };
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(res.json().data[0].featured).toBe(true);
+    });
+
+    it("never surfaces the flag for a site that has not enabled a featured shelf", async () => {
+      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: false };
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(res.json().data[0].featured).toBe(false);
+    });
+
+    it("defaults to not surfacing it for a site with no config row", async () => {
+      configData = null;
+      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+      expect(res.json().data[0].featured).toBe(false);
+    });
+  });
+});