create-ailk 0.19.0 → 0.20.0

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -39,6 +39,12 @@
  *   `outcome: "foreign_site"` and answers 200. An unstamped session is the
  *   hub's own (roadmap D4) and is handled as before. The hub stamps its own
  *   sessions through `siteStamp()`. See README.md § Site filter (#7868).
+ *   Since #8024 one gate before the switch does the same for every
+ *   `customer.*`, `customer.subscription.*` and `invoice.*` event, reading the
+ *   stamp from the Customer's or Subscription's own metadata — for an invoice,
+ *   its own metadata and then the subscription snapshot under
+ *   `parent.subscription_details` or (pre-`basil`) `subscription_details` —
+ *   and only when `data.object.object` is the family's own type.
  *
  * Billing upsert (customer.created / checkout.session.completed):
  *   Billing-entity routing (org-scoped billing, #3601, spec D2): a checkout
@@ -70,6 +76,20 @@
  *   `"no_payment_required"` (a 100%-off promo code, #4862) — anything else
  *   logs `outcome: "unpaid"` and leaves the row `created`.
  *
+ * Proposal paid stamp (checkout.session.completed, #8516 D13):
+ *   A session carrying the server-written `metadata.ailk_proposal` and
+ *   `ailk_workspace` (the client's proposal Checkout,
+ *   `services/proposal-payments.ts`) stamps that proposal's `paid_at` and
+ *   `paid_session_id` once, through the base-tree boundary
+ *   `lib/proposal-paid-store.ts` (this file names no `piece` delegate), and
+ *   writes one `people.proposal.paid` audit row as the Stripe system actor
+ *   keyed by the event id: `succeeded` when stamped, `failed`
+ *   (`already_paid`) when a different session already paid it, none on a
+ *   same-session replay, a `warn` when no such proposal exists, and `failed`
+ *   (`not_paid`) with no stamp for a session that is not paid. A session
+ *   without both keys makes no query. Runs BESIDE the other stamps; never
+ *   throws; logs an 8-character prefix and the outcome only.
+ *
  * Checkout Person (checkout.session.completed, #852 D6):
  *   Chained after that stamp, `recordFlowCheckoutPerson` finds or creates the
  *   Person of the checkout row THIS session completed (matched on its own
@@ -87,10 +107,12 @@
  */
 import { track } from "@working-theory/analytics/server";
 import type { Prisma } from "@working-theory/database";
+import { isId } from "@working-theory/ids";
 import type { FastifyReply, FastifyRequest } from "fastify";
 
 import { config } from "../../config/index.js";
 import { prisma } from "../../lib/prisma.js";
+import { stampProposalPaid as writeProposalPaid } from "../../lib/proposal-paid-store.js";
 import {
   resolveCommerceClaim,
   commerceDisabledResponse,
@@ -104,11 +126,13 @@ import {
   SITE_STAMP_KEY,
 } from "../../lib/site.js";
 import {
+  stripeKeyMode,
   StripeWebhookSignatureError,
   toSubscriptionLifecycleStatus,
   verifyWebhookSignature,
 } from "../../lib/stripe.js";
 import { hasSeen, markSeen } from "../../lib/webhook-idempotency.js";
+import { recordWorkspaceAuditAction } from "../../services/audit-log.js";
 import { isUniqueViolation } from "../../services/default-tenant.js";
 import {
   DUNNING_MAX_SUBSCRIPTIONS,
@@ -274,6 +298,22 @@ export const stripeWebhookHandler = async (
 
   const event = settled.event;
   const eventIdPrefix = event.id.substring(0, 8);
+
+  // #8450 D10 (#6852 SEC-03) — an event whose livemode is not the key class
+  // this process admitted is never one of its own: a live hub must not act on
+  // a test-mode event anyone with the test key can forge, nor a test hub on a
+  // live one. Dropped before the idempotency check and any write; 200 so
+  // Stripe stops retrying, and NOT marked seen, so a corrected deployment
+  // still accepts a redelivery.
+  if ((event.livemode === true) !== (stripeKeyMode() === "live")) {
+    request.log.warn(
+      { eventType: event.type, eventIdPrefix, outcome: "livemode_mismatch" },
+      "stripe webhook event dropped — livemode differs from the admitted key class",
+    );
+    await reply.code(200).send({ received: true });
+    return;
+  }
+
   request.log.info(
     { eventType: event.type, eventIdPrefix },
     "stripe webhook event received",
@@ -292,6 +332,20 @@ export const stripeWebhookHandler = async (
   }
   markSeen(event.id);
 
