create-ailk 0.22.0 → 0.23.0

package/templates/database/__tests__/offerings-checkout-session.db.test.ts

@@ -0,0 +1,270 @@
+/**
+ * @file offerings-checkout-session.db.test.ts
+ *
+ * LIVE-DATABASE proof of the Offerings Checkout session record's table (#8930,
+ * spec docs/specs/8930-the-offerings-checkout-session-record-spec.md D1, D2,
+ * AC-1, AC-2, AC-3; contract A11). Requires DATABASE_URL pointing at a Postgres
+ * with the migrations applied — SKIPS when DATABASE_URL is unset (the repo
+ * convention; the `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so no
+ * row outlives the suite. Each refusal runs in its own savepoint and names the
+ * constraint Postgres reports, so a refusal for the wrong reason fails.
+ */
+import { idRegex } from "@working-theory/ids";
+import { parseLookupKey } from "@working-theory/validation";
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const TABLE = "offerings_checkout_sessions";
+const ORG = "org_01920000-8930-7000-8000-0000000000a1";
+const WS = "wksp_01920000-8930-7000-8000-0000000000b1";
+
+/** The one valid row every refusal changes a single column of. */
+const VALID: Record<string, unknown> = {
+  session_id: "cs_test_a1",
+  workspace_id: WS,
+  organization_id: ORG,
+  price_id: "price_1Abc",
+  lookup_key: "growth_monthly",
+  mode: "test",
+};
+
+/** The eight CHECKs D2 names, and nothing else. */
+const CHECKS = [
+  "offerings_checkout_sessions_id_format",
+  "offerings_checkout_sessions_session_id_format",
+  "offerings_checkout_sessions_workspace_id_format",
+  "offerings_checkout_sessions_organization_id_format",
+  "offerings_checkout_sessions_price_id_format",
+  "offerings_checkout_sessions_lookup_key_format",
+  "offerings_checkout_sessions_mode_domain",
+  "offerings_checkout_sessions_session_mode_agree",
+];
+
+describeDb(
+  "the Offerings Checkout session record (#8930 D1, D2, live DB)",
+  () => {
+    let db: Client;
+
+    beforeAll(async () => {
+      db = new Client({ connectionString: process.env.DATABASE_URL });
+      await db.connect();
+      await db.query("BEGIN");
+    });
+
+    afterAll(async () => {
+      await db.query("ROLLBACK");
+      await db.end();
+    });
+
+    /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+    const violation = async (
+      run: () => Promise<unknown>,
+    ): Promise<string | null> => {
+      await db.query("SAVEPOINT attempt");
+      try {
+        await run();
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        return null;
+      } catch (err) {
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        return (err as { constraint?: string }).constraint ?? String(err);
+      }
+    };
+
+    /** Insert one record: the valid row with `cols` over it. */
+    const insert = (cols: Record<string, unknown> = {}) => {
+      const all = { ...VALID, ...cols };
+      const names = Object.keys(all);
+      return db.query(
+        `INSERT INTO "${TABLE}" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+        names.map((n) => all[n]),
+      );
+    };
+
+    describe("AC-1 — exactly the record's columns", () => {
+      it("has the eight columns, each NOT NULL", async () => {
+        const { rows } = await db.query(
+          `SELECT column_name, is_nullable FROM information_schema.columns
+         WHERE table_schema = current_schema() AND table_name = $1 ORDER BY column_name`,
+          [TABLE],
+        );
+        expect(rows.map((r) => r.column_name)).toEqual([
+          "created_at",
+          "id",
+          "lookup_key",
+          "mode",
+          "organization_id",
+          "price_id",
+          "session_id",
+          "workspace_id",
+        ]);
+        expect(rows.filter((r) => r.is_nullable !== "NO")).toEqual([]);
+      });
+
+      it("carries exactly D2's eight CHECKs", async () => {
+        const { rows } = await db.query(
+          `SELECT conname FROM pg_constraint
+         WHERE conrelid = $1::regclass AND contype = 'c' ORDER BY conname`,
+          [TABLE],
+        );
+        expect(rows.map((r) => r.conname)).toEqual([...CHECKS].sort());
+      });
+
+      it("has one non-primary index: the unique session id key", async () => {
