create-ailk 0.19.0 → 0.19.1

package/templates/apps/api/src/lib/consent-store.ts

@@ -0,0 +1,335 @@
+/**
+ * The consent ledger's read boundary (#8438, spec
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md D4).
+ *
+ * `consent_grants` is append-only and a Person's current state is the newest
+ * row per purpose, so every reader here asks the database for exactly that.
+ * Nothing is read through a window: `DISTINCT ON (purpose_id) … ORDER BY
+ * purpose_id, created_at DESC, id DESC` is one indexed pass over ALL the
+ * matching rows, so no number of other rows can push an answer out
+ * (SEC-8438-2).
+ *
+ * TWO READINGS of a Person's rows (SEC-8438-1). A Person is keyed on an email
+ * anyone can type into a form, so a row an anonymous writer attached to it
+ * proves nothing about what the person themself chose:
+ *
+ *   - OWN rows: `person_id = P` and a source only a verified caller or a
+ *     signed link sent to the person can write — `sign_up`,
+ *     `account_settings`, `email_unsubscribe` (`OWN_CONSENT_SOURCES`). The
+ *     member's screens, the sign-up prompt, and every future send read only
+ *     these.
+ *   - ANY-SOURCE rows: every row with `person_id = P`, plus the cookie rows
+ *     of every visitor linked to P. The operator's Person page reads these,
+ *     marked `unverified` when the source proves nothing.
+ *
+ * Every query takes an explicit `workspaceId`, and a join to a linked
+ * visitor's rows matches `workspace_id` on both tables (SEC-8438-11) — a
+ * visitor id is client-chosen and not namespaced, so another tenant's rows
+ * under the same id must never join.
+ *
+ * This file is the ONLY non-test reader of `consent_grants` and
+ * `consent_visitor_links` (`architecture.yaml` names it as a data-access
+ * boundary, the kind `member-store.ts` is). The writes are
+ * `services/consent.ts`. Logs carry nothing: no email, visitor id, token or
+ * statement.
+ */
+import type { Prisma } from "@working-theory/database";
+import {
+  consentPurposeKind,
+  type ConsentPurposeKind,
+  type ConsentSource,
+  type SiteConsentConfig,
+} from "@working-theory/validation";
+
+import { prisma } from "./prisma.js";
+
+/** What every reader needs of a client: raw reads only. */
+export type ConsentReadClient = Pick<Prisma.TransactionClient, "$queryRaw">;
+
+/**
+ * The sources only a verified caller or a signed link can write (D4,
+ * SEC-8438-1). The SQL below names the same three literals; the store's test
+ * asserts the two agree.
+ */
+export const OWN_CONSENT_SOURCES = [
+  "sign_up",
+  "account_settings",
+  "email_unsubscribe",
+] as const satisfies readonly ConsentSource[];
+
+/** The sources whose rows prove nothing the client confirmed themself. */
+const UNVERIFIED_SOURCES: ReadonlySet<ConsentSource> = new Set([
+  "magnet",
+  "api",
+  "cookie_banner",
+  "legacy",
+]);
+
+/** Whether a row from `source` is unconfirmed by the client (D4). */
+export function isUnverifiedSource(source: ConsentSource): boolean {
+  return UNVERIFIED_SOURCES.has(source);
+}
+
+/** A history page's size (D7). */
+export const CONSENT_HISTORY_PAGE_SIZE = 500;
+
+/** The most platform rows one user can have in view (D4). */
+const PLATFORM_ROWS_MAX = 100;
+
+/** The newest ledger row for one purpose, as the readers serve it. */
+export interface ConsentStateRow {
+  id: string;
+  purposeId: string;
+  granted: boolean;
+  at: Date;
+  source: ConsentSource;
+  sourceRef: string | null;
+  policyVersion: number | null;
+}
+
+export interface ConsentHistoryRow extends ConsentStateRow {
+  locale: string;
+  statement: string;
+  subjectType: string;
+}
+
+/** A registry purpose with the newest row read for it and what that means now. */
+export interface PurposeConsentState {
+  purposeId: string;
+  kind: ConsentPurposeKind;
