create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/services/__tests__/tenant-context-cascade.test.ts

@@ -1,71 +0,0 @@
-// oss: false
-/**
- * @file tenant-context-cascade.test.ts
- *
- * Unit test for `deleteWorkspaceConfig` — the STC-P4 (#3634) service-layer
- * delete-cascade HELPER (Option 1: helper only, no route/caller). Proves the
- * cascade issues exactly three workspace-scoped `deleteMany` calls (theme,
- * identity, seo) and removes ONLY the target workspace's rows (AC-STC-06).
- *
- * SECURITY-SENSITIVE (tenant isolation) — see spec §5.3: the mandatory
- * `security-reviewer` verifies the cascade cannot delete another workspace's
- * rows.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary; __mocks__/prisma.ts is the repo-standard test double.
-jest.mock("../../lib/prisma.js");
-
-import { prisma } from "../../lib/prisma.js";
-import { deleteWorkspaceConfig } from "../tenant-context";
-
-const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
-const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
-
-const CONFIG_MODELS = [
-  "workspaceTheme",
-  "workspaceSiteIdentity",
-  "workspaceSEO",
-] as const;
-
-beforeEach(() => {
-  jest.clearAllMocks();
-});
-
-describe("deleteWorkspaceConfig — workspace-scoped delete-cascade (#3634 Option 1)", () => {
-  it("issues exactly three deleteMany({ where: { workspaceId } }) — one per config table — scoped to the passed workspace", async () => {
-    for (const model of CONFIG_MODELS) {
-      (prisma[model].deleteMany as jest.Mock).mockResolvedValue({ count: 1 });
-    }
-
-    await deleteWorkspaceConfig(WS_A);
-
-    for (const model of CONFIG_MODELS) {
-      expect(prisma[model].deleteMany).toHaveBeenCalledTimes(1);
-      expect(prisma[model].deleteMany).toHaveBeenCalledWith({
-        where: { workspaceId: WS_A },
-      });
-    }
-  });
-
-  it("removes ONLY the target workspace's rows — a where-honoring store proves wsB is untouched", async () => {
-    // Seed both workspaces' rows in each model, delete wsA, assert wsB survives.
-    const stores = CONFIG_MODELS.map((model) => {
-      const store = new Set<string>([WS_A, WS_B]);
-      (prisma[model].deleteMany as jest.Mock).mockImplementation(
-        ({ where }: { where: { workspaceId?: string } }) => {
-          const had = where.workspaceId ? store.has(where.workspaceId) : false;
-          if (where.workspaceId) store.delete(where.workspaceId);
-          return Promise.resolve({ count: had ? 1 : 0 });
-        },
-      );
-      return store;
-    });
-
-    await deleteWorkspaceConfig(WS_A);
-
-    for (const store of stores) {
-      expect(store.has(WS_A)).toBe(false);
-      expect(store.has(WS_B)).toBe(true);
-    }
-  });
-});

package/templates/apps/api/src/services/__tests__/tenant-context.test.ts

@@ -1,379 +0,0 @@
-// oss: false
-/**
- * @file tenant-context.test.ts
- *
- * Unit tests for `resolveActiveTenant`'s single-tenant default-scope
- * resolution — the owner-pin privilege-escalation fix (#3631,
- * docs/specs/single-tenant-owner-pin-spec.md AC-1 … AC-6). Supersedes the
- * #3627 Phase-2 tests: the original AC-1 encoded the now-fixed bug (an
- * unconditional `role: "owner"` grant, keyed on `workspace.count() === 1`,
- * with NO Membership check). Mocks the module-level `prisma` singleton via
- * the repo's manual-mock convention (`jest.mock("../../lib/prisma.js")` →
- * `apps/api/src/lib/__mocks__/prisma.ts`) — `resolveActiveTenant` has no DI
- * seam; it reads the `prisma` singleton directly.
- *
- * SECURITY-SENSITIVE (tenant isolation) — see spec §5.3: these tests are the
- * objective pass/fail record the mandatory `security-reviewer` verifies
- * against.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import { prisma } from "../../lib/prisma.js";
-import type { SessionTenant } from "../../middleware/auth.js";
-import { resolveActiveTenant } from "../tenant-context";
-
-// The reserved-range sentinel values from database/tenancy.ts (ADR-0031
-// rule 7) — re-declared here as literals so the test pins the WIRE values,
-// not whatever the constants happen to be.
