create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -15,10 +15,30 @@
  * Telemetry failures are caught, logged, and do NOT change the response.
  *
  * Billing upsert (customer.created / checkout.session.completed):
- *   Lookup priority:
+ *   Billing-entity routing (org-scoped billing, #3601, spec D2): a checkout
+ *   carrying metadata.organizationId links the Organization (multi-tenant
+ *   module); absent → the existing User path (single-tenant), byte-for-byte.
+ *
+ *   Organization path (metadata.organizationId present):
+ *     1. Typed composite match already pointing at this org → idempotent no-op
+ *     2. Else link the target Organization (by id) billing fields
+ *
+ *   User path (no organizationId — unchanged):
  *     1. Typed composite match: (billingProvider="stripe", billingCustomerId=customer)
  *     2. Email fallback: User.findUnique({ where: { email } }) → update billing fields
  *     3. No match → 200 + warn log; no User row created (pre-signup state)
+ *
+ * Recommender purchase stamp (checkout.session.completed / .expired, #4838):
+ *   A session carrying metadata.flowCheckoutId (the FlowCheckout buyer row
+ *   #4841 opened it with) is stamped `completed` / `expired` by ONE guarded
+ *   `updateMany` on `{ id, status: "created" }` — the durable idempotency key
+ *   (D1): a replay, a restart between deliveries, or a late `expired` after a
+ *   `completed` all match zero rows and log `stale_or_unknown`. Runs BESIDE the
+ *   telemetry + billing tasks (D4), never instead of them; a charged/quoted
+ *   mismatch is logged, never reconciled by overwrite (D2). Always 200. A
+ *   `completed` session stamps only when `payment_status` is `"paid"` or
+ *   `"no_payment_required"` (a 100%-off promo code, #4862) — anything else
+ *   logs `outcome: "unpaid"` and leaves the row `created`.
  */
 import { track } from "@working-theory/analytics/server";
 import type { FastifyReply, FastifyRequest } from "fastify";
@@ -98,22 +118,30 @@ export const stripeWebhookHandler = async (
       const customer = event.data.object as {
         id: string;
         email?: string | null;
+        metadata?: Record<string, string> | null;
       };
-      await upsertBillingIdentity(request, {
-        customerId: customer.id,
-        email: customer.email ?? null,
-        eventIdPrefix,
-      });
+      // Billing-entity routing (spec D2): a multi-tenant checkout stamps the
+      // target Organization id in metadata.organizationId (an individual → their
+      // sentinel default org). Present → link the Organization; absent → the
+      // existing User path, byte-for-byte (single-tenant, degrade-clean).
+      const organizationId = customer.metadata?.["organizationId"] ?? null;
+      if (organizationId) {
+        await upsertOrgBillingIdentity(request, {
+          organizationId,
+          customerId: customer.id,
+          eventIdPrefix,
+        });
+      } else {
+        await upsertBillingIdentity(request, {
+          customerId: customer.id,
+          email: customer.email ?? null,
+          eventIdPrefix,
+        });
+      }
       break;
     }
     case "checkout.session.completed": {
-      const session = event.data.object as {
-        amount_total?: number | null;
-        currency?: string | null;
-        customer?: string | null;
-        customer_details?: { email?: string | null } | null;
-        metadata?: Record<string, string> | null;
-      };
+      const session = event.data.object as CheckoutSessionObject;
       const props = {
         amount: session.amount_total ?? undefined,
         currency: session.currency ?? undefined,
@@ -125,19 +153,47 @@ export const stripeWebhookHandler = async (
         eventIdPrefix,
       };
 
-      // Telemetry and billing upsert are independent — run in parallel.
-      await Promise.all([
-        fireTelemetryWithTimeout(request, "purchase-completed", props),
-        session.customer
-          ? upsertBillingIdentity(request, {
+      // Billing-entity routing (spec D2): metadata.organizationId → Organization
+      // path; absent → the existing User path, unchanged (single-tenant).
+      const organizationId = session.metadata?.["organizationId"] ?? null;
+      let billingTask: Promise<void> = Promise.resolve();
+      if (session.customer) {
+        billingTask = organizationId
+          ? upsertOrgBillingIdentity(request, {
+              organizationId,
               customerId: session.customer,
-              email: session.customer_details?.email ?? null,
               eventIdPrefix,
             })
-          : Promise.resolve(),
+          : upsertBillingIdentity(request, {
+              customerId: session.customer,
+              email: session.customer_details?.email ?? null,
+              eventIdPrefix,
+            });
+      }
+
+      // Telemetry, billing upsert and the recommender stamp are independent —
+      // run in parallel (the stamp is a no-op without metadata.flowCheckoutId).
