create-ailk 0.1.1 → 0.2.0

package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts

@@ -52,8 +52,15 @@ jest.mock("@working-theory/license", () => ({
   }),
 }));
 
+import {
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+} from "@working-theory/validation";
+
 import { prisma } from "../../../lib/prisma.js";
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  MAX_CONSENT_KEYS, UNRECOVERABLE_CONSENT_STATEMENT } from "../../../services/consent.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
 import { startProjectListingRoute } from "../start.js";
 import { submitProjectListingRoute } from "../submit.js";
@@ -164,6 +171,11 @@ function installStore(): void {
     },
   );
 
+  // #5275 — `start` writes the row and its grant in one interactive
+  // transaction; the mock hands the same store-backed client through.
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
   (prisma.projectListing.create as jest.Mock).mockImplementation(
     ({ data }: { data: Row }) => {
       const now = new Date();
@@ -226,6 +238,12 @@ function installStore(): void {
       return Promise.resolve({ count: matched.length });
     },
   );
+
+  // #5275 — the grant write `start` now makes. Append-only, so the mock only
+  // needs to resolve; the start tests below assert on what it was called with.
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
 }
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
@@ -335,6 +353,115 @@ describe("the draft lifecycle (#5036 D1)", () => {
     expect(rows).toHaveLength(0);
   });
 
+  // ── start: the consent grant (#5275 D7/D11) ──
+
+  it.each([
+    ["DECLINES the required purpose", { service_terms: false }],
+    ["is EMPTY beside the literal", {}],
+    ["OMITS the required purpose", { marketing: true }],
+  ])(
+    "start: a consents map that %s is a 400 and creates no row and no grant",
+    async (_label, consents) => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, consents, locale: "en" },
+      });
+      expect(res.statusCode).toBe(400);
+      const body = res.json() as { ok: boolean; error: { code: string; message: string } };
+      expect(body.ok).toBe(false);
+      expect(body.error.code).toBe("invalid_input");
+      expect(body.error.message).toMatch(/service_terms/);
+      expect(rows).toHaveLength(0);
+      expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
+    },
+  );
+
+  it("start: a consents map with more than MAX_CONSENT_KEYS purposes is a 400", async () => {
+    const consents: Record<string, boolean> = { service_terms: true };
+    for (let i = 0; i < MAX_CONSENT_KEYS; i += 1) consents[`junk_${i}`] = true;
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, consents, locale: "en" },
+    });
+    expect(res.statusCode).toBe(400);
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: a grant write that fails takes the row with it — one transaction, no stranded listing", async () => {
+    (prisma.$transaction as jest.Mock).mockImplementation(
+      async (fn: (tx: typeof prisma) => Promise<unknown>) => {
+        const before = rows.length;
+        try {
+          return await fn(prisma);
+        } catch (err) {
+          rows.splice(before); // roll back the in-memory store
+          throw err;
+        }
+      },
+    );
+    (prisma.consentGrant.createMany as jest.Mock).mockRejectedValueOnce(new Error("db down"));
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, consents: { service_terms: true }, locale: "en" },
+    });
+    expect(res.statusCode).toBe(500);
+    expect(rows).toHaveLength(0);
+  });
+
+  it("start: a body carrying consents records one grant per purpose with the DEFAULT statement text", async () => {
+    const { id } = await startDraft(app, { consents: { service_terms: true }, locale: "en" });
+
+    // The expected wording is DERIVED from the registry the server resolves
+    // from, never retyped — the whole point is that the row carries the string
+    // the renderer showed, not a string this test happens to agree with.
+    const purpose = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!;
+    const { statement } = resolveConsentStatement(purpose, "en");
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
+      data: Row[];
+    };
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({
+      siteId: SITE_ID,
+      subjectType: "project_listing",
+      subjectId: id,
+      purposeId: "service_terms",
+      granted: true,
+      locale: "en",
+      statement,
+      statementHash: sha256(statement),
+    });
+    expect(data[0]!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
+    // The row's own consentAt is untouched by the grant write (spec §2.3).
+    expect(rows[0]!["consentAt"]).toBeInstanceOf(Date);
+  });
+
+  it("start: a body carrying only the legacy literal records ONE grant marked unrecoverable", async () => {
+    const { id } = await startDraft(app);
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const { data } = (prisma.consentGrant.createMany as jest.Mock).mock.calls[0]![0] as {
+      data: Row[];
+    };
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({
+      siteId: SITE_ID,
+      subjectType: "project_listing",
+      subjectId: id,
+      purposeId: "service_terms",
+      granted: true,
+      locale: "und",
+      statement: UNRECOVERABLE_CONSENT_STATEMENT,
+      statementHash: sha256(UNRECOVERABLE_CONSENT_STATEMENT),
+    });
+    // Never today's wording for a legacy call — that would fabricate evidence (D11).
+    expect(data[0]!["statement"]).not.toContain("You agree to being contacted");
+  });
+
   // ── patch ──
 
   it("patch: a SINGLE-field patch round-trips", async () => {

package/templates/apps/api/src/routes/project-listings/__tests__/me-route-precedence.test.ts

