create-ailk 0.19.0 → 0.20.0

package/templates/apps/api/src/lib/__tests__/consent-store.test.ts

@@ -0,0 +1,334 @@
+/**
+ * @file consent-store.test.ts
+ * @description The consent ledger's read boundary (#8438 D4, AC-2).
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock;
+ *     prisma singleton via __mocks__/prisma.ts)
+ *
+ * The readers run over `consent-ledger-double.ts`, an in-memory model with
+ * the same semantics as their SQL; the SQL text itself is run against a real
+ * database by `database/__tests__/consent-ledger.db.test.ts`. What this file
+ * proves: the two readings never mix (a row an anonymous writer attached to a
+ * Person never changes the Person's OWN answer), a flood cannot push an
+ * answer out, history pages are complete, and a cursor of another Person is
+ * refused.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../prisma.js");
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { siteConsentConfigSchema } from "@working-theory/validation";
+
+import {
+  CONSENT_HISTORY_PAGE_SIZE,
+  anySourceConsentState,
+  effectiveConsent,
+  isUnverifiedSource,
+  latestVisitorChoice,
+  OWN_CONSENT_SOURCES,
+  ownConsentState,
+  personConsentHistory,
+  userPlatformRows,
+} from "../consent-store.js";
+import { prisma } from "../prisma.js";
+
+import {
+  armConsentLedger,
+  type ConsentLedgerDouble,
+  type LedgerRow,
+} from "./consent-ledger-double.js";
+
+const WS = "wksp_01920000-0000-7000-8000-0000000000a1";
+const OTHER_WS = "wksp_01920000-0000-7000-8000-0000000000a2";
+const PERSON = "person_01920000-0000-7000-8000-0000000000a1";
+const OTHER_PERSON = "person_01920000-0000-7000-8000-0000000000a2";
+const VISITOR = "0192a000-0000-4000-8000-0000000000a1";
+
+const CONFIG = siteConsentConfigSchema.parse({
+  policies: {},
+  purposes: [
+    {
+      id: "news",
+      kind: "preference",
+      area: "communications",
+      label: { en: "News." },
+    },
+    { id: "data", kind: "consent", area: "data", label: { en: "Data." } },
+  ],
+});
+
+let double: ConsentLedgerDouble;
+let counter = 0;
+
+function row(over: Partial<LedgerRow>): LedgerRow {
+  counter += 1;
+  return {
+    id: `cnsnt_00000000-0000-7000-8000-${String(900000 + counter).padStart(12, "0")}`,
+    workspaceId: WS,
+    subjectType: "person",
+    subjectId: PERSON,
+    personId: PERSON,
+    purposeId: "news",
+    granted: true,
+    source: "account_settings",
+    sourceRef: null,
+    policyVersion: 1,
+    locale: "en",
+    statement: "News.",
+    createdAt: new Date(Date.UTC(2026, 9, 12, 0, 0, 0, counter)),
+    ...over,
+  };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  counter = 0;
+  double = armConsentLedger(prisma);
+});
+
+describe("the two readings (SEC-8438-1)", () => {
+  it("a magnet grant an anonymous form attached never changes the Person's OWN answer", async () => {
+    double.ledger.push(
+      row({ purposeId: "data", granted: false, source: "account_settings" }),
+      row({
+        purposeId: "data",
+        granted: true,
+        source: "magnet",
+        sourceRef: "guide",
+      }),
+    );
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")?.effective).toBe(false);
+    expect(any.find((s) => s.purposeId === "data")?.effective).toBe(true);
+    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe("magnet");
+  });
+
+  it("a preference is on until withdrawn, a consent off until granted, with no row", async () => {
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    expect(own.map((s) => [s.purposeId, s.kind, s.row, s.effective])).toEqual([
