create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/project-listings/__tests__/me-route-precedence.test.ts

@@ -1,221 +0,0 @@
-// oss: false
-/**
- * @file me-route-precedence.test.ts
- *
- * The regression net for the one structural risk in #5295: the static
- * `/v1/project-listings/me` and the parametric `/v1/project-listings/:id` share
- * a prefix and are registered in DIFFERENT scopes — `/me` in `server.ts`'s
- * `authScope`, `/:id` inside the encapsulated `tenantScope` behind
- * `tenantPreHandlerPlugin`.
- *
- * `me.test.ts` registers `/me` alone, so nothing there would catch a
- * registration reorder that shadowed `/me` or weakened the tenant guard on
- * `/:id`. The security review for this change verified the behaviour by hand and
- * named the missing net; this file is that net.
- *
- * It asserts three things in ONE Fastify instance with the REAL preHandlers:
- *   1. `/v1/project-listings/me` reaches the `/me` handler — static beats
- *      parametric — and runs auth ONLY, no tenant guard.
- *   2. `/v1/project-listings/<id>` still reaches the tenant handler WITH the
- *      tenant guard: registering a static sibling in the outer scope does not
- *      weaken it. A member below the `owner|admin` floor is still refused.
- *   3. Registering both raises no duplicate-route error.
- *
- * This file is `oss: false` because it imports the multi-tenant slice
- * (`middleware/tenant.js`, `./get.js`), the same reason `tenant-isolation.test.ts`
- * is.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-}));
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    user: { findUnique: jest.fn() },
-    workspace: { findUnique: jest.fn(), count: jest.fn() },
-    membership: { findUnique: jest.fn() },
-    projectListing: { findMany: jest.fn(), findFirst: jest.fn() },
-    waitlistScore: { count: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
-import { projectListingMeRoute, projectListingTenantRoutes } from "../index.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-
-const ORG = "org_00000000-0000-7000-8000-000000000001";
-const WS = "wksp_00000000-0000-7000-8000-000000000001";
-const LISTING_ID = "prjl_00000000-0000-7000-8000-0000000000d1";
-
-/** `owner` clears the floor; `member` does not. Both are real members of ORG. */
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_owner: {
-    id: "sess_owner",
-    userId: "owner-user",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG,
-    activeWorkspaceId: WS,
-  },
-  cookie_member: {
-    id: "sess_member",
-    userId: "member-user",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG,
-    activeWorkspaceId: WS,
-  },
-};
-
-const MEMBERSHIPS: Record<string, string> = {
-  "owner-user": "owner",
-  "member-user": "member",
-};
-
-async function buildApp(): Promise<FastifyInstance> {
-  // The exact nesting server.ts uses: /me in the OUTER auth scope, the tenant
-  // routes in an INNER scope behind the tenant preHandler.
-  const app = Fastify();
-  await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
-    await authScope.register(projectListingMeRoute);
-    await authScope.register(async (tenantScope) => {
-      await tenantScope.register(tenantPreHandlerPlugin);
-      await tenantScope.register(projectListingTenantRoutes);
-    });
-  });
-  await app.ready();
-  return app;
-}
-
-const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
-
-let app: FastifyInstance;
-
-beforeEach(async () => {
-  jest.clearAllMocks();
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
-  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
-    Promise.resolve({ id: where.id, email: `${where.id}@example.com`, emailVerified: true }),
-  );
-  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({ id: WS, organizationId: ORG });
-  // The composite key is `organizationId_userId` — the order `tenant-context.ts`
-  // actually queries with.
-  (prisma.membership.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { organizationId_userId?: { userId: string } } }) => {
-      const userId = where.organizationId_userId?.userId;
-      const role = userId ? MEMBERSHIPS[userId] : undefined;
-      return Promise.resolve(role ? { role } : null);
-    },
-  );
-  // The /me read returns nothing; this file is about routing, not payloads.
-  (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([]);
-  (prisma.projectListing.findFirst as jest.Mock).mockResolvedValue(null);
-  app = await buildApp();
-});
-
-afterEach(async () => {
-  await app.close();
-});
-
-describe("route precedence: static /me beside parametric /:id in one instance", () => {
-  it("registering both raises no duplicate-route error", async () => {
-    // buildApp() already awaited app.ready(); reaching here is the assertion.
-    const tree = app.printRoutes();
-    expect(tree).toContain("me");
-    expect(tree).toContain(":id");
-  });
-
-  it("/v1/project-listings/me reaches the /me handler, not the parametric one", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings/me",
-      headers: cookie("cookie_owner"),
-    });
-
-    // The /me handler answers its own 200 + empty list. The parametric handler
-    // would have answered 400 `validation_failed` — "me" is not a listing id.
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: [] });
-    // And it read through the owner link, not by id.
-    expect(prisma.projectListing.findMany).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { ownerUserId: "owner-user" } }),
-    );
-    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
-  });
-
-  it("/me runs auth ONLY — a caller BELOW the owner|admin floor still gets their own rows", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings/me",
-      headers: cookie("cookie_member"),
-    });
-
-    // A `member` is refused by the tenant routes and allowed here: /me is not
-    // behind the floor, and it does not need to be — the owner link is the gate.
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: [] });
-  });
-
-  it("the parametric /:id still runs the tenant guard — the static sibling does not weaken it", async () => {
-    const ownerRes = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/${LISTING_ID}`,
-      headers: cookie("cookie_owner"),
-    });
-    // Owner clears the floor and reaches the service, which finds no row.
-    expect(ownerRes.statusCode).toBe(404);
-
-    const memberRes = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/${LISTING_ID}`,
-      headers: cookie("cookie_member"),
-    });
-    // Member is still refused BEFORE any read — the floor is intact.
-    expect(memberRes.statusCode).toBe(403);
-  });
-
-  it("the tenant LIST route is unaffected and still refuses a member", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings",
-      headers: cookie("cookie_member"),
-    });
-
-    expect(res.statusCode).toBe(403);
-  });
-
-  it("an unauthenticated caller is refused on both paths", async () => {
-    const meRes = await app.inject({ method: "GET", url: "/v1/project-listings/me" });
-    const idRes = await app.inject({ method: "GET", url: `/v1/project-listings/${LISTING_ID}` });
-
-    expect(meRes.statusCode).toBe(401);
-    expect(idRes.statusCode).toBe(401);
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-    expect(prisma.projectListing.findFirst).not.toHaveBeenCalled();
-  });
-});