create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -0,0 +1,478 @@
+// Not marked oss: false (D-48/#5366 escalation) — tests the
+// always-shipping project-listings anonymous surface; see
+// routes/project-listings/me.ts's header comment.
+/**
+ * @file me.test.ts
+ *
+ * THE ACCEPTANCE GATE for the founder's own listings read (#5295).
+ * Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
+ * projectListingMeRoute` (auth only, NO tenant guard), mocked `lib/prisma.js`.
+ *
+ * Proves the security properties the owner link exists for:
+ *   - two users sharing a `founderEmail` value never see each other's rows;
+ *   - a row whose owner link was never set is invisible to the person whose
+ *     address it carries — the read never falls back to an email comparison;
+ *   - the `where` clause carries `ownerUserId` and nothing resembling an email
+ *     (a clause carrying one is treated as a contract violation and returns
+ *     nothing, the `flow-checkouts` test's own discipline);
+ *   - a signed-in caller who owns nothing gets `200 []`, never a 403;
+ *   - `PROJECT_LISTING_ROLES` is untouched and this route never consults it.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { projectListingMeResponseSchema } from "@working-theory/validation";
+
+// `services/project-listings.ts` imports `routeLead` from `lead-routing.js` at
+// module scope, which transitively imports `@working-theory/email` and
+// `@working-theory/license` — mocked here purely so that import chain resolves,
+// mirroring `tenant-isolation.test.ts`'s discipline.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    user: { findUnique: jest.fn() },
+    projectListing: { findMany: jest.fn() },
+    waitlistScore: { count: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { PROJECT_LISTING_ROLES } from "../../../services/project-listings.js";
+import { projectListingMeRoute } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const SITE_A = "wksp_00000000-0000-7000-8000-000000000001";
+const SITE_B = "wksp_00000000-0000-7000-8000-000000000002";
+
+/**
+ * `ada` and `bruno` are TWO DIFFERENT PEOPLE who typed the SAME address into
+ * the anonymous application form. That is the whole point: `founderEmail` is
+ * not an identity, and nothing may derive ownership from it.
+ */
+const SHARED_EMAIL = "founder@example.com";
+
+const USERS: Record<string, { id: string; email: string; emailVerified: boolean }> = {
+  ada: { id: "ada", email: SHARED_EMAIL, emailVerified: true },
+  bruno: { id: "bruno", email: SHARED_EMAIL, emailVerified: true },
+  // Signed in, verified, owns nothing at all.
+  cleo: { id: "cleo", email: "cleo@example.com", emailVerified: true },
+  // Signed in with an address that was never verified, and whose own listing
+  // WAS linked earlier. See the test that covers this case.
+  dane: { id: "dane", email: "dane@example.com", emailVerified: false },
+};
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_ada: { id: "sess_ada", userId: "ada", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_bruno: { id: "sess_bruno", userId: "bruno", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_cleo: { id: "sess_cleo", userId: "cleo", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+  cookie_dane: { id: "sess_dane", userId: "dane", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
+};
+
+type ListingFixture = {
+  id: string;
+  siteId: string;
+  founderEmail: string;
+  ownerUserId: string | null;
+  experimentKey: string | null;
+  createdAt: Date;
+};
+
+/** A complete stored row at `PROJECT_LISTING_SELECT`'s shape. */
+function row(fixture: ListingFixture) {
+  return {
+    id: fixture.id,
+    siteId: fixture.siteId,
+    leadId: `lead_${fixture.id}`,
+    slug: fixture.id.replace("prjl_", ""),
+    name: "Atlas",
+    oneLiner: "A one-liner.",
+    problem: "A problem.",
+    url: "https://atlas.example.com",
+    product: "live-some-users",
+    commitment: "full-time",
+    teamComposition: "just-me",
+    faqs: null,
+    anythingElse: null,
+    address: "1 Main St",
+    addressLine1: null,
+    addressLine2: null,
+    addressCity: null,
+    addressRegion: null,
+    addressPostalCode: null,
+    addressCountry: null,
+    questions: null,
+    siteAnswers: null,
+    windowDays: 30,
+    founderName: "A Founder",
+    founderEmail: fixture.founderEmail,
+    // #5407 — a row written before the columns existed, and a freshly
+    // started draft on a site that asks for one name line: parts null,
+    // no phone, no verification stamp.
+    founderFirstName: null,
+    founderLastName: null,
+    founderPhone: null,
+    emailVerifiedAt: null,
+    founderCompany: null,
+    headline: "Atlas",
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "requested",
+    consentAt: fixture.createdAt,
+    decidedAt: null,
+    decidedBy: "operator@example.com",
+    issueUrl: "https://github.com/example/repo/issues/1",
+    experimentKey: fixture.experimentKey,
+    windowEndsAt: null,
+    createdAt: fixture.createdAt,
+    updatedAt: fixture.createdAt,
+  };
+}
+
+const LISTINGS: ListingFixture[] = [
+  // ada's own, linked to ada.
