create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/project-listings/__tests__/tenant-isolation.test.ts

@@ -1,566 +0,0 @@
-// oss: false
-/**
- * @file tenant-isolation.test.ts
- *
- * THE ACCEPTANCE GATE for the tenant-scoped project-listings routes (#4998
- * AC2, AC3). Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
- * tenantPreHandlerPlugin -> projectListingTenantRoutes`, mocked
- * `lib/prisma.js`. Fixture sessions for: a site-A owner (sees only site A),
- * a site-B admin (sees only site B; 404 on site A's listing id), a site-B
- * member (403 on every route, before any read), a bearer token (403), no
- * cookie (401). Every success body parses under `projectListingSchema`;
- * `waitlistCount` joins on the listing's own `experimentKey` -> `WaitlistScore.count`
- * — one hop since #5036 D6d, where it used to translate an `experimentId`
- * through `WaitlistExperiment` first. The PATCH transition table is exercised
- * exhaustively — every from->to pair (including #4999's one behavior change:
- * a decision target on an already-decided listing is now a `200` idempotent
- * no-op via the shared `decideListing`, not a `400`).
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { projectListingSchema } from "@working-theory/validation";
-
-// `services/project-listings.ts` imports `routeLead` from `lead-routing.js`
-// (used by the draft-submit path, not by these routes) at module scope, which
-// transitively imports `@working-theory/email` and `@working-theory/license`
-// — mocked here purely so that import chain resolves, mirroring
-// `routes/leads/__tests__/index.test.ts`'s discipline.
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-}));
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    workspace: { findUnique: jest.fn(), count: jest.fn() },
-    membership: { findUnique: jest.fn() },
-    projectListing: { findFirst: jest.fn(), findMany: jest.fn(), update: jest.fn(), updateMany: jest.fn() },
-    waitlistExperiment: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
-import { projectListingTenantRoutes } from "../index.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-
-const ORG_A = "org_00000000-0000-7000-8000-000000000001";
-const WS_A = "wksp_00000000-0000-7000-8000-000000000001";
-const ORG_B = "org_01991234-5678-7000-8000-0000000000bb";
-const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
-
-const WORKSPACES = [
-  { id: WS_A, organizationId: ORG_A },
-  { id: WS_B, organizationId: ORG_B },
-];
-
-const MEMBERSHIPS = [
-  { organizationId: ORG_A, userId: "alice", role: "owner" },
-  { organizationId: ORG_B, userId: "erin", role: "admin" },
-  { organizationId: ORG_B, userId: "carol", role: "member" },
-];
-
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_alice: {
-    id: "sess_alice",
-    userId: "alice",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_A,
-    activeWorkspaceId: WS_A,
-  },
-  cookie_erin: {
-    id: "sess_erin",
-    userId: "erin",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_B,
-    activeWorkspaceId: WS_B,
-  },
-  cookie_carol: {
-    id: "sess_carol",
-    userId: "carol",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_B,
-    activeWorkspaceId: WS_B,
-  },
-};
-
-const opt = (value: string, label: string) => ({ value, label });
-const QUESTIONS = {
-  q2: { prompt: "x", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
-  q3: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q4: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q5: { prompt: "x", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
-  q6: {
-    prompt: "x",
-    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
-  },
-  q7: { prompt: "x" },
-  extras: [],
-};
-
-const LISTING_A = "prjl_00000000-0000-7000-8000-0000000000a1";
-const LISTING_B = "prjl_00000000-0000-7000-8000-0000000000b1";
-/** The experiment KEY the listing stores since #5036 D6d — not an id. */
-const EXP_KEY_A = "exp-a";
-
-function makeRow(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: LISTING_A,
-    siteId: WS_A,
-    leadId: "lead_00000000-0000-7000-8000-000000000001",
-    slug: "my-project",
-    name: "My Project",
-    oneLiner: "A one-liner",
-    problem: "The problem",
-    url: null,
-    // #5036 D2/D5 — `audience` is gone, `stage` is the `product` ladder, and
-    // these five are what the page and tile render from.