+      ["news", "preference", null, true],
+      ["data", "consent", null, false],
+    ]);
+    expect(effectiveConsent("preference", null)).toBe(true);
+    expect(effectiveConsent("agreement", null)).toBe(false);
+    expect(effectiveConsent("consent", { granted: false })).toBe(false);
+  });
+
+  it("the OWN sources are exactly the three the SQL names, and the unverified set is the rest", () => {
+    const source = readFileSync(join(__dirname, "../consent-store.ts"), "utf8");
+    const literal = `IN ('${OWN_CONSENT_SOURCES.join("', '")}')`;
+    expect(source.split(literal).length - 1).toBe(1);
+    expect(OWN_CONSENT_SOURCES.map(isUnverifiedSource)).toEqual([
+      false,
+      false,
+      false,
+    ]);
+    expect(
+      (["magnet", "api", "cookie_banner", "legacy"] as const).every(
+        isUnverifiedSource,
+      ),
+    ).toBe(true);
+  });
+
+  it("another workspace's rows and another Person's rows never show", async () => {
+    double.ledger.push(
+      row({ workspaceId: OTHER_WS, purposeId: "data", granted: true }),
+      row({
+        personId: OTHER_PERSON,
+        subjectId: OTHER_PERSON,
+        purposeId: "data",
+        granted: true,
+      }),
+    );
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")?.row).toBeNull();
+  });
+
+  it("a linked visitor's cookie rows reach the any-source reading only, and only in the same workspace", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        purposeId: "data",
+        granted: true,
+        source: "cookie_banner",
+      }),
+    );
+    double.links.push({
+      workspaceId: WS,
+      visitorId: VISITOR,
+      personId: PERSON,
+      source: "magnet",
+    });
+    double.links.push({
+      workspaceId: OTHER_WS,
+      visitorId: VISITOR,
+      personId: OTHER_PERSON,
+      source: "magnet",
+    });
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe(
+      "cookie_banner",
+    );
+    expect(
+      (await anySourceConsentState(WS, OTHER_PERSON, CONFIG)).every(
+        (s) => s.row === null,
+      ),
+    ).toBe(true);
+    expect(
+      (await ownConsentState(WS, PERSON, CONFIG)).every((s) => s.row === null),
+    ).toBe(true);
+  });
+});
+
+describe("the flood case (SEC-8438-2, AC-2)", () => {
+  it("600 magnet grants and 600 linked-visitor cookie rows cannot push out a withdrawal", async () => {
+    double.ledger.push(
+      row({ purposeId: "data", granted: false, source: "account_settings" }),
+    );
+    double.links.push({
+      workspaceId: WS,
+      visitorId: VISITOR,
+      personId: PERSON,
+      source: "magnet",
+    });
+    for (let i = 0; i < 600; i += 1) {
+      double.ledger.push(
+        row({ purposeId: "data", granted: true, source: "magnet" }),
+      );
+    }
+    for (let i = 0; i < 600; i += 1) {
+      double.ledger.push(
+        row({
+          subjectType: "visitor",
+          subjectId: VISITOR,
+          personId: null,
+          purposeId: "data",
+          granted: true,
+          source: "cookie_banner",
+        }),
+      );
+    }
+    const own = await ownConsentState(WS, PERSON, CONFIG);
+    const any = await anySourceConsentState(WS, PERSON, CONFIG);
+    expect(own.find((s) => s.purposeId === "data")).toMatchObject({
+      effective: false,
+    });
+    expect(any.find((s) => s.purposeId === "data")).toMatchObject({
+      effective: true,
+    });
+
+    // Following nextCursor returns all 1,201 rows exactly once.
