create-ailk 0.12.1 → 0.13.0

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -192,7 +192,7 @@ describe("listOwnedLeads", () => {
     expect(prisma.lead.findMany).not.toHaveBeenCalled();
   });
 
-  it("returns an empty page for a `member` — the role floor is owner|admin", async () => {
+  it("returns the rows to a `member` — `inbox-read` holds every role (#7636 D2)", async () => {
     (prisma.membership.findMany as jest.Mock).mockResolvedValue(
       membershipsWithRole("member"),
     );
@@ -200,6 +200,19 @@ describe("listOwnedLeads", () => {
 
     const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
 
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((row) => row.id)).toEqual(["lead_own_1"]);
+  });
+
+  it("returns an empty page for a role outside the permission table — default deny", async () => {
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      membershipsWithRole("writer"),
+    );
+    seedLeadTable([lead({ id: "lead_own_1", siteId: OWN_SITE_ID })]);
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
     expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
     expect(prisma.lead.findMany).not.toHaveBeenCalled();
   });
@@ -428,11 +441,21 @@ describe("listOwnedLeads — single-tenant build (#6730 D7)", () => {
     expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
   });
 
-  it("a `member` role → empty — the role floor still holds", async () => {
+  it("a `member` role → the default workspace's leads — `inbox-read` holds every role", async () => {
     oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "member" });
 
     const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
 
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
+  });
+
+  it("a role outside the permission table → empty — default deny", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "writer" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
     expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
   });
 

package/templates/apps/api/src/services/__tests__/spoke-resolution.test.ts

@@ -2,7 +2,11 @@
  * @file spoke-resolution.test.ts
  *
  * `resolveCallerSite(request)` and the public resolver's spoke arms (#7532,
- * spec docs/specs/7532-a-spoke-s-public-reads-spec.md D3, AC-1, AC-3, AC-4).
+ * spec docs/specs/7532-a-spoke-s-public-reads-spec.md D3, AC-1, AC-3, AC-4),
+ * and its keyless branch since #7633 (spec
+ * docs/specs/7633-expected-a-keyless-public-read-spec.md D1–D3, AC-1, AC-2,
+ * AC-5): a hub — a deployment whose registry holds a row — refuses a keyless
+ * call exactly as it refuses an unknown key, with no switch set.
  *
  * A spoke names itself with ONE request header, `x-ailk-spoke-key`, looked up
  * by its SHA-256 digest in the hub's registry. Nothing else on the request —
@@ -10,7 +14,9 @@
  *
  * Fixture (spec § 5): three workspaces — the sentinel default `F`, `W1`, `W2`;
  * spokes `S1` → `W1`, `S1b` → `W1`, `S2` → `W2`, each with its own key.
- * `db.spoke.findUnique` answers by `credentialHash`.
+ * `db.spoke.findUnique` answers by `credentialHash`; `db.spoke.findFirst` — the
+ * "is this a hub" read — answers `{ id: S1 }` (a non-empty registry) unless a
+ * case empties it.
  *
  * External dependency boundaries mocked:
  *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
@@ -28,10 +34,12 @@ jest.mock("../../lib/content-adapter.js", () => ({
 import type { FastifyRequest } from "fastify";
 
 import * as configModule from "../../config/index.js";
+import type { HubSpokeKeyMode } from "../../config/index.js";
 import { getContentAdapter } from "../../lib/content-adapter.js";
 import { mockSentinelWorkspaceExists } from "../../lib/__mocks__/prisma.js";
 import { prisma } from "../../lib/prisma.js";
 import {
+  __resetHubStatusForTests,
   resolveCallerSite,
   resolvePublicContentAdapter,
   resolvePublicWorkspace,
@@ -58,7 +66,10 @@ const digest = (key: string) => createHash("sha256").update(key).digest("hex");
 
 type SpokeRow = { id: string; workspaceId: string; revokedAt: Date | null };
 
-/** Program the registry: `db.spoke.findUnique` answers by digest. */
+/**
+ * Program the registry: `db.spoke.findUnique` answers by digest, and
+ * `db.spoke.findFirst` reports a non-empty registry (#7633 D1).
+ */
 function seedRegistry(revoked: readonly string[] = []): void {
   const rows = new Map<string, SpokeRow>([
     [digest(KEY_S1), { id: S1, workspaceId: W1, revokedAt: null }],
@@ -73,6 +84,12 @@ function seedRegistry(revoked: readonly string[] = []): void {
   }: {
     where: { credentialHash: string };
   }) => rows.get(where.credentialHash) ?? null) as never);
+  db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
+}
+
+/** An empty registry: a deployment with no spoke is not a hub (#7633 D1). */
+function emptyRegistry(): void {
+  db.spoke.findFirst.mockResolvedValue(null);
 }
 
