create-ailk 0.11.5 → 0.12.1

package/templates/apps/api/src/routes/project-listings/__tests__/directory.test.ts

@@ -0,0 +1,528 @@
+// Not marked oss: false (D-48/#5366 escalation) — tests the
+// always-shipping project-listings anonymous surface; see
+// routes/project-listings/me.ts's header comment.
+/**
+ * @file directory.test.ts
+ *
+ * THE ACCEPTANCE GATE for `GET /v1/project-listings/directory` (#7521 AC-1,
+ * AC-3): a landing page's directory — the live listicle that names it, its
+ * schema.org entry type, and its ACCEPTED entries with their public profile.
+ *
+ * Real `projectListingDirectoryRoute`, real services, mocked `lib/prisma.js`
+ * over a small in-memory store of listicles, listings and site configs. The
+ * last block boots the real `build()` so the directory's own rate-limited
+ * scope is asserted where it is registered, not in a copy of it.
+ *
+ * Spec: docs/specs/7521-a-generic-directory-surface-for-spec.md §5.1.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@fastify/cors", () => jest.fn().mockResolvedValue(undefined));
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import { listingDirectoryResponseSchema } from "@working-theory/validation";
+
+import { mockWorkspaceExists } from "../../../lib/__mocks__/prisma.js";
+import { prisma } from "../../../lib/prisma.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
+import { __resetBuckets } from "../../../middleware/rate-limit.js";
+import { build } from "../../../server.js";
+import { projectListingDirectoryRoute } from "../index.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SITE_A = "wksp_00000000-0000-7000-8000-00000000000a";
+const SITE_B = "wksp_00000000-0000-7000-8000-00000000000b";
+const KEY_A = "pk-site-a";
+const KEY_B = "pk-site-b";
+
+type Row = Record<string, unknown>;
+
+let listings: Row[];
+let flows: Row[];
+/** `SiteListingConfig` rows by siteId: `{ publicKey, data }`. */
+let configs: Map<string, { publicKey: string; data: Record<string, unknown> }>;
+
+const en = (s: string, fr?: string) => (fr ? { en: s, fr } : { en: s });
+
+function listicleConfig(listing?: Record<string, unknown>) {
+  return {
+    slug: "apply",
+    defaultLocale: "en",
+    steps: [
+      {
+        key: "application",
+        type: "field",
+        copy: { title: en("Apply") },
+        fields: [
+          { name: "full_name", inputType: "text", mapsTo: "name", copy: { label: en("Name") } },
+          { name: "email", inputType: "email", mapsTo: "email", copy: { label: en("Email") } },
+          { name: "website", inputType: "url", copy: { label: en("Website", "Site web") } },
+          {
+            name: "stage",
+            inputType: "select",
+            options: [
+              { value: "idea", label: en("Idea", "Idée") },
+              { value: "live", label: en("Live", "En ligne") },
+            ],
+            copy: { label: en("Stage", "Étape") },
+          },
+        ],
+      },
+    ],
+    ...(listing !== undefined && { listing }),
+  };
+}
+
+function flow(overrides: Row): Row {
+  return {
+    siteId: SITE_A,
+    workspaceId: SITE_A,
+    kind: "listicle",
+    status: "live",
+    landingPage: "/partners",
+    config: listicleConfig({ entryType: "Organization" }),
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+let nextListing = 1;
+function listing(overrides: Row): Row {
+  const n = nextListing++;
+  return {
+    id: `prjl_00000000-0000-7000-8000-${String(n).padStart(12, "0")}`,
+    siteId: SITE_A,
+    workspaceId: SITE_A,
+    capturedByFlowId: "flow_partners",
+    leadId: null,
+    slug: `entry-${n}`,
+    name: `Entry ${n}`,
+    headline: null,
+    oneLiner: `Entry ${n} in one line.`,
+    problem: null,
+    solution: null,
+    url: null,
+    product: null,
+    commitment: null,
+    teamComposition: null,
+    faqs: null,
+    anythingElse: null,
+    address: null,
+    addressLine1: null,
+    addressLine2: null,
+    addressCity: null,
+    addressRegion: null,
+    addressPostalCode: null,
+    addressCountry: null,
+    questions: null,
+    siteAnswers: { website: "https://entry.test", stage: "live", email: "x@y.test" },
+    windowDays: 30,
+    founderName: "A Founder",
+    founderFirstName: null,
+    founderLastName: null,
+    founderEmail: "founder@example.com",
+    founderPhone: "+12015550123",