+      await Promise.all([
+        fireTelemetryWithTimeout(request, "purchase-completed", props),
+        billingTask,
+        stampFlowCheckout(request, { session, eventIdPrefix, outcome: "completed" }),
       ]);
       break;
     }
+    case "checkout.session.expired": {
+      const session = event.data.object as CheckoutSessionObject;
+      if (!session.metadata?.["flowCheckoutId"]) {
+        // Not a recommender session — the same low-noise line the default
+        // arm emitted for this event before #4838 handled it.
+        request.log.info(
+          { eventType: event.type, eventIdPrefix },
+          "unhandled webhook event",
+        );
+        break;
+      }
+      await stampFlowCheckout(request, { session, eventIdPrefix, outcome: "expired" });
+      break;
+    }
     default:
       request.log.info(
         { eventType: event.type, eventIdPrefix },
@@ -149,6 +205,117 @@ export const stripeWebhookHandler = async (
   await reply.code(200).send({ received: true });
 };
 
+type CheckoutSessionObject = {
+  id?: string;
+  payment_status?: string | null;
+  amount_total?: number | null;
+  currency?: string | null;
+  customer?: string | null;
+  customer_details?: { email?: string | null } | null;
+  metadata?: Record<string, string> | null;
+};
+
+/**
+ * Stamp the recommender's FlowCheckout buyer row from a terminal Checkout
+ * Session event (#4838).
+ *
+ * The `status: "created"` guard on the update IS the idempotency key (D1):
+ * `count === 1` → stamped; `count === 0` → the row is already terminal, or the
+ * id is unknown — a warning, never a retry (Stripe would re-fire telemetry +
+ * billing on eventual success). A `completed` session whose
+ * `payment_status` is not `"paid"` logs `unpaid` and leaves the row `created`. A charged amount that differs from the quoted
+ * `amountMinor` is logged with both integers and the stamp proceeds (D2). Log
+ * lines carry only `eventIdPrefix`, an 8-char `flowCheckoutIdPrefix`, an
+ * `outcome`, and the two integers — never the email, customer id, or permalink.
+ *
+ * Never throws — the handler's "always 200 for a verified event" contract.
+ */
+async function stampFlowCheckout(
+  request: FastifyRequest,
+  {
+    session,
+    eventIdPrefix,
+    outcome,
+  }: { session: CheckoutSessionObject; eventIdPrefix: string; outcome: "completed" | "expired" },
+): Promise<void> {
+  const flowCheckoutId = session.metadata?.["flowCheckoutId"];
+  if (!flowCheckoutId) return;
+  const flowCheckoutIdPrefix = flowCheckoutId.substring(0, 8);
+
+  // A `completed` session is only a purchase once Stripe reports it paid, OR
+  // reports nothing was due (`no_payment_required` — a 100%-off promo code,
+  // #4862, still a Stripe-confirmed completion). A delayed-notification or
+  // genuinely unpaid completion leaves the row `created` (code + security
+  // review, PR #4855).
+  if (
+    outcome === "completed" &&
+    session.payment_status !== "paid" &&
+    session.payment_status !== "no_payment_required"
+  ) {
+    request.log.warn(
+      { eventIdPrefix, flowCheckoutIdPrefix, outcome: "unpaid" },
+      "flow checkout: completed session is not paid — not stamping",
+    );
+    return;
+  }
+
+  try {
+    if (outcome === "completed" && typeof session.amount_total === "number") {
+      const row = await prisma.flowCheckout.findUnique({
+        where: { id: flowCheckoutId },
+        select: { amountMinor: true },
+      });
+      if (row && row.amountMinor !== session.amount_total) {
+        request.log.warn(
+          {
+            eventIdPrefix,
+            flowCheckoutIdPrefix,
+            outcome: "amount_mismatch",
+            expected: row.amountMinor,
+            received: session.amount_total,
+          },
+          "flow checkout: charged amount differs from the quoted amount — stamping anyway",
+        );
+      }
+    }
+
+    const result = await prisma.flowCheckout.updateMany({
+      where: { id: flowCheckoutId, status: "created" },
+      data:
+        outcome === "completed"
+          ? {
+              status: "completed",
+              completedAt: new Date(),
+              stripeSessionId: session.id ?? null,
+              stripeCustomerId: session.customer ?? null,
+            }
+          : { status: "expired" },
+    });
+
+    if (result.count === 1) {
+      request.log.info(
+        { eventIdPrefix, flowCheckoutIdPrefix, outcome },
+        "flow checkout stamped",
+      );
+    } else {
+      request.log.warn(
+        { eventIdPrefix, flowCheckoutIdPrefix, outcome: "stale_or_unknown" },
+        "flow checkout: no created row matched — replay, late terminal event, or unknown id",
+      );
+    }
+  } catch (err) {
+    request.log.error(
+      {
+        eventIdPrefix,
+        flowCheckoutIdPrefix,
+        outcome: "stamp_failed",
+        errName: err instanceof Error ? err.name : "UnknownError",
+      },
+      "flow checkout stamp failed — continuing",
+    );
+  }
+}
+
 /**
  * Link User.billingProvider + User.billingCustomerId for a Stripe customer.
