create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -0,0 +1,707 @@
+/**
+ * @file site-answers.test.ts
+ *
+ * THE ACCEPTANCE GATE for the anonymous-write bounds on the site-answers
+ * store (#5285), and for the three contract fields that became writable
+ * beside it.
+ *
+ * The store is what lets a site ask a question the platform does not read —
+ * no column, no migration, no release. The write path is ANONYMOUS: a resume
+ * token and nothing else. So every bound on it is read from the site's
+ * SERVER-side `SiteListingConfig`, exactly as `wordCaps` and `collectedFields`
+ * already are, and the tests below pin each bound to the SITE's number so a
+ * cap that came from the package could not pass by coincidence.
+ *
+ * The tests that would fail QUIETLY, and are the reason this file exists:
+ *
+ *   - an answer for an undeclared id must 400 with NOTHING written. Dropping
+ *     the unknown key instead is indistinguishable, from the client's side,
+ *     from a successful save — and hands the size of the store to whoever is
+ *     posting into it. Asserted on the ROW, not only on the status code.
+ *   - an `operator-only` answer must be absent from the PUBLIC read. A
+ *     visibility flag that is declared and never consulted looks identical to
+ *     one that is, right up until a founder's private answer is on a page.
+ *   - `requestedWindowDays` must be CLAMPED and not stored as posted. The
+ *     site's maximum is its commercial terms; a founder who could post their
+ *     own bound could post an unbounded one.
+ *   - adding three optional fields widens the DEFAULT `collectedFields`
+ *     (it derives from the application schema's own shape), so an existing
+ *     site's submit floor is pinned as unchanged.
+ *
+ * Same harness as `configured-application.test.ts`: real routes, real
+ * services, mocked `lib/prisma.js` over a small in-memory row store.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { SITE_LISTING_CONFIG_DEFAULTS } from "@working-theory/validation";
+
+import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import { prisma } from "../../../lib/prisma.js";
+import { listProjectListings } from "../../../services/project-listings.js";
+import { patchProjectListingDraftRoute } from "../patch-draft.js";
+import { publicProjectListingsRoute } from "../public.js";
+import { startProjectListingRoute } from "../start.js";
+import { submitProjectListingRoute } from "../submit.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SITE_ID = "site-1";
+const SITE_KEY = "pk-site-1";
+
+const opt = (value: string, label: string) => ({ value, label });
+
+const VALID_QUESTIONS = {
+  q2: {
+    prompt: "Why are you here?",
+    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
+  },
+  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: {
+    prompt: "Urgency?",
+    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
+  },
+  q6: {
+    prompt: "Pain?",
+    options: [
+      opt("low", "Low"),
+      opt("medium", "Medium"),
+      opt("high", "High"),
+      opt("critical", "Critical"),
+    ],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+const START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderName: "Ada Founder",
+  founderEmail: "ada@example.com",
+  consent: true,
+};
+
+/** Everything the screens after step one collect, under the default config. */
+const COMPLETE_APPLICATION = {
+  name: "My Project",
+  headline: "Ten words or fewer for the tile title here",
+  oneLiner: "A short sentence describing what the project does for its people.",
+  problem: "The problem is real and this describes it.",
+  product: "wireframes",
+  commitment: "part-time",
+  teamComposition: "co-founders",
+  faqs: [
+    { question: "Q one?", answer: "A one." },
+    { question: "Q two?", answer: "A two." },
+    { question: "Q three?", answer: "A three." },
+  ],
+  address: "1 Founder Way, Springfield",
+  questions: VALID_QUESTIONS,
+};
+
+/**
+ * The `collectedFields` an operator wrote BEFORE #5285 — the roster as it
+ * stood, with none of the three new fields in it. A stored list like this is
+ * what every configured site is actually running on.
+ */
+/**
+ * A site that DELIBERATELY asks for the three #5285 fields. They are opt-in:
+ * excluded from the platform's default mask so that adding them to the payload
+ * could not silently widen what an anonymous caller may write on a site that
+ * never asked. Every round-trip test below therefore configures this rather
+ * than leaning on the default.
