create-ailk 0.22.0 → 0.23.0

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -46,6 +46,7 @@ import * as path from "path";
 import { logger } from "@working-theory/observability";
 import {
   ACCOUNT_TERMS_PURPOSE_ID,
+  CONSENT_LEAD_SOURCE_LIST,
   consentPurposeById,
   SITE_CONSENT_CONFIG_DEFAULTS,
 } from "@working-theory/validation";
@@ -57,6 +58,7 @@ import {
 } from "../../lib/__tests__/consent-ledger-double.js";
 import { prisma } from "../../lib/prisma.js";
 import { routeLead } from "../lead-routing";
+import * as consentService from "../consent";
 import * as personService from "../person";
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -1009,6 +1011,140 @@ describe("#7869 — routeLead with an idempotency key", () => {
   });
 });
 
+// ─── #8730, #9130 — a keyed consent-bearing lead replays ─────────────────────
+//
+// The route writes `payload.consent` on every request, its `acceptedAt` that
+// request's receive time, so a retry's payload differs from the stored one
+// there and nowhere else. The replay comparison leaves it out for EVERY
+// consent-bearing source — iterating the list, so a source added to it later
+// cannot be gated by the route yet compared here.
+describe("#8730, #9130 — routeLead replays a keyed consent-bearing lead", () => {
+  const KEY = "fixture-retry-0000-0000-9130";
+  const STORED_ID = "lead_00000000-0000-7000-8000-000000009131";
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_INBOX_FALLBACK_DIR",
+    "LEAD_CAPTURE_FILE",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  let tmpDir: string;
+
+  const consentAt = (acceptedAt: string) => ({
+    statement: "I accept the terms.",
+    acceptedAt,
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-consent-replay-"));
+    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+    process.env.DATABASE_URL = "postgres://stub";
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_new" });
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+  });
+
+  afterEach(async () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it("covers every consent-bearing source, the job application included", () => {
+    expect(CONSENT_LEAD_SOURCE_LIST).toContain("flow:job-application");
+  });
+
+  it.each(CONSENT_LEAD_SOURCE_LIST)(
+    "%s — a retry whose only difference is the server-written payload.consent replays the stored lead",
+    async (source) => {
+      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+        id: STORED_ID,
+        email: "visitor@example.com",
+        source,
+        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+      });
+
+      const result = await routeLead(
+        {
+          kind: "submit",
+          siteId: "site-abc",
+          source,
+          email: "visitor@example.com",
+          payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
+        },
+        sourceMeta,
+        { idempotencyKey: KEY },
+      );
+
+      expect(result).toMatchObject({ ok: true, replayed: true, id: STORED_ID });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    },
+  );
+
+  it.each(CONSENT_LEAD_SOURCE_LIST)(
+    "%s — a retry with a different form field is still a conflict",
+    async (source) => {
+      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+        id: STORED_ID,
+        email: "visitor@example.com",
+        source,
+        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+      });
+
+      const result = await routeLead(
+        {
+          kind: "submit",
+          siteId: "site-abc",
+          source,
+          email: "visitor@example.com",
+          payload: { name: "Someone else", consent: consentAt("2026-10-18T12:00:00.000Z") },
+        },
+        sourceMeta,
+        { idempotencyKey: KEY },
+      );
+
+      expect(result).toEqual({
+        ok: false,
+        error: { kind: "idempotency_conflict", message: "idempotency key reused" },
+      });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+    },
+  );
+
+  it("a source outside the list still compares payload.consent", async () => {
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: STORED_ID,
+      email: "visitor@example.com",
+      source: "flow:quiz",
+      payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+    });
+
+    const result = await routeLead(
+      {
+        kind: "submit",
+        siteId: "site-abc",
+        source: "flow:quiz",
+        email: "visitor@example.com",
+        payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
+      },
+      sourceMeta,
+      { idempotencyKey: KEY },
+    );
+
+    expect(result).toMatchObject({ ok: false, error: { kind: "idempotency_conflict" } });
+  });
+});
+
 // ─── #852 D6 — every submitted lead carries its Person ──────────────────────
 //
 // The Person step runs through the shared mock's `person` delegate, whose
@@ -1334,7 +1470,11 @@ describe("#852 — the lead's Person (AC-3)", () => {
 // paid checkout lead a registered spoke's server posted with the session id
 // as its key. Every other lead makes no plan call; a failing plan step never
 // changes the lead's result.
-describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
+// #8793 D1 — a marked checkout lead HOLDS its plan: it never writes a
+// Person's plan, logs `held` (or `skipped` for an offering that is no key),
+// and the plan is released only at the Person's verified first link
+// (`person.test.ts`, `checkout-plan.test.ts`).
+describe("#7877 — the checkout lead holds the plan (AC-5; #8793 D1, AC-7)", () => {
   const ENV_KEYS = [
     "DATABASE_URL",
     "NODE_ENV",
@@ -1400,20 +1540,34 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     [...info.mock.calls, ...error.mock.calls]
       .map(([fields]) => fields as Record<string, unknown>)
       .filter((fields) => fields.event === "checkout-plan");
+  /** Every `checkout-plan` line is logged at `info`, never at `error`. */
+  const infoPlanLines = () =>
+    info.mock.calls
+      .map(([fields]) => fields as Record<string, unknown>)
+      .filter((fields) => fields.event === "checkout-plan");
+  /** The lead's answer, as it was before #8793. */
+  const answered = {
+    ok: true,
+    id: LEAD_ID,
+    personId: MOCK_PERSON_ID,
+    persisted: "db",
+    email: { ok: true, messageId: "msg-7877" },
+  };
 
