create-ailk 0.1.0

package/templates/apps/api/src/routes/content/__tests__/get-page.test.ts

@@ -0,0 +1,141 @@
+/**
+ * @file get-page.test.ts
+ * GET /api/content/:type/:slug — single page with resolved JSON-LD.
+ *
+ * Uses the real content adapter backed by a per-test temp dir (Issue #507).
+ * No internal module mocks — the route exercises the real adapter stack.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
+import { contentRoutes } from "../index";
+
+const fixture = setupContentFixture();
+
+describe("GET /api/content/:type/:slug", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns the page with resolved JSON-LD at the document root", async () => {
+    // The fixture writes "home" HomePage in beforeEach by default.
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage/home",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body["@context"]).toBe("https://schema.org");
+    // HomePage composes a Home/Landing @graph (WebPage spine + Organization +
+    // WebSite siblings) — #2618. The page-level fields live on the spine.
+    const graph = body["@graph"] as Array<Record<string, unknown>>;
+    expect(graph.map((n) => n["@type"])).toEqual([
+      "WebPage",
+      "Organization",
+      "WebSite",
+    ]);
+    const spine = graph[0]!;
+    // title from fixture frontmatter: "HomePage home title"
+    expect(typeof spine.name).toBe("string");
+    expect(typeof spine.description).toBe("string");
+    expect(body.page).toMatchObject({
+      type: "HomePage",
+      slug: "home",
+    });
+  });
+
+  it("returns 404 when page is missing", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage/missing-slug",
+    });
+
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("returns 400 on unknown :type", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/Bogus/home",
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("includes publishedAt in ContentPageInput when page has publishedAt", async () => {
+    // Cover the `publishedAt !== undefined` branch.
+    await fixture.writeFixturePage(
+      "Product",
+      "dated-product",
+      {
+        type: "Product",
+        slug: "dated-product",
+        title: "Dated Product",
+        description: "An product with publishedAt",
+        publishedAt: "2024-01-15T00:00:00.000Z",
+      },
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/Product/dated-product",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body["@type"]).toBe("WebPage");
+    expect(body.mainEntity["@type"]).toBe("SoftwareApplication");
+    expect(body.page.publishedAt).toBe("2024-01-15T00:00:00.000Z");
+  });
+
+  it("includes updatedAt and image in ContentPageInput when page has both fields", async () => {
+    // Cover the `updatedAt !== undefined` and `image !== undefined` branches.
+    await fixture.writeFixturePage(
+      "Product",
+      "updated-product",
+      {
+        type: "Product",
+        slug: "updated-product",
+        title: "Updated Product",
+        description: "Has an image",
+        updatedAt: "2024-06-01T00:00:00.000Z",
+        image: "https://example.com/image.jpg",
+      },
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/Product/updated-product",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.page.updatedAt).toBe("2024-06-01T00:00:00.000Z");
+    expect(body.page.image).toBe("https://example.com/image.jpg");
+  });
+
+  it("includes schema in ContentPageInput when page has schema override", async () => {
+    // Cover the `schema !== undefined` branch.
+    // Note: schema is a JSON object in frontmatter; MDX frontmatter doesn't support
+    // nested objects directly — this test verifies the route reads the adapter response.
+    // Use the default fixture "test-product" Product page.
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/Product/test-product",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body["@type"]).toBe("WebPage");
+    expect(body.mainEntity["@type"]).toBe("SoftwareApplication");
+  });
+});

