create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/tenant-isolation.test.ts

@@ -0,0 +1,566 @@
+// oss: false
+/**
+ * @file tenant-isolation.test.ts
+ *
+ * THE ACCEPTANCE GATE for the tenant-scoped project-listings routes (#4998
+ * AC2, AC3). Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
+ * tenantPreHandlerPlugin -> projectListingTenantRoutes`, mocked
+ * `lib/prisma.js`. Fixture sessions for: a site-A owner (sees only site A),
+ * a site-B admin (sees only site B; 404 on site A's listing id), a site-B
+ * member (403 on every route, before any read), a bearer token (403), no
+ * cookie (401). Every success body parses under `projectListingSchema`;
+ * `waitlistCount` joins on the listing's own `experimentKey` -> `WaitlistScore.count`
+ * — one hop since #5036 D6d, where it used to translate an `experimentId`
+ * through `WaitlistExperiment` first. The PATCH transition table is exercised
+ * exhaustively — every from->to pair (including #4999's one behavior change:
+ * a decision target on an already-decided listing is now a `200` idempotent
+ * no-op via the shared `decideListing`, not a `400`).
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { projectListingSchema } from "@working-theory/validation";
+
+// `services/project-listings.ts` imports `routeLead` from `lead-routing.js`
+// (used by the draft-submit path, not by these routes) at module scope, which
+// transitively imports `@working-theory/email` and `@working-theory/license`
+// — mocked here purely so that import chain resolves, mirroring
+// `routes/leads/__tests__/index.test.ts`'s discipline.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    projectListing: { findFirst: jest.fn(), findMany: jest.fn(), update: jest.fn(), updateMany: jest.fn() },
+    waitlistExperiment: { findMany: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { projectListingTenantRoutes } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const ORG_A = "org_00000000-0000-7000-8000-000000000001";
+const WS_A = "wksp_00000000-0000-7000-8000-000000000001";
+const ORG_B = "org_01991234-5678-7000-8000-0000000000bb";
+const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
+
+const WORKSPACES = [
+  { id: WS_A, organizationId: ORG_A },
+  { id: WS_B, organizationId: ORG_B },
+];
+
+const MEMBERSHIPS = [
+  { organizationId: ORG_A, userId: "alice", role: "owner" },
+  { organizationId: ORG_B, userId: "erin", role: "admin" },
+  { organizationId: ORG_B, userId: "carol", role: "member" },
+];
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_alice: {
+    id: "sess_alice",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+  cookie_erin: {
+    id: "sess_erin",
+    userId: "erin",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+  cookie_carol: {
+    id: "sess_carol",
+    userId: "carol",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+};
+
+const opt = (value: string, label: string) => ({ value, label });
+const QUESTIONS = {
+  q2: { prompt: "x", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
+  q3: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: { prompt: "x", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
+  q6: {
+    prompt: "x",
+    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
+  },
+  q7: { prompt: "x" },
+  extras: [],
+};
+
+const LISTING_A = "prjl_00000000-0000-7000-8000-0000000000a1";
+const LISTING_B = "prjl_00000000-0000-7000-8000-0000000000b1";
+/** The experiment KEY the listing stores since #5036 D6d — not an id. */
+const EXP_KEY_A = "exp-a";
+
+function makeRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: LISTING_A,
+    siteId: WS_A,
+    leadId: "lead_00000000-0000-7000-8000-000000000001",
+    slug: "my-project",
+    name: "My Project",
+    oneLiner: "A one-liner",
+    problem: "The problem",
+    url: null,
+    // #5036 D2/D5 — `audience` is gone, `stage` is the `product` ladder, and
+    // these five are what the page and tile render from.
+    product: "working-prototype",
+    commitment: "part-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Example Street, Exampleton, EX1 2AM",
+    questions: QUESTIONS,
+    founderName: "Ada Founder",
+    founderEmail: "ada@example.com",
+    founderCompany: null,
+    headline: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "requested",
+    // Stamped at `start`, never null (#5036 D1).
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: null,
+    decidedBy: null,
+    issueUrl: null,
+    // The experiment's KEY, not its id (#5036 D6d).
