create-ailk 0.11.1 → 0.11.3

package/templates/apps/api/src/routes/auth/transactional-email.ts

@@ -43,6 +43,7 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 import {
   sendEmailVerificationEmail,
+  sendMagicLink,
   sendPasswordChangedEmail,
   sendPasswordResetEmail,
 } from "@working-theory/email";
@@ -75,6 +76,7 @@ const KINDS = new Set<AuthEmailKind>([
   "password-reset",
   "email-verification",
   "password-changed",
+  "magic-link",
 ]);
 
 type RelayBody = {
@@ -134,10 +136,13 @@ function parseBody(rawBody: string): RelayBody | null {
   ) {
     return null;
   }
-  // The two link-carrying kinds need a url; the notice must NOT have one
+  // The three link-carrying kinds need a url; the notice must NOT have one
   // acted on even if a caller supplies it (§ D17 — the notice carries no
   // credential, and that is enforced by the sender's input type too).
-  const needsUrl = kind === "password-reset" || kind === "email-verification";
+  const needsUrl =
+    kind === "password-reset" ||
+    kind === "email-verification" ||
+    kind === "magic-link";
   if (needsUrl && (typeof url !== "string" || url.length === 0)) return null;
   if (expiresInMinutes !== undefined && typeof expiresInMinutes !== "number") {
     return null;
@@ -152,6 +157,34 @@ function parseBody(rawBody: string): RelayBody | null {
   };
 }
 
+/**
+ * One fixed template per kind. Exhaustive: a kind added to `AuthEmailKind`
+ * without a branch here fails the type check.
+ */
+function sendFor(
+  kind: AuthEmailKind,
+  to: string,
+  linkInput: { to: string; url: string; fromAddress: string; expiresInMinutes?: number },
+  fromAddress: string,
+) {
+  switch (kind) {
+    case "password-changed":
+      return sendPasswordChangedEmail({ to, fromAddress });
+    case "email-verification":
+      return sendEmailVerificationEmail(linkInput);
+    case "password-reset":
+      return sendPasswordResetEmail(linkInput);
+    case "magic-link":
+      // The template's copy fixes its own lifetime ("expires in 5 minutes")
+      // and its input has no expiry field, so none is forwarded (#7435 § D4).
+      return sendMagicLink({ to, url: linkInput.url, fromAddress });
+    default: {
+      const unreachable: never = kind;
+      throw new Error(`unhandled auth email kind: ${String(unreachable)}`);
+    }
+  }
+}
+
 export const transactionalEmailRoute: FastifyPluginAsync = async (fastify) => {
   fastify.post(
     "/v1/auth/transactional-email",
@@ -229,7 +262,7 @@ export const transactionalEmailRoute: FastifyPluginAsync = async (fastify) => {
       }
 
       // `kind` selects from FIXED templates. A caller supplies no subject and
-      // no copy — only a recipient and, for the two link kinds, a URL.
+      // no copy — only a recipient and, for the three link kinds, a URL.
       const linkInput = {
         to: body.to,
         url: body.url ?? "",
@@ -238,12 +271,7 @@ export const transactionalEmailRoute: FastifyPluginAsync = async (fastify) => {
           ? { expiresInMinutes: body.expiresInMinutes }
           : {}),
       };
-      const result =
-        body.kind === "password-changed"
-          ? await sendPasswordChangedEmail({ to: body.to, fromAddress })
-          : body.kind === "email-verification"
-            ? await sendEmailVerificationEmail(linkInput)
-            : await sendPasswordResetEmail(linkInput);
+      const result = await sendFor(body.kind, body.to, linkInput, fromAddress);
 
       if (!result.ok) {
         // `error.kind` only — `error.message` can quote an address (§ D12).