package/templates/apps/api/src/routes/content/__tests__/list-pages.test.ts

@@ -0,0 +1,122 @@
+/**
+ * @file list-pages.test.ts
+ * GET /api/content/:type — paginated list of pages.
+ *
+ * Uses the real content adapter backed by a per-test temp dir (Issue #507).
+ * No internal module mocks — the route exercises the real adapter stack.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
+import { contentRoutes } from "../index";
+
+const fixture = setupContentFixture();
+
+describe("GET /api/content/:type", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns 200 with paginated pages and JSON-LD ItemList envelope", async () => {
+    // Seed 3 additional pages so we have a predictable count.
+    await fixture.writeFixturePage("HomePage", "post-0", {
+      type: "HomePage",
+      slug: "post-0",
+      title: "HomePage post-0 title",
+      description: "HomePage post-0 description",
+    });
+    await fixture.writeFixturePage("HomePage", "post-1", {
+      type: "HomePage",
+      slug: "post-1",
+      title: "HomePage post-1 title",
+      description: "HomePage post-1 description",
+    });
+    await fixture.writeFixturePage("HomePage", "post-2", {
+      type: "HomePage",
+      slug: "post-2",
+      title: "HomePage post-2 title",
+      description: "HomePage post-2 description",
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body["@context"]).toBe("https://schema.org");
+    expect(body["@type"]).toBe("ItemList");
+    expect(body.type).toBe("HomePage");
+    expect(Array.isArray(body.items)).toBe(true);
+    // The fixture writes a default "home" page in beforeEach plus the 3 above.
+    expect(body.items.length).toBeGreaterThanOrEqual(3);
+    expect(body.pagination).toMatchObject({
+      page: 1,
+      pageSize: 20,
+    });
+  });
+
+  it("paginates results — page=2 with pageSize=1 returns the second item", async () => {
+    // The fixture's default "home" HomePage page is always present.
+    // Write one more so there are at least 2.
+    await fixture.writeFixturePage("HomePage", "extra-page", {
+      type: "HomePage",
+      slug: "extra-page",
+      title: "Extra Page",
+      description: "An extra page for pagination test",
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage?page=2&pageSize=1",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.items).toHaveLength(1);
+    expect(body.pagination).toMatchObject({
+      page: 2,
+      pageSize: 1,
+    });
+  });
+
+  it("caps pageSize at 100", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage?pageSize=500",
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.pagination.pageSize).toBe(100);
+  });
+
+  it("returns 400 on unknown :type", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/NotARealType",
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = JSON.parse(res.body);
+    expect(body.error).toBeDefined();
+  });
+
+  it("returns 400 when page is non-numeric", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/content/HomePage?page=foo",
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+});

package/templates/apps/api/src/routes/content/__tests__/list-types.test.ts

@@ -0,0 +1,44 @@
+/**
+ * @file list-types.test.ts
+ * GET /api/content/types — return supported page types.
+ */
+import type { FastifyInstance } from "fastify";
+
+import { contentRoutes } from "../index";
+
+describe("GET /api/content/types", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns 200 with the canonical schema.org page types", async () => {
+    const res = await app.inject({ method: "GET", url: "/v1/content/types" });
+
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body["@context"]).toBe("https://schema.org");
+    expect(body["@type"]).toBe("ItemList");
+    expect(Array.isArray(body.types)).toBe(true);
+    expect(body.types).toEqual(
+      expect.arrayContaining([
+        "HomePage",
+        "AboutPage",
+        "Product",
+        "Service",
+        "ContactPage",
+      ]),
+    );
+  });
+
+  it("emits application/json content-type", async () => {
+    const res = await app.inject({ method: "GET", url: "/v1/content/types" });
+    expect(res.headers["content-type"]).toMatch(/application\/json/);
+  });
+});

