create-ailk 0.11.5 → 0.12.0

package/templates/apps/api/src/lib/__tests__/spoke-store.test.ts

@@ -0,0 +1,152 @@
+/**
+ * @file spoke-store.test.ts
+ *
+ * The hub's spoke registry boundary (#7532, spec
+ * docs/specs/7532-a-spoke-s-public-reads-spec.md D2, D7, AC-5): minting a key,
+ * its digest, the one lookup the resolver makes, and the three operator
+ * functions the `spokes` CLI calls.
+ *
+ * External dependency boundary mocked:
+ *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../prisma.js");
+
+import { createHash } from "node:crypto";
+
+import { prisma } from "../prisma.js";
+import {
+  SPOKE_KEY_PREFIX,
+  findSpokeByKeyHash,
+  hashSpokeKey,
+  listSpokes,
+  mintSpokeKey,
+  registerSpoke,
+  revokeSpoke,
+} from "../spoke-store.js";
+
+const db = jest.mocked(prisma);
+
+const W1 = "wksp_00000000-0000-7000-8000-0000000000b1";
+const S1 = "spoke_00000000-0000-7000-8000-0000000000c1";
+
+beforeEach(() => {
+  jest.resetAllMocks();
+});
+
+describe("mintSpokeKey / hashSpokeKey (D2)", () => {
+  it("mints `ailk_spk_` + 32 random bytes in base64url — 52 characters", () => {
+    const key = mintSpokeKey();
+    expect(key.startsWith(SPOKE_KEY_PREFIX)).toBe(true);
+    expect(key).toHaveLength(52);
+    expect(key.slice(SPOKE_KEY_PREFIX.length)).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+
+  it("never mints the same key twice", () => {
+    const keys = new Set(Array.from({ length: 50 }, () => mintSpokeKey()));
+    expect(keys.size).toBe(50);
+  });
+
+  it("digests the TRIMMED key to lowercase hex SHA-256", () => {
+    const key = mintSpokeKey();
+    const expected = createHash("sha256").update(key).digest("hex");
+    expect(hashSpokeKey(key)).toBe(expected);
+    expect(hashSpokeKey(`  ${key}\t`)).toBe(expected);
+    expect(hashSpokeKey(key)).toMatch(/^[0-9a-f]{64}$/);
+  });
+});
+
+describe("findSpokeByKeyHash (D3 step 5)", () => {
+  it("is one findUnique by digest, selecting only what the resolver needs", async () => {
+    const row = { id: S1, workspaceId: W1, revokedAt: null };
+    db.spoke.findUnique.mockResolvedValue(row as never);
+    const digest = "a".repeat(64);
+
+    await expect(findSpokeByKeyHash(digest)).resolves.toEqual(row);
+    expect(db.spoke.findUnique).toHaveBeenCalledTimes(1);
+    expect(db.spoke.findUnique).toHaveBeenCalledWith({
+      where: { credentialHash: digest },
+      select: { id: true, workspaceId: true, revokedAt: true },
+    });
+  });
+
+  it("answers null when no row carries the digest", async () => {
+    db.spoke.findUnique.mockResolvedValue(null);
+    await expect(findSpokeByKeyHash("b".repeat(64))).resolves.toBeNull();
+  });
+});
+
+describe("registerSpoke (D7, AC-5)", () => {
+  it("stores the key's digest and a 17-character prefix, never the key", async () => {
+    db.workspace.findUnique.mockResolvedValue({ id: W1 } as never);
+    db.spoke.create.mockImplementation((async (args: {
+      data: Record<string, unknown>;
+    }) => ({ id: S1, createdAt: new Date(), ...args.data })) as never);
+
+    const result = await registerSpoke({ workspaceId: W1, name: "acme" });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const createArg = db.spoke.create.mock.calls[0]![0] as {
+      data: Record<string, unknown>;
+    };
+    expect(createArg.data["credentialHash"]).toMatch(/^[0-9a-f]{64}$/);
+    expect(createArg.data["credentialHash"]).toBe(hashSpokeKey(result.key));
+    expect(createArg.data["credentialPrefix"]).toBe(result.key.slice(0, 17));
+    expect(createArg.data["workspaceId"]).toBe(W1);
+    expect(createArg.data["name"]).toBe("acme");
+    // No create argument equals the returned key.