+  row: ConsentStateRow | null;
+  /** Granted now: the row's answer, else on for a preference and off otherwise. */
+  effective: boolean;
+}
+
+/** The effective answer for a purpose given its newest row (D4). */
+export function effectiveConsent(
+  kind: ConsentPurposeKind,
+  row: { granted: boolean } | null,
+): boolean {
+  if (row !== null) return row.granted;
+  return kind === "preference";
+}
+
+/** Fold the newest row per purpose id into the registry's purposes. */
+export function foldRowsIntoPurposes(
+  config: SiteConsentConfig,
+  rows: readonly ConsentStateRow[],
+): PurposeConsentState[] {
+  const byPurpose = new Map(rows.map((row) => [row.purposeId, row]));
+  return config.purposes.map((purpose) => {
+    const kind = consentPurposeKind(purpose);
+    const row = byPurpose.get(purpose.id) ?? null;
+    return {
+      purposeId: purpose.id,
+      kind,
+      row,
+      effective: effectiveConsent(kind, row),
+    };
+  });
+}
+
+/**
+ * The newest OWN row per purpose id for a Person, unfolded (D4): one indexed
+ * `DISTINCT ON` pass over all own rows, never a window.
+ */
+export async function ownConsentRows(
+  workspaceId: string,
+  personId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."person_id" = ${personId}
+      AND g."source" IN ('sign_up', 'account_settings', 'email_unsubscribe')
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
+}
+
+/**
+ * The newest ANY-SOURCE row per purpose id for a Person: `person_id = P` or a
+ * cookie row of a visitor linked to P, in this workspace on both tables.
+ * Includes purposes the registry no longer declares — the operator still sees
+ * what was recorded.
+ */
+export async function anySourceConsentRows(
+  workspaceId: string,
+  personId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND (
+        g."person_id" = ${personId}
+        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+          SELECT l."visitor_id" FROM "consent_visitor_links" l
+          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+        ))
+      )
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC`;
+}
+
+/**
+ * A Person's OWN reading, per registry purpose (D4). The member's screens and
+ * the sign-up prompt read only this.
+ */
+export async function ownConsentState(
+  workspaceId: string,
+  personId: string,
+  config: SiteConsentConfig,
+  db: ConsentReadClient = prisma,
+): Promise<PurposeConsentState[]> {
+  return foldRowsIntoPurposes(
+    config,
+    await ownConsentRows(workspaceId, personId, db),
+  );
+}
+
+/**
+ * A Person's ANY-SOURCE reading, per registry purpose. The operator's Person
+ * page and the unsubscribe dedupe read it; a row here is never a member's own
+ * answer (D4).
+ */
+export async function anySourceConsentState(
+  workspaceId: string,
+  personId: string,
+  config: SiteConsentConfig,
+  db: ConsentReadClient = prisma,
+): Promise<PurposeConsentState[]> {
+  return foldRowsIntoPurposes(
+    config,
+    await anySourceConsentRows(workspaceId, personId, db),
+  );
+}
+
+/** One page of a Person's any-source history, newest first. */
+export interface ConsentHistoryPage {
+  rows: ConsentHistoryRow[];
+  /** The id of the page's last row when another page follows, else `null`. */
+  nextCursor: string | null;
+}
+
+/**
+ * A Person's any-source history, 500 rows a page, newest first, keyed by
+ * `(created_at, id)`. Every page is complete: nothing is truncated (D7).
+ * Returns `"invalid_cursor"` for a cursor that is not one of this Person's
+ * rows — checked inside the Person's own scope, so a row id of another
+ * Person or workspace reads exactly like an unknown one.
+ */
+export async function personConsentHistory(
+  workspaceId: string,
+  personId: string,