+        const { rows } = await db.query(
+          `SELECT i.relname AS name, x.indisunique AS unique FROM pg_index x
+         JOIN pg_class i ON i.oid = x.indexrelid
+         WHERE x.indrelid = $1::regclass AND NOT x.indisprimary`,
+          [TABLE],
+        );
+        expect(rows).toEqual([
+          { name: "offerings_checkout_sessions_session_id_key", unique: true },
+        ]);
+      });
+    });
+
+    describe("AC-2 — Postgres refuses each malformed row by the named constraint", () => {
+      it("accepts the valid row and mints a prefixed id", async () => {
+        await db.query("SAVEPOINT ok");
+        const { rows } = await insert();
+        expect(rows[0].id).toMatch(idRegex("offeringsCheckoutSession"));
+        await db.query("ROLLBACK TO SAVEPOINT ok");
+      });
+
+      it("accepts a live record of a live session", async () => {
+        expect(
+          await violation(() =>
+            insert({ session_id: "cs_live_a1", mode: "live" }),
+          ),
+        ).toBeNull();
+      });
+
+      it.each([
+        [
+          "a charge id",
+          { session_id: "ch_test_a1" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a session id with no body",
+          { session_id: "cs_test_" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a session id with a dash",
+          { session_id: "cs_test_a-1" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a workspace id of another shape",
+          { workspace_id: "ws_1" },
+          "offerings_checkout_sessions_workspace_id_format",
+        ],
+        [
+          "an organization id of another shape",
+          { organization_id: "org_1" },
+          "offerings_checkout_sessions_organization_id_format",
+        ],
+        [
+          "an empty Price id",
+          { price_id: "" },
+          "offerings_checkout_sessions_price_id_format",
+        ],
+        [
+          "a Price id with a space",
+          { price_id: "price 1" },
+          "offerings_checkout_sessions_price_id_format",
+        ],
+        [
+          "an uppercase lookup key",
+          { lookup_key: "Growth_Monthly" },
+          "offerings_checkout_sessions_lookup_key_format",
+        ],
+        [
+          "a 41-character plan inside the column width",
+          { lookup_key: `${"a".repeat(41)}_once` },
+          "offerings_checkout_sessions_lookup_key_format",
+        ],
+        [
+          "a mode of prod",
+          { mode: "prod" },
+          "offerings_checkout_sessions_mode_domain",
+        ],
+        [
+          "a live record of a test session",
+          { mode: "live" },
+          "offerings_checkout_sessions_session_mode_agree",
+        ],
+        [
+          "a test record of a live session",
+          { session_id: "cs_live_a1" },
+          "offerings_checkout_sessions_session_mode_agree",
+        ],
+        [
+          "an id of another shape",
+          { id: "ocsess_1" },
+          "offerings_checkout_sessions_id_format",
+        ],
+      ])("refuses %s", async (_label, cols, constraint) => {
+        expect(await violation(() => insert(cols))).toBe(constraint);
+      });
+
+      it("refuses a second record of one session", async () => {
+        expect(
+          await violation(async () => {
+            await insert();
+            await insert({ price_id: "price_2Def" });
+          }),
+        ).toBe("offerings_checkout_sessions_session_id_key");
+      });
+    });
+
+    describe("AC-3 — the lookup-key CHECK accepts exactly what parseLookupKey accepts", () => {
+      const CORPUS = [
+        // Contract §3.7's worked examples.
+        "growth_monthly",
+        "growth_yearly",
+        "basic_once",
+        "samhenry-coaching_monthly",
+        "growth_quarterly",
+        "growth_pro_monthly",
+        "Growth_Monthly",
+        "wendi_retainer",
+        // The anchors, the plan's first character, and its length bound.
+        "-growth_monthly",
+        "growth-_once",
+        "growth_monthly ",
+        "growth_monthly\n",
+        "_monthly",
+        `${"a".repeat(40)}_yearly`,
+        `${"a".repeat(41)}_monthly`,
+        // 46 characters: inside VARCHAR(48), so only the CHECK can refuse it.