+    expect(JSON.stringify(createArg)).not.toContain(result.key);
+    expect(result.spoke.id).toBe(S1);
+  });
+
+  it("refuses a workspace that does not exist, creating nothing", async () => {
+    db.workspace.findUnique.mockResolvedValue(null);
+
+    await expect(
+      registerSpoke({ workspaceId: W1, name: "acme" }),
+    ).resolves.toEqual({ ok: false, reason: "workspace-not-found" });
+    expect(db.spoke.create).not.toHaveBeenCalled();
+  });
+});
+
+describe("revokeSpoke (D7, AC-5)", () => {
+  it("sets revokedAt on that one unrevoked row only", async () => {
+    db.spoke.updateMany.mockResolvedValue({ count: 1 });
+
+    await expect(revokeSpoke(S1)).resolves.toBe(true);
+    const arg = db.spoke.updateMany.mock.calls[0]![0] as {
+      where: unknown;
+      data: { revokedAt: unknown };
+    };
+    expect(arg.where).toEqual({ id: S1, revokedAt: null });
+    expect(arg.data.revokedAt).toBeInstanceOf(Date);
+  });
+
+  it("reports false when no unrevoked row matched", async () => {
+    db.spoke.updateMany.mockResolvedValue({ count: 0 });
+    await expect(revokeSpoke(S1)).resolves.toBe(false);
+  });
+});
+
+describe("listSpokes (D7, AC-5)", () => {
+  it("never selects the credential digest", async () => {
+    db.spoke.findMany.mockResolvedValue([]);
+
+    await listSpokes();
+
+    const arg = db.spoke.findMany.mock.calls[0]![0] as {
+      select: Record<string, boolean>;
+    };
+    expect(arg.select).not.toHaveProperty("credentialHash");
+    expect(arg.select).toEqual({
+      id: true,
+      name: true,
+      workspaceId: true,
+      credentialPrefix: true,
+      createdAt: true,
+      revokedAt: true,
+    });
+  });
+});

package/templates/apps/api/src/lib/spoke-store.ts

@@ -0,0 +1,131 @@
+/**
+ * The hub's spoke registry — its ONE data-access boundary (#7532, spec
+ * docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D2, D7).
+ *
+ * A spoke is a separately deployed site that calls this API server-to-server,
+ * bound to exactly one workspace. It authenticates with a hub-minted key sent
+ * in `x-ailk-spoke-key`. This file is the only one that names `prisma.spoke`.
+ *
+ * THE KEY IS NEVER STORED. The row keeps the lowercase hex SHA-256 of the
+ * trimmed key (`credentialHash`) and its first 17 characters
+ * (`credentialPrefix`: `ailk_spk_` plus 8 random ones) so an operator can
+ * recognise a key in a list. A fast digest is enough: the key carries 256
+ * bits of entropy, so a lookup by its unique digest leaks nothing usable.
+ *
+ * WHAT A KEY PROVES. It identifies a deployed SITE, not a person: every
+ * anonymous visitor of that site, and every agent using its `apps/mcp`, acts
+ * through it. It grants what the site's anonymous visitors can already do on
+ * the hub — read that workspace's enabled meeting types and public content,
+ * and write leads and bookings into it.
+ *
+ * Two kinds of caller, kept apart:
+ *   - the public resolver (`services/public-site-resolver.ts`) calls
+ *     `hashSpokeKey` and `findSpokeByKeyHash` only;
+ *   - the operator CLI (`bin/spokes.ts`) calls `registerSpoke`, `revokeSpoke`
+ *     and `listSpokes`. No route imports them.
+ *
+ * Nothing caches a row: a revocation takes effect on the next request (NFR4).
