create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/project-listings/patch.ts

@@ -1,136 +0,0 @@
-// oss: false
-/**
- * PATCH /v1/project-listings/:id
- *
- * Tenant-scoped listing mutation (#4998 AC3, reshaped by #5033). The body is
- * `.strict()` and carries at most two optional fields, at least one:
- *
- *   - `status` — `active` | `rejected`, the only transition there is. The
- *     lifecycle collapsed to five states with `closed` COMPUTED (#5033 D3),
- *     so `approved -> live` and `live -> closed` no longer exist and `closed`
- *     is not a value this route (or any route) can write. Routed through
- *     `decideListing` — the SAME function `POST /v1/slack/actions` calls — so
- *     the stamp, the window end and the "already decided" idempotency live in
- *     one place. On a changed decision the founder is emailed once via
- *     `sendListingDecisionEmail`.
- *   - `featured` — the operator's shelf flag (#5033 D6), through
- *     `setListingFeatured`. Whether it reaches the public read at all is the
- *     site's `featuredEnabled` config, read server-side; this route sets the
- *     row's own flag and never the config.
- *
- * Sent together, the featured write lands first and the decision's response
- * is what the caller gets back, so one call cannot return a row that
- * contradicts either write.
- *
- * `:id` is validated at the boundary the same way `get.ts` does; a foreign or
- * missing id is `404`. An operator re-PATCHing an already-decided listing
- * gets `200` with the row unchanged (`decideListing`'s idempotent "second
- * click" branch — #4999 AC).
- */
-import { zProjectListingId } from "@working-theory/ids";
-import { projectListingPatchSchema, projectListingSchema } from "@working-theory/validation";
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { z } from "zod";
-
-import {
-  decideListing,
-  sendListingDecisionEmail,
-} from "../../services/project-listing-decision.js";
-import { setListingFeatured, PROJECT_LISTING_ROLES } from "../../services/project-listings.js";
-
-import { sendValidated } from "./respond.js";
-
-const paramsSchema = z.object({ id: zProjectListingId });
-
-function unauthorized(reply: FastifyReply) {
-  return reply.status(401).send({
-    ok: false,
-    error: { code: "unauthorized", message: "Authentication required" },
-  });
-}
-
-function forbidden(reply: FastifyReply) {
-  return reply.status(403).send({
-    ok: false,
-    error: { code: "forbidden", message: "Forbidden" },
-  });
-}
-
-function invalidParams(reply: FastifyReply) {
-  return reply.status(400).send({
-    ok: false,
-    error: { code: "validation_failed", message: "Invalid project listing id" },
-  });
-}
-
-function invalidBody(reply: FastifyReply, message: string) {
-  return reply.status(400).send({
-    ok: false,
-    error: { code: "invalid_input", message },
-  });
-}
-
-function notFound(reply: FastifyReply) {
-  return reply.status(404).send({
-    ok: false,
-    error: { code: "not_found", message: "Project listing not found" },
-  });
-}
-
-export async function patchProjectListingHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const tenant = request.tenant;
-  if (!tenant) return unauthorized(reply);
-  if (!PROJECT_LISTING_ROLES.has(tenant.role)) {
-    request.log.warn(
-      { method: request.method, path: request.url, status: 403 },
-      "[project-listings] patch denied; insufficient role",
-    );
-    return forbidden(reply);
-  }
-
-  const parsedParams = paramsSchema.safeParse(request.params);
-  if (!parsedParams.success) return invalidParams(reply);
-
-  const parsedBody = projectListingPatchSchema.safeParse(request.body);
-  if (!parsedBody.success) {
-    return invalidBody(reply, parsedBody.error.issues[0]?.message ?? "invalid input");
-  }
-
-  const { status, featured } = parsedBody.data;
-
-  if (featured !== undefined) {
-    const featuredResult = await setListingFeatured(
-      tenant.workspaceId,
-      parsedParams.data.id,
-      featured,
-    );
-    if (!featuredResult.ok) return notFound(reply);
-    if (status === undefined) {
-      return sendValidated(reply, projectListingSchema, featuredResult.value, "patch");
-    }
-  }
-
-  if (status === undefined) {
-    // Unreachable — the body schema refuses an empty object — but the
-    // narrowing has to be discharged before `decideListing`.
