create-ailk 0.19.0 → 0.20.0

package/templates/apps/api/src/lib/stripe.ts

@@ -8,7 +8,12 @@
  * '@working-theory/stripe-client' — single chokepoint for AILK-internal ergonomics
  * (logger context, request-id propagation) without touching every consumer.
  */
-import { getStripeClient } from "@working-theory/stripe-client";
+import {
+  admitLiveRestrictedKey,
+  assertSandboxKey,
+  getStripeClient,
+  StripeConfigError,
+} from "@working-theory/stripe-client";
 
 export {
   // PRECONDITION (#6113): do not narrow or bypass this sandbox-only guard for a
@@ -18,6 +23,8 @@ export {
   // Widened by #6852 (the #6113 follow-up): the same function must bind only
   // on a server-stamped metadata.ailk_user_id — an unverified Checkout email
   // never makes a FIRST binding either.
+  // Both are on main (#6850, #6862); #8450 is the narrowing this guarded —
+  // `assertAdmittedStripeKey` below. This export itself stays sandbox-only.
   assertSandboxKey,
   createAdHocPrice,
   createBillingPortalSession,
@@ -60,6 +67,89 @@ export type {
   StripeWebhookEvent,
 } from "@working-theory/stripe-client";
 
+/**
+ * apps/api's live-key admission (#8450 D2 — D-68's apps/api leg, the half
+ * #6881 left unbuilt). Composed at runtime so this file's own text never
+ * trips the repo-wide live-key lint.
+ */
+const LIVE_RESTRICTED_KEY_PREFIX = ["rk", "live", ""].join("_");
+
+let liveKeyAdmitted = false;
+
+/**
+ * `VERCEL_ENV` when set, else `NODE_ENV` — packages/spoke-checkout's own
+ * rule, with one fail-closed delta (PR #8470 security review R-1): on Vercel
+ * (`VERCEL` set) a missing `VERCEL_ENV` is not production, because
+ * `vercel.json` sets `NODE_ENV=production` in every environment, Preview
+ * included.
+ */
+function isProductionBuild(): boolean {
+  if (process.env.VERCEL_ENV !== undefined) {
+    return process.env.VERCEL_ENV === "production";
+  }
+  if (process.env.VERCEL !== undefined) return false;
+  return process.env.NODE_ENV === "production";
+}
+
+/**
+ * Admit this process's Stripe key at server build, or throw
+ * `StripeConfigError` (#8450 D2). Called once, by `server.ts`'s `build()`,
+ * and nowhere else.
+ *
+ * Only a restricted live key, beside `STRIPE_MODE=live`, on a production
+ * build is admitted: the package's one-way flag is set and `"live"` comes
+ * back. `STRIPE_MODE` unset or `test` is today's boot — `assertSandboxKey`,
+ * its message unchanged — and returns `"test"`. Every other combination
+ * throws. It takes no parameter and reads `process.env` only, so it vouches
+ * for the same key `getStripeClient()` later reads. No message names any
+ * part of the key.
+ */
+export function admitApiStripeKey(): "test" | "live" {
+  const mode = process.env.STRIPE_MODE;
+  const key = process.env.STRIPE_SECRET_KEY ?? "";
+
+  if (mode !== undefined && mode !== "test" && mode !== "live") {
+    throw new StripeConfigError('STRIPE_MODE must be "test" or "live".');
+  }
+  if (mode === "live") {
+    if (!key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) {
+      throw new StripeConfigError(
+        "STRIPE_MODE=live needs a restricted live Stripe key. " +
+          "Unrestricted, publishable and test-mode keys are refused.",
+      );
+    }
+    if (!isProductionBuild()) {
+      throw new StripeConfigError(
+        "A restricted live Stripe key is admitted only with STRIPE_MODE=live on a production build " +
+          "(VERCEL_ENV=production, or NODE_ENV=production off Vercel).",
+      );
+    }
+    admitLiveRestrictedKey();
+    liveKeyAdmitted = true;
+    return "live";
+  }
+  assertSandboxKey(key);
+  return "test";
+}
+
+/**
+ * The request-time key check for the routes that may run live (#8450 D3):
+ * the member portal session and the checkout start and read. It returns
+ * before the sandbox-only guard for the restricted live class alone, and
+ * only once `admitApiStripeKey()` admitted it; every other key meets
+ * `assertSandboxKey`'s allow-list, so an unrestricted or publishable live
+ * key is refused whether or not the process admitted.
+ */
+export function assertAdmittedStripeKey(key: string): void {
+  if (liveKeyAdmitted && key.startsWith(LIVE_RESTRICTED_KEY_PREFIX)) return;
+  assertSandboxKey(key);
+}
+
+/** The key class this process admitted at boot: `"live"` only after `admitApiStripeKey()` did. */
+export function stripeKeyMode(): "test" | "live" {
+  return liveKeyAdmitted ? "live" : "test";
+}
+
 /**
  * Expire a Checkout Session (#4912 FR7/D7).
  *
@@ -67,8 +157,9 @@ export type {
  * session already exists, its id never reached the `FlowCheckout` row, and
  * nothing will ever join the two — so the session is closed rather than left
  * live and payable (#4863). Built on the already-re-exported
- * `getStripeClient`, whose construction asserts the `sk_test_` allow-list, so
- * this call inherits the test-mode gate like every other Stripe call here.
+ * `getStripeClient`, whose construction asserts its key allow-list, so this
+ * call inherits the same gate as every other Stripe call here (test-mode, or
+ * the restricted live key once `admitApiStripeKey()` admitted it, #8450).
  */
 export async function expireCheckoutSession(stripeSessionId: string): Promise<void> {
   await getStripeClient().checkout.sessions.expire(stripeSessionId);
@@ -90,8 +181,9 @@ const PLAN_NAME_MAX = 200;
  * first item's product name (else the price nickname); and its default
  * payment method (else the customer's invoice default). At most three reads,
  * no expand path deeper than three levels (SEC-8171-3). Built on
- * `getStripeClient`, so it inherits the `sk_test_` allow-list: a live or
- * missing key throws `StripeConfigError`. It logs nothing and returns no id.
+ * `getStripeClient`, so it inherits its allow-list: a missing key, or a live
+ * key this process did not admit (#8450), throws `StripeConfigError`. It logs
+ * nothing and returns no id.
  */
 export async function readCustomerBillingSummary(
   customerId: string,

