create-ailk 0.1.1 → 0.2.0

package/templates/apps/api/src/services/__tests__/consent-migration.test.ts

@@ -0,0 +1,65 @@
+/**
+ * @file consent-migration.test.ts
+ * @description Drift guard between the consent_grants migration's BACKFILL
+ * and the consent service (#5275, spec §5.1 last bullet + §5.3 second
+ * boundary): every pre-existing listing gets one grant marked
+ * wording-UNRECOVERABLE — the exact `UNRECOVERABLE_CONSENT_STATEMENT`
+ * literal, so a later reader can match it — stamped at the listing's own
+ * consent_at, and project_listings itself is never touched.
+ */
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
+
+import { UNRECOVERABLE_CONSENT_STATEMENT } from "../consent";
+
+const MIGRATION = join(
+  resolve(__dirname, "..", "..", "..", "..", ".."),
+  "database",
+  "migrations",
+  "20260911180000_consent_grants",
+  "migration.sql",
+);
+
+describe("consent_grants migration backfill (#5275 D11)", () => {
+  const sql = readFileSync(MIGRATION, "utf-8");
+
+  it("creates the table with its two indexes", () => {
+    expect(sql).toContain('CREATE TABLE "consent_grants"');
+    expect(sql).toContain('("site_id", "subject_type", "subject_id")');
+    expect(sql).toContain('("site_id", "purpose_id")');
+  });
+
+  it("inserts one row per pre-existing project_listings row", () => {
+    expect(sql).toContain('INSERT INTO "consent_grants"');
+    expect(sql).toMatch(/FROM "project_listings"/);
+    expect(sql).toContain("'project_listing'");
+    expect(sql).toContain("'service_terms'");
+  });
+
+  it("marks every backfilled row with the exact unrecoverable sentinel and a COMPUTED hash", () => {
+    expect(sql).toContain(`'${UNRECOVERABLE_CONSENT_STATEMENT}'`);
+    expect(sql).toContain(
+      `encode(sha256(convert_to('${UNRECOVERABLE_CONSENT_STATEMENT}', 'UTF8')), 'hex')`,
+    );
+    expect(sql).toContain("'und'");
+  });
+
+  it("sources created_at from the listing's own consent_at", () => {
+    const insert = sql.slice(sql.indexOf('INSERT INTO "consent_grants"'));
+    expect(insert).toContain('"consent_at"');
+    expect(insert).toContain('"created_at"');
+  });
+
+  it("never UPDATEs or ALTERs project_listings — consent_at stays as it was", () => {
+    expect(sql).not.toMatch(/UPDATE\s+"project_listings"/i);
+    expect(sql).not.toMatch(/ALTER\s+TABLE\s+"project_listings"/i);
+  });
+
+  it("never stamps today's default wording onto a grant nobody read", () => {
+    expect(sql).not.toContain("You agree to being contacted");
+    const defaultStatement = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!.label["en"]!;
+    expect(sql).not.toContain(defaultStatement);
+  });
+});

package/templates/apps/api/src/services/__tests__/consent.test.ts

@@ -0,0 +1,282 @@
+/**
+ * @file consent.test.ts
+ * @description Unit tests for the consent-grant writer (#5275 Part B) —
+ * `recordConsent`, `recordLegacyConsent`, `consentStatementHash`,
+ * `consentConfigForSite`.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
+ *
+ * The evidence rule under test: a row carries the statement the registry
+ * RESOLVED (the same function the renderer used), in the locale it was
+ * actually served, or the unrecoverable sentinel — never anything a request
+ * body said and never today's wording for a grant nobody read.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { createHash } from "node:crypto";
+
+import {
+  DEFAULT_CONSENT_PURPOSE_ID,
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+  siteConsentConfigSchema,
+} from "@working-theory/validation";
+
+import { prisma } from "../../lib/prisma.js";
+
+import {
+  consentConfigForSite,
+  consentStatementHash,
+  recordConsent,
+  recordLegacyConsent,
+  UNRECOVERABLE_CONSENT_LOCALE,
+  UNRECOVERABLE_CONSENT_STATEMENT,