+        `${"a".repeat(41)}_once`,
+      ];
+
+      it("the corpus holds keys each side accepts and keys each side refuses", () => {
+        const accepted = CORPUS.filter((key) => parseLookupKey(key) !== null);
+        expect(accepted).toEqual([
+          "growth_monthly",
+          "growth_yearly",
+          "basic_once",
+          "samhenry-coaching_monthly",
+          "growth-_once",
+          `${"a".repeat(40)}_yearly`,
+        ]);
+      });
+
+      it.each(CORPUS.map((key) => [JSON.stringify(key), key]))(
+        "inserts %s if and only if the parser accepts it",
+        async (_label, key) => {
+          const refused = await violation(() => insert({ lookup_key: key }));
+          expect(refused === null).toBe(parseLookupKey(key) !== null);
+        },
+      );
+    });
+  },
+);

package/templates/database/__tests__/offerings-migration.test.ts

@@ -0,0 +1,197 @@
+/**
+ * @file offerings-migration.test.ts
+ *
+ * DB-free proof of the offerings_data_model migration's shape (#8876, spec
+ * docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2, AC-1).
+ * Reads the migration's own text and the config schema: it creates exactly
+ * the three tables, with every column the models `@map` to, the three
+ * `_id_format` CHECKs, the three reference-column format CHECKs and every
+ * integrity CHECK D1 names — and touches no other table. The live-database
+ * half is `offerings.db.test.ts`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261020120000_offerings_data_model",
+  "migration.sql",
+);
+const SCHEMA = join(__dirname, "..", "config", "schema.prisma");
+
+const TABLES: Record<string, { model: string; columns: string[] }> = {
+  stripe_connections: {
+    model: "StripeConnection",
+    columns: [
+      "id",
+      "organization_id",
+      "mode",
+      "key_last4",
+      "credential_ciphertext",
+      "webhook_token",
+      "webhook_secret_ciphertext",
+      "live_at",
+      "created_at",
+      "updated_at",
+    ],
+  },
+  organization_offerings: {
+    model: "OrganizationOfferings",
+    columns: ["id", "organization_id", "enabled_product_ids", "created_at", "updated_at"],
+  },
+  workspace_offerings: {
+    model: "WorkspaceOfferings",
+    columns: [
+      "id",
+      "workspace_id",
+      "shown_product_ids",
+      "recommended_plan_product_id",
+      "recommended_addon_product_id",
+      "snapshot",
+      "snapshot_at",
+      "created_at",
+      "updated_at",
+    ],
+  },
+};
+
+/**
+ * Columns a later migration adds, after each table's own: #9070's
+ * `shown_price_ids` (offerings-shown-price-ids-migration.test.ts).
+ */
+const LATER_COLUMNS: Record<string, string[]> = {
+  workspace_offerings: ["shown_price_ids"],
+};
+
+const CHECKS = [
+  "stripe_connections_id_format",
+  "stripe_connections_organization_id_format",
+  "organization_offerings_id_format",
+  "organization_offerings_organization_id_format",
+  "workspace_offerings_id_format",
+  "workspace_offerings_workspace_id_format",
+  "stripe_connections_mode_domain",
+  "stripe_connections_live_at_pair",
+  "stripe_connections_key_last4_shape",
+  "stripe_connections_webhook_token_shape",
+  "stripe_connections_credential_envelope",
+  "stripe_connections_webhook_secret_envelope",
+  "organization_offerings_enabled_product_ids_bound",
+  "workspace_offerings_shown_product_ids_bound",
+  "workspace_offerings_recommended_plan_shown",
+  "workspace_offerings_recommended_addon_shown",
+  "workspace_offerings_snapshot_pair",
+];
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+/** One model's body from the config schema. */
+function modelBody(model: string): string {
+  const match = new RegExp(`^model ${model} \\{\\n([\\s\\S]*?)^\\}`, "m").exec(
+    readFileSync(SCHEMA, "utf8"),
+  );
+  if (!match) throw new Error(`model ${model} not found`);
+  return match[1]!;
+}
+
+/** The column each field of a model maps to: its `@map`, else its own name. */
+function mappedColumns(model: string): string[] {
+  return modelBody(model)
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => /^[a-zA-Z]\w*\s/.test(line))
+    .map((line) => /@map\("([^"]+)"\)/.exec(line)?.[1] ?? line.split(/\s+/)[0]!);
+}
+
+describe("the offerings_data_model migration (#8876 D2, AC-1)", () => {
+  it("creates exactly the three tables, each column the model maps to", () => {
+    const creates = statements().filter((s) => s.startsWith("CREATE TABLE "));
+    expect(creates.map((s) => /^CREATE TABLE "([a-z_]+)"/.exec(s)?.[1])).toEqual(
+      Object.keys(TABLES),
+    );
+    for (const [table, { model, columns }] of Object.entries(TABLES)) {
+      const create = creates.find((s) => s.startsWith(`CREATE TABLE "${table}"`))!;
+      const created = [...create.matchAll(/(?:\( |, )"([a-z0-9_]+)" [A-Z]/g)].map((m) => m[1]);
+      expect(created).toEqual(columns);
+      // #9070 D1 — a later migration adds one column to workspace_offerings.
