create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/routes/project-listings/__tests__/resume-email.test.ts

@@ -0,0 +1,814 @@
+/**
+ * @file resume-email.test.ts
+ *
+ * THE ACCEPTANCE GATE for the resume email's SEND (#5406) — the fire-and-forget
+ * side effect `POST /v1/project-listings` gained.
+ *
+ * Four properties fail quietly if they regress, which is why each is here:
+ *   - the send is OPT-IN, so a site already mailing its own resume link (the
+ *     reason this issue exists) does not start sending a second one;
+ *   - the 201 is never delayed or failed by Resend, because the draft has
+ *     already committed and the founder must get their token back;
+ *   - nothing logs the founder's address, their name, or the resume token —
+ *     the one credential on this anonymous draft, which also rides the LINK;
+ *   - the site's config is read PER SEND, so editing the row changes the next
+ *     email with no rebuild and no module reload.
+ *
+ * Real route, real service, mocked `lib/prisma.js` over a small in-memory row
+ * store (the `drafts.test.ts` discipline). `@working-theory/email` is mocked
+ * because it is an external package boundary whose own contract is tested in
+ * `packages/email/__tests__/send-listing-resume-email.test.ts` — and because
+ * this container has no egress, so no email could be sent regardless.
+ * `@working-theory/license` is mocked for the reason
+ * docs/lessons/project-listings/02 records: the route barrel drags in
+ * `routeLead`'s import chain whether or not a test exercises it.
+ */
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+const mockSendResumeEmail = jest.fn();
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  sendListingResumeEmail: (...args: unknown[]) => mockSendResumeEmail(...args),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+const mockLoggerInfo = jest.fn();
+const mockLoggerWarn = jest.fn();
+const mockLoggerError = jest.fn();
+jest.mock("@working-theory/observability", () => ({
+  logger: {
+    info: (...args: unknown[]) => mockLoggerInfo(...args),
+    warn: (...args: unknown[]) => mockLoggerWarn(...args),
+    error: (...args: unknown[]) => mockLoggerError(...args),
+    debug: jest.fn(),
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { startProjectListingRoute } from "../start.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SITE_ID = "site-1";
+const SITE_KEY = "site-1-public-key";
+
+const FOUNDER_EMAIL = "ada@example.com";
+const FOUNDER_NAME = "Ada Founder";
+
+const START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderName: FOUNDER_NAME,
+  founderEmail: FOUNDER_EMAIL,
+  consent: true,
+};
+
+const BASE_URL = "https://samhenry.org/projects/apply/start";
+
+/** The minimum a site writes to turn the email on. */
+const RESUME_EMAIL_ON = { fromAddress: "hello@samhenry.org", baseUrl: BASE_URL };
+
+// ─── The in-memory row store ────────────────────────────────────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+/** What `prisma.siteListingConfig.findUnique({ where: { siteId } })` answers. */
+let storedConfig: Record<string, unknown> | null;
+/**
+ * The siteId `SITE_KEY` resolves to. `SITE_ID` for every test that does not
+ * care; the per-site budget's tests each claim their OWN site, because the
+ * cap's once-per-window log is remembered PER SITE in module state and two
+ * tests sharing a site would share that memory (#5414).
+ */
+let resolvedSiteId: string;
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    // The per-recipient cap's window clause.
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+  storedConfig = null;
+  resolvedSiteId = SITE_ID;
+
+  // One delegate, two lookups: `where.publicKey` is the site-key resolution,
+  // `where.siteId` the config read.
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: resolvedSiteId } : null);
+      }
+      return Promise.resolve(storedConfig === null ? null : { data: storedConfig });
+    },
+  );
+
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+
+  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
+    const row: Row = {
+      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+      name: null,
+      leadId: null,
+      // Through `Date.now()` rather than a bare `new Date()` so a test that
+      // moves the clock moves the rows with it (the once-per-window log).