+  requiredConsentUnmet,
+} from "../consent";
+
+const SITE_ID = "site-1";
+const SUBJECT = { subjectType: "project_listing", subjectId: "prjl_00000000-0000-7000-8000-000000000001" };
+
+/** Two purposes, one of them bilingual — the fixture every locale case reads from. */
+const CONFIG = siteConsentConfigSchema.parse({
+  policies: { terms: "/terms", privacy: "/privacy" },
+  purposes: [
+    {
+      id: "service_terms",
+      required: true,
+      label: {
+        en: "You agree to our [Terms](terms).",
+        fr: "Vous acceptez nos [Conditions](terms).",
+      },
+    },
+    {
+      id: "marketing_email",
+      required: false,
+      label: { en: "Send me occasional product news." },
+    },
+  ],
+});
+
+type Row = Record<string, unknown>;
+
+function writtenRows(call = 0): Row[] {
+  const arg = (prisma.consentGrant.createMany as jest.Mock).mock.calls[call]![0] as { data: Row[] };
+  return arg.data;
+}
+
+describe("recordConsent (#5275)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+    );
+  });
+
+  it("one granted + one declined purpose → ONE createMany with two rows, one granted:true and one granted:false (D8)", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { service_terms: true, marketing_email: false },
+    });
+
+    expect(written).toBe(2);
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(2);
+    expect(rows.find((r) => r["purposeId"] === "service_terms")).toMatchObject({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      granted: true,
+    });
+    expect(rows.find((r) => r["purposeId"] === "marketing_email")).toMatchObject({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      granted: false,
+    });
+  });
+
+  it("each row carries the RESOLVED statement text and the locale it was actually served in (D7)", async () => {
+    // `fr-CA` is asked for; the bilingual purpose serves `fr` (language-subtag
+    // fallback), the English-only purpose serves `en` (default-locale
+    // fallback). The row records the locale READ, not the one requested.
+    await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "fr-CA",
+      config: CONFIG,
+      consents: { service_terms: true, marketing_email: true },
+    });
+
+    const rows = writtenRows();
+    const terms = rows.find((r) => r["purposeId"] === "service_terms")!;
+    const marketing = rows.find((r) => r["purposeId"] === "marketing_email")!;
+
+    const expectedTerms = resolveConsentStatement(CONFIG.purposes[0]!, "fr-CA");
+    expect(expectedTerms.locale).toBe("fr");
+    expect(terms["statement"]).toBe("Vous acceptez nos [Conditions](terms).");
+    expect(terms["statement"]).toBe(expectedTerms.statement);
+    expect(terms["locale"]).toBe("fr");
+    expect(terms["statementHash"]).toBe(consentStatementHash(expectedTerms.statement));
+
+    expect(marketing["statement"]).toBe("Send me occasional product news.");
+    expect(marketing["locale"]).toBe("en");
+    expect(marketing["locale"]).not.toBe("fr-CA");
+  });
+
+  it("a second recordConsent for the same subject + purpose APPENDS — createMany again, never update/upsert (D9)", async () => {
+    const input = {
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { marketing_email: true },
+    };
+    await recordConsent(input);
+    await recordConsent({ ...input, consents: { marketing_email: false } });
+
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(2);
+    expect(writtenRows(0)[0]).toMatchObject({ purposeId: "marketing_email", granted: true });
+    expect(writtenRows(1)[0]).toMatchObject({ purposeId: "marketing_email", granted: false });
+    // The mock delegate deliberately exposes no mutating method: the writer
+    // has nothing to update or upsert WITH, so append is structural.