+  cursor: string | undefined,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentHistoryPage | "invalid_cursor"> {
+  if (cursor !== undefined) {
+    const found = await db.$queryRaw<Array<{ id: string }>>`
+      SELECT g."id" FROM "consent_grants" g
+      WHERE g."workspace_id" = ${workspaceId}
+        AND g."id" = ${cursor}
+        AND (
+          g."person_id" = ${personId}
+          OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+            SELECT l."visitor_id" FROM "consent_visitor_links" l
+            WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+          ))
+        )
+      LIMIT 1`;
+    if (found.length === 0) return "invalid_cursor";
+  }
+  const cursorId = cursor ?? null;
+  const rows = await db.$queryRaw<ConsentHistoryRow[]>`
+    SELECT g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion",
+      g."locale", g."statement", g."subject_type" AS "subjectType"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND (
+        g."person_id" = ${personId}
+        OR (g."subject_type" = 'visitor' AND g."subject_id" IN (
+          SELECT l."visitor_id" FROM "consent_visitor_links" l
+          WHERE l."workspace_id" = ${workspaceId} AND l."person_id" = ${personId}
+        ))
+      )
+      AND (${cursorId}::text IS NULL OR (g."created_at", g."id") < (
+        SELECT c."created_at", c."id" FROM "consent_grants" c WHERE c."id" = ${cursorId}::text
+      ))
+    ORDER BY g."created_at" DESC, g."id" DESC
+    LIMIT ${CONSENT_HISTORY_PAGE_SIZE + 1}`;
+  const page = rows.slice(0, CONSENT_HISTORY_PAGE_SIZE);
+  const last = page[page.length - 1];
+  return {
+    rows: page,
+    nextCursor:
+      rows.length > CONSENT_HISTORY_PAGE_SIZE && last ? last.id : null,
+  };
+}
+
+/**
+ * The newest row recording a visitor's choice for one purpose — the cookie
+ * writer's dedupe: each CHANGE of choice is logged, a replay adds nothing
+ * (D3, SEC-8438-2).
+ */
+export async function latestVisitorChoice(
+  workspaceId: string,
+  visitorId: string,
+  purposeId: string,
+  db: ConsentReadClient = prisma,
+): Promise<{ granted: boolean; policyVersion: number | null } | null> {
+  const rows = await db.$queryRaw<
+    Array<{ granted: boolean; policyVersion: number | null }>
+  >`
+    SELECT g."granted", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."subject_type" = 'visitor'
+      AND g."subject_id" = ${visitorId}
+      AND g."purpose_id" = ${purposeId}
+    ORDER BY g."created_at" DESC, g."id" DESC
+    LIMIT 1`;
+  return rows[0] ?? null;
+}
+
+/**
+ * When the caller's own `User` row was created — the sign-up window's only
+ * input (SEC-8438-5: `via: "sign_up"` is honored for a user created within
+ * the last 24 hours). `null` when no such user exists.
+ */
+export async function userCreatedAt(
+  userId: string,
+  db: Pick<Prisma.TransactionClient, "user"> = prisma,
+): Promise<Date | null> {
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    select: { createdAt: true },
+  });
+  return user?.createdAt ?? null;
+}
+
+/**
+ * The owner's rows for the Working Theory platform purposes (C8): subject
+ * `user` / `userId`, newest per purpose, at most 100.
+ */
+export async function userPlatformRows(
+  workspaceId: string,
+  userId: string,
+  db: ConsentReadClient = prisma,
+): Promise<ConsentStateRow[]> {
+  return db.$queryRaw<ConsentStateRow[]>`
+    SELECT DISTINCT ON (g."purpose_id")
+      g."id", g."purpose_id" AS "purposeId", g."granted", g."created_at" AS "at",
+      g."source", g."source_ref" AS "sourceRef", g."policy_version" AS "policyVersion"
+    FROM "consent_grants" g
+    WHERE g."workspace_id" = ${workspaceId}
+      AND g."subject_type" = 'user'
+      AND g."subject_id" = ${userId}
+    ORDER BY g."purpose_id", g."created_at" DESC, g."id" DESC
+    LIMIT ${PLATFORM_ROWS_MAX}`;
+}

