create-ailk 0.11.5 → 0.12.0

package/templates/apps/api/src/services/__tests__/slack-notify.test.ts

@@ -11,6 +11,14 @@ jest.mock("../../lib/prisma.js");
 import * as configModule from "../../config/index.js";
 import { prisma } from "../../lib/prisma.js";
 import { postListingApplication, updateListingMessage } from "../slack-notify";
+import {
+  LISTING_DECISION_BLOCK_NAMED_SINCE_SECONDS,
+  listingDecisionBlockId,
+  parseListingDecisionBlockId,
+} from "../slack-notify";
+
+// #7522 D5 — the workspace the listing belongs to; the posted actions block names it.
+const WS = "wksp_00000000-0000-7000-8000-000000000001";
 
 // #5036 D2/D5 reshaped what reaches Slack: `audience` is gone (folded into
 // `oneLiner`'s guidance) and `stage` is the six-rung `product` ladder. Since
@@ -26,6 +34,7 @@ const LISTING = {
   product: "working-prototype",
   founderName: "Ada Founder",
   founderCompany: "Ada Co",
+  workspaceId: WS,
 };
 
 function mockFetchOnce(body: unknown, ok = true): jest.Mock {
@@ -276,3 +285,64 @@ describe("updateListingMessage", () => {
     await expect(updateListingMessage(decided, "active", "Erin")).resolves.toBeUndefined();
   });
 });
+
+// ── #7522 — the actions block names the listing's workspace ────────────────
+
+describe("the listing-decision block_id (#7522)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: undefined,
+      AILK_SLACK_CHANNEL_ID: undefined,
+    });
+  });
+
+  it("posts an actions block whose block_id names the listing's workspace, in the format the route parses", async () => {
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_SLACK_BOT_TOKEN: "xoxb-test",
+      AILK_SLACK_CHANNEL_ID: "C123",
+    });
+    const fetchMock = mockFetchOnce({ ok: true, channel: "C123", ts: "1699999999.000100" });
+
+    await postListingApplication({ ...LISTING });
+
+    const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+    const actionsBlock = body.blocks.find((b: { type: string }) => b.type === "actions");
+    expect(actionsBlock.block_id).toBe(listingDecisionBlockId(WS));
+    expect(actionsBlock.block_id).toBe("listing_decision:" + WS);
+    // The button values stay the bare listing id.
+    expect(actionsBlock.elements[0]).toMatchObject({ action_id: "listing_approve", value: LISTING.id });
+    expect(actionsBlock.elements[1]).toMatchObject({ action_id: "listing_reject", value: LISTING.id });
+  });
+
+  it("round-trips: the parser reads back the workspace the producer wrote", () => {
+    expect(parseListingDecisionBlockId(listingDecisionBlockId(WS))).toEqual({
+      kind: "named",
+      workspaceId: WS,
+    });
+  });
+
+  it("reads an absent block_id or the bare legacy literal as the legacy arm", () => {
+    expect(parseListingDecisionBlockId(undefined)).toEqual({ kind: "legacy" });
+    expect(parseListingDecisionBlockId("listing_decision")).toEqual({ kind: "legacy" });
+  });
+
+  it("reads an empty suffix, a non-workspace id, or a foreign block as invalid — never as legacy", () => {
+    expect(parseListingDecisionBlockId("listing_decision:")).toEqual({ kind: "invalid" });
+    expect(
+      parseListingDecisionBlockId("listing_decision:prjl_00000000-0000-7000-8000-000000000001"),
+    ).toEqual({ kind: "invalid" });
+    expect(parseListingDecisionBlockId("other")).toEqual({ kind: "invalid" });
+  });
+
+  it("the cutover is a whole UTC hour after the pin", () => {
+    expect(Number.isInteger(LISTING_DECISION_BLOCK_NAMED_SINCE_SECONDS)).toBe(true);
+    expect(LISTING_DECISION_BLOCK_NAMED_SINCE_SECONDS % 3600).toBe(0);
+    expect(LISTING_DECISION_BLOCK_NAMED_SINCE_SECONDS).toBeGreaterThan(1790985600);
+  });
+});

package/templates/apps/api/src/services/__tests__/spoke-resolution.test.ts

@@ -0,0 +1,374 @@
+/**
+ * @file spoke-resolution.test.ts
+ *
+ * `resolveCallerSite(request)` and the public resolver's spoke arms (#7532,
+ * spec docs/specs/7532-a-spoke-s-public-reads-spec.md D3, AC-1, AC-3, AC-4).