+  {
+    id: "prjl_ada_one",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "ada",
+    experimentKey: "atlas-waitlist",
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+  },
+  // ada again, NEWER, and in a SECOND workspace of ada's — proves the per-site
+  // waitlistCount resolution and the newest-first ordering.
+  {
+    id: "prjl_ada_two",
+    siteId: SITE_B,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "ada",
+    experimentKey: "atlas-two-waitlist",
+    createdAt: new Date("2026-09-05T00:00:00.000Z"),
+  },
+  // bruno's own — SAME founderEmail as ada's rows, different person.
+  {
+    id: "prjl_bruno_one",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: "bruno",
+    experimentKey: null,
+    createdAt: new Date("2026-09-03T00:00:00.000Z"),
+  },
+  // Carries the shared address and was NEVER linked. Invisible to everyone.
+  {
+    id: "prjl_unlinked",
+    siteId: SITE_A,
+    founderEmail: SHARED_EMAIL,
+    ownerUserId: null,
+    experimentKey: null,
+    createdAt: new Date("2026-09-04T00:00:00.000Z"),
+  },
+  // dane's own, linked while dane's address was still verified.
+  {
+    id: "prjl_dane_one",
+    siteId: SITE_A,
+    founderEmail: "dane@example.com",
+    ownerUserId: "dane",
+    experimentKey: null,
+    createdAt: new Date("2026-09-02T00:00:00.000Z"),
+  },
+];
+
+type ListingWhere = Record<string, unknown> & { ownerUserId?: unknown };
+
+const WAITLIST_COUNTS: Record<string, Record<string, number>> = {
+  [SITE_A]: { "atlas-waitlist": 7 },
+  [SITE_B]: { "atlas-two-waitlist": 3 },
+};
+
+function installFixtureMocks(): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
+    Promise.resolve(USERS[where.id] ?? null),
+  );
+
+  /**
+   * The owner link is the ONLY join the service may use, and this mock is
+   * written to FAIL on a regression rather than to absorb one.
+   *
+   * Two earlier, weaker forms were rejected during review, both of which let a
+   * regression keep the security tests green:
+   *
+   *   - `expect(where).not.toHaveProperty("founderEmail")` inspects TOP-LEVEL
+   *     keys only, so an `OR`-wrapped email fallback
+   *     (`{ OR: [{ ownerUserId }, { founderEmail }] }`) sails straight past it —
+   *     and a mock that then filtered on `where.ownerUserId` returns `[]` for
+   *     that shape, which looks like "nothing leaked".
+   *   - Filtering on `where.ownerUserId` when it is `undefined` also returns
+   *     `[]`, while Prisma compiles an `undefined` filter to no filter at all
+   *     (`WHERE 1=1`) and the REAL read would be unscoped.
+   *
+   * So: any key other than `ownerUserId` THROWS, an `ownerUserId` that is not a
+   * string THROWS, and the filter is exact equality on it. A widened read now
+   * fails as a thrown error rather than as a quietly empty result.
+   */
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: ListingWhere }) => {
+      const keys = Object.keys(where);
+      if (keys.length !== 1 || keys[0] !== "ownerUserId") {
+        throw new Error(
+          `the /me read must scope on ownerUserId and nothing else; got where keys [${keys.join(", ")}]`,
+        );
+      }
+      if (typeof where.ownerUserId !== "string") {
+        throw new Error(
+          "ownerUserId must be a concrete string; Prisma compiles an undefined filter to no filter, leaving the read unscoped",
+        );
+      }
+      const ownerUserId = where.ownerUserId;
+      return Promise.resolve(
+        LISTINGS.filter((l) => l.ownerUserId === ownerUserId)
+          .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
+          .map(row),
+      );
+    },
+  );
+
+  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId: string; experimentKey: string } }) =>
+      Promise.resolve(WAITLIST_COUNTS[where.siteId]?.[where.experimentKey] ?? 0),
+  );
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(async (authScope) => {
+    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(projectListingMeRoute);
+  });
+  await app.ready();
+  return app;
+}
+
+const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
+const URL_ME = "/v1/project-listings/me";
+
+const listingWhere = (call = 0) =>
+  (prisma.projectListing.findMany as jest.Mock).mock.calls[call][0].where as ListingWhere;
+
+let app: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  installFixtureMocks();
+  app = await buildApp();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("GET /v1/project-listings/me — auth", () => {
+  it("no session cookie and no bearer → the preHandler's existing 401; no listing read", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME });
+
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+
+  it("an expired / unknown cookie → 401", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_nobody") });
+
+    expect(res.statusCode).toBe(401);
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/project-listings/me — the owner link is the only join", () => {
+  /** SECURITY PROPERTY: two users sharing a founderEmail value. */
+  it("two users sharing a founderEmail never see each other's listings", async () => {
+    const adaRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+    const brunoRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
+
+    expect(adaRes.statusCode).toBe(200);
+    expect(brunoRes.statusCode).toBe(200);
+
+    const adaIds = (adaRes.json().data as Array<{ id: string }>).map((r) => r.id);
+    const brunoIds = (brunoRes.json().data as Array<{ id: string }>).map((r) => r.id);
+
+    // ada sees her two rows, newest first, and NOT bruno's.
