create-ailk 0.17.0 → 0.19.0

package/templates/apps/api/src/__tests__/cors.test.ts

@@ -1,276 +0,0 @@
-/**
- * @file cors.test.ts
- * @description CORS preflight contract (#5397).
- *
- * The one test file that does NOT mock `@fastify/cors`. Its siblings
- * (`server.test.ts`, `module-exclusion.test.ts`, `index.test.ts`) stub the
- * plugin at the module boundary, which is why the defect this file pins was
- * invisible to the whole suite: with the plugin mocked, the registration
- * options are never read and no preflight is ever answered. The plugin needs
- * no live infrastructure — it is a header writer — so the real one runs here.
- *
- * The defect: `@fastify/cors` defaults `methods` to `GET,HEAD,POST`
- * (node_modules/@fastify/cors/index.js `defaultOptions`), and `server.ts`
- * passed only `origin` + `credentials`. So the preflight for
- * `PATCH /v1/project-listings/drafts/:id` answered
- * `access-control-allow-methods: GET, HEAD, POST` and the browser refused the
- * request — a split-origin site could create a listing draft but never save
- * one. Observed against the salessmyth/samhenry deploy, 2026-09-13.
- *
- * Each case rebuilds the module graph (`jest.resetModules()`) because
- * `config/index.ts` snapshots `FRONTEND_URL` and `NODE_ENV` at import time.
- */
-
-// Mocked for the same reasons the sibling suites give: rate-limit wants a live
-// store, and @working-theory/email pulls an ESM-only transitive dep that
-// jest-resolve cannot load in CommonJS mode. `@fastify/cors` is deliberately
-// NOT mocked — it is the subject.
-jest.mock("@fastify/rate-limit", () => jest.fn().mockResolvedValue(undefined));
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-import { REGISTERED_ROUTES_DECORATOR } from "../openapi/spec";
-import type { RegisteredRoute } from "../openapi/surface-drift";
-
-const FRONTEND_URL = "https://site.example.com";
-const FOREIGN_ORIGIN = "https://attacker.example.net";
-
-// The route the defect was found on: ListingApplicationFlow's `patchDraft`
-// runs in the browser on every advance after step one.
-const DRAFT_PATCH_URL = "/v1/project-listings/drafts/listing_abc123";
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
-type App = any;
-
-const ENV_KEYS = ["FRONTEND_URL", "AILK_TRUSTED_ORIGINS", "NODE_ENV"] as const;
-
-/**
- * Build a server whose `config` was resolved from `env`. Restores the prior
- * environment through `restoreEnv()` in `afterEach`.
- */
-async function buildWith(env: {
-  FRONTEND_URL?: string;
-  AILK_TRUSTED_ORIGINS?: string;
-  NODE_ENV: string;
-}): Promise<App> {
-  for (const key of ENV_KEYS) {
-    const value = env[key];
-    if (value === undefined) {
-      delete process.env[key];
-    } else {
-      process.env[key] = value;
-    }
-  }
-  jest.resetModules();
-   
-  const { build } = require("../server") as typeof import("../server");
-  return build();
-}
-
-/** Issue a CORS preflight the way a browser would. */
-function preflight(
-  app: App,
-  origin: string,
-  method: string,
-  url = DRAFT_PATCH_URL,
-) {
-  return app.inject({
-    method: "OPTIONS",
-    url,
-    headers: {
-      origin,
-      "access-control-request-method": method,
-      "access-control-request-headers": "authorization,content-type",
-    },
-  });
-}
-
-/** `Access-Control-Allow-Methods` as an uppercased, trimmed set. */
-function allowedMethods(response: {
-  headers: Record<string, unknown>;
-}): string[] {
-  const header = response.headers["access-control-allow-methods"];
-  if (typeof header !== "string") return [];
-  return header.split(",").map((method) => method.trim().toUpperCase());
-}
-
-describe("CORS preflight (#5397)", () => {
-  const priorEnv = new Map<string, string | undefined>(
-    ENV_KEYS.map((key) => [key, process.env[key]]),
-  );
-  let app: App;
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-      app = undefined;
-    }
-    for (const [key, value] of priorEnv) {
-      if (value === undefined) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-    jest.resetModules();
-  });
-
-  it("allows PATCH and the authorization header for the configured FRONTEND_URL origin", async () => {
-    // ARRANGE
-    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
-
-    // ACT
-    const response = await preflight(app, FRONTEND_URL, "PATCH");
-
-    // ASSERT — the origin is allowed, with credentials, exactly as before.