+  // #8024 — the billing families' site filter, after `markSeen` as #7868's
+  // in-arm check is, so a foreign redelivery is a duplicate. One gate rather
+  // than a check per arm: the `default` arm's types are filtered too.
+  const foreignStamp = siteStampSourcesOf(event).find(isForeignSiteStamp);
+  if (foreignStamp) {
+    logForeignSiteSkip(request, {
+      stamp: foreignStamp[SITE_STAMP_KEY],
+      eventType: event.type,
+      eventIdPrefix,
+    });
+    await reply.code(200).send({ received: true });
+    return;
+  }
+
   switch (event.type) {
     case "customer.created": {
       const customer = event.data.object as {
@@ -383,6 +437,7 @@ export const stripeWebhookHandler = async (
           }),
         ),
         stampRequestPaid(request, { session, eventIdPrefix }),
+        stampProposalPaid(request, { session, eventId: event.id, eventIdPrefix }),
       ]);
       break;
     }
@@ -480,11 +535,11 @@ type CheckoutSessionObject = {
 };
 
 /**
- * The one log line for a session another site stamped (#7868 D3). Carries the
- * foreign stamp (first 64 characters) and this site's own alias, so a spoke
- * event correctly skipped can be told from a hub event whose alias drifted —
- * site labels only: it takes the stamp, never the session, so no buyer field
- * or amount can reach it.
+ * The one log line for an event another site stamped (#7868 D3, #8024 D3).
+ * Carries the foreign stamp (first 64 characters) and this site's own alias,
+ * so a spoke event correctly skipped can be told from a hub event whose alias
+ * drifted — site labels only: it takes the stamp, never the object, so no
+ * buyer field, customer id or amount can reach it.
  */
 function logForeignSiteSkip(
   request: FastifyRequest,
@@ -506,10 +561,61 @@ function logForeignSiteSkip(
       stamp: stamp?.slice(0, 64),
       ownSite: currentSiteId(),
     },
-    "checkout session stamped for another site — skipped",
+    "stripe event stamped for another site — skipped",
   );
 }
 
+/** The object type whose metadata carries the site for each billing family (#8024 D2). */
+function stampedObjectTypeOf(eventType: string): "subscription" | "customer" | "invoice" | null {
+  if (eventType.startsWith("customer.subscription.")) return "subscription";
+  if (eventType.startsWith("customer.")) return "customer";
+  if (eventType.startsWith("invoice.")) return "invoice";
+  return null;
+}
+
+/** `value` when it is a non-null object, else `null` — every step of a stamp read is guarded (NF1). */
+function objectOrNull(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+/**
+ * The metadata objects that may carry an event's site stamp (#8024 D2), in the
+ * order they are checked: a Subscription's or a Customer's own metadata; an
+ * invoice's own metadata, then the subscription snapshot at the pinned API
+ * version (`parent.subscription_details.metadata`), then at a pre-`basil` one
+ * (`subscription_details.metadata`). Empty for every other event type, and
+ * when `data.object.object` is not the family's own type — a
+ * `customer.source.*` card, say. Reads the payload alone and never throws on
+ * any shape: an absent, `null` or non-object step yields no source, and
+ * `isForeignSiteStamp` treats a non-string stamp as unstamped.
+ */
+function siteStampSourcesOf(event: {
+  type: string;
+  data?: unknown;
+}): Record<string, string>[] {
+  const objectType = stampedObjectTypeOf(event.type);
+  const object = objectOrNull(objectOrNull(event.data)?.["object"]);
+  if (objectType === null || object?.["object"] !== objectType) return [];
+
+  const candidates =
+    objectType === "invoice"
+      ? [
+          object["metadata"],
+          objectOrNull(objectOrNull(object["parent"])?.["subscription_details"])?.[
+            "metadata"
+          ],
+          objectOrNull(object["subscription_details"])?.["metadata"],
+        ]
+      : [object["metadata"]];
+  // The cast only narrows the value type for `isForeignSiteStamp`, which
+  // reads the stamp as `unknown` and `typeof`-checks it.
+  return candidates
+    .map(objectOrNull)
+    .filter((source) => source !== null) as Record<string, string>[];
+}
+
 /**
  * Minimal projected shape of a Stripe Invoice object for the dunning arms
  * (#6034 FR-1). `subscription` and `customer` are EXPANDABLE Stripe fields —
@@ -786,6 +892,95 @@ async function stampRequestPaid(
   }
 }
 