+ */
+const COLLECTED_WITH_OPT_IN = [
+  ...SITE_LISTING_CONFIG_DEFAULTS.collectedFields,
+  "logoMarkUrl",
+  "logoWordmarkUrl",
+  "requestedWindowDays",
+];
+
+const COLLECTED_BEFORE_5285 = [
+  "name",
+  "headline",
+  "oneLiner",
+  "problem",
+  "url",
+  "product",
+  "commitment",
+  "teamComposition",
+  "faqs",
+  "anythingElse",
+  "address",
+  "founderCompany",
+  "questions",
+];
+
+/** A site that asks four questions of its own, one of them for itself only. */
+const SITE_ANSWERS_CONFIG = {
+  maxQuestions: 3,
+  maxAnswerLength: 40,
+  questions: [
+    { id: "why_now", control: "textarea", maxLength: 10 },
+    { id: "referrer", control: "select", options: ["twitter", "friend"] },
+    { id: "demo_url", control: "url" },
+    { id: "billing_email", control: "email", visibility: "operator-only" },
+  ],
+};
+
+// ─── The in-memory row store the Prisma mock is backed by ───────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+/** The `SiteListingConfig.data` blob this site runs on; `null` means no row. */
+let configData: Record<string, unknown> | null;
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (key === "OR") {
+      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
+    }
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+      if ("startsWith" in clause) {
+        return (
+          typeof row[key] === "string" &&
+          (row[key] as string).startsWith(clause["startsWith"] as string)
+        );
+      }
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+  configData = null;
+
+  (prisma.lead.create as jest.Mock).mockImplementation(() =>
+    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
+  );
+
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
+      }
+      return Promise.resolve(configData === null ? null : { data: configData });
+    },
+  );
+
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
+
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+
+  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
+    const now = new Date();
+    const row: Row = {
+      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+      slug: null,
+      name: null,
+      oneLiner: null,
+      problem: null,
+      url: null,
+      product: null,
+      commitment: null,
+      teamComposition: null,
+      faqs: null,
+      anythingElse: null,
+      address: null,
+      addressLine1: null,
+      addressLine2: null,
+      addressCity: null,
+      addressRegion: null,
+      addressPostalCode: null,
+      addressCountry: null,
+      questions: null,
+      siteAnswers: null,
+      founderCompany: null,
+      leadId: null,
+      headline: null,
+      logoMarkUrl: null,
+      logoWordmarkUrl: null,
+      featured: false,
+      decidedAt: null,
+      decidedBy: null,
+      issueUrl: null,
+      experimentKey: null,
+      windowDays: null,
+      windowEndsAt: null,
+      createdAt: now,
+      updatedAt: now,
+      ...data,
+    };
+    rows.push(row);
+    return Promise.resolve(row);
+  });
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where))),
+  );
+
+  (prisma.projectListing.update as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const row = rows.find((r) => matches(r, where));
+      Object.assign(row!, data, { updatedAt: new Date() });
+      return Promise.resolve(row);
+    },
+  );
+
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const matched = rows.filter((r) => matches(r, where));
+      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
+      return Promise.resolve({ count: matched.length });
+    },
+  );
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.register(patchProjectListingDraftRoute);
+  await app.register(submitProjectListingRoute);
+  await app.register(publicProjectListingsRoute);
+  await app.ready();
+  return app;
+}
+
+async function startDraft(
+  app: FastifyInstance,
+): Promise<{ id: string; resumeToken: string }> {
+  const res = await app.inject({
+    method: "POST",
+    url: "/v1/project-listings",
+    payload: START_PAYLOAD,
+  });
+  expect(res.statusCode).toBe(201);
+  return (res.json() as { data: { id: string; resumeToken: string } }).data;
+}
+
+const patch = (
+  app: FastifyInstance,
+  draft: { id: string; resumeToken: string },
+  payload: Record<string, unknown>,
+) =>
+  app.inject({
+    method: "PATCH",
+    url: `/v1/project-listings/drafts/${draft.id}`,
+    headers: bearer(draft.resumeToken),
+    payload,
+  });
+
+const submit = (app: FastifyInstance, draft: { id: string; resumeToken: string }) =>
+  app.inject({
+    method: "POST",
+    url: `/v1/project-listings/drafts/${draft.id}/submit`,
+    headers: bearer(draft.resumeToken),
+  });
+
+const publicRead = (app: FastifyInstance) =>
+  app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
+
+const messageOf = (res: { json: () => unknown }) =>
+  (res.json() as { error: { message: string } }).error.message;
+
+/** Approve the one row in the store, so it reaches the public read. */
+function publish(): void {
+  Object.assign(rows[0]!, {
+    status: "active",
+    decidedAt: new Date(),
+    windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+  });
+}
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe("the site-answers store's anonymous-write bounds (#5285)", () => {
+  setupLeadFileEnv("project-listing-site-answers");
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── The declaration is the gate ──
+
+  describe("the declaration list is the gate", () => {
+    it("patch: refuses an answer for an id the site did NOT declare, and writes NOTHING", async () => {
+      // THE property of this change. A dropped key looks like a saved key to
+      // the client that sent it, and would leave the size of this store in the
+      // hands of whoever is posting into it.