-    expect(response.headers["access-control-allow-origin"]).toBe(FRONTEND_URL);
-    expect(response.headers["access-control-allow-credentials"]).toBe("true");
-    // ...and the method the browser asked about is in the answer. Without an
-    // explicit `methods` option this is `GET, HEAD, POST` and the browser
-    // refuses the PATCH.
-    expect(allowedMethods(response)).toEqual(
-      expect.arrayContaining(["GET", "HEAD", "POST", "PATCH"]),
-    );
-    // The bearer token ListingApplicationFlow sends must survive the preflight.
-    const allowHeaders = String(
-      response.headers["access-control-allow-headers"] ?? "",
-    ).toLowerCase();
-    expect(allowHeaders).toContain("authorization");
-    expect(allowHeaders).toContain("content-type");
-  });
-
-  it("refuses a preflight from an origin other than FRONTEND_URL in production", async () => {
-    // ARRANGE
-    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
-
-    // ACT
-    const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
-
-    // ASSERT — the refusal is the browser's: it blocks any response whose
-    // allow-origin is not its own origin. So the contract to pin is that the
-    // foreign origin is never named back, and the wildcard never appears —
-    // `credentials: true` with `*` would let any site read credentialed
-    // responses (the security-review M1 posture server.ts already documents).
-    // Widening `methods` must not widen WHO may use them. With the ARRAY
-    // `origin` option (#7395 D4), @fastify/cors writes no allow-origin header
-    // at all for an unlisted origin (D6.4); before #7395 it echoed the one
-    // configured string.
-    const allowOrigin = response.headers["access-control-allow-origin"];
-    expect(allowOrigin).not.toBe(FOREIGN_ORIGIN);
-    expect(allowOrigin).not.toBe("*");
-    expect(allowOrigin).toBeUndefined();
-  });
-
-  it("advertises every method the registered route table actually serves", async () => {
-    // ARRANGE — every paid module on, so the widest route surface is measured.
-    process.env.AILK_ENABLED_MODULES = "multi-tenant,scheduling,content-write";
-    try {
-      app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
-      await app.ready();
-
-      // ACT
-      const response = await preflight(app, FRONTEND_URL, "GET", "/health");
-      const advertised = allowedMethods(response);
-      const registered = new Set(
-        (app[REGISTERED_ROUTES_DECORATOR] as RegisteredRoute[]).map((route) =>
-          route.method.toUpperCase(),
-        ),
-      );
-
-      // ASSERT — a route added in a method nobody added to the CORS list is
-      // unreachable from a browser on a split-origin deploy. This is the drift
-      // guard: add a DELETE route, and this fails until `methods` says DELETE.
-      // Reported as a set so a drift names every missing method at once.
-      const missing = [...registered].filter(
-        (method) => !advertised.includes(method),
-      );
-      expect(missing).toEqual([]);
-      // HEAD is never in the route table (Fastify synthesises it from GET, and
-      // server.ts's onRoute hook drops it), so assert it separately.
-      expect(advertised).toContain("HEAD");
-    } finally {
-      delete process.env.AILK_ENABLED_MODULES;
-    }
-  });
-});
-
-// ── #7395 — the trusted-origin allowlist (AC-4) ──────────────────────────────
-//
-// One deployment serves the hub site, its Admin app and every spoke, so CORS
-// answers for each origin the operator listed in FRONTEND_URL or
-// AILK_TRUSTED_ORIGINS, and for no other — in development as in production,
-// since the reflect-any dev arm is gone (D4). A credentialed GET, not only a
-// preflight, carries the header, so a hand-written OPTIONS route cannot pass.