-  it("a live spoke checkout lead sets the plan to the offering minus the <site>_ prefix", async () => {
+  it("a live spoke checkout lead holds the plan: no plan write, one held line", async () => {
     const result = await routeLead(checkoutLead, spokeMeta, {
       idempotencyKey: KEY,
     });
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(setPlan).toHaveBeenCalledTimes(1);
-    expect(setPlan).toHaveBeenCalledWith(WS, MOCK_PERSON_ID, "retainer");
-    expect(planLines()).toEqual([
-      { event: "checkout-plan", outcome: "set", siteId: WS },
+    expect(result).toEqual(answered);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(jest.mocked(prisma.person.updateMany)).not.toHaveBeenCalled();
+    expect(infoPlanLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
     ]);
+    expect(planLines()).toEqual(infoPlanLines());
   });
 
-  it("a bare slug offering is taken as it is", async () => {
+  it("a bare slug offering is held as it is", async () => {
     await routeLead(
       {
         ...checkoutLead,
@@ -1422,7 +1576,10 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       spokeMeta,
       { idempotencyKey: KEY },
     );
-    expect(setPlan).toHaveBeenCalledWith(WS, MOCK_PERSON_ID, "retainer");
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
   });
 
   it("a positive integer amountTotal still qualifies", async () => {
@@ -1434,7 +1591,10 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       spokeMeta,
       { idempotencyKey: KEY },
     );
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
   });
 
   it.each([
@@ -1499,20 +1659,22 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       unknown
     >;
 
-  it("a live spoke checkout lead is created with spokeCheckout true and still sets the plan once", async () => {
+  it("a live spoke checkout lead is created with spokeCheckout true and holds the plan once", async () => {
     await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
     expect(createData()).toMatchObject({ spokeCheckout: true });
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toHaveLength(1);
   });
 
-  it("the same lead relayed for a visitor is created with no spokeCheckout key and still sets the plan", async () => {
+  it("the same lead relayed for a visitor is created with no spokeCheckout key and holds no plan", async () => {
     await routeLead(
       checkoutLead,
       { ...spokeMeta, relayed: true },
       { idempotencyKey: KEY },
     );
     expect(createData()).not.toHaveProperty("spokeCheckout");
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([]);
   });
 
   it.each([
@@ -1570,7 +1732,7 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
   );
 
   it("an offering that is not a key after the strip logs skipped and makes no plan call", async () => {
-    await routeLead(
+    const result = await routeLead(
       {
         ...checkoutLead,
         payload: { ...checkoutLead.payload, offering: "Wendi_Retainer!" },
@@ -1578,10 +1740,26 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       spokeMeta,
       { idempotencyKey: KEY },
     );
+    expect(result).toEqual(answered);
     expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([
+    expect(infoPlanLines()).toEqual([
       { event: "checkout-plan", outcome: "skipped", siteId: WS },
     ]);
+    expect(planLines()).toEqual(infoPlanLines());
+  });
+
+  it("no checkout-plan line names an email, an offering or a key", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    expect(planLines()).toHaveLength(1);
+    for (const line of planLines()) {
+      expect(line).not.toHaveProperty("email");
+      expect(line).not.toHaveProperty("offering");
+      expect(line).not.toHaveProperty("key");
+    }
+    const logged = JSON.stringify(planLines());
+    expect(logged).not.toContain("retainer");
+    expect(logged).not.toContain("cleo@x.io");
+    expect(logged).not.toContain(KEY);
   });
 
