create-ailk 0.18.0 → 0.19.1

package/templates/apps/api/src/server.ts

@@ -55,6 +55,10 @@ import {
 import { tokenRoutes } from "./routes/auth/tokens.js";
 import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
 import { userRoutes } from "./routes/auth/user.js";
+import {
+  consentCookieRoute,
+  consentUnsubscribeRoute,
+} from "./routes/consent/index.js";
 import { getPageRoute } from "./routes/content/get-page.js";
 import { listPagesRoute } from "./routes/content/list-pages.js";
 import { listTypesRoute } from "./routes/content/list-types.js";
@@ -76,6 +80,7 @@ import {
   registerTestAuthRoute,
   shouldMountTestAuth,
 } from "./routes/test/auth/session.js";
+import { consentLinkSecretConfigured } from "./services/consent.js";
 
 /**
  * What a request looks like in a log line — Fastify's own default shape, minus
@@ -111,12 +116,18 @@ import {
  */
 const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
 const LEAD_ID_LOG_SEGMENT = idRegex("lead");
+// #8438 SEC-8438-10 — a third arm for `person_…` segments. The consents route
+// (and every other `…/people/:personId…` route) would otherwise write a full
+// Person id into the request log line, beside `remoteAddress`.
+const PERSON_ID_LOG_SEGMENT = idRegex("person");
 