+    experimentKey: null,
+    windowDays: 21,
+    windowEndsAt: null,
+    slackChannel: null,
+    slackTs: null,
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+const ROWS = [
+  makeRow(),
+  makeRow({ id: LISTING_B, siteId: WS_B, slug: "other-project", founderEmail: "bob@example.com" }),
+];
+
+function installFixtureMocks(rows = ROWS): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
+  );
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { organizationId_userId?: { organizationId: string; userId: string } } }) => {
+      const key = where.organizationId_userId;
+      if (!key) return Promise.resolve(null);
+      return Promise.resolve(
+        MEMBERSHIPS.find((m) => m.organizationId === key.organizationId && m.userId === key.userId) ?? null,
+      );
+    },
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; status?: string; slug?: { startsWith: string } } }) =>
+      Promise.resolve(
+        rows.filter(
+          (r) =>
+            r.siteId === where.siteId &&
+            (where.status === undefined || r.status === where.status) &&
+            (where.slug === undefined || r.slug.startsWith(where.slug.startsWith)),
+        ),
+      ),
+  );
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string; siteId?: string } }) =>
+      Promise.resolve(rows.find((r) => r.id === where.id && r.siteId === where.siteId) ?? null),
+  );
+  (prisma.projectListing.update as jest.Mock).mockImplementation(
+    ({ where, data }: { where: { id: string }; data: Record<string, unknown> }) => {
+      const row = rows.find((r) => r.id === where.id);
+      if (!row) throw new Error("not found");
+      const updated = { ...row, ...data };
+      Object.assign(row, updated);
+      return Promise.resolve(updated);
+    },
+  );
+  // decideListing's guarded compare-and-swap write (#4999 security review) —
+  // only mutates a row when every `where` key matches (a `status: "requested"`
+  // mismatch, e.g. already decided, returns `{ count: 0 }` untouched).
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({
+      where,
+      data,
+    }: {
+      where: { id?: string; siteId?: string; status?: string };
+      data: Record<string, unknown>;
+    }) => {
+      const row = rows.find(
+        (r) =>
+          r.id === where.id &&
+          (where.siteId === undefined || r.siteId === where.siteId) &&
+          (where.status === undefined || r.status === where.status),
+      );
+      if (!row) return Promise.resolve({ count: 0 });
+      Object.assign(row, data);
+      return Promise.resolve({ count: 1 });
+    },
+  );
+  (prisma.waitlistExperiment.findMany as jest.Mock).mockResolvedValue([]);
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(async (scope) => {
+    await scope.register(tenantPreHandlerPlugin);
+    await scope.register(projectListingTenantRoutes);
+  });
+  await app.ready();
+  return app;
+}
+
+function cookieHeaders(token: string): Record<string, string> {
+  // `origin` satisfies the same-origin CSRF check the auth preHandler runs
+  // on non-GET cookie requests (middleware/auth.ts) — harmless on GET.
+  return { cookie: `better-auth.session_token=${token}`, origin: FRONTEND };
+}
+
+describe("project-listings — tenant isolation", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installFixtureMocks();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("a site-A owner sees only site A's listing", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.data).toHaveLength(1);
+    expect(body.data[0].id).toBe(LISTING_A);
+    expect(projectListingSchema.safeParse(body.data[0]).success).toBe(true);
+  });
+
+  it("a site-B admin sees only site B's listing", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: cookieHeaders("cookie_erin"),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.map((r: { id: string }) => r.id)).toEqual([LISTING_B]);
+  });
+
+  it("404s on the other site's listing id, indistinguishable from a genuinely-missing one", async () => {
+    const foreign = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_erin"),
+    });
+    expect(foreign.statusCode).toBe(404);
+
+    const missing = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/prjl_00000000-0000-7000-8000-00000000dead",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(missing.statusCode).toBe(404);
+    expect(missing.body).toBe(foreign.body);
+  });
+
+  it("400s on a malformed :id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/not-a-valid-id",
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("a site-B member gets 403 on every route, before any read", async () => {
+    const list = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: cookieHeaders("cookie_carol"),
+    });
+    expect(list.statusCode).toBe(403);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+
+    const patchRes = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_B}`,
+      headers: cookieHeaders("cookie_carol"),
+      payload: { status: "active" },
+    });
+    expect(patchRes.statusCode).toBe(403);
+  });
+
+  it("a bearer token gets 403 (no tenant binding)", async () => {
+    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+      id: "tok1",
+      userId: "erin",
+      expiresAt: null,
+      revokedAt: null,
+    });
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: { authorization: "Bearer tok_raw" },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("no cookie gets 401", async () => {
+    const res = await app.inject({ method: "GET", url: "/v1/project-listings" });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("GET :id includes waitlistCount joined on the listing's own experimentKey, in one hop", async () => {
+    installFixtureMocks([makeRow({ experimentKey: EXP_KEY_A })]);
+    (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(7);
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.waitlistCount).toBe(7);
+    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      where: { siteId: WS_A, experimentKey: EXP_KEY_A },
+    });
+    // #5036 D6d removed the id-to-key translation read entirely.