+ */
+import { createHash, randomBytes } from "node:crypto";
+
+import { prisma } from "./prisma.js";
+
+/** Every spoke key starts with this, so a leaked one is recognisable. */
+export const SPOKE_KEY_PREFIX = "ailk_spk_";
+
+/** How much of the key the row keeps for recognition: the prefix + 8 characters. */
+const CREDENTIAL_PREFIX_LENGTH = SPOKE_KEY_PREFIX.length + 8;
+
+/** A new key: `ailk_spk_` + 32 random bytes in base64url (52 characters). */
+export function mintSpokeKey(): string {
+  return `${SPOKE_KEY_PREFIX}${randomBytes(32).toString("base64url")}`;
+}
+
+/** The stored digest of a key: lowercase hex SHA-256 of the TRIMMED value. */
+export function hashSpokeKey(key: string): string {
+  return createHash("sha256").update(key.trim()).digest("hex");
+}
+
+export interface SpokeLookupRow {
+  id: string;
+  workspaceId: string;
+  revokedAt: Date | null;
+}
+
+/** The one read the resolver makes: a `findUnique` by digest. */
+export async function findSpokeByKeyHash(
+  credentialHash: string,
+): Promise<SpokeLookupRow | null> {
+  return prisma.spoke.findUnique({
+    where: { credentialHash },
+    select: { id: true, workspaceId: true, revokedAt: true },
+  });
+}
+
+// ── Operator functions — `bin/spokes.ts` only ────────────────────────────────
+
+export interface SpokeListRow {
+  id: string;
+  name: string;
+  workspaceId: string;
+  credentialPrefix: string;
+  createdAt: Date;
+  revokedAt: Date | null;
+}
+
+const SPOKE_LIST_SELECT = {
+  id: true,
+  name: true,
+  workspaceId: true,
+  credentialPrefix: true,
+  createdAt: true,
+  revokedAt: true,
+} as const;
+
+export type RegisterSpokeResult =
+  | { ok: true; spoke: SpokeListRow; key: string }
+  | { ok: false; reason: "workspace-not-found" };
+
+/**
+ * Register a spoke bound to one existing workspace. The returned `key` is the
+ * only copy that will ever exist: the caller prints it once.
+ */
+export async function registerSpoke(params: {
+  workspaceId: string;
+  name: string;
+}): Promise<RegisterSpokeResult> {
+  const workspace = await prisma.workspace.findUnique({
+    where: { id: params.workspaceId },
+    select: { id: true },
+  });
+  if (!workspace) return { ok: false, reason: "workspace-not-found" };
+
+  const key = mintSpokeKey();
+  const spoke = await prisma.spoke.create({
+    data: {
+      workspaceId: params.workspaceId,
+      name: params.name,
+      credentialHash: hashSpokeKey(key),
+      credentialPrefix: key.slice(0, CREDENTIAL_PREFIX_LENGTH),
+    },
+    select: SPOKE_LIST_SELECT,
+  });
+  return { ok: true, spoke, key };
+}
+
+/** Revoke one spoke. `false` when no unrevoked spoke has that id. */
+export async function revokeSpoke(id: string): Promise<boolean> {
+  const { count } = await prisma.spoke.updateMany({
+    where: { id, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+  return count === 1;
+}
+
+/** Every spoke, newest first. Never selects the credential digest. */
+export async function listSpokes(): Promise<SpokeListRow[]> {
+  return prisma.spoke.findMany({
+    select: SPOKE_LIST_SELECT,
+    orderBy: { createdAt: "desc" },
+  });
+}

package/templates/apps/api/src/routes/leads/__tests__/spoke.test.ts

@@ -0,0 +1,331 @@
+/**
+ * @file spoke.test.ts
+ *
+ * `POST /v1/leads/{submit,subscribe,callback}` called by a registered spoke of
+ * a multi-workspace hub (#7532, spec
+ * docs/specs/7532-a-spoke-s-public-reads-spec.md D3, D4; AC-2, AC-3, AC-5).
+ * The three real lead routes run through the real resolver and the real
+ * lead-routing service; only the database and the email provider are doubles.
+ *
+ * Fixture (spec § 5): three workspaces — the sentinel default `F` (the site
+ * alias), `W1` and `W2`; spokes `S1` → `W1`, `S1b` → `W1`, `S2` → `W2`.
