create-ailk 0.12.1 → 0.14.0

package/templates/apps/api/src/__tests__/factories/agent-caller.ts

@@ -0,0 +1,98 @@
+/**
+ * @file agent-caller.ts
+ *
+ * An agent caller for route suites that mock `lib/prisma.js` inline (#3591
+ * D8): a key minted at run time — never a key-shaped literal in a fixture —
+ * plus the two reads the auth preHandler and the multi-tenant guard make for
+ * it, so the suite's existing `agent` and `membership` `findUnique` mocks can
+ * answer an agent without changing what they answer anyone else.
+ *
+ * Usage, inside a suite whose inline prisma mock declares
+ * `agent: { findUnique: jest.fn(), update: jest.fn() }`: build a caller with
+ * `buildAgentCaller({ organizationId, workspaceId })`, give the `agent`
+ * delegate's `findUnique` the `agentKeyLookup(caller)` implementation and the
+ * `membership` delegate's `findUnique` the `agentMembershipLookup(caller,
+ * existingImplementation)` one, then send the request with `caller.headers`.
+ * (This docblock names the delegates in prose: the tenant-scope lint in
+ * `architecture.yaml` scans comments too.)
+ */
+import { hashAgentKey, mintAgentKey } from "../../lib/agent-store.js";
+
+export interface AgentCaller {
+  agentId: string;
+  /** The responsible person's user id — the agent acts on their behalf. */
+  userId: string;
+  membershipId: string;
+  organizationId: string;
+  workspaceId: string;
+  /** The person's own role; the guard clamps the agent to `member`. */
+  role: "owner" | "admin" | "member";
+  headers: { authorization: string };
+}
+
+export function buildAgentCaller(
+  scope: { organizationId: string; workspaceId: string },
+  overrides: Partial<
+    Pick<AgentCaller, "agentId" | "userId" | "membershipId" | "role">
+  > = {},
+): AgentCaller & { key: string } {
+  const key = mintAgentKey();
+  return {
+    agentId: "agent_00000000-0000-7000-8000-00000000a9e1",
+    userId: "user_00000000-0000-7000-8000-00000000a9e2",
+    membershipId: "member_00000000-0000-7000-8000-00000000a9e3",
+    role: "member",
+    ...scope,
+    ...overrides,
+    key,
+    headers: { authorization: `Bearer ${key}` },
+  };
+}
+
+/** The `agent` delegate's `findUnique` for the auth preHandler: the caller's row by its key's digest. */
+export function agentKeyLookup(
+  caller: AgentCaller & { key: string },
+): (args: {
+  where: { credentialHash?: string };
+}) => Promise<Record<string, unknown> | null> {
+  const credentialHash = hashAgentKey(caller.key);
+  return ({ where }) =>
+    Promise.resolve(
+      where.credentialHash === credentialHash
+        ? {
+            id: caller.agentId,
+            workspaceId: caller.workspaceId,
+            organizationId: caller.organizationId,
+            permissionLevel: "member",
+            enabled: true,
+            keyIssuedToMembershipId: caller.membershipId,
+            lastActiveAt: null,
+            responsible: { id: caller.membershipId, userId: caller.userId },
+          }
+        : null,
+    );
+}
+
+type MembershipArgs = {
+  where: { organizationId_userId?: { organizationId: string; userId: string } };
+};
+
+/**
+ * The `membership` delegate's `findUnique`, answering the agent's person's membership
+ * and deferring every other read to `fallback` (the suite's own mock).
+ */
+export function agentMembershipLookup(
+  caller: AgentCaller,
+  fallback: (args: MembershipArgs) => unknown,
+): (args: MembershipArgs) => unknown {
+  return (args) => {
+    const key = args.where.organizationId_userId;
+    if (
+      key?.organizationId === caller.organizationId &&
+      key.userId === caller.userId
+    ) {
+      return Promise.resolve({ id: caller.membershipId, role: caller.role });
+    }
+    return fallback(args);
+  };
+}