package/templates/apps/api/src/lib/stripe.ts

@@ -8,7 +8,12 @@
  * '@working-theory/stripe-client' — single chokepoint for AILK-internal ergonomics
  * (logger context, request-id propagation) without touching every consumer.
  */
-import { getStripeClient } from "@working-theory/stripe-client";
+import {
+  admitLiveRestrictedKey,
+  assertSandboxKey,
+  getStripeClient,
+  StripeConfigError,
+} from "@working-theory/stripe-client";
 
 export {
   // PRECONDITION (#6113): do not narrow or bypass this sandbox-only guard for a
@@ -18,6 +23,8 @@ export {
   // Widened by #6852 (the #6113 follow-up): the same function must bind only
   // on a server-stamped metadata.ailk_user_id — an unverified Checkout email
   // never makes a FIRST binding either.
+  // Both are on main (#6850, #6862); #8450 is the narrowing this guarded —
+  // `assertAdmittedStripeKey` below. This export itself stays sandbox-only.
   assertSandboxKey,
   createAdHocPrice,
   createBillingPortalSession,
@@ -60,6 +67,89 @@ export type {
   StripeWebhookEvent,
 } from "@working-theory/stripe-client";
 
+/**
+ * apps/api's live-key admission (#8450 D2 — D-68's apps/api leg, the half
+ * #6881 left unbuilt). Composed at runtime so this file's own text never
+ * trips the repo-wide live-key lint.
+ */
+const LIVE_RESTRICTED_KEY_PREFIX = ["rk", "live", ""].join("_");
+
+let liveKeyAdmitted = false;
+
+/**
+ * `VERCEL_ENV` when set, else `NODE_ENV` — packages/spoke-checkout's own
+ * rule, with one fail-closed delta (PR #8470 security review R-1): on Vercel
+ * (`VERCEL` set) a missing `VERCEL_ENV` is not production, because
+ * `vercel.json` sets `NODE_ENV=production` in every environment, Preview
+ * included.
+ */
+function isProductionBuild(): boolean {
+  if (process.env.VERCEL_ENV !== undefined) {
+    return process.env.VERCEL_ENV === "production";
+  }
+  if (process.env.VERCEL !== undefined) return false;
+  return process.env.NODE_ENV === "production";
+}
+
+/**
+ * Admit this process's Stripe key at server build, or throw
+ * `StripeConfigError` (#8450 D2). Called once, by `server.ts`'s `build()`,
+ * and nowhere else.
+ *
+ * Only a restricted live key, beside `STRIPE_MODE=live`, on a production
+ * build is admitted: the package's one-way flag is set and `"live"` comes
+ * back. `STRIPE_MODE` unset or `test` is today's boot — `assertSandboxKey`,
+ * its message unchanged — and returns `"test"`. Every other combination
+ * throws. It takes no parameter and reads `process.env` only, so it vouches
+ * for the same key `getStripeClient()` later reads. No message names any
+ * part of the key.
+ */
+export function admitApiStripeKey(): "test" | "live" {
+  const mode = process.env.STRIPE_MODE;
+  const key = process.env.STRIPE_SECRET_KEY ?? "";
+
+  if (mode !== undefined && mode !== "test" && mode !== "live") {
+    throw new StripeConfigError('STRIPE_MODE must be "test" or "live".');
+  }
+  if (mode === "live") {
+    if (!key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) {
+      throw new StripeConfigError(
+        "STRIPE_MODE=live needs a restricted live Stripe key. " +
+          "Unrestricted, publishable and test-mode keys are refused.",
+      );
+    }
+    if (!isProductionBuild()) {
+      throw new StripeConfigError(
+        "A restricted live Stripe key is admitted only with STRIPE_MODE=live on a production build " +
+          "(VERCEL_ENV=production, or NODE_ENV=production off Vercel).",
+      );
+    }
+    admitLiveRestrictedKey();
+    liveKeyAdmitted = true;
+    return "live";
+  }
+  assertSandboxKey(key);
+  return "test";
+}
+
+/**
+ * The request-time key check for the routes that may run live (#8450 D3):
+ * the member portal session and the checkout start and read. It returns
+ * before the sandbox-only guard for the restricted live class alone, and
+ * only once `admitApiStripeKey()` admitted it; every other key meets
+ * `assertSandboxKey`'s allow-list, so an unrestricted or publishable live
+ * key is refused whether or not the process admitted.
+ */
+export function assertAdmittedStripeKey(key: string): void {
+  if (liveKeyAdmitted && key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) return;
+  assertSandboxKey(key);
+}
+
+/** The key class this process admitted at boot: `"live"` only after `admitApiStripeKey()` did. */
+export function stripeKeyMode(): "test" | "live" {
+  return liveKeyAdmitted ? "live" : "test";
+}
+
 /**
  * Expire a Checkout Session (#4912 FR7/D7).
  *
@@ -67,8 +157,9 @@ export type {
  * session already exists, its id never reached the `FlowCheckout` row, and
  * nothing will ever join the two — so the session is closed rather than left
  * live and payable (#4863). Built on the already-re-exported
- * `getStripeClient`, whose construction asserts the `sk_test_` allow-list, so
- * this call inherits the test-mode gate like every other Stripe call here.
+ * `getStripeClient`, whose construction asserts its key allow-list, so this
+ * call inherits the same gate as every other Stripe call here (test-mode, or
+ * the restricted live key once `admitApiStripeKey()` admitted it, #8450).
  */
 export async function expireCheckoutSession(stripeSessionId: string): Promise<void> {
   await getStripeClient().checkout.sessions.expire(stripeSessionId);
@@ -90,8 +181,9 @@ const PLAN_NAME_MAX = 200;
  * first item's product name (else the price nickname); and its default
  * payment method (else the customer's invoice default). At most three reads,
  * no expand path deeper than three levels (SEC-8171-3). Built on
- * `getStripeClient`, so it inherits the `sk_test_` allow-list: a live or
- * missing key throws `StripeConfigError`. It logs nothing and returns no id.
+ * `getStripeClient`, so it inherits its allow-list: a missing key, or a live
+ * key this process did not admit (#8450), throws `StripeConfigError`. It logs
+ * nothing and returns no id.
  */
 export async function readCustomerBillingSummary(
   customerId: string,

