create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/schedule/index.ts

@@ -0,0 +1,249 @@
+// oss: false
+/**
+ * Schedule route group (#4416).
+ *
+ * Routes:
+ *   GET  /v1/schedule/availability — open slots + DERIVED event meta
+ *   GET  /v1/schedule/event-meta   — DERIVED meta alone, for 1..n events (#4633)
+ *   POST /v1/schedule/book         — create a booking for one slot
+ *
+ * These two routes exist so the browser never holds a scheduling credential.
+ * `CAL_API_KEY` is read inside `services/scheduling/` and never leaves this
+ * process; the `booker` section calls these routes and nothing else.
+ *
+ * Anonymous, like the sibling `/v1/flows/*` and `/v1/leads/*` routes — a
+ * prospect booking a call has no account. The `calLink` in the request names
+ * the event, so there is no tenant scope to bind.
+ *
+ * MCP twins (API↔MCP parity, root CLAUDE.md): `list_availability`,
+ * `get_event_meta`, and `create_booking` in `apps/mcp/src/tools/`, all routed
+ * through `@working-theory/api-client` to these handlers.
+ *
+ * Envelope per apps/api/CLAUDE.md: `{ ok: true, data }` /
+ * `{ ok: false, error: { code, message } }`, never 200-with-ok:false.
+ */
+import {
+  calLinkSchema,
+  createBookingInputSchema,
+  getEventMetaInputSchema,
+  listAvailabilityInputSchema,
+  type SchedulingErrorKind,
+} from "@working-theory/validation";
+import type { FastifyPluginAsync, FastifyReply } from "fastify";
+
+import {
+  resolveSchedulingProvider,
+  type SchedulingError,
+} from "../../services/scheduling/index.js";
+
+const SCHEDULING_ERROR_STATUS: Record<SchedulingErrorKind, number> = {
+  invalid_input: 400,
+  not_configured: 503,
+  event_not_found: 404,
+  slot_unavailable: 409,
+  provider_error: 502,
+};
+
+/**
+ * Client-facing messages. The provider's own message is logged, never
+ * returned — an upstream error string can carry account detail, and
+ * apps/api/CLAUDE.md's "never leak" rule covers more than stack traces.
+ */
+const SCHEDULING_ERROR_MESSAGE: Record<SchedulingErrorKind, string> = {
+  invalid_input: "The scheduling request was not valid.",
+  not_configured: "Scheduling is not configured.",
+  event_not_found: "That booking link does not resolve to an event.",
+  slot_unavailable: "That time was just taken. Pick another.",
+  provider_error: "The scheduling provider could not be reached.",
+};
+
+function sendSchedulingError(reply: FastifyReply, kind: SchedulingErrorKind) {
+  return reply.status(SCHEDULING_ERROR_STATUS[kind]).send({
+    ok: false,
+    error: { code: kind, message: SCHEDULING_ERROR_MESSAGE[kind] },
+  });
+}
+
+/**
+ * The public booking page for a calLink — the degraded state's escape hatch.
+ *
+ * Built HERE rather than in the browser on purpose: the URL shape is provider
+ * knowledge, and the `booker` section is written against the seam, not against
+ * Cal. `SCHEDULING_PUBLIC_BASE_URL` lets a self-hosted Cal (or #4288's engine)
+ * supply its own host without any UI change.
+ */
+function publicBookingUrl(calLink: unknown): string | undefined {
+  if (typeof calLink !== "string") return undefined;
+  const parsed = calLinkSchema.safeParse(calLink);
+  if (!parsed.success) return undefined;
+  const base = (
+    process.env["SCHEDULING_PUBLIC_BASE_URL"] ?? "https://cal.com"
+  ).replace(/\/$/, "");
+  return `${base}/${parsed.data}`;
+}
+
+/**
+ * 503 + the provider's own booking page when one can be named. An
+ * unconfigured deploy is a first-class state, not a dead end: the section
+ * renders this as a link out rather than an apology.