-    return invalidBody(reply, "patch body must carry at least one of 'status' or 'featured'");
-  }
-
-  const decisionResult = await decideListing({
-    id: parsedParams.data.id,
-    decision: status,
-    decidedBy: tenant.userId,
-    siteId: tenant.workspaceId,
-  });
-  if (!decisionResult.ok) {
-    if (decisionResult.error.kind === "not_found") return notFound(reply);
-    return invalidBody(reply, decisionResult.error.message);
-  }
-  if (decisionResult.changed) {
-    await sendListingDecisionEmail(decisionResult.value, status);
-  }
-  return sendValidated(reply, projectListingSchema, decisionResult.value, "patch");
-}

package/templates/apps/api/src/routes/schedule/__tests__/index.test.ts

@@ -1,490 +0,0 @@
-// oss: false
-/**
- * @file index.test.ts
- * Route-level inject tests for GET /v1/schedule/availability,
- * GET /v1/schedule/event-meta (#4633), and POST /v1/schedule/book (#4416).
- *
- * Mirrors apps/api/src/routes/flows/__tests__/index.test.ts's shape: a bare
- * Fastify instance with only the routes under test registered. The provider
- * itself is stubbed at the `fetch` boundary rather than mocked out, so these
- * tests cover the real Cal provider's parsing alongside the route's envelope
- * and status mapping.
- */
-
-import type { FastifyInstance } from "fastify";
-
-import {
-  createBookingRoute,
-  getEventMetaRoute,
-  listAvailabilityRoute,
-} from "../index";
-
-const CAL_LINK = "sam/fit-check";
-const FROM = "2026-08-26T00:00:00.000Z";
-const TO = "2026-09-02T00:00:00.000Z";
-
-/**
- * Cal's observed event-type shape (GET /v2/event-types, 2024-06-14): `price`
- * is minor units (0 on an account with no payment app), `currency` sits
- * beside it, `description` may be empty. Overridable per test.
- */
-function eventTypeResponse(overrides: Record<string, unknown> = {}) {
-  return {
-    data: {
-      id: 4242,
-      slug: "fit-check",
-      title: "15-Minute Call with Sam",
-      description: "A quick fit check before we book real time.",
-      hidden: false,
-      lengthInMinutes: 15,
-      price: 0,
-      currency: "usd",
-      scheduleTimeZone: "America/Denver",
-      locations: [{ type: "integrations_google_meet" }],
-      ...overrides,
-    },
-  };
-}
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-/** Route calls by URL fragment so each test declares only what it changes. */
-type FetchStub = jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-
-/**
- * Install a stub at the `fetch` boundary and return it. Typed as the platform
- * signature so it assigns to `globalThis.fetch` directly — no assertion, and
- * the provider under test runs for real against it.
- */
-function stubFetch(
-  handlers: Partial<{
-    eventTypes: (url: string) => Response;
-    slots: () => Response;
-    bookings: () => Response;
-  }>,
-): FetchStub {
-  const mock: FetchStub = jest.fn((input: RequestInfo | URL) => {
-    const url = String(input);
-    if (url.includes("/v2/event-types")) {
-      return Promise.resolve(
-        (handlers.eventTypes ?? (() => json(eventTypeResponse())))(url),
-      );
-    }
-    if (url.includes("/v2/slots")) {
-      return Promise.resolve(
-        (handlers.slots ?? (() => json({ data: {} })))(),
-      );
-    }
-    if (url.includes("/v2/bookings")) {
-      return Promise.resolve(
-        (handlers.bookings ?? (() => json({ data: {} }, 500)))(),
-      );
-    }
-    return Promise.resolve(json({}, 404));
-  });
-  globalThis.fetch = mock;
-  return mock;
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const fastify = require("fastify")();
-  await fastify.register(listAvailabilityRoute);
-  await fastify.register(getEventMetaRoute);
-  await fastify.register(createBookingRoute);
-  return fastify as FastifyInstance;
-}
-
-describe("the /v1/schedule/* routes", () => {
-  let app: FastifyInstance;
-  const realFetch = globalThis.fetch;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env.CAL_API_KEY = "cal_test_key";
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    globalThis.fetch = realFetch;
-    delete process.env.CAL_API_KEY;
-    delete process.env.CAL_API_BASE_URL;
-    delete process.env.SCHEDULING_PUBLIC_BASE_URL;
-  });
-
-  // ── availability ─────────────────────────────────────────────────────────
-
-  it("returns derived event meta alongside the flattened slots", async () => {
-    stubFetch({
-      slots: () =>
-        json({
-          data: {
-            "2026-08-27": [
-              { start: "2026-08-27T16:00:00.000Z" },
-              { start: "2026-08-27T16:30:00.000Z" },
-            ],
-          },
-        }),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as {
-      ok: boolean;
-      data: {
-        event: { durationMinutes: number; meetingType?: string; timeZone: string };
-        slots: { start: string; end: string }[];
-      };
-    };
-    expect(body.ok).toBe(true);
-    // Duration, meeting type, and timezone are DERIVED — nothing in the
-    // request supplied them.