+      const later = LATER_COLUMNS[table] ?? [];
+      expect(mappedColumns(model).filter((c) => !later.includes(c))).toEqual(columns);
+      expect(mappedColumns(model)).toEqual(expect.arrayContaining(later));
+      expect(modelBody(model)).toContain(`@@map("${table}")`);
+    }
+  });
+
+  it("holds one unique index per key and on the webhook token", () => {
+    const indexes = statements()
+      .map((s) => /^CREATE UNIQUE INDEX "([a-z0-9_]+)"/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(indexes).toEqual([
+      "stripe_connections_organization_id_key",
+      "stripe_connections_webhook_token_key",
+      "organization_offerings_organization_id_key",
+      "workspace_offerings_workspace_id_key",
+    ]);
+  });
+
+  it("adds every named CHECK, each once", () => {
+    const added = statements()
+      .map((s) => /^ALTER TABLE "[a-z_]+" ADD CONSTRAINT "([a-z0-9_]+)" CHECK /.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(added).toEqual(CHECKS);
+  });
+
+  it("pins each CHECK's rule", () => {
+    const sql = statements().join("\n");
+    const rule = (name: string) =>
+      new RegExp(`ADD CONSTRAINT "${name}" CHECK (.*)`).exec(sql)?.[1];
+    expect(rule("stripe_connections_mode_domain")).toBe(`("mode" IN ('test', 'live'))`);
+    expect(rule("stripe_connections_live_at_pair")).toBe(
+      `(("mode" = 'live') = ("live_at" IS NOT NULL))`,
+    );
+    expect(rule("stripe_connections_webhook_token_shape")).toBe(
+      `("webhook_token" ~ '^[A-Za-z0-9_-]{43}$')`,
+    );
+    const envelope = `'^v1\\.[A-Za-z0-9_-]{16}\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]+$'`;
+    const keyPrefix = `'(rk|sk|pk)_(test|live)_|whsec_'`;
+    expect(rule("stripe_connections_credential_envelope")).toBe(
+      `("credential_ciphertext" ~ ${envelope} AND "credential_ciphertext" !~ ${keyPrefix})`,
+    );
+    expect(rule("stripe_connections_webhook_secret_envelope")).toBe(
+      `("webhook_secret_ciphertext" IS NULL OR ("webhook_secret_ciphertext" ~ ${envelope} AND "webhook_secret_ciphertext" !~ ${keyPrefix}))`,
+    );
+    for (const [name, column] of [
+      ["organization_offerings_enabled_product_ids_bound", "enabled_product_ids"],
+      ["workspace_offerings_shown_product_ids_bound", "shown_product_ids"],
+    ]) {
+      expect(rule(name!)).toBe(
+        `("${column}" IS NOT NULL AND cardinality("${column}") <= 100 AND array_position("${column}", NULL) IS NULL)`,
+      );
+    }
+    expect(rule("workspace_offerings_snapshot_pair")).toBe(
+      `(("snapshot" IS NULL) = ("snapshot_at" IS NULL))`,
+    );
+  });
+
+  it("touches no other table: no UPDATE, INSERT, DELETE, DROP, or ALTER of another table", () => {
+    const own = new Set(Object.keys(TABLES));
+    for (const s of statements()) {
+      expect(s).not.toMatch(/^(UPDATE|INSERT|DELETE|DROP|TRUNCATE)\b/);
+      const altered = /^ALTER TABLE "([a-z_]+)"/.exec(s)?.[1];
+      if (altered) expect(own.has(altered)).toBe(true);
+      const created = /^CREATE (?:UNIQUE )?INDEX "[a-z0-9_]+" ON "([a-z_]+)"/.exec(s)?.[1];
+      if (created) expect(own.has(created)).toBe(true);
