create-ailk 0.19.0 → 0.20.0

package/templates/apps/api/src/middleware/__tests__/rate-limit-store.test.ts

@@ -0,0 +1,430 @@
+/**
+ * @file rate-limit-store.test.ts
+ *
+ * Unit tests for the rate limiter's database store seam (#5040 AC-2 to
+ * AC-5). The SQL double below is a `RateLimitSqlClient` whose `$queryRaw` /
+ * `$executeRaw` are `jest.fn()`s modeling the same upsert/sweep semantics as
+ * the real SQL (`apps/api/src/lib/rate-limit-store.ts`'s `createDatabaseRateLimitStore`);
+ * the SQL text itself is proved against a real Postgres by
+ * `rate-limit-cross-isolate.db.test.ts` (AC-1, AC-7, AC-8). AC-6's own claim
+ * ("the existing rate-limit.test.ts passes unedited") is checked by running
+ * that file, not re-asserted here.
+ */
+import { createHash } from "node:crypto";
+
+import Fastify, { type FastifyInstance } from "fastify";
+
+import {
+  createDatabaseRateLimitStore,
+  resolveRateLimitStoreKind,
+  type RateLimitSqlClient,
+} from "../../lib/rate-limit-store.js";
+import {
+  buildTrustedKeyDigests,
+  rateLimitMiddleware,
+  type RateLimitOptions,
+} from "../rate-limit.js";
+
+function sha256Hex(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+type Row = { count: number; windowStartMs: number; windowMs: number };
+
+/** A `RateLimitSqlClient` double over an in-memory `Map<keyHash, Row>`. */
+function armSqlDouble(): {
+  client: RateLimitSqlClient;
+  queryRaw: jest.Mock;
+  executeRaw: jest.Mock;
+  rows: Map<string, Row>;
+} {
+  const rows = new Map<string, Row>();
+
+  const queryRaw = jest.fn(
+    (strings: TemplateStringsArray, ...values: unknown[]) => {
+      const sql = strings.join("?");
+      const hash = values[0] as string;
+      const now = values[1] as number;
+      const windowMs = values[2] as number;
+
+      if (sql.includes("INSERT INTO")) {
+        const existing = rows.get(hash);
+        const fresh =
+          !existing || now - existing.windowStartMs >= windowMs;
+        const row: Row = fresh
+          ? { count: 1, windowStartMs: now, windowMs }
+          : { count: existing.count + 1, windowStartMs: existing.windowStartMs, windowMs };
+        rows.set(hash, row);
+        return Promise.resolve([
+          { count: row.count, window_start_ms: row.windowStartMs },
+        ]);
+      }
+      if (sql.includes("SELECT 1")) {
+        const row = rows.get(hash);
+        const open = row !== undefined && now - row.windowStartMs < windowMs;
+        return Promise.resolve(open ? [{ one: 1 }] : []);
+      }
+      return Promise.resolve([]);
+    },
+  );
+
+  const executeRaw = jest.fn(
+    (strings: TemplateStringsArray, ...values: unknown[]) => {
+      const sql = strings.join("?");
+      if (sql.includes("DELETE FROM")) {
+        const now = values[0] as number;
+        for (const [key, row] of rows) {
+          if (row.windowStartMs + row.windowMs <= now) rows.delete(key);
+        }
+      }
+      return Promise.resolve(0);
+    },
+  );
+
+  // eslint-disable-next-line no-restricted-syntax -- RateLimitSqlClient's methods are Prisma's overloaded tagged-template signature, which a jest.fn() double cannot structurally match; this double is the SQL boundary, same footing as lib/prisma.ts's own repo-standard test double.
+  const client = {
+    $queryRaw: queryRaw,
+    $executeRaw: executeRaw,
+  } as unknown as RateLimitSqlClient;
+
+  return { client, queryRaw, executeRaw, rows };
+}
+
+describe("AC-2 — the #7394 R-1 rule holds over the database store", () => {
+  const KEY = "a".repeat(32);
+  const noWarn = () => undefined;
+  const SCOPE = "leads";
+  const KEY_BUCKET = `${SCOPE}|key,0`;
+
+  function keyed(visitorIp: string): Record<string, string> {
+    return {
+      "x-forwarded-for": "198.51.100.1",
+      "x-ailk-visitor-forward-key": KEY,
+      "x-ailk-visitor-ip": visitorIp,
+    };
+  }
+
+  function buildApp(double: ReturnType<typeof armSqlDouble>): FastifyInstance {
+    const app = Fastify({ trustProxy: true });
+    app.register(rateLimitMiddleware, {
+      scope: SCOPE,
+      perIpPerMinute: 10,
+      perKeyPerMinute: 5,
+      trustedKeyDigests: buildTrustedKeyDigests(KEY, noWarn),
+      store: createDatabaseRateLimitStore(double.client),
+    } satisfies RateLimitOptions);
+    app.post("/v1/leads/submit", async () => ({ ok: true }));
+    return app;
+  }
+
+  async function post(app: FastifyInstance, visitorIp: string): Promise<number> {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      headers: keyed(visitorIp),
+    });
+    return res.statusCode;
+  }
+
+  it("a key over ceiling for a visitor with no open window: hitKey + hasOpenWindow run, hit does not", async () => {
+    const double = armSqlDouble();
+    const app = buildApp(double);
+    await app.ready();
+    try {
+      for (let i = 1; i <= 5; i++) expect(await post(app, `203.0.113.${i}`)).toBe(200);
+
+      const fresh = "203.0.113.50";
+      const freshHash = sha256Hex(`${SCOPE}|v0,${fresh}`);
+      const sixth = await app.inject({
+        method: "POST",
+        url: "/v1/leads/submit",
+        headers: keyed(fresh),
+      });
+      expect(sixth.statusCode).toBe(429);
+
+      const keyHash = sha256Hex(KEY_BUCKET);
+      const insertCalls = double.queryRaw.mock.calls.filter(
+        (call) =>
+          String((call[0] as TemplateStringsArray).join("?")).includes(
+            "INSERT INTO",
+          ),
+      );
+      expect(insertCalls.some((call) => call[1] === keyHash)).toBe(true);
+      // hasOpenWindow ran for the fresh visitor...
+      const selectCalls = double.queryRaw.mock.calls.filter(
+        (call) =>
+          String((call[0] as TemplateStringsArray).join("?")).includes(
+            "SELECT 1",
+          ),
+      );
+      expect(selectCalls.some((call) => call[1] === freshHash)).toBe(true);
+      // ...but no `hit` (INSERT) ran for the fresh visitor's own bucket.
+      expect(insertCalls.some((call) => call[1] === freshHash)).toBe(false);
+    } finally {
+      await app.close();
+    }
+  });
+
+  it("a key over ceiling for a visitor with an OPEN window still issues the visitor hit", async () => {
+    const double = armSqlDouble();
+    const app = buildApp(double);
+    await app.ready();
+    try {
+      // Visitor 1 opens its own window first (count 1, well under perIpPerMinute).
+      expect(await post(app, "203.0.113.1")).toBe(200);
+      for (let i = 2; i <= 5; i++) expect(await post(app, `203.0.113.${i}`)).toBe(200);
+
+      const visitor1Hash = sha256Hex(`${SCOPE}|v0,203.0.113.1`);
+      const before = double.queryRaw.mock.calls.filter(
+        (call) =>
+          String((call[0] as TemplateStringsArray).join("?")).includes(
+            "INSERT INTO",
+          ) && call[1] === visitor1Hash,
+      ).length;
+
+      // The key is now over ceiling; visitor 1 still has an open window.
+      await post(app, "203.0.113.1");
+
+      const after = double.queryRaw.mock.calls.filter(
+        (call) =>
+          String((call[0] as TemplateStringsArray).join("?")).includes(
+            "INSERT INTO",
+          ) && call[1] === visitor1Hash,
+      ).length;
+      expect(after).toBe(before + 1);
+    } finally {
+      await app.close();
+    }
+  });
+});
+
+describe("AC-3 — bounded, fail-open to the memory store, never to no limit (#5040 D5)", () => {
+  const IP = "203.0.113.9";
+
+  // Each half runs inside its own jest.isolateModules instance so D5's
+  // once-per-60-s fallback-warn throttle starts fresh for it — a shared
+  // module instance would let test (a)'s warn suppress test (b)'s.
+  function runIsolated(
+    build: (mod: typeof import("../rate-limit")) => Promise<void>,
+  ): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      jest.isolateModules(() => {
+        const mod: typeof import("../rate-limit") = require("../rate-limit");