package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts

@@ -91,7 +91,10 @@ import { checkoutRoutes } from "../index";
 // #6877 — pin the suite's site origin to the fixtures' own origin, so every
 // anonymous case below sends same-origin redirects. Runs before any
 // `describe` is collected, so the #6866 block's SAME_ORIGIN reads it too.
+// #7395 — the redirect lock and the buyer's cookie check read the trusted
+// allowlist, not FRONTEND_URL, so the suite pins both.
 config.FRONTEND_URL = "https://example.com";
+config.TRUSTED_ORIGINS = ["https://example.com"];
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -1298,6 +1301,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
   beforeEach(async () => {
     jest.clearAllMocks();
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
     delete process.env["OSS_API_INTERNAL_SECRET"];
     mockAssertSandboxKey.mockImplementation(() => undefined);
@@ -1328,6 +1332,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     delete process.env["STRIPE_SECRET_KEY"];
     delete process.env["OSS_API_INTERNAL_SECRET"];
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
     else process.env.DATABASE_URL = originalDatabaseUrl;
   });
@@ -1453,45 +1458,24 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 
-  it.each([
-    [
-      "an unparseable FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "not a url";
-      },
-    ],
-    [
-      "a non-http(s) FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "mailto:ops@example.com";
-      },
-    ],
-    [
-      "an unset FRONTEND_URL in production",
-      () => {
-        delete process.env.FRONTEND_URL;
-        config.NODE_ENV = "production";
-      },
-    ],
-  ])(
-    "#6877 R8: %s answers 500 config-error with no Stripe call",
-    async (_label, arrange) => {
-      const envFrontendUrl = process.env.FRONTEND_URL;
-      const nodeEnv = config.NODE_ENV;
-      try {
-        arrange();
-        const res = await post(VALID_BODY);
-
-        expect(res.statusCode).toBe(500);
-        expect(res.json()).toEqual({ error: "config-error" });
-        expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-      } finally {
-        config.FRONTEND_URL = SITE_ORIGIN;
-        config.NODE_ENV = nodeEnv;
-        process.env.FRONTEND_URL = envFrontendUrl;
-      }
-    },
-  );
+  // #7395 D4 — what an unusable or unset FRONTEND_URL did here before
+  // (#6877 R8) is now an empty trusted list: config resolves both to `[]`
+  // (config/__tests__/trusted-origins.test.ts), and the route answers the
+  // same 500.
+  it("#6877 R8: an empty trusted-origin list answers 500 config-error with no Stripe call", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post(VALID_BODY);
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    expect(
+      logLines.some(
+        (l) => l["msg"] === "[checkout] no trusted browser origin is configured",
+      ),
+    ).toBe(true);
+  });
 
   it("#6877 R9: a refused request never reads the session cookie's row", async () => {
     process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
@@ -1514,3 +1498,148 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 });
+
+// ── Trusted-origin allowlist (#7395) ──────────────────────────────────────────
+
+describe("POST /v1/checkout/sessions — trusted-origin allowlist (#7395)", () => {
+  const SITE_ORIGIN = "https://example.com";
+  const SPOKE_A = "https://spoke-a.example";
+  const SESSION_TOKEN = "sess_tok_7395";
+  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+
+  let app: FastifyInstance;
+
+  function post(
+    payload: Record<string, unknown>,
+    headers: Record<string, string> = {},
+  ) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      headers,
+      payload,
+    });
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN, SPOKE_A];
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    delete process.env["OSS_API_INTERNAL_SECRET"];
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_allow7395",
+      url: "https://checkout.stripe.com/c/pay/cs_test_allow7395",
+    });
+
+    app = buildApp();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
+    (prisma.session.findUnique as jest.Mock).mockReset();
+    (prisma.user.findUnique as jest.Mock).mockReset();
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it("accepts an anonymous checkout with both redirects on a listed spoke", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SPOKE_A}/purchase/cancel`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it("accepts redirects split across two listed origins", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SITE_ORIGIN}/pricing`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it.each([
+    ["successUrl", "https://spoke-b.example/x"],
+    ["successUrl", "https://spoke-a.example.evil.test/x"],
+    ["cancelUrl", "https://spoke-b.example/x"],
+    ["cancelUrl", "https://spoke-a.example.evil.test/x"],
+  ])(
+    "refuses a %s on the unlisted %j with 400 naming the field and no Stripe call",
+    async (field, url) => {
+      const res = await post({ ...VALID_BODY, [field]: url });
+
+      expect(res.statusCode).toBe(400);
+      const body = res.json();
+      expect(body.error).toBe("validation-error");
+      expect(body.details).toHaveLength(1);
+      expect(body.details[0].path).toEqual([field]);
+      expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("answers 500 config-error with no Stripe call when the list is empty", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: `${SPOKE_A}/purchase/success`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("signs the buyer in for a valid cookie forwarded with a listed spoke's Origin", async () => {
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_buyer",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+    (prisma.user.findUnique as jest.Mock).mockImplementation(
+      async (args: { select: Record<string, boolean> }) => {
+        const row: Record<string, unknown> = {
+          id: "usr_buyer",
+          email: "buyer@example.com",
+          emailVerified: true,
+          billingProvider: null,
+          billingCustomerId: null,
+        };
+        return Object.fromEntries(
+          Object.keys(args.select).map((k) => [k, row[k]]),
+        );
+      },
+    );
+
+    const res = await post(
+      {
+        productCode: "ailk-pro",
+        successUrl: `${SPOKE_A}/purchase/success`,
+        cancelUrl: `${SPOKE_A}/purchase/cancel`,
+      },
+      { cookie: COOKIE, origin: SPOKE_A },
+    );
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer).toEqual({
+      userId: "usr_buyer",
+      email: "buyer@example.com",
+    });
+  });
+});