package/templates/apps/api/src/middleware/__tests__/auth.hub-session-path.test.ts

@@ -5,7 +5,7 @@
  * docs/specs/7894-the-hub-signs-in-its-spec.md D6; AC-4, AC-5, AC-7).
  *
  * A bearer starting `ailk_hst_` is admitted only beside the SAME spoke's key,
- * only while its grant is live and its person verified, and only on the 18
+ * only while its grant is live and its person verified, and only on the 20
  * routes of `HUB_SESSION_ROUTES` (#8220 D1, AC-1). Any other route answers 404
  * with no handler run (the status `lib/account-config.ts`'s `read()` already
  * loads as "nothing for this caller"), never 403. Each (person, spoke) is
@@ -53,7 +53,7 @@ let spokeA: SeededSpoke;
 let spokeB: SeededSpoke;
 let handlerRuns: string[];
 
-/** D1's 18 strings, in the list's order. */
+/** D1's 18 strings plus #8435's two contact routes and #8438's two consents routes (22), in the list's order. */
 const ADMITTED = [
   "GET /v1/hub-sign-in/me",
   "GET /v1/member/pieces",
@@ -72,11 +72,17 @@ const ADMITTED = [
   "POST /v1/member/requests",
   "POST /v1/member/messages",
   "PATCH /v1/member/profile",
+  "GET /v1/member/profile/contact",
+  "PATCH /v1/member/profile/contact",
   "POST /v1/member/deletion-request",
+  "GET /v1/member/consents",
+  "POST /v1/member/consents",
 ];
 
 /** Every route the credential must NOT reach, each a recording stub. */
 const OFF_LIST = [
+  "GET /v1/consent/platform",
+  "POST /v1/consent/platform",
   "GET /v1/member/other",
   "GET /v1/member/messages/:id",
   "GET /v1/waitlist-signups/me",
@@ -168,9 +174,9 @@ afterEach(async () => {
 });
 
 describe("HUB_SESSION_ROUTES", () => {
-  it("is exactly the 18 entries, by method and registered URL — never a prefix (AC-1)", () => {
+  it("is exactly the 20 entries, by method and registered URL — never a prefix (AC-1)", () => {
     expect([...HUB_SESSION_ROUTES]).toEqual(ADMITTED);
-    expect(HUB_SESSION_ROUTES.length).toBe(18);
+    expect(HUB_SESSION_ROUTES.length).toBe(22);
     for (const route of HUB_SESSION_ROUTES) {
       expect({
         route,

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -836,10 +836,61 @@ describe("per-visitor forwarding, scope namespace and per-scope env limit (#7394
         { method: "POST", url: "/v1/leads/callback" },
         { method: "GET", url: AVAILABILITY },
         { method: "POST", url: BOOK },
+        { method: "POST", url: "/v1/consent/cookie" },
+        { method: "POST", url: "/v1/consent/unsubscribe" },
       ]);
     });
   });
 