+        build(mod).then(resolve, reject);
+      });
+    });
+  }
+
+  it("(a) every SQL call rejecting: 10 succeed, the 11th is 429, exactly one fallback line with reason: error", async () => {
+    await runIsolated(async (mod) => {
+      // eslint-disable-next-line no-restricted-syntax -- see the SQL double above.
+      const client = {
+        $queryRaw: jest.fn().mockRejectedValue(new Error("db down")),
+        $executeRaw: jest.fn().mockRejectedValue(new Error("db down")),
+      } as unknown as RateLimitSqlClient;
+
+      const logLines: Array<Record<string, unknown>> = [];
+      const app = Fastify({
+        trustProxy: true,
+        logger: {
+          level: "warn",
+          stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
+        },
+      });
+      app.register(mod.rateLimitMiddleware, {
+        perIpPerMinute: 10,
+        store: createDatabaseRateLimitStore(client),
+      } satisfies RateLimitOptions);
+      app.get("/test", async () => ({ ok: true }));
+      await app.ready();
+
+      try {
+        for (let i = 0; i < 10; i++) {
+          const res = await app.inject({
+            method: "GET",
+            url: "/test",
+            headers: { "x-forwarded-for": IP },
+          });
+          expect(res.statusCode).toBe(200);
+        }
+        const eleventh = await app.inject({
+          method: "GET",
+          url: "/test",
+          headers: { "x-forwarded-for": IP },
+        });
+        expect(eleventh.statusCode).toBe(429);
+
+        const fallbackLines = logLines.filter(
+          (l) => l["event"] === "rate_limit_store_fallback",
+        );
+        expect(fallbackLines).toHaveLength(1);
+        expect(fallbackLines[0]?.["reason"]).toBe("error");
+        // No key, IP, hash or error message on the fallback line.
+        expect(JSON.stringify(fallbackLines)).not.toContain(IP);
+      } finally {
+        await app.close();
+      }
+    });
+  });
+
+  it("(b) a never-settling SQL call with storeTimeoutMs:50: each request answers within 1s, the 11th is 429, one fallback line with reason: timeout", async () => {
+    await runIsolated(async (mod) => {
+      // eslint-disable-next-line no-restricted-syntax -- see the SQL double above.
+      const client = {
+        $queryRaw: jest.fn(() => new Promise(() => undefined)),
+        $executeRaw: jest.fn(() => new Promise(() => undefined)),
+      } as unknown as RateLimitSqlClient;
+
+      const logLines: Array<Record<string, unknown>> = [];
+      const app = Fastify({
+        trustProxy: true,
+        logger: {
+          level: "warn",
+          stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
+        },
+      });
+      app.register(mod.rateLimitMiddleware, {
+        perIpPerMinute: 10,
+        storeTimeoutMs: 50,
+        store: createDatabaseRateLimitStore(client),
+      } satisfies RateLimitOptions);
+      app.get("/test", async () => ({ ok: true }));
+      await app.ready();
+
+      try {
+        for (let i = 0; i < 10; i++) {
+          const res = await app.inject({
+            method: "GET",
+            url: "/test",
+            headers: { "x-forwarded-for": IP },
+          });
+          expect(res.statusCode).toBe(200);
+        }
+        const eleventh = await app.inject({
+          method: "GET",
+          url: "/test",
+          headers: { "x-forwarded-for": IP },
+        });
+        expect(eleventh.statusCode).toBe(429);
+
+        const fallbackLines = logLines.filter(
+          (l) => l["event"] === "rate_limit_store_fallback",
+        );
+        expect(fallbackLines).toHaveLength(1);
+        expect(fallbackLines[0]?.["reason"]).toBe("timeout");
+      } finally {
+        await app.close();
+      }
+    });
+  }, 15_000);
+});
+
+describe("AC-4 — resolveRateLimitStoreKind (D4's table, all seven rows)", () => {
+  it.each<
+    [string, string | undefined, string | undefined, "memory" | "database", boolean]
+  >([
+    ["set + unset", "postgresql://x", undefined, "database", false],
+    ["set + database", "postgresql://x", "database", "database", false],
+    ["set + memory", "postgresql://x", "memory", "memory", false],
+    ["unset + memory", undefined, "memory", "memory", false],
+    ["unset + unset", undefined, undefined, "memory", false],
+    ["unset + database", undefined, "database", "memory", true],
+    ["set + garbage", "postgresql://x", "garbage", "database", true],
+  ])(
+    "%s -> %s (warns: %s)",
+    (_label, databaseUrl, store, expected, warns) => {
+      const warn = jest.fn();
+      const result = resolveRateLimitStoreKind(
+        { DATABASE_URL: databaseUrl, AILK_RATE_LIMIT_STORE: store },
+        warn,
+      );
+      expect(result).toBe(expected);
+      expect(warn).toHaveBeenCalledTimes(warns ? 1 : 0);
+    },
+  );
+
+  it("unset + garbage -> memory, with the same warning", () => {
+    const warn = jest.fn();
+    const result = resolveRateLimitStoreKind(
+      { DATABASE_URL: undefined, AILK_RATE_LIMIT_STORE: "garbage" },
+      warn,
+    );
+    expect(result).toBe("memory");
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(warn.mock.calls[0]?.[0]).toContain(
+      "AILK_RATE_LIMIT_STORE is not memory or database",
+    );
+  });
+});
+
+describe("AC-5 — the process default store, resolved and logged once per process", () => {
+  const prevDatabaseUrl = process.env.DATABASE_URL;
+  const prevStore = process.env.AILK_RATE_LIMIT_STORE;
+
+  afterEach(() => {
+    if (prevDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = prevDatabaseUrl;
+    if (prevStore === undefined) delete process.env.AILK_RATE_LIMIT_STORE;
+    else process.env.AILK_RATE_LIMIT_STORE = prevStore;
+  });
+
+  it("defaults to the database store when DATABASE_URL is set and AILK_RATE_LIMIT_STORE is unset, logging once", async () => {
+    let queryRawMock!: jest.Mock;
+
+    await new Promise<void>((resolve, reject) => {
+      jest.isolateModules(() => {
+        process.env.DATABASE_URL = "postgresql://test:test@localhost:5432/test";
+        delete process.env.AILK_RATE_LIMIT_STORE;
+
+        queryRawMock = jest.fn().mockResolvedValue([
+          { count: 1, window_start_ms: Date.now() },
+        ]);
+        const executeRawMock = jest.fn().mockResolvedValue(0);
+
+        jest.doMock("../../lib/prisma.js", () => ({
+          prisma: { $queryRaw: queryRawMock, $executeRaw: executeRawMock },
+        }));
+
+        const mod: typeof import("../rate-limit") = require("../rate-limit");
+
+        const logLines: Array<Record<string, unknown>> = [];
+        const app = Fastify({
+          trustProxy: true,
+          logger: {
+            level: "info",
+            stream: { write: (msg: string) => logLines.push(JSON.parse(msg)) },
+          },
+        });
+        app.register(mod.rateLimitMiddleware, { perIpPerMinute: 10 });
+        app.register(async (child) => {
+          child.register(mod.rateLimitMiddleware, {
+            perIpPerMinute: 10,
+            scope: "leads",
+          });
+          child.get("/other", async () => ({ ok: true }));
+        });
+        app.get("/test", async () => ({ ok: true }));
+
+        app
+          .ready()
+          .then(() =>
+            app.inject({
+              method: "GET",
+              url: "/test",
+              headers: { "x-forwarded-for": "203.0.113.77" },
+            }),
+          )
+          .then((res) => {
+            expect(res.statusCode).toBe(200);
+            expect(queryRawMock).toHaveBeenCalledTimes(1);
+            const infoLines = logLines.filter(
+              (l) => l["rateLimitStore"] === "database",
+            );
+            expect(infoLines).toHaveLength(1);
+            return app.close();
+          })
+          .then(resolve, reject);
+      });
+    });
+  });
+});