-
-describe("CORS trusted-origin allowlist (#7395)", () => {
-  const HUB = "https://hub.example";
-  const SPOKE_A = "https://spoke-a.example";
-  const priorEnv = new Map<string, string | undefined>(
-    ENV_KEYS.map((key) => [key, process.env[key]]),
-  );
-  let app: App;
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-      app = undefined;
-    }
-    for (const [key, value] of priorEnv) {
-      if (value === undefined) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-    jest.resetModules();
-  });
-
-  describe.each(["production", "development"])("NODE_ENV=%s", (nodeEnv) => {
-    beforeEach(async () => {
-      app = await buildWith({
-        FRONTEND_URL: HUB,
-        AILK_TRUSTED_ORIGINS: SPOKE_A,
-        NODE_ENV: nodeEnv,
-      });
-    });
-
-    it("allows a PATCH preflight from a listed spoke, with credentials and Vary: Origin", async () => {
-      const response = await preflight(app, SPOKE_A, "PATCH");
-
-      expect(response.headers["access-control-allow-origin"]).toBe(SPOKE_A);
-      expect(response.headers["access-control-allow-credentials"]).toBe(
-        "true",
-      );
-      expect(String(response.headers["vary"] ?? "")).toMatch(/\bOrigin\b/i);
-      expect(allowedMethods(response)).toContain("PATCH");
-    });
-
-    it("names a listed spoke on a credentialed GET, not only on a preflight", async () => {
-      const response = await app.inject({
-        method: "GET",
-        url: "/health",
-        headers: { origin: SPOKE_A, cookie: "better-auth.session_token=x" },
-      });
-
-      expect(response.statusCode).toBe(200);
-      expect(response.headers["access-control-allow-origin"]).toBe(SPOKE_A);
-      expect(response.headers["access-control-allow-credentials"]).toBe(
-        "true",
-      );
-    });
-
-    it("still allows the primary FRONTEND_URL origin", async () => {
-      const response = await preflight(app, HUB, "PATCH");
-
-      expect(response.headers["access-control-allow-origin"]).toBe(HUB);
-    });
-
-    it("writes no allow-origin header for an unlisted origin", async () => {
-      const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
-
-      expect(response.headers["access-control-allow-origin"]).toBeUndefined();
-    });
-  });
-});

package/templates/apps/api/src/__tests__/module-exclusion.test.ts

@@ -1,279 +0,0 @@
-/**
- * @file module-exclusion.test.ts
- * @description Module-exclusion regression test (S1, #5088).
- *
- * Proves the mechanical claim card S1 exists to make true: when a paid
- * module is excluded (`AILK_ENABLED_MODULES` omits it), none of the HTTP
- * routes that module contributes register — Fastify's default 404 is the
- * signal, since a request to an unregistered route always 404s regardless
- * of auth/validation state, while a registered-but-rejected request 4xxs
- * with a DIFFERENT code (401/403/400/...). This is the runtime half of "a
- * route and its MCP tool appear or vanish together" (API↔MCP parity) — see
- * the sibling `apps/mcp/__tests__/module-exclusion.test.ts`.
- *
- * Reverting one of `server.ts`'s `isModuleEnabled(...)` conditionals makes
- * the matching case below fail RED — see #5088 S1 verification notes.
- *
- * Mirrors `src/__tests__/server.test.ts`'s external-boundary mocks (CORS,
- * rate-limit, email) — see that file's header for why each is mocked.
- */
-
-jest.mock('@fastify/cors', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@fastify/rate-limit', () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock('@working-theory/email', () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-import { build } from '../server';
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
-type App = any;
-
-async function withEnabledModules<T>(
-  enabled: string,
-  fn: () => Promise<T>,
-): Promise<T> {
-  const prior = process.env.AILK_ENABLED_MODULES;
-  process.env.AILK_ENABLED_MODULES = enabled;
-  try {
-    return await fn();
-  } finally {
-    if (prior === undefined) {
-      delete process.env.AILK_ENABLED_MODULES;
-    } else {
-      process.env.AILK_ENABLED_MODULES = prior;
-    }
-  }
-}
-
-// One representative route per module-conditional registration block in
-// server.ts. `always404WhenExcluded` routes are expected to 404 ONLY when
-// their module is absent; every other module stays enabled for each case so
-// a bug that over-excludes (drops an unrelated module's route too) is also
-// caught by the "still registered" assertions below.
-const MODULE_ROUTES: Record<string, { method: 'GET' | 'POST'; url: string }[]> =
-  {
-    // /v1/waitlist-experiments and /v1/project-listings are deliberately NOT
-    // listed here since #5677: the review surface registers under EITHER
-    // multi-tenant OR signal-collectors, so excluding multi-tenant alone
-    // leaves them registered by design — the same shape the workspace-settings
-    // routes have. Their matrix is `review-surface-registration.test.ts`,
-    // beside `workspace-module-registration.test.ts`.
-    'multi-tenant': [
-      { method: 'GET', url: '/v1/workspaces' },
-      { method: 'GET', url: '/v1/billing' },
-    ],
-    // #6085 (brief H7) adds two more representative routes for this SAME
-    // module key: the webhook receiver (unsigned → 400 if registered, never
-    // 404 without seed data) and the tenant-guarded appointments read
-    // (unauthenticated → 401 if registered, the same shape /v1/billing
-    // takes in the multi-tenant row above).