+    expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();
+  });
+
+  it("waitlistCount is 0 when experimentKey is unset", async () => {
+    installFixtureMocks([makeRow()]);
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+    });
+    expect(res.json().data.waitlistCount).toBe(0);
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+  });
+
+  // ── AC3 — the transition surface, exhaustively ───────────────────────────
+  //
+  // #5033 collapsed the lifecycle to five states with `closed` COMPUTED, so
+  // the transition table this suite used to walk has one row left:
+  // `requested -> active | rejected`. `approved -> live` and `live -> closed`
+  // no longer exist as concepts. The idempotent "second click" branch (#4999)
+  // is unchanged: a decision target on an already-decided row is `200` with
+  // the row untouched, not a `400`.
+  //
+  // The narrowing is deliberate and is what makes "nothing can write
+  // `closed`" structural: the patch body's enum does not contain it, so the
+  // request never reaches a service that could.
+
+  const STORED = ["draft", "requested", "rejected", "active"] as const;
+  const DECISION_TARGETS = ["active", "rejected"] as const;
+  const DECIDED = new Set<string>(["active", "rejected"]);
+
+  for (const from of STORED) {
+    for (const to of DECISION_TARGETS) {
+      if (from === "requested") {
+        it(`${from} -> ${to} is 200 (the one allowed transition)`, async () => {
+          installFixtureMocks([makeRow({ status: from })]);
+          const res = await app.inject({
+            method: "PATCH",
+            url: `/v1/project-listings/${LISTING_A}`,
+            headers: cookieHeaders("cookie_alice"),
+            payload: { status: to },
+          });
+          expect(res.statusCode).toBe(200);
+          expect(res.json().data.status).toBe(to);
+        });
+      } else if (DECIDED.has(from)) {
+        it(`${from} -> ${to} is 200 idempotent (already decided — #4999 second-click no-op), status stays '${from}'`, async () => {
+          // An already-`active` row needs the window `decideListing` stamped
+          // on it: since #5036 D6b a non-featured active row with no window in
+          // force reads `closed`, which would make this an assertion about the
+          // fail-closed branch rather than about idempotency.
+          installFixtureMocks([
+            makeRow({
+              status: from,
+              ...(from === "active" && {
+                windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+              }),
+            }),
+          ]);
+          const res = await app.inject({
+            method: "PATCH",
+            url: `/v1/project-listings/${LISTING_A}`,
+            headers: cookieHeaders("cookie_alice"),
+            payload: { status: to },
+          });
+          expect(res.statusCode).toBe(200);
+          expect(res.json().data.status).toBe(from);
+          // decideListing's guarded updateMany (`where` includes
+          // `status: "requested"`) is attempted but matches 0 rows, so the
+          // mock's own guard means it never mutated the row either.
+          expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
+            expect.objectContaining({ where: expect.objectContaining({ status: "requested" }) }),
+          );
+        });
+      } else {
+        it(`${from} -> ${to} is 400 (rejected)`, async () => {
+          installFixtureMocks([makeRow({ status: from })]);
+          const res = await app.inject({
+            method: "PATCH",
+            url: `/v1/project-listings/${LISTING_A}`,
+            headers: cookieHeaders("cookie_alice"),
+            payload: { status: to },
+          });
+          expect(res.statusCode).toBe(400);
+        });
+      }
+    }
+  }
+
+  // The invariant, at the route boundary: no request can store `closed`, and
+  // no request can reach the retired vocabulary either.
