create-ailk 0.17.0 → 0.19.0

package/templates/apps/api/src/__tests__/server.test.ts

@@ -1,591 +0,0 @@
-/**
- * @file server.test.ts
- * @description Unit tests for server.ts - Server setup
- *
- * Uses the real build() function with real route plugins. All internal modules
- * run real; external boundaries (CORS, rate-limit) are mocked at the plugin
- * boundary since they would require live network/Redis in production.
- */
-
-import { build, requestLogSerializer } from "../server";
-
-// External service boundaries — mocked because they require live infrastructure
-// or have ESM-only transitive deps that Jest's CJS preset cannot resolve:
-//   @fastify/cors, @fastify/rate-limit — Fastify plugins that would require
-//     live network infrastructure (CORS policy sync, Redis store) in unit tests.
-//   @working-theory/email — transitive dep on @react-email/components which is ESM-only
-//     and cannot be resolved by jest-resolve in CommonJS mode.
-jest.mock("@fastify/cors", () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock("@fastify/rate-limit", () => {
-  return jest.fn().mockResolvedValue(undefined);
-});
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
-}));
-
-describe("Server", () => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
-  let app: any;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-    }
-  });
-
-  describe("build function", () => {
-    it("should build Fastify server instance", async () => {
-      // ACT
-      app = await build();
-
-      // ASSERT
-      expect(app).toBeDefined();
-      expect(typeof app.inject).toBe("function");
-    });
-
-    it("should register health check route returning static OK without external calls", async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: "GET",
-        url: "/health",
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.status).toBe("healthy");
-      expect(body.timestamp).toBeDefined();
-      // No external dependencies in the health check anymore
-      expect(body.platform).toBeUndefined();
-    });
-
-    it("should register root endpoint", async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: "GET",
-        url: "/",
-      });
-
-      // ASSERT
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      expect(body.name).toBe("AI Launch Kit API");
-      expect(body.endpoints).toBeDefined();
-    });
-
-    it("should register CORS", async () => {
-      // ACT
-      app = await build();
-
-      // ASSERT - CORS should be registered (no error thrown)
-      expect(app).toBeDefined();
-    });
-
-    it("should register all route plugins", async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT & ASSERT - Test that routes are registered by checking they don't 404
-      const healthResponse = await app.inject({
-        method: "GET",
-        url: "/health",
-      });
-      expect(healthResponse.statusCode).toBe(200);
-
-      const rootResponse = await app.inject({
-        method: "GET",
-        url: "/",
-      });
-      expect(rootResponse.statusCode).toBe(200);
-    });
-
-    it("should include all endpoints in root response", async () => {
-      // ARRANGE
-      app = await build();
-
-      // ACT
-      const response = await app.inject({
-        method: "GET",
-        url: "/",
-      });
-
-      // ASSERT
-      const body = JSON.parse(response.body);
-      expect(body.endpoints).toHaveProperty("health");
-      expect(body.endpoints).toHaveProperty("tokens");
-      expect(body.endpoints).toHaveProperty("profile");
-    });
-
-    it("startup throws when LEAD_CAPTURE_FILE points at a missing directory", async () => {
-      // ARRANGE — set LEAD_CAPTURE_FILE to a path whose parent dir doesn't exist
-      // so the real validateLeadCaptureDir() throws (AC8). Restore after test.
-      const prior = process.env.LEAD_CAPTURE_FILE;
-      process.env.LEAD_CAPTURE_FILE = "/nonexistent-ailk-test-dir/leads.jsonl";
-
-      try {
-        // ACT & ASSERT
-        await expect(build()).rejects.toThrow(/LEAD_CAPTURE_FILE/);
-      } finally {
-        if (prior === undefined) {
-          delete process.env.LEAD_CAPTURE_FILE;
-        } else {
-          process.env.LEAD_CAPTURE_FILE = prior;
-        }
-      }
-    });
-  });
-});
-
-// ── Bootstrap test: raw-body parser scope encapsulation (AC 13) ──────────────
-//
-// Proves that registering the webhooks plugin (with its raw-body parser scoped
-// to application/json) does NOT leak that parser to other routes. The global
-// Fastify JSON parser must remain active for all non-webhook routes.