 /** A request double carrying only what the resolver may read. */
@@ -89,10 +106,10 @@ function requestWith(headers: Record<string, string | string[]>): {
   return { request, warn };
 }
 
-function setStrictMode(on: boolean): void {
+function setMode(mode: HubSpokeKeyMode): void {
   jest.replaceProperty(configModule, "config", {
     ...configModule.config,
-    AILK_HUB_REQUIRE_SPOKE_KEY: on,
+    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
   });
 }
 
@@ -108,6 +125,7 @@ function expectNoSecretIn(log: jest.Mock): void {
 
 const savedAdapter = process.env.CONTENT_ADAPTER;
 const savedDatabaseUrl = process.env.DATABASE_URL;
+const savedMode = process.env.AILK_HUB_REQUIRE_SPOKE_KEY;
 
 beforeEach(() => {
   jest.resetAllMocks();
@@ -117,7 +135,8 @@ beforeEach(() => {
   seedRegistry();
   mockSentinelWorkspaceExists(db, W1, W2);
   db.workspace.count.mockResolvedValue(3);
-  setStrictMode(false);
+  setMode("auto");
+  __resetHubStatusForTests();
 });
 
 afterEach(() => {
@@ -126,6 +145,8 @@ afterEach(() => {
   else process.env.CONTENT_ADAPTER = savedAdapter;
   if (savedDatabaseUrl === undefined) delete process.env.DATABASE_URL;
   else process.env.DATABASE_URL = savedDatabaseUrl;
+  if (savedMode === undefined) delete process.env.AILK_HUB_REQUIRE_SPOKE_KEY;
+  else process.env.AILK_HUB_REQUIRE_SPOKE_KEY = savedMode;
 });
 
 describe("resolveCallerSite — a registered spoke (AC-1)", () => {
@@ -224,8 +245,8 @@ describe("resolveCallerSite — fail closed (AC-3)", () => {
     expectNoSecretIn(warn);
   });
 
-  it("(v) strict mode refuses a header-less request whatever host, origin or workspace header it carries", async () => {
-    setStrictMode(true);
+  it("(v) mode \"on\" refuses a header-less request whatever host, origin or workspace header it carries", async () => {
+    setMode("on");
     const { request } = requestWith({
       host: "w1.example",
       "x-forwarded-host": "w1.example",
@@ -265,17 +286,20 @@ describe("resolveCallerSite — the registry module is loaded only when a key ne
     jest.dontMock("../../lib/spoke-store.js");
   });
 
-  it("a header-less request is anonymous: zero registry calls, no registry import", async () => {
+  it("with DATABASE_URL unset, a header-less request is anonymous: no registry read, no registry import (#7633 AC-2)", async () => {
+    delete process.env.DATABASE_URL;
     await withThrowingSpokeStore(async (mod) => {
       const { request } = requestWith({});
       await expect(mod.resolveCallerSite(request)).resolves.toEqual({
         kind: "anonymous",
       });
     });
+    expect(db.spoke.findFirst).not.toHaveBeenCalled();
     expect(db.spoke.findUnique).not.toHaveBeenCalled();
   });
 
-  it("a bare request object with no headers at all is anonymous (the frozen suite's shape)", async () => {
+  it("with DATABASE_URL unset, a bare request object with no headers at all is anonymous (the frozen suite's shape)", async () => {
+    delete process.env.DATABASE_URL;
     await withThrowingSpokeStore(async (mod) => {
       await expect(
         mod.resolveCallerSite({} as FastifyRequest),
@@ -283,6 +307,17 @@ describe("resolveCallerSite — the registry module is loaded only when a key ne
     });
   });
 
+  it("mode \"off\" on a hub: a header-less request is anonymous, with no registry import (#7633 AC-5)", async () => {
+    // The isolated resolver reads a fresh config, parsed from the environment.
+    process.env.AILK_HUB_REQUIRE_SPOKE_KEY = "false";
+    await withThrowingSpokeStore(async (mod) => {
+      const { request } = requestWith({});
+      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
+        kind: "anonymous",
+      });
+    });
+  });
+
   it("(iv) a valid-looking key with DATABASE_URL unset is no-database, with no registry import", async () => {
     delete process.env.DATABASE_URL;
     await withThrowingSpokeStore(async (mod) => {
@@ -327,7 +362,8 @@ describe("resolvePublicWorkspace — the spoke prefix (D3)", () => {
     expect(db.workspace.count).not.toHaveBeenCalled();
   });
 