package/templates/apps/api/src/__tests__/factories/in-memory-prisma.ts

@@ -0,0 +1,321 @@
+/**
+ * @file in-memory-prisma.ts
+ *
+ * An in-memory, where-clause-honouring Prisma double, shared by the route
+ * suites that register every tenant-guarded route plugin behind the real auth
+ * and tenant preHandlers (`routes/workspaces/__tests__/member-operates.test.ts`,
+ * #7636, and `agent-guard-parity.test.ts`, #3591).
+ *
+ * Every delegate call is recorded on `__calls` and the store is exposed on
+ * `__db`, so a refusal can be shown to read nothing. A relation filter the
+ * double does not model throws, so scoping that rides on one can never pass
+ * for the wrong reason.
+ *
+ * Usage — the factory must run inside the hoisted `jest.mock` callback:
+ *
+ *   jest.mock("../../../lib/prisma.js", () =>
+ *     jest
+ *       .requireActual<typeof import("../../../__tests__/factories/in-memory-prisma")>(
+ *         "../../../__tests__/factories/in-memory-prisma",
+ *       )
+ *       .createInMemoryPrisma(),
+ *   );
+ */
+export function createInMemoryPrisma(): { prisma: Record<string, unknown> } {
+  type Row = Record<string, unknown>;
+  type Where = Record<string, unknown>;
+  const db: Record<string, Row[]> = {};
+  const calls: Array<{ model: string; op: string }> = [];
+  const OPS = new Set([
+    "in",
+    "notIn",
+    "lt",
+    "lte",
+    "gt",
+    "gte",
+    "not",
+    "equals",
+    "startsWith",
+    "endsWith",
+    "contains",
+    "has",
+    "hasSome",
+    "mode",
+    "path",
+  ]);
+  const isPlain = (v: unknown): v is Record<string, unknown> =>
+    v !== null &&
+    typeof v === "object" &&
+    !Array.isArray(v) &&
+    !(v instanceof Date);
+  const norm = (v: unknown) => (v instanceof Date ? v.getTime() : (v ?? null));
+  const eq = (a: unknown, b: unknown) => norm(a) === norm(b);
+  const cmp = (a: unknown, b: unknown) => {
+    const x = norm(a) as number;
+    const y = norm(b) as number;
+    return x < y ? -1 : x > y ? 1 : 0;
+  };
+  const table = (model: string) => (db[model] ??= []);
+
+  function matchCond(value: unknown, cond: unknown): boolean {
+    if (cond === undefined) return true;
+    if (!isPlain(cond)) return eq(value, cond);
+    const keys = Object.keys(cond);
+    if (!keys.every((k) => OPS.has(k))) {
+      // A nested filter is matched against a nested value. A relation filter
+      // this double does not model fails loudly, so scoping that rides on
+      // one can never pass for the wrong reason.
+      if (
+        keys.some((k) =>
+          ["some", "none", "every", "is", "isNot"].includes(k),
+        ) ||
+        !isPlain(value)
+      ) {
+        throw new Error(
+          `in-memory prisma: unmodelled filter ${JSON.stringify(keys)}`,
+        );
+      }
+      return matches(value, cond);
+    }
+    if ("path" in cond) {
+      const path = cond.path as string[];
+      let nested: unknown = value;
+      for (const p of path) nested = isPlain(nested) ? nested[p] : undefined;
+      const { path: _p, ...rest } = cond;
+      return matchCond(nested, rest);
+    }
+    for (const [op, arg] of Object.entries(cond)) {
+      switch (op) {
+        case "in":
+          if (!(arg as unknown[]).some((v) => eq(value, v))) return false;
+          break;
+        case "notIn":
+          if ((arg as unknown[]).some((v) => eq(value, v))) return false;
+          break;
+        case "lt":
+          if (value == null || cmp(value, arg) >= 0) return false;
+          break;
+        case "lte":
+          if (value == null || cmp(value, arg) > 0) return false;
+          break;
+        case "gt":
+          if (value == null || cmp(value, arg) <= 0) return false;
+          break;
+        case "gte":
