create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/site-key.test.ts

@@ -0,0 +1,375 @@
+/**
+ * @file site-key.test.ts
+ *
+ * THE ACCEPTANCE GATE for the PUBLIC SITE KEY (#5048 D2) — the change that
+ * takes the tenant identifier out of the request body entirely.
+ *
+ * `projectListingStartSchema` carried `siteId`. A body-supplied tenant
+ * identifier is exactly what the consuming site's proxy route existed to
+ * prevent, so the body now carries `siteKey` and the server resolves the site
+ * from `SiteListingConfig.publicKey` (`services/listing-config.ts`'s
+ * `siteIdForPublicKey`). The same key names the site on the public read.
+ *
+ * The half that matters is the REFUSAL half, and it is why this file exists
+ * apart from `drafts.test.ts`: a `siteId` that were merely *ignored* would
+ * look identical from the outside to one that is refused, right up until a
+ * caller pairs a valid key with a foreign `siteId` and something downstream
+ * reads the wrong one. `projectListingStartSchema` is `.strict()`, so both
+ * bodies are a 400 — and that is asserted here rather than assumed.
+ *
+ * Same harness as `drafts.test.ts`: real routes, real services, the mocked
+ * `lib/prisma.js` over a small in-memory row store, so "the draft was filed
+ * against THAT site" is read back off the stored row rather than off the
+ * response the route happens to echo.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+import { prisma } from "../../../lib/prisma.js";
+import { publicProjectListingsRoute } from "../public.js";
+import { startProjectListingRoute } from "../start.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+/** Two sites, each reachable ONLY by its own public key. */
+const SITE_A = "site-a";
+const KEY_A = "pk-site-a";
+const SITE_B = "site-b";
+const KEY_B = "pk-site-b";
+
+const KEYS_TO_SITES: Record<string, string> = { [KEY_A]: SITE_A, [KEY_B]: SITE_B };
+
+const START_PAYLOAD = {
+  siteKey: KEY_A,
+  founderName: "Ada Founder",
+  founderEmail: "ada@example.com",
+  consent: true,
+};
+
+// ─── The in-memory row store the Prisma mock is backed by ───────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (key === "OR") {
+      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
+    }
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+      if ("startsWith" in clause) {
+        return (
+          typeof row[key] === "string" &&
+          (row[key] as string).startsWith(clause["startsWith"] as string)
+        );
+      }
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+
+  // One delegate, two lookups (#5048 D2): `where.publicKey` is the site-key
+  // resolution, `where.siteId` the per-site config read. No config row for the
+  // latter, so the platform defaults apply.
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        const siteId = KEYS_TO_SITES[where.publicKey];
+        return Promise.resolve(siteId ? { siteId } : null);
+      }
+      return Promise.resolve(null);
+    },
+  );
+
+  // #5275 — the grant write `start` makes after the row. Append-only; it only
+  // needs to resolve here (drafts.test.ts asserts on what it is called with).
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
+
+  // #5275 — `start` writes the row and its grant in one interactive
+  // transaction; the mock hands the same store-backed client through.
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
+    const now = new Date();
+    const row: Row = {
+      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+      slug: null,
+      name: null,
+      oneLiner: null,
+      problem: null,
+      url: null,
+      product: null,
+      commitment: null,
+      teamComposition: null,
+      faqs: null,
+      anythingElse: null,
+      address: null,
+      questions: null,
+      founderCompany: null,
+      leadId: null,
+      headline: null,
+      logoMarkUrl: null,
+      logoWordmarkUrl: null,
+      featured: false,
+      decidedAt: null,
+      decidedBy: null,
+      issueUrl: null,
+      experimentKey: null,
+      windowEndsAt: null,
+      createdAt: now,
+      updatedAt: now,
+      ...data,
+    };
+    rows.push(row);
+    return Promise.resolve(row);
+  });
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where))),
+  );
+}
+
+/** An `active`, publicly-readable listing on one site. */
+function seedActiveListing(siteId: string, slug: string): void {
+  rows.push({
+    id: `prjl_00000000-0000-7000-8000-0000000000${slug.length}${rows.length}`,
+    siteId,
+    leadId: null,
+    slug,
+    name: "A Project",
+    headline: null,
+    oneLiner: "A one-liner",
+    problem: "The problem",
+    url: null,
+    product: "working-prototype",
+    commitment: "part-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Founder Way",
+    founderName: "Some Founder",
+    founderEmail: "founder@example.com",
+    founderCompany: null,
+    questions: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "active",
+    consentAt: new Date("2026-08-01T00:00:00.000Z"),
+    decidedAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedBy: "alice",
+    issueUrl: null,
+    experimentKey: null,
+    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+    createdAt: new Date("2026-08-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-08-01T00:00:00.000Z"),
+  });
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.register(publicProjectListingsRoute);
+  await app.ready();
+  return app;
+}
+
+const start = (app: FastifyInstance, payload: Record<string, unknown>) =>
+  app.inject({ method: "POST", url: "/v1/project-listings", payload });
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe("the public site key (#5048 D2)", () => {
+  let app: FastifyInstance;
+  let savedSiteId: string | undefined;
+  let savedPublicKey: string | undefined;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    // The single-tenant env path is OFF unless a test turns it on, so the
+    // config row is the only way to name a site here.