-    product: "working-prototype",
-    commitment: "part-time",
-    teamComposition: "just-me",
-    faqs: null,
-    anythingElse: null,
-    address: "1 Example Street, Exampleton, EX1 2AM",
-    questions: QUESTIONS,
-    founderName: "Ada Founder",
-    founderEmail: "ada@example.com",
-    founderCompany: null,
-    headline: null,
-    logoMarkUrl: null,
-    logoWordmarkUrl: null,
-    featured: false,
-    status: "requested",
-    // Stamped at `start`, never null (#5036 D1).
-    consentAt: new Date("2026-09-01T00:00:00.000Z"),
-    decidedAt: null,
-    decidedBy: null,
-    issueUrl: null,
-    // The experiment's KEY, not its id (#5036 D6d).
-    experimentKey: null,
-    windowDays: 21,
-    windowEndsAt: null,
-    slackChannel: null,
-    slackTs: null,
-    createdAt: new Date("2026-09-01T00:00:00.000Z"),
-    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
-    ...overrides,
-  };
-}
-
-const ROWS = [
-  makeRow(),
-  makeRow({ id: LISTING_B, siteId: WS_B, slug: "other-project", founderEmail: "bob@example.com" }),
-];
-
-function installFixtureMocks(rows = ROWS): void {
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { id?: string } }) =>
-      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
-  );
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
-  (prisma.membership.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { organizationId_userId?: { organizationId: string; userId: string } } }) => {
-      const key = where.organizationId_userId;
-      if (!key) return Promise.resolve(null);
-      return Promise.resolve(
-        MEMBERSHIPS.find((m) => m.organizationId === key.organizationId && m.userId === key.userId) ?? null,
-      );
-    },
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; status?: string; slug?: { startsWith: string } } }) =>
-      Promise.resolve(
-        rows.filter(
-          (r) =>
-            r.siteId === where.siteId &&
-            (where.status === undefined || r.status === where.status) &&
-            (where.slug === undefined || r.slug.startsWith(where.slug.startsWith)),
-        ),
-      ),
-  );
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: { id?: string; siteId?: string } }) =>
-      Promise.resolve(rows.find((r) => r.id === where.id && r.siteId === where.siteId) ?? null),
-  );
-  (prisma.projectListing.update as jest.Mock).mockImplementation(
-    ({ where, data }: { where: { id: string }; data: Record<string, unknown> }) => {
-      const row = rows.find((r) => r.id === where.id);
-      if (!row) throw new Error("not found");
-      const updated = { ...row, ...data };
-      Object.assign(row, updated);
-      return Promise.resolve(updated);
-    },
-  );
-  // decideListing's guarded compare-and-swap write (#4999 security review) —
-  // only mutates a row when every `where` key matches (a `status: "requested"`
-  // mismatch, e.g. already decided, returns `{ count: 0 }` untouched).
-  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
-    ({
-      where,
-      data,
-    }: {
-      where: { id?: string; siteId?: string; status?: string };
-      data: Record<string, unknown>;
-    }) => {
-      const row = rows.find(
-        (r) =>
-          r.id === where.id &&
-          (where.siteId === undefined || r.siteId === where.siteId) &&
-          (where.status === undefined || r.status === where.status),
-      );
-      if (!row) return Promise.resolve({ count: 0 });
-      Object.assign(row, data);
-      return Promise.resolve({ count: 1 });
-    },
-  );
-  (prisma.waitlistExperiment.findMany as jest.Mock).mockResolvedValue([]);
-  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
-  app.register(async (scope) => {
-    await scope.register(tenantPreHandlerPlugin);
-    await scope.register(projectListingTenantRoutes);
-  });
-  await app.ready();
-  return app;
-}
-
-function cookieHeaders(token: string): Record<string, string> {
-  // `origin` satisfies the same-origin CSRF check the auth preHandler runs
-  // on non-GET cookie requests (middleware/auth.ts) — harmless on GET.