+/**
+ * #8516 D13 — stamp a client's proposal paid from its own Checkout Session,
+ * and audit the outcome as Stripe. The two ids come only from the session's
+ * metadata, which this server wrote when it opened the session — a payer can
+ * never set it — and the stamp is scoped by both. Never throws.
+ */
+async function stampProposalPaid(
+  request: FastifyRequest,
+  {
+    session,
+    eventId,
+    eventIdPrefix,
+  }: { session: CheckoutSessionObject; eventId: string; eventIdPrefix: string },
+): Promise<void> {
+  const pieceId = session.metadata?.["ailk_proposal"];
+  const workspaceId = session.metadata?.["ailk_workspace"];
+  const sessionId = session.id;
+  if (
+    typeof pieceId !== "string" ||
+    typeof workspaceId !== "string" ||
+    typeof sessionId !== "string" ||
+    !isId("piece", pieceId) ||
+    !isId("workspace", workspaceId)
+  ) {
+    return;
+  }
+  const ref = pieceId.substring(6, 14);
+
+  const audit = async (outcome: { ok: true } | { ok: false; reason: string }) => {
+    const result = await recordWorkspaceAuditAction({
+      workspaceId,
+      actor: { type: "system", systemId: "stripe" },
+      domain: "people",
+      tool: "proposal.paid",
+      outcome: outcome.ok ? "succeeded" : "failed",
+      ...(!outcome.ok && { failureReason: outcome.reason }),
+      idempotencyKey: eventId,
+      targetType: "piece",
+      targetId: pieceId,
+    });
+    if (!result.ok) {
+      request.log.error(
+        { eventIdPrefix, ref, error: result.error.kind },
+        "proposal paid: audit write failed",
+      );
+    }
+  };
+
+  if (
+    session.payment_status !== "paid" &&
+    session.payment_status !== "no_payment_required"
+  ) {
+    request.log.warn(
+      { eventIdPrefix, ref, outcome: "not_paid" },
+      "proposal paid: completed session is not paid — not stamping",
+    );
+    await audit({ ok: false, reason: "not_paid" });
+    return;
+  }
+
+  try {
+    const outcome = await writeProposalPaid(workspaceId, pieceId, sessionId, new Date());
+    if (outcome === "stamped") {
+      request.log.info({ eventIdPrefix, ref, outcome }, "proposal stamped paid");
+      await audit({ ok: true });
+    } else if (outcome === "already_paid") {
+      request.log.warn(
+        { eventIdPrefix, ref, outcome },
+        "proposal paid: already paid by another session — a second charge",
+      );
+      await audit({ ok: false, reason: "already_paid" });
+    } else if (outcome === "not_found") {
+      request.log.warn({ eventIdPrefix, ref, outcome }, "proposal paid: no such proposal");
+    } else {
+      request.log.info({ eventIdPrefix, ref, outcome }, "proposal paid: replay");
+    }
+  } catch (err) {
+    request.log.error(
+      {
+        eventIdPrefix,
+        ref,
+        outcome: "stamp_failed",
+        errName: err instanceof Error ? err.name : "UnknownError",
+      },
+      "proposal paid stamp failed — continuing",
+    );
+  }
+}
+
 /**
  * The hosted-invoice twin of `stampRequestPaid` (#5970 D4/D8).
  *

package/templates/apps/api/src/server.ts

@@ -55,6 +55,10 @@ import {
 import { tokenRoutes } from "./routes/auth/tokens.js";
 import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
 import { userRoutes } from "./routes/auth/user.js";
+import {
+  consentCookieRoute,
+  consentUnsubscribeRoute,
+} from "./routes/consent/index.js";
 import { getPageRoute } from "./routes/content/get-page.js";
 import { listPagesRoute } from "./routes/content/list-pages.js";
 import { listTypesRoute } from "./routes/content/list-types.js";
@@ -76,6 +80,7 @@ import {
   registerTestAuthRoute,
   shouldMountTestAuth,
 } from "./routes/test/auth/session.js";
+import { consentLinkSecretConfigured } from "./services/consent.js";
 