+      createdAt: new Date(Date.now()),
+      updatedAt: new Date(Date.now()),
+      ...data,
+    };
+    rows.push(row);
+    return Promise.resolve(row);
+  });
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(() => Promise.resolve([]));
+
+  // Both send caps' read: the per-recipient bound (#5411 security review,
+  // finding 1) and the per-site budget (#5414) are the same delegate with
+  // different `where` clauses.
+  (prisma.projectListing.count as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where)).length),
+  );
+
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(({ data }: { data: Row[] }) =>
+    Promise.resolve({ count: data.length }),
+  );
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.ready();
+  return app;
+}
+
+/**
+ * Let the fire-and-forget chain run. The send does several awaited reads before
+ * it reaches the email — the row, the config, and one count per bound — so a
+ * single microtask tick is not enough; `setImmediate` fires only after the
+ * microtask queue has fully drained.
+ */
+const settle = () => new Promise((resolve) => setImmediate(resolve));
+
+async function startDraft(app: FastifyInstance): Promise<{ id: string; resumeToken: string }> {
+  const res = await app.inject({
+    method: "POST",
+    url: "/v1/project-listings",
+    payload: START_PAYLOAD,
+  });
+  expect(res.statusCode).toBe(201);
+  return (res.json() as { ok: true; data: { id: string; resumeToken: string } }).data;
+}
+
+/** The single `sendListingResumeEmail` argument of the most recent call. */
+function emailed(index = 0): {
+  to: string;
+  resumeLink: string;
+  settings: Record<string, string>;
+  variables: Record<string, string>;
+} {
+  return mockSendResumeEmail.mock.calls[index]![0];
+}
+
+describe("the resume email's send (#5406)", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    mockSendResumeEmail.mockResolvedValue({ ok: true, messageId: "msg-resume" });
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── Opt-in ───────────────────────────────────────────────────────────────
+
+  it("sends NOTHING when the site has no SiteListingConfig row at all", async () => {
+    await startDraft(app);
+    await settle();
+    expect(mockSendResumeEmail).not.toHaveBeenCalled();
+  });
+
+  it("sends NOTHING when the config carries no resumeEmail block", async () => {
+    storedConfig = { maxWindowDays: 30 };
+    await startDraft(app);
+    await settle();
+    expect(mockSendResumeEmail).not.toHaveBeenCalled();
+  });
+
+  it("sends NOTHING when resumeEmail carries no fromAddress", async () => {
+    // The opt-in switch. A site with wording but no verified sender must not
+    // start mailing — and a site already sending its own must not get two.
+    storedConfig = { resumeEmail: { subject: "Come back", baseUrl: BASE_URL } };
+    await startDraft(app);
+    await settle();
+    expect(mockSendResumeEmail).not.toHaveBeenCalled();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ reason: "no_from_address" }),
+      "listing-resume-email-skipped",
+    );
+  });
+
+  it("sends NOTHING when resumeEmail carries no baseUrl", async () => {
+    // The platform does not know where a site mounted its application, so
+    // there is no link to build and no default worth guessing.
+    storedConfig = { resumeEmail: { fromAddress: "hello@samhenry.org" } };
+    await startDraft(app);
+    await settle();
+    expect(mockSendResumeEmail).not.toHaveBeenCalled();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ reason: "no_base_url" }),
+      "listing-resume-email-skipped",
+    );
+  });
+
+  // ── The send ─────────────────────────────────────────────────────────────
+
+  it("sends to the founder with the site's own settings once configured", async () => {
+    storedConfig = {
+      siteName: "Sam Henry",
+      resumeEmail: {
+        ...RESUME_EMAIL_ON,
+        senderName: "Sam Henry",
+        replyTo: "sam@samhenry.org",
+        subject: "Verify to continue, {firstName}",
+        outro: "Reply if you get stuck.",
+      },
+    };
+    await startDraft(app);
+    await settle();
+
+    expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
+    expect(emailed().to).toBe(FOUNDER_EMAIL);
+    expect(emailed().settings).toEqual({
+      fromAddress: "hello@samhenry.org",
+      senderName: "Sam Henry",
+      replyTo: "sam@samhenry.org",
+      subject: "Verify to continue, {firstName}",
+      outro: "Reply if you get stuck.",
+    });
+    // `baseUrl` is the API's to consume, not the email package's.