+    emailVerifiedAt: null,
+    founderCompany: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "active",
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: new Date("2026-09-10T00:00:00.000Z"),
+    decidedBy: "owner",
+    issueUrl: null,
+    experimentKey: null,
+    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+    }
+    return row[key] === value;
+  });
+}
+
+type SortTerm = "asc" | "desc" | { sort: "asc" | "desc"; nulls?: "first" | "last" };
+type OrderBy = Array<Record<string, SortTerm>>;
+/** Prisma's ordering, with Postgres's default of NULL first on DESC, last on ASC. */
+function ordered(rows: Row[], orderBy: OrderBy | undefined): Row[] {
+  if (!orderBy) return rows;
+  return [...rows].sort((a, b) => {
+    for (const term of orderBy) {
+      const [key, spec] = Object.entries(term)[0]!;
+      const dir = typeof spec === "string" ? spec : spec.sort;
+      const nulls = (typeof spec === "string" ? undefined : spec.nulls) ?? (dir === "desc" ? "first" : "last");
+      const av = a[key] instanceof Date ? (a[key] as Date).getTime() : (a[key] as string | null);
+      const bv = b[key] instanceof Date ? (b[key] as Date).getTime() : (b[key] as string | null);
+      if (av === bv) continue;
+      if (av === null || av === undefined) return nulls === "first" ? -1 : 1;
+      if (bv === null || bv === undefined) return nulls === "first" ? 1 : -1;
+      const cmp = av < bv ? -1 : 1;
+      return dir === "asc" ? cmp : -cmp;
+    }
+    return 0;
+  });
+}
+
+function installStore(): void {
+  listings = [];
+  flows = [];
+  configs = new Map([
+    [SITE_A, { publicKey: KEY_A, data: {} }],
+    [SITE_B, { publicKey: KEY_B, data: {} }],
+  ]);
+  nextListing = 1;
+
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        for (const [siteId, row] of configs) {
+          if (row.publicKey === where.publicKey) return Promise.resolve({ siteId });
+        }
+        return Promise.resolve(null);
+      }
+      const row = configs.get(where.siteId!);
+      return Promise.resolve(row ? { data: row.data } : null);
+    },
+  );
+  (prisma.flowDefinition.findMany as jest.Mock).mockImplementation(
+    ({ where, orderBy }: { where: Record<string, unknown>; orderBy?: OrderBy }) =>
+      Promise.resolve(ordered(flows.filter((f) => matches(f, where)), orderBy)),
+  );
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where, orderBy, take }: { where: Record<string, unknown>; orderBy?: OrderBy; take?: number }) => {
+      const found = ordered(listings.filter((l) => matches(l, where)), orderBy);
+      return Promise.resolve(take === undefined ? found : found.slice(0, take));
+    },
+  );
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(projectListingDirectoryRoute);
+  await app.ready();
+  return app;
+}
+
+type Directory = {
+  landingPage: string;
+  entryType: string;
+  entries: Array<{ slug: string; status: string; profile: Array<Record<string, string>> }>;
+} | null;
+
+const read = async (app: FastifyInstance, query: string) => {
+  const res = await app.inject({ method: "GET", url: `/v1/project-listings/directory?${query}` });
+  return { res, data: (res.json() as { data?: Directory }).data };
+};
+
+// ─── AC-1 — which entries a landing page shows ─────────────────────────────
+
+describe("GET /v1/project-listings/directory (#7521 AC-1)", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("returns the live listicle's entry type and exactly its accepted entries, the elapsed one closed, in /public's order", async () => {
+    flows.push(flow({ id: "flow_partners" }));
+    const live = listing({ slug: "acme", decidedAt: new Date("2026-09-10T00:00:00.000Z") });
+    const elapsed = listing({
+      slug: "globex",
+      decidedAt: new Date("2026-09-12T00:00:00.000Z"),
+      windowEndsAt: new Date("2026-09-20T00:00:00.000Z"),
+    });
+    const requested = listing({ slug: null, status: "requested", decidedAt: null });
+    listings.push(live, elapsed, requested);
+
+    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(res.statusCode).toBe(200);
+    expect(listingDirectoryResponseSchema.safeParse(data).success).toBe(true);
+    expect(data!.landingPage).toBe("/partners");
+    expect(data!.entryType).toBe("Organization");
+    // /public's order: the three newest by decidedAt first.
