create-ailk 0.22.0 → 0.23.0

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -471,6 +471,55 @@ describe("fulfillDeliverable", () => {
     );
   });
 
+  // ── #8848 D3 — the minted grant id, and a deliverable flow's Asset-only store ──
+
+  it("resolves { grantId } equal to the created row's id on a successful mint", async () => {
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
+  });
+
+  it("resolves undefined on the asset_missing path", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+  });
+
+  it("a gated file snapshot whose key names only a legacy DeliverableAsset mints no grant (SEC-8848-B)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    const configSnapshot = {
+      ...baseConfigSnapshot(),
+      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
+      deliverable: { kind: "file", gated: true, title: en("Q3"), geometry: "letter", pages: 3 },
+    };
+
+    await expect(
+      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
+    ).resolves.toBeUndefined();
+
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "asset_missing" }),
+      expect.any(String),
+    );
+  });
+
+  it("the same legacy-only key on a flow with no deliverable block still mints (NFR1)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({ workspaceId: WORKSPACE_ID });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    const configSnapshot = {
+      ...baseConfigSnapshot(),
+      deliverables: { ...deliverablesBlock(), assets: [{ assetKey: "listing-acme-2026-10-12" }] },
+    };
+
+    await expect(
+      fulfillDeliverable(baseInput({ segment: undefined, configSnapshot })),
+    ).resolves.toEqual({ grantId: GRANT_ID });
+    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
+  });
+
   it("never reaches a key that exists only in ANOTHER workspace (NFR3) — the lookup is scoped to this flow's own workspaceId alone", async () => {
     (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
       workspaceId: WORKSPACE_ID,
@@ -692,7 +741,7 @@ describe("fulfillDeliverable", () => {
       error: { kind: "send_failed", message: "Resend down" },
     });
 
-    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
     expect(mockLoggerInfo).toHaveBeenCalled();
     // AC4: send_failed is a post-mint outcome — it stamps too.
     expect(prisma.deliverableGrant.update).toHaveBeenCalledWith({
@@ -708,7 +757,7 @@ describe("fulfillDeliverable", () => {
       new Error("connection reset"),
     );
 
-    await expect(fulfillDeliverable(baseInput())).resolves.toBeUndefined();
+    await expect(fulfillDeliverable(baseInput())).resolves.toEqual({ grantId: GRANT_ID });
     expect(mockSendDeliverableEmail).toHaveBeenCalled();
     expect(mockLoggerWarn).toHaveBeenCalledWith(
       expect.objectContaining({ grantId: GRANT_ID, outcome: "sent" }),

package/templates/apps/api/src/services/__tests__/keyless-workspace-predicate.test.ts