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -404,22 +404,21 @@ describe("per-IP rate limit middleware", () => {
  * load with an empty Map), reproduced deterministically in-process.
  *
  * This demonstrates — rather than merely asserts, per AC-1's own wording —
- * that the per-IP limit, AS CURRENTLY DESIGNED, does NOT hold across
+ * that the per-IP limit, UNDER THE MEMORY STORE, does NOT hold across
  * separate execution contexts: the same IP, already rate-limited to
  * exhaustion on one instance, is granted a fresh budget on another. This
- * is the accepted, documented trade-off recorded in
- * docs/specs/5111-limiter-surface-spec.md § D4 (no new store for OSS v1;
- * MAX_BUCKETS bounds memory, not the cross-isolate aggregate rate) — this
- * test makes that trade-off provable rather than only claimed in a
- * comment, and will fail (correctly) the day a cross-isolate store
- * replaces the in-process Map.
+ * pins the memory store's own documented trade-off (the SINGLE-REPLICA
+ * CAVEAT) now that a database deployment defaults to the shared store
+ * instead (#5040 D1/D4) — this test makes that trade-off provable rather
+ * than only claimed in a comment, and will fail (correctly) if the memory
+ * store's isolation is ever accidentally narrowed.
  *
  * What this test does NOT demonstrate: whether the LIVE deployment
- * actually runs more than one concurrent isolate for a given route today.
- * That is a platform fact only a reachable live deployment can answer
- * (#5040 AC-1's deployment-level half, recorded open in the issue).
+ * actually runs more than one concurrent isolate for a given route today,
+ * nor the database store's own cross-isolate behavior — that is
+ * `rate-limit-cross-isolate.db.test.ts`'s job (#5040 AC-1).
  */
-describe("cross-isolate limit — does NOT hold by design (#5040, SINGLE-REPLICA CAVEAT)", () => {
+describe("cross-isolate limit — the memory store does not hold by design (#5040, SINGLE-REPLICA CAVEAT)", () => {
   it("the same IP, exhausted on one module instance, is freshly allowed on an independently-loaded instance", async () => {
     const perIpPerMinute = 5;
     const ip = "198.51.100.7";
@@ -753,13 +752,18 @@ describe("per-visitor forwarding, scope namespace and per-scope env limit (#7394
       expect(codes[10]).toBe(429);
     });
 