+          if (value == null || cmp(value, arg) < 0) return false;
+          break;
+        case "not":
+          if (matchCond(value, arg)) return false;
+          break;
+        case "equals":
+          if (!eq(value, arg)) return false;
+          break;
+        case "startsWith":
+          if (typeof value !== "string" || !value.startsWith(arg as string))
+            return false;
+          break;
+        case "endsWith":
+          if (typeof value !== "string" || !value.endsWith(arg as string))
+            return false;
+          break;
+        case "contains":
+          if (typeof value !== "string" || !value.includes(arg as string))
+            return false;
+          break;
+        case "has":
+          if (!Array.isArray(value) || !value.includes(arg)) return false;
+          break;
+        case "hasSome":
+          if (
+            !Array.isArray(value) ||
+            !(arg as unknown[]).some((v) => value.includes(v))
+          ) {
+            return false;
+          }
+          break;
+        default:
+          break;
+      }
+    }
+    return true;
+  }
+
+  function matches(row: Row, where: Where | undefined): boolean {
+    for (const [key, cond] of Object.entries(where ?? {})) {
+      if (key === "AND") {
+        const all = Array.isArray(cond) ? cond : [cond];
+        if (!all.every((w) => matches(row, w as Where))) return false;
+      } else if (key === "OR") {
+        if (!(cond as Where[]).some((w) => matches(row, w))) return false;
+      } else if (key === "NOT") {
+        const all = Array.isArray(cond) ? cond : [cond];
+        if (all.some((w) => matches(row, w as Where))) return false;
+      } else if (
+        !(key in row) &&
+        isPlain(cond) &&
+        !Object.keys(cond).every((k) => OPS.has(k))
+      ) {
+        if (!matches(row, cond)) return false;
+      } else if (!matchCond(row[key], cond)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  function pick(value: unknown, select: unknown): unknown {
+    if (!isPlain(select) || value == null) return value;
+    if (Array.isArray(value)) return value.map((v) => pick(v, select));
+    if (!isPlain(value)) return value;
+    const out: Row = {};
+    for (const [key, spec] of Object.entries(select)) {
+      if (spec === true) out[key] = value[key];
+      else if (isPlain(spec) && key in value) {
+        out[key] = pick(value[key], (spec as Row).select ?? spec);
+      }
+    }
+    return out;
+  }
+
+  function sorted(rows: Row[], orderBy: unknown): Row[] {
+    if (!orderBy) return rows;
+    const orders = (Array.isArray(orderBy) ? orderBy : [orderBy]) as Array<
+      Record<string, string>
+    >;
+    return [...rows].sort((a, b) => {
+      for (const ord of orders) {
+        const [field, dir] = Object.entries(ord)[0] as [string, string];
+        const c = cmp(a[field], b[field]);
+        if (c !== 0) return dir === "desc" ? -c : c;
+      }
+      return 0;
+    });
+  }
+
+  let seq = 0;
+  function apply(row: Row, data: Row): Row {
+    for (const [key, value] of Object.entries(data)) {
+      if (isPlain(value) && "increment" in value) {
+        row[key] = ((row[key] as number) ?? 0) + (value.increment as number);
+      } else if (isPlain(value) && "set" in value) {
+        row[key] = value.set;
+      } else {
+        row[key] = value;
+      }
+    }
+    row["updatedAt"] = new Date();
+    return row;
+  }
+
+  function delegate(model: string) {
+    const log = (op: string) => calls.push({ model, op });
+    const findMany = (args: Row = {}) => {
+      let rows = sorted(
+        table(model).filter((r) => matches(r, args.where as Where)),
+        args.orderBy,
+      );
+      if (typeof args.skip === "number") rows = rows.slice(args.skip);
