create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/services/__tests__/slack-notify.test.ts

@@ -0,0 +1,278 @@
+/**
+ * @file slack-notify.test.ts
+ * @description Unit tests for `postListingApplication` + `updateListingMessage`
+ * (#4999). Slack is called through a thin `fetch` client — `global.fetch` is
+ * mocked directly (no Slack SDK to mock).
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import * as configModule from "../../config/index.js";
+import { prisma } from "../../lib/prisma.js";
+import { postListingApplication, updateListingMessage } from "../slack-notify";
+
+// #5036 D2/D5 reshaped what reaches Slack: `audience` is gone (folded into
+// `oneLiner`'s guidance) and `stage` is the six-rung `product` ladder. Since
+// #5036 D1 every one of these is nullable at rest — a listing only reaches
+// Slack once SUBMITTED, so this fixture is the fully-populated shape and the
+// null branch is covered on its own below.
+const LISTING = {
+  id: "prjl_00000000-0000-7000-8000-000000000001",
+  name: "My Project",
+  oneLiner: "A one-liner",
+  problem: "The problem",
+  url: "https://example.com",
+  product: "working-prototype",
+  founderName: "Ada Founder",
+  founderCompany: "Ada Co",
+};
+
+function mockFetchOnce(body: unknown, ok = true): jest.Mock {
+  const fn = jest.fn().mockResolvedValue({
+    ok,
+    json: () => Promise.resolve(body),
+  });
+  // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch this module calls Slack through
+  global.fetch = fn as unknown as typeof fetch;
+  return fn;
+}
+
+describe("postListingApplication", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: undefined,
+      AILK_SLACK_CHANNEL_ID: undefined,
+    });
+  });
+
+  it("no-ops (never calls fetch) when Slack env is absent", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: undefined,
+      AILK_SLACK_CHANNEL_ID: undefined,
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+    await postListingApplication(LISTING);
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("posts a Block Kit message with Approve/Reject buttons carrying the listing id, and stamps slackChannel/slackTs on success", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    const fetchMock = mockFetchOnce({ ok: true, channel: "C123", ts: "1699999999.000100" });
+
+    await postListingApplication(LISTING);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://slack.com/api/chat.postMessage");
+    expect(init.headers.authorization).toBe("Bearer xoxb-test");
+    const body = JSON.parse(init.body);
+    expect(body.channel).toBe("C123");
+    const actionsBlock = body.blocks.find((b: { type: string }) => b.type === "actions");
+    expect(actionsBlock.elements).toHaveLength(2);
+    expect(actionsBlock.elements[0]).toMatchObject({ action_id: "listing_approve", value: LISTING.id });
+    expect(actionsBlock.elements[1]).toMatchObject({ action_id: "listing_reject", value: LISTING.id });
+
+    expect(prisma.projectListing.update).toHaveBeenCalledWith({
+      where: { id: LISTING.id },
+      data: { slackChannel: "C123", slackTs: "1699999999.000100" },
+    });
+  });
+
+  it("security review (PR #4999, Finding 1): escapes Slack mrkdwn special chars in every applicant-authored field — an anonymous applicant cannot inject a <!channel> mention or a masked <url|label> phishing link", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    const fetchMock = mockFetchOnce({ ok: true, channel: "C123", ts: "1" });
+
+    await postListingApplication({
+      ...LISTING,
+      oneLiner: "<!channel> urgent & unmissable, click <https://evil.example|here>",
+      problem: "<@U12345> please approve",
+      founderCompany: "Acme & Co <script>",
+      url: "https://example.com?a=1&b=2",
+    });
+
+    const [, init] = fetchMock.mock.calls[0];
+    const raw = init.body as string;
+    // The dangerous raw sequences never reach the outbound payload unescaped.
+    expect(raw).not.toContain("<!channel>");
+    expect(raw).not.toContain("<https://evil.example|here>");
+    expect(raw).not.toContain("<@U12345>");
+    expect(raw).not.toContain("Acme & Co <script>");
+    // The escaped forms are present instead.
+    expect(raw).toContain("&lt;!channel&gt;");
+    expect(raw).toContain("&lt;https://evil.example|here&gt;");
+    expect(raw).toContain("&lt;@U12345&gt;");
+    // The bare-ampersand case rode on `audience` before #5036 removed it; it
+    // now rides on `oneLiner`, so the `&` -> `&amp;` leg stays covered.
+    expect(raw).toContain("urgent &amp; unmissable");
+    expect(raw).toContain("Acme &amp; Co &lt;script&gt;");
+  });
+
+  // #5036 D1 made every application field nullable at rest, so
+  // `ProjectListingSlackInfo` had to widen with it. A null renders as an em
+  // dash rather than being asserted away: a `!` here would turn a data
+  // surprise into a crash inside a notifier that is contractually not allowed
+  // to throw.
+  it("renders a null name/oneLiner/problem/product as an em dash rather than throwing", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    const fetchMock = mockFetchOnce({ ok: true, channel: "C123", ts: "1" });
+
+    await expect(
+      postListingApplication({
+        ...LISTING,
+        name: null,
+        oneLiner: null,
+        problem: null,
+        product: null,
+      }),
+    ).resolves.toBeUndefined();
+
+    const [, init] = fetchMock.mock.calls[0];
+    const body = JSON.parse(init.body);
+    expect(body.blocks[0].text.text).toBe("—");
+    const fieldTexts = body.blocks[1].fields.map((f: { text: string }) => f.text);
+    expect(fieldTexts).toContain("*One-liner:*\n—");
+    expect(fieldTexts).toContain("*Problem:*\n—");
+    expect(fieldTexts).toContain("*Product:*\n—");
+  });
+
+  it("never throws and does not stamp the row when the Slack API returns ok: false", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    mockFetchOnce({ ok: false, error: "channel_not_found" });
+
+    await expect(postListingApplication(LISTING)).resolves.toBeUndefined();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+
+  it("never throws when fetch itself rejects", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch this module calls Slack through
+    global.fetch = jest.fn().mockRejectedValue(new Error("network down")) as unknown as typeof fetch;
+
+    await expect(postListingApplication(LISTING)).resolves.toBeUndefined();
+    expect(prisma.projectListing.update).not.toHaveBeenCalled();
+  });
+});
+
+describe("updateListingMessage", () => {
+  const decided = { ...LISTING, slackChannel: "C123", slackTs: "1699999999.000100" };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: undefined,
+    });
+  });
+
+  it("no-ops (never calls fetch) when Slack env is absent", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: undefined,
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+    await updateListingMessage(decided, "active", "Erin");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("no-ops when the row never got a slackChannel/slackTs (post skipped or failed)", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+    await updateListingMessage({ ...LISTING, slackChannel: null, slackTs: null }, "active", "Erin");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("calls chat.update against the SAME channel/ts, replacing the actions block with an outcome line", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+
+    await updateListingMessage(decided, "active", "Erin");
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://slack.com/api/chat.update");
+    const body = JSON.parse(init.body);
+    expect(body.channel).toBe("C123");
+    expect(body.ts).toBe("1699999999.000100");
+    expect(body.blocks.some((b: { type: string }) => b.type === "actions")).toBe(false);
+    const text = JSON.stringify(body.blocks);
+    expect(text).toContain("Approved by Erin");
+  });
+
+  it("renders a Rejected line for a reject outcome", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+
+    await updateListingMessage(decided, "rejected", "Erin");
+
+    const [, init] = fetchMock.mock.calls[0];
+    const body = JSON.parse(init.body);
+    const text = JSON.stringify(body.blocks);
+    expect(text).toContain("Rejected by Erin");
+  });
+
+  it("security review (PR #4999, Finding 4): escapes a Slack-supplied decidedByName before it enters the mrkdwn outcome line", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    const fetchMock = mockFetchOnce({ ok: true });
+
+    await updateListingMessage(decided, "active", "<!channel> Erin");
+
+    const [, init] = fetchMock.mock.calls[0];
+    const raw = init.body as string;
+    expect(raw).not.toContain("<!channel> Erin");
+    expect(raw).toContain("&lt;!channel&gt; Erin");
+  });
+
+  it("never throws when the Slack API call fails", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+    });
+    // eslint-disable-next-line no-restricted-syntax -- test double for the global fetch this module calls Slack through
+    global.fetch = jest.fn().mockRejectedValue(new Error("network down")) as unknown as typeof fetch;
+
+    await expect(updateListingMessage(decided, "active", "Erin")).resolves.toBeUndefined();
+  });
+});