-    it("(v) the valid key on POST /v1/project-listings in the same scope: the eleventh request is 429", async () => {
+    // `POST /v1/project-listings` joined the list with #7479; the resume
+    // link's verification write shares its scope and stays off the list.
+    it("(v) the valid key on POST /v1/project-listings/drafts/:id/verify-email in the same scope: the eleventh request is 429", async () => {
       app = forwardApp({ ...base, trustedKeyDigests: digests() }, [
         LEADS_SUBMIT,
-        "/v1/project-listings",
+        "/v1/project-listings/drafts/:id/verify-email",
       ]);
       await app.ready();
-      const codes = await elevenDistinctVisitors((ip) => keyed(ip), "/v1/project-listings");
+      const codes = await elevenDistinctVisitors(
+        (ip) => keyed(ip),
+        "/v1/project-listings/drafts/listing_abc/verify-email",
+      );
       expect(codes.slice(0, 10).every((code) => code === 200)).toBe(true);
       expect(codes[10]).toBe(429);
     });
@@ -836,10 +840,64 @@ describe("per-visitor forwarding, scope namespace and per-scope env limit (#7394
         { method: "POST", url: "/v1/leads/callback" },
         { method: "GET", url: AVAILABILITY },
         { method: "POST", url: BOOK },
+        { method: "POST", url: "/v1/consent/cookie" },
+        { method: "POST", url: "/v1/consent/unsubscribe" },
+        { method: "POST", url: "/v1/project-listings" },
+        { method: "PATCH", url: "/v1/project-listings/drafts/:id" },
+        { method: "POST", url: "/v1/project-listings/drafts/:id/submit" },
       ]);
     });
   });
 
