create-ailk 0.2.0 → 0.4.0

package/templates/apps/api/src/services/__tests__/lead-promotion.test.ts

@@ -1,393 +0,0 @@
-/**
- * @file lead-promotion.test.ts
- * @description Unit tests for the lead-promotion service (ADR 0009 D3
- * service-layer pattern; spec docs/specs/3586-lead-user-promotion-spec.md §5).
- *
- * External dependency boundary mocked:
- *   - apps/api/src/lib/prisma — the repo-standard `__mocks__/prisma.ts`
- *     manual mock (`jest.mock("../../lib/prisma.js")`).
- *
- * `prisma.lead.findMany` is given a REALISTIC filtering implementation (over
- * an in-memory fixture "table") rather than a static `mockResolvedValue`, so
- * the tenant-safety test (AC-4) actually exercises what the service passes to
- * the DB — a bug that widened the `siteId` match set would surface the
- * cross-tenant lead here, not just in an argument-shape assertion.
- *
- * tenant-context.ts's `listTenancy` runs REAL — it is a pure read over the
- * mocked `prisma.membership.findMany`, so exercising it here also covers the
- * D3/D4 "resolve via the sole tenant-context assembler" contract rather than
- * re-stubbing it.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import { prisma } from "../../lib/prisma.js";
-import { promoteLeadsForVerifiedUser } from "../lead-promotion";
-import type { PromoteLeadsResult } from "../lead-promotion";
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-const USER_ID = "user_00000000-0000-7000-8000-0000000000a1";
-const OWN_ORG_ID = "org_00000000-0000-7000-8000-0000000000b1";
-const OWN_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-0000000000c1";
-// OTHER_WORKSPACE_ID belongs to a different organization than OWN_ORG_ID —
-// the tenant-safety fixture AC-4 relies on (never a workspace of OWN_ORG_ID).
-const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-0000000000c2";
-const USER_EMAIL = "verified-user@example.com";
-
-type FakeLeadRow = {
-  id: string;
-  email: string;
-  siteId: string;
-  source: string;
-  promotedUserId: string | null;
-};
-
-/** Shapes prisma.membership.findMany's mocked return — what listTenancy reads. */
-function ownMembership() {
-  return [
-    {
-      role: "owner",
-      organization: {
-        id: OWN_ORG_ID,
-        name: "Acme",
-        slug: "acme",
-        workspaces: [
-          { id: OWN_WORKSPACE_ID, name: "Acme HQ", slug: "acme-hq" },
-        ],
-      },
-    },
-  ];
-}
-
-function verifiedUser(overrides?: Partial<{ emailVerified: boolean }>) {
-  return {
-    id: USER_ID,
-    email: USER_EMAIL,
-    emailVerified: overrides?.emailVerified ?? true,
-  };
-}
-
-/**
- * Wires prisma.lead.findMany / updateMany to a realistic in-memory "table"
- * filtered by the (where) args the service passes — the DB-fidelity fixture
- * AC-4 relies on: a lead outside `siteId.in` is genuinely never returned,
- * exactly as a real WHERE clause would exclude it.
- */
-function seedLeadTable(rows: FakeLeadRow[]) {
-  const table = rows.map((r) => ({ ...r }));
-
-  (prisma.lead.findMany as jest.Mock).mockImplementation(
-    async (args: {
-      where: {
-        email: string;
-        siteId: { in: string[] };
-        promotedUserId: null;
-      };
-      select: { id: true; siteId: true; source: true };
-    }) => {
-      const { email, siteId } = args.where;
-      return table
-        .filter(
-          (row) =>
-            row.email === email &&
-            siteId.in.includes(row.siteId) &&
-            row.promotedUserId === null,
-        )
-        .map((row) => ({ id: row.id, siteId: row.siteId, source: row.source }));
-    },
-  );
-
-  (prisma.lead.updateMany as jest.Mock).mockImplementation(
-    async (args: { where: { id: { in: string[] } }; data: { promotedUserId: string; promotedAt: Date } }) => {
-      let count = 0;
-      for (const row of table) {
-        if (args.where.id.in.includes(row.id)) {
-          row.promotedUserId = args.data.promotedUserId;
-          count += 1;
-        }
-      }
-      return { count };
-    },
-  );
-
-  return table;
-}
-
-describe("promoteLeadsForVerifiedUser", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  // ── AC-3: verified user + matching lead in the user's own workspace ──────
-  it("AC-3: matches an un-promoted lead in the user's own workspace and marks it promoted", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([
-      {
-        id: "lead_00000000-0000-7000-8000-0000000000d1",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "landing-page-1",
-        promotedUserId: null,
-      },
-    ]);
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(result).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 1,
-      promoted: [
-        {
-          leadId: "lead_00000000-0000-7000-8000-0000000000d1",
-          siteId: OWN_WORKSPACE_ID,
-          source: "landing-page-1",
-        },
-      ],
-    });
-    expect(prisma.lead.findMany).toHaveBeenCalledWith({
-      where: {
-        email: USER_EMAIL,
-        siteId: { in: [OWN_WORKSPACE_ID] },
-        promotedUserId: null,
-      },
-      select: { id: true, siteId: true, source: true },
-    });
-    expect(prisma.lead.updateMany).toHaveBeenCalledWith({
-      where: { id: { in: ["lead_00000000-0000-7000-8000-0000000000d1"] } },
-      data: {
-        promotedUserId: USER_ID,
-        promotedAt: expect.any(Date),
-      },
-    });
-  });
-
-  // ── AC-4 (tenant-safety — load-bearing): cross-tenant siteId not promoted ─
-  it("AC-4: a lead whose siteId belongs to a DIFFERENT organization's workspace is not promoted", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(), // the user belongs ONLY to OWN_ORG_ID / OWN_WORKSPACE_ID
-    );
-    const table = seedLeadTable([
-      {
-        id: "lead_cross_tenant",
-        email: USER_EMAIL,
-        siteId: OTHER_WORKSPACE_ID, // a DIFFERENT organization's workspace
-        source: "contact",
-        promotedUserId: null,
-      },
-    ]);
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(result).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
-    // The cross-tenant lead's promotedUserId is untouched.