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -28,13 +28,14 @@
  *     (backward-compat for OSS standalone deployments). See #935.
  *   - Same-origin redirects (#6877): a request that did not pass an ENABLED
  *     internal-auth gate (the OSS default) must send successUrl and cancelUrl
- *     on the site's own origin — `FRONTEND_URL`'s, exact scheme + host + port,
- *     checked on the raw string as well as on the parse, because the raw
- *     string is what Stripe receives. Anything else is a 400 before any Stripe
- *     call or database read. A caller authenticated by X-Internal-Auth keeps
- *     its redirects; that exemption holds only while every internal caller
- *     builds its redirects itself — an internal caller MUST NEVER forward a
- *     redirect taken from its own end user.
+ *     each on one of the trusted browser origins — `config.TRUSTED_ORIGINS`
+ *     (#7395: FRONTEND_URL's origin plus AILK_TRUSTED_ORIGINS), exact scheme +
+ *     host + port, checked on the raw string as well as on the parse, because
+ *     the raw string is what Stripe receives. Anything else is a 400 before
+ *     any Stripe call or database read. A caller authenticated by
+ *     X-Internal-Auth keeps its redirects; that exemption holds only while
+ *     every internal caller builds its redirects itself — an internal caller
+ *     MUST NEVER forward a redirect taken from its own end user.
  *
  * Error mapping:
  *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
@@ -44,8 +45,8 @@
  *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
  *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
  *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper),
- *                               or FRONTEND_URL is not an absolute http(s) URL / is unset in
- *                               production when the origin lock applies (#6877)
+ *                               or no trusted browser origin is configured when the origin
+ *                               lock applies (#6877, #7395)
  *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
  */
 import { timingSafeEqual } from "node:crypto";
@@ -154,26 +155,6 @@ function internalAuthVerdict(
 
 // ── Same-origin redirect lock (#6877) ────────────────────────────────────────
 
-/**
- * The site's own origin, from `FRONTEND_URL` (#6877 D6). `null` when the
- * setting does not parse, parses to a non-http(s) scheme (whose origin would
- * be the literal `"null"`), or is unset in production — where the config
- * default `http://localhost:3000` would lock a live site to localhost.
- */
-function siteRedirectOrigin(): string | null {
-  if (!process.env["FRONTEND_URL"] && config.NODE_ENV === "production") {
-    return null;
-  }
-  let parsed: URL;
-  try {
-    parsed = new URL(config.FRONTEND_URL);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-  return parsed.origin;
-}
-
 /** C0 controls, space, DEL and backslash — anything a parser may normalize. */
 // eslint-disable-next-line no-control-regex -- the control-character range is exactly what D2 check 1 must refuse.
 const NON_CANONICAL_URL_CHAR = /[\u0000-\u0020\u007f\\]/;
@@ -225,7 +206,7 @@ async function resolveBuyer(
   request: FastifyRequest,
 ): Promise<{ buyer?: Buyer; identity?: IdentityReason }> {
   const cookieUser = await resolveOptionalCookieUser(request, {
-    frontendOrigin: config.FRONTEND_URL,
+    trustedOrigins: config.TRUSTED_ORIGINS,
   });
   if (cookieUser.kind === "none") {
     return cookieUser.reason === "no_cookie"
@@ -279,16 +260,21 @@ export async function checkoutSessionsHandler(
 