-    expect(body.data.event.durationMinutes).toBe(15);
-    expect(body.data.event.meetingType).toBe("Google Meet");
-    expect(body.data.event.timeZone).toBe("America/Denver");
-    // Description and price (#4633) ride the same derived meta.
-    expect(
-      (body.data.event as { description?: string }).description,
-    ).toBe("A quick fit check before we book real time.");
-    expect(
-      (body.data.event as { price?: object }).price,
-    ).toEqual({ amountMinor: 0, currency: "usd" });
-    expect(body.data.slots).toEqual([
-      { start: "2026-08-27T16:00:00.000Z", end: "2026-08-27T16:15:00.000Z" },
-      { start: "2026-08-27T16:30:00.000Z", end: "2026-08-27T16:45:00.000Z" },
-    ]);
-  });
-
-  it("honours timeZone and never sends the api key to the client", async () => {
-    const fetchMock = stubFetch({ slots: () => json({ data: {} }) });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}&timeZone=Europe/Lisbon`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    const slotsCall = fetchMock.mock.calls.find((c) =>
-      String(c[0]).includes("/v2/slots"),
-    );
-    expect(String(slotsCall?.[0])).toContain("timeZone=Europe%2FLisbon");
-    expect(res.body).not.toContain("cal_test_key");
-  });
-
-  it("rejects an unknown query parameter with 400 invalid_input", async () => {
-    stubFetch({});
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}&siteId=evil`,
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "invalid_input",
-    );
-  });
-
-  it("rejects a range longer than the 60-day cap", async () => {
-    stubFetch({});
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=2027-08-26T00:00:00.000Z`,
-    });
-
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("maps an unknown event to 404 event_not_found", async () => {
-    stubFetch({
-      eventTypes: () => json({}, 404),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}`,
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "event_not_found",
-    );
-  });
-
-  it("maps a provider failure to 502 without leaking the upstream detail", async () => {
-    stubFetch({
-      slots: () => json({ message: "internal cal trace: user 91" }, 500),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}`,
-    });
-
-    expect(res.statusCode).toBe(502);
-    expect(res.body).not.toContain("user 91");
-  });
-
-  // ── event meta (#4633) ───────────────────────────────────────────────────
-
-  it("reads meta for several slugs without ever fetching availability", async () => {
-    const fetchMock = stubFetch({
-      eventTypes: (url) =>
-        url.includes("eventTypeSlug=power-hour")
-          ? json(
-              eventTypeResponse({
-                id: 4243,
-                slug: "power-hour",
-                title: "Power Hour",
-                description: "Sixty focused minutes on your positioning.",
-                lengthInMinutes: 60,
-                price: 25000,
-              }),
-            )
-          : json(eventTypeResponse()),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/event-meta?calLinks=sam/fit-check,sam/power-hour",
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as {
-      ok: boolean;
-      data: {
-        events: {
-          calLink: string;
-          event: {
-            title: string;
-            durationMinutes: number;
-            description?: string;
-            price?: { amountMinor: number; currency: string };
-          };
-        }[];
-      };
-    };
-    expect(body.ok).toBe(true);
-    expect(body.data.events.map((e) => e.calLink)).toEqual([
-      "sam/fit-check",
-      "sam/power-hour",
-    ]);
-    // A priced event and a free one, both straight from the provider: minor
-    // units + currency, never a hand-copied badge string.
-    expect(body.data.events[0]?.event.price).toEqual({
-      amountMinor: 0,
-      currency: "usd",
-    });
-    expect(body.data.events[1]?.event).toMatchObject({
-      title: "Power Hour",
-      durationMinutes: 60,
-      description: "Sixty focused minutes on your positioning.",
-      price: { amountMinor: 25000, currency: "usd" },
-    });
-    // The whole point of the route: rendering tiles costs event-type reads
-    // only — no availability window is fetched for any of them.
-    const urls = fetchMock.mock.calls.map((c) => String(c[0]));
-    expect(urls.filter((u) => u.includes("/v2/event-types"))).toHaveLength(2);
-    expect(urls.some((u) => u.includes("/v2/slots"))).toBe(false);
-    // Same invariant the availability route pins: the credential stays
-    // server-side on this route too.