+    const seen: string[] = [];
+    let cursor: string | undefined;
+    let pages = 0;
+    for (;;) {
+      const page = await personConsentHistory(WS, PERSON, cursor);
+      if (page === "invalid_cursor")
+        throw new Error("unexpected invalid cursor");
+      expect(page.rows.length).toBeLessThanOrEqual(CONSENT_HISTORY_PAGE_SIZE);
+      seen.push(...page.rows.map((r) => r.id));
+      pages += 1;
+      if (page.nextCursor === null) break;
+      cursor = page.nextCursor;
+    }
+    expect(pages).toBe(3);
+    expect(seen).toHaveLength(1201);
+    expect(new Set(seen).size).toBe(1201);
+  });
+});
+
+describe("personConsentHistory", () => {
+  it("is newest first and carries the wording, never a subject id", async () => {
+    double.ledger.push(row({ granted: true }), row({ granted: false }));
+    const page = await personConsentHistory(WS, PERSON, undefined);
+    if (page === "invalid_cursor") throw new Error("unexpected");
+    expect(page.rows.map((r) => r.granted)).toEqual([false, true]);
+    expect(page.rows[0]).toHaveProperty("statement", "News.");
+    expect(page.rows[0]).not.toHaveProperty("subjectId");
+    expect(page.nextCursor).toBeNull();
+  });
+
+  it("refuses a cursor that is another Person's row, another workspace's row, or unknown", async () => {
+    double.ledger.push(
+      row({ granted: true }),
+      row({ personId: OTHER_PERSON, subjectId: OTHER_PERSON }),
+      row({ workspaceId: OTHER_WS }),
+    );
+    const [, theirs, elsewhere] = double.ledger;
+    expect(await personConsentHistory(WS, PERSON, theirs!.id)).toBe(
+      "invalid_cursor",
+    );
+    expect(await personConsentHistory(WS, PERSON, elsewhere!.id)).toBe(
+      "invalid_cursor",
+    );
+    expect(await personConsentHistory(WS, PERSON, "cnsnt_nope")).toBe(
+      "invalid_cursor",
+    );
+  });
+});
+
+describe("the cookie dedupe read and the platform read", () => {
+  it("latestVisitorChoice answers the newest row for the visitor and purpose", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        granted: true,
+        purposeId: "data",
+        source: "cookie_banner",
+      }),
+      row({
+        subjectType: "visitor",
+        subjectId: VISITOR,
+        personId: null,
+        granted: false,
+        purposeId: "data",
+        source: "cookie_banner",
+      }),
+    );
+    expect(await latestVisitorChoice(WS, VISITOR, "data")).toEqual({
+      granted: false,
+      policyVersion: 1,
+    });
+    expect(await latestVisitorChoice(WS, VISITOR, "news")).toBeNull();
+    expect(await latestVisitorChoice(OTHER_WS, VISITOR, "data")).toBeNull();
+  });
+
+  it("userPlatformRows reads the user's own rows, newest per purpose", async () => {
+    double.ledger.push(
+      row({
+        subjectType: "user",
+        subjectId: "user_1",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: true,
+      }),
+      row({
+        subjectType: "user",
+        subjectId: "user_1",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: false,
+      }),
+      row({
+        subjectType: "user",
+        subjectId: "user_2",
+        personId: null,
+        purposeId: "wt_marketing",
+        granted: true,
+      }),
+    );
+    const rows = await userPlatformRows(WS, "user_1");
+    expect(rows.map((r) => [r.purposeId, r.granted])).toEqual([
+      ["wt_marketing", false],
+    ]);
+  });
+});

package/templates/apps/api/src/lib/__tests__/stripe-admission.test.ts

@@ -0,0 +1,217 @@
+// oss: false
+/**
+ * apps/api's live-key admission (#8450 D2, D3) over the REAL
+ * `@working-theory/stripe-client` — no mock, so the process-wide flag the
+ * package keeps is the one these cases arm or leave alone.
+ *
+ * Admission is one-way per module registry, so every case loads
+ * `lib/stripe.ts` inside its own `jest.isolateModules` with `process.env`
+ * set before the `require` and restored after.
+ *
+ * Every live-shaped key is composed at runtime from fragments, so this file
+ * never spells a live prefix (architecture.yaml's `(sk|pk|rk)_live_` pattern)
+ * and never names the SDK's admission call.
+ */
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+
+type Shim = typeof import("../stripe");
+
+const RESTRICTED_LIVE = ["rk", "live", ""].join("_");
+const SECRET_LIVE = ["sk", "live", ""].join("_");
+const PUBLISHABLE_LIVE = ["pk", "live", ""].join("_");
+// A distinctive tail: no refusal message may carry any of it.