-    scheduling: [
-      { method: 'GET', url: '/v1/schedule/availability' },
-      { method: 'POST', url: '/v1/webhooks/calcom' },
-      { method: 'GET', url: '/v1/schedule/appointments' },
-    ],
-    // #5853 retired the untenanted /v1/content writes; content-write's
-    // representative route is now the tenant-guarded editor surface. A
-    // REGISTERED route answers 401 here (no session on the inject), an
-    // unregistered one answers Fastify's own 404 — so the "still registered
-    // => not 404" assertion below stays unambiguous, which this matrix's
-    // header requires. The retired URLs are asserted separately, and
-    // module-independently, by RETIRED_ROUTES below.
-    'content-write': [
-      {
-        method: 'POST',
-        url: '/v1/workspaces/wksp_00000000-0000-7000-8000-0000000000aa/content',
-      },
-    ],
-    // D-48 signal-collectors (#5366). Each route is chosen so a REGISTERED
-    // handler never itself answers 404 without seed data (an unregistered
-    // route is Fastify's own 404, so a route whose "not found" business
-    // outcome is also 404 — /v1/flows/:slug with a real slug,
-    // /v1/deliverables/:grantId, which is a deliberately uniform 404 by
-    // design — would be ambiguous evidence either way):
-    //   - /v1/flows/INVALID_SLUG fails flowSlugSchema's kebab-case regex ->
-    //     400, before any flow lookup (flowsScope gate)
-    //   - /v1/waitlist-signups/me is authScope-only (no tenant guard) -> 401
-    //     with no session (one of two authScope gates, D2)
-    //   - /v1/slack/actions with no signature -> 401/503, never 404
-    //     (webhooksScope gate)
-    // NOT any /v1/project-listings/* static path (D4's authScope gate, or
-    // the leadsScope gate's four anonymous routes): whenever this static
-    // route is unregistered, multi-tenant's tenant-scoped parametric
-    // /v1/project-listings/:id (registered whenever multi-tenant is enabled,
-    // which every case below does) matches the last path segment as an :id
-    // value and answers 401 (auth required) instead of Fastify's own 404 —
-    // a real routing precedence effect (server.ts's own comment on
-    // projectListingMeRoute), confirmed for both /me and /public, not a
-    // gating defect but ambiguous evidence for this test's shape.
-    'signal-collectors': [
-      { method: 'GET', url: '/v1/flows/INVALID_SLUG' },
-      { method: 'GET', url: '/v1/waitlist-signups/me' },
-      { method: 'POST', url: '/v1/slack/actions' },
-    ],
-    // D-47 commerce (#5364), narrowed by D-64 (#5796): the flow-checkouts
-    // read and the recommender's two email-moment routes — commerce OVERLAY,
-    // still one representative route per registration site server.ts gates on
-    // isModuleEnabled("commerce").
-    //
-    // /v1/checkout/sessions and /v1/webhooks/stripe are deliberately NOT
-    // listed here any more: they are the base-tree PRIMITIVES, registered
-    // unconditionally and gated on the `commerce` LICENCE CLAIM instead. They
-    // still 404 on every case in this file (no licence is configured in the
-    // test env, so the claim is absent), but they would 404 under the
-    // "every module enabled" case too, which is the opposite of what this
-    // matrix asserts. Their matrix is `commerce-claim-registration.test.ts`.
-    commerce: [
-      { method: 'GET', url: '/v1/flow-checkouts/me' },
-      { method: 'POST', url: '/v1/flows/x/checkout' },
-      { method: 'POST', url: '/v1/flows/x/save' },
-    ],
-  };
-
-/**
- * The untenanted content-write routes #5853 RETIRED by deletion.
- *
- * Unlike every row in MODULE_ROUTES these belong to no module: they must
- * answer Fastify's own 404 on EVERY build, whatever AILK_ENABLED_MODULES
- * says, which is AC-1's retirement half. They are asserted inside each case
- * below rather than in one case of their own, because "on every build" is
- * precisely the claim.
- *
- * MODULE_ROUTES' method union is 'GET' | 'POST', so this carries its own.
