create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/server.ts

@@ -12,30 +12,140 @@
 import cors from '@fastify/cors';
 import rateLimit from '@fastify/rate-limit';
 import Fastify from 'fastify';
+import type { FastifyPluginAsync, FastifyPluginCallback } from 'fastify';
 
 import { config } from './config/index.js';
+import { isModuleEnabled } from './config/modules.js';
 import { registerErrorSerializer } from './lib/error-serializer.js';
 import { validateLeadCaptureDir } from './lib/lead-capture-store.js';
 import { assertSandboxKey } from './lib/stripe.js';
 import { authPreHandlerPlugin } from './middleware/auth.js';
-import { rateLimitMiddleware } from './middleware/rate-limit.js';
+import {
+  rateLimitMiddleware,
+  DEFAULT_PER_IP_PER_MINUTE_STRICT,
+} from './middleware/rate-limit.js';
 import { openapiRoutes } from './openapi/index.js';
+import { exampleAeoRoute, scoreAeoRoute } from './routes/aeo/index.js';
 import { tokenRoutes } from './routes/auth/tokens.js';
 import { userRoutes } from './routes/auth/user.js';
 import { checkoutRoutes } from './routes/checkout/index.js';
-import { contentRoutes } from './routes/content/index.js';
+import { getPageRoute } from './routes/content/get-page.js';
+import { listPagesRoute } from './routes/content/list-pages.js';
+import { listTypesRoute } from './routes/content/list-types.js';
 import {
   CONTENT_RATE_LIMIT_UNAUTH,
   CONTENT_RATE_LIMIT_WINDOW,
 } from './routes/content/rate-limit.js';
+import { deliverableDownloadRoute } from './routes/deliverables/index.js';
+import { flowCheckoutRoutes } from './routes/flow-checkouts/index.js';
+import { getFlowAggregateRoute, getFlowRoute, submitFlowStepRoute } from './routes/flows/index.js';
+import { checkoutRecommendationRoute, saveRecommendationRoute } from './routes/flows/recommender.js';
 import {
   leadCallbackRoute,
   leadSubmitRoute,
   leadSubscribeRoute,
 } from './routes/leads/index.js';
+import {
+  projectListingDraftPatchRoute,
+  projectListingMeRoute,
+  projectListingPublicRoute,
+  projectListingStartRoute,
+  projectListingSubmitRoute,
+} from './routes/project-listings/index.js';
+import { slackActionsRoute } from './routes/slack/index.js';
 import { registerTestAuthRoute, shouldMountTestAuth } from './routes/test/auth/session.js';
+import { waitlistSignupRoutes } from './routes/waitlist-signups/index.js';
 import { webhooksRoutes } from './routes/webhooks/index.js';
 