+ */
+function sendNotConfigured(reply: FastifyReply, calLink: unknown) {
+  const fallbackUrl = publicBookingUrl(calLink);
+  return reply.status(SCHEDULING_ERROR_STATUS.not_configured).send({
+    ok: false,
+    error: {
+      code: "not_configured",
+      message: SCHEDULING_ERROR_MESSAGE.not_configured,
+      ...(fallbackUrl !== undefined ? { fallbackUrl } : {}),
+    },
+  });
+}
+
+/** PII-safe: log the kind + the provider's detail, never the attendee. */
+function logProviderFailure(
+  log: { warn: (obj: object, msg: string) => void },
+  route: string,
+  error: SchedulingError,
+) {
+  log.warn({ route, kind: error.kind, detail: error.message }, "scheduling failed");
+}
+
+export const listAvailabilityRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/schedule/availability", async (request, reply) => {
+    const provider = resolveSchedulingProvider();
+    if (!provider) {
+      return sendNotConfigured(
+        reply,
+        (request.query as Record<string, unknown> | undefined)?.["calLink"],
+      );
+    }
+
+    // Validate the RAW query against the .strict() schema so an unexpected
+    // parameter is rejected rather than silently dropped — the flows route's
+    // posture, applied to a query string.
+    const parsed = listAvailabilityInputSchema.safeParse(request.query);
+    if (!parsed.success) {
+      return reply.status(400).send({
+        ok: false,
+        error: {
+          code: "invalid_input",
+          message:
+            parsed.error.issues[0]?.message ??
+            SCHEDULING_ERROR_MESSAGE.invalid_input,
+        },
+      });
+    }
+
+    const result = await provider.listAvailability({
+      calLink: parsed.data.calLink,
+      from: parsed.data.from,
+      to: parsed.data.to,
+      ...(parsed.data.timeZone !== undefined
+        ? { timeZone: parsed.data.timeZone }
+        : {}),
+    });
+    if (!result.ok) {
+      logProviderFailure(request.log, "availability", result.error);
+      return sendSchedulingError(reply, result.error.kind);
+    }
+
+    return reply.send({ ok: true, data: result.value });
+  });
+};
+
+/**
+ * The meta-only read (#4633). A page of booking tiles calls THIS, never the
+ * availability read: rendering a title, duration, description, or price must
+ * not cost a slot-window fetch per tile. Fans out one provider meta read per
+ * requested link and answers all-or-nothing — a dead slug is an operator
+ * error to surface loudly, not a tile to drop silently.
+ *
+ * No `fallbackUrl` in the degraded state, unlike the availability route: that
+ * field names ONE event's public booking page, and this read is 1..n events.
+ */
+export const getEventMetaRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/schedule/event-meta", async (request, reply) => {
+    const provider = resolveSchedulingProvider();
+    if (!provider) {
+      return sendSchedulingError(reply, "not_configured");
+    }
+
+    const parsed = getEventMetaInputSchema.safeParse(request.query);
+    if (!parsed.success) {
+      return reply.status(400).send({
+        ok: false,
+        error: {
+          code: "invalid_input",
+          message:
+            parsed.error.issues[0]?.message ??
+            SCHEDULING_ERROR_MESSAGE.invalid_input,
+        },
+      });
+    }
+
+    const results = await Promise.all(
+      parsed.data.calLinks.split(",").map(async (calLink) => ({
+        calLink,
+        result: await provider.getEventMeta({ calLink }),
+      })),
+    );
+
+    const events = [];
+    for (const { calLink, result } of results) {
+      if (!result.ok) {
+        logProviderFailure(request.log, "event-meta", result.error);
+        return sendSchedulingError(reply, result.error.kind);
+      }
+      events.push({ calLink, event: result.value });
+    }
+
+    return reply.send({ ok: true, data: { events } });
+  });
+};
+
+export const createBookingRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.post("/v1/schedule/book", async (request, reply) => {
+    const provider = resolveSchedulingProvider();
+    if (!provider) {
+      return sendNotConfigured(
+        reply,
+        (request.body as Record<string, unknown> | undefined)?.["calLink"],
+      );
+    }
+
+    const parsed = createBookingInputSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return reply.status(400).send({
+        ok: false,
+        error: {
+          code: "invalid_input",
+          message:
+            parsed.error.issues[0]?.message ??