+  // #8438 D5/D9 — the cookie banner's log and the unsubscribe landing. Each
+  // is registered in its OWN scope (`consent`, `unsubscribe`), exactly as
+  // server.ts does, and both are on the forwarded-visitor list.
+  describe("the consent routes count each keyed visitor separately, in scopes of their own (#8438)", () => {
+    const COOKIE = "/v1/consent/cookie";
+    const UNSUBSCRIBE = "/v1/consent/unsubscribe";
+
+    function consentApp(): FastifyInstance {
+      const instance = Fastify({ trustProxy: true });
+      for (const [scope, url] of [
+        ["consent", COOKIE],
+        ["unsubscribe", UNSUBSCRIBE],
+      ] as const) {
+        instance.register(async (scoped) => {
+          scoped.register(rateLimitMiddleware, {
+            scope,
+            perIpPerMinute: 10,
+            trustedKeyDigests: digests(),
+          });
+          scoped.post(url, async () => ({ ok: true }));
+        });
+      }
+      return instance;
+    }
+
+    async function post(url: string, headers: Record<string, string>): Promise<number> {
+      if (!app) throw new Error("no app");
+      return (await app.inject({ method: "POST", url, headers })).statusCode;
+    }
+
+    it.each([COOKIE, UNSUBSCRIBE])("%s: two visitors behind one site key are counted separately", async (url) => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) {
+        expect(await post(url, keyed("203.0.113.1"))).toBe(200);
+      }
+      expect(await post(url, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(url, keyed("203.0.113.2"))).toBe(200);
+    });
+
+    it("an exhausted consent bucket leaves unsubscribe answering", async () => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) await post(COOKIE, keyed("203.0.113.1"));
+      expect(await post(COOKIE, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(UNSUBSCRIBE, keyed("203.0.113.1"))).toBe(200);
+    });
+  });
+
   describe("AC-5 — visitor IP validation and normalisation", () => {
     function identityApp(): FastifyInstance {
       const instance = Fastify({ trustProxy: true });

package/templates/apps/api/src/middleware/auth.ts

@@ -34,7 +34,7 @@
  *      spoke's key (`x-ailk-spoke-key`), only while its grant is unrevoked and
  *      unexpired, its client enabled and its person's email verified, and only
  *      on `HUB_SESSION_ROUTES` — an exact list of METHOD + registered URL
- *      pairs — the credential's own `me` and the member routes, 18 in all
+ *      pairs — the credential's own `me` and the member routes, 20 in all
  *      (#8220); any other route is 404 (never 403, so the account area's
  *      `read()` loads "nothing for this caller"). It acts as its person
  *      (`request.userId`) and carries `request.hubSession` — never
@@ -153,9 +153,11 @@ export type HubSession = {
  * The only routes a hub-issued credential reaches (#7894 D6, #8220 D1): an
  * EXACT list of method + registered URL, never a prefix and never computed,
  * so a route added later joins only by a reviewed edit of this list
- * (SEC-7894-3). Three groups, in this order: the credential's own `me` and
+ * (SEC-7894-3). Four groups, in this order: the credential's own `me` and
  * #7877's three member reads; #8169's eight member reads; #8170's six member
- * writes (roadmap §7.2 row order). The member profile write IS admitted — it
+ * writes (roadmap §7.2 row order); #8438's member consents read and write.
+ * `GET /v1/consent/platform` is not admitted — it is the Admin owner's own
+ * consent to Working Theory, on the hub's cookie session. The member profile write IS admitted — it
  * is the person's own account, which roadmap D9 saves through it. Not
  * admitted, deliberately: `GET /v1/waitlist-signups/me`,
  * `GET /v1/flow-checkouts/me`, `GET /v1/subscription/me` and
@@ -181,7 +183,13 @@ export const HUB_SESSION_ROUTES: readonly string[] = Object.freeze([
   "POST /v1/member/requests",
   "POST /v1/member/messages",
   "PATCH /v1/member/profile",
+  "GET /v1/member/profile/contact",
+  "PATCH /v1/member/profile/contact",
   "POST /v1/member/deletion-request",
+  // #8438 D6 — the member's own consents. `GET /v1/consent/platform` is NOT
+  // admitted: those are the Admin owner's, on the hub's own cookie session.
+  "GET /v1/member/consents",
+  "POST /v1/member/consents",
 ]);
 
 /**

package/templates/apps/api/src/middleware/rate-limit.ts

@@ -170,6 +170,11 @@ export const FORWARDED_VISITOR_ROUTES: readonly Readonly<{
   { method: "POST", url: "/v1/leads/callback" },
   { method: "GET", url: "/v1/schedule/availability" },
   { method: "POST", url: "/v1/schedule/book" },
+  // #8438 D5/D9 — the cookie banner's log and the unsubscribe landing: a
+  // site's server forwards each visitor's IP, so one spoke's visitors are
+  // counted one by one rather than in one bucket keyed on its egress IP.
+  { method: "POST", url: "/v1/consent/cookie" },
+  { method: "POST", url: "/v1/consent/unsubscribe" },
 ];
 
 const VISITOR_IP_HEADER = "x-ailk-visitor-ip";