+ */
+import { createHash } from "node:crypto";
+import { Writable } from "node:stream";
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn(),
+  sendRequestConfirmEmail: jest.fn(),
+  sendRequestPaidLinkEmail: jest.fn(),
+}));
+
+// @working-theory/license: consumed transitively by enrichment-shim; mocked to
+// avoid needing a license key in tests (the leads index suite's own reason).
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// The real request-confirm service, with its link sender observable: a
+// spoke's callback must never reach it (spec D4, SEC-7532-2). The call itself
+// is what AC-2 asserts, so the double wraps the real function rather than
+// replacing it.
+// eslint-disable-next-line no-restricted-syntax -- AC-2 asserts this internal function is never called; requireActual keeps its behaviour
+jest.mock("../../../services/request-confirm.js", () => {
+  const actual = jest.requireActual("../../../services/request-confirm.js");
+  return {
+    ...actual,
+    sendRequestConfirmLink: jest.fn(actual.sendRequestConfirmLink),
+  };
+});
+
+import * as configModule from "../../../config/index.js";
+import {
+  SENTINEL_WORKSPACE_ID,
+  mockSentinelWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
+import { prisma } from "../../../lib/prisma.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
+import { sendRequestConfirmLink } from "../../../services/request-confirm.js";
+import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import { leadCallbackRoute, leadSubmitRoute, leadSubscribeRoute } from "../index";
+
+const db = jest.mocked(prisma);
+const email = jest.requireMock("@working-theory/email") as {
+  sendLeadNotification: jest.Mock;
+  sendRequestConfirmEmail: jest.Mock;
+};
+
+const F = SENTINEL_WORKSPACE_ID;
+const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
+const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
+const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
+const S1B = "spoke_01920000-0000-7000-8000-0000000000c2";
+const S2 = "spoke_01920000-0000-7000-8000-0000000000c3";
+
+function spokeKey(tag: string): string {
+  return `ailk_spk_${tag}${"x".repeat(43 - tag.length)}`;
+}
+const KEY_S1 = spokeKey("S1");
+const KEY_S1B = spokeKey("S1b");
+const KEY_S2 = spokeKey("S2");
+const KEY_UNKNOWN = spokeKey("nobody");
+const ALL_KEYS = [KEY_S1, KEY_S1B, KEY_S2, KEY_UNKNOWN];
+
+const digest = (key: string) => createHash("sha256").update(key).digest("hex");
+
+function seedRegistry(revoked: readonly string[] = []): void {
+  const rows = new Map([
+    [digest(KEY_S1), { id: S1, workspaceId: W1, revokedAt: null as Date | null }],
+    [digest(KEY_S1B), { id: S1B, workspaceId: W1, revokedAt: null as Date | null }],
+    [digest(KEY_S2), { id: S2, workspaceId: W2, revokedAt: null as Date | null }],
+  ]);
+  for (const row of rows.values()) {
+    if (revoked.includes(row.id)) row.revokedAt = new Date();
+  }
+  db.spoke.findUnique.mockImplementation((async ({
+    where,
+  }: {
+    where: { credentialHash: string };
+  }) => rows.get(where.credentialHash) ?? null) as never);
+}
+
+function setStrictMode(on: boolean): void {
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    AILK_HUB_REQUIRE_SPOKE_KEY: on,
+  });
+}
+
+type Kind = "submit" | "subscribe" | "callback";
+
+/** Each kind's body — every one names `siteId: W2`, which must be ignored. */
+const BODIES: Record<Kind, Record<string, unknown>> = {
+  submit: {
+    siteId: W2,
+    source: "contact",
+    email: "prospect@example.com",
+    payload: { message: "hello" },
+  },
+  subscribe: { siteId: W2, source: "footer", email: "reader@example.com" },
+  callback: { siteId: W2, name: "Ada Lovelace", phone: "+44 7700 900000", payload: {} },
+};
+
+/** The create delegate each kind writes through. */
+function createDelegate(kind: Kind) {
+  if (kind === "submit") return db.lead.create;
+  if (kind === "subscribe") return db.subscriber.create;
+  return db.callback.create;
+}
+
+function expectNoWrite(): void {
+  expect(db.lead.create).not.toHaveBeenCalled();
+  expect(db.subscriber.create).not.toHaveBeenCalled();
+  expect(db.callback.create).not.toHaveBeenCalled();
+}
+
+const REQUEST_CONFIRM_ENV = [
+  "AILK_REQUEST_CONFIRM_ENABLED",
+  "AILK_REQUEST_CONFIRM_TO",
+  "AILK_REQUEST_CONFIRM_FROM",
+  "AILK_PUBLIC_API_URL",
+] as const;
+
+describe("a spoke calling the lead routes on a multi-workspace hub", () => {
+  setupLeadFileEnv("spoke");
+
+  let app: FastifyInstance;
+  let logLines: string[];
+
+  beforeEach(async () => {
+    // clearAllMocks (not reset): the license double's resolved value must
+    // survive between cases, as in the leads index suite.