+            SCHEDULING_ERROR_MESSAGE.invalid_input,
+        },
+      });
+    }
+
+    const result = await provider.createBooking({
+      calLink: parsed.data.calLink,
+      start: parsed.data.start,
+      attendee: parsed.data.attendee,
+    });
+    if (!result.ok) {
+      logProviderFailure(request.log, "book", result.error);
+      return sendSchedulingError(reply, result.error.kind);
+    }
+
+    // PII-safe structured log — mirrors the leads route: no name, no email.
+    request.log.info(
+      {
+        calLink: parsed.data.calLink,
+        bookingId: result.value.bookingId,
+        start: result.value.start,
+      },
+      "booking created",
+    );
+
+    return reply.status(201).send({ ok: true, data: result.value });
+  });
+};

package/templates/apps/api/src/routes/slack/__tests__/actions.test.ts

@@ -0,0 +1,385 @@
+/**
+ * @file actions.test.ts
+ * @description Unit tests for `POST /v1/slack/actions` (#4999) — signature
+ * verification (valid, invalid, stale, missing, unconfigured) BEFORE any
+ * parse, then the decision path once and the idempotent second click.
+ *
+ * Mirrors `routes/webhooks/__tests__/stripe.test.ts`'s raw-body test-server
+ * discipline: a real Fastify instance with the SAME raw-buffer content-type
+ * parser override `server.ts`'s `webhooksScope` registers, so the signature
+ * is verified over the exact bytes, never a re-serialized parse.
+ *
+ * Runs the REAL `decideListing` / `sendListingDecisionEmail` /
+ * `updateListingMessage` (CONVENTIONS.md "no mocks of code you own") against
+ * mocked BOUNDARIES only: `lib/prisma.js` (DB), `@working-theory/email`
+ * (Resend), and `global.fetch` (the Slack Web API `slack-notify.ts` calls
+ * through).
+ */
+import { createHmac } from "node:crypto";
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockSendApproved = jest.fn();
+const mockSendRejected = jest.fn();
+jest.mock("@working-theory/email", () => ({
+  sendListingApprovedEmail: (...args: unknown[]) => mockSendApproved(...args),
+  sendListingRejectedEmail: (...args: unknown[]) => mockSendRejected(...args),
+}));
+
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+import * as configModule from "../../../config/index.js";
+import { prisma } from "../../../lib/prisma.js";
+import { slackActionsHandler } from "../actions";
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const SIGNING_SECRET = "test-signing-secret";
+const LISTING_ID = "prjl_00000000-0000-7000-8000-000000000001";
+const SITE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+
+const opt = (value: string, label: string) => ({ value, label });
+const QUESTIONS = {
+  q2: { prompt: "x", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
+  q3: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: { prompt: "x", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
+  q6: {
+    prompt: "x",
+    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
+  },
+  q7: { prompt: "x" },
+  extras: [],
+};
+
+function makeRow(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    id: LISTING_ID,
+    siteId: SITE_ID,
+    leadId: "lead_00000000-0000-7000-8000-000000000001",
+    slug: "my-project",
+    name: "My Project",
+    oneLiner: "A one-liner",
+    problem: "The problem",
+    url: null,
+    // #5036 D2/D5 — `audience` is gone, `stage` became the six-rung `product`
+    // ladder, and these five are the new columns the row carries.
+    product: "working-prototype",
+    commitment: "part-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Example Street, Exampleton, EX1 2AM",
+    questions: QUESTIONS,
+    founderName: "Ada Founder",
+    founderEmail: "ada@example.com",
+    founderCompany: null,
+    headline: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "requested",
+    // Stamped at `start`, never null (#5036 D1).
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: null,
+    decidedBy: null,
+    issueUrl: null,
+    // The experiment's KEY, not its id (#5036 D6d).
+    experimentKey: null,
+    windowDays: 21,
+    windowEndsAt: null,
+    slackChannel: null,
+    slackTs: null,
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+function installListingMock(row: ReturnType<typeof makeRow> | null): void {
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string; siteId?: string } }) => {
+      if (!row || row.id !== where.id) return Promise.resolve(null);
+      if (where.siteId !== undefined && row.siteId !== where.siteId) return Promise.resolve(null);
+      return Promise.resolve(row);
+    },
+  );
+  // decideListing's guarded compare-and-swap write (#4999 security review) —
+  // only mutates `row` when every `where` key matches (a `status: "requested"`
+  // mismatch, e.g. already decided, returns `{ count: 0 }` untouched).