+ *
+ * A spoke names itself with ONE request header, `x-ailk-spoke-key`, looked up
+ * by its SHA-256 digest in the hub's registry. Nothing else on the request —
+ * a workspace id, `Host`, `X-Forwarded-Host`, `Origin` — selects a workspace.
+ *
+ * Fixture (spec § 5): three workspaces — the sentinel default `F`, `W1`, `W2`;
+ * spokes `S1` → `W1`, `S1b` → `W1`, `S2` → `W2`, each with its own key.
+ * `db.spoke.findUnique` answers by `credentialHash`.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
+ *   - lib/content-adapter.js (so the adapter the resolver picks is observable)
+ */
+import { createHash } from "node:crypto";
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+// eslint-disable-next-line no-restricted-syntax -- AC-1 asserts WHICH adapter the resolver asks for (workspace-scoped vs shared mdx); the double records that argument
+jest.mock("../../lib/content-adapter.js", () => ({
+  getContentAdapter: jest.fn(() => ({ kind: "adapter-double" })),
+}));
+
+import type { FastifyRequest } from "fastify";
+
+import * as configModule from "../../config/index.js";
+import { getContentAdapter } from "../../lib/content-adapter.js";
+import { mockSentinelWorkspaceExists } from "../../lib/__mocks__/prisma.js";
+import { prisma } from "../../lib/prisma.js";
+import {
+  resolveCallerSite,
+  resolvePublicContentAdapter,
+  resolvePublicWorkspace,
+} from "../public-site-resolver.js";
+
+const db = jest.mocked(prisma);
+
+const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
+const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
+const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
+const S1B = "spoke_01920000-0000-7000-8000-0000000000c2";
+const S2 = "spoke_01920000-0000-7000-8000-0000000000c3";
+
+/** A well-formed 52-character spoke key, distinct per tag. */
+function spokeKey(tag: string): string {
+  return `ailk_spk_${tag}${"x".repeat(43 - tag.length)}`;
+}
+const KEY_S1 = spokeKey("S1");
+const KEY_S1B = spokeKey("S1b");
+const KEY_S2 = spokeKey("S2");
+const KEY_UNKNOWN = spokeKey("nobody");
+
+const digest = (key: string) => createHash("sha256").update(key).digest("hex");
+
+type SpokeRow = { id: string; workspaceId: string; revokedAt: Date | null };
+
+/** Program the registry: `db.spoke.findUnique` answers by digest. */
+function seedRegistry(revoked: readonly string[] = []): void {
+  const rows = new Map<string, SpokeRow>([
+    [digest(KEY_S1), { id: S1, workspaceId: W1, revokedAt: null }],
+    [digest(KEY_S1B), { id: S1B, workspaceId: W1, revokedAt: null }],
+    [digest(KEY_S2), { id: S2, workspaceId: W2, revokedAt: null }],
+  ]);
+  for (const row of rows.values()) {
+    if (revoked.includes(row.id)) row.revokedAt = new Date();
+  }
+  db.spoke.findUnique.mockImplementation((async ({
+    where,
+  }: {
+    where: { credentialHash: string };
+  }) => rows.get(where.credentialHash) ?? null) as never);
+}
+
+/** A request double carrying only what the resolver may read. */
+function requestWith(headers: Record<string, string | string[]>): {
+  request: FastifyRequest;
+  warn: jest.Mock;
+} {
+  const warn = jest.fn();
+  // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the two members the resolver reads (headers, log)
+  const request = {
+    headers,
+    log: { warn, info: jest.fn(), error: jest.fn() },
+  } as unknown as FastifyRequest;
+  return { request, warn };
+}
+
+function setStrictMode(on: boolean): void {
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    AILK_HUB_REQUIRE_SPOKE_KEY: on,
+  });
+}
+
+/** No logged object may carry a key, its digest or its 17-character prefix. */
+function expectNoSecretIn(log: jest.Mock): void {
+  const serialized = JSON.stringify(log.mock.calls);
+  for (const key of [KEY_S1, KEY_S1B, KEY_S2, KEY_UNKNOWN]) {
+    expect(serialized).not.toContain(key);
+    expect(serialized).not.toContain(digest(key));
+    expect(serialized).not.toContain(key.slice(0, 17));
+  }
+}
+
+const savedAdapter = process.env.CONTENT_ADAPTER;
+const savedDatabaseUrl = process.env.DATABASE_URL;
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  (getContentAdapter as jest.Mock).mockReturnValue({ kind: "adapter-double" });
+  process.env.DATABASE_URL = "postgres://stub";
+  process.env.CONTENT_ADAPTER = "database";
+  seedRegistry();
