create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/project-listings/__tests__/founder-identity.test.ts

@@ -0,0 +1,796 @@
+/**
+ * @file founder-identity.test.ts
+ *
+ * THE ACCEPTANCE GATE for the founder's identity in parts and the resume
+ * link's email verification (#5407).
+ *
+ * Two properties carry this change, and both look fine when broken:
+ *
+ *   1. `founder_name` STILL HOLDS A DISPLAY NAME, composed server-side from
+ *      the parts wherever they are written. Every existing reader of it — the
+ *      submit-time slug fallback, the approve/reject email's greeting, the
+ *      Slack review card, the build issue, the `routeLead` identity — reads
+ *      that column and nothing else, so a `start` that stored the parts and
+ *      left the display line to the client would break all of them at once,
+ *      silently, one release later. The stored line and the stored parts must
+ *      also never DISAGREE, which is why the parts win over a `founderName`
+ *      sent beside them.
+ *
+ *   2. VERIFICATION IS WRITE-ONCE AND TOKEN-GATED. The stamp says the resume
+ *      token reached `founder_email` and came back; a second opening must not
+ *      move it, and a wrong token must change nothing and be indistinguishable
+ *      from an unknown draft. An anonymous route whose entire input is an id
+ *      and a token is an oracle for which drafts exist the moment its answers
+ *      differ.
+ *
+ * Same harness as `structured-address.test.ts`: real routes, real services,
+ * mocked `lib/prisma.js` over a small in-memory row store, `routeLead`
+ * running for real against a per-test temp path.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  // #5406/#5407 — the resume email is the ONLY carrier of the verification
+  // nonce, so this mock is not a stub to keep the suite quiet: it is the
+  // founder's mailbox. `nonceFromEmail` below reads the nonce back out of the
+  // link this was asked to send, which is the only way any test here can
+  // obtain one.
+  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import { sendListingResumeEmail } from "@working-theory/email";
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import { prisma } from "../../../lib/prisma.js";
+import { patchProjectListingDraftRoute } from "../patch-draft.js";
+import { startProjectListingRoute } from "../start.js";
+import { submitProjectListingRoute } from "../submit.js";
+import { verifyProjectListingDraftEmailRoute } from "../verify-email.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SITE_ID = "site-1";
+const SITE_KEY = "pk-site-1";
+
+const opt = (value: string, label: string) => ({ value, label });
+
+const VALID_QUESTIONS = {
+  q2: {
+    prompt: "Why are you here?",
+    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
+  },
+  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: {
+    prompt: "Urgency?",
+    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
+  },
+  q6: {
+    prompt: "Pain?",
+    options: [
+      opt("low", "Low"),
+      opt("medium", "Medium"),
+      opt("high", "High"),
+      opt("critical", "Critical"),
+    ],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+/** The #5407 contact screen's body: the name in PARTS, plus a phone. */
+const START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderFirstName: "Ada",
+  founderLastName: "Lovelace",
+  founderEmail: "ada@example.com",
+  founderPhone: "+44 20 7946 0958",
+  consent: true,
+};
+
+/** What every caller that predates #5407 sends, and must go on sending. */
+const LEGACY_START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderName: "Ada van der Berg",
+  founderEmail: "ada@example.com",
+  consent: true,
+};
+
+/** Everything the steps after step one collect, minus the address. */
+const APPLICATION_WITHOUT_ADDRESS = {
+  name: "My Project",
+  headline: "Ten words or fewer for the tile title here",
+  oneLiner: "A short sentence describing what the project does for its people.",
+  problem: "The problem is real and this describes it.",
+  product: "wireframes",
+  commitment: "part-time",
+  teamComposition: "co-founders",
+  faqs: [
+    { question: "Q one?", answer: "A one." },
+    { question: "Q two?", answer: "A two." },
+    { question: "Q three?", answer: "A three." },
+  ],
+  questions: VALID_QUESTIONS,
+};
+
+/** A complete address, so a draft can be driven all the way to `submit`. */
+const ADDRESS_PARTS = {
+  addressLine1: "221B Baker Street",
+  city: "London",
+  region: "Greater London",
+  postalCode: "NW1 6XE",
+  country: "GB",
+};
+
+// ─── The in-memory row store the Prisma mock is backed by ───────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+/** Whether the site has switched the #5406 resume email on for this test. */
+let resumeEmailEnabled = true;
+
+/**
+ * The site's `SiteListingConfig` row, carrying the two members #5406 requires
+ * before it will send anything. Everything else falls back to the platform
+ * defaults, exactly as it does for a site that configures only these.