+      if (typeof args.take === "number") rows = rows.slice(0, args.take);
+      return rows.map(
+        (r) => pick({ ...r }, args.select ?? args.include) as Row,
+      );
+    };
+    const create = (args: Row) => {
+      const data = args.data as Row;
+      const row: Row = {
+        // A registry-shaped id, so an `isId` boundary check accepts it.
+        id: `${model === "user" ? "user" : model}_00000000-0000-7000-8000-${String(++seq).padStart(12, "0")}`,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        ...data,
+      };
+      table(model).push(row);
+      return pick({ ...row }, args.select);
+    };
+    return {
+      findMany: jest.fn(
+        async (args: Row = {}) => (log("findMany"), findMany(args)),
+      ),
+      findFirst: jest.fn(
+        async (args: Row = {}) => (log("findFirst"), findMany(args)[0] ?? null),
+      ),
+      findUnique: jest.fn(
+        async (args: Row = {}) => (
+          log("findUnique"),
+          findMany(args)[0] ?? null
+        ),
+      ),
+      findUniqueOrThrow: jest.fn(async (args: Row = {}) => {
+        log("findUniqueOrThrow");
+        const row = findMany(args)[0];
+        if (!row) throw new Error(`${model} not found`);
+        return row;
+      }),
+      count: jest.fn(
+        async (args: Row = {}) => (
+          log("count"),
+          findMany({ where: args.where }).length
+        ),
+      ),
+      create: jest.fn(async (args: Row) => (log("create"), create(args))),
+      update: jest.fn(async (args: Row) => {
+        log("update");
+        const row = table(model).find((r) => matches(r, args.where as Where));
+        if (!row) throw new Error(`${model} not found`);
+        return pick({ ...apply(row, args.data as Row) }, args.select);
+      }),
+      updateMany: jest.fn(async (args: Row) => {
+        log("updateMany");
+        const rows = table(model).filter((r) =>
+          matches(r, args.where as Where),
+        );
+        for (const row of rows) apply(row, args.data as Row);
+        return { count: rows.length };
+      }),
+      upsert: jest.fn(async (args: Row) => {
+        log("upsert");
+        const row = table(model).find((r) => matches(r, args.where as Where));
+        if (row)
+          return pick({ ...apply(row, args.update as Row) }, args.select);
+        return create({ data: args.create, select: args.select });
+      }),
+      deleteMany: jest.fn(async (args: Row = {}) => {
+        log("deleteMany");
+        const before = table(model).length;
+        db[model] = table(model).filter(
+          (r) => !matches(r, args.where as Where),
+        );
+        return { count: before - table(model).length };
+      }),
+      groupBy: jest.fn(async () => (log("groupBy"), [])),
+      aggregate: jest.fn(
+        async () => (
+          log("aggregate"),
+          { _count: {}, _sum: {}, _max: {}, _min: {} }
+        ),
+      ),
+    };
+  }
+
+  const delegates: Record<string, ReturnType<typeof delegate>> = {};
+  const prisma: Record<string, unknown> = new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        if (prop === "__db") return db;
+        if (prop === "__calls") return calls;
+        if (prop === "$transaction") {
+          return async (arg: unknown) =>
+            typeof arg === "function"
+              ? (arg as (tx: unknown) => unknown)(prisma)
+              : Promise.all(arg as Promise<unknown>[]);
+        }
+        if (prop === "$queryRaw" || prop === "$executeRaw")
+          return async () => [];
+        if (typeof prop !== "string" || prop === "then") return undefined;
+        return (delegates[prop] ??= delegate(prop));
+      },
+    },
+  );
+  return { prisma };
+}