+  // #8438 D5/D9 — the cookie banner's log and the unsubscribe landing. Each
+  // is registered in its OWN scope (`consent`, `unsubscribe`), exactly as
+  // server.ts does, and both are on the forwarded-visitor list.
+  describe("the consent routes count each keyed visitor separately, in scopes of their own (#8438)", () => {
+    const COOKIE = "/v1/consent/cookie";
+    const UNSUBSCRIBE = "/v1/consent/unsubscribe";
+
+    function consentApp(): FastifyInstance {
+      const instance = Fastify({ trustProxy: true });
+      for (const [scope, url] of [
+        ["consent", COOKIE],
+        ["unsubscribe", UNSUBSCRIBE],
+      ] as const) {
+        instance.register(async (scoped) => {
+          scoped.register(rateLimitMiddleware, {
+            scope,
+            perIpPerMinute: 10,
+            trustedKeyDigests: digests(),
+          });
+          scoped.post(url, async () => ({ ok: true }));
+        });
+      }
+      return instance;
+    }
+
+    async function post(url: string, headers: Record<string, string>): Promise<number> {
+      if (!app) throw new Error("no app");
+      return (await app.inject({ method: "POST", url, headers })).statusCode;
+    }
+
+    it.each([COOKIE, UNSUBSCRIBE])("%s: two visitors behind one site key are counted separately", async (url) => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) {
+        expect(await post(url, keyed("203.0.113.1"))).toBe(200);
+      }
+      expect(await post(url, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(url, keyed("203.0.113.2"))).toBe(200);
+    });
+
+    it("an exhausted consent bucket leaves unsubscribe answering", async () => {
+      app = consentApp();
+      await app.ready();
+      for (let i = 0; i < 10; i++) await post(COOKIE, keyed("203.0.113.1"));
+      expect(await post(COOKIE, keyed("203.0.113.1"))).toBe(429);
+      expect(await post(UNSUBSCRIBE, keyed("203.0.113.1"))).toBe(200);
+    });
+  });
+
   describe("AC-5 — visitor IP validation and normalisation", () => {
     function identityApp(): FastifyInstance {
       const instance = Fastify({ trustProxy: true });

