create-ailk 0.1.1 → 0.3.0

package/templates/apps/api/src/services/flow-checkouts.ts

@@ -1,123 +0,0 @@
-/**
- * @file flow-checkouts.ts
- * @description The respondent checkouts read (#4984) — `readMyCheckouts`,
- * the ONLY read path behind `GET /v1/flow-checkouts/me`: a signed-in,
- * email-verified user lists their OWN flow checkouts. Nothing here
- * enumerates, nothing accepts an email, nothing reads across sites.
- *
- * Mirrors `lead-promotion.ts` (ADR 0009 D3 service-layer pattern): the same
- * `User {id, email, emailVerified}` read, the same verified-email refusal
- * (D2 there — the consent basis for linking anonymous-lead PII to a user;
- * here a hard 403, evaluated BEFORE any Lead read), and a scalar-only join
- * to the inbox namespace — `Lead` carries no `@relation` (ADR 0009
- * invariant #1), so the read is three narrow queries, each scoped to
- * `currentSiteId()` (#4665 D3: the scope is a parameter of every query,
- * never a post-filter).
- *
- * The join is the promotion link and ONLY the promotion link:
- * `Lead.promotedUserId === userId`, the scalar `lead-promotion.ts` stamps once
- * the user's email is verified. A Lead is NEVER matched by email at read time
- * — an un-promoted lead that happens to carry the caller's address is not
- * theirs until promotion says so (the #4984 security fence; contrast
- * `waitlist-signups.ts`, whose contract is a single experiment-scoped row).
- *
- * PII boundary: logs carry only `{ siteId, userId, kind }` — never email,
- * a Stripe id, a quote, or a permalink; the row select is the ten contract
- * fields and nothing else.
- */
-
-import type { FlowCheckoutMeResponse } from "@working-theory/validation";
-
-import { prisma } from "../lib/prisma.js";
-import { currentSiteId } from "../lib/site.js";
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export type ReadMyCheckoutsResult =
-  | { ok: true; value: FlowCheckoutMeResponse }
-  | {
-      ok: false;
-      error: {
-        kind: "not_found_user" | "email_unverified";
-        message: string;
-      };
-    };
-
-// ─── Main export ──────────────────────────────────────────────────────────────
-
-/**
- * List the calling user's flow checkouts at the current site, newest first.
- * `userId` is the auth preHandler's `request.userId` — the ONLY identity
- * input; there is no other parameter.
- *
- * Result kinds (the route maps them to HTTP):
- *   - `not_found_user`   — no `User` row for `userId` (404 on the wire).
- *   - `email_unverified` — `User.emailVerified !== true`; refused BEFORE any
- *                          Lead read (403).
- * A verified user with no promoted lead (or no checkout) is `ok` with an
- * empty list — an empty list is not an error.
- */
-export async function readMyCheckouts(userId: string): Promise<ReadMyCheckoutsResult> {
-  const siteId = currentSiteId();
-
-  // D2 — the exact read lead-promotion.ts performs, mirrored not forked.
-  const user = await prisma.user.findUnique({
-    where: { id: userId },
-    select: { id: true, email: true, emailVerified: true },
-  });
-  if (!user) {
-    return { ok: false, error: { kind: "not_found_user", message: "User not found" } };
-  }
-
-  // D2 — the verified-email gate is a service-level invariant: an unverified
-  // address never reaches a Lead read, whatever the call site.
-  if (user.emailVerified !== true) {
-    return {
-      ok: false,
-      error: { kind: "email_unverified", message: "Verify your email to view your checkouts" },
-    };
-  }
-
-  // The promotion link is the ONLY join — never `email` — and the scope is
-  // ANDed in, never a post-filter.
-  const leads = await prisma.lead.findMany({
-    where: { siteId, promotedUserId: userId },
-    select: { id: true },
-  });
-  if (leads.length === 0) return { ok: true, value: [] };
-
-  const rows = await prisma.flowCheckout.findMany({
-    where: { siteId, leadId: { in: leads.map((lead) => lead.id) } },
-    orderBy: { createdAt: "desc" },
-    select: {
-      id: true,
-      flowSlug: true,
-      experimentKey: true,
-      offerKey: true,
-      status: true,
-      amountMinor: true,
-      currency: true,
-      period: true,
-      completedAt: true,
-      createdAt: true,
-    },
-  });
-
-  // Ten fields per row, nothing more — no Stripe id, quote, permalink,
-  // session id, or lead id leaves the row.
-  return {
-    ok: true,
-    value: rows.map((row) => ({
-      id: row.id,
-      flowSlug: row.flowSlug,
-      experimentKey: row.experimentKey,
-      offerKey: row.offerKey,
-      status: row.status,
-      amountMinor: row.amountMinor,
-      currency: row.currency,
-      period: row.period,
-      completedAt: row.completedAt?.toISOString() ?? null,
-      createdAt: row.createdAt.toISOString(),
-    })),
-  };
-}