+ */
+const SITE_CONFIG_ROW = {
+  // `listingConfigFor` selects `data` and parses that blob — the config is one
+  // JSON column, not a row of columns.
+  data: {
+    resumeEmail: {
+      fromAddress: "hello@site.example",
+      baseUrl: "https://site.example/apply",
+    },
+  },
+};
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (key === "OR") {
+      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
+    }
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+      if ("startsWith" in clause) {
+        return (
+          typeof row[key] === "string" &&
+          (row[key] as string).startsWith(clause["startsWith"] as string)
+        );
+      }
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+  resumeEmailEnabled = true;
+
+  (prisma.lead.create as jest.Mock).mockImplementation(() =>
+    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
+  );
+
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
+      }
+      // #5406 — the resume email is OPT-IN, and this suite opts in: without
+      // `fromAddress` and `baseUrl` no message is sent, so no nonce is ever
+      // delivered and nothing here could verify. The `resume-email-off` block
+      // at the end of the file asserts exactly that state, with this returning
+      // null instead.
+      return Promise.resolve(resumeEmailEnabled ? SITE_CONFIG_ROW : null);
+    },
+  );
+
+  // #5275 — the grant write `start` makes after the row. Append-only; it only
+  // needs to resolve here (drafts.test.ts asserts on what it is called with).
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
+
+  // #5275 — `start` writes the row and its grant in one interactive
+  // transaction; the mock hands the same store-backed client through.
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+
+  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
+    const now = new Date();
+    const row: Row = {
+      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+      slug: null,
+      name: null,
+      oneLiner: null,
+      problem: null,
+      url: null,
+      product: null,
+      commitment: null,
+      teamComposition: null,
+      faqs: null,
+      anythingElse: null,
+      address: null,
+      // #5279 — a freshly-started draft has no parts, exactly like every row
+      // written before the columns existed.
+      addressLine1: null,
+      addressLine2: null,
+      addressCity: null,
+      addressRegion: null,
+      addressPostalCode: null,
+      addressCountry: null,
+      questions: null,
+      // #5407 — a row written before the columns existed, and a freshly
+      // started draft on a site that asks for one name line: parts null,
+      // no phone, no verification stamp.
+      founderFirstName: null,
+      founderLastName: null,
+      founderPhone: null,
+      emailVerifiedAt: null,
+      founderCompany: null,
+      leadId: null,
+      headline: null,
+      logoMarkUrl: null,
+      logoWordmarkUrl: null,
+      featured: false,
+      decidedAt: null,
+      decidedBy: null,
+      issueUrl: null,
+      experimentKey: null,
+      windowEndsAt: null,
+      createdAt: now,
+      updatedAt: now,
+      ...data,
+    };
+    rows.push(row);
+    return Promise.resolve(row);
+  });
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where))),
+  );
+
+  (prisma.projectListing.update as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const row = rows.find((r) => matches(r, where));
+      Object.assign(row!, data, { updatedAt: new Date() });
+      return Promise.resolve(row);
+    },
+  );
+
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const matched = rows.filter((r) => matches(r, where));
+      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
+      return Promise.resolve({ count: matched.length });
+    },
+  );
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.register(patchProjectListingDraftRoute);
+  await app.register(submitProjectListingRoute);
+  await app.register(verifyProjectListingDraftEmailRoute);
+  await app.ready();
+  return app;
+}
+
+async function startDraft(
+  app: FastifyInstance,
+  payload: Record<string, unknown> = START_PAYLOAD,
+): Promise<{ id: string; resumeToken: string }> {
+  const res = await app.inject({
+    method: "POST",
+    url: "/v1/project-listings",
+    payload,
+  });
+  expect(res.statusCode).toBe(201);
+  return (res.json() as { data: { id: string; resumeToken: string } }).data;
+}
+
+/**
+ * Call the verify route the way a founder's browser does when it lands on the
+ * emailed link: the resume token in the header, the nonce in the body.
