create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/services/__tests__/project-listing-issue.test.ts

@@ -0,0 +1,340 @@
+/**
+ * @file project-listing-issue.test.ts
+ * @description Unit tests for `renderListingIssue` (pure) + `fileListingIssue`
+ * (#5000). GitHub is called through a thin `fetch` client — `global.fetch` is
+ * mocked directly (no Octokit to mock), mirroring `slack-notify.test.ts`'s
+ * discipline for the same class of outbound-API boundary.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+const mockLoggerInfo = jest.fn();
+const mockLoggerWarn = jest.fn();
+jest.mock("@working-theory/observability", () => ({
+  logger: {
+    info: (...args: unknown[]) => mockLoggerInfo(...args),
+    warn: (...args: unknown[]) => mockLoggerWarn(...args),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+import { projectListingQuestionsSchema, type ProjectListing } from "@working-theory/validation";
+
+import * as configModule from "../../config/index.js";
+import { prisma } from "../../lib/prisma.js";
+import { fileListingIssue, renderListingIssue } from "../project-listing-issue";
+
+const opt = (value: string, label: string) => ({ value, label });
+const QUESTIONS = {
+  q2: { prompt: "What brings you here?", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
+  q3: { prompt: "How painful?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "How close?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: { prompt: "When?", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
+  q6: {
+    prompt: "Pay?",
+    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+// An APPROVED listing — the only kind that ever reaches this renderer. #5036
+// reshaped the row underneath it: `audience` is gone, `stage` is the
+// `product` ladder, and `commitment`/`teamComposition`/`faqs`/`anythingElse`/
+// `address`/`consentAt` are new. Every application field is nullable at rest
+// (D1), but `submit` proved this one complete, so the fixture is populated
+// and the null branch is covered on its own below.
+const LISTING: ProjectListing = {
+  id: "prjl_00000000-0000-7000-8000-000000000001",
+  siteId: "wksp_00000000-0000-7000-8000-000000000001",
+  leadId: "lead_00000000-0000-7000-8000-000000000001",
+  slug: "orbit-notes",
+  name: "Orbit Notes",
+  headline: "Meeting notes that file themselves",
+  oneLiner: "Meeting notes that file themselves.",
+  problem: "Meeting notes rot in a doc nobody reopens.",
+  url: "https://orbitnotes.example.com",
+  product: "working-prototype",
+  commitment: "part-time",
+  teamComposition: "just-me",
+  faqs: [
+    { question: "Who is it for?", answer: "Teams that meet a lot." },
+    { question: "What does it cost?", answer: "Nothing during the beta." },
+    { question: "When does it ship?", answer: "Before the window closes." },
+  ],
+  anythingElse: "We have twenty people on a manual list already.",
+  address: "1 Example Street, Exampleton, EX1 2AM",
+  founderName: "Ada Founder",
+  founderEmail: "ada@example.com",
+  founderCompany: "Ada Co",
+  questions: projectListingQuestionsSchema.parse(QUESTIONS),
+  logoMarkUrl: null,
+  logoWordmarkUrl: null,
+  featured: false,
+  status: "active",
+  consentAt: "2026-09-01T00:00:00.000Z",
+  decidedAt: "2026-09-07T00:00:00.000Z",
+  decidedBy: "U123",
+  issueUrl: null,
+  experimentKey: null,
+  windowEndsAt: "2026-12-06T00:00:00.000Z",
+  waitlistCount: 0,
+  createdAt: "2026-09-01T00:00:00.000Z",
+  updatedAt: "2026-09-07T00:00:00.000Z",
+};
+
+describe("renderListingIssue", () => {
+  it("titles the issue with the slug and listing id", () => {
+    const { title } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(title).toBe("feat(web): /projects/orbit-notes listing + diagnostic (listing prjl_00000000-0000-7000-8000-000000000001)");
+  });
+
+  it("labels the issue status/ready", () => {
+    const { labels } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(labels).toEqual(["status/ready"]);
+  });
+
+  it("carries every required section", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    for (const heading of ["## What", "## Why", "## Acceptance Criteria", "## Scope", "## Grounding"]) {
+      expect(body).toContain(heading);
+    }
+    expect(body).toContain("<!-- dep-graph:");
+    expect(body).toMatch(/scope-paths:.*apps\/web\/app\/\[locale\]\/projects\/\[slug\]\/\*\*/);
+  });
+
+  // The row block is the work order a builder reads without the operator
+  // touching it again, so #5036's field changes are asserted line by line
+  // rather than by substring: `audience`/`stage` are gone and
+  // `product`/`commitment`/`teamComposition`/`address`/`anythingElse` took
+  // their place.