   it("a replayed key writes nothing and sets nothing", async () => {
@@ -1598,33 +1776,6 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     expect(prisma.lead.create).not.toHaveBeenCalled();
     expect(setPlan).not.toHaveBeenCalled();
   });
-
-  it.each([
-    ["throws", () => setPlan.mockRejectedValueOnce(new Error("down"))],
-    ["answers not_found", () => setPlan.mockResolvedValueOnce("not_found")],
-  ])(
-    "a plan step that %s answers exactly like a success, with one failed line naming no offering, email or key",
-    async (_label, arrange) => {
-      const ok = await routeLead(checkoutLead, spokeMeta, {
-        idempotencyKey: KEY,
-      });
-      info.mockClear();
-      error.mockClear();
-      arrange();
-      const failed = await routeLead(checkoutLead, spokeMeta, {
-        idempotencyKey: KEY,
-      });
-      expect(failed).toEqual(ok);
-      expect(failed).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-      expect(planLines()).toEqual([
-        { event: "checkout-plan", outcome: "failed", siteId: WS },
-      ]);
-      const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
-      expect(logged).not.toContain("retainer");
-      expect(logged).not.toContain("cleo@x.io");
-      expect(logged).not.toContain(KEY);
-    },
-  );
 });
 
 describe("#8757 D14 — a spoke checkout's purchase email and Inbox message (AC-11)", () => {
@@ -2028,7 +2179,7 @@ describe("#8757 D14 — a spoke checkout's purchase email and Inbox message (AC-
       });
       await settle();
       expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-      expect(setPlan).toHaveBeenCalledTimes(1);
+      expect(setPlan).not.toHaveBeenCalled();
       const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
       expect(logged).not.toContain("Cleo@X.io");
       expect(logged).not.toContain("retainer");
@@ -2200,6 +2351,8 @@ describe("#8778 — a spoke checkout's terms grant", () => {
     expect(consentLines()).toEqual([
       expect.objectContaining({ outcome: "recorded", siteId: WS }),
     ]);
+    // #8793 D1 — the grant is written; the plan is held, never set here.
+    expect(setPlan).not.toHaveBeenCalled();
   });
 