+ *
+ * `nonce` is deliberately a separate argument rather than something derived
+ * from `draft`, because the WHOLE POINT of #5407's fix is that the nonce is
+ * not derivable from anything `start` hands back. A test that could reach it
+ * without going through the email would be testing the forgeable design.
+ */
+const verifyEmail = (
+  app: FastifyInstance,
+  id: string,
+  token?: string,
+  nonce?: string,
+) =>
+  app.inject({
+    method: "POST",
+    url: `/v1/project-listings/drafts/${id}/verify-email`,
+    ...(token === undefined ? {} : { headers: bearer(token) }),
+    ...(nonce === undefined ? {} : { payload: { verifyNonce: nonce } }),
+  });
+
+/**
+ * Wait for the fire-and-forget resume email to have been dispatched.
+ *
+ * `start` returns its 201 without awaiting the send, so the mock is called a
+ * microtask or two later. Polling the mock is what makes every test below
+ * deterministic without reaching into the service's internals.
+ */
+async function waitForEmail(listingId: string): Promise<void> {
+  for (let i = 0; i < 50; i += 1) {
+    const sent = (sendListingResumeEmail as jest.Mock).mock.calls.some(([arg]) =>
+      String((arg as { resumeLink: string }).resumeLink).includes(listingId),
+    );
+    if (sent) return;
+    await new Promise((resolve) => setTimeout(resolve, 2));
+  }
+  throw new Error(`no resume email dispatched for ${listingId}`);
+}
+
+/**
+ * The nonce as it reached the FOUNDER — read out of the link the resume email
+ * was asked to send, which is the only place it exists outside the server.
+ *
+ * `sendListingResumeEmail` is mocked at the top of this file, so this reads
+ * the argument `project-listing-resume-email.ts` passed it. That indirection
+ * is the test's whole value: it proves the nonce travels by mail and by
+ * nothing else.
+ */
+function nonceFromEmail(listingId: string): string {
+  const calls = (sendListingResumeEmail as jest.Mock).mock.calls;
+  const call = calls.find(([arg]) =>
+    String((arg as { resumeLink: string }).resumeLink).includes(listingId),
+  );
+  if (!call) throw new Error(`no resume email sent for ${listingId}`);
+  const link = new URL((call[0] as { resumeLink: string }).resumeLink);
+  const nonce = link.searchParams.get("verify");
+  if (!nonce) throw new Error("the emailed link carried no verify nonce");
+  return nonce;
+}
+
+const patch = (
+  app: FastifyInstance,
+  draft: { id: string; resumeToken: string },
+  payload: Record<string, unknown>,
+) =>
+  app.inject({
+    method: "PATCH",
+    url: `/v1/project-listings/drafts/${draft.id}`,
+    headers: bearer(draft.resumeToken),
+    payload,
+  });
+
+const submit = (app: FastifyInstance, draft: { id: string; resumeToken: string }) =>
+  app.inject({
+    method: "POST",
+    url: `/v1/project-listings/drafts/${draft.id}/submit`,
+    headers: bearer(draft.resumeToken),
+  });
+
+const storedRow = (id: string): Row => {
+  const row = rows.find((r) => r["id"] === id);
+  expect(row).toBeDefined();
+  return row!;
+};
+
+const draftBody = (res: { json: () => unknown }) =>
+  (res.json() as { data: Record<string, unknown> }).data;
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe("the founder's identity in parts (#5407)", () => {
+  setupLeadFileEnv("project-listing-founder-identity");
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe("`start` stores the parts AND composes the display name", () => {
+    it("writes first name, last name and phone to their own columns", async () => {
+      const draft = await startDraft(app);
+
+      const row = storedRow(draft.id);
+      expect(row["founderFirstName"]).toBe("Ada");
+      expect(row["founderLastName"]).toBe("Lovelace");
+      expect(row["founderPhone"]).toBe("+44 20 7946 0958");
+    });
+
+    it("writes `founder_name` as the composed display string", async () => {
+      // The column every existing reader reads. Written out literally rather
+      // than by calling `composeFounderName`, so a change to the joiner fails
+      // this test instead of travelling through it.