+    expect(emailed().settings).not.toHaveProperty("baseUrl");
+  });
+
+  it("builds the link as baseUrl + ?draft=<id>&token=<resumeToken>&verify=<nonce>", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    const { id, resumeToken } = await startDraft(app);
+    await settle();
+
+    // The exact shape `ListingApplicationFlow`'s `resume` prop reads.
+    const url = new URL(emailed().resumeLink);
+    expect(`${url.origin}${url.pathname}`).toBe(BASE_URL);
+    expect(url.searchParams.get("draft")).toBe(id);
+    expect(url.searchParams.get("token")).toBe(resumeToken);
+    // #5407 — and the verification nonce, which is what makes
+    // `email_verified_at` mean something the resume token could not prove.
+    expect(url.searchParams.get("verify")).toEqual(expect.any(String));
+  });
+
+  // #5407 — this message is the ONLY carrier of the verification nonce, and
+  // the property is what the whole fix rests on: a caller who has everything
+  // `start` returned still cannot verify.
+  it("carries a nonce that appears NOWHERE in `start`'s own response", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+    await settle();
+
+    const nonce = new URL(emailed().resumeLink).searchParams.get("verify")!;
+    expect(nonce).toEqual(expect.any(String));
+    expect(res.body).not.toContain(nonce);
+    // Nor is it any of the values the response DOES carry.
+    const data = (res.json() as { data: Record<string, string> }).data;
+    expect(Object.values(data)).not.toContain(nonce);
+  });
+
+  it("gives each draft its OWN nonce", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    await startDraft(app);
+    await settle();
+    await startDraft(app);
+    await settle();
+
+    const first = new URL(emailed(0).resumeLink).searchParams.get("verify");
+    const second = new URL(emailed(1).resumeLink).searchParams.get("verify");
+    expect(first).not.toBe(second);
+  });
+
+  it("appends to a baseUrl that already carries a query string", async () => {
+    storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, baseUrl: `${BASE_URL}?locale=en` } };
+    const { id } = await startDraft(app);
+    await settle();
+
+    const url = new URL(emailed().resumeLink);
+    expect(url.searchParams.get("locale")).toBe("en");
+    expect(url.searchParams.get("draft")).toBe(id);
+  });
+
+  it("passes {siteName} from the config, and leaves {firstName}/{projectName} unset", async () => {
+    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
+    await startDraft(app);
+    await settle();
+
+    // `name` is null on a step-one draft, and THIS payload sends one display
+    // line rather than the two name parts — `founderName` is deliberately not
+    // split to guess a first name, so `{firstName}` stays unset. Both render
+    // as empty text in the email package.
+    expect(emailed().variables).toEqual({ siteName: "Sam Henry" });
+  });
+
+  // #5407 — the column the note above was waiting for. `{firstName}` is
+  // populated from `founderFirstName` and only where the founder actually
+  // gave one; nothing derives it from `founderName`.
+  it("passes {firstName} when the founder gave one, and never guesses it", async () => {
+    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: {
+        siteKey: SITE_KEY,
+        founderFirstName: "Ada",
+        founderLastName: "Lovelace",
+        founderEmail: FOUNDER_EMAIL,
+        consent: true,
+      },
+    });
+    expect(res.statusCode).toBe(201);
+    await settle();
+
+    expect(emailed().variables).toEqual({ siteName: "Sam Henry", firstName: "Ada" });
+  });
+
+  it("passes no {siteName} when the site has not named itself", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    await startDraft(app);
+    await settle();
+    expect(emailed().variables).toEqual({});
+  });
+
+  // ── The 201 is independent of the email ──────────────────────────────────
+
+  it("answers 201 with the token even when Resend FAILS", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    mockSendResumeEmail.mockResolvedValue({
+      ok: false,
+      error: { kind: "send_failed", message: "Resend API error" },
+    });
+
+    const { id, resumeToken } = await startDraft(app);
+    expect(id).toMatch(/^prjl_/);
+    expect(resumeToken.length).toBeGreaterThan(0);
+
+    await settle();
+    // Logged as a KIND, never as the failure's own contents.