+    }
+  });
+});

package/templates/database/__tests__/offerings-shown-price-ids-migration.test.ts

@@ -0,0 +1,86 @@
+/**
+ * @file offerings-shown-price-ids-migration.test.ts
+ *
+ * DB-free proof of the offerings_shown_price_ids migration's shape (#9070,
+ * spec docs/specs/9070-the-workspace-offerings-page-becomes-spec.md D1,
+ * AC-6). Reads the migration's own text and the config schema: it adds
+ * exactly one column to workspace_offerings, NOT NULL with the empty-array
+ * default, and exactly two CHECKs, each added NOT VALID then VALIDATEd — and
+ * creates, drops and updates nothing else, so no existing row is rewritten.
+ * The live-database half is `offerings.db.test.ts`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261023120000_offerings_shown_price_ids",
+  "migration.sql",
+);
+const SCHEMA = join(__dirname, "..", "config", "schema.prisma");
+
+const CHECKS = [
+  "workspace_offerings_shown_price_ids_bound",
+  "workspace_offerings_shown_prices_need_products",
+];
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+describe("the offerings_shown_price_ids migration (#9070 D1, AC-6)", () => {
+  it("adds exactly one column, NOT NULL with the empty-array default", () => {
+    const adds = statements().filter((s) => / ADD COLUMN /.test(s));
+    expect(adds).toEqual([
+      `ALTER TABLE "workspace_offerings" ADD COLUMN "shown_price_ids" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[]`,
+    ]);
+  });
+
+  it("adds exactly the two CHECKs, each NOT VALID then VALIDATEd", () => {
+    const added = statements()
+      .map((s) => /^ALTER TABLE "workspace_offerings" ADD CONSTRAINT "([a-z0-9_]+)" CHECK .* NOT VALID$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(added).toEqual(CHECKS);
+    const validated = statements()
+      .map((s) => /^ALTER TABLE "workspace_offerings" VALIDATE CONSTRAINT "([a-z0-9_]+)"$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(validated).toEqual(CHECKS);
+    expect(statements()).toHaveLength(1 + 2 * CHECKS.length);
+  });
+
+  it("pins each CHECK's rule", () => {
+    const sql = statements().join("\n");
+    const rule = (name: string) =>
+      new RegExp(`ADD CONSTRAINT "${name}" CHECK (.*) NOT VALID`).exec(sql)?.[1];
+    expect(rule("workspace_offerings_shown_price_ids_bound")).toBe(
+      `(cardinality("shown_price_ids") <= 300 AND array_position("shown_price_ids", NULL) IS NULL)`,
+    );
+    expect(rule("workspace_offerings_shown_prices_need_products")).toBe(
+      `(cardinality("shown_price_ids") = 0 OR cardinality("shown_product_ids") > 0)`,
+    );
+  });
+
+  it("creates, drops and updates nothing, and alters no other table", () => {
+    for (const s of statements()) {
+      expect(s).not.toMatch(/^(UPDATE|INSERT|DELETE|DROP|TRUNCATE|CREATE)\b/);
+      expect(s).toMatch(/^ALTER TABLE "workspace_offerings" /);
+      expect(s).not.toMatch(/ DROP /);
+    }
+  });
+
+  it("the model maps the column with the empty-list default", () => {
+    expect(readFileSync(SCHEMA, "utf8")).toMatch(
+      /^ {2}shownPriceIds +String\[\] +@default\(\[\]\) @map\("shown_price_ids"\)$/m,
+    );
+  });
+});