+  it.each(["closed", "draft", "requested", "applied", "approved", "live"])(
+    "400s a PATCH asking for status '%s', and writes nothing",
+    async (status) => {
+      installFixtureMocks([makeRow({ status: "requested" })]);
+      const res = await app.inject({
+        method: "PATCH",
+        url: `/v1/project-listings/${LISTING_A}`,
+        headers: cookieHeaders("cookie_alice"),
+        payload: { status },
+      });
+      expect(res.statusCode).toBe(400);
+      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
+    },
+  );
+
+  it("stamps decidedAt/decidedBy on requested -> active and requested -> rejected, from request.userId", async () => {
+    installFixtureMocks([makeRow({ status: "requested" })]);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: { status: "active" },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json().data;
+    expect(body.decidedBy).toBe("alice");
+    expect(body.decidedAt).not.toBeNull();
+  });
+
+  it("400s on an unknown body field", async () => {
+    installFixtureMocks([makeRow({ status: "requested" })]);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: { status: "active", decidedBy: "someone-else" },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("400s on an empty body", async () => {
+    installFixtureMocks([makeRow({ status: "requested" })]);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: {},
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  // ── #5033 — the featured flag, scoped to the tenant ─────────────────────
+
+  it("sets the featured flag on its own, scoped to the caller's site", async () => {
+    installFixtureMocks([makeRow({ status: "active" })]);
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_A}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: { featured: true },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.featured).toBe(true);
+    expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: expect.objectContaining({ siteId: WS_A }) }),
+    );
+  });
+
+  it("404s a featured write against a foreign listing id", async () => {
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_B}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: { featured: true },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("400s a PATCH trying to set the site's own config from the request body", async () => {
+    installFixtureMocks([makeRow({ status: "requested" })]);
+    for (const key of ["maxWindowDays", "defaultWindowDays", "featuredEnabled", "windowEndsAt"]) {
+      const res = await app.inject({
+        method: "PATCH",
+        url: `/v1/project-listings/${LISTING_A}`,
+        headers: cookieHeaders("cookie_alice"),
+        payload: { status: "active", [key]: 3000 },
+      });
+      expect(res.statusCode).toBe(400);
+    }
+  });
+
+  it("404s a PATCH on a foreign listing id", async () => {
+    const res = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/${LISTING_B}`,
+      headers: cookieHeaders("cookie_alice"),
+      payload: { status: "active" },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+});

package/templates/apps/api/src/routes/project-listings/get.ts

@@ -0,0 +1,70 @@
+// oss: false
+/**
+ * GET /v1/project-listings/:id
+ *
+ * Tenant-scoped single read (#4998 AC2). `:id` is validated with
+ * `zProjectListingId` (ADR-0031 rule 5) before any lookup — a malformed id is
+ * `400`, never reaches the service. A foreign or missing id is `404`,
+ * indistinguishable (the `waitlist-experiments` no-enumeration posture).
+ */
+import { zProjectListingId } from "@working-theory/ids";
+import { projectListingSchema } from "@working-theory/validation";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { z } from "zod";
+
+import { getProjectListing, PROJECT_LISTING_ROLES } from "../../services/project-listings.js";
+
+import { sendValidated } from "./respond.js";
+
+const paramsSchema = z.object({ id: zProjectListingId });
+
+function unauthorized(reply: FastifyReply) {
+  return reply.status(401).send({
+    ok: false,
+    error: { code: "unauthorized", message: "Authentication required" },
+  });
+}
+
+function forbidden(reply: FastifyReply) {
+  return reply.status(403).send({
+    ok: false,
+    error: { code: "forbidden", message: "Forbidden" },
+  });
+}
+
+function invalidParams(reply: FastifyReply) {
+  return reply.status(400).send({
+    ok: false,
+    error: { code: "validation_failed", message: "Invalid project listing id" },
+  });
+}
+
+function notFound(reply: FastifyReply) {
+  return reply.status(404).send({
+    ok: false,
+    error: { code: "not_found", message: "Project listing not found" },
+  });
+}
+
+export async function getProjectListingHandler(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  const tenant = request.tenant;
+  if (!tenant) return unauthorized(reply);
+  if (!PROJECT_LISTING_ROLES.has(tenant.role)) {
+    request.log.warn(
+      { method: request.method, path: request.url, status: 403 },
+      "[project-listings] get denied; insufficient role",
+    );
+    return forbidden(reply);
+  }
+
+  const parsedParams = paramsSchema.safeParse(request.params);
+  if (!parsedParams.success) return invalidParams(reply);
+
+  const result = await getProjectListing(tenant.workspaceId, parsedParams.data.id);
+  if (!result.ok) return notFound(reply);
+
+  return sendValidated(reply, projectListingSchema, result.value, "get");
+}