-  it("a header-less request keeps today's answer — ambiguous on a three-workspace hub", async () => {
+  it("with an empty registry, a header-less request keeps today's answer — ambiguous on three workspaces (#7633 AC-2)", async () => {
+    emptyRegistry();
     const { request } = requestWith({});
     await expect(resolvePublicWorkspace(request)).resolves.toEqual({
       kind: "unresolved",
@@ -359,12 +395,13 @@ describe("resolvePublicContentAdapter — a spoke's content read (AC-1)", () =>
     expect(getContentAdapter).toHaveBeenCalledWith();
   });
 
-  it.each<[string, Record<string, string>, boolean]>([
-    ["an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, false],
-    ["a malformed key", { "x-ailk-spoke-key": "" }, false],
-    ["a header-less request in strict mode", { host: "w1.example" }, true],
-  ])("%s resolves to null — no adapter at all (AC-3)", async (_label, headers, strict) => {
-    setStrictMode(strict);
+  it.each<[string, Record<string, string>, HubSpokeKeyMode]>([
+    ["an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, "auto"],
+    ["a malformed key", { "x-ailk-spoke-key": "" }, "auto"],
+    ["a header-less request in mode \"on\"", { host: "w1.example" }, "on"],
+    ["a header-less request on a hub, with no switch set (#7633 AC-1)", { host: "w1.example" }, "auto"],
+  ])("%s resolves to null — no adapter at all (AC-3)", async (_label, headers, mode) => {
+    setMode(mode);
     const { request, warn } = requestWith(headers);
 