+      const draft = await startDraft(app);
+      expect(storedRow(draft.id)["founderName"]).toBe("Ada Lovelace");
+    });
+
+    it("composes from the PARTS even when the body also sends a display line", async () => {
+      // The stored line and the stored parts must never disagree — a row
+      // saying "A. Lovelace" beside parts saying "Ada" + "Lovelace" has no
+      // reader that can tell which is right.
+      const draft = await startDraft(app, {
+        ...START_PAYLOAD,
+        founderName: "A. Lovelace",
+      });
+
+      const row = storedRow(draft.id);
+      expect(row["founderName"]).toBe("Ada Lovelace");
+      expect(row["founderFirstName"]).toBe("Ada");
+      expect(row["founderLastName"]).toBe("Lovelace");
+    });
+
+    it("carries the composed name through SUBMIT, which is where every reader picks it up", async () => {
+      // `submit` is the moment the slug is derived, the Lead is written and
+      // the Slack card is posted — all three read `founderName` off the row
+      // and none of them knows the parts exist.
+      const draft = await startDraft(app);
+      await patch(app, draft, { ...APPLICATION_WITHOUT_ADDRESS, address: ADDRESS_PARTS });
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(storedRow(draft.id)["founderName"]).toBe("Ada Lovelace");
+      // The parts survive the transition beside it, unaltered.
+      expect(storedRow(draft.id)["founderFirstName"]).toBe("Ada");
+      expect(storedRow(draft.id)["founderLastName"]).toBe("Lovelace");
+    });
+  });
+
+  describe("a caller that predates #5407 is untouched", () => {
+    it("stores a `founderName` line VERBATIM, with both parts null", async () => {
+      const draft = await startDraft(app, LEGACY_START_PAYLOAD);
+
+      const row = storedRow(draft.id);
+      // Nothing splits it. "Ada van der Berg" has no last space that means
+      // anything, and a wrong split would put an invented surname on the row
+      // the operator reviews with nothing to mark it as invented.
+      expect(row["founderName"]).toBe("Ada van der Berg");
+      expect(row["founderFirstName"]).toBeNull();
+      expect(row["founderLastName"]).toBeNull();
+      expect(row["founderPhone"]).toBeNull();
+    });
+
+    it("refuses a body carrying no name at all, rather than writing a blank one", async () => {
+      const { founderName: _line, ...nameless } = LEGACY_START_PAYLOAD;
+
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: nameless,
+      });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows).toHaveLength(0);
+    });
+
+    it("refuses whitespace-only parts, rather than storing a blank-looking name", async () => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, founderFirstName: "   ", founderLastName: "  " },
+      });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows).toHaveLength(0);
+    });
+  });
+
+  describe("the founder's own draft read echoes their own input back", () => {
+    it("carries the phone and an unverified stamp", async () => {
+      // The founder's own echo DOES carry the phone — it is their own step-one
+      // input, returned to the person who typed it. What must never carry it
+      // is the PUBLIC read, which `public.test.ts` asserts against a row with
+      // a real phone on it rather than a null one.
+      const draft = await startDraft(app);
+      const body = draftBody(await patch(app, draft, { headline: "A headline here" }));
+      expect(body["founderPhone"]).toBe("+44 20 7946 0958");
+      expect(body["emailVerifiedAt"]).toBeNull();
+    });
+  });
+});
+
+describe("the resume link's email verification (#5407)", () => {
+  setupLeadFileEnv("project-listing-verify-email");
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  /** Start a draft and wait for its resume email to have been dispatched. */
+  async function startAndMail(): Promise<{
+    id: string;
+    resumeToken: string;
+    nonce: string;
+  }> {
+    const draft = await startDraft(app);
+    // The send is fire-and-forget, so it lands a microtask or two after the
+    // 201. Waiting on the mock is what makes this deterministic.
+    await waitForEmail(draft.id);
+    return { ...draft, nonce: nonceFromEmail(draft.id) };
+  }
+
+  // ── THE LOAD-BEARING TEST ────────────────────────────────────────────────
+  //
+  // The first design of this route stamped on the resume token alone, and the
+  // resume token is in `start`'s own 201 body. So the forge was two calls:
+  // open a draft under a stranger's address, take the token out of the
+  // response, present it back. Everything else in this describe block can
+  // pass with that design; only this fails.