+  mockSentinelWorkspaceExists(db, W1, W2);
+  db.workspace.count.mockResolvedValue(3);
+  setStrictMode(false);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  if (savedAdapter === undefined) delete process.env.CONTENT_ADAPTER;
+  else process.env.CONTENT_ADAPTER = savedAdapter;
+  if (savedDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+  else process.env.DATABASE_URL = savedDatabaseUrl;
+});
+
+describe("resolveCallerSite — a registered spoke (AC-1)", () => {
+  it.each([
+    [KEY_S1, S1, W1],
+    [KEY_S1B, S1B, W1],
+    [KEY_S2, S2, W2],
+  ])("resolves its key to its own workspace", async (key, spokeId, workspaceId) => {
+    const { request, warn } = requestWith({ "x-ailk-spoke-key": key });
+
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "spoke",
+      spokeId,
+      workspaceId,
+    });
+    expect(db.spoke.findUnique).toHaveBeenCalledTimes(1);
+    expect(db.spoke.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { credentialHash: digest(key) } }),
+    );
+    expectNoSecretIn(warn);
+  });
+
+  it("trims the header value before hashing it", async () => {
+    const { request } = requestWith({ "x-ailk-spoke-key": `  ${KEY_S2} ` });
+    await expect(resolveCallerSite(request)).resolves.toMatchObject({
+      kind: "spoke",
+      workspaceId: W2,
+    });
+  });
+
+  it("ignores a workspace id, host and origin a spoke ALSO sends", async () => {
+    const { request } = requestWith({
+      "x-ailk-spoke-key": KEY_S1,
+      host: "w2.example",
+      "x-forwarded-host": "w2.example",
+      origin: "https://w2.example",
+      "x-ailk-workspace-id": W2,
+    });
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "spoke",
+      spokeId: S1,
+      workspaceId: W1,
+    });
+  });
+});
+
+describe("resolveCallerSite — fail closed (AC-3)", () => {
+  it("(i) an unregistered key is refused as key-unknown", async () => {
+    const { request, warn } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-unknown",
+    });
+    expect(warn).toHaveBeenCalledWith(
+      { reason: "key-unknown" },
+      expect.any(String),
+    );
+    expectNoSecretIn(warn);
+  });
+
+  it("a revoked key is refused as key-revoked, and only that key", async () => {
+    seedRegistry([S1]);
+    const revoked = requestWith({ "x-ailk-spoke-key": KEY_S1 });
+    await expect(resolveCallerSite(revoked.request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-revoked",
+    });
+    expect(revoked.warn).toHaveBeenCalledWith(
+      { reason: "key-revoked", spokeId: S1 },
+      expect.any(String),
+    );
+    expectNoSecretIn(revoked.warn);
+
+    const sibling = requestWith({ "x-ailk-spoke-key": KEY_S1B });
+    await expect(resolveCallerSite(sibling.request)).resolves.toMatchObject({
+      kind: "spoke",
+      workspaceId: W1,
+    });
+  });
+
+  it.each<[string, string | string[]]>([
+    ["a duplicated header, as Node joins it", `${KEY_S1}, ${KEY_S2}`],
+    ["a string[]", [KEY_S1, KEY_S2]],
+    ["an empty value", ""],
+    ["a blank value", "   "],
+    ["a 129-character value", "k".repeat(129)],
+    ["a non-ASCII value", `${KEY_S1.slice(0, 40)}é`],
+    ["a value carrying a control character", `${KEY_S1.slice(0, 40)}\u0001`],
+  ])("(ii)/(iii) %s is refused as key-malformed, before any lookup", async (_label, value) => {
+    const { request, warn } = requestWith({ "x-ailk-spoke-key": value });
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-malformed",
+    });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+    expectNoSecretIn(warn);
+  });
+
+  it("(v) strict mode refuses a header-less request whatever host, origin or workspace header it carries", async () => {
+    setStrictMode(true);
+    const { request } = requestWith({
+      host: "w1.example",
+      "x-forwarded-host": "w1.example",
+      origin: "https://w1.example",
+      "x-ailk-workspace-id": W1,
+    });
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+});
+
+describe("resolveCallerSite — the registry module is loaded only when a key needs it (AC-3 iv, AC-4)", () => {
+  /**
+   * A factory that throws when evaluated: requiring `lib/spoke-store.js` at
+   * all fails the test. `isolateModules` gives the resolver a fresh module
+   * registry, so a previous case's import cannot satisfy it.