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({
+      where,
+      data,
+    }: {
+      where: { id: string; siteId?: string; status?: string };
+      data: Record<string, unknown>;
+    }) => {
+      if (!row || row.id !== where.id) return Promise.resolve({ count: 0 });
+      if (where.siteId !== undefined && row.siteId !== where.siteId) return Promise.resolve({ count: 0 });
+      if (where.status !== undefined && row.status !== where.status) return Promise.resolve({ count: 0 });
+      Object.assign(row, data);
+      return Promise.resolve({ count: 1 });
+    },
+  );
+  (prisma.waitlistExperiment.findMany as jest.Mock).mockResolvedValue([]);
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+}
+
+function mockFetchOk(): jest.Mock {
+  const fn = jest.fn().mockResolvedValue({
+    ok: true,
+    json: () => Promise.resolve({ ok: true }),
+  });
+  // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch slack-notify.ts calls Slack through
+  global.fetch = fn as unknown as typeof fetch;
+  return fn;
+}
+
+function sign(secret: string, timestamp: string, body: string): string {
+  const base = `v0:${timestamp}:${body}`;
+  return `v0=${createHmac("sha256", secret).update(base).digest("hex")}`;
+}
+
+function blockActionsBody(actionId: string, value: string, userId = "U123"): string {
+  const payload = {
+    type: "block_actions",
+    user: { id: userId, username: "erin" },
+    actions: [{ action_id: actionId, value }],
+  };
+  return `payload=${encodeURIComponent(JSON.stringify(payload))}`;
+}
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser(
+      "application/x-www-form-urlencoded",
+      { parseAs: "buffer" },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
+    webhooksScope.post("/v1/slack/actions", slackActionsHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+async function post(server: FastifyInstance, body: string, headers: Record<string, string>) {
+  return server.inject({
+    method: "POST",
+    url: "/v1/slack/actions",
+    payload: Buffer.from(body),
+    headers: { "content-type": "application/x-www-form-urlencoded", ...headers },
+  });
+}
+
+function signedHeaders(body: string, secret = SIGNING_SECRET, timestampSeconds?: number) {
+  const timestamp = String(timestampSeconds ?? Math.floor(Date.now() / 1000));
+  return {
+    "x-slack-request-timestamp": timestamp,
+    "x-slack-signature": sign(secret, timestamp, body),
+  };
+}
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe("POST /v1/slack/actions", () => {
+  let server: FastifyInstance;
+  const originalEnv = process.env;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    delete process.env["AILK_LEAD_NOTIFICATION_FROM"];
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_SIGNING_SECRET: SIGNING_SECRET,
+      AILK_SLACK_BOT_TOKEN: undefined,
+    });
+    mockSendApproved.mockResolvedValue({ ok: true, messageId: "msg-1" });
+    mockSendRejected.mockResolvedValue({ ok: true, messageId: "msg-2" });
+    mockFetchOk();
+    server = await buildTestServer();
+  });
+
+  afterEach(async () => {
+    await server.close();
+    process.env = originalEnv;
+    jest.restoreAllMocks();
+  });
+
+  // ── Signature verification — before any parse ───────────────────────────
+
+  it("returns 503 when AILK_SLACK_SIGNING_SECRET is not set", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_SIGNING_SECRET: undefined,
+    });
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const res = await post(server, body, signedHeaders(body));
+    expect(res.statusCode).toBe(503);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the signature is missing", async () => {
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const res = await post(server, body, { "x-slack-request-timestamp": timestamp });
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the timestamp is missing", async () => {
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const res = await post(server, body, {
+      "x-slack-signature": sign(SIGNING_SECRET, "1699999999", body),
+    });
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the signature does not match", async () => {
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const timestamp = String(Math.floor(Date.now() / 1000));
+    const res = await post(server, body, {
+      "x-slack-request-timestamp": timestamp,
+      "x-slack-signature": "v0=deadbeef",
+    });
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the timestamp is stale (older than 5 minutes) — even with an otherwise-valid signature", async () => {
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const staleSeconds = Math.floor(Date.now() / 1000) - 6 * 60;
+    const res = await post(server, body, signedHeaders(body, SIGNING_SECRET, staleSeconds));
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the signature was computed with the wrong secret", async () => {
+    installListingMock(makeRow());
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const res = await post(server, body, signedHeaders(body, "wrong-secret"));
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  // ── The decision path ────────────────────────────────────────────────────
+
+  it("a valid Approve click flips requested -> active, stamps decidedBy = the Slack user id, sets windowEndsAt, updates the Slack message, sends the approve email once, and replies 200 empty", async () => {
+    installListingMock(makeRow({ slackChannel: "C123", slackTs: "1699999999.000100" }));
+    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "noreply@example.com";
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_SIGNING_SECRET: SIGNING_SECRET,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    const fetchMock = mockFetchOk();
+
+    const body = blockActionsBody("listing_approve", LISTING_ID, "U777");
+    const res = await post(server, body, signedHeaders(body));
+
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toBe("");
+    expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ id: LISTING_ID, status: "requested" }),
+        data: expect.objectContaining({ status: "active", decidedBy: "U777" }),
+      }),
+    );
+    // Slack chat.update fired (the message was updated in place).