   it.each([
@@ -2328,3 +2481,180 @@ describe("#8778 — a spoke checkout's terms grant", () => {
     expect(logged).not.toContain(MOCK_PERSON_ID);
   });
 });
+
+describe("#8932 D7 — the per-Organization webhook's Offerings checkout lead (AC-5)", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008932";
+  const WS = "wksp_00000000-0000-7000-8000-000000008932";
+  const OTHER_WS = "wksp_00000000-0000-7000-8000-000000008933";
+  const SESSION = "cs_live_a8932Offerings"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8932 AC-5), not a credential
+  const KEY = `stripe-offerings ${SESSION}`;
+  const ACCOUNT_TERMS = consentPurposeById(
+    SITE_CONSENT_CONFIG_DEFAULTS,
+    ACCOUNT_TERMS_PURPOSE_ID,
+  )!;
+  const STAMP = `${ACCOUNT_TERMS_PURPOSE_ID}@${ACCOUNT_TERMS.policyVersion}`;
+  /** The input the webhook builds (D6) — the offering is the record's full key. */
+  const offeringsLead = {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email: "buyer@example.com",
+    payload: {
+      page: "checkout",
+      offering: "growth_monthly",
+      site: WS,
+      amountTotal: 4900,
+      currency: "usd",
+      termsAccepted: STAMP,
+    } as Record<string, unknown>,
+  };
+  const webhookMeta = {
+    ip: "203.0.113.9",
+    userAgent: "Stripe/1.0",
+    receivedAt: "2026-10-18T00:00:00.000Z",
+  };
+  const twin = { idempotencyKey: KEY, offeringsCheckout: true as const };
+  const leadCount = jest.fn();
+  let setPlan: jest.SpyInstance;
+  let consent: jest.SpyInstance;
+  let info: jest.SpyInstance;
+  let error: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    process.env.DATABASE_URL = "postgres://stub";
+    delete process.env.NODE_ENV;
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
+    Object.assign(prisma.lead, { count: leadCount });
+    leadCount.mockReset().mockResolvedValue(1);
+    jest
+      .mocked(prisma.interaction.create)
+      .mockResolvedValue({ id: "intx_1" } as never);
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "m" });
+    mockSendPurchaseConfirmationEmail.mockResolvedValue({ ok: true, messageId: "m2" });
+    mockListPlanOfferings.mockResolvedValue([]);
+    setPlan = jest.spyOn(personService, "setPersonPlanOffering").mockResolvedValue("set");
+    consent = jest
+      .spyOn(consentService, "recordCheckoutConsent")
+      .mockResolvedValue("recorded");
+    info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
+    error = jest.spyOn(logger, "error").mockImplementation(() => undefined as never);
+  });
+
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    Reflect.deleteProperty(prisma.lead, "count");
+    setPlan.mockRestore();
+    consent.mockRestore();
+    info.mockRestore();
+    error.mockRestore();
+  });
+
+  const createData = () =>
+    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<string, unknown>;
+  const planLines = () =>
+    [...info.mock.calls, ...error.mock.calls]
+      .map(([fields]) => fields as Record<string, unknown>)
+      .filter((fields) => fields?.["event"] === "checkout-plan");
+  const planWrites = () =>
+    jest
+      .mocked(prisma.person.updateMany)
+      .mock.calls.filter(([args]) => "planOffering" in ((args as { data?: object }).data ?? {}));
+
+  it("creates one marked lead on the prefixed key, holds the full key and grants consent on the bare session id", async () => {
+    const result = await routeLead(offeringsLead, webhookMeta, twin);
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    expect(createData()).toMatchObject({
+      spokeCheckout: true,
+      idempotencyKey: KEY,
+      payload: expect.objectContaining({ offering: "growth_monthly" }),
+    });
+    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "held", siteId: WS }]);
+    expect(consent).toHaveBeenCalledTimes(1);
+    expect(consent).toHaveBeenCalledWith(
+      expect.objectContaining({ workspaceId: WS, sessionId: SESSION }),
+    );
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planWrites()).toEqual([]);
+  });
+
+  it.each([
+    ["without offeringsCheckout", offeringsLead, { idempotencyKey: KEY }],
+    [
+      "an offering the grammar refuses",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, offering: "growth_quarterly" } },
+      twin,
+    ],
+    [
+      "a site that is another workspace",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, site: OTHER_WS } },
+      twin,
+    ],
+    ["a test-mode session key", offeringsLead, { ...twin, idempotencyKey: "stripe-offerings cs_test_a1" }],
+    ["the bare session id as the key", offeringsLead, { ...twin, idempotencyKey: SESSION }],
+    ["source contact", { ...offeringsLead, source: "contact" }, twin],
+    [
+      "page contact",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, page: "contact" } },
+      twin,
+    ],
+  ] as const)("creates an unmarked lead and holds nothing for %s", async (_label, input, options) => {
+    const result = await routeLead(input as typeof offeringsLead, webhookMeta, options);
+    expect(result).toMatchObject({ ok: true, persisted: "db" });
+    expect(createData()).not.toHaveProperty("spokeCheckout");
+    expect(planLines()).toEqual([]);
+    expect(consent).not.toHaveBeenCalled();
+    expect(prisma.interaction.create).not.toHaveBeenCalled();
+    expect(planWrites()).toEqual([]);
+  });
+
+  it("leaves a spoke checkout lead marked exactly as before", async () => {
+    await routeLead(
+      {
+        kind: "submit",
+        siteId: WS,
+        source: "web",
+        email: "cleo@x.io",
+        payload: { site: "wendi", page: "checkout", offering: "wendi_retainer" },
+      },
+      { ...webhookMeta, viaSpoke: true },
+      { idempotencyKey: "cs_live_a1B2c3" }, // gitleaks:allow -- a synthetic Checkout Session id shape, not a credential
+    );
+    expect(createData()).toMatchObject({ spokeCheckout: true });
+    expect(consent).not.toHaveBeenCalledWith(expect.objectContaining({ sessionId: SESSION }));
+  });
+
+  it("the verified first link releases the full lookup key into the Person's plan", async () => {
+    setPlan.mockRestore();
+    jest.mocked(prisma.lead.findMany).mockResolvedValue([
+      { email: offeringsLead.email, payload: offeringsLead.payload },
+    ] as never);
+    jest.mocked(prisma.person.updateMany).mockResolvedValue({ count: 1 } as never);
+    const outcome = await personService.releaseHeldCheckoutPlan(
+      WS,
+      MOCK_PERSON_ID,
+      "usr_buyer_8932",
+      "buyer@example.com",
+    );
+    expect(outcome).toBe("set");
+    expect(prisma.person.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({ data: { planOffering: "growth_monthly" } }),
+    );
+  });
+});