- */
-const RETIRED_ROUTES: {
-  method: 'POST' | 'PATCH' | 'DELETE';
-  url: string;
-}[] = [
-  { method: 'POST', url: '/v1/content/BlogPosting' },
-  { method: 'PATCH', url: '/v1/content/BlogPosting/x' },
-  { method: 'DELETE', url: '/v1/content/BlogPosting/x' },
-];
-
-async function expectRetiredRoutesGone(app: App): Promise<void> {
-  for (const { method, url } of RETIRED_ROUTES) {
-    const res = await app.inject({ method, url });
-    expect(res.statusCode).toBe(404);
-  }
-}
-
-const ALL_MODULES = Object.keys(MODULE_ROUTES);
-
-// A module whose registration is ALSO gated on another module in this matrix.
-// content-write's scope is gated `content-write && (workspace || multi-tenant)`
-// (#5853): its route file imports lib/tenant-db.ts, which only the tenancy
-// slices deliver, so a build without a tenancy module must not register it.
-// `workspace` is not a row of this matrix, so within it the dependency is on
-// multi-tenant alone: excluding multi-tenant legitimately 404s content-write's
-// route too, and the "every OTHER module stays registered" sweep skips that
-// one pair. Every other pair is asserted as before.
-const MODULE_DEPENDENCIES: Record<string, readonly string[]> = {
-  'content-write': ['multi-tenant'],
-};
-
-describe('Module exclusion — registration vanishes with the module (S1, #5088)', () => {
-  let app: App;
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-      app = undefined;
-    }
-    delete process.env.AILK_ENABLED_MODULES;
-  });
-
-  it.each(ALL_MODULES)(
-    "excluding '%s' 404s every route it owns, while every OTHER module's routes stay registered",
-    async (excluded) => {
-      const enabled = ALL_MODULES.filter((m) => m !== excluded).join(',');
-      app = await withEnabledModules(enabled, () => build());
-
-      for (const { method, url } of MODULE_ROUTES[excluded]!) {
-        const res = await app.inject({ method, url });
-        expect(res.statusCode).toBe(404);
-      }
-
-      for (const other of ALL_MODULES) {
-        if (other === excluded) continue;
-        if ((MODULE_DEPENDENCIES[other] ?? []).includes(excluded)) continue;
-        for (const { method, url } of MODULE_ROUTES[other]!) {
-          const res = await app.inject({ method, url });
-          expect(res.statusCode).not.toBe(404);
-        }
-      }
-
-      await expectRetiredRoutesGone(app);
-    },
-  );
-
-  it('with every module explicitly enabled, every module route registers — no over-exclusion', async () => {
-    app = await withEnabledModules(ALL_MODULES.join(','), () => build());
-    for (const routes of Object.values(MODULE_ROUTES)) {
-      for (const { method, url } of routes) {
-        const res = await app.inject({ method, url });
-        expect(res.statusCode).not.toBe(404);
-      }
-    }
-    // Free/never-gate surfaces are unaffected by any module exclusion.
-    const health = await app.inject({ method: 'GET', url: '/health' });
-    expect(health.statusCode).toBe(200);
-    const contentTypes = await app.inject({
-      method: 'GET',
-      url: '/v1/content/types',
-    });
-    expect(contentTypes.statusCode).not.toBe(404);
-
-    // AC-1's retirement half: gone even with EVERY module enabled.
-    await expectRetiredRoutesGone(app);
-  });
-
-  it('excluding every paid module at once still serves the free surface', async () => {
-    app = await withEnabledModules('', () => build());
-    const health = await app.inject({ method: 'GET', url: '/health' });
-    expect(health.statusCode).toBe(200);
-    const contentTypes = await app.inject({
-      method: 'GET',
-      url: '/v1/content/types',
-    });
-    expect(contentTypes.statusCode).not.toBe(404);
-
-    for (const routes of Object.values(MODULE_ROUTES)) {
-      for (const { method, url } of routes) {
-        const res = await app.inject({ method, url });
-        expect(res.statusCode).toBe(404);
-      }
-    }
-
-    await expectRetiredRoutesGone(app);
-  });
-
-  // D-44 / #5368: an unset AILK_ENABLED_MODULES is now the same as an
-  // explicit empty string — no paid module registers by default.