 /**
  * What a request looks like in a log line — Fastify's own default shape, minus
@@ -111,12 +116,18 @@ import {
  */
 const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
 const LEAD_ID_LOG_SEGMENT = idRegex("lead");
+// #8438 SEC-8438-10 — a third arm for `person_…` segments. The consents route
+// (and every other `…/people/:personId…` route) would otherwise write a full
+// Person id into the request log line, beside `remoteAddress`.
+const PERSON_ID_LOG_SEGMENT = idRegex("person");
 
 function redactSensitiveIdSegments(url: string): string {
   return url
     .split("/")
     .map((segment) =>
-      SESSION_ID_LOG_SEGMENT.test(segment) || LEAD_ID_LOG_SEGMENT.test(segment)
+      SESSION_ID_LOG_SEGMENT.test(segment) ||
+      LEAD_ID_LOG_SEGMENT.test(segment) ||
+      PERSON_ID_LOG_SEGMENT.test(segment)
         ? `${segment.slice(0, 8)}…`
         : segment,
     )
@@ -224,7 +235,8 @@ const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
 // #852 D8 — the People reads (the workspace's clients), the SAME scope.
 const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
 // #7877 D9 — a client's pieces, plan and outbound messages, and the
-// workspace's piece stages: the operator's writes, the SAME scope.
+// workspace's piece stages: the writes owners, admins and (#8514) members
+// make, the SAME scope.
 const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
 const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
 const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
@@ -252,6 +264,14 @@ const MEMBER_ARTIFACT_REVIEW = "./routes/member/artifact-review.js";
 const MEMBER_PROFILE = "./routes/member/profile.js";
 const MEMBER_DELETION_REQUEST = "./routes/member/deletion-request.js";
 const MEMBER_BOOKINGS = "./routes/member/bookings.js";
+// #8438 D6 — the member's own consents, under the tenancy predicate beside the
+// other member routes. D8 — the Admin owner's consents to Working Theory,
+// under multi-tenant alone (the module that contributes the Admin app).
+const MEMBER_CONSENTS = "./routes/member/consents.js";
+// #8515 D13 — the client's onboarding read and write, under the tenancy
+// predicate beside the request-quote pair.
+const MEMBER_ONBOARDING = "./routes/member/onboarding.js";
+const CONSENT_PLATFORM = "./routes/consent/platform.js";
 // #3591 PR-B — the agent seat's management routes and an agent's own
 // context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
 // scope.
@@ -332,7 +352,8 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_PEOPLE,
     load: () => import(WORKSPACES_PEOPLE),
   },
-  // #7877 D9 — the member area's operator routes, the SAME scope.
+  // #7877 D9 — the member area's operator routes (owners, admins and, since
+  // #8514, members), the SAME scope.
   workspacePieceRoutes: {
     specifier: WORKSPACES_PIECES,
     load: () => import(WORKSPACES_PIECES),
@@ -394,6 +415,11 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_REQUESTS,
     load: () => import(MEMBER_REQUESTS),
   },
+  // #8515 D13 — the onboarding read and write.
+  memberOnboardingRoutes: {
+    specifier: MEMBER_ONBOARDING,
+    load: () => import(MEMBER_ONBOARDING),
+  },
   memberArtifactReviewRoutes: {
     specifier: MEMBER_ARTIFACT_REVIEW,
     load: () => import(MEMBER_ARTIFACT_REVIEW),
@@ -406,6 +432,16 @@ const SLICE_PLUGINS = {
     specifier: MEMBER_DELETION_REQUEST,
     load: () => import(MEMBER_DELETION_REQUEST),
   },
+  // #8438 D6 — the member's own consents, the SAME scope as the writes above.
+  memberConsentRoutes: {
+    specifier: MEMBER_CONSENTS,
+    load: () => import(MEMBER_CONSENTS),
+  },
+  // #8438 D8 — the owner's consents to Working Theory (multi-tenant only).
+  consentPlatformRoutes: {
+    specifier: CONSENT_PLATFORM,
+    load: () => import(CONSENT_PLATFORM),
+  },
   // The one that reaches services/scheduling/ (scheduling-owned, D11).
   memberBookingRoutes: {
     specifier: MEMBER_BOOKINGS,
@@ -643,24 +679,29 @@ async function tenantPreHandlerForBuild(): Promise<FastifyPluginCallback> {
 }
 
