create-ailk 0.22.0 → 0.24.0

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -50,7 +50,7 @@ jest.mock("../../../lib/prisma.js", () => ({
     },
     user: { findUnique: jest.fn() },
     projectListing: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
+    waitlistScore: { groupBy: jest.fn() },
   },
 }));
 
@@ -258,9 +258,16 @@ function installFixtureMocks(): void {
     },
   );
 
-  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId: string; experimentKey: string } }) =>
-      Promise.resolve(WAITLIST_COUNTS[where.siteId]?.[where.experimentKey] ?? 0),
+  (prisma.waitlistScore.groupBy as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId: string; experimentKey: { in: string[] } } }) =>
+      Promise.resolve(
+        where.experimentKey.in
+          .filter((experimentKey) => (WAITLIST_COUNTS[where.siteId]?.[experimentKey] ?? 0) > 0)
+          .map((experimentKey) => ({
+            experimentKey,
+            _count: { _all: WAITLIST_COUNTS[where.siteId]![experimentKey] },
+          })),
+      ),
   );
 }
 
@@ -378,7 +385,7 @@ describe("GET /v1/project-listings/me — the empty case is not a refusal", () =
   it("no waitlist count is read when the caller owns nothing", async () => {
     await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
 
-    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+    expect(prisma.waitlistScore.groupBy).not.toHaveBeenCalled();
   });
 });
 
@@ -419,13 +426,17 @@ describe("GET /v1/project-listings/me — the response shape", () => {
     // One shared site id would have reported 0 for one of them.
     expect(byId["prjl_ada_one"]).toBe(7);
     expect(byId["prjl_ada_two"]).toBe(3);
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+      by: ["experimentKey"],
       // #6258 AC-6 — the fenced read now filters the CONSTRAINED column beside
       // `siteId`; the two are equal by the workspace_site_agree CHECK.
-      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: "atlas-waitlist" },
+      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: { in: ["atlas-waitlist"] } },
+      _count: { _all: true },
     });
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: "atlas-two-waitlist" },
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+      by: ["experimentKey"],
+      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: { in: ["atlas-two-waitlist"] } },
+      _count: { _all: true },
     });
   });
 

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -61,7 +61,7 @@ jest.mock("../../../lib/prisma.js", () => ({
     projectListing: { findMany: jest.fn() },
     siteListingConfig: { findUnique: jest.fn() },
     waitlistExperiment: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
+    waitlistScore: { groupBy: jest.fn() },
   },
 }));
 
@@ -236,9 +236,13 @@ function installFixtureMocks(): void {
   // count is keyed on the `experimentKey` the listing already holds, so the
   // id-to-key hop this route used to make is gone. A test below asserts it
   // stays gone.
-  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
-    ({ where }: { where: { experimentKey: string } }) =>
-      Promise.resolve(COUNTS_BY_KEY[where.experimentKey] ?? 0),
+  (prisma.waitlistScore.groupBy as jest.Mock).mockImplementation(
+    ({ where }: { where: { experimentKey: { in: string[] } } }) =>
+      Promise.resolve(
+        where.experimentKey.in
+          .filter((experimentKey) => (COUNTS_BY_KEY[experimentKey] ?? 0) > 0)
+          .map((experimentKey) => ({ experimentKey, _count: { _all: COUNTS_BY_KEY[experimentKey] } })),
+      ),
   );
 }
 
@@ -413,10 +417,17 @@ describe("GET /v1/project-listings/public", () => {
 
     it("counts the waitlist through the listing's own experimentKey, in one hop", async () => {
       await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
+      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+        by: ["experimentKey"],
         // #6258 AC-6 — the fenced read now filters the CONSTRAINED column
         // beside `siteId`; the two are equal by the workspace_site_agree CHECK.
-        where: { siteId: SITE, workspaceId: SITE, experimentKey: "exp-newest" },
+        where: {
+          siteId: SITE,
+          workspaceId: SITE,
+          experimentKey: { in: expect.arrayContaining(["exp-newest"]) },
+        },
+        _count: { _all: true },
       });
       // The id-to-key translation read is gone with #5036 D6d.
       expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -885,7 +885,7 @@ describe("a captured draft answers its listicle's Application fields (#7521 AC-2
       ({ where }: { where: Record<string, unknown> }) =>
         Promise.resolve(flows.filter((f) => matches(f, where))),
     );
-    (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+    (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([]);
     app = Fastify();
     await app.register(startProjectListingRoute);
     await app.register(patchProjectListingDraftRoute);

package/templates/apps/api/src/routes/webhooks/README.md

@@ -199,6 +199,72 @@ through `metadata.site`.
   site, which silences the hub's dunning record for that subscription — the
   same key can already cancel or re-price it outright.
 