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      expect.objectContaining({ errorKind: "send_failed" }),
+      "listing resume email send failed",
+    );
+  });
+
+  it("answers 201 even when the email THROWS", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    mockSendResumeEmail.mockRejectedValue(new Error("boom"));
+
+    const { id } = await startDraft(app);
+    expect(id).toMatch(/^prjl_/);
+
+    await settle();
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      expect.objectContaining({ errName: "Error" }),
+      "listing resume email rejected unexpectedly",
+    );
+  });
+
+  it("does NOT wait on the email — the 201 lands while the send is still pending", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    // A send that never settles. If the route awaited it, `inject` would hang
+    // and this test would time out rather than assert.
+    mockSendResumeEmail.mockReturnValue(new Promise(() => {}));
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+    expect(res.statusCode).toBe(201);
+  });
+
+  // ── Per-recipient bound (PR #5411 security review, finding 1) ────────────
+
+  describe("bounds outbound mail per recipient", () => {
+    // `start` is ANONYMOUS and its IP limiter is evadable (`trustProxy`), so
+    // without this a loop over one victim's address is a mail bomb sent from
+    // the site's own verified domain. The cap is what makes an anonymous
+    // outbound send affordable at all.
+    beforeEach(() => {
+      storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    });
+
+    it("sends the first three, then suppresses the fourth for the same address", async () => {
+      for (let i = 0; i < 3; i++) {
+        await startDraft(app);
+        await settle();
+      }
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+
+      await startDraft(app);
+      await settle();
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+      expect(mockLoggerWarn).toHaveBeenCalledWith(
+        expect.objectContaining({ reason: "recipient_rate_limited" }),
+        "listing-resume-email-skipped",
+      );
+    });
+
+    it("suppresses the EMAIL only — the draft is still created and the 201 still carries the token", async () => {
+      // Lesson 14's rule: a quota on an unverified identifier is a lockout
+      // weapon. What this one can deny is the email, never the application —
+      // the founder in front of the form has their token from the 201.
+      for (let i = 0; i < 4; i++) {
+        await startDraft(app);
+        await settle();
+      }
+      expect(rows).toHaveLength(4);
+      const { id, resumeToken } = await startDraft(app);
+      expect(id).toMatch(/^prjl_/);
+      expect(resumeToken.length).toBeGreaterThan(0);
+    });
+
+    it("counts per (site, address) — a different address has its own budget", async () => {
+      for (let i = 0; i < 4; i++) {
+        await startDraft(app);
+        await settle();
+      }
+      mockSendResumeEmail.mockClear();
+
+      await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, founderEmail: "grace@example.com" },
+      });
+      await settle();
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
+    });
+
+    it("does not count drafts older than the window", async () => {
+      // Rolling, so a lockout clears itself rather than being permanent.
+      for (let i = 0; i < 4; i++) {
+        await startDraft(app);
+        await settle();
+      }
+      const twoHoursAgo = new Date(Date.now() - 2 * 60 * 60 * 1000);
+      for (const row of rows) row["createdAt"] = twoHoursAgo;
+      mockSendResumeEmail.mockClear();
+
+      await startDraft(app);
+      await settle();
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  // ── Per-site budget (#5414) ─────────────────────────────────────────────
+
+  describe("bounds outbound mail per SITE", () => {
+    // The residual #5406 stated rather than hid: the per-recipient bound stops
+    // a loop aimed at ONE victim and does nothing about a loop over a thousand
+    // strangers, each of whom receives one message from the site's own
+    // verified sending domain. That is the pattern a mailbox provider reads as
+    // a list blast, and the cost — a flagged domain, a suspendable Resend
+    // account — lands on the site rather than on the caller.
