create-ailk 0.18.0 → 0.19.0

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -1,476 +0,0 @@
-/**
- * @file leads-inbox.test.ts
- * @description Unit tests for the leads-inbox read service (#5678).
- *
- * The load-bearing case is ISOLATION: this endpoint returns contact PII, so
- * the claim "a caller cannot read another site's leads" is tested, not argued.
- *
- * External dependency boundary mocked:
- *   - apps/api/src/lib/prisma — the repo-standard `__mocks__/prisma.ts` manual
- *     mock (`jest.mock("../../lib/prisma.js")`).
- *
- * `prisma.lead.findMany` / `findFirst` are given a REALISTIC filtering
- * implementation over an in-memory fixture "table" rather than a static
- * `mockResolvedValue`, mirroring `lead-promotion.test.ts`. That is what makes
- * the isolation test real: a bug that widened the `siteId` match set would
- * surface the other site's lead in the returned page, not merely in an
- * argument-shape assertion.
- *
- * `tenant-context.ts`'s `listTenancy` runs REAL — a pure read over the mocked
- * `prisma.membership.findMany` — so these tests also exercise the
- * "resolve through `lead-promotion.ts`'s `resolveOwnerWorkspaces`" contract
- * rather than re-stubbing it.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import type { Id } from "@working-theory/ids";
-
-import { prisma } from "../../lib/prisma.js";
-import { listOwnedLeads } from "../leads-inbox";
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-const USER_ID = "user_00000000-0000-7000-8000-0000000000a1" as Id<"user">;
-const OWN_ORG_ID = "org_00000000-0000-7000-8000-0000000000b1";
-/** The caller's own workspace — and therefore the `siteId` of their own leads. */
-const OWN_SITE_ID = "wksp_00000000-0000-7000-8000-0000000000c1";
-/** A DIFFERENT organization's workspace. The caller holds no membership in it. */
-const OTHER_SITE_ID = "wksp_00000000-0000-7000-8000-0000000000c2";
-
-type FakeLeadRow = {
-  id: string;
-  siteId: string;
-  email: string;
-  source: string;
-  payload: unknown;
-  createdAt: Date;
-};
-
-/** Shapes `prisma.membership.findMany`'s return — what `listTenancy` reads. */
-function membershipsWithRole(role: string) {
-  return [
-    {
-      role,
-      organization: {
-        id: OWN_ORG_ID,
-        name: "Acme",
-        slug: "acme",
-        workspaces: [{ id: OWN_SITE_ID, name: "Acme HQ", slug: "acme-hq" }],
-      },
-    },
-  ];
-}
-
-function lead(overrides: Partial<FakeLeadRow> & { id: string }): FakeLeadRow {
-  return {
-    siteId: OWN_SITE_ID,
-    email: "contact@example.com",
-    source: "web",
-    payload: { name: "Ada Lovelace", message: "please call me", phone: "555" },
-    createdAt: new Date("2026-09-15T12:00:00.000Z"),
-    ...overrides,
-  };
-}
-
-/**
- * Wires `prisma.lead.findFirst` / `findMany` to a realistic in-memory "table"
- * filtered by the `where` the service passes — so a row outside `siteId.in` is
- * genuinely never returned, exactly as a real WHERE clause would exclude it.
- */
-function seedLeadTable(rows: FakeLeadRow[]) {
-  const table = rows.map((r) => ({ ...r }));
-
-  type Where = {
-    siteId: { in: string[] };
-    id?: string;
-    OR?: Array<{
-      createdAt?: Date | { lt: Date };
-      id?: { lt: string };
-    }>;
-  };
-
-  const inScope = (row: FakeLeadRow, where: Where) =>
-    where.siteId.in.includes(row.siteId) &&
-    (where.id === undefined || row.id === where.id);
-
-  const afterCursor = (row: FakeLeadRow, where: Where) => {
-    if (!where.OR) return true;
-    return where.OR.some((clause) => {
-      if (clause.createdAt instanceof Date) {
-        return (
-          row.createdAt.getTime() === clause.createdAt.getTime() &&
-          clause.id !== undefined &&
-          row.id < clause.id.lt
-        );
-      }
-      const lt = (clause.createdAt as { lt: Date }).lt;
-      return row.createdAt.getTime() < lt.getTime();
-    });
-  };
-
-  (prisma.lead.findFirst as jest.Mock).mockImplementation(
-    async (args: { where: Where }) =>
-      table.find((row) => inScope(row, args.where)) ?? null,
-  );
-
-  (prisma.lead.findMany as jest.Mock).mockImplementation(
-    async (args: { where: Where; take: number }) =>
-      table
-        .filter((row) => inScope(row, args.where) && afterCursor(row, args.where))
-        .sort((a, b) =>
-          b.createdAt.getTime() - a.createdAt.getTime() || (a.id < b.id ? 1 : -1),
-        )
-        .slice(0, args.take),
-  );
-
-  return table;
-}
-
-describe("listOwnedLeads", () => {
-  // The workspace resolution is module-conditional (isModuleEnabled
-  // 'multi-tenant' — see lead-promotion.ts), so every test that expects rows
-  // needs the module explicitly enabled: AILK_ENABLED_MODULES unset means no
-  // paid modules (D-44, #5368).