-    expect(table.find((r) => r.id === "lead_cross_tenant")?.promotedUserId).toBeNull();
-    // The query itself never widens siteId.in to the foreign workspace.
-    expect(prisma.lead.findMany).toHaveBeenCalledWith({
-      where: {
-        email: USER_EMAIL,
-        siteId: { in: [OWN_WORKSPACE_ID] },
-        promotedUserId: null,
-      },
-      select: { id: true, siteId: true, source: true },
-    });
-  });
-
-  // ── AC-5: unverified email → no-op, verified-email gate ───────────────────
-  it("AC-5: unverified email performs no lead update and returns count:0", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(
-      verifiedUser({ emailVerified: false }),
-    );
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(result).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-    expect(prisma.membership.findMany).not.toHaveBeenCalled();
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
-  });
-
-  // ── AC-6: idempotent — a second invocation promotes nothing ──────────────
-  it("AC-6: a second invocation (leads already promoted) promotes nothing", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([
-      {
-        id: "lead_already_promoted",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "contact",
-        promotedUserId: USER_ID, // already promoted — excluded by the query
-      },
-    ]);
-
-    const first = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-    expect(first).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-
-    const second = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-    expect(second).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
-  });
-
-  // ── Idempotent end-to-end: promote once, re-run promotes nothing more ────
-  it("a lead promoted on the first run is excluded on the second run", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([
-      {
-        id: "lead_first_run",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "contact",
-        promotedUserId: null,
-      },
-    ]);
-
-    const first = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-    expect(first).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 1,
-      promoted: [
-        { leadId: "lead_first_run", siteId: OWN_WORKSPACE_ID, source: "contact" },
-      ],
-    });
-
-    const second = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-    expect(second).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-  });
-
-  // ── No match → count:0 ─────────────────────────────────────────────────────
-  it("no matching lead → returns count:0 with no update", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([]);
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(result).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
-  });
-
-  // ── source preservation ────────────────────────────────────────────────────
-  it("preserves each lead's source in the result", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([
-      {
-        id: "lead_a",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "contact",
-        promotedUserId: null,
-      },
-      {
-        id: "lead_b",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "newsletter-signup",
-        promotedUserId: null,
-      },
-    ]);
-
-    const result = (await promoteLeadsForVerifiedUser({
-      userId: USER_ID,
-    })) as Extract<PromoteLeadsResult, { ok: true }>;
-
-    expect(result.ok).toBe(true);
-    expect(result.count).toBe(2);
-    expect(result.promoted).toEqual([
-      { leadId: "lead_a", siteId: OWN_WORKSPACE_ID, source: "contact" },
-      {
-        leadId: "lead_b",
-        siteId: OWN_WORKSPACE_ID,
-        source: "newsletter-signup",
-      },
-    ]);
-  });
-
-  // ── No workspaces → no-op, never queries lead ─────────────────────────────
-  it("a user with no workspaces is a no-op — never queries inbox.Lead", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(result).toEqual<PromoteLeadsResult>({
-      ok: true,
-      count: 0,
-      promoted: [],
-    });
-    expect(prisma.lead.findMany).not.toHaveBeenCalled();
-  });
-
-  // ── Unknown user → ok:false, user_not_found ───────────────────────────────
-  it("an unknown userId returns ok:false with kind user_not_found", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = (await promoteLeadsForVerifiedUser({
-      userId: "user_does-not-exist",
-    })) as Extract<PromoteLeadsResult, { ok: false }>;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("user_not_found");
-  });
-
-  // ── PII non-leak — the result never carries the user's raw email ─────────
-  it("PII non-leak — the result never carries the user's raw email field", async () => {
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
-    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
-      ownMembership(),
-    );
-    seedLeadTable([
-      {
-        id: "lead_00000000-0000-7000-8000-0000000000d1",
-        email: USER_EMAIL,
-        siteId: OWN_WORKSPACE_ID,
-        source: "contact",
-        promotedUserId: null,
-      },
-    ]);
-
-    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
-
-    expect(JSON.stringify(result)).not.toContain(USER_EMAIL);
-  });
-});