create-ailk 0.18.0 → 0.19.1

package/templates/apps/api/src/lib/__tests__/consent-ledger-double.ts

@@ -0,0 +1,237 @@
+/**
+ * @file consent-ledger-double.ts
+ * @description An in-memory model of the consent ledger for suites that run
+ * the REAL `services/consent.ts` and `lib/consent-store.ts` over the mocked
+ * Prisma client (`lib/__mocks__/prisma.ts`) — #8438.
+ *
+ * `armConsentLedger(prisma)` wires the mocked client so that:
+ *   - `$transaction(fn)` runs `fn` on the same client;
+ *   - `consentGrant.createMany` appends to the returned `ledger`;
+ *   - `consentVisitorLink.createMany` appends to `links` (skipping a repeat);
+ *   - `$queryRaw` answers the way the store's SQL would — newest row per
+ *     purpose for the own / any-source / platform readings, the visitor's
+ *     newest choice, and keyset history pages — by recognising each query's
+ *     SQL text.
+ *
+ * This proves the writers' and routes' decisions ("write only when the answer
+ * changes", "own rows only", "a cursor of another Person is invalid") against
+ * a model with the same semantics as the SQL. The SQL itself is proved
+ * against a real database in `database/__tests__/consent-ledger.db.test.ts`.
+ */
+
+export type LedgerRow = {
+  id: string;
+  workspaceId: string;
+  subjectType: string;
+  subjectId: string;
+  personId: string | null;
+  purposeId: string;
+  granted: boolean;
+  source: string;
+  sourceRef: string | null;
+  policyVersion: number | null;
+  locale: string;
+  statement: string;
+  createdAt: Date;
+};
+
+export type LinkRow = {
+  workspaceId: string;
+  visitorId: string;
+  personId: string;
+  source: string;
+};
+
+const OWN_SOURCES = ["sign_up", "account_settings", "email_unsubscribe"];
+
+type Mockable = {
+  mockImplementation: (fn: (...args: never[]) => unknown) => unknown;
+  mockResolvedValue: (v: unknown) => unknown;
+};
+
+interface ArmablePrisma {
+  $transaction: unknown;
+  $executeRaw: unknown;
+  $queryRaw: unknown;
+  consentGrant: { createMany: unknown };
+  consentVisitorLink: { createMany: unknown };
+}
+
+export interface ConsentLedgerDouble {
+  ledger: LedgerRow[];
+  links: LinkRow[];
+}
+
+let clock = 0;
+
+export function armConsentLedger(prisma: unknown): ConsentLedgerDouble {
+  const p = prisma as ArmablePrisma;
+  const double: ConsentLedgerDouble = { ledger: [], links: [] };
+  clock = 0;
+
+  (p.$transaction as Mockable).mockImplementation((async (
+    fn: (tx: unknown) => unknown,
+  ) => fn(prisma)) as never);
+  (p.$executeRaw as Mockable).mockResolvedValue(1);
+
+  (p.consentGrant.createMany as Mockable).mockImplementation(((args: {
+    data: Array<Omit<LedgerRow, "id" | "createdAt">>;
+  }) => {
+    for (const row of args.data) {
+      clock += 1;
+      double.ledger.push({
+        ...row,
+        id: `cnsnt_00000000-0000-7000-8000-${String(clock).padStart(12, "0")}`,
+        createdAt: new Date(Date.UTC(2026, 9, 12, 0, 0, clock)),
+      });
+    }
+    return Promise.resolve({ count: args.data.length });
+  }) as never);
+
+  (p.consentVisitorLink.createMany as Mockable).mockImplementation(((args: {
+    data: LinkRow[];
+  }) => {
+    let count = 0;
+    for (const row of args.data) {
+      const seen = double.links.some(
+        (l) =>
+          l.workspaceId === row.workspaceId &&
+          l.visitorId === row.visitorId &&
+          l.personId === row.personId,
+      );
+      if (!seen) {
+        double.links.push(row);
+        count += 1;
+      }
+    }
+    return Promise.resolve({ count });
+  }) as never);
+
+  (p.$queryRaw as Mockable).mockImplementation(((
+    strings: TemplateStringsArray,
+    ...values: unknown[]
+  ) => {
+    const sql = strings.join("?");
+    const [workspaceId] = values as [string];
+
+    const linkedVisitors = (personId: string) =>