+## Per-Organization endpoint (#8932)
+
+`POST /v1/webhooks/stripe/:connectionToken` (`stripe-offerings.ts`) is the
+receiver for one Organization's own Stripe connection — the Offerings money
+path (spec `docs/specs/8932-the-per-organization-stripe-webhook-spec.md`,
+contract `docs/specs/8879-the-offerings-security-contract-key-spec.md` W1,
+W3–W11, G5, T8). The 43-character token selects one `StripeConnection` row
+(`findStripeConnectionByWebhookToken`, #8907); that row's decrypted secret
+verifies the signature through `verifyWebhookSignatureKeyless` (no env key),
+and its `organizationId` is the only Organization the event can act for.
+Registered beside the legacy route on every build, with its own 100/min
+per-IP bucket; the commerce claim is read at call time.
+
+**The ladder** — the first step that answers ends the request; every `200`
+body is `{ received: true }` and the outcome is the log line's only:
+
+| #    | Step                                                                                                                                                                                                                | Answer                                                                                     | Seen     |
+| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------- |
+| 1    | the token resolves to no row (or is malformed)                                                                                                                                                                      | `404 not-found`, logs nothing                                                              | no       |
+| 1a   | the token lookup rejects                                                                                                                                                                                            | `503 webhook-unavailable`                                                                  | no       |
+| 2    | the row has no usable secret                                                                                                                                                                                        | `503 webhook-not-configured`                                                               | no       |
+| 3–6  | signature settled, then the claim (as the legacy route): `undetermined` → `503` + `Retry-After: 300`; `unclaimed` → signed `200 dropped_no_commerce_claim`, unsigned the module-disabled `404`; then the held `400` | as stated                                                                                  | no       |
+| 7    | `event.livemode` is not the row's mode                                                                                                                                                                              | `200 livemode_mismatch`                                                                    | no       |
+| 8    | not `checkout.session.completed` / `.async_payment_succeeded` on a session object                                                                                                                                   | `200 ignored_type`                                                                         | no       |
+| 9–11 | the hub's session record (#8930): rejects / unreadable / none                                                                                                                                                       | `503 record-unavailable` / `500 record-unreadable` / `200 unrecorded`                      | no       |
+| 12   | another Organization's record, or `metadata.site` is not the record's workspace                                                                                                                                     | `200 foreign_organization`                                                                 | no       |
+| 13   | the record's mode is not the row's                                                                                                                                                                                  | `200 livemode_mismatch`                                                                    | no       |
+| 14   | already seen for this Organization                                                                                                                                                                                  | `200 duplicate`                                                                            | —        |
+| 15   | a `completed` session neither `paid` nor `no_payment_required`                                                                                                                                                      | `200 unpaid`                                                                               | yes      |
+| 16   | the connection's client or its `listLineItems` call fails                                                                                                                                                           | `503 stripe-unavailable` (never the env key)                                               | no       |
+| 17   | not exactly one line item whose Price id is the record's                                                                                                                                                            | `200 offering_mismatch`                                                                    | yes      |
+| 18   | `routeLead` (below)                                                                                                                                                                                                 | `200 fulfilled` / `already_fulfilled` / `unfulfillable`, else `503 fulfilment-unavailable` | yes / no |
+
+**The lead.** One per session: `routeLead` with the idempotency key
+`"stripe-offerings " + sessionId` — a space, which no `Idempotency-Key`
+header can carry, so no anonymous lead can take the key first — and
+`offeringsCheckout: true`. Its offering is the record's FULL lookup key,
+never `metadata.ailk_offering`. A live session's lead is marked
+`spokeCheckout`, the hold #8793's `releaseHeldCheckoutPlan` releases at the
+buyer's verified first link; no path here writes `Person.planOffering`. A
+test-mode session's lead is written unmarked: no hold, purchase message,
+email or consent grant. A replay or a conflict on that key is
+`already_fulfilled`; a lead the database did not take is a `503`, so Stripe
+retries.
+
+**The legacy endpoint steps aside (W8).** `POST /v1/webhooks/stripe` acks
+any event carrying an `ailk_offering` key — in a session's metadata or any
+site-stamp source above — with `200 { received: true }` and
+`outcome: "offerings_path"`, **before** `markSeen`, and writes nothing.
+Every event without the key takes the legacy path unchanged.
+
+**Two dedup stores.** The legacy route keeps `hasSeen` / `markSeen`; the
+per-Organization route uses its own `hasSeenForOrganization` /
+`markSeenForOrganization`, keyed `<organizationId>:<eventId>`. Neither
+endpoint's store can swallow the other's event. Both are in-memory per
+instance; the per-Organization route's correctness rests on the lead's
+database key.
+
+**Logs.** Each line carries `organizationId`, `eventType`, an 8-character
+`eventIdPrefix` and `outcome` (fewer before an event is verified) — never
+the token, the secret, a full Stripe id, an email, a lookup key, a metadata
+value or Stripe product text. Request and error lines log the path with
+the token replaced whole by `:connectionToken` (`redactLogPath`).
+
+**W11.** No billing identity is bound from a connection's event.
+
 ## Dunning (#6034)
 
 Two arms record a per-subscriber lifecycle state so a failed renewal is no

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts

@@ -179,6 +179,7 @@ describe("AC-1 — completed stamps the row once, guarded, beside the legacy tas
     });
     expect(prisma.user.findFirst).toHaveBeenCalledWith({
       where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
+      select: { id: true },
     });
     expect(prisma.user.findUnique).not.toHaveBeenCalled();
   });