   // ── Same-origin redirect lock (#6877) — before any Stripe or DB call ──────
   if (authVerdict === "open") {
-    const siteOrigin = siteRedirectOrigin();
-    if (siteOrigin === null) {
+    // An empty list is FRONTEND_URL unset in production or unusable, with no
+    // AILK_TRUSTED_ORIGINS (#7395 D4) — refused before any Stripe or DB call.
+    const trustedOrigins = config.TRUSTED_ORIGINS;
+    if (trustedOrigins.length === 0) {
       request.log.error(
         { method: request.method, path: request.url },
-        "[checkout] FRONTEND_URL is not a valid absolute URL",
+        "[checkout] no trusted browser origin is configured",
       );
       return reply.status(500).send({ error: "config-error" });
     }
     const refused = (["successUrl", "cancelUrl"] as const).filter(
-      (field) => !isSameOriginRedirect(parsed.data[field], siteOrigin),
+      (field) =>
+        !trustedOrigins.some((origin) =>
+          isSameOriginRedirect(parsed.data[field], origin),
+        ),
     );
     if (refused.length > 0) {
       // Field names only — the refused URL is never logged or echoed.

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -267,7 +267,7 @@ function installFixtureMocks(): void {
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
   await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
     await authScope.register(projectListingMeRoute);
   });
   await app.ready();

package/templates/apps/api/src/server.ts

@@ -32,7 +32,9 @@ import { authPreHandlerPlugin } from "./middleware/auth.js";
 import { defaultTenantPreHandlerPlugin } from "./middleware/default-tenant.js";
 import {
   rateLimitMiddleware,
+  buildTrustedKeyDigests,
   DEFAULT_PER_IP_PER_MINUTE_STRICT,
+  resolveRateLimitIdentity,
 } from "./middleware/rate-limit.js";
 import { openapiRoutes } from "./openapi/index.js";
 import {
@@ -512,18 +514,19 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * #6889 (SEC-02 of the #6876 security review) — make the checkout route's
  * posture observable. POST /v1/checkout/sessions admits a caller without
  * X-Internal-Auth when OSS_API_INTERNAL_SECRET is unset. With FRONTEND_URL
- * unset, the route's same-origin redirect lock (#6877) answers 500
- * config-error to that caller, and the CORS and cookie-CSRF origin checks pin
- * to the `http://localhost:3000` config default. Both stay optional (OSS
- * standalone compat), so this only ever WARNS — once per unset variable, and
- * only in production. FRONTEND_URL is read from the raw environment because
- * `config.FRONTEND_URL` carries that localhost default.
+ * unset in production, the trusted-origin list (#7395) holds only
+ * AILK_TRUSTED_ORIGINS — with that unset too, CORS and cookie writes refuse
+ * every browser origin and the redirect lock (#6877) answers 500
+ * config-error to that caller. Both stay optional (OSS standalone compat), so
+ * this only ever WARNS — once per unset variable, and only in production.
+ * FRONTEND_URL is read from the raw environment because `config.FRONTEND_URL`
+ * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
-      "[startup] FRONTEND_URL not set in production — CORS/cookie origin checks are pinned to http://localhost:3000, and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
+      "[startup] FRONTEND_URL not set in production — CORS, cookie-authenticated writes and checkout redirects trust only AILK_TRUSTED_ORIGINS; with neither set, all three refuse every browser origin and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
     );
   }
   if (!process.env["OSS_API_INTERNAL_SECRET"]) {
@@ -614,6 +617,17 @@ export async function build() {
     trustProxy: true,
   });
 
+  // The hub's forwarding-key digests (#7394 DD-2), parsed once from
+  // AILK_VISITOR_FORWARD_KEYS and shared by the global ceiling and the leads
+  // scope below, so both limiters apply one identity rule. A keyed spoke's
+  // lead write is counted per visitor (`x-ailk-visitor-ip`); everything else
+  // keys on `req.ip`. Unset → `[]`, which believes no forwarded visitor. The
+  // parse warns by entry position only, never an entry's value.
+  const visitorForwardKeyDigests = buildTrustedKeyDigests(
+    process.env.AILK_VISITOR_FORWARD_KEYS,
+    (msg) => server.log.warn(msg),
+  );
+
   // Collect the route table this server registers (#5314).
   //
   // Installed here — after `Fastify()` and before the first `register()` — so
@@ -645,12 +659,16 @@ export async function build() {
   // never reach the client. Full detail still goes to pino at error level.
   registerErrorSerializer(server);
 