+      new Set(
+        double.links
+          .filter(
+            (l) => l.workspaceId === workspaceId && l.personId === personId,
+          )
+          .map((l) => l.visitorId),
+      );
+    const anySource = (personId: string) =>
+      double.ledger.filter(
+        (r) =>
+          r.workspaceId === workspaceId &&
+          (r.personId === personId ||
+            (r.subjectType === "visitor" &&
+              linkedVisitors(personId).has(r.subjectId))),
+      );
+    const newestPerPurpose = (rows: LedgerRow[]) => {
+      const byPurpose = new Map<string, LedgerRow>();
+      for (const row of rows) byPurpose.set(row.purposeId, row);
+      return [...byPurpose.values()];
+    };
+    const state = (r: LedgerRow) => ({
+      id: r.id,
+      purposeId: r.purposeId,
+      granted: r.granted,
+      at: r.createdAt,
+      source: r.source,
+      sourceRef: r.sourceRef,
+      policyVersion: r.policyVersion,
+    });
+
+    // The visitor's newest choice for one purpose (the cookie writer's dedupe).
+    if (
+      sql.includes(`"subject_type" = 'visitor'`) &&
+      sql.includes("LIMIT 1") &&
+      !sql.includes("person_id")
+    ) {
+      const [, visitorId, purposeId] = values as [string, string, string];
+      const rows = double.ledger.filter(
+        (r) =>
+          r.workspaceId === workspaceId &&
+          r.subjectType === "visitor" &&
+          r.subjectId === visitorId &&
+          r.purposeId === purposeId,
+      );
+      const last = rows[rows.length - 1];
+      return Promise.resolve(
+        last
+          ? [{ granted: last.granted, policyVersion: last.policyVersion }]
+          : [],
+      );
+    }
+    // The platform reading: subject `user`.
+    if (sql.includes(`"subject_type" = 'user'`)) {
+      const [, userId] = values as [string, string];
+      return Promise.resolve(
+        newestPerPurpose(
+          double.ledger.filter(
+            (r) =>
+              r.workspaceId === workspaceId &&
+              r.subjectType === "user" &&
+              r.subjectId === userId,
+          ),
+        ).map(state),
+      );
+    }
+    // A history cursor check: does this row id belong to this Person's scope?
+    if (sql.includes('SELECT g."id" FROM "consent_grants" g')) {
+      const [, cursor, personId] = values as [string, string, string];
+      return Promise.resolve(
+        anySource(personId)
+          .filter((r) => r.id === cursor)
+          .map((r) => ({ id: r.id })),
+      );
+    }
+    // A history page: newest first, keyset on (created_at, id).
+    if (
+      sql.includes('ORDER BY g."created_at" DESC, g."id" DESC') &&
+      sql.includes('g."locale"')
+    ) {
+      const personId = values[1] as string;
+      const cursor = values[values.length - 3] as string | null;
+      let rows = anySource(personId).slice().reverse();
+      if (cursor) {
+        const at = rows.findIndex((r) => r.id === cursor);
+        rows = rows.slice(at + 1);
+      }
+      const limit = values[values.length - 1] as number;
+      return Promise.resolve(
+        rows.slice(0, limit).map((r) => ({
+          ...state(r),
+          locale: r.locale,
+          statement: r.statement,
+          subjectType: r.subjectType,
+        })),
+      );
+    }
+    // The own reading (a Person's own-source rows).
+    if (sql.includes(`'sign_up', 'account_settings', 'email_unsubscribe'`)) {
+      const [, personId] = values as [string, string];
+      return Promise.resolve(
+        newestPerPurpose(
+          double.ledger.filter(
+            (r) =>
+              r.workspaceId === workspaceId &&
+              r.personId === personId &&
+              OWN_SOURCES.includes(r.source),
+          ),
+        ).map(state),
+      );
+    }
+    // The any-source reading.
