create-ailk 0.18.0 → 0.19.1

package/templates/apps/api/src/routes/project-listings/__tests__/directory.test.ts

@@ -1,528 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file directory.test.ts
- *
- * THE ACCEPTANCE GATE for `GET /v1/project-listings/directory` (#7521 AC-1,
- * AC-3): a landing page's directory — the live listicle that names it, its
- * schema.org entry type, and its ACCEPTED entries with their public profile.
- *
- * Real `projectListingDirectoryRoute`, real services, mocked `lib/prisma.js`
- * over a small in-memory store of listicles, listings and site configs. The
- * last block boots the real `build()` so the directory's own rate-limited
- * scope is asserted where it is registered, not in a copy of it.
- *
- * Spec: docs/specs/7521-a-generic-directory-surface-for-spec.md §5.1.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@fastify/cors", () => jest.fn().mockResolvedValue(undefined));
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { listingDirectoryResponseSchema } from "@working-theory/validation";
-
-import { mockWorkspaceExists } from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
-import { __resetBuckets } from "../../../middleware/rate-limit.js";
-import { build } from "../../../server.js";
-import { projectListingDirectoryRoute } from "../index.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const SITE_A = "wksp_00000000-0000-7000-8000-00000000000a";
-const SITE_B = "wksp_00000000-0000-7000-8000-00000000000b";
-const KEY_A = "pk-site-a";
-const KEY_B = "pk-site-b";
-
-type Row = Record<string, unknown>;
-
-let listings: Row[];
-let flows: Row[];
-/** `SiteListingConfig` rows by siteId: `{ publicKey, data }`. */
-let configs: Map<string, { publicKey: string; data: Record<string, unknown> }>;
-
-const en = (s: string, fr?: string) => (fr ? { en: s, fr } : { en: s });
-
-function listicleConfig(listing?: Record<string, unknown>) {
-  return {
-    slug: "apply",
-    defaultLocale: "en",
-    steps: [
-      {
-        key: "application",
-        type: "field",
-        copy: { title: en("Apply") },
-        fields: [
-          { name: "full_name", inputType: "text", mapsTo: "name", copy: { label: en("Name") } },
-          { name: "email", inputType: "email", mapsTo: "email", copy: { label: en("Email") } },
-          { name: "website", inputType: "url", copy: { label: en("Website", "Site web") } },
-          {
-            name: "stage",
-            inputType: "select",
-            options: [
-              { value: "idea", label: en("Idea", "Idée") },
-              { value: "live", label: en("Live", "En ligne") },
-            ],
-            copy: { label: en("Stage", "Étape") },
-          },
-        ],
-      },
-    ],
-    ...(listing !== undefined && { listing }),
-  };
-}
-
-function flow(overrides: Row): Row {
-  return {
-    siteId: SITE_A,
-    workspaceId: SITE_A,
-    kind: "listicle",
-    status: "live",
-    landingPage: "/partners",
-    config: listicleConfig({ entryType: "Organization" }),
-    createdAt: new Date("2026-09-01T00:00:00.000Z"),
-    ...overrides,
-  };
-}
-
-let nextListing = 1;
-function listing(overrides: Row): Row {
-  const n = nextListing++;
-  return {
-    id: `prjl_00000000-0000-7000-8000-${String(n).padStart(12, "0")}`,
-    siteId: SITE_A,
-    workspaceId: SITE_A,
-    capturedByFlowId: "flow_partners",
-    leadId: null,
-    slug: `entry-${n}`,
-    name: `Entry ${n}`,
-    headline: null,
-    oneLiner: `Entry ${n} in one line.`,
-    problem: null,
-    solution: null,
-    url: null,
-    product: null,
-    commitment: null,
-    teamComposition: null,
-    faqs: null,
-    anythingElse: null,
-    address: null,
-    addressLine1: null,
-    addressLine2: null,
-    addressCity: null,
-    addressRegion: null,
-    addressPostalCode: null,
-    addressCountry: null,
-    questions: null,
-    siteAnswers: { website: "https://entry.test", stage: "live", email: "x@y.test" },
-    windowDays: 30,
-    founderName: "A Founder",
-    founderFirstName: null,
-    founderLastName: null,
-    founderEmail: "founder@example.com",
-    founderPhone: "+12015550123",
-    emailVerifiedAt: null,
-    founderCompany: null,
-    logoMarkUrl: null,
-    logoWordmarkUrl: null,
-    featured: false,
-    status: "active",
-    consentAt: new Date("2026-09-01T00:00:00.000Z"),
-    decidedAt: new Date("2026-09-10T00:00:00.000Z"),