package/templates/apps/api/src/routes/content/__tests__/locale.test.ts

@@ -0,0 +1,118 @@
+/**
+ * @file locale.test.ts
+ * Phase 3 S3 — locale query parameter on content read routes.
+ *
+ * Validates:
+ * - GET /v1/content/:type/:slug?locale=en (back-compat)
+ * - GET /v1/content/:type/:slug?locale=zz (silent fallback per AC-i18n-07)
+ * - GET /v1/content/:type/:slug?locale=../../etc/passwd (defense-in-depth)
+ * - GET /v1/content/:type/:slug (absent locale → default)
+ * - GET /v1/content/:type?locale=en (list — back-compat)
+ * - GET /v1/content/:type?locale=zz (list — silent fallback)
+ *
+ * Uses the real content adapter backed by a per-test temp dir; pages are
+ * written to <root>/<type>/<slug>.mdx (legacy non-prefixed layout). The
+ * adapter falls back to that layout for default-locale reads (per S1
+ * contract), so existing fixtures load identically through the locale code
+ * path.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
+import { contentRoutes } from "../index";
+
+const fixture = setupContentFixture();
+
+describe("content routes — locale query parameter (Phase 3 S3)", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe("GET /v1/content/:type/:slug", () => {
+    it("returns the page when ?locale=en (back-compat with explicit default)", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/content/HomePage/home?locale=en",
+      });
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.page.slug).toBe("home");
+    });
+
+    it("falls back to default-locale page when ?locale=zz (unknown locale)", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/content/HomePage/home?locale=zz",
+      });
+      // AC-i18n-07: silent fallback; same 200 response, default-locale page.
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.page.slug).toBe("home");
+    });
+
+    it("falls back to default-locale page when ?locale contains path traversal", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url:
+          "/v1/content/HomePage/home?locale=" +
+          encodeURIComponent("../../etc/passwd"),
+      });
+      // Defense-in-depth at the API boundary: locale not in allowlist →
+      // silent fallback, no traversal reaches the adapter (which has its own
+      // regex check as defense-in-depth).
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.page.slug).toBe("home");
+    });
+
+    it("returns the page without ?locale (absent → default)", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/content/HomePage/home",
+      });
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.page.slug).toBe("home");
+    });
+  });
+
+  describe("GET /v1/content/:type", () => {
+    it("returns the list when ?locale=en (back-compat)", async () => {
+      await fixture.writeFixturePage("HomePage", "loc-en", {
+        type: "HomePage",
+        slug: "loc-en",
+        title: "loc en title",
+        description: "loc en desc",
+      });
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/content/HomePage?locale=en",
+      });
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body["@type"]).toBe("ItemList");
+      expect(
+        body.items.some((p: { slug: string }) => p.slug === "loc-en"),
+      ).toBe(true);
+    });
+
+    it("falls back when ?locale=zz (silent default-locale)", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/content/HomePage?locale=zz",
+      });
+      // Falls back to default-locale list — same shape as no-locale call.
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body["@type"]).toBe("ItemList");
+    });
+  });
+});

package/templates/apps/api/src/routes/content/__tests__/rate-limit.test.ts

@@ -0,0 +1,51 @@
+/**
+ * @file rate-limit.test.ts
+ * Verifies the content API enforces a 60 req/min/IP unauth rate limit.
+ *
+ * Uses the real content adapter backed by a per-test temp dir (Issue #507).
+ * No internal module mocks.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
+import { contentRoutes } from "../index";
+import { CONTENT_RATE_LIMIT_UNAUTH } from "../rate-limit";
+
+setupContentFixture();
+
+describe("Content API rate limiting", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    app = require("fastify")();
+    const rateLimit = require("@fastify/rate-limit");
+    await app.register(rateLimit, {
+      max: CONTENT_RATE_LIMIT_UNAUTH,
+      timeWindow: "1 minute",
+      keyGenerator: () => "shared-test-ip",
+    });
+    await app.register(contentRoutes);
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns 429 once unauth requests exceed the per-minute limit", async () => {
+    expect(CONTENT_RATE_LIMIT_UNAUTH).toBe(60);
+
+    // Burn through the allowance.
+    for (let i = 0; i < CONTENT_RATE_LIMIT_UNAUTH; i++) {
+      const ok = await app.inject({ method: "GET", url: "/v1/content/types" });
+      expect(ok.statusCode).toBe(200);
+    }
+
+    // The next request crosses the threshold.
+    const overLimit = await app.inject({
+      method: "GET",
+      url: "/v1/content/types",
+    });
+    expect(overLimit.statusCode).toBe(429);
+  });
+});