+    expect(data!.entries.map((e) => [e.slug, e.status])).toEqual([
+      ["globex", "closed"],
+      ["acme", "active"],
+    ]);
+  });
+
+  it("a draft listicle, another landing page, another workspace and an uncaptured listing contribute nothing", async () => {
+    flows.push(
+      flow({ id: "flow_partners" }),
+      flow({ id: "flow_draft", status: "draft" }),
+      flow({ id: "flow_tools", landingPage: "/tools" }),
+    );
+    listings.push(
+      listing({ slug: "kept" }),
+      listing({ slug: "from-draft", capturedByFlowId: "flow_draft" }),
+      listing({ slug: "from-tools", capturedByFlowId: "flow_tools" }),
+      listing({ slug: "other-workspace", siteId: SITE_B, workspaceId: SITE_B }),
+      listing({ slug: "uncaptured", capturedByFlowId: null }),
+    );
+
+    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(data!.entries.map((e) => e.slug)).toEqual(["kept"]);
+    // The flow read carried every scope term.
+    expect((prisma.flowDefinition.findMany as jest.Mock).mock.calls[0][0].where).toEqual({
+      siteId: SITE_A,
+      workspaceId: SITE_A,
+      kind: "listicle",
+      status: "live",
+      landingPage: "/partners",
+    });
+  });
+
+  it("a landing page no live listicle names answers data: null, and reads no listings", async () => {
+    flows.push(flow({ id: "flow_partners" }));
+    listings.push(listing({ slug: "acme" }));
+
+    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/about`);
+
+    expect(res.statusCode).toBe(200);
+    expect(data).toBeNull();
+    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
+  });
+
+  it("returns at most 200 entries — the most recently accepted", async () => {
+    flows.push(flow({ id: "flow_partners" }));
+    for (let i = 0; i < 250; i++) {
+      listings.push(
+        listing({ slug: `e-${i}`, decidedAt: new Date(Date.UTC(2026, 0, 1) + i * 60_000) }),
+      );
+    }
+
+    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(res.statusCode).toBe(200);
+    expect(data!.entries).toHaveLength(200);
+    expect(data!.entries.map((e) => e.slug)).not.toContain("e-0");
+    expect(data!.entries.map((e) => e.slug)).toContain("e-249");
+  });
+
+  it("an active row with no decidedAt never takes a slot from an accepted one", async () => {
+    flows.push(flow({ id: "flow_partners" }));
+    listings.push(listing({ slug: "undecided", decidedAt: null }));
+    for (let i = 0; i < 200; i++) {
+      listings.push(
+        listing({ slug: `e-${i}`, decidedAt: new Date(Date.UTC(2026, 0, 1) + i * 60_000) }),
+      );
+    }
+
+    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(data!.entries).toHaveLength(200);
+    expect(data!.entries.map((e) => e.slug)).not.toContain("undecided");
+    expect(data!.entries.map((e) => e.slug)).toContain("e-0");
+  });
+
+  it("a listicle with no `listing` block publishes as CreativeWork", async () => {
+    flows.push(flow({ id: "flow_partners", config: listicleConfig() }));
+    listings.push(listing({ slug: "acme" }));
+
+    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(data!.entryType).toBe("CreativeWork");
+  });
+
+  it("the earlier-created listicle supplies the entry type when two name one page; both contribute entries", async () => {
+    flows.push(
+      flow({ id: "flow_later", config: listicleConfig({ entryType: "Person" }), createdAt: new Date("2026-09-05") }),
+      flow({ id: "flow_partners", createdAt: new Date("2026-09-01") }),
+    );
+    listings.push(listing({ slug: "a" }), listing({ slug: "b", capturedByFlowId: "flow_later" }));
+
+    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    expect(data!.entryType).toBe("Organization");
+    expect(data!.entries.map((e) => e.slug).sort()).toEqual(["a", "b"]);
+  });
+
+  it("each entry's profile carries the listicle's public answers for the request locale, and no contact column", async () => {
+    flows.push(flow({ id: "flow_partners" }));
+    listings.push(listing({ slug: "acme" }));
+
+    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners&locale=fr`);
+
+    expect(data!.entries[0]!.profile).toEqual([
+      { name: "website", label: "Site web", value: "https://entry.test", kind: "url" },
+      { name: "stage", label: "Étape", value: "En ligne", kind: "select" },
+    ]);
+    const body = res.body;
+    expect(body).not.toContain("founder@example.com");
+    expect(body).not.toContain("x@y.test");
+    expect(body).not.toContain("+12015550123");
+  });
+
+  it("a malformed query is a 400 validation_failed", async () => {
+    const { res } = await read(app, `siteKey=${KEY_A}&landingPage=//evil.test`);
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
+  });
+});
+
+// ─── AC-3 — both tenancy shapes, one read ───────────────────────────────────
+
+describe("the directory resolves both tenancy shapes (#7521 AC-3)", () => {
+  let app: FastifyInstance;
+  let savedSiteId: string | undefined;
+  let savedPublicKey: string | undefined;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    savedSiteId = process.env["AILK_SITE_ID"];
+    savedPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
+    delete process.env["AILK_SITE_ID"];
+    delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    __resetSiteWorkspaceCacheForTests();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    if (savedSiteId === undefined) delete process.env["AILK_SITE_ID"];
+    else process.env["AILK_SITE_ID"] = savedSiteId;
+    if (savedPublicKey === undefined) delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    else process.env["AILK_LISTING_PUBLIC_KEY"] = savedPublicKey;
+    await app.close();
+  });
+
+  function seedSiteA(): void {
+    flows.push(flow({ id: "flow_partners" }));
+    listings.push(listing({ slug: "acme" }), listing({ slug: "globex" }));
+  }
+
+  it("multi-tenant (SiteListingConfig.publicKey) and single-tenant (env key) answer the identical body", async () => {
+    seedSiteA();
+    const multi = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+
+    // Single-tenant: no config row carries the key; the env key names the
+    // deployment's own site, resolved through `resolveSiteWorkspaceId()`.