 function redactSensitiveIdSegments(url: string): string {
   return url
     .split("/")
     .map((segment) =>
-      SESSION_ID_LOG_SEGMENT.test(segment) || LEAD_ID_LOG_SEGMENT.test(segment)
+      SESSION_ID_LOG_SEGMENT.test(segment) ||
+      LEAD_ID_LOG_SEGMENT.test(segment) ||
+      PERSON_ID_LOG_SEGMENT.test(segment)
         ? `${segment.slice(0, 8)}…`
         : segment,
     )
@@ -228,9 +239,35 @@ const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
 const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
 const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
 const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
+// #8171 D8 — the workspace's Requests read (the inbound member rows), the
+// SAME scope.
+const WORKSPACES_REQUESTS = "./routes/workspaces/requests.js";
 // #7877 D11 — the member reads: auth only, under the SAME module predicate.
 const MEMBER_PIECES = "./routes/member/pieces.js";
 const MEMBER_MESSAGES = "./routes/member/messages.js";
+// #8169 D9 — the Phase 1 member reads. Five under the SAME predicate; the two
+// that reach services/scheduling/ under scheduling && (workspace ||
+// multi-tenant), because only the scheduling module delivers that directory.
+const MEMBER_PURCHASES = "./routes/member/purchases.js";
+const MEMBER_APPOINTMENTS = "./routes/member/appointments.js";
+const MEMBER_ARTIFACTS = "./routes/member/artifacts.js";
+const MEMBER_REQUEST_FORM = "./routes/member/request-form.js";
+const MEMBER_BILLING = "./routes/member/billing.js";
+const MEMBER_MEETING_TYPES = "./routes/member/meeting-types.js";
+const MEMBER_AVAILABILITY = "./routes/member/availability.js";
+// #8170 D11 — the member writes. Four under the tenancy predicate (the
+// message POST rides MEMBER_MESSAGES); the booking, which reaches
+// services/scheduling/, under scheduling && (workspace || multi-tenant).
+const MEMBER_REQUESTS = "./routes/member/requests.js";
+const MEMBER_ARTIFACT_REVIEW = "./routes/member/artifact-review.js";
+const MEMBER_PROFILE = "./routes/member/profile.js";
+const MEMBER_DELETION_REQUEST = "./routes/member/deletion-request.js";
+const MEMBER_BOOKINGS = "./routes/member/bookings.js";
+// #8438 D6 — the member's own consents, under the tenancy predicate beside the
+// other member routes. D8 — the Admin owner's consents to Working Theory,
+// under multi-tenant alone (the module that contributes the Admin app).
+const MEMBER_CONSENTS = "./routes/member/consents.js";
+const CONSENT_PLATFORM = "./routes/consent/platform.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
 // scope.
@@ -316,6 +353,11 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_PIECES,
     load: () => import(WORKSPACES_PIECES),
   },
+  // #8171 D8 — the Requests read, the SAME scope.
+  workspaceRequestRoutes: {
+    specifier: WORKSPACES_REQUESTS,
+    load: () => import(WORKSPACES_REQUESTS),
+  },
   workspacePlanRoutes: {
     specifier: WORKSPACES_PLAN,
     load: () => import(WORKSPACES_PLAN),
@@ -333,6 +375,68 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_MESSAGES,
     load: () => import(MEMBER_MESSAGES),
   },
+  // #8169 D9 — the Phase 1 member reads, in authScope beside the two above.
+  memberPurchaseRoutes: {
+    specifier: MEMBER_PURCHASES,
+    load: () => import(MEMBER_PURCHASES),
+  },
+  memberAppointmentRoutes: {
+    specifier: MEMBER_APPOINTMENTS,
+    load: () => import(MEMBER_APPOINTMENTS),
+  },
+  memberArtifactRoutes: {
+    specifier: MEMBER_ARTIFACTS,
+    load: () => import(MEMBER_ARTIFACTS),
+  },
+  memberRequestFormRoutes: {
+    specifier: MEMBER_REQUEST_FORM,
+    load: () => import(MEMBER_REQUEST_FORM),
+  },
+  memberBillingRoutes: {
+    specifier: MEMBER_BILLING,
+    load: () => import(MEMBER_BILLING),
+  },
+  // The two that reach services/scheduling/ (scheduling-owned, D9).
+  memberMeetingTypeRoutes: {
+    specifier: MEMBER_MEETING_TYPES,
+    load: () => import(MEMBER_MEETING_TYPES),
+  },
+  memberAvailabilityRoutes: {
+    specifier: MEMBER_AVAILABILITY,
+    load: () => import(MEMBER_AVAILABILITY),
+  },
+  // #8170 D11 — the member writes, in authScope beside the reads.
+  memberRequestRoutes: {
+    specifier: MEMBER_REQUESTS,
+    load: () => import(MEMBER_REQUESTS),
+  },
+  memberArtifactReviewRoutes: {
+    specifier: MEMBER_ARTIFACT_REVIEW,
+    load: () => import(MEMBER_ARTIFACT_REVIEW),
+  },
+  memberProfileRoutes: {
+    specifier: MEMBER_PROFILE,
+    load: () => import(MEMBER_PROFILE),
+  },
+  memberDeletionRequestRoutes: {
+    specifier: MEMBER_DELETION_REQUEST,
+    load: () => import(MEMBER_DELETION_REQUEST),
+  },
+  // #8438 D6 — the member's own consents, the SAME scope as the writes above.
+  memberConsentRoutes: {
+    specifier: MEMBER_CONSENTS,
+    load: () => import(MEMBER_CONSENTS),
+  },
+  // #8438 D8 — the owner's consents to Working Theory (multi-tenant only).
+  consentPlatformRoutes: {
+    specifier: CONSENT_PLATFORM,
+    load: () => import(CONSENT_PLATFORM),
+  },
+  // The one that reaches services/scheduling/ (scheduling-owned, D11).
+  memberBookingRoutes: {
+    specifier: MEMBER_BOOKINGS,
+    load: () => import(MEMBER_BOOKINGS),
+  },
   // #3591 PR-B — the agent seat, the SAME scope.
   workspaceAgentRoutes: {
     specifier: WORKSPACES_AGENTS,
@@ -565,24 +669,29 @@ async function tenantPreHandlerForBuild(): Promise<FastifyPluginCallback> {
 }
 
