create-ailk 0.22.0 → 0.23.0

package/templates/apps/api/src/routes/consent/__tests__/sign-up-rate-limit.test.ts

@@ -0,0 +1,160 @@
+/**
+ * @file sign-up-rate-limit.test.ts
+ * @description #8805 — the sign-up agreements' evidence read is counted per
+ * site key, end to end: the real `build()`, the `signupevidence` scope's own
+ * limiter and the REAL `@fastify/rate-limit` global ceiling.
+ *
+ * Every sign-up reads `GET /v1/consent/sign-up` from the web's server, and
+ * every web instance behind one egress address used to share one per-IP
+ * bucket of 10 a minute — which an anonymous caller spoofing that address's
+ * `X-Forwarded-For` could fill. A request presenting a VALID site key (the
+ * `x-ailk-spoke-key` the web's api-client already sends) is now counted
+ * against that key's own bucket instead, in both limiters; an invalid or
+ * absent key keeps the per-IP 10.
+ *
+ * External dependency boundary mocked: `resolveCallerSite`, the registry
+ * lookup a key digests to (one key valid, every other refused), and
+ * `resolveSiteWorkspaceId`, the route's own workspace seam. `DATABASE_URL` is
+ * unset for the file's duration, so the limiter counts in the memory store.
+ */
+
+const mockResolveCallerSite = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; the registry lookup is the database boundary
+jest.mock("../../../services/public-site-resolver.js", () => ({
+  ...jest.requireActual<object>("../../../services/public-site-resolver.js"),
+  resolveCallerSite: (...args: unknown[]) => mockResolveCallerSite(...args),
+}));
+
+const mockResolveSiteWorkspaceId = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/site.js", () => ({
+  ...jest.requireActual<object>("../../../lib/site.js"),
+  resolveSiteWorkspaceId: () => mockResolveSiteWorkspaceId(),
+}));
+
+jest.mock("@fastify/cors", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+import type { FastifyRequest } from "fastify";
+
+import { __resetBuckets } from "../../../middleware/rate-limit";
+import { build } from "../../../server";
+
+/** The deployment's own site workspace. */
+const W = "wksp_01920000-0000-7000-8000-0000000000a1";
+/** The spoke's own workspace — never the evidence route's answer. */
+const SPOKE_WS = "wksp_01920000-0000-7000-8000-0000000000b1";
+const SPOKE_ID = "spoke_01920000-0000-7000-8000-0000000000b1";
+const VALID = "ailk_spk_valid-site-key";
+const WEB_EGRESS = "198.51.100.20";
+
+describe("GET /v1/consent/sign-up against the real limiters (#8805)", () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any matches server.test.ts
+  let app: any;
+  const prior = {
+    databaseUrl: process.env.DATABASE_URL,
+    perKey: process.env.AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
+  };
+
+  async function statuses(
+    count: number,
+    headers: Record<string, string>,
+  ): Promise<number[]> {
+    const codes: number[] = [];
+    for (let i = 0; i < count; i++) {
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/consent/sign-up",
+        headers,
+      });
+      codes.push(res.statusCode);
+    }
+    return codes;
+  }
+
+  const keyed = (key: string = VALID) => ({
+    "x-forwarded-for": WEB_EGRESS,
+    "x-ailk-spoke-key": key,
+  });
+
+  beforeEach(async () => {
+    __resetBuckets();
+    delete process.env.DATABASE_URL;
+    delete process.env.AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE;
+    mockResolveSiteWorkspaceId.mockResolvedValue(W);
+    mockResolveCallerSite.mockImplementation((req: FastifyRequest) =>
+      Promise.resolve(
+        req.headers["x-ailk-spoke-key"] === VALID
+          ? { kind: "spoke", spokeId: SPOKE_ID, workspaceId: SPOKE_WS }
+          : { kind: "refused", reason: "key-unknown" },
+      ),
+    );
+    app = await build();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    if (app) await app.close();
+    app = undefined;
+  });
+
+  afterAll(() => {
+    for (const [name, value] of [
+      ["DATABASE_URL", prior.databaseUrl],
+      ["AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE", prior.perKey],
+    ] as const) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("admits keyed requests from one IP past 10 a minute — and past the global 60 — up to the key ceiling of 120", async () => {
+    const codes = await statuses(121, keyed());
+    expect(codes.slice(0, 120).every((code) => code !== 429)).toBe(true);
+    expect(codes[120]).toBe(429);
+  });
+
+  it("refuses the eleventh keyless request from one IP with 429", async () => {
+    const codes = await statuses(11, { "x-forwarded-for": WEB_EGRESS });
+    expect(codes.slice(0, 10).every((code) => code !== 429)).toBe(true);
+    expect(codes[10]).toBe(429);
+  });
+
+  it("refuses the eleventh request with an invalid key from one IP with 429", async () => {
+    const codes = await statuses(11, keyed("ailk_spk_forged"));
+    expect(codes.slice(0, 10).every((code) => code !== 429)).toBe(true);
+    expect(codes[10]).toBe(429);
+  });
+
+  it("a spoofer filling the web egress address's buckets leaves the keyed caller its budget", async () => {
+    const spoofed = await statuses(70, { "x-forwarded-for": WEB_EGRESS });
+    expect(spoofed[69]).toBe(429);
+    const codes = await statuses(20, keyed());
+    expect(codes.every((code) => code !== 429)).toBe(true);
+  });
+
+  it("reads AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE over the default", async () => {
+    await app.close();
+    process.env.AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE = "15";
+    app = await build();
+    await app.ready();
+    const codes = await statuses(16, keyed());
+    expect(codes.slice(0, 15).every((code) => code !== 429)).toBe(true);
+    expect(codes[15]).toBe(429);
+  });
+
+  it("answers a keyed request with the site workspace, never the key's", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/consent/sign-up",
+      headers: keyed(),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.workspaceId).toBe(W);
+  });
+});

