create-ailk 0.18.0 → 0.19.1

package/templates/apps/api/src/lib/stripe.ts

@@ -8,7 +8,12 @@
  * '@working-theory/stripe-client' — single chokepoint for AILK-internal ergonomics
  * (logger context, request-id propagation) without touching every consumer.
  */
-import { getStripeClient } from "@working-theory/stripe-client";
+import {
+  admitLiveRestrictedKey,
+  assertSandboxKey,
+  getStripeClient,
+  StripeConfigError,
+} from "@working-theory/stripe-client";
 
 export {
   // PRECONDITION (#6113): do not narrow or bypass this sandbox-only guard for a
@@ -18,6 +23,8 @@ export {
   // Widened by #6852 (the #6113 follow-up): the same function must bind only
   // on a server-stamped metadata.ailk_user_id — an unverified Checkout email
   // never makes a FIRST binding either.
+  // Both are on main (#6850, #6862); #8450 is the narrowing this guarded —
+  // `assertAdmittedStripeKey` below. This export itself stays sandbox-only.
   assertSandboxKey,
   createAdHocPrice,
   createBillingPortalSession,
@@ -60,6 +67,89 @@ export type {
   StripeWebhookEvent,
 } from "@working-theory/stripe-client";
 
+/**
+ * apps/api's live-key admission (#8450 D2 — D-68's apps/api leg, the half
+ * #6881 left unbuilt). Composed at runtime so this file's own text never
+ * trips the repo-wide live-key lint.
+ */
+const LIVE_RESTRICTED_KEY_PREFIX = ["rk", "live", ""].join("_");
+
+let liveKeyAdmitted = false;
+
+/**
+ * `VERCEL_ENV` when set, else `NODE_ENV` — packages/spoke-checkout's own
+ * rule, with one fail-closed delta (PR #8470 security review R-1): on Vercel
+ * (`VERCEL` set) a missing `VERCEL_ENV` is not production, because
+ * `vercel.json` sets `NODE_ENV=production` in every environment, Preview
+ * included.
+ */
+function isProductionBuild(): boolean {
+  if (process.env.VERCEL_ENV !== undefined) {
+    return process.env.VERCEL_ENV === "production";
+  }
+  if (process.env.VERCEL !== undefined) return false;
+  return process.env.NODE_ENV === "production";
+}
+
+/**
+ * Admit this process's Stripe key at server build, or throw
+ * `StripeConfigError` (#8450 D2). Called once, by `server.ts`'s `build()`,
+ * and nowhere else.
+ *
+ * Only a restricted live key, beside `STRIPE_MODE=live`, on a production
+ * build is admitted: the package's one-way flag is set and `"live"` comes
+ * back. `STRIPE_MODE` unset or `test` is today's boot — `assertSandboxKey`,
+ * its message unchanged — and returns `"test"`. Every other combination
+ * throws. It takes no parameter and reads `process.env` only, so it vouches
+ * for the same key `getStripeClient()` later reads. No message names any
+ * part of the key.
+ */
+export function admitApiStripeKey(): "test" | "live" {
+  const mode = process.env.STRIPE_MODE;
+  const key = process.env.STRIPE_SECRET_KEY ?? "";
+
+  if (mode !== undefined && mode !== "test" && mode !== "live") {
+    throw new StripeConfigError('STRIPE_MODE must be "test" or "live".');
+  }
+  if (mode === "live") {
+    if (!key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) {
+      throw new StripeConfigError(
+        "STRIPE_MODE=live needs a restricted live Stripe key. " +
+          "Unrestricted, publishable and test-mode keys are refused.",
+      );
+    }
+    if (!isProductionBuild()) {
+      throw new StripeConfigError(
+        "A restricted live Stripe key is admitted only with STRIPE_MODE=live on a production build " +
+          "(VERCEL_ENV=production, or NODE_ENV=production off Vercel).",
+      );
+    }
+    admitLiveRestrictedKey();
+    liveKeyAdmitted = true;
+    return "live";
+  }
+  assertSandboxKey(key);
+  return "test";
+}
+
+/**
+ * The request-time key check for the routes that may run live (#8450 D3):
+ * the member portal session and the checkout start and read. It returns
+ * before the sandbox-only guard for the restricted live class alone, and
+ * only once `admitApiStripeKey()` admitted it; every other key meets
+ * `assertSandboxKey`'s allow-list, so an unrestricted or publishable live
+ * key is refused whether or not the process admitted.
+ */
+export function assertAdmittedStripeKey(key: string): void {
+  if (liveKeyAdmitted && key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) return;
+  assertSandboxKey(key);
+}
+
+/** The key class this process admitted at boot: `"live"` only after `admitApiStripeKey()` did. */