-    decidedBy: "owner",
-    issueUrl: null,
-    experimentKey: null,
-    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
-    createdAt: new Date("2026-09-01T00:00:00.000Z"),
-    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
-    ...overrides,
-  };
-}
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
-      if ("not" in clause) return row[key] !== clause["not"];
-    }
-    return row[key] === value;
-  });
-}
-
-type SortTerm = "asc" | "desc" | { sort: "asc" | "desc"; nulls?: "first" | "last" };
-type OrderBy = Array<Record<string, SortTerm>>;
-/** Prisma's ordering, with Postgres's default of NULL first on DESC, last on ASC. */
-function ordered(rows: Row[], orderBy: OrderBy | undefined): Row[] {
-  if (!orderBy) return rows;
-  return [...rows].sort((a, b) => {
-    for (const term of orderBy) {
-      const [key, spec] = Object.entries(term)[0]!;
-      const dir = typeof spec === "string" ? spec : spec.sort;
-      const nulls = (typeof spec === "string" ? undefined : spec.nulls) ?? (dir === "desc" ? "first" : "last");
-      const av = a[key] instanceof Date ? (a[key] as Date).getTime() : (a[key] as string | null);
-      const bv = b[key] instanceof Date ? (b[key] as Date).getTime() : (b[key] as string | null);
-      if (av === bv) continue;
-      if (av === null || av === undefined) return nulls === "first" ? -1 : 1;
-      if (bv === null || bv === undefined) return nulls === "first" ? 1 : -1;
-      const cmp = av < bv ? -1 : 1;
-      return dir === "asc" ? cmp : -cmp;
-    }
-    return 0;
-  });
-}
-
-function installStore(): void {
-  listings = [];
-  flows = [];
-  configs = new Map([
-    [SITE_A, { publicKey: KEY_A, data: {} }],
-    [SITE_B, { publicKey: KEY_B, data: {} }],
-  ]);
-  nextListing = 1;
-
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        for (const [siteId, row] of configs) {
-          if (row.publicKey === where.publicKey) return Promise.resolve({ siteId });
-        }
-        return Promise.resolve(null);
-      }
-      const row = configs.get(where.siteId!);
-      return Promise.resolve(row ? { data: row.data } : null);
-    },
-  );
-  (prisma.flowDefinition.findMany as jest.Mock).mockImplementation(
-    ({ where, orderBy }: { where: Record<string, unknown>; orderBy?: OrderBy }) =>
-      Promise.resolve(ordered(flows.filter((f) => matches(f, where)), orderBy)),
-  );
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where, orderBy, take }: { where: Record<string, unknown>; orderBy?: OrderBy; take?: number }) => {
-      const found = ordered(listings.filter((l) => matches(l, where)), orderBy);
-      return Promise.resolve(take === undefined ? found : found.slice(0, take));
-    },
-  );
-  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(projectListingDirectoryRoute);
-  await app.ready();
-  return app;
-}
-
-type Directory = {
-  landingPage: string;
-  entryType: string;
-  entries: Array<{ slug: string; status: string; profile: Array<Record<string, string>> }>;
-} | null;
-
-const read = async (app: FastifyInstance, query: string) => {
-  const res = await app.inject({ method: "GET", url: `/v1/project-listings/directory?${query}` });
-  return { res, data: (res.json() as { data?: Directory }).data };
-};
-
-// ─── AC-1 — which entries a landing page shows ─────────────────────────────
-
-describe("GET /v1/project-listings/directory (#7521 AC-1)", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns the live listicle's entry type and exactly its accepted entries, the elapsed one closed, in /public's order", async () => {
-    flows.push(flow({ id: "flow_partners" }));
-    const live = listing({ slug: "acme", decidedAt: new Date("2026-09-10T00:00:00.000Z") });
-    const elapsed = listing({
-      slug: "globex",
-      decidedAt: new Date("2026-09-12T00:00:00.000Z"),
-      windowEndsAt: new Date("2026-09-20T00:00:00.000Z"),
-    });
-    const requested = listing({ slug: null, status: "requested", decidedAt: null });
-    listings.push(live, elapsed, requested);
-
-    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(res.statusCode).toBe(200);
-    expect(listingDirectoryResponseSchema.safeParse(data).success).toBe(true);
-    expect(data!.landingPage).toBe("/partners");
-    expect(data!.entryType).toBe("Organization");
-    // /public's order: the three newest by decidedAt first.