 /**
- * The commerce boot-time sandbox guard — the one other slice entry that is
+ * The commerce boot-time key admission — the one other slice entry that is
  * not a route plugin, mirroring `tenantPreHandlerSlicePlugin()` above (D3).
- * `lib/stripe.ts` is commerce-owned (D5) and its `assertSandboxKey` is the
+ * `lib/stripe.ts` is commerce-owned (D5) and its `admitApiStripeKey` is the
  * sole `apps/api` reach into the Stripe SDK wrapper package, so it can no
  * longer be a static import (spec D1) once the module is stripped. The
  * widened `const specifier: string` annotation is what defeats `tsc`
  * resolution, exactly as it does above.
+ *
+ * #8450 D4: called with NO argument, so the admission covers the same
+ * `process.env` key `getStripeClient()` later reads. `STRIPE_MODE` unset is
+ * today's sandbox-only check; only a restricted live key beside
+ * `STRIPE_MODE=live` on a production build comes back `"live"`.
  */
-async function assertCommerceSandboxKey(key: string): Promise<void> {
+async function admitCommerceStripeKey(): Promise<"test" | "live"> {
   const specifier: string = "./lib/stripe.js";
   const mod = (await loadSlice(specifier, () => import(specifier))) as {
-    assertSandboxKey?: (key: string) => void;
+    admitApiStripeKey?: () => "test" | "live";
   };
-  const assertSandboxKeyFn = mod.assertSandboxKey;
-  if (!assertSandboxKeyFn) {
-    throw new Error("slice export assertSandboxKey missing from " + specifier);
+  const admitApiStripeKeyFn = mod.admitApiStripeKey;
+  if (!admitApiStripeKeyFn) {
+    throw new Error("slice export admitApiStripeKey missing from " + specifier);
   }
-  assertSandboxKeyFn(key);
+  return admitApiStripeKeyFn();
 }
 
 /**
@@ -676,6 +717,18 @@ async function assertCommerceSandboxKey(key: string): Promise<void> {
  * carries a localhost default.
  */
 function warnOnUnsetProductionProtections(): void {
+  // #8438 D9 — AILK_CONSENT_LINK_SECRET is optional, but a value shorter than
+  // 32 bytes is a misconfiguration worth an error at boot: it is treated as
+  // unset, so no unsubscribe link can be minted or honored. Never the value.
+  if (
+    process.env["AILK_CONSENT_LINK_SECRET"] !== undefined &&
+    process.env["AILK_CONSENT_LINK_SECRET"] !== "" &&
+    !consentLinkSecretConfigured()
+  ) {
+    logger.error(
+      "[startup] AILK_CONSENT_LINK_SECRET is set but shorter than 32 bytes — treated as unset; no unsubscribe link can be minted or honored",
+    );
+  }
   if (config.NODE_ENV !== "production") return;
   if (!process.env["FRONTEND_URL"]) {
     logger.warn(
@@ -713,14 +766,17 @@ export async function build() {
   // site renewed. Never throws; without DATABASE_URL the file store stays.
   await registerLicenseKeyStore();
 
-  // Runtime sandbox-mode guard: reject live-mode Stripe keys before any
-  // webhook or checkout call can exercise them. Idempotent — safe even if
-  // assertSandboxKey is called again inside a route handler. UNCONDITIONAL
-  // since D-64 (#5796): the commerce primitives and lib/stripe.ts are base
-  // tree now, so the key's presence — not a module flag — is the whole
-  // question. A build with no STRIPE_SECRET_KEY has nothing to assert.
+  // Runtime key admission (#8450 D4): refuse, before any webhook or checkout
+  // call can exercise it, every live Stripe key this process cannot vouch
+  // for — all of them unless STRIPE_MODE=live sits beside a restricted live
+  // key on a production build. UNCONDITIONAL since D-64 (#5796): the
+  // commerce primitives and lib/stripe.ts are base tree now, so the key's
+  // presence — not a module flag — is the whole question. A build with no
+  // STRIPE_SECRET_KEY has nothing to admit.
+  let stripeMode: "test" | "live" = "test";
   if (config.STRIPE_SECRET_KEY) {
-    await assertCommerceSandboxKey(config.STRIPE_SECRET_KEY);
+    stripeMode = await admitCommerceStripeKey();
+    logger.info({ stripeMode }, "[startup] stripe key admitted");
   }
 