package/templates/apps/api/src/middleware/__tests__/auth.hub-session-path.test.ts

@@ -5,7 +5,7 @@
  * docs/specs/7894-the-hub-signs-in-its-spec.md D6; AC-4, AC-5, AC-7).
  *
  * A bearer starting `ailk_hst_` is admitted only beside the SAME spoke's key,
- * only while its grant is live and its person verified, and only on the 18
+ * only while its grant is live and its person verified, and only on the 20
  * routes of `HUB_SESSION_ROUTES` (#8220 D1, AC-1). Any other route answers 404
  * with no handler run (the status `lib/account-config.ts`'s `read()` already
  * loads as "nothing for this caller"), never 403. Each (person, spoke) is
@@ -53,7 +53,7 @@ let spokeA: SeededSpoke;
 let spokeB: SeededSpoke;
 let handlerRuns: string[];
 
-/** D1's 18 strings, in the list's order. */
+/** D1's 18 strings plus #8435's two contact routes and #8438's two consents routes (22), in the list's order. */
 const ADMITTED = [
   "GET /v1/hub-sign-in/me",
   "GET /v1/member/pieces",
@@ -72,11 +72,20 @@ const ADMITTED = [
   "POST /v1/member/requests",
   "POST /v1/member/messages",
   "PATCH /v1/member/profile",
+  "GET /v1/member/profile/contact",
+  "PATCH /v1/member/profile/contact",
   "POST /v1/member/deletion-request",
+  "GET /v1/member/consents",
+  "POST /v1/member/consents",
+  // #8515 D13 — the client's onboarding read and write.
+  "GET /v1/member/onboarding",
+  "POST /v1/member/onboarding",
 ];
 
 /** Every route the credential must NOT reach, each a recording stub. */
 const OFF_LIST = [
+  "GET /v1/consent/platform",
+  "POST /v1/consent/platform",
   "GET /v1/member/other",
   "GET /v1/member/messages/:id",
   "GET /v1/waitlist-signups/me",
@@ -168,9 +177,9 @@ afterEach(async () => {
 });
 
 describe("HUB_SESSION_ROUTES", () => {
-  it("is exactly the 18 entries, by method and registered URL — never a prefix (AC-1)", () => {
+  it("is exactly the 24 entries, by method and registered URL — never a prefix (AC-1, #8515 AC-6)", () => {
     expect([...HUB_SESSION_ROUTES]).toEqual(ADMITTED);
-    expect(HUB_SESSION_ROUTES.length).toBe(18);
+    expect(HUB_SESSION_ROUTES.length).toBe(24);
     for (const route of HUB_SESSION_ROUTES) {
       expect({
         route,

package/templates/apps/api/src/middleware/__tests__/default-tenant.test.ts

@@ -580,6 +580,7 @@ describe("defaultTenantPreHandler — agents (#3591 D5, D7)", () => {
       organizationId: DEFAULT_ORG_ID,
       workspaceId: DEFAULT_WORKSPACE_ID,
       role: "member",
+      agent: true,
     });
     await app.close();
   });
@@ -599,6 +600,7 @@ describe("defaultTenantPreHandler — agents (#3591 D5, D7)", () => {
       organizationId: DEFAULT_ORG_ID,
       workspaceId: DEFAULT_WORKSPACE_ID,
       role: "member",
+      agent: true,
       grants: ["content-edit", "magnets-manage"],
     });
     await app.close();

package/templates/apps/api/src/middleware/__tests__/rate-limit-cross-isolate.db.test.ts