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-const OPERATOR_MEMBERSHIP_ID = "member_00000000-0000-7000-8000-000000000001";
-
-function unboundSession(): SessionTenant {
-  return {
-    sessionRowId: "session-1",
-    activeOrganizationId: null,
-    activeWorkspaceId: null,
-  };
-}
-
-function boundSession(
-  workspaceId: string,
-  organizationId: string,
-): SessionTenant {
-  return {
-    sessionRowId: "session-1",
-    activeOrganizationId: organizationId,
-    activeWorkspaceId: workspaceId,
-  };
-}
-
-/**
- * Stubs the single-tenant guard prerequisites (`count === 1`, default
- * Workspace present) shared by every test that exercises the single-tenant
- * branch. Individual tests still stub `membership.findUnique` /
- * `membership.create` / `user.findUnique` themselves.
- */
-function mockSingleTenantWorkspace(): void {
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-    id: DEFAULT_WORKSPACE_ID,
-    organizationId: DEFAULT_ORG_ID,
-  });
-}
-
-const ORIGINAL_ENV = process.env;
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  process.env = { ...ORIGINAL_ENV };
-  delete process.env.AILK_OPERATOR_EMAIL;
-});
-
-afterAll(() => {
-  process.env = ORIGINAL_ENV;
-});
-
-describe("resolveActiveTenant — single-tenant owner-pin (#3631)", () => {
-  it("AC-1: single-tenant, unbound session, caller HOLDS a Membership on the default Org — resolves owner via a real membership.findUnique (the prior D4 bypass is gone)", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveActiveTenant({
-      userId: "solo-operator",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.value.workspaceId).toBe(DEFAULT_WORKSPACE_ID);
-      expect(result.value.organizationId).toBe(DEFAULT_ORG_ID);
-      expect(result.value.role).toBe("owner");
-    }
-    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
-  });
-
-  it("AC-2 (the fix): single-tenant, unbound session, caller has NO Membership (a prior operator already holds OPERATOR_MEMBERSHIP_ID, so this caller's create raises P2002) — DENIES; a second single-tenant OAuth user is not auto-owner", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockRejectedValue({
-      code: "P2002",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveActiveTenant({
-      userId: "second-oauth-user",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
-  });
-
-  it("AC-3: TOFU — no Membership yet, no env pin: bindOperatorMembership issues membership.create with id===OPERATOR_MEMBERSHIP_ID, organizationId===DEFAULT_ORG_ID, role===owner; the caller then resolves owner", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockResolvedValue({
-      id: OPERATOR_MEMBERSHIP_ID,
-      organizationId: DEFAULT_ORG_ID,
-      userId: "first-operator",
-      role: "owner",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveActiveTenant({
-      userId: "first-operator",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(prisma.membership.create).toHaveBeenCalledWith({
-      data: {
-        id: OPERATOR_MEMBERSHIP_ID,
-        organizationId: DEFAULT_ORG_ID,
-        userId: "first-operator",
-        role: "owner",
-      },
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.value.role).toBe("owner");
-    }
-  });
-
-  it("AC-3 (continued): a second, different caller's create raises P2002 (swallowed) — no second owner is created, and that caller is denied (AC-2)", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockRejectedValue({
-      code: "P2002",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveActiveTenant({
-      userId: "second-user",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-  });
-
-  it("AC-4: env pin — a caller whose email does NOT match AILK_OPERATOR_EMAIL is not bound (no membership.create) and is denied", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "op@x.io";
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: "attacker@evil.com",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveActiveTenant({
-      userId: "attacker",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(prisma.user.findUnique).toHaveBeenCalledWith({
-      where: { id: "attacker" },
-      select: { email: true },
-    });
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-  });
-
-  it("AC-4 (continued): env pin — a caller whose email MATCHES (case-insensitive, trimmed) is bound and resolves owner", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "  Op@X.io  ";
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: "op@x.io",
-    });
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveActiveTenant({
-      userId: "the-operator",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(prisma.membership.create).toHaveBeenCalledWith({
-      data: {
-        id: OPERATOR_MEMBERSHIP_ID,
-        organizationId: DEFAULT_ORG_ID,
-        userId: "the-operator",
-        role: "owner",
-      },
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.value.role).toBe("owner");
-    }
-  });
-