+export function stripeKeyMode(): "test" | "live" {
+  return liveKeyAdmitted ? "live" : "test";
+}
+
 /**
  * Expire a Checkout Session (#4912 FR7/D7).
  *
@@ -67,9 +157,92 @@ export type {
  * session already exists, its id never reached the `FlowCheckout` row, and
  * nothing will ever join the two — so the session is closed rather than left
  * live and payable (#4863). Built on the already-re-exported
- * `getStripeClient`, whose construction asserts the `sk_test_` allow-list, so
- * this call inherits the test-mode gate like every other Stripe call here.
+ * `getStripeClient`, whose construction asserts its key allow-list, so this
+ * call inherits the same gate as every other Stripe call here (test-mode, or
+ * the restricted live key once `admitApiStripeKey()` admitted it, #8450).
  */
 export async function expireCheckoutSession(stripeSessionId: string): Promise<void> {
   await getStripeClient().checkout.sessions.expire(stripeSessionId);
 }
+
+/** #8171 D7 — what the Billing page shows: the plan's name and the card on file. */
+export type CustomerBillingSummary = {
+  planName: string | null;
+  paymentMethod: { brand: string; last4: string; expMonth: number; expYear: number } | null;
+};
+
+/** A subscription status that still names the customer's plan (#8171 C10). */
+const CURRENT_SUBSCRIPTION_STATUSES = new Set(["active", "trialing", "past_due", "unpaid"]);
+const PLAN_NAME_MAX = 200;
+
+/**
+ * Read one customer's plan name and card summary (#8171 D7, C10): the newest
+ * subscription that is `active`, `trialing`, `past_due` or `unpaid`; its
+ * first item's product name (else the price nickname); and its default
+ * payment method (else the customer's invoice default). At most three reads,
+ * no expand path deeper than three levels (SEC-8171-3). Built on
+ * `getStripeClient`, so it inherits its allow-list: a missing key, or a live
+ * key this process did not admit (#8450), throws `StripeConfigError`. It logs
+ * nothing and returns no id.
+ */
+export async function readCustomerBillingSummary(
+  customerId: string,
+): Promise<CustomerBillingSummary> {
+  const stripe = getStripeClient();
+  const subscriptions = await stripe.subscriptions.list({
+    customer: customerId,
+    status: "all",
+    limit: 10,
+    expand: ["data.default_payment_method"],
+  });
+  const current = subscriptions.data
+    .filter((sub) => CURRENT_SUBSCRIPTION_STATUSES.has(sub.status))
+    .sort((a, b) => b.created - a.created)[0];
+
+  let planName: string | null = null;
+  const price = current?.items.data[0]?.price;
+  if (price) {
+    let name: string | null = null;
+    if (typeof price.product === "string") {
+      const product = await stripe.products.retrieve(price.product);
+      name = product.name;
+    } else if (price.product && !("deleted" in price.product && price.product.deleted)) {
+      name = (price.product as { name?: string }).name ?? null;
+    }
+    const trimmed = (name ?? price.nickname ?? "").trim().slice(0, PLAN_NAME_MAX);
+    planName = trimmed === "" ? null : trimmed;
+  }
+
+  let method: unknown = current?.default_payment_method ?? null;
+  if (cardOf(method) === null) {
+    const customer = await stripe.customers.retrieve(customerId, {
+      expand: ["invoice_settings.default_payment_method"],
+    });
+    method = "deleted" in customer && customer.deleted
+      ? null
+      : (customer as { invoice_settings?: { default_payment_method?: unknown } }).invoice_settings
+          ?.default_payment_method ?? null;
+  }
+
+  return { planName, paymentMethod: cardOf(method) };
+}
+
+/** A `card` payment method's presentation fields, or `null` for anything else. */
+function cardOf(method: unknown): CustomerBillingSummary["paymentMethod"] {
+  if (typeof method !== "object" || method === null) return null;
+  const { type, card } = method as {
+    type?: unknown;
+    card?: { brand?: unknown; last4?: unknown; exp_month?: unknown; exp_year?: unknown };
+  };
+  if (type !== "card" || !card) return null;
+  const { brand, last4, exp_month: expMonth, exp_year: expYear } = card;
+  if (
+    typeof brand !== "string" ||
+    typeof last4 !== "string" ||
+    typeof expMonth !== "number" ||
+    typeof expYear !== "number"
+  ) {
+    return null;
+  }
+  return { brand, last4, expMonth, expYear };
+}

package/templates/apps/api/src/middleware/__tests__/auth.hub-session-path.test.ts