+    if (sql.includes("consent_visitor_links")) {
+      const [, personId] = values as [string, string];
+      return Promise.resolve(newestPerPurpose(anySource(personId)).map(state));
+    }
+    return Promise.resolve([]);
+  }) as never);
+
+  return double;
+}

package/templates/apps/api/src/lib/__tests__/consent-store.test.ts

@@ -0,0 +1,334 @@
+/**
+ * @file consent-store.test.ts
+ * @description The consent ledger's read boundary (#8438 D4, AC-2).
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock;
+ *     prisma singleton via __mocks__/prisma.ts)
+ *
+ * The readers run over `consent-ledger-double.ts`, an in-memory model with
+ * the same semantics as their SQL; the SQL text itself is run against a real
+ * database by `database/__tests__/consent-ledger.db.test.ts`. What this file
+ * proves: the two readings never mix (a row an anonymous writer attached to a
+ * Person never changes the Person's OWN answer), a flood cannot push an
+ * answer out, history pages are complete, and a cursor of another Person is
+ * refused.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../prisma.js");
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { siteConsentConfigSchema } from "@working-theory/validation";
+
+import {
+  CONSENT_HISTORY_PAGE_SIZE,
+  anySourceConsentState,
+  effectiveConsent,
+  isUnverifiedSource,
+  latestVisitorChoice,
+  OWN_CONSENT_SOURCES,
+  ownConsentState,
+  personConsentHistory,
+  userPlatformRows,
+} from "../consent-store.js";
+import { prisma } from "../prisma.js";
+
+import {
+  armConsentLedger,
+  type ConsentLedgerDouble,
+  type LedgerRow,
+} from "./consent-ledger-double.js";
+
+const WS = "wksp_01920000-0000-7000-8000-0000000000a1";
+const OTHER_WS = "wksp_01920000-0000-7000-8000-0000000000a2";
+const PERSON = "person_01920000-0000-7000-8000-0000000000a1";
+const OTHER_PERSON = "person_01920000-0000-7000-8000-0000000000a2";
+const VISITOR = "0192a000-0000-4000-8000-0000000000a1";
+
+const CONFIG = siteConsentConfigSchema.parse({
+  policies: {},
+  purposes: [
+    {
+      id: "news",
+      kind: "preference",
+      area: "communications",
+      label: { en: "News." },
+    },
+    { id: "data", kind: "consent", area: "data", label: { en: "Data." } },
+  ],
+});
+
+let double: ConsentLedgerDouble;
+let counter = 0;
+
+function row(over: Partial<LedgerRow>): LedgerRow {
+  counter += 1;
+  return {
+    id: `cnsnt_00000000-0000-7000-8000-${String(900000 + counter).padStart(12, "0")}`,
+    workspaceId: WS,
+    subjectType: "person",
+    subjectId: PERSON,
+    personId: PERSON,
+    purposeId: "news",
+    granted: true,
+    source: "account_settings",
+    sourceRef: null,
+    policyVersion: 1,
+    locale: "en",
+    statement: "News.",
+    createdAt: new Date(Date.UTC(2026, 9, 12, 0, 0, 0, counter)),
+    ...over,
+  };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  counter = 0;
+  double = armConsentLedger(prisma);
+});
+
+describe("the two readings (SEC-8438-1)", () => {
+  it("a magnet grant an anonymous form attached never changes the Person's OWN answer", async () => {
+    double.ledger.push(
+      row({ purposeId: "data", granted: false, source: "account_settings" }),
+      row({
+        purposeId: "data",
+        granted: true,
+        source: "magnet",
+        sourceRef: "guide",
+      }),
+    );
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")?.effective).toBe(false);
+    expect(any.find((s) => s.purposeId === "data")?.effective).toBe(true);
+    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe("magnet");