package/templates/apps/api/src/__tests__/schedule-forwarded-rate-limit.test.ts

@@ -0,0 +1,117 @@
+/**
+ * @file schedule-forwarded-rate-limit.test.ts
+ * @description #7633 (conductor amendment, the relay's security review) — a
+ * site's relayed schedule calls are limited per visitor end to end, through
+ * the real `build()`, the schedule scope's own limiter and the REAL
+ * `@fastify/rate-limit` global ceiling: the schedule scope's twin of
+ * `leads-forwarded-rate-limit.test.ts` (#7394 AC-7).
+ *
+ * Once browsers post through a site's same-origin relay (#7644), every
+ * visitor's `GET /v1/schedule/availability` and `POST /v1/schedule/book`
+ * reaches the hub from the site's server. With the hub-issued forwarding key,
+ * each visitor gets the scope's own per-visitor budget, and the key as a
+ * whole a ceiling of 60 a minute — well below the lead routes' 300, because a
+ * booking is a real booking.
+ *
+ * `DATABASE_URL` is unset and the `scheduling` module is enabled for the
+ * file's duration. Whatever each route answers past the limiter (a 400 or a
+ * 503) is not this file's subject: the limiter runs on `onRequest`, before
+ * any handler.
+ */
+
+import { __resetBuckets } from "../middleware/rate-limit";
+import { build } from "../server";
+
+jest.mock("@fastify/cors", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+const KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
+const SPOKE_HOST = "198.51.100.7";
+
+/** A distinct, valid visitor IP per index. */
+function visitor(i: number): string {
+  return `203.0.${Math.floor(i / 250)}.${(i % 250) + 1}`;
+}
+
+function headersFor(visitorIp: string, withKey: boolean): Record<string, string> {
+  return {
+    "x-forwarded-for": SPOKE_HOST,
+    "x-ailk-visitor-ip": visitorIp,
+    ...(withKey && { "x-ailk-visitor-forward-key": KEY }),
+  };
+}
+
+const ROUTES = [
+  { method: "GET", url: "/v1/schedule/availability?calLink=acme%2Fintro" },
+  { method: "POST", url: "/v1/schedule/book", payload: {} },
+] as const;
+
+describe.each(ROUTES)("$method $url for a keyed site, against the real limiters (#7633)", (route) => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any matches server.test.ts
+  let app: any;
+  const prior = {
+    keys: process.env.AILK_VISITOR_FORWARD_KEYS,
+    modules: process.env.AILK_ENABLED_MODULES,
+    databaseUrl: process.env.DATABASE_URL,
+  };
+
+  async function statuses(count: number, visitorFor: (i: number) => string, withKey: boolean): Promise<number[]> {
+    const codes: number[] = [];
+    for (let i = 0; i < count; i++) {
+      const res = await app.inject({ ...route, headers: headersFor(visitorFor(i), withKey) });
+      codes.push(res.statusCode);
+    }
+    return codes;
+  }
+
+  beforeEach(async () => {
+    __resetBuckets();
+    process.env.AILK_VISITOR_FORWARD_KEYS = KEY;
+    process.env.AILK_ENABLED_MODULES = "scheduling";
+    delete process.env.DATABASE_URL;
+    app = await build();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    if (app) await app.close();
+    app = undefined;
+  });
+
+  afterAll(() => {
+    for (const [name, value] of [
+      ["AILK_VISITOR_FORWARD_KEYS", prior.keys],
+      ["AILK_ENABLED_MODULES", prior.modules],
+      ["DATABASE_URL", prior.databaseUrl],
+    ] as const) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("two visitors behind one forwarding key are counted separately: the first's eleventh call is 429, the second's first is not", async () => {
+    const first = await statuses(11, () => "203.0.113.1", true);
+    expect(first.slice(0, 10).every((code) => code !== 429)).toBe(true);
+    expect(first[10]).toBe(429);
+
+    const second = await statuses(1, () => "203.0.113.2", true);
+    expect(second[0]).not.toBe(429);
+  });
+
+  it("without the key, distinct visitors behind one host share the host's budget: the eleventh call is 429", async () => {
+    const codes = await statuses(11, visitor, false);
+    expect(codes.slice(0, 10).every((code) => code !== 429)).toBe(true);
+    expect(codes[10]).toBe(429);
+  });
+
+  it("the key's own ceiling is 60 a minute across all of its visitors: the sixty-first is 429", async () => {
+    const codes = await statuses(61, visitor, true);
+    expect(codes.slice(0, 60).every((code) => code !== 429)).toBe(true);
+    expect(codes[60]).toBe(429);
+  });
+});

package/templates/apps/api/src/config/__tests__/hub-require-spoke-key.test.ts

@@ -1,12 +1,15 @@
 /**
  * @file hub-require-spoke-key.test.ts
- * @description `AILK_HUB_REQUIRE_SPOKE_KEY` — the hub's strict-mode flag
- * (#7532, spec docs/specs/7532-a-spoke-s-public-reads-spec.md D7, AC-5).
+ * @description `AILK_HUB_REQUIRE_SPOKE_KEY` — the hub's spoke-key mode
+ * (#7532 D7; three-state since #7633, spec
+ * docs/specs/7633-expected-a-keyless-public-read-spec.md D2, AC-5).
  *
- * `true`/`1` turn it on; unset, empty, `false` and `0` leave it off —
- * case-insensitively, after trimming. Any other value refuses the boot with a
- * message naming the variable, never the value. On with no `DATABASE_URL`
- * refuses the boot too: strict mode with no registry would refuse every call.
+ * Unset, empty or blank is `"auto"` (refuse a keyless call once the registry
+ * holds a row); `true`/`1` is `"on"`; `false`/`0` is `"off"`, the emergency
+ * opt-out, which warns at boot — case-insensitively, after trimming. Any other
+ * value refuses the boot with a message naming the variable, never the value.
+ * `"on"` with no `DATABASE_URL` refuses the boot too: it would refuse every
+ * call. `"auto"` and `"off"` boot without a database.
  */
 