+    expect(fetchMock).toHaveBeenCalledWith(
+      "https://slack.com/api/chat.update",
+      expect.anything(),
+    );
+    // The approve email fired exactly once.
+    expect(mockSendApproved).toHaveBeenCalledTimes(1);
+    expect(mockSendRejected).not.toHaveBeenCalled();
+    expect(mockSendApproved.mock.calls[0][0].to).toBe("ada@example.com");
+  });
+
+  it("a valid Reject click flips requested -> rejected and sends the reject email once", async () => {
+    installListingMock(makeRow());
+    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "noreply@example.com";
+
+    const body = blockActionsBody("listing_reject", LISTING_ID, "U777");
+    const res = await post(server, body, signedHeaders(body));
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ id: LISTING_ID, status: "requested" }),
+        data: expect.objectContaining({ status: "rejected", decidedBy: "U777" }),
+      }),
+    );
+    expect(mockSendRejected).toHaveBeenCalledTimes(1);
+    expect(mockSendApproved).not.toHaveBeenCalled();
+  });
+
+  it("a second click on an already-decided listing is 200 with no state change and no email", async () => {
+    // The already-decided row carries the window `decideListing` stamped on
+    // it — since #5036 D6b a non-featured active row with no window in force
+    // reads `closed`, and this test is about the second-click no-op, not the
+    // fail-closed branch.
+    installListingMock(
+      makeRow({
+        status: "active",
+        decidedAt: new Date("2026-08-01T00:00:00.000Z"),
+        decidedBy: "U000",
+        windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+      }),
+    );
+    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "noreply@example.com";
+    const fetchMock = mockFetchOk();
+
+    const body = blockActionsBody("listing_approve", LISTING_ID, "U999");
+    const res = await post(server, body, signedHeaders(body));
+
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toBe("");
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(mockSendApproved).not.toHaveBeenCalled();
+    expect(mockSendRejected).not.toHaveBeenCalled();
+  });
+
+  it("an unknown listing id is still 200, no update, no email", async () => {
+    installListingMock(null);
+    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "noreply@example.com";
+
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const res = await post(server, body, signedHeaders(body));
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+    expect(mockSendApproved).not.toHaveBeenCalled();
+  });
+
+  it("a non-block_actions or malformed payload is 200 without touching the DB", async () => {
+    installListingMock(makeRow());
+    const body = "payload=" + encodeURIComponent(JSON.stringify({ type: "view_submission" }));
+    const res = await post(server, body, signedHeaders(body));
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("never carries founderEmail/founderName in the response body", async () => {
+    installListingMock(makeRow());
+    process.env["AILK_LEAD_NOTIFICATION_FROM"] = "noreply@example.com";
+    const body = blockActionsBody("listing_approve", LISTING_ID);
+    const res = await post(server, body, signedHeaders(body));
+    expect(res.body).not.toContain("ada@example.com");
+    expect(res.body).not.toContain("Ada Founder");
+  });
+});