+    jest.clearAllMocks();
+    __resetSiteWorkspaceCacheForTests();
+    process.env.DATABASE_URL = "postgres://stub";
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    setStrictMode(false);
+    seedRegistry();
+    mockSentinelWorkspaceExists(db, W1, W2);
+    db.workspace.count.mockResolvedValue(3);
+    db.lead.create.mockResolvedValue({ id: "lead_01920000-0000-7000-8000-0000000000d1" } as never);
+    db.subscriber.create.mockResolvedValue({ id: "subscr_01920000-0000-7000-8000-0000000000d2" } as never);
+    db.callback.create.mockResolvedValue({ id: "callbk_01920000-0000-7000-8000-0000000000d3" } as never);
+    db.callback.updateMany.mockResolvedValue({ count: 1 });
+    email.sendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-test" });
+    email.sendRequestConfirmEmail.mockResolvedValue({ ok: true, messageId: "msg-confirm" });
+
+    logLines = [];
+    const stream = new Writable({
+      write(chunk, _encoding, done) {
+        logLines.push(String(chunk));
+        done();
+      },
+    });
+    app = Fastify({ logger: { level: "info", stream } });
+    await app.register(leadSubmitRoute);
+    await app.register(leadSubscribeRoute);
+    await app.register(leadCallbackRoute);
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    // No log line written by any case carries a key, its digest or its prefix (AC-3).
+    const written = logLines.join("\n");
+    for (const key of ALL_KEYS) {
+      expect(written).not.toContain(key);
+      expect(written).not.toContain(digest(key));
+      expect(written).not.toContain(key.slice(0, 17));
+    }
+    jest.restoreAllMocks();
+    delete process.env.DATABASE_URL;
+    delete process.env.AILK_LEAD_NOTIFICATION_TO;
+    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
+    for (const key of REQUEST_CONFIRM_ENV) delete process.env[key];
+  });
+
+  function post(kind: Kind, headers: Record<string, string> = {}, body = BODIES[kind]) {
+    return app.inject({ method: "POST", url: `/v1/leads/${kind}`, headers, payload: body });
+  }
+
+  // ── AC-2 ────────────────────────────────────────────────────────────────
+
+  describe.each<Kind>(["submit", "subscribe", "callback"])("POST /v1/leads/%s (AC-2)", (kind) => {
+    it("a spoke's lead lands in its own workspace, whatever siteId the body names", async () => {
+      const res = await post(kind, { "x-ailk-spoke-key": KEY_S1 });
+
+      expect(res.statusCode).toBe(201);
+      expect(res.json().persisted).toBe("db");
+      const create = createDelegate(kind);
+      expect(create).toHaveBeenCalledTimes(1);
+      const { data } = create.mock.calls[0]![0] as {
+        data: { siteId: string; workspaceId: string };
+      };
+      expect(data.siteId).toBe(W1);
+      expect(data.workspaceId).toBe(W1);
+    });
+
+    it("another spoke's lead lands in its own workspace", async () => {
+      const res = await post(kind, { "x-ailk-spoke-key": KEY_S2 }, {
+        ...BODIES[kind],
+        siteId: W1,
+      });
+
+      expect(res.statusCode).toBe(201);
+      const { data } = createDelegate(kind).mock.calls[0]![0] as {
+        data: { siteId: string; workspaceId: string };
+      };
+      expect(data.siteId).toBe(W2);
+      expect(data.workspaceId).toBe(W2);
+    });
+  });
+
+  it("a spoke's callback never takes request-and-confirm: the generic notification goes, no link is minted (AC-2, SEC-7532-2)", async () => {
+    process.env.AILK_REQUEST_CONFIRM_ENABLED = "true";
+    process.env.AILK_REQUEST_CONFIRM_TO = "owner@example.com";
+    process.env.AILK_REQUEST_CONFIRM_FROM = "hello@example.com";
+    process.env.AILK_PUBLIC_API_URL = "https://api.example.com";
+
+    const res = await post("callback", { "x-ailk-spoke-key": KEY_S1 });