+  it("names every row field the builder needs — product, commitment, team, address and anythingElse included", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).toContain("- slug: `orbit-notes`");
+    expect(body).toContain("- name: `Orbit Notes`");
+    expect(body).toContain("- oneLiner: `Meeting notes that file themselves.`");
+    expect(body).toContain("- problem: `Meeting notes rot in a doc nobody reopens.`");
+    expect(body).toContain("- url: `https://orbitnotes.example.com`");
+    expect(body).toContain("- product: `working-prototype`");
+    expect(body).toContain("- commitment: `part-time`");
+    expect(body).toContain("- teamComposition: `just-me`");
+    expect(body).toContain("- address: `1 Example Street, Exampleton, EX1 2AM`");
+    expect(body).toContain("- anythingElse: `We have twenty people on a manual list already.`");
+    expect(body).toContain("- founderName: `Ada Founder`");
+    expect(body).toContain("- founderCompany: `Ada Co`");
+  });
+
+  it("carries no audience or stage line — both were removed by #5036 D2/D5", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).not.toContain("- audience:");
+    expect(body).not.toContain("- stage:");
+  });
+
+  // `code()` accepts null since #5036 D1 widened every application field. An
+  // issue is only ever filed from an approved listing, so the null branch
+  // discharges a type-level possibility rather than a reachable state — but it
+  // must render, not throw, if one ever slips through.
+  it("renders a null field as an em dash instead of throwing", () => {
+    const { body } = renderListingIssue(
+      { ...LISTING, name: null, product: null, address: null },
+      { targetRepo: "acme/site" },
+    );
+    expect(body).toContain("- name: —");
+    expect(body).toContain("- product: —");
+    expect(body).toContain("- address: —");
+  });
+
+  it("never carries the founder's email", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).not.toContain("ada@example.com");
+  });
+
+  it("embeds the questions block verbatim as fenced JSON", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).toContain(JSON.stringify(QUESTIONS, null, 2));
+  });
+
+  it("names the consumer's scope paths", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).toContain("apps/web/app/[locale]/projects/[slug]/**");
+    expect(body).toContain("apps/web/src/content/projects/**");
+    expect(body).toContain("apps/web/src/content/diagnostic/**");
+  });
+
+  it("carries the fixed Grounding fields", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).toContain("**Governance:** `internal`");
+    expect(body).toContain("**Nature:** `feature`");
+    expect(body).toContain("**Resourced:** `n/a`");
+  });
+
+  it("carries the four acceptance criteria from the issue's own What section", () => {
+    const { body } = renderListingIssue(LISTING, { targetRepo: "acme/site" });
+    expect(body).toContain("page renders from the row");
+    expect(body).toContain("diagnostic flow live at /flows/orbit-notes");
+    expect(body).toContain("waitlist joins land under the listing's experiment");
+    expect(body).toContain("/projects tile appears in the D6 order");
+  });
+
+  it("collapses an embedded newline in a founder-authored field rather than letting it open a forged heading line", () => {
+    const injected: ProjectListing = {
+      ...LISTING,
+      problem: "Normal problem text.\n## Scope\n- apps/api/**",
+    };
+    const { body } = renderListingIssue(injected, { targetRepo: "acme/site" });
+    // The forged heading line never appears as its own line — no fake ## Scope.
