create-ailk 0.14.0 → 0.16.0

package/templates/apps/api/src/server.ts

@@ -48,6 +48,10 @@ import {
 } from "./openapi/spec.js";
 import type { RegisteredRoute } from "./openapi/surface-drift.js";
 import { exampleAeoRoute, scoreAeoRoute } from "./routes/aeo/index.js";
+import {
+  hubSignInClientRoutes,
+  hubSignInSessionRoutes,
+} from "./routes/auth/hub-sign-in.js";
 import { tokenRoutes } from "./routes/auth/tokens.js";
 import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
 import { userRoutes } from "./routes/auth/user.js";
@@ -217,6 +221,16 @@ const WORKSPACES_MESSAGES = "./routes/workspaces/messages.js";
 // WORKSPACES_MESSAGES in the same workspace/multi-tenant scope.
 const WORKSPACES_SUBMISSIONS = "./routes/workspaces/submissions.js";
 const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
+// #852 D8 — the People reads (the workspace's clients), the SAME scope.
+const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
+// #7877 D9 — a client's pieces, plan and outbound messages, and the
+// workspace's piece stages: the operator's writes, the SAME scope.
+const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
+const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
+const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
+// #7877 D11 — the member reads: auth only, under the SAME module predicate.
+const MEMBER_PIECES = "./routes/member/pieces.js";
+const MEMBER_MESSAGES = "./routes/member/messages.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
 // scope.
@@ -292,6 +306,33 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_SUBSCRIBERS,
     load: () => import(WORKSPACES_SUBSCRIBERS),
   },
+  // #852 D8 — the People list and Person record, the SAME scope.
+  workspacePeopleRoutes: {
+    specifier: WORKSPACES_PEOPLE,
+    load: () => import(WORKSPACES_PEOPLE),
+  },
+  // #7877 D9 — the member area's operator routes, the SAME scope.
+  workspacePieceRoutes: {
+    specifier: WORKSPACES_PIECES,
+    load: () => import(WORKSPACES_PIECES),
+  },
+  workspacePlanRoutes: {
+    specifier: WORKSPACES_PLAN,
+    load: () => import(WORKSPACES_PLAN),
+  },
+  workspaceOutboundMessageRoutes: {
+    specifier: WORKSPACES_MESSAGES_OUT,
+    load: () => import(WORKSPACES_MESSAGES_OUT),
+  },
+  // #7877 D11 — the member reads, in authScope under the same predicate.
+  memberPieceRoutes: {
+    specifier: MEMBER_PIECES,
+    load: () => import(MEMBER_PIECES),
+  },
+  memberMessageRoutes: {
+    specifier: MEMBER_MESSAGES,
+    load: () => import(MEMBER_MESSAGES),
+  },
   // #3591 PR-B — the agent seat, the SAME scope.
   workspaceAgentRoutes: {
     specifier: WORKSPACES_AGENTS,
@@ -365,6 +406,12 @@ const SLICE_PLUGINS = {
     specifier: FLOWS_INDEX,
     load: () => import(FLOWS_INDEX),
   },
+  // #7876 D1 — a spoke seeds its declared flows; off until
+  // AILK_SPOKE_FLOW_SEED (the route answers 403 flow_seed_disabled).
+  putFlowDefinitionRoute: {
+    specifier: FLOWS_INDEX,
+    load: () => import(FLOWS_INDEX),
+  },
   // #6157 — the tenant-scoped magnet Admin authoring surface. ONE plugin,
   // ONE specifier (D2): all four routes register through this one entry.
   magnetRoutes: {
@@ -791,6 +838,14 @@ export async function build() {
     await authScope.register(tokenRoutes);
     await authScope.register(userRoutes);
 
+    // The hub signs in its spokes (#7894 D5) — `codes` and `me`. Auth only,
+    // NOT tenant-guarded: a person signing in to a spoke has no tenant here.
+    // Unconditional, like the leads inbox read below: a spoke's sign-in is not
+    // a module. `codes` answers a cookie session only; `me` the hub credential
+    // only (both enforced in the route). The credential's own admission is the
+    // preHandler's hub-credential branch (D6).
+    await authScope.register(hubSignInSessionRoutes);
+
     // Tenant-context routes (multi-tenant module) — auth only. They
     // establish/inspect the active workspace, so the tenant guard does not
     // apply to them; each enforces membership in the service layer.
@@ -862,6 +917,18 @@ export async function build() {
       await authScope.register(await sliceRoutePlugin("projectListingMeRoute"));
     }
 