-  return { cookie: `better-auth.session_token=${token}`, origin: FRONTEND };
-}
-
-describe("project-listings — tenant isolation", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installFixtureMocks();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("a site-A owner sees only site A's listing", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings",
-      headers: cookieHeaders("cookie_alice"),
-    });
-    expect(res.statusCode).toBe(200);
-    const body = res.json();
-    expect(body.data).toHaveLength(1);
-    expect(body.data[0].id).toBe(LISTING_A);
-    expect(projectListingSchema.safeParse(body.data[0]).success).toBe(true);
-  });
-
-  it("a site-B admin sees only site B's listing", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings",
-      headers: cookieHeaders("cookie_erin"),
-    });
-    expect(res.statusCode).toBe(200);
-    expect(res.json().data.map((r: { id: string }) => r.id)).toEqual([LISTING_B]);
-  });
-
-  it("404s on the other site's listing id, indistinguishable from a genuinely-missing one", async () => {
-    const foreign = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_erin"),
-    });
-    expect(foreign.statusCode).toBe(404);
-
-    const missing = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings/prjl_00000000-0000-7000-8000-00000000dead",
-      headers: cookieHeaders("cookie_alice"),
-    });
-    expect(missing.statusCode).toBe(404);
-    expect(missing.body).toBe(foreign.body);
-  });
-
-  it("400s on a malformed :id", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings/not-a-valid-id",
-      headers: cookieHeaders("cookie_alice"),
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("a site-B member gets 403 on every route, before any read", async () => {
-    const list = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings",
-      headers: cookieHeaders("cookie_carol"),
-    });
-    expect(list.statusCode).toBe(403);
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-
-    const patchRes = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_B}`,
-      headers: cookieHeaders("cookie_carol"),
-      payload: { status: "active" },
-    });
-    expect(patchRes.statusCode).toBe(403);
-  });
-
-  it("a bearer token gets 403 (no tenant binding)", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok1",
-      userId: "erin",
-      expiresAt: null,
-      revokedAt: null,
-    });
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings",
-      headers: { authorization: "Bearer tok_raw" },
-    });
-    expect(res.statusCode).toBe(403);
-  });
-
-  it("no cookie gets 401", async () => {
-    const res = await app.inject({ method: "GET", url: "/v1/project-listings" });
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("GET :id includes waitlistCount joined on the listing's own experimentKey, in one hop", async () => {
-    installFixtureMocks([makeRow({ experimentKey: EXP_KEY_A })]);
-    (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(7);
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-    });
-    expect(res.statusCode).toBe(200);
-    expect(res.json().data.waitlistCount).toBe(7);
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: WS_A, experimentKey: EXP_KEY_A },
-    });
-    // #5036 D6d removed the id-to-key translation read entirely.
-    expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();
-  });
-
-  it("waitlistCount is 0 when experimentKey is unset", async () => {
-    installFixtureMocks([makeRow()]);
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-    });
-    expect(res.json().data.waitlistCount).toBe(0);
-    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
-  });
-
-  // ── AC3 — the transition surface, exhaustively ───────────────────────────
-  //
-  // #5033 collapsed the lifecycle to five states with `closed` COMPUTED, so
-  // the transition table this suite used to walk has one row left:
-  // `requested -> active | rejected`. `approved -> live` and `live -> closed`
-  // no longer exist as concepts. The idempotent "second click" branch (#4999)
-  // is unchanged: a decision target on an already-decided row is `200` with
-  // the row untouched, not a `400`.
-  //
-  // The narrowing is deliberate and is what makes "nothing can write
-  // `closed`" structural: the patch body's enum does not contain it, so the
-  // request never reaches a service that could.
-
-  const STORED = ["draft", "requested", "rejected", "active"] as const;
-  const DECISION_TARGETS = ["active", "rejected"] as const;
-  const DECIDED = new Set<string>(["active", "rejected"]);
-
-  for (const from of STORED) {
-    for (const to of DECISION_TARGETS) {
-      if (from === "requested") {
-        it(`${from} -> ${to} is 200 (the one allowed transition)`, async () => {
-          installFixtureMocks([makeRow({ status: from })]);
-          const res = await app.inject({
-            method: "PATCH",
-            url: `/v1/project-listings/${LISTING_A}`,
-            headers: cookieHeaders("cookie_alice"),
-            payload: { status: to },
-          });
-          expect(res.statusCode).toBe(200);
-          expect(res.json().data.status).toBe(to);
-        });
-      } else if (DECIDED.has(from)) {
-        it(`${from} -> ${to} is 200 idempotent (already decided — #4999 second-click no-op), status stays '${from}'`, async () => {
-          // An already-`active` row needs the window `decideListing` stamped
-          // on it: since #5036 D6b a non-featured active row with no window in
-          // force reads `closed`, which would make this an assertion about the
-          // fail-closed branch rather than about idempotency.