@@ -0,0 +1,221 @@
+// oss: false
+/**
+ * @file me-route-precedence.test.ts
+ *
+ * The regression net for the one structural risk in #5295: the static
+ * `/v1/project-listings/me` and the parametric `/v1/project-listings/:id` share
+ * a prefix and are registered in DIFFERENT scopes — `/me` in `server.ts`'s
+ * `authScope`, `/:id` inside the encapsulated `tenantScope` behind
+ * `tenantPreHandlerPlugin`.
+ *
+ * `me.test.ts` registers `/me` alone, so nothing there would catch a
+ * registration reorder that shadowed `/me` or weakened the tenant guard on
+ * `/:id`. The security review for this change verified the behaviour by hand and
+ * named the missing net; this file is that net.
+ *
+ * It asserts three things in ONE Fastify instance with the REAL preHandlers:
+ *   1. `/v1/project-listings/me` reaches the `/me` handler — static beats
+ *      parametric — and runs auth ONLY, no tenant guard.
+ *   2. `/v1/project-listings/<id>` still reaches the tenant handler WITH the
+ *      tenant guard: registering a static sibling in the outer scope does not
+ *      weaken it. A member below the `owner|admin` floor is still refused.
+ *   3. Registering both raises no duplicate-route error.
+ *
+ * This file is `oss: false` because it imports the multi-tenant slice
+ * (`middleware/tenant.js`, `./get.js`), the same reason `tenant-isolation.test.ts`
+ * is.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    user: { findUnique: jest.fn() },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    projectListing: { findMany: jest.fn(), findFirst: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { projectListingMeRoute, projectListingTenantRoutes } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const ORG = "org_00000000-0000-7000-8000-000000000001";
+const WS = "wksp_00000000-0000-7000-8000-000000000001";
+const LISTING_ID = "prjl_00000000-0000-7000-8000-0000000000d1";
+
+/** `owner` clears the floor; `member` does not. Both are real members of ORG. */
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_owner: {
+    id: "sess_owner",
+    userId: "owner-user",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG,
+    activeWorkspaceId: WS,
+  },
+  cookie_member: {
+    id: "sess_member",
+    userId: "member-user",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG,
+    activeWorkspaceId: WS,
+  },
+};
+
+const MEMBERSHIPS: Record<string, string> = {
+  "owner-user": "owner",
+  "member-user": "member",
+};
+
+async function buildApp(): Promise<FastifyInstance> {
+  // The exact nesting server.ts uses: /me in the OUTER auth scope, the tenant
+  // routes in an INNER scope behind the tenant preHandler.
+  const app = Fastify();
+  await app.register(async (authScope) => {
+    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(projectListingMeRoute);
+    await authScope.register(async (tenantScope) => {
+      await tenantScope.register(tenantPreHandlerPlugin);
+      await tenantScope.register(projectListingTenantRoutes);
+    });
+  });
+  await app.ready();
+  return app;
+}
+
+const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
+
+let app: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
+    Promise.resolve({ id: where.id, email: `${where.id}@example.com`, emailVerified: true }),
+  );
+  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({ id: WS, organizationId: ORG });
+  // The composite key is `organizationId_userId` — the order `tenant-context.ts`
+  // actually queries with.
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { organizationId_userId?: { userId: string } } }) => {
+      const userId = where.organizationId_userId?.userId;
+      const role = userId ? MEMBERSHIPS[userId] : undefined;
+      return Promise.resolve(role ? { role } : null);
+    },
+  );
+  // The /me read returns nothing; this file is about routing, not payloads.
+  (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([]);
+  (prisma.projectListing.findFirst as jest.Mock).mockResolvedValue(null);
+  app = await buildApp();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("route precedence: static /me beside parametric /:id in one instance", () => {
+  it("registering both raises no duplicate-route error", async () => {
+    // buildApp() already awaited app.ready(); reaching here is the assertion.
+    const tree = app.printRoutes();
+    expect(tree).toContain("me");
+    expect(tree).toContain(":id");
+  });
+
+  it("/v1/project-listings/me reaches the /me handler, not the parametric one", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/me",
+      headers: cookie("cookie_owner"),
+    });
+
+    // The /me handler answers its own 200 + empty list. The parametric handler
+    // would have answered 400 `validation_failed` — "me" is not a listing id.
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+    // And it read through the owner link, not by id.
+    expect(prisma.projectListing.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { ownerUserId: "owner-user" } }),
+    );
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("/me runs auth ONLY — a caller BELOW the owner|admin floor still gets their own rows", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings/me",
+      headers: cookie("cookie_member"),
+    });
+
+    // A `member` is refused by the tenant routes and allowed here: /me is not
+    // behind the floor, and it does not need to be — the owner link is the gate.
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+  });
+
+  it("the parametric /:id still runs the tenant guard — the static sibling does not weaken it", async () => {
+    const ownerRes = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_ID}`,
+      headers: cookie("cookie_owner"),
+    });
+    // Owner clears the floor and reaches the service, which finds no row.
+    expect(ownerRes.statusCode).toBe(404);
+
+    const memberRes = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/${LISTING_ID}`,
+      headers: cookie("cookie_member"),
+    });
+    // Member is still refused BEFORE any read — the floor is intact.
+    expect(memberRes.statusCode).toBe(403);
+  });
+
+  it("the tenant LIST route is unaffected and still refuses a member", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/project-listings",
+      headers: cookie("cookie_member"),
+    });
+
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("an unauthenticated caller is refused on both paths", async () => {
+    const meRes = await app.inject({ method: "GET", url: "/v1/project-listings/me" });
+    const idRes = await app.inject({ method: "GET", url: `/v1/project-listings/${LISTING_ID}` });
+
+    expect(meRes.statusCode).toBe(401);
+    expect(idRes.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
+  });
+});