-  it('with AILK_ENABLED_MODULES unset (the new default), every module route 404s', async () => {
-    delete process.env.AILK_ENABLED_MODULES;
-    app = await build();
-    const health = await app.inject({ method: 'GET', url: '/health' });
-    expect(health.statusCode).toBe(200);
-    const contentTypes = await app.inject({
-      method: 'GET',
-      url: '/v1/content/types',
-    });
-    expect(contentTypes.statusCode).not.toBe(404);
-
-    for (const routes of Object.values(MODULE_ROUTES)) {
-      for (const { method, url } of routes) {
-        const res = await app.inject({ method, url });
-        expect(res.statusCode).toBe(404);
-      }
-    }
-
-    await expectRetiredRoutesGone(app);
-  });
-});

package/templates/apps/api/src/__tests__/openapi-keyless-hub.test.ts

@@ -1,122 +0,0 @@
-/**
- * @file openapi-keyless-hub.test.ts
- * @description #7947 — a hub that refuses keyless public reads (#7633) still
- * serves `GET /v1/openapi.json` to a caller with no spoke key, through the
- * real `build()`. A spoke's `/openapi.json` proxies that document with a plain
- * fetch (no `x-ailk-spoke-key`), so the exemption is what keeps a spoke's
- * discovery surface from answering 502.
- *
- * The risk pinned here is the route moving into a keyed scope, which only a
- * `build()`-level test can see (spec
- * docs/specs/7947-spoke-openapi-keyless-discovery-spec.md D2). Each case also
- * reads `GET /v1/schedule/meeting-types` keyless in the same app and expects
- * the refusal answer, so a 200 on the document cannot pass on a hub that
- * refuses nothing (D3). Two refusing modes (D4): strict `on`, and the default
- * `auto` with a registered spoke.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../lib/prisma.js");
-
-jest.mock("@fastify/cors", () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-import * as configModule from "../config/index.js";
-import type { HubSpokeKeyMode } from "../config/index.js";
-import { prisma } from "../lib/prisma.js";
-import { __resetBuckets } from "../middleware/rate-limit";
-import { build } from "../server";
-import { __resetHubStatusForTests } from "../services/public-site-resolver.js";
-
-const db = jest.mocked(prisma);
-
-function setMode(mode: HubSpokeKeyMode): void {
-  jest.replaceProperty(configModule, "config", {
-    ...configModule.config,
-    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
-  });
-}
-
-/** What a hub that refuses the caller answers on the public meeting-types read. */
-const REFUSAL = { ok: true, data: { slugs: [] } };
-
-describe("GET /v1/openapi.json against a hub that refuses keyless callers (#7947)", () => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any matches server.test.ts
-  let app: any;
-  const prior = {
-    modules: process.env.AILK_ENABLED_MODULES,
-    databaseUrl: process.env.DATABASE_URL,
-  };
-
-  async function startApp(): Promise<void> {
-    app = await build();
-    await app.ready();
-  }
-
-  beforeEach(() => {
-    __resetBuckets();
-    __resetHubStatusForTests();
-    process.env.AILK_ENABLED_MODULES = "scheduling";
-  });
-
-  afterEach(async () => {
-    if (app) await app.close();
-    app = undefined;
-    jest.restoreAllMocks();
-    db.spoke.findFirst.mockReset();
-  });
-
-  afterAll(() => {
-    for (const [name, value] of [
-      ["AILK_ENABLED_MODULES", prior.modules],
-      ["DATABASE_URL", prior.databaseUrl],
-    ] as const) {
-      if (value === undefined) delete process.env[name];
-      else process.env[name] = value;
-    }
-  });
-
-  it("mode `on`: a keyless caller gets the document and the same app refuses its keyless workspace read (AC-1)", async () => {
-    setMode("on");
-    await startApp();
-
-    const doc = await app.inject({ method: "GET", url: "/v1/openapi.json" });
-    expect(doc.statusCode).toBe(200);
-    expect(doc.json().openapi).toBe("3.1.0");
-
-    const refused = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/meeting-types",
-    });
-    expect(refused.statusCode).toBe(200);
-    expect(refused.json()).toEqual(REFUSAL);
-  });
-
-  it("mode `auto` with a registered spoke: the same two answers (AC-2)", async () => {
-    process.env.DATABASE_URL ??=
-      "postgresql://placeholder:placeholder@localhost:5432/placeholder";
-    setMode("auto");
-    // A non-empty registry makes this deployment a hub (#7633 D1).
-    db.spoke.findFirst.mockResolvedValue({
-      id: "spoke_01920000-0000-7000-8000-0000000000c1",
-    } as never);
-    await startApp();
-
-    const doc = await app.inject({ method: "GET", url: "/v1/openapi.json" });
-    expect(doc.statusCode).toBe(200);
-    expect(doc.json().openapi).toBe("3.1.0");
-
-    const refused = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/meeting-types",
-    });
-    expect(refused.statusCode).toBe(200);
-    expect(refused.json()).toEqual(REFUSAL);
-    expect(db.spoke.findFirst).toHaveBeenCalled();
-  });
-});