+/**
+ * Paid-module SLICE entry points, keyed by the export each branch needs
+ * (#5182).
+ *
+ * Every value here names a file the OSS strip removes. A shipping file may not
+ * name a stripped file in ANY import form (spec D1): `import()` defers
+ * EVALUATION, not RESOLUTION, so `tsc` resolves a string-literal specifier
+ * whether or not the `isModuleEnabled()` branch containing it can ever run. The
+ * ten literal `await import()` calls that used to sit at these call sites were
+ * therefore ten TS2307 errors on the public tree, and the static
+ * `./middleware/tenant.js` import was an eleventh — measured on a stripped
+ * tree, not argued.
+ *
+ * Reading the specifier from this table is what makes it non-literal at the
+ * call site, and that INDIRECTION — not the type of the value — is what defeats
+ * resolution. S1's `isModuleEnabled()` gate is unchanged and still decides
+ * whether the branch runs; `AILK_ENABLED_MODULES` unset still means every
+ * module on, so a default build registers exactly what it registered before.
+ *
+ * This mechanism is sound here because `apps/api` is a `tsc`-only surface with
+ * no bundler. It is NOT sound in `packages/ui`: webpack cannot statically
+ * analyse a non-literal `import()` either, and compiles it to an async context
+ * with no members, so the module silently fails to load on the tree that HAS
+ * it. See the note above the imports in `packages/ui/src/sections/SectionRenderer.tsx`.
+ *
+ * `./routes/project-listings/index.js` is deliberately absent: that barrel is a
+ * MIXED directory that ships (the free anonymous listing routes are registered
+ * from it statically at the top of this file), so its dynamic import at the
+ * tenant scope is a literal on purpose and resolves fine on both trees.
+ */
+const SLICE_PLUGIN_SPECIFIERS = {
+  workspaceContextRoutes: './routes/workspaces/index.js',
+  workspaceSessionRoutes: './routes/workspaces/index.js',
+  sessionRoutes: './routes/workspaces/sessions.js',
+  workspaceConfigRoutes: './routes/workspaces/config.js',
+  billingRoutes: './routes/billing/index.js',
+  waitlistExperimentRoutes: './routes/waitlist-experiments/index.js',
+  createPageRoute: './routes/content/create.js',
+  updatePageRoute: './routes/content/update.js',
+  deletePageRoute: './routes/content/delete.js',
+  listAvailabilityRoute: './routes/schedule/index.js',
+  getEventMetaRoute: './routes/schedule/index.js',
+  createBookingRoute: './routes/schedule/index.js',
+} satisfies Record<string, string>;
+
+type SlicePluginName = keyof typeof SLICE_PLUGIN_SPECIFIERS;
+
+/**
+ * Load one slice route plugin. Every entry above is a `FastifyPluginAsync`
+ * export, which is the cast's whole content — `import(nonLiteral)` yields
+ * `any`, so this boundary is the load-bearing line and names the exact shape
+ * rather than spreading `any` into `register()`.
+ *
+ * Throws rather than skipping if the export is missing: the branch only runs
+ * when the module is declared enabled, so an absent export is a build/packaging
+ * fault to surface at boot, not a condition to degrade through.
+ */
+async function sliceRoutePlugin(
+  name: SlicePluginName,
+): Promise<FastifyPluginAsync> {
+  const specifier: string = SLICE_PLUGIN_SPECIFIERS[name];
+  const mod = (await import(specifier)) as Record<
+    string,
+    FastifyPluginAsync | undefined
+  >;
+  const plugin = mod[name];
+  if (!plugin) {
+    throw new Error(`slice export ${name} missing from ${specifier}`);
+  }
+  return plugin;
+}
+
+/**
+ * The multi-tenant preHandler plugin — the one slice entry that is not a
+ * route plugin. `FastifyPluginCallback`, registered with no options
+ * (apps/api/src/middleware/tenant.ts:83).
+ */
+async function tenantPreHandlerSlicePlugin(): Promise<FastifyPluginCallback> {
+  const specifier: string = './middleware/tenant.js';
+  const mod = (await import(specifier)) as {
+    tenantPreHandlerPlugin?: FastifyPluginCallback;
+  };
+  const plugin = mod.tenantPreHandlerPlugin;
+  if (!plugin) {
+    throw new Error('slice export tenantPreHandlerPlugin missing from ' + specifier);
+  }
+  return plugin;
+}
+
 /**
  * Build Fastify server instance (for serverless or standalone)
  * @returns Configured Fastify instance ready for requests
@@ -51,8 +161,31 @@ export async function build() {
     assertSandboxKey(config.STRIPE_SECRET_KEY);
   }
 