+    let capSite = 0;
+    beforeEach(() => {
+      resolvedSiteId = `site-cap-${++capSite}`;
+      storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 3 } };
+    });
+
+    /** The `site_rate_limited` warn lines emitted so far. */
+    function capWarnings(): unknown[][] {
+      return mockLoggerWarn.mock.calls.filter(
+        ([fields]: [Record<string, unknown>]) => fields["reason"] === "site_rate_limited",
+      );
+    }
+
+    /** Start a draft from an address nobody has used, so only the SITE budget binds. */
+    async function startFromFreshAddress(n: number): Promise<void> {
+      await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, founderEmail: `founder-${n}@example.com` },
+      });
+      await settle();
+    }
+
+    it("sends to every stranger UNDER the cap", async () => {
+      for (let i = 0; i < 3; i++) await startFromFreshAddress(i);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+    });
+
+    it("suppresses the send once the site is AT its cap, however many addresses are used", async () => {
+      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
+      // Three sent, three suppressed — the per-recipient bound never fired,
+      // since every address here is distinct and used once.
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+      expect(mockLoggerWarn).toHaveBeenCalledWith(
+        expect.objectContaining({ reason: "site_rate_limited" }),
+        "listing-resume-email-skipped",
+      );
+    });
+
+    it("keeps start's 201 and still creates the draft at the cap", async () => {
+      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
+      mockSendResumeEmail.mockClear();
+
+      // The founder in front of the form loses the EMAIL and nothing else:
+      // their draft exists and their resume token is in the response body.
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, founderEmail: "over-the-cap@example.com" },
+      });
+      expect(res.statusCode).toBe(201);
+      const { id, resumeToken } = (
+        res.json() as { data: { id: string; resumeToken: string } }
+      ).data;
+      expect(id).toMatch(/^prjl_/);
+      expect(resumeToken.length).toBeGreaterThan(0);
+      await settle();
+      expect(mockSendResumeEmail).not.toHaveBeenCalled();
+      expect(rows.some((row) => row["id"] === id)).toBe(true);
+    });
+
+    it("recovers when the window rolls past the earlier drafts", async () => {
+      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+
+      const twoHoursAgo = new Date(Date.now() - 2 * 60 * 60 * 1000);
+      for (const row of rows) row["createdAt"] = twoHoursAgo;
+      mockSendResumeEmail.mockClear();
+
+      await startFromFreshAddress(99);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
+    });
+
+    it("counts each SITE independently — one site's flood does not silence another", async () => {
+      // Tenant isolation, on the budget itself: the count is keyed on the
+      // siteId read off the DRAFT ROW, so a site that has sent nothing sends.
+      for (let i = 0; i < 6; i++) await startFromFreshAddress(i);
+      mockSendResumeEmail.mockClear();
+
+      const counts = (prisma.projectListing.count as jest.Mock).mock.calls.map(
+        ([arg]: [{ where: Record<string, unknown> }]) => arg.where["siteId"],
+      );
+      expect(counts.length).toBeGreaterThan(0);
+      for (const siteId of counts) expect(siteId).toBe(resolvedSiteId);
+
+      // A second site, its own config row, its own empty budget.
+      const OTHER_SITE = "site-2";
+      (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+        ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+          if (where.publicKey !== undefined) {
+            return Promise.resolve({ siteId: OTHER_SITE });
+          }
+          return Promise.resolve({
+            data: { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 3 } },
+          });
+        },
+      );
+
+      await startFromFreshAddress(100);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(1);
+      expect(rows.at(-1)!["siteId"]).toBe(OTHER_SITE);
+    });
+
+    it("still applies the per-recipient bound under a generous site cap", async () => {
+      // The two bounds are independent. A site with plenty of site-wide budget
+      // must still not mail ONE address more than three times in an hour.
+      storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 1000 } };
+      for (let i = 0; i < 5; i++) {
+        await startDraft(app);
+        await settle();
+      }
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(3);
+      expect(mockLoggerWarn).toHaveBeenCalledWith(
+        expect.objectContaining({ reason: "recipient_rate_limited" }),
+        "listing-resume-email-skipped",
+      );
+    });
+
+    it("logs the site cap ONCE per window, with the siteId and the count only", async () => {
+      for (let i = 0; i < 8; i++) await startFromFreshAddress(i);
+
+      const capLogs = capWarnings();
+      // Five sends were suppressed; a line per suppressed send would hand an
+      // attacker a log-flooding primitive on top of everything else.