-  const priorEnabledModules = process.env.AILK_ENABLED_MODULES;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env.AILK_ENABLED_MODULES = "multi-tenant";
-  });
-
-  afterAll(() => {
-    if (priorEnabledModules === undefined) {
-      delete process.env.AILK_ENABLED_MODULES;
-    } else {
-      process.env.AILK_ENABLED_MODULES = priorEnabledModules;
-    }
-  });
-
-  // ── ISOLATION (load-bearing) ───────────────────────────────────────────────
-  it("never returns a lead whose siteId belongs to another site", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("owner"), // the caller belongs ONLY to OWN_ORG_ID
-    );
-    seedLeadTable([
-      lead({
-        id: "lead_own_1",
-        siteId: OWN_SITE_ID,
-        email: "mine@example.com",
-        createdAt: new Date("2026-09-15T12:00:00.000Z"),
-      }),
-      lead({
-        id: "lead_other_1",
-        siteId: OTHER_SITE_ID,
-        email: "theirs@example.com",
-        createdAt: new Date("2026-09-15T13:00:00.000Z"), // NEWER — would sort first
-      }),
-    ]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items.map((row) => row.id)).toEqual(["lead_own_1"]);
-    expect(JSON.stringify(result.value)).not.toContain("theirs@example.com");
-    expect(JSON.stringify(result.value)).not.toContain(OTHER_SITE_ID);
-    // The scope reaches the DB as a filter, not a post-filter in JS.
-    expect(prisma.lead.findMany).toHaveBeenCalledWith(
-      expect.objectContaining({ where: expect.objectContaining({ siteId: { in: [OWN_SITE_ID] } }) }),
-    );
-  });
-
-  it("returns an empty page when the caller belongs to no workspace at all", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
-    seedLeadTable([lead({ id: "lead_other_1", siteId: OTHER_SITE_ID })]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-    // No workspace means no query at all — not a query with an empty `in`.
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  it("returns the rows to a `member` — `inbox-read` holds every role (#7636 D2)", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("member"),
-    );
-    seedLeadTable([lead({ id: "lead_own_1", siteId: OWN_SITE_ID })]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items.map((row) => row.id)).toEqual(["lead_own_1"]);
-  });
-
-  it("returns an empty page for a role outside the permission table — default deny", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("writer"),
-    );
-    seedLeadTable([lead({ id: "lead_own_1", siteId: OWN_SITE_ID })]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  it("rejects a cursor that resolves outside the caller's scope", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("admin"),
-    );
-    seedLeadTable([
-      lead({ id: "lead_own_1", siteId: OWN_SITE_ID }),
-      lead({ id: "lead_other_1", siteId: OTHER_SITE_ID }),
-    ]);
-
-    const result = await listOwnedLeads({
-      userId: USER_ID,
-      cursor: "lead_other_1",
-      limit: 50,
-    });
-
-    expect(result).toEqual({
-      ok: false,
-      error: {
-        kind: "invalid_cursor",
-        message: "cursor does not resolve within this scope",
-      },
-    });
-    // The rejection is indistinguishable from "no such lead" — a foreign
-    // cursor is never a probe that confirms another site's row exists.
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  // ── Row shape (the PII floor) ──────────────────────────────────────────────
-  it("returns exactly the five rendered fields — never the rest of the record", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("owner"),
-    );
-    seedLeadTable([
-      lead({
-        id: "lead_own_1",
-        email: "ada@example.com",
-        source: "conversational-intake",
-        payload: { name: "Ada Lovelace", message: "please call me", phone: "555-0100" },
-      }),
-    ]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items).toEqual([
-      {
-        id: "lead_own_1",
-        name: "Ada Lovelace",
-        email: "ada@example.com",
-        source: "conversational-intake",
-        createdAt: "2026-09-15T12:00:00.000Z",
-      },
-    ]);
-    // The rest of `payload` is never on the wire.
-    const serialized = JSON.stringify(result.value);
-    expect(serialized).not.toContain("please call me");
-    expect(serialized).not.toContain("555-0100");
-    expect(serialized).not.toContain("siteId");
-  });
-
-  it("truncates an unbounded name — one anonymous write cannot size the page", async () => {
-    // PR #5705 security review, finding 1: `boundedLeadPayload` bounds the
-    // payload at 64 KEYS and nothing else, and `POST /v1/leads/submit` is
-    // anonymous with no ownership check on `siteId`, so a stranger can plant a
-    // ~1 MB `name` in the owner's inbox. Ordering is `createdAt desc` and this
-    // unit ships no delete surface, so it would sit on page one for good.