+   */
+  function withThrowingSpokeStore(
+    run: (mod: typeof import("../public-site-resolver.js")) => Promise<void>,
+  ): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      jest.isolateModules(() => {
+        jest.doMock("../../lib/spoke-store.js", () => {
+          throw new Error("lib/spoke-store.js must not be imported");
+        });
+        // A fresh registry instance, required after doMock.
+        const mod = require("../public-site-resolver.js") as typeof import("../public-site-resolver.js");
+        run(mod).then(resolve, reject);
+      });
+    });
+  }
+
+  afterEach(() => {
+    jest.dontMock("../../lib/spoke-store.js");
+  });
+
+  it("a header-less request is anonymous: zero registry calls, no registry import", async () => {
+    await withThrowingSpokeStore(async (mod) => {
+      const { request } = requestWith({});
+      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
+        kind: "anonymous",
+      });
+    });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("a bare request object with no headers at all is anonymous (the frozen suite's shape)", async () => {
+    await withThrowingSpokeStore(async (mod) => {
+      await expect(
+        mod.resolveCallerSite({} as FastifyRequest),
+      ).resolves.toEqual({ kind: "anonymous" });
+    });
+  });
+
+  it("(iv) a valid-looking key with DATABASE_URL unset is no-database, with no registry import", async () => {
+    delete process.env.DATABASE_URL;
+    await withThrowingSpokeStore(async (mod) => {
+      const { request, warn } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
+      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
+        kind: "refused",
+        reason: "no-database",
+      });
+      expectNoSecretIn(warn);
+    });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+});
+
+describe("resolvePublicWorkspace — the spoke prefix (D3)", () => {
+  it.each(["database", "mdx"])(
+    "a spoke resolves to its own workspace on the %s adapter",
+    async (adapter) => {
+      process.env.CONTENT_ADAPTER = adapter;
+      const one = requestWith({ "x-ailk-spoke-key": KEY_S1 });
+      const two = requestWith({ "x-ailk-spoke-key": KEY_S2 });
+
+      await expect(resolvePublicWorkspace(one.request)).resolves.toEqual({
+        kind: "resolved",
+        workspaceId: W1,
+      });
+      await expect(resolvePublicWorkspace(two.request)).resolves.toEqual({
+        kind: "resolved",
+        workspaceId: W2,
+      });
+      // The one-workspace predicate is never consulted for a spoke.
