create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -1,197 +0,0 @@
-/**
- * POST /api/checkout/sessions
- *
- * Generic Stripe checkout primitive. Resolves a productCode to a Stripe
- * hosted-page checkout session and returns the session ID + URL. The session
- * mode is derived from the resolved price by the stripe-client (a recurring
- * price opens a subscription session), so this route serves both (#4398).
- *
- * Security invariants:
- *   - Sandbox-only: live Stripe keys are rejected at runtime before any Stripe call.
- *   - No PII in logs: successUrl/cancelUrl and full session IDs are never logged.
- *     Only the first 8 chars of the session ID appear in log lines.
- *   - Error responses never echo user input (productCode, URLs).
- *   - No DB write: this unit creates a Stripe session only; webhook-driven
- *     persistence is a follow-up issue.
- *   - X-Internal-Auth gate: when OSS_API_INTERNAL_SECRET env var is set,
- *     the X-Internal-Auth header must match; requests without a matching header
- *     are rejected with 401. When the env var is unset, no gate is applied
- *     (backward-compat for OSS standalone deployments). See #935.
- *
- * Error mapping:
- *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
- *   400 validation-error      — Zod validation failed (missing/invalid fields)
- *   404 unknown-product-code  — no active Stripe price for the given productCode
- *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
- *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
- *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper)
- *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
- */
-import { timingSafeEqual } from "node:crypto";
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { z } from "zod";
-
-import {
-  assertSandboxKey,
-  createCheckoutSession,
-  StripeConfigError,
-  UnknownProductCodeError,
-} from "../../lib/stripe.js";
-
-// ── Input validation schema ───────────────────────────────────────────────────
-
-/**
- * Validates a redirect URL: must parse and must use http: or https: scheme.
- * All other schemes (javascript:, ftp:, data:, file:, etc.) are rejected.
- * Accepts http: for dev flexibility; Stripe enforces https: on production
- * hosted-page redirects at their end.
- */
-function isValidRedirectUrl(raw: string): boolean {
-  let parsed: URL;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return false;
-  }
-  return parsed.protocol === "https:" || parsed.protocol === "http:";
-}
-
-const PRODUCT_CODE_REGEX = /^[A-Za-z0-9._-]{1,200}$/;
-
-const CheckoutSessionRequestSchema = z.object({
-  productCode: z
-    .string()
-    .regex(
-      PRODUCT_CODE_REGEX,
-      "productCode must match /^[A-Za-z0-9._-]{1,200}$/",
-    ),
-  successUrl: z.string().refine(isValidRedirectUrl, {
-    message:
-      "successUrl must be a valid URL with a non-empty host and not use javascript: scheme",
-  }),
-  cancelUrl: z.string().refine(isValidRedirectUrl, {
-    message:
-      "cancelUrl must be a valid URL with a non-empty host and not use javascript: scheme",
-  }),
-  quantity: z.number().int().min(1).max(999).optional(),
-  allowPromotionCodes: z.boolean().optional(),
-});
-
-// ── Internal-auth gate ────────────────────────────────────────────────────────
-
-/**
- * Enforce the X-Internal-Auth gate when OSS_API_INTERNAL_SECRET is configured.
- *
- * Gate is env-var-conditional:
- *   - env var SET → header must be present and must match exactly
- *   - env var UNSET → no gate applied (OSS standalone backward-compat)
- *
- * Returns true if the request should be allowed through; false if it must be
- * rejected with 401.
- *
- * Uses a constant-time string comparison to prevent timing attacks on the
- * secret value. Node's `crypto.timingSafeEqual` requires equal-length Buffers,
- * so we compare lengths first (short-circuit is safe — length mismatch reveals
- * no information about the secret's content beyond its length, which is
- * acceptable for a shared internal secret).
- */
-function passesInternalAuthGate(request: FastifyRequest): boolean {
-  const expectedSecret = process.env["OSS_API_INTERNAL_SECRET"];
-  // Gate is disabled when env var is not set — OSS standalone backward-compat.
-  if (!expectedSecret) return true;
-
-  const provided = request.headers["x-internal-auth"];
-  if (typeof provided !== "string" || !provided) return false;
-
-  // Constant-time comparison.
-  const expectedBuf = Buffer.from(expectedSecret, "utf8");
-  const providedBuf = Buffer.from(provided, "utf8");
-  if (expectedBuf.length !== providedBuf.length) return false;
-
-  return timingSafeEqual(expectedBuf, providedBuf);
-}
-
-// ── Handler ───────────────────────────────────────────────────────────────────
-
-export async function checkoutSessionsHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  // ── X-Internal-Auth gate (env-var-conditional) ────────────────────────────
-  if (!passesInternalAuthGate(request)) {
-    return reply.status(401).send({ error: "internal-auth-required" });
-  }
-
-  const stripeSecretKey = process.env["STRIPE_SECRET_KEY"];
-  if (!stripeSecretKey) {
-    return reply.status(500).send({ error: "stripe-not-configured" });
-  }
-  try {
-    assertSandboxKey(stripeSecretKey);
-  } catch {
-    return reply.status(500).send({ error: "live-mode-forbidden" });
-  }
-
-  const parsed = CheckoutSessionRequestSchema.safeParse(request.body);
-  if (!parsed.success) {
-    return reply.status(400).send({
-      error: "validation-error",
-      details: parsed.error.issues,
-    });
-  }
-
-  const { productCode, successUrl, cancelUrl, quantity, allowPromotionCodes } =
-    parsed.data;
-
-  try {
-    const { sessionId, url } = await createCheckoutSession({
-      productCode,
-      successUrl,
-      cancelUrl,
-      quantity: quantity ?? 1,
-      // Omitted when the caller says nothing — Stripe's default (no promo-code
-      // field) is unchanged for every existing caller.