-
-import Fastify from "fastify";
-import { webhooksRoutes } from "../routes/webhooks/index.js";
-
-describe("Parser scope — webhooks raw-body parser does not leak", () => {
-  it("other routes still receive parsed JSON objects after webhooks plugin registers", async () => {
-    // Build a minimal server that mirrors the encapsulation pattern in server.ts:
-    //   1. Register a JSON route that echoes the parsed body.
-    //   2. Register the webhooks plugin inside an encapsulated scope with a
-    //      raw-body (buffer) parser.
-    // If the raw-body parser leaks out of the webhooks scope, the echo route
-    // would receive a Buffer instead of a parsed object.
-
-    const server = Fastify({ logger: false });
-
-    // A simple JSON echo route — simulates any existing JSON-parsed route
-    server.post("/api/echo", async (req) => ({ received: req.body }));
-
-    // Mirror of server.ts registration pattern
-    await server.register(async (webhooksScope) => {
-      webhooksScope.addContentTypeParser(
-        "application/json",
-        { parseAs: "buffer" },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      await webhooksScope.register(webhooksRoutes);
-    });
-
-    await server.ready();
-
-    try {
-      const response = await server.inject({
-        method: "POST",
-        url: "/api/echo",
-        payload: { hello: "world" },
-        headers: { "content-type": "application/json" },
-      });
-
-      expect(response.statusCode).toBe(200);
-      const body = JSON.parse(response.body);
-      // Must be a plain object, not a stringified Buffer
-      expect(body.received).toEqual({ hello: "world" });
-      expect(Buffer.isBuffer(body.received)).toBe(false);
-    } finally {
-      await server.close();
-    }
-  });
-
-  describe("per-scope rate-limit defaults (#5111, DEF-004)", () => {
-    // Real end-to-end behavior against the real in-house rate-limit
-    // middleware (NOT mocked — this repo's convention is to mock only real
-    // external boundaries, never an internal module, see the file header).
-    // aeoScope's `/v1/aeo/score/example` needs no DB/network (a bundled
-    // example, `loadExampleScore()`); flowsScope's `/v1/flows/:slug` with a
-    // schema-invalid slug returns 400 before any DB access — both let the
-    // onRequest rate-limit hook be the only thing under test, regardless of
-    // the eventual handler status.
-    it("caps aeoScope at the strict pre-#4730 default (10/min) — the 11th request 429s", async () => {
-      app = await build();
-      const ip = "198.51.100.11";
-
-      for (let i = 0; i < 10; i++) {
-        const res = await app.inject({
-          method: "GET",
-          url: "/v1/aeo/score/example",
-          headers: { "x-forwarded-for": ip },
-        });
-        expect(res.statusCode).not.toBe(429);
-      }
-
-      const eleventh = await app.inject({
-        method: "GET",
-        url: "/v1/aeo/score/example",
-        headers: { "x-forwarded-for": ip },
-      });
-      expect(eleventh.statusCode).toBe(429);
-    });
-
-    it("leaves flowsScope above the strict default — 11 requests never 429", async () => {
-      // #5366 (D-48): /v1/flows/:slug only registers when signal-collectors
-      // is enabled.
-      const prior = process.env.AILK_ENABLED_MODULES;
-      process.env.AILK_ENABLED_MODULES = "signal-collectors";
-      try {
-        app = await build();
-        const ip = "198.51.100.12";
-
-        for (let i = 0; i < 11; i++) {
-          const res = await app.inject({
-            method: "GET",
-            url: "/v1/flows/not-a-real-slug!!!",
-            headers: { "x-forwarded-for": ip },
-          });
-          // Schema-invalid slug → 400, well before any rate limit or DB call.