   // trustProxy: true (#4730) — the Vercel serverless handler
@@ -933,6 +989,10 @@ export async function build() {
       await authScope.register(
         await sliceRoutePlugin("workspaceContextRoutes"),
       );
+      // #8438 D8 — the Admin owner's consents to Working Theory. Auth only,
+      // NOT tenant-guarded (the owner role is checked inside the route), and
+      // deliberately NOT in `HUB_SESSION_ROUTES`: a cookie session only.
+      await authScope.register(await sliceRoutePlugin("consentPlatformRoutes"));
     }
 
     // The leads INBOX read (#5678) — auth only, NOT tenant-guarded, for the
@@ -1013,9 +1073,13 @@ export async function build() {
       await authScope.register(await sliceRoutePlugin("memberBillingRoutes"));
       // #8170 D11 — the member writes, under the same predicate.
       await authScope.register(await sliceRoutePlugin("memberRequestRoutes"));
+      // #8515 D13 — the onboarding pair, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberOnboardingRoutes"));
       await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
       await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
       await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));
+      // #8438 D6 — the member's own consents, under the same predicate.
+      await authScope.register(await sliceRoutePlugin("memberConsentRoutes"));
     }
     // #8169 D9 — the two member reads that reach services/scheduling/, which
     // only the scheduling module delivers: a scaffold with a tenancy module
@@ -1325,7 +1389,25 @@ export async function build() {
   // `GET /v1/checkout/sessions/:id` — the GET in its own nested,
   // rate-limited sub-scope (D16), so this preHandler applies to both while
   // the GET's own limiter applies to it alone.
+  //
+  // #8450 § 9 SEC-14 — a LIVE process gives both routes their own per-IP
+  // `checkout` bucket on top of the global limiter, because live, the public
+  // GET spends one read of the shared live Stripe account per request. It
+  // lowers the per-IP ceiling per instance (the POST's from the global 20 to
+  // 10; the POST and GET now also share one count); like every limiter here
+  // it is in-memory, so it does not bound the total across serverless
+  // instances. `onRequest`, so it counts before the claim gate. Accepted
+  // residual: a server-side caller — apps/web's server actions, an MCP host's
+  // `purchase` tool — puts all its buyers on its own egress IP, so they share
+  // one bucket; `AILK_RATE_LIMIT_CHECKOUT_PER_MINUTE` raises the ceiling. A
+  // test-mode process registers nothing new.
   await server.register(async (checkoutScope) => {
+    if (stripeMode === "live") {
+      await checkoutScope.register(rateLimitMiddleware, {
+        scope: "checkout",
+        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      });
+    }
     checkoutScope.addHook("preHandler", requireCommerceClaim);
     await checkoutScope.register(await sliceRoutePlugin("checkoutRoutes"));
   });
@@ -1464,6 +1546,31 @@ export async function build() {
   // 10/min on form submissions. The global unauth ceiling above applies.
   await server.register(leadCaptureStatusRoute);
 
+  // The consent floor (#8438 D5, D9) — the cookie banner's log and the
+  // unsubscribe landing. Top level, outside every module gate: consent
+  // logging is part of the never-gated privacy floor. Each is in its OWN
+  // rate-limited scope (`consent`, `unsubscribe`) so filling one never blocks
+  // the other; with a forward key set, a spoke's visitors are counted one by
+  // one (both routes are on FORWARDED_VISITOR_ROUTES). Without one, the
+  // server's own IP is the bucket — the posture of the lead routes. Neither
+  // is behind `authScope`: the caller is a visitor, or a person in their mail.
+  await server.register(async (consentScope) => {
+    consentScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "consent",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await consentScope.register(consentCookieRoute);
+  });
+  await server.register(async (unsubscribeScope) => {
+    unsubscribeScope.register(rateLimitMiddleware, {
+      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      scope: "unsubscribe",
+      trustedKeyDigests: visitorForwardKeyDigests,
+    });
+    await unsubscribeScope.register(consentUnsubscribeRoute);
+  });
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was