+  });
+
+  it("a preference is on until withdrawn, a consent off until granted, with no row", async () => {
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    expect(own.map((s) => [s.purposeId, s.kind, s.row, s.effective])).toEqual([
+      ["news", "preference", null, true],
+      ["data", "consent", null, false],
+    ]);
+    expect(effectiveConsent("preference", null)).toBe(true);
+    expect(effectiveConsent("agreement", null)).toBe(false);
+    expect(effectiveConsent("consent", { granted: false })).toBe(false);
+  });
+
+  it("the OWN sources are exactly the three the SQL names, and the unverified set is the rest", () => {
+    const source = readFileSync(join(__dirname, "../consent-store.ts"), "utf8");
+    const literal = `IN ('${OWN_CONSENT_SOURCES.join("', '")}')`;
+    expect(source.split(literal).length - 1).toBe(1);
+    expect(OWN_CONSENT_SOURCES.map(isUnverifiedSource)).toEqual([
+      false,
+      false,
+      false,
+    ]);
+    expect(
+      (["magnet", "api", "cookie_banner", "legacy"] as const).every(
+        isUnverifiedSource,
+      ),
+    ).toBe(true);
+  });
+
+  it("another workspace's rows and another Person's rows never show", async () => {
+    double.ledger.push(
+      row({ workspaceId: OTHER_WS, purposeId: "data", granted: true }),
+      row({
+        personId: OTHER_PERSON,
+        subjectId: OTHER_PERSON,
+        purposeId: "data",
+        granted: true,
+      }),
+    );
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")?.row).toBeNull();
+  });
+
+  it("a linked visitor's cookie rows reach the any-source reading only, and only in the same workspace", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        purposeId: "data",
+        granted: true,
+        source: "cookie_banner",
+      }),
+    );
+    double.links.push({
+      workspaceId: WS,
+      visitorId: VISITOR,
+      personId: PERSON,
+      source: "magnet",
+    });
+    double.links.push({
+      workspaceId: OTHER_WS,
+      visitorId: VISITOR,
+      personId: OTHER_PERSON,
+      source: "magnet",
+    });
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe(
+      "cookie_banner",
+    );
+    expect(
+      (await anySourceConsentState(WS, OTHER_PERSON, CONFIG)).every(
+        (s) => s.row === null,
+      ),
+    ).toBe(true);
+    expect(
+      (await ownConsentState(WS, PERSON, CONFIG)).every((s) => s.row === null),
+    ).toBe(true);
+  });
+});
+
+describe("the flood case (SEC-8438-2, AC-2)", () => {
+  it("600 magnet grants and 600 linked-visitor cookie rows cannot push out a withdrawal", async () => {
+    double.ledger.push(
+      row({ purposeId: "data", granted: false, source: "account_settings" }),
+    );
+    double.links.push({
+      workspaceId: WS,
+      visitorId: VISITOR,
+      personId: PERSON,
+      source: "magnet",
+    });
+    for (let i = 0; i < 600; i += 1) {
+      double.ledger.push(
+        row({ purposeId: "data", granted: true, source: "magnet" }),
+      );
+    }
+    for (let i = 0; i < 600; i += 1) {
+      double.ledger.push(
+        row({
+          subjectType: "visitor",
+          subjectId: VISITOR,
+          personId: null,
+          purposeId: "data",
+          granted: true,
+          source: "cookie_banner",
+        }),
+      );
+    }
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")).toMatchObject({
+      effective: false,
+    });
+    expect(any.find((s) => s.purposeId === "data")).toMatchObject({
+      effective: true,
+    });
+
+    // Following nextCursor returns all 1,201 rows exactly once.