@@ -0,0 +1,220 @@
+/**
+ * @file rate-limit-cross-isolate.db.test.ts
+ *
+ * LIVE-DATABASE proof of the shared store (#5040 D8: AC-1, AC-7, AC-8). Runs
+ * only when `AILK_TEST_LIVE_DATABASE === "1"` — `apps/api/src/__tests__/setup.ts`
+ * always sets a placeholder `DATABASE_URL`, so the usual
+ * `DATABASE_URL ? describe : describe.skip` gate can't distinguish a real
+ * database from the placeholder; `.github/workflows/api-postgres-compat.yml`'s
+ * full-suite step sets this variable beside its real `DATABASE_URL`.
+ *
+ * Uses the `pg` driver directly (raw SQL), the same reason
+ * `database/__tests__/prefixed-ids.db.test.ts` does: the generated Prisma
+ * client is ESM-only and cannot load under this package's CJS ts-jest
+ * transform. AC-1 drives the store's SQL through a `pg.Client` shim that
+ * turns a tagged template's strings and values into `$1…$n` text, not
+ * through the Prisma binding production uses — that binding is exercised by
+ * `rate-limit-store.test.ts`'s mocked-SQL-client unit tests.
+ */
+import { createHash, randomUUID } from "node:crypto";
+
+import Fastify, { type FastifyInstance } from "fastify";
+import { Client } from "pg";
+
+import {
+  createDatabaseRateLimitStore,
+  type RateLimitSqlClient,
+} from "../../lib/rate-limit-store.js";
+
+const describeDb =
+  process.env.AILK_TEST_LIVE_DATABASE === "1" ? describe : describe.skip;
+
+function sha256Hex(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+/** Turns a tagged template's strings + values into `$1…$n` text for `pg`. */
+function sqlClient(pgClient: Client): RateLimitSqlClient {
+  function toParamText(
+    strings: TemplateStringsArray,
+    values: readonly unknown[],
+  ): string {
+    let text = strings[0] ?? "";
+    for (let i = 0; i < values.length; i++) {
+      text += `$${i + 1}${strings[i + 1] ?? ""}`;
+    }
+    return text;
+  }
+
+  async function queryRaw(
+    strings: TemplateStringsArray,
+    ...values: unknown[]
+  ): Promise<unknown[]> {
+    const res = await pgClient.query(toParamText(strings, values), values);
+    return res.rows;
+  }
+
+  async function executeRaw(
+    strings: TemplateStringsArray,
+    ...values: unknown[]
+  ): Promise<number> {
+    const res = await pgClient.query(toParamText(strings, values), values);
+    return res.rowCount ?? 0;
+  }
+
+  return {
+    $queryRaw: queryRaw as RateLimitSqlClient["$queryRaw"],
+    $executeRaw: executeRaw as RateLimitSqlClient["$executeRaw"],
+  };
+}
+
+describeDb("rate limiter — the shared database store (live, #5040)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+  });
+
+  afterAll(async () => {
+    await db.end();
+  });
+
+  it("AC-1: 20 concurrent requests spread 10/10 over two isolated module instances, one identity, perIpPerMinute 5 — exactly 5×200, 15×429, stored count 20", async () => {
+    const identity = `rl-demo-${randomUUID()}`;
+    const clientA = new Client({ connectionString: process.env.DATABASE_URL });
+    const clientB = new Client({ connectionString: process.env.DATABASE_URL });
+    await clientA.connect();
+    await clientB.connect();
+
+    let appA: FastifyInstance | undefined;
+    let appB: FastifyInstance | undefined;
+
+    // Each isolateModules block gives a fresh require cache: requiring
+    // rate-limit-store AND rate-limit inside it yields module instances
+    // distinct from every other test file's top-level import, with their
+    // own process-default-store memoization — exactly the D8 pattern PR
+    // #5544 already used for the memory-store proof.
+    jest.isolateModules(() => {
+      const storeMod: typeof import("../../lib/rate-limit-store") = require("../../lib/rate-limit-store");
+      const rateLimitMod: typeof import("../rate-limit") = require("../rate-limit");
+      const app = Fastify({ trustProxy: true });
+      app.register(rateLimitMod.rateLimitMiddleware, {
+        perIpPerMinute: 5,
+        store: storeMod.createDatabaseRateLimitStore(sqlClient(clientA)),
+      });
+      app.get("/test", async () => ({ ok: true }));
+      appA = app;
+    });
+
+    jest.isolateModules(() => {