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, {
+        siteAnswers: { why_now: "June", what_colour: "blue" },
+      });
+
+      expect(res.statusCode).toBe(400);
+      expect(messageOf(res)).toContain("what_colour");
+      // The declared answer beside it did not land either — the body is
+      // refused whole, not per key.
+      expect(rows[0]!["siteAnswers"]).toBeNull();
+    });
+
+    it("patch: a site that declares NOTHING accepts no site answer at all", async () => {
+      // The default, and what every unconfigured site runs on: the store
+      // cannot be written by a caller who merely knows the field name.
+      configData = null;
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { siteAnswers: { why_now: "June" } });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows[0]!["siteAnswers"]).toBeNull();
+    });
+
+    it("patch: stores a declared answer", async () => {
+      // The other half of every pair above — without it, a surface that
+      // refused everything would pass them all.
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { siteAnswers: { why_now: "June" } });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June" });
+    });
+
+    it("patch: MERGES answers rather than replacing them — a founder saves one screen at a time", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      await patch(app, draft, { siteAnswers: { why_now: "June" } });
+      const res = await patch(app, draft, { siteAnswers: { referrer: "friend" } });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June", referrer: "friend" });
+    });
+  });
+
+  // ── The caps are the site's own numbers ──
+
+  describe("the caps come from the site's config", () => {
+    it("patch: refuses more answers than the site's maxQuestions, naming the site's number", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, {
+        siteAnswers: {
+          why_now: "June",
+          referrer: "friend",
+          demo_url: "https://example.com",
+          billing_email: "ada@example.com",
+        },
+      });
+
+      expect(res.statusCode).toBe(400);
+      // Pinned to the SITE's three. A message naming the platform's twenty
+      // would mean the cap never came from this site's row.
+      expect(messageOf(res)).toContain("at most 3");
+      expect(rows[0]!["siteAnswers"]).toBeNull();
+    });
+
+    it("patch: refuses an answer longer than the site's per-question cap", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const over = await patch(app, draft, { siteAnswers: { why_now: "x".repeat(11) } });
+      const at = await patch(app, draft, { siteAnswers: { why_now: "x".repeat(10) } });
+
+      expect(over.statusCode).toBe(400);
+      expect(messageOf(over)).toContain("10 characters");
+      expect(at.statusCode).toBe(200);
+      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "x".repeat(10) });
+    });
+
+    it("patch: refuses a select answer outside the options the site declared", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const outside = await patch(app, draft, { siteAnswers: { referrer: "billboard" } });
+      const inside = await patch(app, draft, { siteAnswers: { referrer: "twitter" } });
+
+      expect(outside.statusCode).toBe(400);
+      expect(messageOf(outside)).toContain("billboard");
+      expect(inside.statusCode).toBe(200);
+      expect(rows[0]!["siteAnswers"]).toEqual({ referrer: "twitter" });
+    });
+
+    it("patch: enforces the declared control — a url answer must be http(s)", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+
+      const bad = await patch(app, draft, { siteAnswers: { demo_url: "javascript:alert(1)" } });
+
+      expect(bad.statusCode).toBe(400);
+      expect(rows[0]!["siteAnswers"]).toBeNull();
+    });
+  });
+
+  // ── Visibility ──
+
+  describe("operator-only answers never reach the public read", () => {
+    it("the public read carries the public answer and NOT the operator-only one", async () => {
+      // A visibility flag that is declared and never consulted looks exactly
+      // like one that is — until a founder's private answer is on a page.