-          installFixtureMocks([
-            makeRow({
-              status: from,
-              ...(from === "active" && {
-                windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-              }),
-            }),
-          ]);
-          const res = await app.inject({
-            method: "PATCH",
-            url: `/v1/project-listings/${LISTING_A}`,
-            headers: cookieHeaders("cookie_alice"),
-            payload: { status: to },
-          });
-          expect(res.statusCode).toBe(200);
-          expect(res.json().data.status).toBe(from);
-          // decideListing's guarded updateMany (`where` includes
-          // `status: "requested"`) is attempted but matches 0 rows, so the
-          // mock's own guard means it never mutated the row either.
-          expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
-            expect.objectContaining({ where: expect.objectContaining({ status: "requested" }) }),
-          );
-        });
-      } else {
-        it(`${from} -> ${to} is 400 (rejected)`, async () => {
-          installFixtureMocks([makeRow({ status: from })]);
-          const res = await app.inject({
-            method: "PATCH",
-            url: `/v1/project-listings/${LISTING_A}`,
-            headers: cookieHeaders("cookie_alice"),
-            payload: { status: to },
-          });
-          expect(res.statusCode).toBe(400);
-        });
-      }
-    }
-  }
-
-  // The invariant, at the route boundary: no request can store `closed`, and
-  // no request can reach the retired vocabulary either.
-  it.each(["closed", "draft", "requested", "applied", "approved", "live"])(
-    "400s a PATCH asking for status '%s', and writes nothing",
-    async (status) => {
-      installFixtureMocks([makeRow({ status: "requested" })]);
-      const res = await app.inject({
-        method: "PATCH",
-        url: `/v1/project-listings/${LISTING_A}`,
-        headers: cookieHeaders("cookie_alice"),
-        payload: { status },
-      });
-      expect(res.statusCode).toBe(400);
-      expect(prisma.projectListing.updateMany).not.toHaveBeenCalled();
-    },
-  );
-
-  it("stamps decidedAt/decidedBy on requested -> active and requested -> rejected, from request.userId", async () => {
-    installFixtureMocks([makeRow({ status: "requested" })]);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: { status: "active" },
-    });
-    expect(res.statusCode).toBe(200);
-    const body = res.json().data;
-    expect(body.decidedBy).toBe("alice");
-    expect(body.decidedAt).not.toBeNull();
-  });
-
-  it("400s on an unknown body field", async () => {
-    installFixtureMocks([makeRow({ status: "requested" })]);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: { status: "active", decidedBy: "someone-else" },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("400s on an empty body", async () => {
-    installFixtureMocks([makeRow({ status: "requested" })]);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: {},
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  // ── #5033 — the featured flag, scoped to the tenant ─────────────────────
-
-  it("sets the featured flag on its own, scoped to the caller's site", async () => {
-    installFixtureMocks([makeRow({ status: "active" })]);
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_A}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: { featured: true },
-    });
-    expect(res.statusCode).toBe(200);
-    expect(res.json().data.featured).toBe(true);
-    expect(prisma.projectListing.updateMany).toHaveBeenCalledWith(
-      expect.objectContaining({ where: expect.objectContaining({ siteId: WS_A }) }),
-    );
-  });
-
-  it("404s a featured write against a foreign listing id", async () => {
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_B}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: { featured: true },
-    });
-    expect(res.statusCode).toBe(404);
-  });
-
-  it("400s a PATCH trying to set the site's own config from the request body", async () => {
-    installFixtureMocks([makeRow({ status: "requested" })]);
-    for (const key of ["maxWindowDays", "defaultWindowDays", "featuredEnabled", "windowEndsAt"]) {
-      const res = await app.inject({
-        method: "PATCH",
-        url: `/v1/project-listings/${LISTING_A}`,
-        headers: cookieHeaders("cookie_alice"),
-        payload: { status: "active", [key]: 3000 },
-      });
-      expect(res.statusCode).toBe(400);
-    }
-  });
-
-  it("404s a PATCH on a foreign listing id", async () => {
-    const res = await app.inject({
-      method: "PATCH",
-      url: `/v1/project-listings/${LISTING_B}`,
-      headers: cookieHeaders("cookie_alice"),
-      payload: { status: "active" },
-    });
-    expect(res.statusCode).toBe(404);
-  });
-});

package/templates/apps/api/src/routes/project-listings/get.ts

@@ -1,70 +0,0 @@
-// oss: false
-/**
- * GET /v1/project-listings/:id
- *
- * Tenant-scoped single read (#4998 AC2). `:id` is validated with
- * `zProjectListingId` (ADR-0031 rule 5) before any lookup — a malformed id is
- * `400`, never reaches the service. A foreign or missing id is `404`,
- * indistinguishable (the `waitlist-experiments` no-enumeration posture).