 /**
- * The commerce boot-time sandbox guard — the one other slice entry that is
+ * The commerce boot-time key admission — the one other slice entry that is
  * not a route plugin, mirroring `tenantPreHandlerSlicePlugin()` above (D3).
- * `lib/stripe.ts` is commerce-owned (D5) and its `assertSandboxKey` is the
+ * `lib/stripe.ts` is commerce-owned (D5) and its `admitApiStripeKey` is the
  * sole `apps/api` reach into the Stripe SDK wrapper package, so it can no
  * longer be a static import (spec D1) once the module is stripped. The
  * widened `const specifier: string` annotation is what defeats `tsc`
  * resolution, exactly as it does above.
+ *
+ * #8450 D4: called with NO argument, so the admission covers the same
+ * `process.env` key `getStripeClient()` later reads. `STRIPE_MODE` unset is
+ * today's sandbox-only check; only a restricted live key beside
+ * `STRIPE_MODE=live` on a production build comes back `"live"`.
  */
-async function assertCommerceSandboxKey(key: string): Promise<void> {
+async function admitCommerceStripeKey(): Promise<"test" | "live"> {
   const specifier: string = "./lib/stripe.js";
   const mod = (await loadSlice(specifier, () => import(specifier))) as {
-    assertSandboxKey?: (key: string) => void;
+    admitApiStripeKey?: () => "test" | "live";
   };
-  const assertSandboxKeyFn = mod.assertSandboxKey;
-  if (!assertSandboxKeyFn) {
-    throw new Error("slice export assertSandboxKey missing from " + specifier);
+  const admitApiStripeKeyFn = mod.admitApiStripeKey;
+  if (!admitApiStripeKeyFn) {
+    throw new Error("slice export admitApiStripeKey missing from " + specifier);
   }
-  assertSandboxKeyFn(key);
+  return admitApiStripeKeyFn();
 }
 
 /**
@@ -598,6 +707,18 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
+  // #8438 D9 — AILK_CONSENT_LINK_SECRET is optional, but a value shorter than
+  // 32 bytes is a misconfiguration worth an error at boot: it is treated as
+  // unset, so no unsubscribe link can be minted or honored. Never the value.
+  if (
+    process.env["AILK_CONSENT_LINK_SECRET"] !== undefined &&
+    process.env["AILK_CONSENT_LINK_SECRET"] !== "" &&
+    !consentLinkSecretConfigured()
+  ) {
+    logger.error(
+      "[startup] AILK_CONSENT_LINK_SECRET is set but shorter than 32 bytes — treated as unset; no unsubscribe link can be minted or honored",
+    );
+  }
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
@@ -635,14 +756,17 @@ export async function build() {
   // site renewed. Never throws; without DATABASE_URL the file store stays.
   await registerLicenseKeyStore();
 
-  // Runtime sandbox-mode guard: reject live-mode Stripe keys before any
-  // webhook or checkout call can exercise them. Idempotent — safe even if
-  // assertSandboxKey is called again inside a route handler. UNCONDITIONAL
-  // since D-64 (#5796): the commerce primitives and lib/stripe.ts are base
-  // tree now, so the key's presence — not a module flag — is the whole
-  // question. A build with no STRIPE_SECRET_KEY has nothing to assert.
+  // Runtime key admission (#8450 D4): refuse, before any webhook or checkout
+  // call can exercise it, every live Stripe key this process cannot vouch
+  // for — all of them unless STRIPE_MODE=live sits beside a restricted live
+  // key on a production build. UNCONDITIONAL since D-64 (#5796): the
+  // commerce primitives and lib/stripe.ts are base tree now, so the key's
+  // presence — not a module flag — is the whole question. A build with no
+  // STRIPE_SECRET_KEY has nothing to admit.
+  let stripeMode: "test" | "live" = "test";
   if (config.STRIPE_SECRET_KEY) {
-    await assertCommerceSandboxKey(config.STRIPE_SECRET_KEY);
+    stripeMode = await admitCommerceStripeKey();
+    logger.info({ stripeMode }, "[startup] stripe key admitted");
   }
 
   // trustProxy: true (#4730) — the Vercel serverless handler
@@ -855,6 +979,10 @@ export async function build() {
       await authScope.register(
         await sliceRoutePlugin("workspaceContextRoutes"),
       );
+      // #8438 D8 — the Admin owner's consents to Working Theory. Auth only,
+      // NOT tenant-guarded (the owner role is checked inside the route), and
+      // deliberately NOT in `HUB_SESSION_ROUTES`: a cookie session only.
+      await authScope.register(await sliceRoutePlugin("consentPlatformRoutes"));
     }
 