 // Mock dotenv so a developer's local .env never leaks into the config module.
@@ -25,7 +28,7 @@ jest.mock('@working-theory/observability', () => ({
   },
 }));
 
-describe('AILK_HUB_REQUIRE_SPOKE_KEY (#7532 D7)', () => {
+describe('AILK_HUB_REQUIRE_SPOKE_KEY (#7532 D7, #7633 D2)', () => {
   const originalEnv = process.env;
 
   beforeEach(() => {
@@ -41,16 +44,34 @@ describe('AILK_HUB_REQUIRE_SPOKE_KEY (#7532 D7)', () => {
     jest.restoreAllMocks();
   });
 
-  it.each(['true', 'TRUE', '1', ' True '])('%j parses on', (raw) => {
+  /** The boot warnings that name this variable. */
+  function hubWarnings(): unknown[][] {
+    return mockLoggerWarn.mock.calls.filter((call) =>
+      JSON.stringify(call).includes('AILK_HUB_REQUIRE_SPOKE_KEY'),
+    );
+  }
+
+  it.each([undefined, '', '  '])('%j parses "auto" — the default — and warns nothing', (raw) => {
+    if (raw !== undefined) process.env.AILK_HUB_REQUIRE_SPOKE_KEY = raw;
+    const { config } = require('../index');
+    expect(config).toMatchObject({ AILK_HUB_REQUIRE_SPOKE_KEY: 'auto' });
+    expect(hubWarnings()).toHaveLength(0);
+  });
+
+  it.each(['true', 'TRUE', '1', ' True '])('%j parses "on" and warns nothing', (raw) => {
     process.env.AILK_HUB_REQUIRE_SPOKE_KEY = raw;
     const { config } = require('../index');
-    expect(config.AILK_HUB_REQUIRE_SPOKE_KEY).toBe(true);
+    expect(config).toMatchObject({ AILK_HUB_REQUIRE_SPOKE_KEY: 'on' });
+    expect(hubWarnings()).toHaveLength(0);
   });
 
-  it.each([undefined, '', '  ', 'false', 'FALSE', '0'])('%j parses off', (raw) => {
-    if (raw !== undefined) process.env.AILK_HUB_REQUIRE_SPOKE_KEY = raw;
+  it.each(['false', 'FALSE', '0'])('%j parses "off" — the emergency opt-out — and warns once at boot', (raw) => {
+    process.env.AILK_HUB_REQUIRE_SPOKE_KEY = raw;
     const { config } = require('../index');
-    expect(config.AILK_HUB_REQUIRE_SPOKE_KEY).toBe(false);
+    expect(config).toMatchObject({ AILK_HUB_REQUIRE_SPOKE_KEY: 'off' });
+    const warnings = hubWarnings();
+    expect(warnings).toHaveLength(1);
+    expect(JSON.stringify(warnings)).toContain('AILK_HUB_REQUIRE_SPOKE_KEY=false');
   });
 
   it('any other value refuses the boot, naming the variable and never the value', () => {
@@ -83,7 +104,11 @@ describe('AILK_HUB_REQUIRE_SPOKE_KEY (#7532 D7)', () => {
     );
   });
 
-  it('off with DATABASE_URL unset still boots database-less, as today', () => {
+  it.each([
+    ['auto', undefined],
+    ['off', 'false'],
+  ])('"%s" with DATABASE_URL unset still boots database-less', (mode, raw) => {
+    if (raw !== undefined) process.env.AILK_HUB_REQUIRE_SPOKE_KEY = raw;
     delete process.env.DATABASE_URL;
     const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
       throw new Error('Process exit called');
@@ -91,6 +116,6 @@ describe('AILK_HUB_REQUIRE_SPOKE_KEY (#7532 D7)', () => {
 
     const { config } = require('../index');
     expect(exitSpy).not.toHaveBeenCalled();
-    expect(config.AILK_HUB_REQUIRE_SPOKE_KEY).toBe(false);
+    expect(config).toMatchObject({ AILK_HUB_REQUIRE_SPOKE_KEY: mode });
   });
 });