+    configs.delete(SITE_A);
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
+    process.env["AILK_SITE_ID"] = SITE_A;
+    mockWorkspaceExists(prisma, SITE_A);
+    const single = await read(app, "siteKey=pk-single-tenant&landingPage=/partners");
+
+    expect(multi.res.statusCode).toBe(200);
+    expect(single.res.statusCode).toBe(200);
+    expect(single.data!.entries).toHaveLength(2);
+    expect(single.data).toEqual(multi.data);
+  });
+
+  it("an unmatched key is a 400 unknown_site_key and does not fall through to the env path", async () => {
+    seedSiteA();
+    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
+    process.env["AILK_SITE_ID"] = SITE_A;
+    mockWorkspaceExists(prisma, SITE_A);
+
+    const { res } = await read(app, "siteKey=pk-nobodys-site&landingPage=/partners");
+
+    expect(res.statusCode).toBe(400);
+    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
+    expect(prisma.flowDefinition.findMany).not.toHaveBeenCalled();
+  });
+
+  it("two workspaces of one organization (the hub's spokes) each see only their own entries", async () => {
+    seedSiteA();
+    flows.push(flow({ id: "flow_b", siteId: SITE_B, workspaceId: SITE_B }));
+    listings.push(
+      listing({ slug: "b-entry", siteId: SITE_B, workspaceId: SITE_B, capturedByFlowId: "flow_b" }),
+    );
+
+    const a = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
+    const b = await read(app, `siteKey=${KEY_B}&landingPage=/partners`);
+
+    expect(a.data!.entries.map((e) => e.slug).sort()).toEqual(["acme", "globex"]);
+    expect(b.data!.entries.map((e) => e.slug)).toEqual(["b-entry"]);
+  });
+});
+
+// ─── AC-1 — the directory's own rate-limited scope, through the real build ──
+
+describe("the directory's rate-limit scope (#7521 AC-1, SEC-7521-D1)", () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; matches leads-forwarded-rate-limit.test.ts
+  let server: any;
+  const priorModules = process.env["AILK_ENABLED_MODULES"];
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    __resetBuckets();
+    process.env["AILK_ENABLED_MODULES"] = "signal-collectors";
+    server = await build();
+    await server.ready();
+  });
+
+  afterEach(async () => {
+    if (server) await server.close();
+    server = undefined;
+  });
+
+  afterAll(() => {
+    if (priorModules === undefined) delete process.env["AILK_ENABLED_MODULES"];
+    else process.env["AILK_ENABLED_MODULES"] = priorModules;
+  });
+
+  it("15 directory reads in one minute from one IP all answer 200 — the leads scope would refuse the 11th", async () => {
+    const codes: number[] = [];
+    for (let i = 0; i < 15; i++) {
+      const res = await server.inject({
+        method: "GET",
+        url: `/v1/project-listings/directory?siteKey=${KEY_A}&landingPage=/partners`,
+        headers: { "x-forwarded-for": "198.51.100.7" },
+      });
+      codes.push(res.statusCode);
+    }
+    expect(codes).toEqual(Array(15).fill(200));
+
+    // The same IP's eleventh `/public` read — leadsScope — is refused.
+    const publicCodes: number[] = [];
+    for (let i = 0; i < 11; i++) {
+      const res = await server.inject({
+        method: "GET",
+        url: `/v1/project-listings/public?siteKey=${KEY_A}`,
+        headers: { "x-forwarded-for": "198.51.100.7" },
+      });
+      publicCodes.push(res.statusCode);
+    }
+    expect(publicCodes[10]).toBe(429);
+  });
+});