@@ -0,0 +1,234 @@
+/**
+ * @file keyless-workspace-predicate.test.ts
+ *
+ * One keyless-workspace predicate (#9145). `resolvePublicWorkspace` (content,
+ * pricing, schedule, the consent cookie) and `resolveCallerWorkspace` (the
+ * `/v1/flows` routes and the open deliverable) answer a keyless caller through
+ * the SAME rule — `services/default-tenant.ts#resolveDefaultWorkspaceId`: one
+ * workspace that is the seeded default resolves to it, anything else is
+ * unresolved. The `AILK_SITE_ID` alias is never consulted for a keyless
+ * caller, so a multi-workspace deployment that is not a hub answers every
+ * anonymous route the same way instead of 503 on `/pricing` and the alias
+ * workspace on `/flows/*`.
+ *
+ * The spoke-key arm and every refusal are unchanged; the hub cases here pin
+ * that a keyless call on a hub is refused by both resolvers alike.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
+ */
+import { createHash } from "node:crypto";
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
+import type { FastifyRequest } from "fastify";
+
+import * as configModule from "../../config/index.js";
+import type { HubSpokeKeyMode } from "../../config/index.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../lib/site.js";
+import {
+  mockSentinelWorkspaceExists,
+  mockWorkspaceExists,
+} from "../../lib/__mocks__/prisma.js";
+import { prisma } from "../../lib/prisma.js";
+import {
+  __resetHubStatusForTests,
+  resolveCallerWorkspace,
+  resolvePublicWorkspace,
+} from "../public-site-resolver.js";
+
+const db = jest.mocked(prisma);
+
+const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
+const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
+const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
+const KEY_S1 = `ailk_spk_S1${"x".repeat(41)}`;
+
+const digest = (key: string) => createHash("sha256").update(key).digest("hex");
+
+/** A request double carrying only what the resolver may read. */
+function requestWith(headers: Record<string, string> = {}): FastifyRequest {
+  // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the two members the resolver reads (headers, log)
+  return {
+    headers,
+    log: { warn: jest.fn(), info: jest.fn(), error: jest.fn() },
+  } as unknown as FastifyRequest;
+}
+
+function setMode(mode: HubSpokeKeyMode): void {
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
+  });
+}
+
+/** A deployment with no spoke registered: not a hub (#7633 D1). */
+function notAHub(): void {
+  db.spoke.findFirst.mockResolvedValue(null);
+}
+
+/** A hub: its registry holds `S1` → `W1`. */
+function aHub(): void {
+  db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
+  db.spoke.findUnique.mockImplementation((async ({
+    where,
+  }: {
+    where: { credentialHash: string };
+  }) =>
+    where.credentialHash === digest(KEY_S1)
+      ? { id: S1, workspaceId: W1, revokedAt: null }
+      : null) as never);
+}
+
+/** Exactly one workspace, the seeded default on the sentinel Organization. */
+function oneWorkspaceDeployment(): void {
+  db.workspace.count.mockResolvedValue(1);
+  mockSentinelWorkspaceExists(db);
+}
+
+/** Three workspaces — the seeded default beside `W1` and `W2`. */
+function multiWorkspaceDeployment(): void {
+  db.workspace.count.mockResolvedValue(3);
+  mockSentinelWorkspaceExists(db, W1, W2);
+}
+
+const saved = {
+  adapter: process.env.CONTENT_ADAPTER,
+  databaseUrl: process.env.DATABASE_URL,
+  siteId: process.env.AILK_SITE_ID,
+};
+
+function restore(name: string, value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  process.env.DATABASE_URL = "postgres://stub";
+  process.env.CONTENT_ADAPTER = "database";
+  delete process.env.AILK_SITE_ID;
+  setMode("auto");
+  __resetHubStatusForTests();
+  __resetSiteWorkspaceCacheForTests();
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  restore("CONTENT_ADAPTER", saved.adapter);
+  restore("DATABASE_URL", saved.databaseUrl);
+  restore("AILK_SITE_ID", saved.siteId);
+});
+
+describe("a one-workspace deployment that is not a hub (#9145)", () => {
+  beforeEach(() => {
+    notAHub();
+    oneWorkspaceDeployment();
+  });
+
+  it("serves the same workspace through both resolvers", async () => {
+    const pub = await resolvePublicWorkspace(requestWith());
+    const caller = await resolveCallerWorkspace(requestWith());
+
+    expect(pub).toEqual({ kind: "resolved", workspaceId: DEFAULT_WORKSPACE_ID });
+    expect(caller).toEqual({
+      kind: "resolved",
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      viaSpoke: false,
+    });
+  });
+
+  it("resolveCallerWorkspace answers the predicate on any content adapter — flows are database rows", async () => {
+    process.env.CONTENT_ADAPTER = "mdx";
+
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      viaSpoke: false,
+    });
+  });
+});
+
+describe("a multi-workspace deployment that is not a hub (#9145)", () => {
+  beforeEach(() => {
+    notAHub();
+    multiWorkspaceDeployment();
+  });
+
+  it("answers unresolved through both resolvers, though the default alias resolves", async () => {
+    const pub = await resolvePublicWorkspace(requestWith());
+    const caller = await resolveCallerWorkspace(requestWith());
+
+    expect(pub).toEqual({ kind: "unresolved", reason: "ambiguous" });
+    expect(caller).toEqual({ kind: "unresolved", reason: "ambiguous" });
+  });
+
+  it("answers unresolved through both, though AILK_SITE_ID names a real workspace", async () => {
+    process.env.AILK_SITE_ID = W1;
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+  });
+});
+
+describe("a sole workspace that is not the seeded default (#9145)", () => {
+  it("answers unresolved through both, though AILK_SITE_ID names it", async () => {
+    notAHub();
+    process.env.AILK_SITE_ID = W1;
+    db.workspace.count.mockResolvedValue(1);
+    mockWorkspaceExists(db, W1);
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "ambiguous",
+    });
+  });
+});
+
+describe("a hub (#9145 — the refusals are unchanged)", () => {
+  it("AILK_HUB_REQUIRE_SPOKE_KEY on refuses a keyless call through both, on a one-workspace deployment", async () => {
+    setMode("on");
+    notAHub();
+    oneWorkspaceDeployment();
+
+    await expect(resolvePublicWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "spoke-refused",
+    });
+    await expect(resolveCallerWorkspace(requestWith())).resolves.toEqual({
+      kind: "unresolved",
+      reason: "spoke-refused",
+    });
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+
+  it("a registered spoke still resolves to its own workspace through both", async () => {
+    aHub();
+    multiWorkspaceDeployment();
+    const headers = { "x-ailk-spoke-key": KEY_S1 };
+
+    await expect(resolvePublicWorkspace(requestWith(headers))).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: W1,
+    });
+    await expect(resolveCallerWorkspace(requestWith(headers))).resolves.toEqual({
+      kind: "resolved",
+      workspaceId: W1,
+      viaSpoke: true,
+      spokeId: S1,
+    });
+    expect(db.workspace.count).not.toHaveBeenCalled();
+  });
+});