  *
@@ -221,6 +388,67 @@ async function upsertBillingIdentity(
   }
 }
 
+/**
+ * Link Organization.billingProvider + billingCustomerId for a Stripe customer
+ * (org-scoped billing, #3601, spec D2/D3). Called when a checkout carries
+ * metadata.organizationId — for a real org, or an individual's sentinel default
+ * Organization (orgs-of-one; AC2 — ONE billing path inside the module).
+ *
+ * Idempotent: a typed-composite match (billingProvider="stripe",
+ * billingCustomerId=customerId) already pointing at THIS org is a no-op on
+ * replay. Otherwise the target Organization (by id from checkout metadata) is
+ * linked.
+ *
+ * DB failures are caught and logged (never re-thrown) — a broken link must not
+ * make Stripe retry (which would re-fire analytics + billing on eventual
+ * success), matching the User-path contract above.
+ */
+async function upsertOrgBillingIdentity(
+  request: FastifyRequest,
+  {
+    organizationId,
+    customerId,
+    eventIdPrefix,
+  }: { organizationId: string; customerId: string; eventIdPrefix: string },
+): Promise<void> {
+  try {
+    const existingByBilling = await prisma.organization.findFirst({
+      where: {
+        billingProvider: "stripe",
+        billingCustomerId: customerId,
+      },
+    });
+
+    if (existingByBilling && existingByBilling.id === organizationId) {
+      request.log.info(
+        { eventIdPrefix },
+        "org billing identity already linked — idempotent no-op",
+      );
+      return;
+    }
+
+    await prisma.organization.update({
+      where: { id: organizationId },
+      data: {
+        billingProvider: "stripe",
+        billingCustomerId: customerId,
+      },
+    });
+    request.log.info(
+      { eventIdPrefix },
+      "org billing identity linked from checkout metadata.organizationId",
+    );
+  } catch (err) {
+    request.log.error(
+      {
+        eventIdPrefix,
+        error: err instanceof Error ? err.message : String(err),
+      },
+      "org billing identity upsert failed — continuing",
+    );
+  }
+}
+
 async function fireTelemetryWithTimeout(
   request: FastifyRequest,
   name: string,

package/templates/apps/api/src/routes/workspaces/__tests__/config-tenant-isolation.test.ts

@@ -0,0 +1,356 @@
+// oss: false
+/**
+ * @file config-tenant-isolation.test.ts
+ *
+ * THE ACCEPTANCE GATE for the workspace-scoped site-config write surface
+ * (STC-P4 / #3634): a member of Org A must not read or write Org B's site
+ * config (theme / identity / seo) by ANY route.
+ *
+ * Fixture: two orgs, alice = owner of org A (active wsA), bob = owner of org B
+ * (active wsB). The prisma mock HONORS where-clauses (workspace/membership
+ * compound key) and keeps a per-workspace in-memory config store so a PUT then
+ * GET round-trips — cross-tenant denials are additionally asserted by "config
+ * query never ran" (the guard 403s before any handler touches the model).
+ *
+ * Registration mirrors server.ts exactly: auth preHandler → nested scope
+ * { tenant guard → workspaceConfigRoutes }.