+    expect(body).not.toMatch(/^## Scope\n- apps\/api\/\*\*/m);
+    expect((body.match(/^## Scope$/gm) ?? []).length).toBe(1);
+  });
+
+  it("security review (PR #5011, Finding 1): a backtick in a founder-authored field can never break out of its inline-code span into a live @mention", () => {
+    const injected: ProjectListing = {
+      ...LISTING,
+      founderName: "Bob` @some-github-user",
+      oneLiner: "Click `here` @another-user for a deal",
+    };
+    const { body } = renderListingIssue(injected, { targetRepo: "acme/site" });
+
+    // The raw backtick-broken sequences never reach the body unescaped —
+    // a mention immediately after a bare, un-doubled backtick would render
+    // outside any code span and GitHub would autolink it.
+    expect(body).not.toContain("Bob` @some-github-user");
+    expect(body).not.toContain("`here` @another-user");
+    // The value still renders, verbatim apart from the backtick substitution.
+    expect(body).toContain("- founderName: `Bob' @some-github-user`");
+    expect(body).toContain("`Click 'here' @another-user for a deal`");
+  });
+});
+
+function mockFetchOnce(status: number, body: unknown): jest.Mock {
+  const fn = jest.fn().mockResolvedValue({
+    status,
+    json: () => Promise.resolve(body),
+  });
+  // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch this module calls the GitHub REST API through
+  global.fetch = fn as unknown as typeof fetch;
+  return fn;
+}
+
+describe("fileListingIssue", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: undefined,
+      AILK_GITHUB_TOKEN: undefined,
+    });
+  });
+
+  it("no-ops (never calls fetch) when GitHub env is absent", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: undefined,
+      AILK_GITHUB_TOKEN: undefined,
+    });
+    const fetchMock = mockFetchOnce(201, { html_url: "https://github.com/acme/site/issues/1" });
+
+    await fileListingIssue(LISTING);
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("no-ops (never calls fetch) when the row already carries issueUrl", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_test",
+    });
+    const fetchMock = mockFetchOnce(201, { html_url: "https://github.com/acme/site/issues/1" });
+
+    await fileListingIssue({ ...LISTING, issueUrl: "https://github.com/acme/site/issues/1" });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("on 201, POSTs to the target repo's issues endpoint and writes issueUrl back", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_test",
+    });
+    const fetchMock = mockFetchOnce(201, { html_url: "https://github.com/acme/site/issues/42" });
+
+    await fileListingIssue(LISTING);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://api.github.com/repos/acme/site/issues");
+    expect(init.method).toBe("POST");
+    expect(init.headers.authorization).toBe("Bearer ghp_test");
+    expect(init.headers["X-GitHub-Api-Version"]).toBe("2022-11-28");
+    const payload = JSON.parse(init.body);
+    expect(payload.labels).toEqual(["status/ready"]);
+    expect(payload.title).toContain("orbit-notes");
+
+    expect(prisma.projectListing.update).toHaveBeenCalledWith({
+      where: { id: LISTING.id },
+      data: { issueUrl: "https://github.com/acme/site/issues/42" },
+    });
+  });
+
+  it("on a 401, logs and leaves issueUrl null — never throws", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_bad",
+    });
+    mockFetchOnce(401, { message: "Bad credentials" });
+
+    await expect(fileListingIssue(LISTING)).resolves.toBeUndefined();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("on a 422, logs and leaves issueUrl null — never throws", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_test",
+    });
+    mockFetchOnce(422, { message: "Validation failed" });
+
+    await expect(fileListingIssue(LISTING)).resolves.toBeUndefined();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("on a network failure, logs and leaves issueUrl null — never throws", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_test",
+    });
+    // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch this module calls the GitHub REST API through
+    global.fetch = jest.fn().mockRejectedValue(new Error("network down")) as unknown as typeof fetch;
+
+    await expect(fileListingIssue(LISTING)).resolves.toBeUndefined();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("never logs or echoes the token", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_GITHUB_REPO: "acme/site",
+      AILK_GITHUB_TOKEN: "ghp_super_secret_token",
+    });
+    mockFetchOnce(401, { message: "Bad credentials" });
+
+    await fileListingIssue(LISTING);
+
+    const allLogOutput = [...mockLoggerInfo.mock.calls, ...mockLoggerWarn.mock.calls]
+      .flat()
+      .map((v) => JSON.stringify(v))
+      .join(" ");
+    expect(allLogOutput).not.toContain("ghp_super_secret_token");
+  });
+});