+      expect(db.workspace.count).not.toHaveBeenCalled();
+    },
+  );
+
+  it("a refused key is unresolved (spoke-refused), never the alias or the default", async () => {
+    const { request } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
+    await expect(resolvePublicWorkspace(request)).resolves.toEqual({
+      kind: "unresolved",
+      reason: "spoke-refused",
+    });
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+
+  it("a header-less request keeps today's answer — ambiguous on a three-workspace hub", async () => {
+    const { request } = requestWith({});
+    await expect(resolvePublicWorkspace(request)).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+  });
+});
+
+describe("resolvePublicContentAdapter — a spoke's content read (AC-1)", () => {
+  it("on the database adapter, reads the spoke's own workspace", async () => {
+    const { request } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
+
+    await expect(resolvePublicContentAdapter(request)).resolves.toEqual({
+      kind: "adapter-double",
+    });
+    expect(getContentAdapter).toHaveBeenCalledTimes(1);
+    expect(getContentAdapter).toHaveBeenCalledWith({
+      workspaceId: W1,
+      prisma: db,
+    });
+  });
+
+  it("on the mdx adapter, keeps reading the shared mdx source — no workspace argument", async () => {
+    process.env.CONTENT_ADAPTER = "mdx";
+    const { request } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
+
+    await resolvePublicContentAdapter(request);
+    expect(getContentAdapter).toHaveBeenCalledTimes(1);
+    expect(getContentAdapter).toHaveBeenCalledWith();
+  });
+
+  it.each<[string, Record<string, string>, boolean]>([
+    ["an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, false],
+    ["a malformed key", { "x-ailk-spoke-key": "" }, false],
+    ["a header-less request in strict mode", { host: "w1.example" }, true],
+  ])("%s resolves to null — no adapter at all (AC-3)", async (_label, headers, strict) => {
+    setStrictMode(strict);
+    const { request, warn } = requestWith(headers);
+
+    await expect(resolvePublicContentAdapter(request)).resolves.toBeNull();
+    expect(getContentAdapter).not.toHaveBeenCalled();
+    expectNoSecretIn(warn);
+  });
+});

package/templates/apps/api/src/services/default-tenant.ts

@@ -17,12 +17,13 @@
  * keeps the two paths from drifting.
  *
  * PRECEDENCE, NOT PARALLELISM. When the multi-tenant module is present,
- * `resolveActiveTenant` (the slice) is the entry point and calls
- * `resolveDefaultTenant` only on the branch it always called it on — the
- * previously-unconditional-deny null-binding branch. Nothing about the
- * multi-tenant path changes. Without the module, `middleware/default-tenant.ts`
- * calls this directly. There is one resolution, reached two ways, never two
- * resolutions.
+ * `resolveActiveTenant` (the slice) is the entry point and, on its
+ * null-binding branch only (the session carries no active workspace), calls
+ * `resolveDefaultTenantForOperator` — the same pinned, verified-operator entry
+ * point the base guard uses (#7523). Its explicit-binding branch never reaches
+ * this file. Without the module, `middleware/default-tenant.ts` calls
+ * `resolveDefaultTenantForOperator` directly. There is one resolution, behind
+ * one pin check, reached two ways — never two resolutions.
  *
  * DEFAULT-DENY IS THE FLOOR. `resolveDefaultTenant` returns `null` — never a
  * grant — the instant the deployment is not unambiguously single-tenant
@@ -145,14 +146,14 @@ async function bindOperatorMembership(userId: Id<"user">): Promise<void> {
  * whose `User.email` matches `AILK_OPERATOR_EMAIL`, denying everyone when the
  * pin is unset (#5693 security review, High finding).
  *
- * WHY THE BASE PATH NEEDS THIS AND THE MULTI-TENANT PATH DOES NOT. Registering
- * the review surface on a module-less build made two things reachable together
- * that were previously unreachable there: this resolution's TOFU operator bind,
- * and `services/waitlist-dashboard.ts`'s `isPlatformOperator`, which grants
+ * WHY BOTH PATHS NEED THIS. Registering the review surface on a module-less
+ * build made two things reachable together that were previously unreachable
+ * there: this resolution's TOFU operator bind, and
+ * `services/waitlist-operator-reads.ts`'s `isPlatformOperator`, which grants
  * `{kind: "all"}` — every site's rows, unfiltered — to an `owner` of the
- * sentinel default Organization whenever `AILK_OPERATOR_EMAIL` is merely SET.
- * That predicate never compares the caller to the pin; the pin is an on/off
- * switch for it.
+ * sentinel default Organization. Until #7523 that predicate never compared the
+ * caller to the pin; the pin was an on/off switch for it. It now goes through
+ * `isPinnedOperator` below too, but the bind is the half this function closes.
  *
  * Unpinned TOFU plus that predicate is an escalation. The site's auth
  * auto-provisions a `User` on first login, so on a deployment with the pin
@@ -170,21 +171,29 @@ async function bindOperatorMembership(userId: Id<"user">): Promise<void> {
  * but only at bind time and only for the bind; this is the one that gates the
  * grant.