@@ -5,12 +5,14 @@
  * docs/specs/7894-the-hub-signs-in-its-spec.md D6; AC-4, AC-5, AC-7).
  *
  * A bearer starting `ailk_hst_` is admitted only beside the SAME spoke's key,
- * only while its grant is live and its person verified, and only on the four
- * routes of `HUB_SESSION_ROUTES`. Any other route answers 404 with no handler
- * run (the status `lib/account-config.ts`'s `read()` already loads as "nothing
- * for this caller"), never 403.
+ * only while its grant is live and its person verified, and only on the 20
+ * routes of `HUB_SESSION_ROUTES` (#8220 D1, AC-1). Any other route answers 404
+ * with no handler run (the status `lib/account-config.ts`'s `read()` already
+ * loads as "nothing for this caller"), never 403. Each (person, spoke) is
+ * limited to 60 requests and 10 writes a minute and 30 writes an hour,
+ * charged only after admission (#8220 D2, AC-7).
  *
- * Stub routes stand in for #7877's three member reads, which are unmerged; each
+ * Recording stubs stand in for every admitted and every off-list route; each
  * one records that its handler ran, so "404 with no handler run" is asserted,
  * not assumed.
  *
@@ -34,7 +36,11 @@ import {
 } from "../../__tests__/support/hub-sign-in-fake-db.js";
 import { mintCredential, sha256Hex } from "../../lib/hub-sign-in-store.js";
 import { prisma } from "../../lib/prisma.js";
-import { authPreHandlerPlugin, HUB_SESSION_ROUTES } from "../auth.js";
+import {
+  __resetHubSessionRateBuckets,
+  authPreHandlerPlugin,
+  HUB_SESSION_ROUTES,
+} from "../auth.js";
 
 const db = jest.mocked(prisma);
 
@@ -47,6 +53,61 @@ let spokeA: SeededSpoke;
 let spokeB: SeededSpoke;
 let handlerRuns: string[];
 
+/** D1's 18 strings plus #8435's two contact routes and #8438's two consents routes (22), in the list's order. */
+const ADMITTED = [
+  "GET /v1/hub-sign-in/me",
+  "GET /v1/member/pieces",
+  "GET /v1/member/messages",
+  "GET /v1/member/messages/:id/file",
+  "GET /v1/member/purchases",
+  "GET /v1/member/appointments",
+  "GET /v1/member/artifacts",
+  "GET /v1/member/artifacts/:pieceId/versions/:version/file",
+  "GET /v1/member/meeting-types",
+  "GET /v1/member/availability",
+  "GET /v1/member/request-form",
+  "GET /v1/member/billing",
+  "POST /v1/member/artifacts/:pieceId/review",
+  "POST /v1/member/bookings",
+  "POST /v1/member/requests",
+  "POST /v1/member/messages",
+  "PATCH /v1/member/profile",
+  "GET /v1/member/profile/contact",
+  "PATCH /v1/member/profile/contact",
+  "POST /v1/member/deletion-request",
+  "GET /v1/member/consents",
+  "POST /v1/member/consents",
+];
+
+/** Every route the credential must NOT reach, each a recording stub. */
+const OFF_LIST = [
+  "GET /v1/consent/platform",
+  "POST /v1/consent/platform",
+  "GET /v1/member/other",
+  "GET /v1/member/messages/:id",
+  "GET /v1/waitlist-signups/me",
+  "GET /v1/flow-checkouts/me",
+  "GET /v1/subscription/me",
+  "POST /v1/subscription/portal-session",
+  "GET /v1/auth/tokens",
+  "PATCH /v1/user/profile",
+  "POST /v1/hub-sign-in/codes",
+  // D7's near misses — one method or one segment from an admitted entry.
+  "GET /v1/member/requests",
+  "GET /v1/member/profile",
+  "POST /v1/member/purchases",
+  "DELETE /v1/member/profile",
+  "GET /v1/member/artifacts/:pieceId",
+  "PUT /v1/member/messages",
+];
+
+/** A registered URL with each `:param` filled in. */
+const concrete = (url: string) =>
+  url
+    .replace(":pieceId", "piece_1")
+    .replace(":version", "1")
+    .replace(":id", "lead_1");
+
 /** A live credential for (user, spoke), stored the way the token route stores it. */
 function grant(
   s: SeededSpoke,
@@ -89,22 +150,10 @@ function buildApp(): FastifyInstance {
       };
     };
 