-    expect(res.body).not.toContain("cal_test_key");
-  });
-
-  it("omits the description when the event has none", async () => {
-    stubFetch({
-      eventTypes: () => json(eventTypeResponse({ description: "" })),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/event-meta?calLinks=sam/fit-check",
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as {
-      data: { events: { event: { description?: string } }[] };
-    };
-    expect(body.data.events[0]?.event.description).toBeUndefined();
-    expect(res.body).not.toContain("description");
-  });
-
-  it("rejects a malformed link in the list with 400", async () => {
-    stubFetch({});
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/event-meta?calLinks=sam/fit-check,not-a-link",
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "invalid_input",
-    );
-  });
-
-  it("answers all-or-nothing: one unknown slug fails the read", async () => {
-    stubFetch({
-      eventTypes: (url) =>
-        url.includes("eventTypeSlug=ghost")
-          ? json({}, 404)
-          : json(eventTypeResponse()),
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/event-meta?calLinks=sam/fit-check,sam/ghost",
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "event_not_found",
-    );
-  });
-
-  it("returns 503 not_configured without a fallback URL", async () => {
-    delete process.env.CAL_API_KEY;
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/schedule/event-meta?calLinks=sam/fit-check",
-    });
-
-    expect(res.statusCode).toBe(503);
-    const body = res.json() as {
-      error: { code: string; fallbackUrl?: string };
-    };
-    expect(body.error.code).toBe("not_configured");
-    // fallbackUrl names ONE event's public page; this read is 1..n events.
-    expect(body.error.fallbackUrl).toBeUndefined();
-  });
-
-  // ── degraded state ───────────────────────────────────────────────────────
-
-  it("returns 503 not_configured plus the provider's own booking page", async () => {
-    delete process.env.CAL_API_KEY;
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}`,
-    });
-
-    expect(res.statusCode).toBe(503);
-    const body = res.json() as {
-      error: { code: string; fallbackUrl?: string };
-    };
-    expect(body.error.code).toBe("not_configured");
-    expect(body.error.fallbackUrl).toBe("https://cal.com/sam/fit-check");
-  });
-
-  it("builds the fallback URL from SCHEDULING_PUBLIC_BASE_URL when set", async () => {
-    delete process.env.CAL_API_KEY;
-    process.env.SCHEDULING_PUBLIC_BASE_URL = "https://book.example.com/";
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=${CAL_LINK}&from=${FROM}&to=${TO}`,
-    });
-
-    expect(
-      (res.json() as { error: { fallbackUrl?: string } }).error.fallbackUrl,
-    ).toBe("https://book.example.com/sam/fit-check");
-  });
-
-  it("omits the fallback URL when the calLink is unusable", async () => {
-    delete process.env.CAL_API_KEY;
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/schedule/availability?calLink=not-a-link&from=${FROM}&to=${TO}`,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(
-      (res.json() as { error: { fallbackUrl?: string } }).error.fallbackUrl,
-    ).toBeUndefined();
-  });
-
-  // ── booking ──────────────────────────────────────────────────────────────
-
-  it("creates a booking and returns 201 with the provider's identifier", async () => {
-    stubFetch({
-      bookings: () =>
-        json(
-          {
-            data: {
-              uid: "bkg_9",
-              start: "2026-08-27T16:00:00.000Z",
-              end: "2026-08-27T16:15:00.000Z",
-              meetingUrl: "https://meet.google.com/abc-defg-hij",
-            },
-          },
-          201,
-        ),
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/schedule/book",
-      payload: {
-        calLink: CAL_LINK,
-        start: "2026-08-27T16:00:00.000Z",
-        attendee: { name: "Sam Rivera", email: "sam@example.com" },
-      },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json() as {
-      data: { bookingId: string; meetingUrl?: string };
-    };
-    expect(body.data.bookingId).toBe("bkg_9");
-    expect(body.data.meetingUrl).toBe("https://meet.google.com/abc-defg-hij");
-  });
-
-  it("maps a lost race to 409 slot_unavailable", async () => {
-    stubFetch({
-      bookings: () => json({ error: "no_available_users_found" }, 409),
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/schedule/book",
-      payload: {
-        calLink: CAL_LINK,
-        start: "2026-08-27T16:00:00.000Z",
-        attendee: { name: "Sam Rivera", email: "sam@example.com" },
-      },
-    });
-
-    expect(res.statusCode).toBe(409);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "slot_unavailable",
-    );
-  });
-
-  it("rejects a malformed attendee email with 400", async () => {
-    stubFetch({});
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/schedule/book",
-      payload: {
-        calLink: CAL_LINK,
-        start: "2026-08-27T16:00:00.000Z",
-        attendee: { name: "Sam Rivera", email: "not-an-email" },
-      },
-    });
-
-    expect(res.statusCode).toBe(400);
-  });
-});