+  // trustProxy: true (#4730) — the Vercel serverless handler
+  // (apps/api/api/index.ts) bridges every request through Fastify's
+  // `.inject()` rather than a real socket, so `req.socket.remoteAddress`
+  // (the trustProxy:false default) is a meaningless simulated value, not
+  // the caller's address. With trustProxy enabled, req.ip instead resolves
+  // from `X-Forwarded-For` (the header Vercel's own edge sets on every
+  // inbound request) via Fastify's built-in proxy-addr parsing — reading
+  // the LEFTMOST address in a multi-hop chain, i.e. the address farthest
+  // from this process. This is what lets the per-scope rate limiter
+  // (middleware/rate-limit.ts) key on a real visitor's IP instead of a
+  // constant fallback or a shared intermediary's egress IP (see the flows/
+  // leads/aeo/schedule scopes below).
+  //
+  // Trade-off: X-Forwarded-For is caller-suppliable to anyone hitting this
+  // API directly (there is no fixed, allowlistable upstream proxy — this
+  // API's actual "proxies" are arbitrary consumer web functions), so a
+  // direct caller can still spoof a fresh identity per request. Per-IP
+  // rate limiting on these anonymous surfaces is a best-effort abuse
+  // deterrent, not a hard security boundary; this trades a small amount of
+  // spoof-resistance for correctness on the overwhelmingly common path
+  // (server-action-forwarded traffic), which was previously broken for
+  // every caller.
   const server = Fastify({
     logger: true,
+    trustProxy: true,
   });
 
   // Register error serializer — maps internal exceptions to generic strings
@@ -60,9 +193,14 @@ export async function build() {
   // never reach the client. Full detail still goes to pino at error level.
   registerErrorSerializer(server);
 
-  // Register CORS — public read API + same-origin auth callers
+  // Register CORS — public read API + same-origin auth callers.
+  // With FRONTEND_URL unset: reflect any origin in dev/test (zero-config
+  // boot) but fail CLOSED in production — `origin: true` combined with
+  // `credentials: true` would let any website read credentialed responses
+  // (security review M1). `false` disables cross-origin access entirely;
+  // same-origin and non-browser callers are unaffected.
   await server.register(cors, {
-    origin: config.FRONTEND_URL || true,
+    origin: config.FRONTEND_URL || config.NODE_ENV !== 'production',
     credentials: true,
   });
 
@@ -99,6 +237,8 @@ export async function build() {
         contentList: 'GET /v1/content/:type',
         contentPage: 'GET /v1/content/:type/:slug',
         checkoutSessions: 'POST /v1/checkout/sessions',
+        billing: 'GET /v1/billing',
+        billingPortalSession: 'POST /v1/billing/portal-session',
       },
     };
   });
@@ -112,11 +252,88 @@ export async function build() {
     });
     await authScope.register(tokenRoutes);
     await authScope.register(userRoutes);
+
+    // Tenant-context routes (multi-tenant module) — auth only. They
+    // establish/inspect the active workspace, so the tenant guard does not
+    // apply to them; each enforces membership in the service layer.
+    // Module-conditional (S1, #5088): without the multi-tenant module there
+    // is no workspace concept to switch or inspect.
+    if (isModuleEnabled('multi-tenant')) {
+      await authScope.register(await sliceRoutePlugin('workspaceContextRoutes'));
+    }
+
+    // Respondent signup read (#4731) — auth only, NOT tenant-guarded: a
+    // respondent has no workspace membership and the tenant guard is
+    // default-deny. Identity is request.userId; the service re-checks
+    // User.emailVerified before any Lead read.
+    await authScope.register(waitlistSignupRoutes);
+
+    // Respondent checkouts read (#4984) — the same posture as the signup
+    // read above: auth only, NOT tenant-guarded. Identity is request.userId;
+    // the only join is the lead-promotion link (never an email match).
+    await authScope.register(flowCheckoutRoutes);
+
+    // The founder's OWN listings read (#5295) — the same posture again: auth
+    // only, NOT tenant-guarded, because a founder is not a workspace member
+    // and the tenant guard is default-deny. Identity is request.userId; the
+    // only join is the owner link (ProjectListing.ownerUserId, stamped by
+    // services/listing-promotion.ts), never an email match. The tenant-scoped
+    // listing routes below keep their owner|admin floor untouched — this route
+    // is additive, not a relaxation of that floor. Registered here rather than
+    // inside the multi-tenant scope so a founder can read their own rows on a
+    // build without the module; the static `/me` path takes router precedence
+    // over the tenant scope's parametric `/v1/project-listings/:id`, exactly as
+    // the already-shipped static `/v1/project-listings/public` does.
+    await authScope.register(projectListingMeRoute);
+
+    // Tenant-guarded domain routes (multi-tenant module) — the tenant
+    // preHandler (default-deny guard, see middleware/tenant.ts) runs after
+    // auth for every route in this inner scope. No domain handler executes
+    // without request.tenant, and without the multi-tenant module there is
+    // no tenant concept at all — the whole scope is module-conditional
+    // (S1, #5088), so an OSS build that excludes multi-tenant registers
+    // none of it.
+    if (isModuleEnabled('multi-tenant')) {
+      await authScope.register(async (tenantScope) => {
+        await tenantScope.register(await tenantPreHandlerSlicePlugin());
+        await tenantScope.register(await sliceRoutePlugin('workspaceSessionRoutes'));
+        await tenantScope.register(await sliceRoutePlugin('sessionRoutes'));
+        await tenantScope.register(await sliceRoutePlugin('workspaceConfigRoutes'));
+        // Org-billing routes (#3701) — org-scoped read + Stripe customer-portal.
+        await tenantScope.register(await sliceRoutePlugin('billingRoutes'));
+        // Waitlist operator-dashboard read API (#4665 D7, B0) — tenant-scoped
+        // list/comparison/signups reads over A1's waitlist-experiment rows.
+        await tenantScope.register(
+          await sliceRoutePlugin('waitlistExperimentRoutes'),
+        );
+        // Project-listings dashboard (#4998) — tenant-scoped list/get/patch
+        // over the founder's-application-row lifecycle.
+        const { projectListingTenantRoutes } = await import(
+          './routes/project-listings/index.js'
+        );
+        await tenantScope.register(projectListingTenantRoutes);
+      });
+    }
   });
 