-          expect(res.statusCode).toBe(400);
-        }
-      } finally {
-        if (prior === undefined) {
-          delete process.env.AILK_ENABLED_MODULES;
-        } else {
-          process.env.AILK_ENABLED_MODULES = prior;
-        }
-      }
-    });
-  });
-});
-
-// ── #5970 — the request log must never carry a query string ────────────────
-//
-// The security review's High finding: a bare `logger: true` gives pino's stock
-// `req` serializer, which logs `req.raw.url` VERBATIM — so every open of
-// `/v1/requests/:id/confirm?token=…` wrote a live seven-day credential into
-// the log drain, from a hook that fires before any route-level code can
-// intervene. The four fixes for that finding shipped with no assertion between
-// them, which is precisely how this class of bug comes back: a future refactor
-// restores `request.url` and nothing turns red.
-//
-// Asserted both ways — the serializer's own output, and a real captured line,
-// so neither the function nor its WIRING can regress unnoticed.
-describe("#5970 — the request log carries no query string", () => {
-  const asRequest = (url: string) =>
-    ({
-      url,
-      method: "GET",
-      hostname: "api.example.com",
-      ip: "203.0.113.1",
-    }) as never;
-
-  it("drops the query string but keeps the path and its route parameters", () => {
-    expect(
-      requestLogSerializer(
-        asRequest("/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN"),
-      ),
-    ).toEqual({
-      method: "GET",
-      url: "/v1/requests/callbk_1/confirm",
-      host: "api.example.com",
-      remoteAddress: "203.0.113.1",
-    });
-  });
-
-  it("leaves a URL with no query exactly as it is", () => {
-    expect(requestLogSerializer(asRequest("/health")).url).toBe("/health");
-  });
-
-  it("is actually wired into the instance — a captured line carries no token", async () => {
-    const lines: string[] = [];
-    const fastify = require("fastify")({
-      logger: {
-        level: "info",
-        serializers: { req: requestLogSerializer },
-        stream: { write: (msg: string) => lines.push(msg) },
-      },
-    });
-    fastify.get("/v1/requests/:id/confirm", async () => ({ ok: true }));
-    await fastify.ready();
-    try {
-      await fastify.inject({
-        method: "GET",
-        url: "/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN",
-      });
-      const captured = lines.join("\n");
-      expect(captured).toContain("/v1/requests/callbk_1/confirm");
-      expect(captured).not.toContain("SUPERSECRETTOKEN");
-      expect(captured).not.toContain("token=");
-    } finally {
-      await fastify.close();
-    }
-  });
-});
-
-// #6084 D14/AC-9 — `GET /v1/checkout/sessions/:id` puts its credential in
-// the PATH, which the #5970 query-string strip above does not cover. A
-// `cs_…`-shaped PATH SEGMENT is truncated to its first 8 characters plus
-// `…`; the rule is segment-scoped so it cannot corrupt an unrelated URL.
-describe("#6084 D14 — a cs_… path segment is truncated to 8 characters", () => {
-  const asRequest = (url: string) =>
-    ({
-      url,
-      method: "GET",
-      hostname: "api.example.com",
-      ip: "203.0.113.1",
-    }) as never;
-
-  it("truncates a cs_… session id segment to its first 8 characters plus an ellipsis", () => {
-    expect(
-      requestLogSerializer(
-        asRequest(
-          "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
-        ),
-      ),
-    ).toEqual({
-      method: "GET",
-      url: "/v1/checkout/sessions/cs_test_…",
-      host: "api.example.com",
-      remoteAddress: "203.0.113.1",
-    });
-  });
-
-  it("leaves an unrelated path byte-identical to today (no cs_ segment present)", () => {
-    expect(requestLogSerializer(asRequest("/v1/checkout/sessions")).url).toBe(
-      "/v1/checkout/sessions",
-    );
-  });
-
-  it("does not truncate a segment that merely CONTAINS cs_ mid-string, only one that IS cs_…-shaped", () => {
-    expect(
-      requestLogSerializer(asRequest("/v1/content/discs_catalog")).url,
-    ).toBe("/v1/content/discs_catalog");
-  });
-
-  it("is actually wired into the instance — a captured line carries no full session id", async () => {
-    const lines: string[] = [];
-    const fastify = require("fastify")({
-      logger: {
-        level: "info",
-        serializers: { req: requestLogSerializer },
-        stream: { write: (msg: string) => lines.push(msg) },
-      },
-    });
-    fastify.get("/v1/checkout/sessions/:id", async () => ({ ok: true }));
-    await fastify.ready();
-    try {
-      await fastify.inject({
-        method: "GET",
-        url: "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
-      });
-      const captured = lines.join("\n");
-      expect(captured).toContain("/v1/checkout/sessions/cs_test_…");
-      expect(captured).not.toContain(
-        "cs_test_a1B2c3D4e5F6g7H8i9J0",
-      );
-    } finally {
-      await fastify.close();
-    }
-  });
-});
-
-// #6216 D11/§ 9 A-3 — the SAME rule's second arm: a `lead_…`-shaped PATH
-// SEGMENT (every item read / PATCH under `/v1/workspaces/:id/messages/:leadId`)
-// is truncated to 8 characters plus `…`, exactly like the `cs_` case above.