+  describe("the forge path — `start`'s own response is not enough", () => {
+    it("REFUSES a caller holding only what `start` returned", async () => {
+      const draft = await startDraft(app, {
+        ...START_PAYLOAD,
+        founderEmail: "victim@example.com",
+      });
+
+      // Everything an attacker has after two HTTP calls: the id and the
+      // resume token, straight out of the 201.
+      const res = await verifyEmail(app, draft.id, draft.resumeToken, draft.resumeToken);
+
+      expect(res.statusCode).toBe(404);
+      expect(storedRow(draft.id)["emailVerifiedAt"]).toBeNull();
+    });
+
+    it("never puts the nonce in `start`'s response, where the forge would find it", async () => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: START_PAYLOAD,
+      });
+
+      expect(res.statusCode).toBe(201);
+      // The response is the id and the token, and nothing else — the route's
+      // hard-floor contract, unchanged by #5407.
+      const data = (res.json() as { data: Record<string, unknown> }).data;
+      expect(Object.keys(data).sort()).toEqual(["id", "resumeToken"]);
+
+      // And the nonce is nowhere in the body at all, under any key.
+      await waitForEmail(String(data["id"]));
+      expect(res.body).not.toContain(nonceFromEmail(String(data["id"])));
+    });
+
+    it("stores only a DIGEST — the nonce is not readable off the row", async () => {
+      const { id, nonce } = await startAndMail();
+
+      const row = storedRow(id);
+      expect(row["emailVerifyNonceHash"]).toEqual(expect.any(String));
+      expect(row["emailVerifyNonceHash"]).not.toBe(nonce);
+      // sha-256, hex.
+      expect(row["emailVerifyNonceHash"]).toMatch(/^[0-9a-f]{64}$/);
+    });
+  });
+
+  describe("the emailed nonce is what verifies", () => {
+    it("stamps `email_verified_at` when the link's own nonce is presented", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
+
+      const res = await verifyEmail(app, id, resumeToken, nonce);
+
+      expect(res.statusCode).toBe(200);
+      const stamped = storedRow(id)["emailVerifiedAt"];
+      expect(stamped).toBeInstanceOf(Date);
+      expect((res.json() as { data: { emailVerifiedAt: string } }).data.emailVerifiedAt).toBe(
+        (stamped as Date).toISOString(),
+      );
+    });
+
+    it("is WRITE-ONCE — a second call answers the FIRST stamp and moves nothing", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+
+      const first = await verifyEmail(app, id, resumeToken, nonce);
+      const firstStamp = storedRow(id)["emailVerifiedAt"] as Date;
+
+      const second = await verifyEmail(app, id, resumeToken, nonce);
+
+      expect(second.statusCode).toBe(200);
+      expect((storedRow(id)["emailVerifiedAt"] as Date).getTime()).toBe(firstStamp.getTime());
+      expect(second.json()).toEqual(first.json());
+    });
+
+    it("refuses a WRONG nonce, with the same 404 as everything else", async () => {
+      const { id, resumeToken } = await startAndMail();
+
+      const res = await verifyEmail(app, id, resumeToken, "not-the-nonce");
+
+      expect(res.statusCode).toBe(404);
+      expect(res.json()).toEqual({
+        ok: false,
+        error: { code: "not_found", message: "Draft not found" },
+      });
+      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
+    });
+
+    it("refuses another listing's nonce", async () => {
+      const mine = await startAndMail();
+      const theirs = await startDraft(app, {
+        ...START_PAYLOAD,
+        founderEmail: "grace@example.com",
+      });
+      await waitForEmail(theirs.id);
+
+      const res = await verifyEmail(
+        app,
+        theirs.id,
+        theirs.resumeToken,
+        nonceFromEmail(mine.id),
+      );
+
+      expect(res.statusCode).toBe(404);
+      expect(storedRow(theirs.id)["emailVerifiedAt"]).toBeNull();
+      expect(storedRow(mine.id)["emailVerifiedAt"]).toBeNull();
+    });
+
+    it("refuses a WRONG resume token even with the right nonce", async () => {
+      // The nonce carries the proof, but the token stays in the guard — a
+      // nonce that leaked on its own still opens nothing.