+const TAIL = "FixtureOnlyQv7Zq9X";
+
+const restrictedLiveKey = RESTRICTED_LIVE + TAIL;
+const secretLiveKey = SECRET_LIVE + TAIL;
+const publishableLiveKey = PUBLISHABLE_LIVE + TAIL;
+const testKey = "sk_test_" + TAIL;
+
+const ENV_KEYS = ["STRIPE_SECRET_KEY", "STRIPE_MODE", "VERCEL_ENV", "VERCEL", "NODE_ENV"] as const;
+type EnvKey = (typeof ENV_KEYS)[number];
+
+/** Load a fresh `lib/stripe.ts` under `env`, run `fn`, then restore the four variables. */
+function withShim(env: Partial<Record<EnvKey, string>>, fn: (shim: Shim) => void): void {
+  const saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+  try {
+    for (const k of ENV_KEYS) {
+      if (env[k] === undefined) delete process.env[k];
+      else process.env[k] = env[k];
+    }
+    jest.isolateModules(() => {
+      fn(require("../stripe") as Shim);
+    });
+  } finally {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  }
+}
+
+/** The thrown error, asserted to be the shim's `StripeConfigError` and to carry no key material. */
+function refusal(shim: Shim, fn: () => unknown): Error {
+  let caught: unknown;
+  try {
+    fn();
+  } catch (err) {
+    caught = err;
+  }
+  expect(caught).toBeInstanceOf(shim.StripeConfigError);
+  const message = (caught as Error).message;
+  expect(message).not.toContain(TAIL);
+  expect(message).not.toContain(TAIL.slice(-4));
+  return caught as Error;
+}
+
+const LIVE_PRODUCTION = {
+  STRIPE_SECRET_KEY: restrictedLiveKey,
+  STRIPE_MODE: "live",
+  VERCEL_ENV: "production",
+} as const;
+
+describe("admitApiStripeKey — D2's table", () => {
+  it("takes no parameter, so nothing can arm it from a synthetic object", () => {
+    withShim({ STRIPE_SECRET_KEY: testKey }, (shim) => {
+      expect(shim.admitApiStripeKey.length).toBe(0);
+    });
+  });
+
+  it("admits a restricted live key beside STRIPE_MODE=live on a Vercel production build", () => {
+    withShim(LIVE_PRODUCTION, (shim) => {
+      expect(shim.stripeKeyMode()).toBe("test");
+      expect(shim.admitApiStripeKey()).toBe("live");
+      expect(shim.stripeKeyMode()).toBe("live");
+
+      // F2/F3 — the admitted class passes; the other two live classes do not.
+      expect(() => shim.assertAdmittedStripeKey(restrictedLiveKey)).not.toThrow();
+      refusal(shim, () => shim.assertAdmittedStripeKey(secretLiveKey));
+      refusal(shim, () => shim.assertAdmittedStripeKey(publishableLiveKey));
+      // A test key still passes after admission.
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+
+      // The client the route then calls accepts the same key.
+      expect(shim.getStripeClient()).toBeDefined();
+    });
+  });
+
+  it("off Vercel, reads NODE_ENV=production as the production build", () => {
+    withShim(
+      { STRIPE_SECRET_KEY: restrictedLiveKey, STRIPE_MODE: "live", NODE_ENV: "production" },
+      (shim) => {
+        expect(shim.admitApiStripeKey()).toBe("live");
+        expect(shim.stripeKeyMode()).toBe("live");
+      },
+    );
+  });
+
+  it.each([
+    ["a Vercel preview build", { VERCEL_ENV: "preview", NODE_ENV: "production" }],
+    ["a non-production build off Vercel", { NODE_ENV: "test" }],
+    // vercel.json sets NODE_ENV=production everywhere, Preview included.
+    ["Vercel with VERCEL_ENV missing, even beside NODE_ENV=production", { VERCEL: "1", NODE_ENV: "production" }],
+  ])("refuses a restricted live key with STRIPE_MODE=live on %s", (_label, build) => {
+    withShim({ STRIPE_SECRET_KEY: restrictedLiveKey, STRIPE_MODE: "live", ...build }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/production/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+      refusal(shim, () => shim.getStripeClient());
+    });
+  });
+
+  it.each([
+    ["an unrestricted live key", secretLiveKey],
+    ["a publishable live key", publishableLiveKey],
+    ["a test key", testKey],
+  ])("refuses STRIPE_MODE=live beside %s", (_label, key) => {
+    withShim({ STRIPE_SECRET_KEY: key, STRIPE_MODE: "live", VERCEL_ENV: "production" }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/STRIPE_MODE=live/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+    });
+  });
+
+  it.each(["production", "LIVE", ""])("refuses STRIPE_MODE=%j, whatever the key", (mode) => {