-    expect(data!.entries.map((e) => [e.slug, e.status])).toEqual([
-      ["globex", "closed"],
-      ["acme", "active"],
-    ]);
-  });
-
-  it("a draft listicle, another landing page, another workspace and an uncaptured listing contribute nothing", async () => {
-    flows.push(
-      flow({ id: "flow_partners" }),
-      flow({ id: "flow_draft", status: "draft" }),
-      flow({ id: "flow_tools", landingPage: "/tools" }),
-    );
-    listings.push(
-      listing({ slug: "kept" }),
-      listing({ slug: "from-draft", capturedByFlowId: "flow_draft" }),
-      listing({ slug: "from-tools", capturedByFlowId: "flow_tools" }),
-      listing({ slug: "other-workspace", siteId: SITE_B, workspaceId: SITE_B }),
-      listing({ slug: "uncaptured", capturedByFlowId: null }),
-    );
-
-    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(data!.entries.map((e) => e.slug)).toEqual(["kept"]);
-    // The flow read carried every scope term.
-    expect((prisma.flowDefinition.findMany as jest.Mock).mock.calls[0][0].where).toEqual({
-      siteId: SITE_A,
-      workspaceId: SITE_A,
-      kind: "listicle",
-      status: "live",
-      landingPage: "/partners",
-    });
-  });
-
-  it("a landing page no live listicle names answers data: null, and reads no listings", async () => {
-    flows.push(flow({ id: "flow_partners" }));
-    listings.push(listing({ slug: "acme" }));
-
-    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/about`);
-
-    expect(res.statusCode).toBe(200);
-    expect(data).toBeNull();
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-  });
-
-  it("returns at most 200 entries — the most recently accepted", async () => {
-    flows.push(flow({ id: "flow_partners" }));
-    for (let i = 0; i < 250; i++) {
-      listings.push(
-        listing({ slug: `e-${i}`, decidedAt: new Date(Date.UTC(2026, 0, 1) + i * 60_000) }),
-      );
-    }
-
-    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(res.statusCode).toBe(200);
-    expect(data!.entries).toHaveLength(200);
-    expect(data!.entries.map((e) => e.slug)).not.toContain("e-0");
-    expect(data!.entries.map((e) => e.slug)).toContain("e-249");
-  });
-
-  it("an active row with no decidedAt never takes a slot from an accepted one", async () => {
-    flows.push(flow({ id: "flow_partners" }));
-    listings.push(listing({ slug: "undecided", decidedAt: null }));
-    for (let i = 0; i < 200; i++) {
-      listings.push(
-        listing({ slug: `e-${i}`, decidedAt: new Date(Date.UTC(2026, 0, 1) + i * 60_000) }),
-      );
-    }
-
-    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(data!.entries).toHaveLength(200);
-    expect(data!.entries.map((e) => e.slug)).not.toContain("undecided");
-    expect(data!.entries.map((e) => e.slug)).toContain("e-0");
-  });
-
-  it("a listicle with no `listing` block publishes as CreativeWork", async () => {
-    flows.push(flow({ id: "flow_partners", config: listicleConfig() }));
-    listings.push(listing({ slug: "acme" }));
-
-    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(data!.entryType).toBe("CreativeWork");
-  });
-
-  it("the earlier-created listicle supplies the entry type when two name one page; both contribute entries", async () => {
-    flows.push(
-      flow({ id: "flow_later", config: listicleConfig({ entryType: "Person" }), createdAt: new Date("2026-09-05") }),
-      flow({ id: "flow_partners", createdAt: new Date("2026-09-01") }),
-    );
-    listings.push(listing({ slug: "a" }), listing({ slug: "b", capturedByFlowId: "flow_later" }));
-
-    const { data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    expect(data!.entryType).toBe("Organization");
-    expect(data!.entries.map((e) => e.slug).sort()).toEqual(["a", "b"]);
-  });
-
-  it("each entry's profile carries the listicle's public answers for the request locale, and no contact column", async () => {
-    flows.push(flow({ id: "flow_partners" }));
-    listings.push(listing({ slug: "acme" }));
-
-    const { res, data } = await read(app, `siteKey=${KEY_A}&landingPage=/partners&locale=fr`);
-
-    expect(data!.entries[0]!.profile).toEqual([
-      { name: "website", label: "Site web", value: "https://entry.test", kind: "url" },
-      { name: "stage", label: "Étape", value: "En ligne", kind: "select" },
-    ]);
-    const body = res.body;
-    expect(body).not.toContain("founder@example.com");
-    expect(body).not.toContain("x@y.test");
-    expect(body).not.toContain("+12015550123");
-  });
-
-  it("a malformed query is a 400 validation_failed", async () => {
-    const { res } = await read(app, `siteKey=${KEY_A}&landingPage=//evil.test`);
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
-  });
-});
-
-// ─── AC-3 — both tenancy shapes, one read ───────────────────────────────────
-
-describe("the directory resolves both tenancy shapes (#7521 AC-3)", () => {
-  let app: FastifyInstance;
-  let savedSiteId: string | undefined;
-  let savedPublicKey: string | undefined;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    savedSiteId = process.env["AILK_SITE_ID"];
-    savedPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
-    delete process.env["AILK_SITE_ID"];
-    delete process.env["AILK_LISTING_PUBLIC_KEY"];
-    __resetSiteWorkspaceCacheForTests();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    if (savedSiteId === undefined) delete process.env["AILK_SITE_ID"];
-    else process.env["AILK_SITE_ID"] = savedSiteId;
-    if (savedPublicKey === undefined) delete process.env["AILK_LISTING_PUBLIC_KEY"];
-    else process.env["AILK_LISTING_PUBLIC_KEY"] = savedPublicKey;
-    await app.close();
-  });
-
-  function seedSiteA(): void {
-    flows.push(flow({ id: "flow_partners" }));
-    listings.push(listing({ slug: "acme" }), listing({ slug: "globex" }));
-  }
-
-  it("multi-tenant (SiteListingConfig.publicKey) and single-tenant (env key) answer the identical body", async () => {
-    seedSiteA();
-    const multi = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-
-    // Single-tenant: no config row carries the key; the env key names the
-    // deployment's own site, resolved through `resolveSiteWorkspaceId()`.