-  // Register CORS — public read API + same-origin auth callers.
-  // With FRONTEND_URL unset: reflect any origin in dev/test (zero-config
-  // boot) but fail CLOSED in production — `origin: true` combined with
-  // `credentials: true` would let any website read credentialed responses
-  // (security review M1). `false` disables cross-origin access entirely;
-  // same-origin and non-browser callers are unaffected.
+  // Register CORS — public read API + the trusted browser origins (#7395).
+  // `origin` is ALWAYS a copy of `config.TRUSTED_ORIGINS`, the frozen list
+  // config/index.ts resolves once at startup from FRONTEND_URL and
+  // AILK_TRUSTED_ORIGINS (no `*`, no wildcard host). @fastify/cors echoes a
+  // request's Origin only on an exact match against that array, and writes no
+  // allow-origin header otherwise; an empty list means no cross-origin caller.
+  // Never pass `true`, a function, a RegExp or a delegator here, and never set
+  // a per-route `cors` option: with `credentials: true`, reflecting any origin
+  // would let any website read credentialed responses (security review M1).
+  // Same-origin and non-browser callers are unaffected.
   //
   // `methods` is EXPLICIT because @fastify/cors defaults it to `GET,HEAD,POST`
   // (its own `defaultOptions`), which is narrower than the surface this server
@@ -666,7 +684,7 @@ export async function build() {
   // live route table on every run, so a route added in a NEW method fails there
   // rather than silently becoming unreachable from a browser.
   //
-  // This widens WHICH METHODS the allowed origin may use, never WHO is allowed:
+  // This widens WHICH METHODS the allowed origins may use, never WHO is allowed:
   // `origin` and `credentials` are untouched.
   //
   // `allowedHeaders` is deliberately left unset: null means @fastify/cors
@@ -674,7 +692,7 @@ export async function build() {
   // and `content-type` pass without this file having to maintain a list that
   // silently drops a header a future route needs.
   await server.register(cors, {
-    origin: config.FRONTEND_URL || config.NODE_ENV !== "production",
+    origin: [...config.TRUSTED_ORIGINS],
     credentials: true,
     methods: ["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
   });
@@ -683,9 +701,16 @@ export async function build() {
   // limiter is in-memory by default, which suits a single Vercel function /
   // single-process dev server; multi-instance deployments will need a
   // Redis store, swappable here without changing route code.
+  //
+  // `keyGenerator` (#7394 DD-7): a keyed spoke's lead write counts against its
+  // visitor's own ceiling here too, or a spoke whose visitors share one
+  // egress IP would still be capped at this limit in total. For every other
+  // request it returns `req.ip`, the plugin's own default key.
   await server.register(rateLimit, {
     max: CONTENT_RATE_LIMIT_UNAUTH,
     timeWindow: CONTENT_RATE_LIMIT_WINDOW,
+    keyGenerator: (req) =>
+      resolveRateLimitIdentity(req, visitorForwardKeyDigests).identity,
   });
 
   // Health check
@@ -726,7 +751,7 @@ export async function build() {
   // handlers. Cookie-first, Bearer-fallback; see middleware/auth.ts.
   await server.register(async (authScope) => {
     await authScope.register(authPreHandlerPlugin, {
-      frontendOrigin: config.FRONTEND_URL,
+      trustedOrigins: config.TRUSTED_ORIGINS,
     });
     await authScope.register(tokenRoutes);
     await authScope.register(userRoutes);
@@ -1184,9 +1209,17 @@ export async function build() {
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was
   // never meant to loosen abuse protection here).
+  //
+  // `scope: "leads"` (#7394): this scope's buckets are its own, not shared
+  // with the other scopes' bare-IP count, and AILK_RATE_LIMIT_LEADS_PER_MINUTE
+  // (and ..._PER_KEY_PER_MINUTE, default 300) override the code values. With
+  // `trustedKeyDigests`, a keyed spoke's three lead writes are counted per
+  // forwarded visitor; the project-listing routes below still key on `req.ip`.
   await server.register(async (leadsScope) => {
     leadsScope.register(rateLimitMiddleware, {
       perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "leads",
+      trustedKeyDigests: visitorForwardKeyDigests,
     });
     await leadsScope.register(leadSubmitRoute);
     await leadsScope.register(leadSubscribeRoute);