+    withShim({ ...LIVE_PRODUCTION, STRIPE_MODE: mode }, (shim) => {
+      const err = refusal(shim, () => shim.admitApiStripeKey());
+      expect(err.message).toMatch(/STRIPE_MODE must be "test" or "live"/);
+      expect(shim.stripeKeyMode()).toBe("test");
+      refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+      refusal(shim, () => shim.getStripeClient());
+    });
+  });
+
+  it.each([undefined, "test"])("with STRIPE_MODE=%s, runs today's sandbox check on a test key", (mode) => {
+    withShim({ STRIPE_SECRET_KEY: testKey, STRIPE_MODE: mode }, (shim) => {
+      expect(shim.admitApiStripeKey()).toBe("test");
+      expect(shim.stripeKeyMode()).toBe("test");
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+    });
+  });
+
+  it.each([undefined, "test"])(
+    "with STRIPE_MODE=%s, refuses a restricted live key with today's sandbox message, even on production",
+    (mode) => {
+      withShim({ ...LIVE_PRODUCTION, STRIPE_MODE: mode }, (shim) => {
+        const err = refusal(shim, () => shim.admitApiStripeKey());
+        expect(err.message).toMatch(/Stripe live mode is blocked — sandbox only/);
+        expect(shim.stripeKeyMode()).toBe("test");
+        refusal(shim, () => shim.assertAdmittedStripeKey(restrictedLiveKey));
+        refusal(shim, () => shim.getStripeClient());
+      });
+    },
+  );
+});
+
+describe("assertAdmittedStripeKey — without admission", () => {
+  it("is today's sandbox allow-list: every live class refused, a test key accepted", () => {
+    withShim({ STRIPE_SECRET_KEY: testKey }, (shim) => {
+      expect(() => shim.assertAdmittedStripeKey(testKey)).not.toThrow();
+      for (const key of [restrictedLiveKey, secretLiveKey, publishableLiveKey]) {
+        const err = refusal(shim, () => shim.assertAdmittedStripeKey(key));
+        expect(err.message).toMatch(/Stripe live mode is blocked — sandbox only/);
+      }
+    });
+  });
+});
+
+describe("admitApiStripeKey — call sites (#8450 § 9 SEC-5)", () => {
+  // The sweep is a MONOREPO invariant: it reads the whole git tree. A
+  // scaffolded site (`create-ailk` verify-scaffold, which copies apps/api into
+  // a site that is not a git repository) has no tree to sweep and cannot grow
+  // a new call site of its own, so the sweep is skipped there (#8479/#8478).
+  const repoRoot = path.resolve(__dirname, "../../../../..");
+  const inGitTree = (() => {
+    try {
+      execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        cwd: repoRoot,
+        stdio: "ignore",
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  const itInRepo = inGitTree ? it : it.skip;
+
+  itInRepo("is named only by lib/stripe.ts, server.ts and #8450's own tests", () => {
+    const files = execFileSync("git", ["grep", "-l", "admitApiStripeKey", "--", ":!*.md"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+    })
+      .split("\n")
+      .filter(Boolean)
+      .sort();
+    expect(files).toEqual([
+      "apps/api/src/lib/__tests__/stripe-admission.test.ts",
+      "apps/api/src/lib/__tests__/stripe.test.ts",
+      "apps/api/src/lib/stripe.ts",
+      "apps/api/src/routes/checkout/__tests__/live-key.test.ts",
+      "apps/api/src/routes/subscription/__tests__/portal-live-key.test.ts",
+      "apps/api/src/server.ts",
+    ]);
+  });
+});

package/templates/apps/api/src/lib/__tests__/stripe.test.ts

@@ -62,6 +62,13 @@ describe("apps/api/src/lib/stripe — surface re-exports", () => {
     expect(new stripeShim.UnknownProductCodeError()).toBeInstanceOf(Error);
   });
 
+  // #8450 D2, D3 — apps/api's own live-key admission and its request-time guard.
+  it("exports admitApiStripeKey, assertAdmittedStripeKey and stripeKeyMode as functions", () => {
+    expect(typeof stripeShim.admitApiStripeKey).toBe("function");
+    expect(typeof stripeShim.assertAdmittedStripeKey).toBe("function");
+    expect(typeof stripeShim.stripeKeyMode).toBe("function");
+  });
+
   it("shim functions are the same references as @working-theory/stripe-client exports", () => {
     expect(stripeShim.getStripeClient).toBe(stripeClient.getStripeClient);
     expect(stripeShim.assertSandboxKey).toBe(stripeClient.assertSandboxKey);