+    expect(res.statusCode).toBe(201);
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(sendRequestConfirmLink).not.toHaveBeenCalled();
+    expect(email.sendRequestConfirmEmail).not.toHaveBeenCalled();
+    expect(email.sendLeadNotification).toHaveBeenCalledTimes(1);
+    expect(db.callback.updateMany).not.toHaveBeenCalled();
+  });
+
+  // ── AC-3 ────────────────────────────────────────────────────────────────
+
+  describe.each<[string, Record<string, string>, boolean]>([
+    ["(i) an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, false],
+    ["(ii) a duplicated header", { "x-ailk-spoke-key": `${KEY_S1}, ${KEY_S2}` }, false],
+    ["(iii) an empty key", { "x-ailk-spoke-key": "" }, false],
+    [
+      "(v) strict mode, a header-less request naming W1 every other way",
+      {
+        host: "w1.example",
+        "x-forwarded-host": "w1.example",
+        origin: "https://w1.example",
+        "x-ailk-workspace-id": W1,
+      },
+      true,
+    ],
+  ])("%s (AC-3)", (_label, headers, strict) => {
+    it.each<Kind>(["submit", "subscribe", "callback"])(
+      "POST /v1/leads/%s answers 503 tenant_unresolved before any write",
+      async (kind) => {
+        setStrictMode(strict);
+        const res = await post(kind, headers, { ...BODIES[kind], siteId: W1 });
+
+        expect(res.statusCode).toBe(503);
+        expect(res.json().error).toBe("tenant_unresolved");
+        expectNoWrite();
+      },
+    );
+  });
+
+  it("(iv) a valid key with DATABASE_URL unset answers 503 — never the zero-config alias", async () => {
+    delete process.env.DATABASE_URL;
+    const res = await post("submit", { "x-ailk-spoke-key": KEY_S1 });
+
+    expect(res.statusCode).toBe(503);
+    expect(res.json().error).toBe("tenant_unresolved");
+    expectNoWrite();
+  });
+
+  // ── AC-5 ────────────────────────────────────────────────────────────────
+
+  describe("with S1 revoked (AC-5)", () => {
+    beforeEach(() => {
+      seedRegistry([S1]);
+    });
+
+    it("S1's key gets 503 with no write; S1b (also W1) and S2 keep their own workspaces", async () => {
+      const revoked = await post("submit", { "x-ailk-spoke-key": KEY_S1 });
+      expect(revoked.statusCode).toBe(503);
+      expectNoWrite();
+
+      const sibling = await post("submit", { "x-ailk-spoke-key": KEY_S1B });
+      expect(sibling.statusCode).toBe(201);
+      const siblingData = (db.lead.create.mock.calls[0]![0] as { data: { workspaceId: string } }).data;
+      expect(siblingData.workspaceId).toBe(W1);
+
+      const other = await post("submit", { "x-ailk-spoke-key": KEY_S2 });
+      expect(other.statusCode).toBe(201);
+      const otherData = (db.lead.create.mock.calls[1]![0] as { data: { workspaceId: string } }).data;
+      expect(otherData.workspaceId).toBe(W2);
+    });
+
+    it("in strict mode, S1's header-less retry is refused too", async () => {
+      setStrictMode(true);
+      const res = await post("submit");
+      expect(res.statusCode).toBe(503);
+      expectNoWrite();
+    });
+
+    it("with strict mode off, S1's header-less retry is anonymous and lands under the alias F, never W1 (SEC-7532-3)", async () => {
+      const res = await post("submit");
+      expect(res.statusCode).toBe(201);
+      const { data } = db.lead.create.mock.calls[0]![0] as {
+        data: { siteId: string; workspaceId: string };
+      };
+      expect(data.siteId).toBe(F);
+      expect(data.workspaceId).toBe(F);
+    });
+  });
+});

package/templates/apps/api/src/routes/leads/index.ts

@@ -29,6 +29,15 @@
  * result (no DATABASE_URL, or the alias names no workspace this database
  * holds) is a 503 before any write is attempted — never a guess. See
  * `lead-routing.ts`'s own header for the persistence-side half.