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+      await patch(app, draft, { siteAnswers: { why_now: "June" } });
+      await patch(app, draft, { siteAnswers: { billing_email: "ada@example.com" } });
+      await patch(app, draft, COMPLETE_APPLICATION);
+      await submit(app, draft);
+      publish();
+
+      const res = await publicRead(app);
+
+      expect(res.statusCode).toBe(200);
+      const [listing] = (res.json() as { data: { siteAnswers: Record<string, string> }[] }).data;
+      expect(listing!.siteAnswers).toEqual({ why_now: "June" });
+      expect(listing!.siteAnswers).not.toHaveProperty("billing_email");
+      // And the value itself is nowhere in the serialized response at all.
+      expect(res.payload).not.toContain("ada@example.com");
+    });
+
+    it("the tenant dashboard read carries BOTH — it is the audience operator-only exists for", async () => {
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+      await patch(app, draft, { siteAnswers: { why_now: "June" } });
+      await patch(app, draft, { siteAnswers: { billing_email: "ada@example.com" } });
+
+      const [listing] = await listProjectListings(SITE_ID);
+
+      expect(listing!.siteAnswers).toEqual({
+        why_now: "June",
+        billing_email: "ada@example.com",
+      });
+    });
+
+    it("an answer whose id the site no longer declares is dropped from the public read", async () => {
+      // "No declaration" carries no visibility, and no visibility cannot be
+      // read as public on the read that publishes.
+      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
+      const draft = await startDraft(app);
+      await patch(app, draft, { siteAnswers: { why_now: "June" } });
+      await patch(app, draft, COMPLETE_APPLICATION);
+      await submit(app, draft);
+      publish();
+
+      // The operator retires the question after the answer was written.
+      configData = { siteAnswers: { ...SITE_ANSWERS_CONFIG, questions: [] } };
+      const res = await publicRead(app);
+
+      const [listing] = (res.json() as { data: { siteAnswers: Record<string, string> }[] }).data;
+      expect(listing!.siteAnswers).toEqual({});
+      // Still on the row — the founder's answer is not destroyed, only unpublished.
+      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June" });
+    });
+  });
+
+  // ── The three contract fields ──
+
+  describe("the three contract fields that became writable", () => {
+    it("patch: the two logo urls round-trip onto the row, on a site that asked", async () => {
+      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, {
+        logoMarkUrl: "https://cdn.example.com/mark.svg",
+        logoWordmarkUrl: "https://cdn.example.com/wordmark.svg",
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["logoMarkUrl"]).toBe("https://cdn.example.com/mark.svg");
+      expect(rows[0]!["logoWordmarkUrl"]).toBe("https://cdn.example.com/wordmark.svg");
+    });
+
+    it("patch: REFUSES all three on a site that never opted in, writing nothing", async () => {
+      // The defect the back-compat review found, at the route. `collectedFields`
+      // defaults to every field the payload defines, so adding these three
+      // silently made them writable on every site that had configured nothing —
+      // and the logo fields ride the PUBLIC read as image sources. An anonymous
+      // caller holding a resume token could have attached a third-party image
+      // to the public listing card of a site that never asked for a logo.
+      configData = null;
+      const draft = await startDraft(app);
+
+      for (const body of [
+        { logoMarkUrl: "https://evil.example/a.png" },
+        { logoWordmarkUrl: "https://evil.example/b.svg" },
+        { requestedWindowDays: 9000 },
+      ]) {
+        expect((await patch(app, draft, body)).statusCode).toBe(400);
+      }
+
+      expect(rows[0]!["logoMarkUrl"]).toBeNull();
+      expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
+    });
+
+    it("patch: refuses a logo url that is not http(s) — they render as image sources", async () => {
+      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { logoMarkUrl: "javascript:alert(1)" });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows[0]!["logoMarkUrl"]).toBeNull();
+    });
+
+    it("patch: CLAMPS requestedWindowDays to the site's maximum rather than storing what was posted", async () => {
+      // The one that would fail silently and expensively: an unclamped value
+      // is a founder setting their own commercial terms. The three numbers are
+      // deliberately distinct — 14 (the site's default, written at start), 90
+      // (what was asked for) and 45 (the site's maximum, what must be stored).