+      expect(capLogs).toHaveLength(1);
+      expect(capLogs[0]).toEqual([
+        { siteId: resolvedSiteId, count: 4, reason: "site_rate_limited" },
+        "listing-resume-email-skipped",
+      ]);
+    });
+
+    it("logs AGAIN in the next window — the throttle is a window, not a latch", async () => {
+      // The dedupe remembers per site in module state. If it never expired, a
+      // site attacked on Monday would trip its cap silently for the rest of
+      // the deployment's life, which is the failure mode a throttle is most
+      // likely to have and least likely to be noticed having.
+      const realNow = Date.now.bind(Date);
+      try {
+        for (let i = 0; i < 5; i++) await startFromFreshAddress(i);
+        expect(capWarnings()).toHaveLength(1);
+
+        // Two hours on. The earlier drafts fall out of the window with the
+        // clock, so the budget refills and has to be spent again.
+        jest.spyOn(Date, "now").mockImplementation(() => realNow() + 2 * 60 * 60 * 1000);
+        for (let i = 10; i < 15; i++) await startFromFreshAddress(i);
+        expect(capWarnings()).toHaveLength(2);
+      } finally {
+        jest.spyOn(Date, "now").mockRestore();
+      }
+    });
+
+    it("logs no address, no name, no token and no draft id when the cap is hit", async () => {
+      const tokens: string[] = [];
+      for (let i = 0; i < 6; i++) {
+        const res = await app.inject({
+          method: "POST",
+          url: "/v1/project-listings",
+          payload: { ...START_PAYLOAD, founderEmail: `founder-${i}@example.com` },
+        });
+        tokens.push((res.json() as { data: { resumeToken: string } }).data.resumeToken);
+        await settle();
+      }
+
+      const capLogs = JSON.stringify(capWarnings());
+      expect(capLogs).not.toContain("founder-");
+      expect(capLogs).not.toContain(FOUNDER_NAME);
+      for (const token of tokens) expect(capLogs).not.toContain(token);
+      for (const row of rows) expect(capLogs).not.toContain(row["id"] as string);
+      expect(capLogs).not.toContain(BASE_URL);
+    });
+
+    it("falls back to the PLATFORM cap when the site wrote an invalid one", async () => {
+      // `.catch(undefined)` on the member: a bad cap costs the CAP, never the
+      // addressing beside it. Twenty is the platform default, so a site that
+      // typed `0` sends its fourth email rather than none.
+      storedConfig = {
+        maxWindowDays: 7,
+        resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 0 },
+      };
+      for (let i = 0; i < 4; i++) await startFromFreshAddress(i);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(4);
+      // And the operator is told their value is not in effect, by NAME only.
+      expect(mockLoggerWarn).toHaveBeenCalledWith(
+        { siteId: resolvedSiteId, field: "resumeEmail.maxSendsPerHour" },
+        expect.stringContaining("DROPPED"),
+      );
+    });
+
+    it("suppresses at the PLATFORM cap when the site configured none", async () => {
+      storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+      for (let i = 0; i < 21; i++) await startFromFreshAddress(i);
+      expect(mockSendResumeEmail).toHaveBeenCalledTimes(20);
+    });
+  });
+
+  // ── Tenant isolation ─────────────────────────────────────────────────────
+
+  it("reads the config for the DRAFT'S OWN siteId, never one from the body", async () => {
+    storedConfig = { resumeEmail: RESUME_EMAIL_ON };
+    await startDraft(app);
+    await settle();
+
+    const configReads = (prisma.siteListingConfig.findUnique as jest.Mock).mock.calls.filter(
+      ([arg]: [{ where: Record<string, unknown> }]) => arg.where["siteId"] !== undefined,
+    );
+    expect(configReads.length).toBeGreaterThan(0);
+    for (const [arg] of configReads) {
+      expect((arg as { where: Record<string, unknown> }).where["siteId"]).toBe(SITE_ID);
+    }
+    // And the row the send read its site off is the one just created.