+      const { id, nonce } = await startAndMail();
+
+      const res = await verifyEmail(app, id, "not-the-token", nonce);
+
+      expect(res.statusCode).toBe(404);
+      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
+    });
+  });
+
+  describe("the error surface is `patch`'s and `submit`'s", () => {
+    it("gives an UNKNOWN id the identical answer to a wrong nonce", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+      const wrongNonce = await verifyEmail(app, id, resumeToken, "not-the-nonce");
+      const unknownId = await verifyEmail(
+        app,
+        "prjl_00000000-0000-7000-8000-0000000000ff",
+        resumeToken,
+        nonce,
+      );
+
+      expect(unknownId.statusCode).toBe(wrongNonce.statusCode);
+      expect(unknownId.json()).toEqual(wrongNonce.json());
+    });
+
+    it("refuses a SUBMITTED row — submit clears both digests", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+      const draft = { id, resumeToken };
+      await patch(app, draft, { ...APPLICATION_WITHOUT_ADDRESS, address: ADDRESS_PARTS });
+      expect((await submit(app, draft)).statusCode).toBe(200);
+
+      expect(storedRow(id)["emailVerifyNonceHash"]).toBeNull();
+      const res = await verifyEmail(app, id, resumeToken, nonce);
+
+      expect(res.statusCode).toBe(404);
+      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
+    });
+
+    it("answers 401 when no token is presented at all", async () => {
+      const { id, nonce } = await startAndMail();
+
+      const res = await verifyEmail(app, id, undefined, nonce);
+
+      expect(res.statusCode).toBe(401);
+      expect(res.json()).toEqual({
+        ok: false,
+        error: { code: "unauthorized", message: "A resume token is required" },
+      });
+    });
+
+    it("answers 400 when the body carries no nonce", async () => {
+      const { id, resumeToken } = await startAndMail();
+
+      const res = await verifyEmail(app, id, resumeToken);
+
+      expect(res.statusCode).toBe(400);
+      expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
+      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
+    });
+
+    it("answers 400 on a malformed id, before any credential is consulted", async () => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings/drafts/not-an-id/verify-email",
+        headers: bearer("anything"),
+        payload: { verifyNonce: "anything" },
+      });
+
+      expect(res.statusCode).toBe(400);
+      expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
+    });
+
+    it("never returns either credential, on success or failure", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+      const ok = await verifyEmail(app, id, resumeToken, nonce);
+      const bad = await verifyEmail(app, id, resumeToken, "not-the-nonce");
+
+      for (const res of [ok, bad]) {
+        expect(res.body).not.toContain(resumeToken);
+        expect(res.body).not.toContain(nonce);
+      }
+      // And nothing but the id and the stamp rides the success body.
+      expect(Object.keys((ok.json() as { data: Record<string, unknown> }).data).sort()).toEqual([
+        "emailVerifiedAt",
+        "id",
+      ]);
+    });
+
+    it("surfaces the stamp on the founder's own draft read", async () => {
+      const { id, resumeToken, nonce } = await startAndMail();
+      await verifyEmail(app, id, resumeToken, nonce);
+
+      const body = draftBody(
+        await patch(app, { id, resumeToken }, { headline: "A headline here" }),
+      );
+
+      expect(body["emailVerifiedAt"]).toBe(
+        (storedRow(id)["emailVerifiedAt"] as Date).toISOString(),
+      );
+      // The nonce digest is an internal column and never rides a response.
+      expect(body["emailVerifyNonceHash"]).toBeUndefined();
+    });
+  });
+
+  describe("a site that sends no resume email can never verify", () => {
+    it("mints a nonce, delivers none, and leaves the row unverifiable", async () => {
+      resumeEmailEnabled = false;
+
+      const draft = await startDraft(app);
+      await Promise.resolve();
+
+      // The nonce exists — `start` cannot know whether the send will happen.
+      expect(storedRow(draft.id)["emailVerifyNonceHash"]).toEqual(expect.any(String));
+      // But nothing was mailed, so nothing outside the server holds it.
+      expect(sendListingResumeEmail).not.toHaveBeenCalled();
+      // And the only credentials anyone has do not verify. That is the
+      // correct outcome, not a gap: nobody has read anything at that address.
+      const res = await verifyEmail(app, draft.id, draft.resumeToken, draft.resumeToken);
+      expect(res.statusCode).toBe(404);
+      expect(storedRow(draft.id)["emailVerifiedAt"]).toBeNull();
+    });
+  });
+});