  *
- * The multi-tenant module is unaffected: `resolveActiveTenant` keeps calling
- * `resolveDefaultTenant` directly, on exactly the branch it always called it
- * on. This wrapper is reached only from `middleware/default-tenant.ts`, which
- * only ever runs on a build without that module.
+ * The multi-tenant module reached the same race the same way: its null-binding
+ * branch called `resolveDefaultTenant` directly, so on a one-workspace
+ * multi-tenant deployment with the pin unset the first signed-in caller to
+ * touch a tenant route from `apps/web` (whose sessions never carry an active
+ * workspace) was seated as owner. Since #7523 that branch calls this wrapper
+ * too (docs/specs/7523-a-multi-tenant-session-with-spec.md D1), so a session
+ * with no active workspace is granted the default tenant only when its
+ * caller is the pinned, verified operator. Sessions that DO carry an active
+ * workspace — every Admin-app request — never reach this function.
  *
  * `docs/specs/single-tenant-owner-pin-spec.md` D5 already recommended pinning;
- * on this path it is mandatory rather than advisory, and unset fails closed.
+ * on both paths it is now mandatory rather than advisory, and unset fails
+ * closed.
  *
  * ONE KNOWN IMPRECISION, deliberate. `User.email` is `@unique` in Postgres,
  * which is byte-exact, while this comparison lowercases both sides — so two
  * distinct rows (`Operator@x.com` and `operator@x.com`) could both satisfy one
- * pin. It is not reachable today: `apps/web/auth.ts` configures social
- * providers only, so the address is provider-asserted and normalized rather
- * than caller-chosen. It becomes reachable the moment a credential provider is
- * enabled, and the durable fix is case-insensitive email uniqueness in the
+ * pin. `apps/web/auth.ts` no longer configures social providers only: it also
+ * enables email+password and magic-link sign-in, so the address can be
+ * caller-chosen. Only a VERIFIED row is compared (`findVerifiedEmail`), and
+ * verifying it needs a mailbox proof, so a second row for the pin's address
+ * in a different case is reachable only by someone who controls that
+ * mailbox. The durable fix is still case-insensitive email uniqueness in the
  * schema (citext, or lowercase-at-write) so "matches the pin" and "is unique"
  * agree. Matching case-sensitively here instead would be worse: it would lock
  * out an operator who typed their own address with different capitalisation.
@@ -192,9 +201,26 @@ async function bindOperatorMembership(userId: Id<"user">): Promise<void> {
 export async function resolveDefaultTenantForOperator(
   userId: Id<"user">,
 ): Promise<TenantContext | null> {
+  return (await isPinnedOperator(userId)) ? resolveDefaultTenant(userId) : null;
+}
+
+/**
+ * The one pin-match predicate in `apps/api` (#7523 D2): `true` only when
+ * `AILK_OPERATOR_EMAIL` is set and the caller's VERIFIED `User.email` equals
+ * it. Both sides are trimmed and lowercased; a blank pin counts as unset and
+ * refuses before any read, so it can never "match" a blank `User.email`.
+ *
+ * Shared by the two tenant guards (through `resolveDefaultTenantForOperator`)
+ * and by `services/waitlist-operator-reads.ts`'s `isPlatformOperator`. It
+ * lives in this base-build file because that operator-read file rides more
+ * than one module slice and may import only files every build ships.
+ * `bindOperatorMembership` keeps its own inline check: it must allow a bind
+ * when the pin is unset, which this predicate never does.
+ */
+export async function isPinnedOperator(userId: Id<"user">): Promise<boolean> {
   const pinnedEmail = process.env.AILK_OPERATOR_EMAIL?.trim().toLowerCase();
   if (!pinnedEmail) {
-    return null;
+    return false;
   }
   // The verified-email read is `services/verified-email.ts` (#5701 D4) — the
   // one this and the four other email-keyed paths share. It returns the
@@ -202,12 +228,9 @@ export async function resolveDefaultTenantForOperator(
   // against the pin a proven claim rather than an asserted one.
   const verified = await findVerifiedEmail(userId);
   if (!verified.ok) {
-    return null;
-  }
-  if (verified.value.email.trim().toLowerCase() !== pinnedEmail) {
-    return null;
+    return false;
   }
-  return resolveDefaultTenant(userId);
+  return verified.value.email.trim().toLowerCase() === pinnedEmail;
 }
 
 /**