package/templates/apps/api/src/services/__tests__/audit-log.test.ts

@@ -51,6 +51,7 @@ import {
   freshAuditIdempotencyKey,
   recordAgentWrite,
   recordAuditAction,
+  recordWorkspaceAuditAction,
   redactPersonalData,
   type AuditActor,
   type AuditRowDigestInput,
@@ -935,3 +936,93 @@ describe("recordAgentWrite given the request (#3591 PR-B)", () => {
     expect(mockLoggerError.mock.calls[0]![1]).toBe("[audit-log] agent write audit refused");
   });
 });
+
+// ─── #8516 D14 — recordWorkspaceAuditAction, a row without a tenant ────────────
+
+describe("#8516 AC-7 — recordWorkspaceAuditAction", () => {
+  const PIECE_ID = "piece_0190f3a2-7c1d-7e4a-9b2c-000000000004";
+  const ROW = {
+    domain: "people",
+    tool: "proposal.client_review",
+    outcome: "succeeded" as const,
+    idempotencyKey: "req_proposal_review",
+    targetType: "piece",
+    targetId: PIECE_ID,
+    summary: '{"by":"client","review":"approved","priced":true}',
+  };
+
+  it("writes the row recordAuditAction would for the same workspace and user actor", async () => {
+    const tenantWrite = stubDb();
+    const tenantResult = await recordAuditAction(
+      { ...ROW, tenant: TENANT, actor: userActor(USER_ID) },
+      tenantWrite.db,
+    );
+    const workspaceWrite = stubDb();
+    const workspaceResult = await recordWorkspaceAuditAction(
+      { ...ROW, workspaceId: WORKSPACE_ID, actor: { type: "user", userId: USER_ID as Id<"user"> } },
+      workspaceWrite.db,
+    );
+
+    expect(workspaceWrite.create).toHaveBeenCalledTimes(1);
+    expect(firstWrittenRow(workspaceWrite.create)).toEqual(firstWrittenRow(tenantWrite.create));
+    expect(workspaceResult).toEqual(tenantResult);
+    expect(workspaceResult).toMatchObject({ ok: true, outcome: "recorded" });
+  });
+
+  it("the system actor stores actor_type system and actor_id stripe", async () => {
+    const { db, create } = stubDb();
+    const result = await recordWorkspaceAuditAction(
+      {
+        workspaceId: WORKSPACE_ID,
+        actor: { type: "system", systemId: "stripe" },
+        domain: "people",
+        tool: "proposal.paid",
+        outcome: "failed",
+        failureReason: "already_paid",
+        idempotencyKey: "evt_test_proposal",
+        targetType: "piece",
+        targetId: PIECE_ID,
+      },
+      db,
+    );
+
+    expect(result).toMatchObject({ ok: true, outcome: "recorded" });
+    expect(create).toHaveBeenCalledTimes(1);
+    const row = firstWrittenRow(create);
+    expect(row).toMatchObject({
+      workspaceId: WORKSPACE_ID,
+      actorType: "system",
+      actorId: "stripe",
+      action: "people.proposal.paid",
+      targetType: "piece",
+      targetId: PIECE_ID,
+    });
+    expect(row.metadata).toEqual({
+      v: 2,
+      outcome: "failed",
+      tool: "proposal.paid",
+      idempotencyKey: "evt_test_proposal",
+      failureReason: "already_paid",
+    });
+    expect(row.metadata).not.toHaveProperty("onBehalfOf");
+    expect(zAuditLogId.safeParse(row.id).success).toBe(true);
+  });
+
+  it("an invalid workspaceId is invalid_input and writes nothing", async () => {
+    const { db, create } = stubDb();
+    const result = await recordWorkspaceAuditAction(
+      { ...ROW, workspaceId: "not-a-workspace", actor: { type: "system", systemId: "stripe" } },
+      db,
+    );
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        kind: "invalid_input",
+        message: "workspaceId is not a valid workspace id",
+        persisted: false,
+      },
+    });
+    expect(create).not.toHaveBeenCalled();
+  });
+});