-    configs.delete(SITE_A);
-    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
-    process.env["AILK_SITE_ID"] = SITE_A;
-    mockWorkspaceExists(prisma, SITE_A);
-    const single = await read(app, "siteKey=pk-single-tenant&landingPage=/partners");
-
-    expect(multi.res.statusCode).toBe(200);
-    expect(single.res.statusCode).toBe(200);
-    expect(single.data!.entries).toHaveLength(2);
-    expect(single.data).toEqual(multi.data);
-  });
-
-  it("an unmatched key is a 400 unknown_site_key and does not fall through to the env path", async () => {
-    seedSiteA();
-    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
-    process.env["AILK_SITE_ID"] = SITE_A;
-    mockWorkspaceExists(prisma, SITE_A);
-
-    const { res } = await read(app, "siteKey=pk-nobodys-site&landingPage=/partners");
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
-    expect(prisma.flowDefinition.findMany).not.toHaveBeenCalled();
-  });
-
-  it("two workspaces of one organization (the hub's spokes) each see only their own entries", async () => {
-    seedSiteA();
-    flows.push(flow({ id: "flow_b", siteId: SITE_B, workspaceId: SITE_B }));
-    listings.push(
-      listing({ slug: "b-entry", siteId: SITE_B, workspaceId: SITE_B, capturedByFlowId: "flow_b" }),
-    );
-
-    const a = await read(app, `siteKey=${KEY_A}&landingPage=/partners`);
-    const b = await read(app, `siteKey=${KEY_B}&landingPage=/partners`);
-
-    expect(a.data!.entries.map((e) => e.slug).sort()).toEqual(["acme", "globex"]);
-    expect(b.data!.entries.map((e) => e.slug)).toEqual(["b-entry"]);
-  });
-});
-
-// ─── AC-1 — the directory's own rate-limited scope, through the real build ──
-
-describe("the directory's rate-limit scope (#7521 AC-1, SEC-7521-D1)", () => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; matches leads-forwarded-rate-limit.test.ts
-  let server: any;
-  const priorModules = process.env["AILK_ENABLED_MODULES"];
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    __resetBuckets();
-    process.env["AILK_ENABLED_MODULES"] = "signal-collectors";
-    server = await build();
-    await server.ready();
-  });
-
-  afterEach(async () => {
-    if (server) await server.close();
-    server = undefined;
-  });
-
-  afterAll(() => {
-    if (priorModules === undefined) delete process.env["AILK_ENABLED_MODULES"];
-    else process.env["AILK_ENABLED_MODULES"] = priorModules;
-  });
-
-  it("15 directory reads in one minute from one IP all answer 200 — the leads scope would refuse the 11th", async () => {
-    const codes: number[] = [];
-    for (let i = 0; i < 15; i++) {
-      const res = await server.inject({
-        method: "GET",
-        url: `/v1/project-listings/directory?siteKey=${KEY_A}&landingPage=/partners`,
-        headers: { "x-forwarded-for": "198.51.100.7" },
-      });
-      codes.push(res.statusCode);
-    }
-    expect(codes).toEqual(Array(15).fill(200));
-
-    // The same IP's eleventh `/public` read — leadsScope — is refused.
-    const publicCodes: number[] = [];
-    for (let i = 0; i < 11; i++) {
-      const res = await server.inject({
-        method: "GET",
-        url: `/v1/project-listings/public?siteKey=${KEY_A}`,
-        headers: { "x-forwarded-for": "198.51.100.7" },
-      });
-      publicCodes.push(res.statusCode);
-    }
-    expect(publicCodes[10]).toBe(429);
-  });
-});