+ *
+ * SECURITY-SENSITIVE (tenant isolation for untrusted end-tenants) — see spec
+ * §5.3: this suite is the objective pass/fail record the mandatory
+ * `security-reviewer` verifies against.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn(), update: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    workspaceTheme: {
+      findUnique: jest.fn(),
+      upsert: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    workspaceSiteIdentity: {
+      findUnique: jest.fn(),
+      upsert: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    workspaceSEO: {
+      findUnique: jest.fn(),
+      upsert: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { workspaceConfigRoutes } from "../config.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
+const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
+const ORG_A = "org_00000000-0000-7000-8000-000000000aaa";
+const ORG_B = "org_00000000-0000-7000-8000-000000000bbb";
+
+// ── Fixture data ────────────────────────────────────────────────────────────
+
+const WORKSPACES = [
+  { id: WS_A, organizationId: ORG_A },
+  { id: WS_B, organizationId: ORG_B },
+];
+
+const MEMBERSHIPS = [
+  { organizationId: ORG_A, userId: "alice", role: "owner" },
+  { organizationId: ORG_B, userId: "bob", role: "owner" },
+];
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_alice: {
+    id: "sess_alice",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+  cookie_bob: {
+    id: "sess_bob",
+    userId: "bob",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+};
+
+// ── Valid config bodies (schema-conformant) ─────────────────────────────────
+
+const PALETTE = {
+  bg: "#ffffff",
+  bgMuted: "#f5f5f5",
+  surface: "#ffffff",
+  border: "#e5e5e5",
+  text: "#111111",
+  textMuted: "#666666",
+  primary: "#2563eb",
+  primaryFg: "#ffffff",
+  accent: "#9333ea",
+  accentFg: "#ffffff",
+  destructive: "#dc2626",
+  destructiveFg: "#ffffff",
+};
+
+const VALID_THEME = {
+  version: "1",
+  colors: { light: PALETTE, dark: PALETTE },
+  radius: { sm: "2px", md: "6px", lg: "12px" },
+  shadow: { sm: "0 1px 2px", md: "0 2px 4px", lg: "0 4px 8px" },
+  fonts: { display: "Inter", body: "Inter" },
+  lineHeight: { tight: "1.1", normal: "1.5", relaxed: "1.8" },
+  icon: { sm: "16px", md: "20px", lg: "24px" },
+  breakpoint: { sm: "640px", md: "768px", lg: "1024px", xl: "1280px" },
+  container: { sm: "640px", md: "768px", lg: "1024px", xl: "1280px" },
+};
+
+const VALID_IDENTITY = {
+  kind: "Organization",
+  name: "Acme",
+  url: "https://acme.example",
+};
+
+const VALID_SEO = { version: "1", description: "Acme site" };
+
+const CONFIG_CASES = [
+  { type: "theme", model: "workspaceTheme", valid: VALID_THEME },
+  { type: "identity", model: "workspaceSiteIdentity", valid: VALID_IDENTITY },
+  { type: "seo", model: "workspaceSEO", valid: VALID_SEO },
+] as const;
+
+// ── Where-clause-honoring mock wiring (stateful config store) ───────────────
+
+type Where = Record<string, unknown>;
+
+/** Per-model, per-workspaceId in-memory store so PUT→GET round-trips. */
+function installFixtureMocks(): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.session.update as jest.Mock).mockResolvedValue({});
+
+  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
+  );
+  // Genuinely multi-tenant (2 workspaces) — the single-tenant default-resolution
+  // branch (count() === 1) must never fire, so an unbound session keeps denying.
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
+
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({
+      where,
+    }: {
+      where: {
+        organizationId_userId?: { organizationId: string; userId: string };
+      };
+    }) => {
+      const key = where.organizationId_userId;
+      if (!key) return Promise.resolve(null);
+      return Promise.resolve(
+        MEMBERSHIPS.find(
+          (m) =>
+            m.organizationId === key.organizationId && m.userId === key.userId,
+        ) ?? null,
+      );
+    },
+  );
+
+  for (const { model } of CONFIG_CASES) {
+    const store = new Map<
+      string,
+      { id: string; workspaceId: string; data: unknown }
+    >();
+    const delegate = prisma[model];
+    (delegate.findUnique as jest.Mock).mockImplementation(
+      ({ where }: { where: { workspaceId?: string } }) =>
+        Promise.resolve(
+          where.workspaceId ? (store.get(where.workspaceId) ?? null) : null,
+        ),
+    );
+    (delegate.upsert as jest.Mock).mockImplementation(
+      ({
+        where,
+        create,
+        update,
+      }: {
+        where: { workspaceId: string };
+        create: { workspaceId: string; data: unknown };
+        update: { data: unknown };
+      }) => {
+        const existing = store.get(where.workspaceId);
+        const row = existing
+          ? { ...existing, data: update.data }
+          : {