+    expect(adaIds).toEqual(["prjl_ada_two", "prjl_ada_one"]);
+    // bruno sees his one row, and NOT ada's — though every row in play carries
+    // the identical founderEmail.
+    expect(brunoIds).toEqual(["prjl_bruno_one"]);
+
+    expect(adaIds).not.toContain("prjl_bruno_one");
+    expect(brunoIds).not.toContain("prjl_ada_one");
+    expect(brunoIds).not.toContain("prjl_ada_two");
+    // And neither of them reaches the un-linked row carrying the same address.
+    expect([...adaIds, ...brunoIds]).not.toContain("prjl_unlinked");
+  });
+
+  /** SECURITY PROPERTY: no read-time email fallback. */
+  it("a listing carrying the caller's own address but NO owner link is never returned", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    const ids = (res.json().data as Array<{ id: string }>).map((r) => r.id);
+    expect(ids).not.toContain("prjl_unlinked");
+  });
+
+  it("the where clause is the owner link and carries nothing email-shaped", async () => {
+    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
+  });
+
+  it("a query parameter is never read — ?email= and ?ownerUserId= change nothing", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `${URL_ME}?email=${encodeURIComponent(SHARED_EMAIL)}&ownerUserId=bruno`,
+      headers: cookie("cookie_ada"),
+    });
+
+    expect(res.statusCode).toBe(200);
+    // Still ada's own rows, scoped by the SESSION's user id.
+    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
+    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
+      "prjl_ada_two",
+      "prjl_ada_one",
+    ]);
+  });
+});
+
+describe("GET /v1/project-listings/me — the empty case is not a refusal", () => {
+  /** SECURITY / UX PROPERTY: owning nothing is an empty list, never a 403. */
+  it("a signed-in caller who owns no listing gets 200 with an empty list, not a 403", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: [] });
+    // Specifically NOT the tenant routes' 403 — cleo is legitimately signed in.
+    expect(res.statusCode).not.toBe(403);
+  });
+
+  it("no waitlist count is read when the caller owns nothing", async () => {
+    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
+
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/project-listings/me — the response shape", () => {
+  it("every row parses under projectListingMeResponseSchema", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(res.statusCode).toBe(200);
+    const parsed = projectListingMeResponseSchema.safeParse(res.json().data);
+    expect(parsed.success).toBe(true);
+  });
+
+  it("the five internal references never reach the founder", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    for (const listing of res.json().data as Array<Record<string, unknown>>) {
+      expect(listing).not.toHaveProperty("siteId");
+      expect(listing).not.toHaveProperty("leadId");
+      expect(listing).not.toHaveProperty("decidedBy");
+      expect(listing).not.toHaveProperty("issueUrl");
+      expect(listing).not.toHaveProperty("experimentKey");
+    }
+    // No workspace id reaches the wire anywhere in the body.
+    expect(res.body).not.toContain(SITE_A);
+    expect(res.body).not.toContain(SITE_B);
+  });
+
+  it("waitlistCount is resolved per site, not all under one site id", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    const byId = Object.fromEntries(
+      (res.json().data as Array<{ id: string; waitlistCount: number }>).map((r) => [
+        r.id,
+        r.waitlistCount,
+      ]),
+    );
+    // prjl_ada_one's experiment lives at SITE_A (7); prjl_ada_two's at SITE_B (3).
+    // One shared site id would have reported 0 for one of them.
+    expect(byId["prjl_ada_one"]).toBe(7);
+    expect(byId["prjl_ada_two"]).toBe(3);
+    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      where: { siteId: SITE_A, experimentKey: "atlas-waitlist" },
+    });
+    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      where: { siteId: SITE_B, experimentKey: "atlas-two-waitlist" },
+    });
+  });
+
+  it("the founder's own email is echoed back to the founder who wrote it", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
+
+    expect((res.json().data as Array<{ founderEmail: string }>)[0]?.founderEmail).toBe(
+      SHARED_EMAIL,
+    );
+  });
+});
+
+describe("GET /v1/project-listings/me — the read-time verification posture", () => {
+  /**
+   * A caller whose address is no longer verified still reads the rows their
+   * link already covers. This is deliberate, and it is the one place this route
+   * diverges from `/v1/flow-checkouts/me`, which re-checks `emailVerified`.