+      const storeMod: typeof import("../../lib/rate-limit-store") = require("../../lib/rate-limit-store");
+      const rateLimitMod: typeof import("../rate-limit") = require("../rate-limit");
+      const app = Fastify({ trustProxy: true });
+      app.register(rateLimitMod.rateLimitMiddleware, {
+        perIpPerMinute: 5,
+        store: storeMod.createDatabaseRateLimitStore(sqlClient(clientB)),
+      });
+      app.get("/test", async () => ({ ok: true }));
+      appB = app;
+    });
+
+    if (!appA || !appB) {
+      throw new Error("isolateModules did not synchronously assign both apps");
+    }
+    await appA.ready();
+    await appB.ready();
+
+    try {
+      const inject = (app: FastifyInstance) =>
+        app.inject({
+          method: "GET",
+          url: "/test",
+          headers: { "x-forwarded-for": identity },
+        });
+      const results = await Promise.all([
+        ...Array.from({ length: 10 }, () => inject(appA!)),
+        ...Array.from({ length: 10 }, () => inject(appB!)),
+      ]);
+      const statuses = results.map((r) => r.statusCode);
+      expect(statuses.filter((s) => s === 200)).toHaveLength(5);
+      expect(statuses.filter((s) => s === 429)).toHaveLength(15);
+
+      const hash = sha256Hex(identity);
+      const row = await db.query(
+        `SELECT "count" FROM "rate_limit_counters" WHERE "key_hash" = $1`,
+        [hash],
+      );
+      expect(row.rows[0]?.count).toBe(20);
+    } finally {
+      await appA.close();
+      await appB.close();
+      await clientA.end();
+      await clientB.end();
+    }
+  });
+
+  it("AC-7: sweep deletes an expired row only on the interval trigger, never on 'limited'", async () => {
+    const store = createDatabaseRateLimitStore(sqlClient(db));
+    const now = Date.now();
+    const staleHash = sha256Hex(`rl-stale-${randomUUID()}`);
+    const openHash = sha256Hex(`rl-open-${randomUUID()}`);
+
+    await db.query(
+      `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ($1, $2, $3, 1)`,
+      [staleHash, now - 120_000, 60_000],
+    );
+    await db.query(
+      `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ($1, $2, $3, 1)`,
+      [openHash, now, 60_000],
+    );
+
+    await store.sweep(now, 60_000, "limited");
+    let rows = await db.query(
+      `SELECT "key_hash" FROM "rate_limit_counters" WHERE "key_hash" IN ($1, $2)`,
+      [staleHash, openHash],
+    );
+    expect(rows.rows).toHaveLength(2);
+
+    await store.sweep(now, 60_000, "interval");
+    rows = await db.query(
+      `SELECT "key_hash" FROM "rate_limit_counters" WHERE "key_hash" IN ($1, $2)`,
+      [staleHash, openHash],
+    );
+    expect(rows.rows.map((r: { key_hash: string }) => r.key_hash)).toEqual([
+      openHash,
+    ]);
+  });
+
+  it("AC-8: key_hash is always a sha256 digest, never the raw identity, and both format CHECKs hold", async () => {
+    const store = createDatabaseRateLimitStore(sqlClient(db));
+    const identity = `203.0.113.${1 + Math.floor(Math.random() * 254)}`;
+    const now = Date.now();
+    await store.hit(identity, now, 60_000);
+
+    const allRows = await db.query(`SELECT "key_hash" FROM "rate_limit_counters"`);
+    for (const row of allRows.rows as Array<{ key_hash: string }>) {
+      expect(row.key_hash).not.toContain("203.0.113");
+    }
+    const hash = sha256Hex(identity);
+    const matched = await db.query(
+      `SELECT 1 FROM "rate_limit_counters" WHERE "key_hash" = $1`,
+      [hash],
+    );
+    expect(matched.rows).toHaveLength(1);
+
+    await expect(
+      db.query(
+        `INSERT INTO "rate_limit_counters" ("key_hash", "window_start_ms", "window_ms", "count") VALUES ('not-hex', $1, 60000, 1)`,
+        [now],
+      ),
+    ).rejects.toThrow(/rate_limit_counters_key_hash_hex/);
+
+    await expect(
+      db.query(
+        `INSERT INTO "rate_limit_counters" ("id", "key_hash", "window_start_ms", "window_ms", "count") VALUES ('bad', $1, $2, 60000, 1)`,
+        [sha256Hex(`rl-bad-id-${randomUUID()}`), now],
+      ),
+    ).rejects.toThrow(/rate_limit_counters_id_format/);
+  });
+});