-  // The four admitted routes (the member reads are stubs).
-  server.get("/v1/hub-sign-in/me", echo("me"));
-  server.get("/v1/member/pieces", echo("pieces"));
-  server.get("/v1/member/messages", echo("messages"));
-  server.get("/v1/member/messages/:id/file", echo("file"));
-
-  // Everything else the credential must NOT reach.
-  server.get("/v1/member/other", echo("other"));
-  server.get("/v1/member/messages/:id", echo("message-item"));
-  server.get("/v1/waitlist-signups/me", echo("waitlist-signups"));
-  server.get("/v1/flow-checkouts/me", echo("flow-checkouts"));
-  server.get("/v1/subscription/me", echo("subscription"));
-  server.post("/v1/subscription/portal-session", echo("portal"));
-  server.get("/v1/auth/tokens", echo("tokens"));
-  server.patch("/v1/user/profile", echo("profile"));
-  server.post("/v1/hub-sign-in/codes", echo("codes"));
+  for (const route of [...ADMITTED, ...OFF_LIST]) {
+    const [method, url] = route.split(" ") as [string, string];
+    server.route({ method: method as "GET", url, handler: echo(route) });
+  }
   return server;
 }
 
@@ -112,6 +161,7 @@ beforeEach(async () => {
   jest.resetAllMocks();
   state = installHubSignInFakeDb(db);
   handlerRuns = [];
+  __resetHubSessionRateBuckets();
   user = seedUser(state);
   spokeA = seedSpoke(state, "a.example.com");
   spokeB = seedSpoke(state, "b.example.com");
@@ -124,35 +174,36 @@ afterEach(async () => {
 });
 
 describe("HUB_SESSION_ROUTES", () => {
-  it("is exactly the four reads, by method and registered URL — never a prefix", () => {
-    expect([...HUB_SESSION_ROUTES]).toEqual([
-      "GET /v1/hub-sign-in/me",
-      "GET /v1/member/pieces",
-      "GET /v1/member/messages",
-      "GET /v1/member/messages/:id/file",
-    ]);
+  it("is exactly the 20 entries, by method and registered URL — never a prefix (AC-1)", () => {
+    expect([...HUB_SESSION_ROUTES]).toEqual(ADMITTED);
+    expect(HUB_SESSION_ROUTES.length).toBe(22);
+    for (const route of HUB_SESSION_ROUTES) {
+      expect({
+        route,
+        open: route.endsWith("/") || route.includes("*"),
+      }).toEqual({
+        route,
+        open: false,
+      });
+    }
   });
 });
 
 describe("hub credential — admitted routes", () => {
-  it.each([
-    ["GET", "/v1/hub-sign-in/me", "me"],
-    ["GET", "/v1/member/pieces", "pieces"],
-    ["GET", "/v1/member/messages", "messages"],
-    ["GET", "/v1/member/messages/lead_1/file", "file"],
-  ])(
-    "%s %s is admitted as the credential's person, bound to the spoke",
-    async (method, url, name) => {
+  it.each(ADMITTED)(
+    "%s is admitted as the credential's person, bound to the spoke",
+    async (route) => {
+      const [method, url] = route.split(" ") as [string, string];
       const credential = grant(spokeA);
 
       const res = await app.inject({
         method: method as "GET",
-        url,
+        url: concrete(url),
         headers: headers(credential),
       });
 
       expect(res.statusCode).toBe(200);
-      expect(handlerRuns).toEqual([name]);
+      expect(handlerRuns).toEqual([route]);
       const body = res.json();
       expect(body.userId).toBe(user.id);
       expect(body.hubSession).toEqual({
@@ -194,6 +245,28 @@ describe("hub credential — every other route is 404 with no handler run (AC-7)
     expect(handlerRuns).toEqual([]);
   });
 