+      configData = {
+        maxWindowDays: 45,
+        defaultWindowDays: 14,
+        collectedFields: COLLECTED_WITH_OPT_IN,
+      };
+      const draft = await startDraft(app);
+      expect(rows[0]!["windowDays"]).toBe(14);
+
+      const res = await patch(app, draft, { requestedWindowDays: "90" });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["windowDays"]).toBe(45);
+    });
+
+    it("patch: stores a requested window BELOW the site's maximum as asked", async () => {
+      configData = {
+        maxWindowDays: 45,
+        defaultWindowDays: 14,
+        collectedFields: COLLECTED_WITH_OPT_IN,
+      };
+      const draft = await startDraft(app);
+
+      await patch(app, draft, { requestedWindowDays: 21 });
+
+      expect(rows[0]!["windowDays"]).toBe(21);
+    });
+
+    it("patch: refuses a window that is not a positive whole number of days", async () => {
+      configData = {
+        maxWindowDays: 45,
+        defaultWindowDays: 14,
+        collectedFields: COLLECTED_WITH_OPT_IN,
+      };
+      const draft = await startDraft(app);
+
+      expect((await patch(app, draft, { requestedWindowDays: 0 })).statusCode).toBe(400);
+      expect((await patch(app, draft, { requestedWindowDays: -7 })).statusCode).toBe(400);
+      expect((await patch(app, draft, { requestedWindowDays: "soon" })).statusCode).toBe(400);
+      expect(rows[0]!["windowDays"]).toBe(14);
+    });
+  });
+
+  // ── The floor the three new fields must not move ──
+
+  describe("submit requirements are unchanged by the three added fields", () => {
+    it("the three are OPT-IN, absent from the default collected set, and never required at submit", async () => {
+      // This assertion was inverted by the back-compat review. The default
+      // `collectedFields` derives from the application schema's own shape, so
+      // adding a field WIDENED what an anonymous caller could write on every
+      // site that never wrote an explicit mask — and the two logo fields ride
+      // the public read and render as image sources. They are excluded from
+      // the default now; a site that wants them names them.
+      for (const field of ["logoMarkUrl", "logoWordmarkUrl", "requestedWindowDays"]) {
+        expect(SITE_LISTING_CONFIG_DEFAULTS.collectedFields).not.toContain(field);
+      }
+
+      configData = null;
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION); // carries none of the three
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["status"]).toBe("requested");
+      expect(rows[0]!["logoMarkUrl"]).toBeNull();
+      expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
+    });
+
+    it("a site whose stored collectedFields predates #5285 submits exactly as it did", async () => {
+      // What every configured site is actually running on: a list written
+      // before these three existed. It must keep working untouched.
+      configData = { collectedFields: COLLECTED_BEFORE_5285 };
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION);
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["status"]).toBe("requested");
+    });
+
+    it("a site whose stored collectedFields predates #5285 cannot have a logo written into it", async () => {
+      // The collected set is a WRITE gate as well as a completeness floor
+      // (#5048 D5): a site that never asks for a logo must not have one
+      // written by an anonymous caller who knows the field name.
+      configData = { collectedFields: COLLECTED_BEFORE_5285 };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { logoMarkUrl: "https://cdn.example.com/m.svg" });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows[0]!["logoMarkUrl"]).toBeNull();
+    });
+
+    it("the missing-field list an empty draft is refused with names none of the three", async () => {
+      configData = null;
+      const draft = await startDraft(app);
+      await patch(app, draft, { name: "My Project" });
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(422);
+      const body = res.json() as { error: { missingFields: string[] } };
+      expect(body.error.missingFields).not.toContain("logoMarkUrl");
+      expect(body.error.missingFields).not.toContain("logoWordmarkUrl");
+      expect(body.error.missingFields).not.toContain("requestedWindowDays");
+    });
+  });
+});