+    const seen: string[] = [];
+    let cursor: string | undefined;
+    let pages = 0;
+    for (;;) {
+      const page = await personConsentHistory(WS, PERSON, cursor);
+      if (page === "invalid_cursor")
+        throw new Error("unexpected invalid cursor");
+      expect(page.rows.length).toBeLessThanOrEqual(CONSENT_HISTORY_PAGE_SIZE);
+      seen.push(...page.rows.map((r) => r.id));
+      pages += 1;
+      if (page.nextCursor === null) break;
+      cursor = page.nextCursor;
+    }
+    expect(pages).toBe(3);
+    expect(seen).toHaveLength(1201);
+    expect(new Set(seen).size).toBe(1201);
+  });
+});
+
+describe("personConsentHistory", () => {
+  it("is newest first and carries the wording, never a subject id", async () => {
+    double.ledger.push(row({ granted: true }), row({ granted: false }));
+    const page = await personConsentHistory(WS, PERSON, undefined);
+    if (page === "invalid_cursor") throw new Error("unexpected");
+    expect(page.rows.map((r) => r.granted)).toEqual([false, true]);
+    expect(page.rows[0]).toHaveProperty("statement", "News.");
+    expect(page.rows[0]).not.toHaveProperty("subjectId");
+    expect(page.nextCursor).toBeNull();
+  });
+
+  it("refuses a cursor that is another Person's row, another workspace's row, or unknown", async () => {
+    double.ledger.push(
+      row({ granted: true }),
+      row({ personId: OTHER_PERSON, subjectId: OTHER_PERSON }),
+      row({ workspaceId: OTHER_WS }),
+    );
+    const [, theirs, elsewhere] = double.ledger;
+    expect(await personConsentHistory(WS, PERSON, theirs!.id)).toBe(
+      "invalid_cursor",
+    );
+    expect(await personConsentHistory(WS, PERSON, elsewhere!.id)).toBe(
+      "invalid_cursor",
+    );
+    expect(await personConsentHistory(WS, PERSON, "cnsnt_nope")).toBe(
+      "invalid_cursor",
+    );
+  });
+});
+
+describe("the cookie dedupe read and the platform read", () => {
+  it("latestVisitorChoice answers the newest row for the visitor and purpose", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        granted: true,
+        purposeId: "data",
+        source: "cookie_banner",
+      }),
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        granted: false,
+        purposeId: "data",
+        source: "cookie_banner",
+      }),
+    );
+    expect(await latestVisitorChoice(WS, VISITOR, "data")).toEqual({
+      granted: false,
+      policyVersion: 1,
+    });
+    expect(await latestVisitorChoice(WS, VISITOR, "news")).toBeNull();
+    expect(await latestVisitorChoice(OTHER_WS, VISITOR, "data")).toBeNull();
+  });
+
+  it("userPlatformRows reads the user's own rows, newest per purpose", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "user",
+        subjectId: "user_1",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: true,
+      }),
+      row({
+        subjectType: "user",
+        subjectId: "user_1",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: false,
+      }),
+      row({
+        subjectType: "user",
+        subjectId: "user_2",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: true,
+      }),
+    );
+    const rows = await userPlatformRows(WS, "user_1");
+    expect(rows.map((r) => [r.purposeId, r.granted])).toEqual([
+      ["wt_marketing", false],
+    ]);
+  });
+});

package/templates/apps/api/src/lib/__tests__/deliverable-asset-store.test.ts

@@ -184,3 +184,41 @@ describe("module boundary contract (§1.14 / D16)", () => {
     );
   });
 });
+
+// #8171 D3 (AC-6): a delivered version's file is never a magnet deliverable —
+// untagged, attached to no message, and still `null` from both reads.
+describe("a delivered version's file (#8171 D3)", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (prisma.interaction.count as jest.Mock).mockResolvedValue(0);
+  });
+
+  it("findDeliverableAssetIdByKey returns null, counting within the workspace", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID, tags: [] });
+    (prisma.pieceVersion.count as jest.Mock).mockResolvedValueOnce(1);
+
+    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "draft-2.pdf");
+
+    expect(prisma.pieceVersion.count).toHaveBeenCalledWith({
+      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
+    });
+    expect(result).toBeNull();
+  });
+
+  it("readDeliverableAsset returns null, counting within the workspace", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
+      filename: "draft-2.pdf",
+      contentType: "application/pdf",
+      bytes: new Uint8Array([1, 2, 3]),
+      tags: [],
+    });
+    (prisma.pieceVersion.count as jest.Mock).mockResolvedValueOnce(1);
+
+    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
+
+    expect(prisma.pieceVersion.count).toHaveBeenCalledWith({
+      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
+    });
+    expect(result).toBeNull();
+  });
+});