+    expect(rows[0]!["siteId"]).toBe(SITE_ID);
+  });
+
+  // ── Runtime configuration ────────────────────────────────────────────────
+
+  it("sends TWICE with different config rows and no module reload", async () => {
+    // The issue's whole premise: an operator edits SiteListingConfig and the
+    // NEXT email changes. Nothing between the two starts re-imports a module,
+    // restarts the app, or resets a cache — only the stored row moves.
+    storedConfig = {
+      siteName: "First Site",
+      resumeEmail: { fromAddress: "one@a.example", baseUrl: "https://a.example/apply" },
+    };
+    await startDraft(app);
+    await settle();
+
+    storedConfig = {
+      siteName: "Second Site",
+      resumeEmail: {
+        fromAddress: "two@b.example",
+        baseUrl: "https://b.example/apply",
+        subject: "A whole new subject",
+      },
+    };
+    await startDraft(app);
+    await settle();
+
+    expect(mockSendResumeEmail).toHaveBeenCalledTimes(2);
+    expect(emailed(0).settings.fromAddress).toBe("one@a.example");
+    expect(emailed(0).variables.siteName).toBe("First Site");
+    expect(emailed(0).settings.subject).toBeUndefined();
+    expect(emailed(1).settings.fromAddress).toBe("two@b.example");
+    expect(emailed(1).variables.siteName).toBe("Second Site");
+    expect(emailed(1).settings.subject).toBe("A whole new subject");
+    expect(emailed(1).resumeLink.startsWith("https://b.example/apply")).toBe(true);
+  });
+
+  // ── PII ──────────────────────────────────────────────────────────────────
+
+  it("logs no founder email, no founder name, no resume token and no link", async () => {
+    storedConfig = { siteName: "Sam Henry", resumeEmail: RESUME_EMAIL_ON };
+    mockSendResumeEmail.mockResolvedValue({
+      ok: false,
+      error: { kind: "send_failed", message: "Resend API error" },
+    });
+
+    const { resumeToken } = await startDraft(app);
+    await settle();
+
+    const logged = JSON.stringify([
+      ...mockLoggerInfo.mock.calls,
+      ...mockLoggerWarn.mock.calls,
+      ...mockLoggerError.mock.calls,
+    ]);
+    expect(logged).not.toContain(FOUNDER_EMAIL);
+    expect(logged).not.toContain(FOUNDER_NAME);
+    expect(logged).not.toContain(resumeToken);
+    // The link CARRIES the token, so it is PII-equivalent on this surface.
+    expect(logged).not.toContain(BASE_URL);
+    // What IS logged: routing metadata only.
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      { siteId: SITE_ID, listingId: rows[0]!["id"], errorKind: "send_failed" },
+      "listing resume email send failed",
+    );
+  });
+
+  // ── A dropped config block is observable (PR #5411 review, item 2) ───────
+
+  it("warns when a malformed resumeEmail block is DROPPED, naming the field only", async () => {
+    // `.catch(undefined)` keeps the site's window bounds when its email block
+    // is malformed — correct behaviour, but silent. This is what makes it
+    // findable: an operator who typos a key gets a line saying so.
+    storedConfig = {
+      maxWindowDays: 7,
+      resumeEmail: { fromAddress: "hello@samhenry.org", subjct: "typo" },
+    };
+    await startDraft(app);
+    await settle();
+
+    expect(mockSendResumeEmail).not.toHaveBeenCalled();
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      { siteId: SITE_ID, field: "resumeEmail" },
+      expect.stringContaining("DROPPED"),
+    );
+    // Field name only — never the site's addresses or its copy.
+    const logged = JSON.stringify(mockLoggerWarn.mock.calls);
+    expect(logged).not.toContain("hello@samhenry.org");
+  });
+});