+   *
+   * The re-check is load-bearing on `/v1/waitlist-signups/me`, where the match
+   * IS an email, and it is defence in depth on `/v1/flow-checkouts/me`. Here it
+   * would be neither: the link is the proof, it was only ever issuable under
+   * verification, and refusing on a later unverified address would hide rows
+   * the caller already proved they own (changing your email address is not a
+   * reason to lose your own submissions). An unverified address still cannot
+   * CREATE a link — `listing-promotion.ts` refuses before any listing read.
+   */
+  it("a caller whose address is no longer verified still reads the rows their link already covers", async () => {
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_dane") });
+
+    expect(res.statusCode).toBe(200);
+    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
+      "prjl_dane_one",
+    ]);
+    expect(listingWhere()).toEqual({ ownerUserId: "dane" });
+  });
+});
+
+describe("the existing operator role floor is untouched", () => {
+  it("PROJECT_LISTING_ROLES is still exactly owner + admin", () => {
+    expect([...PROJECT_LISTING_ROLES].sort()).toEqual(["admin", "owner"]);
+    expect(PROJECT_LISTING_ROLES.size).toBe(2);
+  });
+
+  it("the /me route never consults the tenant context or the role floor", async () => {
+    // The app this suite builds registers NO tenant preHandler at all, so
+    // `request.tenant` is undefined for every request above. That every test in
+    // this file answers 200 is the proof: a route that consulted the floor
+    // would have answered 401/403 instead.
+    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
+
+    expect(res.statusCode).toBe(200);
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -1,3 +1,6 @@
+// Not marked oss: false (D-48/#5366 escalation) — tests the
+// always-shipping project-listings anonymous surface; see
+// routes/project-listings/me.ts's header comment.
 /**
  * @file public.test.ts
  *
@@ -34,6 +37,13 @@ import { projectListingPublicSchema } from "@working-theory/validation";
 // `routes/leads/__tests__/index.test.ts`'s discipline.
 jest.mock("@working-theory/email", () => ({
   sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  // #5406 — `start` now reaches the resume email. Declared here for the reason
+  // docs/lessons/project-listings/04 records: a mock factory that omits an
+  // export the code under test calls leaves it `undefined` at the callsite.
+  // These suites configure no `resumeEmail`, so the send short-circuits before
+  // this is reached; it is declared so a future fixture that DOES configure
+  // one fails on its assertion rather than on a missing mock.
+  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
 }));
 jest.mock("@working-theory/license", () => ({
   checkLicense: jest.fn().mockResolvedValue({
@@ -108,6 +118,13 @@ function makeRow(overrides: Partial<Record<string, unknown>>) {
     questions: QUESTIONS,
     founderName: "Some Founder",
     founderEmail: "founder@example.com",
+    // #5407 — a row that filled in EVERY new column, which is the shape that
+    // can actually leak. A null phone would pass the public-read tests below
+    // whether or not the strip existed.
+    founderFirstName: "Some",
+    founderLastName: "Founder",
+    founderPhone: "+12015550123",
+    emailVerifiedAt: new Date("2026-08-02T00:00:00.000Z"),
     founderCompany: null,
     headline: null,
     logoMarkUrl: null,
@@ -268,6 +285,27 @@ describe("GET /v1/project-listings/public", () => {
     }
   });
 
+  // #5407 — the phone and the verification stamp join `founderEmail` on the
+  // never-public list, and the fixture above carries a real value for each so
+  // this test can actually fail. Asserted on the SERIALIZED body, not on the
+  // parsed rows: `.strict()` would reject an extra key, but only a string
+  // search proves the VALUE is not riding some other field.
+  it("never carries founderPhone or emailVerifiedAt on any row (#5407)", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/project-listings/public?siteKey=${SITE_KEY}`,
+    });
+
+    const body = JSON.stringify(res.json());
+    expect(body).not.toContain("founderPhone");
+    expect(body).not.toContain("+12015550123");
+    expect(body).not.toContain("emailVerifiedAt");
+    expect(body).not.toContain("2026-08-02");
+    // The two name PARTS do ride the public read, deliberately: they are the
+    // same information as `founderName`, which has always been public.
+    expect(body).toContain("founderFirstName");
+  });
+
   it("400s on a malformed siteKey", async () => {
     const res = await app.inject({ method: "GET", url: "/v1/project-listings/public?siteKey=" });
     expect(res.statusCode).toBe(400);