-// The `cs_…` behaviour must stay byte-identical (asserted in the SAME test).
-describe("#6216 D11 — a lead_… path segment is truncated to 8 characters, cs_ unchanged", () => {
-  const LEAD_ID = "lead_01928374-65ba-7cde-89ab-0123456789ab";
-
-  const asRequest = (url: string) =>
-    ({
-      url,
-      method: "GET",
-      hostname: "api.example.com",
-      ip: "203.0.113.1",
-    }) as never;
-
-  it("truncates a lead_… id segment to its first 8 characters plus an ellipsis", () => {
-    expect(
-      requestLogSerializer(
-        asRequest(`/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`),
-      ),
-    ).toEqual({
-      method: "GET",
-      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/lead_019…",
-      host: "api.example.com",
-      remoteAddress: "203.0.113.1",
-    });
-  });
-
-  it("leaves the list path (no :leadId segment) byte-identical to today", () => {
-    expect(
-      requestLogSerializer(
-        asRequest(
-          "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
-        ),
-      ).url,
-    ).toBe(
-      "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
-    );
-  });
-
-  it("the cs_… behaviour is byte-identical after adding the lead_ arm", () => {
-    expect(
-      requestLogSerializer(
-        asRequest("/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0"),
-      ).url,
-    ).toBe("/v1/checkout/sessions/cs_test_…");
-  });
-
-  it("is actually wired into the instance — a captured line carries no full lead id", async () => {
-    const lines: string[] = [];
-    const fastify = require("fastify")({
-      logger: {
-        level: "info",
-        serializers: { req: requestLogSerializer },
-        stream: { write: (msg: string) => lines.push(msg) },
-      },
-    });
-    fastify.get("/v1/workspaces/:workspaceId/messages/:leadId", async () => ({
-      ok: true,
-    }));
-    await fastify.ready();
-    try {
-      await fastify.inject({
-        method: "GET",
-        url: `/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`,
-      });
-      const captured = lines.join("\n");
-      expect(captured).toContain("/messages/lead_019…");
-      expect(captured).not.toContain(LEAD_ID);
-    } finally {
-      await fastify.close();
-    }
-  });
-});
-
-// ── #6889 — production startup warns when a checkout protection is unset ─────
-//
-// POST /v1/checkout/sessions admits a caller without X-Internal-Auth when
-// OSS_API_INTERNAL_SECRET is unset, and with FRONTEND_URL unset its redirect
-// lock answers 500 while CORS and cookie writes trust only AILK_TRUSTED_ORIGINS
-// (#7395 D5; before #7395 they pinned to localhost). Both
-// are optional by design (OSS standalone compat), so startup must never fail
-// on them — but a production boot says so, once per variable. Each case rebuilds the module graph because `config/index.ts`
-// snapshots NODE_ENV at import time.