+    // The member reads (#7877 D11) — auth only, NOT tenant-guarded: a client
+    // holds no membership (and an agent, which reaches only tenant-guarded
+    // routes, is refused 403 by the preHandler). Each handler resolves the
+    // caller through `memberCaller` and the workspace from the calling
+    // spoke's key, never a request value. Registered under the SAME module
+    // predicate as every routes/workspaces/* route, at the exact URLs the
+    // preHandler's `HUB_SESSION_ROUTES` admits a hub credential on.
+    if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
+      await authScope.register(await sliceRoutePlugin("memberPieceRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberMessageRoutes"));
+    }
+
     // Tenant-guarded domain routes (multi-tenant module) — the tenant
     // preHandler (default-deny guard, see middleware/tenant.ts) runs after
     // auth for every route in this inner scope. No domain handler executes
@@ -1024,6 +1091,25 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspaceSubscriberRoutes"),
         );
+        // The People reads (#852 D8) — the SAME scope and guard: the
+        // workspace's clients and one Person with its derived timeline,
+        // behind `people-read` (owner, admin, a granted agent).
+        await tenantScope.register(
+          await sliceRoutePlugin("workspacePeopleRoutes"),
+        );
+        // The member area's operator routes (#7877 D9) — the SAME scope and
+        // guard: a client's pieces, plan and outbound messages, and the
+        // workspace's declared piece stages. Writes need `people-write`
+        // (owner, admin; never an agent).
+        await tenantScope.register(
+          await sliceRoutePlugin("workspacePieceRoutes"),
+        );
+        await tenantScope.register(
+          await sliceRoutePlugin("workspacePlanRoutes"),
+        );
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceOutboundMessageRoutes"),
+        );
         // The agent seat (#3591 PR-B) — the SAME scope and guard: owners and
         // admins list, add, re-key and switch off agents (`agents-manage`),
         // and an agent reads its own context at GET /v1/agent/context.
@@ -1249,6 +1335,22 @@ export async function build() {
     await authEmailScope.register(transactionalEmailRoute);
   });
 
+  // The hub signs in its spokes (#7894 D5) — `token` and `revoke`. Their OWN
+  // scope, deliberately OUTSIDE `authScope`: the caller is a spoke's server,
+  // authenticated by its client secret AND its spoke key inside the service,
+  // not by a person's session — an auth preHandler in front would reject every
+  // legitimate call. `scope: "hubsignin"` namespaces the buckets (the scope
+  // name admits no hyphen). The per-IP limit keys on `req.ip` under
+  // `trustProxy`, so it is a backstop only; the control is the per-client
+  // bucket the service keys on the VERIFIED client (SEC-7894-8).
+  await server.register(async (hubSignInScope) => {
+    hubSignInScope.register(rateLimitMiddleware, {
+      perIpPerMinute: 60,
+      scope: "hubsignin",
+    });
+    await hubSignInScope.register(hubSignInClientRoutes);
+  });
+
   // Lead-capture status (#6730 D4) — a cheap read the web page makes before
   // choosing the form or the contact email. Top level, NOT in `leadsScope`:
   // the web server's single egress IP already spends that scope's strict
@@ -1360,6 +1462,9 @@ export async function build() {
       await flowsScope.register(
         await sliceRoutePlugin("getFlowAggregateRoute"),
       );
+      await flowsScope.register(
+        await sliceRoutePlugin("putFlowDefinitionRoute"),
+      );
     }
     // The recommender's email-moment routes (#4841) — same anonymous,
     // rate-limited posture as the three above. Module-conditional (commerce,

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -354,7 +354,7 @@ describe("fulfillDeliverable", () => {
     (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
       workspaceId: WORKSPACE_ID,
     });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID, tags: [] });
 
     await fulfillDeliverable(baseInput());
 
@@ -366,7 +366,7 @@ describe("fulfillDeliverable", () => {
     );
     expect(prisma.asset.findFirst).toHaveBeenCalledWith({
       where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
-      select: { id: true },
+      select: { id: true, tags: true },
     });
     expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
     expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
@@ -421,7 +421,7 @@ describe("fulfillDeliverable", () => {
     (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
       workspaceId: WORKSPACE_ID,
     });
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID, tags: [] });
     // beforeEach's default deliverableAsset.findUnique mock already resolves
     // a row at this key — it must never even be consulted.
 
@@ -482,7 +482,7 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.asset.findFirst).toHaveBeenCalledWith({
       where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
-      select: { id: true },
+      select: { id: true, tags: true },
     });
     expect(prisma.asset.findFirst).not.toHaveBeenCalledWith(
       expect.objectContaining({