+ *
+ * A REGISTERED SPOKE (#7532 D4) resolves FIRST: a hub serving several spokes
+ * reads the spoke's key from `x-ailk-spoke-key` through
+ * `resolveCallerSite()` (`services/public-site-resolver.ts`) and writes the
+ * lead into that spoke's own workspace. A refused key — malformed, unknown or
+ * revoked, or no key at all on a hub in strict mode — is the same 503
+ * `tenant_unresolved` before any write. A header-less request on a hub
+ * without strict mode takes the alias resolution above, unchanged. The body's
+ * `siteId` stays ignored on every branch.
  */
 
 import { track } from "@working-theory/analytics/server";
@@ -40,7 +49,9 @@ import {
   type LeadKind,
   type RouteLeadInput,
   routeLead,
+  type SourceMeta,
 } from "../../services/lead-routing.js";
+import { resolveCallerSite } from "../../services/public-site-resolver.js";
 import { sendRequestConfirmLink } from "../../services/request-confirm.js";
 
 /**
@@ -125,12 +136,22 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
       // private @working-theory/lead-routing package (not present in this
       // repo, not inspectable) is the one consumer this trace could not
       // complete; see docs/specs/5112-leads-ip-trace-spec.md §8.
-      const sourceMeta = {
+      const sourceMeta: SourceMeta = {
         ip: request.ip,
         userAgent: request.headers["user-agent"],
         receivedAt: new Date().toISOString(),
       };
 
+      // #7532 D4 — a registered spoke resolves first, to its own workspace; a
+      // refused key never falls through to the alias below.
+      const caller = await resolveCallerSite(request);
+      if (caller.kind === "refused") {
+        return reply.status(503).send({
+          error: "tenant_unresolved",
+          message: "This site is not configured to accept submissions.",
+        });
+      }
+
       // #6203 — resolve the tenant SERVER-SIDE before any write is
       // attempted. Two branches, deliberately different:
       //
@@ -150,7 +171,10 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
       //    deleted after boot, a transient read), and it fails closed the
       //    same way: reject, never guess (spec AC-4).
       let workspaceId: string;
-      if (!process.env.DATABASE_URL) {
+      if (caller.kind === "spoke") {
+        workspaceId = caller.workspaceId;
+        sourceMeta.viaSpoke = true;
+      } else if (!process.env.DATABASE_URL) {
         workspaceId = currentSiteId();
       } else {
         const resolved = await resolveSiteWorkspaceId();
@@ -239,7 +263,13 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
       // would match nothing and the operator would be left with no email at
       // all. On that path the generic notification is sent instead, which is
       // what keeps "exactly one" true in both directions.
-      if (kind === "callback" && result.persisted === "db") {
+      // A spoke's callback never takes this path (#7532 D4, SEC-7532-2): the
+      // link is minted on the deployment's one Stripe account.
+      if (
+        kind === "callback" &&
+        result.persisted === "db" &&
+        caller.kind !== "spoke"
+      ) {
         const callbackInput = buildInput(kind, body, workspaceId) as Extract<
           RouteLeadInput,
           { kind: "callback" }