+    savedSiteId = process.env["AILK_SITE_ID"];
+    savedPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
+    delete process.env["AILK_SITE_ID"];
+    delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    if (savedSiteId === undefined) delete process.env["AILK_SITE_ID"];
+    else process.env["AILK_SITE_ID"] = savedSiteId;
+    if (savedPublicKey === undefined) delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    else process.env["AILK_LISTING_PUBLIC_KEY"] = savedPublicKey;
+    await app.close();
+  });
+
+  // ── the refusal half ──
+
+  it("start: a body naming the site by `siteId` is REFUSED, not silently ignored", async () => {
+    const { siteKey: _siteKey, ...withoutKey } = START_PAYLOAD;
+    const res = await start(app, { ...withoutKey, siteId: SITE_A });
+
+    // `.strict()` — the old field is an unrecognised key, so this is a 400 and
+    // not a create that quietly dropped it. The distinction is the whole point:
+    // a dropped `siteId` and a refused one look the same until one of them
+    // lands somewhere.
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { ok: boolean }).ok).toBe(false);
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: a body carrying BOTH a valid `siteKey` and a `siteId` is refused", async () => {
+    // The one that matters. A caller holding a legitimate public key must not
+    // be able to smuggle a tenant override alongside it — if `siteId` were
+    // merely ignored this would create a draft, and the only thing standing
+    // between that and a cross-tenant write would be the resolution order in
+    // the handler.
+    const res = await start(app, { ...START_PAYLOAD, siteId: SITE_B });
+
+    expect(res.statusCode).toBe(400);
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+
+  // ── the resolution half ──
+
+  it("start: a valid siteKey files the draft against THAT config row's siteId", async () => {
+    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_B });
+    expect(res.statusCode).toBe(201);
+
+    // Asserted on the STORED row, not the response: the response echoes an id
+    // and a token and would say nothing about which tenant the row landed in.
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!["siteId"]).toBe(SITE_B);
+    // And the key itself is never stored as if it were the site.
+    expect(rows[0]!["siteId"]).not.toBe(KEY_B);
+  });
+
+  it("start: an UNKNOWN siteKey is a 400 `unknown_site_key` and writes no row", async () => {
+    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-nobodys-site" });
+
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: an unknown siteKey never FALLS BACK to the deployment's own site", async () => {
+    // The failure this guards is silent: a typo in a mounted surface's key
+    // would file one site's applications against another, with a 201 and a
+    // resume token to make it look like it worked.
+    process.env["AILK_SITE_ID"] = "the-deployments-own-site";
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-the-deployments-own-site";
+
+    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-typo" });
+
+    expect(res.statusCode).toBe(400);
+    expect(rows).toHaveLength(0);
+    expect(rows.some((r) => r["siteId"] === "the-deployments-own-site")).toBe(false);
+  });
+
+  it("start (single-tenant): AILK_LISTING_PUBLIC_KEY resolves to currentSiteId() with no config row", async () => {
+    // The default `create-ailk` scaffold is one customer per deployment and
+    // has no `SiteListingConfig` row at all; requiring one would mean a site
+    // could not accept an application until an operator wrote a database row.
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
+    delete process.env["AILK_SITE_ID"]; // → currentSiteId() falls back to "default"
+
+    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
+
+    expect(res.statusCode).toBe(201);
+    expect(rows[0]!["siteId"]).toBe("default");
+  });
+
+  it("start (single-tenant): the env key resolves to AILK_SITE_ID where one is set", async () => {
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
+    process.env["AILK_SITE_ID"] = "the-only-site";
+
+    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
+
+    expect(res.statusCode).toBe(201);
+    expect(rows[0]!["siteId"]).toBe("the-only-site");
+  });
+
+  // ── the same key on the public read ──
+
+  it("public: `?siteId=` is a 400 — the parameter is `siteKey` now", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/public?siteId=${SITE_A}`,
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
+  });
+
+  it("public: `?siteKey=` with a known key returns THAT site's rows and no other's", async () => {
+    seedActiveListing(SITE_A, "on-site-a");
+    seedActiveListing(SITE_B, "on-site-b");
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/public?siteKey=${KEY_A}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    const slugs = (res.json() as { data: Array<{ slug: string }> }).data.map((r) => r.slug);
+    expect(slugs).toEqual(["on-site-a"]);
+    // The read is scoped by the RESOLVED id, not by the key string.
+    expect(
+      (prisma.projectListing.findMany as jest.Mock).mock.calls[0][0].where.siteId,
+    ).toBe(SITE_A);
+  });
+
+  it("public: an unknown siteKey is a 400 `unknown_site_key` and reads no rows", async () => {
+    seedActiveListing(SITE_A, "on-site-a");
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/public?siteKey=pk-nobodys-site",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+});