+              id: `${model}_row`,
+              workspaceId: create.workspaceId,
+              data: create.data,
+            };
+        store.set(where.workspaceId, row);
+        return Promise.resolve(row);
+      },
+    );
+    (delegate.deleteMany as jest.Mock).mockImplementation(
+      ({ where }: { where: { workspaceId?: string } }) => {
+        const had = where.workspaceId ? store.has(where.workspaceId) : false;
+        if (where.workspaceId) store.delete(where.workspaceId);
+        return Promise.resolve({ count: had ? 1 : 0 });
+      },
+    );
+  }
+}
+
+// ── App assembly (mirrors server.ts registration order) ─────────────────────
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(async (scope) => {
+    await scope.register(tenantPreHandlerPlugin);
+    await scope.register(workspaceConfigRoutes);
+  });
+  await app.ready();
+  return app;
+}
+
+function cookieHeaders(
+  token: string,
+  mutating = false,
+): Record<string, string> {
+  return {
+    cookie: `better-auth.session_token=${token}`,
+    ...(mutating ? { origin: FRONTEND } : {}),
+  };
+}
+
+describe("site-config tenant isolation — cross-org read/write denied on every config route", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installFixtureMocks();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe.each(CONFIG_CASES)("$type", ({ type, model, valid }) => {
+    const own = `/v1/workspaces/${WS_A}/${type}`;
+    const foreign = `/v1/workspaces/${WS_B}/${type}`;
+    // The mocked delegate for this config type — jest's `expect` accepts the
+    // mock fns directly (matching the sibling tenant-isolation.test.ts pattern).
+    const delegate = prisma[model];
+
+    // AC-1 — own-workspace write then read round-trips; server-side scope only.
+    it("PUT own workspace with a valid body → 200 and GET returns the stored blob", async () => {
+      const put = await app.inject({
+        method: "PUT",
+        url: own,
+        headers: cookieHeaders("cookie_alice", true),
+        payload: valid,
+      });
+      expect(put.statusCode).toBe(200);
+      expect(put.json().ok).toBe(true);
+      expect(put.json().data).toEqual(valid);
+      // The upsert is scoped to the resolved workspace, never a body-supplied id.
+      expect(delegate.upsert).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { workspaceId: WS_A } }),
+      );
+
+      const get = await app.inject({
+        method: "GET",
+        url: own,
+        headers: cookieHeaders("cookie_alice"),
+      });
+      expect(get.statusCode).toBe(200);
+      expect(get.json().data).toEqual(valid);
+    });
+
+    // AC-4 — GET a not-yet-configured workspace → data: null (not 404).
+    it("GET an unconfigured workspace → { ok: true, data: null }", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: own,
+        headers: cookieHeaders("cookie_alice"),
+      });
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ ok: true, data: null });
+    });
+
+    // AC-3 — invalid body → 400, no upsert.
+    it("PUT with a schema-invalid body → 400 validation_failed, no upsert runs", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: own,
+        headers: cookieHeaders("cookie_alice", true),
+        payload: { bogus: true },
+      });
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.code).toBe("validation_failed");
+      expect(delegate.upsert).not.toHaveBeenCalled();
+    });
+
+    // AC-2 — cross-workspace READ denied, no config query runs.
+    it("GET a foreign workspace's config → 403, no config query runs", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: foreign,
+        headers: cookieHeaders("cookie_alice"),
+      });
+      expect(res.statusCode).toBe(403);
+      expect(delegate.findUnique).not.toHaveBeenCalled();
+    });
+
+    // AC-2 — cross-workspace WRITE denied, no config query runs.
+    it("PUT a foreign workspace's config → 403, no upsert runs", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: foreign,
+        headers: cookieHeaders("cookie_alice", true),
+        payload: valid,
+      });
+      expect(res.statusCode).toBe(403);
+      expect(delegate.upsert).not.toHaveBeenCalled();
+    });
+
+    // AC-2 — unauthenticated → 401.
+    it("GET without a session → 401", async () => {
+      const res = await app.inject({ method: "GET", url: own });
+      expect(res.statusCode).toBe(401);
+    });
+
+    // Grant path works for the other tenant too.
+    it("the owning tenant of the other org CAN write its own config", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: `/v1/workspaces/${WS_B}/${type}`,
+        headers: cookieHeaders("cookie_bob", true),
+        payload: valid,
+      });
+      expect(res.statusCode).toBe(200);
+      expect(delegate.upsert).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { workspaceId: WS_B } }),
+      );
+    });
+  });
+});