+  it.each(
+    OFF_LIST.slice(-6).map((route) => route.split(" ") as [string, string]),
+  )(
+    "the registered near miss %s %s is still the preHandler's 404 (#8220 D7)",
+    async (method, url) => {
+      const credential = grant(spokeA);
+
+      const res = await app.inject({
+        method: method as "GET",
+        url: concrete(url),
+        headers: headers(credential),
+      });
+
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({
+        ok: false,
+        error: { code: "not_found", message: "Not found" },
+      });
+      expect(handlerRuns).toEqual([]);
+    },
+  );
+
   it("the list is method-exact: HEAD on an admitted URL is not admitted", async () => {
     const credential = grant(spokeA);
     const res = await app.inject({
@@ -308,3 +381,163 @@ describe("hub credential — it is a bearer and nothing else", () => {
     expect(res.body).not.toContain(credential);
   });
 });
+
+// ─── #8220 D2 — the per-(person, spoke) budget (AC-7) ───────────────────────
+
+describe("hub credential — the per-person budget at each spoke (#8220 D2, AC-7)", () => {
+  const T0 = Date.UTC(2026, 9, 11, 12, 0, 0);
+  let now: number;
+  let clock: jest.SpyInstance<number, []>;
+
+  beforeEach(() => {
+    now = T0;
+    clock = jest.spyOn(Date, "now").mockImplementation(() => now);
+  });
+
+  afterEach(() => {
+    clock.mockRestore();
+  });
+
+  const read = (credential: string, s: SeededSpoke = spokeA) =>
+    app.inject({
+      method: "GET",
+      url: "/v1/member/pieces",
+      headers: headers(credential, s),
+    });
+  const write = (credential: string, s: SeededSpoke = spokeA) =>
+    app.inject({
+      method: "POST",
+      url: "/v1/member/messages",
+      headers: headers(credential, s),
+    });
+
+  async function times(
+    n: number,
+    send: () => ReturnType<typeof read>,
+  ): Promise<number[]> {
+    const statuses: number[] = [];
+    for (let i = 0; i < n; i += 1) statuses.push((await send()).statusCode);
+    return statuses;
+  }
+
+  it("a person's 61st admitted request at one spoke in one minute is 429 with Retry-After and the rate_limited body, no handler run", async () => {
+    const credential = grant(spokeA);
+    expect(new Set(await times(60, () => read(credential)))).toEqual(
+      new Set([200]),
+    );
+    handlerRuns = [];
+    now += 15_000;
+
+    const res = await read(credential);
+
+    expect(res.statusCode).toBe(429);
+    expect(res.headers["retry-after"]).toBe("45");
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "rate_limited", message: "Too many requests" },
+    });
+    expect(handlerRuns).toEqual([]);
+  });
+
+  it("another person at the same spoke, and the same person at another spoke, are admitted in that minute (SEC-8220-4)", async () => {
+    const credential = grant(spokeA);
+    await times(60, () => read(credential));
+    expect((await read(credential)).statusCode).toBe(429);
+
+    const other = seedUser(state);
+    expect((await read(grant(spokeA, { userId: other.id }))).statusCode).toBe(
+      200,
+    );
+    expect((await read(grant(spokeB), spokeB)).statusCode).toBe(200);
+    // The spent bucket opens again when its minute ends.
+    now += 60_000;
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("the 11th write in a minute is 429; after it a read is admitted and a 12th write is 429", async () => {
+    const credential = grant(spokeA);
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+
+    const eleventh = await write(credential);
+    expect(eleventh.statusCode).toBe(429);
+    expect(Number(eleventh.headers["retry-after"])).toBeGreaterThanOrEqual(1);
+    expect((await read(credential)).statusCode).toBe(200);
+    expect((await write(credential)).statusCode).toBe(429);
+  });
+
+  it("a refused request is not counted: after 10 admitted and 50 refused writes, a read is admitted", async () => {
+    const credential = grant(spokeA);
+    await times(10, () => write(credential));
+    expect(new Set(await times(50, () => write(credential)))).toEqual(
+      new Set([429]),
+    );
+
+    // A counted refusal would make this the 61st request of the minute.
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("writes refused by the minute ceiling do not advance the hourly count; the 31st write in an hour is 429 and a read after it is admitted", async () => {
+    const credential = grant(spokeA, {
+      expiresAt: new Date(T0 + 24 * 3_600_000),
+    });
+    // Minute 0: 10 admitted, 20 refused by the minute ceiling.
+    expect(await times(30, () => write(credential))).toEqual([
+      ...Array<number>(10).fill(200),
+      ...Array<number>(20).fill(429),
+    ]);
+    // Minutes 1 and 2: 10 admitted each — 30 admitted in the hour.
+    now += 60_000;
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+    now += 60_000;
+    expect(new Set(await times(10, () => write(credential)))).toEqual(
+      new Set([200]),
+    );
+
+    // Minute 3: the 31st admitted write would pass the minute's ceiling, but
+    // not the hour's — Retry-After is the hour's end, 57 minutes away.
+    now += 60_000;
+    const thirtyFirst = await write(credential);
+    expect(thirtyFirst.statusCode).toBe(429);
+    expect(thirtyFirst.headers["retry-after"]).toBe(String(57 * 60));
+    expect((await read(credential)).statusCode).toBe(200);
+
+    // The hour ends: writes are admitted again.
+    now = T0 + 60 * 60_000;
+    expect((await write(credential)).statusCode).toBe(200);
+  });
+
+  it("100 off-list or refused-credential requests leave the next admitted request admitted — no bucket before admission", async () => {
+    const credential = grant(spokeA);
+    // 70 off-list requests with the person's own live credential: charged
+    // before the route check, they alone would spend the minute's 60.
+    for (let i = 0; i < 70; i += 1) {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/subscription/me",
+        headers: headers(credential),
+      });
+      expect(res.statusCode).toBe(404);
+    }
+    for (let i = 0; i < 30; i += 1) {
+      expect((await read(mintCredential())).statusCode).toBe(401);
+    }
+    expect(handlerRuns).toEqual([]);
+
+    expect((await read(credential)).statusCode).toBe(200);
+  });
+
+  it("GET /v1/hub-sign-in/me is an admitted route and is charged like the rest", async () => {
+    const credential = grant(spokeA);
+    await times(60, () => read(credential));
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/hub-sign-in/me",
+      headers: headers(credential),
+    });
+    expect(res.statusCode).toBe(429);
+  });
+});