-      ...(allowPromotionCodes !== undefined && { allowPromotionCodes }),
-    });
-
-    request.log.info(
-      {
-        method: request.method,
-        path: request.url,
-        sessionIdPrefix: sessionId.substring(0, 8),
-        status: 201,
-      },
-      "[checkout] session created",
-    );
-
-    return reply.status(201).send({ sessionId, url });
-  } catch (err) {
-    if (err instanceof UnknownProductCodeError) {
-      // 404 — do NOT echo productCode in the response body
-      return reply.status(404).send({ error: "unknown-product-code" });
-    }
-    if (err instanceof StripeConfigError) {
-      // 500 — misconfiguration; log message (no PII) but never echo in response
-      request.log.error(
-        {
-          method: request.method,
-          path: request.url,
-          errName: err.name,
-          message: err.message,
-        },
-        "[checkout] config error",
-      );
-      return reply.status(500).send({ error: "config-error" });
-    }
-    request.log.error(
-      {
-        method: request.method,
-        path: request.url,
-        errName: err instanceof Error ? err.name : "unknown",
-      },
-      "[checkout] stripe error; checkout-unavailable",
-    );
-    return reply.status(502).send({ error: "checkout-unavailable" });
-  }
-}

package/templates/apps/api/src/routes/deliverables/__tests__/index.test.ts

@@ -1,393 +0,0 @@
-/**
- * @file index.test.ts
- * Route-level inject tests for GET /v1/deliverables/:grantId (#3961 D5).
- *
- * Mirrors apps/api/src/routes/flows/__tests__/index.test.ts's shape: a bare
- * Fastify instance with only the route under test registered, prisma
- * mocked via __mocks__/prisma.ts.
- */
-
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../../../lib/prisma.js");
-
-import { deliverableDownloadRoute } from "../index";
-import { prisma } from "../../../lib/prisma.js";
-import { compilePlaybook, loadVendoredPlayLibrary } from "../../../services/playbook-compile.js";
-
-const GRANT_ID = "dgrant_00000000-0000-7000-8000-0000000000g1";
-const SITE_ID = "site-abc";
-const ASSET_ID = "dasset_00000000-0000-7000-8000-0000000000a1";
-
-function grantRow(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: GRANT_ID,
-    siteId: SITE_ID,
-    assetId: ASSET_ID,
-    leadId: "lead_00000000-0000-7000-8000-0000000000e1",
-    sessionId: "flsess_00000000-0000-7000-8000-0000000000c1",
-    createdAt: new Date(),
-    ...overrides,
-  };
-}
-
-function assetRow(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: ASSET_ID,
-    siteId: SITE_ID,
-    key: "guide-default",
-    filename: "guide.pdf",
-    contentType: "application/pdf",
-    bytes: Buffer.from("PDF-BYTES"),
-    size: 9,
-    createdAt: new Date(),
-    updatedAt: new Date(),
-    ...overrides,
-  };
-}
-
-describe("GET /v1/deliverables/:grantId", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env.DATABASE_URL = "postgres://stub";
-
-    const fastify = require("fastify")();
-    await fastify.register(deliverableDownloadRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env.DATABASE_URL;
-  });
-
-  // ── Happy path ───────────────────────────────────────────────────────────
-
-  it("returns 200 with the asset's bytes, content-type, and content-disposition filename", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow(),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["content-type"]).toBe("application/pdf");
-    expect(res.headers["content-disposition"]).toBe(
-      'attachment; filename="guide.pdf"',
-    );
-    expect(res.rawPayload.toString()).toBe("PDF-BYTES");
-  });
-
-  // ── AC1 — X-Content-Type-Options: nosniff (#4002, #3961 security-review) ──
-
-  it("sets X-Content-Type-Options: nosniff on a 200 download response", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow(),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["x-content-type-options"]).toBe("nosniff");
-  });
-
-  it("allows repeated downloads on the same grant (no consumption)", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow(),
-    );
-
-    const first = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-    const second = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(first.statusCode).toBe(200);
-    expect(second.statusCode).toBe(200);
-  });
-
-  // ── AC2 — uniform 404 (no enumeration oracle) ───────────────────────────
-
-  it("returns a uniform 404 for an unknown grant id", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/deliverables/dgrant_00000000-0000-7000-8000-999999999999",
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: expect.any(String) },
-    });
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("returns a uniform 404 for a malformed id (identical shape to unknown)", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/deliverables/not-a-real-grant-id",
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: expect.any(String) },
-    });
-  });
-
-  it("returns a uniform 404 (identical shape) when the grant exists but its asset row is missing", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: expect.any(String) },
-    });
-  });
-