   // Public routes — no auth required.
-  await server.register(contentRoutes);
+  await server.register(listTypesRoute);
+  await server.register(listPagesRoute);
+  await server.register(getPageRoute);
+  // Content-write routes (create/update/delete) — already Pro-tier gated at
+  // CALL time via requirePaidTier (apps/api/src/lib/require-paid-tier.ts);
+  // module-conditional at REGISTRATION too (S1, #5088) so an OSS build that
+  // excludes the content-write slice never wires the handler in at all. Not
+  // a MODULE_SLICES entry — see config/modules.ts.
+  if (isModuleEnabled('content-write')) {
+    await server.register(await sliceRoutePlugin('createPageRoute'));
+    await server.register(await sliceRoutePlugin('updatePageRoute'));
+    await server.register(await sliceRoutePlugin('deletePageRoute'));
+  }
   await server.register(checkoutRoutes);
+  // Deliverable download — a capability-token URL (#3961 D5); the token
+  // itself is the sole gate, so no auth preHandler applies.
+  await server.register(deliverableDownloadRoute);
 
   // Webhooks routes — raw-body parser scoped to this sub-router only so the
   // global JSON parser on all other routes is unaffected.
@@ -128,17 +345,100 @@ export async function build() {
         done(null, body);
       },
     );
+    // Slack's block_actions payload arrives as a urlencoded `payload` form
+    // field (#4999) — raw buffer here too, so the signature is verified over
+    // the EXACT bytes Slack signed, never a re-serialized parse.
+    webhooksScope.addContentTypeParser(
+      'application/x-www-form-urlencoded',
+      { parseAs: 'buffer' },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
     await webhooksScope.register(webhooksRoutes);
+    await webhooksScope.register(slackActionsRoute);
   });
 