- */
-import { zProjectListingId } from "@working-theory/ids";
-import { projectListingSchema } from "@working-theory/validation";
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { z } from "zod";
-
-import { getProjectListing, PROJECT_LISTING_ROLES } from "../../services/project-listings.js";
-
-import { sendValidated } from "./respond.js";
-
-const paramsSchema = z.object({ id: zProjectListingId });
-
-function unauthorized(reply: FastifyReply) {
-  return reply.status(401).send({
-    ok: false,
-    error: { code: "unauthorized", message: "Authentication required" },
-  });
-}
-
-function forbidden(reply: FastifyReply) {
-  return reply.status(403).send({
-    ok: false,
-    error: { code: "forbidden", message: "Forbidden" },
-  });
-}
-
-function invalidParams(reply: FastifyReply) {
-  return reply.status(400).send({
-    ok: false,
-    error: { code: "validation_failed", message: "Invalid project listing id" },
-  });
-}
-
-function notFound(reply: FastifyReply) {
-  return reply.status(404).send({
-    ok: false,
-    error: { code: "not_found", message: "Project listing not found" },
-  });
-}
-
-export async function getProjectListingHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const tenant = request.tenant;
-  if (!tenant) return unauthorized(reply);
-  if (!PROJECT_LISTING_ROLES.has(tenant.role)) {
-    request.log.warn(
-      { method: request.method, path: request.url, status: 403 },
-      "[project-listings] get denied; insufficient role",
-    );
-    return forbidden(reply);
-  }
-
-  const parsedParams = paramsSchema.safeParse(request.params);
-  if (!parsedParams.success) return invalidParams(reply);
-
-  const result = await getProjectListing(tenant.workspaceId, parsedParams.data.id);
-  if (!result.ok) return notFound(reply);
-
-  return sendValidated(reply, projectListingSchema, result.value, "get");
-}

package/templates/apps/api/src/routes/project-listings/list.ts

@@ -1,47 +0,0 @@
-// oss: false
-/**
- * GET /v1/project-listings
- *
- * Tenant-scoped dashboard list (#4998 AC2), the `waitlist-experiments` list
- * route's own pattern: scope derived server-side from `request.tenant`
- * (never a client-supplied site id), role floor `owner|admin` checked before
- * any read, response re-parsed against its own contract schema before send.
- */
-import { projectListingListResponseSchema } from "@working-theory/validation";
-import type { FastifyReply, FastifyRequest } from "fastify";
-
-import { listProjectListings, PROJECT_LISTING_ROLES } from "../../services/project-listings.js";
-
-import { sendValidated } from "./respond.js";
-
-function unauthorized(reply: FastifyReply) {
-  return reply.status(401).send({
-    ok: false,
-    error: { code: "unauthorized", message: "Authentication required" },
-  });
-}
-
-function forbidden(reply: FastifyReply) {
-  return reply.status(403).send({
-    ok: false,
-    error: { code: "forbidden", message: "Forbidden" },
-  });
-}
-
-export async function listProjectListingsHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const tenant = request.tenant;
-  if (!tenant) return unauthorized(reply);
-  if (!PROJECT_LISTING_ROLES.has(tenant.role)) {
-    request.log.warn(
-      { method: request.method, path: request.url, status: 403 },
-      "[project-listings] list denied; insufficient role",
-    );
-    return forbidden(reply);
-  }
-
-  const data = await listProjectListings(tenant.workspaceId);
-  return sendValidated(reply, projectListingListResponseSchema, data, "list");
-}