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("owner"),
-    );
-    seedLeadTable([
-      lead({ id: "lead_own_1", payload: { name: "A".repeat(900_000) } }),
-    ]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items[0]?.name).toBe("A".repeat(200));
-    expect(JSON.stringify(result.value).length).toBeLessThan(1000);
-  });
-
-  it("reads `name` as null when the site's form captured none", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("owner"),
-    );
-    seedLeadTable([lead({ id: "lead_own_1", payload: { company: "Acme" } })]);
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items[0]?.name).toBeNull();
-  });
-
-  // ── Pagination ─────────────────────────────────────────────────────────────
-  it("pages newest first and hands back the last row's id as nextCursor", async () => {
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      membershipsWithRole("owner"),
-    );
-    seedLeadTable([
-      lead({ id: "lead_a", createdAt: new Date("2026-09-15T10:00:00.000Z") }),
-      lead({ id: "lead_b", createdAt: new Date("2026-09-15T11:00:00.000Z") }),
-      lead({ id: "lead_c", createdAt: new Date("2026-09-15T12:00:00.000Z") }),
-    ]);
-
-    const first = await listOwnedLeads({ userId: USER_ID, limit: 2 });
-    expect(first.ok).toBe(true);
-    if (!first.ok) return;
-    expect(first.value.items.map((row) => row.id)).toEqual(["lead_c", "lead_b"]);
-    expect(first.value.nextCursor).toBe("lead_b");
-
-    const second = await listOwnedLeads({
-      userId: USER_ID,
-      cursor: first.value.nextCursor ?? undefined,
-      limit: 2,
-    });
-    expect(second.ok).toBe(true);
-    if (!second.ok) return;
-    expect(second.value.items.map((row) => row.id)).toEqual(["lead_a"]);
-    expect(second.value.nextCursor).toBeNull();
-  });
-});
-
-// ─── #6730 D7 — the single-tenant inbox, pinned to the operator ──────────────
-
-describe("listOwnedLeads — single-tenant build (#6730 D7)", () => {
-  const { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } = jest.requireActual(
-    "@working-theory/database/tenancy",
-  ) as { DEFAULT_ORG_ID: string; DEFAULT_WORKSPACE_ID: string };
-  const OPERATOR_EMAIL = "owner@example.com";
-  const prior = {
-    modules: process.env.AILK_ENABLED_MODULES,
-    pin: process.env.AILK_OPERATOR_EMAIL,
-  };
-
-  /** One workspace — the seeded default — and a caller whose verified email is `email`. */
-  function oneWorkspaceDeployment(opts: {
-    email: string;
-    verified?: boolean;
-    workspaceCount?: number;
-    role?: string;
-  }) {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(opts.workspaceCount ?? 1);
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: DEFAULT_ORG_ID,
-    });
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      id: USER_ID,
-      email: opts.email,
-      emailVerified: opts.verified ?? true,
-    });
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: opts.role ?? "owner",
-    });
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    delete process.env.AILK_ENABLED_MODULES;
-    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
-    seedLeadTable([
-      lead({ id: "lead_own", siteId: DEFAULT_WORKSPACE_ID }),
-      lead({ id: "lead_elsewhere", siteId: OTHER_SITE_ID }),
-    ]);
-  });
-
-  afterAll(() => {
-    for (const [key, value] of [
-      ["AILK_ENABLED_MODULES", prior.modules],
-      ["AILK_OPERATOR_EMAIL", prior.pin],
-    ] as const) {
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-  });
-
-  it("the pinned, verified owner sees the default workspace's leads — and only those", async () => {
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
-  });
-
-  it("the pin unset → empty", async () => {
-    delete process.env.AILK_OPERATOR_EMAIL;
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  it("a different verified email → empty", async () => {
-    oneWorkspaceDeployment({ email: "stranger@example.com" });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  it("the pinned email, unverified → empty", async () => {
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, verified: false });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-  });
-
-  it("a second workspace → empty (not unambiguously one-workspace)", async () => {
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, workspaceCount: 2 });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-  });
-
-  it("a `member` role → the default workspace's leads — `inbox-read` holds every role", async () => {
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "member" });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
-  });
-
-  it("a role outside the permission table → empty — default deny", async () => {
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "writer" });
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-  });
-
-  it("with multi-tenant on, resolveOwnerWorkspaces is the path — the default-tenant resolver is not called", async () => {
-    process.env.AILK_ENABLED_MODULES = "multi-tenant";
-    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
-    const ownerWorkspaces = jest.requireActual("../owner-workspaces.js");
-    const spy = jest.spyOn(ownerWorkspaces, "resolveOwnerWorkspaces");
-
-    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
-
-    expect(spy).toHaveBeenCalledWith(USER_ID);
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
-    spy.mockRestore();
-  });
-});