package/templates/apps/api/src/middleware/auth.ts

@@ -34,8 +34,8 @@
  *      spoke's key (`x-ailk-spoke-key`), only while its grant is unrevoked and
  *      unexpired, its client enabled and its person's email verified, and only
  *      on `HUB_SESSION_ROUTES` — an exact list of METHOD + registered URL
- *      pairs — the credential's own `me` and the member routes, 18 in all
- *      (#8220); any other route is 404 (never 403, so the account area's
+ *      pairs — the credential's own `me` and the member routes, 24 in all
+ *      (#8220, #8515); any other route is 404 (never 403, so the account area's
  *      `read()` loads "nothing for this caller"). It acts as its person
  *      (`request.userId`) and carries `request.hubSession` — never
  *      `request.sessionTenant` — and its request logger names the spoke
@@ -153,9 +153,12 @@ export type HubSession = {
  * The only routes a hub-issued credential reaches (#7894 D6, #8220 D1): an
  * EXACT list of method + registered URL, never a prefix and never computed,
  * so a route added later joins only by a reviewed edit of this list
- * (SEC-7894-3). Three groups, in this order: the credential's own `me` and
+ * (SEC-7894-3). Five groups, in this order: the credential's own `me` and
  * #7877's three member reads; #8169's eight member reads; #8170's six member
- * writes (roadmap §7.2 row order). The member profile write IS admitted — it
+ * writes (roadmap §7.2 row order); #8438's member consents read and write;
+ * #8515's onboarding read and write — 24 in all.
+ * `GET /v1/consent/platform` is not admitted — it is the Admin owner's own
+ * consent to Working Theory, on the hub's cookie session. The member profile write IS admitted — it
  * is the person's own account, which roadmap D9 saves through it. Not
  * admitted, deliberately: `GET /v1/waitlist-signups/me`,
  * `GET /v1/flow-checkouts/me`, `GET /v1/subscription/me` and
@@ -181,7 +184,16 @@ export const HUB_SESSION_ROUTES: readonly string[] = Object.freeze([
   "POST /v1/member/requests",
   "POST /v1/member/messages",
   "PATCH /v1/member/profile",
+  "GET /v1/member/profile/contact",
+  "PATCH /v1/member/profile/contact",
   "POST /v1/member/deletion-request",
+  // #8438 D6 — the member's own consents. `GET /v1/consent/platform` is NOT
+  // admitted: those are the Admin owner's, on the hub's own cookie session.
+  "GET /v1/member/consents",
+  "POST /v1/member/consents",
+  // #8515 D13 — the client's onboarding read and write.
+  "GET /v1/member/onboarding",
+  "POST /v1/member/onboarding",
 ]);
 
 /**

package/templates/apps/api/src/middleware/default-tenant.ts

@@ -122,6 +122,15 @@ export async function defaultTenantPreHandler(
     return;
   }
 
+  // #8514 D4 (SEC-8514-A) — fail closed: an agent's tenant must carry the
+  // marker `agentTenant` sets, or the agent would hold a member's client rows
+  // by role. A path that built one without it refuses every request.
+  if (request.agent && tenant.agent !== true) {
+    request.log.error({ event: "agent-tenant-unmarked" }, "agent tenant without its marker");
+    reply.code(403).send(FORBIDDEN);
+    return;
+  }
+
   request.tenant = tenant;
 }