+    const delegate = prisma.consentGrant as Record<string, unknown>;
+    expect(delegate["update"]).toBeUndefined();
+    expect(delegate["upsert"]).toBeUndefined();
+    expect(delegate["updateMany"]).toBeUndefined();
+  });
+
+  it("an unknown purpose id writes NOTHING for it — no statement was rendered (evidence rule)", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { service_terms: true, not_a_purpose: true },
+    });
+
+    expect(written).toBe(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!["purposeId"]).toBe("service_terms");
+  });
+
+  it("only unknown purpose ids → no createMany at all, returns 0", async () => {
+    const written = await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: CONFIG,
+      consents: { not_a_purpose: true },
+    });
+    expect(written).toBe(0);
+    expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
+  });
+
+  it("never writes the unrecoverable sentinel when a statement was resolved", async () => {
+    await recordConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      locale: "en",
+      config: SITE_CONSENT_CONFIG_DEFAULTS,
+      consents: { [DEFAULT_CONSENT_PURPOSE_ID]: true },
+    });
+    const [row] = writtenRows();
+    expect(row!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
+    expect(row!["locale"]).not.toBe(UNRECOVERABLE_CONSENT_LOCALE);
+  });
+});
+
+describe("recordLegacyConsent (#5275 D11)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+    );
+  });
+
+  it("writes exactly one row: sentinel statement, locale 'und', purpose service_terms under the default config", async () => {
+    const written = await recordLegacyConsent({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      config: SITE_CONSENT_CONFIG_DEFAULTS,
+    });
+
+    expect(written).toBe(1);
+    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
+    const rows = writtenRows();
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toEqual({
+      siteId: SITE_ID,
+      ...SUBJECT,
+      purposeId: DEFAULT_CONSENT_PURPOSE_ID,
+      granted: true,
+      locale: UNRECOVERABLE_CONSENT_LOCALE,
+      statement: UNRECOVERABLE_CONSENT_STATEMENT,
+      statementHash: consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT),
+    });
+    expect(rows[0]!["purposeId"]).toBe("service_terms");
+    expect(rows[0]!["locale"]).toBe("und");
+    // Never today's wording for a grant nobody read.
+    expect(rows[0]!["statement"]).not.toContain("You agree to being contacted");
+  });
+
+  it("targets the first REQUIRED purpose, not merely the first purpose", async () => {
+    const config = siteConsentConfigSchema.parse({
+      purposes: [
+        { id: "marketing_email", required: false, label: { en: "News." } },
+        { id: "service_terms", required: true, label: { en: "Terms." } },
+      ],
+    });
+    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
+    expect(writtenRows()[0]!["purposeId"]).toBe("service_terms");
+  });
+
+  it("falls back to the first purpose when none is required", async () => {
+    const config = siteConsentConfigSchema.parse({
+      purposes: [{ id: "marketing_email", required: false, label: { en: "News." } }],
+    });
+    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
+    expect(writtenRows()[0]!["purposeId"]).toBe("marketing_email");
+  });
+});
+
+describe("consentStatementHash", () => {
+  it("is sha256 hex", () => {
+    expect(consentStatementHash("abc")).toBe(
+      "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+    );
+    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toBe(
+      createHash("sha256").update(UNRECOVERABLE_CONSENT_STATEMENT).digest("hex"),
+    );
+    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toMatch(/^[0-9a-f]{64}$/);
+  });
+});
+
+describe("consentConfigForSite", () => {
+  it("resolves every site to the platform defaults until a config row exists", async () => {
+    await expect(consentConfigForSite(SITE_ID)).resolves.toBe(SITE_CONSENT_CONFIG_DEFAULTS);
+  });
+});
+
+describe("requiredConsentUnmet (#5275, security review Medium 1)", () => {
+  const config = {
+    policies: {},
+    purposes: [
+      { id: "service_terms", required: true, label: { en: "a" } },
+      { id: "marketing", required: false, label: { en: "b" } },
+    ],
+  };
+
+  it("names a required purpose that is declined OR absent, and passes when every required one is true", () => {
+    expect(requiredConsentUnmet(config, { service_terms: false })).toBe("service_terms");
+    expect(requiredConsentUnmet(config, {})).toBe("service_terms");
+    expect(requiredConsentUnmet(config, { marketing: true })).toBe("service_terms");
+    expect(requiredConsentUnmet(config, { service_terms: true })).toBeUndefined();
+    expect(requiredConsentUnmet(config, { service_terms: true, marketing: false })).toBeUndefined();
+  });
+});