-  it("AC-4 (empty-pin edge — spec §5.3(d)): a blank/whitespace-only AILK_OPERATOR_EMAIL is treated as unset — pure TOFU, no email lookup, never matches a blank User.email", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "   ";
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveActiveTenant({
-      userId: "any-caller",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
-    expect(result.ok).toBe(true);
-  });
-
-  it("AC-5 (regression floor): multi-tenant unbound (count>1) DENIES — default-deny preserved, no default scope granted, no membership.create", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(2);
-
-    const result = await resolveActiveTenant({
-      userId: "some-user",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
-    expect(prisma.membership.findUnique).not.toHaveBeenCalled();
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-  });
-
-  it("AC-5 (regression floor): explicit-binding path is unchanged — workspace-exists + org-match + membership required; missing Membership still denies; the single-tenant default branch is NOT entered", async () => {
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: "real-workspace",
-      organizationId: "real-org",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveActiveTenant({
-      userId: "member-user",
-      sessionTenant: boundSession("real-workspace", "real-org"),
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-  });
-
-  it("AC-5 (regression floor): explicit-binding path grants a scope when workspace + membership both resolve", async () => {
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: "real-workspace",
-      organizationId: "real-org",
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "admin",
-    });
-
-    const result = await resolveActiveTenant({
-      userId: "member-user",
-      sessionTenant: boundSession("real-workspace", "real-org"),
-    });
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.value.workspaceId).toBe("real-workspace");
-      expect(result.value.role).toBe("admin");
-    }
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-  });
-
-  it("AC-5 (regression floor): count===1 but the sole workspace id !== DEFAULT_WORKSPACE_ID DENIES — the branch binds on DEFAULT_WORKSPACE_ID, not any single workspace", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-    // The DEFAULT_WORKSPACE_ID lookup returns null: the sole workspace in this
-    // deployment has some other (real, DB-generated prefixed-uuid) id.
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveActiveTenant({
-      userId: "some-user",
-      sessionTenant: unboundSession(),
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error.kind).toBe("forbidden");
-    }
-    expect(prisma.membership.findUnique).not.toHaveBeenCalled();
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-  });
-
-  it("AC-6 (race): two concurrent first-caller resolves against the mocked unique constraint converge to EXACTLY ONE owner — the create-losing caller swallows P2002 and is denied", async () => {
-    mockSingleTenantWorkspace();
-    let membershipBoundTo: string | null = null;
-    (prisma.membership.create as jest.Mock).mockImplementation(
-      ({ data }: { data: { userId: string } }) => {
-        if (membershipBoundTo !== null) {
-          return Promise.reject({ code: "P2002" });
-        }
-        membershipBoundTo = data.userId;
-        return Promise.resolve({
-          id: OPERATOR_MEMBERSHIP_ID,
-          organizationId: DEFAULT_ORG_ID,
-          userId: data.userId,
-          role: "owner",
-        });
-      },
-    );
-    (prisma.membership.findUnique as jest.Mock).mockImplementation(
-      ({
-        where,
-      }: {
-        where: { organizationId_userId: { userId: string } };
-      }) =>
-        Promise.resolve(
-          where.organizationId_userId.userId === membershipBoundTo
-            ? { role: "owner" }
-            : null,
-        ),
-    );
-
-    const results = await Promise.all([
-      resolveActiveTenant({
-        userId: "caller-a",
-        sessionTenant: unboundSession(),
-      }),
-      resolveActiveTenant({
-        userId: "caller-b",
-        sessionTenant: unboundSession(),
-      }),
-    ]);
-
-    // Exactly one OPERATOR_MEMBERSHIP_ID row results from two concurrent
-    // first-callers — the PK-uniqueness invariant (D2). This test does not
-    // depend on WHICH of the two callers wins (that's scheduling order, not
-    // the invariant under test).
-    expect(prisma.membership.create).toHaveBeenCalledTimes(2);
-    const oks = results.map((r) => r.ok);
-    expect(oks.filter((ok) => ok === true)).toHaveLength(1);
-    expect(oks.filter((ok) => ok === false)).toHaveLength(1);
-    const denied = results.find((r) => !r.ok);
-    if (denied && !denied.ok) {
-      expect(denied.error.kind).toBe("forbidden");
-    }
-    const granted = results.find((r) => r.ok);
-    if (granted && granted.ok) {
-      expect(granted.value.role).toBe("owner");
-    }
-  });
-});