     await expect(resolvePublicContentAdapter(request)).resolves.toBeNull();
@@ -372,3 +409,252 @@ describe("resolvePublicContentAdapter — a spoke's content read (AC-1)", () =>
     expectNoSecretIn(warn);
   });
 });
+
+// ── #7633 — the keyless branch on a hub ──────────────────────────────────────
+
+describe("resolveCallerSite — a keyless call on a hub is refused like an unknown key (#7633 AC-1)", () => {
+  it("is refused as key-required after one registry read with no where, and no key lookup", async () => {
+    const { request, warn } = requestWith({});
+
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+    expect(warn).toHaveBeenCalledWith(
+      { reason: "key-required" },
+      expect.any(String),
+    );
+  });
+
+  it("is refused when the registry's only row is revoked — revocation never re-opens keyless access", async () => {
+    seedRegistry([S1, S1B, S2]);
+    const { request } = requestWith({});
+
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("is refused whatever host, origin or workspace header it carries", async () => {
+    const { request } = requestWith({
+      host: "w1.example",
+      "x-forwarded-host": "w1.example",
+      origin: "https://w1.example",
+      "x-ailk-workspace-id": W1,
+    });
+
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("resolvePublicWorkspace answers it exactly as it answers an unknown key", async () => {
+    const keyless = await resolvePublicWorkspace(requestWith({}).request);
+    const unknown = await resolvePublicWorkspace(
+      requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN }).request,
+    );
+
+    expect(keyless).toEqual({ kind: "unresolved", reason: "spoke-refused" });
+    expect(keyless).toEqual(unknown);
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+});
+
+describe("resolveCallerSite — a deployment with no spoke keeps today's keyless answer (#7633 AC-2)", () => {
+  it("with DATABASE_URL set and an empty registry, is anonymous after exactly one registry read", async () => {
+    emptyRegistry();
+    const { request, warn } = requestWith({});
+
+    await expect(resolveCallerSite(request)).resolves.toEqual({
+      kind: "anonymous",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("an unprogrammed read (undefined, the shared mock's default) is read as an empty registry", async () => {
+    db.spoke.findFirst.mockReset();
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "anonymous",
+    });
+  });
+});
+
+describe("resolveCallerSite — the switch and fail-closed reads (#7633 AC-5)", () => {
+  it("mode \"off\" with a non-empty registry is anonymous with zero registry calls", async () => {
+    setMode("off");
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "anonymous",
+    });
+    expect(db.spoke.findFirst).not.toHaveBeenCalled();
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("mode \"on\" with an empty registry is refused with zero registry calls", async () => {
+    setMode("on");
+    emptyRegistry();
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).not.toHaveBeenCalled();
+    expect(db.spoke.findUnique).not.toHaveBeenCalled();
+  });
+
+  it.each<[string, unknown]>([
+    ["a leftover boolean true", true],
+    ["an unknown string", "yes"],
+  ])("a mode outside the union (%s) refuses, with zero registry calls (NFR5)", async (_label, value) => {
+    emptyRegistry();
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      AILK_HUB_REQUIRE_SPOKE_KEY: value as HubSpokeKeyMode,
+    });
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("a failed registry read rejects — never anonymous — and is not held: the next call reads again (NFR3)", async () => {
+    db.spoke.findFirst.mockRejectedValueOnce(new Error("connection reset"));
+
+    await expect(resolveCallerSite(requestWith({}).request)).rejects.toThrow(
+      "connection reset",
+    );
+
+    emptyRegistry();
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "anonymous",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe("resolveCallerSite — the held hub answer (#7633 D3, AC-5)", () => {
+  const T0 = 1_800_000_000_000;
+  let now: number;
+
+  beforeEach(() => {
+    now = T0;
+    jest.spyOn(Date, "now").mockImplementation(() => now);
+  });
+
+  async function keyless() {
+    return resolveCallerSite(requestWith({}).request);
+  }
+
+  it("a \"yes\" is held: two keyless calls on a hub make one read, and both are refused", async () => {
+    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
+    now = T0 + 5_000;
+    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+  });
+
+  it("a \"no\" is held for 30 s, then read again; a later \"yes\" is held for good", async () => {
+    emptyRegistry();
+
+    await expect(keyless()).resolves.toEqual({ kind: "anonymous" });
+    now = T0 + 29_999;
+    await expect(keyless()).resolves.toEqual({ kind: "anonymous" });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+
+    // The first registration lands; the held "no" expires.
+    db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
+    now = T0 + 30_001;
+    await expect(keyless()).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
+
+    // Never reverts in-process, whatever the table later says.
+    emptyRegistry();
+    now = T0 + 10 * 60_000;
+    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe("resolveCallerSite — a failed hub-status read (#7633 conductor amendment to NFR3: lead capture is never lost)", () => {
+  const T0 = 1_800_000_000_000;
+  let now: number;
+
+  beforeEach(() => {
+    now = T0;
+    jest.spyOn(Date, "now").mockImplementation(() => now);
+  });
+
+  /** A request double whose `log.error` is observable. */
+  function keylessWithLog() {
+    const error = jest.fn();
+    // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the members the resolver reads (headers, log)
+    const request = {
+      headers: {},
+      log: { warn: jest.fn(), info: jest.fn(), error },
+    } as unknown as FastifyRequest;
+    return { request, error };
+  }
+
+  it("(a) with a previous successful \"not a hub\", the held answer is reused on every route, and the failure is logged at error", async () => {
+    emptyRegistry();
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({ kind: "anonymous" });
+
+    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
+    now = T0 + 30_001;
+    const { request, error } = keylessWithLog();
+    await expect(resolveCallerSite(request)).resolves.toEqual({ kind: "anonymous" });
+    expect(error).toHaveBeenCalledTimes(1);
+    expect(JSON.stringify(error.mock.calls)).not.toContain("connection reset");
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
+  });
+
+  it("(b) a cold start: a keyless lead write proceeds as on a non-hub, logged at error; every other caller still rejects", async () => {
+    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
+
+    const lead = keylessWithLog();
+    await expect(
+      resolveCallerSite(lead.request, { keylessOnRegistryFailure: "anonymous" }),
+    ).resolves.toEqual({ kind: "anonymous" });
+    expect(lead.error).toHaveBeenCalledTimes(1);
+
+    // Nothing is held: a content read or schedule call still rejects.
+    await expect(resolveCallerSite(requestWith({}).request)).rejects.toThrow("connection reset");
+    await expect(resolvePublicWorkspace(requestWith({}).request)).rejects.toThrow("connection reset");
+  });
+
+  it("(b) a call that carries a key is unchanged under the lead-write option — an unknown key is refused", async () => {
+    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
+    const { request } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
+    await expect(
+      resolveCallerSite(request, { keylessOnRegistryFailure: "anonymous" }),
+    ).resolves.toEqual({ kind: "refused", reason: "key-unknown" });
+    expect(db.spoke.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("(c) a process that has seen a hub keeps refusing keyless calls through an outage — on a lead write too", async () => {
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toMatchObject({ kind: "refused" });
+
+    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
+    now = T0 + 10 * 60_000;
+    await expect(
+      resolveCallerSite(requestWith({}).request, { keylessOnRegistryFailure: "anonymous" }),
+    ).resolves.toEqual({ kind: "refused", reason: "key-required" });
+    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
+      kind: "refused",
+      reason: "key-required",
+    });
+    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
+  });
+});