package/templates/apps/api/src/routes/consent/account.ts

@@ -3,7 +3,7 @@
  * (#8765, spec docs/specs/8765-sign-up-refuses-without-the-spec.md D2, D5).
  *
  *   GET  /v1/consent/sign-up?locale=
- *       Anonymous and keyless. `{ workspaceId, agreements: [{ purposeId,
+ *       Anonymous. `{ workspaceId, agreements: [{ purposeId,
  *       policyVersion, locale, statement, statementHash }] }` — one entry per
  *       `signUp` agreement of the site registry, its statement resolved by
  *       `resolveConsentStatement` for `locale` (default `en`) and hashed by
@@ -34,7 +34,9 @@
  * Callers. The evidence route: the web's own server, stamping the grant it
  * writes inside Better Auth's sign-up transaction (`apps/web/lib/
  * sign-up-agreements.ts`, D3, D4). Registered at the top level in its own
- * rate-limited scope (`signupevidence`), outside every module gate. The
+ * rate-limited scope (`signupevidence`), outside every module gate; a call
+ * presenting a valid site key is counted per key there, any other per IP
+ * (#8805, `server.ts`) — the key never chooses the workspace. The
  * account pair: `memberCaller` — the hub's own cookie session or a hub
  * credential (the account layout's interstitial, D7); a personal `ApiToken`
  * is `401 unauthorized`. There is no verified-email floor: the agreement is

package/templates/apps/api/src/routes/content/__tests__/get-page.test.ts

@@ -222,7 +222,7 @@ describe("GET /api/content/:type/:slug", () => {
         "# Content Strategist",
       );
 
-    it("targets <baseUrl>/<locale>/careers/<slug>#apply", async () => {
+    it("targets <baseUrl>/<locale>/careers/<slug>/apply", async () => {
       writeSiteMdx(fixture.getContentRoot());
       await writePosting();
       const res = await app.inject({ method: "GET", url: "/v1/content/JobPosting/content-strategist" });
@@ -230,7 +230,7 @@ describe("GET /api/content/:type/:slug", () => {
       const entity = JSON.parse(res.body).mainEntity as Record<string, unknown>;
       expect(entity.potentialAction).toEqual({
         "@type": "ApplyAction",
-        target: "https://example.com/en/careers/content-strategist#apply",
+        target: "https://example.com/en/careers/content-strategist/apply",
       });
     });