-  it("returns a uniform 404 when the asset's siteId does not match the grant's (defense in depth)", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow({ siteId: "site-abc" }),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow({ siteId: "site-other" }),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: expect.any(String) },
-    });
-  });
-
-  // ── No route serves assets by key, id, or filename (structural) ─────────
-
-  it("has no route accepting a siteId/key/filename combination — only /:grantId", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/deliverables/by-key/guide-default",
-    });
-
-    expect(res.statusCode).toBe(404);
-  });
-
-  // ── Filename sanitization — no header injection from an operator-authored filename ──
-
-  it("sanitizes CR/LF out of the filename before it reaches Content-Disposition", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow({ filename: 'evil.pdf"\r\nX-Injected: true' }),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    const disposition = res.headers["content-disposition"] as string;
-    expect(disposition).not.toContain("\r");
-    expect(disposition).not.toContain("\n");
-    expect(res.headers["x-injected"]).toBeUndefined();
-  });
-
-  it("falls back to a safe default filename when sanitization empties the name", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      grantRow(),
-    );
-    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(
-      assetRow({ filename: "\r\n\r\n" }),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["content-disposition"]).toContain("download");
-  });
-
-  // ── flows_not_configured-style guard ────────────────────────────────────
-
-  it("returns 503 when DATABASE_URL is unset (feature not configured; NOT attacker-distinguishing)", async () => {
-    delete process.env.DATABASE_URL;
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(prisma.deliverableGrant.findUnique).not.toHaveBeenCalled();
-  });
-
-  // ── FEAT-074 U4b (#4718) D4 — the playbook: virtual asset (AC-1) ─────────
-
-  const LIBRARY = loadVendoredPlayLibrary();
-  const LEAD_ID = "lead_00000000-0000-7000-8000-0000000000e1";
-
-  function playbookGrantRow(overrides: Partial<Record<string, unknown>> = {}) {
-    return grantRow({
-      assetId: "playbook:targeting-maturity",
-      leadId: LEAD_ID,
-      ...overrides,
-    });
-  }
-
-  function playbookInstanceRow(level: number) {
-    const { source, markdown } = compilePlaybook({
-      score: { id: `wlscore_${level}`, tier: `level_${level}`, ruleTrace: [] },
-      plays: LIBRARY,
-      leadId: LEAD_ID,
-    });
-    return { level, source, markdown };
-  }
-
-  it("renders and serves a PDF for a playbook: grant, filename playbook-level-<N>.pdf", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      playbookGrantRow(),
-    );
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
-      playbookInstanceRow(5),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["content-type"]).toBe("application/pdf");
-    expect(res.headers["content-disposition"]).toBe(
-      'attachment; filename="playbook-level-5.pdf"',
-    );
-    expect(res.headers["x-content-type-options"]).toBe("nosniff");
-    expect(res.rawPayload.subarray(0, 4).toString("latin1")).toBe("%PDF");
-    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("labels the Gate (Level 0) filename playbook-gate.pdf, never playbook-level-0.pdf", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      playbookGrantRow(),
-    );
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
-      playbookInstanceRow(0),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["content-disposition"]).toBe(
-      'attachment; filename="playbook-gate.pdf"',
-    );
-  });
-
-  it("scopes the PlaybookInstance read by grant.siteId AND grant.leadId — never a request-supplied id (AC-1 tenancy)", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      playbookGrantRow(),
-    );
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(
-      playbookInstanceRow(1),
-    );
-
-    await app.inject({ method: "GET", url: `/v1/deliverables/${GRANT_ID}` });
-
-    expect(prisma.playbookInstance.findFirst).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { siteId: SITE_ID, leadId: LEAD_ID, experimentKey: "targeting-maturity" },
-      }),
-    );
-  });
-
-  it("returns a uniform 404 when the lead has no PlaybookInstance (AC-1)", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      playbookGrantRow(),
-    );
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: expect.any(String) },
-    });
-  });
-
-  it("returns 500 render_failed (never a bare uncaught throw) when the stored source names a play the current library no longer declares", async () => {
-    (prisma.deliverableGrant.findUnique as jest.Mock).mockResolvedValue(
-      playbookGrantRow(),
-    );
-    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({
-      level: 0,
-      source: {
-        artifact_type: "playbook",
-        scope: "person",
-        scope_ref: LEAD_ID,
-        method: "targeting-maturity",
-        level: 0,
-        plays: ["tm-999.999"],
-        compiled_from: "wlscore_defect",
-      },
-      markdown: "",
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/deliverables/${GRANT_ID}`,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "render_failed", message: expect.any(String) },
-    });
-  });
-});