-
-describe("#6889 — production startup warns on an unset FRONTEND_URL or OSS_API_INTERNAL_SECRET", () => {
-  const ENV_KEYS = [
-    "NODE_ENV",
-    "FRONTEND_URL",
-    "OSS_API_INTERNAL_SECRET",
-    // Cleared so a production boot never trips config's database-module exit.
-    "AILK_ENABLED_MODULES",
-  ] as const;
-  type EnvKey = (typeof ENV_KEYS)[number];
-  const priorEnv = new Map<string, string | undefined>(
-    ENV_KEYS.map((key) => [key, process.env[key]]),
-  );
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
-  let app: any;
-
-  afterEach(async () => {
-    if (app) {
-      await app.close();
-      app = undefined;
-    }
-    for (const [key, value] of priorEnv) {
-      if (value === undefined) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-    jest.restoreAllMocks();
-  });
-
-  /** Boot a fresh module graph under `env` and return every warning message. */
-  async function bootWarnings(
-    env: Partial<Record<EnvKey, string>>,
-  ): Promise<string[]> {
-    for (const key of ENV_KEYS) {
-      const value = env[key];
-      if (value === undefined) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-    jest.resetModules();
-    const { logger } =
-      require("@working-theory/observability") as typeof import("@working-theory/observability");
-    const warn = jest.spyOn(logger, "warn");
-    const { build: freshBuild } =
-      require("../server") as typeof import("../server");
-    app = await freshBuild();
-    return warn.mock.calls.map((args) =>
-      args
-        .map((arg) => (typeof arg === "string" ? arg : JSON.stringify(arg)))
-        .join(" "),
-    );
-  }
-
-  const naming = (messages: string[], name: string) =>
-    messages.filter((message) => message.includes(name));
-
-  it("warns exactly once naming FRONTEND_URL when it is unset in production", async () => {
-    const messages = await bootWarnings({
-      NODE_ENV: "production",
-      OSS_API_INTERNAL_SECRET: "internal-secret",
-    });
-    expect(naming(messages, "FRONTEND_URL")).toHaveLength(1);
-    expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(0);
-    // #7395 D5 — nothing is pinned to localhost any more; an unset
-    // FRONTEND_URL in production trusts only AILK_TRUSTED_ORIGINS.
-    expect(naming(messages, "FRONTEND_URL")[0]).not.toContain("localhost:3000");
-  });
-
-  it("warns exactly once naming OSS_API_INTERNAL_SECRET when it is unset in production", async () => {
-    const messages = await bootWarnings({
-      NODE_ENV: "production",
-      FRONTEND_URL: "https://site.example.com",
-    });
-    expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(1);
-    expect(naming(messages, "FRONTEND_URL")).toHaveLength(0);
-  });
-
-  it("warns once for each when both are unset in production, and still starts", async () => {
-    const messages = await bootWarnings({ NODE_ENV: "production" });
-    expect(naming(messages, "FRONTEND_URL")).toHaveLength(1);
-    expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(1);
-    const health = await app.inject({ method: "GET", url: "/health" });
-    expect(health.statusCode).toBe(200);
-  });
-
-  it("logs no warning for either when both are set in production", async () => {
-    const messages = await bootWarnings({
-      NODE_ENV: "production",
-      FRONTEND_URL: "https://site.example.com",
-      OSS_API_INTERNAL_SECRET: "internal-secret",
-    });
-    expect(naming(messages, "FRONTEND_URL")).toHaveLength(0);
-    expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(0);
-  });
-
-  it.each(["development", "test"])(
-    "logs no warning for either outside production (NODE_ENV=%s), both unset",
-    async (nodeEnv) => {
-      const messages = await bootWarnings({ NODE_ENV: nodeEnv });
-      expect(naming(messages, "FRONTEND_URL")).toHaveLength(0);
-      expect(naming(messages, "OSS_API_INTERNAL_SECRET")).toHaveLength(0);
-      const health = await app.inject({ method: "GET", url: "/health" });
-      expect(health.statusCode).toBe(200);
-    },
-  );
-});