package/templates/apps/api/src/services/__tests__/tenant-context-cascade.test.ts

@@ -0,0 +1,71 @@
+// oss: false
+/**
+ * @file tenant-context-cascade.test.ts
+ *
+ * Unit test for `deleteWorkspaceConfig` — the STC-P4 (#3634) service-layer
+ * delete-cascade HELPER (Option 1: helper only, no route/caller). Proves the
+ * cascade issues exactly three workspace-scoped `deleteMany` calls (theme,
+ * identity, seo) and removes ONLY the target workspace's rows (AC-STC-06).
+ *
+ * SECURITY-SENSITIVE (tenant isolation) — see spec §5.3: the mandatory
+ * `security-reviewer` verifies the cascade cannot delete another workspace's
+ * rows.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary; __mocks__/prisma.ts is the repo-standard test double.
+jest.mock("../../lib/prisma.js");
+
+import { prisma } from "../../lib/prisma.js";
+import { deleteWorkspaceConfig } from "../tenant-context";
+
+const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
+const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
+
+const CONFIG_MODELS = [
+  "workspaceTheme",
+  "workspaceSiteIdentity",
+  "workspaceSEO",
+] as const;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe("deleteWorkspaceConfig — workspace-scoped delete-cascade (#3634 Option 1)", () => {
+  it("issues exactly three deleteMany({ where: { workspaceId } }) — one per config table — scoped to the passed workspace", async () => {
+    for (const model of CONFIG_MODELS) {
+      (prisma[model].deleteMany as jest.Mock).mockResolvedValue({ count: 1 });
+    }
+
+    await deleteWorkspaceConfig(WS_A);
+
+    for (const model of CONFIG_MODELS) {
+      expect(prisma[model].deleteMany).toHaveBeenCalledTimes(1);
+      expect(prisma[model].deleteMany).toHaveBeenCalledWith({
+        where: { workspaceId: WS_A },
+      });
+    }
+  });
+
+  it("removes ONLY the target workspace's rows — a where-honoring store proves wsB is untouched", async () => {
+    // Seed both workspaces' rows in each model, delete wsA, assert wsB survives.
+    const stores = CONFIG_MODELS.map((model) => {
+      const store = new Set<string>([WS_A, WS_B]);
+      (prisma[model].deleteMany as jest.Mock).mockImplementation(
+        ({ where }: { where: { workspaceId?: string } }) => {
+          const had = where.workspaceId ? store.has(where.workspaceId) : false;
+          if (where.workspaceId) store.delete(where.workspaceId);
+          return Promise.resolve({ count: had ? 1 : 0 });
+        },
+      );
+      return store;
+    });
+
+    await deleteWorkspaceConfig(WS_A);
+
+    for (const store of stores) {
+      expect(store.has(WS_A)).toBe(false);
+      expect(store.has(WS_B)).toBe(true);
+    }
+  });
+});