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -836,10 +836,61 @@ describe("per-visitor forwarding, scope namespace and per-scope env limit (#7394
         { method: "POST", url: "/v1/leads/callback" },
         { method: "GET", url: AVAILABILITY },
         { method: "POST", url: BOOK },
+        { method: "POST", url: "/v1/consent/cookie" },
+        { method: "POST", url: "/v1/consent/unsubscribe" },
       ]);
     });
   });
 
+  // #8438 D5/D9 — the cookie banner's log and the unsubscribe landing. Each
+  // is registered in its OWN scope (`consent`, `unsubscribe`), exactly as
+  // server.ts does, and both are on the forwarded-visitor list.
+  describe("the consent routes count each keyed visitor separately, in scopes of their own (#8438)", () => {
+    const COOKIE = "/v1/consent/cookie";
+    const UNSUBSCRIBE = "/v1/consent/unsubscribe";
+
+    function consentApp(): FastifyInstance {
+      const instance = Fastify({ trustProxy: true });
+      for (const [scope, url] of [
+        ["consent", COOKIE],
+        ["unsubscribe", UNSUBSCRIBE],
+      ] as const) {
+        instance.register(async (scoped) => {
+          scoped.register(rateLimitMiddleware, {
+            scope,
+            perIpPerMinute: 10,
+            trustedKeyDigests: digests(),
+          });
+          scoped.post(url, async () => ({ ok: true }));
+        });
+      }
+      return instance;
+    }
+
+    async function post(url: string, headers: Record<string, string>): Promise<number> {
+      if (!app) throw new Error("no app");
+      return (await app.inject({ method: "POST", url, headers })).statusCode;
+    }
+
+    it.each([COOKIE, UNSUBSCRIBE])("%s: two visitors behind one site key are counted separately", async (url) => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) {
+        expect(await post(url, keyed("203.0.113.1"))).toBe(200);
+      }
+      expect(await post(url, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(url, keyed("203.0.113.2"))).toBe(200);
+    });
+
+    it("an exhausted consent bucket leaves unsubscribe answering", async () => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) await post(COOKIE, keyed("203.0.113.1"));
+      expect(await post(COOKIE, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(UNSUBSCRIBE, keyed("203.0.113.1"))).toBe(200);
+    });
+  });
+
   describe("AC-5 — visitor IP validation and normalisation", () => {
     function identityApp(): FastifyInstance {
       const instance = Fastify({ trustProxy: true });