     // The leads INBOX read (#5678) — auth only, NOT tenant-guarded, for the
@@ -927,6 +1055,32 @@ export async function build() {
     if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
       await authScope.register(await sliceRoutePlugin("memberPieceRoutes"));
       await authScope.register(await sliceRoutePlugin("memberMessageRoutes"));
+      // #8169 D9 — the Phase 1 member reads, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberPurchaseRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberAppointmentRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberArtifactRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberRequestFormRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberBillingRoutes"));
+      // #8170 D11 — the member writes, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberRequestRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));
+      // #8438 D6 — the member's own consents, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberConsentRoutes"));
+    }
+    // #8169 D9 — the two member reads that reach services/scheduling/, which
+    // only the scheduling module delivers: a scaffold with a tenancy module
+    // and no scheduling carries neither file, and one with scheduling and no
+    // tenancy module registers neither.
+    if (
+      isModuleEnabled("scheduling") &&
+      (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant"))
+    ) {
+      await authScope.register(await sliceRoutePlugin("memberMeetingTypeRoutes"));
+      await authScope.register(await sliceRoutePlugin("memberAvailabilityRoutes"));
+      // #8170 D11 — the member booking, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberBookingRoutes"));
     }
 
     // Tenant-guarded domain routes (multi-tenant module) — the tenant
@@ -1104,6 +1258,11 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspacePieceRoutes"),
         );
+        // #8171 D8 — the Requests read: the inbound member rows, behind
+        // `inbox-read`; the content only to a role holding `people-read`.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceRequestRoutes"),
+        );
         await tenantScope.register(
           await sliceRoutePlugin("workspacePlanRoutes"),
         );
@@ -1218,7 +1377,25 @@ export async function build() {
   // `GET /v1/checkout/sessions/:id` — the GET in its own nested,
   // rate-limited sub-scope (D16), so this preHandler applies to both while
   // the GET's own limiter applies to it alone.
+  //
+  // #8450 § 9 SEC-14 — a LIVE process gives both routes their own per-IP
+  // `checkout` bucket on top of the global limiter, because live, the public
+  // GET spends one read of the shared live Stripe account per request. It
+  // lowers the per-IP ceiling per instance (the POST's from the global 20 to
+  // 10; the POST and GET now also share one count); like every limiter here
+  // it is in-memory, so it does not bound the total across serverless
+  // instances. `onRequest`, so it counts before the claim gate. Accepted
+  // residual: a server-side caller — apps/web's server actions, an MCP host's
+  // `purchase` tool — puts all its buyers on its own egress IP, so they share
+  // one bucket; `AILK_RATE_LIMIT_CHECKOUT_PER_MINUTE` raises the ceiling. A
+  // test-mode process registers nothing new.
   await server.register(async (checkoutScope) => {
+    if (stripeMode === "live") {
+      await checkoutScope.register(rateLimitMiddleware, {
+        scope: "checkout",
+        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      });
+    }
     checkoutScope.addHook("preHandler", requireCommerceClaim);
     await checkoutScope.register(await sliceRoutePlugin("checkoutRoutes"));
   });
@@ -1357,6 +1534,31 @@ export async function build() {
   // 10/min on form submissions. The global unauth ceiling above applies.
   await server.register(leadCaptureStatusRoute);
 
+  // The consent floor (#8438 D5, D9) — the cookie banner's log and the
+  // unsubscribe landing. Top level, outside every module gate: consent
+  // logging is part of the never-gated privacy floor. Each is in its OWN
+  // rate-limited scope (`consent`, `unsubscribe`) so filling one never blocks
+  // the other; with a forward key set, a spoke's visitors are counted one by
+  // one (both routes are on FORWARDED_VISITOR_ROUTES). Without one, the
+  // server's own IP is the bucket — the posture of the lead routes. Neither
+  // is behind `authScope`: the caller is a visitor, or a person in their mail.
+  await server.register(async (consentScope) => {
+    consentScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "consent",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await consentScope.register(consentCookieRoute);
+  });
+  await server.register(async (unsubscribeScope) => {
+    unsubscribeScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "unsubscribe",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await unsubscribeScope.register(consentUnsubscribeRoute);
+  });
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was