-  // Leads routes — rate-limit middleware scoped to this sub-router
+  // Leads routes — rate-limit middleware scoped to this sub-router. Own
+  // default (10/min, pre-#4730) rather than inheriting the wider
+  // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was
+  // never meant to loosen abuse protection here).
   await server.register(async (leadsScope) => {
-    leadsScope.register(rateLimitMiddleware);
+    leadsScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+    });
     await leadsScope.register(leadSubmitRoute);
     await leadsScope.register(leadSubscribeRoute);
     await leadsScope.register(leadCallbackRoute);
+    // Project-listings anonymous surface (#4998, reshaped by #5036) — the
+    // three-operation draft lifecycle plus the public page-render read, all
+    // on the same rate-limited, identity-blind posture as the leads routes
+    // above.
+    //
+    // Do NOT read that rate limit as a bound on anonymous draft creation. It
+    // keys on `req.ip`, and `trustProxy` is on (see the note at the top of this
+    // file), so a caller reaching the API directly can vary
+    // `X-Forwarded-For` and get a fresh budget per request. That is a
+    // pre-existing property of the limiter, not of these routes; what these
+    // routes do is keep the cost of an unbounded call small — `start` writes
+    // one row and sends nothing, and the Lead write with its operator
+    // notification waits for `submit` (PR #5042 security review, finding 4).
+    await leadsScope.register(projectListingStartRoute);
+    await leadsScope.register(projectListingDraftPatchRoute);
+    await leadsScope.register(projectListingSubmitRoute);
+    await leadsScope.register(projectListingPublicRoute);
+  });
+
+  // Flows routes — anonymous surface; rate-limit middleware scoped to this
+  // sub-router, matching the leads scope above (#3956 D4 Clarifications:
+  // "follows whatever the existing anonymous /v1/leads/* routes do today").
+  // Keeps the wider, env-var-driven default (#4730 — see
+  // apps/api/src/routes/flows/README.md § Rate limit) — this is the ONE
+  // scope #4730's bump was actually sized for; unchanged by #5111.
+  await server.register(async (flowsScope) => {
+    flowsScope.register(rateLimitMiddleware);
+    await flowsScope.register(getFlowRoute);
+    await flowsScope.register(submitFlowStepRoute);
+    await flowsScope.register(getFlowAggregateRoute);
+    // The recommender's email-moment routes (#4841) — same anonymous,
+    // rate-limited posture as the three above.
+    await flowsScope.register(saveRecommendationRoute);
+    await flowsScope.register(checkoutRecommendationRoute);
+  });
+
+  // AEO score routes (#4666) — anonymous surface, same posture as the flows
+  // scope above: a waitlist respondent has no account. Rate-limited because
+  // each call fans out to the respondent's own site (an external fetch), the
+  // same reason the schedule scope below is rate-limited for a third party.
+  // Own default (10/min, pre-#4730) — see the leads scope's comment above
+  // (#5111, DEF-004).
+  await server.register(async (aeoScope) => {
+    aeoScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+    });
+    await aeoScope.register(scoreAeoRoute);
+    await aeoScope.register(exampleAeoRoute);
   });
 
+  // Schedule routes (#4416) — anonymous surface, same posture as the flows
+  // and leads scopes above: a prospect booking a call has no account, and the
+  // calLink in the request names the event, so there is no tenant scope to
+  // bind. Rate-limited because each call fans out to a third-party provider.
+  // Own default (10/min, pre-#4730) — see the leads scope's comment above
+  // (#5111, DEF-004). Module-conditional (S1, #5088): the scheduling module
+  // owns this whole route set, so an OSS build that excludes it registers
+  // neither the routes nor their imports.
+  if (isModuleEnabled('scheduling')) {
+    await server.register(async (scheduleScope) => {
+      scheduleScope.register(rateLimitMiddleware, {
+        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      });
+      await scheduleScope.register(await sliceRoutePlugin('listAvailabilityRoute'));
+      await scheduleScope.register(await sliceRoutePlugin('getEventMetaRoute'));
+      await scheduleScope.register(await sliceRoutePlugin('createBookingRoute'));
+    });
+  }
+
   // Test-auth route — triple-gated (NODE_ENV !== production AND
   // AILK_TEST_AUTH_ENABLED === 'true' AND AILK_TEST_AUTH_USER_ALLOWLIST
   // non-empty). When any gate fails, the route is never registered and